Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Even though my postfix server cannot be used without authentification (open relay), sending mail in another users name after logging in is still possible like this:

EHLO domain.org
auth plain eW91IGxpdHRsZSBkaXJ0eSBiYXN0YXJkIDstKQ==
235 2.7.0 Authentication successful
mail from: otheruser@domain.org
250 2.1.0 Ok
rcpt to: recipient@otherdomain.org
250 2.1.5 Ok
data
354 End data with <CR><LF>.<CR><LF>
Please send me your account info.
.
250 2.0.0 Ok: queued as D40692A61AA
quit

How can this be prevented?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

In your

smtpd_sender_restrictions =

you should have (possibly among other things):

        reject_authenticated_sender_login_mismatch,

You must have smtpd_sender_login_maps defined to provide a username to email address mapping.

share|improve this answer
    
This looks very promising, thank you! I suppose it is also possible to specifically allow a certain user to send using another users name? (For example, when acting as a relay host) –  Zulakis May 25 '13 at 17:20
    
Yes, if you put them in the aforementioned login map. –  Michael Hampton May 25 '13 at 17:21
    
That's exactly what I was looking for. Thanks! –  Zulakis May 25 '13 at 17:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.