Article Title: Redhat6.2 + qmail + smtpd authentication prevents spammers from abusing your server. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.
Author: Polaris
Software environment:
Redhat6.2 qmail1.3
The email server serves both internal and external services. It uses ADSL for Internet access and dns2go.com for domain name resolution. Single Nic. The vro is Linksys.
Background:
I have installed the qmail server using the general method, and the DNS is stable. If I do not set the DNS, the following situations may occur: when the Internet is disconnected, you cannot log on to the Intranet email server to receive emails. In addition, my server was recently used to send a large number of spam messages (I do not know how my server address was discovered ), therefore, we want to add the smtpd verification function on the original basis.
I'm using the third method in ideal's article (http://www.ccidnet.com/tech/network/2001/04/04/58_1931.html) (this method is recommended)
Method 3 to prevent misuse of mail relay
For a Mail System With roaming users, another way to prevent the relay function from being abused is to require user authentication when sending emails, just as users need authentication when receiving emails. It is assumed that the system has been successfully installed with the qmail-1.03 and vpopmail, and the original system runs properly.
./Load qmail-smtpd rcpthosts. o commands. o timeoutread. o
Timeoutwrite. o ip. o ipme. o ipalloc. o control. o constmap. o
Received. o date822fmt. o now. o qmail. o cdb. a fd. a wait.
Datetime. a getln. a open. a sig. a case. a env. a stralloc.
Alloc. a substdio. a error. a str. a fs. a auto_qmail.o 'cat
Socket. lib'
Copy the newly generated qmail-smtpd to the/var/qmail/bin directory.
3、compile and install cmd5checkpw-0.22.tar.gz
Decompress, compile, and install:
[Root @ www src] # tar xvfz cmd5checkpw-0.22.tar.gz
[Root @ www src] # cd cmd5checkpw-0.22
[Root @ www cmd5checkpw-0.22] # make; make install
4. Set relay rules.
Relay means that the server accepts smtp requests from the client and forwards emails sent from the client to a third party. It is very easy to control relay under qmail. As long as the environment variables of the smtp process accessed by the client contain (RELAYCLIENT = ""), relay is allowed; otherwise, the relay is rejected. The implementation method is to set RELAYCLIENT = "" One by one (RELAYCLIENT = "") for the IP address that requires relay in/etc/tcp. smtp, and then generate a rule table using tcprules. In this article, we need to implement relay after SMTP authentication and do not need to pre-set any IP addresses. Therefore, the default rule is to "only relay this server ". /Etc/tcp. smtp content should be:
4. Set the SetUID and SetGID of/home/vpopmail/bin/vchkpw.
This is important, otherwise the authentication fails. This is because the smtpd process is executed by qmaild. The password verification program was originally used only by the pop3 process and executed by root or vpopmail respectively to read the passwords in the shadow or database and retrieve the user's email directory. Qmaild has no permission to perform these operations. To call the password verification program, the smtp process must use setuid and setgid. In fact, we can rest assured that these two password verification programs both contain source code and are very secure, you only need to put it in a safe directory (other users do not have the permission to execute the command except qmaild; in fact, if there are no other SHELL accounts, you don't have to worry about it ).
Chmod u + s/home/vpopmail/bin/vchkpw
Chmod g + s/home/vpopmail/bin/vchkpw
5. Modify the smtpd startup command line
My qmail is automatically started and executed under/etc/rc. d/init. d. So modify this file and change the qmail-smtpd part to the following parameter format:
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.
