Postfix - How to prevent external clients from using my server as a relay?

Question

I have a postfix server installed on Ubuntu 14.04. A PHP script running on the machine uses it to send outgoing email. Additionally, I use postfix to receive mail sent to a local account, which is then forwarded to my personal gmail.

However, this means that anyone can connect to my server and use it as an open relay for spam. How can I prevent remote connections from relaying email?

This is my main.cf:

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = aviacao.pt
virtual_alias_maps = hash:/etc/postfix/virtual
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = aviacao.pt, localhost.localdomain, localhost
relayhost = 
mynetworks = 0.0.0.0/0
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = ipv4

If I change mynetworks to 127.0.0.0/8 then people won't be able to send email to the local account.

Solution 1

Your smtpd_relay_restrictions should prevent that anyone can connect to my server and use it as an open relay for spam.

The value of mynetworks does not determine if others can email you. 127.0.0.0/8 is a correct value 0.0.0.0/0 is not.

What determines if email for your account [email protected] is accepted is determined by the settings that inform postfix that it should accept email for the example.com domainname, such as mydestination

Solution 2

the setting of smtpd_relay_restrictions you have is correct except that you defined your mynetworks wide open (shown below from your main.cf)

mynetworks = 0.0.0.0/0

Just remove mynetworks; the default value should restrict relay access. For example, mine comes out as shown below with default.

postconf -d |grep mynetworks
mynetworks = 127.0.0.0/8 192.168.1.0/24

You should really test your server to ensure that is not an open relay. There are lot of online tools available ex: http://www.mydnstools.info/smtprelay

Ref: http://www.postfix.org/SMTPD_ACCESS_README.html

Comments

[Jenny D]

Go to postfix.org and look at the Documentation link. If you are putting a mailserver on the internet, you need to actually know how it works, not just follow instructions on a QA site.