Internal open relay

[vlaurenz]

From all I have read, Scalix says that SMTP Auth is enabled by default. Currently, we are only allowing HTTPS access to our Scalix server from outside of our network. We would like to change this to allow IMAPS, POP3S, and SMTPS all via stunnel, from the outside.

Below is the dialog from a machine on my internal network. As you can see, anyone who knows how can currently spoof mail internally. How do I fix this? I have searched and it seems like support doesn't have an answer for this.

Code: Select all

$ telnet myscalixserver.mydomain 25
Trying <public IP>...
Connected to myscalixserver.mydomain (public IP).
Escape character is '^]'.
220 myscalixserver.mydomain ESMTP Scalix SMTP Relay 10.0.1.3; Mon, 26 Jun 2006 16:28:05 -0400 (EDT)
MAIL From:<relaytest@relaytest.com>
250 relaytest@relaytest.com... Sender ok
RCPT To:<scalix.user@mydomain>
250 Ok
data
354 Enter mail, end with "." on a line by itself (relay)
From: relaytest@relaytest.com
To: scalix.user@mydomain
Subject: This is an open relay internally
This is the message body
.
250 Ok
quit
221 myscalixserver.mydomain closing connection
Connection closed by foreign host.

The contents of my smtp.cfg:

Code: Select all

EXTENSIONS=AUTH,DSN,8BITMIME
RELAY accept 127.0.0.1
RELAY accept .mydomain
AUTH_SUCCESS accept ALL

RELAY Log_Reject ALL

# extra rules added to prevent open relay usage
RECIPIENT Log_Reject *@*@*
RECIPIENT Log_Reject *%*
RECIPIENT Log_Reject *!*
RECIPIENT Log_Reject *#*@*

[ScalixSupport]

Hi. I think you're confusing the meaning of an "open relay", please see this link:

http://en.wikipedia.org/wiki/Open_relay

The keywords there "relay (i.e. send) e-mail through it". If you had attempted to send to:

rcpt to: user@yahoo.com

or

rcpt to: user@earthlink.net

and it allowed those to go through, then you would definitely have an open relay. What you're trying to prevent here is spammers using your server to send mail to millions of addresses not on your server. To prevent spammers from sending to your users, you need to install something like Spamassassin to help identify what is and what isn't spam.

Thanks,
Rachel