1

I have an application written in .NET framework that sends emails using our STMP server.

I was researching another emailing issue which caused me to look at the SMTP logs.

Here is a sample SMPT log entry...

00:10:35 [64.77.200.185][43483994] rsp: 220 mail.MUNGEDSERVERNAME.org 
00:10:35 [64.77.200.185][43483994] connected at 9/7/2011 12:10:35 AM
00:10:35 [64.77.200.185][43483994] cmd: EHLO Prospector
00:10:35 [64.77.200.185][43483994] rsp: 250-mail.MUNGEDSERVERNAME.org Hello [zz.zz.zzz.zzz] 250-SIZE 31457280 250-AUTH LOGIN CRAM-MD5 250 OK 
00:10:36 [64.77.200.185][43483994] cmd: AUTH login <removed>
00:10:36 [64.77.200.185][43483994] rsp: 334 UGFzc3dvcmQ6 
00:10:36 [64.77.200.185][43483994] rsp: 535 Authentication failed 
00:10:36 [64.77.200.185][43483994] cmd: MAIL FROM:<[email protected]>
00:10:36 [64.77.200.185][43483994] rsp: 250 OK <[email protected]> Sender ok 
00:10:36 [64.77.200.185][43483994] cmd: RCPT TO:<[email protected]>
00:10:36 [64.77.200.185][43483994] rsp: 250 OK <[email protected]> Recipient ok 
00:10:36 [64.77.200.185][43483994] cmd: DATA
00:10:36 [64.77.200.185][43483994] rsp: 354 Start mail input; end with <CRLF>.<CRLF> 
00:10:37 [64.77.200.185][43483994] rsp: 250 OK 
00:10:37 [64.77.200.185][43483994] Data transfer succeeded, writing mail to 45415707.eml
00:11:48 [64.77.200.185][43483994] disconnected at 9/7/2011 12:11:48 AM

My question is how come that the SEND succeeds even though the AUTH login cmd is returning rsp 535 Authentication failed.

By the way, this pattern (AUTH fails...send succeeds) is every logged attempt not just this one. Should this bother me? Does this indicate an insecure setup of our SMTP server?

Thanks.

1 Answer 1

4

This means that the client's trying and failing to authenticate, but the server doesn't require authentication to send.

Regarding security of the server, it depends how the rest of the policies on the SMTP server are configured, but it certainly warrants a closer look; the server may be filtering on source IP, or by recipient domain, but if it's not, then it's likely an open relay.

By the way, change that password; the base64 that it was sent in decodes to plain text. I've stripped it from your message, but it's in the edit history forever.

4
  • Thanks...great answer. By the way...since the email server is faked and the email addresses are faked is it still insecure? Seth Sep 7, 2011 at 17:18
  • @Seth Not sure I understand what you mean - the security of the server's configuration can't really be evaluated based on the info here, but a quick way to check would be one of the open relay tests - or were you referring to having the password in the edit history? Sep 7, 2011 at 17:26
  • Yes...I was talking about having the password in the edit history. In fact...when I base64 decode that original string it does not have a password (whew) but rather has the username...Is that wrong. Should it have had the password? Sep 7, 2011 at 17:32
  • @Seth No, that's right - username should be the first message in a LOGIN challenge-response conversation. Sep 7, 2011 at 18:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .