Configuring Sendmail: Overview

The easiest way to generate Sendmail configurations is to follow these steps: 1. Enable needed features and tweak settings in sendmail.mc. 2. Set up domain-name masquerading, if needed, in sendmail.mc. 3. Run m4 to generate sendmail.cf from sendmail.mc.

4. Configure delivery rules by editing mailertable. 5. Configure relaying rules by editing access.

6. Configure multiple-domain handling rules by editing virtusers. 7. Define local user-aliases in aliases.

8. Convert mailertable, access, virtusers, and aliases to databases.

9. Define all valid hostnames of the local system in the file local-host-names. 10. (Re-)start sendmail.

Once set up properly, sendmail.mc, mailertable, access, and virtusers won’t need to be changed very often, if at all. The most volatile configuration information on any email system is usually user information.

Therefore, on Sendmail systems, /etc/aliases is the file that will probably need the most ongoing maintenance.

7.4.5 Configuring sendmail.mc

The first task in setting up an SMTP server is generating /etc/sendmail.cf, for which I strongly suggest you use /etc/mail/sendmail.mc (on SuSE systems, /etc/mail/linux.mc). That’s the method I describe here.

Depending on which Linux distribution you use, a complete configuration reference for sendmail.mc can be found in /usr/lib/sendmail-cf/README.cf (Red Hat and its derivatives), /usr/share/sendmail/README (SuSE), or

/usr/share/doc/sendmail/cf.README.gz (Debian).

The "mc" in sendmail.mc is short for "macro configuration." sendmail.mc isn’t a complete macro itself; it consists mainly of parameters, or "directives" in Sendmail’s parlance, some of which are passed to macros, while others themselves expand to complete macros. There are several types of macro directive to be aware of, all of which appear in the truncated sendmail.mc listing in Example 7-1.

Example 7-1. Excerpt from an /etc/mail/sendmail.mc file divert(-1)

dnl This is a comment line

include(‘/usr/lib/sendmail-cf/m4/cf.m4’) VERSIONID(‘Mail server’)dnl OSTYPE(‘linux’) define(‘confDEF_USER_ID’,‘‘8:12’’)dnl define(‘confPRIVACY_FLAGS’, ‘authwarnings,needmailhelo,noexpn,novrfy’)dnl define(‘confSMTP_LOGIN_MSG’, ‘ Sendmail’)dnl define(‘confSAFE_FILE_ENV’, ‘/var/mailjail’)dnl define(‘confUNSAFE_GROUP_WRITES’)dnl undefine(‘UUCP_RELAY’)dnl

undefine(‘BITNET_RELAY’)dnl FEATURE(‘access_db’,‘hash -o /etc/mail/access.db’)dnl FEATURE(‘smrsh’,‘/usr/sbin/smrsh’)dnl FEATURE(‘dnsbl’)dnl FEATURE(‘blacklist_recipients’)dnl FEATURE(‘mailertable’,‘hash -o /etc/mail/mailertable.db’)dnl FEATURE(‘virtusertable’,‘hash -o /etc/mail/virtusertable.db’)dnl FEATURE(‘use_cw_file’)dnl FEATURE(‘masquerade_entire_domain’)dnl FEATURE(‘masquerade_envelope’)dnl FEATURE(‘nouucp’)dnl MASQUERADE_AS(‘hackenbush.com’)dnl MASQUERADE_DOMAIN(‘.hackenbush.com’)dnl EXPOSED_USER(‘root’)dnl MAILER(smtp)dnl MAILER(procmail)dnl Cwlocalhost.localdomain

The first important type of sendmail.mc entry is the comment. Comment lines begin with the string dnl, which is short for "delete through newline." Besides appearing at the beginning of each comment line, dnl can also be used at the end of "real" lines, which prevents unnecessary blank lines from being inserted into /etc/sendmail.cf. The second line in Example 7-1 is a comment line.

The next interesting type of sendmail.mc directive is m4 variable definitions, which always begin with the string define or undefine, followed by a variable name and, if applicable, a value to assign to it. The syntax for definitions should be obvious in Example 7-1. Note that the ‘’ marks enclosing variable names and values prevent them from being prematurely expanded by m4. Some variables are Boolean (true or false), but most people don’t bother specifying their values: if you cite a Boolean variable in a define directive but omit its value, it defaults to true; citing it in an undefine directive without a value causes it to default to false. Another important kind of directive is the FEATURE. These lines each begin with the string FEATURE, followed by one or more parameters enclosed in directed quotation marks (‘’).

Similar in syntax to FEATURE statements, MAILER directives are placed at or near the end of sendmail.mc and define which mailers are supported on the system. In Example 7-1, the second- and third-to-last lines tell Sendmail to support the exchange of mail with SMTP and procmail agents.

Finally, there are some directives that invoke and configure macros directly by name.

MASQUERADE_DOMAIN, MASQUERADE_AS, and EXPOSED_USER are a few such macros that are present in Example 7-1.

7.4.5.1 Some sendmail.mc m4 variable definitions

Let’s look at specific sendmail.mc directives that affect security, beginning with some definitions: define(‘confDEF_USER_ID’,‘‘ userid:groupid’)dnl

The confDEF_USER_ID definition tells Sendmail under which user ID and group ID it should run by default. If this variable isn’t defined, its values default to 1:1 (user = bin, group=bin), but I recommend changing it. Red Hat’s default of 8:12 (user=mail, group=mail) is more sensible. Sendmail is intelligent enough to run as root while listening on TCP port 25 (which is a privileged port) but to demote itself to whatever value is set in confDEF_USER_ID once mail arrives. Beforehand, you may need to add a user and group for Sendmail to use. If your system doesn’t already have a group named mail, use this command:

groupadd -g 12 mail

Similarly, if your system doesn’t have a user account named mail, use this command to create one: useradd -u 8 -g 12 -d /var/spool/mail -s /bin/false mail

define(‘confPRIVACY_FLAGS’, ‘ flag1,flag2,etc.’)dnl

As you can see, when we define the macro confPRIVACYFLAGS, we can specify a list of one or more flags that determine how Sendmail behaves in SMTP sessions. Table 7-1 shows some flags I recommend using on any publicly accessible Sendmail server.

Table 7-1. Useful privacy flags in Sendmail

Privacy flag Description

Goaway Sets all privacy flags except noreceipts, restrictmailq, restrictqrun, restrictexpand, and noetrn.

Noexpn Disables the EXPN and VERB commands. Novrfy Disables the VRFY command.

noreceipts Disables the returning of return and read receipts. restrictmailq

Allows only members of the group that owns /var/spool/mqueue to view Sendmail’s queue files via the mailq command. Note that if you set this flag, the permissions on /var/spool/mqueue may still be at 0700 without impairing mail-group members’ ability to run mailq.

restrictqrun

Allows only root or the owner of /var/spool/mqueue to process Sendmail’s queue (i.e., to tell Sendmail to attempt to send all messages currently in its queue, a là sendmail -q).

authwarnings Indicates discrepancies (e.g., sender claims her hostname is but her IP reverse-resolves to matahari.boldimposters.net) within the affected tubby.tubascoundrels.org, message's X-Authentication-Warning header.

needexpnhelo Indicates that SMTP clients needn't begin with _{the EXPN command at some point, in which case they must} HELO/EHLO_HELO unless they wish to use _{or EHLO first.} needvrfyhelo Indicates that SMTP clients needn't begin with _{the VRFY command at some point, in which case they must} HELO/EHLO_HELO unless they wish to use _{or EHLO first} define(‘confSMTP_LOGIN_MSG’, ‘ message’)dnl

This variable defines the banner string that sendmail sends to remote clients at the beginning of each SMTP session. By default, this string is set to $j Sendmail$v/$Z; $b, where $j expands to the local Fully Qualified Domain Name (FQDN), $v expands to the sendmail daemon's version, $Z expands to the version number of the m4 configuration, and $b expands to a time/date stamp.

In truth, none of this information needs to be provided. I personally prefer to set my Sendmail login message to a minimal ‘Sendmail’.

define(‘confSAFE_FILE_ENV’, ‘ /path/to/jail’)dnl

This definition tells Sendmail to set sendmail.cf's SafeFileEnvironment variable to which some subdirectory of / that sendmail will chroot when writing files. For more information, see Section