external/mailinabox
1
0
Fork 0
mirror of https://github.com/mail-in-a-box/mailinabox.git synced 2024-11-22 02:17:26 +00:00
Code Issues Releases Wiki Activity

disable SMTP AUTH on port 25 to stop it accidentally being used for submission

Browse Source 
fixes #830
This commit is contained in:
Joshua Tauberer 2018-11-30 09:49:00 -05:00
parent b05b06c74a
commit aa52f52d02
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
setup/mail-postfix.sh
View File

@ -73,6 +73,8 @@ tools/editconf.py /etc/postfix/main.cf \
# Enable the 'submission' port 587 smtpd server and tweak its settings. # Enable the 'submission' port 587 smtpd server and tweak its settings.
# #
# * Enable authentication. It's disabled globally so that it is disabled on port 25,
# so we need to explicitly enable it here.
# * Do not add the OpenDMAC Authentication-Results header. That should only be added # * Do not add the OpenDMAC Authentication-Results header. That should only be added
# on incoming mail. Omit the OpenDMARC milter by re-setting smtpd_milters to the # on incoming mail. Omit the OpenDMARC milter by re-setting smtpd_milters to the
# OpenDKIM milter only. See dkim.sh. # OpenDKIM milter only. See dkim.sh.
@ -87,6 +89,7 @@ tools/editconf.py /etc/postfix/main.cf \
# emails but we turn this off by setting nested_header_checks empty. # emails but we turn this off by setting nested_header_checks empty.
tools/editconf.py /etc/postfix/master.cf -s -w \ tools/editconf.py /etc/postfix/master.cf -s -w \
"submission=inet n - - - - smtpd "submission=inet n - - - - smtpd
-o smtpd_sasl_auth_enable=yes
-o syslog_name=postfix/submission -o syslog_name=postfix/submission
-o smtpd_milters=inet:127.0.0.1:8891 -o smtpd_milters=inet:127.0.0.1:8891
-o smtpd_tls_security_level=encrypt -o smtpd_tls_security_level=encrypt

8
setup/mail-users.sh
View File

@ -65,11 +65,15 @@ service auth {
} }
EOF EOF
# And have Postfix use that service. # And have Postfix use that service. We *disable* it here
# so that authentication is not permitted on port 25 (which
# does not run DKIM on relayed mail, so outbound mail isn't
# correct, see #830), but we enable it specifically for the
# submission port.
tools/editconf.py /etc/postfix/main.cf \ tools/editconf.py /etc/postfix/main.cf \
smtpd_sasl_type=dovecot \ smtpd_sasl_type=dovecot \
smtpd_sasl_path=private/auth \ smtpd_sasl_path=private/auth \
smtpd_sasl_auth_enable=yes smtpd_sasl_auth_enable=no
# ### Sender Validation # ### Sender Validation