Subject: Re: replacing sendmail with postfix (summary)
To: William Allen Simpson <wsimpson@greendragon.com>
From: Andrew Brown <atatat@atatdot.net>
List: current-users
Date: 07/09/2003 23:27:27
>(1) currently, out-of-the-box, post install, neither mailer runs.  This 
>    is due to the NetBSD install requirement that no externally 
>    accessible services run by default.

correct.

>(2) there is *no* consensus on the sendmail configuration for merely
>    sending daily/weekly root mail, without accepting incoming mail
>    (the default necessary to install).  

i believe consensus was that you have to enable it.

>(3) sendmail example in /etc/defaults/rc.conf does work with the 
>    current sysinst, with some manual tweaking. 

the only "undesirable" aspect of enabling and running the default
sendmail is that it listens on all interfaces.  if you don't want it
to do so, the instructions on how to do that were simple and
straightforward.  if you don't do that, it will accept connections
from anywhere, but in all likelihood, refuse the mail.  or you could
run it out of inetd which could listen on the loopback interface
only.

>(4) manual tweaking is undesirable.

manual tweaking is, nevertheless required.

>(5) sendmail is better at managing large numbers of domains.

perhaps, perhaps not, but that's not particularly germaine to this
discussion.

>(6) the out-of-the-box install only needs single user mail forwarding, 
>    handling only 2 to 4 messages per day. 

true.  no issue there.

>(7) sendmail has a bigger memory footprint than postfix.

that all depends on your usage.  sendmail actually has a lower memory
footprint than postfix when you start it.  it's only over time and
high usage that sendmail grows larger than postfix.  that is not to
say that postfix doesn't grow also, but its growth curve is much
shallower.

>(8) sendmail has a history of security problems.

so does windows.  so does solaris.  so does hpux.  so does pine.

>(9) postfix does *not* have the localhost problem (PR install/21999), 
>    because postfix always uses FQDNs internally.

you are still expected to make sure that your name servers are
responding properly, regardless of what you do with them.

>(10) the change to use postfix without incoming mail is simple and 
>    straightforward (1 line).

right.  comment out the smtpd line, and enable postfix in
/etc/rc.conf.  sendmail, on the other hand, requires you to enable it
in /etc/rc.conf, add an additional flag via rc.conf, and that's it.
or you can manually frob the sendmail.cf.  or you can frob the
sendmail.mc file and build the new config and install it.

>(11) those desiring to use sendmail for larger installations also have 
>    the expertise to handle the mailer.conf change, and other changes.

those desiring to use a specific mta for a large installation are not
expected to be concerned about a single end system like this.

>(12) and most surpassing to me of all, most of the respondents, even 
>    those suggesting the fixes for sendmail problems I described, 
>    state they've changed to postfix.  The populi have spoken!

then you should switch, too.

>Therefore, I conclude that postfix should be the DEFAULT mailer, but 
>not the only mailer.  That requires only 3 file changes:
>
> * comment (add # next to) smtpd in /etc/postfix/master.cf

a similar change could be made the sendmail config file.

> * swap the commented lines (sendmail to postfix) in /etc/mailer.conf
> * have sysinst add "postfix=YES" to /etc/rc.conf
>
>This will not tread on anybody's toes, will not affect current 
>operations, will not prevent folks from using other mailers, but will 
>solve the current install bug (PR install/21998).

i'm sorry, but i don't see how switching to postfix as the default
mailer would solve your particular problem.  you seem to have issue
with the fact the daily reports don't get delivered, and the wherefore
of that has been examined in detail.  whichever mailer is the default
will still have to be enabled.

>Someday, there may be system packages instead, but they aren't here 
>yet, and nobody seems to be assigned to them.  Until then, this is 
>the only viable solution.

i don't see how system packages would affect this situation, except to
add more steps.

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior@daemon.org             * "ah!  i see you have the internet
twofsonet@graffiti.com (Andrew Brown)                that goes *ping*!"
werdna@squooshy.com       * "information is power -- share the wealth."