Qmail [was Re: [Israel.pm] Detecting Random characters]

Yuval Yaari yuval at windax.com
Mon Oct 4 10:00:10 PDT 2004


Shlomi Fish said:
>> 2. They aren't that much easier to configure
>
> Even a little is OK.

That's true.

>
>> 3. They need more maintainance than qmail
>
> More maintenance? How so? Can you give examples? Have you used qmail in
> the  same scenarios as you used Postfix and Courier?

Yes.
Just a quick example: I had to upgrade postfix because of a security hole.
I never want to recompile anything just to solve a security hole.
I often find (found...) myself doing it.
I love qmail because I never upgrade it, and I don't need to.

>
>> 4. They aren't as secure/stable/fast as qmail
>>
>
> Are they not as secure as qmail? Are they not as stable? Are they not as
> fast?  Secure, stable and fast are three completely different things.

They are not as fast (according to benchmarks, you may or may not trust
these).
They are not as stable (I could be wrong on this one, but I had to restart
postfix, etc).
They are not as secure (look on the net for security issues with each of
them).

> I know qmail is an excellent product. However, I cannot rely on its
> author to  be supportive of me because of his bad attitude. And I do
> need maintainers  that are supportive, or at least the option to fork
> the project. In qmail, I  have none.

Ok, that's a valid point.
Still doesn't matter me much (personally).

> But at least Cube is BSD-licensed so I can fork it. In any case this was
>  frustrating. Now, imagine if the same happens to qmail? I can always
> avoid  playing a stupid 3-D game, but I depend on a mail server.

Just modify the source and recompile.
DJB won't sue you.
I will cover all your expenses if he does, really :)

> And re-compiling the software takes more. And putting the patch in your
> build  script for posterity also takes time. And eventually you need to
> manage a  great deal of patches. I'm glad I'm using Mandrake (or Debian
> for that  matter) instead of a something like Slackware, so I can
> upgrade packages by  installing the RPM or SRPM.

That's what I like in qmail, I never recompile.
That's exactly the point :)
I do NOT have to upgrade (tfu-tfu-tfu)...

>> You can use it without patches.
>
> Read "The qmail Handbook" - it describes a great deal of patches that
> are  essential for some tasks.

qmail.org also has a big list.
I did not need to patch mine.
Even when I did, once, it took me 5 minutes including download-time, etc.

> Because I like Mandrake, and think it makes a great distribution for a
> client  system, or even a server. If not Mandrake, then Debian, or
> RedHat, or any  other binary-based distributions. Naturally, in Gentoo
> and source-based  distributions, it is less of an issue, but if I had to
> recompile everything  for any simple upgrade, I would lose my mind, and
> so would most people out  there.

I used qmail on a binary based distribution.
I still compile code when it comes to qmail and apache.

> Well, I agree that some things should be installed from source. A
> mail-server  is usually not one of them. And for many hosts carrying
> web-servers neither  is a web-server. Mandrake comes with an excellent
> Apache distribution, with  SSL-support, Apache 1 and Apache 2, mod_perl
> and mod_php, etc. It may be more  bloated than a distribution kept to
> the minimum, but it's very nice and  usable. The configuration was also
> made very easy.

Any default apache configuration/compilation stinks.
There are things that must match your needs...
It loads too many modules, which cause it to use a lot more RAM.
It's good enough for your personal website, maybe.

>> Please try to use them. Even on a small mail server.
>> I've been using Qmail for 2 years now, and I really haven't touched it
>> except for compiling once.
>> Postfix had a lot of security issues, and I personally didn't like it.
>> I don't see how Postfix or Courier are any better.
>>
>
> "Postfix... I don't see how Postfix or Courier..." - something is wrong
> here.

I gave a reason why I would never go back to Postfix.
Then I said that I can't see how Postfix or Courier are any better.

> Can you please double check this last sentence?

I just did.

> In any case, postfix/courier/exim/whatever will be very easily upgraded
> at the  next update round of the packages. This cannot be said on qmail,
> whose  upgrade will be much more problematic.

You don't see the point.
Postfix needed too many upgrades.
And as "easy" (i.e: easier than qmail) as they were, I just don't need to
do that with qmail.
Zero updates in two years, w/o giving up on security.
You just don't upgrade qmail, and that's why I like it.
Take a look at their version, I think 1.03 came out at 1998!
If I were to install qmail in 98, and still have the same mail server
untouched, I would be so happy right now.
I installed it in 2002 and I hope it could survive until 2008 w/o upgrades :)
Postfix is going to have too many bugs and security holes by then.

I hope you see my point.

> I _would_ use a package. I use a package whenever possible.

I'd never use a package for qmail, because you install it once, and keep
it for years.
I would rather take a WEEK to install qmail from source, than upgrade
Postfix's package every week.

  --Yuval





More information about the Perl mailing list