I am able to do the following and connect successfully without any type of credentials:

telnet <IP Address> 25

When I am in I can verfiy emails, send emails, etc. I feel like this is a security risk. Is there a way of putting some type of protection in place to block direct access from happening like that? This has been tested externally and internally, both yield same results.

  • Is there any reason you can't just block port 25 entirely and use SSH instead? – Philip Rowlands Jun 25 '19 at 15:39
  • @PhilipRowlands That server utilizes an application(icewarp) that needs that port open to send mail out. – dlw Jun 25 '19 at 15:44
  • There is no need to keep the port open to the outside in order to send mail to outside, i.e. there should be no harm in blocking this port for outside access if it is only needed by icewarp on the same host. – Steffen Ullrich Jun 25 '19 at 17:16
  • 1
    @PhilipRowlands It's an SMTP server (notice both the port and the "send emails, etc." parts), and therefore has no idea how to respond to an SSH client. – CBHacking Jun 25 '19 at 23:32
  • @CBHacking Thanks for the correction! I really need to stop looking at questions close to 5pm. :) – Philip Rowlands Jun 26 '19 at 7:47

The search string you are looking for is "SMTP server require authentication" (or just "<server product name> authentication"). To be clear, what you're establishing isn't really a "Telnet Connection", it's an SMTP connection that you're typing in by hand using telnet. If you tried to send anything that wasn't valid SMTP traffic, the server would ignore it or disconnect. You could also use clients other than telnet - anything that supports arbitrary TCP connections would work - and the server has no way to know what program is being run as the client anyhow.

Mind you, even after you set your SMTP server to require authentication, you'll still be able to telnet to it. All that telnet is doing is establishing a TCP connection. There's nowhere in a TCP handshake to supply credentials; that comes after the connection is established (see https://en.wikipedia.org/wiki/SMTP_Authentication for more info).

You should also look into enabling TLS (the same Transport Layer Security protocol used in HTTPS) on your server. Even with authentication, sending mail via an insecure connection allows an attacker to potentially read or even modify the mail. Authenticating over an insecure connection potentially allows an attacker to steal your credentials, or at least replay them to authenticate as you at a later time, unless you use a protocol very specifically designed to be secure against that. Therefore, switching to TLS should be done before authentication.

| improve this answer | |
  • Thank you for this. That makes a lot of sense . – dlw Jun 26 '19 at 21:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.