OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Edward Wildgoose (Edward.Wildgoose_at_FRMHedge.com)
Date: Mon Dec 02 2002 - 11:10:30 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    > > It will never happen, but my vote would be that all SMTP servers from now on are shipped with SMTP AUTH enabled by default (using PAM/sasldb on linux, local user account on Win32). The user must climb the admin curve to turn that off rather than having to do some work to switch it on!

    > Please NO. I imagine that the majority of users have no use for SMTP AUTH.... I don't even have sasldb installed. My mail servers have the necessary software installed to handle mail.

    Well, I know what you mean, but...

    I'm guessing that you are a small email server, friends and family? Don't you already need a username password to download email? AUTH'ing to upload mail is just a click box in the majority of email programs, and for (many) email email programs they default to the same username/password as for receiving...

    ...so what's the problem (in a nutshell).

    My thinking is that most home/small users will have pop/IMAP via local accounts on a one box solution, so why not put that into place out of the box...? The number of questions on the list about SASL or complicated pop before SMTP when a simple auth setup would be far easier (not to mention the number of people who get something that ought to work, but get blindsided by the chroot setup)

    What would be interesting is a breakdown of open-relay's by country and type of server. BT Openworld have clamped down on their network because of the number of open relays on ADSL lines (also they are a bunch of ****, but that is a different story). My guess is that in Europe/US there are a large number of Exchange CD's walking home from the office and out of the box Exchange talks to the world. As for the rest of the world I guess standard sendmail relay's by default?

    Anyway, it would be nice to drive up the standard of the out of the box email server. My view is that AUTH costs very little in a LAN environment and is usually REQUIRED in a dialup environment, so pop it in out of the box...

    ...As I say, I don't expect it to fly, but you don't get if you don't ask!

    Ed