0

On my server, I need to send email via Postfix. The SMTP settings are as follows and these work. Email is sent via Gmail properly:

relayhost = [smtp.gmail.com]:587
smtp_use_tls = yes
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_tls_CAfile = /etc/ssl/certs/ca-bundle.crt
smtp_sasl_security_options = noanonymous
smtp_sasl_tls_security_options = noanonymous

The issue is that nmap shows port 25 to be open.

# nmap -p1-65535 localhost

Starting Nmap 6.40 ( http://nmap.org ) at 2019-04-18 16:02 EDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0000070s latency).
Other addresses for localhost (not scanned): 127.0.0.1
Not shown: 65530 closed ports

PORT     STATE    SERVICE
25/tcp   open     smtp
80/tcp   open     http
443/tcp  open     https

Am I correct in presuming that port 25 can be closed if our Postfix is using external Gmail SMTP? Googling for port 25 closure as many ISPs do to prevent spammy relaying, there's a mixed bag of advice.

In my specific case, I only need Postfix to highly selectively work to send email from the server to myself. Nowhere else. All email via Wordpress etc is done via plugins which support Gmail SMTP.

This is what's running on port 25 for now:

# lsof -i :25
COMMAND   PID USER   FD   TYPE  DEVICE SIZE/OFF NODE NAME
master  31853 root   13u  IPv4 2073744      0t0  TCP Serv:smtp (LISTEN)
master  31853 root   14u  IPv6 2073745      0t0  TCP Serv:smtp (LISTEN)

Can I close port 25?

0

The method by which your postfix installation sends email (i.e. relaying via gmail in your case) has nothing to do with how your postfix installation receives email. Normal behaviour for a MTA (mail transport agent) is to listen to the SMTP port (25) for incoming email.

It is possible that some application on your system will be sending email by connecting to localhost:25; in that case you will still need postfix to listen to port 25. You could limit it to port 25 on localhost in that case: edit the master.cf file and replace the smtp at the beginning of the line with 127.0.0.1:smtp.

If you are absolutely certain that nothing connects to port 25 when sending mail, then simply comment out the line beginning with smtp.

Don't forget to restart postfix after modifying its configuration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.