Re: authenticate o365 users with postfix without smtp auth

2019-06-18 Thread Emmanuel Fusté
Le 17/06/2019 à 20:29, Wietse Venema a écrit : Emmanuel Fust?: Le 17/06/2019 ? 12:05, Emmanuel Fust? a ?crit?: Le 16/06/2019 ? 22:37, Viktor Dukhovni a ?crit?: On Sun, Jun 16, 2019 at 05:46:52PM +0200, Stefan Bauer wrote: Some of our users use o365 but would like to use our service for outgo

Re: authenticate o365 users with postfix without smtp auth

2019-06-18 Thread Emmanuel Fusté
Le 17/06/2019 à 21:31, Wietse Venema a écrit : Viktor Dukhovni: On Mon, Jun 17, 2019 at 02:29:05PM -0400, Wietse Venema wrote: I suppose that Postfix will need to forward the OORG information that it received from the Microsoft server, not a name that is hard-coded in main.cf, and that Postfix

Re: authenticate o365 users with postfix without smtp auth

2019-06-17 Thread Stefan Bauer
As microsoft ofers DKIM-singing for outgoing mails at no extra cost, i will validate this information as 3rd authentication token. Looks much clearer and several addons for postfix exist to do so. Am Mo., 17. Juni 2019 um 21:31 Uhr schrieb Wietse Venema < wie...@porcupine.org>: > > The latter is

Re: authenticate o365 users with postfix without smtp auth

2019-06-17 Thread Wietse Venema
Viktor Dukhovni: > On Mon, Jun 17, 2019 at 02:29:05PM -0400, Wietse Venema wrote: > > > I suppose that Postfix will need to forward the OORG information > > that it received from the Microsoft server, not a name that is > > hard-coded in main.cf, and that Postfix will need to send that > > informa

Re: authenticate o365 users with postfix without smtp auth

2019-06-17 Thread Viktor Dukhovni
On Mon, Jun 17, 2019 at 02:29:05PM -0400, Wietse Venema wrote: > I suppose that Postfix will need to forward the OORG information > that it received from the Microsoft server, not a name that is > hard-coded in main.cf, and that Postfix will need to send that > information only to systems that sho

Re: authenticate o365 users with postfix without smtp auth

2019-06-17 Thread Wietse Venema
Emmanuel Fust?: > Le 17/06/2019 ? 12:05, Emmanuel Fust? a ?crit?: > > Le 16/06/2019 ? 22:37, Viktor Dukhovni a ?crit?: > >> On Sun, Jun 16, 2019 at 05:46:52PM +0200, Stefan Bauer wrote: > >> > >>> Some of our users use o365 but would like to use our service for > >>> outgoing > >>> mails.? We are

Re: authenticate o365 users with postfix without smtp auth

2019-06-17 Thread Emmanuel Fusté
Le 17/06/2019 à 13:08, Stefan Bauer a écrit : Emmanuel, thank you. That was of great help to see, that others have same isses with o365. Do you have any more infos how you do the experimental certificate matching part with postifx? In the official experimental release from Wietse. Emman

Re: authenticate o365 users with postfix without smtp auth

2019-06-17 Thread Emmanuel Fusté
Le 17/06/2019 à 12:05, Emmanuel Fusté a écrit : Le 16/06/2019 à 22:37, Viktor Dukhovni a écrit : On Sun, Jun 16, 2019 at 05:46:52PM +0200, Stefan Bauer wrote: Some of our users use o365 but would like to use our service for outgoing mails.  We are offering smtp sending services.  Integrating o

Re: authenticate o365 users with postfix without smtp auth

2019-06-17 Thread Emmanuel Fusté
Le 17/06/2019 à 13:14, Wietse Venema a écrit : Emmanuel Fust?: The "proper" Microsoft way is to use their proprietary XOORG SMTP extension used in their hybrid cloud scenario. - Is there a protocol definition for this, or is there only implementation by trial and error? The only official statem

Re: authenticate o365 users with postfix without smtp auth

2019-06-17 Thread Martijn Brinkers
On 16-06-19 21:50, Peter wrote: > On 17/06/19 2:00 AM, Stefan Bauer wrote: >> we are running a small smtp relay service with postfix for >> authenticated users. Unfortunately office 365 does not offer any smtp >> authentication mechanism when sending mails via connectors to smarthosts. > > I ca

Re: authenticate o365 users with postfix without smtp auth

2019-06-17 Thread Wietse Venema
Emmanuel Fust?: > The "proper" Microsoft way is to use their proprietary XOORG SMTP > extension used in their hybrid cloud scenario. - Is there a protocol definition for this, or is there only implementation by trial and error? - How is the XOORG information verified against other information (c

Re: authenticate o365 users with postfix without smtp auth

2019-06-17 Thread Stefan Bauer
Emmanuel, thank you. That was of great help to see, that others have same isses with o365. Do you have any more infos how you do the experimental certificate matching part with postifx? thank you in advance Stefan Am Mo., 17. Juni 2019 um 12:05 Uhr schrieb Emmanuel Fusté < emmanuel.fu...@exter

Re: authenticate o365 users with postfix without smtp auth

2019-06-17 Thread Emmanuel Fusté
Le 16/06/2019 à 22:37, Viktor Dukhovni a écrit : On Sun, Jun 16, 2019 at 05:46:52PM +0200, Stefan Bauer wrote: Some of our users use o365 but would like to use our service for outgoing mails. We are offering smtp sending services. Integrating our service in o365 is tricky, as one can only spe

Re: authenticate o365 users with postfix without smtp auth

2019-06-16 Thread Stefan Bauer
I'm glad you're asking. These are cloud-hosted domains at microsofts exchange online (o365) infrastructure. Each user can set outgoing routing to smarthosts(called connectors) in exchanges admin-center. But - as said, no smtp-authentication is offered. We're providing sending-capabilities paired

Re: authenticate o365 users with postfix without smtp auth

2019-06-16 Thread Jon Radel
> On Jun 16, 2019, at 6:38 PM, Bill Cole > wrote: > >> On 16 Jun 2019, at 16:27, @lbutlr wrote: >> >> On 16 Jun2019, at 12:05, Bill Cole >> wrote: > [...] >> >>> As the OP says, they support an outbound "smarthost" connector, >> >> >> Not a term I’ve heard before. > > The term "smarthost" dates

Re: authenticate o365 users with postfix without smtp auth

2019-06-16 Thread Bill Cole
On 16 Jun 2019, at 16:27, @lbutlr wrote: On 16 Jun2019, at 12:05, Bill Cole wrote: [...] As the OP says, they support an outbound "smarthost" connector, Not a term I’ve heard before. The term "smarthost" dates from the days when it was fairly common for some hosts to know more about h

Re: authenticate o365 users with postfix without smtp auth

2019-06-16 Thread Bill Cole
On 16 Jun 2019, at 14:33, Stefan Bauer wrote: Bill, yes thats the question. i would consider the two factors as reliable. MS is signing mails. i just like clear user authentication instead of rely on volatile ips/blocks, microsoft publishes/changes. what i need to check is also, whether MS

Re: authenticate o365 users with postfix without smtp auth

2019-06-16 Thread Viktor Dukhovni
On Sun, Jun 16, 2019 at 05:46:52PM +0200, Stefan Bauer wrote: > Some of our users use o365 but would like to use our service for outgoing > mails. We are offering smtp sending services. Integrating our service in > o365 is tricky, as one can only specify a smarthost but microsoft does not > offe

Re: authenticate o365 users with postfix without smtp auth

2019-06-16 Thread @lbutlr
On 16 Jun2019, at 12:05, Bill Cole wrote: > But they do. Wild. > As the OP says, they support an outbound "smarthost" connector, Not a term I’ve heard before. > This is not such an unusual requirement. I have worked with multiple > businesses whose regulatory compliance relies on having all

Re: authenticate o365 users with postfix without smtp auth

2019-06-16 Thread Peter
On 17/06/19 2:00 AM, Stefan Bauer wrote: we are running a small smtp relay service with postfix for authenticated users. Unfortunately office 365 does not offer any smtp authentication mechanism when sending mails via connectors to smarthosts. I can't believe I just looked up MS docs for you,

Re: authenticate o365 users with postfix without smtp auth

2019-06-16 Thread Stefan Bauer
Bill, yes thats the question. i would consider the two factors as reliable. MS is signing mails. i just like clear user authentication instead of rely on volatile ips/blocks, microsoft publishes/changes. what i need to check is also, whether MS allows spoofing of sender address. i need to make su

Re: authenticate o365 users with postfix without smtp auth

2019-06-16 Thread Bill Cole
On 16 Jun 2019, at 13:40, Stefan Bauer wrote: MS is publishing source ips/ranges. sasl_exeptions_networks seems an option but i still dont like the lack of authentication. So if you know that the SMTP client matches SPF (or a statically-set address set) for the sender domain AND the sender

Re: authenticate o365 users with postfix without smtp auth

2019-06-16 Thread Bill Cole
On 16 Jun 2019, at 13:18, @lbutlr wrote: On 16 Jun2019, at 10:48, Stefan Bauer wrote: [...] the last mile o365->recipient should go through our service like o365->postfix->recipient I do not believe any company, much less Microsoft, is going to sent emails from their users to other users t

Re: authenticate o365 users with postfix without smtp auth

2019-06-16 Thread Stefan Bauer
MS is publishing source ips/ranges. sasl_exeptions_networks seems an option but i still dont like the lack of authentication. Am Sonntag, 16. Juni 2019 schrieb Wietse Venema : > Stefan Bauer: >> its like the first: >> >> end-user client -> microsoft server -> postfix server -> remote recipient >

Re: authenticate o365 users with postfix without smtp auth

2019-06-16 Thread Wietse Venema
Stefan Bauer: > its like the first: > > end-user client -> microsoft server -> postfix server -> remote recipient How would Postfix know that the server is Microsoft Office 365? >From the reverse DNS? Wietse

Re: authenticate o365 users with postfix without smtp auth

2019-06-16 Thread @lbutlr
On 16 Jun2019, at 10:48, Stefan Bauer wrote: > our users send/receive via o365. That’s not what you said. You said "some of our users use o365 but would like to use our service for outgoing mails.” > the last mile o365->recipient should go through our service like > o365->postfix->recipient I

Re: authenticate o365 users with postfix without smtp auth

2019-06-16 Thread Stefan Bauer
its like the first: end-user client -> microsoft server -> postfix server -> remote recipient Am Sonntag, 16. Juni 2019 schrieb Wietse Venema : > Stefan Bauer: >> our users send/receive via o365. the last mile o365->recipient should go >> through our service like o365->postfix->recipient > > Dum

Re: authenticate o365 users with postfix without smtp auth

2019-06-16 Thread Wietse Venema
Stefan Bauer: > our users send/receive via o365. the last mile o365->recipient should go > through our service like o365->postfix->recipient Dumb question: is the mail flow like this: end-user client -> microsoft server -> postfix server -> remote recipient Or is it something else? - Local recip

Re: authenticate o365 users with postfix without smtp auth

2019-06-16 Thread Stefan Bauer
our users send/receive via o365. the last mile o365->recipient should go through our service like o365->postfix->recipient here, o365 does not offer smtp auth against postfix. Am Sonntag, 16. Juni 2019 schrieb @lbutlr : > On 16 Jun2019, at 09:46, Stefan Bauer wrote: >> some of our users use o365

Re: authenticate o365 users with postfix without smtp auth

2019-06-16 Thread @lbutlr
On 16 Jun2019, at 09:46, Stefan Bauer wrote: > some of our users use o365 but would like to use our service for outgoing > mails. we are offering smtp sending services. integrating our service in o365 > is tricky, as one can only specify a smarthost but microsoft does not offer > any kind of au

Re: authenticate o365 users with postfix without smtp auth

2019-06-16 Thread Benny Pedersen
Stefan Bauer skrev den 2019-06-16 17:46: some of our users use o365 but would like to use our service for outgoing mails. we are offering smtp sending services. integrating our service in o365 is tricky, as one can only specify a smarthost cyrus-sasl support rimap, if o365 users can use that ?

Re: authenticate o365 users with postfix without smtp auth

2019-06-16 Thread Stefan Bauer
some of our users use o365 but would like to use our service for outgoing mails. we are offering smtp sending services. integrating our service in o365 is tricky, as one can only specify a smarthost but microsoft does not offer any kind of authentication for smarthosts. so i'm asking if someone al

Re: authenticate o365 users with postfix without smtp auth

2019-06-16 Thread Viktor Dukhovni
On Sun, Jun 16, 2019 at 04:00:38PM +0200, Stefan Bauer wrote: > We are running a small smtp relay service with postfix for authenticated > users. Unfortunately office 365 does not offer any smtp authentication > mechanism when sending mails via connectors to smarthosts. There's a giant gap betwee

authenticate o365 users with postfix without smtp auth

2019-06-16 Thread Stefan Bauer
Hi, we are running a small smtp relay service with postfix for authenticated users. Unfortunately office 365 does not offer any smtp authentication mechanism when sending mails via connectors to smarthosts. how could one protect smtp submission in another way? without authentication, everyone fr