1

I have an email server running Postfix. Everything is working fine, However, recently, some internal emails received emails from their own addresses with phishing content. After finding out, I learned that Postfix can send internal emails using telnet port 25, sending it internally in my domain does not require authentication. I got the idea of enabling authentication with local domain emails, I searched but got no answer. I appreciate the help Sorry my English is not good so I have to use google translate

2 Answers 2

1

It's alerting that someone from the localhost is able to send phishing mail: it means someone is already inside the system or there's e.g. a web application that enables those connections. You shouldn't accept this, but carefully investigate where it's coming from and stop it.

That said, to answer your question, there's nothing special with local delivery regarding SMTP on port 25. Removing this permission could be done (in the main.cf) simply by either

  • removing the permit_mynetworks from smtpd_recipient_restrictions or
  • removing the 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 from mynetworks.

However, with this your local users must use the submission port(s) to deliver their mail. The authenticated users can by default use any address as an envelope sender. To limit this, the submission and/or smtps services in master.cf should have:

  -o smtpd_sender_login_maps=hash:/etc/postfix/virtual
  -o smtpd_sender_restrictions=reject_sender_login_mismatch

Here, the hash:/etc/postfix/virtual is the same that is used for virtual_alias_maps, because it already has the required address@example.com username format with the correct address to user mappings.

2
  • Thank you for consulting the solution. I just want to prevent using terminal or mail sender to spread spam and phishing mail in the local domain. Lik e the image below. Anyone can do this: photos.app.goo.gl/kMWATmBrNR4bz8si7 Dec 24, 2020 at 8:59
  • This answer covers exactly that considering local users. However, there are other configuration problems that may leave your mail server an open relay where anyone from anywhere could send mail through it. Dec 24, 2020 at 9:26
1

One way of doing it is to open main.cf, search for all the instances of permit_mynetworks and comment them out, then issue a postfix reload.

2
  • Dear friend, I followed the instructions you submitted but the issue is still not resolved. I can still telnet port 25 and send email without authentication Jan 4, 2021 at 3:34
  • Make sure you are not testing by sending email to one of the domains listed in the postfix transport map. Mar 23, 2021 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.