6 ms·

OpenSMTPD

chasil 4y ago
This had a showstopper bug a few years ago that could completely compromise a host. I don't usually need this, so I disable it. https://blog.qualys.com/vulnerabilities-threat-research/2020/01/29/openbsd-opensmtpd-remote-code-execution-vulnerability-cve-2020-7247 https://blog.qualys.com/vulnerabilities-threat-research/2020...
- paulnpace 4y ago
  The problem I find with this line of reasoning is at the end of the evaluation I've disconnected from all networks and powered down the devices after uninstalling all of the operating systems.
- ori_b 4y ago
  The postmortem is worth reading: https://poolp.org/posts/2020-01-30/opensmtpd-advisory-dissected/ https://poolp.org/posts/2020-01-30/opensmtpd-advisory-dissec... It's worth reading through the systemic mitigations that would make a clone of this bug impossible in the future.
  - chasil 4y ago
    Interesting that the problem was introduced in a major architecture change to external MDAs, invoked with system(), and was specific to mbox format that requires elevated privilege. I think that I will keep this disabled.
- asveikau 4y ago
  They actually had a few really bad code execution bugs in a tight space of time a few years ago when someone was auditing it. It's a good idea to subscribe to announce@openbsd.org if you run this daemon to get notified of issues. I was running it out of ports on FreeBSD at that time, and wound up patching from source because i didn't want to wait for the ports tree to update. I still see attempts to exploit these bugs in my logs. Even though they've been patched for years. That said, it's good that these were exposed and fixed, as opposed to not found. It's a relatively new daemon compared to other mail servers and it was still ironing things out.
jacob019 4y ago
How does it compare to postfix?
- traceroute66 4y ago
  > How does it compare to postfix? I haven't done a detailed comparison, but going how the OpenBSD guys go with other re-implementations (e.g. LibreSSL vs OpenSSL), I'm going to guess that it will have a reduced feature-set and capabilities. I've nothing against the OpenBSD guys, but sometimes its a case of "right tool for the job". OpenBSD is great for firewalls and routers. Of course OpenSSH is without competitor, its just awesome. But (some of) the rest of the OpenBSD toolset I'm not too sure ... for example Chrony is lightyears ahead of OpenNTPD etc. Postfix is an excellent MTA. Written from a security-first mentality. Its widely deployed, and hence battle tested. As a result of its wide deployment its pretty much a case of "everyone knows how it works", the Postfix mailing list is excellent in terms of getting support. TL;DR personally I see no reason to replace Postfix with anything, be it OpenSMTPD or anything else.
  - chasil 4y ago
    I would guess that the IBM/Eclipse license was a major problem from a BSD perspective. "OpenSMTPD is a fairly complete SMTP implementation."
    - traceroute66 4y ago
      Some might say "fairly complete" is in the eye of the beholder. ;-) Technically OpenNTPD is a "fairly complete implementation" too, but its a waste of time compared to Chrony.
      - Beltalowda 4y ago
        It's simple, works, synchronizes my clock, and doesn't have a manpage thousands of lines long. It's also explicitly intended not to solve every NTP use case but rather just the common "I want my laptop's clock to be roughly accurate" use case.
sylware 4y ago
self-hosted: wrote my own at the right scale.
gorgoiler 4y ago
Native SRS is a nice thing to have, especially if you are forwarding to Gmail. A shame that DKIM wasn’t built in too, but there’s a filter/plug-in architecture and you can add a third party filter to do DKIM for you. Sometimes a commitment to supporting a plug-in architecture can be a little overzealous. Yes, it’s a nice general purpose puzzle to solve if you are the engineer writing the code. When DKIM is such a critical part of email in 2022, I wouldn’t mind if it were treated as a special case and supported by default.
- thrwawway 4y ago
  [dead]
  - swixmix 4y ago
    Or try https://openports.se/mail/opensmtpd-filters/dkimsign https://openports.se/mail/opensmtpd-filters/dkimsign And it has support for ed25519.
- daneel_w 4y ago
  I use DKIMproxy. It's "abandonware" so there won't ever be any ed25519 support, but it gets the job done nevertheless.
hardwaresofton 4y ago
This project looks cool but: https://maddy.email/ https://maddy.email/ https://blitiri.com.ar/p/chasquid/ https://blitiri.com.ar/p/chasquid/
- medo-bear 4y ago
  but what?
  - hardwaresofton 4y ago
    Ah sorry —- but these are easier to run, come with imap, automatic dkim and other awesome features
SahAssar 4y ago
I was hoping for this to be openttd but for routing email.

This had a showstopper bug a few years ago that could completely compromise a host. I don't usually need this, so I disable it. https://blog.qualys.com/vulnerabilities-threat-research/2020/01/29/openbsd-opensmtpd-remote-code-execution-vulnerability-cve-2020-7247 https://blog.qualys.com/vulnerabilities-threat-research/2020...

paulnpace 4y ago
The problem I find with this line of reasoning is at the end of the evaluation I've disconnected from all networks and powered down the devices after uninstalling all of the operating systems.
ori_b 4y ago
The postmortem is worth reading: https://poolp.org/posts/2020-01-30/opensmtpd-advisory-dissected/ https://poolp.org/posts/2020-01-30/opensmtpd-advisory-dissec... It's worth reading through the systemic mitigations that would make a clone of this bug impossible in the future.
- chasil 4y ago
  Interesting that the problem was introduced in a major architecture change to external MDAs, invoked with system(), and was specific to mbox format that requires elevated privilege. I think that I will keep this disabled.
asveikau 4y ago
They actually had a few really bad code execution bugs in a tight space of time a few years ago when someone was auditing it. It's a good idea to subscribe to announce@openbsd.org if you run this daemon to get notified of issues. I was running it out of ports on FreeBSD at that time, and wound up patching from source because i didn't want to wait for the ports tree to update. I still see attempts to exploit these bugs in my logs. Even though they've been patched for years. That said, it's good that these were exposed and fixed, as opposed to not found. It's a relatively new daemon compared to other mail servers and it was still ironing things out.

jacob019 4y ago

How does it compare to postfix?

traceroute66 4y ago
> How does it compare to postfix? I haven't done a detailed comparison, but going how the OpenBSD guys go with other re-implementations (e.g. LibreSSL vs OpenSSL), I'm going to guess that it will have a reduced feature-set and capabilities. I've nothing against the OpenBSD guys, but sometimes its a case of "right tool for the job". OpenBSD is great for firewalls and routers. Of course OpenSSH is without competitor, its just awesome. But (some of) the rest of the OpenBSD toolset I'm not too sure ... for example Chrony is lightyears ahead of OpenNTPD etc. Postfix is an excellent MTA. Written from a security-first mentality. Its widely deployed, and hence battle tested. As a result of its wide deployment its pretty much a case of "everyone knows how it works", the Postfix mailing list is excellent in terms of getting support. TL;DR personally I see no reason to replace Postfix with anything, be it OpenSMTPD or anything else.
- chasil 4y ago
  I would guess that the IBM/Eclipse license was a major problem from a BSD perspective. "OpenSMTPD is a fairly complete SMTP implementation."
  - traceroute66 4y ago
    Some might say "fairly complete" is in the eye of the beholder. ;-) Technically OpenNTPD is a "fairly complete implementation" too, but its a waste of time compared to Chrony.
    - Beltalowda 4y ago
      It's simple, works, synchronizes my clock, and doesn't have a manpage thousands of lines long. It's also explicitly intended not to solve every NTP use case but rather just the common "I want my laptop's clock to be roughly accurate" use case.

sylware 4y ago

self-hosted: wrote my own at the right scale.

gorgoiler 4y ago

Native SRS is a nice thing to have, especially if you are forwarding to Gmail. A shame that DKIM wasn’t built in too, but there’s a filter/plug-in architecture and you can add a third party filter to do DKIM for you. Sometimes a commitment to supporting a plug-in architecture can be a little overzealous. Yes, it’s a nice general purpose puzzle to solve if you are the engineer writing the code. When DKIM is such a critical part of email in 2022, I wouldn’t mind if it were treated as a special case and supported by default.

thrwawway 4y ago
[dead]
- swixmix 4y ago
  Or try https://openports.se/mail/opensmtpd-filters/dkimsign https://openports.se/mail/opensmtpd-filters/dkimsign And it has support for ed25519.
daneel_w 4y ago
I use DKIMproxy. It's "abandonware" so there won't ever be any ed25519 support, but it gets the job done nevertheless.

hardwaresofton 4y ago

This project looks cool but: https://maddy.email/ https://maddy.email/ https://blitiri.com.ar/p/chasquid/ https://blitiri.com.ar/p/chasquid/

medo-bear 4y ago
but what?
- hardwaresofton 4y ago
  Ah sorry —- but these are easier to run, come with imap, automatic dkim and other awesome features

SahAssar 4y ago

I was hoping for this to be openttd but for routing email.