Rockman-Industries/Zimbra-Outgoing-restriction-for-spammail-even-in-case-of-password-compromizatiton

ISSUE

If a user's password is compromised, the Server default setup allows the user to relay emails using a different email address than the one uses to authenticate with smtp, Which cause the outgoing spamming

Process

  In ZCS 8 
  vim /opt/zimbra/conf/zmconfigd.cf 
  Find this line:
  POSTCONF smtpd_sender_restrictions FILE zmconfigd/smtpd_sender_restrictions.cf
  Below that line add :
  Note: Do not forget to include the tab at the beginning of each line:
  POSTCONF smtpd_sender_login_maps       FILE postfix_sender_login_maps.cf

  Create file - postfix_sender_login_maps.cf
  vim /opt/zimbra/conf/postfix_sender_login_maps.cf
  Add :
  hash:/opt/zimbra/conf/exceptions-db ldap:/opt/zimbra/conf/ldap-restricrelay.cf
  
  An exceptions file, allows you to declare a different email sender address that a user can have, as a way of bypassing the restriction.
  Create the exceptions file, by running this command:
  
  vim /opt/zimbra/conf/exceptions-db
  (Optional) Add text to the file, one line per address, where the first word is the email sender address and the second word is the username.
  Example: johndoe@otherdomain.com admin
  Note: You can leave the file empty.

  Create the DB file, by running this command:
  /opt/zimbra/postfix/sbin/postmap exceptions-db

  Create /opt/zimbra/conf/ldap-restricrelay.cf
  Obtain the LDAP server_host and the bind_pw of the user uid=zmpostfix,cn=appaccts,cn=zimbra:
  Seek and record the data from the file /opt/zimbra/conf/ldap-vam.cf, by running these commands:
      grep server_host /opt/zimbra/conf/ldap-vam.cf
      grep bind_pw /opt/zimbra/conf/ldap-vam.cf

 vim /opt/zimbra/conf/ldap-restricrelay.cf
  Adjust the server_host and bind_pw values to match your server hostname and password:
  
  server_host = ldap://zimbramail.rockmanindustries.com:389 
  server_port = 389 
  search_base = 
  query_filter = (&(|(uid=%s)(zimbraMailDeliveryAddress=%s)(zimbraMailAlias=%s)(zimbraMailCatchAllAddress=%s))(zimbraMailStatus=enabled)) 
  result_attribute uid,zimbraMailDeliveryAddress,zimbraMailForwardingAddress,zimbraPrefMailForwardingAddress,zimbraMailCatchAllForwardingAddress
  version = 3
  start_tls = yes
  tls_ca_cert_dir = /opt/zimbra/conf/ca
  bind = yes 
  bind_dn = uid=zmpostfix,cn=appaccts,cn=zimbra
  bind_pw = kdNX17Pb
  timeout = 30

  Set the permissions on the necessary files, by running this command:
  chown zimbra: postfix_sender_* exceptions-db* ldap-restricrelay.cf

  For the new policy to come into effect:
  zmmtactl restart

  Reference : http://wiki.zimbra.com/wiki/Enforcing_a_match_between_the_FROM_address_and_the_sasl_username