OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: Problems with backscaters and require authentication (Was: Digest of postfix-users list V1 #2211)

From: mouss (moussnetoyen.net)
Date: Wed Dec 03 2008 - 04:24:55 CST


anebiiguanait.com a écrit :
>> ------------------------------
>>
>> Date: Tue, 02 Dec 2008 14:50:21 +0100
>> From: mouss <moussnetoyen.net>
>> Subject: Re: Problems with backscaters and require authentication
>>
>> anebiiguanait.com a écrit :
>>> Hi,
>>>
>>> i have some problems with spammers and i would like to ask how to set
>>> postfix to validate sender email addresses only for our domains. Is
>>> there some way to do this?
>> what do you mean exactly by "validate"? check that the address exists?
>> you can use reject_unlisted_sender.
>>
>>> Other thing that i want to ask. I have this problem:
>>>
>>> i connect thru telnet to the smtp server and send email this way:
>>>
>>> helo myhostname.example.com
>>> mail from:realusermydomain.com
>>> rcpt to:realusermydomain.com
>>> data
>>> something here
>>> .
>>> quit
>>>
>>> mydomain.com is domain from the system.
>>>
>>> i'm able to send spam to this user, using the same email address in
>>> "mail from" field.
>>>
>>> Is there some way to protect my mailserver from this kind of things for
>>> our domains. If "mail from" use our domains (for example
>>> usernamemydomain.com), then to require authentication.
>>>
>>
>> smtpd_sender_login_maps =
>> hash:/etc/postfix/sender_login
>>
>> smtpd_sender_restrictions =
>> reject_sender_login_mismatch
>>
>>
>> http://www.postfix.org/postconf.5.html#smtpd_sender_login_maps
>>
>>
>
> Hi, thanks for the reply. Yes i mean to check if sender exists, but only
> for our domains, not for all senders, because there are mail servers
> that reject this kind of checking.
>
> I suppose that when i configure this way my system, it will not make
> problems with rest of senders, right?

yes, it's ok. use reject_unlisted_sender in smtpd restrictions.

you can use (with or without reject_unlisted_sender):
smtpd_reject_unlisted_sender = yes