topic Re: Send Email - restrict sender in Administration and Deployment

Send Email - restrict sender

MariaD — Wed, 12 Dec 2018 20:59:38 GMT

Hi Folks,

We have define the option emailsys, emailhost and emailport in our sasv9.cfg file. We use port 25.

All our users work with SAS EG or they have automatic SAS programs running on crontab. Recently we discovered that any user can send email as other people. For example, my email is name@comapny.com but in my SAS program is allow to define SENDER="other_name@company.com". So the email is sent as other_name@company.com

There is any way to restrict it? So the only sender will be the user or onlt allow a generic address as a sender?

I know about EMAILAUTHPROTOCOL option. But even if we set to "LOGIN" in our sasv9.cfg, the user can disable this option using:

options EMAILAUTHPROTOCOL=NONE;

Regards,

Re: Send Email - restrict sender

PaulHomes — Wed, 12 Dec 2018 22:34:32 GMT

The answer to this one really lies with the mail server. It sounds like your mail server allows unauthenticated senders from inside the local networks. Talk you your mail server admins about this. They will have configuration options to enforce SMTP authentication and match login user-id to from-address(es) - e.g. Postfix smtpd_sender_login_maps Of course, changes like this may have impacts on other systems using the same mail servers.

Re: Send Email - restrict sender

MariaD — Thu, 13 Dec 2018 00:55:40 GMT

@PaulHomes Thanks!