I have an internet connection with a public, static IPv4 address (the IP address has a PTR record for foo.org domain, and I own foo.org domain, and have nameservers for it elsewhere, mx record is set to use the static ip). I have an OpenBSD i386 installed on a machine that is the only thing that uses this internet connection.

If I nmap all the port of it from the internet side, I can't see any open ports. Great. Since no service is running on the OpenBSD machine that is faced to the internet.

I need to install a mail server on it, so people could use it for sending/receiving e-mails securely.

So I googled and I will choose to install:

OpenSMPTd for SMTPS (using port 465)
popa3d for POP3S (using port 995)

Question: is this enough for a mail server? Will I be able to send/receive e-mails? (only port 465 will be open for the world/internet, pop3s will be only allowed from localhost, because we will use an ssh tunnel /with port knock/ to this openbsd machine to receive mail), so nmaping all the ports of the openbsd machine only outputs that port 465 is open.

UPDATE: so it turn out I don't really need a pop3 server, because I just need to log in to the openbsd machine, and there I can see the mails locally(afaik thunderbird can be set to see local mails.).

  • 1
    SMTPS is deprecated (since 1998), and port 465 hasn't been assigned to it for a while. Submission is on port 587, see RFC 6409. – derobert Dec 12 '12 at 21:56
  • Try it and see? – Kevin Dec 12 '12 at 23:03

You will be able to send mail, and your users will be able to submit mail to the system, but most if not all mail servers will look for SMTP (port 25) to submit mail to you. You can encourage TLS on the SMTP port, but I don't believe mail servers normally try to deliver to SMTPS.

| improve this answer | |
  • 1
    Gasko Peter could even require TLS on the SMTP port (e.g., by rejecting MAIL FROM without it, which will cause a lot of people to be unable to mail you, but, that's your choice). You're quite correct, mail servers connect to port 25 to send mail. To be a mail server, it must be open and speak SMTP. – derobert Dec 12 '12 at 21:54

first of all OpenSMTPD rocks (as everything OpenBSD) :) Here is a sample smtpd.conf for you. fields containing "your" must be supplied by you.

# This is the smtpd server system-wide configuration file.
# See smtpd.conf(5) for more information.
listen on lo0 port 25
#here you must have a certificate created named "mail.yourdomain.net"
listen on $ext_if port 25 tls certificate mail.yourdomain.net auth-optional
hostname "mx.yourdomain.net"

map secrets source db "/etc/mail/secrets.db"
map aliases source db "/etc/mail/aliases.db"
accept from any for domain "yourdomain.net" deliver to mda "procmail -f -" 
accept for local alias aliases deliver to mbox
#check smtpd.conf(5) for more possible URIs (smtps+auth, ssl+auth .. etc)
accept for any relay via tls+auth://mail.upstreamprovider.com auth secrets

check also this post about OpenSMTPD config (for the creation of the certificates) as well as the great calomel.org guide. As for the popa3d i've heard that it's fine , but for my personal use i always prefer to SSH onto my box and view my mails that way (but very few people would like that these days) so i don't need to run a POP service...

Another thing is that if you chose IMAP over POP you get for free the ability to get a webmail program running on top of it like davmail (but not sure if you want that).

Finally don't forget to check the lists because OpenSMTPD is improving all the time and if you follow -current check that page too. cheers!

| improve this answer | |

Yes this should work, you will need to enable port 25 to make sure MTAs can deliver mail to you - see SMTP specification and SMTPS on wikipedia (and links therein).

As a side note: instead of a ssh tunnel you might want to use stunnel.

| improve this answer | |
  • 3
    s/old MTAs/everyone else on the Internet/. MTAs relay mail over port 25. It can (should!) be secured with STARTTLS. But it doesn't happen over port 465. – derobert Dec 12 '12 at 22:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.