Linux Server Security (2nd Edition( [Electronic resources] نسخه متنی

9.3. Securing Your MTA

Now we come to the specifics: how to
configure SMTP server software securely. But which software should
you use?

My own favorite MTA is
Postfix. Wietse
Venema, its
creator, has outstanding credentials as an expert and pioneer in
TCP/IP application security, making security one of the primary
design goals. What's more, Postfix has a very low
learning curve: simplicity is another design goal. Finally, Postfix
is extremely fast and reliable. I've never had a bad
experience with Postfix in any context (except the self-inflicted
kind).

Qmail also has an
enthusiastic user base. Even though it's only
slightly less difficult to configure than Sendmail,
it's worth considering for its excellent security
and performance. D. J. Bernstein's official Qmail
web site is at http://cr.yp.to/qmaill.

Exim, another highly
regarded mailer, is the default MTA in Debian GNU/Linux. The official
Exim home page is http://www.exim.org, and its creator, Philip
Hazel, has
written a book on it, Exim: The Mail Transfer
Agent (O'Reilly).

I mention Qmail and Exim because they each have their proponents,
including some people I respect a great deal. But as I mentioned at
the beginning of the chapter, Sendmail and Postfix are the MTAs
we're going to cover in depth here. So if
you're interested in Qmail or Exim,
you'll need to refer to the URLs I just pointed out.

After you've decided which MTA
to run, you need to consider how
you'll run it. An SMTP gateway that handles
all email entering an organization from the Internet and vice versa
but doesn't actually host any user accounts will
need to be configured differently from an SMTP server with local user
accounts and local mailboxes.

The next two sections are selective tutorials on Sendmail and
Postfix. I'll cover some basic aspects (but by no
means all) of what you need to know to get started on each
application, and then I'll cover as much as possible
on how to secure it. Where applicable, we'll
consider configuration differences between two of the most common
roles for SMTP servers: gateways and what I'll call
"shell servers" (SMTP servers with
local user accounts).

Both Sendmail and Postfix are capable of serving in a wide variety of
roles and therefore support many more features and options than I can
cover in a book on security. Sources of additional information are
listed at the end of this chapter.