Sendmail, 3rd Edition

Vendor Versus Compiling

Should you compile sendmail from the source or obtain it from a vendor? Vendors tend to ship old versions of sendmail with their operating systems. Current versions of operating systems frequently ship V8.11 sendmail. Very old versions of sendmail should be replaced because they are insecure. Newer versions should also be replaced because the latest version (V8.12) contains many new and valuable features.

To find out which version you are running, issue the following command:^[1]

% /usr/sbin/sendmail -d0.1 -bt < /dev/null

The first line (of possibly many) printed should contain the version number. If no version is displayed, you might be running a very old version of sendmail indeed, or some other program masquerading as sendmail. In either instance, you should upgrade.

If V8.9.2 or earlier is displayed, you should plan to upgrade. V8.9.3 was the last secure version of the V8.9 series.

If V8.11.5 or earlier is displayed, you should plan to upgrade. V8.11.6 was the last secure version of the V8.11 series.

A more difficult decision is whether to upgrade to V8.12 if you are already running V8.9.3 or V8.11.6 sendmail. Potential reasons for upgrading are as follows:

Security

The sendmail program has always been a prime target of attack by crackers (probably because it is distributed as fully commented source code). Although sendmail has been secure since V8.11.6, one of your C-language libraries might not be. If you have been notified of a security hole in your ...