0

I configured postfix + covecot and everythings works just fine, until I realize that users can send emails signed as any other emails, for example I have mail [email protected] and I can send email as [email protected], but postfix shouldn't allow me to do that. I have no idea how to prevent such behavior.

my config files:

postfix

main.cf: http://paste.kde.org/464534/

master.cf: http://paste.kde.org/464540/

dovecot

dovecot.conf: paste.kde.org/464546/

thank you very much for helping me out ;]

2 Answers 2

3

The short answer is that you can't. SMTP simply isn't designed to do that. In the old days (tm), mail servers were prepared to relay mail for everyone. This proved unsustainable in the spam era, and mail servers now generally only relay mail for their legitimate user community, identified by IP address, authentication, or both. But they will still generally relay any mail for any such user, even mail claiming to be from someone other than that user.

I'm sure it's possible to tie your mail server down, such that you will only allow your authenticated users to send mail from the user as whom they have authenticated. You could also tie your server down to refuse email from outside your organisation that claimed to be from within. But I'd advise against it, because it builds a culture of false expectation: your users, knowing that they can trust the sender of internal mail received internally, may start to trust the sender of external mail received internally (which you have no way to authenticate), or trust the sender of internal mail received externally (which you can't enforce).

Better, IMHO, to educate users that they can't trust the declared sender of an email. If you really want to be able to authenticate the sender of an email, investigate cryptographic technologies like OpenPGP, and have your users create, exchange, and use their keys.

Edit: I'm not a gmail user, so I don't know if gmail prevents authenticated users sending email from some other sender. But as I said above, even if it does, that doesn't stop someone sending email to a third-party recipient claiming to be from such a gmail user (yes, I'm aware that gmail.com publishes an SPF record; but it's a weak record, ending in ?all, and in any case you can't mandate that the recipients mail server checks it). Behaving as if email authenticates the sender is a bad idea, because even though in some cases it may do, it doesn't in all cases (or even most cases).

4
  • ok, sure, but if I have email @ gmail than I can't do such a thing, right? I just can't send mail as [email protected], somehow they managed to do the trick..?
    – lipt0n
    Apr 27, 2012 at 8:34
  • They do it in some cases; they can't do it in the general case. They require that you list valid sender addresses beforehand, and they do vet for some obvious spoofs, but they can't verify in general that you listed accounts that belong to you.
    – geekosaur
    Apr 27, 2012 at 9:11
  • Submisson, however, IS designed to do just that. The latest RFC(4409) is 6 years old: tools.ietf.org/html/rfc4409
    – adaptr
    Apr 27, 2012 at 10:55
  • The only part of that RFC that I can find regarding vetting the sender address is 6.1, and then the RFC only permits it, rather than mandating it. Moreover, there's no reliable way to tell that some other sending host has performed such a step.
    – MadHatter
    Apr 27, 2012 at 11:15
0

It is technically impossible to verify the sender on plain SMTP.

However, encrypted and authenticated submission over port 587 has been common for a decade now; you should educate your users on how to use that.

It is quite easy to enable in postfix; simply uncomment the submission example in master.cf, and reject submission over port 25.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .