Email Ports

To send email from server to server, or from client to server, TCP port 25 (SMTP) is used.

For a client to retrieve email from a server, use TCP port 110 for POP3 connections, and TCP port 143 for IMAP connections. For a client behind a firewall to retrieve email from a server out on the Internet, open port 110 or 143 in the outbound direction, since the traffic is outbound from your network to the Internet. To allow Internet clients to retrieve mail from a server on your internal network, open port 110 or 143 inbound, since the traffic is coming into your network from outside.

Hardening is an Ongoing Process

For example, years ago, there was a running joke about the “Sendmail bug of the week,” because Sendmail is a complex application and new vulnerabilities were being identified in the program with such great frequency. Today many Microsoft applications seem to have comments like that applied to them, and it’s easy for Linux/UNIX users to look down upon them for that – not having been around when administrators were shaking their heads, wondering when the stream of Sendmail reports would end.

SMTP Hole

One interesting issue with the SMTP protocol is the ability of an attacker to use an SMTP server to find user ID’s of users on your system via the SMTP VRFY command. Most mail servers have this disabled today (in fact, most servers can detect telnet connections and deny them), but some don’t. To find out if yours still allows VRFY, use the command “telnet yourmailservername 25”, then type the line “HELO test” and press enter, then after the server tells you it’s pleased to make your acquaintance (a social lot, mail server programmers ;-), type “VRFY yourloginID” and enter. You’re safe if you receive a reply saying that the VRFY command is not known or not allowed. You need to check with your vendor on how to disable it, if the VRFY came back with information. The SMTP command “EXPN yourloginID” has similar issues, but it’s somewhat worse – because if the SMTP server handles group alias expansion, a command of the form “EXPN aliasname” could potentially dump out to the requesting user, a list of all users in that alias.