Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an application written in .NET framework that sends emails using our STMP server.

I was researching another emailing issue which caused me to look at the SMTP logs.

Here is a sample SMPT log entry...

00:10:35 [64.77.200.185][43483994] rsp: 220 mail.MUNGEDSERVERNAME.org 
00:10:35 [64.77.200.185][43483994] connected at 9/7/2011 12:10:35 AM
00:10:35 [64.77.200.185][43483994] cmd: EHLO Prospector
00:10:35 [64.77.200.185][43483994] rsp: 250-mail.MUNGEDSERVERNAME.org Hello [zz.zz.zzz.zzz] 250-SIZE 31457280 250-AUTH LOGIN CRAM-MD5 250 OK 
00:10:36 [64.77.200.185][43483994] cmd: AUTH login <removed>
00:10:36 [64.77.200.185][43483994] rsp: 334 UGFzc3dvcmQ6 
00:10:36 [64.77.200.185][43483994] rsp: 535 Authentication failed 
00:10:36 [64.77.200.185][43483994] cmd: MAIL FROM:<EMAIL@MYEMAIL.com>
00:10:36 [64.77.200.185][43483994] rsp: 250 OK <EMAIL@MYEMAIL.com> Sender ok 
00:10:36 [64.77.200.185][43483994] cmd: RCPT TO:<ANOTHEREMAIL@gmail.com>
00:10:36 [64.77.200.185][43483994] rsp: 250 OK <ANOTHEREMAIL@gmail.com> Recipient ok 
00:10:36 [64.77.200.185][43483994] cmd: DATA
00:10:36 [64.77.200.185][43483994] rsp: 354 Start mail input; end with <CRLF>.<CRLF> 
00:10:37 [64.77.200.185][43483994] rsp: 250 OK 
00:10:37 [64.77.200.185][43483994] Data transfer succeeded, writing mail to 45415707.eml
00:11:48 [64.77.200.185][43483994] disconnected at 9/7/2011 12:11:48 AM

My question is how come that the SEND succeeds even though the AUTH login cmd is returning rsp 535 Authentication failed.

By the way, this pattern (AUTH fails...send succeeds) is every logged attempt not just this one. Should this bother me? Does this indicate an insecure setup of our SMTP server?

Thanks.

share|improve this question
add comment

1 Answer

This means that the client's trying and failing to authenticate, but the server doesn't require authentication to send.

Regarding security of the server, it depends how the rest of the policies on the SMTP server are configured, but it certainly warrants a closer look; the server may be filtering on source IP, or by recipient domain, but if it's not, then it's likely an open relay.

By the way, change that password; the base64 that it was sent in decodes to plain text. I've stripped it from your message, but it's in the edit history forever.

share|improve this answer
    
Thanks...great answer. By the way...since the email server is faked and the email addresses are faked is it still insecure? Seth –  Seth Spearman Sep 7 '11 at 17:18
    
@Seth Not sure I understand what you mean - the security of the server's configuration can't really be evaluated based on the info here, but a quick way to check would be one of the open relay tests - or were you referring to having the password in the edit history? –  Shane Madden Sep 7 '11 at 17:26
    
Yes...I was talking about having the password in the edit history. In fact...when I base64 decode that original string it does not have a password (whew) but rather has the username...Is that wrong. Should it have had the password? –  Seth Spearman Sep 7 '11 at 17:32
    
@Seth No, that's right - username should be the first message in a LOGIN challenge-response conversation. –  Shane Madden Sep 7 '11 at 18:39
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.