Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Preface:

Server admin n00b here. I'm setting up a web server for our site (Ubuntu 8.04 LTS 64-bit). The web server is not used for processing inbound mail or outbound mail sent by actual mail users for the domain; all of that is handled separately (by a hosting service; I have neither the time nor the expertise to keep a mail system running properly).

So, three-part question:

  1. Is there any need for sendmail, postfix, qmail, exim, etc. on the web server? E.g., for logwatch or other processes to send their notifications? This is a hosted dedicated server and came with mail pre-configured, but naturally if I don't need it, I want to reduce the attack surface -- it's a publicly-facing server, after all.

  2. If I don't need any of those installed, presumably I have to tell the server somewhere what SMTP server to use when sending mail? Or would that be per each package doing so (apticron, logwatch, etc.).

  3. Again assuming I don't need mail services, what are the most popular config files in which I'd want to change the email address from "root" to something more appropriate to ensure that we do receive notifications? E.g.: /etc/apticron/apticron.conf, /etc/logwatch/conf/logwatch.conf, ...

Links very welcome indeed.

Thanks in advance!

share|improve this question
    
Just a side comment, the question is IMHO far from "n00b". –  Jesper Mortensen Oct 11 '09 at 18:44
    
Cheers Jesper. :-) –  T.J. Crowder Oct 11 '09 at 21:06

6 Answers 6

up vote 8 down vote accepted

You need the mail server so that your local processes (like logwatch) can send mail. However, you can configure the mail server to only listen on 127.0.0.1 not on all networks, and that means that outsiders can't use it. That will reduce your "attack surface" (good term, by the way, I've never heard it before).

The usual answer for part 3 of your question is to put in an alias in /etc/aliases or where-ever your chosen mail server keeps its alias file. By default, those files usually alias a whole bunch of things (like "webmaster" and "bin") to root, and then at the end of all those, you put in another alias that aliases root to you.

share|improve this answer
    
Thanks! Very helpful! (I can't up-vote yet, and it seems rude to accept an answer too quickly, so I'll wait a bit.) Okay, I need an MTA. This server appears to have qmail pre-configured, so I may as well use that, only listening on 127.0.0.1, just to be tidy (I've already clamped port 25 down at the firewall level anyway). But I don't need (for instance) something called courier which is (according to netstat -lp) providing POP3 and IMAP. (BTW, I'm pretty sure I got "Attack surface" from Mick Bauer -- linuxjournal.com/xstatic/corporate/staff/Bauer) –  T.J. Crowder Oct 11 '09 at 13:20
    
No, you don't need courier. –  Paul Tomblin Oct 11 '09 at 13:38
    
To add a thought, your web developers/existing code may want to send e-mail (in addition to the already mentioned log processes, etc), and may expect a local MTA. –  Tim Lytle Oct 11 '09 at 19:32

You need some kind of MTA on your box, because most services don't know how to talk to a remote SMTP server and rely on sendmail(1).

On the other hand, you don't need a full fledged MTA like sendmail or postfix. You can use for example nullmailer or ssmtp (available as packages on Ubuntu) which doesn't implement the SMTP-listening part.

This minimal MTA in turn should be configured to relay your email via your ISP's mail gateway.

share|improve this answer
    
I forgot about nullmailer. That's probably a better solution than trying to configure qmail. –  Paul Tomblin Oct 11 '09 at 13:39
    
Thanks! (Can't up-vote yet.) Very cool. –  T.J. Crowder Oct 11 '09 at 13:45
    
+1 Another choice is ssmtpd. I don't know enough to recommend one over the other. –  David Pashley Oct 11 '09 at 13:51
    
ssmtpd is written in python, so it needs Python. nullmailer written in C++ –  TiFFolk Oct 11 '09 at 14:41

i've setup few vps without any mailserver with no problem at all. i even do apt-get purge postfix sendmail exim4-base nullmailer just to make sure nothing installed. and check nothing is listening on port 25.

apache, mysql, all others works with no problem.

except for one thing for sure, you cant send email. thus phpmail will not work.

share|improve this answer
  1. You need MTA (sendmail, etc) to send mail from your applications, like raid monitoring tools.
  2. yes, you need it
  3. You can change "alias" file, and make redirection, for ex: from root to wallace@wallace.com
share|improve this answer

You still need something than can send mail from your box. If you don't want to "full" MTA, you might try ssmtp. This is "fake" MTA, that emulates sendmail and can be configured to send all mail via remote smtp server.

share|improve this answer

I personally don't know how to config various Linux services to send out e-mail messages, but you're right: you don't need a local mail server if you're not processing e-mails with that machine.

Even if your services used the local mail server to send out their own messages, that would be a very bad setup, because it wouldn't be a publicly recognized mail server on the Internet, so most "real" mail servers would reject messages coming from it because of anti-spam filtering.

I strongly encourage you to configure your services to send out their e-mails using your ISP's mail server and disable the local one on your server.

share|improve this answer
2  
you need a local mta, because services that need to send mail cannot talk to the isp's server directly –  hop Oct 11 '09 at 13:25
    
There are some which need a local MTA, but most services can talk to any SMTP server. –  Massimo Oct 11 '09 at 13:33
1  
cron can't. There are many other unix programs that assume /usr/sbin/sendmail (or worse /var/lib/sendmail) –  David Pashley Oct 11 '09 at 13:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.