connecting to port 25-need to secure

[troytunes]

I have relaying blocked in the SMTP settings by making my internet POP3/SMTP users authenticate. That's fine.

Now, can I make all connections to port 25 have to authenticate as well? Someone right now could use telnet to connect to my port 25 and send someone in the network an email.

I don't want to block port 25 and make all those Outlook clients use VPN to send mail, and I don't see the setting to do this in SMTP properties...I can block IP's, but that's about it.

Thanks for any help.

 

[Zelandakh]

huh? you want every server in the world to authenticate to you before sending emails?

well, you CAN...

I'd recommend that you don't though.

<signature sold. new owner moving in shortly>

 

[troytunes]

Oh ya, here's the third party stuff:

We use an outside email filtering service that sends cleaned emails to our server on port 25...but I guess even those 8 servers would have to be allowed through somehow, maybe I could let their servers connect without authenticating but nothing else...

hmm...getting more and more complicated to plug this port 25 hole...it just bugs me that some disgruntled employee could get a virus-ridden email directly to one of our users so easily on that port...

 

[tmpadmin]

Under you default SMTP Virtual server properties / Access / connection. Enter the IP of the machine that is forwarding you your cleaned e-mail. I have the same setup. Works great, you might have to add a few other IP's in some cases (just think about this when you are pulling your hair out when someone can not sent).

Now if I could only have that setup for my main domain and the default setup for my secondary domain (secondary isn't getting filtered).

 

[troytunes]

Sounds good for a small group of users, but I've got a few hundred users making connections from all over the country to this server to send their company email.

...I'm thinking this can't be done unless I get all of those users on VPN and then stop the world from connecting to my server on 25, just let the filtering servers in...

 

[tmpadmin]

Either vpn or web access.