Hi everyone,
I have been using OPNsense Business Edition as a mail gateway with the Postfix and Rspamd plugins for quite some time. The setup works well and has been very reliable.
However, I have recently started questioning whether OPNsense is still a suitable platform for running a mail gateway, particularly from a security and long-term maintenance perspective.
My main concern is the maintenance and update cycle of the Postfix and Rspamd packages and their corresponding OPNsense plugins.
Some examples:Rspamd: Until recently, the OPNsense ports tree was still at version 4.1.0, while upstream had already released 4.2.x, including several security fixes. Fortunately, version 4.2.3 has now been merged into the OPNsense ports tree, which is encouraging.
Postfix: While the Community Edition already provides Postfix 3.11.7, my Business Edition installation (26.4.2p4) still ships with Postfix 3.11.3.
Business vs. Community: The Business Edition follows a different release cycle and appears to lag behind the Community Edition regarding certain package updates. While I understand the benefits of a more conservative release process, this raises questions about the timely distribution of security fixes.
I am aware that the OPNsense plugins and the underlying FreeBSD packages are separate components, and that an unchanged plugin version does not necessarily mean the underlying software is outdated.
Nevertheless, a mail gateway processes untrusted content from the Internet, making timely security updates particularly important.
This raises a few questions:- Is OPNsense still actively maintained and recommended as a platform for running a Postfix/Rspamd mail gateway, both in the Community and Business Editions?
- Are security updates for Postfix and Rspamd actively monitored and prioritised, even when the corresponding plugins receive little development activity?
- How does the Business Edition handle security vulnerabilities in packages that are newer in the Community Edition? Are security fixes backported, or do Business users have to wait for the next major release?
- Is there any established maintenance commitment for the Postfix and Rspamd plugins, or do they primarily depend on individual community contributors?
I am not looking for additional features. My main interest is a reliable, secure and reasonably low-maintenance mail gateway.
I really appreciate the work that goes into OPNsense, and I would prefer to continue using it for this purpose. However, I would like to better understand whether the current maintenance model provides sufficient security coverage for Internet-facing mail services.
I would be particularly interested in feedback from the OPNsense developers and other administrators running Postfix/Rspamd in production.
Thanks for your insights!
1. The user base for postfix/rspamd is probably more silent that you might wish. Impossible to say what size it is. More postfix and rspamd plugin development would probably change that, but that is also purely dependent on the user base.
2. I think this starts at the wrong end since we're mostly a consumer of FreeBSD ports:
ports % git grep -e rspamd -e postfix security/vuxml/vuln/2026.xml | wc -l
0
For the core team everything not in the core doesn't get extra attention beyond that.
3. Simple, see 2.
4. Both plugins are on hold, see 1.
Cheers,
Franco