Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a Centos server with cPanel on it.

Yesterday, some hackers had successfully connected to my smpt server and sent thousand of emails from it.

What I want to do is blocking every ports except for HTTP and HTTPS ports to everyone (IN and OUT), except to some ips (for admin purpose).

I've already did this for the past few months with smpt ports opened. This is working perfectly, but I want to know if blocking ports 25, 465 and 587 (IN and OUT) will prevent the server itself from sending emails. I have some php scripts which need to send emails.

I don't want any email accounts, so sending emails from a mail client is not necessary.

share|improve this question
4  
I want to know if blocking ports 25, 465 and 587 (IN and OUT) will prevent the server itself from sending emails - Yes it will. You can't have your cake and eat it too. –  joeqwerty Mar 26 at 15:47
    
The server ip addresses are on the ignore list of the firewall, so these ports are not blocked for them. But does the recipient server has to access mine for some reason? –  Marm Mar 26 at 16:01
    
No, the recipient server does not need to connect to your server on ports 25, 465 or 587. –  joeqwerty Mar 26 at 16:02
    
So allowing only the server ip addresses to access these ports will work? –  Marm Mar 26 at 16:07

3 Answers 3

up vote 4 down vote accepted

SMTP involves a conversation between two SMTP servers on port 25. I'm going to copy and paste a sample conversation from this website, which is demonstrating testing SMTP with telnet:

telnet: > telnet mx1.example.com smtp
telnet: Trying 192.0.2.2...
telnet: Connected to mx1.example.com.
telnet: Escape character is '^]'.
server: 220 mx1.example.com ESMTP server ready Tue, 20 Jan 2004 22:33:36 +0200
client: HELO client.example.com
server: 250 mx1.example.com
client: MAIL from: <sender@example.com>
server: 250 Sender <sender@example.com> Ok
client: RCPT to: <recipient@example.com>
server: 250 Recipient <recipient@example.com> Ok
client: DATA
server: 354 Ok Send data ending with <CRLF>.<CRLF>
client: From: sender@example.com
client: To: recipient@example.com
client: Subject: Test message
client: 
client: This is a test message.
client: .
server: 250 Message received: 20040120203404.CCCC18555.mx1.example.com@client.example.com
client: QUIT
server: 221 mx1.example.com ESMTP server closing connection

If you only allow outgoing, it's going to be a short conversation. Your server will never receive any replies from the remote SMTP server.

In other words: Yes, it will block mail.

share|improve this answer
    
Only the incoming or destination side communicates on port 25. The outgoing or source side uses a port in the ephemeral port range. –  joeqwerty Mar 26 at 18:45
1  
@joeqwerty All SMTP server to SMTP server communication takes place over standard SMTP ports. Clients can connect to standard SMTP ports from random ports. Marm is sending mail from his CentOS server from PHP; I presume he's coded it to use a local SMTP server rather than to connect to the SMTP servers of the individual recipients. I could be mistaken, of course. –  Katherine Villyard Mar 26 at 18:59
    
That is not the case. When my SMTP server sends an outgoing email it connects FROM an ephemeral port TO port 25 of the destination server. My server does not use port 25 for outgoing SMTP sessions. My server uses port 25 for incoming SMTP sessions, not outgoing SMTP sessions. If you have an email server handy you can confirm this with netstat. When we talk about application and service ports, in almost all cases, we're talking about the destination port, not the source port. –  joeqwerty Mar 26 at 19:05
    
I do have an Exchange server, but netstat isn't providing that information. ;) Nor is Nagios. Exchange is too busy with local mail; Nagios isn't busy enough. I actually went looking for documentation with a definitive answer before I replied to you the first time, but my google-fu is failing me. So I'm going back to the depths of my memory (1995), where I could have sworn I was told it worked that way. –  Katherine Villyard Mar 26 at 19:31
1  
All my connections involving port 25 either way were submissions (spam, LOL), so I got my friend to check. I stand corrected. And also stand by "No, you will not receive mail." :) At the very least, it's going to fail any site that uses sender verify. –  Katherine Villyard Mar 26 at 20:18

Yes, if you block the port #. There will be no successful communication which is needed for that service to work.

share|improve this answer
    
The server ip addresses are on the ignore list of the firewall, so these ports are not blocked for them. But does the recipient server has to access mine for some reason? –  Marm Mar 26 at 16:02
    
If I let only the outgoing ports open, will it works? –  Marm Mar 26 at 16:30
1  
I doubt it @Marm –  secure212 Mar 26 at 17:14

Alternatively instead of blocking the connections and un-blocking when needed (that's what it seems you want to do) you can stop the server and start it only when you need it, looks like a 'cleaner' option.

share|improve this answer
    
You can send email without the server running. Depending on the setup, you depend on that fact for a stand alone Unix/Linux workstation to be able to send mail. –  Hunter Eidson Mar 26 at 20:59
    
I know, if he just wants to send email he may as well turn off the mail server, or if he just needs local delivery he can run it binded locally, not clear on what he really wants to do –  LinuxDevOps Mar 26 at 21:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.