4 ms·

one thing to definitely watch in OpenBSD is their new mail daemon, OpenSMTPD. It has a configuration syntax that is about 100x easier to setup and understand th

one thing to definitely watch in OpenBSD is their new mail daemon, OpenSMTPD. It has a configuration syntax that is about 100x easier to setup and understand than anything else out there, although they are still working to get it up to par feature wise. The code is also written with a heavy focus on security, correctness, and simplicity. Its definitely something to watch for all those hackers that want an alternative to gmail that isnt the insanity of a postfix/qmail setup. listen on em0 map aliases { source db "/etc/mail/aliases.db" } accept for local deliver to mbox accept for all relay Thats all you need for a working mail setup :) http://opensmtpd.org/ http://opensmtpd.org/

emillon 14y ago
> accept for all relay If this defines an open mail relay, please think twice because your machine may be used to send spam and get blacklisted.
- poolpOrg 14y ago
  nope, by default rules have "safe" implicit behavior: accept for all relay -> accept from local for all relay to create an open relay one has to explicitly: accept from all for all relay
KonradKlause 14y ago
Let's hope that it does not end like: http://www.opencvs.org http://www.opencvs.org
- peteretep 14y ago
  How did that end?
  - KonradKlause 14y ago
    "OpenCVS is to be released soon." since 2004
- 16s 14y ago
  They sometimes take on too much. They are very ambitious.
- protomyth 14y ago
  The folks working on it are making pretty good progress and took in some donation money early in its existence.
craigmoore 14y ago
I'll be giving this ago. Last time I set up a mail server I came pretty close to tears.
mrothe 14y ago
I don't think configuring e.g. postfix is that difficult: # # /etc/postfix/main.cf # # disable diff service biff = no # TLS parameters smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key smtpd_use_tls=yes smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache # disable warnings about NIS on mail delivery (default adds nis:mail.aliases) alias_maps = hash:/etc/aliases # do not grant special privileges to hosts except localhost mynetworks_style = host #set the mailbox size to limit to `unlimited' mailbox_size_limit = 0 myhostname = fulla.mrothe.de mydestination = $myhostname, localhost.$mydomain, localhost, mrothe.de mailbox_command = procmail -a "$EXTENSION" And on a backup MX instead of adding your domains to `mydestination` you just set: [...] myhostname = blei.mrothe.de #don't touch mydestination, which defaults to "$myhostname, localhost.$mydomain, localhost" # accept mail for these domains to be relayed relay_domains = $mydestination, mrothe.de
- JoachimSchipper 14y ago
  Two nitpicks: you don't need to set myhostname; many mailservers will think you less spammy if your hostname is mail.$mydomain.
  - mrothe 14y ago
    Thank you, but I set it, because myhostname is "fulla.localdomain" if I don't set it. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=214741 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=214741
    - JoachimSchipper 14y ago
      Which goes to show that you can still get it wrong after verifying locally (hostname typically does return a FQDN on OpenBSD)...
- poolpOrg 14y ago
  I agree it's not that difficult and prior to OpenSMTPD I've been a user of Postfix for 10 years, so I know the software is good and far easier to setup than the big S. ;-) However, here's a better example of a configuration that is simple with OpenSMTPD and slightly more complex on others: listen on em0 tls cert "mycert" enable auth map "vmap" { source plain "/etc/mail/virtual" } accept from all for virtual "vmap" deliver to maildir accept for all relay This will have the daemon listen on all addresses of interface em0 (both IPv4 and IPv6), it will enable STARTTLS using certificate "mycert" and activating authentication for system users (no pop-before-smtp, no cyrus-sasl and whatnot). It will accept mail from anywhere for all virtual domains in the mapping "vmap" and deliver to maildirs, while relaying mails from local users to the world. That is a fairly basic setup that quite a lot of people use, yet the effort required to achieve similar setup on other software can range from just "slightly irritating" to "extremely painful". Here it's done with 4 lines that are almost readable by someone who has never used the software. Some other features like relaying through remote MX that require auth; tagging; forcing secure channels; allow more complex setups while retaining the same simple syntax. /!\ warning: as a major contributor to OpenSMTPD, I'm biased ;-) /!\
Duff 14y ago
People still use qmail? I thought the more rational sendmail alternatives had gotten alot more traction?

emillon 14y ago

> accept for all relay If this defines an open mail relay, please think twice because your machine may be used to send spam and get blacklisted.

poolpOrg 14y ago
nope, by default rules have "safe" implicit behavior: accept for all relay -> accept from local for all relay to create an open relay one has to explicitly: accept from all for all relay

KonradKlause 14y ago

Let's hope that it does not end like: http://www.opencvs.org http://www.opencvs.org

peteretep 14y ago
How did that end?
- KonradKlause 14y ago
  "OpenCVS is to be released soon." since 2004
16s 14y ago
They sometimes take on too much. They are very ambitious.
protomyth 14y ago
The folks working on it are making pretty good progress and took in some donation money early in its existence.

craigmoore 14y ago

I'll be giving this ago. Last time I set up a mail server I came pretty close to tears.

mrothe 14y ago

I don't think configuring e.g. postfix is that difficult: # # /etc/postfix/main.cf # # disable diff service biff = no # TLS parameters smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key smtpd_use_tls=yes smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache # disable warnings about NIS on mail delivery (default adds nis:mail.aliases) alias_maps = hash:/etc/aliases # do not grant special privileges to hosts except localhost mynetworks_style = host #set the mailbox size to limit to `unlimited' mailbox_size_limit = 0 myhostname = fulla.mrothe.de mydestination = $myhostname, localhost.$mydomain, localhost, mrothe.de mailbox_command = procmail -a "$EXTENSION" And on a backup MX instead of adding your domains to `mydestination` you just set: [...] myhostname = blei.mrothe.de #don't touch mydestination, which defaults to "$myhostname, localhost.$mydomain, localhost" # accept mail for these domains to be relayed relay_domains = $mydestination, mrothe.de

JoachimSchipper 14y ago
Two nitpicks: you don't need to set myhostname; many mailservers will think you less spammy if your hostname is mail.$mydomain.
- mrothe 14y ago
  Thank you, but I set it, because myhostname is "fulla.localdomain" if I don't set it. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=214741 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=214741
  - JoachimSchipper 14y ago
    Which goes to show that you can still get it wrong after verifying locally (hostname typically does return a FQDN on OpenBSD)...
poolpOrg 14y ago
I agree it's not that difficult and prior to OpenSMTPD I've been a user of Postfix for 10 years, so I know the software is good and far easier to setup than the big S. ;-) However, here's a better example of a configuration that is simple with OpenSMTPD and slightly more complex on others: listen on em0 tls cert "mycert" enable auth map "vmap" { source plain "/etc/mail/virtual" } accept from all for virtual "vmap" deliver to maildir accept for all relay This will have the daemon listen on all addresses of interface em0 (both IPv4 and IPv6), it will enable STARTTLS using certificate "mycert" and activating authentication for system users (no pop-before-smtp, no cyrus-sasl and whatnot). It will accept mail from anywhere for all virtual domains in the mapping "vmap" and deliver to maildirs, while relaying mails from local users to the world. That is a fairly basic setup that quite a lot of people use, yet the effort required to achieve similar setup on other software can range from just "slightly irritating" to "extremely painful". Here it's done with 4 lines that are almost readable by someone who has never used the software. Some other features like relaying through remote MX that require auth; tagging; forcing secure channels; allow more complex setups while retaining the same simple syntax. /!\ warning: as a major contributor to OpenSMTPD, I'm biased ;-) /!\

Duff 14y ago

People still use qmail? I thought the more rational sendmail alternatives had gotten alot more traction?