Slashdot Mirror
Postfix: A Secure and Easy-to-Use MTA
BSD Forums writes "On March 3rd, 2003, Internet Security Systems, in cooperation with the Department of Homeland Security, issued a warning regarding a hole found in Sendmail. The warning, echoed by CERT, warned system admins that any version lower than 8.12.8 was vulnerable to a serious root exploit. Sendmail has a long history of security holes, most of which have been thoroughly documented on security sites. While Sendmail runs half the mail servers in the world, there are smaller and easier-to-use mail transfer agents (MTAs). Network administrator Glenn Graham demonstrates how Postfix gives you most of the power with a fraction of the pain."
Of course now I get al the exim, qmail and postfix fanboys blasting at me, but sendmail works well. Works good enough for most. Heck, if sendmail were so insecure, why is OpenBSD still including it in it's base?
Don't get me wrong, postfix is a nice MTA. Yes, it is easier to set up depending on what you think is "easy", but still, it's a nice MTA, but no reason to not use Sendmail if you can help it.
I run a number of qmail instances as part of my job, and while it may remain unbroken from a compromise viewpoint, it can get suffer from denial-of-service problems by bogging down to the point that the mail queue has to be cleared and the daemon restarted for the thing to run
I've never had this problem with PostFix.
I stopped running SendMail a long time ago, so I can't comment on that package's behavior first-hand when presented with a crushing load.
Qmail uses some kind of weird uniq ways. Of course you may defend your lovely Qmail server.
:)...
But if I remember correct. You cannot feel difference between Qmail vs Postfix until, start to deliver 40.000 mails per day.
So use Postfix
[My english is better than most other people's Turkish, so please point out mistakes politely. Thank you.]
I for one have used sendmail and postfix, and have tried qmail in the past [sorry, didn't like it]. :)
I finally settled on Postifx. I really like it. I feel I don't have to jump through nearly as many hoops to get it running well as I did with sendmail. I certainly didn't need a 900 page 'bat' book to get postfix running.
With that said, to each his/her own. Use what you want, I'm sure people love qmail for reasons that make sense to them, and the same with exim and sendmail. Those of you who would flame me or others because of our choice of email servers all I can say is "Get over it..."
Ender
Nothing to see here
Just like Internet Explorer is still used because it ships as the default browser with every flavor of Windows, and Apple Mail is still used because it ships as the default mail client with every flavor of Mac OS X, and so on. This surprises you because...?
--
Damn the Emperor!
Sendmail.. ugh. Remember that old comment, if you've got nothing nice to say? At least they gave out free sendmail swiss army knives once!
MoFscker
If you run virtual domains, Postfix or Sendmail is not an option, especially if you dont want to deliver john@d1.com and john@d2.com to john@localhost. Heck, with virtual domains, you don't want to have user accounts anyway.
I wish there were other easy to use open source options, because Qmail really suffers under Sobig at this point.
Newsfollow.com
Sorry for the flamebait, but how would it seem if an "objective" news-headline site said the following:
"The Dodge Ram has had a number of documented problems over the years. However, for less problems, try the Ford Explorer."
Come on...
This wasn't just plain terrible, this was fancy terrible. This was terrible with raisins in it. - Dorothy Parker
Can someone post a list of the things we LOSE going to postfix? I'm interested, but I'd like to be able to check to see what I'm losing, so I can compare that to what I'm using.
When you have thousands of domains on the box you really do notice how much better postfix is than sendmail.
I've handled tens of thousands of domains under both and the ease of management, load handling and better security (as well as readable code!) make postfix the hands down winner for me.
Really? If you don't have any MTA on your workstation, how do you get all of the email messages to root telling you that things are wrong with your system? Or might that be why you are reinstalling all the time? :)
You could try Debian; not only does it not install Sendmail by default (I think they're on Exim now; used to be smail, IIRC), but it's designed to only have to be installed once, ever, which solves your other problem.
WMBC freeform/independent online radio.
(Offtopic: A similarly nice, elegant solution for desktop/clients PC printing is pdq, which unlike lpd and cups runs only as a local spooler without opening a network port, and is lean (65k), dead-simple and functional. With nullmailer/ssmtp & pdq, I managed to close all ports (except of course SSH) on my two desktop PCs under Debian GNU/Linux without any firewalling. AFAIK, Debian is the only OS offering all the aforementioned pieces of software as part of its main distribution.)
gopher://cramer.plaintext.cc http://cramer.plaintext.cc:70
BIND was originally was an implementation in C of Jeeves, which was the original PDP-10 DNS implementation. This explains some of the cruft (but in fact I don't feel that BIND has all that much cruft).
Qmail has a guarantee
But have you noticed the qualifiers? Sendmail works around bugs in the OS (and most of the CERT warnings involving sendmail are because of OS related issues and other delivery programs, not the sendmail core).
How many of the race conditions fixed in sendmail and apache exist today in qmail? Does qmail work around any linux kernal problems?
I'm just wondering.. if you install a sendmail alternative (exim, let's say), will it break any CGI scripts you are using for your webpage that call on sendmail to send mail?
I have no problem with the principle idea of switching from Sendmail to something more secure like qmail, postfix, exim, except for the fact that nobody has brought up that nearly EVERY *nix distro has tools that depend on having *sendmail*. Perl modules, bash scripts, all look for the particular behavior of sendmail. Sure, qmail has a sendmail-like wrapper, but I've had problems in sending mail with qmail. Haven't wanted to try anything else yet. It's such a pain to get anything else working, I'd rather use the m4's and keep sendmail working "good enough".
I only post comments when someone on the internet is wrong.
"Even just recently there was a remote DOS in some versions of postfix."
Big deal. DJB offers $500 for finding a security hole in qmail EXCEPT DOS attacks.
According to http://cr.yp.to/surveys/sendmail.html and http://cr.yp.to/surveys/smtpsoftware6.txt, Sendmail has long been trending towards less and less hosts running it. As of his last survey two years ago, it was at 42%. And if you look only at "serious" MTAs, those for sites that have heavy mail volumes, you'll probably see even less Sendmail.
One simple rule for its versus it's
>Postfix, on the other hand, suffers from the windows design pardigim.
a q&m=1060186 77502632&w=2
>One big package to do it all.
I guess if you define "one big package" to be modularized like this and "do it all" to mean "be an MTA" then you're right. Are you saying that qmail does less, with more than 36 different executables (which is how many postfix uses), and that that's better?
>Even Wietse doesn't trust his own software.
>http://marc.theaimsgroup.com/?l=bugtr
Riiight. So you're saying that when Dan ships a bug fix, all qmail installations are magically updated, and all distributions out there on FTP servers and CDs are updated too. No? That's all that Wietse was lamenting - read the message again. He's saying that you can fix a bug in the current code but you can't make it go away retroactively. He doesn't say he doesn't use or trust his own software.
>Postfix on the other hand is still underdevelopment,
I guess you would prefer an abandoned product? Or are you saying it's not ready for production use yet? IBM released it FIVE YEARS AGO as the IBM Secure Mailer. It does get updated, though. Horrors! Do you use an OS that is "done" too, because not ever being updated is a good thing?
>suffers from a poor design,
According to you. How exactly is the design poor in your opinion? Hint: You can't just say "it's like Windows". What are some specific design choices and examples of why that's bad? Or are you just hand-waving?
>and probably will include the kitchen sink by next year.
Based on what, exactly? Please explain why you think Postfix is adding all sorts of non-MTA features lately, and preferrably show a link to a message by Wietse where he says he's going to do so in the future.
Most of the installs I've done for postfix and exim (I prefer exim) replace sendmail completely and setup a link from /usr/sbin/sendmail (or whereever) to the replacement. Both postfix and exim will accept the same commandline parameters as sendmail (although they ignore some of them) so this won't break any locally installed software that expects sendmail to be available.
Yeah me too. I messed with Postfix on Debian for awhile. I got it to work but I wasn't real comfortable that I understood what I had done.
Switching to Exim was great, I thought the config file much better. When I rebuilt my server to Gentoo a couple of weekends ago, I moved to Exim 4.1 and thought the config even better.