Re: mail server doing local delivery only for extra security
> This may seem an odd question but here goes:
> I am setting up a firewall for my home network running Debian 2.2. From
> what I can tell, I have to have a mail server install for the "at" program
to
> work. I currently have exim installed and configured to do local delivery
> only (the only thing I need it to do is to deliver messages for root to
> another userid on the same box).
Local delivery agents deliver on the local machine, so it is very odd, that
an SMTP server would be required for at(1), I thought it used a command line
mailer to do the delivery.
> Now, this got me thinking. While I have exim configured for local
> deliveries only, and my firewall rules will be set up to ensure that the
> mailserver is not accessed from the outside, it seems like the ideal
option
> is to have a mailserver setup that ONLY does local delivery (incapable of
> doing deliveries off the box, regardless of the configuration).
If you're PARANOID why have it listening on port 25 at all?
> Maybe I am paranoid, but this seems even safer. Does anyone know if
there is such a program?
If you use email, you will talk to an SMTP server at some point? Your email
client either punts it off to a relay eg) smtp.isp.net, or it goes to an
SMTP server running on localhost. Delivery direct to the domains MX, is
probably not a good idea, as it can be slow, and crashes would loose the
email.
It's you choice whether having mail queued locally and saved immediately, is
worth it or not. If you need to serve SMTP, then postfix is package written
by the TCP Wrappers guy with security in mind, perhaps it will even let you
bind only to the local interfaces, as a belt and braces approach to your
firewall rules. sendmail has improved over the years, and is the most
common implementation, if you're on the security lists, and run apt-get the
window for exploitation is very small. Security is a trade off, only you
can decide where the right point on features v security and configuration
effort curve is.
> Also, how important is having the "at" program? I don't know if I
> need it. Maybe I should just remove the at program and then the
mailserver
> software alltogether.
Well if you want to run batch jobs at particular times, or use the batch
command, then you need it. If you don't plan on running batch jobs, then
you only need it, if some other software uses at(1) or batch(1), for
background processing (unlikely?). If you don't install it, and you
discover you need it, you can install it with apt without problems, so why
not try deinstalling it?
Rob
Reply to: