Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I just did [a test][1] that told me my gateway's (debian squeeze) port 110 is visible from outside.

It's a box with two network cards, eth0 is for my internal network (192.168.1.0/24) and eth1 goes to "the internet" (as ppp0).

Is an open port 110 on the outside connection a necessity when I run postfix, use the box to collect mail using fetchmail, and have the mail collected by internal boxes using pop3 (popa3d)?

Is everything o.k. as long as my postfix has a main.cf with lines like these?

mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128 192.168.1.0/24
inet_interfaces = 192.168.1.1, 127.0.0.1

where 192.168.1.0/24 is my home network and 192.168.1.1 is eth0?

Or was I stupid and opened a port I should rather have closed or invisible to the outside network?

share|improve this question

1 Answer 1

up vote 5 down vote accepted

Having port 110 (POP3) open and available is completely normal if your intention is to run a POP server. POP3 is perhaps a bit archaic/obsolete and you might consider using IMAP instead, but there is nothing fundamentally wrong with it.

I don't know what test you used, but it might be that it is signalled as a problem because STARTTLS is not supported, which means passwords will be sent in the clear. The POP3 protocol supports STARTTLS but it seems like popa3d might not. Perhaps you should consider using a better POP server, such as Dovecot. Dovecot also supports specifying which IP addresses to listen on in its config file, which popa3d also appears not to support, so perhaps you might also want to use that if you want to accept POP3 connections only on the WAN and not on the LAN.

By the way, you listed Postfix configuration directives in your question, which have nothing to do with POP (or IMAP).

share|improve this answer
    
Well, it's a POP server, and as such, port 110 is required to be open - but the only machines that are supposed to collect mail are on the internal network. Is it reasonable (or possible) to open port 110 on the internal interface (eth0) and close it for the external interface (eth1/ppp0), or will this break my ability to collect mail at my provider's mail server? –  zebonaut Feb 24 '13 at 20:21
    
popa3d does not appear to be configurable enough to allow binding to a specific interface/address (i.e. eth0 and not eth1 or ppp0). You could always work around that with firewall rules, but that's neither elegant nor good for defense in depth. More devastatingly, it doesn't seem to support STARTTLS either, meaning passwords will be sent in the clear. For these two reasons (especially the second), I recommend you use a better POP server, such as Dovecot. It will solve both problems for you. –  Celada Feb 24 '13 at 21:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.