Postfix: A Secure and Easy-to-Use MTA

BSD Forums writes "On March 3rd, 2003, Internet Security Systems, in cooperation with the Department of Homeland Security, issued a warning regarding a hole found in Sendmail. The warning, echoed by CERT, warned system admins that any version lower than 8.12.8 was vulnerable to a serious root exploit. Sendmail has a long history of security holes, most of which have been thoroughly documented on security sites. While Sendmail runs half the mail servers in the world, there are smaller and easier-to-use mail transfer agents (MTAs). Network administrator Glenn Graham demonstrates how Postfix gives you most of the power with a fraction of the pain."

Comments

Or try qmail - unbroken since v1.03 (1998)

[KeithH]

Qmail is rock-solid. The best proof I can offer is that fact that no security flaw has been found since 1.03 was released in 1998. The man is a cryptographer and designed it for security.

There is also an enormous amount of support for the product available. Check out qmail.org and cr.yp.to/qmail.html

Re:Or try qmail - unbroken since v1.03 (1998)

[KeithH]

The DoS problem doesn't lie with qmail itself. That particular issue is best addressed through thresholding which is supported by ucspi-tcp's tcpserver (a replacement for inetd or xinetd).

If you are using ucspi-tcp already, then it is probably as simple as modifying the contents of /var/qmail/control/concurrencyincoming.

ucspi-tcp is not *required* but much of the qmail documentation assumes that you are using it. ucspi-tcp is also written by Dan Berstein (cr.yp.to/ucspi-tcp.html)

Use Qmail

[The Original Yama]

The Qmail author offers money for any holes found. So far he hasn't had to pay a cent.

I've switched one box to postfix..

[brentlaminack]

In general I found that virtual domains were a bit trickier to set up in postfix than in sendmail. Ordinary aliases were just as easy (read identical). My sites don't do enough volume to tell any difference in performance. The build/install process was probably a bit easier for postfix, i.e. didn't have to monkey around with M4. So as a sendmail admin of more years than I care to think about, postfix seems about as easy to administer as sendmail on a day-to-day basis.

Courier

[dusanv]

I have been using Courier for over two years now. No remote roots ever or problems of any kind (I am amazed!). It's open sourced and a full package (esmtp, pop, imap, webmail and a thousand other things). It gets my vote.

Re:Qmail just works

[InsaneGeek]

What you talking about Willis?

Sendmail & Postfix support virtual domains with no problems.

Postfix: http://www.postfix.org/faq.html#virtual_domains

Sendmail you can do it extremely easily with the virtualusertable (and I have for years and years)

Re:Stupid question...

[Basje]

No it doesn't. Debian has Exim as it's default MTA.

Re:Milters?

[Anonymous Coward]

content_filter is the equivalent of Milter for Postfix.

This is quite powerful. For example, you can have some regular expression (around header or body), that sent to the content_filter.

If you want to switch and have milter in mind, please consult the documentation about content_filter...

Re:Milters?

[cloudmaster]

Yes, postfix has mail filters. They're just not *called* "milters", and they're readable by people who don't have M4 parsers built into their reading glasses. Grumble grumble crummy sendmail configuration grumble.

In fact, most of the things you can do with sendmail through external additions are already in postfix. I'm pretty sure that Postfix is also overall "faster" than Sendmail, and it upgrades easier, and the config system is useful, etc...