README revision 90792
138032Speter 238032Speter SENDMAIL RELEASE 8 338032Speter 438032SpeterThis directory has the latest sendmail(TM) software from Sendmail, Inc. 538032Speter 638032SpeterReport any bugs to sendmail-bugs@sendmail.ORG 738032Speter 864562SgshapiroThere is a web site at http://WWW.Sendmail.ORG/ -- see that site for 938032Speterthe latest updates. 1038032Speter 1164562Sgshapiro+--------------+ 1264562Sgshapiro| INTRODUCTION | 1364562Sgshapiro+--------------+ 1438032Speter 1564562Sgshapiro0. The vast majority of queries to <sendmail-questions@sendmail.org> 1664562Sgshapiro are answered in the README files noted below. 1764562Sgshapiro 1864562Sgshapiro1. Read this README file, especially this introduction, and the DIRECTORY 1964562Sgshapiro PERMISSIONS sections. 2064562Sgshapiro 2180785Sgshapiro2. Read the INSTALL file in this directory. 2280785Sgshapiro 2380785Sgshapiro3. Read sendmail/README, especially: 2464562Sgshapiro a. the introduction 2564562Sgshapiro b. the BUILDING SENDMAIL section 2664562Sgshapiro c. the relevant part(s) of the OPERATING SYSTEM AND COMPILE QUIRKS section 2764562Sgshapiro 2864562Sgshapiro You may also find these useful: 2964562Sgshapiro 3090792Sgshapiro d. sendmail/SECURITY 3190792Sgshapiro e. devtools/README 3290792Sgshapiro f. devtools/Site/README 3390792Sgshapiro g. libmilter/README 3490792Sgshapiro h. mail.local/README 3590792Sgshapiro i. smrsh/README 3664562Sgshapiro 3780785Sgshapiro4. Read cf/README. 3864562Sgshapiro 3938032SpeterSendmail is a trademark of Sendmail, Inc. 4038032Speter 4138032Speter+-----------------------+ 4238032Speter| DIRECTORY PERMISSIONS | 4338032Speter+-----------------------+ 4438032Speter 4538032SpeterSendmail often gets blamed for many problems that are actually the 4638032Speterresult of other problems, such as overly permissive modes on directories. 4738032SpeterFor this reason, sendmail checks the modes on system directories and 4864562Sgshapirofiles to determine if they can be trusted. For sendmail to run without 4964562Sgshapirocomplaining, you MUST execute the following command: 5038032Speter 5138032Speter chmod go-w / /etc /etc/mail /usr /var /var/spool /var/spool/mqueue 5238032Speter chown root / /etc /etc/mail /usr /var /var/spool /var/spool/mqueue 5338032Speter 5438032SpeterYou will probably have to tweak this for your environment (for example, 5538032Spetersome systems put the spool directory into /usr/spool instead of 5664562Sgshapiro/var/spool). If you set the RunAsUser option in your sendmail.cf, the 5764562Sgshapiro/var/spool/mqueue directory will have to be owned by the RunAsUser user. 5864562SgshapiroAs a general rule, after you have compiled sendmail, run the command 5938032Speter 6038032Speter sendmail -v -bi 6138032Speter 6238032Speterto initialize the alias database. If it gives messages such as 6338032Speter 6438032Speter WARNING: writable directory /etc 6564562Sgshapiro WARNING: writable directory /var/spool/mqueue 6638032Speter 6738032Speterthen the directories listed have inappropriate write permissions and 6838032Spetershould be secured to avoid various possible security attacks. 6938032Speter 7038032SpeterBeginning with sendmail 8.9, these checks have become more strict to 7138032Speterprevent users from being able to access files they would normally not 7238032Speterbe able to read. In particular, .forward and :include: files in unsafe 7338032Speterdirectory paths (directory paths which are group or world writable) will 7438032Speterno longer be allowed. This would mean that if user joe's home directory 7538032Speterwas writable by group staff, sendmail would not use his .forward file. 7638032SpeterThis behavior can be altered, at the expense of system security, by 7738032Spetersetting the DontBlameSendmail option. For example, to allow .forward 7838032Speterfiles in group writable directories: 7938032Speter 8038032Speter O DontBlameSendmail=forwardfileingroupwritabledirpath 8138032Speter 8238032SpeterOr to allow them in both group and world writable directories: 8338032Speter 8438032Speter O DontBlameSendmail=forwardfileinunsafedirpath 8538032Speter 8638032SpeterItems from these unsafe .forward and :include: files will be marked 8738032Speteras unsafe addresses -- the items can not be deliveries to files or 8838032Speterprograms. This behavior can also be altered via DontBlameSendmail: 8938032Speter 9038032Speter O DontBlameSendmail=forwardfileinunsafedirpath, 9138032Speter forwardfileinunsafedirpathsafe 9238032Speter 9338032SpeterThe first flag allows the .forward file to be read, the second allows 9438032Speterthe items in the file to be marked as safe for file and program 9538032Speterdelivery. 9638032Speter 9738032SpeterOther files affected by this strengthened security include class 9890792Sgshapirofiles (i.e., Fw /etc/mail/local-host-names), persistent host status files, 9964562Sgshapiroand the files specified by the ErrorHeader and HelpFile options. Similar 10038032SpeterDontBlameSendmail flags are available for the class, ErrorHeader, and 10138032SpeterHelpFile files. 10238032Speter 10338032SpeterIf you have an unsafe configuration of .forward and :include: 10438032Speterfiles, you can make it safe by finding all such files, and doing 10538032Spetera "chmod go-w $FILE" on each. Also, do a "chmod go-w $DIR" for 10638032Spetereach directory in the file's path. 10738032Speter 10838032Speter 10938032Speter+-----------------------+ 11038032Speter| RELATED DOCUMENTATION | 11138032Speter+-----------------------+ 11238032Speter 11338032SpeterThere are other files you should read. Rooted in this directory are: 11438032Speter 11538032Speter FAQ 11680785Sgshapiro The FAQ (frequently answered questions) is no longer maintained 11780785Sgshapiro with the sendmail release. It is available at 11880785Sgshapiro http://www.sendmail.org/faq/ . The file FAQ is a reminder of 11980785Sgshapiro this and a pointer to the web page. 12064562Sgshapiro INSTALL 12164562Sgshapiro Installation instructions for building and installing sendmail. 12238032Speter KNOWNBUGS 12364562Sgshapiro Known bugs in the current release. 12438032Speter RELEASE_NOTES 12538032Speter A detailed description of the changes in each version. This 12638032Speter is quite long, but informative. 12764562Sgshapiro sendmail/README 12838032Speter Details on compiling and installing sendmail. 12938032Speter cf/README 13038032Speter Details on configuring sendmail. 13138032Speter doc/op/op.me 13238032Speter The sendmail Installation & Operations Guide. Be warned: if 13338032Speter you are running this off on SunOS or some other system with an 13438032Speter old version of -me, you need to add the following macro to the 13538032Speter macros: 13638032Speter 13738032Speter .de sm 13838032Speter \s-1\\$1\\s0\\$2 13938032Speter .. 14038032Speter 14138032Speter This sets a word in a smaller pointsize. 14238032Speter 14338032Speter 14438032Speter+--------------+ 14538032Speter| RELATED RFCS | 14638032Speter+--------------+ 14738032Speter 14838032SpeterThere are several related RFCs that you may wish to read -- they are 14964562Sgshapiroavailable via anonymous FTP to several sites. For a list of the 15064562Sgshapiroprimary repositories see: 15138032Speter 15238032Speter http://www.isi.edu/in-notes/rfc-retrieval.txt 15338032Speter 15438032SpeterThey are also online at: 15538032Speter 15638032Speter http://www.ietf.org/ 15738032Speter 15838032SpeterThey can also be retrieved via electronic mail by sending 15938032Speteremail to one of: 16038032Speter 16138032Speter mail-server@nisc.sri.com 16238032Speter Put "send rfcNNN" in message body 16338032Speter nis-info@nis.nsf.net 16438032Speter Put "send RFCnnn.TXT-1" in message body 16538032Speter sendrfc@jvnc.net 16638032Speter Put "RFCnnn" as Subject: line 16738032Speter 16838032SpeterFor further instructions see: 16938032Speter 17038032Speter http://www.isi.edu/in-notes/rfc-editor/rfc-info 17138032Speter 17238032SpeterImportant RFCs for electronic mail are: 17338032Speter 17438032Speter RFC821 SMTP protocol 17538032Speter RFC822 Mail header format 17638032Speter RFC974 MX routing 17738032Speter RFC976 UUCP mail format 17838032Speter RFC1123 Host requirements (modifies 821, 822, and 974) 17990792Sgshapiro RFC1344 Implications of MIME for Internet Mail Gateways 18038032Speter RFC1413 Identification server 18190792Sgshapiro RFC1428 Transition of Internet Mail from Just-Send-8 to 18290792Sgshapiro 8-bit SMTP/MIME 18390792Sgshapiro RFC1652 SMTP Service Extension for 8bit-MIMEtransport 18438032Speter RFC1869 SMTP Service Extensions (ESMTP spec) 18538032Speter RFC1870 SMTP Service Extension for Message Size Declaration 18638032Speter RFC1891 SMTP Service Extension for Delivery Status Notifications 18738032Speter RFC1892 Multipart/Report Content Type for the Reporting of 18838032Speter Mail System Administrative Messages 18938032Speter RFC1893 Enhanced Mail System Status Codes 19038032Speter RFC1894 An Extensible Message Format for Delivery Status 19138032Speter Notifications 19238032Speter RFC1985 SMTP Service Extension for Remote Message Queue Starting 19364562Sgshapiro RFC2033 Local Mail Transfer Protocol (LMTP) 19464562Sgshapiro RFC2034 SMTP Service Extension for Returning Enhanced Error Codes 19590792Sgshapiro RFC2045 Multipurpose Internet Mail Extensions (MIME) Part One: 19690792Sgshapiro Format of Internet Message Bodies 19764562Sgshapiro RFC2476 Message Submission 19864562Sgshapiro RFC2487 SMTP Service Extension for Secure SMTP over TLS 19964562Sgshapiro RFC2554 SMTP Service Extension for Authentication 20090792Sgshapiro RFC2821 Simple Mail Transfer Protocol 20190792Sgshapiro RFC2822 Internet Message Format 20290792Sgshapiro RFC2852 Deliver By SMTP Service Extension 20390792Sgshapiro RFC2920 SMTP Service Extension for Command Pipelining 20438032Speter 20538032SpeterOther standards that may be of interest (but which are less directly 20638032Speterrelevant to sendmail) are: 20738032Speter 20838032Speter RFC987 Mapping between RFC822 and X.400 20938032Speter RFC1049 Content-Type header field (extension to RFC822) 21038032Speter 21138032SpeterWarning to AIX users: this version of sendmail does not implement 21238032SpeterMB, MR, or MG DNS resource records, as defined (as experiments) in 21338032SpeterRFC1035. 21438032Speter 21538032Speter 21664562Sgshapiro+---------+ 21764562Sgshapiro| WARNING | 21864562Sgshapiro+---------+ 21964562Sgshapiro 22064562SgshapiroSince sendmail 8.11 and later includes hooks to cryptography, the 22164562Sgshapirofollowing information from OpenSSL applies to sendmail as well. 22264562Sgshapiro 22364562SgshapiroPLEASE REMEMBER THAT EXPORT/IMPORT AND/OR USE OF STRONG CRYPTOGRAPHY 22464562SgshapiroSOFTWARE, PROVIDING CRYPTOGRAPHY HOOKS OR EVEN JUST COMMUNICATING 22564562SgshapiroTECHNICAL DETAILS ABOUT CRYPTOGRAPHY SOFTWARE IS ILLEGAL IN SOME 22664562SgshapiroPARTS OF THE WORLD. SO, WHEN YOU IMPORT THIS PACKAGE TO YOUR 22764562SgshapiroCOUNTRY, RE-DISTRIBUTE IT FROM THERE OR EVEN JUST EMAIL TECHNICAL 22864562SgshapiroSUGGESTIONS OR EVEN SOURCE PATCHES TO THE AUTHOR OR OTHER PEOPLE 22964562SgshapiroYOU ARE STRONGLY ADVISED TO PAY CLOSE ATTENTION TO ANY EXPORT/IMPORT 23090792SgshapiroAND/OR USE LAWS WHICH APPLY TO YOU. THE AUTHORS ARE NOT LIABLE FOR 23190792SgshapiroANY VIOLATIONS YOU MAKE HERE. SO BE CAREFUL, IT IS YOUR RESPONSIBILITY. 23264562Sgshapiro 23364562SgshapiroIf you use OpenSSL then make sure you read their README file which 23464562Sgshapirocontains information about patents etc. 23564562Sgshapiro 23664562Sgshapiro 23738032Speter+-------------------+ 23838032Speter| DATABASE ROUTINES | 23938032Speter+-------------------+ 24038032Speter 24138032SpeterIF YOU WANT TO RUN THE NEW BERKELEY DB SOFTWARE: **** DO NOT **** 24238032Speteruse the version that was on the Net2 tape -- it has a number of 24338032Speternefarious bugs that were bad enough when I got them; you shouldn't have 24438032Speterto go through the same thing. Instead, get a new version via the web at 24538032Speterhttp://www.sleepycat.com/. This software is highly recommended; it gets 24638032Speterrid of several stupid limits, it's much faster, and the interface is 24738032Speternicer to animals and plants. If the Berkeley DB include files 24838032Speterare installed in a location other than those which your compiler searches, 24938032Speteryou will need to provide that directory when building: 25038032Speter 25138032Speter Build -I/path/to/include/directory 25238032Speter 25338032SpeterIf you are using Berkeley DB versions 1.85 or 1.86, you are *strongly* 25464562Sgshapirourged to upgrade to DB version 2 or later, available from 25564562Sgshapirohttp://www.sleepycat.com/. Berkeley DB versions 1.85 and 1.86 are known to 25664562Sgshapirobe broken in various nasty ways (see http://www.sleepycat.com/db.185.html), 25764562Sgshapiroand can cause sendmail to dump core. In addition, the newest versions of 25864562Sgshapirogcc and the Solaris compilers perform optimizations in those versions that 25964562Sgshapiromay cause fairly random core dumps. 26038032Speter 26138032SpeterIf you have no choice but to use Berkeley DB 1.85 or 1.86, and you are 26238032Speterusing both Berkeley DB and files in the UNIX ndbm format, remove ndbm.h 26338032Speterand ndbm.o from the DB library after building it. You should also apply 26438032Speterall of the patches for DB 1.85 and 1.86 found at the Sleepycat web site 26538032Speter(see http://www.sleepycat.com/db.185.html), as they fix some of the known 26638032Speterproblems. 26738032Speter 26838032SpeterIf you are using a version of Berkeley DB 2 previous to 2.3.15, and you 26938032Speterare using both Berkeley DB and files in the UNIX ndbm format, remove dbm.o 27038032Speterfrom the DB library after building it. No other changes are necessary. 27138032Speter 27238032SpeterIf you are using Berkeley DB version 2.3.15 or greater, no changes are 27338032Speternecessary. 27438032Speter 27538032SpeterThe underlying database file formats changed between Berkeley DB versions 27664562Sgshapiro1.85 and 1.86, again between DB 1.86 and version 2.0, and finally between 27764562SgshapiroDB 2.X and 3.X. If you are upgrading from one of those versions, you must 27864562Sgshapirorecreate your database file(s). Do this by rebuilding all maps with 27964562Sgshapiromakemap and rebuilding the alias file with newaliases. 28038032Speter 28138032Speter 28238032Speter+--------------------+ 28338032Speter| HOST NAME SERVICES | 28438032Speter+--------------------+ 28538032Speter 28638032SpeterIf you are using NIS or /etc/hosts, it is critical that you 28738032Speterlist the long (fully qualified) name somewhere (preferably first) in 28838032Speterthe /etc/hosts file used to build the NIS database. For example, the 28938032Speterline should read 29038032Speter 29138032Speter 128.32.149.68 mastodon.CS.Berkeley.EDU mastodon 29238032Speter 29338032Speter**** NOT **** 29438032Speter 29538032Speter 128.32.149.68 mastodon 29638032Speter 29738032SpeterIf you do not include the long name, sendmail will complain loudly 29838032Speterabout ``unable to qualify my own domain name (mastodon) -- using 29938032Spetershort name'' and conclude that your canonical name is the short 30038032Speterversion and use that in messages. The name "mastodon" doesn't mean 30138032Spetermuch outside of Berkeley, and so this creates incorrect and unreplyable 30238032Spetermessages. 30338032Speter 30438032Speter 30538032Speter+-------------+ 30638032Speter| USE WITH MH | 30738032Speter+-------------+ 30838032Speter 30938032SpeterThis version of sendmail notices and reports certain kinds of SMTP 31038032Speterprotocol violations that were ignored by older versions. If you 31138032Speterare running MH you may wish to install the patch in contrib/mh.patch 31238032Speterthat will prevent these warning reports. This patch also works 31338032Speterwith the old version of sendmail, so it's safe to go ahead and 31438032Speterinstall it. 31538032Speter 31638032Speter 31738032Speter+----------------+ 31838032Speter| USE WITH IDENT | 31938032Speter+----------------+ 32038032Speter 32138032SpeterSendmail 8 supports the IDENT protocol, as defined by RFC 1413. 32264562SgshapiroNote that the RFC states a client should wait at least 30 seconds 32364562Sgshapirofor a response. As of 8.10.0, the default Timeout.ident is 5 seconds 32464562Sgshapiroas many sites have adopted the practice of dropping IDENT queries. 32564562SgshapiroThis has lead to delays processing mail. 32638032Speter 32764562SgshapiroNo ident server is included with this distribution. It is available 32864562Sgshapirofrom: 32938032Speter 33064562Sgshapiro ftp://ftp.lysator.liu.se/pub/ident/servers/ 33164562Sgshapiro http://sf.www.lysator.liu.se/~pen/pidentd/ 33238032Speter 33343730Speter+-------------------------+ 33443730Speter| INTEROPERATION PROBLEMS | 33543730Speter+-------------------------+ 33643730Speter 33743730SpeterMicrosoft Exchange Server 5.0 33843730Speter We have had a report that ``about 7% of messages from Sendmail 33943730Speter to Exchange were not being delivered with status messages of 34043730Speter "connection reset" and "I/O error".'' Upgrading Exchange from 34143730Speter Version 5.0 to Version 5.5 Service Pack 2 solved this problem. 34243730Speter 34364562SgshapiroCommuniGate Pro 34464562Sgshapiro CommuniGate Pro 3.2.4 does not accept the AUTH= -parameter on 34564562Sgshapiro the MAIL FROM command if the client is not authenticated. Use 34643730Speter 34764562Sgshapiro define(`confAUTH_OPTIONS', `A') 34864562Sgshapiro 34964562Sgshapiro in .mc file if you have compiled sendmail with Cyrus SASL 35064562Sgshapiro and you communicate with CommuniGate Pro servers. 35164562Sgshapiro 35238032Speter+---------------------+ 35338032Speter| DIRECTORY STRUCTURE | 35438032Speter+---------------------+ 35538032Speter 35638032SpeterThe structure of this directory tree is: 35738032Speter 35838032Spetercf Source for sendmail configuration files. These are 35938032Speter different than what you've seen before. They are a 36038032Speter fairly dramatic rewrite, requiring the new sendmail 36138032Speter (since they use new features). 36238032Spetercontrib Some contributed tools to help with sendmail. THESE 36338032Speter ARE NOT SUPPORTED by sendmail -- contact the original 36438032Speter authors if you have problems. (This directory is not 36538032Speter on the 4.4BSD tape.) 36664562Sgshapirodevtools Build environment. See devtools/README. 36738032Speterdoc Documentation. If you are getting source, read 36838032Speter op.me -- it's long, but worth it. 36990792Sgshapiroeditmap A program to edit and query maps that have been created 37090792Sgshapiro with makemap, e.g., adding and deleting entries. 37164562Sgshapiroinclude Include files used by multiple programs in the distribution. 37264562Sgshapirolibsmdb sendmail database library with support for Berkeley DB 1.X, 37364562Sgshapiro Berkeley DB 2.X, Berkeley DB 3.X, and NDBM. 37464562Sgshapirolibsmutil sendmail utility library with functions used by different 37564562Sgshapiro programs. 37638032Spetermail.local The source for the local delivery agent used for 4.4BSD. 37738032Speter THIS IS NOT PART OF SENDMAIL! and may not compile 37838032Speter everywhere, since it depends on some 4.4-isms. Warning: 37938032Speter it does mailbox locking differently than other systems. 38064562Sgshapiromailstats Statistics printing program. 38138032Spetermakemap A program that creates the keyed maps used by the $( ... $) 38238032Speter construct in sendmail. It is primitive but effective. 38338032Speter It takes a very simple input format, so you will probably 38438032Speter expect to preprocess must human-convenient formats 38538032Speter using sed scripts before this program will like them. 38638032Speter But it should be functionally complete. 38738032Speterpraliases A program to print the DBM or NEWDB version of the 38838032Speter aliases file. 38938032Speterrmail Source for rmail(8). This is used as a delivery 39038032Speter agent for for UUCP, and could presumably be used by 39138032Speter other non-socket oriented mailers. Older versions of 39238032Speter rmail are probably deficient. RMAIL IS NOT PART OF 39338032Speter SENDMAIL!!! The 4.4BSD source is included for you to 39464562Sgshapiro look at or try to port to your system. There is no 39564562Sgshapiro guarantee it will even compile on your operating system. 39638032Spetersmrsh The "sendmail restricted shell", which can be used as 39738032Speter a replacement for /bin/sh in the prog mailer to provide 39838032Speter increased security control. NOT PART OF SENDMAIL! 39964562Sgshapirosendmail Source for the sendmail program itself. 40038032Spetertest Some test scripts (currently only for compilation aids). 40164562Sgshapirovacation Source for the vacation program. NOT PART OF SENDMAIL! 40264562Sgshapiro 40390792Sgshapiro$Revision: 8.81 $, Last updated $Date: 2001/09/26 16:22:19 $ 404