postfix邮件服务器安全

 为防止postfix邮件服务器被人冒用，使用它发送伪造的垃圾邮件，进行了以下实验，添加了smtp验证。

分析smtp发送
把内部IP从邮件 的信任网络中去掉， 然后测试邮件发送（依靠邮件发件人）

 

root@slackbox[~]# telnet mail.XXXXXX.com 25
Trying 10.70.253.52...
Connected to mail.XXXXXX.com.
Escape character is '^]'.
220 mail.XXXXXX.com ESMTP Postfix
mail from: [email protected] #直接发起邮件， 未进行SMTP认证,并伪造发件人为[email protected], abc为实际不存在的用户
250 2.1.0 Ok #服务器返回OK， 说明服务器未对sender进行认证
rcpt to: [email protected]  #指定收件人为我本人
250 2.1.5 Ok #服务器返回OK
data #写邮件
354 End data with <CR><LF>.<CR><LF>
sfafafdsfafasfasfas
afsdasfsfasfsafas
. #结束写邮件并发送
250 2.0.0 Ok: queued as 6C0FC3D5288 #服务器返回邮件已进入发送队列

同时， 邮件服务器的日志显示，邮件已经发送:status=sent，上述实验表明了 邮件服务器没有经过smtp认证。

增加smtp认证， 堵住漏洞
Postfix配置

 

#指定发件人认证登录
smtpd_sender_login_maps = ldap:/etc/postfix/ldap-users.cf,
ldap:/etc/postfix/ldap-mailbox.cf
#不允许不在列表中的发件人
smtpd_reject_unlisted_sender = yes
#需要helo信息
smtp_helo_required = yes
smtpd_recipient_restrictions 段增加下面内容：
reject_sender_login_mismatch
reject_authenticated_sender_login_mismatch,
reject_unauthenticated_sender_login_mismatch,
reject_non_fqdn_hostname,
reject_non_fqdn_sender,
reject_non_fqdn_recipient,
reject_invalid_hostname,

测试一： 试图不通过验证直接发邮件

 

#telnet mail.XXXXXX.com 25
Trying 10.70.253.52...
connected to mail.XXXXXX.com.
Escape character is '^]'.
220 "mail.XXXXXX.com Mail System"
mail from: [email protected]
50 2.1.0 Ok
rcpt to: [email protected]
553 5.7.1 <jhuang@XXXXXX.com>: Sender address rejected: not logged in

证明发送邮件需要作SMTP认证, 没有认证的不允许发送邮件。

测试二： 试图SMTP认证， 并以伪造不存在的邮件地址发送邮件

 

# telnet mail.XXXXXX.com 25
Trying 10.70.253.52...
Connected to mail.XXXXXX.com.
Escape character is '^]'.
220 "mail.XXXXXX.com Mail System"
auth login
334 VXNlcm5hbWU6
amh1YW5n
334 UGFzc3dvcsfafafafmQ6
bG92ZXdpbm5pZXlpbg==
235 2.7.0 Authentication successful
mail from: [email protected]
250 2.1.0 Ok
rcpt to: [email protected]
550 5.1.0 <abc@XXXXXX.com>: Sender address rejected: User unknown in local recipient tabl

证明不允许伪造不存在的本地邮件地址发邮件

测试三:试图通过SMTP认证， 并仿冒他人邮件地址发送邮件

 

# telnet mail.XXXXXX.com 25
Trying 10.70.253.52...
Connected to mail.XXXXXX.com.
220 "mail.XXXXXX.com Mail System"
auth login
334 VXNlcm5hbWU6
amh1YW5n
334 UGFzlllllkokopkc3dvcmQ6
bG92ZXdpbm5pZXlpbg==
235 2.7.0 Authentication successful
mail from: [email protected]
250 2.1.0 Ok
rcpt to: [email protected]
553 5.7.1 <lxiong@XXXXXX.com>: Sender address rejected: not owned by user jhuang

证明登录用户与邮件发送人不一致时， 禁止发送邮件

测试四：禁止邮件中继

 

#telnet mail.XXXXXX.com 25
Trying 10.70.253.52...
Connected to mail.XXXXXX.com.
Escape character is '^]'.
220 mail.XXXXXX.com ESMTP Postfix
mail from: [email protected]
250 2.1.0 Ok
rcpt to: [email protected]
554 5.7.1 <address2@yeah.net>: Recipient address rejected: Access denied