Comment by bhauer | Hacker News Reader

Comment by bhauer | Hacker News Reader

Parent Full thread

Despite my grievance elsewhere in this thread that mail servers do not come pre-configured with sensible defaults, I would guess that no modern mail servers are pre-configured as an open-relay when installed. The concern about port 25 relaying being abused by spammers strikes me as an anachronism.

In any event, I found that mainstream ISPs are willing to unblock port 25 if you tell them you are running a personal mail server and have it properly configured to not relay for unauthenticated users.

Aside from that, you'll want one static IP to make your life easy so you don't need to use dynamic DNS.

I think matters such as availability of your server and configuration are surmountable challenges.

But I strongly agree with you about security. Although I really like the idea of this device, the first thing I noticed in the product web page is the use of PHP Roundcube for webmail. I have a fear of running PHP anywhere on my network. The track record [1] is way better than, say, Wordpress, but seeing things like Exec Code, even back in 2008, gives me pause.

[1] http://www.cvedetails.com/vulnerability-list/vendor_id-8905/...

The argument for blocking outbound SMTP is not primarily about misconfigured servers. It's about malware that wants to send spam.

Good point!

Nevertheless, in my experience, ISPs will unblock port 25 for customers on request. I've only worked with a few in my years, but I've not yet encountered any resistance.

Most ISPs that I'm familiar with won't unblock common server ports (25, 80, 443) unless you are on a business account (though that's not much more these days).

Though it isn't always just inbound 25 traffic... often it's outbound as well. Also, the larger issue is hacked/pwned machines and bots, not just open relays. Which reminds me, I need to update Tomato on my router.

My ISP only blocks common ports on dynamic ip ranges. If you order a static IP, you do whatever you want with it. They even set reverse dns record for me when I asked, because some blocklists/mail servers want it that way.

Issue with running your own mail server nowadays is spam. Gmail does a decent job filtering all the crap.

Indeed bhauer! Though, one would hope Hillary Clinton was thinking about utmost security when she was setting up her mail server...

Of course! And I am certain that she and colleagues always used GPG or similar when e-mailing between her personal mail server and the State Department's official mail server. Because it goes without saying they would do so, otherwise those e-mails carrying untold sensitive information would have been routed in the clear. And that obviously never happened.

What I've gathered from news reports is that her mail server was accepting SSL connections, with a certificate that was probably strong enough at the time it was installed, but that was insufficiently strong for the brute-force attacks available today. Aside from that, it wasn't too bad - especially given the physical security of her residence (i.e., Secret Service).

Note that the State Department's score on the FISMA report was significantly worse than that of the infamously hacked Office of Personnel Management, so maybe Ms. Clinton was on to something. https://www.whitehouse.gov/sites/default/files/omb/assets/eg...

Reply on news.ycombinator.com