Re: [PLUG] OpenSMTPD RFC 2822 Error

["N. Albert via plug" <plug@lists.phillylinux.org>]

On 12/5/2023 5:38 PM, Casey Bralla via plug wrote:
> Oooh.  I like the idea of writing my own server.  Seems like (in theory)
> it aught to be relatively straightforward.  My problem would be the
> encryption stuff, and some of the edge cases.

Encryption is easy (at least encryption in transit, which is I assume 
what you mean, I don't really believe in encryption of email at rest)... 
It's just TLS, same as every other protocol that supports it. I just use 
OpenSSL.
What other edge cases are you thinking about?

> Like you said, it would
> be a great way to really understand what's happening. 

Yes, I think there is no better way to understand email (or any 
protocol) than to implement it. I used the maildir++ format which is 
mostly standardized and I think Dovecot and some other mail servers 
support it, so if you didn't want to write an IMAP server maybe you 
wouldn't have to.
SMTP and POP3 are relatively simple protocols. IMAP is massively more 
complicated so took a lot longer, and then I wrote my own webmail 
program since all the existing ones like Roundcube suck.
Sieve support kind of fell on the back burner, I have rudimentary 
support working, but there's really only one Sieve library for C, and it 
hasn't been maintained in 10+ years so it doesn't compile anymore and 
the package has... issues.
My email server software is all open source, by the way, if it's helpful 
to look at... mine is all written in C, and is GPL: 
https://github.com/InterLinked1/lbbs

Because I was writing it myself mainly for my own use, it's designed to 
be easy to do the things that I want to do (or probably most individuals 
/ small groups), as opposed to some kind of massive organization with 
large numbers of complex requirements.

> In my case, I
> wouldn't have to have rock-solid reliability, since it'll be just my
> personal eMails.  I wrote a mass-mailing program several years ago in
> python, and found it to be relatively easy to do.

Yeah, the first couple months I experienced a lot of segfaults but by 
now I've gotten most of the bugs worked out.
I thinks stability is kind of relative... if you use a service provider 
like Gmail, they're notorious for locking people out of their own 
accounts randomly. You get what you pay for / the effort you invested 
into it. If something goes wrong, I'd rather blame myself and then go 
fix it than be helpless.

> I've been running my own postfix/dovecot system for years.  But I'm sick
> of the delays caused by my grey listing system and am terrified of
> messing with a running system.  Therefore, I built an entire "mini
> internet" in virtualbox so I can mess with stuff, test it, screw it up,
> then spin a new VM and try again.  Once I have built and rebuilt the
> server a few times, I'll be confident to build a production server on a
> rented server.  And of course, messing up and then fixing it, is the
> best way to learn a new system.

Yes, I would definitely recommend setting up a separate system to test 
with... I usually test major changes on a separate test system first and 
then move them into production when more comfortable with it.

Grey listing I haven't actually implemented yet. It's on my list of 
things to do at some point but hasn't been a high priority, and I've 
been a bit wary of it since I hear it backfires if you don't do it quite 
right. I've actually found that tarpitting seems to be very effective. I 
keep track of the number of protocol violations an SMTP MTA commits 
during a session, and tarpit it accordingly. Most junk clients will just 
give up and abort eventually, before it even tries to deliver a message. 
High reward and basically no drawbacks at all.
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug