-2

I have a postfix server installed on Ubuntu 14.04. A PHP script running on the machine uses it to send outgoing email. Additionally, I use postfix to receive mail sent to a local account, which is then forwarded to my personal gmail.

However, this means that anyone can connect to my server and use it as an open relay for spam. How can I prevent remote connections from relaying email?

This is my main.cf:

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = aviacao.pt
virtual_alias_maps = hash:/etc/postfix/virtual
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = aviacao.pt, localhost.localdomain, localhost
relayhost = 
mynetworks = 0.0.0.0/0
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = ipv4

If I change mynetworks to 127.0.0.0/8 then people won't be able to send email to the local account.

closed as off-topic by Jenny D, MadHatter, masegaloeh, mdpc, Katherine Villyard Feb 6 '15 at 4:55

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions should demonstrate reasonable business information technology management practices. Questions that relate to unsupported hardware or software platforms or unmaintained environments may not be suitable for Server Fault - see the help center." – Jenny D, MadHatter, masegaloeh, mdpc, Katherine Villyard
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Go to postfix.org and look at the Documentation link. If you are putting a mailserver on the internet, you need to actually know how it works, not just follow instructions on a QA site. – Jenny D Feb 5 '15 at 17:05
8

Your smtpd_relay_restrictions should prevent that anyone can connect to my server and use it as an open relay for spam.

The value of mynetworks does not determine if others can email you. 127.0.0.0/8 is a correct value 0.0.0.0/0 is not.

What determines if email for your account username@example.com is accepted is determined by the settings that inform postfix that it should accept email for the example.com domainname, such as mydestination

3

the setting of smtpd_relay_restrictions you have is correct except that you defined your mynetworks wide open (shown below from your main.cf)

mynetworks = 0.0.0.0/0

Just remove mynetworks; the default value should restrict relay access. For example, mine comes out as shown below with default.

postconf -d |grep mynetworks
mynetworks = 127.0.0.0/8 192.168.1.0/24

You should really test your server to ensure that is not an open relay. There are lot of online tools available ex: http://www.mydnstools.info/smtprelay

Ref: http://www.postfix.org/SMTPD_ACCESS_README.html

Not the answer you're looking for? Browse other questions tagged or ask your own question.