1

I'd like to entirely disable AUTH on my home server's sendmail on Fedora 21, mostly because the constant fail2ban Emails are annoying, coming from constant CRAM-MD5 brute force attempts to get my server to serve as a relay. Disabling AUTH removes this whole category of attack. What I'd like is that the only authorization for relaying is the file /etc/mail/access, and that my sendmail not even accept AUTH commands.

When I wireshark an SMTP connection or when I use telnet to test my sendmail, after EHLO it responds:

250-<hostname> Hello [<remote host>], pleased to meet you 
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE
250-DSN
250-AUTH GSSAPI DIGEST-MD5 CRAM-MD5
250-DELIVERBY
250 HELP 

My sendmail config has these commented out lines:

dnl TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
dnl define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl

I'm wondering if simply configuring

TRUST_AUTH_MECH(`')dnl Empty list to disable auth
define(`confAUTH_MECHANISMS', `')dnl Empty list to disable auth

is sufficient. I also wonder if there will be unexpected side effects, such as being unable to send mail to a server using AUTH. I've tried to search for information about this, but I've only found people who want AUTH but can't get it working, and client problems with AUTH. I don't want to assume that an empty list does what I want, and no documentation I've found says explicitly how to completely disable AUTH.

Edit: I could disable fail2ban email notification (although I find it useful) or increase my ban time (good idea for AUTH as no legitimate connection will use it on my server). I still want to disable AUTH. I think I'm more secure if I do so. If disabled, future bugs in this area won't be my security holes.

  • fail2ban doesn't send emails, unless you configure it to do something that involves sending emails. How about simply changing your fail2ban configuration to, say, block these hosts outright for a long period of time (on the order of days)? – a CVn Oct 26 '15 at 21:27
  • I hit a bug earlier this year where fail2ban would crash. Not seeing a single notification for 24 hours was a clear sign. I think that's fixed, but the notifications are still useful as long as it's not from an unrelenting hacker who won't give up. Good idea on increasing ban time for AUTH. I updated the question to indicate why I think disabling AUTH is still a good idea. – Eddie Oct 27 '15 at 1:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.