Idea ID: 2852728

Provide more appropriate Relay/Host Protection defaults

Status : New Idea
Brief Description
Security exposure: SMG Relay/Host Protection defaults
 
SMG Relay.PNG
 
This is the section to which I am referring in Module Management / Manage SMTP Interfaces:
 

Description
The documentation states this for Relay/Host Protection:

  • Restrict relaying: Default enabled.
  • Allowed relay sources: Add the system's SMTP relay. Default "127.0.0.1", "10.*", "172.16.0.0/12", "192.168.*.".
  • Allow Relay: Enable to allow relaying. Default, enabled.
  • Skip Connection Tests: Enable to skip the connection test. Default enabled.
  • Allow relay if authenticated: Default disabled. This implies AUTH LOGIN but the option is unavailable.
Implication: Any device having a private IP address can relay via the SMG appliance without having to authenticate. This includes devices at the other end of a VPN and devices connected via a rogue access point!
 
These TIDs confirm that the default settings are inappropriate without discussing the implications.
These defaults need to be removed and the documentation updated to better explain the security implications.

Tags:

Labels:

Other
  • Good point Kevin!  I setup SMG so long ago, I don't remember what the defaults were.  I do know that I modified the above setting to only allow my GWIA.  Defaults should not be wide open.  In my opinion, nothing should be permitted and the administrator should be directed to define only those addresses which should be allowed.  This is not a hard task so security should prevail over "easy".