Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Poste.io – Complete Mail Server

poste.io

Post reply on HN
Print view View original

21–30 of 247 posts

Re: Poste.io – Complete Mail Server

#21

Post by oarsinsync »

velcrovan wrote: post #14
capableweb wrote: post #3

Earlier quoted context omitted.

There is also basic forms of protection you should put in front of everything you make public, in order to reduce the attack surface. Firewall that blocks everything by default, strip all headers unless you veto them manually, aggressive rate-limiting you increase the limit only for specific IPs and so on. Putting up any type of software on a unprotected server even in 2006 is begging for trouble.

Define “unprotected”. The particular server had a firewall and fail2ban along with other measures. But Roundcube is a webmail service, so you’re leaving 443 open in any case. No amount of firewalls or rate limiting will help you if the thing you’re running is a web service that turns out to have a SQL injection vulnerability in one of its endpoints. Email servers in particular are going to be under attack all day lon…

I use http basic auth in front of every https internet exposed service.

The services may have their own auth system on top of that, but htpasswd in front solves the vast majority of problems. Can’t exploit an SQL injection vulnerability if you can’t reach the endpoint in the first place.

I’m less concerned about apache2 and nginx http basic auth vulnerabilities. They’ll get fixed much quicker than random webapps.

Anything else goes behind a VPN.

Re: Poste.io – Complete Mail Server

#22

Post by richwater »

andix wrote: post #20
that_courtney wrote: post #13

I feel like this solution is optimizing the wrong problem. The bulk of work with managing a mail server (these days) isn't software setup and admin. On the receiving side, it's all the work dealing with abuse and attacks. On the sending side -- and this is the tough one -- it's getting sites to accept your email. When I finally gave up managing my own mail server (about two years ago), I found that about every six mo…

No, that kind of software optimizes a very important problem. It’s quite cumbersome to set up all components of a mail server by yourself. At some point you start hosting a domain for a friend. Then then friend wants to create some mailboxes, forwardings and so on by themselves. So you just give them SSH and tell them to edit the postfix config? Having a web interface that does it all and doesn’t break things is very…

Who does this...?

Re: Poste.io – Complete Mail Server

#23

Post by c0l0 »

that_courtney wrote: post #13

I feel like this solution is optimizing the wrong problem. The bulk of work with managing a mail server (these days) isn't software setup and admin. On the receiving side, it's all the work dealing with abuse and attacks. On the sending side -- and this is the tough one -- it's getting sites to accept your email. When I finally gave up managing my own mail server (about two years ago), I found that about every six mo…

Having been a part-time postmaster for more than a decade by now, I fully agree, and would even go further: Ingress spam is pretty much a solved problem if you play your cards right. ChatGPT et al. might change that again - but the mechanisms you can deploy today are very effective against the current UBE landscape.

The _real_ problem is reliably getting your 100% legit mail into your consenting recipients' inboxes.

Re: Poste.io – Complete Mail Server

#24

Post by stonogo »

andix wrote: post #20
that_courtney wrote: post #13

I feel like this solution is optimizing the wrong problem. The bulk of work with managing a mail server (these days) isn't software setup and admin. On the receiving side, it's all the work dealing with abuse and attacks. On the sending side -- and this is the tough one -- it's getting sites to accept your email. When I finally gave up managing my own mail server (about two years ago), I found that about every six mo…

No, that kind of software optimizes a very important problem. It’s quite cumbersome to set up all components of a mail server by yourself. At some point you start hosting a domain for a friend. Then then friend wants to create some mailboxes, forwardings and so on by themselves. So you just give them SSH and tell them to edit the postfix config? Having a web interface that does it all and doesn’t break things is very…

This problem is solvable without a web interface: https://manpages.ubuntu.com/manpages/bionic/man5/dot-qmail.5...

Re: Poste.io – Complete Mail Server

#25

Post by user3939382 »

c0l0 wrote: post #23
that_courtney wrote: post #13

I feel like this solution is optimizing the wrong problem. The bulk of work with managing a mail server (these days) isn't software setup and admin. On the receiving side, it's all the work dealing with abuse and attacks. On the sending side -- and this is the tough one -- it's getting sites to accept your email. When I finally gave up managing my own mail server (about two years ago), I found that about every six mo…

Having been a part-time postmaster for more than a decade by now, I fully agree, and would even go further: Ingress spam is pretty much a solved problem if you play your cards right. ChatGPT et al. might change that again - but the mechanisms you can deploy today are very effective against the current UBE landscape. The _real_ problem is reliably getting your 100% legit mail into your consenting recipients' inboxes.

> The _real_ problem is reliably getting your 100% legit mail into your consenting recipients' inboxes

It's amazing that having someone in your address book isn't enough in many cases. Like, why?

Re: Poste.io – Complete Mail Server

#26

Post by andix »

velcrovan wrote: post #2

First thought: oh, huh, a self-hosted CVE generator. In seriousness, installing Roundcube on my own server circa 2006 was the cause of the first and only time I’ve had a server hacked. It’s probably improved since then or it wouldn’t still be around, but it put me off ever hosting my own email. The risks only get worse the further away you get from personal/hobby use.

I’m hosting mail servers for over a decade now. They are all very low frequency, so probably not a lot of attackers find them. I try to enable as many automatic updates as possible, because I don’t operate them professionally. Just every few months I check if all updates are installed, and if there is something wrong. So far I only had two hacked accounts (probably the users got phished or used compromised public PCs while logging in to webmail - the country of the attacker was the same where they were on holiday).

So far no break-ins that I noticed. But it is for sure possible that somebody broke in without me noticing (and did nothing worth noticing).

Re: Poste.io – Complete Mail Server

#27

Post by stonogo »

sam_lowry_ wrote: post #5

Dovecot, Roundcube, ClamAV, Rspamd are all battle-tested and reasonable choices, but the choice of Haraka, a Node.js-based SMTP server, feels dubious. Why not exim or something similarly solid and well-understood?

What is solid about exim? Not only does it have more CVEs than any other mail transport agent (including four, all critical or high, just last year), they tend to respond by doing infamous things like releasing security patches on Christmas morning. I'm not the biggest fan of Haraka, but exim is easily the biggest security hassle you can ask for in an email server.

Re: Poste.io – Complete Mail Server

#28

Post by layer8 »

user3939382 wrote: post #25
c0l0 wrote: post #23

Earlier quoted context omitted.

Having been a part-time postmaster for more than a decade by now, I fully agree, and would even go further: Ingress spam is pretty much a solved problem if you play your cards right. ChatGPT et al. might change that again - but the mechanisms you can deploy today are very effective against the current UBE landscape. The _real_ problem is reliably getting your 100% legit mail into your consenting recipients' inboxes.

> The _real_ problem is reliably getting your 100% legit mail into your consenting recipients' inboxes It's amazing that having someone in your address book isn't enough in many cases. Like, why?

Because the from address can be forged, probably.

Re: Poste.io – Complete Mail Server

#29

Post by sconi »

oarsinsync wrote: post #21
velcrovan wrote: post #14

Earlier quoted context omitted.

Define “unprotected”. The particular server had a firewall and fail2ban along with other measures. But Roundcube is a webmail service, so you’re leaving 443 open in any case. No amount of firewalls or rate limiting will help you if the thing you’re running is a web service that turns out to have a SQL injection vulnerability in one of its endpoints. Email servers in particular are going to be under attack all day lon…

I use http basic auth in front of every https internet exposed service. The services may have their own auth system on top of that, but htpasswd in front solves the vast majority of problems. Can’t exploit an SQL injection vulnerability if you can’t reach the endpoint in the first place. I’m less concerned about apache2 and nginx http basic auth vulnerabilities. They’ll get fixed much quicker than random webapps. Any…

why not vpn for the https services?

Re: Poste.io – Complete Mail Server

#30

Post by c0l0 »

layer8 wrote: post #28
user3939382 wrote: post #25

Earlier quoted context omitted.

> The _real_ problem is reliably getting your 100% legit mail into your consenting recipients' inboxes It's amazing that having someone in your address book isn't enough in many cases. Like, why?

Because the from address can be forged, probably.

Not really a problem in the age of DKIM, _if_ you want to solve it.
Post reply on HN