1.1 --- a/thesis/tex/3-MailTransferAgents.tex	Mon Dec 15 13:39:46 2008 +0100
     1.2 +++ b/thesis/tex/3-MailTransferAgents.tex	Mon Dec 15 13:40:25 2008 +0100
     1.3 @@ -8,7 +8,7 @@
     1.4  \section{Types of MTAs}
     1.5  ``Mail transfer agent'' is a term covering a variety of programs. One thing is common to them: they transfer email from one machine to another.
     1.6  
     1.7 -This is how \person{Bryan Costales} defines a \mta\ in \cite{costales97}:
     1.8 +This is how Bryan \person{Costales} defines a \mta\ in \cite{costales97}:
     1.9  \begin{quote}
    1.10  A mail transfer agent (MTA) is a highly specialized program that delivers mail and transports it between machines, like the post office.
    1.11  \end{quote}
    1.12 @@ -69,9 +69,9 @@
    1.13  
    1.14  This section introduces a selection of popular \MTA{}s; they are the most likely substitutes for \masqmail. All are \emph{sendmail-compatible} ``smart'' \freesw\ \MTA{}s that focus on mail transfer, as is \masqmail.
    1.15  
    1.16 -The programs chosen are: \sendmail, \exim, \qmail, and \postfix. They are the most important representatives of the regarded group. Although \MTA\ statistics are rare, FIXME(have different results), and good data is hard to collect, these programs tend to stay near the top.
    1.17 +The programs chosen are: \sendmail, \exim, \qmail, and \postfix. They are the most important representatives of the regarded group. Although \MTA\ statistics are rare, differ, and good data is hard to collect, these programs tend to stay near the top.
    1.18  
    1.19 -Table \ref{tab:mta-market-share} shows the Top 10 \MTA{}s of three different statistics. The first published by \name{O'ReillyNet} in 2007 \citeweb{oreillynet:mta-stats} , the second by \name{MailRadar.com} from YYYY \citeweb{mailradar:mta-stats} , and the third by \person{Daniel~J.\ Bernstein} (the author of \qmail) done in 2001 \citeweb{djb:mta-stats}.
    1.20 +Table \ref{tab:mta-market-share} shows the most used \MTA{}s determined by three different statistics. The first done Ken \person{Simpson} and Stas \person{Bekman} published by \name{O'ReillyNet} in 2007 \citeweb{oreillynet:mta-stats} , the second by \name{MailRadar.com} with unknown date \citeweb{mailradar:mta-stats} , and the third by Daniel~J.\ \person{Bernstein} (the author of \qmail) done in 2001 \citeweb{djb:mta-stats}.
    1.21  
    1.22  \begin{table}
    1.23  	\begin{center}
    1.24 @@ -81,10 +81,14 @@
    1.25  	\label{tab:mta-market-share}
    1.26  \end{table}
    1.27  
    1.28 -Other members of the same group are: \name{smail}, \name{zmailer}, \name{MMDF}, and \name{courier-mta}. They all are less important and rarely used, thus ommited here.
    1.29 +All surveys show high market shares for the four \MTA{}s---\sendmail, \exim, \qmail, \postfix. Only the \name{Microsoft} mail servers and \name{IMail} have comparable large shares. Other \freesw\ \mta{}s are: \name{smail}, \name{zmailer}, \name{MMDF}, and \name{courier-mta}. They all are less important and rarely used.
    1.30  
    1.31 +The three surveys base on different data. \person{Bernstein} took 1,000,000 randomly chosen \NAME{IP} addresses, containing 39,206 valid hosts; 958 of them accepted a connection. \name{MailRadar}'s data source is unspecified, as well as the time of data collection. The \name{O'Reilly} survey used only domains with companies behind them; in total it were 400,000 hosts.
    1.32  
    1.33 -Now follows a small introduction to the five programs chosen for comparison, except \masqmail\ which already was introduced in chapter \ref{chap:introduction}. Longer introductions, including analysis and comparison, were written by \person{Jonathan de Boyne Pollard} \citeweb{jdebp}.
    1.34 +Remarkable are the 22 percent of ``mail security layers''\footnote{mail security layers are software guards between the network and the \mta\ that filter unwanted mail before it reaches the \MTA. This increases security by blocking attacks against the \MTA\ and by filtering malicious content. It also decreases the work load of the guarded \MTA.} in the \name{O'Reilly} survey. This large share may be a result of only regarding business mail servers. The problem concerning the survey is the deguise of the \mta\ working behind the security layer. It seems wrong to assume equal shares for the \MTA{}s behind the guards as for the unguarded \MTA{}s, because they will be more often used to guard weak \MTA{}s, as strong ones might not need them. This needs to be kept in mind when using the \name{O'Reilly} survey.
    1.35 +
    1.36 +
    1.37 +Now follows a small introduction to the five programs chosen for comparison, except \masqmail\ which already was introduced in chapter \ref{chap:introduction}. Longer introductions, including analysis and comparison, were written by Jonathan de \person{Boyne Pollard} \citeweb{jdebp}.
    1.38  
    1.39  
    1.40  
    1.41 @@ -92,7 +96,7 @@
    1.42  \label{sec:sendmail}
    1.43  \sendmail\ is the most popular \mta, since it was one of the first and was shipped as default \MTA{}s by many vendors of \unix\ systems. %fixme: ref
    1.44  
    1.45 -The program was written by \person{Eric Allman} as the successor of his program \name{delivermail}. \sendmail\ was first released with \NAME{BSD} 4.1c in 1983. Allman was not the only one working on the program. Other people developed own versions of it and a variety of flavors came up, especially in the late eighties when Allman was inactive. %fixme: ref
    1.46 +The program was written by Eric \person{Allman} as the successor of his program \name{delivermail}. \sendmail\ was first released with \NAME{BSD} 4.1c in 1983. Allman was not the only one working on the program. Other people developed own versions of it and a variety of flavors came up, especially in the late eighties when Allman was inactive. %fixme: ref
    1.47  
    1.48  \sendmail\ is focused on transferring mails between different protocols and networks, this lead to a very flexible (though complex) configuration.
    1.49  
    1.50 @@ -106,7 +110,7 @@
    1.51  
    1.52  \subsubsection*{exim}
    1.53  \label{sec:exim}
    1.54 -\exim\ was started in 1995 by \person{Philip Hazel} at the \name{University of Cambridge}. It is forked of \name{smail-3}, and inherited the monolithic architecture, similar to \sendmail's. But having no separation of the individual components of the system, like \qmail\ and \postfix\ have, did not hurt. Its security is comparably good. %fixme: ref
    1.55 +\exim\ was started in 1995 by Philip \person{Hazel} at the \name{University of Cambridge}. It is forked of \name{smail-3}, and inherited the monolithic architecture, similar to \sendmail's. But having no separation of the individual components of the system, like \qmail\ and \postfix\ have, did not hurt. Its security is comparably good. %fixme: ref
    1.56  
    1.57  \exim\ is highly configurable, especially in the field of mail policies. This makes it easy to specify how mail is routed through the system and who is allowed to send email to whom. Also interfaces for integration of virus and spam check programs are provided by design. %fixme: ref
    1.58  
    1.59 @@ -119,20 +123,20 @@
    1.60  \subsubsection*{qmail}
    1.61  \label{sec:qmail}
    1.62  \qmail\ is seen by its community as ``a modern SMTP server which makes sendmail obsolete''.%fixme: ref
    1.63 -It was written by \person{Daniel~J.\ Bernstein} starting in 1995. His primary goal was to create a secure \MTA\ to replace the popular, but vulnerable, \sendmail. %fixme: ref
    1.64 +It was written by Daniel~J.\ \person{Bernstein} starting in 1995. His primary goal was to create a secure \MTA\ to replace the popular, but vulnerable, \sendmail. %fixme: ref
    1.65  
    1.66  \qmail\ first introduced many innovative concepts in \mta\ design and is generally seen as the first security-aware \MTA\ developed. %fixme:ref
    1.67  %fixme: what about mmdf?
    1.68  
    1.69  Since November 2007, \qmail\ is released in the \name{public domain} which makes it \freesw. The latest release is 1.03 from July 1998.
    1.70  
    1.71 -The programs homepages are \citeweb{qmail:homepage1} and \citeweb{qmail:homepage2}. Further information about \qmail\ is available with \person{Dave Sill}'s ``Life with qmail'' \citeweb{lifewithqmail}.
    1.72 +The programs homepages are \citeweb{qmail:homepage1} and \citeweb{qmail:homepage2}. Further information about \qmail\ is available with Dave \person{Sill}'s ``Life with qmail'' \citeweb{lifewithqmail}.
    1.73  
    1.74  
    1.75  
    1.76  \subsubsection*{postfix}
    1.77  \label{sec:postfix}
    1.78 -The \postfix\ project was started in 1999 at \name{IBM research}, then called \name{VMailer} or \name{IBM Secure Mailer}. \person{Wietse Venema}'s program ``attempts to be fast, easy to administer, and secure. The outside has a definite Sendmail-ish flavor, but the inside is completely different.''\citeweb{postfix:homepage} In fact, \postfix\ was mainly designed after qmail's architecture to gain security. But in contrast to \qmail\ it aims much more on being fast and full-featured.
    1.79 +The \postfix\ project was started in 1999 at \name{IBM research}, then called \name{VMailer} or \name{IBM Secure Mailer}. Wietse \person{Venema}'s program ``attempts to be fast, easy to administer, and secure. The outside has a definite Sendmail-ish flavor, but the inside is completely different.''\citeweb{postfix:homepage} In fact, \postfix\ was mainly designed after qmail's architecture to gain security. But in contrast to \qmail\ it aims much more on being fast and full-featured.
    1.80  
    1.81  Today \postfix\ is taken by many \unix\ systems and \gnulinux\ distributions as default \MTA.
    1.82  
    1.83 @@ -147,7 +151,7 @@
    1.84  
    1.85  \section{Comparison of MTAs}
    1.86  
    1.87 -This section does not try to provide an overall \MTA\ comparison, because this is already done by others. Remarkable comparisons are the one by \person{Dan Shearer} \cite{shearer06} and a discussion on the mailing list \name{plug@lists.q-linux.com} \citeweb{plug:mtas}. Tabulary overviews may be found at \citeweb{mailsoftware42}, \citeweb{wikipedia:comparison-of-mail-servers}, and \citeweb[section 1.9]{lifewithqmail}.
    1.88 +This section does not try to provide an overall \MTA\ comparison, because this is already done by others. Remarkable comparisons are the one by Dan \person{Shearer} \cite{shearer06} and a discussion on the mailing list \name{plug@lists.q-linux.com} \citeweb{plug:mtas}. Tabulary overviews may be found at \citeweb{mailsoftware42}, \citeweb{wikipedia:comparison-of-mail-servers}, and \citeweb[section 1.9]{lifewithqmail}.
    1.89  
    1.90  Here provided is an overview on a selection of important properties, covering the four previously introduced programs. The data comes from the above stated sources and is collected in table \ref{tab:mta-comparison}.
    1.91  
    1.92 @@ -163,7 +167,7 @@
    1.93  \subsection{Architecture}
    1.94  
    1.95  Architecture is most important when comparing \MTA{}s. Many other properties of a program depend on its architecture. %fixme: add ref?
    1.96 -\person{Munawar Hafiz} \cite{hafiz05} discusses in detail on \mta\ architecture, comparing \sendmail, \qmail, \postfix, and \name{sendmail X}. \person{Jonathan de Boyne Pollard}'s \MTA\ review \citeweb{jdebp} is a source too.
    1.97 +Munawar \person{Hafiz} \cite{hafiz05} discusses in detail on \mta\ architecture, comparing \sendmail, \qmail, \postfix, and \name{sendmail X}. Jonathan de \person{Boyne Pollard}'s \MTA\ review \citeweb{jdebp} is a source too.
    1.98  
    1.99  Two different architecture types show off: monolithic and modular \mta{}s.
   1.100  
   1.101 @@ -171,7 +175,7 @@
   1.102  
   1.103  Modular \MTA{}s are \NAME{MMDF}, \qmail, \postfix, and \name{MeTA1}. They consist of several programs, each doing a part of the overall job. The different programs run with the least permissions the need, and \emph{setuid root} needs not to be used.
   1.104  
   1.105 -The architecture does not directly define the program's security, but ``[t]he goal of making a software secure can be better achieved by making the design simple and easier to understand and verify''\cite[chapter 6]{hafiz05}. \exim, though being monolithic, has a fairly clean security record. But it is very hard to keep the security up, as the program growth. \person{Wietse Venema} (the author of \postfix) says, the architecture enabled \postfix\ to grow without running into security problems. \citeweb[page 13]{venema:postfix-growth}
   1.106 +The architecture does not directly define the program's security, but ``[t]he goal of making a software secure can be better achieved by making the design simple and easier to understand and verify''\cite[chapter 6]{hafiz05}. \exim, though being monolithic, has a fairly clean security record. But it is very hard to keep the security up, as the program growth. Wietse \person{Venema} (the author of \postfix) says, the architecture enabled \postfix\ to grow without running into security problems. \citeweb[page 13]{venema:postfix-growth}
   1.107  
   1.108  The modular design, with each sub-program doing one part of the overall job, is applied \name{Unix Philosophy}. The Unix Philosophy \cite{gancarz95} demands ``small is beautiful'' and ``make each program do one thing well''. Monolithic \MTA{}s fail here.
   1.109