[tarballed]

Hello everyone and Happy Holidays!

Well, I thought i'd start a thread here about a setup im working on (still workign on the LDAP setup...almost done).

As it stands right now, I have a Mail gateway on our company DMZ running FreeBSD 4.9, postfix-2.0.16 and mailscanner. Working like a champ right now.

We also have a internal mail server that is running Red Hat 8.0, with postfix-2.0.14 and courier-imap 2.2.1. Working pretty good as well.

What i'd like to do is setup webmail here, so anyone can access their email no matter where they are. I've been checking out SQWebmail, squirrelmail and horde, but haven't decided which one im going to use yet.

However, my main question is in the network layout and design of this setup. Since our actual mail server is on a private part of our network, i've been trying to figure out the best, more secure way to setup webmail.

I've figured at a minimum cyrus-sasl is needed so I can setup smtp auth, so only valid users can send mail through my mail server, no matter where they connect from.

But where im really in a bind is, designing this, from a firewall rule setup. For instance, since the mail server is isolated from the internet, it really cannot be accessed unless you are on our LAN.

With that in mind, what are my alternatives? Do I setup some type of custom filter on my firewall to allow access to my mail server? Or do I setup something on our DMZ? Maybe setup a relay server of some sort?

I thought i'd post here and get some additional ideas here, so I can begin working on this once i've finished my PDC/LDAP server.

Thanks everyone and Happy Holidays!

Tarballed

[elmore]

best thing to here here is setup an iplessbridge in front of you dmz so traffic behind it (i.e.) traffic in you dmz if protected by your bridge. Then for whatever webmail package you use (Horde BTW is the best free webmail client around, no need to even evaluate the others) just have it tunnel through to your internal mail server. That way no user accounts or Maildirs/ are actually stored on the webmail server. You of course want to do this over https (just do a self signed cert) then just stunnel through your firewall on a nonstandard port to your internal imap server.

Done. The whole thing should take less than a couple of hours.

[tarballed]

I've been thinking about this for a bit, and I came across one option.

Probably, the easiest way I could do this is to put the actual mail server on the DMZ, and configure everything appropriately; webmail, cyrus-sasl, apache, postfix etc.

This would seem to be the more straightforward approach.

However, one thing, if I did set this up that would be a downside, is the use of a mail gateway, which I really liked.

By chance, anyone out there setup their email server in a similar fashion? I may go this route, and would probably use FreeBSD as the mail server. I saw soup4you2's how-to, and it looked very nice...

I appreciate it.

Tarballed

[tarballed]

or....

What about setting up webmail on the actual mail gateway itself?
Then, I could setup IMAP to acess the internal mail server to view clients emails...

Or is that not a feasible idea?

Thoughts?

T

[tarballed]

best thing to here here is setup an iplessbridge in front of you dmz so traffic behind it (i.e.) traffic in you dmz if protected by your bridge. Then for whatever webmail package you use (Horde BTW is the best free webmail client around, no need to even evaluate the others) just have it tunnel through to your internal mail server. That way no user accounts or Maildirs/ are actually stored on the webmail server. You of course want to do this over https (just do a self signed cert) then just stunnel through your firewall on a nonstandard port to your internal imap server.


I'm assuming that OpenBSD would be the best option for the iplessbridge?
Any known issues being that the box would connect from our commercial firewall to the iplessbridge, then to the DMZ? (Trying to cover all angles here)

I see...I would setup the actual webmail client on a server on the DMZ, correct? Then it would tunnel from the DMZ to the internal mail server...

Sounds cool....

Tarballed