Whitelist mail domains and users to smtp on mail server

Question

Lately our mail server (postfix 2.9.6, ubuntu 12.04, courier) got compromised by spammers that are send plenty of dummy mails to many recipients.

The spammers used two different ways:

1. using real domain on my server but fake user account that didn't exist
2. using fake sender mail (user and domain),

I had to blacklist each one by one on /etc/postfix/main.cf:

smtpd_sender_restrictions = check_sender_access hash:/etc/postfix/sender_access

/etc/postfix/sender_access:

fake-domain.com   DISCARD
[email protected] DISCARD

Is there a way to secure my server more as to allow only some white-list that contains the server's real domain and all user accounts I have, and block any other fake senders?

Answer 1

Your smtp should be set up so that only internal clients can access it. In Postfix this looks something like the following (obviously with your internal IP range).

smtpd_relay_restrictions = permit_mynetworks
mynetworks = 127.0.0.0/8 192.168.0.0/24

In smtpd_relay_restrictions you may also want to add permit_sasl_authenticated and set up SASL authentication for clients. You can then require all clients to be authenticated to be able to send emails outside of your servers destinations (defined by mydestination). See here or here among many others for a detailed description of setting up SASL for Postfix.

If you set it up with mynetworks, an external attacker (connecting from the internet) will not be able to use your smtp as an open relay. If an internal client is compromised, you have to fix that internal client, but requiring authentication from internal clients as well mitigates that risk somewhat (but a compromised client will potentially give away the credentials to the smtp server too).

Also one common mistake is when you put our smtp behind a firewall, set up your smtp to only allow local clients to send emails to external addresses, and then have your firewall rewrite packages with the source IP set to that of the firewall as opposed to the external client - so your smtp sees external traffic from the internal firewall IP address. You can fix this either by not rewriting the source address of packages, or not having the firewall address in mynetworks.