IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [postfix]

16 questions
68
votes
1 answer

Unusual mail headers show evidence of MTA attack. Have I been pwned?

Today I found an extremely unusual email in my catchall inbox, without subject, sender or content. My Gmail client for android reported the mail was sent by me, triggering a nuclear alert in my mind. I had fear that someone had guessed my robust…
usr-local-ΕΨΗΕΛΩΝ
  • 5,310
  • 2
  • 17
  • 35
3
votes
1 answer

Why are my emails going to spam?

I have been trying to learn about phishing emails. I have read up quite a bit on it. I setup a domain somthing.tk (free domain), hosted a website on a VPS (Digital Ocean). Set up my own mail transfer agent (Postfix). Now I have set…
yeah_well
  • 3,699
  • 1
  • 13
  • 30
3
votes
1 answer

Is `tls_preempt_cipherlist = yes` in postfix a good idea nowadays?

Postfix' own documentation says it may cause issues, but only mentions "Windows 2003 Microsoft Exchange clients". Everything else I've found (first was CheckTLS, as far as I've been able to find, that's why it says "Has server cipher order? nope…
Henrik supports the community
  • 207
  • 1
  • 10
3
votes
1 answer

How should output of fail2ban postfix-sasl look like

I want to be sure that fail2ban is properly banning failed postfix SASL login attempts. When I do iptables -L I can see list of banned hosts for SSHD, but I can't figure out a way to see banned hosts for SASL. postfix SASL is enabled, which I can…
Aleksandar Pavić
  • 272
  • 2
  • 11
2
votes
2 answers

DMARC report for mails I didn't send

I set up DKIM, DMARC and SPF on my domain/server a few years ago, and never touched it again since then. Here are my DNS records (my domain is mydomain.com and my IP addresses are 1.1.1.1 and 2001::1): mydomain.com. 0 TXT "v=spf1 mx a ptr…
Foo
  • 23
  • 3
2
votes
1 answer

Is TLS 1.3 supported in Dovecot 2.3.4 and Postfix 3.3.2?

I would like to configure an email CentOS 7-based server to use TLS 1.3. Currently it uses TLS 1.2 for securing the SMTP and POP3 sessions. For SMTP I use Postfix software and for POP3 I use Dovecot software. I am interested in using only TLS 1.3 in…
Nancy Price
  • 21
  • 1
  • 3
1
vote
1 answer

Postfix pickup daemon "from:" verification

I was surprised to notice that sending email from a local server account allows any user to send a message with: From: whatever@whateverdomain This is a security issue, because it allows identity spoofing. When sending email from a local server…
user228896
1
vote
3 answers

POST requests are bypassing PHP checks

I have a website with a contact form on PHP and a mail server. Email are sent with the help of PHP mail function like so $name = cleanInput($_POST["name"]); $e = $_POST["email"]; $email = filter_var(cleanInput($e), FILTER_SANITIZE_EMAIL); if…
yaugenka
  • 113
  • 4
1
vote
1 answer

Postfix SMTP - Can I use SSH public keys instead of sasl password

I am relatively new to managing mail server, although i am familiar with webhosting servers not running dedicated email services. Postfix is configured to use sasl-password authentication I have setup a mail server and am noticing repeated brute…
adam
  • 13
  • 3
0
votes
0 answers

Dealing with particular clients wrt TLS support in postfix?

External (other) Mail clients have started to deny/de-list anonymous ciphersuites. But the TLS support is often spotty. Worse, some clients (mainly Windows, which does not care one whit about your RFC specs or lists of common protocols and does its…
aphid
  • 273
  • 1
  • 6
0
votes
2 answers

My postfix server is getting DOSed, what can I do?

Port 25 is open and I'm getting thousands of emails. How can I make it stop?
evening
  • 461
  • 1
  • 6
  • 15
0
votes
0 answers

Unrecognized mails sent from my mail server - please help to find the "hole"

Since about 2 weeks, I am receiving from time to time (about 2-3 times per week) similar emails: What do I have: A VPS (webserver) with Wordpress, configured to send emails via SMTP, thanks to the WP SMTP Mail plugin. A VPS - only mailserver What…
Pikk
  • 101
0
votes
0 answers

spam that penetrated reject_sender_login_mismatch in postfix

We have the following in postfix's main.cf: smtpd_recipient_restrictions= permit_sasl_authenticated, permit_mynetworks ... smtpd_sender_restrictions = permit_mynetworks, reject_sender_login_mismatch ... yet we just received the following spam: To:…
John
  • 101
0
votes
1 answer

Linking mail server with application database

I have a web application running on node.js, backed by a MongoDB database which stores user data etc... I'd like to offer my users an email account, so I've set up a mail server using Postfix, dovecot, etc... My problem is that I'd like to link the…
penalosa
  • 143
  • 6
-1
votes
1 answer

Unauthorized access postfix "lost connection after MAIL from unknown[127.0.0.1] "

Someone or "something" is trying to access the server. my postfix log showed: mx2 postfix/smtpd[*****]: lost connection after MAIL from unknown[127.0.0.1] My concern is why is it from the localhost? and I just can't figure it out with "after MAIL"…
zapdos3
  • 13
  • 4
1
2