Subject: Re: SMTP Authentication - is it mandatory if supported?

From: John Gardiner Myers <[email-masked]>
Date: Thu, 06 Sep 2001 14:00:51 -0700

Paul Smith wrote:
> i.e. our server can be configured so that some IP addresses require
> authentication and others don't, or so that mail to local users doesn't
> require authentication, but mail to remote users does (to allow incoming
> SMTP mail)

In that case, your server should advertise the AUTH extension to those
clients for which which it requires authentication and should not
advertise the AUTH extension to those clients for which it does not
require authentication.

An SMTP server should not advertise (request) authentication on a
connection unless there is some benefit to be gained from that
authentication.  Otherwise, the server is causing the client/user to go
through the cost of presenting credentials for no gain.

It is entirely reasonable for a client to use the presence of the AUTH
extension on a server to require a successful SMTP authentication.  This
removes the requirement for the user to correctly configure the client
to know the server's policy.

---

From: Tony Hansen <[email-masked]>
Date: Thu, 06 Sep 2001 22:59:55 -0400

I'm sorry, John. I have to disagree.

The equation is NOT "advertises == requires". I don't think it's
reasonable at all for a client to use the presence of the AUTH extension
to infer the requirement.

If an SMTP server advertises that it can do authentication, it does NOT
mean that the server is requiring authentication. It only means that if
whatever is connecting to it DOES do authentication, then that entity
can >>>potentially<<< gain additional capabilities. If the entity does
NOT do authentication, it doesn't gain those additional capabilities.
End of story.

Consider an SMTP server that offers various private extensions for those
that authenticate. Obviously my netscape client isn't going to know
anything about those extensions. So why should it be forced to
authenticate if it isn't going to benefit? Yet, because it thinks that
being able to authenticate means that it MUST authenticate, it isn't
gaining a thing by doing so. And there's no way to override that
assumption.

Wrong, wrong, wrong!

	Tony Hansen
	[email-masked]

---

From: Claus Assmann <[email-masked]>
Date: Thu, 6 Sep 2001 20:23:32 -0700

> through the cost of presenting credentials for no gain.

SMTP AUTH is not just for authentication, but also for a security
layer (SA_S_L). So it can be useful to advertise (which is something
else than request) SMTP AUTH if at least one of the mechanisms
actually can provide a security layer.

It would be nice if a MUA has a configuration option to turn on/off
SMTP AUTH.

---

From: [email-masked]
Date: Thu, 06 Sep 2001 20:22:12 -0700 (PDT)

> I'm sorry, John. I have to disagree.

And so do I.

> to infer the requirement.

Certainly not all clients. Consider the following common relay blocking
scenario: I want to allow connections from outside my organization to send to
any internal address, but authentication is required to send to external
addresses. This can be done with two separate servers, of course, but it may
not be convenient to set things up this way.

> NOT do authentication, it doesn't gain those additional capabilities.

Exactly.

> Wrong, wrong, wrong!

You bet.

				Ned

---

From: Chris Newman <[email-masked]>
Date: Fri, 07 Sep 2001 17:38:32 -0700

>> I'm sorry, John. I have to disagree.

As do I.  The fact that SMTP AUTH _may_ provide additional capabilities for 
certain recipients does not mean that all client MUST authenticate.

Indeed it's a major problem for servers because we have to ship with SMTP 
AUTH turned off for "internal" connections to avoid unnecessary credential 
prompts, but this means the configuration and user-visible behavior must be 
changed in order to permit auth-restricted lists or other such useful 
features.  It also causes problems with testing in my experience.

But John's point that a client needs a way to discover server security 
policy is a good one.  Perhaps we need a separate "AUTHREQUIRED" ESMTP 
keyword.

I believe appropriate policies for servers to advertise are:

	always		SMTP AUTH is required for all mail transfers.
			Clients should prompt for authentication.

	nonlocal	SMTP AUTH is required for relay to non-local
			recipients.  A non-local recipient is one whose
			associated MX or A record does not include the current
			server.  Clients should prompt for authentication
			unless they determine all recipients are local.

	limited		SMTP AUTH is only required for certain
			restricted-posting mailing lists and advanced features.
			Client behavior should be same as

	<absent>	Server declines to advertise policy, client
			should try to send mail without authentication
			and if it fails with code 4.7.1 from RFC 1893/2034,
			the client should retry with authentication.  This
			behavior may be configurable by the user.

		- Chris

---

From: John Gardiner Myers <[email-masked]>
Date: Thu, 06 Sep 2001 14:00:51 -0700

---

From: Tony Hansen <[email-masked]>
Date: Thu, 06 Sep 2001 22:59:55 -0400

Wrong, wrong, wrong!

	Tony Hansen
	[email-masked]

---

From: Claus Assmann <[email-masked]>
Date: Thu, 6 Sep 2001 20:23:32 -0700

---

From: [email-masked]
Date: Thu, 06 Sep 2001 20:22:12 -0700 (PDT)

And so do I.

Exactly.

You bet.

				Ned

---

From: Chris Newman <[email-masked]>
Date: Fri, 07 Sep 2001 17:38:32 -0700

- Chris

Date: Fri, 07 Sep 2001 17:38:32 -0700
From: Chris Newman <[email-masked]>
Subject: Re: SMTP Authentication - is it mandatory if supported?
To: [email-masked], Tony Hansen <[email-masked]>
Cc: John Gardiner Myers <[email-masked]>, [email-masked]
Sender: [email-masked]

		- Chris

Date: Thu, 06 Sep 2001 20:22:12 -0700 (PDT)
From: [email-masked]
Subject: Re: SMTP Authentication - is it mandatory if supported?
To: Tony Hansen <[email-masked]>
Cc: John Gardiner Myers <[email-masked]>, [email-masked]
Sender: [email-masked]

And so do I.

Exactly.

You bet.

				Ned

Date: Thu, 6 Sep 2001 20:23:32 -0700
From: Claus Assmann <[email-masked]>
To: [email-masked]
Subject: Re: SMTP Authentication - is it mandatory if supported?
Sender: [email-masked]

Date: Thu, 06 Sep 2001 22:59:55 -0400
From: Tony Hansen <[email-masked]>
To: John Gardiner Myers <[email-masked]>
CC: [email-masked]
Subject: Re: SMTP Authentication - is it mandatory if supported?
Sender: [email-masked]

Wrong, wrong, wrong!

	Tony Hansen
	[email-masked]

> to know the server's policy.

To: [email-masked]
Path: not-for-mail
From: John Gardiner Myers <[email-masked]>
Newsgroups: mcom.list.ietf-sasl
Subject: Re: SMTP Authentication - is it mandatory if supported?
Date: Thu, 06 Sep 2001 14:00:51 -0700
Organization: Netscape Communications Corporation
Lines: 22
NNTP-Posting-Host: 208.12.60.242
Sender: [email-masked]

Date: Tue, 04 Sep 2001 10:43:00 -0700
To: "Voit, Michael" <[email-masked]>
From: "Kurt D. Zeilenga" <[email-masked]>
Subject: Re: segmentation fault using saslpasswd
Cc: "[email-masked]'" <[email-masked]>
Sender: [email-masked]

I suggest you redirect this question to the Cyrus SASL
mailing list <[email-masked]>.  Questions
regarding the use of any particular SASL implementation
is a bit off topic here.

Kurt

At 05:25 AM 2001-09-03, Voit, Michael wrote:

>hello,
>
>everytime i call saslpasswd and enter the passwords, it quits with
>"segmentation fault". i did not get any errors installing - btw. suse linux
>installs it anyway by itself, so i think there is no buidling problem...
>anybody any idea?
>
>thanx in advance
>
>michael voit

From: "Voit, Michael" <[email-masked]>
To: "[email-masked]'" <[email-masked]>
Subject: segmentation fault using saslpasswd
Date: Mon, 3 Sep 2001 14:25:29 +0200 
Sender: [email-masked]

hello,

everytime i call saslpasswd and enter the passwords, it quits with
"segmentation fault". i did not get any errors installing - btw. suse linux
installs it anyway by itself, so i think there is no buidling problem...
anybody any idea?

thanx in advance

michael voit