7

Preface:

Server admin n00b here. I'm setting up a web server for our site (Ubuntu 8.04 LTS 64-bit). The web server is not used for processing inbound mail or outbound mail sent by actual mail users for the domain; all of that is handled separately (by a hosting service; I have neither the time nor the expertise to keep a mail system running properly).

So, three-part question:

  1. Is there any need for sendmail, postfix, qmail, exim, etc. on the web server? E.g., for logwatch or other processes to send their notifications? This is a hosted dedicated server and came with mail pre-configured, but naturally if I don't need it, I want to reduce the attack surface -- it's a publicly-facing server, after all.

  2. If I don't need any of those installed, presumably I have to tell the server somewhere what SMTP server to use when sending mail? Or would that be per each package doing so (apticron, logwatch, etc.).

  3. Again assuming I don't need mail services, what are the most popular config files in which I'd want to change the email address from "root" to something more appropriate to ensure that we do receive notifications? E.g.: /etc/apticron/apticron.conf, /etc/logwatch/conf/logwatch.conf, ...

Links very welcome indeed.

Thanks in advance!

2
  • Just a side comment, the question is IMHO far from "n00b".
    – user2874
    Oct 11, 2009 at 18:44
  • Cheers Jesper. :-) Oct 11, 2009 at 21:06

6 Answers 6

8

You need the mail server so that your local processes (like logwatch) can send mail. However, you can configure the mail server to only listen on 127.0.0.1 not on all networks, and that means that outsiders can't use it. That will reduce your "attack surface" (good term, by the way, I've never heard it before).

The usual answer for part 3 of your question is to put in an alias in /etc/aliases or where-ever your chosen mail server keeps its alias file. By default, those files usually alias a whole bunch of things (like "webmaster" and "bin") to root, and then at the end of all those, you put in another alias that aliases root to you.

3
  • Thanks! Very helpful! (I can't up-vote yet, and it seems rude to accept an answer too quickly, so I'll wait a bit.) Okay, I need an MTA. This server appears to have qmail pre-configured, so I may as well use that, only listening on 127.0.0.1, just to be tidy (I've already clamped port 25 down at the firewall level anyway). But I don't need (for instance) something called courier which is (according to netstat -lp) providing POP3 and IMAP. (BTW, I'm pretty sure I got "Attack surface" from Mick Bauer -- linuxjournal.com/xstatic/corporate/staff/Bauer) Oct 11, 2009 at 13:20
  • No, you don't need courier. Oct 11, 2009 at 13:38
  • To add a thought, your web developers/existing code may want to send e-mail (in addition to the already mentioned log processes, etc), and may expect a local MTA.
    – Tim Lytle
    Oct 11, 2009 at 19:32
6

You need some kind of MTA on your box, because most services don't know how to talk to a remote SMTP server and rely on sendmail(1).

On the other hand, you don't need a full fledged MTA like sendmail or postfix. You can use for example nullmailer or ssmtp (available as packages on Ubuntu) which doesn't implement the SMTP-listening part.

This minimal MTA in turn should be configured to relay your email via your ISP's mail gateway.

3
  • I forgot about nullmailer. That's probably a better solution than trying to configure qmail. Oct 11, 2009 at 13:39
  • +1 Another choice is ssmtpd. I don't know enough to recommend one over the other. Oct 11, 2009 at 13:51
  • ssmtpd is written in python, so it needs Python. nullmailer written in C++
    – TiFFolk
    Oct 11, 2009 at 14:41
1

i've setup few vps without any mailserver with no problem at all. i even do apt-get purge postfix sendmail exim4-base nullmailer just to make sure nothing installed. and check nothing is listening on port 25.

apache, mysql, all others works with no problem.

except for one thing for sure, you cant send email. thus phpmail will not work.

0

I personally don't know how to config various Linux services to send out e-mail messages, but you're right: you don't need a local mail server if you're not processing e-mails with that machine.

Even if your services used the local mail server to send out their own messages, that would be a very bad setup, because it wouldn't be a publicly recognized mail server on the Internet, so most "real" mail servers would reject messages coming from it because of anti-spam filtering.

I strongly encourage you to configure your services to send out their e-mails using your ISP's mail server and disable the local one on your server.

3
  • 2
    you need a local mta, because services that need to send mail cannot talk to the isp's server directly
    – user1686
    Oct 11, 2009 at 13:25
  • There are some which need a local MTA, but most services can talk to any SMTP server.
    – Massimo
    Oct 11, 2009 at 13:33
  • 1
    cron can't. There are many other unix programs that assume /usr/sbin/sendmail (or worse /var/lib/sendmail) Oct 11, 2009 at 13:55
0
  1. You need MTA (sendmail, etc) to send mail from your applications, like raid monitoring tools.
  2. yes, you need it
  3. You can change "alias" file, and make redirection, for ex: from root to wallace@wallace.com
0

You still need something than can send mail from your box. If you don't want to "full" MTA, you might try ssmtp. This is "fake" MTA, that emulates sendmail and can be configured to send all mail via remote smtp server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.