Subject: SMTP servers requiring security/authentication

From: "Jeff Stephenson (Exchange)" <[email-masked]>
Date: Thu, 12 Jun 1997 15:10:15 -0700

The SMTP AUTH draft (draft-myers-smtp-auth-05.txt), while providing a
mechanism for a submitting client to authenticate to the server and
establish a secure session, doesn't contain a provision for the server
to inform the client that authentication or security are _required_ for
submission.  I'd like to see an addition to the draft which addresses
how an SMTP server responds to SMTP commands when authentication or
security are required but the client has not successfully issued an
appropriate AUTH command.

The current STARTTLS command (draft-hoffman-smtp-ssl-03.txt) has a
provision along these lines, specifying a response of "505 Must issue a
STARTTLS command first" to any command other than STARTTLS or QUIT if
the server requires TLS.  This might best be generalized to "505 Secure
SMTP session required" and used in both the SMTP AUTH and STARTTLS
worlds.  Similarly, a server which required the client to authenticate
could respond with "506 Authentication required" to anything but a
command which could establish authentication.

Clearly there are some ordering problems to be worked out here - if
someone wants to do a STARTTLS to establish security (but not client
identity) and an AUTH command to authenticate, we don't want the
STARTTLS rejected because of lack of authentication.

---

From: Jeff Williams <[email-masked]>
Date: Thu, 12 Jun 1997 18:00:13 +0100

Jeff,

> appropriate AUTH command.

  This is absolutely a good idea and we have included this ability
already in our "Interface Facility" or MLPI to facilitate this through
a direct call passing the command(S) that can be defined.  But I agree
with Jeff here, this should be part of the Draft.
> command which could establish authentication.

  Agreed again here.  And again, we do include this capability in our
"Interface Facility? or MLPI.  Yet I might add that limiting the 
diffrent "Start Commands", for simplifacation here, should not just
be limited to TLS for SMTP.  And we do provide this capability as
well that can be defined in addition to any other command structure,or
in addition to existing command structure that may already exist.  >;)
> STARTTLS rejected because of lack of authentication.

  This is very simply workable.  Many diffrent approaches can be used
to achiev this consideration.

Regards,

-- 
Jeffrey A. Williams
DIR. Internet Network Eng/SR. Java Development Eng.
Information Eng. Group. IEG. INC. 
Phone :913-294-2375 (v-office)
E-Mail [email-masked]

---

From: Jeff Williams <[email-masked]>
Date: Thu, 12 Jun 1997 18:00:13 +0100

Jeff,

Regards,