[Dovecot] vpopmail

[C J Kenneth Tan -- OptimaNumerics]

Matthias,

Thanks for the pointer.  I see that you put on the Wiki claiming that
SMTP AUTH is the alternative.  

On 2006-06-02 11:35 +0200 Matthias Andree (matthias.andree at gmx.de) wrote:

> C J Kenneth Tan -- OptimaNumerics <cjtan at OptimaNumerics.com> writes:
> 
> > I was running 1.0.beta3 code with no problems.  I recently switched to
> > 1.0.beta8 and I noticed that vpopmail's pop-before-smtp functionality
> > stopped working.  I am using vpopmail authentication.  Has anyone else
> > encountered this problem?   
> 
> 1. Don't use POP-before-SMTP. It's dangerous.
> 
> 2. Don't use POP-before-SMTP. It's a major security risk.
> 
> 3. Don't use POP-before-SMTP, it allows viruses to relay mail.
> 
> 4. if you still want it, check the release notes and the Dovecot Wiki,
>    either has the relevant information.

I was reporting that using 1.0.beta8, vpopmail's pop-before-smtp
functionality stopped working.  Is intentional?  I didn't see any
relevant changes in the ChangeLog file.

1. Would you be able to explain to me how SMTP AUTH prevents virus
   relay that cannot be accomplished with POP-before-SMTP? 

2. Would you be able to also explain what do you mean by "dangerous"?

3. Would you be able to also explain what do you mean by "major
   security risk"?

Thank you.


Ken
-----------------------------------------------------------------------
C J Kenneth Tan, PhD
OptimaNumerics Ltd                    Telephone: +44 798 941 7838
E-mail: cjtan at OptimaNumerics.com      Telephone: +44 207 099 4428
Web: http://www.OptimaNumerics.com    Facsimile: +44 207 100 4572
-----------------------------------------------------------------------