12 ms·
Show HN: OpenBSD Email Service – A free-email alternative
- dozzie 9y agoSo basically, step 1: install SMTP and IMAP servers, step 2: configure them to run your domain, step 3: configure your DNS?
- h0r14 9y agoYes, and for junk I chose rspamd for Bayes classification, very effective so far.
- Tepix 9y agoIf you don't want to do everything by hand, check out https://github.com/sovereign/sovereign/ https://github.com/sovereign/sovereign/
- Tharkun 9y agoStep 4: wonder why the hell people aren't replying to your mails. Step 5: realize you've been blackholed by gmail and hotmail with no bounces and no explanation. Step 6: frustration. Step 7: tell people to add your e-mail address to their address book (wtf) and watch as things magically work for a while. Step 8: repeat.
- semanticist 9y agoMy mail server routes via Amazon's SES, which provides an SMTP smarthost my instance of postfix can relay mail to. You authenticate each sending domain using DNS, and it even supports DKIM signing. Until I did this, my deliverability, especially to GMail, was awful.
- _eht 9y agoThat's a smart way to work around a frustrating problem. It's a bummer there are so many loopholes to jump through.
- Tharkun 9y agoAssuming you're running your own mailserver because you like the idea of a decentralized web; isn't it kind of odd to then rely on Amazon?
- semanticist 9y agoMaybe, but in my case it would not be a valid assumption.
- amdavidson 9y agoHave you seen any issues with the envelope from not matching the the email address? ezmlm, for example, will not let you subscribe/unsubscribe
- semanticist 9y agoI've not run into any problems myself - even if I did, I think I'd rather be able to reliably email people with GMail accounts!
- h0r14 9y agoI think Step 7 is a good idea. Initially, I asked some contacts to send me an email from Gmail and Protonmail, to which I replied. From then on, my emails work fine with them (negative spam score).
- a012 9y agoThe hardest part to me is to get an IP address that's clean so your outgoing emails won't be marked as junks. Also, then you'll have to get help from ISP to update PTR records for your IP address, it's not worth.
- h0r14 9y agoI guess I was lucky because I haven't encountered a "dirty" IP yet, but I only tested 6 VPS providers so far. PTR records are updated from the VPS provider web interface, it takes a few seconds to activate.
- Tepix 9y agoThe last time i rented a new server I checked the IP in the various blacklists. There was one blacklist that had listed the entire subnet the server was in. I asked them to whitelist my IP address in that subnet which they did. It took only a few minutes to write an email.
- dozzie 9y agoIt took quite a lot of knowledge what blacklists are out there and time to check them all. It's hardly "just a few minutes to write an e-mail".
- h0r14 9y agoI used http://multirbl.valli.org/ http://multirbl.valli.org/ but who knows how many are out there, not including private lists.
- reaperducer 9y agoIt's the private lists that will get you. What do you do if Google has your IP address on an internal blacklist? Or your health insurance company? Or some random Barracuda-style e-mail filtering appliance? Nothing. You're screwed.
- kennu 9y agoI used to do this for a long time (with Ubuntu), but over the years there was always something popping up that required fixing, updating or other attention. Eventually I decided to let someone else worry about maintaining the mail services and spam filters and put my own focus on other things.
- h0r14 9y agoI'm in your reverse situation, a long time free-email user. Given the latest news, I decided to self-host my email address and not have a 3rd party filter my Inbox. I'm surprised how easy it is, and having fun with sieve scripts :)
- deusex_ 9y agoIt's fun until it becomes a chore. And until you realize you're always one step behind people trying to break through with spam or attacks.
- mseebach 9y agoLong time self-hosted email user, then long time Gmail user. Playing with your own server is fun, and I really enjoyed it. But things do go wrong, and they go wrong at the least convenient times. I've lost a whole day of a holiday trying to find a place with internet so I could log in and fix some small thing that had broken (I also hosted for a handful of other people, not all of whom were on holiday). And I've had that sinking feeling when you realise that that important email you've been waiting for has been sitting for a day and a half behind a crashed/misconfigured service somewhere. Good luck with your endeavour, it is if nothing else a learning experience. But it's important to keep in mind that if email is a critical tool for you (it is for many people, ymmv), toying with it may not be the best idea.
- hueving 9y agoHow did the service suddenly become misconfigured?
- Tepix 9y agoLowEndTalk.com will help you find a super cheap VPS. However I would advise using dedicated hardware for the server instead for improved privacy. There are two possible routes: 1) Rent a cheap dedicated server such as the Kimsufi line by OVH or the Personal line by Online.net. These cost below 10€ a month. 2) Run the email service on your box at home and use the cheapest VPS you can find just to tunnel a non-dialup IP address to that box using OpenVPN. The cheap VPS usually costs less than $10 per year.
- h0r14 9y agoWhen renting a dedicated box, a VNC-like interface is required to enter disk encryption password, which could be intercepted by the host. Moreover, this has to be done on each restart. I look at dedicated box more as an upgrade from VPS. For privacy, I think user encrypted email messages provide the best option. At home self-hosting through VPN is a good idea. It would involve maintaining hardware, which I traded for low cost VPS. With a replica backup MX, I am not married to any hosting provider, and can hop without downtime.
- nickpsecurity 9y ago" a VNC-like interface is required to enter disk encryption password, which could be intercepted by the host. " There's a rule in security that anyone in physical possession of your device should be assumed to have access to it. The host has the server whether physical or virtual. You're not safe from them. Trusting them is the tradeoff made for the cheap, hosted server. " I look at dedicated box more as an upgrade from VPS." Multiple VPS's share a physical box. A malicious VPS can look for secrets in another VPS using side channels. This isn't possible on bare metal: they have to compromise an app or get a shell first. The next concern would be endpoint security. OpenBSD covers that well. Then, there's host or peripheral firmware which is almost always a risk if a 3rd party is hosting things. Your attack surface does go down, though, when you're not sharing a box with an attacker. There's also the performance benefits.
- h0r14 9y agoPrivacy from host is not possible, and you make a very good point about hardware access. Virtual machine are secured by the shared host. I don't really expect top security from this end. A replica backup MX enables me to safely change hosts, if they behave badly. OpenBSD defaults are what I base my endpoint security on, and keeping this updated is super easy.
- webaholic 9y agoThere is also mail-in-a-box: https://github.com/mail-in-a-box/mailinabox https://github.com/mail-in-a-box/mailinabox
- splitrocket 9y agoThis. The hard part of hosting your own mail is emphatically dns and deliverability. Mail-in-a-box does all of the dns magic to ensure folks get your email. The rest is gravy.
- dqv 9y agoMIAB is a great piece of software. I've been using it for a little longer than two years and it's a pleasure to use. Updating is easy and I've had no problems with it since the first install. It is rock-solid and reliable.
- waz0wski 9y agoAnd also http://mailcow.email http://mailcow.email if you want something to quickly spin up in Docker with a bit more configuration available
- scruffyherder 9y agoAnd for 12.50 I get exchange+office all hosted and I don't do a thing. Thanks best part is that clients get my emails, and I'm not wasting days trying to fight the brick wall that is Google, Yahoo, Apple, Microsoft,and every other isp that blocks by default.
- Infernal 9y agoI don't really think the downvotes are warranted on this one - given that the post title calls out the expense, I think a discussion on what you gain (and/or give up) for an additional $10/mo is well within bounds.
- throwaway2048 9y agothe point is being in control of your own software stack, nobody cares that you can use some hosted solution easily.
- perlgod 9y agoI'm always amazed at the negative comments on HN when the topic of self-hosting your email comes up - I saw many of the same replies when my mail server guide [1] got linked here a few weeks ago. Most people suggest to give all your email to some corporation. If people want to create their own mail service, more power to them - this is supposed to be HACKER news! [1] https://news.ycombinator.com/item?id=16238937 https://news.ycombinator.com/item?id=16238937
- peterwwillis 9y agoIf you have a lot of time to kill and don't need reliable email, self-hosting is fine. But it's a bit like building your own car. Fun hobby: not reliable.
- perlgod 9y agoSpeak for yourself - I've hosted my own email for over half a decade and never had any issues whatsoever. Set it up once, keep paying your DNS/VPS provider, and update your box every now and then, and you won't have any issues. Of course, it's more work than having Google or Fastmail do it, but so what? I'm sure a significant majority of HN readers already have a VPS and domain name of some kind. Setting aside a few hours to set up a mail server on it isn't the indentured servitude many of y'all make it out to be.
- Milner08 9y agoThe only reason a self-built car won't be reliable is because you don't know what you are doing. The same goes for email. If you take the time to understand what you are doing it is perfectly fine.
- jlg23 9y agoWorks reliably for me since 1997.
- HighPlainsDrftr 9y agoSame here. I used to host out of my house. Now its on a server in a data center somewhere. Some of it is written in perl - which I have no problem reading (spamassassin).
- hapless 9y agoI wouldn't entrust my email to an operating system that lacks mandatory access control. OpenBSD is a fascinating project, but it is _decades_ behind the state of the art in security.
- nbsd4lyfe 9y agoWhy do you need ACLs to run a few services on their own server?
- hapless 9y agoSo that a root compromise in one service does not escalate to the entire server. As a concrete example: my personal mail server (on a modern operating system) has its SMTP handling in a separate process from mailbox serving. If the SMTP process is compromised, and the attacker reaches uid=0, it doesn't matter -- no data from the mailboxes can be exfiltrated. Only SMTP is broken, because mandatory access control prevents the SMTP "root" from doing anything the SMTP daemon would not ordinarily be permitted to do. The SMTP daemon is not empowered to read mailboxes, even if its uid is 0.
- nbsd4lyfe 9y agoI think in this hypothetical scenario the uid 0 attacker can create its own node for /dev/rwd0 and use raw disk accesses to get around filesystem limits.
- busterarm 9y agoIt's also hypothetical in that there's no known OpenSMTPd exploit that will allow you to get root, and barring a single CVE its record is pretty damn good. https://www.cvedetails.com/cve/CVE-2015-7687/ https://www.cvedetails.com/cve/CVE-2015-7687/ Then you compare its record to Sendmail...
- hapless 9y agoIt's a matter of defense in depth. OpenBSD robs you of one of the layers that is standard on every other operating system in the world: Linux, FreeBSD, Solaris, even Windows.
- giancarlostoro 9y agoI've always wanted to host my own mail but every time I look it up they always recommend like 2GB of ram. I've thought about whether one in D / Rust would be easier to host, but are there any decent libs out there or someone know what mail setup I could have on a simple $5 a month digitalocean VPS?
- elchief 9y agolowendbox.com lists plenty of cheap 2GB VPS
- emptybits 9y agoOP recommendation is minimum 512 MB RAM. Giving it 1 GB for headroom still lets you run on the AWS EC2 Free Tier (i.e. t2.micro instance). Would that work?
- Tepix 9y agoIf all you want is email (and not owncloud/nextcloud, your own webmail and some other services), 512 MB is plenty. If you can live without antivirus scanning of email you could get away with 256MB.
- INTPenis 9y agoThis is a nice writeup but my own personal modification of this model is to host an MDA at home where I've got plenty of space and it costs nothing. But then forward all mail to a proxy on a VPS that only does spam filtering and never saves mails on disk.