0

I tried setting up a mailman server recently, to try hosting some mailing lists. I did add the DMARC, DKIM and SPF records btw.

Recently, I saw that a lot (A LOT) of spam was being sent from my server (the queue grew to thousands, with emails being sent to so many random email addresses). Is their any way that I can only allow mailman to send mails from my server? I want to be able to send emails to any server, but I guess only process doing the sending should be mailman? Let me know if I am at fault for not understanding how it works.

My configuration here:

# File /etc/exim4/conf.d/main/00_local_macros

DKIM_DOMAIN = lists.domain.name
DKIM_SELECTOR = default
DKIM_PRIVATE_KEY = /etc/exim4/dkim/privatekey.pem
DKIM_CANON = relaxed

#-------
# File /etc/exim4/conf.d/main/25_mm3_macros

domainlist mm3_domains=lists.domain.name
MM3_LMTP_HOST=172.25.195.2
MM3_LMTP_PORT=8024
MM3_HOME=/opt/mailman/core/var

################################################################
# The configuration below is boilerplate:
# you should not need to change it.

# The path to the list receipt (used as the required file when
# matching list addresses)
MM3_LISTCHK=MM3_HOME/lists/${local_part}.${domain}

# Place this file at
# /etc/exim4/conf.d/router/455_mm3_router

mailman3_router:
  driver = accept
  domains = +mm3_domains
  require_files = MM3_LISTCHK
  local_part_suffix_optional
  local_part_suffix = -admin : \
     -bounces   : -bounces+* : \
     -confirm   : -confirm+* : \
     -join      : -leave     : \
     -owner     : -request   : \
     -subscribe : -unsubscribe
  transport = mailman3_transport

  # Place this file at

#-------
# File /etc/exim4/conf.d/transport/55_mm3_transport

mailman3_transport:
  debug_print = "Email for mailman"
  driver = smtp
  protocol = lmtp
  allow_localhost
  hosts = MM3_LMTP_HOST
  port = MM3_LMTP_PORT
  rcpt_include_affixes = true

#-------
# File /etc/exim4/update-exim4.conf.conf
#
# Edit this file and /etc/mailname by hand and execute update-exim4.conf
# yourself or use 'dpkg-reconfigure exim4-config'
#
# Please note that this is _not_ a dpkg-conffile and that automatic changes
# to this file might happen. The code handling this will honor your local
# changes, so this is usually fine, but will break local schemes that mess
# around with multiple versions of the file.
#
# update-exim4.conf uses this file to determine variable values to generate
# exim configuration macros for the configuration file.
#
# Most settings found in here do have corresponding questions in the
# Debconf configuration, but not all of them.
#
# This is a Debian specific file

dc_eximconfig_configtype='internet'
dc_other_hostnames=''
dc_local_interfaces='0.0.0.0 ; ::0'
dc_readhost=''
dc_relay_domains=''
dc_minimaldns='false'
dc_relay_nets='0.0.0.0/0'
dc_smarthost=''
CFILEMODE='644'
dc_use_split_config='true'
dc_hide_mailname=''
dc_mailname_in_oh='true'
dc_localdelivery='mail_spool'
IGNORE_SMTP_LINE_LENGTH_LIMIT='true'

And my mailman config:

[mta]
incoming: mailman.mta.exim4.LMTP
outgoing: mailman.mta.deliver.deliver
lmtp_host: 172.25.195.2
lmtp_port: 8024
smtp_host: 172.25.195.4
smtp_port: 25
configuration: python:mailman.config.exim4

[mailman]
# This address is the "site owner" address.  Certain messages which must be
# delivered to a human, but which can't be delivered to a list owner (e.g. a
# bounce from a list owner), will be sent to this address.  It should point to
# a human.
site_owner: admin@domain.name
Sid Verma
  • 101

2 Answers2

3

The dc_relay_nets='0.0.0.0/0' allows relay from any IP address making your mail server an open relay. You should limit that to your internal / trusted networks.

SPF/DKIM/DMARC won't protect you from internal configuration errors. In worst case the server DKIM signs unauthorized mail. Eventually your IP address gets blacklisted.

Esa Jokinen
  • 46,944
  • 3
  • 83
  • 129
  • 1
    Thanks. For some reason, setting dc_relay_nets didn't do anything to the autogenerated config, so I used the MAIN_RELAY_NETS macro to get the same thing done. – Sid Verma Dec 24 '19 at 14:36
1

As Esa pointed out, dc_relay_nets is the problem here. Run dpkg-reconfigure exim4-config to run through the configuration wizard again and change the value, or edit the file and reload Exim to reprocess it into a new Exim config file.

Exim has a handy exim4 -d -bh 1.2.3.4 command that simulates an SMTP session and displays in detail how ACLs are processed, resulting in ail being accepted for relay or local delivery or denied. It's an invaluable tool whenever you want to ask Exim "why is this allowed" (or denied).

Sam Morris
  • 377
  • 1
  • 11