login
Search
Hi, I want to install a mailserver. What is the easiest and the most secure solution ? OpenBSD comes with Sendmail. I seen a lot of people use Postfix instead Sendmail. Is there someone to advice me about the choice of the MTA ? Thank's.
Why do you think OpenBSD ships with (a custom and secure) sendmail by default? Do you think it is because that is the easiest and most secure option or do you think by installing postfix you'll be all secure and stuff? -- chs
I only want to know what is better (easiest way, most secure) to use. And have your advice. On Fri, 13 Aug 2010 09:04:01 +0200, Christer Solskogen
I would never use sendmail for anything halfway serious. -- Henning Brauer, hb@bsws.de, henning@openbsd.org BS Web Services, http://bsws.de Full-Service ISP - Secure Hosting, Mail and DNS Services Dedicated Servers, Rootservers, Application Hosting
<beavis> huh, hurr, he said qmail </beavis> -- Peter N. M. Hansteen, member of the first RFC 1149 implementation team http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/ "Remember to set the evil bit on all malicious network traffic" delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.
What are your views on qmail versus Postfix? Note that I'm *not* criticising your choice of qmail, and especially not now that it's in the public domain. I simply want to learn more about the subject. /Fredrik Henbjork
irrelevant here anyway. -- Henning Brauer, hb@bsws.de, henning@openbsd.org BS Web Services, http://bsws.de Full-Service ISP - Secure Hosting, Mail and DNS Services Dedicated Servers, Rootservers, Application Hosting
++ sendmail is fine if you have a few users at a relatively quiet domain, all of whom you want to have system accounts on the mailserver. smtpd does similarly but has unpredictable behavior at best. i spent many hours fiddling with smtpd until i gave up on it. postfix is great because of the virtual user support, meaning that your mail users do not require system accounts, and configurability. hosting several domains, all with separate mailboxes e.g. user@domain1.com and user@domain2.com is done pretty easily by postfix. in the instance that you need support from the postfix-users mailing list don your douchebag-proof-suit and you should be ok so long as you don't subscribe to that list. i have heard good things about qmail but never used it myself. FYI - this is a very old and contentious question - 'which mta is best?'
Qmail has worked for me for many years. We get about 50.00 smtp connections a day and do about 200K deliveries a month.
On Fri, 13 Aug 2010 12:27:56 +0200 qmail first grabbed my attention which it already had when I noticed a large defense organisation using it. I love qmail especially for it's use of the unix philosophy of many small parts and that it was built with security and simplicity in mind. It's not too easy to setup or keep track of vulnerabilities in patches, but spamcontrol at "www.fehcom.de" makes it easier to turn qmail into a fully functional and modern MTA, possibly even more functional and patched than you would desire, but still great. qmail is almost definately easier than messing with sendmails configs, ONCE the install is over with too. I don't know but believe postfix has the shallowest learning curve and has always had a good security record. Sendmail will likely make OpenBSD upgrades easier and inherits the eyes of OpenBSD developers.
On 8/13/2010 at 3:43 AM Peter Miller wrote: |> I only want to know what is better (easiest way, most secure) to use. |> And have your advice. | |He just gave it to you. sendmail. ============= My opinion, and my opinion only - if you do notd to change any of the configuration settings from the base install, then stay with sendmail. Once you need to start "getting into" the sendmail configuration files to use, for example, one transport for one domain and another transport as the default, then sendmail's configuration rapidly becomes daunting. I moved over to Postfix because of its excellent security and ease of configuration. YMMV and all that stuff.
Easiest doesn't necessarily fit with most secure ... or everyone would be using Windows and Macs? You have to understand what you are setting up, and sometimes that understanding doesn't come "easy" and security isn't a check box. What is easy for you - is it the same as what is easy for me? I started from scratch with the O'Reilly sendmail book ... It's your network, your requirements, your time. Webmail? TLS? POP? IMAP? Volume of email? Why do you think there are so many choices in open source - what one person found easy/useful/secure didn't work for someone else. sendmail, popa3d, and openwebmail have worked for /me/ for a very low volume mail server. I didn't find it that easy (but I learnt a lot on the way, it wasn't time wasted.) I don't know how secure it is. But as Christer has said, if it's in the OpenBSD base, that should mean something. As always - YMMV!
Just because it's in base doesn't mean that it's the "best" choice. After all, it *could* just mean that noone has had the time and/or energy to replace it with something "better" in base. I think few would argue that all things in base are perfect, and that there is no room for improvement. /Fredrik Henbjork, who hates Sendmail from a usability point of view.
Hmmm. Sendmail was in base and is still in the system, but was replace as the default MTA by smtpd a few release ago. So, I sure don't thin you will see smtpd being replace again by something else in base. It was already done. Check the archive. It was announced and done in 4.6 http://openbsd.org/46.html New tools: * Added smtpd(8), a new privilege-separated SMTP daemon. Are you saying you want the replacement in place now to be replace again!?!?!?...
bullshit. -- Henning Brauer, hb@bsws.de, henning@openbsd.org BS Web Services, http://bsws.de Full-Service ISP - Secure Hosting, Mail and DNS Services Dedicated Servers, Rootservers, Application Hosting
You are right as out of the box MTA in standard operation. I should
phase it differently. Like I said sendmail is still there. smtpd is in
base as well, but sendmail is the one in default operation. My mistake
in the details.
# man smtpd | grep appeared
The smtpd program first appeared in OpenBSD 4.6.
But bullshit it was from me. sendmail is still the default MTA yes, but
you have the choice and can use smtpd.
No. For clarification; I don't believe there is such a thing as the universal "best" MTA, since different users have different requirements. I personally like a smallish MTA, like smtpd(8), as the default MTA in base. But I also like my network servers to have been "field proven in the nasty wilderness" by others for some time before starting to use them myself in production, and smptd(8) is still a rather fresh piece of software. Were there any other reasons for writing smtpd(8), instead of just importing Postfix into base as the default MTA, besides Postfix's license? /Fredrik Henbjork, who also wonders if anyone here has any strong opinions regarding the feature set and security of the Apache in base, when compared to recent versions of (the BSD- licensed and C-based) Nginx and lighttpd?
Men, that's rather very selfish! So, you want everyone one else to do the work, but not you!? You don't want to participate in testing things and improving them, but rather, just sit back and demand that you are served on a silver plate? Or may be gold even here... Sorry if that sound ash here, but I can't believe what I read here.... It does come out that way as you put it. I hope it's not what you mean right? I must be wrong for sure... Yes, license and that's in the archive. Help yourself to the answer. Same here. It's been explore in the archive as well. Help yourself to the answer. Or is it like your first statement. You want others to do the work for you and point you to the answer? Best, Daniel
Yes, I'm "selfish" enough to want to run stable and secure software on my *production* systems. It's hard enough to find software that works really well as it is, and especially if it faces the Internet and the Bad People on it who want to exploit your systems, even if you limit yourself to "stable" releases from quality driven projects. So I prefer to do testing on designated test systems, instead of taking unnecessary risks with the production systems I'm responsible for. But I bet you're the kind of guy who gladly volunteers to put yourself and your family in a car running freshly written, and poorly tested, 0.0.0.0.0.1-alfa version brake system software to help iron out the bugs in it. Or are you also a selfish bastard, just like me? ;-D /Fredrik Henbjork
The one that you are most familiar with will always be the most secure solution. If you think choosing a particular product will ensure security you are wrong from the start. I happen to like sendmail and use it still --- James A. Peltier james_a_peltier@yahoo.ca
On 8/13/2010 at 9:04 AM Christer Solskogen wrote: |On Fri, Aug 13, 2010 at 8:55 AM, <openbsd@e-solutions.re> wrote: |> Hi, |> |> I want to install a mailserver. |> What is the easiest and the most secure solution ? |> OpenBSD comes with Sendmail. I seen a lot of people use Postfix instead |> Sendmail. |> Is there someone to advice me about the choice of the MTA ? |> | |Why do you think OpenBSD ships with (a custom and secure) sendmail by |default? ============= sendmail has an OpenBSD compatible license? :)
On Fri, 13 Aug 2010 10:55:13 +0400 "It depends" - as mentioned before, you need to specify the environment, mail volume etc. My opinion: *) Since 4.6 OpenBSD ships with its own daemon: "man smtpd". From what I remember it's not meant for production yet, but just for sending internal traffic (logs, notifications etc.) it works fine for me. *) Use qmail for large volume traffic, but be sure to read a bit about its "developer environment" before ;) *) If none of those two seem to be right for you, well, then use Postfix... regards, Robert
You can try smtpd(8) which is in base. Some people reported that they are using it in production already. At least configuration is much more easier then in sendmail(8) -- b If youbre good at something, never do it for free.b B bThe Joker
Yeah, /me for example... handles some 100,000 connects per day, with spam ratio about 3/1...4/1. i.e. some 25,000 deliveries per day. On Fri, 13 Aug 2010 13:35:44 +0200 -- With best regards, Gregory Edigarov
I have been for almost 18 months now. I use it as spam filter and front end for others. I do not have users n that box, not that it couldn't I guess. I never tried to make it so. It's risky, yes, but you don't make an omelet without breaking eggs! I ran into some issue time to time before, all in misc@ if you want to see it. But I must say in general, it's been very good for me. I upgrade it to the latest time to time when I see Gilles dong lots of commit to it. I run two of them, so if one goes south, I can switch to a second one real quick, but so far, it never happened to me to have big issues. The only one I had was the virtual domain hosting that just didn't work as explain in the man page and Gilles did work on it. If you want something simple, that's it. For a small server, I sure would go with it. But keep in mind it's not fully announce yet as ready for production, however, like the project, it's announcing productions things when they are rock solid. That doesn't mean smtpd is not, so if you run it, you help testing it and if you ran into issues, so far they all have been corrected pretty darn fast! So, do as you see fit, but if you are not scare of running bleeding edge new OpenBSD stuff, go for it and you will have fun as long as you are not scare to get your hand in it and do your own research when/if needed. Not that it required lots of hand holding so far. But it deserved more credit then Gilles is welling to give it! (;> I would say he is very conservative, just like everyone else in the project. They give you the best, so enjoy it! I sure would give it a run for good, I did for a long time so far and I have no complains for how I use it so far! YMMV. Daniel
For a basic mailserver, there's no reason to not use standard Senamdaill To make it even simpler, install Webmin - the sendmail manager tool is very useful. Lee
I've used Courier-MTA on OpenBSD for a few years. I think it's a good choice if you want an all-in-one package but you don't think your mail server should come with an OS (Zimbra). I also have Maia Mailguard in front of it to catch spam, and the base OS Sendmail in front of that because I don't trust Maia to listen on the Internet.
I'll second that. We've used Courier-MTA for at least five years and it is very robust with rock-solid performance and a good security record. (We use sendmail too btw, in spam-filtering mail frontends.) Unfortunately Courier-MTA isn't in ports (although its cousins Courier- IMAP and Courier-POP3 are), but it is pretty straight-forward to compile from source (read up carefully on the rather lengthy but well-documented compile-and-install process though). http://www.courier-mta.org/ /B -- internetlabbet.se / work: +46 8 551 124 80 / "Words must Benny LC6fgren / mobile: +46 70 718 11 90 / be weighed, / fax: +46 8 551 124 89 / not counted." / email: benny -at- internetlabbet.se
On 8/13/2010 at 11:26 PM Benny LC6fgren wrote: |Steve Shockley wrote: |> On 8/13/2010 2:55 AM, openbsd@e-solutions.re wrote: |>> Is there someone to advice me about the choice of the MTA ? |> |> I've used Courier-MTA on OpenBSD for a few years. I think it's a good |> choice if you want an all-in-one package but you don't think your mail |> server should come with an OS (Zimbra). | |I'll second that. We've used Courier-MTA for at least five years and it |is very robust with rock-solid performance and a good security record. | |(We use sendmail too btw, in spam-filtering mail frontends.) | |Unfortunately Courier-MTA isn't in ports (although its cousins Courier- |IMAP and Courier-POP3 are), but it is pretty straight-forward to compile |from source (read up carefully on the rather lengthy but well-documented |compile-and-install process though). | |http://www.courier-mta.org/ ============= I've used courier-imap for a few years on one of my servers. I like it because of the dedication to implementing standards and that I don't see stupid security mistakes in it.
Generically speaking -- and I'm digesting several decades of experience into a few paragraphs, so I'm going to make some sweeping statements that, of course, have exceptions. Except for the last one. If you've never done this before, then stick with sendmail because it minimizes the probability that you'll screw up. Postfix is easier to configure than sendmail. It also benefits from having been designed after many years of experience with sendmail, so it incorporates some lessons learned. It is relatively straighforward to switch between the two, once you've mastered some basic concepts. In the contemporary environment, either is a good choice for relatively secure, relatively high-performance environments. Both can be configured/customized extensively and there is plenty of support for both, from multiple sources. Exim is newer and arguably still easier to configure. It might be a good choice for someone with limited requirements and little experience. Courier is well-integrated with the other components necessary to make a fully-featured mail server, and is worth consideration if its feature set overlaps well with your requirements. Qmail is crap and is only used by people who don't know any better. ---Rsk
Actually "q"mail is only used by people who do know better because otherwise people like yahoo wouldn't go to such lengths to install it (caused by it's old licensing). There is a lot of bullshit about qmail floating around which I assume drove you to your opinion, please tell me why it is crap perhaps privately, after all this is an OpenBSD and not a qmail mailing list and I am currently assuming that what you have to say is wrong or has a patch for it.