Open relay by default...

[bigjools]

I had to add these two options for smtp in master.cf

    -o smtpd_sasl_auth_enable=no
    -o smtpd_relay_restrictions=reject_unauth_destination

Otherwise my port 25 was an open relay!

[tessus]

Hmm, why would you disable SASL auth? Disclaimer: I am using sendmail, but the principles of an MTA are the same.

You need SASL to authenticate against posfix to be allowed to send email. If you disable it, you won't be authenticated and can't send email.

My friend used this script and the settings after the setup were:

smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
smtpd_recipient_restrictions = permit_sasl_authenticated, permit_mynetworks, reject_unauth_destination, reject_unknown_recipient_domain

This doesn't look like an open mail relay to me.

P.S.: I just tried to use my friend's mail server as a relay and got a 4.7.1. Thus no open relay.

[bigjools]

Hello.

Well your experience is different from mine, I followed the instructions exactly and ended up with an open relay, and provided the changes to stop that. Your config needs smtpd_relay_restrictions=reject_unauth_destination at a minimum.

The changes are for the smtpd only, NOT submission, which should never have sasl auth present.

[tessus]

The changes are for the smtpd only, NOT submission, which should never have sasl auth present.

I don't understand this. I am using SASL on submissions (465 - implicit TLS), because authentication is needed, otherwise my sendmail says "no-no" to people who want to send mail.

[bigjools]

The changes are for the smtpd only, NOT submission, which should never have sasl auth present.

I don't understand this. I am using SASL on submissions (465 - implicit TLS), because authentication is needed, otherwise my sendmail says "no-no" to people who want to send mail.

465/587 are submission in the config. Port 25 is the smtpd items.

[bigjools]

@LukeSmithxyz I'm using Ubuntu 22.04.

[bigjools]

The changes are for the smtpd only, NOT submission, which should never have sasl auth present.

I don't understand this. I am using SASL on submissions (465 - implicit TLS), because authentication is needed, otherwise my sendmail says "no-no" to people who want to send mail.

Also apologies, my English was not very clear. I mean to say you don't need sasl on port 25, the smtpd service.

[tessus]

@bigjools Ahh, the sentence was ambigious. I thought that "which should never have sasl auth present" was referencing the word submission, but apparently you did mean to reference smtpd.

P.S.: I mentioned before that I used sendmail, so the config works differently, but when I read the sentence as "The changes are for the smtpd only, NOT submission. smtpd should never have sasl auth present." then it makes perfect sense.