Tony Finch | 1 Sep 2006 17:51
Picon
Favicon

Re: After a 450, queue or try next MX?


On Wed, 30 Aug 2006, ned+ietf-smtp <at> mrochek.com wrote:
>
> We eventually settled on an intermediate strategy. Temporary failures
> before the MAIL FROM caiuse us to retry using the next MX, failures at
> or after the MAIL FROM do not. We have found that this works pretty well
> overall.

You are effectively making a distinction between errors related to the
destination host and errors relating to the particular message. Perhaps it
would be a further improvement to use enhanced status codes to identify
errors at or after MAIL FROM that also relate to the host rather than the
message.

According to the enhanced status code design, you should just be able to
check that the second digit is a 3, but unfortunately the design has not
been followed consistently. For instance, x.3.4 (message too big) is a
per-message error not a per-host error (it should probably be an x.6.z
code not an x.3.z code), and x.4.5 (mail system congested) is a per-host
error not a per-message error (it should be an x.3.z code).

Tony.
--

-- 
f.a.n.finch  <dot <at> dotat.at>  http://dotat.at/
FISHER: WEST OR NORTHWEST 4 OR 5 BECOMING VARIABLE 3 OR 4. FAIR. MODERATE OR
GOOD.

ned+ietf-smtp | 1 Sep 2006 22:11

Re: After a 450, queue or try next MX?


> On Wed, 30 Aug 2006, ned+ietf-smtp <at> mrochek.com wrote:
> >
> > We eventually settled on an intermediate strategy. Temporary failures
> > before the MAIL FROM caiuse us to retry using the next MX, failures at
> > or after the MAIL FROM do not. We have found that this works pretty well
> > overall.

> You are effectively making a distinction between errors related to the
> destination host and errors relating to the particular message.

Not really. The distinction is between problems that tend to affect a single
host and problems that tend to affect the ability to deliver regardless of the
host you happen to be talking to. The specific message rarely has anything to
do with it - the factors that tend to block delivery completely are things like
a systemic failure of some infrastructure service the servers all depend on
like DNS or directory or antispam or antivirus, or a problem with the client
being blacklisted or otherwise held in bad odor by the servers, or a network
issue where TCP connections get whacked consistently. (This, BTW, is why
maintaining some amount of cache state about how remote systems are behaving is
effective - if there really were lots of message-specific failure modes this
strategy would be seriously counterproductive.)

What might actually help is attempting to classify network level errors better.
There's little point in trying every one of some regional ISP's 18 gazillion
servers if the problem is someone put a backhoe blade through a critical bit of
fiber. The question you're trying to answer is when you have a total connection
failure is it likely to be specific to the host or is it likely to affect
connections to all hosts?

(Continue reading)

[H]e8u[S] | 7 Sep 2006 22:37
Picon

CRAM-MD5 Authentication failure

Hello,
 
 
First of all, I'm using a MDaemon 9.0.4 server and I have to make a small SMTP client (linked to this server) for a website in PHP.
 
When I send the "EHLO" command, the server says:
 
250-he8us.XXXX.XXX Hello exponline, pleased to meet you
250-ETRN
250-AUTH=LOGIN
250-AUTH LOGIN CRAM-MD5
250-8BITMIME
250 SIZE 0
 
So, I choose to authenticate with CRAM-MD5 method. I send the command and the server says:
 
334 UGFzc3dvcmQ6 (the string is always the same)
 
I think the string is the thing you call "challenge" and I "base64 decode" it:
 
Password:
 
The first thing I do is to send my base64_encoded password but I had the "535 Authentication failed" response.
So I base64_decode the string, I hash_hmac("md5", $challenge, $pass) (the manual of the function: http://be.php.net/manual/en/function.hash-hmac.php)
That gave me:
 
0e3f380dc0f4788203a3594089ae8d46
 
I made the CRAM-MD5 string:
 
exponline <at> he8us.XXXX.XXX 0e3f380dc0f4788203a3594089ae8d46
 
I base64_encode it
 
ZXhwb25saW5lQGhlOHVzLm5vLWlwLm9yZyAwZTNmMzgwZGMwZjQ3ODgyMDNhMzU5NDA4OWFlOGQ0Ng==
 
And I sended it to the server and I had the same error "535 Authentication failed"
 
I tried without base64_decode the challenge => error
Without base64_decode the challenge and base64_encode the CRAM-MD5 => error
Without the base64_encode the CRAM-MD5 => error...
 
Does somebody have an idea on why it doesn't work?
Wich other authentication method can I use?
 
Thanks a lot for the response...
 
Cédric
Paul Smith | 8 Sep 2006 11:12
Picon
Favicon

Re: CRAM-MD5 Authentication failure

At 21:37 07/09/2006, [H]e8u[S] wrote:
Hello,
 
 
First of all, I'm using a MDaemon 9.0.4 server and I have to make a small SMTP client (linked to this server) for a website in PHP.
 
When I send the "EHLO" command, the server says:
 
250-he8us.XXXX.XXX Hello exponline, pleased to meet you
250-ETRN
250-AUTH=LOGIN
250-AUTH LOGIN CRAM-MD5
250-8BITMIME
250 SIZE 0
 
So, I choose to authenticate with CRAM-MD5 method. I send the command and the server says:
 
334 UGFzc3dvcmQ6 (the string is always the same)
 
I think the string is the thing you call "challenge" and I "base64 decode" it:
 
Password:

If the CRAM-MD5 challenge is always the same that is really bad! The whole point is that it should be different every time to prevent replay attacks. Are you sure you're sending the 'AUTH CRAM-MD5' command correctly? 'Password:' is the correct response to the second half of an 'AUTH LOGIN' authentication.

If you are sending the 'AUTH CRAM-MD5' command correctly, and the challenge is always the same it looks like MDaemon's authors need to read the standards a bit better again...

The first thing I do is to send my base64_encoded password but I had the "535 Authentication failed" response.
So I base64_decode the string, I hash_hmac("md5", $challenge, $pass) (the manual of the function: http://be.php.net/manual/en/function.hash-hmac.php)
That gave me:
 
0e3f380dc0f4788203a3594089ae8d46
 
I made the CRAM-MD5 string:

Note that the CRAM-MD5 string isn't just the MD5 of the challenge & password put together. See RFC 2095

It's
MD5 ((password XOR opad), MD5 ((password XOR ipad), challenge))

 
exponline <at> he8us.XXXX.XXX 0e3f380dc0f4788203a3594089ae8d46
 
I base64_encode it
 
ZXhwb25saW5lQGhlOHVzLm5vLWlwLm9yZyAwZTNmMzgwZGMwZjQ3ODgyMDNhMzU5NDA4OWFlOGQ0Ng==
 
And I sended it to the server and I had the same error "535 Authentication failed"
 
I tried without base64_decode the challenge => error
Without base64_decode the challenge and base64_encode the CRAM-MD5 => error
Without the base64_encode the CRAM-MD5 => error...
 
Does somebody have an idea on why it doesn't work?
Wich other authentication method can I use?

Have you tried using the CRAM-MD5 checker at http://www.net-track.ch/opensource/cmd5/ to make sure that you are doing your CRAM-MD5 encoding properly.

This utility will show the intermediate values as well for you.

[H]e8u[S] | 8 Sep 2006 13:06
Picon

RE: CRAM-MD5 Authentication failure

The command in the MDaemon documentation is "AUTH LOGIN CRAM-MD5" (I have always an error with it) but I tried "AUTH CRAM-MD5" and the server response is "235 Authentication successful".
 
Thanks a lot for your response
 
Cédric
 
 
 

De : Paul Smith [mailto:paul <at> pscs.co.uk]
Envoyé : vendredi 8 septembre 2006 11:13
À : [H]e8u[S]; ietf-smtp <at> imc.org
Objet : Re: CRAM-MD5 Authentication failure

At 21:37 07/09/2006, [H]e8u[S] wrote:
Hello,
 
 
First of all, I'm using a MDaemon 9.0.4 server and I have to make a small SMTP client (linked to this server) for a website in PHP.
 
When I send the "EHLO" command, the server says:
 
250-he8us.XXXX.XXX Hello exponline, pleased to meet you
250-ETRN
250-AUTH=LOGIN
250-AUTH LOGIN CRAM-MD5
250-8BITMIME
250 SIZE 0
 
So, I choose to authenticate with CRAM-MD5 method. I send the command and the server says:
 
334 UGFzc3dvcmQ6 (the string is always the same)
 
I think the string is the thing you call "challenge" and I "base64 decode" it:
 
Password:

If the CRAM-MD5 challenge is always the same that is really bad! The whole point is that it should be different every time to prevent replay attacks. Are you sure you're sending the 'AUTH CRAM-MD5' command correctly? 'Password:' is the correct response to the second half of an 'AUTH LOGIN' authentication.

If you are sending the 'AUTH CRAM-MD5' command correctly, and the challenge is always the same it looks like MDaemon's authors need to read the standards a bit better again...

The first thing I do is to send my base64_encoded password but I had the "535 Authentication failed" response.
So I base64_decode the string, I hash_hmac("md5", $challenge, $pass) (the manual of the function: http://be.php.net/manual/en/function.hash-hmac.php)
That gave me:
 
0e3f380dc0f4788203a3594089ae8d46
 
I made the CRAM-MD5 string:

Note that the CRAM-MD5 string isn't just the MD5 of the challenge & password put together. See RFC 2095

It's
MD5 ((password XOR opad), MD5 ((password XOR ipad), challenge))


exponline <at> he8us.XXXX.XXX 0e3f380dc0f4788203a3594089ae8d46
 
I base64_encode it
 
ZXhwb25saW5lQGhlOHVzLm5vLWlwLm9yZyAwZTNmMzgwZGMwZjQ3ODgyMDNhMzU5NDA4OWFlOGQ0Ng==
 
And I sended it to the server and I had the same error "535 Authentication failed"
 
I tried without base64_decode the challenge => error
Without base64_decode the challenge and base64_encode the CRAM-MD5 => error
Without the base64_encode the CRAM-MD5 => error...
 
Does somebody have an idea on why it doesn't work?
Wich other authentication method can I use?

Have you tried using the CRAM-MD5 checker at http://www.net-track.ch/opensource/cmd5/ to make sure that you are doing your CRAM-MD5 encoding properly.

This utility will show the intermediate values as well for you.

Chris Doty | 12 Sep 2006 16:47

(unknown)


unsubscribe

Soumya M | 15 Sep 2006 11:15

(unknown)

 
subscribe
Soumya M | 15 Sep 2006 12:45

CRAM MD5 Algorithm

Hello Everybody,
 
Can Someody help me with CRAM MD5 method of authentication? Can somebody give me the algorithm for CRAM MD5?
 
I tried doing it here and am not able authenticate successfully. Pls help me.this is urgent.
Soumya
Abhijit Menon-Sen | 15 Sep 2006 13:22
Favicon

Re: CRAM MD5 Algorithm


At 2006-09-15 16:15:52 +0530, soumyam <at> jataayusoft.com wrote:
>
> Can somebody give me the algorithm for CRAM MD5? 

See RFC 2195 and <http://en.wikipedia.org/wiki/CRAM-MD5>.

(This isn't the right mailing list for that question.)

-- ams

Paul Smith | 15 Sep 2006 13:28
Picon
Favicon

Re: CRAM MD5 Algorithm

At 11:45 15/09/2006, Soumya M wrote:
Hello Everybody,
 
Can Someody help me with CRAM MD5 method of authentication? Can somebody give me the algorithm for CRAM MD5?
 
I tried doing it here and am not able authenticate successfully. Pls help me.this is urgent.

Read the RFCs!

It's all there in RFC 2195. If it's urgent, I'd have thought you'd have looked there already.

Also, there's a freeware CRAM MD5 checker program out there - Google for it, that'll probably help.


Gmane