Disable authentication for plain port 25 in Exim?

[Protected]

Hello there.

I run a server with directadmin. Every service in it uses secure protocols or alternative ports or is adequately firewalled. The sole point of failure is port 25 SMTP, which must remain open to the internet to ensure people can receive e-mail from the outside.

As a result, my DA inbox slowly fills up with brute force attempts detected by the monitor - every single one of them targetting exim. I've never been too worried about this, since I don't move that much e-mail and all passwords are secure. Even so, it's bothersome.

I've recently been told that I should be able to disable authentication on port 25 entirely and use it only for receiving external mail. Is this true? Are there drawbacks? Can anyone give me more information or a link to the correct thread or help page (I couldn't find any)? Or if there aren't any, can you explain how to do this or point me in the right direction at least?

Thanks.

 

[zEitEr]

Hello,

Please check my reply here: https://forum.directadmin.com/threa...untries-access-to-smtpauth.49128/#post-252708

 

[Protected]

How do I do it for port 25 only? Apparently I actually have a setting for allowing unadvertised auth which IIRC was added for compatibility with broken clients that were written with Microsoft Exchange in mind (apparently Exchange breaks the protocol). I need to be able to apply settings to port 25 only?

 

[zEitEr]

Use server_advertise_condition for that

http://www.exim.org/exim-html-current/doc/html/spec_html/ch-smtp_authentication.html#SECTauthexiser

 

[Protected]

Finally had time to look into this again.

I added to my authenticators:

server_advertise_condition = ${if eq{$received_port}{25}{}{1}}

It seems to not be blocking anything it shouldn't. Hope it blocks what it should now! I'll have to wait and see (or is there a test I can perform?)

 

[Protected]

Apparently it's not working, I can authenticate on port 25...

EDIT: Maybe it's because it sees my connection as localhost?

Roundcube's test script returns "expected" results:

* When setup with port 25, it can send mail from an external to an internal address, but not from internal to external (either "fails to add recipient" or, if I add auth info, "auth not supported").

* When setup with port 587, it can send e-mail both ways, provided I'm authenticated for internal to external.

So if that's what a random internet person would experience, that's perfect!