ports 25, 465 and 587 are blocked automatically after installing DirectAdmin

[daro2013]

For security reasons I wouln't do that. There is a better way to do this.

You need to set these both settings like this:

SMTP_BLOCK = "1"
SMTP_ALLOWLOCAL = "1"

This way no untrusted people can abuse your smtp from outside and local smtp traffic (from your customers) is allowed.

That wont work if you run internal SMTP like my website. They should be set:

SMTP_BLOCK = "0"
SMTP_ALLOWLOCAL = "1"

advised by [B]splby[/B]

 

[Richard G]

That wont work if you run internal SMTP like my website. They should be set:

You're wrong. That will work. You should not set smtp_block to 0.
Because then the smtp_allowlocal=1 doesn't matter anyway anymore either. Maybe you didn't have the smtp_allowlocal to 1 but set to 0, then it won't work indeed.

We got forums on our servers and websites, which send mail via our smtp server and also via php mail and that all works fine with the settings I said.
If you can't send mail that way, then something else is wrong at your system.

These should also be default:
SMTP_ALLOWUSER = ""
SMTP_ALLOWGROUP = "mail,mailman"

However, if you want to keep things the way you have set it now, feel free to do that, but do not declare that they should be set that way because they shouldn't and it gives a wrong impression to others.

P.s. please don't quote full posts.

 

[ikkeben]

advised by @splby

I dont read here advise to set it to 0 i think misunderstanding.

Hello. Most likely, you have an established meaning
SMTP_BLOCK = ON
This one blocks connections from the server by users to external smtp servers. This is the recommendation of many spam list owners.

I think and asked before the test you use is from external , but website you talk about is internal yes or no?

And also for external follow @Richard G advice and the real advice @splby given you .

 

[daro2013]

You're wrong. That will work. You should not set smtp_block to 0.
Because then the smtp_allowlocal=1 doesn't matter anyway anymore either. Maybe you didn't have the smtp_allowlocal to 1 but set to 0, then it won't work indeed.

We got forums on our servers and websites, which send mail via our smtp server and also via php mail and that all works fine with the settings I said.
If you can't send mail that way, then something else is wrong at your system.

These should also be default:
SMTP_ALLOWUSER = ""
SMTP_ALLOWGROUP = "mail,mailman"

However, if you want to keep things the way you have set it now, feel free to do that, but do not declare that they should be set that way because they shouldn't and it gives a wrong impression to others.

P.s. please don't quote full posts.

I can confirm that these settings work for internal SMTP using a plugin:

SMTP_BLOCK = "0"
SMTP_ALLOWLOCAL = "1"

and these settings wont work:

SMTP_BLOCK = "1"
SMTP_ALLOWLOCAL = "1"

on my website using internal SMTP.

And I have not touched these settings:

SMTP_ALLOWUSER = ""
SMTP_ALLOWGROUP = "mail,mailman"

advised by Richard G


In summary for those who have similar issues after installing DirectAdmin. I follow these procedures advised by our great community:

1. Install and configure Firewall CSF on Centos 7 where DirectAdmin is installed. Here is a good guide:

How to install and configure Config Server Firewall (CSF) on CentOS | DigitalOcean

I was recently asked if there is an easier way to manage your server’s Firewall on servers with web-based interfaces like cPanel, CentOS Web Panel and with s…

www.digitalocean.com

2. Make sure set this line in CSF config file:

$ cd /etc/csf/ && vi csf.conf

SMTP_BLOCK = "0"
SMTP_ALLOWLOCAL = "1"

3. Make sure ports 25, 465 and 587 are added to these line in CSF config file:

$ vi csf.conf

# Allow incoming TCP ports
TCP_IN = "20,21,22,25,53,80,110,143,443,465,587,993,995,2222,6827,35000:35999"

# Allow outgoing TCP ports
TCP_OUT = "20,21,22,25,53,80,110,113,443,465,587,993,995,2222"

4. Add your server's IP in CSF allow list with a line:

$ vi /etc/csf/csf.allow

xxx.xxx.xxx.xxx

5. Reload CSF and reboot your server:

$ csf -r
$ reboot

6. If mail.yourdomain.com is not working or open in the internal settings of, for example, a plugin, change it to your server's IP above which is in Firewall CSF's allow list.

It works very for Internal SMTP setting on my server. For external SMTP, you may follow Richard G's advice.

Many thanks for great support.

 

[daro2013]

I dont read here advise to set it to 0 i think misunderstanding.


I think and asked before the test you use is from external , but website you talk about is internal yes or no?

And also for external follow @Richard G advice and the real advice @splby given you .

Yes, it is internal SMTP setting using a plugin

 

[Richard G]

2. Make sure set this line in CSF config file:

I don't see that in the link you gave.

Anyway, I only asked not to advise to set smtp_block to 0 as this is not the smartest way to work. Feel free to use the setting as you like but just don't advertise it as the best solution.

As you can read from the CSF documentation:

Block outgoing SMTP except for root, exim and mailman (forces scripts/users
to use the exim/sendmail binary instead of sockets access).

So smtp is still possible, but via Exim, so local users have to user the correct smtp setting in their scripts with correct password.
This does not work on some VPS systems, that's why to check with the csftest.pl script.

This has to be correct too:
SMTP_PORTS = "25,465,587"

Same ports in outgoing tcp too.

Example from a hobby domain of mine, a Xenforo forum with smtp settings, same other customers use in their scripts on our different servers with for example Wordpress, IPB and PHPBB.

Connection type                            SMTP
Host            mail.myhobbydomain.com:587
Username                [email protected]
Encryption                TLS

But again, if you wish to use SMTP="0" then this is your free choice. I only ask to not advertise this as being the best solution.

If it doesn't work with the setting I provided with your local mailserver then something else is maybe set wrong or your vps does not support it.
It's not that you're doing something completely wrong or bad. It's just a bit less safe.