configuring sendmail

[kaancho12]

it seems that the spammers are able to relay mail using non-existent account on our server. for example even though webmaster@abc.com doesnt exist in our users account(at abc.com) they can relay message through that.
i checked the file /etc/mail/access and it had these settings:
localhost.localdomain RELAY
localhost RELAY
127.0.0.1 RELAY
companyip RELAY
is there a way to configure sendmail so that only users that exist in our server are able to relay messages through the ip.
thanks
'ko12

 

[RhythmAce]

You really should be using smtpauth. The way things work right now is that when mail gets sent through your server it relays it unless you specifically tell it not to. Then once the cows got out, the pop server will authenticate the user by checking user name and password. There are two things you can do. One is to use a method called pop-before-smtp which is somewhat out dated nowadays. The prefered way is to use smtpauth which requires saslauthd to be installed and running. Then you need to add or uncomment a couple lines in sendmail.mc. I will post them for you in my next post.

 

[RhythmAce]

TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl

This will cause the smtp server to ask for the user's name and password before it will relay any mail. The drawback to this is if you have a lot of users. You will need to tell all of them that they will need to configure their mail client to give this info. It's really very simple. For example, if they are using outlook, they can go to Tools > Accounts then highlight the account and click properties. click on the "Servers" tab and in the section for the outgoing server check the box that says "This server requires authentication". There should be a button to configure it and when the window pops up just click on "Use the same info and the incoming server". Close the window and save. No mail will be lost. They just won't be able to send any mail until this is done.

 

[kaancho12]

thanks for your advice. one problem though is that there are some scripts that are run through cron-jobs that send out emails too. and they exist on company ip not on the host- machine. i will read more on smtpauth in the meantime.
thanks
ko12

 

[RhythmAce]

Your scripts will still work because they run as a valid user on your system. They also access sendmail directly rather then the smtp port which tells it right off the bat that it's a local user.

 

[BitFuzzy]

as RhythmAce indicated, services or scripts (or local requests) will not have a problem.

Another option to smtpauth is pop-before-smtp which has served me very well for some time.. both do about the same thing, though SMTP_AUTH is the current method being utilized.

I just don't like to monkey with things that work