Changes in Version 8.13 of sendmail

Although this version of sendmail provides many new features, the FallBackSmartHost option is the most significant addition. Because of this option you no longer need to use main.cf and subsidiary.cf. The main.cf file was used in environments that supported MX records. The subsidiary.cf file was used in environments without a fully operative DNS. In such environments a smart host was used instead of MX records. The FallBackSmartHost option provides unified configuration. It operates like an MX record of last possible preference for all environments. To ensure that mail gets delivered to clients, this option, if enabled, provides a well-connected (or smart) host that serves as a backup (or failover) for MX records that fail.

For more information about version 8.13, see the following sections:

• Additional Command-Line Options in Version 8.13 of sendmail

• Additional and Revised Configuration File Options in Version 8.13 of sendmail

• Additional and Revised FEATURE() Declarations in Version 8.13 of sendmail

Additionally, SMTP can run with Transport Layer Security (TLS). See the following description.

Support for Running SMTP With TLS in Version 8.13 of sendmail

Communications between SMTP servers and clients are not usually controlled or trusted on either end. This lack of security might allow a third party to monitor and even alter a communication between a server and a client. SMTP can use Transport Layer Security (TLS) in version 8.13 of sendmail to resolve this problem. This extended service to SMTP servers and clients provides the following:

• Private, authenticated communications over the Internet

• Protection from eavesdroppers and attackers

STARTTLS is the SMTP keyword that initiates a secure SMTP connection by using TLS. This secure connection might be between two servers or between a server and a client. A secure connection is defined as follows:

• The source email address and the destination address are encrypted.

• The content of the email message is encrypted.

When the client issues the STARTTLS command, the server responds with one of the following:

• 220 Ready to start TLS

• 501 Syntax error (no parameters allowed)

• 454 TLS not available due to temporary reason

The 220 response requires the client to start the TLS negotiation. The 501 response notes that the client incorrectly issued the STARTTLS command. STARTTLS is issued with no parameters. The 454 response necessitates that the client apply rule set values to determine whether to accept or maintain the connection.

Note that to maintain the Internet's SMTP infrastructure, publicly used servers must not require a TLS negotiation. However, a server that is used privately might require the client to perform a TLS negotiation. In such instances, the server returns this response:

530 Must issue a STARTTLS command first

The 530 response instructs the client to issue the STARTTLS command to establish a connection.

The server or client can refuse a connection if the level of authentication and privacy is not satisfactory. Alternately, because most SMTP connections are not secure, the server and client might maintain an unsecure connection. Whether to maintain or refuse a connection is determined by the configuration of the server and the client.

Support for running SMTP with TLS is not enabled by default. TLS is enabled when the SMTP client issues the STARTTLS command. Before the SMTP client can issue this command, you must set up the certificates that enable sendmail to use TLS. See How to Set SMTP to Use TLS. Note that this procedure includes defining new configuration file options and rebuilding your sendmail.cf file.

Configuration File Options for Running SMTP With TLS

The following table describes the configuration file options that are used to run SMTP with TLS. If you declare any of these options, use one of the following syntaxes:

• O OptionName=argument # for the configuration file

• -O OptionName=argument # for the command line

• define(`m4Name',argument) # for m4 configuration

Table 3-12 Configuration File Options for Running SMTP With TLS

For sendmail to support SMTP's use of TLS, the following options must be defined:

• CACertPath

• CACertFile

• ServerCertFile

• ClientKeyFile

Other options are not required.

Macros for Running SMTP With TLS

The following table describes the macros that are used by the STARTTLS command.

Table 3-13 Macros for Running SMTP With TLS

Rule Sets for Running SMTP With TLS

The following table describes rule sets that determine whether an SMTP connection that uses TLS should be accepted, continued, or refused.

Table 3-14 Rule Sets for Running SMTP With TLS

For more information, see http://www.sendmail.org/m4/starttls.html.

Security Considerations Related to Running SMTP With TLS

As a standard mail protocol that defines mailers that run over the Internet, SMTP is not an end-to-end mechanism. Because of this protocol limitation, TLS security through SMTP does not include mail user agents. Mail user agents act as an interface between users and a mail transfer agent such as sendmail.

Also, mail might be routed through multiple servers. For complete SMTP security the entire chain of SMTP connections must have TLS support.

Finally, the level of negotiated authentication and privacy between each pair of servers or a client and server pair must be considered. For more information, see Authentication Services in Oracle Solaris 11.1 Administration: Security Services.

Additional Command-Line Options in Version 8.13 of sendmail

The following table describes additional command-line options that are available in version 8.13 of sendmail. Other command-line options are described in the sendmail(1M) man page.

Table 3-15 Command-Line Options Available in Version 8.13 of sendmail

Additional and Revised Configuration File Options in Version 8.13 of sendmail

The following table describes the added and revised configuration file options. If you declare any of these options, use one of the following syntaxes.

O OptionName=argument          # for the configuration file
-O OptionName=argument         # for the command line
define(`m4Name',argument)     # for m4 configuration

Table 3-16 Configuration File Options Available in Version 8.13 of sendmail

Additional and Revised FEATURE() Declarations in Version 8.13 of sendmail

The following table describes the added and revised FEATURE() declarations. This m4 macro uses the following syntax.

FEATURE(`name', `argument')

Table 3-17 FEATURE() Declarations Available in Version 8.13 of sendmail

FEATURE(`local_lmtp', `/usr/local/bin/lmtp', `lmtp')