1 Topic by jayen.rachh

  • jayen.rachh
  • Member
  • Offline
  • Registered: 2022-02-14
  • Posts: 4

Topic: Iredmail relaying issue

==== REQUIRED BASIC INFO OF YOUR IREDMAIL SERVER ====
- iRedMail version (check /etc/iredmail-release):
- Deployed with iRedMail Easy or the downloadable installer?
- Linux/BSD distribution name and version:
- Store mail accounts in which backend (LDAP/MySQL/PGSQL):
- Web server (Apache or Nginx):
- Manage mail accounts with iRedAdmin-Pro?
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====
Hello,

We are using "0.9.7 MYSQL edition" and it is installed on Ubuntu OS.  We are facing relay issue.

Setup Brief.

Firewall :  Fortigate (LAN IP 192.168.0.100)
Server IP :  192.168.0.222

Here is the mail queue details :

*** ENVELOPE RECORDS active/9C9112307E82 ***
message_size:            2099            1881              20               0            2099               0
message_arrival_time: Sat Feb 12 21:28:00 2022
create_time: Sat Feb 12 21:28:00 2022
content_filter: smtp-amavis:[127.0.0.1]:10024
named_attribute: log_ident=9C9112307E82
named_attribute: rewrite_context=remote
sender: support@2talk.co.nz
named_attribute: log_client_name=unknown
named_attribute: log_client_address=192.168.0.100
named_attribute: log_client_port=29960
named_attribute: log_message_origin=unknown[192.168.0.100]
named_attribute: log_helo_name=[2.56.56.76]
named_attribute: log_protocol_name=ESMTP
named_attribute: client_name=unknown
named_attribute: reverse_client_name=unknown
named_attribute: client_address=192.168.0.100
named_attribute: client_port=29960
named_attribute: helo_name=[2.56.56.76]
named_attribute: protocol_name=ESMTP
named_attribute: client_address_type=2
named_attribute: dsn_orig_rcpt=rfc822;b737ng2@yahoo.com
original_recipient:
recipient: b737ng2@yahoo.com
named_attribute: dsn_orig_rcpt=rfc822;anh8516@yahoo.com
original_recipient:
recipient: anh8516@yahoo.com
named_attribute: dsn_orig_rcpt=rfc822;ajqk@yahoo.com
original_recipient:
recipient: ajqk@yahoo.com
named_attribute: dsn_orig_rcpt=rfc822;ami_tomake_bahlobashi@yahoo.com
original_recipient:
recipient: ami_tomake_bahlobashi@yahoo.com
named_attribute: dsn_orig_rcpt=rfc822;basse3a@yahoo.com
original_recipient:
recipient: basse3a@yahoo.com
named_attribute: dsn_orig_rcpt=rfc822;anh202001@yahoo.com
original_recipient:
recipient: anh202001@yahoo.com
named_attribute: dsn_orig_rcpt=rfc822;babymove@yahoo.com
original_recipient:
recipient: babymove@yahoo.com
named_attribute: dsn_orig_rcpt=rfc822;anhnguyenvnn@yahoo.com
original_recipient:
recipient: anhnguyenvnn@yahoo.com
named_attribute: dsn_orig_rcpt=rfc822;awake2nte@yahoo.com
original_recipient:
recipient: awake2nte@yahoo.com
named_attribute: dsn_orig_rcpt=rfc822;babym18@yahoo.com
original_recipient:
recipient: babym18@yahoo.com
named_attribute: dsn_orig_rcpt=rfc822;asurgers@yahoo.com
original_recipient:
recipient: asurgers@yahoo.com
named_attribute: dsn_orig_rcpt=rfc822;anhchuacobo84@yahoo.com
original_recipient:
recipient: anhchuacobo84@yahoo.com
named_attribute: dsn_orig_rcpt=rfc822;adato2985@yahoo.com
original_recipient:
recipient: adato2985@yahoo.com
named_attribute: dsn_orig_rcpt=rfc822;alboni@yahoo.com
original_recipient:
recipient: alboni@yahoo.com
named_attribute: dsn_orig_rcpt=rfc822;anvuongk9t2@yahoo.com
original_recipient:
recipient: anvuongk9t2@yahoo.com
named_attribute: dsn_orig_rcpt=rfc822;asad@yahoo.com
original_recipient:
recipient: asad@yahoo.com
named_attribute: dsn_orig_rcpt=rfc822;afontts@yahoo.com
original_recipient:
recipient: afontts@yahoo.com
named_attribute: dsn_orig_rcpt=rfc822;aircrow2@yahoo.com
original_recipient:
recipient: aircrow2@yahoo.com
named_attribute: dsn_orig_rcpt=rfc822;baldpate7@yahoo.com
original_recipient:
recipient: baldpate7@yahoo.com
named_attribute: dsn_orig_rcpt=rfc822;annguyen105@yahoo.com
original_recipient:
recipient: annguyen105@yahoo.com
*** MESSAGE CONTENTS active/9C9112307E82 ***
regular_text: Received: from [2.56.56.76] (unknown [192.168.0.100])
regular_text:   by "Removed purposely" (Postfix) with ESMTP id 9C9112307E82;
regular_text:   Sat, 12 Feb 2022 21:28:00 +0530 (IST)
regular_text: Content-Type: text/plain; charset="iso-8859-1"
regular_text: MIME-Version: 1.0
regular_text: Content-Transfer-Encoding: quoted-printable
regular_text: Content-Description: Mail message body
regular_text: Subject: Your Payment Reference Number (PRN): STBI/2022/-3433-9001
regular_text: To: Recipients <support@2talk.co.nz>
regular_text: From: "Mr. Elliott C. Harris" <support@2talk.co.nz>
regular_text: Date: Sat, 12 Feb 2022 07:58:34 -0800
regular_text: Reply-To: agnesbundy.financialadvisor@outlook.com


Since 192.168.0.100 is in mypermit network it is allowing mail to be relayed.  How can we ensure only domain users can send mails with respective to submission. i.e. 587 and 25 is used for MTA to MTA transfer.

I have deleted 58k mails of such from queue and worried.

Best,

Jayen

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by thedethwalker

  • thedethwalker
  • Member
  • Offline
  • Registered: 2022-02-08
  • Posts: 34

Re: Iredmail relaying issue

Hello, If I understand correctly you want to use port 25 only for mail server to mail server connection and port 587 for submission by clients. If that is the case here is the answer:

https://serverfault.com/questions/70626 … 25-but-587

change "smtpd_sasl_auth_enable = yes" in main.cf to "no" or just comment the line.

Then add to master.cf:

submission inet n       -       n       -       -       smtpd
  -o smtpd_sasl_auth_enable=yes

This is also the way that the newest version(1.5.1) of iRedMail deals with this problem. Here is the settings for submission port 587 in master.cf for the newest version, they may be of help:

submission inet n       -       n       -       -       smtpd
  -o syslog_name=postfix/submission
  -o smtpd_tls_security_level=encrypt
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o content_filter=smtp-amavis:[127.0.0.1]:10026

3 Reply by jayen.rachh

  • jayen.rachh
  • Member
  • Offline
  • Registered: 2022-02-14
  • Posts: 4

Re: Iredmail relaying issue

It is same as you have mentioned,  However what I can see is someone is able to connect smtp and Postfix is recognizing as 192.168.0.100 (Fortinet Firewall) which is allowing them to send out mail without authentication.

See this below lines :

content_filter: smtp-amavis:[127.0.0.1]:10024
named_attribute: log_ident=9C9112307E82
named_attribute: rewrite_context=remote
sender: support@2talk.co.nz
named_attribute: log_client_name=unknown
named_attribute: log_client_address=192.168.0.100
named_attribute: log_client_port=29960
named_attribute: log_message_origin=unknown[192.168.0.100]
named_attribute: log_helo_name=[2.56.56.76]
named_attribute: log_protocol_name=ESMTP
named_attribute: client_name=unknown
named_attribute: reverse_client_name=unknown
named_attribute: client_address=192.168.0.100

Sender is support@2talk.co.nz,  where is our domain is different.

4 Reply by thedethwalker (edited by thedethwalker 2022-02-15 23:21:24)

  • thedethwalker
  • Member
  • Offline
  • Registered: 2022-02-08
  • Posts: 34

Re: Iredmail relaying issue

Ok then, if I understand correctly you mean that your firewall allows someone from the outside to connect with an IP of 192.168.0.100 (that is actually called spoofing). I haven't worked on Fortinet Firewall before I have only worked on CISCO, but you should be able to do the following. Set up an ACL on the external interface (the one facing the internet) that will deny all incoming packets coming from 192.168.0.0/24, 10.0.0.0/8 and 172.16.0.0/16. Also you could add 127.0.0.0/8.

Make sure that on the external interface only the incoming packets from those IPs are denied and not the outgoing. Otherwise you'll block you're whole network.

If you cannot do it on the firewall, you should be able to do it on your router.

5 Reply by alm

  • alm
  • Member
  • Offline
  • Registered: 2021-12-27
  • Posts: 39

Re: Iredmail relaying issue

Did you NAT your external IP to your internal IP? If so, that's wrong. You should setup a VIP (Virtual IP) which links the external IP-address to the internal IP-address of the iRedMail server. Also, you should make a rule that allows traffic from the Internet to the VIP over port 25. In this way the iRedMail server should see the external IP-address of the external party and know when to allow or disallow mails being relayed.

PS. I'm also using FortiGate.

6 Reply by jayen.rachh

  • jayen.rachh
  • Member
  • Offline
  • Registered: 2022-02-14
  • Posts: 4

Re: Iredmail relaying issue

Thank for the input on forti firewall config, I will ask firewall guy to configure as you mentioned and provide feedback.

7 Reply by jayen.rachh

  • jayen.rachh
  • Member
  • Offline
  • Registered: 2022-02-14
  • Posts: 4

Re: Iredmail relaying issue

Also,  Is it possible to disable null sender even within permit network.  I need help in setting up iRedapd settings.py,  it is read only file, I can obviously change permission but thought to ask if there is better way to deal with.   

P.S, Client doesn't have budget for iredmail pro

8 Reply by thedethwalker (edited by thedethwalker 2022-02-16 03:36:07)

  • thedethwalker
  • Member
  • Offline
  • Registered: 2022-02-08
  • Posts: 34

Re: Iredmail relaying issue

jayen.rachh wrote:

Also,  Is it possible to disable null sender even within permit network.  I need help in setting up iRedapd settings.py,  it is read only file, I can obviously change permission but thought to ask if there is better way to deal with.   

P.S, Client doesn't have budget for iredmail pro

If you don't have iredmail pro you'll have to play around with the command line: https://docs.iredmail.org/manage.iredap … pd-plugins

About the permissions thing, just use sudo or login as root.