Στις 8/1/2019 12:07, ο Murray Crane έγραψε:
They use their "work email addresses" as
personal accounts, as well as
business accounts (don't get me started), and they don't want to be
reliant on connectivity to the corporate Exchange servers,
I'd start with this
cause it all starts here.
So this is the boss not trusting your business' internet connection? How
about a synced IMAP mailbox that allows offline access while you're
down? Or how about he gets you a backup uplink via GSM or something?
Then all of this would not be required.
OR maybe he connected once from a hotel with a firewalled hotspot and
couldn't get to your exchange servers and decided "this doesn't work"?
Do you provide webmail access?
so I've set up a Docker mail server on their home
network, but getting
their mail delivered to both that MTA and the Exchange servers is
above my knowledge grade.
If you are currently supporting a mail server on their
consider how many "homes" you need to add mail servers to once this gets
out as a solution. Bob the CEO tells Jim the CFO and then Jim tells
sales and you're screwed cause now 20 Jonathans want it, too. Just don't
do it (tm). Say no up front rather than down the line.
And why docker, they already have a server at home? Who's supporting that?
I've patiently tried to explain that
"that's not how SMTP works",
It would have some issues with bounces
but it would work.
The question is, why would you do this at all and set yourself up for a
tech support nightmare?
but I'm being met with recalcitrance and "you
need to be a solutions
provider", so I thought I'd put this in front of the hivemind and see
if any of you know of an easy way to do this?
As for being a 'solutions
provider' let them know that creating an
unnecessary problem and solving it is like putting holes in your water
bucket and finding a way to handle the spillage instead of plugging the
freakin' holes. Mention Hillary and her "home server".
From the top of my head I see 2 options:
1 VPN is good but you'll need to setup all their personal machines for
it, including mobiles (yes). Depending on what OS they're using you
could be in for a bit of a permanent support job. If it's just windows
maybe set up a simple self extracting rar file or installer they can run
that sets up openvpn for them with a bundled config file to just route
your corporate IPs. I would not do VPN in general cause unless you set
up careful routing to allow access only to the mail server you'll be
bringing their home machine/phone into your network (yikes). So lots of
work on both sides.
2 Opening IMAP access to exchange from outside would mean you need to
setup their mail clients for it, which is also a permanent support job,
but easier. This is what I'd do since you can secure it via TLS and a
decent password policy (ie you set their passwords for them) and surely
Exchange can handle IMAP.
Bit of background to help - the only way that I can
think of possibly
doing this is to MITM it (stick another MTA server outside our
network, have it send the emails for the directors to two destination
servers and just pass all the other mail to our Exchange
infrastructure, if that's even possible without darkweb solutions),
and I won't be allowed to use a cloud email service to do this as they
are vehemently opposed to "The Cloud" (again, don't get me started).
If you have a postfix server you can do this:
But again, why?