How to use only submit.cf on a sendmail SMTP client

[Robert Harker]

At most sites the most common use of sendmail is to act as a
message submission agent on all of the various Linux and Unix
servers on the network. These servers are only SMTP clients.
They do not accept incoming mail and they do no local delivery
of mail. The only mail they deal with is locally generated mail
from various administrative accounts, root, operator, oracle,
web, etc..., and all of this local mail is always forwarded to
a SMTP relay.

Assuming that you really want sendmail to only act as an SMTP client,
then what I recommend in my "Managing Internet Mail" class is to
only use the submit.cf file (from the submit.mc file) Since the host
would not be receiving any inbound mail, there would be no reason
to run the SMTP server (sendmail -bd) and since the SMTP server
is not running there would be no reason to use /var/spool/mqueue,
hence no reason to run the root owned queue daemon. What is nice
about this about this configuration is that there is no sendmail
running on the system as root. Sendmail is completely blocked as
an attack vector. It can't be used for a remote exploit since it
is not listening to any port, not even localhost. It can't be used
as a local exploit because it never runs as root.

To configure a sendmail SMTP client, you modify the submit.cf
file to forward the mail to the remote/central SMTP server,
smtprelay.your.dom, rather than trying to use the local SMTP server
listening to the loopback interface. You do this by changing the
"msp" (message submission program) feature:

From: FEATURE(`msp', `[127.0.0.1]')
To: FEATURE(`msp', `smtprelay.your.dom')

The "msp" feature only applies to mail addressed to the host itself,
an unqualified "user" or "***@thishost.dom". For non-local mail
you would still need to set the SMART_HOST relay in your
sendmail.mc file:

define(`SMART_HOST',`smtprelay.your.dom')

I also assume you would like local mail addresses generated
on this host to be masqueraded as the domain "***@your.dom".
So use masquerading:

MASQUERADE_AS(`your.dom')
FEATURE(`allmasquerade')
FEATURE(`masquerade_envelope')

and to make sure all addresses leave with a domain name
(just in case):

FEATURE(always_add_domain)

If there are some administrative accounts that it would be useful
to see the hostname in the address, then add them to the Exposed
User class, $=E, with:

EXPOSED_USER(`root operator')

You would also want some of the other stuff in the original
submit.mc file:

VERSIONID(`submit.mc Robert Harker, ***@harker.com 060424')
define(`confCF_VERSION', `Client')
dnl dirty hack to keep proto.m4 from complaining
define(`__OSTYPE__',`')
define(`confTIME_ZONE', `USE_TZ')
define(`confDONT_INIT_GROUPS', `True')

Since this is an SMTP client, all forwarding and aliasing should
be done by the remote SMTP server, smtprelay.your.dom. The "msp"
feature automatically sets them both to a null path.

You should also set the Maximum message size to be consistent with the
your site-wide conventions or the next SMTP relay,smtprelay.your.dom:

define(`confMAX_MESSAGE_SIZE',`10000000')

RedHat, Fedora, and CentOS set the default user and group ID:

define(`confDEF_USER_ID',``8:12'')

This needs to be before the MAILER() definitions or the "msp"
feature.

Finally a few other things: don't waste time probing network
interfaces and don't waist time with Delivery Status Notifications:

define(`confDONT_PROBE_INTERFACES',true)
define(`confTO_QUEUEWARN_DSN',`')
define(`confTO_QUEUERETURN_DSN',`12h')

So putting it all together as a client.mc file:

VERSIONID(`client.mc Robert Harker, ***@harker.com
060424')
define(`confCF_VERSION', `client')dnl
dnl dirty hack to keep proto.m4 from complaining
define(`__OSTYPE__',`')
define(`confTIME_ZONE', `USE_TZ')dnl

MASQUERADE_AS(`your.dom')dnl
FEATURE(`allmasquerade')dnl
FEATURE(`masquerade_envelope')dnl
FEATURE(always_add_domain)dnl
EXPOSED_USER(`root operator')dnl

define(`SMART_HOST',`smtprelay.your.dom')dnl
define(`confMAX_MESSAGE_SIZE',`10000000')dnl

define(`confDONT_INIT_GROUPS', `True')dnl
define(`confDEF_USER_ID',``8:12'')dnl
define(`confDONT_PROBE_INTERFACES',true)dnl

define(`confTO_QUEUEWARN_DSN',`')dnl
define(`confTO_QUEUERETURN_DSN',`12h')dnl

FEATURE(`msp', `smtprelay.your.dom')dnl

Now that you are not running a sendmail queue daemon or a sendmail
SMTP server there is no need for a real sendmail.cf file. You can
use submit.cf for both:

cd /etc/mail
mv sendmail.cf sendmail.cf.orig
ln -s submit.cf sendmail.cf

You also want to turn off the standard sendmail SMTP server
and queue daemon. In Linux this is normally configured in
/etc/sysconfig/sendmail:

DAEMON=no
QUEUE=
SMQUEUE=p1h

Set DAEMON=no and QUEUE= to null. You can tune the queue daemon
with SMQUEUE=<time>. The "p" before "1h" tells sendmail to run
the queue as a persistent queue daemon.

Now you have a nice generic sendmail configuration which disables
both local and remote exploits in sendmail. It also is generic
enough to deploy on any OS running sendmail 8.12 or 8.13.

Hope this helps

RLH

For info about our "Managing Internet Mail, Setting Up and Trouble
Shooting sendmail and DNS" and a schedule of dates and locations,
please send email to ***@harker.com, or visit www.harker.com

[Per Hedeland]

Post by Robert Harker
From: FEATURE(`msp', `[127.0.0.1]')
To: FEATURE(`msp', `smtprelay.your.dom')
The "msp" feature only applies to mail addressed to the host itself,
you would still need to set the SMART_HOST relay in your
define(`SMART_HOST',`smtprelay.your.dom')

No, the msp FEATURE will send *all* mail to the second argument (a
SMART_HOST setting never comes into play). See cf/README.

Post by Robert Harker
I also assume you would like local mail addresses generated
MASQUERADE_AS(`your.dom')
FEATURE(`allmasquerade')
FEATURE(`masquerade_envelope')

In many cases (at least when the MTA is sendmail) it would make more
sense to do the masquerading on the MTA. One thing less to configure and
maintain on these "dumb" hosts.

Post by Robert Harker
and to make sure all addresses leave with a domain name
FEATURE(always_add_domain)

This only applies to local delivery, so is always irrelevant for the
MSP. The standard rewrite rules will make sure all addresses are
qualified when sending via SMTP.

Post by Robert Harker
define(`confDEF_USER_ID',``8:12'')

This is only relevant for delivery processes forked by sendmail
(i.e. local mailer, .forward-invoked program) - not used by the MSP.

Post by Robert Harker
Finally a few other things: don't waste time probing network
define(`confDONT_PROBE_INTERFACES',true)
define(`confTO_QUEUEWARN_DSN',`')
define(`confTO_QUEUERETURN_DSN',`12h')

Well, most people may not consider DSNs - which would happen here e.g.
if the MTA is unreachable - to be a waste of time. Of course if the MTA
is unreachable (or otherwise doesn't accept any mail), the MSP is out of
luck, since it can't send the DSN anywhere. This could maybe be
considered a weakness in this MSP-only setup, as the likelihood of
having problems delivering to a remote MTA is probably a bit higher than
with the standard local MTA. (Typical case is maybe that the identity of
the remote MTA has changed, but the admin forgot to update submit.mc on
this host - the standard [127.0.0.1] isn't likely to change.) Then
again, if there really are no local mailboxes on the host, using the
standard setup would just move the problem from the MSP to the local
MTA.

For completeness, the "standard" way to set up this functionality would
be to not touch submit.mc, but use FEATURE(nullclient) in sendmail.mc
and run a loopback-only MTA (and standard queue runner of course). The
main difference would be that the MTA could be used as (local) "attack
vector", but in this case (no local delivery) it can usefully be
configured to run as non-root via confRUN_AS_USER. The other side of
that coin is that it can also serve as MSA for any local SMTP-only MUAs,
which can then simply be configured with "localhost" as the "SMTP
server", avoiding the need to change any user config if/when the
identity of the mail hub changes. YMMV...

--Per Hedeland
***@hedeland.org