iPhones and SMTP auth |
Post Reply 
|
| Author | |
WebGuyz 
Senior Member 
Joined: 09 May 2005 Location: United States Status: Offline Points: 348 |
 Post Options
 Thanks(0)
 Quote Reply
 Topic: iPhones and SMTP authPosted: 09 August 2007 at 6:43pm |
|
Got 4 customers trying to set up iPhones for outbound mail and not being able to. They can receive emails from our Smartermail mail server, but I use SFE for SMTP auth for outbound sending of mail. Has anyone using SMTP auth in SFI/SFE been able to authenticate iPhones for outgoing email? Thanks! |
|
|
http://www.webguyz.net
|
|
 |
|
|
LogSat
Admin Group 
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 09 August 2007 at 6:50pm |
|
In SpamFilter, under the "Debug View" tab under Settings, could you please enable the Debug Monitor? You'll need to enter the IP of the customer in the "IP to monitor" field.
This should show the SMTP transactions that IP is performing, and could give a clue as to what is happening. |
|
|
|
|
WebGuyz
Senior Member
Joined: 09 May 2005 Location: United States Status: Offline Points: 348 |
Post Options
Thanks(0)
Quote Reply
Posted: 09 August 2007 at 10:24pm |
|
I have to wait for one of the affected users to call me back. In the regular log I see an IP address connect and then a few seconds later a disconnect and nothing in between.
|
|
|
http://www.webguyz.net
|
|
|
|
|
atifghaffar
Senior Member
Joined: 31 May 2006 Location: Switzerland Status: Offline Points: 104 |
Post Options
Thanks(0)
Quote Reply
Posted: 10 August 2007 at 1:23am |
|
I think its related
http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID= 5796&KW=mac Cram-md5 by default i guess. |
|
|
best regards
Atif |
|
|
|
|
WebGuyz
Senior Member
Joined: 09 May 2005 Location: United States Status: Offline Points: 348 |
Post Options
Thanks(0)
Quote Reply
Posted: 10 August 2007 at 1:31am |
|
According to the users CRAM-MD5 is one of the choices but so is PASSWORD which is what I tell them to try. Googling around it seems many people are having issues with iPhones and outbound emails but I'm just not sure where the fault lays. Wish I had one to play with.
|
|
|
http://www.webguyz.net
|
|
|
|
|
WebGuyz
Senior Member
Joined: 09 May 2005 Location: United States Status: Offline Points: 348 |
Post Options
Thanks(0)
Quote Reply
Posted: 10 August 2007 at 10:17am |
|
Atif, Your probably right. I had a Blackjack user who could not do outgoing using SF to authenicate. In debug I saw the SFE hello and what it supported but the BJ never authenticated. I created a dns entry that went straight to our Smartermail box and bam, it worked right away!! Here is what Smartermail sends: rsp: 250-mail99.webguyz.net Hello [166.217.199.183] 250-SIZE 31457280 250-AUTH LOGIN CRAM-MD5 250 OK Here is what SF sends: >>EHLO Inbox <<250-8BITMIME <<250-SIZE 30720000 <<250 HELP So for now I have a work around for the macs, iphone, blackjack's and pegasus mail clients that don't work with SF authentication, but it would be nice if CRAM-MD5 were added so I could centralize all authenticating users. Have sent an email to my iPhone users telling them to use a special DNS entry. Will let you know if they become happy campers. Thanks! |
|
|
http://www.webguyz.net
|
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 10 August 2007 at 10:49pm |
|
Most likely we will not be adding CRAM-MD5 support to SpamFilter. To use CRAM-MD5, SpamFilter should have access to the actual user's password.
This is not possible if using Unix's password files, and would require significantly lowering Active Directory's security by configuring it for reversible encryption for passwords (which could also require resetting all of the user's passwords). LDAP directories may support CRAM-MD5 authentication requests. We'll be verifying the above assumptions, as they may not be 100% accurate, but this was currently the reason to not supporting that standard. |
|
|
|
|
atifghaffar
Senior Member
Joined: 31 May 2006 Location: Switzerland Status: Offline Points: 104 |
Post Options
Thanks(0)
Quote Reply
Posted: 13 August 2007 at 6:17pm |
|
WebGuyz,
In my experience (trial and error), Its best to separate all different mail servers. SF(I|E) are best left as MX Servers. I have separate servers doing the following. MX Server (SFI) Accept mails from other mailservers for AuthorizedTo emails and forward to incoming mailserver. DO not ALLOW SMTP-AUTH (Relaying only) Outgoing servers that do only one thing. Send mails to other MX. SMTP-AUTH Servers. Similar like the outgoing servers except that they only auth SMTP-AUTH (No Relaying, even for the master domain or any other domin) This keeps things nicely separated to also debug.... |
|
|
best regards
Atif |
|
|
|
|
WebGuyz
Senior Member
Joined: 09 May 2005 Location: United States Status: Offline Points: 348 |
Post Options
Thanks(0)
Quote Reply
Posted: 13 August 2007 at 9:07pm |
|
We do have separate servers for inbound (SFE) Main (smartermail) and outbound gateways(smartermail).
The only reason I am using SFE for auth is to protect against the spammers who bypass MX servers and try to send directly to servers. Our users use mail.xxxx.com for both incoming and outgoing servers (which is our main server) . While smartermail won't relay for a non-customer, it will attempt to deliver email to that server if its a valid domain on that server and it will attempt dictionary attacks against that server.
If way back when I had created a separate dns entry for outgoing and pointed it to a different server then this would have been moot. But since I had hundreds of users already setup that way SF fit the bill to authenticate using the same outgoing mail server as before.
Looking at Openldap or MS's free AD/AM as a possiblity of standardizing on LDAP for auth when I get some time.
|
|
|
http://www.webguyz.net
|
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 19 December 2008 at 11:05pm |
|
FYI we just made available in the registered user area a pre-release of SpamFilter v4.1.2.796 that should finally allow SMTP AUTH with the iPhone and Mac OS X Mail.app
|
|
|
|
|
WebGuyz
Senior Member
Joined: 09 May 2005 Location: United States Status: Offline Points: 348 |
Post Options
Thanks(0)
Quote Reply
Posted: 21 December 2008 at 4:36pm |
|
woohoo!!
|
|
|
http://www.webguyz.net
|
|
|
|
|
WebGuyz
Senior Member
Joined: 09 May 2005 Location: United States Status: Offline Points: 348 |
Post Options
Thanks(0)
Quote Reply
Posted: 22 December 2008 at 3:50pm |
Roberto,
We use Unix password file for authentication. Is this still true for the new version with CRAM-MD5 support? I don't have a Mac or Iphone to test with after loading the new version.
|
|
|
http://www.webguyz.net
|
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 23 December 2008 at 4:02pm |
|
Actually we didn't enable CRAM-MD5 support in SpamFilter, so everything is as it was. You can still use all previous authentication methods (Unix crypt, Active Directory with non-reversible encryption, etc), they are not affected by this new feature.
|
|
|
|
|
WebGuyz
Senior Member
Joined: 09 May 2005 Location: United States Status: Offline Points: 348 |
Post Options
Thanks(0)
Quote Reply
Posted: 23 December 2008 at 4:25pm |
|
I thought CRAM-MD5 was what iphone used.
I guess I'll just have to wait until I get a call (if I get call ;-) about someone asking how to get an Iphone or Mac box working for outgoing email by way of authentication thru the most current version.
Thanks!
|
|
|
http://www.webguyz.net
|
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 23 December 2008 at 4:43pm |
|
It's one of the ones used by Apple, but not the only one. To be honest I can't be sure if they recently enabled a new AUTH extension or we got lucky in our tests and found one they do support... but it seems to work with both devices (iPhone v2.2 and Leopard OS X 10.5.6)
|
|
|
|
|
WebGuyz
Senior Member
Joined: 09 May 2005 Location: United States Status: Offline Points: 348 |
Post Options
Thanks(0)
Quote Reply
Posted: 24 December 2008 at 2:38pm |
|
So Iphone users should choose PASSWORD as the authentication method, correct?
|
|
|
http://www.webguyz.net
|
|
|
|
|
LogSat
Admin Group
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 24 December 2008 at 3:20pm |
|
Correct.
|
|
|
|
Topic Options
LogSat wrote:|
Post Reply
|
|
Tweet
|
| Forum Jump | Forum Permissions You cannot post new topics in this forum You cannot reply to topics in this forum You cannot delete your posts in this forum You cannot edit your posts in this forum You cannot create polls in this forum You cannot vote in polls in this forum |
This page was generated in 0.221 seconds.