Exim4 setup that allows me sending emails without becoming an open relay

Question

So I've acquired a VPS and a domain (my_domain.com, say), and now I'd like to set up my own, exim4-based e-mail infrastructure for learning purposes. In order not to produce an open relay I need some basic understanding about best practices for authentication.

My initial understanding is that the MTA (exim4) should act in two roles when it comes to authentication:

• When my MUA (Apple Mail on a MacBook, say) connects to it over SMTP, it must insist on authentication. If the sender address is me@my-domain.com, the username/password for (Debian) user me on the VPS should serve. My ISP assigns variable IP addresses, so I could not fix the MAU to a particular one nor do I know the applicable range. In any case, after such authentication the MTA should send (relay?) the message to the relevant MTA (at mail.your-domain.com, say) without further authentication.

• When another MTA (at mail.your-domain.com, say) contacts my MUA over SMTP it should keep it for delivery only when the target domain is my_domain.com (i.e. allow this as local domain) and dump it otherwise (i.e. not act as an open relay).

My questions is two-fold like this: Is my basic understanding correct and will the following set of answers to dpkg-reconfigure exim4-config achieve this setup/goal?

mail name: my_domain.com
IP-addresses to listen on for incoming SNMP connection: (the VPS)
local domains: mail;my_domain.com
domains to relay mail for: (none)
machines to relay mail for: (none)
keep DNS-queries minimal: no
delivery method for local mail: mbox format in /var/mail
split configuration file into small files: no
root and postmaster mail recipient: root

I'm currently puzzled because this does not mention any authentication (or on what grounds the MTA could even make a distinction between SMTP-connections from an MUA or another MTA) and whether messages to domains other than local domains will be "dumped". This looks to me as if it would allow my MTA to receive messages to my-domain.com from anywhere, not be an open relay, but also not allow my MUA to send anything via it.

Answer 1

exim is powerful and flexible enough to act in any role you want. But for normal SMTP operations the only scenario required the authentication is the "someone want to submit or relay the message via me". Submission and relaying should be strongly restricted to prevent excommunication by DNSBLs. If exim serve to some subnet, s&r is commonly restricted to that subnet. But if client hosts are wandering over the internet with dynamically changed IPs from various subnets, the only possibility to restrict clients is the authentication.

First of all you have to enable SMTP encryption with SSL/TLS

daemon_smtp_ports       = 25 : 465 : 587 
tls_on_connect_ports    = 465
tls_certificate         = /path/exim.crt
tls_privatekey          = /path/exim.key

Self-signed pair generated by openssl is enough. Encryption is an option for the plain SMTP on the port 25 or MSA on 587 and mandatory for SMTPS on 465.

Authentication will be possible only for encrypted clients to prevent passing login-pass over unencripted connection:

auth_advertise_hosts    = ${if eq{$tls_cipher}{}{}{*}}

Any non-emtpy $tls_cipher generated when TLS is established is a good sign to begin the auth.

Now we can use the ACL:

acl_smtp_connect        = acl_conn
acl_smtp_rcpt           = acl_rcpt
acl_smtp_data           = acl_data

begin acl
.....
acl_rcpt:
  accept authenticated = *
  accept         hosts =  : +relay_from_hosts
  require      domains = +relay_to_domains : +local_domains
  deny

Here we accept the message for s&r in three cases:

1. if client is authenticated
2. if client is from the list of the well-known hosts/subnets
3. if message is incoming message for one of our domains.
4. the last deny is not needed as third rule do deny implicitly, but for better comrehension I like to place the explicit final accept/deny in all cases.

The other MTAs are generally passed by third rule, no matter authenticated they are or not. We can't demand auth from the other MTAs as it isn't mandatory by RFCs. But we strongly restrict all outer MTAs to the messages for our domains only. We do not relay their messages to the other domains under any circumstances.

Answer 2

The setup that the Debian configuration offers is for normal local use. More complicated setups such as with authentication will need manual editing of the configuration.

It is probably easier to reconfigure for the split config. Then you can enable authentication in /etc/exim4/conf.d/auth/ . The file 30_exim4-config_examples contains lots of commented-out examples which should be enough to help you on your way.

The plain_server snippet uses a passwd file in /etc/exim4/ which contains usernames and passwords separated by a colon. By default exim will only offer authentication when the connection is encrypted, which is a good thing.

I use dovecot's authentication service for validating users in exim; that way if a user can access dovecot (for e.g. IMAP) then they can use the same credentials for sending email through exim.