3

My postfix is letting me send emails through it without authentication. It has been setup to allow authentication, but it also allows non authenticated sending which I'd like to stop.

What config settings are the relevant ones in this situation?

Here is an output of postconf -n to help debug:

alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
html_directory = no
inet_interfaces = all
inet_protocols = all
mail_owner = postfix
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain,
mydomain = hiddenforprivacy.org
myhostname = mail.hiddenforprivacy.org
myorigin = $myhostname
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
sample_directory = /usr/share/doc/postfix-2.6.6/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtpd_client_restrictions = permit_mynetworks, permit_sasl_authenticated
smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = private/auth
smtpd_sasl_type = dovecot
soft_bounce = no
unknown_local_recipient_reject_code = 550
virtual_alias_domains = 
virtual_alias_maps = hash:/etc/postfix/virtual
6
  • 1
    Add the output of postconf -n to the question
    – ALex_hha
    Sep 21, 2013 at 17:56
  • Does the smtpd_client_restrictions setting permit_mynetworks allow emails that are listed in mydomain to send through the mail server without a password? Sep 21, 2013 at 18:46
  • 1
    # postconf mynetworks ?
    – ALex_hha
    Sep 21, 2013 at 18:53
  • @ALex_hha mynetworks = 127.0.0.0/8 77.0.0.0/8 [::1]/128 [fe80::%eth0]/64 Sep 21, 2013 at 19:19
  • 1
    It should be 127.0.0.0/8
    – ALex_hha
    Sep 21, 2013 at 19:31

1 Answer 1

3

You should remove the permit_mynetworks directive from smtpd_client_restrictions. Then, if you are using version 2.10 or later, add:

 smtpd_relay_restrictions = permit_sasl_authenticated, reject_unauth_destination

If you are not there yet, remember this, and when you update, add this directive then.

What this will do is disable any unauthenticated access to your mailserver at all, including from your own networks in $mynetworks. The one exception is that remote hosts will still be able to submit mail destined for one of your addresses (so you can still recieve mail, as remote MTAs sending mail to you do not authenticate); this is the difference between reject_unauth_destination and reject. It will also update your relay access control to the 2.10 specification.

If you want to not even accept mail (eg. from other mailservers) to hosts in your domain without authentication, replace reject_unauth_destination with reject. If you do that you will not get any incoming email through this server.

9
  • smtpd_relay_restrictions is not available in postfix-2.6.6
    – ALex_hha
    Sep 21, 2013 at 19:08
  • Yes, if you are using an ancient version (prior to 2.10), ignore the bit about smtpd_relay_restrictions. That part of the ACL system was broken out of smtpd_recipient_restrictions in 2.10. Also, upgrade your MTA ;) Sep 21, 2013 at 19:09
  • 1
    To what are you sending? You will always be able to send to local addresses without authentication (and there is no point preventing that, because you have to allow external users to do so anyway). Try sending to an external domain (such as gmail) without authentication. Sep 22, 2013 at 7:43
  • 1
    Without permit_mynetworks you can't send mail from localhost to the world without authentication, for e.g. apache can't send mail. To domains in the mydestination you will be able send mail any way. So it would be great if you add maillog for such transmission.
    – ALex_hha
    Sep 22, 2013 at 8:49
  • 1
    I had no idea. I was only trying to send to my own domain! But you are correct - on trying to send to another domain I was prompted for password. Well done! Sep 22, 2013 at 8:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .