Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Hey I set up Postfix to use cyrus SASL implantation and I'm able to login and send emails, but I can still telnet on port 25 and send mails even if I'm not authenticated, which I whish to deny.

smtp_sasl part of my main.cf:

smtpd_sasl_path = smtpd
smtpd_sasl_type = cyrus
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_sasl_security_options = noanonymous
smtpd_recipient_restrictions = reject_non_fqdn_recipient, reject_non_fqdn_sender, reject_unlisted_recipient, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_invalid_hostname, reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_rbl_client, sbl-xbl.spamhaus.org, reject_rbl_client, bl.spamcop.net, reject_rbl_client, list.dsbl.org, reject_rbl_client, rbl.mail-abuse.org, reject_rbl_client, spamsources.fabel.dk

Full config here

Did I forgot something?

Telnet Log:

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2014.04.20 16:10:32 =~=~=~=~=~=~=~=~=~=~=~=
220 the999ers.eu ESMTP Postfix (Debian/GNU)
ehlo kim-nuernberger.eu
250-the999ers.eu
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
MAIL FROM: test@kim-nuernberger.eu
250 2.1.0 Ok
RCPT TO: trash@kim-nuernberger.eu
DATA
250 2.1.5 Ok
354 End data with <CR><LF>.<CR><LF>
Subject: test
This is a test mail
.
250 2.0.0 Ok: queued as B82481DF1CE
quit
221 2.0.0 Bye

this was captured from my local pc and I connected via my domain kim-nuernberger.eu.

Postfix log (/var/log/mail.log)

Apr 20 16:31:37 The999ers postfix/smtpd[16420]: connect from unknown[2a03:4000:2:206::1]
Apr 20 16:31:57 The999ers postfix/smtpd[16420]: 25CED1DF1CE: client=unknown[2a03:4000:2:206::1]
Apr 20 16:32:13 The999ers postfix/cleanup[16425]: 25CED1DF1CE: message-id=<20140420143157.25CED1DF1CE@kim-nuernberger.eu>
Apr 20 16:32:13 The999ers postfix/qmgr[16407]: 25CED1DF1CE: from=<test@kim-nuernberger.eu>, size=385, nrcpt=1 (queue active)
Apr 20 16:32:14 The999ers postfix/smtp[16426]: 25CED1DF1CE: to=<trash.kim.nuernberger@hotmail.de>, orig_to=<trash@kim-nuernberger.eu>, relay=mx4.hotmail.com[65.55.37.104]:25, delay=25, delays=23/0.01/0.47/1.1, dsn=2.0.0, status=sent (250  <20140420143157.25CED1DF1CE@kim-nuernberger.eu> Queued mail for delivery)
Apr 20 16:32:14 The999ers postfix/qmgr[16407]: 25CED1DF1CE: removed
Apr 20 16:32:14 The999ers postfix/smtpd[16420]: disconnect from unknown[2a03:4000:2:206::1]

Note: I updated the log after fixing some unnecessary problems.

share|improve this question
    
What address are you "telnetting" from, and to? –  grawity Apr 17 '14 at 15:06
    
@grawity I telnet from my local adress to my domain, or did you mean somethig different? –  Kimmax Apr 17 '14 at 15:28

1 Answer 1

up vote 2 down vote accepted
+50

It is because you might have tried to send mail from the server(i.e telnet localhost 25) itself and in your smtpd_recipient_restrictions permit_mynetworks comes before permit_sasl_authenticated and so the clients listed in mynetworks (localhost in your case) need not authenticate. Rearrange the restrictions to achieve what you want.

More info: postfix docs

Edit 1:

Thanks for the telnet and postfix logs. postfix will not require authentication to receive mails for the domains it handle under mydestination,relay_domains virtual_alias_domains and virtual_mailbox_domains. Users will not be able to relay to external domains(i.e the domains that are remote. eg. gmail.com) unless they authenticate and this is the expected behaviour.

share|improve this answer
    
Well I open the telnet connection from my local pc and connect via the domain (kim-nuernberger.eu in this case) to the server, so this shouldn't happen, right? –  Kimmax Apr 18 '14 at 17:05
    
Can you give the IP address or it's prefix of your local pc and your server? –  clement Apr 20 '14 at 12:48
    
Even removing permit_mynetworks doesn't work at all.. –  Kimmax Apr 20 '14 at 13:34
    
can you update the question with the telnet command that worked and the postfix log lines generated for the same? –  clement Apr 20 '14 at 13:56
1  
Hey postfix will not require authentication to receive mails for the domains it handle under mydestination,relay_domains virtual_alias_domains and virtual_mailbox_domains. Users will not be able to relay to external domains(i.e the domains that are remote. eg. gmail.com) unless they authenticate and this is the expected behaviour. –  clement Apr 20 '14 at 15:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.