Solved: Sendmail question. Problem with yahoo.

[Coleman Kane]

On Mon, 2008-04-14 at 11:55 -0400, Tom Buskey wrote:
> 
> 
> On Mon, Apr 14, 2008 at 11:34 AM, Ben Scott <dragonhawk at gmail.com>
> wrote:
>         On Mon, Apr 14, 2008 at 10:59 AM, Tom Buskey <tom at buskey.name>
>         wrote:
>         > Sendmail has a long history of security problems.
>         
>         
>          I have to point out that the above statement would be equally
>         true
>         if one wrote "Unix" instead of "Sendmail".  (This is not a
>         snide
>         remark, although it may qualify as "subtle".)
> 
> I can't disagree with you there.  I used to work at a paranoid
> security firm.  Sendmail was written by 1 person & they avoided all
> code by that person because of the coding techniques/style lent itself
> to buffer overflows.  Unix had many more authors and different coding
> styles.  
> 
> 
>           Separate from the above: From what I know if it, Postfix has
>         a more
>         modular design than Sendmail.  Such designs usually lend
>         themselves to
>         task isolation and least-privilege, which is usually good for
>         security.  It's interesting, but despite Sendmail's more
>         flexible
> 
> Security was part of the design goal from day one.  Sendmail was
> created in a different era.  In fact, the 1st internet worm in 1988
> was enabled because of the root access backdoor written into Sendmail.
> That stuff isn't in Sendmail anymore of course. 
> 
> 
>         design, implemention of these concepts came later.  When they
>         did
>         arrive, though, they were implemented using the same Sendmail
>         configuration facilities already existent.  I'm not sure that
>         last
>         part really matters, much, though.  The source code to
>         everything is
>         readily available.  What difference does it make if one has to
>         write a
>         new .c file vs a new .cf file?  That might matter on a
>         slavery-software platform, but surely we all know that story
>         by now.
>         
>          It may be worth noting that Postfix was created by Wietse
>         Venema,
>         the same person who created tcp_wrappers.
> 
> Qmail was written by DJ Bernstien, also with a security mindset.

Additionally to this, djb has a long-standing (since 1997) reward of
$500 for anybody who can publish a verifiable security crack against
qmail. Since then, nobody has been able to provide this.

> 
> I know Qmail hasn't accepted outside code.  I don't think Sendmail
> has.  Does Postfix? Does Exim? Does any MTA have multiple authors?
> 

I believe that postfix is still maintained by the original author,
although he does accept patches for review and inclusion. Exim is
maintained by a group at the University of Cambridge (UK), though I
don't know how central the project's structure is regarding the main
author.

I really do have to say that my favorite all-time mailserver has been
qmail. The one thing qmail lacks is many of the more complex and regular
features that are common with systems like Postfix, Exim, and Sendmail,
as well as integration with heavier-weight IMAP back-ends. There is a
large amount of qmail-specific software out there, and I found qmail's
code to be wonderful to hack on when I needed to add extra features
(such as editing qmail-smtpd to do more stuff at the SMTP-end).

I haven't found a mailserver that scales better than qmail either for
handling gigantic amounts of email flow. That said, finding others with
the breadth of knowledge that I have on qmail proves quite difficult.
For our IT clients, we just use Postfix because it is something that
"everyone can administer" (hooray pragmatism).

At "previous job", I hosted all client mail (for 30k+ domains) through
two machines using one as the mail-store (w/ courier-imap) and one as
the front-end filter/remailer (for email forward accounts). It was
wonderful.

-- 
Coleman Kane