Spam on local mail account from outside

Dear,
as per default configuration we have the mynetworks as follows:
mynetworks = 127.0.0.0/8 [::1]/128 public.ip.of.the.server.

In that way with a standard phpmailer library (https://github.com/PHPMailer/PHPMailer) is it possible to connect from outside, to the server of the domain and send mail to the local user of the server. That without any authention. In addiction of that, the email sent in that way doesn't go attraverso the antispam. I think that this is a pretty bad behaviour. Spammers know that trick, and use them to inoculate spam (it's pretty simple).

How we can solve that problem (eg. could be a good idea empty the "mynetworks" variable? or it's there a way to force authentication also for local email?)
Thank you.

 

Probably i cannot descrive correctly the issue. Took for example one defaced website called DEFACEDWEBSITE.COM
On that website one attacker upload a phpmailer script like that:

"""""""""
include("class.phpmailer.php");

$from_email = "fakefrom@fakedomain";
$from_name = "fakename";
$to = "[email protected]";
$subject = "some subject";
$body = "some body";
$mail = new PHPMailer();
$mail->isMail();
$mail->CharSet = 'utf-8';
$mail->SetFrom($from_email, $from_name);
$mail->AddAddress($to);
$mail->Subject = $subject;
$mail->isHTML(false);
$mail->Body = $body;
if (!$mail->send()){
$to_domain = explode("@", $to);
$to_domain = $to_domain[1];
$mail->IsSMTP();
$mail->Host = mx_lookup($to_domain);
$mail->Port = 25;
$mail->SMTPAuth = false;
if (!$mail->send()){
return Array(0, $mail->ErrorInfo);
}else{
return Array(2, 0);
}
}
"""""""
As you can see the attacker, connect directly to the victim domain on the 25 port.
And the mail goes ahead because the mail destination is local on that domain obviously.

Any clue?

 

This is the problem till. The hacked website IS NOT on the same server of the mail "[email protected]".
The hacked website, from the malicious code can get the MX of the somedomain.com and then, from remote, connect him to the smtp server of the mx record [ $mail->Host = mx_lookup($to_domain); ]. And then inoculate the spammy email on the "somedomain.com" account. Without any authentication required, because at the eyes of the smtp server of the mx of the domain, the mail is local, so without relay mail.

If you want (i don't know if you have time to try that) you can try yourself.
Gest two vps with standard ispconfig installation. On one put the code above (with phpmailer class downloaded from github). On another create the mail.

 

Hi Jesse,

thank you for your feedback. I have changed the postfix configuration removing the public.ip.of.the.server, and i have also tested on another server build from the scratch, that had not the public.ip.of.the.server on the mynetworks.
So, the problem persist also with only "mynetworks = 127.0.0.0/8 [::1]/128" configuration.
Additional stuff, are that the mail sent in that way doesn't go thought the antispam because they are seen as local email.

I don't ask you to take my word for real, but to try by yourself. The above code is slightly wrong, here i paste the code that you can use if you wanna try:

"""""
<?php

include("class.phpmailer.php");
include("class.smtp.php");

$from_email = "fakefrom@fakedomain";
$from_name = "fakename";
$to = "[email protected]";
$subject = "test email subject 3";
$body = "body email text 3";

$mail = new PHPMailer();
$mail->CharSet = 'utf-8';
$mail->SetFrom($from_email, $from_name);
$mail->AddAddress($to);
$mail->Subject = $subject;
$mail->isHTML(false);
$mail->Body = $body;

$to_domain = explode("@", $to);
$to_domain = $to_domain[1];
$mail->IsSMTP();
$mail->Host = mx_lookup($to_domain);
$mail->Port = 25;
$mail->SMTPAuth = false;
if (!$mail->send()){
return Array(0, $mail->ErrorInfo);
}else{
return Array(2, 0);
}

function mx_lookup($hostname)
{
@getmxrr($hostname, $mxhosts, $precedence);
if(count($mxhosts) === 0) return '127.0.0.1';
$position = array_keys($precedence, min($precedence));
return $mxhosts[$position[0]];
}
"""""

Class needed are:
https://github.com/PHPMailer/PHPMailer/blob/master/class.smtp.php
https://github.com/PHPMailer/PHPMailer/blob/master/class.phpmailer.php

Thank you

 

Thank's to take the time to reply on my post. Yes i know how smtp works, but my opinion (IMHO) is that on one server setup for an hosting services, can't take for real mail sent locally without authentication from outside. The amount of spam sent in that way is like 90% of the total.

By the way, with some adjustment of smtpd_recipient_restrictions we have mitigated that problem.

 

Maybe I misunderstood but:
If I have something running on my server it can send mail using local MTA using any kind of FROM/TO I like.
However, I could setup the MTA to check if FROM is actually a valid account, but then I use some valid FROM to send my spam.
If you allow someone accessing a script which allows sending mail, or somone placed a script due to a security issue in wordpress for example, it's a nice invitation for everyone sending spam using the MTA.

You might need to allow sasl authenticated sender only for sending mails, hence you need to remove
permit_mynetworks, from your listings in main.cf

Code:

permit_mynetworks, permit_sasl_authenticated,

this would check: is the sender on my host/localhost/myRemoteIP and if so, let him pass

Beware, you may need to adjust other settings to let your cronjobs and other services send mail to you.