Russell Coker <russell@coker.com.au> writes:

On Sun, 30 Dec 2012, chris@chrisbailey.au.com wrote:

...

I've just moved to Postfix from SendMail on a new hosting server I have built, just wanting to hear of any issues anyone has had, if any, with putting postfix in a chroot jail.

In a default configuration Postfix uses a chroot for some of it's own processes. See field 4 in /etc/postfix/master.cf.

Generally Postfix uses minimum privileges for it's processes and it has a really good security history (unlike Sendmail) so you probably don't need to do anything more.

+1. Security-wise, postfix is one of my least concerns. I run each service inside its own container (LXC). I give each container its own rootfs, but it's not exactly minimal -- they each run syslogd and sshd and have apt and suchlike. I presume that's not what you're talking about. Also, to avoid going completely insane, I am obliged to host postfix and dovecot in the same container. If I ran mailman, it would also have to go in the same container. I've also deployed zimbra (which contains postfix) in anger, but I'm pretty sure it was under KVM, not LXC.

hannah commodore <hannah@tinfoilhat.net> writes:

...

Roundcube Webmail client 0.7.3 if you are concerned with security, I'd entirely avoid running roundcube.. I've had nothing but trouble with it

Ah, I didn't spot that part of the original post. I have a blanket ban on PHP for security reasons, so I never looked closely at roundcube or squirrelmail. I *did* find prayer. It's written in C, speaks HTTP/HTTPS to the front end (so no need for apache or fastcgi on the same host), and IMAP/IMAPS to the backend (so you *will* need dovecot). It's old-school enough that it works in proper browsers (like w3m) as well as fancy-pants bloaty ones. I can recommend it with the following caveats: - it has two themes. You want the newer, non-default one. - it's an OK fallback MUA, but you don't want to use it every day. - for some bizarre reason when I put it behind an apache reverse proxy (to do the LDAP auth layer), clicking on an attachment doesn't work. apache returns a 404 without even asking prayer for the attachment. The URLs look the same, so I'm completely stuck on that one.

Quoting Christopher M. Bailey (chris@chrisbailey.au.com):

Thanks for the recommendation, but this is for hosting emails for corporate customers, so having issues with attachments would be an issue, most are using M$ Outlook as their main MUA, but I'm needing a nice web based one for when they are not in their offices.

Trent did say the problem arises only when he puts it behind an Apache reverse proxy. ('Hope that helps!) -- Cheers, Nothing's hotter than having a copyeditor correct your sex scenes. Rick Moen -- Max Barry rick@linuxmafia.com McQ! (4x80)