3 ms·

Seriously? If other email providers are blocking you, smarthost through an email provider. If you're getting brute forced, learn how to set up and run blockli

Seriously? If other email providers are blocking you, smarthost through an email provider. If you're getting brute forced, learn how to set up and run blocklistd or fail2ban. Not getting 100 meg attachments is an issue that other email providers have, not people who run their own servers. If your server doesn't have any free disk space, that's on you. If it does, then set confMAX_MESSAGE_SIZE to whatever you want. If by "standard X" you're talking about SPF or DKIM, there are lots of tutorials. If your email software is vulnerable because of issues with your distro, you're doing things wrong. The point is if you can't, don't. If you don't want to think about issues like these, then you shouldn't be running servers, anyway, so you're definitely not the target audience. If you can, then these things aren't issues.

yokoprime 5y ago
I get it, if you're genuinely interested in hosting email, it's fairly easy... but those who aren't will lose interest after a couple of major setbacks and that's that. E-mail is, whether you like it or not, pretty critical, so it's not the best place for hobbyists to start.
shmoogy 5y ago
Isn't the big/only issue regarding getting into inbox? I would imagine if warming / domain warming would be ridiculously difficult in modern times.
rasengan 5y ago
That's true, but to do it securely isn't as simple as one would like to believe. Setting up "DKIM/SPF/etc." simply provides auth/verify security on send, but I'm more specifically referring to the receiver side security. If you're really properly securing your mail server, it would likely be isolated behind a firewall and only have a LAN ip of some kind and utilize UUCP for transport to another LAN machine that does not have WAN access, and then, only allow POP3/IMAP access to machines in the LAN or connected to the LAN via VPN tunnel. Finally, you would want to setup a backup system of some kind for this machine to periodically backup via rsync when the inotify/fswatch file modification triggers. Next, you'd have a separate SMTP machine. For things like critical deliverability, you can't rely on SMTP to 'retry' albeit it's how they are supposed to act, so it would make sense to have multiple SMTP machines across multiple different backbones in different physical locations with backup power and the like with different MX priorities set. The initial configuration and running a mail server are incredibly easy. It's running it securely that increases the difficulty on order of magnitude (because you essentially have to setup a proper security protocol across multiple machines (a network) - defense in depth). That said, it's easily doable if you're already running complex infrastructure. Hopefully, you're getting paid for your time and costs for doing so. If not, then I hope you need to rely upon the protection of needing a home-invasion warrant vs a simple-subpoena since a machine at your home can't really just be 'subpoenad' while a machine at some datacenter business can. This of course assumes you're even running the machine at home because if you're doing all this on some VM the value of doing so diminishes ever so quickly. EDIT: Just to be clear, you can't simply rely on fail2ban and some other on-machine script / snort / daemon / kernel feature to protect you. There are bugs in software/systems and 0days are very real (as well as the market places for them).
TedDoesntTalk 5y ago
> If other email providers are blocking you, smarthost through an email provider. Can someone please explain what this means?
- xanaxagoras 5y ago
  Your SMTP server uses an authenticated relay through (let's say) sendgrid that you pay for. Sendgrid delivers your mail using their reputation.
- e12e 5y ago
  It means no longer hosting your own server for sending email, but rather use eg smtp.gmail.com to send outgoing mail. It would mean allowing Gmail.com to send email from your domain via SPF, thus allowing all with a Gmail account to spoof your from domain/header. Ed: as sibling correctly notes, "smart hosting" specifically referes to setting your smtp server to relay via another (eg: Gmail) - eg exim or postfix allow setting a "smart host" so that rather than looking up the receiving smtp server, all mail is shunted to the smarthost to figure out. Added: you might get good delivery to Gmail using Gmail smarthost (requiring you to have a Gmail account) - but you might need to use outlook.com as a smarthost to get good delivery to o365 accounts... Etc.
  - easrng 5y ago
    Google requires that you verify ownership of a domain before you send emails as it with Gmail.
    - e12e 5y ago
      Ah, indeed it does.
      - DarylZero 5y ago
        They also require a paid account for this now. Though, I have one grandfathered in from like 15 years ago.
- 5y ago
cookiengineer 5y ago
> fail2ban As a sidenote: The two RCEs this year were enough for me to judge the quality of this software. If a whois entry of the attacker's IP/domain can RCE your intrusion blocking software, I mean...really?
john2010 5y ago
> If you're getting brute forced, learn how to set up and run blocklistd or fail2ban. What about updating OS/packages/CVE when on holiday? Note that many CVEs are usually sent only to top-tier providers.

yokoprime 5y ago

I get it, if you're genuinely interested in hosting email, it's fairly easy... but those who aren't will lose interest after a couple of major setbacks and that's that. E-mail is, whether you like it or not, pretty critical, so it's not the best place for hobbyists to start.

shmoogy 5y ago

Isn't the big/only issue regarding getting into inbox? I would imagine if warming / domain warming would be ridiculously difficult in modern times.

rasengan 5y ago

That's true, but to do it securely isn't as simple as one would like to believe. Setting up "DKIM/SPF/etc." simply provides auth/verify security on send, but I'm more specifically referring to the receiver side security. If you're really properly securing your mail server, it would likely be isolated behind a firewall and only have a LAN ip of some kind and utilize UUCP for transport to another LAN machine that does not have WAN access, and then, only allow POP3/IMAP access to machines in the LAN or connected to the LAN via VPN tunnel. Finally, you would want to setup a backup system of some kind for this machine to periodically backup via rsync when the inotify/fswatch file modification triggers. Next, you'd have a separate SMTP machine. For things like critical deliverability, you can't rely on SMTP to 'retry' albeit it's how they are supposed to act, so it would make sense to have multiple SMTP machines across multiple different backbones in different physical locations with backup power and the like with different MX priorities set. The initial configuration and running a mail server are incredibly easy. It's running it securely that increases the difficulty on order of magnitude (because you essentially have to setup a proper security protocol across multiple machines (a network) - defense in depth). That said, it's easily doable if you're already running complex infrastructure. Hopefully, you're getting paid for your time and costs for doing so. If not, then I hope you need to rely upon the protection of needing a home-invasion warrant vs a simple-subpoena since a machine at your home can't really just be 'subpoenad' while a machine at some datacenter business can. This of course assumes you're even running the machine at home because if you're doing all this on some VM the value of doing so diminishes ever so quickly. EDIT: Just to be clear, you can't simply rely on fail2ban and some other on-machine script / snort / daemon / kernel feature to protect you. There are bugs in software/systems and 0days are very real (as well as the market places for them).

TedDoesntTalk 5y ago

> If other email providers are blocking you, smarthost through an email provider. Can someone please explain what this means?

xanaxagoras 5y ago
Your SMTP server uses an authenticated relay through (let's say) sendgrid that you pay for. Sendgrid delivers your mail using their reputation.
e12e 5y ago
It means no longer hosting your own server for sending email, but rather use eg smtp.gmail.com to send outgoing mail. It would mean allowing Gmail.com to send email from your domain via SPF, thus allowing all with a Gmail account to spoof your from domain/header. Ed: as sibling correctly notes, "smart hosting" specifically referes to setting your smtp server to relay via another (eg: Gmail) - eg exim or postfix allow setting a "smart host" so that rather than looking up the receiving smtp server, all mail is shunted to the smarthost to figure out. Added: you might get good delivery to Gmail using Gmail smarthost (requiring you to have a Gmail account) - but you might need to use outlook.com as a smarthost to get good delivery to o365 accounts... Etc.
- easrng 5y ago
  Google requires that you verify ownership of a domain before you send emails as it with Gmail.
  - e12e 5y ago
    Ah, indeed it does.
    - DarylZero 5y ago
      They also require a paid account for this now. Though, I have one grandfathered in from like 15 years ago.
5y ago

cookiengineer 5y ago

> fail2ban As a sidenote: The two RCEs this year were enough for me to judge the quality of this software. If a whois entry of the attacker's IP/domain can RCE your intrusion blocking software, I mean...really?

john2010 5y ago

> If you're getting brute forced, learn how to set up and run blocklistd or fail2ban. What about updating OS/packages/CVE when on holiday? Note that many CVEs are usually sent only to top-tier providers.