README revision 64562
138032Speter 238032Speter SENDMAIL RELEASE 8 338032Speter 438032SpeterThis directory has the latest sendmail(TM) software from Sendmail, Inc. 538032Speter 638032SpeterReport any bugs to sendmail-bugs@sendmail.ORG 738032Speter 864562SgshapiroThere is a web site at http://WWW.Sendmail.ORG/ -- see that site for 938032Speterthe latest updates. 1038032Speter 1164562Sgshapiro+--------------+ 1264562Sgshapiro| INTRODUCTION | 1364562Sgshapiro+--------------+ 1438032Speter 1564562Sgshapiro0. The vast majority of queries to <sendmail-questions@sendmail.org> 1664562Sgshapiro are answered in the README files noted below. 1764562Sgshapiro 1864562Sgshapiro1. Read this README file, especially this introduction, and the DIRECTORY 1964562Sgshapiro PERMISSIONS sections. 2064562Sgshapiro 2164562Sgshapiro2. Read sendmail/README, especially: 2264562Sgshapiro a. the introduction 2364562Sgshapiro b. the BUILDING SENDMAIL section 2464562Sgshapiro c. the relevant part(s) of the OPERATING SYSTEM AND COMPILE QUIRKS section 2564562Sgshapiro 2664562Sgshapiro You may also find these useful: 2764562Sgshapiro 2864562Sgshapiro d. devtools/README 2964562Sgshapiro e. devtools/Site/README 3064562Sgshapiro 3164562Sgshapiro3. Read cf/README. 3264562Sgshapiro 3338032SpeterSendmail is a trademark of Sendmail, Inc. 3438032Speter 3538032Speter+-----------------------+ 3638032Speter| DIRECTORY PERMISSIONS | 3738032Speter+-----------------------+ 3838032Speter 3938032SpeterSendmail often gets blamed for many problems that are actually the 4038032Speterresult of other problems, such as overly permissive modes on directories. 4138032SpeterFor this reason, sendmail checks the modes on system directories and 4264562Sgshapirofiles to determine if they can be trusted. For sendmail to run without 4364562Sgshapirocomplaining, you MUST execute the following command: 4438032Speter 4538032Speter chmod go-w / /etc /etc/mail /usr /var /var/spool /var/spool/mqueue 4638032Speter chown root / /etc /etc/mail /usr /var /var/spool /var/spool/mqueue 4738032Speter 4838032SpeterYou will probably have to tweak this for your environment (for example, 4938032Spetersome systems put the spool directory into /usr/spool instead of 5064562Sgshapiro/var/spool). If you set the RunAsUser option in your sendmail.cf, the 5164562Sgshapiro/var/spool/mqueue directory will have to be owned by the RunAsUser user. 5264562SgshapiroAs a general rule, after you have compiled sendmail, run the command 5338032Speter 5438032Speter sendmail -v -bi 5538032Speter 5638032Speterto initialize the alias database. If it gives messages such as 5738032Speter 5838032Speter WARNING: writable directory /etc 5964562Sgshapiro WARNING: writable directory /var/spool/mqueue 6038032Speter 6138032Speterthen the directories listed have inappropriate write permissions and 6238032Spetershould be secured to avoid various possible security attacks. 6338032Speter 6438032SpeterBeginning with sendmail 8.9, these checks have become more strict to 6538032Speterprevent users from being able to access files they would normally not 6638032Speterbe able to read. In particular, .forward and :include: files in unsafe 6738032Speterdirectory paths (directory paths which are group or world writable) will 6838032Speterno longer be allowed. This would mean that if user joe's home directory 6938032Speterwas writable by group staff, sendmail would not use his .forward file. 7038032SpeterThis behavior can be altered, at the expense of system security, by 7138032Spetersetting the DontBlameSendmail option. For example, to allow .forward 7238032Speterfiles in group writable directories: 7338032Speter 7438032Speter O DontBlameSendmail=forwardfileingroupwritabledirpath 7538032Speter 7638032SpeterOr to allow them in both group and world writable directories: 7738032Speter 7838032Speter O DontBlameSendmail=forwardfileinunsafedirpath 7938032Speter 8038032SpeterItems from these unsafe .forward and :include: files will be marked 8138032Speteras unsafe addresses -- the items can not be deliveries to files or 8238032Speterprograms. This behavior can also be altered via DontBlameSendmail: 8338032Speter 8438032Speter O DontBlameSendmail=forwardfileinunsafedirpath, 8538032Speter forwardfileinunsafedirpathsafe 8638032Speter 8738032SpeterThe first flag allows the .forward file to be read, the second allows 8838032Speterthe items in the file to be marked as safe for file and program 8938032Speterdelivery. 9038032Speter 9138032SpeterOther files affected by this strengthened security include class 9264562Sgshapirofiles (i.e. Fw /etc/mail/local-host-names), persistent host status files, 9364562Sgshapiroand the files specified by the ErrorHeader and HelpFile options. Similar 9438032SpeterDontBlameSendmail flags are available for the class, ErrorHeader, and 9538032SpeterHelpFile files. 9638032Speter 9738032SpeterIf you have an unsafe configuration of .forward and :include: 9838032Speterfiles, you can make it safe by finding all such files, and doing 9938032Spetera "chmod go-w $FILE" on each. Also, do a "chmod go-w $DIR" for 10038032Spetereach directory in the file's path. 10138032Speter 10238032Speter 10338032Speter+-----------------------+ 10438032Speter| RELATED DOCUMENTATION | 10538032Speter+-----------------------+ 10638032Speter 10738032SpeterThere are other files you should read. Rooted in this directory are: 10838032Speter 10938032Speter FAQ 11038032Speter Answers to Frequently Asked Questions. 11164562Sgshapiro INSTALL 11264562Sgshapiro Installation instructions for building and installing sendmail. 11338032Speter KNOWNBUGS 11464562Sgshapiro Known bugs in the current release. 11538032Speter RELEASE_NOTES 11638032Speter A detailed description of the changes in each version. This 11738032Speter is quite long, but informative. 11864562Sgshapiro sendmail/README 11938032Speter Details on compiling and installing sendmail. 12038032Speter cf/README 12138032Speter Details on configuring sendmail. 12238032Speter doc/op/op.me 12338032Speter The sendmail Installation & Operations Guide. Be warned: if 12438032Speter you are running this off on SunOS or some other system with an 12538032Speter old version of -me, you need to add the following macro to the 12638032Speter macros: 12738032Speter 12838032Speter .de sm 12938032Speter \s-1\\$1\\s0\\$2 13038032Speter .. 13138032Speter 13238032Speter This sets a word in a smaller pointsize. 13338032Speter 13438032Speter 13538032Speter+--------------+ 13638032Speter| RELATED RFCS | 13738032Speter+--------------+ 13838032Speter 13938032SpeterThere are several related RFCs that you may wish to read -- they are 14064562Sgshapiroavailable via anonymous FTP to several sites. For a list of the 14164562Sgshapiroprimary repositories see: 14238032Speter 14338032Speter http://www.isi.edu/in-notes/rfc-retrieval.txt 14438032Speter 14538032SpeterThey are also online at: 14638032Speter 14738032Speter http://www.ietf.org/ 14838032Speter 14938032SpeterThey can also be retrieved via electronic mail by sending 15038032Speteremail to one of: 15138032Speter 15238032Speter mail-server@nisc.sri.com 15338032Speter Put "send rfcNNN" in message body 15438032Speter nis-info@nis.nsf.net 15538032Speter Put "send RFCnnn.TXT-1" in message body 15638032Speter sendrfc@jvnc.net 15738032Speter Put "RFCnnn" as Subject: line 15838032Speter 15938032SpeterFor further instructions see: 16038032Speter 16138032Speter http://www.isi.edu/in-notes/rfc-editor/rfc-info 16238032Speter 16338032SpeterImportant RFCs for electronic mail are: 16438032Speter 16538032Speter RFC821 SMTP protocol 16638032Speter RFC822 Mail header format 16738032Speter RFC974 MX routing 16838032Speter RFC976 UUCP mail format 16938032Speter RFC1123 Host requirements (modifies 821, 822, and 974) 17038032Speter RFC1413 Identification server 17138032Speter RFC1869 SMTP Service Extensions (ESMTP spec) 17238032Speter RFC1652 SMTP Service Extension for 8bit-MIMEtransport 17338032Speter RFC1870 SMTP Service Extension for Message Size Declaration 17438032Speter RFC2045 Multipurpose Internet Mail Extensions (MIME) Part One: 17538032Speter Format of Internet Message Bodies 17638032Speter RFC1344 Implications of MIME for Internet Mail Gateways 17738032Speter RFC1428 Transition of Internet Mail from Just-Send-8 to 17838032Speter 8-bit SMTP/MIME 17938032Speter RFC1891 SMTP Service Extension for Delivery Status Notifications 18038032Speter RFC1892 Multipart/Report Content Type for the Reporting of 18138032Speter Mail System Administrative Messages 18238032Speter RFC1893 Enhanced Mail System Status Codes 18338032Speter RFC1894 An Extensible Message Format for Delivery Status 18438032Speter Notifications 18538032Speter RFC1985 SMTP Service Extension for Remote Message Queue Starting 18664562Sgshapiro RFC2033 Local Mail Transfer Protocol (LMTP) 18764562Sgshapiro RFC2034 SMTP Service Extension for Returning Enhanced Error Codes 18864562Sgshapiro RFC2476 Message Submission 18964562Sgshapiro RFC2487 SMTP Service Extension for Secure SMTP over TLS 19064562Sgshapiro RFC2554 SMTP Service Extension for Authentication 19138032Speter 19238032SpeterOther standards that may be of interest (but which are less directly 19338032Speterrelevant to sendmail) are: 19438032Speter 19538032Speter RFC987 Mapping between RFC822 and X.400 19638032Speter RFC1049 Content-Type header field (extension to RFC822) 19738032Speter 19838032SpeterWarning to AIX users: this version of sendmail does not implement 19938032SpeterMB, MR, or MG DNS resource records, as defined (as experiments) in 20038032SpeterRFC1035. 20138032Speter 20238032Speter 20364562Sgshapiro+---------+ 20464562Sgshapiro| WARNING | 20564562Sgshapiro+---------+ 20664562Sgshapiro 20764562SgshapiroSince sendmail 8.11 and later includes hooks to cryptography, the 20864562Sgshapirofollowing information from OpenSSL applies to sendmail as well. 20964562Sgshapiro 21064562SgshapiroPLEASE REMEMBER THAT EXPORT/IMPORT AND/OR USE OF STRONG CRYPTOGRAPHY 21164562SgshapiroSOFTWARE, PROVIDING CRYPTOGRAPHY HOOKS OR EVEN JUST COMMUNICATING 21264562SgshapiroTECHNICAL DETAILS ABOUT CRYPTOGRAPHY SOFTWARE IS ILLEGAL IN SOME 21364562SgshapiroPARTS OF THE WORLD. SO, WHEN YOU IMPORT THIS PACKAGE TO YOUR 21464562SgshapiroCOUNTRY, RE-DISTRIBUTE IT FROM THERE OR EVEN JUST EMAIL TECHNICAL 21564562SgshapiroSUGGESTIONS OR EVEN SOURCE PATCHES TO THE AUTHOR OR OTHER PEOPLE 21664562SgshapiroYOU ARE STRONGLY ADVISED TO PAY CLOSE ATTENTION TO ANY EXPORT/IMPORT 21764562SgshapiroAND/OR USE LAWS WHICH APPLY TO YOU. THE AUTHORS ARE NOT LIABLE FOR 21864562SgshapiroANY VIOLATIONS YOU MAKE HERE. SO BE CAREFUL, IT IS YOUR RESPONSIBILITY. 21964562Sgshapiro 22064562SgshapiroIf you use OpenSSL then make sure you read their README file which 22164562Sgshapirocontains information about patents etc. 22264562Sgshapiro 22364562Sgshapiro 22438032Speter+-------------------+ 22538032Speter| DATABASE ROUTINES | 22638032Speter+-------------------+ 22738032Speter 22838032SpeterIF YOU WANT TO RUN THE NEW BERKELEY DB SOFTWARE: **** DO NOT **** 22938032Speteruse the version that was on the Net2 tape -- it has a number of 23038032Speternefarious bugs that were bad enough when I got them; you shouldn't have 23138032Speterto go through the same thing. Instead, get a new version via the web at 23238032Speterhttp://www.sleepycat.com/. This software is highly recommended; it gets 23338032Speterrid of several stupid limits, it's much faster, and the interface is 23438032Speternicer to animals and plants. If the Berkeley DB include files 23538032Speterare installed in a location other than those which your compiler searches, 23638032Speteryou will need to provide that directory when building: 23738032Speter 23838032Speter Build -I/path/to/include/directory 23938032Speter 24038032SpeterIf you are using Berkeley DB versions 1.85 or 1.86, you are *strongly* 24164562Sgshapirourged to upgrade to DB version 2 or later, available from 24264562Sgshapirohttp://www.sleepycat.com/. Berkeley DB versions 1.85 and 1.86 are known to 24364562Sgshapirobe broken in various nasty ways (see http://www.sleepycat.com/db.185.html), 24464562Sgshapiroand can cause sendmail to dump core. In addition, the newest versions of 24564562Sgshapirogcc and the Solaris compilers perform optimizations in those versions that 24664562Sgshapiromay cause fairly random core dumps. 24738032Speter 24838032SpeterIf you have no choice but to use Berkeley DB 1.85 or 1.86, and you are 24938032Speterusing both Berkeley DB and files in the UNIX ndbm format, remove ndbm.h 25038032Speterand ndbm.o from the DB library after building it. You should also apply 25138032Speterall of the patches for DB 1.85 and 1.86 found at the Sleepycat web site 25238032Speter(see http://www.sleepycat.com/db.185.html), as they fix some of the known 25338032Speterproblems. 25438032Speter 25538032SpeterIf you are using a version of Berkeley DB 2 previous to 2.3.15, and you 25638032Speterare using both Berkeley DB and files in the UNIX ndbm format, remove dbm.o 25738032Speterfrom the DB library after building it. No other changes are necessary. 25838032Speter 25938032SpeterIf you are using Berkeley DB version 2.3.15 or greater, no changes are 26038032Speternecessary. 26138032Speter 26238032SpeterThe underlying database file formats changed between Berkeley DB versions 26364562Sgshapiro1.85 and 1.86, again between DB 1.86 and version 2.0, and finally between 26464562SgshapiroDB 2.X and 3.X. If you are upgrading from one of those versions, you must 26564562Sgshapirorecreate your database file(s). Do this by rebuilding all maps with 26664562Sgshapiromakemap and rebuilding the alias file with newaliases. 26738032Speter 26838032Speter 26938032Speter+--------------------+ 27038032Speter| HOST NAME SERVICES | 27138032Speter+--------------------+ 27238032Speter 27338032SpeterIf you are using NIS or /etc/hosts, it is critical that you 27438032Speterlist the long (fully qualified) name somewhere (preferably first) in 27538032Speterthe /etc/hosts file used to build the NIS database. For example, the 27638032Speterline should read 27738032Speter 27838032Speter 128.32.149.68 mastodon.CS.Berkeley.EDU mastodon 27938032Speter 28038032Speter**** NOT **** 28138032Speter 28238032Speter 128.32.149.68 mastodon 28338032Speter 28438032SpeterIf you do not include the long name, sendmail will complain loudly 28538032Speterabout ``unable to qualify my own domain name (mastodon) -- using 28638032Spetershort name'' and conclude that your canonical name is the short 28738032Speterversion and use that in messages. The name "mastodon" doesn't mean 28838032Spetermuch outside of Berkeley, and so this creates incorrect and unreplyable 28938032Spetermessages. 29038032Speter 29138032Speter 29238032Speter+-------------+ 29338032Speter| USE WITH MH | 29438032Speter+-------------+ 29538032Speter 29638032SpeterThis version of sendmail notices and reports certain kinds of SMTP 29738032Speterprotocol violations that were ignored by older versions. If you 29838032Speterare running MH you may wish to install the patch in contrib/mh.patch 29938032Speterthat will prevent these warning reports. This patch also works 30038032Speterwith the old version of sendmail, so it's safe to go ahead and 30138032Speterinstall it. 30238032Speter 30338032Speter 30438032Speter+----------------+ 30538032Speter| USE WITH IDENT | 30638032Speter+----------------+ 30738032Speter 30838032SpeterSendmail 8 supports the IDENT protocol, as defined by RFC 1413. 30964562SgshapiroNote that the RFC states a client should wait at least 30 seconds 31064562Sgshapirofor a response. As of 8.10.0, the default Timeout.ident is 5 seconds 31164562Sgshapiroas many sites have adopted the practice of dropping IDENT queries. 31264562SgshapiroThis has lead to delays processing mail. 31338032Speter 31464562SgshapiroNo ident server is included with this distribution. It is available 31564562Sgshapirofrom: 31638032Speter 31764562Sgshapiro ftp://ftp.lysator.liu.se/pub/ident/servers/ 31864562Sgshapiro http://sf.www.lysator.liu.se/~pen/pidentd/ 31938032Speter 32043730Speter+-------------------------+ 32143730Speter| INTEROPERATION PROBLEMS | 32243730Speter+-------------------------+ 32343730Speter 32443730SpeterMicrosoft Exchange Server 5.0 32543730Speter We have had a report that ``about 7% of messages from Sendmail 32643730Speter to Exchange were not being delivered with status messages of 32743730Speter "connection reset" and "I/O error".'' Upgrading Exchange from 32843730Speter Version 5.0 to Version 5.5 Service Pack 2 solved this problem. 32943730Speter 33064562SgshapiroCommuniGate Pro 33164562Sgshapiro CommuniGate Pro 3.2.4 does not accept the AUTH= -parameter on 33264562Sgshapiro the MAIL FROM command if the client is not authenticated. Use 33343730Speter 33464562Sgshapiro define(`confAUTH_OPTIONS', `A') 33564562Sgshapiro 33664562Sgshapiro in .mc file if you have compiled sendmail with Cyrus SASL 33764562Sgshapiro and you communicate with CommuniGate Pro servers. 33864562Sgshapiro 33938032Speter+---------------------+ 34038032Speter| DIRECTORY STRUCTURE | 34138032Speter+---------------------+ 34238032Speter 34338032SpeterThe structure of this directory tree is: 34438032Speter 34538032Spetercf Source for sendmail configuration files. These are 34638032Speter different than what you've seen before. They are a 34738032Speter fairly dramatic rewrite, requiring the new sendmail 34838032Speter (since they use new features). 34938032Spetercontrib Some contributed tools to help with sendmail. THESE 35038032Speter ARE NOT SUPPORTED by sendmail -- contact the original 35138032Speter authors if you have problems. (This directory is not 35238032Speter on the 4.4BSD tape.) 35364562Sgshapirodevtools Build environment. See devtools/README. 35438032Speterdoc Documentation. If you are getting source, read 35538032Speter op.me -- it's long, but worth it. 35664562Sgshapiroinclude Include files used by multiple programs in the distribution. 35764562Sgshapirolibsmdb sendmail database library with support for Berkeley DB 1.X, 35864562Sgshapiro Berkeley DB 2.X, Berkeley DB 3.X, and NDBM. 35964562Sgshapirolibsmutil sendmail utility library with functions used by different 36064562Sgshapiro programs. 36138032Spetermail.local The source for the local delivery agent used for 4.4BSD. 36238032Speter THIS IS NOT PART OF SENDMAIL! and may not compile 36338032Speter everywhere, since it depends on some 4.4-isms. Warning: 36438032Speter it does mailbox locking differently than other systems. 36564562Sgshapiromailstats Statistics printing program. 36638032Spetermakemap A program that creates the keyed maps used by the $( ... $) 36738032Speter construct in sendmail. It is primitive but effective. 36838032Speter It takes a very simple input format, so you will probably 36938032Speter expect to preprocess must human-convenient formats 37038032Speter using sed scripts before this program will like them. 37138032Speter But it should be functionally complete. 37238032Speterpraliases A program to print the DBM or NEWDB version of the 37338032Speter aliases file. 37438032Speterrmail Source for rmail(8). This is used as a delivery 37538032Speter agent for for UUCP, and could presumably be used by 37638032Speter other non-socket oriented mailers. Older versions of 37738032Speter rmail are probably deficient. RMAIL IS NOT PART OF 37838032Speter SENDMAIL!!! The 4.4BSD source is included for you to 37964562Sgshapiro look at or try to port to your system. There is no 38064562Sgshapiro guarantee it will even compile on your operating system. 38138032Spetersmrsh The "sendmail restricted shell", which can be used as 38238032Speter a replacement for /bin/sh in the prog mailer to provide 38338032Speter increased security control. NOT PART OF SENDMAIL! 38464562Sgshapirosendmail Source for the sendmail program itself. 38538032Spetertest Some test scripts (currently only for compilation aids). 38664562Sgshapirovacation Source for the vacation program. NOT PART OF SENDMAIL! 38764562Sgshapiro 38864562Sgshapiro$Revision: 8.71.4.6 $, Last updated $Date: 2000/06/29 04:18:43 $ 389