Sendmail Authentication

From: Gerry Doris

Date: Monday, 18 March 2002 3:55 PM

The following are some instructions I pulled together for another list to help some Yahoo folks get authentication working.

SuSE includes instructions at the following url to add the authentication you want http://sdb.suse.de/en/sdb/html/sendmail_smtp_auth.html

Also, I got the following instructions from the Redhat list. This will enable several modes of authentication/encryption that you might find interesting. This allows your clients to authenticate with your sendmail server with something other than clear text.

***************

Please see the following instructions for setting up authentication with sendmail. This will allow LOGIN PLAIN to be authenticated using PAM. While not the greatest (clear text) it works for win clients by just checking their "server requires authentication" box and uses PAM for authentication with user id/password. pine clients can authenticate by adding "/user=userid" (userid is your real id) after the smtp server.

pine will automatically pick the best level of authentication. If you want to use SASL encryption then check out the following link. http://lists.suse.com/archive/suse-security/2001-Dec/0294.html

******************

This is from Rodolfo J. Paiz

The following are basic instructions on enabling SMTP AUTH on a late-model server. These instructions have been tested with Red Hat Linux 7.0 and 7.2, using sendmail versions 8.11.0 through 8.11.6 obtained in RPM form from Red Hat updates.

They *should* work; however, if they don't, I will *ONLY* attempt to help people resolve issues with SMTP AUTH on redhat-list or enigma-list, so that everyone gets the benefit of the questions & answers. No questions in private email will be answered. Also, note that I am not an expert so I may not even know the answers.

Give me feedback and I might just post this on the Web so people can get at it more conveniently. Having said that...

  1. Make sure all your clients are configured to authenticate to the mail server. They will not be able to send mail at all if they don't. Double-check; many people somehow check the wrong box.

    In Outlook or Outlook Express, in the section "Outgoing Mail" of each Internet Mail account, there is a checkbox labeled "My server requires authentication." Check that; the settings do not need to be changed since they are the same username/password they need to get mail.

    In Eudora, every Personality has a checkbox labeled "Authentication allowed". Eudora being somewhat more intelligent, this box is checked by default.

  2. Make sure you are root. If you logged in as a normal user, make sure you became root using "su -" to get the full login environment. "su" alone misses some things.

  3. Backup your sendmail.mc file by:
    # cp /etc/mail/sendmail.mc /etc/mail/sendmail.mc.bak
  4. The file /etc/mail/sendmail.mc needs to contain the following three lines:
    define(`confAUTH_OPTIONS', `A')dnl
    TRUST_AUTH_MECH(`DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
    define(`confAUTH_MECHANISMS', `DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
    

    Please note these are three lines only, be careful of the word wrap. Also, those are *directed quotes* not normal quotes. The left directed quote is< typed with the backtick or "accent grave" key (for those French among us), and the right directed quote is typed with the apostrophe.

  5. Backup the /etc/sendmail.cf (the file sendmail actually uses to run) by:
    # cp /etc/sendmail.cf /etc/sendmail.cf.bak
    
  6. Generate a new sendmail.cf file:
    # m4 /etc/mail/sendmail.mc > /etc/mail/sendmail.cf
    
  7. Copy your new sendmail.cf file over the old one:
    # cp /etc/mail/sendmail.cf /etc/sendmail.cf
    Overwrite /etc/sendmail.cf? y
    
  8. Verify that you have an /etc/pam.d/smtp file with the following contents:
    #%PAM-1.0
    auth       required     /lib/security/pam_stack.so service=system-auth
    account    required     /lib/security/pam_stack.so service=system-auth
    
  9. Verify that you have a /usr/lib/sasl/Sendmail.conf file with the following contents:
    pwcheck_method:pam
    
  10. Test that sendmail has correctly configured AUTH. Since you do not yet have any encrypted authentication mechanisms available, the only ones shown when you issue an EHLO command should be LOGIN and PLAIN.

    # telnet localhost 25
    Trying 127.0.0.1...
    Connected to localhost.
    Escape character is '^]'.<
    220 dude.com ESMTP Sendmail 8.11.6/8.11.6; Tue, 29 Jan 2002 07:24:49 -0600
    ehlo localhost
    250-dude.com Hello dude.com [127.0.0.1], pleased to meet you
    250-ENHANCEDSTATUSCODES
    250-8BITMIME
    250-SIZE
    250-DSN
    250-ONEX
    250-ETRN
    250-XUSR
    250-AUTH LOGIN PLAIN
    250 HELP
    quit
    221 2.0.0 dude.com closing connection
    Connection closed by foreign host.
    
  11. Test removing all relaying in the access map at 2:00 AM then trying to send mail. Do this by backing up your current /etc/mail/access and using something like this:

    # Check the /usr/share/doc/sendmail-8.11.6/README.cf file for a description
    # of the format of this file. (search for access_db in that file)
    # The /usr/share/doc/sendmail-8.11.6/README.cf is part of the sendmail-doc
    # package.
    #
    # by default we allow relaying from localhost...
    localhost.localdomain           RELAY
    localhost                       RELAY
    127.0.0.1                       RELAY
    
  12. Ensure that your file /etc/mail/relay-domains contains *only* the domains you host.

  13. Ensure that your sendmail.mc does not enable relaying in funny forms like "accept unresolvable domains", "relay by domain", or any of that crap. An example (complete) sendmail.mc which is relay-safe is included here:

    divert(-1)
    dnl This is the sendmail macro config file. If you make changes to this file,
    dnl you need the sendmail-cf rpm installed and then have to generate a
    dnl new /etc/sendmail.cf by running the following command:
    dnl
    dnl        m4 /etc/mail/sendmail.mc > /etc/sendmail.cf
    dnl
    include(`/usr/share/sendmail-cf/m4/cf.m4')
    VERSIONID(`linux setup for Red Hat Linux')dnl
    OSTYPE(`linux')
    define(`confDEF_USER_ID',``8:12'')dnl
    undefine(`UUCP_RELAY')dnl
    undefine(`BITNET_RELAY')dnl
    define(`confAUTO_REBUILD')dnl
    define(`confTO_CONNECT', `1m')dnl
    define(`confTRY_NULL_MX_LIST',true)dnl
    define(`confDONT_PROBE_INTERFACES',true)dnl
    define(`PROCMAIL_MAILER_PATH',`/usr/bin/procmail')dnl
    define(`ALIAS_FILE', `/etc/aliases')dnl
    dnl define(`STATUS_FILE', `/etc/mail/statistics')dnl
    define(`UUCP_MAILER_MAX', `2000000')dnl
    define(`confUSERDB_SPEC', `/etc/mail/userdb.db')dnl
    define(`confPRIVACY_FLAGS', `authwarnings,novrfy,noexpn,restrictqrun')dnl
    define(`confAUTH_OPTIONS', `A')dnl
    TRUST_AUTH_MECH(`DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
    define(`confAUTH_MECHANISMS', `DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
    dnl define(`confTO_QUEUEWARN', `4h')dnl
    dnl define(`confTO_QUEUERETURN', `5d')dnl
    dnl define(`confQUEUE_LA', `12')dnl
    dnl define(`confREFUSE_LA', `18')dnl
    dnl FEATURE(delay_checks)dnl
    FEATURE(`no_default_msa',`dnl')dnl
    FEATURE(`smrsh',`/usr/sbin/smrsh')dnl
    FEATURE(`mailertable',`hash -o /etc/mail/mailertable.db')dnl
    FEATURE(`virtusertable',`hash -o /etc/mail/virtusertable.db')dnl
    FEATURE(redirect)dnl
    FEATURE(always_add_domain)dnl
    FEATURE(use_cw_file)dnl
    FEATURE(use_ct_file)dnl
    FEATURE(local_procmail,`',`procmail -t -Y -a $h -d $u')dnl
    FEATURE(`access_db',`hash -o /etc/mail/access.db')dnl
    FEATURE(`blacklist_recipients')dnl
    EXPOSED_USER(`root')dnl
    dnl Change sendmail to only listen on the loopback interface and
    dnl the internal network interface; never accept outside traffic.
    dnl Add "dnl" to both DAEMON_OPTIONS lines to accept mail from
    dnl all network interfaces.
    dnl DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')
    dnl DAEMON_OPTIONS(`Port=smtp,Addr=192.168.0.1, Name=MTA')
    dnl NOTE: binding both IPv4 and IPv6 daemon to the same port requires
    dnl       a kernel patch
    dnl DAEMON_OPTIONS(`port=smtp,Addr=::1, Name=MTA-v6, Family=inet6')
    dnl We strongly recommend to comment this one out if you want to protect
    dnl yourself from spam. However, the laptop and users on computers that do
    dnl not have 24x7 DNS do need this.
    dnl FEATURE(`accept_unresolvable_domains')dnl
    dnl FEATURE(`relay_based_on_MX')dnl
    MAILER(smtp)dnl
    MAILER(procmai)dnl
    Cwlocalhost.localdomain
    
  14. Hover anxiously over the server for a couple of days and check for "Relaying denied" errors. Track them down aggressively as most will be your own customers. :) Fix their mail client configurations which they didn't fix before when you told them to.

  15. Get some sleep.

searchSearch Index