Zhang,
Thank you for your assurance there is no back door.  However, given your expertise, I was hoping you might provide suggestion on how to detect or protect against potential back door.  I do not have the know how to review the source code, and I think few people who would consider using and are using iRedMail do.  If you were in the same position as me/us, the potential user, what would you do, both prior to installing, and after installing the application.
Sincerely,
Dan Genzyme

Hi,

Install Rkhunter and clamAV and use regular server scans. You could use CSF that will enable audit service and creat chksums for all files and track modifications in key files.

So the key will be watching server files/ firewall.

You would find more help in security forums as this topic would apply to many services and standard postfix.

Most of issue will come from open ports services like web. So lock down apache install and jail correctly php stack, you can add mod_security with tight rules there too as a first defensive layer against potential hacks, jailing would extend it from spreading and firewall lock down will help too. Audit using CSF or such will warn on any abnormal activity.

M B