Securing and Optimizing Linux: RedHat Edition -A Hands on Guide
Prev Chapter 22. Software -Server/Mail Network Next

22.12. Limit queue processing to root

Ordinarily, anyone may process the queue with the -q switch. To limit queue processing to root and the owner of the queue directory, you must specify the restrictqrun option in the /etc/mail/sendmail.cf file.

Edit the sendmail.cf file, vi /etc/mail/sendmail.cf and change the line:


         O PrivacyOptions=authwarnings,goaway,restrictmailq
To read: 

         O PrivacyOptions=authwarnings,goaway,restrictmailq,restrictqrun

Now re-start the sendmail process manually for the change to take effect:


         [root@deep] /# /etc/rc.d/init.d/sendmail restart
         

         Shutting down sendmail:                                          [  OK  ]
         Starting sendmail:                                             [  OK  ]
Any non-privileged user who attempts to process the queue will get this message: 

         [user@deep /]$ /usr/sbin/sendmail -q
         

         You do not have permission to process the queue

22.12.1. The SMTP greeting message

When Sendmail accepts an incoming SMTP connection it sends a greeting message to the other host. This message identifies the local machine and is the first thing it sends to say it is ready.

Edit the sendmail.cf file, vi /etc/mail/sendmail.cf and change the line:


         O SmtpGreetingMessage=$j Sendmail $v/$Z; $b
To read: 

         O SmtpGreetingMessage=$j
Now re-start the sendmail process manually for the change to take effect: 

         [root@deep] /# /etc/rc.d/init.d/sendmail restart
         

         Shutting down sendmail:                                          [  OK  ]
         Starting sendmail:                                             [  OK  ]

Tip: This change doesn't actually affect anything, but was recommended by folks in the news.admin.net-abuse.email newsgroup as a legal precaution. It modifies the banner, which Sendmail displays upon receiving a connection.

Do set the immutable bit on important Sendmail files, important Sendmail files can be set immutable for better security with the chattr command of Linux. A file with the +i attribute cannot be modified, deleted or renamed. No link can be created to this file, and no data can be written to the file. Only the super-user can set or clear this attribute.

  1. Set the immutable bit on the sendmail.cf file:

    
         [root@deep] /# chattr  +i /etc/mail/sendmail.cf

  2. Set the immutable bit on the local-host-names file:

    
         [root@deep] /# chattr  +i /etc/mail/local-host-names

  3. Set the immutable bit on the aliases file:

    
         [root@deep] /# chattr  +i /etc/mail/aliases

  4. Set the immutable bit on the access file:

    
         [root@deep] /# chattr  +i /etc/mail/access

Further documentation and for more details, there are several man pages you can read:

aliases(5)

- aliases file for sendmail

makemap(8)

- create database maps for sendmail

sendmail(8)

- an electronic mail transport agent

mailq(1)

- print the mail queue

newaliases(1)

- rebuild the data base for the mail aliases file

mailstats(8)

- display mail statistics

praliases(8)

- display system mail aliases

Prev Home Next
The /etc/mail/aliases file Up Sendmail Administrative Tools