0

I'm currently in the process of setting up a new (Debian) webserver to replace a very old (Debian) webserver which I also setup years and years ago. I'm trying to "clone" the old webserver as much as possible. The old webserver also runs a mailserver.

One of the things I noticed on the old webserver is that incoming connections on port 25 (SMTP) from outside the local network are blocked. But I can't remember why I did that, nor do I remember how I did that. I'm guessing it has something to do with security? So should I block port 25 on the new server as well?

Apologies if this is a "dumb" question.

EDIT:

Sheeeeesh... It turns out my provider blocks outgoing traffic over port 25! So the old server has port 25 open... Sorry for wasting everyone's time!

Improve this question
6
  • ISPs commonly block that port, especially for residential connections.
    – Ron Maupin
    Mar 29, 2020 at 17:42
  • 2
    We can't know why or how you did it years ago, nor should you do it now. This depends entirely on your needs: whether you are supposed to receive mail with the server or not. But I'd take some time to think of the approach: should you be cloning your settings from this years old box, or should you instead be thinking of the current best practices. Public web and mail servers are constantly under attacks.
    – Esa Jokinen
    Mar 29, 2020 at 18:06
  • Are you SURE your SMTP servers listens for incoming SMTP connection on other interfaces than 127.0.0.1? Check nestat -ant | grep :25
    – AnFi
    Mar 29, 2020 at 18:12
  • MTAs default to using port 25 in order to exchange messages (in plaintext). Maybe you've disabled it to force inbound mail on a secure TLS connection?
    – SamR.
    Mar 29, 2020 at 21:45
  • @SamR TLS should be negotiated on port 25. It is unclear to me if 465 was ever used for this purpose, but if it was it was never published by EITF as a standard pepipost.com/blog/25-465-587-2525-choose-the-right-smtp-port has a good summary of this.
    – davidgo
    Mar 29, 2020 at 23:23

1 Answer 1

Reset to default
0

You are likely using your SMTP server just to send emails from the websites/services on your box. (This is a common scenario). If that assumption is correct your mail server does not need to be listening on port 25 for requests from the outside world, which would make it marginally less secure and increase the risk of it being an open relay.

There is no single way to stop it listening externally, but a common and solid way to do so is in the OS firewall - for example using iptables to only allow connection TO port 25 originating from the IP addresses of the machine.

If in doubt you should do this on the new machine.

Improve this answer
5
  • It's also receiving mail for all hosted domains... It does listen to port 587 and 465. When other mail servers send mail to my server, do they first try port 25 and if they are unable to connect, automatically try port 587 and 465?
    – Zippy1970
    Mar 29, 2020 at 19:55
  • 1
    No, SMTP server -> SMTP server communications happen on port 25 only. They do not fall back to 587 or 465 - the latter two ports generally having user authentication associated with them and being used for Client -> SMTP server communication.
    – davidgo
    Mar 29, 2020 at 23:20
  • Then how is my old webserver receiving emails? Port 25 is closed (I can't telnet to it from the outside) and yet it's receiving emails just fine... Does it use port knocking?
    – Zippy1970
    Mar 29, 2020 at 23:39
  • I doubt it uses port knocking. This is far outside the SMTP spec and makes no sense in this context. Is it possible that you have a firewall redirecting requests on port 25 to a non-standard port? What happens if you run tcpdump on the system while receiving an email - presumably this will tell you the destination port and give you a clue as to where to look?
    – davidgo
    Mar 30, 2020 at 1:41
  • Sheeeeesh... It turns out my provider blocks outgoing traffic over port 25! So the old server has port 25 open... Sorry for wasting everyone's time!
    – Zippy1970
    Mar 30, 2020 at 7:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .