Jump to content

OpenSMTPD

From Wikipedia, the free encyclopedia

OpenBSD SMTP Server
Developer(s)The OpenBSD Project
Initial release5.3 / 17 March 2013; 11 years ago (2013-03-17)[1][2]
Stable release
7.5.0p0 / 10 April 2024; 5 months ago (2024-04-10)[3]
Repositorycvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/smtpd/
Written inC
Operating systemOpenBSD, FreeBSD, NetBSD, Linux, macOS[4]
PlatformCross-platform[4]
Standard(s)RFC 5321
TypeMail transfer agent
LicenseISC
Websitewww.opensmtpd.org Edit this on Wikidata
As ofJuly 2016

OpenSMTPD (also known as OpenBSD SMTP Server) is a Unix daemon implementing the Simple Mail Transfer Protocol to deliver messages on a local machine or to relay them to other SMTP servers. It was publicly released on 17 March 2013 with version number 5.3, after being in development since late 2008.

OpenSMTPD is primarily developed by Gilles Chehade, Eric Faurot and Charles Longeau as part of the OpenBSD project. Its design goals include security, reliability, ease of configuration, and support for common use cases. The source code is available under the ISC license.

Its portable version, like that of OpenSSH, is developed as a child project which adds the portability code to the OpenBSD version and releases it separately. The portable version was initiated by Charles Longeau and adds support for multiple operating systems including NetBSD, FreeBSD, DragonFly BSD, and several Linux distributions.

History

[edit]

The development of OpenSMTPD was motivated by a combination of issues with current SMTP daemons: difficult configuration, complicated and difficult to audit code, and unsuitable licensing.[5][6] OpenSMTPD was designed to solve these problems and make mail exchanges accessible to a wider user-base. After a period of development, OpenSMTPD first appeared in OpenBSD 4.6.[7] The first release shipped with OpenBSD 5.3.[1][2][8]

On 2 October 2015, the results of a security audit were released. Version 5.4.4p1 was audited, and nine issues were found.[9] As a result, OpenSMTPD 5.7.2 was released to address these issues.[10]

On 28 January 2020, a vulnerability in OpenSMTPD was disclosed that could be remotely exploited to run arbitrary shell commands as root. OpenSMTPD 6.6.2 was released to fix the vulnerability.[11] [12]

Goals

[edit]

OpenSMTPD is an attempt by the OpenBSD team to produce an SMTP daemon implementation that is secure, reliable, high performance, simple to security audit and trivial to set up and administer. Code is designed to keep the memory, CPU and disk requirements as low as possible but it is admitted that large mail systems are not intended to be run on low-end machines, and trade-offs are made where higher memory usage would bring indisputable benefits.[13]

As such, the design goals for OpenSMTPD are: security, ease of use, and performance. Security in OpenSMTPD is achieved by robust validity check in the network input path, use of bounded buffer operations via strlcpy, and privilege separation to mitigate the effects of possible security bugs exploiting the daemon through privilege escalation. In order to simplify the use of SMTP, OpenSMTPD implements a smaller set of functionalities than those available in other SMTP daemons, the objective is to provide enough features to satisfy typical usage at the risk of unsuitability for esoteric or niche requirements.

References

[edit]
  1. ^ a b "OpenBSD 5.3 introduces stable SMTPD". h-online.com. 1 May 2013.
  2. ^ a b "OpenSMTPD 5.3 released". poolp.org. 17 March 2013. Retrieved 27 September 2024.
  3. ^ Polo, Omar (10 April 2024). "OpenSMTPD 7.5.0p0 Released". openbsd-announce (Mailing list). Retrieved 27 September 2024.
  4. ^ a b "OpenSMTPD Portable Release". OpenBSD. Retrieved 15 October 2015.
  5. ^ "OpenSMTPD Goals". opensmtpd.org.
  6. ^ Corbet, Jonathan (27 May 2009). "Coming soon: OpenSMTPD". Linux Weekly News (LWN). Retrieved 6 April 2012.
  7. ^ "OpenBSD 4.6". openbsd.org.
  8. ^ "OpenBSD 5.3". openbsd.org.
  9. ^ "OpenSMTPD Audit Report". Qualys. 2 October 2015. Retrieved 11 October 2015.
  10. ^ "Announce: OpenSMTPD 5.7.2 released". Retrieved 11 October 2015.
  11. ^ "Unpleasant vulnerability in OpenSMTPD". LWN.net. Retrieved 30 January 2020.
  12. ^ "OpenSMTPD advisory dissected". Retrieved 30 January 2020.
  13. ^ "OpenSMTPD Goals". opensmtpd.org.
[edit]
Retrieved from "https://en.wikipedia.org/w/index.php?title=OpenSMTPD&oldid=1248127713"