The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Preventing authenticated users sending from non-existent accounts/domains

Discussion in 'E-mail Discussions' started by movielad, Apr 3, 2012.

  1. movielad

    movielad Well-Known Member
    PartnerNOC

    Joined:
    May 14, 2003
    Messages:
    107
    Likes Received:
    2
    Trophy Points:
    18
    cPanel Access Level:
    DataCenter Provider
    Without amending the main Exim configuration itself, is there a switch or external config option to prevent cPanel/WHM authenticated email users from relaying mail for domains and user accounts NOT configured on the server?

    We're seeing a large number of compromised (weak passwords) on customer servers that are being used to send out spam with made-up email addresses. As the attackers have already successfully authenticated with the SMTP server, they can send whatever they like.

    Martyn
     
  2. cPanelTristan

    cPanelTristan Quality Assurance Analyst
    Staff Member

    Joined:
    Oct 2, 2010
    Messages:
    7,623
    Likes Received:
    21
    Trophy Points:
    38
    Location:
    somewhere over the rainbow
    cPanel Access Level:
    Root Administrator
    Re: Preventing authenticated users sending from non-existent accounts/domai

    Hello Martyn,

    You can try the following suggestion mentioned in this thread post:

    http://forums.cpanel.net/f5/setup-l...-hour-per-domain-users-201222.html#post843452

    Simply look for the part where it has "2. Stopping spoofing from webmail and SMTP authenticated users" and add that section to the begin acl portion of the exim.conf using WHM > Exim Configuration Manager > Advanced Editor area.

    Thanks!
     
  3. movielad

    movielad Well-Known Member
    PartnerNOC

    Joined:
    May 14, 2003
    Messages:
    107
    Likes Received:
    2
    Trophy Points:
    18
    cPanel Access Level:
    DataCenter Provider
    Re: Preventing authenticated users sending from non-existent accounts/domai

    Thanks Tristran!

    The sender verify handles local accounts, but when I tried the ACL on a RELEASE server running 11.32.12 and adding the ACL code just after BEGINACL, it still allowed me to relay mail using external/non-local domains..

    Martyn
     
  4. cPanelTristan

    cPanelTristan Quality Assurance Analyst
    Staff Member

    Joined:
    Oct 2, 2010
    Messages:
    7,623
    Likes Received:
    21
    Trophy Points:
    38
    Location:
    somewhere over the rainbow
    cPanel Access Level:
    Root Administrator
    Re: Preventing authenticated users sending from non-existent accounts/domai

    If that isn't working as needed, then I'd suggest to try posting on exim.org mailing list:

    https://lists.exim.org/mailman/listinfo/exim-users

    They know the best way to configure options that aren't default.
     
  5. SF Servers

    SF Servers Registered

    Joined:
    May 29, 2015
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Córdoba
    cPanel Access Level:
    Root Administrator
    Hello! Did you find a solution for this? I have the same problem. Thanks!
     
  6. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,787
    Likes Received:
    665
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello,

    Could you provide a specific example of what's happening on your server? This thread is over three years old.

    Thank you.
     
  7. SF Servers

    SF Servers Registered

    Joined:
    May 29, 2015
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Córdoba
    cPanel Access Level:
    Root Administrator
    Sorry for my english, i'm using a translator.

    I have a correctly smtp authenticated user that is sending emails with a "from" using an external domain. I need block that posibility.

    Can you help me? Thank you!
     
  8. ruzbehraja

    ruzbehraja Well-Known Member

    Joined:
    May 19, 2011
    Messages:
    383
    Likes Received:
    7
    Trophy Points:
    18
    cPanel Access Level:
    Root Administrator
    I see these options could be useful for tracking, but don't prevent the mail from being sent out.

    WHM > Service Configuration > Exim Configuration Manager > Basic > Mail

    EXPERIMENTAL: Rewrite From: header to match actual sender [?]

    If you enabled this option, the From: header will be rewritten to be the email address of the actual message sender. If you choose the "remote" option, only messages that are being sent to remote destinations will be affected.​


    Set SMTP Sender: headers [?]

    (-f flag passed to sendmail) This will create “On behalf of” notices in Microsoft® Outlook, but it may also help track abuse of the mail system since recipients will see the SMTP login used to send each message.

     
  9. SF Servers

    SF Servers Registered

    Joined:
    May 29, 2015
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Córdoba
    cPanel Access Level:
    Root Administrator
    Thank you, I can track with my configuration, but I have users that uses their credentials to send external domains :(
     
  10. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,787
    Likes Received:
    665
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
  11. SF Servers

    SF Servers Registered

    Joined:
    May 29, 2015
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Córdoba
    cPanel Access Level:
    Root Administrator
Loading...

Share This Page