SENDMAIL

'Sendmail' is a mail transfer agent (MTA) that is a well known project of the open source, free software and Unix communities, which is distributed both as free software and proprietary software.

Contents

History and use

Security

Sendmail X / MeTA1

Sendmail-8

Releases

History of Vulnerabilities

References

See also

External links

History and use

A descendant of the original ARPANET ''delivermail'' application, Sendmail is a remarkably flexible program, supporting many kinds of mail transfer and delivery including the overwhelmingly popular SMTP. The original version of Sendmail was written by Eric Allman in the early 1980s at UC Berkeley, who had also written delivermail previously. Delivermail was shipped in 1979 with 4.0 and 4.1 BSD. Sendmail was shipped with BSD 4.1c in 1983 (the first BSD version to include TCP/IP).
Sendmail remains the most popular MTA on the Internet. Its popularity is due in part to its position as the standard MTA under most variants of the Unix operating system. According to latest D. J. Bernstein SMTP survey[1], as of November 2001 approximately 42% of the publicly reachable mail servers on the Internet were running Sendmail. More recent surveys have suggested a decline, with 29.4% of mail servers in August 2007 detected as running Sendmail in a study performed by E-Soft, Inc. [2] Sendmail is trailed by Microsoft Exchange Server, Exim, and Postfix, these four being the only mail servers with more than 10% of the installed base.
As Sendmail is a complex package with a great deal of functionality, it can be difficult for an inexperienced system administrator to configure. Documentation of the Sendmail system has not always kept pace with changes to the administrative interfaces; despite the availability of macro-based configuration tools, many support websites instruct administrators to directly modify configuration files that should instead be managed by administrative tools. The failure of vendors to update their support materials contributes to the perception of Sendmail as a difficult-to-configure package.
The complexity of Sendmail does provide benefits, in the form of flexibility and scalability. Sendmail supports a variety of mail transfer protocols, including SMTP, ESMTP, DECnet's mail11, HylaFax, QuickPage and UUCP. Additionally, Sendmail v8.12 as of September 2001 introduced support for milters - external mail filtering programs that can participate in each step of the SMTP conversation.

Security

Sendmail originated in the early days of the modern Internet, an era when security was not a primary consideration in the development of network software. Early versions of Sendmail suffered from a number of security vulnerabilities that have been corrected over the years.
Sendmail itself incorporated a certain amount of privilege separation in order to avoid exposure to security issues. Current versions of Sendmail, like other modern MTAs, incorporate a number of security improvements and optional features that can be configured to improve security and help prevent abuse.

Sendmail X / MeTA1

The next generation of Sendmail was initially called Sendmail X (previously it was called Sendmail 9, but is not an evolution of the Sendmail version 8 code base). However, the development of Sendmail X was stopped in favor of a new project called MeTA1.
The first release of Sendmail X (smX-0.0.0.0) was made available on October 30 2005. The final release was smX-1.0.PreAlpha7.0., released on May 20 2006 under the same license used by Sendmail 8.
Development on MeTA1 continues, with the released code at the pre-alpha stage as of June 2007.

Sendmail-8

Releases

★ Sendmail-8.14.1 2007-04-03

★ Sendmail-8.14.0 2007-01-31

★ Sendmail-8.13.0 2004-06-20

★ Sendmail-8.12.0 2001-09-08

★ Sendmail-8.11.0 2000-07-19

★ Sendmail-8.10.0 2000-03-01

★ Sendmail-8.9.0 1998-05-19

★ Sendmail-8.8.0 1996-09-26

★ Sendmail-8.7 1995-09-16

★ Sendmail-8.6 1993-10-05

★ ...

★ Sendmail-8.1 1993-06-07 - 4.4BSD freeze. No semantic changes.
''The information is based on RELEASE_NOTES file from sendmail distribution.''

History of Vulnerabilities

Sendmail vulnerabilities in CERT advisories and alerts.

★ TA06-081A Sendmail Race Condition Vulnerability

★ CA-2003-25 Buffer Overflow in Sendmail

★ CA-2003-12 Buffer Overflow in Sendmail

★ CA-2003-07 Remote Buffer Overflow in Sendmail

★ CA-1997-05 MIME Conversion Buffer Overflow in Sendmail Versions 8.8.3 and 8.8.4

★ CA-1996-25 Sendmail Group Permissions Vulnerability

★ CA-1996-24 Sendmail Daemon Mode Vulnerability

★ CA-1996-20 Sendmail Vulnerabilities

References

★ sendmail, 3rd Edition, Bryan Costales with Eric Allman, , , O'Reilly and Associates, December 2002, ISBN — This is the Sendmail "bible" containing 1232 pages about Sendmail. It is also known as "The Bat Book", because of the picture on its cover. The 1st Edition was published in November 1993.

★ sendmail 8.13 Companion, Bryan Costales, George Jansen, Claus Assmann, Gregory Shapiro, , , O'Reilly and Associates, September 2004, ISBN — A companion to ''sendmail, 3rd Edition'', this book documents the improvements in V8.13 in parallel with its release.

★ sendmail Cookbook, Craig Hunt, , , O'Reilly, December 2003, ISBN

★ sendmail Performance Tuning, Nick Christenson, , , Addison-Wesley, 2002-09-13, ISBN [3]

See also

★ List of mail servers

★ Mail Delivery Agent

★ Mail User Agent

★ The original ''UNIX-HATERS Handbook'' dedicated an entire chapter to the problems and weaknesses of sendmail.

External links

★ Sendmail Consortium, sendmail.org

★ Sendmail, Inc., sendmail.com

★ Milter.org, Sendmail MILTERs [4]

★ Daniel J. Bernstein, Internet SMTP server survey, October 2001

★ Mike Brodbelt, A brief history of mail

★ History of Sendmail: Interview with Eric Allman Philippe Lourier

★ — presented at the USENIX Annual Technical Conference

★ A Talk with the Father of sendmail Alan Williamson