Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 12 replies
  • Subscribers 2 subscribers
  • Views 12229 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Relaying authentication Qs

jtv
My last post was pretty incomprehensible, so I regrouped my thoughts!

We've got a 2nd email domain that's been added behind our Astaro.  Our original environment is all local-subnets only for sending out mail, the new email domain is all external, users are all over the country with a combination of residential and business connections.

Further complicating the issue is that there is no central authentication method for these users - no AD or anything else.  So, as of right now I've had to bypass the SMTP proxy (using DNAT) for this email domain, which is not ideal.  

What I'm trying to figure out is what the simplest way to enable these users to relay.  I'd prefer to avoid having them authenticate through the Astaro, as the SMTP server already has a comprehensive relay policy in place.  I don't see any way to let only specific domains have lax relaying policies.

Any suggestions on what to pursue?  I know it's a big no-no, but I was considering setting the allowed relay to "all" - BUT only if the individual servers relaying restrictions remained in place.   Obviously that's not something I want to test in a production environment.


This thread was automatically locked due to age.
Parents
  • 0
    I have a kludge way for this to work.  Not exactly as you want, but better than nothing.
     
    1)  No DNAT Rule
    2)  You will need to create a user account for each of your remote workers on the Astaro.  Either use backend auth or have it be a separate local account, but the password MUST match the one entered into their email client.  I believe that the username is case sensitive for Astaro as well (had an issue with this a long time ago, maybe it's resolved now, but I still just make certain that the account entered in Astaro and the email client have matching case.).
    3)  Add these user accounts to the authenticated relay box.
     
    When a remote user tries to send an email, they will be authenticated against Astaro, which will then forward the email onto your internal email server.  This way you get security from unauthorized realy and filtering capabilities.
     
    It would be great if Astaro could do filtering AND forward authentication requests onto the mail server, but that capability just doesn't exist that I've been able to figure out.
    __________________
    ACE v8/SCA v9.3

    ...still have a v5 install disk in a box somewhere.

    http://xkcd.com
    http://www.tedgoff.com/mb
    http://www.projectcartoon.com/cartoon/1
  • 0 in reply to Scott_Klassen
    I have a kludge way for this to work.  Not exactly as you want, but better than nothing.
     
    1)  No DNAT Rule
    2)  You will need to create a user account for each of your remote workers on the Astaro.  Either use backend auth or have it be a separate local account, but the password MUST match the one entered into their email client.  I believe that the username is case sensitive for Astaro as well (had an issue with this a long time ago, maybe it's resolved now, but I still just make certain that the account entered in Astaro and the email client have matching case.).
    3)  Add these user accounts to the authenticated relay box.
     
    When a remote user tries to send an email, they will be authenticated against Astaro, which will then forward the email onto your internal email server.  This way you get security from unauthorized realy and filtering capabilities.
     
    It would be great if Astaro could do filtering AND forward authentication requests onto the mail server, but that capability just doesn't exist that I've been able to figure out.


    Thank you, this is exactly what I've been trying to ask.  So, as long as the username/pass is the same between both the SMTP server and the Astaro, it will work?  You don't have to disable user authentication on the SMTP server?
  • 0 in reply to jtv

    i have same problem..

    my scenario:

    linux mail server with virtula users/domains

    before i enabled smtp proxy in sophos i ised nat rules from wan to lan all email ports i need,the problem smapassain an clama on mail server..

    so i enabed smtp protection:

    simple mode

    routing settings:

    domains: my.com

    host list: lan ip of my mail server

    verify recipients: with callout

    relaying settings:

    checked authenticated users

    creat a local user in sophos for relaying

    allow hosts: mail server lan ip 

    advanced settings:

    not use transparent

    createca in stratcom ssl and configured it for tls

    in my mail server configure relay configuration that use sophos smtp(authentication for sophos smtp with local user that i created)

    testing:)

    when i send mail from gmail to xxx@my.com>working good,sophos check the recipient in internal mail,scanning the mail and deliver it to internal mail to the recipient

    when i sending mail from my webmail(my webmail on the mail server,same server!!!),work good ,it use sophos relay,all scans working

    BUT i can use anymore mail client like oulook,when i configure smtp in otlook,it dot authenticate mail server,it try authenticate sohhos smtp...

  • 0 in reply to IlyaYakov

    I don't agree with the approach that atv insisted on taking six years ago.  Try what i suggested...

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0 in reply to IlyaYakov

    I don't agree with the approach that atv insisted on taking six years ago.  Try what i suggested...

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
No Data
Unfiltered HTML