OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: "reject_unverified_recipient" and "unverified_recipient_reject_code" question

From: Justin Piszcz (jpiszczlucidpixels.com)
Date: Thu Feb 07 2008 - 09:25:34 CST


On Thu, 7 Feb 2008, Alejandro Facultad wrote:

> Noel Jones wrote:
>> Alejandro Facultad wrote:
>>> Dear all, I have Postfix 2.3.8 as my mail server and I want this: if
>>> someone write a message to a non existant mail account from my domain,
>>> he/she must get a response code = 250 and not 550. I want the same
>>> response code that he/she will obtain in case of writting to an
>>> existing mail account.
>>>
>>> I edit the main.cf adding "reject_unverified_recipient" and
>>> "unverified_recipient_reject_code = 250" in this way but people
>>> writting to a non valid mail account still get the 550 error code:
>>>
>>> smtpd_recipient_restrictions =
>>> check_recipient_access hash:/etc/postfix/access
>>> permit_mynetworks
>>> reject_unknown_sender_domain
>>> reject_unauth_destination
>>> check_policy_service unix:private/policy
>>> reject_unverified_recipient
>>>
>>>
>>> unverified_recipient_reject_code = 250
>>>
>>> Thanks in advance
>>>
>>> Alejandro
>>
>> What exactly is the point of this? This sounds like a really bad idea.
>>
>> Don't use reject_unverified_recipient if you don't want to reject unverified recipients.
>>
>
> Noel, I want people from Internet that send messages to non existant
> users from my domain they don't get an error code (550) but they must
> get an 250 success code. They don't have to know which mail accounts
> are valid or invalid, they must see ALL accounts as valid, because
> nowadays there are a lot of intruders getting our mail accounts,
> probing time after time via telnet port 25 and if they get code 250
> they get a valid account. We want the intruders always get code 250 so
> they can't discriminate between valid and invalid mail accounts.
>
> I work for a company with strong security policies for mail accounts.
>
> Thanks a lot.
>

What you need is these two lines (and don't use the
reject_unverified_recipient, which was mentioned earlier)

In your main.cf:

luser_relay = username_to_dump_non_existent_mail_to
local_recipient_maps =

Justin.