8

Am I misinterpreting the results of netstat -anp --tcp --udp | grep LISTEN wrong, or does the output mean, that the process exim4 is listening to the outside on port 25:

tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1960/exim4            
tcp6       0      0 ::1:25                  :::*                    LISTEN      1960/exim4    

Could this be considered a security risk in a default Debian installation?

  • 2
    You are misinterpreting the output of netstat. @enzotib is correct. Exim bound itself to the loopback address -- and while it is certainly willing to accept connection attempts from anywhere, only connections coming in over the loopback interface will reach it to begin with. – Shadur Nov 10 '11 at 14:49
9

As you see, it only listens on localhost (both IPv4 and IPv6), so I suppose it is not a security risk, but better to wait for a guru to come in.

| improve this answer | |
  • 1
    Exim has a pretty good track record as far as security vulnerabilities go. If it does ever have a problem, this configuration would allow anyone allowed to log into the machine to exploit it. So, this is only a problem if you don't trust someone you've given login access to. – Warren Young Nov 10 '11 at 20:30
  • In other words, the output does mean that exim4 is only listening for connections on the local machine (127.0.0.1 is the IPv4 local host address and ::1 is the IPv6 local host address). You can check that with telnet mycomputer 25 or nmap -p25 mycomputer from another machine. – Gilles 'SO- stop being evil' Nov 10 '11 at 23:24
1

It is not really a security risk, as it is only accessible to processes already running on the server. There are residual risks which are applicable to all mail delivery software:

  • It is possible to send sufficient email to a user to use up their quota. This assumes you have quotas enabled, which is not the case on default install.
  • Potential to cause code to run as a result of sending the mail. Exim has a good record for being a secure mail delivery system.
  • Potential to cause Exim to raise the load average to cause slow performance.

On a default install, there are far simpler ways to directly cause the problems that could potentially be create via Exim.

Some tools expect to send email via SMTP rather than using the sendmail functionality built into Exim. Disabling the ports will still allow email to be sent using the sendmail method, so disabling the listener is unlikely to increase security.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.