Very Computer

This should be a piece of cake question to answer for anybody that has spent
any time as an IT guru (which I haven't ;-)

I want to set up email hosting for my company.  We currently have a hardware
firewall that provides DMZ, outside and local intranet connections guarded by
policies.  We have a fat pipe coming into the firewall.

I want to place a bastion host (a hardened Linux box) on the DMZ running
postfix as the SMTP server and qpopper as the POP3/IMAP server.

I want all employees to be able to use the SMTP server to send out all mail
from the intranet.  They should also be able to access their mail stored on
the bastion host via POP3 (IMAP?) from the local net to the bastion host
through the firewall.  It would also be nice if they could access their mail
from outside the company via IMAP.

Perhaps later, another two bastion hosts on the DMZ running FTP and HTTP
servers.

Is this doable?  Does this pose security risks?

Thanks for your comments.

Very do-able. It poses acceptable security risks to my mind. Most of
that risk will be centered on how well you can secure the bastion
host. You will be able to configure, using tcp wrappers and your
firewall who can use the IMAP and POP servers. Also pay attention to
who you leave the SMTP server open to as a relay. You don't want to
let the world have it.

-burk

--

Thanks for the response!

Obviously, this is a huge topic and I have alot of learning to do.  I know
that a server like Mercury allows outside users to relay but only with a
user/password challenge.  The problem with that is that it is transmitted in
the clear.  Is there any wayto allow selected relaying with encrypted login
from the outside?

Well, what comes to mind is some sort of APOP or encrypted POP3 with
a POP before SMTP solution. You could run your POP services over an
SSL tunnel, and then you use some program to open the relay for any
user that has sucessfully POPped.

here's a few interesting sites....
http://www.networkcomputing.com/1018/1018ws22.html
http://www.rickk.com/sslwrap/
http://www.iecc.com/pop-before-smtp.html

Hope this helps!

-burk
--