Canon Color Network UFR Printer Kit-C1, Руководство по обслуживанию

Страница: 58 / 122

Chapter 2
2-6
<Authentication mechanism>
In the POP server, multiple authentication mechanisms can be possessed and the authentication mecha-
nism is set according to the security policy which the server administrator decides. E-mail client applica-
tion selects the authentication algorism from the specified authentication algorism and performs the
authentication at the transmission. This device supports the following authentication algorism.
CRAM-MD5
Challenge-Response Authentication Mechanism calculated using MD5 algorism with the key based on the
HMAC-MD5 (RFC2104).
Note:
Currently, POP AUTH server in the field are mostly made by Microsoft and NTLM authentication is
used. CRAM-MD5 is installed, but there is no server which the operations are checked, so the evaluation
has not performed. For this reason, POP AUTH operations with CRAM-MD5 are not supported.
NTLM
Authentication method of Windows NT
User name has to be set in the form of "User name@ NT domain name".
Example:
Windows2000 or former: User name\\CANON (Domain name can be omitted according to the
environment.)
Windows 2000: User name@canon.co.jp (Domain name can be omitted according to the environment.)
PLAIN
Authentication method that user name and password are transmitted in plaintext (BASE64 encode) and the
packet is encrypted. (RFC2595) By applying with the later "Encrypted transmission", the authentication
is secured.
LOGIN
User name and password are transmitted in plaintext (BASE64 Encode). Actual method of communicating
information is same as PLAIN. By applying with the later "Encrypted transmission", the authentication is
secured.
Note:
When SSL is not operated, the authentication of PLAIN and LOGIN is not encrypted, so there is no
difference from the authentication of the plaintext USER/PASS. For this reason, there is no meaning of
using POP AUTH. This operation gives misunderstanding that it is encrypted, so operations with POP
AUTH are prohibited.
< POP AUTH reception operations>
Even POP AUTH is set to be used for receiving, if the mail server does not support POP AUTH, the server
supporting-authentication method and the device supporting-authentication method are different, the re-
ception with POP AUTH is impossible. In this case, "POP AUTH Encryption Error" is displayed on the
status line.
<Authentication protocol example>
Examples of transmission protocol when using POP AUTH are shown below.
With the CAPA response from the client, supporting SASL is informed from the server. At this time, us-
able authentication algorism is described. If multiple authentication algorisms are possessed, multiple al-
gorism names are described. Client selects one algorism from the authentication algorisms which the
server informed and the selected authentication algorism is informed to the server. The server sends the
server challenge data, and performs authentication by returning this data and the encrypted data created
from the user name and password as a response. Generally, the authentication algorism can be selected on
the server side whether to be used. If it is not suitable to be used for the security, it can be prohibited by
the settings on the server side. (Security policy can be determined by the server.)
Server: +OK POP3 v2001.78 server ready <4a61.3e55cd70@test.canon.co.jp>
Client(iR): CAPA
S: +OK Capability list follows:
S: TOP
S: LOGIN-DELAY 180
S: UIDL
S: STLS
S: USER
S: SASL CRAM-MD5 LOGIN
S: .