Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hey I set up Postfix to use cyrus SASL implantation and I'm able to login and send emails, but I can still telnet on port 25 and send mails even if I'm not authenticated, which I whish to deny.

smtp_sasl part of my main.cf:

smtpd_sasl_path = smtpd
smtpd_sasl_type = cyrus
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_sasl_security_options = noanonymous
smtpd_recipient_restrictions = reject_non_fqdn_recipient, reject_non_fqdn_sender, reject_unlisted_recipient, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_invalid_hostname, reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_rbl_client, sbl-xbl.spamhaus.org, reject_rbl_client, bl.spamcop.net, reject_rbl_client, list.dsbl.org, reject_rbl_client, rbl.mail-abuse.org, reject_rbl_client, spamsources.fabel.dk

Full config here

Did I forgot something?

Telnet Log:

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2014.04.20 16:10:32 =~=~=~=~=~=~=~=~=~=~=~=
220 the999ers.eu ESMTP Postfix (Debian/GNU)
ehlo kim-nuernberger.eu
250-the999ers.eu
250-PIPELINING
250-SIZE 10240000
250-VRFY
250-ETRN
250-STARTTLS
250-AUTH PLAIN LOGIN
250-AUTH=PLAIN LOGIN
250-ENHANCEDSTATUSCODES
250-8BITMIME
250 DSN
MAIL FROM: test@kim-nuernberger.eu
250 2.1.0 Ok
RCPT TO: trash@kim-nuernberger.eu
DATA
250 2.1.5 Ok
354 End data with <CR><LF>.<CR><LF>
Subject: test
This is a test mail
.
250 2.0.0 Ok: queued as B82481DF1CE
quit
221 2.0.0 Bye

this was captured from my local pc and I connected via my domain kim-nuernberger.eu.

Postfix log (/var/log/mail.log)

Apr 20 16:31:37 The999ers postfix/smtpd[16420]: connect from unknown[2a03:4000:2:206::1]
Apr 20 16:31:57 The999ers postfix/smtpd[16420]: 25CED1DF1CE: client=unknown[2a03:4000:2:206::1]
Apr 20 16:32:13 The999ers postfix/cleanup[16425]: 25CED1DF1CE: message-id=<20140420143157.25CED1DF1CE@kim-nuernberger.eu>
Apr 20 16:32:13 The999ers postfix/qmgr[16407]: 25CED1DF1CE: from=<test@kim-nuernberger.eu>, size=385, nrcpt=1 (queue active)
Apr 20 16:32:14 The999ers postfix/smtp[16426]: 25CED1DF1CE: to=<trash.kim.nuernberger@hotmail.de>, orig_to=<trash@kim-nuernberger.eu>, relay=mx4.hotmail.com[65.55.37.104]:25, delay=25, delays=23/0.01/0.47/1.1, dsn=2.0.0, status=sent (250  <20140420143157.25CED1DF1CE@kim-nuernberger.eu> Queued mail for delivery)
Apr 20 16:32:14 The999ers postfix/qmgr[16407]: 25CED1DF1CE: removed
Apr 20 16:32:14 The999ers postfix/smtpd[16420]: disconnect from unknown[2a03:4000:2:206::1]

Note: I updated the log after fixing some unnecessary problems.

share|improve this question
    
What address are you "telnetting" from, and to? – grawity Apr 17 '14 at 15:06
    
@grawity I telnet from my local adress to my domain, or did you mean somethig different? – Kimmax Apr 17 '14 at 15:28
up vote 3 down vote accepted
+50

It is because you might have tried to send mail from the server(i.e telnet localhost 25) itself and in your smtpd_recipient_restrictions permit_mynetworks comes before permit_sasl_authenticated and so the clients listed in mynetworks (localhost in your case) need not authenticate. Rearrange the restrictions to achieve what you want.

More info: postfix docs

Edit 1:

Thanks for the telnet and postfix logs. postfix will not require authentication to receive mails for the domains it handle under mydestination,relay_domains virtual_alias_domains and virtual_mailbox_domains. Users will not be able to relay to external domains(i.e the domains that are remote. eg. gmail.com) unless they authenticate and this is the expected behaviour.

share|improve this answer
    
Well I open the telnet connection from my local pc and connect via the domain (kim-nuernberger.eu in this case) to the server, so this shouldn't happen, right? – Kimmax Apr 18 '14 at 17:05
    
Can you give the IP address or it's prefix of your local pc and your server? – clement Apr 20 '14 at 12:48
    
Even removing permit_mynetworks doesn't work at all.. – Kimmax Apr 20 '14 at 13:34
    
can you update the question with the telnet command that worked and the postfix log lines generated for the same? – clement Apr 20 '14 at 13:56
1  
Hey postfix will not require authentication to receive mails for the domains it handle under mydestination,relay_domains virtual_alias_domains and virtual_mailbox_domains. Users will not be able to relay to external domains(i.e the domains that are remote. eg. gmail.com) unless they authenticate and this is the expected behaviour. – clement Apr 20 '14 at 15:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .