OpenSMTPD

https://www.opensmtpd.org/

by rdpintqogeogsaa • 4 years ago

98 34 4 years ago

opensmtpd.org

chasil3• 4 years ago

This had a showstopper bug a few years ago that could completely compromise a host.

I don't usually need this, so I disable it.

https://blog.qualys.com/vulnerabilities-threat-research/2020...

paulnpace3• 4 years ago

The problem I find with this line of reasoning is at the end of the evaluation I've disconnected from all networks and powered down the devices after uninstalling all of the operating systems.

ori_b• 4 years ago

The postmortem is worth reading:

https://poolp.org/posts/2020-01-30/opensmtpd-advisory-dissec...

It's worth reading through the systemic mitigations that would make a clone of this bug impossible in the future.

chasil3• 4 years ago

Interesting that the problem was introduced in a major architecture change to external MDAs, invoked with system(), and was specific to mbox format that requires elevated privilege.

I think that I will keep this disabled.

asveikau• 4 years ago

They actually had a few really bad code execution bugs in a tight space of time a few years ago when someone was auditing it. It's a good idea to subscribe to announce@openbsd.org if you run this daemon to get notified of issues.

I was running it out of ports on FreeBSD at that time, and wound up patching from source because i didn't want to wait for the ports tree to update.

I still see attempts to exploit these bugs in my logs. Even though they've been patched for years.

That said, it's good that these were exposed and fixed, as opposed to not found. It's a relatively new daemon compared to other mail servers and it was still ironing things out.

jacob019• 4 years ago

How does it compare to postfix?

traceroute662• 4 years ago

How does it compare to postfix?

I haven't done a detailed comparison, but going how the OpenBSD guys go with other re-implementations (e.g. LibreSSL vs OpenSSL), I'm going to guess that it will have a reduced feature-set and capabilities.

I've nothing against the OpenBSD guys, but sometimes its a case of "right tool for the job". OpenBSD is great for firewalls and routers. Of course OpenSSH is without competitor, its just awesome.

But (some of) the rest of the OpenBSD toolset I'm not too sure ... for example Chrony is lightyears ahead of OpenNTPD etc.

Postfix is an excellent MTA. Written from a security-first mentality. Its widely deployed, and hence battle tested. As a result of its wide deployment its pretty much a case of "everyone knows how it works", the Postfix mailing list is excellent in terms of getting support.

TL;DR personally I see no reason to replace Postfix with anything, be it OpenSMTPD or anything else.

chasil3• 4 years ago

I would guess that the IBM/Eclipse license was a major problem from a BSD perspective.

"OpenSMTPD is a fairly complete SMTP implementation."

swixmix• 4 years ago

OpenSMTPD is the right answer if you want a general purpose mail server [1] that is secure by default. [2]

[1] https://poolp.org/posts/2021-01-31/january-2021-opensmtpd-li...

[2] https://www.openbsd.org/security.html

buzzlightyear32• 4 years ago

I use OpenNTPD on my router. Apparently time on local network is "exact" (off by some 50 ms) which is good enough for me. I don't need my clocks to be light years ahead indeed.

YPPH• 4 years ago

OpenSMTPD is far easier to configure and far harder to mistakenly misconfigure.

paulnpace3• 4 years ago

As with most things, it depends on your use case. Except for some very high-volume or ancient features, it has pretty much everything.

However, unlike Postfix, you can actually configure OpenSMTPD yourself without breaking it. Postfix suffers heavily from a Byzantium configuration that everyone is copy-pasting because understanding how to create a configuration from scratch requires man-months of reading their docs.

The biggest downside to OpenSMTPD is the portable version is weakly supported, so it's only useful if you are running it on OpenBSD, which is a shame, really, because it's probably what most people would prefer if they could run it on their preferred OS.

phsau• 4 years ago

We run Postfix at a large, high-volume scale and I can confirm OpenSMTPD does not have the feature/configuration set to work as a replacement. Postfix is great in this regard because it has near endless configurability, but it comes at the cost of complexity.

ok123456• 4 years ago

I remember when postfix was the "easier" MTA software meant to replace Sendmail and all of its m4 macros for rules. Getting Sendmail to do anything other than be a completely open relay was not easy.

atmosx• 4 years ago

Much easier to configure and operate. I don’t know performance wise since I only run my personal smtpd on both more than 10 years ago.

daneel_w2• 4 years ago

Leaps and bounds simpler and faster to configure. A basic setup for receiving and sending mail is about 10-12 lines of human-readable config.

ape4• 4 years ago

That's what people used to say about Postfix vs Sendmail

sylware• 4 years ago

self-hosted: wrote my own at the right scale.

gorgoiler• 4 years ago

Native SRS is a nice thing to have, especially if you are forwarding to Gmail.

A shame that DKIM wasn’t built in too, but there’s a filter/plug-in architecture and you can add a third party filter to do DKIM for you.

Sometimes a commitment to supporting a plug-in architecture can be a little overzealous. Yes, it’s a nice general purpose puzzle to solve if you are the engineer writing the code. When DKIM is such a critical part of email in 2022, I wouldn’t mind if it were treated as a special case and supported by default.

daneel_w2• 4 years ago

I use DKIMproxy. It's "abandonware" so there won't ever be any ed25519 support, but it gets the job done nevertheless.

hardwaresofton2• 4 years ago

This project looks cool but:

https://maddy.email/

https://blitiri.com.ar/p/chasquid/

medo-bear• 4 years ago

but what?

hardwaresofton2• 4 years ago

Ah sorry —- but these are easier to run, come with imap, automatic dkim and other awesome features

SahAssar• 4 years ago

I was hoping for this to be openttd but for routing email.

OpenSMTPD

Related Stories