sendmail as cron

[kholikt]

Hi,

I am doing some security compliant check I was thinking of disable sendmail daemon and run it as cron. Is this advisable to do so?

3,18,33,48 * * * * /usr/sbin/sendmail -q >/dev/null2>&1

[Peter Godron · Accepted solution]

Unless a justifiable reason exists I would not run it from cron, as error tracking may get a lot harder.
What would be the difference between having it running at all times and every 15 minutes?

[Ravi_8]

Hi,

sendmail daemon must be running if the sendmail need to run, If you disable it, cronjob gives the error

[Gordon Morrison]

I experimented with this when looking into increasing security, as it is one of the recommendations in the CIS Benchmark for HP-UX (See http://www.CISecurity.org)
I found it to be more trouble than it's worth. The main problem is that this setup prevents the host from receiving any email from outside. The cron job flushes outgoing email, but it will never collect. Users on the same node can send and receive to each other, but that machine won't accept any email from outside.

[Peter Godron]

Hi,
what was the solution/decision on this in the end? What was the reasoning on choosing the particular solution?

[Thierry Poels_1]

Hi,

there's no need to run the sendmail daemon continiously if your server does not receive mail, or doesn't act as a gateway.
You don't need sendmail to send mails :)

And because there were (and probably still are) many security issues with sendmail it's a damn good idea to disable the daemon and run it periodicaly throug cron.

regards,
Thierry.

[Elmar P. Kolkman]

Thierry is right, of course...
On a node where you won't receive mail, only send it, this is a good idea. Though there is no need to run it every 15 minutes, normally, because if a user sends mail, it will first try to send it directly and only if that doesn't succeed at once, it is placed in the queue. So only if the relay or receiving mail server doesn't respond when the mail is sent initially, you need the flushing proces started with cron...