Subject: Re: smap/smapd/postfix: malformed sender addesses

From: [email-masked] (James Seymour)
Date: Wed, 7 Jun 2000 10:04:31 -0400 (EDT)

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

In Message-id: <[email-masked]>,
"Overdijk, Harrie" <[email-masked]> wrote:
[snip]
>                                                      ... As
> a replacement for sendmail I have chosen for postfix 

Good idea, IMO :-).  Except...

>                                                      in send
> only mode and configured it for use on a firewall. I have
> tested it local from several systems using telnet to simulate
> a SMTP session and all looks well.
[snip]

Kind of a "carrying coals to Newcastle" approach, IMO.  Postfix is not
a monolithic MTA like sendmail.  It was developed from scratch by
someone who is arguably one of the best-known and most talented Unix
security folks on the net (one of your own countrymen:  Wietse
Venema).  The "exposed" part of Postfix is the SMTP daemon.  Like with
smap/smapd, this is a separate piece of code.  And like
smap/smapd/sendmail: Postfix's separate components are isolated from
each other.  Further, if you're really concerned about Postfix possibly
being breached, you can run it under a unique UID and/or put it in a
chroot'd jail.

And tho I haven't looked at Yao's smap/smapd patches (nor is it my
intention to belittle his work!), I'd be almost willing to bet
Postfix has more extensive anti-spam controls.

(Guess what I'm running on both my Gauntlet and T.REX firewalls?)

Regards,
Jim
-- 
Jim Seymour                         | Medar, Inc.
[email-masked]                  | 24775 Crestview Ct.
Systems & Network Administrator     | Farmington Hills, MI. 48335
                                    | FAX: (248)477-8897

---

From: Rick Murphy <[email-masked]>
Date: Thu, 08 Jun 2000 06:50:45 -0400

At 10:04 AM 6/7/00 -0400, James Seymour wrote:
>Kind of a "carrying coals to Newcastle" approach, IMO.

I've got to agree with Jim. If you're going to go through the effort to 
configure postfix, get rid of smap and smapd. Combining the two won't do 
much to tighten up the postfix installation and it only serves to 
complicate the setup. (More complicated means more likely to be set up 
wrong IMHO.)
         -Rick