OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: security hole -- anynomous user can send email from my postfix

From: JOYDEEP (j.bakshiunlimitedmail.org)
Date: Mon Apr 02 2007 - 04:37:57 CDT


mouss wrote:
> JOYDEEP wrote:
>>
>>
>> Exactly I am looking for such a solution.
>> How can I use LDAP with postfix for user authentication
>> or
>> how to use the authentication u are asking for ?
>>
>
> start by adding
> reject_unlisted_recipient
> reject_unlisted_sender
> at the top of your smtpd_recipient_restrictions.

I have done smtpd_recipient_restrictions = reject_unlisted_sender

and now I can't send mail even as a valid user. have I done anything
wrong here ?
please suggest.

>
> this will reject mail using non existent addresses. people can still
> forge email. You must understand that this is not a problem for
> everybody. If it is for you, then you can enforce authentication and
> login<->sender match.
>
> In short you need to the following
> 1- setup sasl. check the SASL README. The Book of Postfix is a
> recommended reading... (mouss's still trying to earn his beer:)
> 2- you'll need to setup a
> http://www.postfix.org/postconf.5.html#smtpd_sender_login_maps
> and use
> http://www.postfix.org/postconf.5.html#reject_sender_login_mismatch
> in your smtpd restrictions, before permit_sasl_authenticated
>
> If you have programs or internal relays sending mail, make sure these
> won't get blocked.
>
>