The Risks of Running a Mail Server
The first step in running a successful email server is determining that you actually need an email server. Unlike more basic services, such as Apache, email is a more intrusive process that enables complete strangers to store information on your computer. In addition, administration of an email server is an ongoing process. Monitoring and detecting problems is a must. Email has been around for more than 20 years, but it's still growing and evolving. Because it is one of the most highly utilized pieces of software on the Internet, it is also one of the most prone to attacks.
Mail server security is unlike basic server security because it occurs on two levels. First, you must protect the physical server software from being exploited. Remote users have found numerous holes in sendmail (included in earlier versions of Mac OS X) that enabled them to gain unauthorized access. Monitoring server logs for unexplained connections and abnormal mail transmissions is standard practice. This aspect of mail server security ought to seem familiar because it should be a common practice for other basic system services, such as FTP or HTTP.
The second security problem is mail server abuse. This doesn't necessarily equate to compromising the email server, but the results can be even more far-reaching. Email spam, for example, is the result of poorly implemented email security. In the case of spam, there are two possible problems. The first is that an authorized user is inappropriately using your email resources; the second is that an unauthorized user is taking advantage of an open relay on your mail server to do the work of distributing his or her spam.
In both cases, the result is the same. The second scenario is the most serious when considering the security of your network. It is much akin to hacking but without necessarily needing to exploit any program flaws on your system.
For these reasons, you should seriously consider alternatives to running your own mail server. Users in need of controlling their own email accounts and the privacy of storing their own messages, or requiring complex mail relaying or automated processing are the best candidates for running their own server.
A properly configured server requires little maintenance and will perform well on Tiger. An improperly configured server, however, could be a disaster.