Subject: Re: About using postfix on the firewall...

From: "Naresh Narang" <[email-masked]>
Date: Sun, 23 Jul 2000 12:36:04 IST

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

What I believe is this:

    Split DNS is to help build a firewall. It has to resolve domains whether 
from internal or external IP addresses / Domain names. It does not get bound 
to sendmail. Sendmail uses info supplied by DNS for sending mails. So, it is 
your Postfix configuration which has to take care of proper routing of 
Internal or External mail, like you might have seen for sendmail in the FAQ.

Regards,
NKN

>
>I am going to run split dns (external dns on the bastion host, internal
>over one of our servers), will postfix have any problem to send email from
>outside to internal network? The split-dns FAQ only talks about Sendmail
>configuration .

________________________________________________________________________
Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com

---

From: Malcolm Tester <[email-masked]>
Date: Mon, 31 Jul 2000 18:01:46 -0600

I have to agree with Joseph here.  You need split DNS, regardless of the MTA
you use.  The only interaction between DNS and the MTA is where the MX
record is concerned.  As long as it is properly configured, it doesn't
matter.

While I am a big supporter of Wietse, I also agree with Joseph that no
software is bug-free.  No one is perfect, least of all, us humans.  I'm
quite sure Postfix has bugs that can be exploited.  I just prefer it over
sendmail because (personally) I feel it has less bugs.  To be honest, I use
Sendmail too, on the internal side of my network, because I prefer what it
can offer in other areas than Postfix, where security is not so much a
concern.

Can you use Postfix without smap/smapd?  Yes.  You can run Sendmail without
it too.  Is it recommended?  No.  I don't think anyone would recommend doing
that explicitly.  You might run less of a chance of being bitten than with
Sendmail, but for the optimum security, use smap/smapd.  That's what they
are there for.  If you decide you can get away without doing so, then fine.
Your choice.  But Postfix is not intended to be a replacement for
smap/smapd.  It's a replacement for Sendmail.  The configuration of the fwtk
is the same, regardless of what MTA you use.

If you need help getting postfix to talk to the internal network, you can
email me offline and I'll be happy to help.

Malcolm W. Tester II
Systems Administrator
Cambric Corporation
110 West Business Park Drive
Draper, Utah 84020
http://www.cambric.com

This message is intended only for the use of the individual or entity to
whom it is addressed and may contain information that is privileged,
confidential and exempt from disclosure under applicable law.  If the reader
of this message is not the intended recipient, or the employee or agent
responsible for delivering the message to the intended recipient, you are
hereby notified that any dissemination, distribution or copying of this
communication is strictly prohibited.  If you have received this
communication in error, please delete it from your system and notify the
sender identified above by e-mail.

> -----Original Message-----
> From: Joseph S D Yao [mailto:[email-masked]]
> Sent: Monday, July 31, 2000 3:10 PM
> To: Leandro Gelasi
> Cc: [email-masked]
> Subject: Re: About using postfix on the firewall...
> 
> 
> On Sat, Jul 22, 2000 at 08:25:06PM +0200, Leandro Gelasi wrote:
> ...
> > Reading list's archives, I found that postfix can be used 
> in replacement
> > of smap/smapd daemon on the bastion host.
> > Is this correct? It will simplify my life in installing the firewall
> > system on the bastion host, because I am already using 
> postfix on our
> > servers.
> > 
> The two are totally separate questions, even though they have a lot to
> do with each other.
> 
> Split DNS is, of course, absolutely essential to any FWTK 
> installation.
> Properly implemented, of course.  There is no "sendmail configuration"
> in DNS.  Mail exchange records apply to all properly-implemented mail
> transfer agents.
> 
> Postfix is another question.  There are those who believe 
> implicitly in
> its author, therefore it must be bug-free.  I do not agree.  I would
> continue to use smap/smapd as the proxy, and either sendmail 
> or postfix
> as the mail transfer agent.  At this point, there are good arguments
> for either of those in that position.  But NOT as a firewall proxy.
> 
> -- 
> Joe Yao				[email-masked] - 
> Joseph S. D. Yao
> COSPO/OSIS Computer Support					EMT-B
> --------------------------------------------------------------
> ---------
> This message is not an official statement of COSPO policies.
>