1# Copyright (c) 2000-2001 Sendmail, Inc. and its suppliers. 2# All rights reserved. 3# 4# By using this file, you agree to the terms and conditions set 5# forth in the LICENSE file which can be found at the top level of 6# the sendmail distribution. 7# 8# $Id: SECURITY,v 1.47 2001/09/23 02:29:05 ca Exp $ 9# 10 11This file gives some hints how to configure and run sendmail for 12people who are very security conscious (you should be...). 13 14Even though sendmail goes through great lengths to assure that it 15can't be compromised even if the system it is running on is 16incorrectly or insecurely configured, it can't work around everything. 17This has been demonstrated by recent OS problems which have 18subsequently been used to compromise the root account using sendmail 19as a vector. One way to minimize the possibility of such problems 20is to install sendmail without set-user-ID root, which avoids local 21exploits. This configuration, which is the default starting with 228.12, is described in the first section of this security guide. 23 24 25***************************************************** 26** sendmail configuration without set-user-ID root ** 27***************************************************** 28 29sendmail needs to run as root for several purposes: 30 31- bind to port 25 32- call the local delivery agent (LDA) as root (or other user) if the LDA 33 isn't set-user-ID root (unless some other method of storing e-mail in 34 local mailboxes is used). 35- read .forward files 36- write e-mail submitted via the command line to the queue directory. 37 38Only the last item requires a set-user-ID/set-group-ID program to 39avoid problems with a world-writable directory. It is however 40sufficient to have a set-group-ID program and a group-writable 41queue directory. The other requirements listed above can be 42fulfilled by a sendmail daemon that is started by root. Hence this 43section explains how to use two sendmail configurations to accomplish 44the goal to have a sendmail binary that is not set-user-ID root, 45and hence is not open to system configuration/OS problems or at 46least less problematic in presence of those. 47 48The default configuration starting with sendmail 8.12 uses one 49sendmail binary which acts differently based on operation mode and 50supplied options. 51 52sendmail must be a set-group-ID (default group: smmsp, recommended 53gid: 25) program to allow for queueing mail in a group-writable 54directory. Two .cf files are required: sendmail.cf for the daemon 55and submit.cf for the submission program. The following permissions 56should be used: 57 58-r-xr-sr-x root smmsp ... /PATH/TO/sendmail 59drwxrwx--- smmsp smmsp ... /var/spool/clientmqueue 60drwx------ root wheel ... /var/spool/mqueue 61-r--r--r-- root wheel ... /etc/mail/sendmail.cf 62-r--r--r-- root wheel ... /etc/mail/submit.cf 63 64That is, the owner of sendmail is root, the group is smmsp, and 65the binary is set-group-ID. The client mail queue is owned by 66smmsp with group smmsp and is group writable. The client mail 67queue directory must be writable by smmsp, but it must not be 68accessible for others. That is, do not use world read or execute 69permissions. In submit.cf the option UseMSP must be set, and 70QueueFileMode must be set to 0660. submit.cf is available in 71cf/cf/, which has been built from cf/cf/submit.mc. The file can 72be used as-is, if you want to add more options, use cf/cf/submit.mc 73as starting point and read cf/README: MESSAGE SUBMISSION PROGRAM 74carefully. 75 76The .cf file is chosen based on the operation mode. For -bm (default), 77-bs, and -t it is submit.cf (if it exists) for all others it is 78sendmail.cf. This selection can be changed by -Ac or -Am (alternative 79.cf file: client or mta). 80 81The daemon must be started by root as usual, e.g., 82 83/PATH/TO/sendmail -L sm-mta -bd -q1h 84 85(replace /PATH/TO with the right path for your OS, e.g., 86/usr/sbin or /usr/lib). 87 88Notice: if you run sendmail from inetd (which in general is not a 89good idea), you must specify -Am in addition to -bs. 90 91Mail will end up in the client queue if the daemon doesn't accept 92connections or if an address is temporarily not resolvable. The 93latter problem can be minimized by using 94 95 FEATURE(`nocanonify', `canonify_hosts') 96 define(`confDIRECT_SUBMISSION_MODIFIERS', `C') 97 98which, however, may have undesired side effects. See cf/README for 99a discussion. In general it is necessary to clean the queue either 100via a cronjob or by running a daemon, e.g., 101 102/PATH/TO/sendmail -L sm-msp-queue -Ac -q30m 103 104If the option UseMSP is not set, sendmail will complain during 105queue runs about bogus file permission. If you want a queue runner 106for the client queue, you probably have to change OS specific 107scripts to accomplish this (check the man pages of your OS for more 108information.) You can start this program as root, it will change 109its user id to RunAsUser (smmsp by default, recommended uid: 25). 110This way smmsp does not need a valid shell. 111 112Summary 113------- 114 115This is a brief summary how the two configuration files are used: 116 117sendmail.cf For the MTA (mail transmission agent) 118 The MTA is started by root as daemon: 119 120 /PATH/TO/sendmail -L sm-mta -bd -q1h 121 122 it accepts SMTP connections (on ports 25 and 587 by default); 123 it runs the main queue (/var/spool/mqueue by default). 124 125submit.cf For the MSP (mail submission program) 126 The MSP is used to submit e-mails, hence it is invoked 127 by programs (and maybe users); it does not run as SMTP 128 daemon; it uses /var/spool/clientmqueue by default; it 129 can be started to run that queue periodically: 130 131 /PATH/TO/sendmail -L sm-msp-queue -Ac -q30m 132 133 134Hints and Troubleshooting 135------------------------- 136 137RunAsUser: FEATURE(`msp') sets the option RunAsUser to smmsp. 138This user must have the group smmsp, i.e., the same group as the 139clientmqueue directory. If you specify a user whose primary group 140is not the same as that of the clientmqueue directory, then you 141should explicitly set the group, e.g., 142 143 FEATURE(`msp') 144 define(`confRUN_AS_USER', `mailmsp:smmsp') 145 146STARTTLS: If sendmail is compiled with STARTTLS support on a platform 147that does not have HASURANDOMDEV defined, you either need to specify 148the RandFile option (as for the MTA), or you have to turn off 149STARTTLS in the MSP, e.g., 150 151 DAEMON_OPTIONS(`Name=NoMTA, Addr=127.0.0.1, M=S') 152 FEATURE(`msp') 153 CLIENT_OPTIONS(`Family=inet, Address=0.0.0.0, M=S') 154 155The first option is used to turn off STARTTLS when the MSP is 156invoked with -bs as some MUAs do. 157 158 159What doesn't work anymore 160------------------------- 161 162Normal users can't use mailq anymore to see the MTA mail queue. 163There are several ways around it, e.g., changing QueueFileMode 164or giving users access via a program like sudo. 165 166sendmail -bv may give misleading output for normal users since it 167may not be able to access certain files, e.g., .forward files of 168other users. 169 170 171Alternative 172----------- 173 174Instead of having one set-group-ID binary, it is possible to use 175two with different permissions: one for message submission 176(set-group-ID), one acting as daemon etc, which is only executable 177by root. In that case it is possible to remove features from 178the message submission program to have a smaller binary. 179You can use 180 181 sh ./Build install-sm-mta 182 183to install a sendmail program to act as daemon etc under the name 184sm-mta. 185 186Set-User-Id 187----------- 188 189If you really have to install sendmail set-user-ID root, you can use 190 191 sh ./Build install-set-user-id 192 193