Go Back   HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials > Linux Forums > Server Operation

Do you like HowtoForge? Please consider supporting us by becoming a subscriber.
Reply
 
Thread Tools Display Modes
  #1  
Old 25th March 2010, 02:49
tuananh87vn tuananh87vn is offline
Member
 
Join Date: Sep 2009
Posts: 39
Thanks: 8
Thanked 0 Times in 0 Posts
Default How to disable open relay on Postfix?

Hi everyone,

Open relay, yet again, concerns me. I followed the Falko's guide on installing Debian postfix with some other stuff, things've been running cool, except for the open relay problem. As I configure MS Outlook to test email, even with no password, the test emails can still be sent. A open relay problem, isn't it?

I've tried several ways to disable it, but none worked. Can anybody help me out?

Thx alot ^^
Reply With Quote
Sponsored Links
  #2  
Old 26th March 2010, 02:25
falko falko is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 41,701
Thanks: 1,900
Thanked 2,741 Times in 2,575 Posts
Default

You can test your server here: http://www.spamhelp.org/shopenrelay/
__________________
Falko
--
Download the ISPConfig 3 Manual! | Check out the ISPConfig 3 Billing Module!

FB: http://www.facebook.com/howtoforge

nginx-Webhosting: Timme Hosting | Follow me on:
Reply With Quote
  #3  
Old 26th March 2010, 06:38
tuananh87vn tuananh87vn is offline
Member
 
Join Date: Sep 2009
Posts: 39
Thanks: 8
Thanked 0 Times in 0 Posts
Default

Hi,
I've tried the test, the result said my smtp server is NOT an open relay. Seems like I have a misunderstanding here:

Outsiders (who are unauthenticated) cannot use my smtp server to send email to other server (or to relay mails). That's why my server is not considered an open relay.

However someone can still INJECT mails into my server (i.e: send mails to some users) as anonymous sender, right? Sometimes emails sent in this way is blocked as spam, sometimes, they are passed CLEAN. So how to prevent it? Is it something like using "smptd_client_restriction" or "smtpd_sender_restriction"?

thx alot!
Reply With Quote
  #4  
Old 27th March 2010, 12:29
falko falko is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 41,701
Thanks: 1,900
Thanked 2,741 Times in 2,575 Posts
Default

There are two scenarios where users don't have to authenticate:
1) You send to a rdcipient who is on the server.
2) You send from a client whose IP is listed in mynetworks in /etc/postfix/main.cf.
__________________
Falko
--
Download the ISPConfig 3 Manual! | Check out the ISPConfig 3 Billing Module!

FB: http://www.facebook.com/howtoforge

nginx-Webhosting: Timme Hosting | Follow me on:
Reply With Quote
  #5  
Old 27th March 2010, 17:47
tuananh87vn tuananh87vn is offline
Member
 
Join Date: Sep 2009
Posts: 39
Thanks: 8
Thanked 0 Times in 0 Posts
Default

Quote:
Originally Posted by falko View Post
There are two scenarios where users don't have to authenticate:
1) You send to a rdcipient who is on the server.
2) You send from a client whose IP is listed in mynetworks in /etc/postfix/main.cf.
Hi,
For the 2nd scenario, it is likely for those who are logged into the system (as mynetworks specifies 127.0.0.1/8)

But for the 1st one, although i've placed some restrictions on client (like, client must be from user list), chances are that somebody who knows the emails of some users within the server still use them to spam the server itself. In this case, is it possible to force smtp authentication to any user who wants to use smtp service? (like Gmail, it forces its users to authenticate themselves before doing anything)
Reply With Quote
  #6  
Old 5th April 2010, 09:59
tuananh87vn tuananh87vn is offline
Member
 
Join Date: Sep 2009
Posts: 39
Thanks: 8
Thanked 0 Times in 0 Posts
Default

No reply?
I'm really stuck
Reply With Quote
  #7  
Old 6th April 2010, 13:36
dstomov dstomov is offline
Junior Member
 
Join Date: Apr 2010
Posts: 1
Thanks: 0
Thanked 0 Times in 0 Posts
Default

Hi,

I have similar problem (or may be the same). I use ubuntu 9.10 with ispconfig3. Now anyone can use my server on port 25 to send emails to the email boxes on my server. I want to know how to stop this. If the email is not for mines mail boxes there is response '5.7.1 Relay access denied', which is good, but when it is for my boxes is not good.
Reply With Quote
  #8  
Old 22nd September 2010, 13:00
minhnghivn minhnghivn is offline
Junior Member
 
Join Date: Sep 2010
Posts: 2
Thanks: 0
Thanked 0 Times in 0 Posts
Default My solution...

Try adding the following to your main.cf:
Code:
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sender_restrictions = reject_unknown_sender_domain
This help prevents any one from sending mail through your server without logging in first.
__________________
Boléro.VN - bộ sưu tập thơ vŕ note nhạc (sheet nhạc) khổng lồ của Việt Nam...

Last edited by minhnghivn; 22nd September 2010 at 13:01. Reason: modify layout
Reply With Quote
  #9  
Old 31st December 2013, 01:58
mburb mburb is offline
Junior Member
 
Join Date: Mar 2010
Posts: 3
Thanks: 0
Thanked 0 Times in 0 Posts
 
Default

Quote:
Originally Posted by minhnghivn View Post
Try adding the following to your main.cf:
Code:
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtpd_sender_restrictions = reject_unknown_sender_domain
This help prevents any one from sending mail through your server without logging in first.

Bingo! I had this problem and your suggestion (minhnghivn) has resolved it completely

I added this: reject_unknown_sender_domain

For me, my legit email was mostly working normally, but there was also a significant volume of junk mail (most of which was being rejected) trying to be sent through my server, visible in /var/log/mail.log The high volume of email attempts were all rejected, but the problem was that lots of this junk was being queued (only to be rejected again) and then after a couple weeks my mail server would stop delivering mail. Periodic reboots would resolve problem. But now the problem is eliminated... Basically I think I set up postfix improperly to begin with.

postqueue -p shows a list of files in queue (for me all the addresses in there looked spammy; confirmed the issue)

I ran the suggestions made by minh, then I did: postfix reload

Then I ran: postsuper -d ALL to delete all the items in queue

Then I monitored the mail log for awhile and found that my legit email was goin thru properly but the spammy stuff was no longer showing up in log:

tail /var/log/mail.log -n 100

Thanks for help! (from Canada)
Also, thanks to Falko for your great tutorials, I have used them for years

Last edited by mburb; 31st December 2013 at 02:04.
Reply With Quote
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
High on Lenny - Lvm Mount Problem Serverman Technical 1 23rd June 2009 16:26
Postfix not responding to telnet CarbonCopy Server Operation 6 8th May 2009 05:39
localhost postfix/master: fatal: bind 127.0.0.1 port 125: Permission denied g18c Installation/Configuration 4 24th March 2009 17:39
Centos 4.4 32bit Hangs, High Server load 3cwired_com Server Operation 11 16th November 2006 15:47
Verify email setup meekish Installation/Configuration 28 27th October 2006 15:36


All times are GMT +2. The time now is 06:54.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.