Security issue: SMTP and qmail

Hi, I have set up an internal mailserver based on qmail and RH6.2 behind a firewall. There are some security aspects in which I am not sure about. If SMTP is opened in the firewall, the machine could easily be hacked I assume. Are there any recommendations how to secure smtp on qmail? Thx!

Re: Security issue: SMTP and qmail

On Thu, Feb 01, 2001 at 02:53:48PM +0100, Marcus Korte wrote: Hi, I have set up an internal mailserver based on qmail and RH6.2 behind a firewall. There are some security aspects in which I am not sure about. If SMTP is opened in the firewall, the machine could easily be hacked I assume.

Re: Security issue: SMTP and qmail

If security is a concern then you might not want to be running RedHat On Thu, Feb 01, 2001 at 02:53:48PM +0100, Marcus Korte wrote: Hi, I have set up an internal mailserver based on qmail and RH6.2 behind a firewall. There are some security aspects in which I am not sure about. If SMTP

Re: Security issue: SMTP and qmail

On Thu, Feb 01, 2001 at 11:04:03AM -0600, Graphic Rezidew wrote: If security is a concern then you might not want to be running RedHat At least, not an unmodified RedHat. My typical post-install procedure is to either remove or disable anything that doesn't need to be running (in terms of

Re: Security issue: SMTP and qmail

* Bruce Guenter [EMAIL PROTECTED] writes: On Thu, Feb 01, 2001 at 11:04:03AM -0600, Graphic Rezidew wrote: If security is a concern then you might not want to be running RedHat At least, not an unmodified RedHat. My typical post-install procedure is to either remove or disable anything

Re: Security issue: SMTP and qmail

On Thu, Feb 01, 2001 at 09:03:30PM +0100, Robin S. Socha wrote: OK, so after the next GNOMEified update, you start from scratch. Who puts GNOME on a server? Who puts server software on a GNOME desktop? To my mind they're seperate. Besides, I generally ignore updates to critical systems until

security issue

Hello, Running a network test against my recent qmail installation, I get reports on the mailto programs hole, which allows users to telnet to port 25 and issue: MAIL FROM: root@this_host RCPT: any program This allows users to potentially execute any command with root authority. The warning

Re: security issue

Quoting John Steniger ([EMAIL PROTECTED]): Running a network test against my recent qmail installation, I get reports on the mailto programs hole, which allows users to telnet to port 25 and issue: MAIL FROM: root@this_host RCPT: any program Huh. I've never heard of this exploit! Now,

Re: security issue

It is not an issue. I don't remember if qmail will silently drop these messages or return a bounce for them, but it most certainly will not run any programs as root because of them. ScottG. John Steniger [EMAIL PROTECTED] writes: Hello, Running a network test against my recent qmail

Security Issue on qmail

Hello, I am a rookie on using qmail, but I can feel the power of it, really amazing. I have several questions about the implementation of qmail. If possible, please give me some advice. Thanks. (1) Anti-relay Issue Any security risk about Mail Relaying? If I really want to get rid of relay,

Re: Security Issue on qmail

On Tue, Sep 07, 1999 at 05:39:15PM +0800, [EMAIL PROTECTED] wrote: Hello, I am a rookie on using qmail, but I can feel the power of it, really amazing. I have several questions about the implementation of qmail. If possible, please give me some advice. Thanks. (1) Anti-relay Issue

Re: Security Issue on qmail

On Tue, 7 Sep 1999 [EMAIL PROTECTED] wrote: Hello, I am a rookie on using qmail, but I can feel the power of it, really amazing. I have several questions about the implementation of qmail. If possible, please give me some advice. Thanks. (1) Anti-relay Issue Any security risk

Re: Frustrating sort of security issue with virtual domains

D J Bernstein [EMAIL PROTECTED] writes: (Also, the SMTP server will automatically disallow addresses with a particular suffix, so that you can set up private domains without worrying about what's in rcpthosts. I haven't decided yet what the magic suffix will be.) I believe .invalid has been

Frustrating sort of security issue with virtual domains

I've always liked the way that qmail separated rcpthosts from locals and virtualdomains, so that you can have private virtual domains for your local and LAN users not visible to the outside. This lets me have, say, a fax gateway where I set up, say. fax.example.org in virtualdomains but not

Re: Frustrating sort of security issue with virtual domains

John R Levine writes: [EMAIL PROTECTED] | bouncesaying 'Permission denied' [ "@$HOST" != "@fax" ] Or I could move everything out of the local domain, make everything a virtual domain and empty out locals. That surely is not the right solution. It's actually not too hard to do with