[tlug] sasl

[Tony Laszlo <laszlo@example.com>]

I set up a Mac and a Linux box so that each could 
send email to an ISP using smtp-auth. I noticed 
that the Mac configuration required the user's 
password that is understood at the ISP, while 
the sendmail + cyrus-sasl configuration required 
only a password on the local box, i.e., a password 
that is not understood by the ISP. That strikes me 
as a situation that could be abused, but perhaps 
that is because I just set it up today for the 
first time. 

so, 
when sending mail as macuser@example.com from a machine 
mymac, a person needs to supply the password used set by 
the ISP. 

when sending mail as linuxuser@example.com 
from a machine called mylinuxbox, a person needs to supply a password 
that is only relevant to the linux box, i.e., the one used when setting 
up sasl. 

a person with a linux box anywhere could pretend to be linuxuser on 
mylinuxbox and send mail to the ISP's smtp server, couldn't he? 

or am I missing something?


-- 
Tony Laszlo
http://www.issho.org/modules.php?op=modload&name=phpWiki&file=index&pagename=La$
(going for the record - blog with the longest URL)