Re: [Exim] Does Exim have security problems?

Página Principal
Apagar esta mensagem
Responder a esta mensagem
Autor: Andromeda
Data:  
Para: Exim
Assunto: Re: [Exim] Does Exim have security problems?
At 18:51 29/08/2000 +0600, you wrote:
>This is exactly the reason for my original posting, my primary need is the
>ease of configuring, but security is also vital as I am sure that all of
>you would agree.


Mustapha,

I have had a *nix box online for the last 4 or so years. It was actively
attacked quite a few times, and only in April this year it was breached due
to a weak user password (and boy did that user suffer the consequences).

I had Sendmail on that machine for exactly 8 days, because I wanted virtual
domain processing (one of the sample configurations included with Exim is
mine), and because I KNEW about the sendmail exploits out there.

The solution? Exim. First I ran 1.90, and then upgraded to version 3.04
when it came out. It was configurable, it was safe (and it still is), it
did the job efficiently.

>But unlike you when I discusses MTA's with my collegues all of them seemed
>to say that for 100% security there is only one MTA and thats Qmail blah
>blah, then they go to explain why modular designs are much better than


QMAIL is ugly for a beginner. You have to create more users than I like,
you have to do stuff that makes replacing sendmail a mess. It may be
modular, and has dedicated daemons that do stuff for you, but is is really
NECESSARY to run all that stuff under their own users the whole time? It
makes life harder for the administrator.

>than sendmail regarding security etc.qmails authour has a 1000$
>reward and etc etc..until I wonder what is truth and what is untruth.


A $1,000 reward does not mean it's safe. DOS attacks were left out of the
equation (which I'd say is what tips the balance in favour of Exim).

>at the single config file and it looks good, much more easier to configure
>than sendmail and very well documented too, also the installation appears
>to be very straightforward too.


Then tell your colleagues to shove off and do your own thing.

>Sorry, but I get the impression that you do not seem to like my request
>for information. I am sorry that I troubled you, you see my english isn't


Well, the "my MTA is better than your MTA" issue is a bone of contention.
My suggestion:

1. Install Exim. Toy with it. Try to configure it using the helpfiles to
your specifications. Subscribe to the mailing list and ask a "complicated"
question. Look at the responses.

2. Install QMail. Do as above.

3. Install Postfix. Do as above.

Which one does the better job? Which one are YOU comfortable dealing with?
What is your general feeling of support? THAT is the one you should go with.

With Regards

Andromeda

- The Andromeda HTML Workshop - http://www.htmlworkshop.com/
Home of Search & Replace 98