1# Copyright (c) 2000-2002 Proofpoint, Inc. and its suppliers. 2# All rights reserved. 3# 4# By using this file, you agree to the terms and conditions set 5# forth in the LICENSE file which can be found at the top level of 6# the sendmail distribution. 7# 8# $Id: SECURITY,v 1.52 2013-11-22 20:51:54 ca Exp $ 9# 10 11This file gives some hints how to configure and run sendmail for 12people who are very security conscious (you should be...). 13 14Even though sendmail goes through great lengths to assure that it 15can't be compromised even if the system it is running on is 16incorrectly or insecurely configured, it can't work around everything. 17This has been demonstrated by OS problems which have subsequently 18been used to compromise the root account using sendmail as a vector. 19One way to minimize the possibility of such problems is to install 20sendmail without set-user-ID root, which avoids local exploits. 21This configuration, which is the default starting with 8.12, is 22described in the first section of this security guide. 23 24 25***************************************************** 26** sendmail configuration without set-user-ID root ** 27***************************************************** 28 29sendmail needs to run as root for several purposes: 30 31- bind to port 25 32- call the local delivery agent (LDA) as root (or other user) if the LDA 33 isn't set-user-ID root (unless some other method of storing e-mail in 34 local mailboxes is used). 35- read .forward files 36- write e-mail submitted via the command line to the queue directory. 37 38Only the last item requires a set-user-ID/set-group-ID program to 39avoid problems with a world-writable directory. It is however 40sufficient to have a set-group-ID program and a group-writable 41queue directory. The other requirements listed above can be 42fulfilled by a sendmail daemon that is started by root. Hence this 43section explains how to use two sendmail configurations to accomplish 44the goal to have a sendmail binary that is not set-user-ID root, 45and hence is not open to system configuration/OS problems or at 46least less problematic in presence of those. 47 48The default configuration starting with sendmail 8.12 uses one 49sendmail binary which acts differently based on operation mode and 50supplied options. 51 52sendmail must be a set-group-ID (default group: smmsp, recommended 53gid: 25) program to allow for queueing mail in a group-writable 54directory. Two .cf files are required: sendmail.cf for the daemon 55and submit.cf for the submission program. The following permissions 56should be used: 57 58-r-xr-sr-x root smmsp ... /PATH/TO/sendmail 59drwxrwx--- smmsp smmsp ... /var/spool/clientmqueue 60drwx------ root wheel ... /var/spool/mqueue 61-r--r--r-- root wheel ... /etc/mail/sendmail.cf 62-r--r--r-- root wheel ... /etc/mail/submit.cf 63 64[Notice: On some OS "wheel" is not used but "bin" or "root" instead, 65however, this is not important here.] 66 67That is, the owner of sendmail is root, the group is smmsp, and 68the binary is set-group-ID. The client mail queue is owned by 69smmsp with group smmsp and is group writable. The client mail 70queue directory must be writable by smmsp, but it must not be 71accessible for others. That is, do not use world read or execute 72permissions. In submit.cf the option UseMSP must be set, and 73QueueFileMode must be set to 0660. submit.cf is available in 74cf/cf/, which has been built from cf/cf/submit.mc. The file can 75be used as-is, if you want to add more options, use cf/cf/submit.mc 76as starting point and read cf/README: MESSAGE SUBMISSION PROGRAM 77carefully. 78 79The .cf file is chosen based on the operation mode. For -bm (default), 80-bs, and -t it is submit.cf (if it exists) for all others it is 81sendmail.cf. This selection can be changed by -Ac or -Am (alternative 82.cf file: client or mta). 83 84The daemon must be started by root as usual, e.g., 85 86/PATH/TO/sendmail -L sm-mta -bd -q1h 87 88(replace /PATH/TO with the right path for your OS, e.g., 89/usr/sbin or /usr/lib). 90 91Notice: if you run sendmail from inetd (which in general is not a 92good idea), you must specify -Am in addition to -bs. 93 94Mail will end up in the client queue if the daemon doesn't accept 95connections or if an address is temporarily not resolvable. The 96latter problem can be minimized by using 97 98 FEATURE(`nocanonify', `canonify_hosts') 99 define(`confDIRECT_SUBMISSION_MODIFIERS', `C') 100 101which, however, may have undesired side effects. See cf/README for 102a discussion. In general it is necessary to clean the queue either 103via a cronjob or by running a daemon, e.g., 104 105/PATH/TO/sendmail -L sm-msp-queue -Ac -q30m 106 107If the option UseMSP is not set, sendmail will complain during 108queue runs about bogus file permission. If you want a queue runner 109for the client queue, you probably have to change OS specific 110scripts to accomplish this (check the man pages of your OS for more 111information.) You can start this program as root, it will change 112its user id to RunAsUser (smmsp by default, recommended uid: 25). 113This way smmsp does not need a valid shell. 114 115 116Summary 117------- 118 119This is a brief summary how the two configuration files are used: 120 121sendmail.cf For the MTA (mail transmission agent) 122 The MTA is started by root as daemon: 123 124 /PATH/TO/sendmail -L sm-mta -bd -q1h 125 126 it accepts SMTP connections (on ports 25 and 587 by default); 127 it runs the main queue (/var/spool/mqueue by default). 128 129submit.cf For the MSP (mail submission program) 130 The MSP is used to submit e-mails, hence it is invoked 131 by programs (and maybe users); it does not run as SMTP 132 daemon; it uses /var/spool/clientmqueue by default; it 133 can be started to run that queue periodically: 134 135 /PATH/TO/sendmail -L sm-msp-queue -Ac -q30m 136 137 138Hints and Troubleshooting 139------------------------- 140 141RunAsUser: FEATURE(`msp') sets the option RunAsUser to smmsp. 142This user must have the group smmsp, i.e., the same group as the 143clientmqueue directory. If you specify a user whose primary group 144is not the same as that of the clientmqueue directory, then you 145should explicitly set the group, e.g., 146 147 FEATURE(`msp') 148 define(`confRUN_AS_USER', `mailmsp:smmsp') 149 150STARTTLS: If sendmail is compiled with STARTTLS support on a platform 151that does not have HASURANDOMDEV defined, you either need to specify 152the RandFile option (as for the MTA), or you have to turn off 153STARTTLS in the MSP, e.g., 154 155 DAEMON_OPTIONS(`Name=NoMTA, Addr=127.0.0.1, M=S') 156 FEATURE(`msp') 157 CLIENT_OPTIONS(`Family=inet, Address=0.0.0.0, M=S') 158 159The first option is used to turn off STARTTLS when the MSP is 160invoked with -bs as some MUAs do. 161 162 163What doesn't work anymore 164------------------------- 165 166Normal users can't use mailq anymore to see the MTA mail queue. 167There are several ways around it, e.g., changing QueueFileMode 168or giving users access via a program like sudo. 169 170sendmail -bv may give misleading output for normal users since it 171may not be able to access certain files, e.g., .forward files of 172other users. 173 174 175Alternative 176----------- 177 178Instead of having one set-group-ID binary, it is possible to use 179two with different permissions: one for message submission 180(set-group-ID), one acting as daemon etc, which is only executable 181by root. In that case it is possible to remove features from 182the message submission program to have a smaller binary. 183You can use 184 185 sh ./Build install-sm-mta 186 187to install a sendmail program to act as daemon etc under the name 188sm-mta. 189 190 191Set-User-Id 192----------- 193 194If you really have to install sendmail set-user-ID root, first build 195the sendmail package normally using 196 197 sh ./Build 198 199Then you can use 200 201 sh ./Build install-set-user-id 202 203to install the package in the old (pre-8.12) way. Make sure that 204no submit.cf file is installed. See devtools/README about 205confSETUSERID_INSTALL which you need to define. 206