The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Preventing authenticated users sending from non-existent accounts/domains

Discussion in 'E-mail Discussions' started by movielad, Apr 3, 2012.

  1. movielad

    movielad Well-Known Member
    PartnerNOC

    Joined:
    May 14, 2003
    Messages:
    107
    Likes Received:
    2
    Trophy Points:
    168
    cPanel Access Level:
    DataCenter Provider
    Without amending the main Exim configuration itself, is there a switch or external config option to prevent cPanel/WHM authenticated email users from relaying mail for domains and user accounts NOT configured on the server?

    We're seeing a large number of compromised (weak passwords) on customer servers that are being used to send out spam with made-up email addresses. As the attackers have already successfully authenticated with the SMTP server, they can send whatever they like.

    Martyn
     
    #1 movielad, Apr 3, 2012
  2. cPanelTristan

    cPanelTristan Quality Assurance Analyst
    Staff Member

    Joined:
    Oct 2, 2010
    Messages:
    7,622
    Likes Received:
    24
    Trophy Points:
    238
    Location:
    somewhere over the rainbow
    cPanel Access Level:
    Root Administrator
    Re: Preventing authenticated users sending from non-existent accounts/domai

    Hello Martyn,

    You can try the following suggestion mentioned in this thread post:

    http://forums.cpanel.net/f5/setup-limit-sending-out-mails-per-hour-per-domain-users-201222.html#post843452

    Simply look for the part where it has "2. Stopping spoofing from webmail and SMTP authenticated users" and add that section to the begin acl portion of the exim.conf using WHM > Exim Configuration Manager > Advanced Editor area.

    Thanks!
     
    #2 cPanelTristan, Apr 3, 2012
  3. movielad

    movielad Well-Known Member
    PartnerNOC

    Joined:
    May 14, 2003
    Messages:
    107
    Likes Received:
    2
    Trophy Points:
    168
    cPanel Access Level:
    DataCenter Provider
    Re: Preventing authenticated users sending from non-existent accounts/domai

    Thanks Tristran!

    The sender verify handles local accounts, but when I tried the ACL on a RELEASE server running 11.32.12 and adding the ACL code just after BEGINACL, it still allowed me to relay mail using external/non-local domains..

    Martyn
     
    #3 movielad, Apr 4, 2012
  4. cPanelTristan

    cPanelTristan Quality Assurance Analyst
    Staff Member

    Joined:
    Oct 2, 2010
    Messages:
    7,622
    Likes Received:
    24
    Trophy Points:
    238
    Location:
    somewhere over the rainbow
    cPanel Access Level:
    Root Administrator
    Re: Preventing authenticated users sending from non-existent accounts/domai

    If that isn't working as needed, then I'd suggest to try posting on exim.org mailing list:

    https://lists.exim.org/mailman/listinfo/exim-users

    They know the best way to configure options that aren't default.
     
    #4 cPanelTristan, Apr 4, 2012
  5. SF Servers

    SF Servers Registered

    Joined:
    May 29, 2015
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Córdoba
    cPanel Access Level:
    Root Administrator
    Hello! Did you find a solution for this? I have the same problem. Thanks!
     
    #5 SF Servers, May 29, 2015
  6. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    36,343
    Likes Received:
    1,209
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Hello,

    Could you provide a specific example of what's happening on your server? This thread is over three years old.

    Thank you.
     
    #6 cPanelMichael, May 29, 2015
  7. SF Servers

    SF Servers Registered

    Joined:
    May 29, 2015
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Córdoba
    cPanel Access Level:
    Root Administrator
    Sorry for my english, i'm using a translator.

    I have a correctly smtp authenticated user that is sending emails with a "from" using an external domain. I need block that posibility.

    Can you help me? Thank you!
     
    #7 SF Servers, May 29, 2015
  8. ruzbehraja

    ruzbehraja Well-Known Member

    Joined:
    May 19, 2011
    Messages:
    392
    Likes Received:
    11
    Trophy Points:
    68
    cPanel Access Level:
    Root Administrator
    I see these options could be useful for tracking, but don't prevent the mail from being sent out.

    WHM > Service Configuration > Exim Configuration Manager > Basic > Mail

    EXPERIMENTAL: Rewrite From: header to match actual sender [?]

    If you enabled this option, the From: header will be rewritten to be the email address of the actual message sender. If you choose the "remote" option, only messages that are being sent to remote destinations will be affected.​


    Set SMTP Sender: headers [?]

    (-f flag passed to sendmail) This will create “On behalf of” notices in Microsoft® Outlook, but it may also help track abuse of the mail system since recipients will see the SMTP login used to send each message.

    ​
     
    #8 ruzbehraja, May 30, 2015
  9. SF Servers

    SF Servers Registered

    Joined:
    May 29, 2015
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Córdoba
    cPanel Access Level:
    Root Administrator
    Thank you, I can track with my configuration, but I have users that uses their credentials to send external domains :(
     
    #9 SF Servers, May 30, 2015
  10. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    36,343
    Likes Received:
    1,209
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    #10 cPanelMichael, Jun 1, 2015
  11. SF Servers

    SF Servers Registered

    Joined:
    May 29, 2015
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Córdoba
    cPanel Access Level:
    Root Administrator
    Thanks!
     
    #11 SF Servers, Jun 1, 2015
(You must log in or sign up to post here.)
Loading...
Similar Threads - Preventing authenticated users
  1. Chris H

    Preventing users viewing system information

    Chris H, May 5, 2017, in forum: Security
    Replies:
    2
    Views:
    128
    Chris H
    May 5, 2017
  2. Arkaic

    Preventing xlmrpc.php server-side?

    Arkaic, Aug 29, 2016, in forum: Security
    Replies:
    8
    Views:
    703
    cPanelMichael
    Sep 1, 2016
  3. davez0rz

    Preventing WHM From altering IPTables

    davez0rz, May 27, 2016, in forum: Security
    Replies:
    1
    Views:
    441
    cPanelMichael
    Jun 2, 2016
  4. webmasteryoda

    Preventing changes of mailhelo

    webmasteryoda, Feb 3, 2016, in forum: E-mail Discussions
    Replies:
    3
    Views:
    423
    cPanelMichael
    Feb 4, 2016
  5. Forcerdj

    Preventing server load issues

    Forcerdj, Jan 16, 2016, in forum: Workarounds and Optimization
    Replies:
    4
    Views:
    763
    cPanelMichael
    Jan 18, 2016

Share This Page