Hello Zakaria,
I agree if port 25 is open it would work just fine, but how to get around
the fact that GCP block port 25?
On Sat, Feb 19, 2022 at 2:05 PM Zakaria <hi@???> wrote:
> Hi Terrence, Mohamed,
>
> If port 25 on such SMTP server is open and accessible remotely then EHLO
> command will work, and if not then at such point it is not possible to be
> initiated since its port is not accessible and this is the point where EHLO
> wouldnt work. To check ports accessibility, I advise to refer to port
> checkers tools and online services, insert server IP and check if the
> relevant port is open or use the following command:-
>
> ss -alpnt | grep '25'
>
> I'm really sorry for not being able to help in configuring by myself, its
> just I've many things to do while I would love to but I'm happy to answer
> any question to any issue you might face. I advise to just hit the ground
> and start compiling and installing dovecot and exim and things will be easy
> once you start setting up the configuration files.
>
> With good luck.
>
> Zakaria.
>
> On 19 Feb 2022 17:42, Terrance Devor via Exim-users <exim-users@???>
> wrote:
>
> Hello Zakaria,
>
> - Adding Mohamed who is our CTO
>
> Please see my comments inline
>
>
> On Mon, Feb 7, 2022 at 5:26 PM Zakaria via Exim-users <exim-users@???>
>
> wrote:
>
> > Hi Terrance,
> > Here is my input.
> > I have configured EXIM with dovecot in VPS, I think it would be
> doable
> > in similar way to docker containers I presume and if its not then
> seems
> > the issues would be along the lines of just requiring ports opening,
> > although I used not port 26 nor I found any need in my VPS setup but
> I
> > read somewhere GCP blocks 25 and people turn to 26 as unique one thus
> > needs to be opened for SMTP authentications and connections.
> >
>
> Agreed, the setup will be very similar and we will need to setup the
> correct IN/EGRESS rules to setup the ports for SMTP/IMAP. The idea is to
> setup EXIM/Dovecot with emails persisted to a filesystem. IMAP/POP will be
> configured to force our employees to download the emails onto their local
> machines after the quote (200MB) has been met. I am a little confused by
> the whole use port 26 instead of port 25, whould EHLO attempt from other
> SMTP servers still work? Would they not attempt the EHLO on port 25? At
> which point the EHLO attempt would fail.
>
>
> > In regards security implementation to handle DKIM, SPF, DMARC and
> DANE
> > I recommend sidn.nl tutorials on how to configure them, they offered
> me
> > great resource to understand how it works and, as always with me
> while
> > its depending on your security ideals still I suggest to loosen
> sidn.nl
> > denys to warning so to make sure all emails are received and perhaps
> > add headers indicating which validation fails in case there was, and
> > using sieve forward to spam with rewritten subject, e.g. content is
> > likely spam, rewrite " spam content ", and in the event of DKIM
> failure
> > either bad or invalid signature, then add DKIM failure accordingly,
> > etc. Refer to
> >
> https://www.sidn.nl/en/modern-internet-standards/hands-on-implementing-
> > spf-dkim-and-dmarc-in-exim
> >
> https://www.sidn.nl/en/news-and-blogs/hands-on-implementing-dane-in-exi
> > m
> >
>
> This will be very important. Because this is for corporate emails we don't
> want to ask our clients to check their SPAM folder...
>
>
>
> > I have not tested Postfix but so far EXIM as MTA and Dovecot as IMAP
> > Server, together works just perfectly, therefore I recommend using
> them
> > over Postfix.
> >
>
> We also want to go with EXIM/Dovecot with spam and virus detection.
>
>
> > Also, I recommend to secure EXIM and Dovecot so to handle connections
> > only over SSL, I think its better to enable mail server over SSL and
> > disable STARTTLS i.e. enable port 465 for SMTP and 993 for IMAP and I
> > guess 995 for POP3 to enable SSL as well as disable 587, 143 and 110
> to
> > disable STARTTLS and require ssl i.e. encryption in SMTP
> > authentications and IMAP as well as POP3 connections, since it seems
> > STARTTLS is prune to some attack vectors, refer
> > to https://nostarttls.secvuln.info/
>
>
> I configured something very similar when I setup my own email server 15
> years ago. Would love to see the same setup (ie, use of SSL with disabled
> STATTLS and enabling ports 465/993 only and disable the rest) We need a
> very secured email server instance that require employees to get on the
> company VPN to send/receive email.
>
> >
> > In terms of ssl library, I compiled recent EXIM master against latest
> > openssl, I guess 3.0.1 and it works perfectly with no issues.
> > Lastly its ARC, I am currently working on configuring ARC
> experimental,
> > so far the EXIM experimental documentation seems to be a good
> starting
> > point. I've not finished, and there could be out there more
> elaborative
> > sources other than EXIM notes, so I recommend to do further research
> on
> > your own. It seems generally its all about adding several blocks in
> > ACLs and options in transports and routers along enabling ARC flag
> > during compilation.
> > I hope you find my input helpful, with good luck.
> > Zakaria.
> >
>
> As discussed, I setup an email server on a 2U which I had in my home about
> 10 years ago EXIM4 days.... Currently, technical work is well over my
> ability and would really appreciate if you guys would help us deploy this
> on our K8S cluster.
>
> We have a small budget that I could put towards settting up a fully
> secured
> EXIM and dovecot server on our Kuberntes cluster. We would package up the
> custom docker image, we need someone to help in the configuration and lock
> everything down for a secure email service that is fully verified.
>
> Can you please help?
>
>
>
>
> > On 5 Feb 2022 15:01, Byung-Hee HWANG via Exim-users
> > <exim-users@???> wrote:
> >
> > Terrance Devor via Exim-users <exim-users@???> writes:
> > > To add some additional information regarding what we are trying
> to
> > achieve:
> > >
> > > - An email server as a docker container. Prefer EXIM however
> > Postfix would
> > > work
> > > - A POP3/IMAP server as a docker container
> > >
> > > The containers will be deployed to a kubernetes cluster on GCP.
> We
> > also
> > > want DKIM and all the verification to work perfectly. This is for
> > my own
> > > company, security is a must :)
> > >
> > > Can anyone please help guide in the right direction?
> > As you know, all bytes are money on GCP, AWS and other Cloud
> > services. So i do not use POP3/IMAP on GCP. All incoming emails
> goes
> > forward to real Gmail box:
> > #+BEGIN_SRC text
> > soyeomul@bionic190316003:~$ cat ~/.forward
> > soyeomul+gcp@???
> > #+END_SRC
> > And i don't know about a docker. +Both Exim and Postfix are good
> > MTA.
> > Sincerely, Byung-Hee
> > --
> > ## List details at
> > https://lists.exim.org/mailman/listinfo/exim-users
> > ## Exim details at http://www.exim.org/
> > ## Please use the Wiki with this list - http://wiki.exim.org/
> > --
> > ## List details at https://lists.exim.org/mailman/listinfo/exim-users
> > ## Exim details at http://www.exim.org/
> > ## Please use the Wiki with this list - http://wiki.exim.org/
> >
> --
> ## List details at https://lists.exim.org/mailman/listinfo/exim-users
> ## Exim details at http://www.exim.org/
> ## Please use the Wiki with this list - http://wiki.exim.org/
>
>
>
