The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

SMTP AUTH (Mail Authentication)

Discussion in 'E-mail Discussions' started by crazyaboutlinux, Feb 24, 2009.

  1. crazyaboutlinux

    crazyaboutlinux Well-Known Member

    Joined:
    Nov 3, 2007
    Messages:
    938
    Likes Received:
    0
    Trophy Points:
    16
    hi

    i have found that cPanel is enabled SMTP authentication by default see this blog

    http://faq.cpanel.net/show.cgi?qa=117760494503285


    though users can send emails from outlook without enable smtp authentication, this should not happen

    let me know what to do for that users cannot send emails without enabling SMTP authentication from outlook express ??

    Thanks in advance

    Regards,
    Nileshd
     
  2. cPanelNick

    cPanelNick Administrator
    Staff Member

    Joined:
    Mar 9, 2015
    Messages:
    3,426
    Likes Received:
    2
    Trophy Points:
    38
    cPanel Access Level:
    DataCenter Provider

    I highly recommend encouraging your users to use SMTP authentication as it is a much more reliable measure then "pop/imap before smtp."

    If you do not want to use SMTP authentication and they are unable to send mail without authentication you should check the following: make sure tailwatchd is enabled, running, and the Antirelayd driver is enabled in the service manager, also confirm they have logged into the pop/imap server before sending.
     
  3. crazyaboutlinux

    crazyaboutlinux Well-Known Member

    Joined:
    Nov 3, 2007
    Messages:
    938
    Likes Received:
    0
    Trophy Points:
    16
    no , i just want a users can not send emails from outlook express without enabling "My server requires authentication"
     
  4. cPanelDavidG

    cPanelDavidG Technical Product Specialist

    Joined:
    Nov 29, 2006
    Messages:
    11,279
    Likes Received:
    8
    Trophy Points:
    38
    Location:
    Houston, TX
    cPanel Access Level:
    Root Administrator
    You want a user to use SMTP authentication before sending mail via your SMTP server, correct?

    Outlook usually does POP before SMTP, which means if you have POP before SMTP enabled, the machine that successfully checked mail via POP can send mail for a period of 30 minutes from that last successful login without needing SMTP authentication. After those 30 minutes pass, SMTP authentication will be required. The SMTP authentication credentials are the same as the POP authentication credentials.

    All of this POP before SMTP information is stored in /etc/relayhosts by tailwatchd (a task formerly performed by: antirelayd).

    At this time, there is no setting in cPanel or WHM to disable this behavior. Perhaps you can implement a custom solution to handle this.
     
  5. crazyaboutlinux

    crazyaboutlinux Well-Known Member

    Joined:
    Nov 3, 2007
    Messages:
    938
    Likes Received:
    0
    Trophy Points:
    16
    yes Mr David, you are right, a user have to USE SMTP authentication compulsory before sending mail via our SMTP server

    And i found in a cPanel blog that SMTP authentication is a enable by default by cPanel server.

    what does mean ??
    it means a user can not send mails from outlook express without check "My Server Requires Authentication"

    i tried to check by send a test mail with & without check "My Server Requires Authentication" & it is sent successfully, this should not happen & i do not want it .

    without check "My Server Requires Authentication" Spammers can hack our server IP & can send unsolicited emails using our Server SMTP
     
  6. cPanelDavidG

    cPanelDavidG Technical Product Specialist

    Joined:
    Nov 29, 2006
    Messages:
    11,279
    Likes Received:
    8
    Trophy Points:
    38
    Location:
    Houston, TX
    cPanel Access Level:
    Root Administrator
    I believe you are mistaking our POP-before-SMTP authentication capabilities with open relaying. Open relaying is when anyone can send mail to a SMTP server without any authentication and the mail gets sent. cPanel/WHM environments are not open relays.

    You can test this yourself by attempting to send an email through your cPanel/WHM server without authenticating via POP first (or within the past 30 minutes). You will be prompted to supply SMTP authentication credentials in this scenario. This is what is meant by cPanel/WHM requires authentication by default for SMTP. However, if you POP before SMTP, you have already authenticated, and no further authentication is required until after 30 minutes past your POP transaction.

    POP-before-SMTP still requires authentication. However, the authentication is supplied during the POP transaction rather than both the POP and SMTP transactions.

    EDIT:
    You can control the number of messages a domain can send per hour. By default, this is unlimited, but a common setting is 100 messages per hour. This threshold can be set in Tweak Settings as you desire to further throttle potential spam.
     
    #6 cPanelDavidG, Feb 26, 2009
    Last edited: Feb 28, 2009
  7. crazyaboutlinux

    crazyaboutlinux Well-Known Member

    Joined:
    Nov 3, 2007
    Messages:
    938
    Likes Received:
    0
    Trophy Points:
    16
    i have a POP id of cPanel/WHM server & its configured in Outlook Express Email client
    now i tried send a email to my own gmail id without check "My SMTP Server Requires Authentication" from Outlook Express Mail client & its get delivered, this should not happen.
    Now What i want, when any POP id of cPanel/WHM server's Configured in Outlook Express Email client & user try to send email without enable this option "My SMTP Server Requires Authentication" at the same time a user will prompt for an Error

    I am able to send email without select smtp authentication. So, how to apply authentication mode on server . our client user should not send email without authentication.
     
    #7 crazyaboutlinux, Feb 28, 2009
    Last edited: Mar 2, 2009
  8. cPanelDavidG

    cPanelDavidG Technical Product Specialist

    Joined:
    Nov 29, 2006
    Messages:
    11,279
    Likes Received:
    8
    Trophy Points:
    38
    Location:
    Houston, TX
    cPanel Access Level:
    Root Administrator
    I am confused. Are your users able to receive mail via POP3 or IMAP without authentication? Outlook Express will check mail before sending mail (in my experience, but it has been a while), hence authenticate with the server.

    If you encounter a scenario where a user can send mail through your server without previously authenticating to it via POP or SMTP within 30 minutes of prior POP3 authentication, please let our technical analysts take a look at that: http://tickets.cPanel.net/submit
     
    #8 cPanelDavidG, Mar 2, 2009
    Last edited: Mar 2, 2009
  9. tbabble

    tbabble Registered

    Joined:
    Jun 19, 2007
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    I'll bet you are POP'ing first and don't realize it. A common misunderstanding. You need to turn off the Send/Receive for the account in Express first, then wait for more than 30 minutes, then try to send from this account. You'll find that the password prompt appears and you cannot send email without entering it. If you then move that message to Drafts, then Send/Receive the specific account and try to send again it will be sent. This is what the mod refers to as POP before SMTP.
     
    #9 tbabble, Mar 6, 2009
    Last edited: Mar 6, 2009
  10. crazyaboutlinux

    crazyaboutlinux Well-Known Member

    Joined:
    Nov 3, 2007
    Messages:
    938
    Likes Received:
    0
    Trophy Points:
    16
    should i close outlook express application or uncheck this : including this account when receiving mail or synchronizing or any other to stop Send/Receive email ??
     
  11. crazyaboutlinux

    crazyaboutlinux Well-Known Member

    Joined:
    Nov 3, 2007
    Messages:
    938
    Likes Received:
    0
    Trophy Points:
    16
    if i disable this option then which could be create ??
    i need your help pls suggest me what to do
     
  12. crazyaboutlinux

    crazyaboutlinux Well-Known Member

    Joined:
    Nov 3, 2007
    Messages:
    938
    Likes Received:
    0
    Trophy Points:
    16
    HI Nick,


    I want to use SMTP authentication compulsory for all my clients & my clients are can not send email via outlook without check my server requires authentication even pop before SMTP

    hope that is clear
     
  13. crazyaboutlinux

    crazyaboutlinux Well-Known Member

    Joined:
    Nov 3, 2007
    Messages:
    938
    Likes Received:
    0
    Trophy Points:
    16
    yes you are right i am poping first after 30 minutes i prompt for an error
    so what i want is why i wait for 30 minutes then get error spammers are can do much more in 30 minutes do you realize that ???
     
  14. Lyttek

    Lyttek Well-Known Member

    Joined:
    Jan 2, 2004
    Messages:
    770
    Likes Received:
    3
    Trophy Points:
    18
    Ok, you're NOT getting the point...

    If a spammer tries to use your server to send email, they will NOT trigger the 'allow them to send email for 30 minutes because they just checked a valid account' function that's called 'pop/imap before smtp'.

    A spammer will not (ok, should not, but that's another story) be allowed to send email for 30 minutes UNLESS they have an account on your server that they can check. The ONLY people who can send email without using smtp authentication are those people WHO HAVE ACCOUNTS on your server.

    YOU are able to send mail without smtp authenication because you have an account on the machine that you checked first. When those 30 minutes were up, you were unable to send email because the time had expired. This is exactly what a spammer would see, because they don't have an account.
     
  15. cPanelDavidG

    cPanelDavidG Technical Product Specialist

    Joined:
    Nov 29, 2006
    Messages:
    11,279
    Likes Received:
    8
    Trophy Points:
    38
    Location:
    Houston, TX
    cPanel Access Level:
    Root Administrator
    UPDATE: If you disable the antirelayd driver for tailwatchd, SMTP authentication will always be required regardless of POP3 authentication. You can do this by running the following command via SSH as root:

    Code:
    /usr/local/cpanel/bin/tailwatchd --disable=Cpanel::TailWatch::Antirelayd
     
  16. crazyaboutlinux

    crazyaboutlinux Well-Known Member

    Joined:
    Nov 3, 2007
    Messages:
    938
    Likes Received:
    0
    Trophy Points:
    16
    if i do this after that the users are couldn't be able to send email without " smtp mail.domain.com & My server requires authentication " even the users are poping first righttt ? let me know if i am any misunderstanding .
     
    #16 crazyaboutlinux, Apr 22, 2009
    Last edited: Apr 22, 2009
  17. crazyaboutlinux

    crazyaboutlinux Well-Known Member

    Joined:
    Nov 3, 2007
    Messages:
    938
    Likes Received:
    0
    Trophy Points:
    16
    also the user will prompt for an error same as below


    if this thing will work fine then your servers will be safe against spammerssssssssssss

    this is prevent for outgoing spam

    Hope cPanel staff will look into this issue & make it this thing ASAP.

    And All the guy's at cPanel registered users & viewers let me know your suggestions please....
     
    #17 crazyaboutlinux, Apr 22, 2009
    Last edited: Apr 22, 2009
  18. crazyaboutlinux

    crazyaboutlinux Well-Known Member

    Joined:
    Nov 3, 2007
    Messages:
    938
    Likes Received:
    0
    Trophy Points:
    16
    after poping user will prompt for an error like below

    this is my local ISP's IP address '61.15.204.211''
     
  19. meeven

    meeven Well-Known Member

    Joined:
    May 8, 2007
    Messages:
    124
    Likes Received:
    0
    Trophy Points:
    16
    Nilesh, that's correct. If you follow cPaneldavid's latest instructions, your users won't be able to send without SMTP authentication even if POP authentication happens first. Or, to put it more simply, you're now forcing SMTP authentication for all your users.
     
  20. crazyaboutlinux

    crazyaboutlinux Well-Known Member

    Joined:
    Nov 3, 2007
    Messages:
    938
    Likes Received:
    0
    Trophy Points:
    16
    is there create any serious problem if i disable this option.

    e.g incoming/outgoing email problem via outlook or direct webmail.

    and again if i want to enable this option again may i able or not ?
     
Loading...

Share This Page