Home / server / Questions / 422468
In Process
Lock
Asked: 2012-08-30 04:46:06 +0800 CST

Postfix- open relay. How to configure so it is not?

  • 772

I have setup Postfix but am having trouble with the setup.

Whenever I used to send emails to the server, it reject my mails saying 'Relaying Denied', so I changed the following in main.cf:

mynetworks = 0.0.0.0/0
mynetworks_style = subnet

I can now send email and it works, but MX tests say that it is an open relay (obviously unintended).

How can I resolve this? I obviously want anybody to be able to email my domain, but I'm unsure of the configuration.

I know I can change the mynetworks, but then doesn't this restrict who CAN email to the server?

centos

4 Answers

  1. mynetworks must only contain trusted users that can use the server to relay mails to other domains - otherwise, as you've found, it's an open relay. You might want to set it to 192.168.0.0/16, 10/8 or 172.16.0.0/12 if using RFC 1918 addresses on your internal network.

    The settings that control whether people can send mail to your server include mydestination and virtual_mailbox_domains - read the docs here or here.

    • 5

  2. The problem that opens you up is the 

    mynetworks = 0.0.0.0/0

    Cause somewhere below you probably have it listed in

    smtpd_recipient_restrictions = ... permit_mynetworks ...

    If you need to be able to send email from any ip then you just look at enabled a user/password to send email which the common one is sasl

    • 5

  3. As documented at http://www.postfix.org/postconf.5.html#mynetworks :

    mynetworks (default: see "postconf -d" output)
    The list of "trusted" remote SMTP clients that have more privileges than "strangers".

    In particular, "trusted" SMTP clients are allowed to relay mail through Postfix.
    See the smtpd_recipient_restrictions parameter description in the postconf(5) manual.

    • 3

  4. use authentification only for yours ip: main.cf

    smtpd_recipient_restrictions =
    permit_mynetworks
    reject_unauth_destination

    use file to store your ip main.cf:

    mynetworks = hash:/etc/postfix/network_table

    Use script to update your ip if change (run in cron)

    #!/bin/bash
###
## sh /sx_sys/postfix_mynetwork_ip_checker.sh
LOGFILE="/var/log/smtp_relay.log"

curent_ip=$(dig @exemple.com exemple.com | awk '/^;; ANSWER SECTION:$/ { getline ; print $5 }')
#echo $curent_ip

saved_ip=$(</etc/postfix/network_table )
#echo $saved_ip
if [ "$curent_ip OK" != "$saved_ip" && -n "$curent_ip"]; then
echo "$curent_ip OK" > "/etc/postfix/network_table"
postmap /etc/postfix/network_table
echo "$(date) smtp allow for $curent_ip" >> $LOGFILE 2>&1
mail -s "smtp allow for $curent_ip $(date)" [email protected] < /dev/null
fi
exit 0
    • 0