Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Run Your Own Mail Server (2017)

c0ffee.net

Post reply on HN
Print view View original

261–270 of 339 posts

Re: How to Run Your Own Mail Server (2017)

#261

Post by toomim »

inferiorhuman wrote: post #144
agentultra wrote: post #41

I run my own mail infrastructure. To say the least I wouldn't recommend it even to my worst enemies. It's horrible. Actually it's fine until it's not. Then your email doesn't work and you could be missing out on important communications. And then you're scrambling to figure out how the spammers managed to exploit your setup this time. And you have to learn a tonne of crap in order to manage it... and the text files!…

My experience was quite the opposite (granted I'm an ops guy these days anyhow). I've been self-hosting mail for ages with a postfix + dovecot + cyrus + spamassassin + opendkim + dkimproxy + lets encrypt stack. Everything just works, although I'm going to move it into a jail sooner than later so I can rebuild it more easily. The biggest pain is no longer having a static IP or reverse DNS (thanks Sonic!). Having rever…

> I've been self-hosting mail for ages with a postfix + dovecot + cyrus + spamassassin + opendkim + dkimproxy + lets encrypt stack.

So you call it easy to configure together 7 different systems just to get a working mail server?

Re: How to Run Your Own Mail Server (2017)

#262

Post by burgerdev »

_jal wrote: post #212
rsync wrote: post #143

Earlier quoted context omitted.

"And then you're scrambling to figure out how the spammers managed to exploit your setup this time." ... " ... writing a MTA with the goal of minimizing configuration and being secure and resistant to attacks by default. " As a 20+ year UNIX sysadmin and fellow owner of my own email infrastructure for 18 of those, I am surprised to read this and am not even sure what you are talking about. Can you explain what you me…

I'm in the same boat - been running my own mail since the 90s. I could understand complaints about lots of weird hoops to jump through to get mail from your server accepted elsewhere - that has become harder over time[1] - but there's a very short list of things that need to be done to avoid being hijacked. Mail server setup for the uninitiated does look a little daunting, especially if you're more accustomed to "all…

I've been running my mail server for 6 years now. Mail to Microsoft's servers (live.com, etc.) keeps ending up in the spam folder, even though spf, dkim and dmarc are set up and my IP has been clean for the entire period. The bright side is that I only notice this in the rare case of "mail to all contacts", since noone is on outlook.com these days.

Re: How to Run Your Own Mail Server (2017)

#263

Post by rafael859 »

sfilargi wrote: post #260

I run my own mail server that I coded myself ( https://github.com/sfilargi/puremail ). It's basically a single binary that has an SMTP server and webmail server. It works absolutely fine for me without much stress. I do hit a couple of bugs here and there, mainly on the mail parsing, but it's not big deal.

I don't think that you should leave your parse.txt there. Looks like personal data.

Re: How to Run Your Own Mail Server (2017)

#264

Post by twothamendment »

dingaling wrote: post #178
twothamendment wrote: post #14

Icing on the cake: Sprinkle a little Let's Encrypt in there to cover SSL. It doesn't take much to have a cron make a new cert and restart dovecot and postfix. My setup is similar, but it uses MySQL instead of LDAP. I love being able to make aliases and even better - deleting them when I'm done with them.

> Sprinkle a little Let's Encrypt in there to cover SSL. Unfortunately most MTAs aren't configured to check the certificate chain, so they'll happily take any SSL cert they're handed and start chatting. MITM or downgrading is trivial. There is an IETF draft ( MTA-STS ) from 2017 that should address this.

True and it will be nice when MTA's check the chain - but all of my mail clients do check or at least complain if it expires.

Re: How to Run Your Own Mail Server (2017)

#265

Post by sfilargi »

rafael859 wrote: post #263
sfilargi wrote: post #260

I run my own mail server that I coded myself ( https://github.com/sfilargi/puremail ). It's basically a single binary that has an SMTP server and webmail server. It works absolutely fine for me without much stress. I do hit a couple of bugs here and there, mainly on the mail parsing, but it's not big deal.

I don't think that you should leave your parse.txt there. Looks like personal data.

Thanks

Re: How to Run Your Own Mail Server (2017)

#266

Post by kakarot »

ryanlol wrote: post #177
andris9 wrote: post #166

Earlier quoted context omitted.

In the age of password leaks it is really common that email accounts are easy targets and get hijacked – most users are probably still using the same password for their email as they used for LinkedIn in 2012. So it might happen from time to time that an otherwise normal account suddenly sends 20 000 emails to hotmail.com unless you have somehow predicted that and configured the mail server to not allow it.

>most users are probably still using the same password for their email as they used for LinkedIn in 2012 This is absolutely not true.

What? That is totally true.

Most users that reuse passwords statistically did not rotate their passwords across all websites because most users that reuse passwords statistically do not rotate their passwords.

We aren't talking about the overall Linkedin userbase, just that specific subset that reuses passwords for secure services.

Re: How to Run Your Own Mail Server (2017)

#267

Post by e12e »

_jal wrote: post #240
agentultra wrote: post #216

Earlier quoted context omitted.

To be fair I've been running my infrastructure for years and it's usually fine. The problem I have is that it's a pain in the ass to setup correctly and when things do go wrong it's really hard to figure out what's going on. > Can you explain what you mean by attacks and exploits from spammers? I haven't encountered a remote exploit (yet) but yes: accidentally running an open relay, backscattering, etc. You also have…

> That's where the idea for a secure-by-default MTA that couldn't possibly be configured to be an open relay came from. You're close to describing the motivation behind Postfix. Between the design and the documentation, Postfix is hard to screw up, from a security perspective. And it is really easy to configure, at least in contrast to What Came Before - believe me, if you think this is complex, buy a crusty sysadmin…

I'm fairly happy with opensmtpd: https://www.opensmtpd.org/faq/example1.html#smtpd

Re: How to Run Your Own Mail Server (2017)

#268

Post by icelancer »

toomim wrote: post #261
inferiorhuman wrote: post #144

Earlier quoted context omitted.

My experience was quite the opposite (granted I'm an ops guy these days anyhow). I've been self-hosting mail for ages with a postfix + dovecot + cyrus + spamassassin + opendkim + dkimproxy + lets encrypt stack. Everything just works, although I'm going to move it into a jail sooner than later so I can rebuild it more easily. The biggest pain is no longer having a static IP or reverse DNS (thanks Sonic!). Having rever…

> I've been self-hosting mail for ages with a postfix + dovecot + cyrus + spamassassin + opendkim + dkimproxy + lets encrypt stack. So you call it easy to configure together 7 different systems just to get a working mail server?

iRedMail will do this for you in one shot. I've done it. I still don't recommend it, but it's pretty easy.

Re: How to Run Your Own Mail Server (2017)

#269

Post by inferiorhuman »

toomim wrote: post #261
inferiorhuman wrote: post #144

Earlier quoted context omitted.

My experience was quite the opposite (granted I'm an ops guy these days anyhow). I've been self-hosting mail for ages with a postfix + dovecot + cyrus + spamassassin + opendkim + dkimproxy + lets encrypt stack. Everything just works, although I'm going to move it into a jail sooner than later so I can rebuild it more easily. The biggest pain is no longer having a static IP or reverse DNS (thanks Sonic!). Having rever…

> I've been self-hosting mail for ages with a postfix + dovecot + cyrus + spamassassin + opendkim + dkimproxy + lets encrypt stack. So you call it easy to configure together 7 different systems just to get a working mail server?

> So you call it easy to configure together 7 different systems just to get a working mail server?

Yes, with the qualification that I brain farted on cyrus (not using that for mail) and you can just as easily skip the two dkim packages (which were a bit tedious to figure out).

Postfix works out of the box. Diffing the stock main.cf with mine the differences are: new additions that never made it into my main.cf, a few lines to enforce stronger TLS ciphers (optional), a manual blacklist (optional), virtual domain stuff (also optional), milter lines for dkim and spf (optional), a line to deliver to procmail instead of directly to a mailbox (optional), and a line to enable mail relay access to authenticated users (also optional). You could install postfix and have a good experience out of the box.

Dovecot: a line to enable verbose process names (optional), a stanza to enable the SASL backend (optional), a line to specify which keys to use for TLS (mandatory), a few lines to up per-user limits (optional). Setting up SSL is going to be the hardest part, and even that shouldn't be too bad.

Procmail: A couple lines to pipe everything to spamassassin and deliver to a mailbox or a spam folder. This may be considered tricky by some but procmail is ancient and, in my experience, examples abound.

Spamassassin: No changes. In fact I think I've ripped out most of my custom config except for some whitelist stuff.

Four packages and you'll have a working SMTP and IMAP server. No, I don't think that's difficult. Wrangling an OpenLDAP install, sure that's difficult. This? No. Scaling it out to hundreds or thousands of users is trickier, but not something the typical home user would need to bother with.

For everything above there's actually quite good documentation. What's difficult is figuring out which packages to install in the first place and deviating from the stock configurations for the little extras you may want, but even then the big challenge is in taking the time to read the documentation and figuring out which features you want. Maintenance is trivial, although I probably should update my postfix config to get it in line with the current config syntax.

Re: How to Run Your Own Mail Server (2017)

#270

Post by Jaruzel »

rkagerer wrote: post #247
Jaruzel wrote: post #75

Earlier quoted context omitted.

My use case is different, as I'm a Windows guy, but this is what I've got: 1. Custom MTA that handles incoming SMTP. 2. SpamAssassin that is called by the above MTA which flags email as spam/not-spam. 3. Custom MTA forwards not-spam to the users inbox. 4. Custom MTA forwards SPAM to postmaster (this bit needs significant re-working) 5. Main Mailserver is Microsoft Exchange run On-Premises. 6. All Mail clients are Out…

Your custom MTA is impressive, but if you want to reduce the amount of custom code you need to maintain (and don't mind one third party service in the mix), you could use something like SpamHero. It's reasonably effective and fairly cheap. Postini was even better, before Google bought them and bastardized the product.

Agreed. I would love to ditch the customisations and run something standard!
Post reply on HN