SECURITY revision 90792 
1# Copyright (c) 2000-2001 Sendmail, Inc. and its suppliers.
2#	All rights reserved.
3#
4# By using this file, you agree to the terms and conditions set
5# forth in the LICENSE file which can be found at the top level of
6# the sendmail distribution.
7#
8#	$Id: SECURITY,v 1.47 2001/09/23 02:29:05 ca Exp $
9#
10
11This file gives some hints how to configure and run sendmail for
12people who are very security conscious (you should be...).
13
14Even though sendmail goes through great lengths to assure that it
15can't be compromised even if the system it is running on is
16incorrectly or insecurely configured, it can't work around everything.
17This has been demonstrated by recent OS problems which have
18subsequently been used to compromise the root account using sendmail
19as a vector.  One way to minimize the possibility of such problems
20is to install sendmail without set-user-ID root, which avoids local
21exploits.  This configuration, which is the default starting with
228.12, is described in the first section of this security guide.
23
24
25*****************************************************
26** sendmail configuration without set-user-ID root **
27*****************************************************
28
29sendmail needs to run as root for several purposes:
30
31- bind to port 25
32- call the local delivery agent (LDA) as root (or other user) if the LDA
33  isn't set-user-ID root (unless some other method of storing e-mail in
34  local mailboxes is used).
35- read .forward files
36- write e-mail submitted via the command line to the queue directory.
37
38Only the last item requires a set-user-ID/set-group-ID program to
39avoid problems with a world-writable directory.  It is however
40sufficient to have a set-group-ID program and a group-writable
41queue directory.  The other requirements listed above can be
42fulfilled by a sendmail daemon that is started by root.  Hence this
43section explains how to use two sendmail configurations to accomplish
44the goal to have a sendmail binary that is not set-user-ID root,
45and hence is not open to system configuration/OS problems or at
46least less problematic in presence of those.
47
48The default configuration starting with sendmail 8.12 uses one
49sendmail binary which acts differently based on operation mode and
50supplied options.
51
52sendmail must be a set-group-ID (default group: smmsp, recommended
53gid: 25) program to allow for queueing mail in a group-writable
54directory.  Two .cf files are required:  sendmail.cf for the daemon
55and submit.cf for the submission program.  The following permissions
56should be used:
57
58-r-xr-sr-x	root   smmsp	... /PATH/TO/sendmail
59drwxrwx---	smmsp  smmsp	... /var/spool/clientmqueue
60drwx------	root   wheel	... /var/spool/mqueue
61-r--r--r--	root   wheel	... /etc/mail/sendmail.cf
62-r--r--r--	root   wheel	... /etc/mail/submit.cf
63
64That is, the owner of sendmail is root, the group is smmsp, and
65the binary is set-group-ID.  The client mail queue is owned by
66smmsp with group smmsp and is group writable.  The client mail
67queue directory must be writable by smmsp, but it must not be
68accessible for others. That is, do not use world read or execute
69permissions.  In submit.cf the option UseMSP must be set, and
70QueueFileMode must be set to 0660.  submit.cf is available in
71cf/cf/, which has been built from cf/cf/submit.mc.  The file can
72be used as-is, if you want to add more options, use cf/cf/submit.mc
73as starting point and read cf/README:  MESSAGE SUBMISSION PROGRAM
74carefully.
75
76The .cf file is chosen based on the operation mode.  For -bm (default),
77-bs, and -t it is submit.cf (if it exists) for all others it is
78sendmail.cf.  This selection can be changed by -Ac or -Am (alternative
79.cf file: client or mta).
80
81The daemon must be started by root as usual, e.g.,
82
83/PATH/TO/sendmail -L sm-mta -bd -q1h
84
85(replace /PATH/TO with the right path for your OS, e.g.,
86/usr/sbin or /usr/lib).
87
88Notice: if you run sendmail from inetd (which in general is not a
89good idea), you must specify -Am in addition to -bs.
90
91Mail will end up in the client queue if the daemon doesn't accept
92connections or if an address is temporarily not resolvable.  The
93latter problem can be minimized by using
94
95	FEATURE(`nocanonify', `canonify_hosts')
96	define(`confDIRECT_SUBMISSION_MODIFIERS', `C')
97
98which, however, may have undesired side effects.  See cf/README for
99a discussion.  In general it is necessary to clean the queue either
100via a cronjob or by running a daemon, e.g.,
101
102/PATH/TO/sendmail -L sm-msp-queue -Ac -q30m
103
104If the option UseMSP is not set, sendmail will complain during
105queue runs about bogus file permission.  If you want a queue runner
106for the client queue, you probably have to change OS specific
107scripts to accomplish this (check the man pages of your OS for more
108information.)  You can start this program as root, it will change
109its user id to RunAsUser (smmsp by default, recommended uid: 25).
110This way smmsp does not need a valid shell.
111
112Summary
113-------
114
115This is a brief summary how the two configuration files are used:
116
117sendmail.cf	For the MTA (mail transmission agent)
118	The MTA is started by root as daemon:
119
120		/PATH/TO/sendmail -L sm-mta -bd -q1h
121
122	it accepts SMTP connections (on ports 25 and 587 by default);
123	it runs the main queue (/var/spool/mqueue by default).
124
125submit.cf	For the MSP (mail submission program)
126	The MSP is used to submit e-mails, hence it is invoked
127	by programs (and maybe users); it does not run as SMTP
128	daemon; it uses /var/spool/clientmqueue by default; it
129	can be started to run that queue periodically:
130
131		/PATH/TO/sendmail -L sm-msp-queue -Ac -q30m
132
133
134Hints and Troubleshooting
135-------------------------
136
137RunAsUser: FEATURE(`msp') sets the option RunAsUser to smmsp.
138This user must have the group smmsp, i.e., the same group as the
139clientmqueue directory.  If you specify a user whose primary group
140is not the same as that of the clientmqueue directory, then you
141should explicitly set the group, e.g.,
142
143	FEATURE(`msp')
144	define(`confRUN_AS_USER', `mailmsp:smmsp')
145
146STARTTLS: If sendmail is compiled with STARTTLS support on a platform
147that does not have HASURANDOMDEV defined, you either need to specify
148the RandFile option (as for the MTA), or you have to turn off
149STARTTLS in the MSP, e.g.,
150
151	DAEMON_OPTIONS(`Name=NoMTA, Addr=127.0.0.1, M=S')
152	FEATURE(`msp')
153	CLIENT_OPTIONS(`Family=inet, Address=0.0.0.0, M=S')
154
155The first option is used to turn off STARTTLS when the MSP is
156invoked with -bs as some MUAs do.
157
158
159What doesn't work anymore
160-------------------------
161
162Normal users can't use mailq anymore to see the MTA mail queue.
163There are several ways around it, e.g., changing QueueFileMode
164or giving users access via a program like sudo.
165
166sendmail -bv may give misleading output for normal users since it
167may not be able to access certain files, e.g., .forward files of
168other users.
169
170
171Alternative
172-----------
173
174Instead of having one set-group-ID binary, it is possible to use
175two with different permissions: one for message submission
176(set-group-ID), one acting as daemon etc, which is only executable
177by root.  In that case it is possible to remove features from
178the message submission program to have a smaller binary.
179You can use
180
181	sh ./Build install-sm-mta
182
183to install a sendmail program to act as daemon etc under the name
184sm-mta.
185
186Set-User-Id
187-----------
188
189If you really have to install sendmail set-user-ID root, you can use
190
191	sh ./Build install-set-user-id
192
193