crazylazy.info

Why to hate typical Unix mailserver setups

I hate that stuff - and it's not that Postfix in particular sucks. But integrating with Postfix is absurd. Surely it works, and as long as it works nobody changes that stuff on how it's designed.

Even deploying an SSL/TLS setup is challenging. But no, you also need to install proper authentication. Locally, Postfix (for unknown reasons) is chrooted. People think that this is a security feature.

Who needs this?

Yay, free mails in a sustaining setup!

This is a tutorial on how to practically setup a relatively secure mail-server.

It's supposed to be as minimal as reasonable nowadays, and for a small amount of users (standard root server, max. ~20 mail-users at once). Without a real DB backend. It doesn't scale business-needs, however it's supposed to be extendable.

The reference system this setup works with is a Debian GNU Linux with:

• Maildrop - instead of Procmail for more flexible filter rulesets
• Postfix and Postfix-pcre ~ 2.7

Setting up the server

If you do this, you want three things:

• a clean and secure setup, that ensures your availability - even if you're working on a remote-server
• easy steps
• drinking a coke or a coffee during this setup. No beer. Because kernel-upgrades and beer don't work together

Okay, what's grsecurity and why do I need it

Easily said: it's doing everything to prevent successful exploitation, like we recently saw happening on Linux through SCTP, ptrace or UDEV.

this is a random security picture. :)

German Security Skills - Confickr, MPLS...