WampServer

where and how i install the mail\smtp...?

in the instalation i remember it asked me and i just clicked on ok...

[guides.jlbn.net]

how i change those settings now?



Edited 2 time(s). Last edit at 02/29/2008 03:17PM by sasha.

when user trying to register
the media wiki shows:

"failed to connect to mailserver at "localhost" port 25
verify your smtp and smtp_port setting in php.ini() or use_ini_set

You can setup mail parameters in php.ini in apache2/bin directory. Directives you want to look for
are SMTP, smtp_port, sendmail_from, sendmail_path. Or you can setup mail in php code.

Important: You need to have a mail server installed and working. You can use IIS SMTP mail server or download Java mail servers.

Be careful w/ mail server, even just for testing, because the second, not even minute, your mail server up, spammers' spybots can detect and use your mail server for their purposes and you, yes YOU, are the one who take all responsibilities for their actions, in worst case you might be sentenced in jail :-(

Every day, my mail server's black list is full of spammers' ip and even I keep updating w/ anti-spammers' sources, they keep changing their proxy ip's in order to attack people's mail servers, of course including mine :-(

Have you ever seen something like these:

[www.google.com]

[www.google.com]

I'm in US, but you can see those mails were sent out under my mail server and from RUSSIA and THAILAND :-(

Even your ISP might allow you to send out a certain messages per month in order to prevent you to become a spammer, but the problem is spammers' spy bots would detect your send-mail-form and keep attach your ISP mail server until the point that your ISP have to terminate your service, or worst case, try to charge you for their damages :-(

That's the reason why I'm thinking about complete shut down my mail server and use some free SMTP mailserver services out there and let them deal w/ spammers ;-)

Have fun,

FREE One A Day
FREE Photo
FREE Games
FREE Websites
FREE Portable GPS
FREE WAMP Guides

Hi,

If you only send emails from your WAMP server through another SMTP server, you do not need to open TCP port 25 on your WAMP box. Then of course the Reply-To address in the messages your server sends has to point to an existing mailbox you can access.

If you 'know your jungle', can safely send emails from your web server though your ISP's SMTP server or your corporate mail server.


The first link below shows in detail how the baddies perform the email injections using unsecure forms.
Check out the second link to see more examples how you can protect your scripts from the attacks which utilise the well known weaknesses in the MIME and SMTP standards:

1. [nyphp.org]

2. [www.mailinjection.com]

Regards,

toivo
Sydney, Australia

He he... he he... ;-)
The idea is good and I did not say that you can't have mail server, just be careful w/ it, since most people want to have mail server so they can use it w/ their free scripts such as Joomla, WordPress, MediaWiki, phpBB, so on; however, a lot of people is not good enough to actually modify those free scripts in order to prevent spammers, so this is just a friendly reminder since you have the right to chose your own path ;-)

Have fun,

FREE One A Day
FREE Photo
FREE Games
FREE Websites
FREE Portable GPS
FREE WAMP Guides

i need the mail sender only for register\forgot password...phpbb\mediawiki
i am not gonna give away free mail acount for shareware use...an i will try to gard those applications from spammers...

how i can open a port 25 on wamp box?
and what details do i need to change inside php.ini?

Hi,

If you do not run an SMTP server, you do not need to open the TCP port 25 at the Windows firewall to the outside world. Of course, if you run an SMTP server, your router needs to forward the STMP or port 25 packets to the internal IP address of your SMTP server. The mail server application will listen on port 25 and process the incoming messages.

The php.ini file is not concerned with mail server settings. The STMP settings in the php.ini file specify for the mail() function the IP address and port where to send messages.

Regards,

toivo
Sydney, Australia

Just as I've said, you have the right to choose your own path. Just remember that spammers will NOT ask you for permission to use your mail server and the second your mail server is up, they would use it even before you know how to use your own mail server. Without your knowledge, spammers' auto software will auto setup mail accounts and use them for their purposes, so don't think that they can only use your mail server only when you grant them permission (ie. give out free emails as you thought)

As seen in my example above, we're using mail server b/w our group members only and most of group members are in US except 1 in China, 1 in Japan, and 1 in France, but mails were sent out under our mail server and from Thailand and Russia :-(

Anyway, no pain no gain, no practice no success, so good luck ;-)

Have fun,

FREE One A Day
FREE Photo
FREE Games
FREE Websites
FREE Portable GPS
FREE WAMP Guides

Hi,

Assuming that you are not running a mail server (SMTP server) in the WAMP box, there is no way spammers can break into anything whatsoever.

On the other hand, spammers can send their spam messages to any mailbox they like, including the mailbox to which you receive responses from the users of your WAMP based web application. Also, if you have an existing mailbox which has been included in the mailing lists peddled by spammers and other criminals, your mailbox may end up as a forged origin of spammed messages.

If you have published your email address on the web or perhaps if the name of your mailbox is a word in the dictionary or a common name like john.smith@example.com, you will get truck loads of spam, unless your service provider scans the incoming messages addressed to you with an anti-spam filter.

There is not much anyone else than ISPs controlling all the email traffic and the governments with enough motivation to legistlate and enforce adequate anti-spam laws can do to curb the activities of marketing companies and businesses leeching their profits from spam (and spyware, but that is a different story, check out my take on spyware at [totaldata.biz]).

If you are worried about automated bots registering as users in your forum, you can eliminate bots by installing an extension that supports the CAPTCHA challenge-response verification in the registration process, see details at [en.wikipedia.org].

Even if your registration forms were secure (see yesterday's post in this thread), your CMS or forum application should always send an activation email to newly registered users, to make sure that a real human with an existing mailbox has signed up.

These measures alone do not prevent someone from trying to manually register a fake username with someone else's email address, just to annoy them with the automatic activation email. Without enforcing the use of ID cards or fingerprint readers, and especially with current limited support from ISPs and governments, there are practical limits to what the technology can do in cases like online identity theft, other than logging the IP address and the hostname where the registration came from. Particularly if there is a chance the IP address and hostname have been anonymized, sigh...


Regards,

toivo
Sydney, Australia

Well, here is a solution,

To activate SMTP I decided to not run a mail server (since I had no need for one) and instead try to find an SMTP-only server. This solution allows you to send email without opening any ports to the outside, since all you will be doing from your box is outgoing connections through port 25.

There are several SMTP-only servers. Freeware and shareware. I was interested in a freeware one. Of those few I tested, I quickly realized I couldn't get that to work. This because my ISP, wisely I may add, blocks all outgoing connections from its customers on port 25.

So, I turned to the next best thing. A SMTP forwarder. Some application that allowed me to forward my smtp requests to my ISP.

The solution for me was Mobile TCP at [www.ko2000.nu] . An handy tool for laptops that are on the move, but that can also be used for these purposes.

Easy to setup; All I needed was to create a new network on the settings menu item and provide it with my local IP and my ISP smtp server.

The downside to this setup is that there will be a small delay when a script needs to send email since you will need to wait to be authenticated at your provider. But that is a price I was willing to pay.

Do not forget to change your php.ini, if you haven't already and remember that since you are using PHP on windows, you should use '/r/n' as newline characters on your message body, instead of just bare LFs. (see, [cr.yp.to] for an example of an MTA that would refuse your message)

as a matter of fact, i never set smtp on my server before.
i found that tutorial
[www.endlesscomputer.com]
i followed the instructions and now my questions are:
1)how\where i need to change\modify the mail settings in wamp
2)can spammers open a mail acount using my server now? without my premmision

Hi marfig,

Interesting to find out that there are SMTP-only servers, or send-only mail servers. Is that not the same as SMTP forwarder? As you say, ISPs nowadays block outgoing connections from their customers on port 25 - to other destinations than their own STMP server.

However, I am not sure what the benefits are in the STMP-only or forwarding approach. Your PHP script uses mail(), phpMailer or some other mail routine and therefore creates a direct socket connection both to the ISP's SMTP server when using the mail() function, and to localhost when you are using a forwarder.

Regards,

toivo
Sydney, Australia

Hi sasha,

First of all, you cannot run IIS and WAMP (Apache) in the same server. The SMTP settings are in the php.ini file. Search for SMTP and you will find them. The explanation of the settings can be found in the PHP reference manual at [php.net].

You need to understand in detail how to protect your system from email injections in forms where users can enter information into your system. if you know how HTML forms work with the web server and how to program in PHP, follow the links given earlier in this thread to security information. If you are not fully skilled in this area, you need to get someone who knows his way around PHP to assist you.

Regards,

toivo
Sydney, Australia

Hi toivo,

There is indeed a difference between the two. SMTP only servers are perhaps today just not as useful as they were before. I believe these were always common on *NIX machines. Another, somewhat discombobulated example of a SMTP only server in Windows is the IIS Virtual SMTP Server. I have to say SMTP servers won't be missed the day they die ISPs worldwide are seeing to it.

Forwarders, on the other hand, function in the way you know. Their main purpose is to allow laptops that travel a lot without having to manually change the mail client smtp settings everytime (the same purpose falsely announced by smtp servers targeting the end user market).

Meanwhile I would love for you to enter into a bit more detail on phpMail. I'm not confident in the Linux world and I installed WAMP because I'm doing the move from ASP to PHP. So, everything new I can learn will be a bonus.

---
Hi Sasha,

You open your php.ini file from the WAMP menu under PHP. You modify the following two lines under the [[mail function] header:
SMTP = localhost
sendmail_from = xpto@xpto.xpto

You then restart Apache. It's also a good idea to restart Mobile TCP after having set it up.

As for your security concerns, Toivo addressed them already. However I'll add to that the fact you are not running a server and opening any port to the outside by doing this. You are only accepting connections on port 25 from your trusted network (on your case, localhost) and then doing an outgoing connection to your ISP.

So this is just like sending a regular email to your ISP through your mail client. The only difference is that your port 25 was never involved.


toivo Wrote:
-------------------------------------------------------
> Hi marfig,
>
> Interesting to find out that there are SMTP-only
> servers, or send-only mail servers. Is that not
> the same as SMTP forwarder? As you say, ISPs
> nowadays block outgoing connections from their
> customers on port 25 - to other destinations than
> their own STMP server.
>
> However, I am not sure what the benefits are in
> the STMP-only or forwarding approach. Your PHP
> script uses mail(), phpMailer or some other mail
> routine and therefore creates a direct socket
> connection both to the ISP's SMTP server when
> using the mail() function, and to localhost when
> you are using a forwarder.
>
> Regards,

@ toivo
I really don't want to start a flamewar w/ you or so, especially I've already stated that the users have the right to choose their own paths. If they like to have their own mail server, nobody can stop them. Here I only remind them to be careful when having a mail server running on their own computer since NOT all users are a good coder like you that can do something to protect their own mail server

@ sasha
If you've already setup mail server and w/o any protections as toivo's suggestions, your mail server might be already worked for spammers. Try to do some thorough research, you might catch some mails already sent out under your mail server, of course w/o your permission and mostly from somewhere that you never thought of :-(

Have fun,

FREE One A Day
FREE Photo
FREE Games
FREE Websites
FREE Portable GPS
FREE WAMP Guides

I need to set it for sending mails only(the phpbb will send mails to users)
it wont be able to recieve them...

if i cant run IIS and WAMP together then running smtp on wamp=changing the php.ini details??

the mail smtp will than be local host?

you can set them up together. just need to set them on different ports..



maybe look at an easier way if thats the only email you want to send. you can use a free website that will send an email for you. all you do is fill in there link as the action in your php script


look at this link here>>>[www.response-o-matic.com]

If you don't setup mail and MX records properly, all you mails sent will be ended up in Junk/Spam folders of user email accounts such as Yahhoo, hotmail, gmail, etc. The users don't even notice they got mails from you.