HI,

I currently running a postfix(2.1.5-9) mail server under debian sarge 3.1 environment. There are a couple more server inside the machine, things like LAMP(intranet only) and samba. The server is protected behind cisco router with vpn configured and iptables inside the exact server (ya, everything in one box...).

Now, I would like to install an web interface for ppl to access email on browse outside the LAN network. I wonder if webmin(got its own webserver) is safe enough to do the job or should i run it with openwebmail by utilizing apache(version 1.33)?

Also, i would like to know what are the things i need to consider to not open a big security hole for hacker to get through.



Thanks in advanced


chris

Webmin is going to be massive overkill to simply allow people to access mail. It has the ability to view/modify a huge number of things on the system, including turning on/off services, user admin, iptables config, etc. If all you need is mail, then I'd setup something specifically designed for that job like POP or webmail. Using webmin is going to open more potential holes than it would solve for this scenario.

As far as security, obviously you'll want to implement some kind of authorization so that only valid users can send mail otherwise you'll find your machine being used to send spam. You'll also want to harden Apache and the underlying OS itself. OS and Apache hardening guides can be found in the Security references thread and the Apache site has info on security as well. I'm also reading a fantastic book on Apache hardening which I would highly recommend.

sorry i was meant to say 'usermin'(a cutdown version for end user) then webmin :P

But i have the same feeling that apache seems to be flexible in term of tighten up the security then the mini web-server provide by usermin... but i just want to confirm you guys.


thx