Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

can one implement an IP address based restriction for SMTP AUTH in Postfix?

Scenario: I'm running a Postfix mail server that receives mails from all over the Internet. But the server doesn't only receive mails, it also allows its authenticated users to send mails to internal users or to external ones. So far no problem.

Unfortunately, I'm always getting a little scared when reading the log files. There are thousands of unsuccessful, illegal login attempts every day from IP addresses from all over the world.

But actually the legitimate sender hosts only come from a handful of known ip address ranges. So I know only someone from (for example)

  • 134.500.0.0/16
  • 134.700.42.0/24
  • 134.800.133.7

might even be a legitimate sender at all. (I know that the IP address given in the example above are malformed. I just don't wanted to unveil the real ones.)

So if the sender comes from a different ip range, he's for sure none of my users and therfore not allowed to relay anything.

I don't want someone from outside of these subnets to be able to relay even if he figures out a valid username/password combination for SMTP AUTH. If he's from a non-white-listed ip address range, he mustn't send. Under no circumstances. So permit_sasl_authenticated alone is not enough. As long as someone from "certain" countries (I don't want to name them explicitly...) is able to login with stolen/brute-forced/spyed credentials, it's not secure enough. :-) (Think of social engineering, trojan keyloggers that steal account data, lightheaded users with easy-to-guess passwords, etc.)

=> So is it possible to implement an ip address restriction for SMTP AUTH login attempts? (The receiving of incoming mails must not be affected by this. For that I have policyd-weight etc. Here it's only about outgoing / to be relayed mails.)

Solutions that won't work:

  • iptables firewall restriction. As I want to be able to receive mails from all over the Internet on port 25, I cannot implement restrictions on transport layer level. - Moreover, I want the legitimate users to be able to connect on port 25 to admit new outgoing mails into the server. So allowing mail sending only via a subnet restricted-mystery tcp port, e.g. 24343, is no solution, too.
  • permit_mynetworks: Not everybody from the known ip ranges is a legitimate user. So I can't allow everybody from there to send. SMTP AUTH login is necessary to determine whether someone is an authorized user.

I appreciate any help and hints! Many thanks in advance! Yours, Mr. Snrub

share|improve this question
add comment

4 Answers

How about putting your SMTP AUTH on another port like 587, and using iptables to restrict access to that port? 587 isn't a hidden port, it's an RFC defined mail submission port. Mail to you arrives on 25, mail through you needs to go over 587.

http://tools.ietf.org/html/rfc6409

share|improve this answer
    
Hopefully he has already set this up. –  Michael Hampton Feb 7 '13 at 18:24
add comment

I would advice you to use a HIDS like OSSEC to temporarily block IPs that tried to log in. You can also add a rule in OSSEC to exclude your trusted networks from this rule, so legitimate users don't get blocked after a few attempts.

I'm proposing this as I don't think Postfix actually has a way to complement my_networks and SASL.

share|improve this answer
add comment

You want to use a negated form of smtpd_sasl_exceptions_networks.

smtpd_sasl_exceptions_networks = !134.500.0.0/16 !134.700.42.0/24 !134.800.133.7

You might also be interested in smtpd_client_connection_rate_limit.

share|improve this answer
add comment

There are thousands of unsuccessful, illegal login attempts every day from IP addresses from all over the world.

install fail2ban and tweak an existing or create a new filter to trap for these. I use:

failregex =\[<HOST>\]\: SASL LOGIN authentication failed
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.