Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Sendmail

|

279

Configuring SASL for client-server authentication

If your Sendmail server needs to authenticate individual users (e.g., “road warrior”

remote users) instead of other servers, SASL configuration is much simpler. All we

need to do is create a /usr/lib/sasl/Sendmail.conf file that sets

pwcheck_method to pam

(Example 9-13).

And that’s it! Since SASL will use the existing local PAM mechanism present on all

Linux systems to authenticate prospective relays, there’s no need to create /etc/

sasldb.

Once /usr/lib/Sendmail.conf and /etc/sasldb are ready, we must configure Sendmail for

authentication. If you’re doing so as you read this (and yours is a client-server relay

scenario), skip to “Configuring Sendmail for client-server authentication.”

Your distribution’s SASL package may support other authentication

methods besides those described in this chapter (if so, those methods

may require additional RPM or deb packages—e.g., cyrus-sasl-md5).

Although one or more of these other methods may be a viable option

for authenticating your remote users,

pam is the most convenient

method on most Linux systems, which is why I’m focusing on that

method here.

Configuring Sendmail for server-server authentication

There are two files to edit to prepare our Sendmail server to authenticate other serv-

ers ...