Anyone can send mail without AUTH (only to postmaster@...)

biberbb

Hi All

running a mailcow setup as per the docs.
Expected behaviour for me would have been to require AUTH for any connection from outside the local / trusted network.
That is also what I experience, EXCEPT for mails to postmaster@domain.tld

i.e. I can telnet from anywhere into the mailserver (telnet mail.domain.tld 25) and manually compose/trigger an email to postmaster@domain.tld

telnet mail.domain.tld 25

Trying IP-Address …
Connected to mail.domain.tld.
Escape character is ‘^]’.
220 mail.domain.tld ESMTP Postcow

helo mail.domain.tld

250 mail.domain.tld

MAIL FROM:any-user@domain.tld

250 2.1.0 Ok

RCPT TO:postmaster@domain.tld

250 2.1.5 Ok

DATA

354 End data with <CR><LF>.<CR><LF>

SUBJECT: Evil Testmail...

...to postmaster without any authentication.

.

250 2.0.0 Ok: queued as AA4646FF5E

I find this very surprising, but maybe this is standard behavior for the postmaster account? It does not work for any other target account.

Any clues?

Thanks and best regards
bb

esackbauer

On Port 25 you never have AUTH obligatory, otherwise no other server would be able to send mail to your server.
on Port 587 there is AUTH obligatory because its intended for clients.

What do you mean “telnet from anywhere”? Does that match whitelists you have configured?

mlcwuser

I can confirm that this works, but to be honest, I’m not sure if this is supposed to work, and if it is, whether it’s actually a problem.

…and yes the message will only be delivered when sending it to postmaster@domain.tld.

When sending to other mailboxes on the server, the server tells me:

554 5.7.1 This message does not meet our delivery requirements

BUT, it looks like the message still got sent, because after a few minutes I got a Spam Quarantine Notification about the message beeing quarantined with a SPAM score of 19.89.

Oh, and when I try to send a message to an external address, I get…

554 5.7.1 <name@externaldomain.tld>: Relay access denied

…which is fine, I guess.

mlcwuser

After thinking about it a little more, I’ve come to the conclusion, please correct me if I’m wrong, that this behaviour is perfectly normal. I mean, if other mail servers had to authenticate themselves in order to send email to a particular mailbox, the whole email system would stop working. 😉

But what I still don’t understand is why sending a message to the postmaster account does not result in a “This message does not meet our delivery requirements” message, and does not trigger the spam filter…

biberbb

Hi!

Thanks for confirming!
Yes, I think it’s fine that Postfix denies to act as a relay for external target addresses.

Then probably the rest is intended behavior in the sense that Postfix generally accepts mails for internal targets and relies on Rspamd judge on Spam.
I think I also found out why mails to postmaster@domain.tld go through, while any other internal target results in Spam / Quarantine: in the mailheader I read this comment from the X-Rspamd module “whiltelisting postmaster smtp rcpt”, resulting in a Spam score of 0.00. Apparently, mails to postmaster are being treated special by Rspamd.

Still not sure if I like this behavior, but at least it seems to be intended / no bug.

Thanks for your support.

Best regards
bb

esackbauer

It seems that is intended, because postmaster needs to deal with problems and should not be filtered, therefore it was whitelisted in the code (see line 90 ff)
mailcow/mailcow-dockerizedblob/master/data/conf/rspamd/lua/rspamd.local.lua

mlcwuser

esackbauer because postmaster needs to deal with problems

I guess that makes sense then, and thanks for posting the link to the code. 🙂

biberbb

… learned a lot. Thanks guys!