Re: fix.your.open.relay.or.die.net

["Brad Jensen" <brad@xxxxxxxxxxx>]

----- Original Message -----
From: "Walden H. Leverich" <WaldenL@TechSoftInc.com>
To: <midrange-l@midrange.com>
Sent: Saturday, November 24, 2001 6:25 AM
Subject: RE: fix.your.open.relay.or.die.net


> James,
>
> That is NOT possible. How does you server know "you" are you and
not me
> pretending to be you? There must be something enabled. Perhaps
something
> that says you must check for new mail before sending old mail?
Many servers
> assume you're allowed to relay IF the IP your sending from has
checked for
> new mail in the last several minutes. Since checking for new
mail requires a
> userid and password they can safely assume you're authorized.

Not really, some ISPs reuse IPs - so it really ins't safe.

> The
> check-before-send is NOT part of the RFC, but may be a default
config for
> sendmail.  Otherwise what's to stop me from configuring a copy
of netscape
> like you just described and SPAMing the world?

Well, based ont he fact that Outlook Express has a checkbox for
password-controlled SMTP, I assume some SMTP servers are now
checking passwords.