I can send it to everyone like spoofing

[Tyno (Hris Angelo)]

Hello to neth community!
I will use the subject as a colleague.
Right now I have a serious problem;
I have installed netserver latest version 7.5 with postfix on it.
I use a Thunderbird email client and send a letter from another email server by choosing “customize from address” and writing random@mynethserver.com and sending it successfully through which address I decide.

Тhe problem resembles that… " * SystemUserRecipientStatus {enabled,disabled} enabled , accept from any network the recipient addresses formed by user account names and domain part localhost , localhost.<domainname> and FQDN hostname." but in my config is disable…

In the previous version 7.4 I have not encountered a similar problem.
How can I stop this?
Best regards!

[davidep (Davide Principi)]

@Tyno

I use a Thunderbird email client and send a letter from another email server by choosing “customize from address” and writing random@mynethserver.com and sending it successfully through which address I decide.

This is the NethServer sender policy: once authenticated the client can set any sender.

@Tyno

SystemUserRecipientStatus

I don’t think this is related to the sender policy

@Tyno

In the previous version 7.4 I have not encountered a similar problem.

The sender policy didn’t change since 7.3!

Could you provide an example with some maillog excerpts? Maybe I didn’t understand your issue!

@Tyno

I will use the subject as a colleague.

They seem two distinct issues

[Tyno (Hris Angelo)]

I have standard 7.5 nethserver and configured as an email server - mail.mynethserver.com
I have Thunderbird mail client on windows with another email account, for example another_mail@anotheremailserver.com.
When sending a letter from a Thunderbird, I have the option to change the recipient via “customize from address” where I enter everything@mynethserver.com and I can send it to everyone like spoofing. No logging info in logviewer…

[mrmarkuz (Markus Neuberger)]

Hi @Tyno,

as @davidep wrote:

@davidep

This is the NethServer sender policy: once authenticated the client can set any sender.

But there’s a feature request with a solution for your issue that seems to work with Thunderbird (but not with other mail webapps like Roundcube or Webtop):

Check authenticated user/identity before sending

I managed to have a working implementation, but it is just for fun Creating a simple panel to configure this behavior would be complex. Before proceed, you need to understand how it works, otherwise some users will not be able to send any mail. Take a look at: https://blog.felipe-alfaro.com/2006/02/19/block-sender-address-spoofing-with-smpt-auth/ So, let’s start. Configuration 1. Create a template-custom Execute: mkdir -p /etc/e-smith/templates-custom/etc/postfix/master.cf C…

[saitobenkei]

@mrmarkuz

But there’s a feature request with a solution for your issue that seems to work with Thunderbird (but not with other mail webapps like Roundcube or Webtop):

AFAIK the latest version of Webtop should allow user authentication for outgoing mail

These should be the commands to enable outgoing authentication on webtop:

http://docs.nethserver.org/en/v7/webtop5.html#smtp-setting

But I haven’t tried.