Sendmail Question
Results 1 to 8 of 8

Thread: Sendmail Question

  1. #1
    Member
    Join Date
    Mar 2002
    Posts
    67

    Sendmail Question

    Since I have little or no knowledge of Unix (other than the names of various processes)...I am submitting this post to the Unix gurus.

    I'm trying to satisfy the auditing group with a basic explanation of why "sendmail" should not be listed as a "forbidden" process on all Unix boxes. The information I have found thus far points out that there are patches available that make sendmail more secure (in addition to disabling a couple of parameters). I have sent them information that the Unix boxes in the area I work in use sendmail as a way to communicate/forward mail with each other internally. SNMP community names also get flagged by audit (but that's another issue).

    I am looking for information (other than CIAC advisories) that describes how sendmail can be exploited and what actions are needed to resolve the vulnerability. Any input is greatly appreciated...

    Thanks.
    \"No matter where you go,
    there you are.\"

  2. #2
    Senior Member linuxcomando's Avatar
    Join Date
    Sep 2001
    Posts
    430
    The sad story is that sendmail should probley not be allowed and here is my reasons why, First sendmail is one "big" program it has lots of lines of code and 9/10ths of the time is running as root. Now you could but it in a chroot env, or jail but it is still not the best of choises. By far do i think it more secure than microsoft exchange but if you need smtp i would recomend qmail or postfix. But if you do run sendmail run in a chroot enviormet. If you run in the sandboxed env. it will be much more secure.
    I toor\'d YOU!

  3. #3
    Junior Member
    Join Date
    Aug 2002
    Posts
    14

    Other alternatives

    One of the main problems with Sendmail is that it is a single process, and at some point in time that process has to run as root to bind port 25. You might try another mail server like Postfix (I like a lot!) or QMail (not tried but heard good things about). They both overcome this by using multiple processes. Only one of which ever runs under the context of root (to bind port 25). OK, now I planted the bomb, stand back and watch the Sendmail Flame War! I know people will have differing opinions, and I dont dislike Sendmail (I personally admin 5 Sendmail servers, and 8 Postfix servers), but it's past is undeniable and it has had many problems. So there's my 2 cents...

    Cheers,
    m!thr!l

  4. #4
    Senior Member
    Join Date
    Apr 2002
    Posts
    634
    Sendmail is a very vulnerable service. There are different vulnerabilities in all the versions. So the only way to be more secure with it is to install all new versions and patchs.
    Life is boring. Play NetHack... --more--

  5. #5
    Member
    Join Date
    Mar 2002
    Posts
    67

    Sendmail

    But how easy would it be for someone to exploit sendmail and then run as root?

    The situation I'm facing is that auditing won't tell me why sendmail is forbidden, and the Unix admins tell me that all boxes are running the latest patched version. The funny part is that the patches are coming from the group that controls Unix loads, and they had input into writing the Unix security standard.

    I don't want to get dinged by others in AO for not knowing the pros/cons of sendmail or its alternatives...all I have to go on is what the auditors say and what the sysadmins say. All I want to do is protect the environment I am responsible for.
    \"No matter where you go,
    there you are.\"

  6. #6
    Senior Member problemchild's Avatar
    Join Date
    Jul 2002
    Posts
    551
    Boy, talk about a program with a checkered past. About the only thing more dangerous than sendmail is bind. If your concern is really about boxes you're responsible for, you need to drop sendmail.

    Why are you fighting so hard to keep a dangerous old dinosaur like sendmail, when there are newer and far more secure alternatives like postfix and qmail readily available? There has to be something more going on here.....
    Do what you want with the girl, but leave me alone!

  7. #7
    Jaded Network Admin nebulus200's Avatar
    Join Date
    Jun 2002
    Posts
    1,356
    There is something to remember about sendmail. It is NOT necessary to be running sendmail to send mail from your workstations, because you can still invoke sendmail and send it. It is only required to be receiving mail, and in that vain, the question you need to ask yourself is, how important/legitimate is it to have X number of machines that can directly receive mail? If you already have a mail server setup and the proper clients, it really isn't needed. And if you follow the security posture of turning off services that aren't needed, that leads you to the conclusion that sendmail should be disabled. It has frequently had problems with security, it leaves X number of potential holes open, and it leaves alot of worries about how well configured the sendmail is on each and everyone one of those workstations. A bad configuration could make your company the victim of spam relayers, and at a very minimum, the target for frequent scans of SMTP servers, looking for someone that is improperly configured. Or even worse, say someone configured their server to allow for pipes or something else that leads to a compromise of your systems.

    If you look at what you are risking versus what you are gaining, IMHO, sendmail should be disabled.

    Neb
    There is only one constant, one universal, it is the only real truth: causality. Action. Reaction. Cause and effect...There is no escape from it, we are forever slaves to it. Our only hope, our only peace is to understand it, to understand the 'why'. 'Why' is what separates us from them, you from me. 'Why' is the only real social power, without it you are powerless.

    (Merovingian - Matrix Reloaded)

  8. #8
    Member
    Join Date
    Mar 2002
    Posts
    67

    Sendmail

    I return to the office today...I will review the latest scans/reports to see what shows up. The Unix admins say they have disabled unneeded processes/services. Discard and snmpdx were two of them. Sendmail was the 3rd one flagged (and the one they're griping about).

    Thanks for all the discussion...
    \"No matter where you go,
    there you are.\"

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

 Security News

     Patches

       Security Trends

         How-To

           Buying Guides