Postfix: disable authentication through port 25
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ margin-bottom:0;
}
When using Postfix and IMAP on a mailserver, at least 3 ports are usually opened
25 smtp : incoming emails from anybody (whole internet)
465 smtps : outgoing emails from authorized users (to the whole intenet)
993 imap : imap for authorized users
I would like to configure postfix, so that authorized users can only send email through 465. By default this is not so. Users can also use STARTTLS over port 25. I would like to disable that.
My plan is to use port 25 for the public sending me email
use port 465 for my users (I can use firewall to allow specific IP ranges, or use custom port)
This would prevent port 25 being exploitable from brute force attacks, where hackers try to guess user/password. Port 25 simply would not accept user/password, even if it were valid. And since port 465 is restricted by firewall, hackers cannot exploit 465 either.
Is this possible in Postfix?
I am using Postfix 2.9.6-2 on Debian Wheezy
postfix smtp imap sasl
asked Jul 19 '14 at 19:40
Martin VegterMartin Vegter
39937127243
add a comment |
When using Postfix and IMAP on a mailserver, at least 3 ports are usually opened
25 smtp : incoming emails from anybody (whole internet)
465 smtps : outgoing emails from authorized users (to the whole intenet)
993 imap : imap for authorized users
I would like to configure postfix, so that authorized users can only send email through 465. By default this is not so. Users can also use STARTTLS over port 25. I would like to disable that.
My plan is to use port 25 for the public sending me email
use port 465 for my users (I can use firewall to allow specific IP ranges, or use custom port)
This would prevent port 25 being exploitable from brute force attacks, where hackers try to guess user/password. Port 25 simply would not accept user/password, even if it were valid. And since port 465 is restricted by firewall, hackers cannot exploit 465 either.
Is this possible in Postfix?
I am using Postfix 2.9.6-2 on Debian Wheezy
postfix smtp imap sasl
asked Jul 19 '14 at 19:40
Martin VegterMartin Vegter
39937127243
1
I know this is old, but you should always allow port 587 (submission) as this is the proper port.
– lbutlr
Mar 20 '16 at 23:59
add a comment |
When using Postfix and IMAP on a mailserver, at least 3 ports are usually opened
25 smtp : incoming emails from anybody (whole internet)
465 smtps : outgoing emails from authorized users (to the whole intenet)
993 imap : imap for authorized users
I would like to configure postfix, so that authorized users can only send email through 465. By default this is not so. Users can also use STARTTLS over port 25. I would like to disable that.
My plan is to use port 25 for the public sending me email
use port 465 for my users (I can use firewall to allow specific IP ranges, or use custom port)
This would prevent port 25 being exploitable from brute force attacks, where hackers try to guess user/password. Port 25 simply would not accept user/password, even if it were valid. And since port 465 is restricted by firewall, hackers cannot exploit 465 either.
Is this possible in Postfix?
I am using Postfix 2.9.6-2 on Debian Wheezy
postfix smtp imap sasl
asked Jul 19 '14 at 19:40
Martin VegterMartin Vegter
39937127243
When using Postfix and IMAP on a mailserver, at least 3 ports are usually opened
25 smtp : incoming emails from anybody (whole internet)
465 smtps : outgoing emails from authorized users (to the whole intenet)
993 imap : imap for authorized users
I would like to configure postfix, so that authorized users can only send email through 465. By default this is not so. Users can also use STARTTLS over port 25. I would like to disable that.
My plan is to use port 25 for the public sending me email
use port 465 for my users (I can use firewall to allow specific IP ranges, or use custom port)
This would prevent port 25 being exploitable from brute force attacks, where hackers try to guess user/password. Port 25 simply would not accept user/password, even if it were valid. And since port 465 is restricted by firewall, hackers cannot exploit 465 either.
Is this possible in Postfix?
I am using Postfix 2.9.6-2 on Debian Wheezy
postfix smtp imap sasl
postfix smtp imap sasl
asked Jul 19 '14 at 19:40
Martin VegterMartin Vegter
39937127243
asked Jul 19 '14 at 19:40
Martin VegterMartin Vegter
39937127243
edited Jul 19 '14 at 20:14
Martin Vegter
asked Jul 19 '14 at 19:40
Martin VegterMartin Vegter
39937127243
asked Jul 19 '14 at 19:40
Martin VegterMartin Vegter
39937127243
asked Jul 19 '14 at 19:40
Martin VegterMartin Vegter
39937127243
39937127243
1
I know this is old, but you should always allow port 587 (submission) as this is the proper port.
– lbutlr
Mar 20 '16 at 23:59
add a comment |
1
I know this is old, but you should always allow port 587 (submission) as this is the proper port.
– lbutlr
Mar 20 '16 at 23:59
1
1
I know this is old, but you should always allow port 587 (submission) as this is the proper port.
– lbutlr
Mar 20 '16 at 23:59
I know this is old, but you should always allow port 587 (submission) as this is the proper port.
– lbutlr
Mar 20 '16 at 23:59
add a comment |
1 Answer
1
active
oldest
votes
WARNING:
The request does not follow best security practice because you disable TLS (encryption) on your main mail relay port, exposing data sent through that port to third-party listeners and/or in-flight modification. The answer below satisfies the request, but best practice requires STARTTLS for the port 25 connection as well.
The master.cf file (usually /etc/postfix/master.cf) controls the startup and configuration of specific Postfix services. A configuration like this in that file, according to the documentation, will do what you want:
smtp inet n - - - - smtpd
-o smtpd_tls_security_level=none
-o smtpd_sasl_auth_enable=no
smtps inet n - - - - smtpd
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
This configuration turns off authentication and the STARTTLS option on port 25. It turns on the STARTTLS option on port 465, requires STARTTLS usage, enables authentication, and only allows clients to connect if authenticated.
You might also look into the smtpd_tls_wrappermode option to force true TLS connections (and not STARTTLS connections).
Note that this kind of configuration can make the Postfix configuration somewhat difficult to follow (options may be set in main.cf and then overridden in master.cf). The other option is to run multiple instances of Postfix, each with their own main.cf configuration files that specify these options.
answered Jul 19 '14 at 23:40
hruntinghrunting
70455
1
if conflicting options were set inmain.cf, which ones would take preference? From what you say, it seems thatmaster.cfoverridesmain.cf. Is this correct?
– Martin Vegter
Jul 20 '14 at 9:34
1
The-ooptions override those in the configuration files. Themaster.cffile coordinates the startup of processes, and if you were to startup the processes by hand with the-ooptions, they would override whatever the configuration file specified.
– hrunting
Jul 20 '14 at 12:09
Won't-o smtpd_tls_security_level=nonekill TLS/make everything plain text in case some server is trying to relay email or some other server-to-server SMTP connection to port 25?
– TCB13
Feb 11 '18 at 21:37
The-o smtpd_tls_security_level=nonewill indeed prevent STARTTLS from working on port 25 and thus make all communication in plain-text. That is what the question requested.
– hrunting
Feb 17 '18 at 15:59
I'm still downvoting this for the above reason. Complying with OP's request is fine, but you should add a capital-letter warning that is a very bad idea. (Please let me upvote you instead, by adding that. ;-) )
– ntninja
19 hours ago
|
show 1 more comment
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f145499%2fpostfix-disable-authentication-through-port-25%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
WARNING:
The request does not follow best security practice because you disable TLS (encryption) on your main mail relay port, exposing data sent through that port to third-party listeners and/or in-flight modification. The answer below satisfies the request, but best practice requires STARTTLS for the port 25 connection as well.
The master.cf file (usually /etc/postfix/master.cf) controls the startup and configuration of specific Postfix services. A configuration like this in that file, according to the documentation, will do what you want:
smtp inet n - - - - smtpd
-o smtpd_tls_security_level=none
-o smtpd_sasl_auth_enable=no
smtps inet n - - - - smtpd
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
This configuration turns off authentication and the STARTTLS option on port 25. It turns on the STARTTLS option on port 465, requires STARTTLS usage, enables authentication, and only allows clients to connect if authenticated.
You might also look into the smtpd_tls_wrappermode option to force true TLS connections (and not STARTTLS connections).
Note that this kind of configuration can make the Postfix configuration somewhat difficult to follow (options may be set in main.cf and then overridden in master.cf). The other option is to run multiple instances of Postfix, each with their own main.cf configuration files that specify these options.
answered Jul 19 '14 at 23:40
hruntinghrunting
70455
1
if conflicting options were set inmain.cf, which ones would take preference? From what you say, it seems thatmaster.cfoverridesmain.cf. Is this correct?
– Martin Vegter
Jul 20 '14 at 9:34
1
The-ooptions override those in the configuration files. Themaster.cffile coordinates the startup of processes, and if you were to startup the processes by hand with the-ooptions, they would override whatever the configuration file specified.
– hrunting
Jul 20 '14 at 12:09
Won't-o smtpd_tls_security_level=nonekill TLS/make everything plain text in case some server is trying to relay email or some other server-to-server SMTP connection to port 25?
– TCB13
Feb 11 '18 at 21:37
The-o smtpd_tls_security_level=nonewill indeed prevent STARTTLS from working on port 25 and thus make all communication in plain-text. That is what the question requested.
– hrunting
Feb 17 '18 at 15:59
I'm still downvoting this for the above reason. Complying with OP's request is fine, but you should add a capital-letter warning that is a very bad idea. (Please let me upvote you instead, by adding that. ;-) )
– ntninja
19 hours ago
|
show 1 more comment
WARNING:
The request does not follow best security practice because you disable TLS (encryption) on your main mail relay port, exposing data sent through that port to third-party listeners and/or in-flight modification. The answer below satisfies the request, but best practice requires STARTTLS for the port 25 connection as well.
The master.cf file (usually /etc/postfix/master.cf) controls the startup and configuration of specific Postfix services. A configuration like this in that file, according to the documentation, will do what you want:
smtp inet n - - - - smtpd
-o smtpd_tls_security_level=none
-o smtpd_sasl_auth_enable=no
smtps inet n - - - - smtpd
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
This configuration turns off authentication and the STARTTLS option on port 25. It turns on the STARTTLS option on port 465, requires STARTTLS usage, enables authentication, and only allows clients to connect if authenticated.
You might also look into the smtpd_tls_wrappermode option to force true TLS connections (and not STARTTLS connections).
Note that this kind of configuration can make the Postfix configuration somewhat difficult to follow (options may be set in main.cf and then overridden in master.cf). The other option is to run multiple instances of Postfix, each with their own main.cf configuration files that specify these options.
answered Jul 19 '14 at 23:40
hruntinghrunting
70455
1
if conflicting options were set inmain.cf, which ones would take preference? From what you say, it seems thatmaster.cfoverridesmain.cf. Is this correct?
– Martin Vegter
Jul 20 '14 at 9:34
1
The-ooptions override those in the configuration files. Themaster.cffile coordinates the startup of processes, and if you were to startup the processes by hand with the-ooptions, they would override whatever the configuration file specified.
– hrunting
Jul 20 '14 at 12:09
Won't-o smtpd_tls_security_level=nonekill TLS/make everything plain text in case some server is trying to relay email or some other server-to-server SMTP connection to port 25?
– TCB13
Feb 11 '18 at 21:37
The-o smtpd_tls_security_level=nonewill indeed prevent STARTTLS from working on port 25 and thus make all communication in plain-text. That is what the question requested.
– hrunting
Feb 17 '18 at 15:59
I'm still downvoting this for the above reason. Complying with OP's request is fine, but you should add a capital-letter warning that is a very bad idea. (Please let me upvote you instead, by adding that. ;-) )
– ntninja
19 hours ago
|
show 1 more comment
WARNING:
The request does not follow best security practice because you disable TLS (encryption) on your main mail relay port, exposing data sent through that port to third-party listeners and/or in-flight modification. The answer below satisfies the request, but best practice requires STARTTLS for the port 25 connection as well.
The master.cf file (usually /etc/postfix/master.cf) controls the startup and configuration of specific Postfix services. A configuration like this in that file, according to the documentation, will do what you want:
smtp inet n - - - - smtpd
-o smtpd_tls_security_level=none
-o smtpd_sasl_auth_enable=no
smtps inet n - - - - smtpd
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
This configuration turns off authentication and the STARTTLS option on port 25. It turns on the STARTTLS option on port 465, requires STARTTLS usage, enables authentication, and only allows clients to connect if authenticated.
You might also look into the smtpd_tls_wrappermode option to force true TLS connections (and not STARTTLS connections).
Note that this kind of configuration can make the Postfix configuration somewhat difficult to follow (options may be set in main.cf and then overridden in master.cf). The other option is to run multiple instances of Postfix, each with their own main.cf configuration files that specify these options.
answered Jul 19 '14 at 23:40
hruntinghrunting
70455
WARNING:
The request does not follow best security practice because you disable TLS (encryption) on your main mail relay port, exposing data sent through that port to third-party listeners and/or in-flight modification. The answer below satisfies the request, but best practice requires STARTTLS for the port 25 connection as well.
The master.cf file (usually /etc/postfix/master.cf) controls the startup and configuration of specific Postfix services. A configuration like this in that file, according to the documentation, will do what you want:
smtp inet n - - - - smtpd
-o smtpd_tls_security_level=none
-o smtpd_sasl_auth_enable=no
smtps inet n - - - - smtpd
-o smtpd_tls_security_level=encrypt
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
This configuration turns off authentication and the STARTTLS option on port 25. It turns on the STARTTLS option on port 465, requires STARTTLS usage, enables authentication, and only allows clients to connect if authenticated.
You might also look into the smtpd_tls_wrappermode option to force true TLS connections (and not STARTTLS connections).
Note that this kind of configuration can make the Postfix configuration somewhat difficult to follow (options may be set in main.cf and then overridden in master.cf). The other option is to run multiple instances of Postfix, each with their own main.cf configuration files that specify these options.
answered Jul 19 '14 at 23:40
hruntinghrunting
70455
edited 50 mins ago
answered Jul 19 '14 at 23:40
hruntinghrunting
70455
answered Jul 19 '14 at 23:40
hruntinghrunting
70455
answered Jul 19 '14 at 23:40
hruntinghrunting
70455
70455
1
if conflicting options were set inmain.cf, which ones would take preference? From what you say, it seems thatmaster.cfoverridesmain.cf. Is this correct?
– Martin Vegter
Jul 20 '14 at 9:34
1
The-ooptions override those in the configuration files. Themaster.cffile coordinates the startup of processes, and if you were to startup the processes by hand with the-ooptions, they would override whatever the configuration file specified.
– hrunting
Jul 20 '14 at 12:09
Won't-o smtpd_tls_security_level=nonekill TLS/make everything plain text in case some server is trying to relay email or some other server-to-server SMTP connection to port 25?
– TCB13
Feb 11 '18 at 21:37
The-o smtpd_tls_security_level=nonewill indeed prevent STARTTLS from working on port 25 and thus make all communication in plain-text. That is what the question requested.
– hrunting
Feb 17 '18 at 15:59
I'm still downvoting this for the above reason. Complying with OP's request is fine, but you should add a capital-letter warning that is a very bad idea. (Please let me upvote you instead, by adding that. ;-) )
– ntninja
19 hours ago
|
show 1 more comment
1
if conflicting options were set inmain.cf, which ones would take preference? From what you say, it seems thatmaster.cfoverridesmain.cf. Is this correct?
– Martin Vegter
Jul 20 '14 at 9:34
1
The-ooptions override those in the configuration files. Themaster.cffile coordinates the startup of processes, and if you were to startup the processes by hand with the-ooptions, they would override whatever the configuration file specified.
– hrunting
Jul 20 '14 at 12:09
Won't-o smtpd_tls_security_level=nonekill TLS/make everything plain text in case some server is trying to relay email or some other server-to-server SMTP connection to port 25?
– TCB13
Feb 11 '18 at 21:37
The-o smtpd_tls_security_level=nonewill indeed prevent STARTTLS from working on port 25 and thus make all communication in plain-text. That is what the question requested.
– hrunting
Feb 17 '18 at 15:59
I'm still downvoting this for the above reason. Complying with OP's request is fine, but you should add a capital-letter warning that is a very bad idea. (Please let me upvote you instead, by adding that. ;-) )
– ntninja
19 hours ago
1
1
if conflicting options were set in
main.cf, which ones would take preference? From what you say, it seems that master.cf overrides main.cf. Is this correct?– Martin Vegter
Jul 20 '14 at 9:34
if conflicting options were set in
main.cf, which ones would take preference? From what you say, it seems that master.cf overrides main.cf. Is this correct?– Martin Vegter
Jul 20 '14 at 9:34
1
1
The
-o options override those in the configuration files. The master.cf file coordinates the startup of processes, and if you were to startup the processes by hand with the -o options, they would override whatever the configuration file specified.– hrunting
Jul 20 '14 at 12:09
The
-o options override those in the configuration files. The master.cf file coordinates the startup of processes, and if you were to startup the processes by hand with the -o options, they would override whatever the configuration file specified.– hrunting
Jul 20 '14 at 12:09
Won't
-o smtpd_tls_security_level=none kill TLS/make everything plain text in case some server is trying to relay email or some other server-to-server SMTP connection to port 25?– TCB13
Feb 11 '18 at 21:37
Won't
-o smtpd_tls_security_level=none kill TLS/make everything plain text in case some server is trying to relay email or some other server-to-server SMTP connection to port 25?– TCB13
Feb 11 '18 at 21:37
The
-o smtpd_tls_security_level=none will indeed prevent STARTTLS from working on port 25 and thus make all communication in plain-text. That is what the question requested.– hrunting
Feb 17 '18 at 15:59
The
-o smtpd_tls_security_level=none will indeed prevent STARTTLS from working on port 25 and thus make all communication in plain-text. That is what the question requested.– hrunting
Feb 17 '18 at 15:59
I'm still downvoting this for the above reason. Complying with OP's request is fine, but you should add a capital-letter warning that is a very bad idea. (Please let me upvote you instead, by adding that. ;-) )
– ntninja
19 hours ago
I'm still downvoting this for the above reason. Complying with OP's request is fine, but you should add a capital-letter warning that is a very bad idea. (Please let me upvote you instead, by adding that. ;-) )
– ntninja
19 hours ago
|
show 1 more comment
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f145499%2fpostfix-disable-authentication-through-port-25%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
I know this is old, but you should always allow port 587 (submission) as this is the proper port.
– lbutlr
Mar 20 '16 at 23:59