| View previous topic :: View next topic |
| Author |
Message |
harsha
n00b
Joined: 19 Jul 2002
Posts: 37
Location: Philadelphia, PA
|
 Posted: Sat Oct 11, 2003 8:50 am Post subject: securing postfix, apache, etc |
 |
|
Hi all,
I just managed to get my mail server running, and noticed that i could do the following:
| Code: |
telnet aoboc.com 25
helo spam.com
mail from: some@spam.com
rcpt to: user@aoboc.com or any other email for that matter
...
and so on...
|
basically, my postfix server is allowing anyone to connect to port 25 and send email.
I'm assuming it must be something to do with the local_recipient_maps parameter in main.cf file, i could'nt understand it completely. Can anyone tell me how I can avoid this? Obviously, i only want the users under aoboc.com to be able to use that postfix server. I'm surprised this isnt set to this way by default in postfix config, but i wouldnt know better...
Also, what other things do i need to secure before I open this mail server to the internet. Like, wt kinda firewall rules need to be applied to something like apache or postfix. I mean, they have to be accessible from anywhere for someone to view ur site, or send u an email right? I've found a few, but just incase i missed something, do u know of any good references (links) to securing your web/mail server (apache/postfix/mysql/php..the usual).
thanks,
harsha |
|
| Back to top |
|
 |
BenjyD_UK
n00b
Joined: 03 Sep 2003
Posts: 44
|
| Posted: Sat Oct 11, 2003 9:36 am Post subject: Local network |
|
|
Postfix will relay mail from machines on your local network by default, but is not an open relay. Try telnetting to that machine from an ip not on your local network and I doubt that will work. You can use www.ordb.org to check if your server is an open relay - they run a service that will try to use all sorts of tricks to get your server to relay mail.
Blocking by the from header isn't much use, as a spammer could still send email as you. If you want to relay from machines not on your local net, look into smtp auth.
As for firewall rules, there's nothing special for apache etc beyond the obvious. Only ports running external services should be visible from the outside (probably 22,25,80,143), of course, but that's about it. |
|
| Back to top |
|
|
harsha
n00b
Joined: 19 Jul 2002
Posts: 37
Location: Philadelphia, PA
|
| Posted: Sat Oct 11, 2003 4:18 pm Post subject: |
|
|
| Quote: | | Try telnetting to that machine from an ip not on your local network and I doubt that will work. |
Actually, that was the problem, I telnetted to the server from a completely different ip, and i was able to do wt I mentioned before. Thanks for the great link, I had no idea such a tool was available...
harsha |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Networking & Security
