Sendmail is a Mail Transport Agent (MTA) that uses the Simple
Mail Transport Protocol (SMTP) to deliver electronic messages
between other MTAs and to email clients or delivery agents.
Although many MTAs are capable of encrypting traffic between one
another, most do not, so sending email over any public networks is
considered an inherently insecure form of communication.
For more information about how email works and an overview of
common configuration settings, refer to the chapter titled
Email in the Red Hat
Enterprise Linux Reference Guide. This section assumes a basic
knowledge of how to generate a valid /etc/mail/sendmail.cf by editing the /etc/mail/sendmail.mc and running the m4 command as explained in the Red Hat Enterprise Linux Reference Guide.
It is recommended that anyone planning to implement a Sendmail
server address the following issues.
Because of the nature of email, a determined attacker can flood
the server with mail fairly easily and cause a denial of service.
By setting limits to the following directives in /etc/mail/sendmail.mc, the effectiveness of such
attacks are limited.
-
confCONNECTION_RATE_THROTTLE —
The number of connections the server can receive per second. By
default, Sendmail does not limit the number of connections. If a
limit is set and reached, further connections are delayed.
-
confMAX_DAEMON_CHILDREN — The
maximum number of child processes that can be spawned by the
server. By default, Sendmail does not assign a limit to the number
of child processes. If a limit is set and reached, further
connections are delayed.
-
confMIN_FREE_BLOCKS — The minimum
number of free blocks which must be available for the server to
accept mail. The default is 100 blocks.
-
confMAX_HEADERS_LENGTH — The
maximum acceptable size (in bytes) for a message header.
-
confMAX_MESSAGE_SIZE — The
maximum acceptable size (in bytes) for any one message.
Never put the mail spool directory, /var/spool/mail/, on an NFS shared volume.
Because NFSv2 and NFSv3 do not maintain control over user and
group IDs, two or more users can have the same UID, and receive and
read each other's mail. With NFSv4 using Kerberos, this is not the
case, since the SECRPC_GSS kernel module
does not utilize UID-based authentication.
To help prevent local user exploits on the Sendmail server, it
is best for mail users to only access the Sendmail server using an
email program. Shell accounts on the mail server should not be
allowed and all user shells in the /etc/passwd file should be set to /sbin/nologin (with the possible exception of the
root user).
