SMTP server on pfSense.

Gertjan

@apetrenko said in SMTP server on pfSense.:

what I have to upgrade

Wasn't telling you what to upgrade. Don't know your hardware.
And with "PCI/SoC/ISO" all bets are off. Like patching a firewall with a mail server ;)

I do like the solution you found

bingo600

Won't the above solution need some kind of golang runtime/libraries to be installed ??
How do you ensure those packages are kept up2date ??

rcoleman-netgate

@apetrenko said in SMTP server on pfSense.:

I found a better and simple solution: https://github.com/wiggin77/mailrelay installed on pfSense.

Sideloading packages into pfSense will likely fail or disappear when you upgrade the platform. If you reach out to TAC you will be told to remove any repos and sideloaded programs before we will ever look at your machine.

apetrenko

@bingo600 binary is static. update package -- standard sysadmin task. Right?

apetrenko

@rcoleman-netgate since updates are coming no more often than 1 time per 3-5 years, I'm safe on this problem. :) I have an ansible for installing and configuring some 3rd party stuff on my pfsense.

And I don't think USAF will have any interest to my router.
[Tactical Air Command (USAF)]

Question to netgate: why are you so interested to prevent me to use smtp relay on pfSense box? You have no obligation, I'm using the "community edition". Everything on my responsibility. Why are you so much stirred up against my solution?

rcoleman-netgate

@apetrenko said in SMTP server on pfSense.:

Question to netgate: why are you so interested to prevent me to use smtp relay on pfSense box? You have no obligation, I'm using the "community edition". Everything on my responsibility. Why are you so much stirred up against my solution?

Any add-on to your system comes with its own unknowns and potential security holes that could be exploited.

If you want to keep a fully secure system the best route is to not add outside (untested) binaries and leave yourself secure by putting the job of a mail server onto a ... mail... server... and not a firewall.

jimp

@apetrenko said in SMTP server on pfSense.:

Question to netgate: why are you so interested to prevent me to use smtp relay on pfSense box? You have no obligation, I'm using the "community edition". Everything on my responsibility. Why are you so much stirred up against my solution?

Because this is a security product and e-mail services have a long history of being a gigantic attack surface full of holes and bringing more risk than anyone sane would want to take on. Most other add-on services are either only still around because they're entrenched (and hard to get people to stop using) or because the risk is relatively low by comparison.

If you want to do it, you're on your own. That kind of service does not belong on a firewall.

EOT. Locking.