![Postfix 充当域邮箱的开放中继](https://linux22.com/image/665719/Postfix%20%E5%85%85%E5%BD%93%E5%9F%9F%E9%82%AE%E7%AE%B1%E7%9A%84%E5%BC%80%E6%94%BE%E4%B8%AD%E7%BB%A7.png)
我有一个在 Debian 7.8 上运行并配置了 postfix 2.9.6 的邮件服务器。
我的限制如下:
smtpd_sender_restrictions = reject_sender_login_mismatch, reject_unknown_sender_domain, reject_non_fqdn_sender, reject_unlisted_sender, permit_sasl_authenticated, reject_unauth_destination, permit_mynetworks
#smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, check_helo_access pcre:/etc/postfix/helo_access.pcre
smtpd_client_restrictions = permit_sasl_authenticated, permit_mynetworks
smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination
问题是电子邮件别名可以在没有授权的情况下向内部用户发送邮件
示例(所有请求都是在客户端的身份验证关闭的情况下发出的,而不是从本地主机发出的):
[email protected] -> [email protected] --> Mail sent
[email protected] -> [email protected] --> Mail sent
[email protected] -> [email protected] --> Mail sent
[email protected] -> [email protected] --> Mail sent
[email protected] -> [email protected] --> Sender address rejected: not logged in
[email protected] -> [email protected] --> Sender address rejected: not logged in
[email protected] -> [email protected] --> Relay access denied
[email protected] -> [email protected] --> Relay access denied
其中邮箱是数据库中的任何虚拟用户
有什么想法吗?谢谢!
答案1
编辑:读到reject_unverified_sender可能导致黑名单,我已删除id,现在问题又回来了
我想我已经通过以下限制解决了这个问题:
smtpd_client_restrictions = permit_sasl_authenticated, permit_mynetworks
#smtpd_helo_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_non_fqdn_helo_hostname, reject_invalid_helo_hostname, check_helo_access pcre:/etc/postfix/helo_access.pcre
smtpd_sender_restrictions = permit_sasl_authenticated, reject_unverified_sender, reject_sender_login_mismatch, reject_unknown_sender_domain, reject_non_fqdn_sender, reject_unlisted_sender, reject_unauth_destination, permit_mynetworks
smtpd_recipient_restrictions = permit_sasl_authenticated, reject_unauth_destination
我缺少的选项是reject_unverified_sender,我在permit_sasl_authenticated之后添加了它,这样我仍然可以使用别名发送邮件。