RE: Account Creation and Password Change

Hi Faisal,

> HI,
>
> Thanks for all your feedback I initially discouraged my company to use
> such system but they were insisting me to do so.  I knew that it's gonna
> be BIG hole and could result with complete own/compromised system. Now I
> gonna put these replies to Management (computer illiterate) that what I
> was saying is right.

Handling the suits can be a problem. They tend to like what they've heard
is popular rather than what works best, but they generally always respond
when you throw $$ figures around. If you make it clear that a compomised
system will cost much more than securing a system does, they just might
give you the leeway to make the decision yourself, based on informed
advice and best practices.

> Ok I need a suggestion that all my user's need only mailbox no access to
> box we are an small ISP here which mail MTA should I go for? Currently I
> am using sendmail.

Email admin is quite a bit different than system admin. There's no need to
have email users as system users if all they do is catch email. In fact,
considering that they will likely from time to time be logging in from
unsecured locations, it's ideal to have email users set up as not system
users. It makes the system a little more difficult to crack for the script
kiddies.

Sendmail is a huge monolithic beast in comparison to postfix and qmail.
Both of these 2 are lighter, faster and more secure. IMHO postfix is the
fastest and easiest to use and configure, but qmail has more options, and
the guys on the qmail list like really hard (and extremely detailed)
questions provided you've done your homework extensively.

Sendmail has been around a while, and while maturing had some security
problems, though it's reasonably secure now. Postfix and qmail are both
pretty secure (nothing is 100%), more so than sendmail.

You also have the cyrus-SASL option. I've done the preliminary homework on
cyrus-SASL and shied away from it in preference for the other 2 I
mentioned. Courier also has a lot of options, and comes in a complete
package with about 10 different email admin tools, including a webmail
interface. Not as secure as postfix or qmail, but with plenty of options.

Someone else mentioned postix with MySQL, which is a good suggestion.
Before you just drop it in and go for it though, I would do the homework
on these others and then put together a matrix of options and make your
decision based on the results according to your needs. (Not everyone needs
a super secure email system, not everyone needs a whole mess of options.)

> Or I use sendmail with virtusertable ?

You could, I wouldn't.

HTH
-- 
Keith Mastin
BeechTree Information Technology Services Inc.
Toronto, Canada
(416)696 6070