-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Tuesday, June 24 at 09:30 AM, quoth [EMAIL PROTECTED]:
> I use mutt's IMAP to check my email, and mutt's built-in SMTP to
> point to my remote SMTP server (that is, I have set
> smtp_url=smtps://blah.com). I also have set smtp_pass, but I've
> discovered by accident that I can send mail even with smtp_pass
> commented out, and without mutt asking me to enter that password.
So can I! But that's because I put the password into the smtp_url.
> It *seemed* that somebody (mutt, or the smtp server) is determining
> the user name and password needed by the smtp server, by looking at
> what imap_user and imap_pass are.
Unlikely. More likely, your server has implemented IMAP-before-SMTP,
which means anyone from your IP address can send email via SMTP
without a username or password. It's not that it's figuring out what
your username and password are, it's that successful logins to your
IMAP server probably put your IP address on a whitelist that your SMTP
server uses. My server does the same thing... in part because some of
my users really didn't want to understand SMTP-AUTH or enter their
password into their email client more than once, and rather than roll
my eyes and sigh at them and try and argue that two different email
protocols are necessary and the ability to have different passwords
for each is absolutely necessary, I just implemented IMAP-before-SMTP.
The devil is in the details, and there are some drawbacks to this kind
of policy (which I can get into, but is probably offtopic of this
list), but it's a common-enough setup that I wouldn't be surprised if
your server does it.
> However, this can't be right, because if I leave imap_user in place,
> so that only smtp_pass and imap_pass are unset, I can send mail
> without being prompted for anything.
So... your IMAP server will let you log in without a password?
> I'm beginning to wonder if I'm really getting authenticated smtp
> service.
It's not authenticated (really) if you don't specify a user and
password for SMTP... but you could consider that authenticating via
IMAP authenticated you for SMTP as well. It's kinda all in how you
look at it.
~Kyle
- --
And thou shalt smite the house of Ahab thy master, that I may avenge
the blood of my servants the prophets, and the blood of all the
servants of the LORD, at the hand of Jezebel. For the whole house of
Ahab shall perish.
-- Bible, II Kings (9:7-8)
-----BEGIN PGP SIGNATURE-----
Comment: Thank you for using encryption!
iEYEARECAAYFAkhhE0AACgkQBkIOoMqOI14YBgCeKcsoio3g9aEdpBAzI4tDPL9q
gxUAoKokoJrB6EHJ6Ar2Pw0wv7Gt9ysv
=3yNA
-----END PGP SIGNATURE-----
