Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Today I mentioned strange issue on my ispconfig 3 installation. After some debugging it was clear that anyone can send emails to local domains without authentication.

I checked main.cf and sow that smtp_senders_restriction pointing to mail_access table in ispconfig database. The issue is that table is empty and I'm not sure how to add record there through ispconfig interface.

Any thoughts??

Thanks in advance.

share|improve this question
1  
Do not quite understand the question. If someone sends mail from the Internet to your domain, how it should be authenticated on your server? And if so, then what username and password? –  GreyZmeem Apr 3 '12 at 7:05
    
@GreyZmeem here is the case: telnet example.com email from: user1@example.com rcpt to: user@example.com data . this is possible with standart ispconfig installation from howtoforge without authentication for user1. if you trie to send email to user3@domain.com it will complain teat relay is denay which means that you need to authenticate to send emails to others. Issue is that ispconfig configuration allows sending email to local domains from local emailboxes without authentication. This should not be allowed as anyone can send bunch of emails to user2 and load server and storage etc. –  Taron Sargsyan Apr 25 '12 at 19:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.