Hello!
On current SmarterMail release, Webmail users have the right to add a SMTP account setting local SmarterMail SMTP server without enabling the authentication and providing any other local or not local email address (also a not-existent fake address) as From address.
SmarterMail allows to send messages from that address through itself without checking if the webmail user is authorized to use it, also if the "Require auth match" is set to "Email address" under the server protocols settings.
So, for example, that webmail user can send a fraud message spoofing itself as the boss of the company, or another work colleague, or anyone else. And if the destination address resides inside the same SmarterMail server, it will be almost impossibile to discover the fraud.
IMHO, if in SmarterMail the "Require auth match" option is enabled (set to "Email address" or "Domain"), this important security policy must be valid also using the Webmail service and not only when the user works with an external email client.
Morover, if "Require auth match" option is set to "Email address", if the address is included in an alias, on current release the alias will be available and usable as "From address" only using webmail, but not using an external client.
My two questions/proposals are:
- it is possible to improve the internal security without bypass the "Require auth match" when a user set local SmarterMail SMTP server as an additional SMTP account?
- it is possible to make the "Require auth match" option able to check and authorize the relay also for the aliases of a user?
Thank you.
Daniele