We are currently using dovecot for smtp auth, and due to an increase in
spammers abusing smtp auth we setup dovecot to return an invalid login
for user's that have been set to "disabled" in our provisioning system.
This seemed to work for a while (preventing spammers that are using
auth), but we are finding that a number of spammers are somehow keeping
their smtp connection open after we have "disabled" smtp auth and
continuing to send messages even though the authentication should be
failing. We are not sure why this is the behavior or even what we
should be looking for to determine how they are circumventing the
authentication.
postconf -n:
alias_database = hash:/etc/aliases
alias_maps = hash:/etc/aliases
broken_sasl_auth_clients = yes
command_directory = /usr/sbin
config_directory = /etc/postfix
daemon_directory = /usr/libexec/postfix
data_directory = /var/lib/postfix
debug_peer_level = 2
default_destination_recipient_limit = 1000
default_process_limit = 1000
header_checks = regexp:/etc/postfix/header_checks
html_directory = no
inet_interfaces = all
inet_protocols = all
mail_owner = postfix
mailbox_size_limit = 52224000
mailq_path = /usr/bin/mailq.postfix
manpage_directory = /usr/share/man
message_size_limit = 52224000
mydestination = $myhostname, localhost.$mydomain, localhost
myhostname = server.domain.tld
mynetworks = $config_directory/mynetworks
newaliases_path = /usr/bin/newaliases.postfix
queue_directory = /var/spool/postfix
readme_directory = /usr/share/doc/postfix-2.6.6/README_FILES
recipient_bcc_maps = hash:/etc/postfix/recipient_bcc
relayhost = relay.domain.tld
sample_directory = /usr/share/doc/postfix-2.6.6/samples
sendmail_path = /usr/sbin/sendmail.postfix
setgid_group = postdrop
smtp_data_done_timeout = 900s
smtp_data_init_timeout = 900s
smtp_data_xfer_timeout = 900s
smtp_helo_timeout = 900s
smtp_mail_timeout = 900s
smtp_tls_note_starttls_offer = yes
smtpd_client_event_limit_exceptions = static:all
smtpd_helo_required = yes
smtpd_recipient_restrictions = permit_mynetworks, check_client_access
mysql:/etc/postfix/authb4smtp.cf, check_client_access
cidr:/etc/postfix/access permit_sasl_authenticated,
reject_unauth_destination
smtpd_sasl_auth_enable = yes
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = dovecot
smtpd_sender_restrictions = reject_unknown_sender_domain,
reject_non_fqdn_sender, permit
smtpd_tls_CAfile = /etc/postfix/tls.ca.crt
smtpd_tls_auth_only = no
smtpd_tls_cert_file = /etc/postfix/tls.crt
smtpd_tls_key_file = /etc/postfix/tls.key
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:/var/lib/postfix/smtpd_tls_cache
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
unknown_local_recipient_reject_code = 550
