Securing Postfix?

[VanDaMe]

I have follow your instruction on http://www.howtoforge.com/virtual_us...ix_debian_etch and it's works GREAT!

However I got few questions

1. User still able to sending email without auth
2. When I tried to use option My outgoing smtp requires auth, I can't send email

thank's before for your help

[_X_]

if you have:
postconf -e 'smtpd_sasl_auth_enable = yes'
postconf -e 'broken_sasl_auth_clients = yes'
postconf -e 'smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination'

in your postix config then you shouldn't be able to send mail without auth and enabling My outgoing smtp requires auth should work

[falko]

Originally Posted by VanDaMe

I have follow your instruction on http://www.howtoforge.com/virtual_us...ix_debian_etch and it's works GREAT!

However I got few questions

1. User still able to sending email without auth

Authentication is not needed if
- you're sending emails to recipients on that server
- you're logged in on that server (for example by using webmail)
- are sending from an IP address listed in mynetworks in /etc/postfix/main.cf.

2. When I tried to use option My outgoing smtp requires auth, I can't send email

thank's before for your help

What's in your mail log?

[VanDaMe]

Originally Posted by falko

Authentication is not needed if
- you're sending emails to recipients on that server
- you're logged in on that server (for example by using webmail)
- are sending from an IP address listed in mynetworks in /etc/postfix/main.cf.

on main.cf, i only set mynetworks to 127.0.0.1/8
I'm sending using outlook
If sending to onother email such as yahoo.com, mail.log shows me
Relay access denied --> seems to be good
But if I using same auth, can't send email.

What's in your mail log?

Nov 3 09:28:06 mp-fs-13 postfix/smtpd[23876]: connect from unknown[my.ip.address]
Nov 3 09:28:06 mp-fs-13 postfix/smtpd[23876]: lost connection after UNKNOWN from unknown[my.ip.address]
Nov 3 09:28:06 mp-fs-13 postfix/smtpd[23876]: disconnect from unknown[my.ip.address]

[VanDaMe]

here's the output on postconf -n

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
inet_interfaces = all
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
mydestination = localhost, localhost.localdomain
myhostname = my.domain.com
mynetworks = 127.0.0.0/8
myorigin = /etc/mailname
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $relay_domains $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $transport_maps $mynetworks $virtual_mailbox_limit_maps
recipient_delimiter = +
relayhost =
smtp_tls_session_cache_database = btree:${queue_directory}/smtp_scache
smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_tls_cert_file = /etc/postfix/smtpd.cert
smtpd_tls_key_file = /etc/postfix/smtpd.key
smtpd_tls_session_cache_database = btree:${queue_directory}/smtpd_scache
smtpd_use_tls = yes
transport_maps = proxy:mysql:/etc/postfix/mysql-virtual_transports.cf
virtual_alias_domains =
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql-virtual_forwardings.cf, mysql:/etc/postfix/mysql-virtual_email2email.cf
virtual_gid_maps = static:5000
virtual_mailbox_base = /home/vmail
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql-virtual_domains.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailboxes.cf
virtual_uid_maps = static:5000

[falko]

Are there any other errors in your mail log?

[VanDaMe]

Nothing else. What we got is only

Nov 3 09:28:06 mp-fs-13 postfix/smtpd[23876]: connect from unknown[my.ip.address]
Nov 3 09:28:06 mp-fs-13 postfix/smtpd[23876]: lost connection after UNKNOWN from unknown[my.ip.address]
Nov 3 09:28:06 mp-fs-13 postfix/smtpd[23876]: disconnect from unknown[my.ip.address]

[falko]

What's the output of

telnet localhost 25

and then

ehlo localhost

?

[VanDaMe]

mp-fs-13:~# telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 my.hostname.com ESMTP Postfix (Debian/GNU)
ehlo localhost
250-my.hostname.com
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH LOGIN PLAIN
250-AUTH=LOGIN PLAIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
quit
221 2.0.0 Bye
Connection closed by foreign host.

[falko]

Looks ok. Have you tried to restart Postfix and Saslauthd?