Require/force users use login/passwd

[Shaggy]

I just installed sentora on a fresh vps to play around with and learn.

Something i found a bit disturbing is that out of the box sentora configs postfix to allow anyone to send email to your own domains.

For an example
domain.ltd is added
i create mailbox mail1@domain.ltd

by using a simple script iam now able to send spam from any host to my sentora as long as i send from mail1@domain.ltd and send to mail1@domain.ltd or well from mail1@domain.ltd to any existing email adress under domain.ltd

Is there a way to only accept outgoing mail from "clients" that been authenticated through sasl ?

[TGates]

Hmm, sounds like more of a postfix issue than Sentora. We should check their site and see what they suggest and maybe add it into the installer

Me.B

[Me.B]

but only script in the server are allowed. we might tune this to allow only authentificated users by default. That's the config I use.

Beside that you can change it in postfix.

[Shaggy]

but only script in the server are allowed.  we might tune this to allow only authentificated users by default. That's the config I use.

Beside that you can change it in postfix.

Code:

smtpd_sender_restrictions = permit_sasl_authenticated,
                                reject_sender_login_mismatch,
                                reject_unlisted_sender,
                                permit
smtpd_recipient_restrictions = permit_sasl_authenticated,
                                reject_unauth_destination,
                                reject_non_fqdn_sender,
                                reject_non_fqdn_recipient,
                                reject_unknown_recipient_domain,
                                reject_rbl_client bl.spamcop.net,
                                reject_rbl_client b.barracudacentral.org,
                                reject_rbl_client zen.spamhaus.org,
                                reject_rbl_client dnsbl.sorbs.net,
                                check_policy_service unix:private/policy-spf

this is what i added from what i read it should not allow anyone to send mail w/o using login/pass
or did i mess something up ?