Re: Roundcube (was: Re: Mulberry and Windows 11 )

On 4/6/2023 4:06 PM, John Klensin wrote:
> This is more or less as I had feared.   My current setup with
> Mulberry for reading my own mail from "anywhere" is that I open
> an SSH tunnel to the outgoing SMTP and IMAP servers on my server
> machine which is, in turn, behind a fairly robust firewall.  Its
> SMTP server is open for incoming mail, but it is set up to not
> allow relaying (fairly standard these days).

I port forward to my server and rely on the STARTTLS connection to 
provide the protection. You might consider using a client certificate to 
log in to your mail services instead of a password. Run fail2ban to 
block the script kiddies.

Letsencrypt is pretty easy to use to assign a server certificate to your 
home server. You just need to expose the web server running Roundcube to 
the Internet (at least for the duration of the cert renewal) or use the 
Letsencrypt DNS client. Assign the name mail.example.com (substitute 
your domain) to your home IP address and have Letsencrypt grant a cert 
to that name so you can use an encrypted connection when accessing the 
server remotely.

Another approach is to lease a VPS to run your mail server. I do that to 
receive mail on my domain because my ISP doesn't allow port 25 
connections. I use the cheapest Linode.com. For $7/month you get a 
decent amount of CPU and memory to run an IMAP and SMTP server, plus 
regular backups. (I'm using Dovecot and Sendmail on CentOS 7, along with 
MIMEDefang, SpamAssassin, and ClamAV.) I connect to that from my home 
mail server with fetchmail to pull the received mail into their final 
folders.