Chapter 9. Securing Internet Email
Like DNS, email's
importance and ubiquity make it a prime target for vandals, thieves,
and pranksters. Common types of email abuse include the following: Eavesdropping confidential data sent via email "Mail-bombing" people with bogus
messages that fill up their mailboxes or crash their email servers Sending messages with forged sender addresses to impersonate someone
else Propagating viruses Starting chain letters (hoaxes) Hijacking the email server itself to launch other types of attacks Sending unsolicited commercial email (UCE), a.k.a.
"spam"
The scope and severity of these threats are not helped by the
complexity of running Internet email services, including both
Mail Transfer Agents (MTAs) and Mail
Delivery Agents (MDAs). Email administration requires a working
understanding of the Simple Mail
Transfer Protocol (SMTP) plus your MDA protocol of choice (typically
IMAP or POP3), as well as a mastery of your MTA and MDA applications
of choice. There really aren't any shortcuts around
either requirement (although some MTAs and MDAs are easier to master
than others). There are a number of MTAs in common use.
Sendmail is the
oldest and traditionally the most popular.
Postfix is a more
modular, simpler, and more secure alternative by Wietse
Venema.
Qmail is another
modular and secure alternative by Daniel J. Bernstein.
Exim is the default MTA
in Debian GNU/Linux.
And those are just a few! In this chapter, we'll cover some general email
security concepts, and then we'll explore specific
techniques for securing two different MTAs: Sendmail, because of its
popularity, and Postfix, because it's my preferred
MTA. But we won't stop there! As important as MTAs are, your users don't interact
directly with them; most users retrieve mail via a Mail Delivery
Agent (MDA) service such as POP3 or IMAP (or a web interface that
interacts with an MDA). Therefore we'll also cover
MDA security basics, how to secure the popular Cyrus IMAP MDA with
both SSL and LDAP, and then end with a brief discussion of email
encryption. |