5 ms·

>Running a email server is not hard. That is true. However, Running an email server properly /is/ hard. Security, maintenance, patching, journaling, litigatio

>Running a email server is not hard. That is true. However, Running an email server properly /is/ hard. Security, maintenance, patching, journaling, litigation holds, bouncing, ssl/tls, dkim, etc.. It's not exactly as simple as apt-get install teh-emails

belorn 14y ago
With a dedicated email-server, maintenance is as easy as configuring auto-updates and doing 2 commands once every 2-3 years. SSL/TLS require two additional step. You go to CAcert and add a very simple setting in postfix. If you uses webmail, you can just plug this in and use it there and forget about ssl/tls in postfix. DKIM is neither required or useful in most use cases. If your a bank with online accounts, then you should use it, but then you really MUST not outsource your email. They should have a sysadmin that can maintain a secure email infrastructure, in the same way that they got a professional installing a lock and alarm on the door. Get a consultant, ie a professional doing the installation if you don't have a sysadmin. As for journaling (default from the file system) and bouncing emails (defaulting to the user who sent the email), both are given free without any configuration. Litigation holds, ie concerns about how to comply with being legally forced to retain and hand over emails to the government. That is a bit out of scope for most companies and users, but if you are concerned about this see above statement about DKIM. So ye, for users and 99% of companies in the world it is indeed as simple as doing an apt-get install postfix and follow some simple tutorial in configuring grey listing, black listing subscription and adding a dns entry.
- obituary_latte 14y ago
  >So ye, for users and 99% of companies in the world it is indeed as simple as doing an apt-get install postfix and follow some simple tutorial in configuring grey listing, black listing subscription and adding a dns entry. Hopefully the tutorial mentions how to make sure relay is off. And it explains how to configure those magic auto-updates. And it covers amavisd and/or other anti-spam features. Also, I hope it at least mentions some basic security for the system. My point is and stands: it is not easy to properly run an email server. Simply running apt-get install postfix does not a properly configured email server make - no matter how easy it is. This fact makes hosted solutions, run by people dedicated to running that type of stuff, compelling. Especially for those "99%".
  - belorn 14y ago
    relay is dealt with during install in debian, and default is only allow relay from localhost (ipv4 and ipv6). in the case of roundcube, localhost is then perfectly fine. auto-update is as simple as apt-get install unattended-upgrades. greylisting is: apt-get install postgrey blacklisting is the only real "slightly" iffy area, because there aren't a obvious one guide to do it. It is however a very simple way of installing it once and not touching it again. (http://www.howtoforge.com/block_spam_at_mta_level_postfix http://www.howtoforge.com/block_spam_at_mta_level_postfix) looks to be a old guide, through there might be more current methods out there. As for system harderning... I have yet of hearing a single person having a stable debian installation getting hacked (if they update/autoupdate!). basic security for the system should be left to default, so long one do pick a decent password (or avoid installing ssh).

belorn 14y ago

With a dedicated email-server, maintenance is as easy as configuring auto-updates and doing 2 commands once every 2-3 years. SSL/TLS require two additional step. You go to CAcert and add a very simple setting in postfix. If you uses webmail, you can just plug this in and use it there and forget about ssl/tls in postfix. DKIM is neither required or useful in most use cases. If your a bank with online accounts, then you should use it, but then you really MUST not outsource your email. They should have a sysadmin that can maintain a secure email infrastructure, in the same way that they got a professional installing a lock and alarm on the door. Get a consultant, ie a professional doing the installation if you don't have a sysadmin. As for journaling (default from the file system) and bouncing emails (defaulting to the user who sent the email), both are given free without any configuration. Litigation holds, ie concerns about how to comply with being legally forced to retain and hand over emails to the government. That is a bit out of scope for most companies and users, but if you are concerned about this see above statement about DKIM. So ye, for users and 99% of companies in the world it is indeed as simple as doing an apt-get install postfix and follow some simple tutorial in configuring grey listing, black listing subscription and adding a dns entry.

obituary_latte 14y ago
>So ye, for users and 99% of companies in the world it is indeed as simple as doing an apt-get install postfix and follow some simple tutorial in configuring grey listing, black listing subscription and adding a dns entry. Hopefully the tutorial mentions how to make sure relay is off. And it explains how to configure those magic auto-updates. And it covers amavisd and/or other anti-spam features. Also, I hope it at least mentions some basic security for the system. My point is and stands: it is not easy to properly run an email server. Simply running apt-get install postfix does not a properly configured email server make - no matter how easy it is. This fact makes hosted solutions, run by people dedicated to running that type of stuff, compelling. Especially for those "99%".
- belorn 14y ago
  relay is dealt with during install in debian, and default is only allow relay from localhost (ipv4 and ipv6). in the case of roundcube, localhost is then perfectly fine. auto-update is as simple as apt-get install unattended-upgrades. greylisting is: apt-get install postgrey blacklisting is the only real "slightly" iffy area, because there aren't a obvious one guide to do it. It is however a very simple way of installing it once and not touching it again. (http://www.howtoforge.com/block_spam_at_mta_level_postfix http://www.howtoforge.com/block_spam_at_mta_level_postfix) looks to be a old guide, through there might be more current methods out there. As for system harderning... I have yet of hearing a single person having a stable debian installation getting hacked (if they update/autoupdate!). basic security for the system should be left to default, so long one do pick a decent password (or avoid installing ssh).