Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

258

|

Chapter 9: Securing Internet Email

Sendmail Pros and Cons

On the plus side, Sendmail has a huge user community; as a result, it’s easy to find

both free and commercial support for it, not to mention a wealth of electronic and

print publications. It’s also stable and predictable, one of the most mature network

applications of all time.

On the downside, Sendmail has acquired a certain amount of “cruft” (layers of old

code) over its long history, resulting in a reputation of it being insecure and bloated.

Both charges are open to debate, however.

While it’s true that Sendmail has had a number of significant vulnerabilities over the

years, these have been brought to light and fixed very rapidly. An argument can

therefore be made that Sendmail security is a glass half-empty/half-full situation.

Depending on your viewpoint, Sendmail’s various vulnerability reports and subse-

quent patches may prove that Sendmail is inherently insecure; or perhaps the fact

that they come to light and are fixed quickly proves that Sendmail’s development

team and user community are pretty much on top of things, or maybe you think the

truth is somewhere in between. (I’m in this last camp.)

A more useful criticism is that Sendmail is monolithic: a vulnerability in one portion

of its functionality results in ...