Block local relay without authentication

brandon45

• June 29, 2015 04:27

I've noticed that I can send mail from any existing user to any other existing user on the server without authentication, for example if I have two domains hosted on whm domainone.com and domaintwo.com I can send mails from mail@domainone.com to mai@domaintwo.com or even to himself without the need to authenticate is there an exim acl that I can use to block it(I don't want to enforce spf)?

• 

  storminternet

  • June 29, 2015 17:43

  Are you using any script or application to send emails from one domain to another or using outlook ?

  0
• 

  brandon45

  • June 29, 2015 17:58

  Are you using any script or application to send emails from one domain to another or using outlook ?

  
  I'm not, I want to block it because I'm receiving spam messages from for example mail@mydomain.com[/EMAIL] to mail@mydomain.com[/EMAIL]

  0
• 

  cPanelMichael

  • July 20, 2015 14:45

  Hello :) How are you sending the email without authentication (e.g. email client, script)? Are you sure that you are not just spoofing the "FROM" address? Have you reviewed the message header to see if it shows the actual sender address? Thank you.

  0
• 

  brandon45

  • July 20, 2015 16:54

  Hello :) How are you sending the email without authentication (e.g. email client, script)? Are you sure that you are not just spoofing the "FROM" address? Have you reviewed the message header to see if it shows the actual sender address? Thank you.

  
  I'm using telnet, for example
  ehlo test.local mail from: rcpt to: data .
  

  0
• 

  cPanelMichael

  • July 21, 2015 14:39

  What shows up in the message header for the sender? Thank you.

  0
• 

  brandon45

  • July 21, 2015 14:53

  What shows up in the message header for the sender? Thank you.

  
  
  Return-path: Envelope-to: account@mydomain.com Delivery-date: Mon, 20 Jul 2015 18:53:55 +0200 Received: from [x.x.x.x] (port=6312 helo=test.local) by myserver.com with esmtp (Exim 4.85) (envelope-from ) id 1ZHEK8-00089t-W8 for account@mydomain.com; Mon, 20 Jul 2015 18:53:55 +0200
  

  0
• 

  Martinho Novais

  • August 19, 2015 11:02

  Hi! I have the same problem. I already have active either SPF and DKIM to this account. But, if in the "Sender" is a valid email account, and the "Recipient" is a valid email account for the same domain or from the another domain in the same machine, the message is delivery without autentication. How you can see, who is generate this message is an IP address that isn't mine. (ceil.webhostingireland.ie - 91.210.235.40 ) How can it is possible? Is there any kind of solution for this problem?
  Delivery Event Details Event: success Sender User: -remote- Sender Domain: Sender: scxxxxira@sisxxxa4.pt[/EMAIL] Sent Time: Aug 19, 2015 4:19:04 AM Sender Host: ceil.domain.ie Sender IP: 91.210.235.40 Authentication: localdelivery Spam Score: -1.2 Recipient: emxxxs@sisxxxa4.pt[/EMAIL] Delivered To: emxxxs@sisxxxa4.pt[/EMAIL] deliveryuser: sisxxxa4 deliverydomain: sisxxxa4.pt Router: virtual_user Transport: virtual_userdelivery Out Time: Aug 19, 2015 4:19:04 AM ID: 1ZRtuN-0006nX-QX Delivery Host: localhost Delivery IP: 127.0.0.1 Size: 6.89 KB Result: Accepted
  

  0
• 

  cPanelMichael

  • August 28, 2015 13:17

  I already have active either SPF and DKIM to this account.

  
  Hello :) Try enabling the "Reject SPF Failures" option if you want SPF records verified for incoming email. It's found under the "ACL Options" tab in "WHM Home " Service Configuration " Exim Configuration Manager". Thank you.

  0

Please sign in to leave a comment.