Miscellaneous first checks

• I checked that all ports are open and not blocked by my ISP / hosting provider.
• I know that SSL errors are likely the result of a wrong setup on the user side and not caused by DMS itself. I'm confident my setup is correct.

Affected Component(s)

Podman creates open postfix relay

What happened and when does this occur?

As you state in your mailserver.env, the network option might open up an open relay when specifying the wrong network. The default is localhost.

When running Podman in rootless mode, all source IP's get translated to localhost by default, so the relay is publicly accessible to the whole WAN side and there is no mention/warning about this anywhere in the wiki.

What did you expect to happen?

I expected this to be an out-of-the-box secure solution. I did not know about Podmans behaviour earlier and I think users should be warned or ideally the default config should be updated to secure Podman in rootless mode.

How do we replicate the issue?

1. Launch DMS with Podman in rootless mode
2. Expose port 25
3. The gateway is now open to the public -> Watch your mailserver get used as a spam-distributor :)

DMS version

v10.4.0

What operating system is DMS running on?

Linux

What instruction set architecture is DMS running on?

x86_64 / AMD64

What container orchestration tool are you using?

Podman (not officially supported)

docker-compose.yml

It's the default config provided by the master branch

Other relevant information

This was tested on AlmaLinux 8.5 using Podman 3.3.1 in rootless mode with podman-compose v1.0.2.
Unprivileged port bindings start at 25, I have not configured firewalld redirects to unprivileged ports (but I guess this has no impact on the issue?)

What level of experience do you have with Docker and mail servers?

• I am inexperienced with docker
• I am inexperienced with mail servers
• I am uncomfortable with the CLI

Code of conduct

• I have read this project's Code of Conduct and I agree
• I have read the README and the documentation and I searched the issue tracker but could not find a solution