OPNsense as mail gateway, security view

[jassonmc]

Hi everyone,

I have been using OPNsense Business Edition as a mail gateway with the Postfix and Rspamd plugins for quite some time. The setup works well and has been very reliable.

However, I have recently started questioning whether OPNsense is still a suitable platform for running a mail gateway, particularly from a security and long-term maintenance perspective.

My main concern is the maintenance and update cycle of the Postfix and Rspamd packages and their corresponding OPNsense plugins.

Some examples:

Rspamd: Until recently, the OPNsense ports tree was still at version 4.1.0, while upstream had already released 4.2.x, including several security fixes. Fortunately, version 4.2.3 has now been merged into the OPNsense ports tree, which is encouraging.

Postfix: While the Community Edition already provides Postfix 3.11.7, my Business Edition installation (26.4.2p4) still ships with Postfix 3.11.3.

Business vs. Community: The Business Edition follows a different release cycle and appears to lag behind the Community Edition regarding certain package updates. While I understand the benefits of a more conservative release process, this raises questions about the timely distribution of security fixes.

I am aware that the OPNsense plugins and the underlying FreeBSD packages are separate components, and that an unchanged plugin version does not necessarily mean the underlying software is outdated.

Nevertheless, a mail gateway processes untrusted content from the Internet, making timely security updates particularly important.

This raises a few questions:

• Is OPNsense still actively maintained and recommended as a platform for running a Postfix/Rspamd mail gateway, both in the Community and Business Editions?
• Are security updates for Postfix and Rspamd actively monitored and prioritised, even when the corresponding plugins receive little development activity?
• How does the Business Edition handle security vulnerabilities in packages that are newer in the Community Edition? Are security fixes backported, or do Business users have to wait for the next major release?
• Is there any established maintenance commitment for the Postfix and Rspamd plugins, or do they primarily depend on individual community contributors?

I am not looking for additional features. My main interest is a reliable, secure and reasonably low-maintenance mail gateway.

I really appreciate the work that goes into OPNsense, and I would prefer to continue using it for this purpose. However, I would like to better understand whether the current maintenance model provides sufficient security coverage for Internet-facing mail services.

I would be particularly interested in feedback from the OPNsense developers and other administrators running Postfix/Rspamd in production.

Thanks for your insights!

[franco]

1. The user base for postfix/rspamd is probably more silent that you might wish. Impossible to say what size it is. More postfix and rspamd plugin development would probably change that, but that is also purely dependent on the user base.

2. I think this starts at the wrong end since we're mostly a consumer of FreeBSD ports:

Code Select Expand

ports % git grep -e rspamd -e postfix security/vuxml/vuln/2026.xml | wc -l
       0
For the core team everything not in the core doesn't get extra attention beyond that.

3. Simple, see 2.

4. Both plugins are on hold, see 1.


Cheers,
Franco

[Monviech (Cedrik)]

I ran Plesk as mail gateway, which also gives you more than postfix.

You can configure amavis and spamassassin and more in it.

Of course the convenience of getting all these features easily configured and up to date + modern Webgui costs some subscription money.

But I would rather use a dedicated server for mail stuff. If mail is a first class citizen of a  paid product it is maintained and secure.

[mimugmail]

Postfix/rspamd was quite fun to build back in the days, but nowadays I'd stick to proxmox Mail gateway

[nero355]

The user base for postfix/rspamd is probably more silent that you might wish. Impossible to say what size it is. More postfix and rspamd plugin development would probably change that, but that is also purely dependent on the user base.

What are you saying exactly ?
Is Postfix becoming deprecated ?
Or is there just less and less support for it when the OS it runs on is FreeBSD ?

I ran Plesk as mail gateway, which also gives you more than postfix.

You can configure amavis and spamassassin and more in it.

Of course the convenience of getting all these features easily configured and up to date + modern Webgui costs some subscription money.

Plesk/cPanel/DirectAdmin were pretty much THE ONES to use when I use to work for a Hosting/Server Rental Company in the past :)

But it's a lot of software for just e-mailing to be honest...

But I would rather use a dedicated server for mail stuff.

+1 here!

My opinion is that a lot of people "overload" their OPNsense with too much stuff that does not belong on it and could also avoid a lot of update/upgrade issues!

Nowadays I'd stick to proxmox Mail gateway.

Also a good option IMHO considering the fact that it has been developed for a decent amount of years by now so it should be a solid product! :)