On Fri, Nov 14, 2008 at 04:13:19PM -0500, Charles Marcus wrote:
> On 11/14/2008, Wietse Venema ([EMAIL PROTECTED]) wrote:
> > Postfix as released by me does not chroot anything. Some
> > Linux distributors insist on setting up things this way,
> > which only can give Postfix a bad reputation.
> >
> > Perhaps if enough people complain it will be changed.
>
> I'd be very interested in the response that the postfix author (and
> other vastly more knowledgable people than I, like Victor) would give to
> the people who claim that if it isn't chrooted, it isn't secure.
>
> The only answer I can give right now is 'well, I've heard the author
> Witese enema) on the email support list say that it doesn't really
> provide any more security and isn't worth the headache'.
My $0.02:
Chroot only helps if the rest of the system is nailed down as tight. So
few are, that chroot provides very little real benefit. Postfix is
already the most hardened code on the box, chrooting Postfix does not
fix the other far more vulnerable components of the system.
If you are not running Postfix on BSD firewall mail gateway, don't chroot.
--
Viktor.
Disclaimer: off-list followups get on-list replies or get ignored.
Please do not ignore the "Reply-To" header.
To unsubscribe from the postfix-users list, visit
http://www.postfix.org/lists.html or click the link below:
<mailto:[EMAIL PROTECTED]>
If my response solves your problem, the best way to thank me is to not
send an "it worked, thanks" follow-up. If you must respond, please put
"It worked, thanks" in the "Subject" so I can delete these quickly.
