Preventing authenticated users sending from non-existent accounts/domains

[movielad]

Without amending the main Exim configuration itself, is there a switch or external config option to prevent cPanel/WHM authenticated email users from relaying mail for domains and user accounts NOT configured on the server?

We're seeing a large number of compromised (weak passwords) on customer servers that are being used to send out spam with made-up email addresses. As the attackers have already successfully authenticated with the SMTP server, they can send whatever they like.

Martyn

 

[cPanelTristan]

Re: Preventing authenticated users sending from non-existent accounts/domai

Hello Martyn,

You can try the following suggestion mentioned in this thread post:

http://forums.cpanel.net/f5/setup-l...-hour-per-domain-users-201222.html#post843452

Simply look for the part where it has "2. Stopping spoofing from webmail and SMTP authenticated users" and add that section to the begin acl portion of the exim.conf using WHM > Exim Configuration Manager > Advanced Editor area.

Thanks!

 

[movielad]

Re: Preventing authenticated users sending from non-existent accounts/domai

Thanks Tristran!

The sender verify handles local accounts, but when I tried the ACL on a RELEASE server running 11.32.12 and adding the ACL code just after BEGINACL, it still allowed me to relay mail using external/non-local domains..

Martyn

 

[cPanelTristan]

Re: Preventing authenticated users sending from non-existent accounts/domai

If that isn't working as needed, then I'd suggest to try posting on exim.org mailing list:

https://lists.exim.org/mailman/listinfo/exim-users

They know the best way to configure options that aren't default.

 

[SF Servers]

Hello! Did you find a solution for this? I have the same problem. Thanks!

 

[cPanelMichael]

Hello! Did you find a solution for this? I have the same problem. Thanks!

Hello,

Could you provide a specific example of what's happening on your server? This thread is over three years old.

Thank you.

 

[SF Servers]

Sorry for my english, i'm using a translator.

I have a correctly smtp authenticated user that is sending emails with a "from" using an external domain. I need block that posibility.

Can you help me? Thank you!

 

[ruzbehraja]

I see these options could be useful for tracking, but don't prevent the mail from being sent out.

WHM > Service Configuration > Exim Configuration Manager > Basic > Mail

EXPERIMENTAL: Rewrite From: header to match actual sender [?]

If you enabled this option, the From: header will be rewritten to be the email address of the actual message sender. If you choose the "remote" option, only messages that are being sent to remote destinations will be affected.​

Set SMTP Sender: headers [?]

(-f flag passed to sendmail) This will create “On behalf of” notices in Microsoft® Outlook, but it may also help track abuse of the mail system since recipients will see the SMTP login used to send each message.

​

 

[SF Servers]

Thank you, I can track with my configuration, but I have users that uses their credentials to send external domains

 

[cPanelMichael]

Hello,

You may want to vote for the following feature request if the previous options referenced in this thread are not sufficient:

https://features.cpanel.net/topic/exim-restrict-authenticated-outgoing-email-with-sender-domain

Thank you.

 

[SF Servers]

Thanks!