README revision 38032
138032Speter/*- 238032Speter * @(#)README 8.48 (Berkeley) 5/19/98 338032Speter */ 438032Speter 538032Speter SENDMAIL RELEASE 8 638032Speter 738032SpeterThis directory has the latest sendmail(TM) software from Sendmail, Inc. 838032SpeterSee doc/changes/changes.me for a summary of changes since 5.67. 938032Speter 1038032SpeterReport any bugs to sendmail-bugs@sendmail.ORG 1138032Speter 1238032SpeterThere is a web site at http://WWW.Sendmail.ORG -- see that site for 1338032Speterthe latest updates. 1438032Speter 1538032Speter****************************************************************** 1638032Speter** DO NOT USE MAKE to compile sendmail. Instead, cd src and ** 1738032Speter** use the "Build" shell script. On many environments this ** 1838032Speter** will do everything for you, no fuss, no muss. See ** 1938032Speter** src/README for more details of compilation. See cf/README ** 2038032Speter** for details about building a runtime configuration file. ** 2138032Speter****************************************************************** 2238032Speter 2338032SpeterSendmail is a trademark of Sendmail, Inc. 2438032Speter 2538032Speter+-----------------------+ 2638032Speter| DIRECTORY PERMISSIONS | 2738032Speter+-----------------------+ 2838032Speter 2938032SpeterSendmail often gets blamed for many problems that are actually the 3038032Speterresult of other problems, such as overly permissive modes on directories. 3138032SpeterFor this reason, sendmail checks the modes on system directories and 3238032Speterfiles to determine if can have been trusted. For sendmail to run 3338032Speterwithout complaining, you MUST execute the following command: 3438032Speter 3538032Speter chmod go-w / /etc /etc/mail /usr /var /var/spool /var/spool/mqueue 3638032Speter chown root / /etc /etc/mail /usr /var /var/spool /var/spool/mqueue 3738032Speter 3838032SpeterYou will probably have to tweak this for your environment (for example, 3938032Spetersome systems put the spool directory into /usr/spool instead of 4038032Speter/var/spool and use /etc/mail for aliases file instead of /etc). If you 4138032Speterset the RunAsUser option in your sendmail.cf, the /var/spool/mqueue 4238032Speterdirectory will have to be owned by the RunAsUser user. As a general rule, 4338032Speterafter you have compiled sendmail, run the command 4438032Speter 4538032Speter sendmail -v -bi 4638032Speter 4738032Speterto initialize the alias database. If it gives messages such as 4838032Speter 4938032Speter WARNING: writable directory /etc 5038032Speter WARNING: writable directory /usr/spool/mqueue 5138032Speter 5238032Speterthen the directories listed have inappropriate write permissions and 5338032Spetershould be secured to avoid various possible security attacks. 5438032Speter 5538032SpeterBeginning with sendmail 8.9, these checks have become more strict to 5638032Speterprevent users from being able to access files they would normally not 5738032Speterbe able to read. In particular, .forward and :include: files in unsafe 5838032Speterdirectory paths (directory paths which are group or world writable) will 5938032Speterno longer be allowed. This would mean that if user joe's home directory 6038032Speterwas writable by group staff, sendmail would not use his .forward file. 6138032SpeterThis behavior can be altered, at the expense of system security, by 6238032Spetersetting the DontBlameSendmail option. For example, to allow .forward 6338032Speterfiles in group writable directories: 6438032Speter 6538032Speter O DontBlameSendmail=forwardfileingroupwritabledirpath 6638032Speter 6738032SpeterOr to allow them in both group and world writable directories: 6838032Speter 6938032Speter O DontBlameSendmail=forwardfileinunsafedirpath 7038032Speter 7138032SpeterItems from these unsafe .forward and :include: files will be marked 7238032Speteras unsafe addresses -- the items can not be deliveries to files or 7338032Speterprograms. This behavior can also be altered via DontBlameSendmail: 7438032Speter 7538032Speter O DontBlameSendmail=forwardfileinunsafedirpath, 7638032Speter forwardfileinunsafedirpathsafe 7738032Speter 7838032SpeterThe first flag allows the .forward file to be read, the second allows 7938032Speterthe items in the file to be marked as safe for file and program 8038032Speterdelivery. 8138032Speter 8238032SpeterOther files affected by this strengthened security include class 8338032Speterfiles (i.e. Fw /etc/sendmail.cw), persistent host status files, and 8438032Speterthe files specified by the ErrorHeader and HelpFile options. Similar 8538032SpeterDontBlameSendmail flags are available for the class, ErrorHeader, and 8638032SpeterHelpFile files. 8738032Speter 8838032SpeterIf you have an unsafe configuration of .forward and :include: 8938032Speterfiles, you can make it safe by finding all such files, and doing 9038032Spetera "chmod go-w $FILE" on each. Also, do a "chmod go-w $DIR" for 9138032Spetereach directory in the file's path. 9238032Speter 9338032Speter 9438032Speter+--------------+ 9538032Speter| MANUAL PAGES | 9638032Speter+--------------+ 9738032Speter 9838032SpeterThe sendmail manual pages use contemporary Berkeley troff macros. If 9938032Speteryour system does not process these manual pages, you can pick up the 10038032Speternew macros in a BSD Net/2 FTP site (e.g. on FTP.UU.NET, the files 10138032Speter/systems/unix/bsd-sources/share/tmac/*). 10238032Speter 10338032SpeterThe strip.sed file is only used in installation. 10438032Speter 10538032SpeterAfter installation, edit tmac.doc and tmac.andoc to reflect the 10638032Speterinstallation path of the tmac files. Those files contain pointers to 10738032Speter/usr/share/tmac/, and those pointers are not changed by the `make 10838032Speterinstall` process. There's also a bug in those files -- make the 10938032Speterfollowing patch: 11038032Speter 11138032Speter*** tmac.an~ Tue Jul 12 14:29:09 1994 11238032Speter--- tmac.an Fri Jul 15 13:17:54 1994 11338032Speter*************** 11438032Speter*** 50,55 **** 11538032Speter .de TH 11638032Speter .rn TH xX 11738032Speter .so /usr/share/lib/tmac/tmac.an.old 11838032Speter! .TH \\$1 \\$2 \\$3 \\$4 \\$5 \\$6 \\$7 \\$8 11938032Speter .rm xX 12038032Speter .. 12138032Speter--- 50,55 ---- 12238032Speter .de TH 12338032Speter .rn TH xX 12438032Speter .so /usr/share/lib/tmac/tmac.an.old 12538032Speter! .TH "\\$1" "\\$2" "\\$3" "\\$4" "\\$5" "\\$6" "\\$7" "\\$8" 12638032Speter .rm xX 12738032Speter .. 12838032Speter 12938032SpeterRename the existing tmac.an to be tmac.an.old, and rename tmac.andoc 13038032Speterto be tmac.an. 13138032Speter 13238032Spetertmac.an will choose between tmac.an.old, your old macros, or tmac.doc, 13338032Speterwhich are the new macros, so that both the new man pages and the 13438032Speterexisting man pages will be translated properly. 13538032Speter 13638032SpeterI'm also told that the groff distribution from MIT has a tmac.doc 13738032Spetermacro set that is compatible with these macros. 13838032Speter 13938032Speter 14038032Speter+-----------------------+ 14138032Speter| RELATED DOCUMENTATION | 14238032Speter+-----------------------+ 14338032Speter 14438032SpeterThere are other files you should read. Rooted in this directory are: 14538032Speter 14638032Speter doc/changes/changes.ps 14738032Speter Describes changes between Release 5 and Release 8 of sendmail. 14838032Speter There are some things that may behave somewhat differently. 14938032Speter For example, the rules governing when :include: files will 15038032Speter be read have been tightened up for security reasons. 15138032Speter FAQ 15238032Speter Answers to Frequently Asked Questions. 15338032Speter KNOWNBUGS 15438032Speter Known bugs in the current release. I try to keep this up 15538032Speter to date -- get the latest version from FTP.Sendmail.ORG 15638032Speter in /ucb/sendmail/KNOWNBUGS. 15738032Speter RELEASE_NOTES 15838032Speter A detailed description of the changes in each version. This 15938032Speter is quite long, but informative. 16038032Speter src/README 16138032Speter Details on compiling and installing sendmail. 16238032Speter cf/README 16338032Speter Details on configuring sendmail. 16438032Speter doc/op/op.me 16538032Speter The sendmail Installation & Operations Guide. Be warned: if 16638032Speter you are running this off on SunOS or some other system with an 16738032Speter old version of -me, you need to add the following macro to the 16838032Speter macros: 16938032Speter 17038032Speter .de sm 17138032Speter \s-1\\$1\\s0\\$2 17238032Speter .. 17338032Speter 17438032Speter This sets a word in a smaller pointsize. 17538032Speter 17638032Speter 17738032Speter+--------------+ 17838032Speter| RELATED RFCS | 17938032Speter+--------------+ 18038032Speter 18138032SpeterThere are several related RFCs that you may wish to read -- they are 18238032Speteravailable via anonymous FTP to several sites, including: 18338032Speter 18438032Speter ftp://nic.ddn.mil/rfc/ 18538032Speter ftp://nis.nsf.net/documents/rfc/ 18638032Speter ftp://nisc.jvnc.net/rfc/ 18738032Speter ftp://venera.isi.edu/in-notes/ 18838032Speter ftp://wuarchive.wustl.edu/doc/rfc/ 18938032Speter 19038032SpeterFor a list of the primary repositories see: 19138032Speter 19238032Speter http://www.isi.edu/in-notes/rfc-retrieval.txt 19338032Speter 19438032SpeterThey are also online at: 19538032Speter 19638032Speter http://www.ietf.org/ 19738032Speter 19838032SpeterThey can also be retrieved via electronic mail by sending 19938032Speteremail to one of: 20038032Speter 20138032Speter mail-server@nisc.sri.com 20238032Speter Put "send rfcNNN" in message body 20338032Speter nis-info@nis.nsf.net 20438032Speter Put "send RFCnnn.TXT-1" in message body 20538032Speter sendrfc@jvnc.net 20638032Speter Put "RFCnnn" as Subject: line 20738032Speter 20838032SpeterFor further instructions see: 20938032Speter 21038032Speter http://www.isi.edu/in-notes/rfc-editor/rfc-info 21138032Speter 21238032SpeterImportant RFCs for electronic mail are: 21338032Speter 21438032Speter RFC821 SMTP protocol 21538032Speter RFC822 Mail header format 21638032Speter RFC974 MX routing 21738032Speter RFC976 UUCP mail format 21838032Speter RFC1123 Host requirements (modifies 821, 822, and 974) 21938032Speter RFC1413 Identification server 22038032Speter RFC1869 SMTP Service Extensions (ESMTP spec) 22138032Speter RFC1652 SMTP Service Extension for 8bit-MIMEtransport 22238032Speter RFC1870 SMTP Service Extension for Message Size Declaration 22338032Speter RFC2045 Multipurpose Internet Mail Extensions (MIME) Part One: 22438032Speter Format of Internet Message Bodies 22538032Speter RFC1344 Implications of MIME for Internet Mail Gateways 22638032Speter RFC1428 Transition of Internet Mail from Just-Send-8 to 22738032Speter 8-bit SMTP/MIME 22838032Speter RFC1891 SMTP Service Extension for Delivery Status Notifications 22938032Speter RFC1892 Multipart/Report Content Type for the Reporting of 23038032Speter Mail System Administrative Messages 23138032Speter RFC1893 Enhanced Mail System Status Codes 23238032Speter RFC1894 An Extensible Message Format for Delivery Status 23338032Speter Notifications 23438032Speter RFC1985 SMTP Service Extension for Remote Message Queue Starting 23538032Speter 23638032SpeterOther standards that may be of interest (but which are less directly 23738032Speterrelevant to sendmail) are: 23838032Speter 23938032Speter RFC987 Mapping between RFC822 and X.400 24038032Speter RFC1049 Content-Type header field (extension to RFC822) 24138032Speter 24238032SpeterWarning to AIX users: this version of sendmail does not implement 24338032SpeterMB, MR, or MG DNS resource records, as defined (as experiments) in 24438032SpeterRFC1035. 24538032Speter 24638032Speter 24738032Speter+-------------------+ 24838032Speter| DATABASE ROUTINES | 24938032Speter+-------------------+ 25038032Speter 25138032SpeterIF YOU WANT TO RUN THE NEW BERKELEY DB SOFTWARE: **** DO NOT **** 25238032Speteruse the version that was on the Net2 tape -- it has a number of 25338032Speternefarious bugs that were bad enough when I got them; you shouldn't have 25438032Speterto go through the same thing. Instead, get a new version via the web at 25538032Speterhttp://www.sleepycat.com/. This software is highly recommended; it gets 25638032Speterrid of several stupid limits, it's much faster, and the interface is 25738032Speternicer to animals and plants. If the Berkeley DB include files 25838032Speterare installed in a location other than those which your compiler searches, 25938032Speteryou will need to provide that directory when building: 26038032Speter 26138032Speter Build -I/path/to/include/directory 26238032Speter 26338032SpeterIf you are using Berkeley DB versions 1.85 or 1.86, you are *strongly* 26438032Speterurged to upgrade to DB version 2, available from http://www.sleepycat.com/. 26538032SpeterBerkeley DB versions 1.85 and 1.86 are known to be broken in various nasty 26638032Speterways (see http://www.sleepycat.com/db.185.html), and can cause sendmail 26738032Speterto dump core. In addition, the newest versions of gcc and the Solaris 26838032Spetercompilers perform optimizations in those versions that may cause fairly 26938032Speterrandom core dumps. 27038032Speter 27138032SpeterIf you have no choice but to use Berkeley DB 1.85 or 1.86, and you are 27238032Speterusing both Berkeley DB and files in the UNIX ndbm format, remove ndbm.h 27338032Speterand ndbm.o from the DB library after building it. You should also apply 27438032Speterall of the patches for DB 1.85 and 1.86 found at the Sleepycat web site 27538032Speter(see http://www.sleepycat.com/db.185.html), as they fix some of the known 27638032Speterproblems. 27738032Speter 27838032SpeterIf you are using a version of Berkeley DB 2 previous to 2.3.15, and you 27938032Speterare using both Berkeley DB and files in the UNIX ndbm format, remove dbm.o 28038032Speterfrom the DB library after building it. No other changes are necessary. 28138032Speter 28238032SpeterIf you are using Berkeley DB version 2.3.15 or greater, no changes are 28338032Speternecessary. 28438032Speter 28538032SpeterThe underlying database file formats changed between Berkeley DB versions 28638032Speter1.85 and 1.86, and again between DB 1.86 and version 2.0. If you are 28738032Speterupgrading from one of those versions, you must recreate your database 28838032Speterfile(s). Do this by rebuilding all maps with makemap and rebuilding the 28938032Speteralias file with newaliases. 29038032Speter 29138032Speter 29238032Speter+--------------------+ 29338032Speter| HOST NAME SERVICES | 29438032Speter+--------------------+ 29538032Speter 29638032SpeterIf you are using NIS or /etc/hosts, it is critical that you 29738032Speterlist the long (fully qualified) name somewhere (preferably first) in 29838032Speterthe /etc/hosts file used to build the NIS database. For example, the 29938032Speterline should read 30038032Speter 30138032Speter 128.32.149.68 mastodon.CS.Berkeley.EDU mastodon 30238032Speter 30338032Speter**** NOT **** 30438032Speter 30538032Speter 128.32.149.68 mastodon 30638032Speter 30738032SpeterIf you do not include the long name, sendmail will complain loudly 30838032Speterabout ``unable to qualify my own domain name (mastodon) -- using 30938032Spetershort name'' and conclude that your canonical name is the short 31038032Speterversion and use that in messages. The name "mastodon" doesn't mean 31138032Spetermuch outside of Berkeley, and so this creates incorrect and unreplyable 31238032Spetermessages. 31338032Speter 31438032Speter 31538032Speter+-------------+ 31638032Speter| USE WITH MH | 31738032Speter+-------------+ 31838032Speter 31938032SpeterThis version of sendmail notices and reports certain kinds of SMTP 32038032Speterprotocol violations that were ignored by older versions. If you 32138032Speterare running MH you may wish to install the patch in contrib/mh.patch 32238032Speterthat will prevent these warning reports. This patch also works 32338032Speterwith the old version of sendmail, so it's safe to go ahead and 32438032Speterinstall it. 32538032Speter 32638032Speter 32738032Speter+----------------+ 32838032Speter| USE WITH IDENT | 32938032Speter+----------------+ 33038032Speter 33138032SpeterSendmail 8 supports the IDENT protocol, as defined by RFC 1413. 33238032SpeterNo ident server is included with this distribution. I have found 33338032Spetercopies available on: 33438032Speter 33538032Speter ftp.lysator.liu.se /pub/ident/servers 33638032Speter romulus.ucs.uoknor.edu /networking/ident/servers 33738032Speter ftp.cyf-kr.edu.pl /agh/uciagh/network/ident 33838032Speter 33938032SpeterIf you want to run an IDENT server, I suggest getting a copy from 34038032Speterone of those sites. Versions are available for several different 34138032Spetersystems, including Apollo, BSD, NeXT, AIX, TOPS20, and VMS. 34238032Speter 34338032Speter 34438032Speter+---------------------+ 34538032Speter| DIRECTORY STRUCTURE | 34638032Speter+---------------------+ 34738032Speter 34838032SpeterThe structure of this directory tree is: 34938032Speter 35038032Spetercf Source for sendmail configuration files. These are 35138032Speter different than what you've seen before. They are a 35238032Speter fairly dramatic rewrite, requiring the new sendmail 35338032Speter (since they use new features). 35438032Spetercontrib Some contributed tools to help with sendmail. THESE 35538032Speter ARE NOT SUPPORTED by sendmail -- contact the original 35638032Speter authors if you have problems. (This directory is not 35738032Speter on the 4.4BSD tape.) 35838032Speterdoc Documentation. If you are getting source, read 35938032Speter op.me -- it's long, but worth it. 36038032Spetermail.local The source for the local delivery agent used for 4.4BSD. 36138032Speter THIS IS NOT PART OF SENDMAIL! and may not compile 36238032Speter everywhere, since it depends on some 4.4-isms. Warning: 36338032Speter it does mailbox locking differently than other systems. 36438032Spetermailstats Statistics printing program. It has the pathname of 36538032Speter sendmail.st compiled in, so if you've changed that, 36638032Speter beware. 36738032Spetermakemap A program that creates the keyed maps used by the $( ... $) 36838032Speter construct in sendmail. It is primitive but effective. 36938032Speter It takes a very simple input format, so you will probably 37038032Speter expect to preprocess must human-convenient formats 37138032Speter using sed scripts before this program will like them. 37238032Speter But it should be functionally complete. 37338032Speterpraliases A program to print the DBM or NEWDB version of the 37438032Speter aliases file. 37538032Speterrmail Source for rmail(8). This is used as a delivery 37638032Speter agent for for UUCP, and could presumably be used by 37738032Speter other non-socket oriented mailers. Older versions of 37838032Speter rmail are probably deficient. RMAIL IS NOT PART OF 37938032Speter SENDMAIL!!! The 4.4BSD source is included for you to 38038032Speter look at or try to port to your system. I know it doesn't 38138032Speter compile on {SunOS, HP-UX, OSF/1, other} (pick one). 38238032Spetersmrsh The "sendmail restricted shell", which can be used as 38338032Speter a replacement for /bin/sh in the prog mailer to provide 38438032Speter increased security control. NOT PART OF SENDMAIL! 38538032Spetersrc Source for the sendmail program itself. 38638032Spetertest Some test scripts (currently only for compilation aids). 387