Re: [SLUG] Sendmail security?

From: Matthew Moen (matt@mattmoen.com)
Date: Mon Apr 08 2002 - 17:43:45 EDT


> Postfix is arguably more secure, but it has a much smaller user base.
> I've used it, and it does work, but it simply never gave me the warm
> fuzzies (and I'm a hardcore old school sendmail kind of guy).

I've been using Postfix at for a client with 125+ users with great results
for about two years. panix.com, one of the oldest ISP's in the
world (more than 4000 shell users, countless more dialup and DSL users)
has been running it for a few years. Debian's mailing list server
uses it as well, along with countless other heavily loaded servers.
In short, it's rock solid.

In the security department, the author is quite paranoid. Rather
than going for the large all-knowing all-powerful single sendmail
executable postfix consists of several smaller executable's following
the Murray Hill Unix philosophy. (Small, well written programs, that
do simple, predictable things.) Mail coming in from the network talks
to a daemon with virtually no privileges, which passes stuff onto
"cleanup" daemon through a well-defined interface.
For further digression, take a look at the documentation:
http://www.postfix.org/docs.html

IMHO, if you're not running postfix internally, (and there are still a
few reasons not to, more on that below) you should at least use
it to protect sendmail from the nasty, vicious, network that is the
internet. It's pretty easy to set it up to forward everything on toward
another host. At least with Debian, it's very easy to set up...I'm not sure
about Redhat and variants. After installation, all that's needed is
a stroll with your favorite editor through the well documented
main.cf file, and a re-start of the daemon.

Did I mention on how well it handles heavy loads?

As for the virtues of sendmail, I believe there are address re-writing
tricks that Postfix can't do, and perhaps a few other things, but not all
that much. (Did I mention that postfix will let you do address mangling
with perl-style regexes!) Some larger sites might prefer some of
sendmail's quirks.

Another downside is that admins using Postfix might gain more weight
on account of not having to lug the bat-book around with them. ;-)

The only trouble I've ever had was with some minor trouble with my migration
at the 125+ user site. If you want to use mail aliases for mailing lists
Postfix does behave slightly differently than does sendmail. That
said, you really should be using Smartlist, majordomo or equilivent
for this.

Also, there are people out there who like qmail...And then there are the
folks who don't:
http://www.linuxmafia.com/~rick/faq/#djb

-- 
Matthew Moen



This archive was generated by hypermail 2.1.3 : Fri Aug 01 2014 - 19:56:32 EDT