OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: Another change to smtp_sasl_auth.

From: Keean Schupke (keeanfry-it.com)
Date: Wed Nov 21 2007 - 16:04:27 CST


Hi,

>
> Verify already uses a database as a backend, but it is effectively
> Berkeley DB only. No support for SQL at this time.
>

For (2) I mean SQL to give transaction support, so you don't get
problems with power outages.

> > I think even just (1) gives useful functionality, so I will submit a
> > patch for review at this stage, before going on to (2).
>

I think not hammering a mailserver with lots of incorrect
authentications is a "good net neighbour" policy, and parhaps should
be the default behaviour?

> Even (1) is esoteric enough that I am not sure it should be adopted.
>
> Will anyone else need such a feature? It is a hack to work around "titanic
> bureaucracy", and questionable overloading of services designed to serve
> entirely different goals.

No the services were designed to handle all the mail needs of the
organisation including this... They may have been designed badly...
but there it is.

>
> Is account lock-out a common behaviour for SOHO email submission via ISP
> outbound hosts? Is using the verify service in this way a reasonably
> useful safety mechanism for SOHO users or a single-site feature?
>

It might become more so, once the MTA's support the feature... AFAIK
not many mailservers do this... but if it becomes a feature in
Exchange, then I can see people starting to use it.

The best argument for adopting this would seem to be reducing net
traffic, and avoiding unecessary auth attempts.

All I can say is this is going to be big in the UK, as the "titanic
bureaucracy" is something a lot of people/companies will want or have
to deal with.

Regards,
Keean Schupke, Fry-IT Ltd.