Which one is more secure ect? I've been doing alot of research and everywhere says Postfix is better, or no qmail is better what is your all's pro's/cons from personal experience? Any input would be great!

From a pure security standpoint... there has never... and I mean *never* been a security hole found in qmail. It's also very, very easy to use and configure.

Not only easy usage and configuration.. some people are looking at the speed of each mail daemon. A lot of people think postfix is process faster than qmail. To me they're all the same... it all comes down to how you configure them. I've used sendmail with about 5000+ users at my old job.. and it worked perfectly.

But for hosting, I chose qmail... because I can separate userfile for each domain and also I can modify it a lot easier. I think you can do the same with sendmail, but we're talking a lot of coding there.. ..:)

Security wise .. they're all the same, eventhough qmail claims to have a better security than sendmail. Just make sure you do a regular updates..

anybody have a link to Qmail ?
mahalo

www.qmail.org

I just think anyone who develops software 4 years ago and has not had to come out with 1 patch / security update for it must be an awesome programmer. QMail has been able to support everything anyone has wanted to come out for it. I love it to death!

We've used qmail on a couple machines and haven't had any problems.

Anyone else here using vpopmail + qmailadmin? The reason I originally installed qmail was since I couldn't find a decent & reasonably priced hosting end-user mail control panel. It took a while to get everything working the first time, but once we got the process down it's worked like a charm.

Good deal, we went ahead with Qmail installed it.. everything is working great. Now we are just looking for a pop3 server to use.. I think we are going to go with qmails pop3d.. any ideas of a better one?

Aloha
I believe Hostpro uses Qmail for the NT boxes there unix boxes that work as ther mail servers
and they also use
IMP@horde.org
for others

Folks, Qmail owner is a great marketer. I drop qmail after using it for a year. There're many incompetent issue coming along it. eg. The security issue explained by qmail owner is a hoax. Any extra feature need to be patch by third party software. The real issue of MTA is the Configuration. Postfix privide highest level of configuration. Qmail/procmail is imcompetent in today SPAM world. If someone spam/bomb you, Qmail will just accept it, then try to reply the spammer. Unfortunately, spammer use free email address that doesn't exists/disabled, hence spammed mail left in your machine, painful isn't it?

Go use sendmail/Postfix. Sendmail version greater than 8.10.x can filter incoming mail to a socket and reject spam without accepting it. Even the biggest security list like securityfocus.net use Postfix.

Top 10 reasons to avoid qmail et al
http://groups.yahoo.com/group/djb-qmail/message/75992

Yeah one of the 10 reasons:

2. Its mascot is a dolphin, and I can't see how this relates to mail software.

:D

Now is it for some purpose? or what?

Qmail rules. So what can we do about it? :)

With 19 patches applied, I personally like qmail the best. It's probably more secure than postfix, but I'll admit to never having looked at postfix.

I just use the pop3 daemon that came with qmail.

I use qmail and vpopmail. I don't have any problems and never have. As for people saying qmail's security claims are a hoax and it's not more secure than Sendmail, etc. Well, that's ridiculous. Sendmail has, not unlike SSH, BIND, etc., many exploits that have given attackers root and have resulted in many boxes being compromised. Indeed, with the proper understanding and configuration of Sendmail, it can be just as secure as qmail. However, you have to worry about keeping up with the latest patches too, or you risk being compromised. This has never happened in qmail and you can bet people have tried to break it -- I have tried a little, not much though, and I've not broken the thing. I would use qmail first, and Sendmail or Postfix second. I just don't like worrying that if I go a day without knowing there's a new exploit in Sendmail, that I could be targeted in the meantime (like if I go on vacation). So, I'd rather use Postfix second. I'd never use some crappy thing like Exim though (and it's more insecure than Sendmail), but the other's are a good choice. There's some other, not as popular one's that are not bad choices. If you understand your email program and know how to configure and secure it, you have made the right choice, for the most part.

If you check out all the different program's histories, faults, features and pros and cons, and get familiar with them, you'll not need to ask everyone's differing opinions and you'll end up making the best choice -- since some really aren't better than other's, but some most definitely are. That's up to you to decide, but qmail or postfix are both good choices. What you use for POP email is up to you as well, but I've used Qpopper, pop3d and vpopper and they are all pretty good, although Qpopper did have some security issues before and pop3d is suggested over it. However, I use vpopmail currently and I really like it a lot -- perhaps better than the other two. Finally, as far as procmail not being good or qmail bouncing messages -- that can all be configured to do what you tell it to do -- and it doesn't get any better than that (and that IS good!). If you don't find enough control in the recipes, simply create a script to do the checking and have procmail or even qmail launch it to parse any part of the email (or all of it). I don't see the problem at all, unless you rely solely on default configuration installs and 3rd party programs and scripts to just do things or not, without you being involved to create any custom or personal scripts or recipes. Otherwise, they are an excellent choice and all that matters is that you have complete control to do whatever you want -- and that's what makes a good program (not ease of use or the best default install!) Anyway, that's my experience and opinion about this subject.

If I were starting from scratch, I would go with Postfix over qmail. Currently we use qmail 99% of the time, and Postfix the rest. Never sendmail.

Don't ask me why. You don't want that discussion. Let's just say that blind devotion to "cool software" gradually breaks down after a long enough struggle with getting it to behave correctly in real usage... and it needs updates and patches badly. It just isn't getting any attention from the author as far as I can tell. Not that I want to incur the wrath of DJB. I'm sure he's a nice guy in real life.

Kevin

Originally posted by sigma
If I were starting from scratch, I would go with Postfix over qmail.

Care to explain a bit more. Especially with regards to hosting. I know qmail was selected by pair for some very strong reasons.

:)

I just bothered to click on that link for the "top 10 reasons to user Postfix over qmail". LART, is all I can say. That was ridiculous. Bernstein has written great software. qmail, djbdns, etc. He's an intelligent and proficient programmer that understands areas that a lot of other programmers and company's putting out their so-called software either aren't aware of, or don't care. How anyone can come in and start ranting on irrelevant or misguided information on a Yahoo group with those nonsense and convince anyone this is factual or rational debating or reasons, is just beyond me. When you start seeing qmail not perform well, or even very well, or you hear of a root exploit, or basically any exploit, or any failure for it to work in the capacity it should and does and has for years now, then come complain and give reasons and compare it to the non-failure of the other software in any area. Some people might not be able to set it up or configure it properly or get bothered by having to actually do their job as an administrator and follow simple instructions, and some people might just prefer other programs over qmail (and that's fine), but those do not indicate that qmail isn't a very, very good program that's very well built.


I've covered some points in my previous post, and I'm not intending to cover all the ludicrous remarks about how I'm glad DJB didn't rely on the standard, buggy libraries other software uses that helps result in more bugs and problems and security issues -- not that they do, but someone writing their own functions to keep it closed from being effected by a community of other library coders, is smart if anything. Again, Postfix is a fine product, I have no problems or complaints about it, but I don't see _any_ rational or valid argument to say that it's better than qmail. I think both are good, and that was a lame attempt for some troll to go and bug the people in the qmail group -- it shouldn't be taken seriously, and this guy obviously had nothing reasonable to use for his argument -- why? Because there's nothing at all wrong with qmail.

If you choose qmail since the beginning day and decide to switch over to Postfix , you'll need to do lots of headache configuration change per user , not mention learning curve on how to control over a new horse. Unfortunagely, most admin don't have time to do that.

I haven't used Postfix so I cant tell you if it's better, but I am using qmail+vpopmail on FreeBSD, and it is working excellently - even a fool like me can manage it

Cheers
Balaji

Originally posted by Tim_Greer

Because there's nothing at all wrong with qmail.

What if I spam you using an non existentent hotmail address. Can you configure qmail not to accept it? (not that it will read full message body and reply to sender later)

Originally posted by jakis


What if I spam you using an non existent hotmail address. Can you configure qmail not to accept it? (not that it will accept full message and re-inject later)

That's a poor rationalization. You can configure any (well, probably almost any) to check the email to verify it's real before it accepts it, or before it replies or even bounces. If I get "SPAMMED", it'll be trashed. Having it verify an email on the other end, is not a perfect practice and it's not a good system, no matter what the reason for doing it. I hope you can do better than that.

Originally posted by Tim_Greer


check the email to verify it's real before it accepts it, or before it replies or even bounces. If I get "SPAMMED", it'll be trashed.

What if other end use qmail? We'll never know if the From: address exists since qmail won't reveal user information per se. Accepting spammed mail to TRASH is a nightmare of my qmail server over a year. At least new version of Sendmail/Postfix can do more header screening and deny delivery without losing bandwidth.

Originally posted by jakis


What if other end use qmail? We'll never know if the From: address exists since qmail won't reveal user information per se. Accepting spammed mail to TRASH is a nightmare of my qmail server over a year. At least new version of Sendmail/Postfix can do more header screening and deny delivery without losing bandwidth.

You don't have to accept things blindly. Read some information about this and qmail and how to configure it the way you want and not worry about this. Or, run Postfix if that's what you want, without trying to figure out how to configure qmail. I like qmail, it, and possibly with some add-ons (just like Postfix needs for some things too!), can do anything that anything else can do. It can do most things people want or need, without add-on's too. Have you looked into qmail, to see that you don't have to download it all either, before it's accepted? Please do.

Anyone can run a bad configuration on another server, using any program, and I don't trust the other end -- I trust my end, and that's all you can trust and rely on. If you want the Internet to be a perfect place and have everyone conform to rules (I wish too!), you better prepare for disappointment. If you think any of that's fool proof, give me your email to test and show you some examples with, and I'll show you some stuff and how nothing alone will cut it and that you'll need to inevitably rely on your services' configuration to ensure that things work how you want.

Originally posted by jakis
What if I spam you using an non existentent hotmail address. Can you configure qmail not to accept it? (not that it will read full message body and reply to sender later)

As far as I can tell, postfix won't even do that. Postfix is capable of verifying the domain in the sender address. Hotmail.com is a valid domain, and so it would be allowed through. Qmail can check the sender domain too:

http://lsc.kva.hu/dl/qmail-1.03-mfcheck.3.patch

How would you verify an email address without attempting to deliver to it? That would be very wasteful.

I read the "top 10 reasons to avoid qmail" also, and although there are some problems with qmail, I didn't see any actual ones listed. And if you would go on to read the replies to that post, you can see everyone pick him to shreds.

I'm sure there are good reasons to use postfix, but it being better than qmail is not one of them. I fear that you've fallen for some postfix fud.

I use qmail exclusively, except on my desktop system where postfix is the default MTA.

Here is some reason why I choose qmail over postfix. Please note that I'm using qmail almost exclusively for web hosting purpose. It might or might not be more suitable for other purpose.

- ezmlm is an excellent mailing list management software. And it only runs under qmail.

- easy to use virtual domain support

- a lot of excellent third party virtual domain management software available

- it's components is beautifully separated from each other. it is very easy to extend qmail by inserting simple shell scripts between qmail components.

Qmail is not perfect though. It requires a lot of patches to get it working the way I want. The RPM set on www.untroubled.org is usually enough, so it is not necessary to manually patch qmail anymore.

However, if for some reason I need to replace qmail with other MTA, I probably would choose Courier MTA (http://www.courier-mta.org), not postfix.

I believe you should be able to have it check it (the email address itself, not just the domain). I don't recall how, as I would never implement such a thing. There's too many places where that can and will go wrong -- but it can be done. I didn't ever implement it, because it's just such a bad idea, so I can't really say what, how, or where you'd do this.

Verifying From: address/domain is the useless feature. People/spammer/bomber use valid/varied From: address , To: your address. Noway you can escape. I once send email to support of verio-hosting.com and received the following auto-reply(not denied delivery)

########
Your message has been returned for the following reason:

In order to successfully open an issue your email must contain your
account domain name in the "subject" line of your message.

Examples:

Subject: I can't upload files to mydomain.com
Subject: More information about case 9710-00101
##########

Isn't this a better way to hosting solution? I think sendmail 8.10.x can filter this waywithout hassling to accept full message body, not sure how to do that with postfix.

Originally posted by jakis
Verifying From: address/domain is the useless feature. People/spammer/bomber use valid/varied From: address , To: your address. Noway you can escape. I once send email to support of verio-hosting.com and received the following auto-reply(not denied delivery)

########
Your message has been returned for the following reason:

In order to successfully open an issue your email must contain your
account domain name in the "subject" line of your message.

Examples:

Subject: I can't upload files to mydomain.com
Subject: More information about case 9710-00101
##########

Isn't this a better way to hosting solution? I think sendmail 8.10.x can filter this waywithout hassling to accept full message body, not sure how to do that with postfix.

Hanh? You seem to be contradicting yourself in the first statment, because you made a big deal of checking the sender address.

I haven't figured out what you're trying to say about the autoresponder in your second statement. Can you please explain?

Well it sounds to me like the choice of qmail over postfix comes down to more minor feature/integration issues that one being far superior over the other.

I use postfix, but because it meets a very specific need I have. I need to be able to write directly to the virtual user account database directly rather than write to a text file and rehash it. With postfix, you can choose whether to use a mysql, postgres, berkeleyDB3 databse (probably more choices) for your virtual user database. This is just one example of how configurable postfix seems to be. With qmail, AFAIK, the virtual user account database is something called cdb which stands for constant database (read-only to improve speed - but doesn't fit my needs).

If I was doing mass virtual hosting I would probably go with qmail because it has such a large user base amongst those users and seems to have lots of stuff like vpopper that integrate with it.

Also, the postfix virtual mailbox delivery agent is a bit of a pain in the bum (I don't know if any work has been done on it since the snapshot installed). But using the standard setup requires keeping three BerkeleyDB3 databases in sync, which is a bit silly. If I remember, there is a patch someone has written for storing virtual mailbox delivery agent account info in a postgres database, but anyway...

Someone mentioned courier mail server. Interesting. This was one I considered, but can't remember much about it. Does anyone want to give some more advocacy for this? I use courier-imap which is sweet.

Originally posted by bitserve


I haven't figured out what you're trying to say about the autoresponder in your second statement. Can you please explain?

Try filtering message though To: and Subject: not sender's address. Verio is a similar example that filter Subject: , unfortunately, they use autoresponder. The real efficient usage need smtpd filtering instead of autoresponder.

Qmail author is a great programmer his software is great ,yet doesn't mean it is flexible. Remember the first time you decide to install qmail ?. Did you recall a license "If you want to distribute modified versions of qmail (including ports, no matter how minor the changes are) you'll have to get my approval" It's published here http://cr.yp.to/qmail/dist.html . Below're many reasons I quit.

- Most smtpd provide basic filtering features (filter means MTA can check message format before let it in or reject it without trasfer to local software where the message could only be replied to sender or forwarded to trash) , Filtering is the efficient way to bang the door against unsolicited email without hassling the machine, While qmail can filter nothing but from address (using badmailfrom control file, but that can't prevent senders who usually change his From: address). If Qmail can do filtering well , we shouldn't hear qmail-scanner.pl from sourceforge. Anobody willing to run perl file instead of original smtpd?

- Internet is weak. Qmail cause it become weaker. If I intend to bomb mail to a machine. I pick a domain , look at mx record, telnet to that SMTP port to check if it was qmail. I started to send mail from nonexistent@yahoo.com to a@yourdomain b@yourdomain ... Unfortunately, qmail gladly accept it , deliver to local user even if user's quota exceed then try reply error message to nonexistent@yahoo.com Unfortunately, yahoo bang against it "no such user", Finally, sins left in that machine, Result in administrator to cleanup the queue.

- Qmail has no config file but control file which administrator can't do real modification to it's functionality. If Qmail don't want to reveal user information trough SMTP port , administrator can't force it to show either. Unlike Postfix even SMTP banner can be changed.

- I had a virtualdomain user whose his .qmail file became wrong permission (755 instead of 600) . Qmail accept incoming messages of this user then queued it in local machine until expiry. User yell , how he did never receive any email. Result in administrator to check again. With Postfix can be configured to do soft bounce (queue) or hard bounce(reply error to sender, no queue). With hard bounce, user can easily know the problem and report it.

I once believe that qmail is cool. It allow web user to change his Return-Path in message header , but that is that , nobody know this feature, administrator should better prepare this feature automatically. If you want to use vpopmail (I won't), be informed that it support Posftix as well. Some might say good thing about qmail virtualdomains. Actually all MTA can setup virtualdomains. POP3/IMAP virtualdomain is another story.

Well, if postfix fits your needs, then you use it. Simple eh?

I could go on countering your post point by point in good depth, but then you will come up with another set of problems. So I guess I'll just save my time and let you use postfix in peace. :)

I really fail to understand the "this rocks and that sucks" attitude that is so prevalent in this board.

The bottom line is that both postfix and qmail are excellent MTAs; neither is perfect, though.

I suspect either one will satisfy the needs of 99.99% of the people who need an MTA. I use qmail at work and postfix on my hobby servers. Both get the job done quickly, reliably and efficiently.

Figure out which features you want in an MTA, then choose an MTA that matches those features.

It is nice having a choice between two excellent pieces of software for a given task. I wish there were a similar choice for desktop operating systems, instead all we have is a choice of a single mediocre pile of software.

Originally posted by jakis
Folks, Qmail owner is a great marketer. I drop qmail after using it for a year. There're many incompetent issue coming along it. eg. The security issue explained by qmail owner is a hoax. Any extra feature need to be patch by third party software. The real issue of MTA is the Configuration. Postfix privide highest level of configuration. Qmail/procmail is imcompetent in today SPAM world. If someone spam/bomb you, Qmail will just accept it, then try to reply the spammer. Unfortunately, spammer use free email address that doesn't exists/disabled, hence spammed mail left in your machine, painful isn't it?

Go use sendmail/Postfix. Sendmail version greater than 8.10.x can filter incoming mail to a socket and reject spam without accepting it. Even the biggest security list like securityfocus.net use Postfix.

Top 10 reasons to avoid qmail et al
http://groups.yahoo.com/group/djb-qmail/message/75992

Someone want to translate what this clown is talking about? "postfix provide highest level of configuration"? "qmail/procmail is imcompetent in today SPAM world"? *shrug*

The "weakness" he speaks of is one of qmail's greatest advantages: It's so easy to drop in a script or another piece of software to do what you want to do. From someone that has been around the block a few times, I find qmail's modular architecture to be a godsend. If you deal in high volumes of mail, being able to isolate function based on server through the use of things such as qmqp, etc are great. Maildir makes working with NFS a hell of a lot easier. There's a reason so many high volume, successful web sites use qmail.

Dan Bernstein is an excellent programmer, and admittedly his software is harder to understand by most; but hey, not everything in this industry is point and click.

Postfix is an excellent piece of software. Benchmarks, as of late, have hinted at postfix being a tad bit faster. I'd not complain about using either.

Sendmail, on the other hand is a f**king debacle. It's bloated, slow, monolithic and tries to do everything. Anything that takes a book as thick as a phonebook to gain an expert's understanding of is definitely not a good thing in my book. Secondly, let sendmail's security history speak for itself (since there seem to be a lot of newcomers, try going back to 8.5.x and 8.6.x; this and the versions before are what I cut my teeth on, you cannot expect me to be trusting of sendmail).

I have also been unable to determine what jakis is talking about, but most of it seems to be how jakis understands how the two programs work, which is no where similar to how I understand them to work.

The thing that jakis mentioned about autoresponders, I still don't understand the point trying to be made, but I don't think it was relevant to the thread.

sorry, bitserve, the example imply that If verio didn't filter email subject like that,they'd receive more unsolicited email, however their filter is not perfect since it was done after delivery (say by autoresponder) which results in increased email traffic (accept, deliver , bounce) . If this filter was done at SMTP port , the message won't even be accepted. the following link may explain how qmail didn't let us modify its behavior. This is one of many inflexibilities qmail offers.

http://groups.google.com/groups?threadm=wx0k80bkew2.fsf%40sws5.ctd.ornl.gov

One good think I would say about qmail is it's 3 dimension virtual domain structure. It map each domain to a folder within user's directory where each email has its own config file. Hosing can offer unlimited email , user can do unlimited settings like forwarding to unlimited external email.

Weight it, some people still use win95 and say it is the best OS. the only think they talk about w2k is it's good as well.

After leaning towards exim, i finally decided to go with qmail because of the integrated pop3 server. There are many pop servers that are compatible w/ exim, but after spending days looking at popa3d, teapop, qpopper, etc, i just couldn't make up my mind.

Just got qmail up this morning.

The most helpful documentation so far has been the qmail-HOWTO (www.flounder.net/qmail/qmail-howto.html) and lifewithqmail.org . If you are using the HOWTO, and want to use maildirs, i STRONGLY suggest reading the INSTALL.maildir that comes with qmail. I couldn't get it to work until I read that install document.

I tried using the untroubled.com rpms, and qmailtheeasyway, but ultimately chose to use the .tar.gz from qmails site. Using the .tar.gz and following the above documents, one has a better understanding of what exactly is going on. And if you are really going to administrate your own boxen, that's very important, don't you think? :)

Jake

Originally posted by jakis
sorry, bitserve, the example imply that If verio didn't filter email subject like that,they'd receive more unsolicited email, however their filter is not perfect since it was done after delivery (say by autoresponder) which results in increased email traffic (accept, deliver , bounce) . If this filter was done at SMTP port , the message won't even be accepted. the following link may explain how qmail didn't let us modify its behavior. This is one of many inflexibilities qmail offers.

Ah. So you're saying that verio is using qmail, and that they don't have their autoresponder set up the way that they want it set up, because they are limited by qmail? And they wouldn't be limited if they used postfix?

That would be relevant, and pretty wild.

I'd bet that if verio didn't have their autoresponder set up the way that they wanted, that they would fix that. Verio might even replace the tech, if he or she didn't know how to do it.

Originally posted by Jake29

I tried using the untroubled.com rpms, and qmailtheeasyway, but ultimately chose to use the .tar.gz from qmails site. Using the .tar.gz and following the above documents, one has a better understanding of what exactly is going on. And if you are really going to administrate your own boxen, that's very important, don't you think? :)

Jake

Yes, but sooner or later you will need to patch your qmail. I found that doing untarring, patching, and compiling cycle is tiresome, especially if you had a lot of machine to deal with and if some of the patches are conflicting with each other.

Hi,

Someone mentioned that qmail could not handle reading its virtual domain configuration in a SQL database. There are patches for this:

http://iain.cx/unix/qmail/mysql.php
http://www.softagency.co.jp/mysql/qmail.en.html

I reviewed both Postfix+mysql and Qmail+mySQL, and only qmail delivers a usable solution for me.

With the virtual agent under postfix, the only thing you can do is map an incoming email address to a mailbox or a remote address. I know for sure that the first Qmail+mySQL patch mentioned above supports piping mail to a process. Also the second one supports quotas.

Also, may people have mentioned that there was a lot of patches made for qmail and no new official releases. I think this is not a bad thing, it makes patches easier to maintain!

Originally posted by smash

Also, may people have mentioned that there was a lot of patches made for qmail and no new official releases. I think this is not a bad thing, it makes patches easier to maintain!

Well, not if the patches are conflicting to each other. Try patching qmail yourself using a dozen or so patches, there's a good chance that some of the patches are conflicting. And combine this if you had a lot of server to manage.

Originally posted by smash
...
I reviewed both Postfix+mysql and Qmail+mySQL, and only qmail delivers a usable solution for me.

With the virtual agent under postfix, the only thing you can do is map an incoming email address to a mailbox or a remote address.

Not true.



...Also, may people have mentioned that there was a lot of patches made for qmail and no new official releases. I think this is not a bad thing, it makes patches easier to maintain!


It is very difficult when the patches start conflicting with each other, as was the case with me. It is far better to have a rational set of maintained source code than to deal with a gaggle of patches.



On the other hand, I can't believe this thread is still going on. :D

Originally posted by Mike the newbie

Not true.


why :confused: