Setting up a mail server

Background Some terminology:

MTA

Mail Transport Agent

MUA

Mail User Agent

MDA

Mail Delivery Agent

SMTP

Simple Mail Transfer Protocol

MX

Mail eXchange

POP

Post Office Protocol

IMAP

Internet Message Access Protocol

With SMTP you connect to a server and send two things: envelope and message. The envelope looks like this:

MAIL FROM: <enrico@enricozini.org>
RCPT TO: <rms@fsf.org>
RCPT TO: <linus@linux.org>

The message looks like this:

From: <enrico@enricozini.org>
To: <rms@fsf.org>
Cc: <linus@linux.org>
Message-ID: <1234567@enricozini.org>
Subject: Test mail
Hi Richard,
this is a test mail.  I'm also writing
Linus to show how to send to more people.
Cheers,
Enrico

There is no authentication. There is no encryption. Two usual types of access control:

1. Outbound e-mail is normally only accepted from an internal network
2. Inbound e-mail is normally accepted from anywhere

The DNS is used to find the SMTP server to use to send a message:

$ host -t MX yahoo.com
yahoo.com MX 10 smtp1.yahoo.com
yahoo.com MX 20 smtp2.yahoo.com
yahoo.com MX 20 smtp3.yahoo.com

The process of sending an E-Mail:

1. Enrico writes an E-Mail:

   From: Enrico Zini <enrico@enricozini.org>
   To: Richard Stallman <rms@fsf.org>
   Subject: Hello from Addis
   Hi Richard,
   Addis is a wonderful city, even if
   it rains a lot.
   Bye,  Enrico
   

2. Enrico's MUA connects to the SMTP server (for example, port 25 of smtp.aau.edu.et):

   HELO enricozini.org
   200 OK Hello enricozini.org
   MAIL FROM: <enrico@enricozini.org>
   200 OK Mail from enrico@enricozini.org
   RCPT TO: <rms@fsf.org>
   

   Here, the SMTP server performs relay control: "do we relay mail to rms@fsf.org?":

   • Outbound e-mail is normally only accepted from an internal network
   • Inbound e-mail is normally accepted from anywhere

   A target address could be refused:

   413 ERR I don't relay for rms@fsf.org
   

   In this case, the destination is not local but the recipient is accepted because I'm inside the local network:

   200 OK Destination rms@fsf.org
   DATA
   200 OK Please send message body
   From: Enrico Zini <enrico@enricozini.org>
   To: Richard Stallman <rms@fsf.org>
   Subject: Hello from Addis
   Date: Mon, 17 Jul 2006 09:49:45 +0300
   Message-ID: <124372643@enricozini.org>
   Hi Richard,
   Addis is a wonderful city, even if
   it rains a lot.
   Bye,  Enrico
   .
   200 OK Message accepted
   QUIT
   200 OK Bye.
   

3. The SMTP server needs to find out where to send the message, using the DNS:

   $ host -t MX fsf.org
   fsf.org MX 10 mail.fsf.org
   fsf.org MX 20 mail.gnu.org
   

4. So the SMTP server tries the first one and connects to port 25 of mail.fsf.org:

   HELO smtp.aau.edu.et
   200 OK Hello smtp.aau.edu.et
   MAIL FROM: <enrico@enricozini.org>
   200 OK Mail from enrico@enricozini.org
   RCPT TO: <rms@fsf.org>
   

   The destination is accepted because it's for a local user:

   200 OK Destination rms@fsf.org
   DATA
   200 OK Please send message body
   From: Enrico Zini <enrico@enricozini.org>
   To: Richard Stallman <rms@fsf.org>
   Subject: Hello from Addis
   Date: Mon, 17 Jul 2006 09:49:45 +0300
   Message-ID: <124372643@enricozini.org>
   Received: by mail.aau.edu.et
     on Mon, 17 Jul 2006 09:55:53 +0300
     from 10.4.15.158
   Hi Richard,
   Addis is a wonderful city, even if
   it rains a lot.
   Bye,  Enrico
   .
   200 OK Message accepted
   QUIT
   200 OK Bye.
   

5. Now, mail.fsf.org will invoke a MDA to write the mail in Richard Stallman's mailbox.

Example of problems with mail handling:

• Accepting inbound connections:
  • Malicious input:
    • logic errors
    • buffer overflows
    • DoS (Denial Of Service) attacks
    • Connection floods
• Performing outbound connections:
  • Programming errors:
    • Flooding of connections
• Performing routing:
  • Unauthorised relays
  • Mail loops
• Writing to the local hard drive:
  • Filling up the hard drive
  • Writing to the wrong files
• Writing to the local hard drive as root:
  • In case of error or attack, any file in the system can potentially be compromised

RFC-822 is the original standard for E-mail. RFCs are standard Internet documents. Have a look at RFC documents released the 1st of April.

postfix Common setup: "Internet site with smarthost". More difficult to maintain: "Internet site". A smarthost is a machine that will relay e-mail for you. Questions asked with "Internet site with smarthost":

• Mail name: aau.edu.et (name used to publicly identify the mail server)
• Smarthost name: smtp.telecom.net.et (SMTP server that will relay our e-mail)

To test a mail server:

$ telnet localhost 25
HELO me
MAIL FROM: <a@b.c>
RCPT TO: <mail@of.a.local.user>
DATA
hi
.
QUIT

By default, you find locally delivered mail in /var/mail/username. Postfix configuration files:

/etc/postfix/master.cf

configures how all the postfix components run together (man 5 master)

/etc/postfix/main.cf

Main postfix configuration (man 5 postconf)

To rewrite addresses:

1. In /etc/postfix/main.cf:

   canonical_maps = hash:/etc/postfix/canonical
   

2. Then in /etc/postfix/canonical you can add the rewrite rules, like:

   enrico   enrico@enricozini.org
   

3. When /etc/postfix/canonical is modified you need to regenerate the index:

   sudo postmap canonical
   

   (same is when you change the alias file: sudo postalias /etc/aliases)

(see file:///usr/share/doc/postfix/html/ADDRESS_REWRITING_README.html) Manipulating the message queue:

mailq - List the mail queue.

Example:

mailq

postqueue - Postfix queue control

Examples:

# Like mailq
postqueue -p
# Tries to send every message in the queue
postqueue -f
# Tries to send every message in the queue for that site
postqueue -s site

postsuper - Postfix superintendent

Examples:

# Deletes one message
sudo postsuper -d 7C4D2EC0F5D
# Deletes all messages held in the queue for later delivery
sudo postsuper -d ALL deferred

Different mail queues in postfix:

incoming

mail who just entered the system

active

mail to be delivered

deferred

mail to be delivered later because there were problems

hold

mail that should not be delivered until released from hold

Mail logs are in:

/var/log/mail.log
/var/log/mail.err
/var/log/mail.info
/var/log/mail.warn

Mail delivery Mailbox formats:

• mbox: single file, mail separated by "From " lines
• maildir: one directory per folder, one file per mail
• mh: similar to maildir, but not really used

Alternate MDA: procmail: allows to filter mail automatically into different folders. Mail forwarding with ~/.forward: allows to redirect mail to a different address: just put the address you want to send to in the file ~/.forward.

POP or IMAP server Installation:

apt-get install dovecot

Configuration is in:

/etc/dovecot/dovecot.conf

The main thing that is needed is to enable the mail protocols you want:

protocols = imaps

Server monitoring To make all sorts of graphs:

apt-get install munin munin-node

Example: http://munin.ping.uio.no To compute more statistics:

• anteater
• isoqlog
• mailgraph

Monitor system logs: logcheck:

• sends you mail with abnormal log lines
• It's important to customize what is normal and you do it with regular expressions

Filtering viruses and spam clamav - Virus scanner Virus scanning:

• Postfix gives the mail to clamav that scans it and gives it back if it's clean.
• Strategies for infected mail:
  • silently delete it
  • refuse the mail and send a notification to the sender
  • refuse the mail and send a notification to the receiver
  • quarantine the e-mail
  • refuse delivery with a SMTP error
  • deliver with an extra header that says that it's a virus

spamassassin - Spam filter Spam scanning:

• Postfix gives the mail to spamd that scans it and gives it back with some spam information.
• Strategies for spam mail:
  • silently delete it
  • refuse the mail and send a notification to the sender
  • refuse the mail and send a notification to the receiver
  • quarantine the e-mail
  • refuse delivery with a SMTP error
  • deliver with an extra header that says that it's spam
• New techniques:
  • greylisting: when you receive a mail from a host you've never seen before, refuse it with a temporary error, and accept it the second time (after some time delay). Spammers normally don't retry, and implementing retry would increase their cost of sending e-mail.
  • crossassassin: if more than some amount of your users receive a mail with the same message ID, throw it away. Sending mails with different headers would increase the cost of sending e-mail.

Man pages and sections Man pages are divided in sections:

• man man shows all the sections of the manpages
• man 5 postconf shows the postconf manpage in the "configuration file" section
• Normally manpages are referred as manpage(section) (e.g. postconf(5) )

• ifconfig - configure a network interface

• dnsmasq - Simple DNS and DHCP server

• host - DNS lookup utility

• route - show / manipulate the IP routing table

• arping - send ARP REQUEST to a neighbour host

• mii-tool - view, manipulate media-independent interface status (IOW, see if the cable works)

• nmap - Network exploration tool and security / port scanner Examples:

  # Look at what machines are active in the local network:
  nmap -sP 10.5.15.0/24
  # Look at what ports are open in a machine:
  nmap 10.5.15.26
  

• tcpdump - dump traffic on a network It can be used to see if there is traffic, and to detect traffic that shouldn't be there.

# Convert a unix timestamp to a readable date
date -d @1152841341

1. type the address www.google.com in the browser
2. the browser needs the IP address of the web server:

1. look for the DNS address in /etc/resolv.conf (/etc/resolv.conf is created automatically by the DHCP client)
2. try all the DNS servers in /etc/resolv.conf until one gives you the IP address of www.google.com
3. take the first address that comes from the DNS (in our case was 64.233.167.104)

3. figure out how to connect to 64.233.167.104:

1. consult the routing table to see if it's in the local network:

1. if it's in the local network, then look for the MAC address (using ARP - Address Resolution Protocol)
2. if it'd not in the local network, then send through the gateway (again using ARP to find the MAC address of the gateway)

4. Send out the HTTP request to the local web server or through the gateway, using the Ethernet physical protocol, and the MAC address to refer to the other machine.

1. See if the network driver works:

1. With ifconfig, see if you see the HWaddr:. If you do not see it, then the linux driver for the network card is not working. Unfortunately there's no exact way to say that it works perfectly

2. See if you have an IP address with ifconfig. If you find out that you need to rerun DHCP (for example, if the network cable was disconnected when the system started), then you can do it either by deactivating/reactivating the Ethernet interface using System/Administration/Networking or, on a terminal, running:

   # ifdown eth0
   # ifup eth0
   

   If you don't get an IP, try to see if the DHCP server is reachable by running:

   $ arping -D [address of DHCP server]
   

3. See if the local physical network works:

1. With sudo mii-tool, see if the cable link is ok. If it's not, then it's a problem in the cable or the plugs, or simply the device at the other end of the cable is turned off.
2. Try arping or ping -n on a machine in the local network (like the gateway) to see if the local network works.

4. See if the DNS works:

1. Find out the DNS address:

   cat /etc/resolv.conf
   

2. If it's local, arping it

3. If it's not local, ping -n it

4. Try to resolve a famous name using that DNS:

   $ host [name] [IP address of the DNS]
   

5. Try to resolve the name of the machine you're trying to connect. If you can resolve a famous name but not the name you need, then it's likely a problem with their DNS.

5. If you use a proxy, see if the proxy is reachable: check if the proxy name resolves to an IP, if you can ping it, if you can telnet to the proxy address and port:

   $ telnet [proxy address] [proxy port]
   

   you quit telnet with ^]quit.

6. If you can connect directly to the web server, try to see if it answers:

   $ telnet [address] 80
   

   If you are connected, you can confirm that it's a web server:

   GET / HTTP/1.0 (then Enter twice)
   

   If it's a web server, it should give you something like a webpage or an HTTP redirect.

1. check that it's running:

   $ ps aux   grep dnsmasq
   

2. check that it's listening on the right port:

   $ sudo netstat -lp
   

3. check that it's listening from the outside:

   $ nmap [hostname]
   

4. check for messages in /var/log/daemon.log or /var/log/syslog

5. check that the configuration is correct and reload or restart the server to make sure it's running with the right configuration:

   # /etc/init.d/dnsmasq restart
   

By default: works as a DNS server that serves the data in /etc/hosts. By default: uses /etc/resolv.conf to find addresses of other DNS to use when a name is not found in /etc/hosts. To enable the DHCP server, uncomment:

dhcp-range=192.168.0.50,192.168.0.150,12h

in /etc/dnsmasq.conf and set it to the range of addresses you want to serve. Pay attention to never put two DHCP servers on the same local network, or they will interfere with each others. To test if the DHCP server is working, use dhcping (not installed by default on Ubuntu). To communicate other information like DNS, gateway and netmask to the clients, use this piece of dnsmasq.conf:

# For reference, the common options are:
# subnet mask - 1
# default router - 3
# DNS server - 6
# broadcast address - 28
dhcp-option=1,255.255.255.0
dhcp-option=3,192.168.0.1
dhcp-option=6,192.168.0.1
dhcp-option=28,192.168.0.255

• changing the name of the local machine in /etc/hosts breaks sudo, and without sudo it's impossible to edit the file. The only way to fix this is a reboot in recovery mode.
• dhclient -n -w is different than dhclient -nw

# Create an archive
tar zcvf nmap.tar.gz *.deb
# Extract an archive
tar zxvf nmap.tar.gz
# Look at the contents of an archive
tar ztvf nmap.tar.gz

# To send
nc -l -p 12345 -q 1 < nmap.tar.gz
# To receive
nc 10.5.15.123 12345 > nmap.tar.gz
# To repeat the send command 20 times
for i in  seq 1 20 ; do nc -l -p 12345 -q 1 < nmap.tar.gz ; done

• ls - list directory contents
• cp - copy files and directories
• mv - move (rename) files
• rm - remove files or directories
• find - search for files in a directory hierarchy
• cat - concatenate files and print on the standard output
• more - file perusal filter for crt viewing
• less - opposite of more (quit with 'q')
• cd - Change the current directory to DIR. (use "help cd" instead of "man cd")
• mkdir - make directories
• rmdir - remove empty directories

• grep, egrep, fgrep, rgrep - print lines matching a pattern
• tail - output the last part of files
• head - output the first part of files
• sort - sort lines of text files
• uniq - report or omit repeated lines
• sed - stream editor
• wc - print the number of newlines, words, and bytes in files

• You set the system default locale to Amharic, and the gdm login will be in Amharic input mode. We didn't find out how to switch it back to input roman characters. Right click on the input field to set the input method doesn't work. Since usernames are not in Amharic, you're locked out.

• So you CTRL+ALT+F1, login and try dpkg-reconfigure locales. On Ubuntu Dapper, it does not work anymore.

• So you dig and dig and dig and finally find that you can force a locale in /etc/default/gdm (but not in /etc/gdm/locale.conf, nor in /etc/gdm/gdm.conf).

• Then the internet works for a bit and you look up how to reconfigure locales in Ubuntu. Turns out you have to use localeconf, which is not installed by default, is not in universe and thus not on the CDs, and needs to be downloaded from the Internet.

• The Ubuntu wiki is all on https, which defeats any attempt of proxy caching.

• An Internet proxy needs to be configured 3 times: in Gnome, in Firefox and in Synaptic (well, apt). This is especially tricky when you forgot to setup the proxy in Synaptic and seemingly unrelated applications fail, like the Ubuntu language selector, which internally invokes the package manager to download missing langpacks.

• Some short descriptions in the NAME section of manpages are hard to understand, or wrong. Noted on apt-get, apt-cache and less. Top prize goes to apt-cache:

  NAME
         apt-cache - APT package handling utility -- cache manipulator
  DESCRIPTION
         [...] apt-cache does not manipulate the state of the system but
         does provide operations to search and generate interesting output
         from the package metadata. [...]
  

  So apt-cache is a manipulator that doesn't manipulate. A possible improvement can be "query the APT package cache".

• The language selector in Ubuntu Breezy doesn't really exit and keeps the package database locked. This seems to be fixed in Dapper, and probably had been fixed in some Breezy update. System updates here are a problem: my Dapper (with some Universe things in it) wanted to download more than 120Mb of data, and the Uni network was giving me 14Kbps. It's been a nice opportunity to teach about fuser -uva and kill.

• dict, squid and many other packages from 'main' are not on the normal Ubuntu CDs: is there an easy way to build a CD with them? Or do Ubuntu CDs with extra packages already exist? I'll have to find out.

• cupsys has documentation outside of /usr/share/doc, in /usr/share/cups/doc-root.

• man works on all commands, except cd, which is an internal shell command and thus needs help instead of man. I should remember to ponder about autogenerating manpages from help output.

• Is there an index-like manpage with a list of the core Unix commands and their short descriptions? It there's not, it's easy to generate:

  #!/bin/sh
  DIR=$ 1:-"/bin" 
  (
  find $DIR   while read FILE
  do
     if [ -x $FILE ] && ! [ -d $FILE ]
     then
             LANG=C COLUMNS=2000 man  basename $FILE    \
                   grep ^SYNOPSIS -B 100   grep ^NAME -A 100   \
                   tail -n +2   head -n +2   \
                   grep -v '^[ \t]*$'
     fi
  done
  )   sort   uniq   sed 's/^ \+//'
  

  Try running it on /bin and /sbin: it's great!. Also, since it doesn't redirect stderr, it nicely exposes a number of manpage problems.

• Find more info about that Wikipedia live CD with Wikipedia browsable without the Internet.
• Make a collection of Free technical E-books: even those Indian low-cost book editions are too expensive here, so E-books mean a lot.

• Lack of STUN support, which means that you cannot do VoIP behind a NAT router without configuring a port-forward (which is often not possible). Nokia is also unlikely to add STUN support because the phone's target audience is clearly large businesses equipping their employees with phones that will work with VoIP locally, and "fall back" to GSM when on the road.
• Broken WPA2 implementation. I could not get my phone to associate with my WPA2 router. Reasons may be the AES implementation, which seems broken (see below), or just a faulty WPA2 implementation. I can get other devices, including my Palm, to talk to the router over WPA2 just fine.
• Broken AES (or VPN) implementation, meaning I could not get a VPN connection to either of a Cisco router, a Check Point VPN-1 gateway, a Linux host running FreeS/WAN, or OpenVPN when AES was used. I could connect to all but the OpenVPN client using 3DES.
• No WLAN reconnects. If your WLAN connection drops while you're using it, you have to exit the programme (or reassociate with the VoIP gateway) to get it back up. This sucks when browsing the web!
• Sucky battery lifetime. I was playing around with the device, using a fully-charged but two year old battery. After about 2.5 hours, it displayed the first low battery warning. Obviously, WLAN consumes a lot of power, but that's just too much and too fast.

• A major point of friction I've gathered from many (Debian) sides stems from the fact that many developers are largely unsatisfied with how Canonical/Ubuntu cooperates and "gives back" to the Debian community: essentially, at the moment all we get are monolithic patches describing the differences between Debian packages and their Ubuntu counterparts. Even though Mark has claimed that the patches should be modular if the underlying package uses a modular package management system (such as dpatch), this does not seem to be the case at first glance (c.f. e.g. squid). You have to look inside the monolithic patch to note that its changes are compartementalised into dpatch files. Yet, Canonical/Ubuntu continuously claims to be "good" and to "give back" to the Debian community, but that's just not happening in that way. Canonical/Ubuntu either has to start giving back according to their own claims, or stop pretending that it does, and it's good that I have heard this voiced by one of the Canonical employees as well.

• The perception that Canonical/Ubuntu is taking advantage of Debian seems to prevail. Taking advantage in this definition entails using but not giving back, as well as dragging integrative work out of Debian, something Joey Hess described as the supermarket thing, which has the potential to ruin the Debian project. Whether this is true or false, intentional or unintentional, it is important to recognize that these sentiments do exist among a number of members of the Debian community. There's a related point, namely jealousy about Ubuntu's success, and the fear that it steals Debian's users. In response, it is often said that while Ubuntu depends on Debian, the reverse is not the case: Debian does not need Ubuntu. This is false and true at the same time. Debian surely need derivatives like Ubuntu, for derivatives bring users, and users bring improvements and weight. However, Debian does not need any one derivative more than any other, and in fact it has been considered harmful if any derivative stands out.

• Many of those with whom I've spoken perceive that Canonical/Ubuntu do not acknowledge Debian enough, nor give credit where credit is due. And this lack of credit and acknowledgement further amplifies the fear. Two examples seem to stand out:

  • The "universe" community that gathered around Ubuntu's core surprisingly often does not know about Debian, or do not know how Ubuntu and Debian relate. I do not have any data on this, unfortunately (see below). This is something to take up with the Ubuntu Community Council.

  • On the ubuntu.com front page, Debian is not mentioned at all; if you actually follow the About Ubuntu link, you can find Debian mentioned once in the first paragraph (albeit without a link), and if you did notice the right hand menu expanding, you may even decide to click on Ubuntu and Debian, where the relationship is finally illustrated from the Ubuntu point of view. To many, this is just not enough. Update (+6h): the About Ubuntu page now links to the Debian homepage. Thanks!

• Canonical people, and Mark especially, draw an important line between Ubuntu (which is mostly free/open-source), and Canonical with its other products (Launchpad, Rosetta; which are non-free). However, from the outside, this line does not exist, or at least it appears as if there's a much stronger relationship between the Canonical and the Ubuntu project. This impression casts a corporate shadow over Ubuntu which deters many developers, even if it's undeniable that Ubuntu is a project of its own (to a large degree).

• There's no question about Mark being on an agenda, for which he has assembled an impressively powerful team (which indirectly includes many Debian developers) at an (even more impressively) cheap cost. It's not my business to speculate about other people's finances, but those that do conclude that Mark is very likely not running too much of a risk with what he does at the moment and could basically pull out at any point in time. To some, who have dedicated large parts of their lives to Debian, this seems like an unwelcome way to play a game.

• When Canonical entered the market and hired some developers to work on a Debian-related project, a lot of jealousy boiled up among those who didn't get a job, because back then it seemed that Canonical was out to pay people to work on Debian -- which is a common dream among us developers; at least people hoped that's what it would be. Many fundamental contributors felt left out and confronted with the question why they should continue their work for free when others are now getting paid for it. The twist is that nobody wanted to ask themselves that question, because money was never the reason why they started to work on Debian. The situation has leveled by now (I think). More and more people realise that Canonical is taking Ubuntu into a direction where many Debian developers do not want to go. Nevertheless, it seems that some of the frictions we are currently facing between Debian and Ubuntu still have their roots in the bad feelings from those times (which may well still exist in the individual case). Canonical/Ubuntu (and some Debian developers) need to realise (and get over) this, and somehow I think they've got a long way to go.

• quality improvements to the patches they "give back" to Debian, and the adoption of a more appropriate medium of exchange. Instead of patches, active reaching out to the Debian developers by the Ubuntu developers would be even better in certain cases. The claim by Mark and one of his employees that this is simply impossible because of the commonly misconceived size of the paid body of developers (which is just too small) is really their challenge, and if they cannot meet it, maybe they have to go around it. It should be noted that efforts along these lines exist, so Canonical does not have to start from scratch. Note to Debian developers: if you're so inclined, please add your name to the bottom of that page.
• a clear statement about how Canonical/Ubuntu plans to coexist or cooperate with Debian, and then the execution of those plans without leaving any doubt.
• a survey of the Ubuntu community to gather (and publish) information about common perceptions of Debians position and role with respect to Ubuntu and vice versa. Again, this is something for the Ubuntu Community Council.
• steps to ensure better familiarity with the Debian-Ubuntu situation among the Ubuntu community members.
• a dedicated space for Debian people to go and be heard. Maybe the #debian-ubuntu channel on irc.debian.org will suffice, if some of the Canonical/Ubuntu higher-ups make an effort to keep an eye on it.
• further steps by Canonical towards improving the relationship between the two projects, which could include regular meetings (or even irregular ones), uniting prominent representatives from both sides.

• http://www.osnews.com/comment.php?news_id=15106
• https://lists.ubuntu.com/archives/sounder/2006-July/008113.html

• both are triple-band with WCDMA support.
• both come with bluetooth, infrared, GPRS, EDGE, WCDMA, and WLAN (incl. WPA/WPA2 and EAP support).
• both have a VoIP client, though the store manager didn't know for sure whether I could connect to a SER (SIP express router) on the 'Net over a WLAN connection. They say that you can connect to a local gatekeeper [0], so I'd assume it's possible, but that's something to try out; read on...
• both can assign ring tones per contact. Nokia heard my cries...
• both can reuse my 6230's battery and charger. This is really a major selling point of Nokia -- all of their phones have the same charger, and batteries are compatible across many!
• both run Series 60 v3, Symbian OS 9.1, which is somewhat outdates (9.2) is current, but it does give you "improvements in the OS [which] mean that applications and content, and therefore a developers investment, are better protected than ever." (Wikipedia). Boy am I glad!
• both can run ScummVM, meaning I can play all of the best games ever released! If this is not a selling point for a business phone, what is?

• the E60 has no camera, while the E70 comes with a 2 megapixel one. I am actually not sure whether this is a plus or a minus, given that it is nice to have a camera handy when your life isn't all cubicles and security-conscious companies.
• the E70 sports a keyboard that you can fold out (as does the 6822). Unfortunately, here in Switzerland, all they offer is a QWERTZ version, which I'll avoid if at all possible. I don't think I'll be using the phone for "working" (as in word processing or spreadsheet editing; who does?), and I avoid SMS when I can, so even though the keyboard is certainly cool qand usable, I won't draw too much benefit.
• the E70 seems to have better battery life (according to the specs), but that's something that can be addressed with a more powerful battery, I'd say (plus, I can use my 6230 battery with both).
• the E60 is 3 cm smaller and weighs 10 grammes less than the E70. That said, it's still a lot bigger than the 6230 I now have.