From owner-freebsd-arch@freebsd.org Thu Dec 28 19:17:04 2017 Return-Path: Delivered-To: freebsd-arch@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 356C7EAF104 for ; Thu, 28 Dec 2017 19:17:04 +0000 (UTC) (envelope-from julian@freebsd.org) Received: from vps1.elischer.org (vps1.elischer.org [204.109.63.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "vps1.elischer.org", Issuer "CA Cert Signing Authority" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 1BFC5668A5; Thu, 28 Dec 2017 19:17:03 +0000 (UTC) (envelope-from julian@freebsd.org) Received: from Julian-MBP3.local (115-166-0-128.dyn.iinet.net.au [115.166.0.128]) (authenticated bits=0) by vps1.elischer.org (8.15.2/8.15.2) with ESMTPSA id vBSJGuoS005035 (version=TLSv1.2 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO); Thu, 28 Dec 2017 11:17:01 -0800 (PST) (envelope-from julian@freebsd.org) Subject: Re: RFC: Sendmail deprecation ? To: karels@FreeBSD.org, "freebsd-arch@freebsd.org" References: <201712131321.vBDDL29q039904@mail.karels.net> From: Julian Elischer Message-ID: Date: Fri, 29 Dec 2017 03:16:49 +0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0) Gecko/20100101 Thunderbird/52.5.0 MIME-Version: 1.0 In-Reply-To: <201712131321.vBDDL29q039904@mail.karels.net> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Content-Language: en-US X-BeenThere: freebsd-arch@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: Discussion related to FreeBSD architecture List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 28 Dec 2017 19:17:04 -0000 On 13/12/17 9:21 pm, Mike Karels wrote: > It is clear that there isn't a consensus on a single choice of MTA, > and that is fine. Here is a summary of my take on current options > after reading the discussion to this point: > > First, we seem to agree that the target for a default setup is not > that of an Internet-facing MTA, which requires some thought and > configuration. Instead, the target is an originate-only system > that does either on-box mail delivery or outbound delivery. At the > very least, it can deliver the sysadmin emails configured by default. > > The options that have been presented: > > o Use dma. That would apparently suffice for some systems, and is already > in base. However, in my opinion, it is missing some capabilities that > some sites (including mine) may require: > - .forward processing > - Its masqerade configuration seems to be too simplistic, e.g. > masquerade all or nothing, rather then exempting root and other > specified system users. > - Some mail clients, e.g. perl packages that we use at $JOB, connect > to localhost:25 (or SMTP on some other host) rather than invoking > "sendmail" directly. dma will not support these. > In addition, it is not as well integrated into the system. It wasn't > immediately obvious to me how to enable it, until I followed the > "See Also" to mailwrapper; I guess I knew that at one time. It also > requires manual configuration of TLS and a certificate if you want to > use TLS. > > o Use the sendmail in base, configured for submission only. This is > completely integrated and works out of the box. It has none of the > limitations listed for dma. IIRC, a certificate is generated automatically > so that TLS could work with no additional configuration. Presumably this > could be done for dma as well, but it has not been done. > > o Use the sendmail in ports. This is apparently more full-featured, but not > as nicely integrated with FreeBSD. No one has volunteered to resolve this > so far. Or maybe it isn't that hard. But it wouldn't work "out of the > box;" the system woudln't have this MTA available until manually installed. > > o Use some other MTA, e.g. OpenSMTPD. Of course there are Postfix, Exim > and probably others, mostly aimed at full-service MTAs. I know little > about these, but they are not pre-configured. (OK, I once configured > an Exim system and got it to do what was required for a test, but I've > blocked it from my mind.) > > Another issue that has been brought up: > > o It's a bother to remove sendmail to replace it with something else if it > is not a package. I don't understand; isn't it just a matter of putting > sendmail_submit_enable="NO" into /etc/rc.conf to be ready to configure > something else? Or are people so short of disk space that they need to > remove the binary, config files, etc? > > It seems to me that the option that is best-integrated, and which serves > the needs of the greatest number of systems, is the sendmail in base. I still > favor a configuration step that selects one of a small number of MTA choices > and configures it, but we don't seem to have a framework for doing that now > if we want something to be working out-of-the box. Thus, I think that > removing sendmail from base now would make the system less flexible and > usable. This is close to my thinking.. I see no real reason to remove it.. the binary isn't exactly huge by today's standards.. -r-xr-sr-x  1 root  smmsp  696880 Aug 24 03:56 sendmail [julian@porridge ~/p4/build_inv_10x]$ ls -l `which vim` -rwxr-xr-x  1 root  wheel  2389560 Aug 11 21:23 /usr/local/bin/vim [julian@porridge ~/p4/build_inv_10x]$ ls -l /lib/libc.so.7 -r--r--r--  1 root  wheel  1654264 Aug 24 03:54 /lib/libc.so.7 Currently  it is the most integrated and I've found it reliable. if it has SSL built in by default we'd be golden. > > Mike > _______________________________________________ > freebsd-arch@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-arch > To unsubscribe, send any mail to "freebsd-arch-unsubscribe@freebsd.org" >