How to disable open relay on Postfix?

[tuananh87vn]

Hi everyone,

Open relay, yet again, concerns me. I followed the Falko's guide on installing Debian postfix with some other stuff, things've been running cool, except for the open relay problem. As I configure MS Outlook to test email, even with no password, the test emails can still be sent. A open relay problem, isn't it?

I've tried several ways to disable it, but none worked. Can anybody help me out?

Thx alot ^^

[falko]

You can test your server here: http://www.spamhelp.org/shopenrelay/

[tuananh87vn]

Hi,
I've tried the test, the result said my smtp server is NOT an open relay. Seems like I have a misunderstanding here:

Outsiders (who are unauthenticated) cannot use my smtp server to send email to other server (or to relay mails). That's why my server is not considered an open relay.

However someone can still INJECT mails into my server (i.e: send mails to some users) as anonymous sender, right? Sometimes emails sent in this way is blocked as spam, sometimes, they are passed CLEAN. So how to prevent it? Is it something like using "smptd_client_restriction" or "smtpd_sender_restriction"?

thx alot!

[falko]

There are two scenarios where users don't have to authenticate:
1) You send to a rdcipient who is on the server.
2) You send from a client whose IP is listed in mynetworks in /etc/postfix/main.cf.

[tuananh87vn]

Originally Posted by falko

There are two scenarios where users don't have to authenticate:
1) You send to a rdcipient who is on the server.
2) You send from a client whose IP is listed in mynetworks in /etc/postfix/main.cf.

Hi,
For the 2nd scenario, it is likely for those who are logged into the system (as mynetworks specifies 127.0.0.1/8)

But for the 1st one, although i've placed some restrictions on client (like, client must be from user list), chances are that somebody who knows the emails of some users within the server still use them to spam the server itself. In this case, is it possible to force smtp authentication to any user who wants to use smtp service? (like Gmail, it forces its users to authenticate themselves before doing anything)

[tuananh87vn]

No reply?
I'm really stuck

[dstomov]

Hi,

I have similar problem (or may be the same). I use ubuntu 9.10 with ispconfig3. Now anyone can use my server on port 25 to send emails to the email boxes on my server. I want to know how to stop this. If the email is not for mines mail boxes there is response '5.7.1 Relay access denied', which is good, but when it is for my boxes is not good.

[minhnghivn]

Try adding the following to your main.cf:

smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sender_restrictions = reject_unknown_sender_domain

This help prevents any one from sending mail through your server without logging in first.