Re: SMTP servers requiring security/authentication

Jeff,

Jeff Stephenson (Exchange) wrote:
> 
> The SMTP AUTH draft (draft-myers-smtp-auth-05.txt), while providing a
> mechanism for a submitting client to authenticate to the server and
> establish a secure session, doesn't contain a provision for the server
> to inform the client that authentication or security are _required_ for
> submission.  I'd like to see an addition to the draft which addresses
> how an SMTP server responds to SMTP commands when authentication or
> security are required but the client has not successfully issued an
> appropriate AUTH command.

  This is absolutely a good idea and we have included this ability
already in our "Interface Facility" or MLPI to facilitate this through
a direct call passing the command(S) that can be defined.  But I agree
with Jeff here, this should be part of the Draft.
> 
> The current STARTTLS command (draft-hoffman-smtp-ssl-03.txt) has a
> provision along these lines, specifying a response of "505 Must issue a
> STARTTLS command first" to any command other than STARTTLS or QUIT if
> the server requires TLS.  This might best be generalized to "505 Secure
> SMTP session required" and used in both the SMTP AUTH and STARTTLS
> worlds.  Similarly, a server which required the client to authenticate
> could respond with "506 Authentication required" to anything but a
> command which could establish authentication.

  Agreed again here.  And again, we do include this capability in our
"Interface Facility? or MLPI.  Yet I might add that limiting the 
diffrent "Start Commands", for simplifacation here, should not just
be limited to TLS for SMTP.  And we do provide this capability as
well that can be defined in addition to any other command structure,or
in addition to existing command structure that may already exist.  >;)
> 
> Clearly there are some ordering problems to be worked out here - if
> someone wants to do a STARTTLS to establish security (but not client
> identity) and an AUTH command to authenticate, we don't want the
> STARTTLS rejected because of lack of authentication.

  This is very simply workable.  Many diffrent approaches can be used
to achiev this consideration.

Regards,

-- 
Jeffrey A. Williams
DIR. Internet Network Eng/SR. Java Development Eng.
Information Eng. Group. IEG. INC. 
Phone :913-294-2375 (v-office)
E-Mail [email protected]