6

My postfix e-mail server is finally working well.

Now, I need to prevent users from forging their e-mail addresses in the client programs in the "from" field in the header, because a user can send email as other user with that, and a unexperienced user can think that is real.

If a user is experienced, he can inspect the email headers and know what is happening, but is there a way to block this behaviour?

  • So, how gmail does that? I tried to change my email name using gmail, and i am blocked immediately! so... – Luciano Andress Martini Jul 6 '16 at 20:49
  • @Shadur SMTP doesn't, but this protection can be made on top of SMTP. The local sender (postfix) must check the user names (LHS of the From address) exactly as requested in this question, and must sign the headers in such a way that the recipient machine can verify which machine sent the email (search "DKIM"). – Gilles Jul 6 '16 at 23:44
  • Pretty much. Unfortunately I had a train to catch, hence lack of a longer response. – Shadur Jul 7 '16 at 7:20
  • Tarleb. Thank you. Now this security issue gone away, you answer are great! – Luciano Andress Martini Jul 8 '16 at 19:40
9

Have a look at the smtpd_sender_restrictions and smtpd_sender_login_maps settings. The former can prevent malformed from addresses, while the latter can force the sender address to match the login name.

# Prevent malformed senders
smtpd_sender_restrictions =
    reject_non_fqdn_sender       # Ensure correct mail addresses
    reject_unknown_sender_domain # Ensure sender address is from your domain
    reject_authenticated_sender_login_mismatch # Check if the user is 
                                 # allowed to use this sender address

# Maps used to stop sender address forgeries.
smtpd_sender_login_maps = pcre:/etc/postfix/login_maps.pcre

The contents of login_maps.pcre could be

# Use this regex if your users are local users, i.e. if the login name does
# is just the username, not a full mail address.  Note that literal dots
# have to be backslash escaped (`\.`) to avoid interpretation of these dots
# as regex wildcard.
/^([^@+]*)(\+[^@]*)?@example\.com$/ ${1}
# If one doesn't care about subaddresses, this could be simplified to
/^(.*)@example\.com/ ${1}

# This is appropriate if you have virtual users who login with their
# full mail address as their username.  Local addresses won't work, though
/^(.*)$/    ${1}

The above config assumes that postfix was compiled with support for PCRE. On Ubuntu/Debian, this requires the postfix-pcre package to be installed.

Note that this will only work if nobody but authenticated users can send mail. If you allow mail from unauthenticated users, the above method won't help and will fail. Make sure to read Rui F Ribeiro's answer if that's the case.

  • 2
    I suggest adding reject_unknown_sender_domain after reject_non_fqdn_sender; the login_maps are quite interesting, assuming all users have to login to send email; wont it create problems with non-authenticated emails, if any? ; You also need postfix compiled with pcre. – Rui F Ribeiro Jul 6 '16 at 22:14
  • 1
    Thanks @RuiFRibeiro :) This friendly, solution oriented atmosphere here at SE is what I love the most. – tarleb Jul 7 '16 at 6:42
  • 2
    yeah, i know. i used to maintain the postfix-tls package when there was still such a thing as the non-us archive. debian likes to not take choices away from people with pre-compiled packages, even if the choices don't make much sense. in practice, pretty much everyone installs postfix-pcre along with postfix. – cas Jul 7 '16 at 6:48
  • 1
    @tarleb, I would suggest adding to the post that if in Debian or Ubuntu, you need to install the postfix-pcre package – Rui F Ribeiro Jul 7 '16 at 6:53
  • 3
    that's because they split out the pcre functionality into a separate module package so that users could choose. postfix-pcre contains little more than /usr/lib/postfix/postfix-pcre.so.1.0.1 – cas Jul 7 '16 at 6:54
1

While SMTP forging cannot be prevented, and the underlying protocol was not designed with security in mind, you can minimise in postfix the effects of email forging by your internal users.

You can configure your postfix and clients to be mandatory to authenticate to send email via port 587 with authentication.

That does not however prevent them from sending email, however, it makes the life of spam malware more difficult (but not impossible).

As for gmail, they have lots of the customisations to the code, or even their own proprietary email server. Back when I managed an ISP, I collected and wrote extensions to QMail that did not allow it to forward emails that were not from our domain, and also only accepting existing authenticated users in the FROM field (e.g. double checking the FROM with the user doing the authentication)

To relay email only for authenticated users in postfix, make sure you have in the file /etc/postfix/main.cf at the beginning of the smtpd_recipient_restrictions directive the following two options:

smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination

For more details, please check the official documentation at Postfix SMTP relay and access control

  • Rui, thank you for the information i think its is already mandatory, how can i check this in the configuration file? – Luciano Andress Martini Jul 6 '16 at 20:54
  • @LucianoAndressMartini talking about patches, have a look at the VDA patches for postfix. Cheers. – Rui F Ribeiro Jul 7 '16 at 6:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.