Disabling the Sendmail daemon for outgoing mail
Are you only sending outgoing mail with Sendmail? If you do not need to
process incoming SMTP mail, disable the Sendmail daemon for improved
security. Please read the excellent article Improving
Sendmail Security by Turning It Off for more information.
Beginning with Sendmail 8.12.x, the default behavior of the Message
Process (MSP) is to send outgoing mail through the local Message
Transport Agent (MTA) process. In other words, in order to send
outgoing mail, you need to run Sendmail in daemon mode. Even if
Sendmail is configured to only listen on the loopback interface,
running Sendmail in daemon mode could lead to local privilege
escalation if a security vulnerability in Sendmail is discovered.
Instead of using a local MTA to send outgoing mail, Sendmail can be
configured to use a different MTA. Therefore, outgoing mail will
relayed through your mail gateway, and you will not have to run
Sendmail in daemon mode.
To use a different MTA to relay outgoing mail with Sendmail 8.12.x and
make the following changes:
1. Modify the MSP macro configuration (submit.mc)
cp submit.mc submit.mc.original
2. Build and install the MSP configuration file.
sh Build submit.cf
cp submit.cf /etc/mail
3. If you are running Sendmail in daemon mode (i.e. a Sendmail process
running with the -bd flags),
terminate the process. If applicable, modify the Sendmail
startup/shutdown script (/etc/init.d/sendmail)
so that Sendmail is not started in daemon mode.
ex. Comment or remove the following lines in /etc/init.d/sendmail:
# Start the MTA
/usr/lib/sendmail -L sm-mta -bd
Back to brandonhutchinson.com.
Last modified: 04/19/2005