SMTP Fixup and SMTP AUTH 1

[pixboy]

I know there's been many posts on the Pix firewall's SMTP fixup command. However, the vast majority seem to be dealing with issues related to Exchange servers. We use Netscape Messaging Server (3.6 in production, and I'm testing 4.15).

Right now, our mail server is outside the firewall. On my testing box, which is inside the firewall, I realized that the SMTP fixup command is preventing the use of SMTP's AUTH, since it restricts the session to straight SMTP, and not ESMTP. (And, no, this isn't one of those port 113 IDENT things.)

Our mail server requires that you either pass the AUTH test or match a predefined list of IP addresses that can relay. (My testing box is the same way, even though it's implemented differently. That's because Netscape Messaging Server 4.15 can do it at the protocol level, rather than at the post-SMTP receive stage. Much nicer!)

Here's my overall question -- What is the danger in turning off the SMTP fixup in our situation? I have two mail servers (both Netscape, not including my testing box) behind our firewall already, and I don't want to open them up to potential problems. I've seen several mentions of "not-so-nice" SMTP commands that would be permitted, but I'd like to know what impact they might have. Any thoughts would be greatly appreciated.

Thanks!

 

[yizhar]

HI

I think that if your mail server is patched with latest fixes, configured properly, and if you need the additional commands, then you can disable the smtp fixup on the pix.

It is still much better then placing the mail server out there on the jungle.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[pixboy]

Yizhar:

Thanks for being the voice of reason and knowledge. I was pretty sure things would be OK if I disabled the fixup.

I just have to check the other two mail servers that are already behind the Pix to make sure they're at least up-to-date. (We have another one that's already outside, and I'm pretty sure the other two are at the same patch level and all, so things should be OK.)

Thanks!

 

[berford]

I'd agree with Yizhar here. In addition you can configure soecific mail services on the mail server. Patch it and also look at the configuration.