Post.Office

reviewed for Web Tools Review by Philip Greenspun

Imagine my surprise then when I talked to folks at software.com about reviewing their Post.Office product, a replacement for Unix sendmail (also runs on NT), and they said "We looked at Web Tools Review and think it's great. We'd love it if you did a review of Post.Office."

I thought "These guys must either have a great product or their competition must really suck."

Their Competition Must Really Suck

Setting up sendmail is as easy as reading a 15-page man page (type "man sendmail"), scratching your head for an hour, going out to the bookstore to buy a copy of the O'Reilly sendmail book, spending a day or two with its 1050 dense pages. It might take you two or three days to get multi-domain delivery working (e.g., if one physical computer is serving "photo.net" and "webtravel.org" and you want "webmaster@photo.net" and "webmaster@webtravel.org" to go to different people).

Most mail clients are tolerant of minor configuration errors so you might be fielding vague user complaints for the next few months.

The best thing about sendmail is that it makes it very easy for remote users to take advantage of all of your Unix box's services. sendmail runs as root. sendmail is a C program. sendmail sucks data in from the Internet. sendmail doesn't always bother to check whether these data are larger than expected. A clever person can feed sendmail an email message containing arbitrary instructions for your computer. These instructions will get stuffed into some jumped-to memory locations by the C program. Eventually your Unix box will be running instructions of someone else's choosing. With root privileges.

These guys must have a great product

If you have a lot of users, e.g., if you are an ISP, you will save a lot of administration time by farming out tasks to users. They can connect to the Post.Office web site with Netscape and change their password, delivery mechanism, forwarding info, vacation messages, etc.

Security with Post.Office is much better than with sendmail. First, Post.Office is obscure. Not too many people run it. Nobody has the source code except the software.com folks. Normally I'm against systems that rely on "security by obscurity" but there is no denying the power of obscurity (HP Unix systems at MIT almost never get attacked; Sun systems are constantly being knocked over). Even if someone does figure out how to attack Post.Office, the program doesn't run as root. It runs as a regular Unix user with ordinary privileges. Hence Harry Hacker's instructions won't be running with superuser privileges.

Another big reason that Post.Office is more secure than sendmail is that you need not make someone a Unix user just because you want them to be able to receive mail on your server. If they aren't ever going to drive a Unix shell, then they should just be added as a Post.Office user for POP delivery or forwarding.

Post.Office is way faster and consumes fewer system resources than sendmail. However, like sendmail and first-generation Web server programs, Post.Office forks a process for every message sent. Don't expect to handle 100 requests/second like you could with a Web server program on a desktop Unix box. Post.Office's benchmarks show that a huge 4-CPU Sun UltraSPARC can process about 45 messages/second.

Warts

Another wart is that Post.Office can't run from a relational database management system. If you are maintaining an RDBMS table with comprehensive information about your users, it would be nice if your mail transfer agent just could look stuff up there. Then you wouldn't have to work to keep Post.Office's dbm files up to date with the RDBMS table. [Software.com makes a beefier product called InterMail (used by AT&T WorldNet) that can run from an RDMBS.]

Bottom Line

The Price

Links

• the horse's mouth (software.com's site)

Netscape Messaging Server

1. picked up user and authentication information from an LDAP server
2. had an API so that you could program it
3. functioned as an IMAP server so that you could move your client software into the 1990s

The Great Unsolved Problem in Mailers

We have a Unix machine with 20 fake IP addresses and 20 Web sites.  The
name of the machine is, for example, homepage.lcs.mit.edu.  One site is
"photo.net".  We want to send email from the box 

from: webmaster@photo.net

but many recipient MTAs will reject this mail because they are getting a
connection from "homepage.lcs.mit.edu", which is not "photo.net".  I.e.,
our email alert to them looks like spam.  Can we run 20 separate
Netscape MTA's, each one of which will appear to have the right IP
address?  Is there an extra header we can write that will make the
foreign MTA accept it?

If anyone knows of a solution to this problem, I'd be grateful to see it show up as a comment (below).

Another alternative to sendmail is Innosoft's PMDF product.

Like Post Office, it is a commercial product for which you have to shell out some cash, but their support team is top notch, and PMDF runs on several platforms, including VMS and several Unixes. They (Innosoft) can be reached at http://www.innosoft.com/.

-- Javier Henderson, May 11, 1997

There is also a very good free alternative to sendmail on Unix: qmail, written by D.J. Bernstein. You can have a look at it at http://www.qmail.org/ . It doesn't come with any kind of management tools or a GUI but it is safe, easy to install and very fast in most situations. It is not made as an replacement for sendmail. Mr. Bernstein requires you to have some basic knowledge about the "Unix way" to use software. I use qmail on several Linux machines (all 486/33 with 16MB RAM) without any problems. SPAM filtering and virtual domains are included in qmail. If you are looking for a free REPLACEMENT for sendmail you probably have to wait for the initial release of Vmail, a project startet by Wietse Venema (http://wzv.win.tue.nl/vmail/).

Frank

-- Frank Tegtmeyer, October 18, 1997

I just wanted to add to the support for Qmail. I've used it on my SGI Unix box as a complete replacement to sendmail since I first started it up. It's a lot easier to configure than Sendmail, and the qmail mailing list is pretty good at giving help if you're stuck.

-- David H Dennis, December 5, 1997

It looks like if you want to run Post Office on an Intel platform, you can only do it under NT.

Too bad they don't support any of the free Unixes available.

-- Javier Henderson, December 30, 1998

I've had some good experiences with Exim (see The Exim home page for more information). Exim is an open-source mailer, adopted by the GNU project, developed by Philip Hazel, at Cambridge University in the UK.
It allows seperate aliases files for each domain you are hosting - for example I ensure that webmaster@tardis.org and webmaster@netcetera.co.uk go to two separate addresses, while hosted on the same box.

I don't currently have a patch available for the "multiple addresses for MTA's" problem, and I'm not sure how simple this is for the MTA to control. I imagine that what is required is a patch to make the server bind to a specific address, rather than just the first one in the list. I've seen this type of patch for some IRC clients, but not for an MTA.

I use exim in a busy ISP - it's easy to manage, has a useful API to hook custom tools into, and seems to perform well. I've had no problems hooking in listservers such as majordomo into it.

-- Jonathan Care, April 13, 1999

I've admin-ed a bunch of Unix boxes since the mid 1980's (gasp) and at my advanced age (36) I'm not as impressed by thoroughly complicated machinery anymore, I just want stuff to work. So I was looking at ditching sendmail for one of the newer vintage (although sendmail keeps rev-ing). After playing around with a few packages, and hosing the sendmail that came with RedHat (see - I told you I got lazy), I decided to reinstall sendmail since I had a deadline coming up. I downloaded the source, and installed the way you install any other Unix software - skim the README, then type make; make install and grab a cup of coffee. Well, hey, they actually have a directory with a really, really short file that runs through a gazillion M4 macros to generate sendmail.cf Turns out that after all these years of battling the output, I should have been playing with the tiny little file that does exactly what I want, and is more like all the other Unix s/w I play with. I almost always edit config.h before installing, sorta like the mydomain.ini for ACS. It was pathetically easy to do, installed without a hitch, and did exactly what I wanted. There are decent examples on the web of tweaked files ... Turns out that sendmail has such a REPUTATION of being difficult, that I actually let myself get sucked into believing it. YMMV.

-- Alfred Werner, July 19, 1999

I have extremely good experiences with qmail. It is simple, secure, fast, feature-rich and easily extensible. It follows a standard Unix way of designing software, with lots of small replaceable processes linked together with pipes.

I set up qmail with virtual domains, spam blocking and a mailing list manager (ezmlm, designed for qmail) for an ISP guy in England. Even though I had never used Solaris before (!), qmail was easily installed.

Where do I submit articles for the Web Tools Review? I would like to write an article about setting up qmail.

-- Guan Yang, August 15, 1999

In addition to PostOffice, Sendmail, and Qmail there is another alternative that goes by the name of Intrastore.. which really promises a lot more than the various products mentioned above.. with a web interface.. and coming from the venerable CDC...this product is free on linux (availbale on other os's as well) for upto 250 users..

I have tried Intrastore and it works like a song receiving upto 1000 messages a minute on a DEC ALPHA..

-- Ramaswamy V, August 25, 1999

Yet another free mail transfer agent alternative is postfix, check <http://www.postfix.org/>. It's designed as a sendmail replacement, is fast, secure, easy to install and configure, and reliable.

-- Mike Fischbein, September 3, 1999

Exim is also my mailer of choice (for my home configuration, which is quite complicated; for simple configurations, well, sendmail comes with RedHat, so why bother changing it).

Exim has a bunch of advantages:

• Actually written with some thought about security, so no "comedy" rootshell security holes
• Configuration files that don't look like line noise[1]
• Comes complete with an excellent filtering tool, which you can use to do some things most MTA's can't do in a tightly integrated fashion (an obvious example is to fork a message; an example of a situation in which you might want to do this is to short-circuit delivery of mail to a user's local maildrop, but also kick it out onto your ISP's relay so that it can get to them if they're not home at the moment. That's actually what the example below is for.)
• Perl bindings (though not, unfortunately, as general as you'd want -- they're pretty much just for rewriting rules.
• Written by those nice people at the Cambridge University Computing Service[2]
• Compact and comprehensible manual
• Drop-in sendmail replacement (pretty much)

1. Well, you can if you try:

# 3. rewrite certain outgoing addresses to go to local recipients also, by
# changing *only* the envelope recipient
^(.*)$  ${lookup{$1}lsearch{/software/exim-3.03/conf/map.local}{__LOCAL_AND_REMOTE__$1}fail}    T
^__LOCAL_AND_REMOTE__([^@]+)@([^#]+)$   __LOCAL_AND_REMOTE__$1%$2@${primary_hostname}   T

... but in Sendmail this would undoubtedly look like <$< > @ < ... and on for another 200 characters, and frankly that's no fun.

2. OK, maybe that's not an actual advantage

-- Chris Lightfoot, September 18, 1999

Oh... and about your "great unsolved problem" -- this sounds to me like a problem with the upstream relay. There's no reason that I shouldn't be able to emit mail from, say, "chris@ex-parrot.com", into "relay.some-service-provider.net", so long as I am doing so from "some-machine.some-service-provider.net" (i.e., a machine for which relaying is permitted through that host). The fact that the message From: line is not "someone@somewhere.some-service-provider.net" should not be relevant.

-- Chris Lightfoot, September 18, 1999

When I went to find this software I got this: Attention Post.Office Customers: As of September 1, 2001, Openwave will discontinue the sale of Post.Office* from our corporate Web site and through our sales force. We will continue to offer support services for Post.Office through Openwave’s Technical Assistance Center (TAC) for an additional twelve (12) months with support ending August 31, 2002. openwave apear to have taken software.com as given by P. Greenspun in the link at the head of the article.

-- Laurence Cuffe, October 4, 2001

Personally, I install Postfix whenever I needs a MTA. Postfix seems to be the best alternative to Sendmail. It provides Sendmail compatibility, in a more secure and modular way, with a configuration that is clear to understand. Postfix is also lighter when it comes to system load.

I used Postfix as a SMTP gateway for a 2000 active mail users messaging system. It was trouble free.

-- Hubert Figuiere, March 12, 2002

• Postfix mailer home page- Home page for the Postfix MTA   (contributed by Mike Fischbein)

• Unofficial qmail home page- Very comprehensive listing of stuff for the qmail MTA. Links to all the official stuff from Dan Bernstein as well as hundreds of contributed fixes, enhancements, tips, FAQs, etc etc etc.   (contributed by Matthew Brown)