Je reçois des courriers d'hameçonneurs utilisant de fausses adresses locales Je comprends que les mails provenant de mon réseau ne nécessitent pas d'authentification (pour les tâches cron et autres), mais quelqu'un dans un autre pays ne devrait-il pas avoir besoin d'une authentification même s'il envoie des mails à l'intérieur de mon domaine ?
Exemple : actuellement, je suis autorisé à envoyer un message de someone@mydomain.tld à someoneelse@mydomain.tld sans authentification, même si je me connecte à partir d'un autre pays et non à partir de mynetworks.
dans main.cf, mynetworks n'a que localhost de défini
Y a-t-il quelque chose que je puisse faire à ce sujet ?
Explications complémentaires Prendre le site smtper par exemple. Il n'est pas hébergé sur mes serveurs (probablement pas dans mon pays non plus), donc je m'attendrais à ce que si je place l'hôte et le port de mon serveur, que je ne mets pas les informations d'identification appropriées et que je demande l'envoi d'un courrier depuis et vers les courriels que j'héberge, cela échoue. Mais ce n'est pas le cas. Il passe sans problème.
Demande d'information
Comme demandé, voici mon main.cf
smtpd_banner = $myhostname ESMTP $mail_name powered by Easy Hosting Control Panel (ehcp) on Ubuntu, www.ehcp.net
biff = no
append_dot_mydomain = no
readme_directory = /usr/share/doc/postfix
# TLS parameters
tls_random_source=dev:/dev/urandom
tls_preempt_cipherlist = yes
# TLS Incoming
smtpd_tls_cert_file=/path/to/my/certificate.crt
smtpd_tls_key_file=/path/to/my/certificate.key
smtpd_tls_CAfile=/path/to/my/certificate.ca-bundle
smtpd_use_tls=yes
smtpd_tls_auth_only=yes
smtpd_tls_security_level=may
smtpd_tls_ciphers = high
smtpd_tls_mandatory_ciphers=high
smtpd_tls_exclude_ciphers = MD5, DES, ADH, RC4, PSD, SRP, 3DES, CAMELLIA, eNULL, aNULL
smtpd_tls_mandatory_exclude_ciphers = MD5, DES, ADH, RC4, PSD, SRP, 3DES, CAMELLIA, eNULL, aNULL
smtpd_tls_loglevel=1
smtpd_tls_received_header=yes
smtpd_tls_session_cache_timeout=3600s
smtpd_tls_mandatory_protocols = TLSv1.2, TLSv1.1, TLSv1, !SSLv2, !SSLv3
smtpd_tls_protocols = TLSv1.2, TLSv1.1, TLSv1, !SSLv2, !SSLv3
smtpd_starttls_timeout = 300s
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
# TLS Outgoing
smtp_tls_cert_file=/path/to/my/certificate.crt
smtp_tls_key_file=/path/to/my/certificate.key
smtp_tls_CAfile=/path/to/my/certificate.ca-bundle
smtp_use_tls=yes
smtp_tls_security_level=may
smtp_tls_ciphers = high
smtp_tls_mandatory_ciphers=high
smtp_tls_exclude_ciphers = MD5, DES, ADH, RC4, PSD, SRP, 3DES, CAMELLIA, eNULL, aNULL
smtp_tls_mandatory_exclude_ciphers = MD5, DES, ADH, RC4, PSD, CAMELLIA, SRP, 3DES, eNULL
smtp_tls_loglevel=1
smtp_tls_received_header=yes
smtp_tls_session_cache_timeout=3600s
smtp_tls_mandatory_protocols = TLSv1.2, TLSv1.1, TLSv1, !SSLv2, !SSLv3
smtp_tls_protocols = TLSv1.2, TLSv1.1, TLSv1, !SSLv2, !SSLv3
smtp_starttls_timeout = 300s
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
# General Configuration
myhostname = mydomain.tld
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination = localhost
relayhost =
mynetworks = 127.0.0.0/8
mailbox_command = procmail -a "$EXTENSION"
mailbox_size_limit = 0
recipient_delimiter = +
debug_peer_list =
debug_peer_level = 1
disable_vrfy_command = yes
inet_protocols = ipv4
inet_interfaces = all
smtpd_destination_concurrency_limit = 2
smtpd_destination_rate_delay = 1s
smtpd_extra_recipient_limit = 10
smtpd_error_sleep_time = 1s
smtpd_soft_error_limit = 10
smtpd_hard_error_limit = 20
# Virtual domains, mailboxes, etc
virtual_alias_domains =
virtual_alias_maps = proxy:mysql:/etc/postfix/mysql-virtual_forwardings.cf, proxy:mysql:/etc/postfix/mysql-virtual_email2email.cf
virtual_mailbox_domains = proxy:mysql:/etc/postfix/mysql-virtual_domains.cf
virtual_mailbox_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailboxes.cf
virtual_mailbox_base = /home/vmail
virtual_uid_maps = static:5000
virtual_gid_maps = static:5000
virtual_create_maildirsize = yes
virtual_mailbox_extended = yes
virtual_mailbox_limit_maps = proxy:mysql:/etc/postfix/mysql-virtual_mailbox_limit_maps.cf
virtual_mailbox_limit_override = yes
virtual_maildir_limit_message = "The user you are trying to reach is over quota."
virtual_overquota_bounce = yes
virtual_mailbox_limit = 0
virtual_message_limit = 0
mailbox_size_limit = 0
message_size_limit = 0
default_process_limit = 3
sender_canonical_maps =
transport_maps = proxy:mysql:/etc/postfix/mysql-virtual_transports.cf
proxy_read_maps = $local_recipient_maps $mydestination $virtual_alias_maps $virtual_alias_domains $virtual_mailbox_maps $virtual_mailbox_domains $relay_recipient_maps $canonical_maps $sender_canonical_maps $recipient_canonical_maps $relocated_maps $mynetworks $virtual_mailbox_limit_maps $transport_maps
# SASL Authentication
#smtpd_sasl_type = courier
smtpd_sasl_path = smtpd
smtpd_sasl_local_domain = $myhostname
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
smtpd_tls_auth_only = yes
# Restrictions
#smtpd_delay_reject = yes
#smtpd_helo_required = yes
#smtpd_helo_restrictions = permit_mynetworks, reject_invalid_helo_hostname, permit
#smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
#smtpd_sender_restrictions = permit_mynetworks, reject_unknown_sender_domain, reject_unlisted_sender, permit
#smtpd_recipient_restrictions = reject_unauth_pipelining, reject_non_fqdn_recipient, reject_unknown_recipient_domain, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_rbl_client zen.spamhaus.org, reject_rbl_client b1.spamcop.net, check_policy_service unix:postgrey/socket, permit
smtpd_relay_restrictions = permit_mynetworks, permit_sasl_authenticated, defer_unauth_destination
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, check_client_access cidr:/etc/postfix/client_checks
# milters & filters (Amavis & DKIM)
content_filter = smtp-amavis:127.0.0.1:10024
milter_protocol = 2
milter_default_action = accept
smtpd_milters = inet:localhost:8891
non_smtpd_milters = $smtpd_milters
