README revision 43730
138032Speter/*- 243730Speter * @(#)README 8.51 (Berkeley) 1/25/1999 338032Speter */ 438032Speter 538032Speter SENDMAIL RELEASE 8 638032Speter 738032SpeterThis directory has the latest sendmail(TM) software from Sendmail, Inc. 838032SpeterSee doc/changes/changes.me for a summary of changes since 5.67. 938032Speter 1038032SpeterReport any bugs to sendmail-bugs@sendmail.ORG 1138032Speter 1238032SpeterThere is a web site at http://WWW.Sendmail.ORG -- see that site for 1338032Speterthe latest updates. 1438032Speter 1538032Speter****************************************************************** 1642575Speter** A new Build architecture is in place that allows you to ** 1742575Speter** use the "Build" shell script in any of the program ** 1842575Speter** directories. On many environments this will do everything ** 1942575Speter** for you, no fuss, no muss. See src/README for more details ** 2042575Speter** of compilation. See cf/README for details about building ** 2142575Speter** a runtime configuration file. ** 2238032Speter****************************************************************** 2338032Speter 2438032SpeterSendmail is a trademark of Sendmail, Inc. 2538032Speter 2638032Speter+-----------------------+ 2738032Speter| DIRECTORY PERMISSIONS | 2838032Speter+-----------------------+ 2938032Speter 3038032SpeterSendmail often gets blamed for many problems that are actually the 3138032Speterresult of other problems, such as overly permissive modes on directories. 3238032SpeterFor this reason, sendmail checks the modes on system directories and 3338032Speterfiles to determine if can have been trusted. For sendmail to run 3438032Speterwithout complaining, you MUST execute the following command: 3538032Speter 3638032Speter chmod go-w / /etc /etc/mail /usr /var /var/spool /var/spool/mqueue 3738032Speter chown root / /etc /etc/mail /usr /var /var/spool /var/spool/mqueue 3838032Speter 3938032SpeterYou will probably have to tweak this for your environment (for example, 4038032Spetersome systems put the spool directory into /usr/spool instead of 4138032Speter/var/spool and use /etc/mail for aliases file instead of /etc). If you 4238032Speterset the RunAsUser option in your sendmail.cf, the /var/spool/mqueue 4338032Speterdirectory will have to be owned by the RunAsUser user. As a general rule, 4438032Speterafter you have compiled sendmail, run the command 4538032Speter 4638032Speter sendmail -v -bi 4738032Speter 4838032Speterto initialize the alias database. If it gives messages such as 4938032Speter 5038032Speter WARNING: writable directory /etc 5138032Speter WARNING: writable directory /usr/spool/mqueue 5238032Speter 5338032Speterthen the directories listed have inappropriate write permissions and 5438032Spetershould be secured to avoid various possible security attacks. 5538032Speter 5638032SpeterBeginning with sendmail 8.9, these checks have become more strict to 5738032Speterprevent users from being able to access files they would normally not 5838032Speterbe able to read. In particular, .forward and :include: files in unsafe 5938032Speterdirectory paths (directory paths which are group or world writable) will 6038032Speterno longer be allowed. This would mean that if user joe's home directory 6138032Speterwas writable by group staff, sendmail would not use his .forward file. 6238032SpeterThis behavior can be altered, at the expense of system security, by 6338032Spetersetting the DontBlameSendmail option. For example, to allow .forward 6438032Speterfiles in group writable directories: 6538032Speter 6638032Speter O DontBlameSendmail=forwardfileingroupwritabledirpath 6738032Speter 6838032SpeterOr to allow them in both group and world writable directories: 6938032Speter 7038032Speter O DontBlameSendmail=forwardfileinunsafedirpath 7138032Speter 7238032SpeterItems from these unsafe .forward and :include: files will be marked 7338032Speteras unsafe addresses -- the items can not be deliveries to files or 7438032Speterprograms. This behavior can also be altered via DontBlameSendmail: 7538032Speter 7638032Speter O DontBlameSendmail=forwardfileinunsafedirpath, 7738032Speter forwardfileinunsafedirpathsafe 7838032Speter 7938032SpeterThe first flag allows the .forward file to be read, the second allows 8038032Speterthe items in the file to be marked as safe for file and program 8138032Speterdelivery. 8238032Speter 8338032SpeterOther files affected by this strengthened security include class 8438032Speterfiles (i.e. Fw /etc/sendmail.cw), persistent host status files, and 8538032Speterthe files specified by the ErrorHeader and HelpFile options. Similar 8638032SpeterDontBlameSendmail flags are available for the class, ErrorHeader, and 8738032SpeterHelpFile files. 8838032Speter 8938032SpeterIf you have an unsafe configuration of .forward and :include: 9038032Speterfiles, you can make it safe by finding all such files, and doing 9138032Spetera "chmod go-w $FILE" on each. Also, do a "chmod go-w $DIR" for 9238032Spetereach directory in the file's path. 9338032Speter 9438032Speter 9538032Speter+--------------+ 9638032Speter| MANUAL PAGES | 9738032Speter+--------------+ 9838032Speter 9938032SpeterThe sendmail manual pages use contemporary Berkeley troff macros. If 10038032Speteryour system does not process these manual pages, you can pick up the 10138032Speternew macros in a BSD Net/2 FTP site (e.g. on FTP.UU.NET, the files 10238032Speter/systems/unix/bsd-sources/share/tmac/*). 10338032Speter 10438032SpeterThe strip.sed file is only used in installation. 10538032Speter 10638032SpeterAfter installation, edit tmac.doc and tmac.andoc to reflect the 10738032Speterinstallation path of the tmac files. Those files contain pointers to 10838032Speter/usr/share/tmac/, and those pointers are not changed by the `make 10938032Speterinstall` process. There's also a bug in those files -- make the 11038032Speterfollowing patch: 11138032Speter 11238032Speter*** tmac.an~ Tue Jul 12 14:29:09 1994 11338032Speter--- tmac.an Fri Jul 15 13:17:54 1994 11438032Speter*************** 11538032Speter*** 50,55 **** 11638032Speter .de TH 11738032Speter .rn TH xX 11838032Speter .so /usr/share/lib/tmac/tmac.an.old 11938032Speter! .TH \\$1 \\$2 \\$3 \\$4 \\$5 \\$6 \\$7 \\$8 12038032Speter .rm xX 12138032Speter .. 12238032Speter--- 50,55 ---- 12338032Speter .de TH 12438032Speter .rn TH xX 12538032Speter .so /usr/share/lib/tmac/tmac.an.old 12638032Speter! .TH "\\$1" "\\$2" "\\$3" "\\$4" "\\$5" "\\$6" "\\$7" "\\$8" 12738032Speter .rm xX 12838032Speter .. 12938032Speter 13038032SpeterRename the existing tmac.an to be tmac.an.old, and rename tmac.andoc 13138032Speterto be tmac.an. 13238032Speter 13338032Spetertmac.an will choose between tmac.an.old, your old macros, or tmac.doc, 13438032Speterwhich are the new macros, so that both the new man pages and the 13538032Speterexisting man pages will be translated properly. 13638032Speter 13738032SpeterI'm also told that the groff distribution from MIT has a tmac.doc 13838032Spetermacro set that is compatible with these macros. 13938032Speter 14038032Speter 14138032Speter+-----------------------+ 14238032Speter| RELATED DOCUMENTATION | 14338032Speter+-----------------------+ 14438032Speter 14538032SpeterThere are other files you should read. Rooted in this directory are: 14638032Speter 14738032Speter doc/changes/changes.ps 14838032Speter Describes changes between Release 5 and Release 8 of sendmail. 14938032Speter There are some things that may behave somewhat differently. 15038032Speter For example, the rules governing when :include: files will 15138032Speter be read have been tightened up for security reasons. 15238032Speter FAQ 15338032Speter Answers to Frequently Asked Questions. 15438032Speter KNOWNBUGS 15538032Speter Known bugs in the current release. I try to keep this up 15638032Speter to date -- get the latest version from FTP.Sendmail.ORG 15738032Speter in /ucb/sendmail/KNOWNBUGS. 15838032Speter RELEASE_NOTES 15938032Speter A detailed description of the changes in each version. This 16038032Speter is quite long, but informative. 16138032Speter src/README 16238032Speter Details on compiling and installing sendmail. 16338032Speter cf/README 16438032Speter Details on configuring sendmail. 16538032Speter doc/op/op.me 16638032Speter The sendmail Installation & Operations Guide. Be warned: if 16738032Speter you are running this off on SunOS or some other system with an 16838032Speter old version of -me, you need to add the following macro to the 16938032Speter macros: 17038032Speter 17138032Speter .de sm 17238032Speter \s-1\\$1\\s0\\$2 17338032Speter .. 17438032Speter 17538032Speter This sets a word in a smaller pointsize. 17638032Speter 17738032Speter 17838032Speter+--------------+ 17938032Speter| RELATED RFCS | 18038032Speter+--------------+ 18138032Speter 18238032SpeterThere are several related RFCs that you may wish to read -- they are 18338032Speteravailable via anonymous FTP to several sites, including: 18438032Speter 18538032Speter ftp://nic.ddn.mil/rfc/ 18638032Speter ftp://nis.nsf.net/documents/rfc/ 18738032Speter ftp://nisc.jvnc.net/rfc/ 18838032Speter ftp://venera.isi.edu/in-notes/ 18938032Speter ftp://wuarchive.wustl.edu/doc/rfc/ 19038032Speter 19138032SpeterFor a list of the primary repositories see: 19238032Speter 19338032Speter http://www.isi.edu/in-notes/rfc-retrieval.txt 19438032Speter 19538032SpeterThey are also online at: 19638032Speter 19738032Speter http://www.ietf.org/ 19838032Speter 19938032SpeterThey can also be retrieved via electronic mail by sending 20038032Speteremail to one of: 20138032Speter 20238032Speter mail-server@nisc.sri.com 20338032Speter Put "send rfcNNN" in message body 20438032Speter nis-info@nis.nsf.net 20538032Speter Put "send RFCnnn.TXT-1" in message body 20638032Speter sendrfc@jvnc.net 20738032Speter Put "RFCnnn" as Subject: line 20838032Speter 20938032SpeterFor further instructions see: 21038032Speter 21138032Speter http://www.isi.edu/in-notes/rfc-editor/rfc-info 21238032Speter 21338032SpeterImportant RFCs for electronic mail are: 21438032Speter 21538032Speter RFC821 SMTP protocol 21638032Speter RFC822 Mail header format 21738032Speter RFC974 MX routing 21838032Speter RFC976 UUCP mail format 21938032Speter RFC1123 Host requirements (modifies 821, 822, and 974) 22038032Speter RFC1413 Identification server 22138032Speter RFC1869 SMTP Service Extensions (ESMTP spec) 22238032Speter RFC1652 SMTP Service Extension for 8bit-MIMEtransport 22338032Speter RFC1870 SMTP Service Extension for Message Size Declaration 22438032Speter RFC2045 Multipurpose Internet Mail Extensions (MIME) Part One: 22538032Speter Format of Internet Message Bodies 22638032Speter RFC1344 Implications of MIME for Internet Mail Gateways 22738032Speter RFC1428 Transition of Internet Mail from Just-Send-8 to 22838032Speter 8-bit SMTP/MIME 22938032Speter RFC1891 SMTP Service Extension for Delivery Status Notifications 23038032Speter RFC1892 Multipart/Report Content Type for the Reporting of 23138032Speter Mail System Administrative Messages 23238032Speter RFC1893 Enhanced Mail System Status Codes 23338032Speter RFC1894 An Extensible Message Format for Delivery Status 23438032Speter Notifications 23538032Speter RFC1985 SMTP Service Extension for Remote Message Queue Starting 23642575Speter RFC2033 Local Mail Transfer Protocol 23738032Speter 23838032SpeterOther standards that may be of interest (but which are less directly 23938032Speterrelevant to sendmail) are: 24038032Speter 24138032Speter RFC987 Mapping between RFC822 and X.400 24238032Speter RFC1049 Content-Type header field (extension to RFC822) 24338032Speter 24438032SpeterWarning to AIX users: this version of sendmail does not implement 24538032SpeterMB, MR, or MG DNS resource records, as defined (as experiments) in 24638032SpeterRFC1035. 24738032Speter 24838032Speter 24938032Speter+-------------------+ 25038032Speter| DATABASE ROUTINES | 25138032Speter+-------------------+ 25238032Speter 25338032SpeterIF YOU WANT TO RUN THE NEW BERKELEY DB SOFTWARE: **** DO NOT **** 25438032Speteruse the version that was on the Net2 tape -- it has a number of 25538032Speternefarious bugs that were bad enough when I got them; you shouldn't have 25638032Speterto go through the same thing. Instead, get a new version via the web at 25738032Speterhttp://www.sleepycat.com/. This software is highly recommended; it gets 25838032Speterrid of several stupid limits, it's much faster, and the interface is 25938032Speternicer to animals and plants. If the Berkeley DB include files 26038032Speterare installed in a location other than those which your compiler searches, 26138032Speteryou will need to provide that directory when building: 26238032Speter 26338032Speter Build -I/path/to/include/directory 26438032Speter 26538032SpeterIf you are using Berkeley DB versions 1.85 or 1.86, you are *strongly* 26638032Speterurged to upgrade to DB version 2, available from http://www.sleepycat.com/. 26738032SpeterBerkeley DB versions 1.85 and 1.86 are known to be broken in various nasty 26838032Speterways (see http://www.sleepycat.com/db.185.html), and can cause sendmail 26938032Speterto dump core. In addition, the newest versions of gcc and the Solaris 27038032Spetercompilers perform optimizations in those versions that may cause fairly 27138032Speterrandom core dumps. 27238032Speter 27338032SpeterIf you have no choice but to use Berkeley DB 1.85 or 1.86, and you are 27438032Speterusing both Berkeley DB and files in the UNIX ndbm format, remove ndbm.h 27538032Speterand ndbm.o from the DB library after building it. You should also apply 27638032Speterall of the patches for DB 1.85 and 1.86 found at the Sleepycat web site 27738032Speter(see http://www.sleepycat.com/db.185.html), as they fix some of the known 27838032Speterproblems. 27938032Speter 28038032SpeterIf you are using a version of Berkeley DB 2 previous to 2.3.15, and you 28138032Speterare using both Berkeley DB and files in the UNIX ndbm format, remove dbm.o 28238032Speterfrom the DB library after building it. No other changes are necessary. 28338032Speter 28438032SpeterIf you are using Berkeley DB version 2.3.15 or greater, no changes are 28538032Speternecessary. 28638032Speter 28738032SpeterThe underlying database file formats changed between Berkeley DB versions 28838032Speter1.85 and 1.86, and again between DB 1.86 and version 2.0. If you are 28938032Speterupgrading from one of those versions, you must recreate your database 29038032Speterfile(s). Do this by rebuilding all maps with makemap and rebuilding the 29138032Speteralias file with newaliases. 29238032Speter 29338032Speter 29438032Speter+--------------------+ 29538032Speter| HOST NAME SERVICES | 29638032Speter+--------------------+ 29738032Speter 29838032SpeterIf you are using NIS or /etc/hosts, it is critical that you 29938032Speterlist the long (fully qualified) name somewhere (preferably first) in 30038032Speterthe /etc/hosts file used to build the NIS database. For example, the 30138032Speterline should read 30238032Speter 30338032Speter 128.32.149.68 mastodon.CS.Berkeley.EDU mastodon 30438032Speter 30538032Speter**** NOT **** 30638032Speter 30738032Speter 128.32.149.68 mastodon 30838032Speter 30938032SpeterIf you do not include the long name, sendmail will complain loudly 31038032Speterabout ``unable to qualify my own domain name (mastodon) -- using 31138032Spetershort name'' and conclude that your canonical name is the short 31238032Speterversion and use that in messages. The name "mastodon" doesn't mean 31338032Spetermuch outside of Berkeley, and so this creates incorrect and unreplyable 31438032Spetermessages. 31538032Speter 31638032Speter 31738032Speter+-------------+ 31838032Speter| USE WITH MH | 31938032Speter+-------------+ 32038032Speter 32138032SpeterThis version of sendmail notices and reports certain kinds of SMTP 32238032Speterprotocol violations that were ignored by older versions. If you 32338032Speterare running MH you may wish to install the patch in contrib/mh.patch 32438032Speterthat will prevent these warning reports. This patch also works 32538032Speterwith the old version of sendmail, so it's safe to go ahead and 32638032Speterinstall it. 32738032Speter 32838032Speter 32938032Speter+----------------+ 33038032Speter| USE WITH IDENT | 33138032Speter+----------------+ 33238032Speter 33338032SpeterSendmail 8 supports the IDENT protocol, as defined by RFC 1413. 33438032SpeterNo ident server is included with this distribution. I have found 33538032Spetercopies available on: 33638032Speter 33738032Speter ftp.lysator.liu.se /pub/ident/servers 33838032Speter romulus.ucs.uoknor.edu /networking/ident/servers 33938032Speter ftp.cyf-kr.edu.pl /agh/uciagh/network/ident 34038032Speter 34138032SpeterIf you want to run an IDENT server, I suggest getting a copy from 34238032Speterone of those sites. Versions are available for several different 34338032Spetersystems, including Apollo, BSD, NeXT, AIX, TOPS20, and VMS. 34438032Speter 34538032Speter 34643730Speter+-------------------------+ 34743730Speter| INTEROPERATION PROBLEMS | 34843730Speter+-------------------------+ 34943730Speter 35043730SpeterMicrosoft Exchange Server 5.0 35143730Speter We have had a report that ``about 7% of messages from Sendmail 35243730Speter to Exchange were not being delivered with status messages of 35343730Speter "connection reset" and "I/O error".'' Upgrading Exchange from 35443730Speter Version 5.0 to Version 5.5 Service Pack 2 solved this problem. 35543730Speter 35643730Speter 35738032Speter+---------------------+ 35838032Speter| DIRECTORY STRUCTURE | 35938032Speter+---------------------+ 36038032Speter 36138032SpeterThe structure of this directory tree is: 36238032Speter 36338032Spetercf Source for sendmail configuration files. These are 36438032Speter different than what you've seen before. They are a 36538032Speter fairly dramatic rewrite, requiring the new sendmail 36638032Speter (since they use new features). 36738032Spetercontrib Some contributed tools to help with sendmail. THESE 36838032Speter ARE NOT SUPPORTED by sendmail -- contact the original 36938032Speter authors if you have problems. (This directory is not 37038032Speter on the 4.4BSD tape.) 37138032Speterdoc Documentation. If you are getting source, read 37238032Speter op.me -- it's long, but worth it. 37338032Spetermail.local The source for the local delivery agent used for 4.4BSD. 37438032Speter THIS IS NOT PART OF SENDMAIL! and may not compile 37538032Speter everywhere, since it depends on some 4.4-isms. Warning: 37638032Speter it does mailbox locking differently than other systems. 37738032Spetermailstats Statistics printing program. It has the pathname of 37838032Speter sendmail.st compiled in, so if you've changed that, 37938032Speter beware. 38038032Spetermakemap A program that creates the keyed maps used by the $( ... $) 38138032Speter construct in sendmail. It is primitive but effective. 38238032Speter It takes a very simple input format, so you will probably 38338032Speter expect to preprocess must human-convenient formats 38438032Speter using sed scripts before this program will like them. 38538032Speter But it should be functionally complete. 38638032Speterpraliases A program to print the DBM or NEWDB version of the 38738032Speter aliases file. 38838032Speterrmail Source for rmail(8). This is used as a delivery 38938032Speter agent for for UUCP, and could presumably be used by 39038032Speter other non-socket oriented mailers. Older versions of 39138032Speter rmail are probably deficient. RMAIL IS NOT PART OF 39238032Speter SENDMAIL!!! The 4.4BSD source is included for you to 39338032Speter look at or try to port to your system. I know it doesn't 39438032Speter compile on {SunOS, HP-UX, OSF/1, other} (pick one). 39538032Spetersmrsh The "sendmail restricted shell", which can be used as 39638032Speter a replacement for /bin/sh in the prog mailer to provide 39738032Speter increased security control. NOT PART OF SENDMAIL! 39838032Spetersrc Source for the sendmail program itself. 39938032Spetertest Some test scripts (currently only for compilation aids). 400