Sendmail

Sendmail headquarters in Emeryville (in the same building as Jamba Juice).

Sendmail is a mail transfer agent (MTA) that supports many kinds of mail transfer and delivery including the overwhelmingly popular SMTP.

A descendant of delivermail program written by Eric Allman, Sendmail is a well-known project of the free and open source software and Unix communities, and is distributed both as free software and proprietary software.

History and use

Allman had written the original ARPANET delivermail which was shipped in 1979 with 4.0 and 4.1 BSD. Sendmail, a derivative, was written in the early 1980s at UC Berkeley, and shipped with BSD 4.1c in 1983 (the first BSD version to include TCP/IP).

Sendmail remains the most popular MTA on the Internet. Its popularity is due in part to its position as the standard MTA under most variants of the Unix operating system.^{[citation needed]} According to latest D. J. Bernstein SMTP survey^[1], as of November 2001^[update] approximately 42% of the publicly reachable mail servers on the Internet were running Sendmail. More recent surveys have suggested a decline, with 29.4% of mail servers in August 2007 detected as running Sendmail in a study performed by E-Soft, Inc.^[2] Sendmail is trailed by Microsoft Exchange Server, Exim, and Postfix, these four being the only mail servers with more than 10% of the installed base.

Sendmail can be difficult to configure. Whereas nearly all popular Unix based server software has human readable configuration files, Sendmail's configuration is not considered human readable. Instead, the Sendmail authors recommend that administrators learn and use macro language tools, particularly M4 to configure Sendmail. Sendmail is unique amongst Unix based MTAs in this requirement, and no MTA developed since Sendmail requires or recommends the use of macro languages for configuration.

Sendmail supports a variety of mail transfer protocols, including SMTP, ESMTP, DECnet's mail11, HylaFax, QuickPage and UUCP. Additionally, Sendmail v8.12 as of September 2001^[update] introduced support for milters - external mail filtering programs that can participate in each step of the SMTP conversation.

Security

Sendmail originated in the early days of the modern Internet, an era when security was not a primary consideration in the development of network software. Early versions of Sendmail suffered from a number of security vulnerabilities that have been corrected over the years.

Sendmail itself incorporated a certain amount of privilege separation in order to avoid exposure to security issues. Current versions of Sendmail, like other modern MTAs, incorporate a number of security improvements and optional features that can be configured to improve security and help prevent abuse.

Sendmail X / MeTA1

The next generation of Sendmail was initially called Sendmail X (previously it was called Sendmail 9, but is not an evolution of the Sendmail version 8 code base). However, the development of Sendmail X was stopped in favor of a new project called MeTA1.

The first release of Sendmail X (smX-0.0.0.0) was made available on October 30, 2005. The final release was smX-1.0.PreAlpha7.0., released on May 20, 2006 under the same license used by Sendmail 8.

Development on MeTA1 continues, with the released code at the pre-alpha stage as of October 2008.

Sendmail-8

Releases

• Sendmail-8.14.3 2008-05-03
• Sendmail-8.14.2 2007-11-01
• Sendmail-8.14.1 2007-04-03
• Sendmail-8.14.0 2007-01-31
• Sendmail-8.13.0 2004-06-20
• Sendmail-8.12.0 2001-09-08
• Sendmail-8.11.0 2000-07-19
• Sendmail-8.10.0 2000-03-01
• Sendmail-8.9.0 1998-05-19
• Sendmail-8.8.0 1996-09-26
• Sendmail-8.7 1995-09-16
• Sendmail-8.6 1993-10-05
• ...
• Sendmail-8.1 1993-06-07 - 4.4BSD freeze. No semantic changes.

The information is based on RELEASE_NOTES file from sendmail distribution.

History of vulnerabilities

Sendmail vulnerabilities in CERT advisories and alerts.

• "TA06-081A Sendmail Race Condition Vulnerability". US-CERT Alerts. http://www.us-cert.gov/cas/techalerts/TA06-081A.html. 
• "CA-2003-25 Buffer Overflow in Sendmail". CERT Advisories. http://www.cert.org/advisories/CA-2003-25.html. Retrieved on January 7 2005. 
• "CA-2003-12 Buffer Overflow in Sendmail". CERT Advisories. http://www.cert.org/advisories/CA-2003-12.html. Retrieved on January 7 2005. 
• "CA-2003-07 Remote Buffer Overflow in Sendmail". CERT Advisories. http://www.cert.org/advisories/CA-2003-07.html. Retrieved on January 7 2005. 
• "CA-1997-05 MIME Conversion Buffer Overflow in Sendmail Versions 8.8.3 and 8.8.4". CERT Advisories. http://www.cert.org/advisories/CA-1997-05.html. Retrieved on January 7 2005. 
• "CA-1996-25 Sendmail Group Permissions Vulnerability". CERT Advisories. http://www.cert.org/advisories/CA-1996-25.html. Retrieved on January 7 2005. 
• "CA-1996-24 Sendmail Daemon Mode Vulnerability". CERT Advisories. http://www.cert.org/advisories/CA-1996-24.html. Retrieved on January 7 2005. 
• "CA-1996-20 Sendmail Vulnerabilities". CERT Advisories. http://www.cert.org/advisories/CA-1996-20.html. Retrieved on January 7 2005. 

See also

• List of mail servers
• Mail Delivery Agent
• Mail User Agent
• The original UNIX-HATERS Handbook dedicated an entire chapter to the problems and weaknesses of sendmail.
• Internet messaging platform
• Morris worm an 1988 internet worm

References

External links

• Sendmail Consortium, sendmail.org
• Sendmail, Inc., sendmail.com
• Milter.org, Sendmail MILTERs [2]
• Daniel J. Bernstein, Internet SMTP server survey, October 2001
• Mike Brodbelt, A brief history of mail
• Lourier, Philippe (1999). "History of Sendmail: Interview with Eric Allman". Dr. Dobb's Journal. http://technetcast.ddj.com/tnc_program.html?program_id=32. 
• Eric Allman et al. (1999) (PDF). Sendmail Evolution: 8.10 and Beyond. http://www.sendmail.org/~gshapiro/Sendmail-8.10.Paper.pdf.  — presented at the USENIX Annual Technical Conference
• Williamson, Alan (2003-08-11). "A Talk with the Father of sendmail". LinuxWorld. http://linux.sys-con.com/read/33904.htm.