On Mon, Nov 29, 1999 at 08:07 +0100, Security Webmaster OKDesign oHG wrote:

one of our clients wants to read his mailaccount with SMTP instead of POP3. Question one: What has to be changed/modified to prepare our server for this ?

Have a look at the fetchmail(1) manpage. There's an option to use the SMTP ETRN command to "fetch" mail. But I don't know anything about the parameters involved and such. I'm sure the smtp daemon has to support this command, too (open up a "telnet mailhost smtp" and ask for "HELP" or go and read RFC822 and its successors).

Question two (thats why I post to this list): It's told that this solution has some security-holes. What are these holes and how can the security be increased ? Is there a bug (for which a bugfix exists ?) in the smtpd or what ?

I cannot see any benefit from one method over the other. Both of them are cleartext although both could be tunneled via SSL or ssh. POP might use APOP for authentication, but this won't help when transfering the messages -- it's just that: encrypted auth. When you're uncomfortable with this situation, use pgp and other of these methods which fit into today's topology seemlessly. virtually yours - Gerhard Sittig -- If you don't understand or are scared by any of the above ask your parents or an adult to help you.