Re: Is SMTP with no authentication possible?
On Thu, Sep 20, 2007 at 04:32:47PM -0500, Kyle Wheeler wrote: > On Thursday, September 20 at 09:51 PM, quoth Chris G: > >Ah, sorry, I'm confused - I was confusing authentication with > >encryption. My server requires my name and password but the > >connection isn't encrypted. > > O, I get it. In that case, I know exactly why mutt requires SASL: > because that's the library it uses to transform your username and > password into a form that an SMTP server will accept, whether that be > base64-encoding it, or whatever. SASL isn't a connection-encryption > library (that would be something like gnutls or openssl), it's an > authentication encoding library. SASL stands for "Simple > Authentication and Security Layer." Thus, mutt doesn't have to > implement LOGIN, PLAIN, SKEY, CRAM-MD5, or whatever else, but can rely > on the SASL library to handle such details. A more complete > explanation of the SASL concept is here: > http://en.wikipedia.org/wiki/Simple_Authentication_and_Security_Layer > That explains it all, thank you, now I understand. It was actually easier to build mutt with SASL than I expected because the SASL libraries are in a default build of Fedora 7 (well, they were in the one I've been given to use at work) and just putting:- --with-sasl was all that was needed. Since --help gave:- --with-sasl=PFX Use Cyrus SASL 2 network security library I was thinking it was a rarely used library that I would have to build myself and tell mutt where it was. Thanks for the help (and patience) everybody. -- Chris Green
Re: Is SMTP with no authentication possible?
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thursday, September 20 at 09:51 PM, quoth Chris G: >Ah, sorry, I'm confused - I was confusing authentication with >encryption. My server requires my name and password but the >connection isn't encrypted. O, I get it. In that case, I know exactly why mutt requires SASL: because that's the library it uses to transform your username and password into a form that an SMTP server will accept, whether that be base64-encoding it, or whatever. SASL isn't a connection-encryption library (that would be something like gnutls or openssl), it's an authentication encoding library. SASL stands for "Simple Authentication and Security Layer." Thus, mutt doesn't have to implement LOGIN, PLAIN, SKEY, CRAM-MD5, or whatever else, but can rely on the SASL library to handle such details. A more complete explanation of the SASL concept is here: http://en.wikipedia.org/wiki/Simple_Authentication_and_Security_Layer ~Kyle - -- All men by nature desire to know. -- Aristotle -BEGIN PGP SIGNATURE- Comment: Thank you for using encryption! iD8DBQFG8ub/BkIOoMqOI14RAnFxAJ9YFEuvYShpUF0uuR+A53LS/gfb5QCfXypg AG3rVfQmJR9HPiuMpjWDBi4= =3NW3 -END PGP SIGNATURE-
Re: Is SMTP with no authentication possible?
On Thu, Sep 20, 2007 at 02:28:23PM -0500, Kyle Wheeler wrote: > On Thursday, September 20 at 08:16 PM, quoth Chris G: > >> Why doesn't removing the username from the equation work? > >> > >> unset smtp_pass > >> unset smtp_user > >> set smtp_url='smtp://mail3.atroad.com' > >> > > Well it might do but I'd have to type my user name in every time I > > connected which would become a bit of a bore after a while. > > Wait, what? Why would it require a user name? I've *never* encountered > an SMTP server that required that I send a username, but didn't need a > password. In fact, I think it would be an RFC violation to advertise > SMTP-AUTH and modify the standard authentication mechanisms to not > accept a password (and accepting just *any* password is equally > strange). I mean, seriously, what's the point of asking for a username > but not a password? It doesn't prevent unauthorized use, it doesn't > provide for a way of auditing messages, it doesn't provide you with > *anything* that can't be obtained by simply not requiring a username > at all. > Ah, sorry, I'm confused - I was confusing authentication with encryption. My server requires my name and password but the connection isn't encrypted. -- Chris Green
Re: Is SMTP with no authentication possible?
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thursday, September 20 at 08:16 PM, quoth Chris G: >> Why doesn't removing the username from the equation work? >> >> unset smtp_pass >> unset smtp_user >> set smtp_url='smtp://mail3.atroad.com' >> > Well it might do but I'd have to type my user name in every time I > connected which would become a bit of a bore after a while. Wait, what? Why would it require a user name? I've *never* encountered an SMTP server that required that I send a username, but didn't need a password. In fact, I think it would be an RFC violation to advertise SMTP-AUTH and modify the standard authentication mechanisms to not accept a password (and accepting just *any* password is equally strange). I mean, seriously, what's the point of asking for a username but not a password? It doesn't prevent unauthorized use, it doesn't provide for a way of auditing messages, it doesn't provide you with *anything* that can't be obtained by simply not requiring a username at all. ~Kyle - -- One of the penalties for refusing to participate in politics is that you end up being governed by your inferiors. -- Plato -BEGIN PGP SIGNATURE- Comment: Thank you for using encryption! iD8DBQFG8snXBkIOoMqOI14RAoXCAJ9TXVdAyxKF9HwEGClLKwlSyZgWDwCdHdYS PZqHyyq+cpIXiiAPiHac1FQ= =ux5X -END PGP SIGNATURE-
Re: Is SMTP with no authentication possible?
On Thu, Sep 20, 2007 at 01:14:21PM -0500, Kyle Wheeler wrote: > On Thursday, September 20 at 07:05 PM, quoth Chris G: > >In the end my build of mutt with SASL and the following in muttrc > >seem to work:- > >set smtp_pass='xxx' > >set smtp_url='smtp://[EMAIL PROTECTED]' > > > >No smtp_authenticators setting seems to get it to work. > > > >It still seems a bit odd that you have to compile it with SASL in > >order to get mutt to work with an SMTP server that doesn't require > >authentication. > > Why doesn't removing the username from the equation work? > > unset smtp_pass > unset smtp_user > set smtp_url='smtp://mail3.atroad.com' > Well it might do but I'd have to type my user name in every time I connected which would become a bit of a bore after a while. -- Chris Green
Re: Is SMTP with no authentication possible?
> It still seems a bit odd that you have to compile it with SASL in > order to get mutt to work with an SMTP server that doesn't require > authentication. I don't think you do. $ mutt -v | grep -i sasl +USE_POP +USE_IMAP +USE_SMTP -USE_GSS -USE_SSL_OPENSSL -USE_SSL_GNUTLS -USE_SASL +HAVE_GETADDRINFO As Kyle said, try it with no username in $smtp_url, and $smtp_user and $smtp_pass unset. -- -D.[EMAIL PROTECTED]NSITUniversity of Chicago "Polka music needs to prevail." John Ziobrowski, Polka America Corporation
Re: Is SMTP with no authentication possible?
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Thursday, September 20 at 07:05 PM, quoth Chris G: >In the end my build of mutt with SASL and the following in muttrc >seem to work:- >set smtp_pass='xxx' >set smtp_url='smtp://[EMAIL PROTECTED]' > >No smtp_authenticators setting seems to get it to work. > >It still seems a bit odd that you have to compile it with SASL in >order to get mutt to work with an SMTP server that doesn't require >authentication. Why doesn't removing the username from the equation work? unset smtp_pass unset smtp_user set smtp_url='smtp://mail3.atroad.com' ~Kyle - -- I married beneath me---all women do. -- Nancy Astor -BEGIN PGP SIGNATURE- Comment: Thank you for using encryption! iD8DBQFG8rh9BkIOoMqOI14RAtC5AKDt4WEQbWcQn8f3/xvUuYhRz5GDhACgyksl aAdGIQsDNAIiK4/KSBJVYNY= =tFuv -END PGP SIGNATURE-
Re: Is SMTP with no authentication possible?
On Thu, Sep 20, 2007 at 10:14:26AM -0500, David Champion wrote: > > I use this: > > smtp_url="smtp://localhost/" > > > (I run sendmail locally. I could use local submission via $sendmail, > but I use the built-in SMTP code to exercise the code.) > > I also have certain send2-hooks which replace that with another SMTP > server. You can replace localhost with your smtp server name, and > submit without authn. > In the end my build of mutt with SASL and the following in muttrc seem to work:- set smtp_pass='xxx' set smtp_url='smtp://[EMAIL PROTECTED]' No smtp_authenticators setting seems to get it to work. It still seems a bit odd that you have to compile it with SASL in order to get mutt to work with an SMTP server that doesn't require authentication. -- Chris Green
Re: Is SMTP with no authentication possible?
I use this: smtp_url="smtp://localhost/" (I run sendmail locally. I could use local submission via $sendmail, but I use the built-in SMTP code to exercise the code.) I also have certain send2-hooks which replace that with another SMTP server. You can replace localhost with your smtp server name, and submit without authn. -- -D.[EMAIL PROTECTED]NSITUniversity of Chicago "Polka music needs to prevail." John Ziobrowski, Polka America Corporation
Re: Is SMTP with no authentication possible?
Hi, * Chris G [07-09-20 12:11:02 +0100] wrote: Is there no way to tell mutt that no sort of authentication is required? Reading the code, the answer should be: don't set a username. What's your $smtp_url set to? bye, Rocco -- .wq!
Re: Is SMTP with no authentication possible?
On Thu, Sep 20, 2007 at 04:59:58PM +0530, Dilip M wrote: > On 9/20/07, Chris G <[EMAIL PROTECTED]> wrote: > > On Thu, Sep 20, 2007 at 12:11:02PM +0100, Chris G wrote: > > > I have looked back in the list archives and others seem to have had > > > this problem but I see no resolutionsnip... > > What smtp software you are using? Is it mentioned in .muttrc. > Huh? I don't use "smtp software", that's what someone else provides listening on port 25 somewhere. -- Chris Green
Re: Is SMTP with no authentication possible?
On 9/20/07, Chris G <[EMAIL PROTECTED]> wrote: > On Thu, Sep 20, 2007 at 12:11:02PM +0100, Chris G wrote: > > I have looked back in the list archives and others seem to have had > > this problem but I see no resolutionsnip... What smtp software you are using? Is it mentioned in .muttrc. -- Dilip I'm new mutt user and here to stay!
Re: Is SMTP with no authentication possible?
On Thu, Sep 20, 2007 at 12:11:02PM +0100, Chris G wrote: > I have looked back in the list archives and others seem to have had > this problem but I see no resolution. > > I am using mutt on a corporate network where both I and the SMTP > server are behind a firewall. Thus there is no authentication for > the SMTP server (you may or may not agree with this but it's the way > it is, I can't change it). > > Is there no way to tell mutt that no sort of authentication is > required? > > > Alternatively I could use an external authenticated SMTP server but > then (presumably) I need to build mutt with SASL and some other bits, > can someone clarify what exactly is required please. This is on a bog > standard Fedora 7 system, I do have root access and have (obviously!) > already built mutt 1.5.16 so another build or two is not beyond me. > Just a further bit of information, I have now built mutt with SASL and when I try and send mail it says:- No authenticators available help!! -- Chris Green
Is SMTP with no authentication possible?
I have looked back in the list archives and others seem to have had this problem but I see no resolution. I am using mutt on a corporate network where both I and the SMTP server are behind a firewall. Thus there is no authentication for the SMTP server (you may or may not agree with this but it's the way it is, I can't change it). Is there no way to tell mutt that no sort of authentication is required? Alternatively I could use an external authenticated SMTP server but then (presumably) I need to build mutt with SASL and some other bits, can someone clarify what exactly is required please. This is on a bog standard Fedora 7 system, I do have root access and have (obviously!) already built mutt 1.5.16 so another build or two is not beyond me. -- Chris Green
