Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Postfix issue, ( i asked this yesterday and manged to delete my own post instead of editing it sorry for that)

I use Postfix+sasl

i got these settings in main.cf

smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions = permit_mynetworks,permit_sasl_authenticated,check_client_access hash:/var/lib/pop-before-smtp/hosts,reject_unauth_destination

and on this server i have the domain myrealdomain.com

now if i use a smtp tester and use the domain fakedomain.com as sender it gets blocked as it should BUT if i use myrealdomain.com the mail server just dont accept the email it also delivers it to whatever email i tell it to deliver.

now i want it to ALWAYS ask for login and passwd when someone try to SEND an email from my server no matter if it uses a domain hosted on the mailserver or not!

as it is now you can use my server to spam other ppl aslong as you use a domain that hosted on the mail server.

any help would be greatly aprichiated!

postconf -n output

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
append_dot_mydomain = no
biff = no
broken_sasl_auth_clients = yes
config_directory = /etc/postfix
content_filter = smtp-amavis:[127.0.0.1]:10024

debug_peer_level = 1
debug_peer_list =
html_directory = /usr/share/doc/postfix/html
inet_interfaces = all
mailbox_size_limit = 0
mydestination = localhost
myhostname = mail.myrealdomain.com
mynetworks = 127.0.0.0/8, 192.168.0.0/16
myorigin = /etc/mailname
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps   $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps  $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps     $mynetworks $virtual_mailbox_limit_maps $transport_maps
readme_directory = /usr/share/doc/postfix
receive_override_options = no_address_mappings
recipient_delimiter = +
relayhost =
sender_canonical_maps =
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
smtp_use_tls = yes
smtpd_banner = mail.myrealdomain.com ESMTP  FrogSMTP powered by FrogLinux
smtpd_recipient_restrictions =   permit_mynetworks,permit_sasl_authenticated,check_client_access hash:/var/lib/pop-before-    smtp/hosts,reject_unauth_destination 
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_tls_CAfile = /etc/postfix/cacert.pem
smtpd_tls_auth_only = no
smtpd_tls_cert_file = /etc/postfix/smtpd.cert
smtpd_tls_key_file = /etc/postfix/smtpd.key
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtpd_tls_session_cache_timeout = 3600s
smtpd_use_tls = yes
tls_random_source = dev:/dev/urandom
transport_maps = proxy:mysql:/etc/postfix/mysql-virtual_transports.cf
virtual_alias_domains =
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql-virtual_forwardings.cf,     proxy:mysql:/etc/postfix/mysql-virtual_email2email.cf
virtual_gid_maps = static:5000
virtual_mailbox_base = /home/vmail
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql-virtual_domains.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailboxes.cf
virtual_uid_maps = static:5000

Regards Martin

share|improve this question
    
Are you sure the smtp tester isn't in your $mynetworks? –  NickW Mar 13 '13 at 17:49
    
yes i even tested to create a email act on a friend old XP pc in outlook and i could mail stright to anyone aslong as i used a domain hosted on the server mynetworks = 127.0.0.0/8, 192.168.0.0/16 that all i have in mynetworks –  Marf Mar 13 '13 at 18:03
    
Try adding this to your main.cf smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination –  NickW Mar 14 '13 at 9:19
    
ok i did some kernel mods and had to reboot the server now it blocks like it should do not ask me why couse i cant figure out wth is going on anyhow it works now so im not gonna touch it lol :) –  Marf Mar 14 '13 at 15:18
    
I suggest trying to figure out what made it work if you want to be someone who knows what he's doing. –  gparent Mar 14 '13 at 17:49
add comment

1 Answer

Your smtpd_recipient_restrictions are not strict enough. If this machine is not a MX, but a MSA/MTA then you'll probably want to end with reject.

Example MSA/MTA setting:
smtpd_recipient_restrictions = permit_mynetworks permit_sasl_authenticated reject

This will accept mail from authenticated users and the addresses listed in mynetworks and reject all other mail.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.