topic sendmail as cron in Operating System - HP-UX

sendmail as cron

kholikt — Tue, 11 Jan 2005 04:23:47 GMT

Hi,

I am doing some security compliant check I was thinking of disable sendmail daemon and run it as cron. Is this advisable to do so?

3,18,33,48 * * * * /usr/sbin/sendmail -q >/dev/null2>&1

Re: sendmail as cron

Peter Godron — Tue, 11 Jan 2005 04:38:07 GMT

Unless a justifiable reason exists I would not run it from cron, as error tracking may get a lot harder.
What would be the difference between having it running at all times and every 15 minutes?

Re: sendmail as cron

Ravi_8 — Tue, 11 Jan 2005 04:39:20 GMT

Hi,

sendmail daemon must be running if the sendmail need to run, If you disable it, cronjob gives the error

Re: sendmail as cron

Gordon Morrison — Wed, 12 Jan 2005 04:48:20 GMT

I experimented with this when looking into increasing security, as it is one of the recommendations in the CIS Benchmark for HP-UX (See http://www.CISecurity.org)
I found it to be more trouble than it's worth. The main problem is that this setup prevents the host from receiving any email from outside. The cron job flushes outgoing email, but it will never collect. Users on the same node can send and receive to each other, but that machine won't accept any email from outside.

Re: sendmail as cron

Peter Godron — Fri, 28 Jan 2005 05:48:53 GMT

Hi,
what was the solution/decision on this in the end? What was the reasoning on choosing the particular solution?

Re: sendmail as cron

Thierry Poels_1 — Fri, 28 Jan 2005 06:15:21 GMT

Hi,

there's no need to run the sendmail daemon continiously if your server does not receive mail, or doesn't act as a gateway.
You don't need sendmail to send mails :)

And because there were (and probably still are) many security issues with sendmail it's a damn good idea to disable the daemon and run it periodicaly throug cron.

regards,
Thierry.

Re: sendmail as cron

Elmar P. Kolkman — Fri, 28 Jan 2005 08:08:21 GMT

Thierry is right, of course...
On a node where you won't receive mail, only send it, this is a good idea. Though there is no need to run it every 15 minutes, normally, because if a user sends mail, it will first try to send it directly and only if that doesn't succeed at once, it is placed in the queue. So only if the relay or receiving mail server doesn't respond when the mail is sent initially, you need the flushing proces started with cron...