RFC 2245

Anonymous SASL Mechanism

📅 published November 1997, from ietf

RFC 2245: Anonymous SASL Mechanism 🎀

Okay bestie, here's the title block tea ☕ This is RFC 2245, and it's called Anonymous SASL Mechanism. Chris Newman from Innosoft wrote it. It's a Standards Track doc, dated November 1997. The title block doesn't list anything it obsoletes or updates, so no drama there 💅

Status of this Memo 📜

This doc is an Internet standards track protocol for the Internet community, and it wants feedback and suggestions for making it better 💖 For the current standardization state and status of this protocol, check the "Internet Official Protocol Standards" (STD 1) list 🔍 Distribution of this memo is unlimited, so share it with everyone 🦋

Copyright Notice ©️

Abstract ✨

Okay so it's super common on the Internet to let people in anonymously to all kinds of services 🌈 Back in the day, this was done with a plain text password mechanism where the user name was anonymous and the password was optional trace info, like an email address 🍓 But plaintext login commands aren't allowed in new IETF protocols anymore 🙈 So we need a new way to do anonymous login inside the SASL [SASL] framework. Iconic glow-up, honestly ✨

1. Conventions Used in this Document 🦋

Lowkey the most important part: the key words MUST, MUST NOT, SHOULD, SHOULD NOT, and MAY in this doc mean exactly what they're defined to mean in "Key words for use in RFCs to Indicate Requirement Levels" [KEYWORDS]. Read them like the rules they are 🫶

2. Anonymous SASL mechanism 🌸

The mechanism name for anonymous access is ANONYMOUS. It's giving simplicity: it's just one message, from the client to the server 💅 The client can send optional trace info, which is a human readable string. That trace info should be one of three things: an Internet email address, an opaque string that doesn't contain the @ character and can be understood by the system administrator of the client's domain, or nothing at all. For privacy reasons, an Internet email address should only be used with the user's permission 🔐

A server that allows anonymous access will announce support for the ANONYMOUS mechanism, and let anyone log in with it, usually with restricted access 🧚

Here's the formal grammar for the client message, written in Augmented BNF [ABNF] 🤓

message         = [email / token]

TCHAR           = %x20-3F / %x41-7E
                  ;; any printable US-ASCII character except '@'

email           = addr-spec
                  ;; as defined in [IMAIL], except with no free
                  ;; insertion of linear-white-space, and the
                  ;; local-part MUST either be entirely enclosed in
                  ;; quotes or entirely unquoted

token           = 1*255TCHAR

3. Example 🧚‍♀️

Here's a sample anonymous login between an IMAP client and server 💖 In this example, "C:" means lines sent by the client and "S:" means lines sent by the server. If lines get wrapped without a new "C:" or "S:" label, the wrapping is just for editorial clarity and isn't part of the command 🙈

This example uses the IMAP profile [IMAP4] of SASL. The base64 encoding of challenges and responses, plus the "+ " in front of responses, are part of the IMAP4 profile and not SASL itself 🎀 Newer SASL profiles will include the client message right in the AUTHENTICATE command, so the extra round trip (where the server replies with an empty "+ ") can be skipped 🔥

In this example, the user's opaque identification token is sirhc 🌈

     S: * OK IMAP4 server ready
     C: A001 CAPABILITY
     S: * CAPABILITY IMAP4 IMAP4rev1 AUTH=CRAM-MD5 AUTH=ANONYMOUS
     S: A001 OK done
     C: A002 AUTHENTICATE ANONYMOUS
     S: +
     C: c2lyaGM=
     S: A003 OK Welcome, trace information has been logged.

4. Security Considerations 💀

This part is serious, bestie 😭 The anonymous mechanism lets anyone access information. That's why it should be disabled by default, so the administrator can make a deliberate choice to turn it on 🔒

If anonymous users have any write privileges, a denial of service attack is possible by filling up all the available space. You can prevent this by disabling all write access for anonymous users 🛑

If anonymous users have read and write access to the same area, the server can become a communication channel for anonymously exchanging information 👀 Servers that accept anonymous submissions should implement the common "drop box" model, which forbids anonymous read access to the area where anonymous submissions are accepted 📦

If anonymous users can run many expensive operations (for example, an IMAP SEARCH BODY command), this could enable a denial of service attack 🥵 Servers are encouraged to limit the number of anonymous users and lower their priority or limit their resource usage 💜

If there's no idle timeout for anonymous users and there's a limit on how many anonymous users can connect, a denial of service attack is enabled 😱 Servers should implement an idle timeout for anonymous users ⏳

The trace information is not authenticated, so it can be falsified. This can be used to try to get someone else in trouble for accessing questionable information. Administrators trying to trace abuse need to realize this information may be falsified 🚨

A client that uses the user's correct email address as trace info without explicit permission may violate that user's privacy 🙈 Information about who accesses an anonymous archive on a sensitive subject (for example, sexual abuse) has strong privacy needs. Clients should not send the email address without the user's explicit permission, and they should offer the option of sending no trace token at all, which only exposes the source IP address and time 🫣 Anonymous proxy servers could enhance this privacy, but they would have to consider the resulting potential denial of service attacks 🌸

Anonymous connections are susceptible to man in the middle attacks that can view or alter the data being transferred 😨 Clients and servers are encouraged to support external integrity and encryption mechanisms 🔐

Protocols that don't require an explicit anonymous login are more susceptible to break-ins, given certain common implementation techniques 🚪 For example, Unix servers that offer user login may start up as root and switch to the appropriate user id after an explicit login command. Normally, these servers refuse all data access commands before an explicit login and may enter a restricted security environment (for example, the Unix chroot function) for anonymous users 🛡️ If anonymous access isn't explicitly requested, the entire data access machinery is exposed to external security attacks without a chance for explicit protective measures 💀 Protocols that offer restricted data access should not allow anonymous data access without an explicit login step 🫶

5. References 📚

[ABNF] Crocker, D. and P. Overell, "Augmented BNF for Syntax Specifications: ABNF", RFC 2234, November 1997.
[IMAIL] Crocker, D., "Standard for the Format of Arpa Internet Text Messages", STD 11, RFC 822, August 1982.
[IMAP4] Crispin, M., "Internet Message Access Protocol - Version 4rev1", RFC 2060, December 1996.
[KEYWORDS] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", RFC 2119, March 1997.
[SASL] Myers, J., "Simple Authentication and Security Layer (SASL)", RFC 2222, October 1997.

6. Author's Address 🖊️

Chris Newman Innosoft International, Inc. 1050 Lakes Drive West Covina, CA 91790 USA

Email: chris.newman@innosoft.com

Okay, the legal bits: this document and translations of it may be copied and furnished to others. Derivative works that comment on or explain it, or help with implementing it, may be prepared, copied, published, and distributed, in whole or in part, without restriction of any kind, as long as the above copyright notice and this paragraph are included on all such copies and derivative works 📄 However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations. The exception is for developing Internet standards, where the procedures for copyrights defined in the Internet Standards process must be followed, or for translating it into languages other than English 🌍

The limited permissions above are perpetual and won't be revoked by the Internet Society or its successors or assigns ♾️

This document and the information in it is provided on an "AS IS" basis, and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE 🫶

📦 where this page comes from

ietf: rfc2245 1997-11
💖 girlified by claude-haiku-5-5 on 2026-10-15: a language model's rewrite of the original, under its terms