Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #191066 > unrolled thread

Secure email server setup

Back to article view | Back to linux.debian.user

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Secure email server setup "J.W. Foster" <jfoster81747@yahoo.com> - 2018-01-14 16:40 +0100
    Re: Secure email server setup rhkramer@gmail.com - 2018-01-14 19:00 +0100
      Re: Secure email server setup Brian <ad44@cityscape.co.uk> - 2018-01-14 20:30 +0100
        Re: Secure email server setup rhkramer@gmail.com - 2018-01-14 22:50 +0100
          Re: Secure email server setup Brian <ad44@cityscape.co.uk> - 2018-01-15 00:20 +0100
            Re: Secure email server setup Alessandro Vesely <vesely@tana.it> - 2018-01-15 10:50 +0100
              Re: Secure email server setup rhkramer@gmail.com - 2018-01-15 16:30 +0100
                Re: Secure email server setup Alessandro Vesely <vesely@tana.it> - 2018-01-15 19:00 +0100
                  Re: Secure email server setup Greg Wooledge <wooledg@eeg.ccf.org> - 2018-01-15 20:00 +0100
                    Re: Secure email server setup rhkramer@gmail.com - 2018-01-15 20:10 +0100
                      Re: Secure email server setup Brian <ad44@cityscape.co.uk> - 2018-01-15 22:10 +0100
                    Re: Secure email server setup Henning Follmann <hfollmann@itcfollmann.com> - 2018-01-15 20:30 +0100
                  Re: Secure email server setup rhkramer@gmail.com - 2018-01-15 20:00 +0100
                    Re: Secure email server setup Brian <ad44@cityscape.co.uk> - 2018-01-15 21:10 +0100
                    Re: Secure email server setup rhkramer@gmail.com - 2018-01-17 14:40 +0100
            Re: Secure email server setup Jonathan Sélea <jonathan@selea.se> - 2018-01-15 20:40 +0100
              Re: Secure email server setup Greg Wooledge <wooledg@eeg.ccf.org> - 2018-01-15 20:50 +0100
              Re: Secure email server setup Henning Follmann <hfollmann@itcfollmann.com> - 2018-01-15 21:00 +0100
                Re: Secure email server setup Jonathan Sélea <jonathan@selea.se> - 2018-01-15 21:00 +0100
                  Re: Secure email server setup Henning Follmann <hfollmann@itcfollmann.com> - 2018-01-15 22:40 +0100
                    Re: Secure email server setup Jonathan Sélea <jonathan@selea.se> - 2018-01-16 11:10 +0100
                Re: Secure email server setup Brian <ad44@cityscape.co.uk> - 2018-01-15 21:50 +0100
                  Re: Secure email server setup Henning Follmann <hfollmann@itcfollmann.com> - 2018-01-15 22:30 +0100
                    Re: Secure email server setup Brian <ad44@cityscape.co.uk> - 2018-01-16 20:00 +0100
    Re: Secure email server setup deloptes <deloptes@gmail.com> - 2018-01-14 19:50 +0100
      Re: Secure email server setup basti <basti@unix-solution.de> - 2018-01-14 20:10 +0100
        Re: Secure email server setup deloptes <deloptes@gmail.com> - 2018-01-14 22:00 +0100
    Re: Secure email server setup Brian <ad44@cityscape.co.uk> - 2018-01-14 20:30 +0100
    Re: Secure email server setup Joe <joe@jretrading.com> - 2018-01-14 21:20 +0100

Page 1 of 2  [1] 2  Next page →

#191066 — Secure email server setup

[Multipart message — attachments visible in raw view] — view raw

I am looking for a reliable step by step process for setting up an email server located on an existing website server. I have installed;  exim4 light, dovecot, Thunderbird, OpenSSL, and TLS security. I have tried following several bits of documentation regarding this with some success, but as with every time I try this, I open up my system to SPAM at a ridiculous rate. I want to eliminate that and get this mail server fully operational. I am seeking a well-documented approach that I can follow. I am using current Debian Stretch and the server is primarily a Mediawiki system where I NEED  mail available. Any tips are appreciated. Thanks!John

[toc] | [next] | [standalone]

#191072

On Sunday, January 14, 2018 10:36:40 AM J.W. Foster wrote:
> I am looking for a reliable step by step process for setting up an email
> server located on an existing website server. I have installed;  exim4
> light, dovecot, Thunderbird, OpenSSL, and TLS security. I have tried
> following several bits of documentation regarding this with some success,
> but as with every time I try this, I open up my system to SPAM at a
> ridiculous rate. I want to eliminate that and get this mail server fully
> operational. I am seeking a well-documented approach that I can follow. I
> am using current Debian Stretch and the server is primarily a Mediawiki
> system where I NEED  mail available. Any tips are appreciated. Thanks!John

Some clarification would help:

   * Do youi really need an email server on this machine, or do you just need 
the capability to send and receive email?  I guess I'm not familiar enough 
with Mediawiki--does it need an email server?

In my (old) installations of TWiki, the ability to send and receive email was 
all I needed.

[toc] | [prev] | [next] | [standalone]

#191088

On Sun 14 Jan 2018 at 12:49:46 -0500, rhkramer@gmail.com wrote:

> On Sunday, January 14, 2018 10:36:40 AM J.W. Foster wrote:
> > I am looking for a reliable step by step process for setting up an email
> > server located on an existing website server. I have installed;  exim4
> > light, dovecot, Thunderbird, OpenSSL, and TLS security. I have tried
> > following several bits of documentation regarding this with some success,
> > but as with every time I try this, I open up my system to SPAM at a
> > ridiculous rate. I want to eliminate that and get this mail server fully
> > operational. I am seeking a well-documented approach that I can follow. I
> > am using current Debian Stretch and the server is primarily a Mediawiki
> > system where I NEED  mail available. Any tips are appreciated. Thanks!John
> 
> Some clarification would help:
> 
>    * Do youi really need an email server on this machine, or do you just need 
> the capability to send and receive email?  I guess I'm not familiar enough 
> with Mediawiki--does it need an email server?
> 
> In my (old) installations of TWiki, the ability to send and receive email was 
> all I needed.

If you did not use a mail server, you were not *receiving* email but,
more than likely, *collecting* it.

-- 
Brian.

[toc] | [prev] | [next] | [standalone]

#191099

On Sunday, January 14, 2018 02:26:03 PM Brian wrote:
> On Sun 14 Jan 2018 at 12:49:46 -0500, rhkramer@gmail.com wrote:
> > On Sunday, January 14, 2018 10:36:40 AM J.W. Foster wrote:
> > > I am looking for a reliable step by step process for setting up an
> > > email server located on an existing website server. I have installed; 
> > > exim4 light, dovecot, Thunderbird, OpenSSL, and TLS security. I have
> > > tried following several bits of documentation regarding this with some
> > > success, but as with every time I try this, I open up my system to
> > > SPAM at a ridiculous rate. I want to eliminate that and get this mail
> > > server fully operational. I am seeking a well-documented approach that
> > > I can follow. I am using current Debian Stretch and the server is
> > > primarily a Mediawiki system where I NEED  mail available. Any tips
> > > are appreciated. Thanks!John
> > 
> > Some clarification would help:
> >    * Do youi really need an email server on this machine, or do you just
> >    need
> > 
> > the capability to send and receive email?  I guess I'm not familiar
> > enough with Mediawiki--does it need an email server?
> > 
> > In my (old) installations of TWiki, the ability to send and receive email
> > was all I needed.
> 
> If you did not use a mail server, you were not *receiving* email but,
> more than likely, *collecting* it.

Ok, but it worked and did what I needed to do.  And how many people would 
perceive a difference between receiving it and collecting it in casual usage of 
those words and in this context?

[toc] | [prev] | [next] | [standalone]

#191104

On Sun 14 Jan 2018 at 16:43:53 -0500, rhkramer@gmail.com wrote:

> On Sunday, January 14, 2018 02:26:03 PM Brian wrote:
> > On Sun 14 Jan 2018 at 12:49:46 -0500, rhkramer@gmail.com wrote:
> > > On Sunday, January 14, 2018 10:36:40 AM J.W. Foster wrote:
> > > > I am looking for a reliable step by step process for setting up an
> > > > email server located on an existing website server. I have installed; 
> > > > exim4 light, dovecot, Thunderbird, OpenSSL, and TLS security. I have
> > > > tried following several bits of documentation regarding this with some
> > > > success, but as with every time I try this, I open up my system to
> > > > SPAM at a ridiculous rate. I want to eliminate that and get this mail
> > > > server fully operational. I am seeking a well-documented approach that
> > > > I can follow. I am using current Debian Stretch and the server is
> > > > primarily a Mediawiki system where I NEED  mail available. Any tips
> > > > are appreciated. Thanks!John
> > > 
> > > Some clarification would help:
> > >    * Do youi really need an email server on this machine, or do you just
> > >    need
> > > 
> > > the capability to send and receive email?  I guess I'm not familiar
> > > enough with Mediawiki--does it need an email server?
> > > 
> > > In my (old) installations of TWiki, the ability to send and receive email
> > > was all I needed.
> > 
> > If you did not use a mail server, you were not *receiving* email but,
> > more than likely, *collecting* it.
> 
> Ok, but it worked and did what I needed to do.  And how many people would 
> perceive a difference between receiving it and collecting it in casual usage of 
> those words and in this context?

Not many in this context, probably. But precision and the desire to
educate has never been amongst the strong points of commentators on
email. You would soon notice the difference if you had to collect
your mail from a Royal Mail office instead of having it delivered.
Apart from having to travel to collect it, "spam" control is handled
differently in each case.

-- 
Brian.

[toc] | [prev] | [next] | [standalone]

#191115

On Mon 15/Jan/2018 00:19:24 +0100 Brian wrote:
> On Sun 14 Jan 2018 at 16:43:53 -0500, rhkramer@gmail.com wrote:
> 
>> On Sunday, January 14, 2018 02:26:03 PM Brian wrote:
>>> On Sun 14 Jan 2018 at 12:49:46 -0500, rhkramer@gmail.com wrote:
>>>> On Sunday, January 14, 2018 10:36:40 AM J.W. Foster wrote:
>>>>> I am looking for a reliable step by step process for setting up an 
>>>>> email server located on an existing website server. I have
>>>>> installed; exim4 light, dovecot, Thunderbird, OpenSSL, and TLS

Thunderbird isn't needed on a server

>>>>> security. I have tried following several bits of documentation
>>>>> regarding this with some success, but as with every time I try this,
>>>>> I open up my system to SPAM at a ridiculous rate. I want to
>>>>> eliminate that and get this mail server fully operational. I am
>>>>> seeking a well-documented approach that I can follow. I am using
>>>>> current Debian Stretch and the server is primarily a Mediawiki
>>>>> system where I NEED  mail available. Any tips are appreciated.
>>>>> Thanks!John>>>>
>>>> Some clarification would help:
>>>> * Do youi really need an email server on this machine, or do you just
>>>>   need>>>> the capability to send and receive email?  I guess I'm not
>>>>   familiar enough with Mediawiki--does it need an email server?>>>>
>>>> In my (old) installations of TWiki, the ability to send and receive
>>>> email was all I needed.>>>
>>> If you did not use a mail server, you were not *receiving* email but,
>>> more than likely, *collecting* it.
>> 
>> Ok, but it worked and did what I needed to do.  And how many people would
>> perceive a difference between receiving it and collecting it in casual
>> usage of those words and in this context?>
> Not many in this context, probably. But precision and the desire to
> educate has never been amongst the strong points of commentators on
> email. You would soon notice the difference if you had to collect
> your mail from a Royal Mail office instead of having it delivered.
> Apart from having to travel to collect it, "spam" control is handled
> differently in each case.

It may help to note explicitly that spam control includes the possibility to
whitelist known wiki contributors from /some/ filters --e.g. never skip
anti-virus; after all, even known contributors can have their email accounts
hijacked.

Since most email messages are sent in cleartext, it is also worth to note
explicitly the difference in terms of privacy between receiving and collecting.

For sending capabilities, many postmasters end up taking recourse to external
smart hosts because their IP address is in a tainted block, regularly thrown in
the Junk folder by some mailbox providers (e.g. hotmail).  The worthiness of
running a mail queue is lost in that case.

Ale

[toc] | [prev] | [next] | [standalone]

#191137

On Monday, January 15, 2018 04:39:17 AM Alessandro Vesely wrote:
> Since most email messages are sent in cleartext, it is also worth to note
> explicitly the difference in terms of privacy between receiving and
> collecting.

I don't understand, can you (or someone) attempt to clarify / amplify?

[toc] | [prev] | [next] | [standalone]

#191147

On Mon 15/Jan/2018 16:23:54 +0100 rhkramer wrote:
> On Monday, January 15, 2018 04:39:17 AM Alessandro Vesely wrote:
>> Since most email messages are sent in cleartext, it is also worth to note
>> explicitly the difference in terms of privacy between receiving and
>> collecting.
> 
> I don't understand, can you (or someone) attempt to clarify / amplify?

Personal (non-list) email messages happen to contain confidential information,
from innocent shopping preferences to passwords.  Although it is possible to
use end-to-end encryption to safeguard confidentiality, the vast majority of
messages are sent in cleartext.  A good percentage[*] of SMTP servers apply
transport encryption (STARTTLS), so the chances that a message is read in
transit are low.  However, the chances that MX servers can read cleartext
messages is 100%, which hence is the rate of trust users have to grant to their
mailbox providers.  The amount of info that can be extracted is directly
proportional to their AI skills, while what they do with it only depends on how
much greedy they are.

Given this state of affairs, the absence of a clean method for setting up an
email server is particularly obnoxious, IMHO.

Ale

[*] See, for example this 2014 stat:
https://www.facebook.com/notes/protect-the-graph/the-current-state-of-smtp-starttls-deployment/1453015901605223/

[toc] | [prev] | [next] | [standalone]

#191149

On Mon, Jan 15, 2018 at 01:51:30PM -0500, rhkramer@gmail.com wrote:
> Does the SMTP server encrypt both between it and the "client" and between it 
> and the other end destination / source?  

No, not always.  Plaintext SMTP is the default for transferring mail
from one server to another.  Basically, you should just assume that
anything you send in an email is readable by the entire world, unless
you encrypt the actual message itself (PGP, GnuPG, etc.).

[toc] | [prev] | [next] | [standalone]

#191151

On Monday, January 15, 2018 01:58:08 PM Greg Wooledge wrote:
> On Mon, Jan 15, 2018 at 01:51:30PM -0500, rhkramer@gmail.com wrote:
> > Does the SMTP server encrypt both between it and the "client" and between
> > it and the other end destination / source?
> 
> No, not always.  Plaintext SMTP is the default for transferring mail
> from one server to another.  Basically, you should just assume that
> anything you send in an email is readable by the entire world, unless
> you encrypt the actual message itself (PGP, GnuPG, etc.).

Ok, thanks.  I guess that's what I expected, and that it could almost more 
accurately be phrased--"almost never, unless you encrypt the actual message".

Thanks very much!

[toc] | [prev] | [next] | [standalone]

#191165

On Mon 15 Jan 2018 at 14:08:35 -0500, rhkramer@gmail.com wrote:

> On Monday, January 15, 2018 01:58:08 PM Greg Wooledge wrote:
> > On Mon, Jan 15, 2018 at 01:51:30PM -0500, rhkramer@gmail.com wrote:
> > > Does the SMTP server encrypt both between it and the "client" and between
> > > it and the other end destination / source?
> > 
> > No, not always.  Plaintext SMTP is the default for transferring mail
> > from one server to another.  Basically, you should just assume that
> > anything you send in an email is readable by the entire world, unless
> > you encrypt the actual message itself (PGP, GnuPG, etc.).
> 
> Ok, thanks.  I guess that's what I expected, and that it could almost more 
> accurately be phrased--"almost never, unless you encrypt the actual message".

You are confusing what the smtp delivery system can do with what *you*
can do before sending the mail. There is no connection between the two.

-- 
Brian.

[toc] | [prev] | [next] | [standalone]

#191154

On Mon, Jan 15, 2018 at 01:58:08PM -0500, Greg Wooledge wrote:
> On Mon, Jan 15, 2018 at 01:51:30PM -0500, rhkramer@gmail.com wrote:
> > Does the SMTP server encrypt both between it and the "client" and between it 
> > and the other end destination / source?  
> 
> No, not always.  Plaintext SMTP is the default for transferring mail
> from one server to another.  Basically, you should just assume that
> anything you send in an email is readable by the entire world, unless
> you encrypt the actual message itself (PGP, GnuPG, etc.).
> 

But these days most use encryption S2S and most clients do too.
I log on my server if they use TLS or not and all the big ones definitely
do. However between each hop the mail is unencrypted. If it sits at gmail
for example google can read the mail. There are a few exception worth
mentioning: for example protonmail. If I understand this correctly they
use your public key (pgp) and any unencrypted mail will be encrypted before
stored.

-H


-- 
Henning Follmann           | hfollmann@itcfollmann.com

[toc] | [prev] | [next] | [standalone]

#191150

On Monday, January 15, 2018 12:53:20 PM Alessandro Vesely wrote:
> On Mon 15/Jan/2018 16:23:54 +0100 rhkramer wrote:
> > On Monday, January 15, 2018 04:39:17 AM Alessandro Vesely wrote:
> >> Since most email messages are sent in cleartext, it is also worth to
> >> note explicitly the difference in terms of privacy between receiving
> >> and collecting.
> > 
> > I don't understand, can you (or someone) attempt to clarify / amplify?
> 
> Personal (non-list) email messages happen to contain confidential
> information, from innocent shopping preferences to passwords.  Although it
> is possible to use end-to-end encryption to safeguard confidentiality, the
> vast majority of messages are sent in cleartext.  A good percentage[*] of
> SMTP servers apply transport encryption (STARTTLS), so the chances that a
> message is read in transit are low.  However, the chances that MX servers
> can read cleartext messages is 100%, which hence is the rate of trust
> users have to grant to their mailbox providers.  The amount of info that
> can be extracted is directly proportional to their AI skills, while what
> they do with it only depends on how much greedy they are.
> 
> Given this state of affairs, the absence of a clean method for setting up
> an email server is particularly obnoxious, IMHO.

Thanks very much--that helps a lot, but due to my ignorance of email systems, 
let me ask a followup:

Does the SMTP server encrypt both between it and the "client" and between it 
and the other end destination / source?  

(My understanding of SMTP may be faulty, but, AIUI, if your ISP is your SMTP 
server, email is stored there (unless deleted) (so that you can access it from 
more than one of your computers.  Is it the transmittal between that server 
and your computer(s) that is encrypted, or between that server and the source 
/ destination of the email, or both?

[toc] | [prev] | [next] | [standalone]

#191162

On Mon 15 Jan 2018 at 13:51:30 -0500, rhkramer@gmail.com wrote:

> On Monday, January 15, 2018 12:53:20 PM Alessandro Vesely wrote:
> > On Mon 15/Jan/2018 16:23:54 +0100 rhkramer wrote:
> > > On Monday, January 15, 2018 04:39:17 AM Alessandro Vesely wrote:
> > >> Since most email messages are sent in cleartext, it is also worth to
> > >> note explicitly the difference in terms of privacy between receiving
> > >> and collecting.
> > > 
> > > I don't understand, can you (or someone) attempt to clarify / amplify?
> > 
> > Personal (non-list) email messages happen to contain confidential
> > information, from innocent shopping preferences to passwords.  Although it
> > is possible to use end-to-end encryption to safeguard confidentiality, the
> > vast majority of messages are sent in cleartext.  A good percentage[*] of
> > SMTP servers apply transport encryption (STARTTLS), so the chances that a
> > message is read in transit are low.  However, the chances that MX servers
> > can read cleartext messages is 100%, which hence is the rate of trust
> > users have to grant to their mailbox providers.  The amount of info that
> > can be extracted is directly proportional to their AI skills, while what
> > they do with it only depends on how much greedy they are.
> > 
> > Given this state of affairs, the absence of a clean method for setting up
> > an email server is particularly obnoxious, IMHO.
> 
> Thanks very much--that helps a lot, but due to my ignorance of email systems, 
> let me ask a followup:
> 
> Does the SMTP server encrypt both between it and the "client" and between it 
> and the other end destination / source?  

Use of TLS is explained here:

https://www.gov.uk/government/publications/email-security-standards/transport-layer-security-tls

Note "...in transit between computers..."

> (My understanding of SMTP may be faulty, but, AIUI, if your ISP is your SMTP 
> server, email is stored there (unless deleted) (so that you can access it from 
> more than one of your computers.  Is it the transmittal between that server 

Your ISP is not *your* smtp server. You do not have an smtp server. You
have a collection facility from your ISP.

> and your computer(s) that is encrypted, or between that server and the source 
> / destination of the email, or both?

The second. The mail is encrypted by the sender and transmitted to the
receiver. You are not the receiver. All you do is collect it from the
receiver. While the receiver has it, anyone with access to their systems
can read it. I think this is the point Alessandro Vesely was making.
Greg Wooledge's point is a different one because it depends (partly) on
TLS not being used.

Analogy: you give a letter to a trusted friend with instructions to
deliver it directly to A, the intended recipient. 

You give a letter to a trusted friend with instructions to deliver it
directly to B, a convenient drop-off point for mail. A *collects* it
from B.

Both methods work. Which one is the more secure?

(Points are available for the correct answer :) ).

-- 
Brian.


> 

[toc] | [prev] | [next] | [standalone]

#191228

On Monday, January 15, 2018 01:51:30 PM rhkramer@gmail.com wrote:
> (My understanding of SMTP may be faulty, but, AIUI, if your ISP is your
> SMTP server, email is stored there (unless deleted) (so that you can
> access it from more than one of your computers.  

For the record:

   1) My statement above is wrong / misleading.  It turns out that I was 
thinking of IMAP when I described a server that keeps email stored on the 
(computer with) the IMAP server (often your ISP).

   2) I should usually refrain from discussions on email, although  I set up a 
few email servers a long time ago (15 years??) they were cookie cutter copies 
of each other, and didn't deal with many things that should be dealt with 
these days (and probably should have been dealt with back then).

[toc] | [prev] | [next] | [standalone]

#191157

[Multipart message — attachments visible in raw view] — view raw

On 2018-01-15 00:19, Brian wrote:
> On Sun 14 Jan 2018 at 16:43:53 -0500, rhkramer@gmail.com wrote:
>
>> On Sunday, January 14, 2018 02:26:03 PM Brian wrote:
>>> On Sun 14 Jan 2018 at 12:49:46 -0500, rhkramer@gmail.com wrote:
>>>> On Sunday, January 14, 2018 10:36:40 AM J.W. Foster wrote:
>>>>> I am looking for a reliable step by step process for setting up an
>>>>> email server located on an existing website server. I have installed; 
>>>>> exim4 light, dovecot, Thunderbird, OpenSSL, and TLS security. I have
>>>>> tried following several bits of documentation regarding this with some
>>>>> success, but as with every time I try this, I open up my system to
>>>>> SPAM at a ridiculous rate. I want to eliminate that and get this mail
>>>>> server fully operational. I am seeking a well-documented approach that
>>>>> I can follow. I am using current Debian Stretch and the server is
>>>>> primarily a Mediawiki system where I NEED  mail available. Any tips
>>>>> are appreciated. Thanks!John
>>>> Some clarification would help:
>>>>    * Do youi really need an email server on this machine, or do you just
>>>>    need
>>>>
>>>> the capability to send and receive email?  I guess I'm not familiar
>>>> enough with Mediawiki--does it need an email server?
>>>>
>>>> In my (old) installations of TWiki, the ability to send and receive email
>>>> was all I needed.
>>> If you did not use a mail server, you were not *receiving* email but,
>>> more than likely, *collecting* it.
>> Ok, but it worked and did what I needed to do.  And how many people would 
>> perceive a difference between receiving it and collecting it in casual usage of 
>> those words and in this context?
> Not many in this context, probably. But precision and the desire to
> educate has never been amongst the strong points of commentators on
> email. You would soon notice the difference if you had to collect
> your mail from a Royal Mail office instead of having it delivered.
> Apart from having to travel to collect it, "spam" control is handled
> differently in each case.

I would not recommend having a emailserver on the same server as a
website, because if the website is compromised the "hacker" can just use
the mail() function
to send emails in your name.
As other people already have said - do you really need emailserver of
this kind?
And why is Thunderbird installed on that particular machine?

/ Jonathan

[toc] | [prev] | [next] | [standalone]

#191158

On Mon, Jan 15, 2018 at 08:34:33PM +0100, Jonathan Sélea wrote:
> I would not recommend having a emailserver on the same server as a
> website, because if the website is compromised the "hacker" can just use
> the mail() function
> to send emails in your name.

This can be done regardless of whether the email server is physically
the same computer as the web server.  That separation (or lack thereof)
is not relevant.

[toc] | [prev] | [next] | [standalone]

#191160

On Mon, Jan 15, 2018 at 08:34:33PM +0100, Jonathan Sélea wrote:
> 
> 
> On 2018-01-15 00:19, Brian wrote:
> > On Sun 14 Jan 2018 at 16:43:53 -0500, rhkramer@gmail.com wrote:
> >
> >> On Sunday, January 14, 2018 02:26:03 PM Brian wrote:
> >>> On Sun 14 Jan 2018 at 12:49:46 -0500, rhkramer@gmail.com wrote:
> >>>> On Sunday, January 14, 2018 10:36:40 AM J.W. Foster wrote:
>
[...] 
> I would not recommend having a emailserver on the same server as a
> website, because if the website is compromised the "hacker" can just use
> the mail() function
> to send emails in your name.

so can she/he if the mailserver is on a different host. That doesn't make
any difference.


> As other people already have said - do you really need emailserver of
> this kind?

This however is a valid question. A full functional mailserver requires
effort and administrative knowledge to setup properly. And your question
already hints that the latter is no there yet.

> And why is Thunderbird installed on that particular machine?
> 
> / Jonathan
> 


-H

-- 
Henning Follmann           | hfollmann@itcfollmann.com

[toc] | [prev] | [next] | [standalone]

#191161

[Multipart message — attachments visible in raw view] — view raw

>> I would not recommend having a emailserver on the same server as a
>> website, because if the website is compromised the "hacker" can just use
>> the mail() function
>> to send emails in your name.
> so can she/he if the mailserver is on a different host. That doesn't make
> any difference.
It would, because other mailservers would deny emails from that one
because it would fail authentication (SPF, DKIM, DMARC for example).

[toc] | [prev] | [next] | [standalone]

#191168

On Mon, Jan 15, 2018 at 08:56:20PM +0100, Jonathan Sélea wrote:
> >> I would not recommend having a emailserver on the same server as a
> >> website, because if the website is compromised the "hacker" can just use
> >> the mail() function
> >> to send emails in your name.
> > so can she/he if the mailserver is on a different host. That doesn't make
> > any difference.
> It would, because other mailservers would deny emails from that one
> because it would fail authentication (SPF, DKIM, DMARC for example).
> 
Your webserver having a method to use a smarthost, using an external
mailserver can be abused when compromised. So no win here. Still exploited
once the attacker is on the system. It will just use the same smarthost
with the webservers credentials and the mailserver will happily relay the
spam. 

-H


> 
> 
> 
> 



-- 
Henning Follmann           | hfollmann@itcfollmann.com

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | linux.debian.user

csiph-web