So I recently managed to make my Self-Hosted mailserver an Open Relay. This is bad.

My mailserver (dockerized mailcow) currently runs on a little NUC under my stairs. It has worked well with only minor problems over the 3 or so years I’ve had it running; I got spamhaused once, etc.

The problem all started with me trying to patch a percieved security hole. See, docker doesn’t respect firewalls like UFW or firewalld (all based on iptables of course), instead opting to allow ports through iptables as you add -p flags to your containers in spite of any other rules you may have.

Now I thought this was rather terrible. I don’t want to have to look both at my firewall and at all my docker port bindings to check if something is open. So as many of us would do, I started trawling the internet for solutions and started to learn about why this behaviour existed.

According to some articles/stackoverflows/etc. the way to stop docker messing with iptables and creating its own rules is to disable the feature in the daemon.json. Seems simple enough. The only caveat that I found mentioned was that container networking would break (in terms of internet reachability) but that’s ok because I just had to add a firewalld rule to allow masquerading and that problem was solved.

Now the problem I failed to see was that of NAT changing. Prior to disabling the iptables flag, the mailserver would see connections’ IPs as their real public ones. However afterwards, every single IP was that of the internal docker network default route.

I didn’t think much of it at the time, merely that it would be more annoying to see who was connecting but that was fine because I had what I wanted. Firewalld was now the sole controller of my ports 🎉

Little did I know (or maybe I did and just forgot) that postfix has a trusted list of IPs and it will relay anything from them without question. These IPs include internal IPs such as that of the default route…

So essentially every SMTP request was being NATed to have a sender address of 172.22.1.1 and postfix started sending EVERYTHING 😵‍💫

It wasn’t long before a plethora of bots had saturated my poor NUC with HUNDERDS OF THOUSANDS of emails.

I got home this evening to lag spikes in Tarkov which prompted me to check the server where I found this mess.

After taking everything down, re-enabling the iptables and flushing all the postfix queues, I was able to spin back up and not have the whole thing start spiralling again.

Some tips for those hosting mailservers:

I’m gonna go cry myself to sleep now and pray that the big mail hosts like Google and Microsoft take pity on me and my screw up. (We all know I’ll never be able to send another email to Microsoft again, who am I kidding)

  • KittensInc@alien.topB
    link
    fedilink
    English
    arrow-up
    1
    ·
    11 months ago

    Honestly, it’s about time Postfix gets replaced with a modern email server. It’s a dinosaur designed around 1990s UNIX, with dozens of leftover footguns eagerly waiting to go off.

    The fact that it even allows local mail submission or trusted subnets is already problematic, if you ask me. It is 2023, email should only be allowed after proper authentication & authorization!

    • weselko@alien.topB
      link
      fedilink
      English
      arrow-up
      1
      ·
      11 months ago

      This makes no sense. Postfix supports auth, since forever, with varius mechanisms. What is a modern mailserver in your opinion? Honestly curious.

      • KittensInc@alien.topB
        link
        fedilink
        English
        arrow-up
        1
        ·
        11 months ago

        Of course Postfix supports auth, I’m not disputing that.

        The problem is that it also supports completely anonymous submission from localhost and from local networks, and there are half a dozen ways to accidentally turn your server into an open relay. This made sense in the 1990s when every machine was hosting its own mail server for the two dozen local users, but we don’t live in that world anymore and support for it should’ve been removed already. If you’re using it something is going seriously wrong in your setup, so why is it allowed at all?

        I haven’t looked too closely into it, but something like Stalwart seems closer to my expectations: just a no-nonsense batteries-included secure-by-default mail server.

        There are also dozens of “mail in a box” setups out there who try to do the same thing, but they all end up being Rube Goldberg machines built on top of legacy software.

        • weselko@alien.topB
          link
          fedilink
          English
          arrow-up
          1
          ·
          11 months ago

          I get your point and in the context of selfhosted it makes lots of sense. But I wouldn’t write of postfix, its included with all the linux distros, in a lot of them as a default mailserver. And would strongly argue that it still has its place, even though its configuration isn’t beginner friendly. Kinda like a crocodile, it hasn’t changed much in all those years, but maybe it didn’t have to.