I'm working at a small research center that has to manage a lot of things independently on a tight budget. One of these is all things IT infrastructure, including web and email hosting. Though I've not been formed as a system administrator, I've so far succeeded in finding an affordable root server at a hosting company, setting up our websites and web applications, and keeping them running for a couple of years.
So far, our email has been hosted externally, which means that we pay little for little value: 875Mb email storage space for max. 35 POP-mailboxes. After a couple of data-losses due to local inbox corruptions in email clients, I've decided to at least investigate the option of using the postfix / qmail mail server that's present on the root server we're hiring. At first sight, there are many advantages: we'd be able to switch to virtually unlimited IMAP accounts, include the email in the email accounts in the server backups, use more storage per mailbox, etc. On top of that, the mail server is already included in the fee we're paying for the webserver, so we could cut the external email hosting cost and even get much more for less.
The technical part has been fun enough: I've been able to set it all up (discovering the virtues of the Plesk panel) and in principle we could just switch to the new email server right away. Yet, I'm not confident I can properly estimate the risks involved in managing an email server, security wise. Of course, I have SpamAssassin and antivirus (Plesk Premium antivirus) enabled on all email accounts, set up an SSH certificate and added SPF, DMARC, and DKIM records to our DNS. My major concern is: does this suffice, and what are the chances of being attacked and having the entire server compromised?
For example, I've noticed how -even in this premature testing phase-, the QMail logs are full of messages such as:
Dec 15 17:07:00 server4545 postfix/smtpd[23838]: connect from unknown[91.200.13.5]
Dec 15 17:07:00 server4545 plesk_saslauthd[24512]: Invalid mail address 'albert@'
Dec 15 17:07:00 server4545 postfix/smtpd[23838]: warning: unknown[91.200.13.5]: SASL LOGIN authentication failed: authentication failure
Dec 15 17:07:00 server4545 postfix/smtpd[23838]: lost connection after AUTH from unknown[91.200.13.5]
Dec 15 17:07:00 server4545 postfix/smtpd[23838]: disconnect from unknown[91.200.13.5]
Dec 15 17:07:04 server4545 postfix/smtpd[23838]: connect from 24-35-233-74.fidnet.com[24.35.233.74]
Dec 15 17:07:04 server4545 postfix/smtpd[23838]: lost connection after CONNECT from 24-35-233-74.fidnet.com[24.35.233.74]
Dec 15 17:07:04 server4545 postfix/smtpd[23838]: disconnect from 24-35-233-74.fidnet.com[24.35.233.74]
Dec 15 17:07:20 server4545 postfix/smtpd[23838]: warning: hostname ip-address-pool-xxx.fpt.vn does not resolve to address 118.71.172.216: Name or service not known
Dec 15 17:07:20 server4545 postfix/smtpd[23838]: connect from unknown[118.71.172.216]
Dec 15 17:07:22 server4545 postfix/smtpd[23838]: NOQUEUE: reject: RCPT from unknown[118.71.172.216]: 554 5.7.1 <name@ourdomain.com>: Relay access denied; from=<voicemailandfax@jgnluxwatch.com> to=<name@ourdomain.com> proto=ESMTP helo=<[100.74.205.159]>
Dec 15 17:07:22 server4545 postfix/smtpd[23838]: disconnect from unknown[118.71.172.216]
Dec 15 17:07:22 server4545 /usr/lib/plesk-9.0/psa-pc-remote[8577]: Message aborted.
Dec 15 17:07:22 server4545 /usr/lib/plesk-9.0/psa-pc-remote[8577]: Message aborted.
This seems to suggest a lot of interest from totally unrelated IP addresses, even though I'm currently not even using the thing for testing. The good part seems to be that those attempts are being recognized and rejected, but still I'm wondering where they come from and how much I should worry. Even if they are innocent, I can imagine processing all those requests could cause serious overhead for the server. For testing purposes, I have added an MX record with low priority in our DNS; I wonder if this already is 'inviting' so many requests to our mail server?
In other words: I'm looking for reasonable advice on the security risks involved in running an own mail server. After all, if things break, they might break everything and I'll have to deal with it myself.
Any advice would be much appreciated!
Ron