为防止postfix邮件服务器被人冒用，使用它发送伪造的垃圾邮件，进行了以下实验，添加了smtp验证。
分析smtp发送
把内部IP从邮件 的信任网络中去掉， 然后测试邮件发送（依靠邮件发件人）
- root@slackbox[~]# telnet mail.XXXXXX.com 25
- Trying 10.70.253.52...
- Connected to mail.XXXXXX.com.
- Escape character is '^]'.
- 220 mail.XXXXXX.com ESMTP Postfix
- mail from: abc@XXXXXX.com #直接发起邮件， 未进行SMTP认证,并伪造发件人为abc@XXXXXX.com, abc为实际不存在的用户
- 250 2.1.0 Ok #服务器返回OK， 说明服务器未对sender进行认证
- rcpt to: jhuang@XXXXXX.com #指定收件人为我本人
- 250 2.1.5 Ok #服务器返回OK
- data #写邮件
- 354 End data with <CR><LF>.<CR><LF>
- sfafafdsfafasfasfas
- afsdasfsfasfsafas
- . #结束写邮件并发送
- 250 2.0.0 Ok: queued as 6C0FC3D5288 #服务器返回邮件已进入发送队列
同时， 邮件服务器的日志显示，邮件已经发送:status=sent，上述实验表明了 邮件服务器没有经过smtp认证。
增加smtp认证， 堵住漏洞
Postfix配置
- #指定发件人认证登录
- smtpd_sender_login_maps = ldap:/etc/postfix/ldap-users.cf,
- ldap:/etc/postfix/ldap-mailbox.cf
- #不允许不在列表中的发件人
- smtpd_reject_unlisted_sender = yes
- #需要helo信息
- smtp_helo_required = yes
- smtpd_recipient_restrictions 段增加下面内容：
- reject_sender_login_mismatch
- reject_authenticated_sender_login_mismatch,
- reject_unauthenticated_sender_login_mismatch,
- reject_non_fqdn_hostname,
- reject_non_fqdn_sender,
- reject_non_fqdn_recipient,
- reject_invalid_hostname,
测试一： 试图不通过验证直接发邮件
- #telnet mail.XXXXXX.com 25
- Trying 10.70.253.52...
- connected to mail.XXXXXX.com.
- Escape character is '^]'.
- 220 "mail.XXXXXX.com Mail System"
- mail from: jhuang@XXXXXX.com
- 50 2.1.0 Ok
- rcpt to: jhuang@XXXXXX.com
- 553 5.7.1 <jhuang@XXXXXX.com>: Sender address rejected: not logged in
证明发送邮件需要作SMTP认证, 没有认证的不允许发送邮件。
测试二： 试图SMTP认证， 并以伪造不存在的邮件地址发送邮件
- # telnet mail.XXXXXX.com 25
- Trying 10.70.253.52...
- Connected to mail.XXXXXX.com.
- Escape character is '^]'.
- 220 "mail.XXXXXX.com Mail System"
- auth login
- 334 VXNlcm5hbWU6
- amh1YW5n
- 334 UGFzc3dvcsfafafafmQ6
- bG92ZXdpbm5pZXlpbg==
- 235 2.7.0 Authentication successful
- mail from: abc@XXXXXX.com
- 250 2.1.0 Ok
- rcpt to: jhuang@XXXXXX.com
- 550 5.1.0 <abc@XXXXXX.com>: Sender address rejected: User unknown in local recipient tabl
证明不允许伪造不存在的本地邮件地址发邮件
测试三:试图通过SMTP认证， 并仿冒他人邮件地址发送邮件
- # telnet mail.XXXXXX.com 25
- Trying 10.70.253.52...
- Connected to mail.XXXXXX.com.
- 220 "mail.XXXXXX.com Mail System"
- auth login
- 334 VXNlcm5hbWU6
- amh1YW5n
- 334 UGFzlllllkokopkc3dvcmQ6
- bG92ZXdpbm5pZXlpbg==
- 235 2.7.0 Authentication successful
- mail from: lxiong@XXXXXX.com
- 250 2.1.0 Ok
- rcpt to: jhuang@XXXXXX.com
- 553 5.7.1 <lxiong@XXXXXX.com>: Sender address rejected: not owned by user jhuang
证明登录用户与邮件发送人不一致时， 禁止发送邮件
测试四：禁止邮件中继
- #telnet mail.XXXXXX.com 25
- Trying 10.70.253.52...
- Connected to mail.XXXXXX.com.
- Escape character is '^]'.
- 220 mail.XXXXXX.com ESMTP Postfix
- mail from: address1@163.com
- 250 2.1.0 Ok
- rcpt to: address2@yeah.net
- 554 5.7.1 <address2@yeah.net>: Recipient address rejected: Access denied