Hello everyone.

 

I have a bug that I found in SmarterMail 14.1.5675. I uncovered a bug in SmarterMail that I am not sure the devs know about or not. So if this has been addressed in a newer update please let me know.

 

Here's the situation, we have a domain that is currently being migrated to another service. Under instruction of their tech team I disabled the domain on our mail server so that the users would be forced to log into the new mail service as opposed to using our mail server. They don't want to have the domain removed yet off our server. They might want to migrate their history if they need it.

 

So all is well, I selected to have the domain disabled on our server. That would stop any new email and any from user logging in. I checked the stats this morning on that domain and I see successful user login for today. Not all accounts but about 7 of them. I disabled the domain yesterday. So looking through my POP logs I found that the accounts that have last login activity are all using Apple products,  the log lists APOP for successful login. I see login attempts for another user that got rejected. Most likely another email client. Which is what I would expect to see. But why did SmarterMail allow the Apple login?

 

Here's a snippet of my POP log from this morning: (mind you the domain has been disabled for half of a day already)

 

[2015.11.12] 00:00:14 [73.XXX.66.XXX][14585249] connected at 11/12/2015 12:00:14 AM
[2015.11.12] 00:00:14 [73.XXX.66.XXX][14585249] USER user1@XXXXXXXXXX.com
[2015.11.12] 00:00:14 [73.XXX.66.XXX][14585249] PASS XXXX
[2015.11.12] 00:00:14 [73.XXX.66.XXX][14585249] -ERR UserName or Password is incorrect
[2015.11.12] 00:00:14 [73.XXX.66.XXX][14585249]  login failed
[2015.11.12] 00:00:31 [73.XXX.66.XXX][14585249] disconnected at 11/12/2015 12:00:31 AM
[2015.11.12] 00:04:05 [70.XXX.66.XXX][18118454] connected at 11/12/2015 12:04:05 AM
[2015.11.12] 00:04:05 [70.XXX.66.XXX][39484429] connected at 11/12/2015 12:04:05 AM
[2015.11.12] 00:04:05 [70.XXX.66.XXX][18118454] APOP user2@XXXXXXXXXX.com ce0f070989caa222d03f72350e71ab7d
[2015.11.12] 00:04:05 [70.XXX.66.XXX][18118454] user2@XXXXXXXXXX.com logged in

 

So user1 is most likely using a email client either on a PC or a different device other than an Apple product and got the rejection notice. Which is what I would expect to see because of the disabled domain. Now user2 is using a Apple product and is allowed the connection, even though the domain is disabled.

 

So why was the connection for user2 allowed?

 

What I am going to do as a workaround is disable those accounts, but I wanted to bring this forward in case the devs are not aware of it. This definitely needs to be addressed.