Why can I still send mail with the sendmail daemon shutdown?

[Craig A. Sharp]

We are talking about shutting down the sendmail daemon to protect from the latest vulnerability. http://secunia.com/advisories/19342

I am testing and with the sendmail daemon shutdown, I am still able to send out mail. Can someone explain why this is happening?

[Pete Randall]

The sendmail daemon receives mail. It does not need to be running in order to send mail. Check the man page.


Pete

[A. Clay Stephenson]

This is perfectly normal. Eventhough sendmail is not running as a deamon listening for requests --- necessary to receive mail --- a user can still either directly launch sendmail or indirectly through another mail front-end command (mailx, mail, elc, et al). Sendmail sends the mails and then exits when used in this way.

[Steven E. Protter]

Shalom Craig,

The sendmail binary can send mail without the daemon up. the daemon permits the reception of mail.

The binary will act according to the sendmail.cf configuration, so you can configure the server not to let mail off the system.

The sendmail folks consider this to be a feature.

SEP

[Craig A. Sharp]

ok thats great. So if I shutdown the daemon I should be protected from the vulnerability?

[Peter Godron]

Craig,
yes, that is correct.
The vulnerability is in the daemon, necessary for receiving mail.

[Geoff Wild]

Craig - that is correct - it is only for port 25...

You could remove sendmail altogether if you like - by deleting the sendmail binaries..

Rgds...Geoff

[Rick Garland]

One item that auditors look for is sendmail. If you have the sendmail daemon running this constitutes a security risk is their minds because the system will receive mail.

Having the daemon will still allow the system to send mail out but will not receive any mail.