Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

how to config postfix when send email need login? I have config postfix server to send email to my customers. I found postfix can send mail without login. I doubt it might be used for other ones send spam email, so who can help me?

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no
append_dot_mydomain = no
#delay_warning_time = 4h
readme_directory = no
smtpd_tls_cert_file = /etc/ssl/certs/ssl-mail.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-mail.key
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
myhostname = domain.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = domain.com, localhost
#mydestination = hash:/etc/postfix/mydomains
relayhost =
relay_domains = gmail.com,hotmail.com,163.com,qq.com
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
home_mailbox = Maildir/
mailbox_command = /usr/lib/dovecot/deliver -c /etc/dovecot/conf.d/01-mail-stack-delivery.conf -m "${EXTENSION}"
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_auth_enable = yes 
smtpd_sasl_security_options = noanonymous
smtp_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
#smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination,reject_unknown_sender_domain, reject_unauth_pipelining
#smtpd_recipient_restrictions = reject_unauth_pipelining
smtpd_recipient_restrictions = permit_mynetworks,reject_invalid_hostname,reject_non_fqdn_hostname,reject_non_fqdn_sender,reject_non_fqdn_recipient,reject_unauth_destination,reject_unknown_sender_domain,reject_unknown_recipient_domain,reject_rbl_client bl.spamcop.net,permit
smtpd_helo_restrictions =
    permit_mynetworks,
    reject_non_fqdn_hostname,
    reject_invalid_hostname,
    permit
#smtpd_recipient_restrictions = reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unauth_pipelining, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
smtp_tls_security_level = may
smtpd_tls_security_level = may
smtpd_tls_auth_only = no
smtp_tls_note_starttls_offer = yes
smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
policy-spf_time_limit = 3600s
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_authenticated_header = yes
smtpd_sender_restrictions = reject_unknown_sender_domain
smtpd_client_restrictions = sleep 1,reject_unauth_pipelining, permit_sasl_authenticated
smtp_use_tls = yes
smtpd_tls_mandatory_protocols = SSLv3, TLSv1
smtpd_tls_mandatory_ciphers = medium

#authorized_submit_users = bitwolaiye
smtpd_helo_required = yes
smtp_sasl_mechanism_filter = plain, login
share|improve this question
1  
It is difficult to understand the question. Are you trying to send mail from a system connected to a dynamic IP address? Does this help? askubuntu.com/questions/91839/… –  user8290 Dec 25 '12 at 2:27
    
It is almost identical to this question. I have answered there. –  John Siu Dec 25 '12 at 5:58
    
@Christopher I have a static IP server, I use it as smtp server, but I found it can sendmail without login, so I want postfix check login before sendmail. –  ZhouQi Dec 25 '12 at 6:39
    
@JohnSiu I have try your answer , but I can sendmail without login also. –  ZhouQi Dec 25 '12 at 6:41
    
Update your question with /etc/postfix/main.cf. I think your config is too wide open. Especially "mynetwork". –  John Siu Dec 25 '12 at 6:44
show 2 more comments

1 Answer

up vote 0 down vote accepted

Try this main.cf. Test from a machine other than the email server.

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no
append_dot_mydomain = no
#delay_warning_time = 4h
readme_directory = no
smtpd_tls_cert_file = /etc/ssl/certs/ssl-mail.pem
smtpd_tls_key_file = /etc/ssl/private/ssl-mail.key
smtpd_use_tls = yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
myhostname = domain.com
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = domain.com, localhost
#mydestination = hash:/etc/postfix/mydomains
relayhost =
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = all
home_mailbox = Maildir/
mailbox_command = /usr/lib/dovecot/deliver -c /etc/dovecot/conf.d/01-mail-stack-delivery.conf -m "${EXTENSION}"
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_auth_enable = yes 
smtpd_sasl_security_options = noanonymous
smtp_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_recipient_restrictions =
        permit_mynetworks,
        permit_sasl_authenticated,
        reject_invalid_hostname,
        reject_non_fqdn_hostname,
        reject_non_fqdn_sender,
        reject_non_fqdn_recipient,
        reject_unknown_recipient_domain,
        reject_unlisted_recipient,
        reject_unauth_destination,
        reject_rbl_client cbl.abuseat.org,
        permit

smtpd_helo_restrictions =
    permit_mynetworks,
    reject_non_fqdn_hostname,
    reject_invalid_hostname,
    permit
smtp_tls_security_level = may
smtpd_tls_security_level = may
smtpd_tls_auth_only = no
smtp_tls_note_starttls_offer = yes
smtpd_tls_CAfile = /etc/ssl/certs/cacert.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
policy-spf_time_limit = 3600s
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_authenticated_header = yes
smtpd_sender_restrictions = reject_unknown_sender_domain
smtpd_client_restrictions = sleep 1,reject_unauth_pipelining, permit_sasl_authenticated
smtp_use_tls = yes
smtpd_tls_mandatory_protocols = SSLv3, TLSv1
smtpd_tls_mandatory_ciphers = medium

#authorized_submit_users = bitwolaiye
smtpd_helo_required = yes
smtp_sasl_mechanism_filter = plain, login
share|improve this answer
    
oh,yes. I think 'reject_rbl_client cbl.abuseat.org' is usefull. –  ZhouQi Dec 25 '12 at 7:25
    
You can add more. But test frequently. They die from time to time and will really screw up. –  John Siu Dec 25 '12 at 7:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.