Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

Preventing authenticated users sending from non-existent accounts/domains

Discussion in 'E-mail Discussion' started by movielad, Apr 3, 2012.

  1. movielad

    movielad Well-Known Member

    Joined:
    May 14, 2003
    Messages:
    109
    Likes Received:
    2
    Trophy Points:
    168
    cPanel Access Level:
    Root Administrator
    Twitter:
    Without amending the main Exim configuration itself, is there a switch or external config option to prevent cPanel/WHM authenticated email users from relaying mail for domains and user accounts NOT configured on the server?

    We're seeing a large number of compromised (weak passwords) on customer servers that are being used to send out spam with made-up email addresses. As the attackers have already successfully authenticated with the SMTP server, they can send whatever they like.

    Martyn
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #1 movielad, Apr 3, 2012
  2. cPanelTristan

    cPanelTristan Quality Assurance Analyst Staff Member

    Joined:
    Oct 2, 2010
    Messages:
    7,606
    Likes Received:
    33
    Trophy Points:
    238
    Location:
    somewhere over the rainbow
    cPanel Access Level:
    Root Administrator
    Re: Preventing authenticated users sending from non-existent accounts/domai

    Hello Martyn,

    You can try the following suggestion mentioned in this thread post:

    http://forums.cpanel.net/f5/setup-limit-sending-out-mails-per-hour-per-domain-users-201222.html#post843452

    Simply look for the part where it has "2. Stopping spoofing from webmail and SMTP authenticated users" and add that section to the begin acl portion of the exim.conf using WHM > Exim Configuration Manager > Advanced Editor area.

    Thanks!
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #2 cPanelTristan, Apr 3, 2012
  3. movielad

    movielad Well-Known Member

    Joined:
    May 14, 2003
    Messages:
    109
    Likes Received:
    2
    Trophy Points:
    168
    cPanel Access Level:
    Root Administrator
    Twitter:
    Re: Preventing authenticated users sending from non-existent accounts/domai

    Thanks Tristran!

    The sender verify handles local accounts, but when I tried the ACL on a RELEASE server running 11.32.12 and adding the ACL code just after BEGINACL, it still allowed me to relay mail using external/non-local domains..

    Martyn
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #3 movielad, Apr 4, 2012
  4. cPanelTristan

    cPanelTristan Quality Assurance Analyst Staff Member

    Joined:
    Oct 2, 2010
    Messages:
    7,606
    Likes Received:
    33
    Trophy Points:
    238
    Location:
    somewhere over the rainbow
    cPanel Access Level:
    Root Administrator
    Re: Preventing authenticated users sending from non-existent accounts/domai

    If that isn't working as needed, then I'd suggest to try posting on exim.org mailing list:

    https://lists.exim.org/mailman/listinfo/exim-users

    They know the best way to configure options that aren't default.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #4 cPanelTristan, Apr 4, 2012
  5. SF Servers

    SF Servers Registered

    Joined:
    May 29, 2015
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Córdoba
    cPanel Access Level:
    Root Administrator
    Hello! Did you find a solution for this? I have the same problem. Thanks!
     
    #5 SF Servers, May 29, 2015
  6. cPanelMichael

    cPanelMichael Technical Support Community Manager Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    47,009
    Likes Received:
    2,123
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    Hello,

    Could you provide a specific example of what's happening on your server? This thread is over three years old.

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #6 cPanelMichael, May 29, 2015
  7. SF Servers

    SF Servers Registered

    Joined:
    May 29, 2015
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Córdoba
    cPanel Access Level:
    Root Administrator
    Sorry for my english, i'm using a translator.

    I have a correctly smtp authenticated user that is sending emails with a "from" using an external domain. I need block that posibility.

    Can you help me? Thank you!
     
    #7 SF Servers, May 29, 2015
  8. ruzbehraja

    ruzbehraja Well-Known Member

    Joined:
    May 19, 2011
    Messages:
    392
    Likes Received:
    11
    Trophy Points:
    68
    cPanel Access Level:
    Root Administrator
    I see these options could be useful for tracking, but don't prevent the mail from being sent out.

    WHM > Service Configuration > Exim Configuration Manager > Basic > Mail

    EXPERIMENTAL: Rewrite From: header to match actual sender [?]

    If you enabled this option, the From: header will be rewritten to be the email address of the actual message sender. If you choose the "remote" option, only messages that are being sent to remote destinations will be affected.​


    Set SMTP Sender: headers [?]

    (-f flag passed to sendmail) This will create “On behalf of” notices in Microsoft® Outlook, but it may also help track abuse of the mail system since recipients will see the SMTP login used to send each message.

    ​
     
    #8 ruzbehraja, May 30, 2015
  9. SF Servers

    SF Servers Registered

    Joined:
    May 29, 2015
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Córdoba
    cPanel Access Level:
    Root Administrator
    Thank you, I can track with my configuration, but I have users that uses their credentials to send external domains :(
     
    #9 SF Servers, May 30, 2015
  10. cPanelMichael

    cPanelMichael Technical Support Community Manager Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    47,009
    Likes Received:
    2,123
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
    #10 cPanelMichael, Jun 1, 2015
  11. SF Servers

    SF Servers Registered

    Joined:
    May 29, 2015
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Córdoba
    cPanel Access Level:
    Root Administrator
    Thanks!
     
    #11 SF Servers, Jun 1, 2015
(You must log in or sign up to post here.)
Loading...
Similar Threads - Preventing authenticated users
  1. spacereaper82

    Preventing the server from compromise

    spacereaper82, Oct 1, 2018, in forum: Security
    Replies:
    3
    Views:
    334
    keat63
    Oct 9, 2018
  2. PeteS

    Preventing user password change in webmail

    PeteS, Sep 7, 2018, in forum: E-mail Discussion
    Replies:
    2
    Views:
    410
    PeteS
    Dec 11, 2018
  3. bugetarul

    Htaccess preventing file uploads?

    bugetarul, May 19, 2018, in forum: Security
    Replies:
    3
    Views:
    576
    cPanelMichael
    May 21, 2018
  4. toplisek

    Preventing reply for an email account

    toplisek, Jan 13, 2018, in forum: E-mail Discussion
    Replies:
    1
    Views:
    302
    cPanelMichael
    Jan 18, 2018
  5. psnabe

    Authenticated Received Chain for cPanel?

    psnabe, Dec 13, 2018, in forum: E-mail Discussion
    Replies:
    1
    Views:
    298
    cPanelMichael
    Dec 17, 2018

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice