Re: autocreatequota - does it really work?

[Voutsinas Nikos]

Ken Murchison wrote:

I'll let the CMU guys respond for themselves, but the createonpost
feature seems problematic if your MTA doesn't verify the legitimacy of
the recipient address before passing it to lmtpd.  The only way that
lmtpd knows if a recipient is allowed or not is if the INBOX for that
user exists.  With createonpost enabled, you'll get INBOXes created for
every damn address that a spammer tries in your domain.

Now, if you're MTA does user lookups in LDAP, MySQL, etc, then this is a
non-issue.

Thanks Ken for pointing out this issue,

To clear things out, RFC 821 requires [or at least encourage] the verification of recipient's address by the SMTP/MTA/MSA server:


The second step in the procedure is the RCPT command.

RCPT <SP> TO:<forward-path> <CRLF>

This command gives a forward-path identifying one recipient.
If accepted, the receiver-SMTP returns a 250 OK reply, and
stores the forward-path. If the recipient is unknown the
receiver-SMTP returns a 550 Failure reply. This second step of
the procedure can be repeated any number of times.



Configurations where user's verification is not even attempted [eg due to bad-implemented MTA] do not worth considering.

Now on the other hand, using the INBOX existence or not as a criterion is problematic for the cases where the MTA is able to verify the user validity. I understand that this solution is a byproduct of the fact that cyrus-imap/cyrus-sasl provides many alternatives as far as the type of the users' database is concerned [WITCH IS A GREAT FEATURE]. So checking the existence of the inbox is just an easy way out, and "fail safe".

Createonpost feature is not where the problem lies, but rather it provides a solution. For the time being i think that if someone uses the right combination of MTA and user's database, can take advantage of it. [As Ken said :)]

Nikos Voutsinas