0

I am having trouble configuring my mail server (Dovecot and Postfix). The problem is that someone can send spam mails to my address from my own mail server. The server is not open-relay but it seems to be half-open.

Example:

alice@example.de
bob@example.de

Bad Guy sends spam from:
alice@example.de to alice@example.de

OR from
bob@example.de to alice@example.de

without needing any password.

Sending spam to others is not possible. I tried sending a mail to my own domain from my own domain via Telnet and it was possible without password. How can I prevent this?

migrated from security.stackexchange.com May 17 '16 at 4:57

This question came from our site for information security professionals.

0

1) Enable mail loging in /etc/rsyslog.conf

mail.*;mail.debug                                               -/var/log/maillog

service rsyslog restart

2) Try to find out how these messages are taken by postfix

3) add correct rules to main.cf

something like this:

smtpd_relay_restrictions = permit_sasl_authenticated,
        check_recipient_access hash:/etc/postfix/accept_my_domains,
        check_recipient_access hash:/etc/postfix/access,
        check_recipient_access hash:/etc/postfix/block_recipient,
        check_helo_access hash:/etc/postfix/check_hello,
        reject_unknown_recipient_domain,
        reject_unauth_destination,
        reject_invalid_hostname,
        reject_unauth_pipelining,
        reject_non_fqdn_recipient,
        reject_unverified_recipient,
        permit_auth_destination,
        reject
  • I don't think it's a matter of looking at logs, it's a matter of understanding the first comment – Sum1sAdmin May 17 '16 at 8:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy