How to verify /reject/accept real email users at Proxmox level

[ithelpdesk]

Dear Support/ Friends,

I have a zimbra email server lying behind proxmox.

Now I need proxmox to reject the unknown users emails (of our inside domains) without going to the Zimbra.Now proxmoox is forwarding all emails on behalf of internal domains without checking with the email server whether it exists or not.

Please give me a hint.

Thanks in advance.

Liju

 

[hata_ph]

if your zimbra are using ldap, u can use ldap filtering to reject unknown email address.

https://dhenandi.com/prevent-spam-email-using-ldap-verification-on-proxmox-mail-gateway/

 

[ithelpdesk]

if your zimbra are using ldap, u can use ldap filtering to reject unknown email address.

https://dhenandi.com/prevent-spam-email-using-ldap-verification-on-proxmox-mail-gateway/

This one I tried but its rejecting all emails ..I’ve changed the object “NOT LDAP User” from “From” to “To” .Still its rejecting outside emails and sending Bounce back

 

[tom]

Dear Support/ Friends,

I have a zimbra email server lying behind proxmox.

Now I need proxmox to reject the unknown users emails (of our inside domains) without going to the Zimbra.Now proxmoox is forwarding all emails on behalf of internal domains without checking with the email server whether it exists or not.

Please give me a hint.

Thanks in advance.

Liju

The receiver verification on SMTP level is reliable and fast, why do you NOT want to use this?

 

[ithelpdesk]

The receiver verification on SMTP level is reliable and fast, why do you NOT want to use this?

Yes Sir thats the option I am looking for..Can u exactly tell me where lies that option ?

Regards,
Liju

 

[hata_ph]

This one I tried but its rejecting all emails ..I’ve changed the object “NOT LDAP User” from “From” to “To” .Still its rejecting outside emails and sending Bounce back

I am using the unknown ldap address and working fine.
DId you create an incoming block rules for the unknown ldap profile? Show us your rules...
Is your ldap configure correctly? Can you see all your valid ldap/email users in PMG?

 

[ithelpdesk]

I am using the unknown ldap address and working fine.
DId you create an incoming block rules for the unknown ldap profile? Show us your rules...
Is your ldap configure correctly? Can you see all your valid ldap/email users in PMG?

Is your ldap configure correctly? YES
Can you see all your valid ldap/email users in PMG? YES

 

[hata_ph]

Maybe show us the mail.log....

 

[Stoiko Ivanov]

Yes Sir thats the option I am looking for..Can u exactly tell me where lies that option ?

GUI->Configuration->Mail Proxy->Options-> Verify Receivers

I hope this helps!

 

[ithelpdesk]

GUI->Configuration->Mail Proxy->Options-> Verify Receivers

I hope this helps!

Ok now its set it 450 and I need to change it to 550 right for complete rejection,right ???

 

[ithelpdesk]

Maybe show us the mail.log....

After a server restart its working fine with LDAP.But I prefer the SMTP level as it will use less resources..

Regards,
Liju

 

[tom]

Ok now its set it 450 and I need to change it to 550 right for complete rejection,right ???

I recommend 450 on the Proxmox Mail Gateway.

But you need to make sure that the internal email server answers with a 550 on a connection attempt of an unknown email address.

See also:
https://www.proxmox.com/en/downloads/item/proxmox-mail-gateway-deployment-guide

chapter 3.3.5

 

[hata_ph]

Some hackers will use verify receiver method to gather your email address....

A directory harvest attack (DHA) is a technique used by spammers in an attempt to find valid/existent e-mail addresses at a domain by using brute force. The attack is usually carried out by way of a standard dictionary attack, where valid e-mail addresses are found by brute force guessing valid e-mail addresses at a domain using different permutations of common usernames. These attacks are more effective for finding e-mail addresses of companies since they are likely to have a standard format for official e-mail aliases (i.e. jdoe@example.domain, johnd@example.domain, or johndoe@example.domain).

https://en.wikipedia.org/wiki/Directory_Harvest_Attack

 

[ithelpdesk]

Some hackers will use verify receiver method to gather your email address....



https://en.wikipedia.org/wiki/Directory_Harvest_Attack

Ok if you go the other way around (LDAP with notification) they can get it ,right?

 

[tom]

Some hackers will use verify receiver method to gather your email address....



https://en.wikipedia.org/wiki/Directory_Harvest_Attack

It is recommended to NOT tell the attacker if an email address is valid.

This can be done by sending a temporary error code - 450 (and not 550) - our recommended setting for receiver verification.

 

[AirForLife]

This one I tried but its rejecting all emails ..I’ve changed the object “NOT LDAP User” from “From” to “To” .Still its rejecting outside emails and sending Bounce back

I guess this method would cause backscatter problem, as it messages would not be rejected by SMTP protocol, but separate bounce mail would be generated after accepting first mail.

 

[hata_ph]

Ok if you go the other way around (LDAP with notification) they can get it ,right?

Come to think of it. Seem both method will attract DHA too...but usually I will just disable the bounce back notification.

 

[ithelpdesk]

Come to think of it. Seem both method will attract DHA too...but usually I will just disable the bounce back notification.

Yes that sounds good...