securing email server

[cdhgold]

i'm running a imap/pop3 server on rhel4 using dovecot/postfix/squirrelmail and i want to secure it but am not sure where to start .. any suggestions?

cdhgold

[Void Main]

Depends on who needs to connect to it and from where. Is it behind a hardware firewall or is it Internet facing with iptables? I would suggest encrypting all connections (imaps/pop3s/https) and restricting to as narrow of a scope of addresses as you can. It would also be best to require authentication for sending mail.

[cdhgold]

it is internet facing .. have not configured iptables yet .. i take it from your question i should do that before i deal with the email services?

[Void Main]

I would certainly make sure only necessary ports are exposed with iptables as a first step baseline. Then you have to make sure the services on the other end of the ports left exposed are as secure as you can make them.