19 messages in net.sourceforge.lists.courier-usersRE: [courier-users] SMTP authentication
FromSent OnAttachments
Bowie BaileyJan 30, 2004 6:13 pm 
Jesse KeatingJan 31, 2004 10:39 am 
Federico BaraldiFeb 1, 2004 3:44 am 
Bowie BaileyFeb 2, 2004 6:17 am 
Bowie BaileyFeb 2, 2004 8:41 am 
Bowie BaileyFeb 2, 2004 8:59 am 
Matthew WilsonFeb 2, 2004 9:09 am 
Bowie BaileyFeb 2, 2004 9:50 am 
Anand BuddhdevFeb 2, 2004 10:15 am 
Bowie BaileyFeb 2, 2004 10:19 am 
Anand BuddhdevFeb 2, 2004 10:49 am 
Kirk A WolffFeb 2, 2004 10:54 am 
Gordon MessmerFeb 2, 2004 10:59 am 
Bowie BaileyFeb 2, 2004 11:43 am 
Malcolm WeirFeb 2, 2004 12:24 pm 
Gordon MessmerFeb 2, 2004 12:39 pm 
Bowie BaileyFeb 2, 2004 12:58 pm 
ScottFeb 2, 2004 1:14 pm 
Malcolm WeirFeb 2, 2004 5:34 pm 
Actions with this message:
Paste this link in email or IM:
Paste this link in email or IM:
Atom feed for this thread
Paste this URL into your reader:
Subject:RE: [courier-users] SMTP authenticationActions...
From:Bowie Bailey (Bowi@BUC.com)
Date:Feb 2, 2004 9:50:23 am
List:net.sourceforge.lists.courier-users

From: Matthew Wilson [mailto:matt@shinythings.com]

allowing relay is the same as connect without auth. An auth'd user is granted the ability to relay, so allowing an IP to relay is effectively the same.

Ok, except that I don't want this ip to be able to relay.

I want my users to connect to my Courier box to send email via authenticated smtp. Unauthenticated users or Internet MTAs should not be allowed to connect. General email from the Internet comes through a filtering server. This server needs to be able to deliver to the Courier box, but it is unable to authenticate itself.

So... - The filtering server should be able to connect without authentication - The filtering server should NOT be able to relay - Everyone else should be required to authenticate

It sounds like the mail from the filtering server will all be destined for your user server, so you should not need any special setup. Courier will accept mail for addresses that it is configured to accept mail for. Just don't put your user server in DNS as an MX, that's easy.

The filtering server will have to be configured to accept mail for your domains so that it can filter the messages and then forward the good messages onto your user server. Is this where you need help?

/etc/courier/smtpaccess/ should at this point only allow 127.0.0.1 to relay, just so your scripts and whatnot can mail you, etc.

The only thing I need help with is the authentication.

At the moment, my Courier server does not allow smtp connections from the Internet. What I want to do is allow my users to send mail through my server via authenticated smtp. But I don't want any chance of other mail bypassing the filtering server.

There's not going to be an MX record for the Courier server, but if it accepts smtp connections from the Internet, then I have to assume that the spammers will eventually find it. I know that a non-authenticated connection will not relay, but I don't want spam sent to my users either. So I'm trying to configure it so that it only accepts what is absolutely necessary.

Authenticated smtp should be allowed for anyone. -- This is default and not a problem.

Non-authenticated smtp should be allowed only for the filtering server -- This is what I am trying to figure out.

If I set AUTHREQUIRED=1, then how do I allow the filtering server to connect without authentication and without being able to relay?

If I set AUTHREQUIRED=0, then how do I deny non-authenticated connections from anyone except the filtering server?

Bowie