0

I have a Debian cloud server with Exim4 running and serving emails with DMARC, SPF, and DKIM properly set up. I can ssh into the server and send and receive encrypted emails successfully. Dovecot is running on the server and allows clients to connect over IMAPS and retrieve email from any location. In the update-exim4.conf.conf file, the "dc_relay_nets" setting allows email relays from a specific IP address at an office location. Outgoing email only works coming from that IP address. There is no VPN service set up to allow users to remote into the network behind the router at the IP address approved for relay. Users cannot send emails from outside the office.

I have the ability to put private keys or random passwords (which hopefully can be locked from user access) on all of the clients. Most links I can find only mention the option to specify relay networks or relay domains. What is the best way to provide users the ability to authenticate to the email server and send mail from any location? Exim4 has a lot of capabilities, so I'd be surprised if it couldn't do this. Am I missing a setting somewhere?

1 Answer 1

0

SMTP AUTH over STARTLS usually to TCP/587 is a typical way to do this, and is also a typical way for attackers to try to brute force passwords, so giving users very very long very very random passwords is probably ideal (more ideal might be a VPN, and then not having yet another SMTP port hanging out there on the Internet, especially one that may have relaxed anti-spam policies). Most email clients support SMTP AUTH, though I've seen centrally dictated Microsoft policies that have prohibited SMTP AUTH in Outlook (so we had those customers use Google Mail instead).

1
  • Thank you. That got me going in the right direction. looks like STARTLS over TCP/587 with SMTP into Google search gave more promising results. I previously found a lot of results on a passwd.client file, but apparently I needed to create a file called 'passwd' and enter <username>:<encrypted password>:<cleartext password> on one line and restarting the service. That got it working.
    – Jeff12
    Aug 19, 2022 at 23:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .