Ok not linux but AIX and secure sendmail setup

cyph3r7 · 08-05-2003, 05:51 AM

The scenario:

Background:

Secure server running AIX in a DMZ. Has scripted cron jobs which monitor processes and notify admins if things go wrong via sendmail. Currently listening on default interface for port 25.

Issue:

Do not want sendmail to listen on port 25, or any for that matter. Only to be configured to send and flush queue.

Suggested solutions:

1) Run send mail from loopback interface only. Add line DaemonPortOptions=Port=smtp,Addr=127.0.0.1, Name=MTA in /etc/sendmail.cf. This is currently done on secure Red Hat and FreeBSD servers without issue.

2) Configure sendmail for inetd process. Create sendmail script and place in inetd.d directory to force sendmail to run outbound only. Add cron "10 * * * * /usr/sbin/sendmail -q" to run and flush queue every 10 minutes. With this option sendmail will respond to port 25 when a request is made however will not always be listening.

3) Implement both above solutions.

Request for comments:

Looking for suggestions as to best practice for the above scenario. I have and currently use option one on all of my servers without issue but thought I would get some feedback from the grey matter here on this board.

Thanks!

bentz · 08-05-2003, 08:49 AM

I suggest that you not run sendmail as a daemon at all, if it is not accepting incoming mail delivery. If your cron jobs are doing thier job at keeping the mail queue moving, then it is not nessasary to run sendmail as a daemon. Knowing nothing about AIX, I can't illude as how to take it out of the init process. If it is SYSV based, there will be a script under /etc/init.d that you can simply remove the executable permission and it will be disabled (but no deleted) from startup. From the language of your message, you are already familiar with all of this and I'm now asking myself, "why am I explaining this?". I hope this helps, good luck.

cyph3r7 · 08-05-2003, 10:44 AM

yeah dude I actually thought the same thing on the way to work. I think we will go this route of cron helping out.

cyph3r7 · 08-06-2003, 06:26 AM

Just a follow up:

First bentz, thanks you pointed me to the K.I.S.S. principle. (For those who don't know, Keep It Simple Stupid, not the rock band.)

Anyway, we tried the approach of disabling from inet on boot and running the daemon like so "sendmail -q 60m"

works like a champ, thanks bro....

bentz · 08-06-2003, 08:12 AM

No problem! I'm glad it's working for you.