Difference between pages "Cyrus-SASL" and "Sendmail"

From Wikislax
(Difference between pages)
Jump to: navigation, search
(Created page with "{{RightTOC}} == What is Cyrus-SASL ? == [http://www.cyrusimap.org/#sasl SASL] is a protocol to manage authentication between clients and servers. It is used in messaging to...")
 
(Created page with "{{RightTOC}} == What is Sendmail ? == [http://www.sendmail.org Sendmail] is the most widespread Open Source program to transport mail between machines using the SMTP protoco...")
 
Line 1: Line 1:
 
{{RightTOC}}
 
{{RightTOC}}
  
−
== What is Cyrus-SASL ? ==
+
== What is Sendmail ? ==
  
−
[http://www.cyrusimap.org/#sasl SASL] is a protocol to manage authentication between clients and servers. It is used in messaging to authenticate clients to '''smtp pop3 imap ldap servers'''. SASL is specified in RFC 2222 (Simple Authentication and Security Layer). SASL defines how authentication information is exchanged, but lets other specifications define the authentication methods really used.
+
[http://www.sendmail.org Sendmail] is the most widespread Open Source program to transport mail between machines using the SMTP protocol (and also some older protocols such as UUCP and others). <u>Note</u> : sendmail does not afford delivering mail to clients using the POP and IMAP protocols. A separate software such as Cyrus-IMAP must be installed to handle this.
  
−
Among these, '''CRAM-MD5''' and its successor '''DIGEST-MD5''' use a shared secret (a password) and a challenge that affords proving that the other side owns the password without actually needing to send it over the wire. '''GSSAPI''' is the method for '''KERBEROS V5'''. '''PLAIN''' use a plaintext password. Microsoft Outlook Express uses only proprietary methods, '''LOGIN''' uses a base 64-coded plaintext password, '''NTLM''' is the Microsoft NT Lan Manager Authentication and '''SPA''' stands for secure password authentication.
+
== Installing Sendmail ==
  
−
'''Cyrus-SASL''', an Open Source software developped by the Carnegie-Mellon University, implements the standard methods, and also includes plugins to handle proprietary authentication methods such as Microsoft '''NTLM/SPA'''.
+
[http://www.sendmail.com/sm/open_source/download Download] then untar to /usr/local and edit the compile options as below, updating the paths to your specific environment. Sendmail also includes many default compile options not listed here. Review the bat book (O’Reilly Sendmail, by Bryan Costales and Eric Allman) for more details.
  
−
'''Cyrus-SASL''' offers several options to check the real passwords. '''saslauthd''' affords using the '''saslauthd''' daemon to check cleartext-only passwords against '''PAM''' (the system passwords and '''/etc/shadow'''), '''LDAP''', '''Kerberos''', and others. '''auxprop''' affords using external modules for passwords stored in an external '''SASLdb''' (using '''Berkeley db''') or '''SQL''' database, or in an '''LDAP''' directory.
+
# cd /var/log/packages
 +
# removepkg sendmail-cf-x.y.z-noarch-t
 +
# removepkg sendmail-x.y.z-x86_64-t
 +
# cd
 +
# tar -C /usr/local -xvf sendmail-8.15.2
 +
# cd /usr/local/
 +
# chown -R root:root sendmail-8.15.2/
 +
# cd sendmail-x.y.z
 +
# vi /etc/mail/local-host-names
 +
i
 +
your.domain.com
 +
<esc>
 +
:x
 +
# mkdir /var/spool/mqueue
 +
# vi devtools/Site/site.config.m4
 +
i
 +
APPENDDEF(`confENVDEF', `-DSTARTTLS')
 +
APPENDDEF(`confLIBS', `-lssl -lcrypto')
 +
APPENDDEF(`confLIBDIRS', `-I/usr/local/lib64')
 +
APPENDDEF(`confINCDIRS', `-I/usr/local/openssl-1.0.2j/include')
 +
 +
APPENDDEF(`confENVDEF', `-DSASL')
 +
APPENDDEF(`confLIBS', `-lsasl2')
 +
APPENDDEF(`confLIBDIRS', `-I/usr/local/lib/sasl2')
 +
APPENDDEF(`confINCDIRS', `-I/usr/local/cyrus-sasl-2.1.26/include')
 +
 +
APPENDDEF(`confMAPDEF', `-DLDAPMAP')
 +
APPENDDEF(`confLIBS', `-lldap')
 +
APPENDDEF(`confLIBDIRS', `-I/usr/local/lib64')
 +
APPENDDEF(`confINCDIRS', `-I/usr/local/openldap-2.4.44/include')
 +
 +
APPENDDEF(`confLIBS', `-ldb')
 +
APPENDDEF(`confLIBS', `-lresolv')
 +
APPENDDEF(`confLIBS', `-llber')
 +
 +
APPENDDEF(`confMAPDEF', `-DDNSMAP -DMAP_REGEX -DNEWDB')
 +
APPENDDEF(`confENVDEF', `-DMILTER -DNETINET -DNETUNIX -DSM_CONF_LDAP_MEMFREE=1')
 +
APPENDDEF(`confENVDEF', `-DIPV6_FULL=0 -DNETINET6=0 -DNIS=0 -DSOCKETMAP=0')
 +
APPENDDEF(`confENVDEF', `-DTCPWRAPPERS=0 -DUSE_LDAP_INIT=0')
 +
<esc>
 +
:x
  
−
== Installing Cyrus-SASL ==
+
Then compile the software and verify how the compile options have been taken into account :
  
−
[http://www.cyrusimap.org/mediawiki/index.php/Downloads#SASL_Library Download], untar to /usr/local then install as below. The authentication methods used are '''CRAM-MD5''' (needed? for '''Thunderbird'''), '''DIGEST-MD5''', '''PLAIN''', '''LOGIN''' (needed for '''Microsoft Outlook Express'''), the password checking methods used are '''saslauthd''' (with PAM or LDAP) and '''ldapdb'''. There's support for OpenSSL (not sure if this is used as SASL includes its own encryption routines), and random number generation uses '''/dev/urandom''' to avoid  authentication severe slowdowns observed when using '''/dev/random''' (but should not be used for OTP of SRP).
+
# ./Build -c install
 +
…
 +
# ln -s /usr/local/lib64/libldap-2.4.so.2 /usr/lib64/libldap-2.4.so.2
 +
# ln -s /usr/local/lib64/liblber-2.4.so.2 /usr/lib64/liblber-2.4.so.2
 +
# ldconfig
 +
# sendmail -d0.10 -bt < /dev/null
 +
Version 8.15.1
 +
  Compiled with: DNSMAP LDAPMAP LOG MAP_REGEX MATCHGECOS MILTER MIME7TO8
 +
                MIME8TO7 NAMED_BIND NETINET NETUNIX NEWDB PIPELINING SASLv2
 +
                SCANF STARTTLS USERDB XDEBUG
 +
    OS Defines: HASFCHOWN HASFCHMOD HASGETDTABLESIZE HASINITGROUPS
 +
                HASLSTAT HASNICE HASRANDOM HASRRESVPORT HASSETREGID HASSETREUID
 +
                HASSETRLIMIT HASSETSID HASSETVBUF HASURANDOMDEV HASSTRERROR
 +
                HASUNAME HASUNSETENV HASWAITPID IDENTPROTO REQUIRES_DIR_FSYNC
 +
                SFS_VFS USE_DOUBLE_FORK USE_SIGLONGJMP
 +
Kernel symbols: /boot/vmlinux
 +
      Conf file: /etc/mail/submit.cf (default for MSP)
 +
      Conf file: /etc/mail/sendmail.cf (default for MTA)
 +
      Pid file: /var/run/sendmail.pid (default)
 +
Canonical name: inner.studioware.com
 +
  UUCP nodename: inner
 +
        a.k.a.: inner
 +
        a.k.a.: [192.168.0.1]
 +
        a.k.a.: [127.0.0.1]
 +
      Conf file: /etc/mail/sendmail.cf (selected)
 +
      Pid file: /var/run/sendmail.pid (selected)
 +
 +
============ SYSTEM IDENTITY (after readcf) ============
 +
      (short domain name) $w = inner
 +
  (canonical domain name) $j = inner.studioware.com
 +
          (subdomain name) $m = studioware.com
 +
              (node name) $k = inner
 +
========================================================
 +
 +
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
 +
Enter <ruleset> <address>
 +
 
 +
<u>Here is a short comment on the options selected :</u>
 +
 
 +
'''DNSMAP''' : allows to look up host and address information. Used for reverse lookups. Necessary to use the enhdnsbl blacklist feature for improved spam screening.
 +
 
 +
'''LDAPMAP''' : enable use of LDAP databases.
 +
 
 +
'''LOG''' : log error messages and other useful information that is often important for security and debugging.
 +
 
 +
'''MAP_REGEX''' : ability to match addresses to regular expressions in rule sets with the regex class of database map (§23.7.21 of the Sendmail book 3d edition).
 +
 
 +
'''MATCHGECOS''' : support of limited fuzzy name matching. Normally defined as true by default.
 +
 
 +
'''MILTER''' : ability to submit messages to external programs that can be used to screen messages for spam indicators, viruses, or other content that you might want to reject.
 +
 
 +
'''MIME7TO8''' : ability to convert messages that were converted into either quoted-printable or base64 back into their original 8-bit form. The decision to make this conversion is based on the F=9 delivery agent flag (§20.8.10 of the Sendmail book 3d edition).
 +
 
 +
'''MIME8TO7''' : ability to convert 8-bit MIME message content into 7-bit MIME so that mail can be transported through non-8-bit gateways. The methods used and the circumstances required to trigger conversion are described under the EightBitMode option (§24.9.42 of the Sendmail book 3d edition).
 +
 
 +
'''NAMED_BIND''' : automatically take advantage of DNS lookups or MX records to resolve addresses and canonical hostnames.
 +
 
 +
'''NETINET''' : to support an Ipv4 network.
 +
 
 +
'''NETUNIX''' : to support a unix domain network.
  
−
# tar -C /usr/local -xvf cyrus-sasl-x.y.z.tar.gz
+
'''NEWDB''' : to support aliasing in an efficient manner.
−
# cd /usr/local
 
−
# chmod -R go-w cyrus-sasl-x.y.z
 
−
# cd cyrus-sasl-x.y.z
 
−
# ./configure --help | less
 
−
# ./configure --libdir=/usr/local/lib64 --disable-alwaystrue --disable-checkapop \
 
−
--disable-otp --disable-gssapi --disable-anon --enable-login --with-devrandom=/dev/urandom \
 
−
--with-saslauthd=/var/state/saslauthd --with-openssl=/usr/local --with-ldap=/usr/local \
 
−
--enable-ldapdb
 
−
# make
 
−
# removepkg /var/log/packages/qca-cyrus-sasl-x.y.z_betat-x86_64-1
 
−
# removepkg /var/log/packages/cyrus-sasl-x.y.z-x86_64-2
 
−
# make install
 
−
# make clean
 
−
# mkdir /var/state/saslauthd
 
−
# ln -s /usr/local/lib/sasl2 /usr/lib/sasl2
 
−
# ln -sf /usr/local/lib64/libsasl2.la /usr/lib64/libsasl2.la
 
−
# ln -sf /usr/local/lib64/libsasl2.so.3 /usr/lib64/libsasl2.so.2
 
−
# ldconfig
 
  
−
== Reinstalling OpenLDAP ==
+
'''PIPELINING''' : enable pipelining SMTP extension.
  
−
There is a chicken-and-egg problem with OpenLDAP and Cyrus-SASL as they reference each other. At previous chapter we installed OpenLDAP without '''--enable-spasswd --with-cyrus-sasl'''. We now reinstall OpenLDAP with '''--enable-spasswd --with-cyrus-sasl''' :
+
'''SASLv2''' : support SMTP AUTH version 2.
  
−
# cd /usr/local/openldap-x.y.z
+
'''SCANF''' : support scanf(3) with the F command.
−
# make distclean
 
−
# ./configure --help | less
 
−
# ./configure --libdir=/usr/local/lib64 --mandir=/usr/local/man \
 
−
--disable-ipv6 --with-tls --enable-spasswd --with-cyrus-sasl
 
−
# make depend
 
−
# make
 
−
# make test
 
−
# make install
 
−
# make clean
 
  
−
== Configuring Cyrus-SASL ==
+
'''STARTTLS''' : enable stream encryption.
  
−
Applications that use SASL are advised to use an '''Application.conf''' file in '''/usr/lib/sasl2''', with a '''mech_list''' line defining a subset of the authentication methods defined for the site, and a '''pwcheck_method''' line defining the password checking method. If all authentication methods defined for the site can be used by the application then it is not necessary to use '''mech_list'''. log_level is between 0 and 7 (default 1, log unusual errors) and defines the verbosity of the logs produced under '''/var/log''' in files '''auth.log''', '''debug''', '''maillog''' and '''syslog'''.
+
'''USERDB''' : support the user database, that allows sender and recipient addresses to be rewritten under the control of an external database.
  
−
== Known issue ==
+
'''XDEBUG''' : support sanity checks. In past releases of sendmail, changes in file descriptors and other key variables have sometimes occurred for reasons that remain a mistery to this day. Small “sanity checks” have been included in the code to discover such anomalies, should they appear again.
  
−
Applications using SASL authentication (e.g. OpenLdap, Cyrus-IMAP) expect to find a ''GuessMyName.conf'' file in /usr/lib/sasl2 to work properly. If this file cannot be found, there will be messages ''_sasl_plugin_load failed on sasl_auxprop_plug_init for plugin:'' in /var/log/debug and ''auxpropfunc error invalid parameter supplied'' in /var/log/syslog. To find the name of the missing file, re-make install SASL after adding line '''_sasl_log (NULL, SASL_LOG_ERR, "File %s could not be fopened\n", filename);''' in lib/config.c just after the call to fopen. Known SASL configuration filenames are :
+
== Configuring Sendmail ==
  
−
* Cyrus.conf
+
Since v8.12 and by default on Linux Slackware, sendmail runs as non-set-user-id root and comes in two guises. In one guise, it is run as before by root to function as a listening daemon and uses the '''/etc/mail/sendmail.cf''' configuration file. In the second guise, it is run as an ordinary user (usually smmsp), to collect locally submitted messages and uses the '''/etc/mail/submit.cf''' configuration file. Both guises are launched at system startup if script '''/etc/rc.d/rc.sendmail''' is executable. Let us create these files :
−
* INN.conf
 
−
* Sendmail.conf
 
−
* slapd.conf
 
  
−
== Using saslauthd ==
+
# cd /usr/local/sendmail*/cf/cf
 +
# cp generic-linux.mc sendmail.mc
 +
# vi sendmail.mc
  
−
An Application.conf file to use '''saslauthd''' could be :
+
* Define the following macro to avoid user information leaks by the VRFY command, that verifies the validity of a user name, the EXPN command, that expands the distribution lists, and the VERB command, that puts a remote MTA in verbose mode :
  
−
  log_level: 0
+
  define(`confPRIVACY_FLAGS', `goaway, restrictexpand, restrictmailq, restrictqrun')dnl
−
mech_list: PLAIN LOGIN
 
−
pwcheck_method: saslauthd
 
  
−
Specify the '''saslauthd''' options in file '''/etc/rc.d/rc.saslauthd'''. '''-a ldap''' affords using ldap and '''-n''' is the number of waiting processes. Put 0 to create authentication processes only on demand. chmod u+x /etc/rc.d/rc.saslauthd to afford automatically launching saslauthd at startup. For more saslauthd options, see the '''man saslauthd''' page.
+
* Define the following macro to change the default banner and avoid letting the software name and version number appear :
  
−
  saslauthd_start() {
+
  define(`confSMTP_LOGIN_MSG', `inner.studioware.com service')dnl
−
  # If saslauthd is not running, start it:
 
−
  if [ ! -r /var/state/saslauthd/saslauthd.pid ]; then
 
−
    echo "Starting SASL authentication daemon:  /usr/local/sbin/saslauthd -a ldap -n 0"
 
−
    /usr/local/sbin/saslauthd -a ldap -n 0
 
−
  fi
 
−
}
 
  
−
When using ldap, file '''/usr/local/etc/saslauthd.conf''' defines the LDAP access parameters :
+
* In recent versions sendmail is configured by default to forbid open relay. However the SMTP AUTH extension affords authenticated users to relay. Define the SASL authentication mechanisms used :
  
−
  ldap_auth_method: custom
+
  define(`confAUTH_MECHANISMS', `CRAM-MD5 DIGEST-MD5 PLAIN LOGIN')dnl
−
  ldap_authz: proxyUser
+
  TRUST_AUTH_MECH(`CRAM-MD5 DIGEST-MD5 PLAIN LOGIN')dnl
−
ldap_filter: cn=%u
 
−
ldap_id: proxyUser
 
−
ldap_mech: DIGEST-MD5
 
−
ldap_password: proxyPassword
 
−
ldap_search_base: dc=domain,dc=com
 
−
ldap_servers: ldap://localhost
 
−
ldap_use_sasl: yes
 
  
−
Restart '''slapd''' and use '''testsaslauthd''' to make sure is works :
+
* Define macros to take into account in '''sendmail.mc''' the certificates previously created :
  
−
  # killall slapd
+
  define(`confCACERT_PATH', `/etc/ssl/certs')dnl
−
  # /usr/local/libexec/slapd -u ldap -g ldap -h ldap://localhost/
+
define(`confCACERT', `confCACERT_PATH`'/cacert.pem')dnl
−
  # testsaslauthd -u myUser -p myPassword
+
  define(`confSERVER_CERT', `/etc/ssl/certs/mtacert.pem')dnl
−
  0: OK “Success.”
+
define(`confSERVER_KEY', `/etc/ssl/private/mtakey.pem.unsecure')dnl
 +
  define(`confCLIENT_CERT', `/etc/ssl/certs/mtacert.pem')dnl
 +
  define(`confCLIENT_KEY', `/etc/ssl/private/mtakey.pem.unsecure')dnl
  
−
<u>Note</u> : as already noted above when introducing the password checking methods, '''saslauthd''' affords using only cleartext passwords (even if it uses digest-md5 when talking to slapd). So only the PLAIN and LOGIN mechanisms can be used with '''saslauthd'''. For security, any such connection should be encapsulated within TLS when used over the wire.
+
* Defining a maximum message size (here 15 megs) can be a good idea :
  
−
== Using sasldb ==
+
define(`confMAX_MESSAGE_SIZE', `15728640')dnl
  
−
An Application.conf file to use sasldb could be:
+
As the second guise of Sendmail is ran as '''smmsp''', let us make a copy of the server private keys that will be readable only by this user then define macros to take into account in '''submit.mc''' the certificates :
  
−
  auxprop_plugin: sasldb
+
  # cd /etc/ssl/private
−
  mech_list: CRAM-MD5 DIGEST-MD5 PLAIN LOGIN
+
# cp mtakey.pem.unsecure smmsp.mtakey.pem.unsecure
−
  pwcheck_method: auxprop
+
# chown <nowiki>smmsp:smmsp</nowiki> smmsp.mtakey.pem.unsecure
 +
 +
define(`confCACERT_PATH', `/etc/ssl/certs')dnl
 +
define(`confCACERT', `confCACERT_PATH`'/cacert.pem')dnl
 +
define(`confSERVER_CERT', `/etc/ssl/certs/mtacert.pem')dnl
 +
define(`confSERVER_KEY', `/etc/ssl/private/smmsp.mtakey.pem.unsecure')dnl
 +
  define(`confCLIENT_CERT', `/etc/ssl/certs/mtacert.pem')dnl
 +
  define(`confCLIENT_KEY', `/etc/ssl/private/smmsp.mtakey.pem.unsecure')dnl
  
−
'''sasldb''' affords storing a list of users/passwords in the '''/etc/sasldb2''' password database. The tools to maintain this database are '''sasldblistusers2''', that affords listing the users, and '''saslpasswd2''', that affords adding or removing users/passwords. For more options, see the man pages. <u>Note</u> : when creating users, it might be necessary to append the domain name for the password checking to work.
+
Let us now finalize and generate sendmail.cf, copy sendmail.mc and sendmail.cf to /etc/mail. Do the same with submit.mc and submit.cf :
  
−
  # saslpasswd2 -c myUser@myDomain.com
+
  # cd /usr/local/sendmail*/cf/cf
−
  Password:
+
# m4 ../m4/cf.m4 sendmail.mc > sendmail.cf
−
  # sasldblistusers2
+
  # cp sendmail.mc /etc/mail
−
  myUser@myDomain.com: userPassword
+
  # cp sendmail.cf /etc/mail
−
  # saslpasswd2 -d myUser@myDomain.com
+
  # vi submit.mc
 +
# m4 ../m4/cf.m4 submit.mc > submit.cf
 +
# cp submit.mc /etc/mail
 +
  # cp submit.cf /etc/mail
  
−
== Using ldapdb ==
+
== Configuring Sendmail SASL ==
  
−
This is our preferred method, as it affords using the LDAP directory as a single and direct (saslauthd is not needed when using the ldapdb auxprop) source of authentication for all applications. We will use it later in this document for Sendmail and Cyrus-IMAP authentication. As we are authenticating against localhost we are using interprocess communication only so there is no need for encryption and we use the PLAIN mechanism. An Application.conf file to use '''ldapdb''' is as below :
+
For SMTP authentication, we use SASL against the OpenLDAP directory installed previously. As only mechanism, we use PLAIN, later ensuring security by forcing SSL encryption over port 465 SMTPS (actually, DIGEST-MD5 and CRAM-MD5 are not widely used, and Microsoft Outlook uses only the LOGIN non standard mechanism). Here is the content of file '''/usr/local/lib/sasl2/Sendmail.conf''' :
  
 
  auxprop_plugin: ldapdb
 
  auxprop_plugin: ldapdb
 
  ldapdb_id: proxyUser
 
  ldapdb_id: proxyUser
 
  ldapdb_mech: DIGEST-MD5
 
  ldapdb_mech: DIGEST-MD5
−
  ldapdb_pw: proxyPassword
+
  ldapdb_pw: proxyUserPassword
−
  ldapdb_uri: ldap://localhost
+
  ldapdb_uri: ldap'''s'''://localhost
 
  log_level: 0
 
  log_level: 0
 
  mech_list: PLAIN
 
  mech_list: PLAIN
 
  pwcheck_method: auxprop
 
  pwcheck_method: auxprop
  
−
File '''/usr/local/lib/sasl2/slapd.conf''' tells slapd to use its own internal auxprop_plugin module slapd to authenticate proxyUser :
+
As it contains sensitive information, the owner and rights of this file should be set so that it can be read only by its user root:root.
 +
 
 +
== Running sendmail ==
 +
 
 +
Build installs sendmail not in /usr/local/sbin but in /usr/sbin. Make sure that the right path is used in '''/etc/rc.d/rc.sendmail''' then make the file executable and start the software :
 +
 
 +
# cd /etc/rc.d
 +
# vi rc.sendmail
 +
# chmod u+x rc.sendamil
 +
# ./rc.sendmail start
 +
 
 +
== Checking sendmail run-time options ==
 +
 
 +
Correct configuration of the STARTTLS option can be tested using the command below, in which '''-bs''' requests sendmail to use SMTP on its standard input and '''-Am''' requests sendmail to use the server configuration file, even if  used in local message submission mode :
 +
 
 +
# sendmail -bs -Am
 +
220 inner.studioware.com ESMTP service
 +
ehlo studioware.com
 +
250-inner.studioware.com Hello root@localhost, pleased to meet you
 +
250-ENHANCEDSTATUSCODES
 +
250-PIPELINING
 +
250-8BITMIME
 +
250-SIZE 15728640
 +
250-DSN
 +
250-ETRN
 +
250-AUTH PLAIN
 +
250-STARTTLS
 +
250-DELIVERBY
 +
250 HELP
 +
quit
 +
221 2.0.0 inner.studioware.com closing connection
 +
 
 +
In this example the STARTTLS keyword appears, showing that this site supports TLS. If the STARTTLS keyword does not appear, check file '''/var/log/maillog''' for error messages or launch again the sendmail command, adding debug option '''-O LogLevel=14'''. Errors will be displayed on the console.
 +
 
 +
If the STARTTLS keyword appears, then TLS is available to cipher the communication and to verify the certificates of the connecting clients. To test this, it is possible to use the '''s_client''' command of '''openssl'''. The result can be observed in file '''/var/log/maillog'''. If the log line includes '''verify=OK''', then the certificate has been successfully verified. If it includes '''verify=NO''', then no certificate has been used, and if it includes '''verify=FAIL''', the certificate verification step has failed. Notice that this failure does not prevent the software from using encryption. Only that the other party was not authenticated by sendmail.
 +
 
 +
# openssl s_client -connect inner:25 -starttls smtp -cert /etc/ssl/certs/mtacert.pem -key /etc/ssl/private/mtakey.pem
 +
'''. . .'''
 +
# vi /var/log/maillog
 +
'''. . .'''
 +
Oct 15 10:42:00 inner sm-mta[24527]: STARTTLS=server, relay=IDENT:0@desktop.studioware.com [192.168.0.2], version=TLSv1.2, verify=OK, cipher=DHE-RSA-AES256-GCM-SHA384, bits=256/256
 +
 
 +
To use the PLAIN authentication, enter '''auth plain authent''' on a single line, where '''authent''' is a base64 encoded string composed of a null character, followed by the user name, followed by a null character, followed by the password. In practise, authent may be obtained by typing :
 +
 
 +
# base64 -
 +
<ctrl>@username<ctrl>@password<ctrl>d<ctrl>d
 +
 
 +
== To effectively check certificates ==
 +
 
 +
To effectively use STARTTLS to allow relaying based on certificates or to restrict incoming or outgoing connections, you need to use specific  macros in '''sendmail rulesets''', please see the instructions in http://www.sendmail.org/~ca/email/starttls.html. If using your own (self-signed) Certification Authority Certificate, you need to place it in your in your '''/etc/ssl/certs''' directory  with a symbolic link whose name must be based on the certificate hash code. This can be done in this way :
 +
 
 +
# C=CACertificateFileName
 +
# ln -s $C `openssl x509 -noout -hash < $C`.0
  
−
auxprop_plugin: slapd
+
== Errors in /var/log/maillog ==
−
log_level: 0
 
−
mech_list: DIGEST-MD5
 
−
pwcheck_method: auxprop
 
  
−
As they contain sensitive information, the owner and rights of these files should be set so that they can be read only by their user ldap:ldap.
+
The message '''did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA''' in log file '''/var/log/maillog''' means that a remote server connected to your site but closed the connection before actually sending any mail. This is probably related to malicious behaviour to connect to, scan, or exploit vulnerabilities of your site. Observing the line with [[Desktop software#Wireshark|wireshark]] with filter '''port smtp''' will afford checking what really happens. Here are a few interesting additional [http://security.stackexchange.com/questions/45931/what-is-the-hack-attempt-going-on-when-i-see-did-not-issue-mail-expn-vrfy-etrn comments] about this issue.
  
 
<br/>
 
<br/>
  
−
{{pFoot|[[OpenLDAP]]|[[Main Page]]|[[Sendmail]]}}
+
{{pFoot|[[Cyrus-SASL]]|[[Main Page]]|[[Cyrus-IMAP]]}}

Latest revision as of 23:30, 6 December 2017

What is Sendmail ?

Sendmail is the most widespread Open Source program to transport mail between machines using the SMTP protocol (and also some older protocols such as UUCP and others). Note : sendmail does not afford delivering mail to clients using the POP and IMAP protocols. A separate software such as Cyrus-IMAP must be installed to handle this.

Installing Sendmail

Download then untar to /usr/local and edit the compile options as below, updating the paths to your specific environment. Sendmail also includes many default compile options not listed here. Review the bat book (O’Reilly Sendmail, by Bryan Costales and Eric Allman) for more details. 

# cd /var/log/packages
# removepkg sendmail-cf-x.y.z-noarch-t
# removepkg sendmail-x.y.z-x86_64-t
# cd
# tar -C /usr/local -xvf sendmail-8.15.2
# cd /usr/local/
# chown -R root:root sendmail-8.15.2/
# cd sendmail-x.y.z
# vi /etc/mail/local-host-names
i
your.domain.com
<esc>
:x
# mkdir /var/spool/mqueue
# vi devtools/Site/site.config.m4
i
APPENDDEF(`confENVDEF', `-DSTARTTLS')
APPENDDEF(`confLIBS', `-lssl -lcrypto')
APPENDDEF(`confLIBDIRS', `-I/usr/local/lib64')
APPENDDEF(`confINCDIRS', `-I/usr/local/openssl-1.0.2j/include')

APPENDDEF(`confENVDEF', `-DSASL')
APPENDDEF(`confLIBS', `-lsasl2')
APPENDDEF(`confLIBDIRS', `-I/usr/local/lib/sasl2')
APPENDDEF(`confINCDIRS', `-I/usr/local/cyrus-sasl-2.1.26/include')

APPENDDEF(`confMAPDEF', `-DLDAPMAP')
APPENDDEF(`confLIBS', `-lldap')
APPENDDEF(`confLIBDIRS', `-I/usr/local/lib64')
APPENDDEF(`confINCDIRS', `-I/usr/local/openldap-2.4.44/include')

APPENDDEF(`confLIBS', `-ldb')
APPENDDEF(`confLIBS', `-lresolv')
APPENDDEF(`confLIBS', `-llber')

APPENDDEF(`confMAPDEF', `-DDNSMAP -DMAP_REGEX -DNEWDB')
APPENDDEF(`confENVDEF', `-DMILTER -DNETINET -DNETUNIX -DSM_CONF_LDAP_MEMFREE=1')
APPENDDEF(`confENVDEF', `-DIPV6_FULL=0 -DNETINET6=0 -DNIS=0 -DSOCKETMAP=0')
APPENDDEF(`confENVDEF', `-DTCPWRAPPERS=0 -DUSE_LDAP_INIT=0')
<esc>
:x

Then compile the software and verify how the compile options have been taken into account : 

# ./Build -c install
…
# ln -s /usr/local/lib64/libldap-2.4.so.2 /usr/lib64/libldap-2.4.so.2
# ln -s /usr/local/lib64/liblber-2.4.so.2 /usr/lib64/liblber-2.4.so.2
# ldconfig
# sendmail -d0.10 -bt < /dev/null
Version 8.15.1
 Compiled with: DNSMAP LDAPMAP LOG MAP_REGEX MATCHGECOS MILTER MIME7TO8
                MIME8TO7 NAMED_BIND NETINET NETUNIX NEWDB PIPELINING SASLv2
                SCANF STARTTLS USERDB XDEBUG
    OS Defines: HASFCHOWN HASFCHMOD HASGETDTABLESIZE HASINITGROUPS
                HASLSTAT HASNICE HASRANDOM HASRRESVPORT HASSETREGID HASSETREUID
                HASSETRLIMIT HASSETSID HASSETVBUF HASURANDOMDEV HASSTRERROR
                HASUNAME HASUNSETENV HASWAITPID IDENTPROTO REQUIRES_DIR_FSYNC
                SFS_VFS USE_DOUBLE_FORK USE_SIGLONGJMP
Kernel symbols: /boot/vmlinux
     Conf file: /etc/mail/submit.cf (default for MSP)
     Conf file: /etc/mail/sendmail.cf (default for MTA)
      Pid file: /var/run/sendmail.pid (default)
Canonical name: inner.studioware.com
 UUCP nodename: inner
        a.k.a.: inner
        a.k.a.: [192.168.0.1]
        a.k.a.: [127.0.0.1]
     Conf file: /etc/mail/sendmail.cf (selected)
      Pid file: /var/run/sendmail.pid (selected)

============ SYSTEM IDENTITY (after readcf) ============
      (short domain name) $w = inner
  (canonical domain name) $j = inner.studioware.com
         (subdomain name) $m = studioware.com
              (node name) $k = inner
========================================================

ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>

Here is a short comment on the options selected :

DNSMAP : allows to look up host and address information. Used for reverse lookups. Necessary to use the enhdnsbl blacklist feature for improved spam screening.

LDAPMAP : enable use of LDAP databases.

LOG : log error messages and other useful information that is often important for security and debugging.

MAP_REGEX : ability to match addresses to regular expressions in rule sets with the regex class of database map (§23.7.21 of the Sendmail book 3d edition).

MATCHGECOS : support of limited fuzzy name matching. Normally defined as true by default.

MILTER : ability to submit messages to external programs that can be used to screen messages for spam indicators, viruses, or other content that you might want to reject.

MIME7TO8 : ability to convert messages that were converted into either quoted-printable or base64 back into their original 8-bit form. The decision to make this conversion is based on the F=9 delivery agent flag (§20.8.10 of the Sendmail book 3d edition).

MIME8TO7 : ability to convert 8-bit MIME message content into 7-bit MIME so that mail can be transported through non-8-bit gateways. The methods used and the circumstances required to trigger conversion are described under the EightBitMode option (§24.9.42 of the Sendmail book 3d edition).

NAMED_BIND : automatically take advantage of DNS lookups or MX records to resolve addresses and canonical hostnames.

NETINET : to support an Ipv4 network.

NETUNIX : to support a unix domain network.

NEWDB : to support aliasing in an efficient manner.

PIPELINING : enable pipelining SMTP extension.

SASLv2 : support SMTP AUTH version 2.

SCANF : support scanf(3) with the F command.

STARTTLS : enable stream encryption.

USERDB : support the user database, that allows sender and recipient addresses to be rewritten under the control of an external database.

XDEBUG : support sanity checks. In past releases of sendmail, changes in file descriptors and other key variables have sometimes occurred for reasons that remain a mistery to this day. Small “sanity checks” have been included in the code to discover such anomalies, should they appear again.

Configuring Sendmail

Since v8.12 and by default on Linux Slackware, sendmail runs as non-set-user-id root and comes in two guises. In one guise, it is run as before by root to function as a listening daemon and uses the /etc/mail/sendmail.cf configuration file. In the second guise, it is run as an ordinary user (usually smmsp), to collect locally submitted messages and uses the /etc/mail/submit.cf configuration file. Both guises are launched at system startup if script /etc/rc.d/rc.sendmail is executable. Let us create these files : 

# cd /usr/local/sendmail*/cf/cf
# cp generic-linux.mc sendmail.mc
# vi sendmail.mc
  • Define the following macro to avoid user information leaks by the VRFY command, that verifies the validity of a user name, the EXPN command, that expands the distribution lists, and the VERB command, that puts a remote MTA in verbose mode :
define(`confPRIVACY_FLAGS', `goaway, restrictexpand, restrictmailq, restrictqrun')dnl
  • Define the following macro to change the default banner and avoid letting the software name and version number appear :
define(`confSMTP_LOGIN_MSG', `inner.studioware.com service')dnl
  • In recent versions sendmail is configured by default to forbid open relay. However the SMTP AUTH extension affords authenticated users to relay. Define the SASL authentication mechanisms used :
define(`confAUTH_MECHANISMS', `CRAM-MD5 DIGEST-MD5 PLAIN LOGIN')dnl
TRUST_AUTH_MECH(`CRAM-MD5 DIGEST-MD5 PLAIN LOGIN')dnl
  • Define macros to take into account in sendmail.mc the certificates previously created :
define(`confCACERT_PATH', `/etc/ssl/certs')dnl
define(`confCACERT', `confCACERT_PATH`'/cacert.pem')dnl
define(`confSERVER_CERT', `/etc/ssl/certs/mtacert.pem')dnl
define(`confSERVER_KEY', `/etc/ssl/private/mtakey.pem.unsecure')dnl
define(`confCLIENT_CERT', `/etc/ssl/certs/mtacert.pem')dnl
define(`confCLIENT_KEY', `/etc/ssl/private/mtakey.pem.unsecure')dnl
  • Defining a maximum message size (here 15 megs) can be a good idea :
define(`confMAX_MESSAGE_SIZE', `15728640')dnl

As the second guise of Sendmail is ran as smmsp, let us make a copy of the server private keys that will be readable only by this user then define macros to take into account in submit.mc the certificates : 

# cd /etc/ssl/private
# cp mtakey.pem.unsecure smmsp.mtakey.pem.unsecure
# chown smmsp:smmsp smmsp.mtakey.pem.unsecure

define(`confCACERT_PATH', `/etc/ssl/certs')dnl
define(`confCACERT', `confCACERT_PATH`'/cacert.pem')dnl
define(`confSERVER_CERT', `/etc/ssl/certs/mtacert.pem')dnl
define(`confSERVER_KEY', `/etc/ssl/private/smmsp.mtakey.pem.unsecure')dnl
define(`confCLIENT_CERT', `/etc/ssl/certs/mtacert.pem')dnl
define(`confCLIENT_KEY', `/etc/ssl/private/smmsp.mtakey.pem.unsecure')dnl

Let us now finalize and generate sendmail.cf, copy sendmail.mc and sendmail.cf to /etc/mail. Do the same with submit.mc and submit.cf : 

# cd /usr/local/sendmail*/cf/cf
# m4 ../m4/cf.m4 sendmail.mc > sendmail.cf
# cp sendmail.mc /etc/mail
# cp sendmail.cf /etc/mail
# vi submit.mc
# m4 ../m4/cf.m4 submit.mc > submit.cf
# cp submit.mc /etc/mail
# cp submit.cf /etc/mail

Configuring Sendmail SASL

For SMTP authentication, we use SASL against the OpenLDAP directory installed previously. As only mechanism, we use PLAIN, later ensuring security by forcing SSL encryption over port 465 SMTPS (actually, DIGEST-MD5 and CRAM-MD5 are not widely used, and Microsoft Outlook uses only the LOGIN non standard mechanism). Here is the content of file /usr/local/lib/sasl2/Sendmail.conf : 

auxprop_plugin: ldapdb
ldapdb_id: proxyUser
ldapdb_mech: DIGEST-MD5
ldapdb_pw: proxyUserPassword
ldapdb_uri: ldaps://localhost
log_level: 0
mech_list: PLAIN
pwcheck_method: auxprop

As it contains sensitive information, the owner and rights of this file should be set so that it can be read only by its user root:root.

Running sendmail

Build installs sendmail not in /usr/local/sbin but in /usr/sbin. Make sure that the right path is used in /etc/rc.d/rc.sendmail then make the file executable and start the software : 

# cd /etc/rc.d
# vi rc.sendmail
# chmod u+x rc.sendamil
# ./rc.sendmail start

Checking sendmail run-time options

Correct configuration of the STARTTLS option can be tested using the command below, in which -bs requests sendmail to use SMTP on its standard input and -Am requests sendmail to use the server configuration file, even if used in local message submission mode : 

# sendmail -bs -Am
220 inner.studioware.com ESMTP service
ehlo studioware.com
250-inner.studioware.com Hello root@localhost, pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE 15728640
250-DSN
250-ETRN
250-AUTH PLAIN
250-STARTTLS
250-DELIVERBY
250 HELP
quit
221 2.0.0 inner.studioware.com closing connection

In this example the STARTTLS keyword appears, showing that this site supports TLS. If the STARTTLS keyword does not appear, check file /var/log/maillog for error messages or launch again the sendmail command, adding debug option -O LogLevel=14. Errors will be displayed on the console.

If the STARTTLS keyword appears, then TLS is available to cipher the communication and to verify the certificates of the connecting clients. To test this, it is possible to use the s_client command of openssl. The result can be observed in file /var/log/maillog. If the log line includes verify=OK, then the certificate has been successfully verified. If it includes verify=NO, then no certificate has been used, and if it includes verify=FAIL, the certificate verification step has failed. Notice that this failure does not prevent the software from using encryption. Only that the other party was not authenticated by sendmail. 

# openssl s_client -connect inner:25 -starttls smtp -cert /etc/ssl/certs/mtacert.pem -key /etc/ssl/private/mtakey.pem
. . .
# vi /var/log/maillog
. . .
Oct 15 10:42:00 inner sm-mta[24527]: STARTTLS=server, relay=IDENT:0@desktop.studioware.com [192.168.0.2], version=TLSv1.2, verify=OK, cipher=DHE-RSA-AES256-GCM-SHA384, bits=256/256

To use the PLAIN authentication, enter auth plain authent on a single line, where authent is a base64 encoded string composed of a null character, followed by the user name, followed by a null character, followed by the password. In practise, authent may be obtained by typing : 

# base64 -
<ctrl>@username<ctrl>@password<ctrl>d<ctrl>d

To effectively check certificates

To effectively use STARTTLS to allow relaying based on certificates or to restrict incoming or outgoing connections, you need to use specific macros in sendmail rulesets, please see the instructions in http://www.sendmail.org/~ca/email/starttls.html. If using your own (self-signed) Certification Authority Certificate, you need to place it in your in your /etc/ssl/certs directory with a symbolic link whose name must be based on the certificate hash code. This can be done in this way : 

# C=CACertificateFileName
# ln -s $C `openssl x509 -noout -hash < $C`.0

Errors in /var/log/maillog

The message did not issue MAIL/EXPN/VRFY/ETRN during connection to MTA in log file /var/log/maillog means that a remote server connected to your site but closed the connection before actually sending any mail. This is probably related to malicious behaviour to connect to, scan, or exploit vulnerabilities of your site. Observing the line with wireshark with filter port smtp will afford checking what really happens. Here are a few interesting additional comments about this issue.


Cyrus-SASL Main Page Cyrus-IMAP
Retrieved from "http://studioware.com/wikislax/index.php?title=Cyrus-SASL&oldid=26"