I'm having an issue that's above my competence level. As we're working on improving the security measures that are in place in our network, we found (among others) one flaw that we have no idea how to fix.
We have our own SMTP server locally based on a MDaemon and we hire a professional hosting service that connects us to the WAN and they also have their own SMTP relay, publicly accessible. So when the mail goes through, it comes from their SMTP to ours, to our devices. But we found out that their tcp port 587 didn't ask for authentification meaning we could spoof any address whose domain name they handle, sending any email from, for example, boss@ourcorp.com to accountants@ourcorp.com, making it easier for a potential attacker to do phishing scams. But our service provider can't just close this port because we have nomadic users sending mails through it from their cellphone. Here are the options i thought of, being unsure how feasible they are :
- Synchronise their SMTP user database with ours (or making it just theirs) so they have the login/passwords to enforce and check authentification when someone just netcat on the MSA on port 587,
- Not use their MSA and putting ours public directly, having the same practical effect of reducing it to just one publicly accesible MSA that has the user database to check for authentication,
- Find some way of relaying the authentification request from their MSA to ours, making the verification, and returning an "accept" or "decline" token to their MSA. It would probably be the ideal option, but i have no idea how we could do that. I know that relaying authentification request are used for chained LDAP/LDAP or Active Directory/LDAP situation, but have no idea how it can be used practically or if it works with SMTP-AUTH,
- Find some anti-spoofing software to put on our servers (but how would it check ? The mail will always be coming from a trusted MSA with a potentially existing address)
If you have any thoughts on our issue, thanks in advance.