Re: IIS SMTP - is open relay prevented?


"Sanford Whiteman" <swhitemanlistens-software@xxxxxxxxxxxxxxxxxxxxx> wrote in message news:op.t2c8ifvl6c17zw@xxxxxxxxxxxxxxxxxxxxxxx

> As it is, your current configuration is probably the easiest to
> maintain.

Laziest to maintain != Easiest to maintain. It's one thing to
streamline your configuration, it's another to have no audit trail or
security boundaries because you run everything in the same context.
Web developers need to get used to the uncomfortable idea of _somebody
else_ running their code, whether that be a customer or a hacker. That
means knowing *which* web application sent mail from 127.0.0.1. On a
server with innumerable posting acceptors running under the same
context, an accidentally open HTTP-SMTP proxy is almost impossible to
track down.

Alternatively, if there's only a single web application, and this is compromised, then you gain very little from SMTP AUTH since the attacker is merely manipulating what the web application is permitted to do anyway.

Cheers
Ken

.

Relevant Pages

  • Re: auditing with context?
    ... so it would seem that a generic method which jumps up on ... Its probably best implemented by doing all database updates through ... If you want to record context then this must must be ... Its also essential if the audit trail is ...
    (comp.lang.java.programmer)
  • Re: auditing with context?
    ... Its probably best implemented by doing all database updates through stored procedures that generate the audit log while doing any auditable database operation. ... If you want to record context then this must must be passed as a parameter to every stored procedure that generates audit trail entries. ... If this is about code coverage, ...
    (comp.lang.java.programmer)
Loading