Poste.io – Complete Mail Server
poste.io
Poste.io – Complete Mail Server
1–10 of 247 posts
Re: Poste.io – Complete Mail Server
#2First thought: oh, huh, a self-hosted CVE generator.
In seriousness, installing Roundcube on my own server circa 2006 was the cause of the first and only time I’ve had a server hacked. It’s probably improved since then or it wouldn’t still be around, but it put me off ever hosting my own email. The risks only get worse the further away you get from personal/hobby use.
Re: Poste.io – Complete Mail Server
#3First thought: oh, huh, a self-hosted CVE generator. In seriousness, installing Roundcube on my own server circa 2006 was the cause of the first and only time I’ve had a server hacked. It’s probably improved since then or it wouldn’t still be around, but it put me off ever hosting my own email. The risks only get worse the further away you get from personal/hobby use.
There is also basic forms of protection you should put in front of everything you make public, in order to reduce the attack surface. Firewall that blocks everything by default, strip all headers unless you veto them manually, aggressive rate-limiting you increase the limit only for specific IPs and so on.
Putting up any type of software on a unprotected server even in 2006 is begging for trouble.
Re: Poste.io – Complete Mail Server
#4First thought: oh, huh, a self-hosted CVE generator. In seriousness, installing Roundcube on my own server circa 2006 was the cause of the first and only time I’ve had a server hacked. It’s probably improved since then or it wouldn’t still be around, but it put me off ever hosting my own email. The risks only get worse the further away you get from personal/hobby use.
>>First thought: oh, huh, a self-hosted CVE generator.
Haha, same. I've run my own mail servers, got the tshirt, and don't want to have to do it again. Point your domain to one of a bazillian email services instead.
Re: Poste.io – Complete Mail Server
#5Dovecot, Roundcube, ClamAV, Rspamd are all battle-tested and reasonable choices, but the choice of Haraka, a Node.js-based SMTP server, feels dubious.
Why not exim or something similarly solid and well-understood?
Re: Poste.io – Complete Mail Server
#6First thought: oh, huh, a self-hosted CVE generator. In seriousness, installing Roundcube on my own server circa 2006 was the cause of the first and only time I’ve had a server hacked. It’s probably improved since then or it wouldn’t still be around, but it put me off ever hosting my own email. The risks only get worse the further away you get from personal/hobby use.
Hm. Been running mailinabox since 2012 or so, no issues. I like the idea of consolodating executables a bit and simplifying the system, so I'll have a look at poste.io.
Re: Poste.io – Complete Mail Server
#7Dovecot, Roundcube, ClamAV, Rspamd are all battle-tested and reasonable choices, but the choice of Haraka, a Node.js-based SMTP server, feels dubious. Why not exim or something similarly solid and well-understood?
Postfix
Re: Poste.io – Complete Mail Server
#8Dovecot, Roundcube, ClamAV, Rspamd are all battle-tested and reasonable choices, but the choice of Haraka, a Node.js-based SMTP server, feels dubious. Why not exim or something similarly solid and well-understood?
What is wrong with Haraka it's like 10 years old?
Re: Poste.io – Complete Mail Server
#9Dovecot, Roundcube, ClamAV, Rspamd are all battle-tested and reasonable choices, but the choice of Haraka, a Node.js-based SMTP server, feels dubious. Why not exim or something similarly solid and well-understood?
I generally recommend replacing Roundcube with SnappyMail (https://snappymail.eu) -- not having to deal with a database by not maintaining much state is a win.
I was expecting to see Postfix instead of Haraka. I wouldn't have been very surprised at exim.