How to restrict
access to the SMTP server
|
|
Author: Darrell May
Problem 1: You want to restrict access to the SMTP server to allow only your ISP to connect and relay e-mail for your domain. Problem 2: You want to block someone from accessing your SMTP server and sending e-mails to your users. |
|
Solution 1: HowTo restrict access
to the SMTP server to allow only your ISP to connect and relay e-mail
for your domain.
Here are the steps required to restrict access to the SMTP server on e-smith so that only local networks and your defined IP ranges are able to connect to your SMTP server. This is a good way to prevent hackers from accessing your SMTP server for spamming or for sending viruses. In my case, I had a client who uses an ISP mail relay server for all inbound and outbound mail delivery. The ISP checks for viruses inbound and outbound and I wanted to permit only the ISP mail relay server and local networks access to the SMTP server. I wanted to block all other attempts to directly connect to the SMTP server, which would of course bypass the ISP virus check. |
|
One file controls access to the SMTP
server. It is /etc/smtpd_check_rules which is actually a
link to /var/spool/smtpd/etc/smtpd_check_rules. A typical
default setting is shown below:
#------------------------------------------------------------ |
|
Here is a look at the two most important
Allow sections above:
# Allow relaying from the local network This basically says, "allow full access inbound and outbound to the SMTP server if the source came from one of your local networks". These networks are your defaults of course plus any others you assign via the e-smith-manager Local Networks panel. # Allow any of our domains This basically says, "allow full access inbound to the SMTP server if they are sending to yourdomain.com". This is the one we want to change to restrict inbound access to our ISP relay servers. To do this simply create a new template fragment as follows and edit the entry as appropriate. In my case I wanted to restrict access to my ISP relay servers which use the IP range 209.17.184.0/24: mkdir -p
/etc/e-smith/templates-custom/var/spool/smtpd/etc/smtpd_check_rules Here is the original file: { In my case, I simply needed to edit both lines of "allow:ALL:ALL:" to "allow:209.17.184.0/24:ALL:" which now restricts access to that IP range only. Then to finish simply expand the template and restart SMTP. I choose to execute these commands: /sbin/e-smith/expand-template /var/spool/smtpd/etc/smtpd_check_rules Now my clients SMTP server is restricted and permits access from their local networks and their ISP mail-relay-server only. |
|
Solution 2: HowTo block someone
from accessing your SMTP server and sending e-mails to your users.
You simply need to create a custom smtpd_check_rules template entry named 10DenyList following these steps: mkdir -p
/etc/e-smith/templates-custom/var/spool/smtpd/etc/smtpd_check_rules Then enter the following lines replacing $EmailBlocks with a valid entry as shown below: # Block access to the SMTP server
from: Address pattern examples:
Then to finish simply expand the template and restart SMTP. I choose to execute these commands: /sbin/e-smith/expand-template /var/spool/smtpd/etc/smtpd_check_rules |
|