[
https://issues.apache.org/jira/browse/JAMES-4171?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18057688#comment-18057688
]
Jean Helou commented on JAMES-4171:
-----------------------------------
I managed to find it after all :
the smtp configuration explicitely lists
{code}
<handler class="org.apache.james.smtpserver.CoreCmdHandlerLoader"/>
{code}
and this in turn loads
{code}
AuthRequiredToRelayRcptHook.class.getName(),
{code}
Since I was in the code I wondered why the require only logged users would be
better served by adding a required parameter in <auth> over adding a handler in
the chain
I assume you intend to add some kind of isAuthRequired or isSubmissionServer
property to the SMTPConfiguration interface then propagate that in the
org.apache.james.protocols.smtp.SMTPSession so you can check for it in
org.apache.james.protocols.smtp.core.AbstractAuthRequiredToRelayRcptHook#doRcpt
and force the AUTH_REQUIRED result instead of going letting the hook DECLINE
I'm sure if it's much clearer over adding a dedicated SubmissionServerHook or
SubmissionSeverHandler
all the other security countermeasures seem to be implemented that way 🤷♂
> Submission only server
> ----------------------
>
> Key: JAMES-4171
> URL: https://issues.apache.org/jira/browse/JAMES-4171
> Project: James Server
> Issue Type: Improvement
> Components: SMTPServer
> Reporter: Benoit Tellier
> Priority: Major
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> h3. Context
> I end up having to provide a submission only server for one of my customer.
> Problem: James bundles together the MX and submission role thus always accept
> email of remote users addressed to local users.
> This unorthodox behaviour is not a problem when combining both roles (though
> surprising!) however not being able to say "only authenticated users here"
> prevents implementing the aformentionned use case
> h3. Proposal
> Add auth.required configuration option in SMTP
> If true, then discard unauthenticated senders.
> This shall be the documented + recommended value however for
> retro-compatibility I propose to keep the legacy value as a default value.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
