Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm experiencing problems with my web server where someone is using it to send spam. It appears that it's accepting emails without authentication.

How can I block my web server from accepting emails without authentication?

I tried testing with https://www.wormly.com/test_smtp_server (using the below details) and it seems to confirm my theory that the server is just accepting emails from external sources.

Using 78.129.132.155, cakes@pezcuckow.com, myemail@gmail.com

Connecting...
SMTP -> FROM SERVER:
220 tent.pegproductions.com ESMTP Exim 4.72 Thu, 31 Jan 2013 20:18:55 +0000
SMTP -> FROM SERVER: 
250-tent.pegproductions.com Hello node-mec2.wormly.com [184.72.226.23]
250-SIZE 20971520
250-PIPELINING
250-AUTH PLAIN LOGIN
250-STARTTLS
250 HELP
MAIL FROM: email@place.com
SMTP -> FROM SERVER:
250 OK
RCPT TO: myemail@gmail.com
SMTP -> FROM SERVER:
250 Accepted
Sending Mail Message Body...
SMTP -> FROM SERVER:
354 Enter message, ending with "." on a line by itself
SMTP -> FROM SERVER:
250 OK id=1U10b1-0002T6-TU
Message completed successfully.

I've got the following in my exim.conf:

plain:
    driver = plaintext
    public_name = PLAIN
    server_prompts = :
    server_condition = "${perl{smtpauth}}"
    server_set_id = $2

login:
    driver = plaintext
    public_name = LOGIN
    server_prompts = "Username:: : Password::"
    server_condition = "${perl{smtpauth}}"
    server_set_id = $1

Where smtpauth is a perl script that checks the provided username and password from directadmin:

sub smtpauth
{
        $username       = Exim::expand_string('$1');
        $password       = Exim::expand_string('$2');
        $extra          = Exim::expand_string('$3');
        $domain         = "";
        $unixuser       = 1;

        #check for netscape that offsets the login/pass by one
        if ($username eq "" && length($extra) > 0)
        {
                $username = $password;
                $password = $extra;
        }

        if ($username =~ /\@/)
        {
                $unixuser = 0;
                ($username,$domain) = split(/\@/, $username);
                if ($domain eq "") { return "no"; }
        }

        if ($unixuser == 1)
        {
                #the username passed doesn't have a domain, so its a system account
                $homepath = (getpwnam($username))[7];
                if ($homepath eq "") { return 0; }
                open(PASSFILE, "< $homepath/.shadow") || return "no";
                $crypted_pass = <PASSFILE>;
                close PASSFILE;

                if ($crypted_pass eq crypt($password, $crypted_pass)) { return "yes"; }
                else { return "no"; }
        }
        else
        {
                #the username contain a domain, which is now in $domain.
                #this is a pure virtual pop account.

                open(PASSFILE, "< /etc/virtual/$domain/passwd") || return "no";
                while (<PASSFILE>)
               {
                        ($test_user,$test_pass) = split(/:/,$_);
                        $test_pass =~ s/\n//g; #snip out the newline at the end
                        if ($test_user eq $username)
                        {
                                if ($test_pass eq crypt($password, $test_pass))
                                {
                                        close PASSFILE;
                                        return "yes";
                                }
                        }
                }
                close PASSFILE;
                return "no";
        }

        return "no";
}
share|improve this question

1 Answer 1

Read this:

HowTo Setup Basic SMTP AUTH in Exim4

And this:

Exim.org Chapter 33 - SMTP authentication

share|improve this answer
    
Info added above, I thought I already have it set up! –  Pez Cuckow Jan 31 '13 at 20:51
    
Please consider adding the actual information, that is relevant, from the links to your post. –  artifex Jun 13 at 21:07
    
@artifex Both articles in their entirety are relevant. –  nojak Jun 16 at 22:21
    
@nojak serverfault.com/help/how-to-answer - The section provide context for your links –  artifex Jun 18 at 16:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.