{"id":1662,"date":"2025-04-25T18:05:38","date_gmt":"2025-04-25T16:05:38","guid":{"rendered":"https:\/\/www.shukko.com\/x3\/?p=1662"},"modified":"2025-04-25T18:05:38","modified_gmt":"2025-04-25T16:05:38","slug":"the-new-default-smtp-authentication-policy","status":"publish","type":"post","link":"https:\/\/www.shukko.com\/x3\/2025\/04\/25\/the-new-default-smtp-authentication-policy\/","title":{"rendered":"the new default SMTP authentication policy"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\" id=\"\ufe0f-block-smtp-authentication-on-port-25-and-plain-text-connections\">\u203c\ufe0f Block SMTP authentication on port 25 and plain-text connections&nbsp;improved<\/h2>\n\n\n\n<p>The Exim configuration is updated to not allow users to perform SMTP authentication on TCP port 25. This means email clients will not be able to use port 25 for sending emails. TCP port 25 will be exclusively used for communication between mail servers, and clients will have to use 587 or 465 ports.<\/p>\n\n\n\n<p>The motivation for this change is to completely separate the mail server-to-server (MTA-to-MTA) communications from client-to-server (MUA-to-MTA) communications. This makes it easier to harden the email submission security. For example:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>TCP ports 587 and 465 could use custom firewall rules to only allow sending emails from trusted networks.<\/li>\n\n\n\n<li>It is no longer possible to brute-force the email credentials over the TCP port 25.<\/li>\n<\/ul>\n\n\n\n<p>In addition to blocking SMTP authentication on port TCP 25, Exim will no longer allow SMTP authentication over plain-text connections. This change protects the clients from accidentally misconfiguring email applications to not use encrypted connections. Use of encryption is critical because SMTP authentication uses literal user passwords without any hashing. Accessing SMTP over plaintext at least once is enough for the user credentials to be stolen. There is an exception made to allow not using encryption for internal connections over&nbsp;<code>localhost<\/code>.<\/p>\n\n\n\n<p>This is a big change that might affect servers and clients that relied on authentication always being available. This feature is implemented in a way to allow server administrators to restore the old behaviour in a simple way.<\/p>\n\n\n\n<p>The authentication availability on SMTP ports is controlled by the&nbsp;<code>AUTH_ENABLE_CONDITION<\/code>&nbsp;macro in the&nbsp;<code>\/etc\/exim.variables.conf<\/code>&nbsp;file. The new default policy is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>AUTH_ENABLE_CONDITION = ${if and { {!eq{$interface_port}{25}} { or { {def:tls_in_cipher} {match_ip{$sender_host_address}{&lt;; 127.0.0.1 ; ::1}} } } }}\n<\/code><\/pre>\n\n\n\n<p>The policy can be changed by setting it to a different value in the&nbsp;<code>\/etc\/exim.variables.conf.custom<\/code>&nbsp;file and rebuilding the Exim configuration with the&nbsp;<code>da build exim_conf<\/code>&nbsp;command.<\/p>\n\n\n\n<p>Examples:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Use old (insecure) SMTP authentication policy, authentication always available\nsed -i '\/^AUTH_ENABLE_CONDITION \/d' \/etc\/exim.variables.conf.custom\necho 'AUTH_ENABLE_CONDITION = yes' &gt;&gt; \/etc\/exim.variables.conf.custom\nda build exim_conf\n\n# Block SMTP authentication on plain-text connections, but allow it to work on all TCP ports\nsed -i '\/^AUTH_ENABLE_CONDITION \/d' \/etc\/exim.variables.conf.custom\necho 'AUTH_ENABLE_CONDITION = ${if or { {def:tls_in_cipher} {match_ip{$sender_host_address}{&lt;; 127.0.0.1 ; ::1}} }}' &gt;&gt; \/etc\/exim.variables.conf.custom\nda build exim_conf\n\n# Block SMTP authentication on TCP port 25, but allow it on plain-text connections on on other ports\nsed -i '\/^AUTH_ENABLE_CONDITION \/d' \/etc\/exim.variables.conf.custom\necho 'AUTH_ENABLE_CONDITION = ${if !eq{$interface_port}{25}}' &gt;&gt; \/etc\/exim.variables.conf.custom\nda build exim_conf\n\n# Use the new (secure) DirectAdmin SMTP authentication policy\nsed -i '\/^AUTH_ENABLE_CONDITION \/d' \/etc\/exim.variables.conf.custom\nda build exim_conf\n<\/code><\/pre>\n\n\n\n<p><strong>Note:<\/strong>&nbsp;It is highly recommended to use the new default SMTP authentication policy. The mechanism to revert to the old policy should only be used temporarily until all the clients are reconfigured to use SMTP submission ports (587 or 465) and encryption.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"csf-adjusted-smtp-ports-for-smtp-block-to-block-25-port-only\"><a href=\"https:\/\/docs.directadmin.com\/changelog\/version-1.676.html#csf-adjusted-smtp-ports-for-smtp-block-to-block-25-port-only\">#<\/a><\/h2>\n","protected":false},"excerpt":{"rendered":"<p>\u203c\ufe0f Block SMTP authentication on port 25 and plain-text connections&nbsp;improved The Exim configuration is updated to not allow users to perform SMTP authentication on TCP port 25. This means email clients will not be able to use port 25 for sending emails. TCP port 25 will be exclusively used for communication between mail servers, and [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1662","post","type-post","status-publish","format-standard","hentry","category-kategerisiz"],"_links":{"self":[{"href":"https:\/\/www.shukko.com\/x3\/wp-json\/wp\/v2\/posts\/1662","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.shukko.com\/x3\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.shukko.com\/x3\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.shukko.com\/x3\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.shukko.com\/x3\/wp-json\/wp\/v2\/comments?post=1662"}],"version-history":[{"count":1,"href":"https:\/\/www.shukko.com\/x3\/wp-json\/wp\/v2\/posts\/1662\/revisions"}],"predecessor-version":[{"id":1663,"href":"https:\/\/www.shukko.com\/x3\/wp-json\/wp\/v2\/posts\/1662\/revisions\/1663"}],"wp:attachment":[{"href":"https:\/\/www.shukko.com\/x3\/wp-json\/wp\/v2\/media?parent=1662"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.shukko.com\/x3\/wp-json\/wp\/v2\/categories?post=1662"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.shukko.com\/x3\/wp-json\/wp\/v2\/tags?post=1662"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}