5 ms·

Since Ubuntu doesn’t come with a firewall enabled by default, your postfix server is listening on all interfaces for mail immediately. The mynetworks configurat

by polard2 10y ago

Since Ubuntu doesn’t come with a firewall enabled by default, your postfix server is listening on all interfaces for mail immediately. The mynetworks configuration should prevent relaying, but any potential vulnerabilities in your postfix daemon are exposed to the network without your consent. I would prefer to configure postfix first before I ever allow it to run on my server Technically, if security is your focus, then shouldn't one of your first actions after setting up a new machine be to set iptables default action to drop all incoming new,invalid packets anyway? I mean, I generally install server with nothing. Set up iptables. Then install packages and open ports.

smacktoward 10y ago
> Technically, if security is your focus, then shouldn't one of your first actions after setting up a new machine be to set iptables default action to drop all incoming new,invalid packets anyway? But why expect the user to do that themselves? Shouldn't security be the default, with a secure configuration provided out of the box? Giving the user a secure configuration which they can then opt out of if they wish does better by the user than giving them an insecure configuration and then asking them to opt in to security does.
- vacri 10y ago
  If the user can't do that, then the user is not going to have the chops to configure Postfix anyway. Seriously, Debian is the upstream distro does this, and it's the other linux grandparent with RHEL. It's been around for decades, used in production the same way RHEL and BSD are, and we haven't had debian-based boxes compromised left, right, and centre with these 'insecure' defaults. The threat is imaginary, and not born out in real world numbers.
riprowan 10y ago
> Since Ubuntu doesn’t come with a firewall enabled by default, your postfix server is listening on all interfaces for mail immediately. But Ubuntu doesn't come with a postfix server enabled by default, so that's not really a concern, is it?
- JdeBP 10y ago
  Ubuntu does, however. Here is its guide: * https://help.ubuntu.com/lts/serverguide/postfix.html https://help.ubuntu.com/lts/serverguide/postfix.html Here is where it is enabled by default: * https://git.launchpad.net/postfix/tree/debian/postfix.postinst#n169 https://git.launchpad.net/postfix/tree/debian/postfix.postin... And here is where the installation process auto-starts the server: * https://git.launchpad.net/postfix/tree/debian/postfix.postinst#n557 https://git.launchpad.net/postfix/tree/debian/postfix.postin...
  - riprowan 10y ago
    Well I never. TIL. I've always installed and started it because I assumed it wasn't already running. Thanks!

by polard2 10y ago

smacktoward 10y ago

> Technically, if security is your focus, then shouldn't one of your first actions after setting up a new machine be to set iptables default action to drop all incoming new,invalid packets anyway? But why expect the user to do that themselves? Shouldn't security be the default, with a secure configuration provided out of the box? Giving the user a secure configuration which they can then opt out of if they wish does better by the user than giving them an insecure configuration and then asking them to opt in to security does.

vacri 10y ago
If the user can't do that, then the user is not going to have the chops to configure Postfix anyway. Seriously, Debian is the upstream distro does this, and it's the other linux grandparent with RHEL. It's been around for decades, used in production the same way RHEL and BSD are, and we haven't had debian-based boxes compromised left, right, and centre with these 'insecure' defaults. The threat is imaginary, and not born out in real world numbers.

riprowan 10y ago

> Since Ubuntu doesn’t come with a firewall enabled by default, your postfix server is listening on all interfaces for mail immediately. But Ubuntu doesn't come with a postfix server enabled by default, so that's not really a concern, is it?

JdeBP 10y ago
Ubuntu does, however. Here is its guide: * https://help.ubuntu.com/lts/serverguide/postfix.html https://help.ubuntu.com/lts/serverguide/postfix.html Here is where it is enabled by default: * https://git.launchpad.net/postfix/tree/debian/postfix.postinst#n169 https://git.launchpad.net/postfix/tree/debian/postfix.postin... And here is where the installation process auto-starts the server: * https://git.launchpad.net/postfix/tree/debian/postfix.postinst#n557 https://git.launchpad.net/postfix/tree/debian/postfix.postin...
- riprowan 10y ago
  Well I never. TIL. I've always installed and started it because I assumed it wasn't already running. Thanks!