Re: smtp_auth spam using anonymous * Marc G. Fournier :
>   E69A92F87A7: client=unknown[219.235.2.53], sasl_method=LOGIN, 
> sasl_username=anonymous
> 
>   I've got a slew of these in my /var/log/maillog, and alot of spam being
> relayed through ... the only thing I've been able to find on the 'Net seems to
> point to setting:
> 
> smtpd_sasl_security_options = noanonymous

Nope, you are mixing things, to be precisely the SASL mechanism (here: LOGIN)
and the login name sent (here: anonymous).

When you set options using the Postfix $smtpd_sasl_security_options parameter
you set a policy that tell's libsasl which mechanism types (anonymous,
plaintext, mutual auth, etc.) Postfix is allowed to offer.

So when you specify "smtpd_sasl_security_options = noanonymous" you tell
Postfix to offer any mechanism Cyrus SASL provides, except (!) for mechanisms
that belong to the group of ANONYMOUS mechanism types.


In your case the log indicates that the sending party used the LOGIN mechanism
(mechanism type: plaintext). You _could_ set a policy that forbids plaintext
mechanisms, setting e.g. "smtpd_sasl_security_options = noanonymous,
noplaintext", but it will get you nowhere because the evidence you provided
indicates you have a different problem.

The problem you have is that the abusing party is able to authenticate
successfully. Changing the mechanism will probably not stop them as long as
they are able to authenticate. That's part of the idea of SMTP AUTH: Raise
some unknown parties priviledges if they provide evidence that they are a know
party - successful authentication does exactly that.

They will probably be using _any_ mechanism your server offers - as long as
they know how to handle the mechanism - because they seem to know the password
associated with your login user "anonymous".

So what's the solution? I doubt that Cyrus SASL is buggy and waives any party
through as long as they claim to be user "anonymous". It's probably setting a
more secure password that cannot be guessed or calculated.

Spammers do dictionary attacks on servers that are capable to do SMTP AUTH in
order to get a valid SASL login name and password. It's a perfect goal. You
get access to someone others ressources _and_ that party will probably survive
greylisting etc. Considering that people use weak password all the time, you
can easily guess how often they succeed.

b@rick



> 
>   But that doesn't seem to stop it ... so is there something else I need to set
> to disable this?
> 
>   I'm running postfix-2.4.3,1 on FreeBSD right now ...
> 
> Thank you
> 
> 
> - - ----
> Marc G. Fournier           Hub.Org Networking Services (http://www.hub.org)
> Email . pdbzoqn@hub.org                              MSN . pdbzoqn@hub.org
> Yahoo . yscrappy               Skype: hub.org        ICQ . 7615664
> - -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.4 (FreeBSD)
> 
> iD8DBQFHvjBu4QvfyHIvDvMRAupXAKDCrK2RhjNe51LTiixBXLvtSwvABQCg1o3F
> KRvNsCHGFKyjgq8NSFXVeRE=
> =2zje
> - -----END PGP SIGNATURE-----
> 
> - ---------- End Forwarded Message ----------
> 
> 
> 
> - ----
> Marc G. Fournier           Hub.Org Networking Services (http://www.hub.org)
> Email . pdbzoqn@hub.org                              MSN . pdbzoqn@hub.org
> Yahoo . yscrappy               Skype: hub.org        ICQ . 7615664
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.4 (FreeBSD)
> 
> iD8DBQFHvkjf4QvfyHIvDvMRAv+LAKDRL4NJRN2WH/6rkVWh5sN790dbmgCdHwzB
> iJFNebmem2yooeK26umt9Wo=
> =Pm3s
> -----END PGP SIGNATURE-----
> 

-- 
The Book of Postfix

saslfinger (debugging SMTP AUTH):

