Preventing authenticated users sending from non-existent accounts/domains

movielad

Well-Known Member
May 14, 2003
109
2
168
cPanel Access Level
Root Administrator
Twitter
Without amending the main Exim configuration itself, is there a switch or external config option to prevent cPanel/WHM authenticated email users from relaying mail for domains and user accounts NOT configured on the server?

We're seeing a large number of compromised (weak passwords) on customer servers that are being used to send out spam with made-up email addresses. As the attackers have already successfully authenticated with the SMTP server, they can send whatever they like.

Martyn
 

cPanelTristan

Quality Assurance Analyst
Staff member
Oct 2, 2010
7,607
40
248
somewhere over the rainbow
cPanel Access Level
Root Administrator
Re: Preventing authenticated users sending from non-existent accounts/domai

Hello Martyn,

You can try the following suggestion mentioned in this thread post:

http://forums.cpanel.net/f5/setup-l...-hour-per-domain-users-201222.html#post843452

Simply look for the part where it has "2. Stopping spoofing from webmail and SMTP authenticated users" and add that section to the begin acl portion of the exim.conf using WHM > Exim Configuration Manager > Advanced Editor area.

Thanks!
 

movielad

Well-Known Member
May 14, 2003
109
2
168
cPanel Access Level
Root Administrator
Twitter
Re: Preventing authenticated users sending from non-existent accounts/domai

Thanks Tristran!

The sender verify handles local accounts, but when I tried the ACL on a RELEASE server running 11.32.12 and adding the ACL code just after BEGINACL, it still allowed me to relay mail using external/non-local domains..

Martyn
 

cPanelTristan

Quality Assurance Analyst
Staff member
Oct 2, 2010
7,607
40
248
somewhere over the rainbow
cPanel Access Level
Root Administrator
Re: Preventing authenticated users sending from non-existent accounts/domai

If that isn't working as needed, then I'd suggest to try posting on exim.org mailing list:

https://lists.exim.org/mailman/listinfo/exim-users

They know the best way to configure options that aren't default.
 

SF Servers

Registered
May 29, 2015
4
0
1
Córdoba
cPanel Access Level
Root Administrator
Sorry for my english, i'm using a translator.

I have a correctly smtp authenticated user that is sending emails with a "from" using an external domain. I need block that posibility.

Can you help me? Thank you!
 

ruzbehraja

Well-Known Member
May 19, 2011
392
11
68
cPanel Access Level
Root Administrator
I see these options could be useful for tracking, but don't prevent the mail from being sent out.

WHM > Service Configuration > Exim Configuration Manager > Basic > Mail

EXPERIMENTAL: Rewrite From: header to match actual sender [?]

If you enabled this option, the From: header will be rewritten to be the email address of the actual message sender. If you choose the "remote" option, only messages that are being sent to remote destinations will be affected.​


Set SMTP Sender: headers [?]

(-f flag passed to sendmail) This will create “On behalf of” notices in Microsoft® Outlook, but it may also help track abuse of the mail system since recipients will see the SMTP login used to send each message.