mail: disabled mailboxes accepted at RCPT time, causing backscatter

[stephdl]

Postfix accepts mail for disabled mailboxes and hidden accounts. Dovecot then rejects it at LMTP delivery, and Postfix sends a bounce to the sender. The sender is often forged, so this is backscatter and it can hurt the server reputation.

Steps to reproduce

• Install mail 1.8.0 and bind it to a Samba AD user domain
• Add a mail domain with "Add user addresses" enabled, e.g. example.org
• Create user alice and disable her mailbox from the Mail UI
• From an external host, connect to port 25 and send EHLO test, MAIL FROM:<forged@example.com>, RCPT TO:<alice@example.org>, DATA
• Repeat with RCPT TO:<krbtgt@example.org> and RCPT TO:<ldapservice@example.org>
• Check the journal: journalctl --since -5min | grep -E "status=|non-delivery"

Expected behavior

RCPT TO is rejected with 550 5.1.1 User unknown, like any non existent address.

Actual behavior

RCPT TO returns 250 2.1.5 Ok for alice, krbtgt and ldapservice. An unknown address is correctly rejected with 550. LMTP delivery then fails and Postfix sends a bounce to the forged sender:

to=<alice@mail.example.org.localhost>, orig_to=<alice@example.org>, ... status=bounced (... 550 5.1.1 <alice@mail.example.org.localhost> User doesn't exist ...)
sender non-delivery notification: ABEE4C6E2C

Postfix checks recipients with laddusers-ad.cf and laddusers-rfc2307.cf. Their query_filter only checks that the account exists. Dovecot excludes DOVECOT_DISABLED_USERS (which also contains hidden_users) from its LDAP filters, Postfix does not. The variable is already passed to the postfix container through discovery.env.

A possible fix is to add the same NOT-OR clause used in dovecot/usr/local/bin/reload-config to the Postfix laddusers*.cf filter, and to reload Postfix when a mailbox is enabled or disabled.

Components

• ns8-mail 1.8.0, latest stable release, with Samba AD 3.5.0
• Reproduced on a test system, same code in current main

See also

• Reported by Thorsten, private message