Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

One of my clients is using a cPanel-based Virtual Dedicated Server that appears to allow unauthenticated SMTP:

bash$ echo EHLO | nc 25
250-SIZE 52428800
250 HELP

It therefore appears that anyone (esp. spammers) can use his mail server to send whatever - I just connected from my DSL connection at home, and...

bash$ nc 25
From: <>
To: <>
Date: ...
Subject: ...

I just tested this, and sure enough, it sent a mail from "".

Since I am not familiar with cPanel and WHM, can someone provide pointers to configure his mail server to (a) only accept TLS connections and (b) only authenticated ones (i.e. with user/password, not just plain connections).

Thanks for any help.

share|improve this question

closed as off-topic by Hyppy, masegaloeh, mdpc, HBruijn, MadHatter May 4 '15 at 7:57

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

Without knowing what MTA your client is running its hard to provide more specific configuration information.

share|improve this answer
I posted some more details in an answer below. – ttsiodras Mar 3 '10 at 18:08
If you've authenticated to that server recently, it may not actually be an open relay. See – quadruplebucky Mar 4 '10 at 1:47

The VDS uses Exim:

bash$ yum list | grep -i exim
exim.i386                                4.69-23.1_cpanel_maild installed   

I just thought that cPanel/WHM would offer this though some menu/button which I am somehow missing... I have no trouble editing configuration files, but I fear that the set of pages (PHP/CGI scripts) offered by cPanel/WHM are depending on specific formating of configuration files (for Exim and the rest of the UNIX tools) - which I wouldn't want to break...

Any further advise most welcome.

share|improve this answer
up vote 1 down vote accepted

Thank you "quadruplebucky", you were spot-on.

That is, false alarm - to anyone else who is worrying about this, just read link the link "quadruplebucky" pointed to.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.