Dotaz: bezpecny postfix

[cartman]

Dobry den,

Zacnem trochu netradicne, main.cf:

queue_directory = /srv/spool/postfix
mail_spool_directory = /srv/spool/mail
command_directory = /usr/sbin
daemon_directory = /usr/lib/postfix
mail_owner = postfix
default_privs = nobody
myorigin = $myhostname
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
unknown_local_recipient_reject_code = 450
mynetworks_style = host
mynetworks = 192.168.1.0/24, 127.0.0.0/8
mailbox_command = /usr/bin/procmail
debug_peer_level = 2
debugger_command =
         PATH=/bin:/usr/bin:/usr/local/bin
         xxgdb $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/sbin/sendmail
newaliases_path = /usr/bin/newaliases
mailq_path = /usr/bin/mailq
setgid_group = postdrop
manpage_directory = /usr/share/man
sample_directory = /usr/share/doc/postfix-2.1.5-r1/sample
readme_directory = /usr/share/doc/postfix-2.1.5-r1/readme
default_destination_concurrency_limit = 10
local_destination_concurrency_limit = 2
alias_maps = hash:/etc/mail/aliases
alias_database = hash:/etc/mail/aliases
home_mailbox = .maildir/
smtpd_sasl_auth_enable = yes
smtpd_sasl2_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain =
broken_sasl_auth_clients = yes
smtpd_client_restrictions =
                        permit_sasl_authenticated,
                        permit_tls_all_clientcerts,
                        reject_unauth_pipelining,
                        reject_unknown_sender_domain,
                        reject_unauth_destination
smtpd_recipient_restrictions =
                        permit_sasl_authenticated,
                        reject_unknown_sender_domain,
                        reject_unauth_pipelining,
                        reject_unknown_recipient_domain,
                        reject_non_fqdn_sender,
                        reject_non_fqdn_recipient,
                        reject_non_fqdn_hostname,
                        reject_unauth_destination
smtpd_sender_restrictions =
                        permit_sasl_authenticated,
                        reject_authenticated_sender_login_mismatch,
                        reject_sender_login_mismatch,
                        #reject_unknown_sender_domain,
                        #reject_unlisted_sender,
                        #reject_unverified_sender,
                        reject_unauth_destination
smtpd_use_tls=yes
smtpd_tls_auth_only = yes
smtpd_tls_key_file = /etc/postfix/newreq.pem
smtpd_tls_cert_file = /etc/postfix/newcert.pem
smtpd_tls_CAfile = /etc/postfix/cacert.pem
smtpd_tls_loglevel = 3
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
### New stuff
#local_recipient_maps = $alias_maps unix:passwd.byname
disable_vrfy_command = yes
allow_untrusted_routing = no
#maps_rbl_domains = sbl.spamhaus.org, relays.ordb.org
smtp_tls_note_starttls_offer = yes
smtpd_delay_reject = yes
#smtpd_enforce_tls = yes

master.cf:

smtp      inet  n       -       n       -       -       smtpd -v
smtps    inet  n       -       n       -       -       smtpd -v
     -o smtpd_enforce_tls=no -o smtpd_sasl_auth_enable=yes

Plus je tu este courier-imap-ssl a cyrus-sasl. Autentifikuje sa cez pam. Cele by to malo vyzerat tak ze uzivatelia ktory maju shell konto mozu pouzivat mail. Maily im mozu chodit a oni mozu posielat; plus si mozu postu pozriet aj cez imap. Vseko funguje ako ma, ale nie som si isty ci je postfix bezpecne nakonfigurovany. Hlavne tie restrictions som si neni celkom isty. Trapi ma to, ze sa moze niekto telnetnut na port 25 a poslat mail localnemu uzivatelovi. Prosim pochopte, ze konfigurujem nieco take prvy krat. Uvitam kazdu radu.

Odpovědi

[jm]

Trapi ma to, ze sa moze niekto telnetnut na port 25 a poslat mail localnemu uzivatelovi. Prosim pochopte, ze konfigurujem nieco take prvy krat. Uvitam kazdu radu.

Nevim, co vas na tom trapi. To je normalni funkce MTA, ze pres nej lze poslat mail uzivatelum.

[cartman]

chcel by som to maximalne obmedzit

[Michal Čihař]

No jestli nechceš přijímat maily z venku, tak nastav inet_interfaces jenom na loopback, případně interní interface.