1

I have an application (written in PHP) which sends email using SMTP and runs on the same system as the email server. Are there any security concerns about using port 25 on localhost rather than port 587 on the server's external IP with TLS?

Thanks

Improve this question
4
  • a port is a port. There is no difference between port 25 instead of port 587.
    – Ramhound
    Jun 27, 2014 at 13:40
  • There is a difference, because the mail server will not accept TLS on port 25.
    – Keith M
    Jun 27, 2014 at 17:26
  • That sounds like an server application limitation and/or a configuration problem. I was speaking from a pure technical perspective.
    – Ramhound
    Jun 27, 2014 at 22:35
  • I know what you mean, but a port is just an advertised connection to a server, so its behavior is defined by that server. That's not really an application limitation and/or configuration problem.
    – Keith M
    Jun 29, 2014 at 5:45

1 Answer 1

Reset to default
0

My guess here, with a strictly localhost connection, is that you'd need root access to peek at any data flowing back and forth to the server. At that point a malicious user could find the data using many other means.

If true, I think you're fine with the "listen only on localhost" connection.

That said, bear in mind that these things tend to expand, and soon you may want to check mail from afar. Then you'd want TLS. You can revisit it then, or bite the bullet now.

Improve this answer
1
  • This application only sends, and no change is expected in that behavior. Not being an email expert, the thing I'm not clear about is what happens when the email is relayed from localhost to the destination mail server. Does that only get encrypted if my application makes a TLS connection?
    – Keith M
    Jun 27, 2014 at 16:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .