I'd like to entirely disable AUTH on my home server's sendmail on Fedora 21, mostly because the constant fail2ban Emails are annoying, coming from constant CRAM-MD5 brute force attempts to get my server to serve as a relay. Disabling AUTH removes this whole category of attack. What I'd like is that the only authorization for relaying is the file
/etc/mail/access, and that my sendmail not even accept AUTH commands.
When I wireshark an SMTP connection or when I use telnet to test my sendmail, after EHLO it responds:
250-<hostname> Hello [<remote host>], pleased to meet you 250-ENHANCEDSTATUSCODES 250-PIPELINING 250-8BITMIME 250-SIZE 250-DSN 250-AUTH GSSAPI DIGEST-MD5 CRAM-MD5 250-DELIVERBY 250 HELP
My sendmail config has these commented out lines:
dnl TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl dnl define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
I'm wondering if simply configuring
TRUST_AUTH_MECH(`')dnl Empty list to disable auth define(`confAUTH_MECHANISMS', `')dnl Empty list to disable auth
is sufficient. I also wonder if there will be unexpected side effects, such as being unable to send mail to a server using AUTH. I've tried to search for information about this, but I've only found people who want AUTH but can't get it working, and client problems with AUTH. I don't want to assume that an empty list does what I want, and no documentation I've found says explicitly how to completely disable AUTH.
Edit: I could disable fail2ban email notification (although I find it useful) or increase my ban time (good idea for AUTH as no legitimate connection will use it on my server). I still want to disable AUTH. I think I'm more secure if I do so. If disabled, future bugs in this area won't be my security holes.