If the SMTP server requires that both the user name AND the user's IP address must be authenticated together, then it would seem that the only way this could occur would be for the spammer to obtain the user's Kerio password, and use it to authenticate to the Kerio SMTP server from multiple foreign servers that were sending the spam emails through our server.
In either case, when and how does the Kerio SMTP server determine that the authentication has expired? Or does it check ONLY the user name, and relay subsequent emails from that authenticated user, regardless of what IP address they originate from? For example, if has authenticated from his home computer, and while he is authenticated, an email arrives at the Kerio SMTP server from some other IP address purporting to be from, will Kerio relay it? Since the SMTP server only allows relay for "authenticated" users, my question is what constitutes "authenticated"? What does the Kerio SMTP server check to determine whether an incoming email is from an authenticated user?ĭoes it check both the user name AND the IP address? For example, if has authenticated to SMTP from one IP address, does the SMTP server check BOTH the user name and IP address of incoming emails, and consider only emails from that user AND that IP address to be "authenticated"? The spam emails "spoofed" the email address of one of our Kerio users, using it as a fake "from" address. The spam emails originated from several different IP addresses outside of our LAN, which appear to be various servers in Algiers, Turkey and Chile. Check the option Require SSL-secured connection. If possible, use an SMTP server within the local network. Enter the DNS name or IP address of the server in the Server field. Users authenticated through SMTP for outgoing mail In the administration interface, go to Remote Services > SMTP Relay. Users from the local IP address group (the internal office LAN)Ģ. The SMTP server is configured to allow relay only for:ġ.
#Kerio connect smtp settings password#
We have recently experienced a problem where it appears that a spammer was able to relay dozens of spam emails through our Kerio 8.3.2 server in violation of the SMTP Server settings - or else the spammer had obtained the password of one of our users and was able to authenticate to SMTP with it, which seems unlikely.
Home » GFI User Forums » Kerio Connect » SMTP relay settings violated? Show: Today's Messages :: Show Polls :: Message Navigator
0 kommentar(er)
