sendmail PrivacyOptions

[Fred Martin_1]

I can lock down sendmail a bit, by using PrivacyOptions. If I take the strict approach, am I going to potentially disallow some email that I actually want?

For example, 'noreceipts' stops declaring success on a delivery. 'noexpn' and 'novrfy' prevent queries on addresses and aliases.

But - would I keep valid (wanted) email from being delivered?

Fred

[Sridhar Bhaskarla]

Hi Fred,

noexpn and novrfy are used duriing the debugging phase. If I turn them off, then a person that does telnet to the SMPT port will not be able to verify or expand the local aliases. For ex.,

For a hacker the following will help

myid@[ mysystem ]=> telnet tobehacked 25
Trying...
Connected to tobehacked.
Escape character is '^]'.
220 tobehacked ESMTP Sendmail 8.9.3 (PHNE_18546)/8.7.1; Tue, 18 Feb 2003 14:30:47 -0600 (CST)
vrfy hackedlogin
250 To Be Hacked Fellow
quit

If you disable noexpn and novrfy, then it would be

myid@[ mysystem ]=> telnet tobehacked 25
Trying...
Connected to tobehacked.
Escape character is '^]'.
220 Your EMSTP activity is being monitored
vrfy hackedlogin
252 Cannot VRFY user; try RCPT to attempt delivery (or try finger)

Also consider changing the Greeting options.

No valid email will be rejected with the above options.

-Sri

[Christopher Caldwell]

You won't prevent any valid e-mail from being delivered. You will prevent some exploratory (invalid) e-mail from being delivered.

You'll also make your system more secure.

I've been happy with

O PrivacyOptions=goaway

[Fred Martin_1]

Exactly - I also considered 'goaway' but I was afraid I would start getting phone calls from my common business associates, with 'how come my email bounces back now?' -- I guess I can't get over the fear that there is a -valid- mail server out there that will not deliver mail that it can't explicitly get a 'success' returned, and so on.

I also learned a valuable lesson, although I am speculating at this point - if you leave expn turned on, and have an easily-guessed mail alias like 'everybody' ... you're asking for trouble.

[Fred Martin_1]

Let me ask this before I drop this thread...is there anyone that would disagree about setting the 'goaway' parameter - or any more comments about what it does exactly?

[Sridhar Bhaskarla · Accepted solution]

HI Fred,

Goaway disables all SMTP status queries which is like a superset of all other options.

You should be ok with it.

-Sri

[Fred Martin_1]

I have set the option to goaway, per Christopher's suggestion above.

Thanks folks,

Fred