Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

One of my clients is using a cPanel-based Virtual Dedicated Server that appears to allow unauthenticated SMTP:

bash$ echo EHLO | nc mail.clientscompany.com 25
...
250-SIZE 52428800
250-PIPELINING
250-AUTH PLAIN LOGIN
250-STARTTLS
250 HELP

It therefore appears that anyone (esp. spammers) can use his mail server to send whatever - I just connected from my DSL connection at home, and...

bash$ nc mail.clientscompany.com 25
HELO clientscompany.com
MAIL FROM: realuser@clientscompany.com
RCPT TO: innocentspamvictim@wherever.com
DATA
From: <realuser@clientscompany.com>
To: <innocentspamvictim@wherever.com>
Date: ...
Subject: ...
Blah
.
QUIT

I just tested this, and sure enough, it sent a mail from "realuser@clientscompany.com".

Since I am not familiar with cPanel and WHM, can someone provide pointers to configure his mail server to (a) only accept TLS connections and (b) only authenticated ones (i.e. with user/password, not just plain connections).

Thanks for any help.

share|improve this question

3 Answers 3

http://spamlinks.net/prevent-secure-relay-fix.htm

Without knowing what MTA your client is running its hard to provide more specific configuration information.

share|improve this answer
    
I posted some more details in an answer below. –  ttsiodras Mar 3 '10 at 18:08
1  
If you've authenticated to that server recently, it may not actually be an open relay. See webhostingtalk.com/showthread.php?t=671553 –  quadruplebucky Mar 4 '10 at 1:47

The VDS uses Exim:

bash$ yum list | grep -i exim
exim.i386                                4.69-23.1_cpanel_maild installed   

I just thought that cPanel/WHM would offer this though some menu/button which I am somehow missing... I have no trouble editing configuration files, but I fear that the set of pages (PHP/CGI scripts) offered by cPanel/WHM are depending on specific formating of configuration files (for Exim and the rest of the UNIX tools) - which I wouldn't want to break...

Any further advise most welcome.

share|improve this answer
up vote 0 down vote accepted

Thank you "quadruplebucky", you were spot-on.

That is, false alarm - to anyone else who is worrying about this, just read link the link "quadruplebucky" pointed to.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.