Home / server / Questions / 366151
Accepted
shanet
Asked: 2012-03-05 00:46:23 +0800 CST

Postfix: Allow unauthenticated incoming mail, but only authenticated outgoing mail?

  • 772

I'm new to the world of mail server's and have been working on setting up my own via Postfix on Ubuntu 11.10. So far, I have SASL authentication working over TLS so that's good; I'm worrying about security now.

In short: I want Postfix to accept all unauthenticated incoming mail, but only allow authenticated outgoing mail. This also makes me wonder if I have STARTTLS and TLS support on ports 465 and 587, do I still need to listen on port 25? Will mail servers try to deliver mail on port 587 if 25 is closed?

But back to the allow unauthenticated incoming, but only authenticated outgoing, I tried adding

-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject

to the smtp line in my master.cf file, but then that blocks unauthenticated incoming mail. Is there a way to only allow incoming on port 25, and leave ports 465/587 for outgoing only?

I'm not sure what good it would do, but I can post the rest of my config if necessary. Any help is greatly appreciated since I'm new to all this and it's still confusing. Thank you!

ubuntu smtp postfix tls

2 Answers

  1. Best Answer

    As you have understood that to apply options in master.cf to override options in main.cf on a per-port basis.

    To achieve your goal you want to place the restriction as smtpd_recipient_restrictions rather than smtpd_client_restrictions. The key is to reject_unauth_destination instead of just reject:

    mydestination = aardvark.com, acme.com 
smtpd_recipient_restrictions = permit_sasl_authenticated,reject_unauth_destination

    This prevents an unauthenticated client from sending to any domain you're not responsible for. In this context domains you're responsible for are more than just mydestination. See reject_unauth_destination in the manual.

    • 4

  2. I have been looking for hours to solve this and your answer is spot-on Couling.

    For more information, this also works when using Plesk/CentOS (my situation). Especially when using Plesk the value permit_mynetworks is also added to the smtpd_recipient_restrictions variable by default, allowing all Plesk domains to send SMTP mail out without authentication.

    See: http://forum.parallels.com/showthread.php?296391-Plesk-domains-can-submit-emails-through-unauthenticated-SMTP

    Also added to main.cf for security reasons (for anyone interested;

    smtpd_client_connection_count_limit = 20
smtpd_sasl_authenticated_header = yes
maximal_queue_lifetime = 1d
    • 0