Disable unauthenticated sending of OUTGOING email for all local users

2020-12-29 Thread Ignacio García
Hello there, and thanks so much for your help I've got a web+mail server in the same machine. PHP's mail function is disabled, but other 3rd party functions such as PHPMailer can use sendmail to potentially send emails, as if I was invoking it from a shell echo hello | sendmail m...@email.c

SPAM attack from bounce techniques

2020-12-29 Thread Rafael Azevedo
Hi there, I've noticed that one of our servers is receiving a huge amount of unauthorized requests. User connects to our server and tries to send an email to any destination. Our servers denies the message because user is not authenticated. Then, a bounce is generated to the source address, which

Connection refused / telnet: connect to address 10.5.2.1: Connection refused

2020-12-29 Thread Wolfgang Paul Rauchholz
I am setting up an email server on my home box with postfix and dovecot My server is modem router and has as such an internal and external network interface *From my laptop (LAN)*From Thunderbird I get the message: Could not connect to server localhost. The connection was refused. Testing with te

AW: SPAM attack from bounce techniques

2020-12-29 Thread ludicree
Hi Rafael, quick thoughts. Do you have smtpd_recipient_restrictions = reject_unauth_destination in your main.cf? The request should be rejected and not be queued. Greets, Ludi Von: owner-postfix-us...@postfix.org Im Auftrag von Rafael Azevedo Gesendet: Dienstag, 29. Dezem

AW: Controlling MS Azure Cloud Spam

2020-12-29 Thread ludicree
Hi, thanks for your replies. I took a second look at that spam wave and noticed that the scheme 1. Return-Path: 2. Empty From Field might not actually be true. The From field often contains something, but no FQDN. Postfix rejected the spam correctly when pointed at Az

Re: Disable unauthenticated sending of OUTGOING email for all local users

2020-12-29 Thread Nick
On 2020-12-29 12:36 GMT, Ignacio García wrote: > finding an answer to prevent sending unauthenticated email to OUTSIDE > DESTINATIONS ONLY and pretty much all I found is removing Try including permit_mynetworks in smtpd_helo_restrictions and in smtpd_sender_restrictions, but omit permit_mynetworks

Re: Connection refused / telnet: connect to address 10.5.2.1: Connection refused

2020-12-29 Thread Jan Ceuleers
On 29/12/2020 13:58, Wolfgang Paul Rauchholz wrote: > I am setting up an email server on my home box with postfix and dovecot > My server is modem router and has as such an internal and external > network interface > > *>From my laptop (LAN) > *From Thunderbird I get the message: Could not connect

Re: Connection refused / telnet: connect to address 10.5.2.1: Connection refused

2020-12-29 Thread Jim Reid
> On 29 Dec 2020, at 12:58, Wolfgang Paul Rauchholz > wrote: > > The server is listening on port 25, 587 and 465 > netstat -plutn | grep 25 and 587 > tcp0 0 127.0.0.1:250.0.0.0:* LISTEN > 28704/master > tcp0 0 127.0.0.1:587 0

Re: Javamail connection

2020-12-29 Thread James B. Byrne
On Fri, December 25, 2020 12:43, John Stoffel wrote: > > Why don't you setup a local only postfix instance on the same host as > the application, which only listed on 127.0.0.1:25, which the dumb > Java app can then send email through *without encryption*, then let > the local postfix instance

Re: [External] SPAM attack from bounce techniques

2020-12-29 Thread Kevin A. McGrail
On 12/29/2020 7:37 AM, Rafael Azevedo wrote: Hi there, I've noticed that one of our servers is receiving a huge amount of unauthorized requests. User connects to our server and tries to send an email to any destination. Our servers denies the message because user is not authenticated. Then,

Re: Disable unauthenticated sending of OUTGOING email for all local users

2020-12-29 Thread Wietse Venema
Ignacio Garc?a: > Hello there, and thanks so much for your help > > > I've got a web+mail server in the same machine. PHP's mail function is > disabled, but other 3rd party functions such as PHPMailer can use > sendmail to potentially send emails, as if I was invoking it from a shell > > echo

Re: SPAM attack from bounce techniques

2020-12-29 Thread Rafael Azevedo
Hi there, Thanks for the reply. Yes I do: smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unknown_reverse_client_hostname, reject_unknown_client_hostname, reject_unknown_sender_domain, reject_non_fqdn_recipient, reject_unauth_destination, #rejec

Re: [External] SPAM attack from bounce techniques

2020-12-29 Thread Rafael Azevedo
Hi Kevin, I think this might be related to a customized content filter after queue that we have. How should the content filter answer in case we don't want to accept the message neither for bounces or to the delivery queue? Huge thanks! Em ter., 29 de dez. de 2020 às 11:31, Kevin A. McGrail escre

Re: [External] SPAM attack from bounce techniques

2020-12-29 Thread Wietse Venema
Rafael Azevedo: > Hi Kevin, > I think this might be related to a customized content filter after queue > that we have. > How should the content filter answer in case we don't want to accept the > message neither for bounces or to the delivery queue? > Huge thanks! Options: - Run it as a before-qu

Re: SPAM attack from bounce techniques

2020-12-29 Thread Rafael Azevedo
Guys, According to this referente [1], one of the principal operations is to discard or quarantine the message. How should the MAIL FILTER respond to postfix so it could do such actions? Huge thanks, BR, Rafael [1] - http://www.postfix.org/FILTER_README.html Em ter., 29 de dez. de 2020 às 09:37

Re: [External] SPAM attack from bounce techniques

2020-12-29 Thread Rafael Azevedo
Hi Wietse, Thanks for the help ! I've just asked in another message about how to proceed in the "otherwise" option. I'm trying to quarantine the message and don't really know how to do it. Any help would be appreciated. Thanks once again. BR, Rafael Em ter., 29 de dez. de 2020 às 15:16, Wietse Ve

Re: SPAM attack from bounce techniques

2020-12-29 Thread Wietse Venema
Rafael Azevedo: > Guys, > According to this referente [1], one of the principal operations is to > discard or quarantine the message. > How should the MAIL FILTER respond to postfix so it could do such actions? EHLO blah 250 ok MAIL FROM: 250 ok RCPT TO: 250 ok DATA 351 blah header body . 250 ok Q

Re: [External] SPAM attack from bounce techniques

2020-12-29 Thread Wietse Venema
Rafael Azevedo: > Hi Wietse, > Thanks for the help ! > I've just asked in another message about how to proceed in the "otherwise" > option. > I'm trying to quarantine the message and don't really know how to do it. > Any help would be appreciated. Add a header that says this is spam, then use a ma

Re: Javamail connection

2020-12-29 Thread John Stoffel
> "James" == James B Byrne writes: James> On Fri, December 25, 2020 12:43, John Stoffel wrote: >> >> Why don't you setup a local only postfix instance on the same host as >> the application, which only listed on 127.0.0.1:25, which the dumb >> Java app can then send email through *without e

Re: AW: Controlling MS Azure Cloud Spam

2020-12-29 Thread Nick Tait
On 30/12/2020 2:38 am, ludic...@gmail.com wrote: @Nick A check for a valid FQDN in From is in smtpd_sender_restrictions. At the point where it got to bounce message, SPF was skipped. Would OpenDMARC then still work? The smtpd_sender_restrictions that you specify are applied to the /envelope