Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mail-in-a-box: easy to set up modern SMTP/SMTPS server stack

github.com

Post reply on HN
Print view View original

61–70 of 150 posts

Re: Mail-in-a-box: easy to set up modern SMTP/SMTPS server stack

#61

Post by mike-cardwell »

xyzzy123 wrote: post #35

This is cool, but it doesn't actually help you with mass surveillance unless the other side of your conversation is doing that too. What point running your own email server if your friend is on hotmail? Also, even if you both run your own MTAs STARTTLS does not help much except to reduce the scope of the passive-only surveillance dragnet, because the configuration does not require signed certificates. Finally, if bot…

> Also, even if you both run your own MTAs STARTTLS does not help much except to reduce the scope of the passive-only surveillance dragnet, because the configuration does not require signed certificates.

Exim and Postfix (and hopefully others to come) are both working on adding DNSSEC and DANE support right now. Which means in the not too distant future it will be possible to publish cryptographically signed data in the DNS that your MX has TLS support, and what the fingerprints are.

> Finally, if both parties are technical enough to run their own email servers, um, why not just use GPG?

OpenPGP encrypted email leaks all sorts of information/meta data.

Re: Mail-in-a-box: easy to set up modern SMTP/SMTPS server stack

#62

Post by xyzzy123 »

mike-cardwell wrote: post #61
xyzzy123 wrote: post #35

This is cool, but it doesn't actually help you with mass surveillance unless the other side of your conversation is doing that too. What point running your own email server if your friend is on hotmail? Also, even if you both run your own MTAs STARTTLS does not help much except to reduce the scope of the passive-only surveillance dragnet, because the configuration does not require signed certificates. Finally, if bot…

> Also, even if you both run your own MTAs STARTTLS does not help much except to reduce the scope of the passive-only surveillance dragnet, because the configuration does not require signed certificates. Exim and Postfix (and hopefully others to come) are both working on adding DNSSEC and DANE support right now. Which means in the not too distant future it will be possible to publish cryptographically signed data in…

The metadata problem is so hard that if you actually solve it you are not using email anymore. This is why I'm saying it's a boondoggle. Even in the best case where my mother and I are running our own STARTTLS secured MTAs, oh wait, timing and message size.

GPG gives you actual privacy but minimal resistance against traffic analysis. All this other stuff gives you NO end to end privacy, AND minimal resistance against traffic analysis.

Messaging is a weird special case and GPG is behind the times (because people are coming to realise that repudiability and FS are important), but it's still a heck of a lot better than even working TLS slapped on SMTP (which doesn't even currently exist).

Re: Mail-in-a-box: easy to set up modern SMTP/SMTPS server stack

#63

Post by arbitrage »

Niten wrote: post #52
morsch wrote: post #9

Very nice. Comes with Roundcube so you've got a webmail client available. - DKIM signing on outgoing messages (opendkim). - The machine acts as its own DNS server and is automatically configured for SPF and DKIM (nsd). I remember many people running their own SMTP server used to have massive issues with their outgoing mail being silently or non-silently ignored or sent to the spam folder. Does this take care of this?…

> I remember many people running their own SMTP server used to have massive issues with their outgoing mail being silently or non-silently ignored or sent to the spam folder. Does this take care of this? "Mostly" really isn't good enough. Frankly I've had mixed results over several years of hosting my own personal email server, even with a valid PTR, SPF, and DKIM. Most SMB and personal email systems I interact with…

hotmail used to actively blackhole e-mail from smaller servers, no bounce, no warning, nothing. just accept it and throw it away.

i don't know if they still do that, but it was far easier to convince everyone i knew at the time that hotmail was garbage, rather than making any headway with their mail admins.

Re: Mail-in-a-box: easy to set up modern SMTP/SMTPS server stack

#64

Post by mike-cardwell »

Niten wrote: post #52
morsch wrote: post #9

Very nice. Comes with Roundcube so you've got a webmail client available. - DKIM signing on outgoing messages (opendkim). - The machine acts as its own DNS server and is automatically configured for SPF and DKIM (nsd). I remember many people running their own SMTP server used to have massive issues with their outgoing mail being silently or non-silently ignored or sent to the spam folder. Does this take care of this?…

> I remember many people running their own SMTP server used to have massive issues with their outgoing mail being silently or non-silently ignored or sent to the spam folder. Does this take care of this? "Mostly" really isn't good enough. Frankly I've had mixed results over several years of hosting my own personal email server, even with a valid PTR, SPF, and DKIM. Most SMB and personal email systems I interact with…

I was suffering the same problem about 7 years ago on my own personal mail server. I discovered that if I padded out the message headers with a load of junk headers to push the message size up beyond about 50KB, then the otherwise exact same message would arrive in the Inbox at Hotmail rather than being blackholed.

https://lists.exim.org/lurker/message/20070614.130838.42d1bd...

I haven't done this for many years though as it was such a terrible hack. I do wonder if it still works, or if the threshold has changed though.

Re: Mail-in-a-box: easy to set up modern SMTP/SMTPS server stack

#66

Post by mike-cardwell »

xyzzy123 wrote: post #62
mike-cardwell wrote: post #61

Earlier quoted context omitted.

> Also, even if you both run your own MTAs STARTTLS does not help much except to reduce the scope of the passive-only surveillance dragnet, because the configuration does not require signed certificates. Exim and Postfix (and hopefully others to come) are both working on adding DNSSEC and DANE support right now. Which means in the not too distant future it will be possible to publish cryptographically signed data in…

The metadata problem is so hard that if you actually solve it you are not using email anymore. This is why I'm saying it's a boondoggle. Even in the best case where my mother and I are running our own STARTTLS secured MTAs, oh wait, timing and message size. GPG gives you actual privacy but minimal resistance against traffic analysis. All this other stuff gives you NO end to end privacy, AND minimal resistance against…

The security of email will never be perfect; that is obvious. But there is still legitimate and real value gained from making small incremental improvements to it. If you can hide the To/From/Subject of a message from a passive or even active MITM (because of DANE), then that's a good thing.

Re: Mail-in-a-box: easy to set up modern SMTP/SMTPS server stack

#67

Post by brianshaler »

> It is a mail server in a box aimed to be deployed securely into any cloud infrastructure. It provides no user interface to send or check one’s mail but implements all of the underlying protocols that other applications (mail clients), such as Google K-9 for mobile devices, Mailpile, and Mozilla Thunderbird, can interoperate with.

The combination of Mail-in-a-box and Mailpile seems pretty exciting.

Since running your own mail server is opening a new vector for attack, I'd be curious how Mail-in-a-box is going to handle security updates.

Re: Mail-in-a-box: easy to set up modern SMTP/SMTPS server stack

#68

Post by Torgo »

clarry wrote: post #20
thisishugo wrote: post #16

It remains a constant frustration to me that Postfix, Exim, Cyrus, Dovecot and the like still feel as if they belong very much in the "here be dragons" territories of the Unix world. Configuring these systems is an exercise in constant frustration and bafflement. They're such a pain to use that since becoming the sysadmin in charge of our work email servers, I gave up running personal ones as well and just pay FastMa…

Have you tried OpenSMTPD[1]? I've been running it for a few years now, admittedly with a very basic setup. My config is about ten lines long, written in five minutes or so. I haven't really needed to touch it since. [1] https://www.opensmtpd.org/

I love OpenSMTPD. The only issue I had with it was, no filter API (just fixed, as of a month ago or so) and to get things like spam and antivirus filtering, or domainkeys, you have to proxy chain it. Also, the API changed very rapidly, and I had to run nightlies for a while to get around a few issues (I'm on stable now though with no problems.) These things add complexity to the configuration, but I would still rather do this than maintain any other mail server software.

Re: Mail-in-a-box: easy to set up modern SMTP/SMTPS server stack

#70

Post by chris_mahan »

robomartin wrote: post #31

This is neat. I've been running my own email forever and appreciate the difficulty involved. I do have a question: Does hosting your own email truly isolate you from government surveillance? If a million people use this to host their own email on AWS, what's to keep the NSA from ordering Amazon to tap into your data? You almost have to host it on your own hardware in the garage in order to add a significant layer of…

VPS in Germany?
Post reply on HN