1

I want to prevent my php scripts from sending mails through the MTA in localhost 25, without authentication.

I have been told that the server, by default, trusts itself, and that's why I need no auth in this case. So I have to disable the 'unauthenticated local relay'. How can I achieve that in postfix?

  • I liked @Cedric answer it made sense, but I tried to apply this on my local postfix machine and tried phpmailer it still send the email as well. I had removed permit_mynetworks but phpmailer script is still sending. reference to this got me here after I disabled auth in the script link here postfix was rebooted etc... this puzzles me as well... – gstlouis May 3 '16 at 23:02
5

Within your Postfix configuration, you can use the setting smtpd_recipient_restrictions in order to decide who should be able do use your server as a relay.

For example, in my config it looks like this:

smtpd_recipient_restrictions = 
  permit_mynetworks,
  permit_sasl_authenticated,
  reject_unauth_destination

That means that every one from my network (see also the mynetworks setting) and everyone who is authenticated can send email. Simply remove permit_mynetworks, and nobody will be able to send email without authentication anymore. Just be aware that this might break other programs that currently rely on being able to send you email without authentication, and not just your PHP application.

| improve this answer | |
0

Are you sure your scripts send email over TCP connection to localhost? This is quite uncommon, local emails are usually injected into postfix maildrop queue directly.

| improve this answer | |
  • No I'm not sure =p. I'm using a php library that receives as arguments 'localhost' and 25. I don't know what it does with them, but it can send mails even when I don't use the next method 'authenticate', which receives as arguments a login and a password. – HappyDeveloper Feb 10 '11 at 21:35
0

As mentioned by Alex, email's from local programs often get dumped right into the queue, bypassing all the network configs that you've deployed to block this.

The setting to control this local behavior is: authorized_submit_users

In your main.cf postfix config, you may have this line:

authorized_submit_users = static:anyone

It may not be set explicitly, but the above is the default, so ANY named user on localhost can submit directly to the queue. To block the submit queue completely, just define an empty list in main.cf:

authorized_submit_users =

or, I like to do the following to only allow root to submit on localhost:

authorized_submit_users = root

Reference: http://www.postfix.org/postconf.5.html

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.