This question title might seem a little vague, and I apologize for that. Let me just begin by stating I'm an engineering psychologist—not an IT security or computer guru by trade. As luck would have it, my employer (a very, very big one) has placed me on a small team where I work on a mission critical server that can (ideally) never fail and has to have the utmost security. I do web design, accessibility analysis, user experience stuff — all front-end. Without really thinking about it and without any regard to my skills or background, someone up the chain unwittingly placed me in charge of also making sure the entire system is secure, as at one point our website was listed on senderbase.org with a poor reputation rating.

One of my co-workers seems to think that unix's Sendmail is the root of the problem. Concordantly, we blocked all traffic on port 25 and stopped running sendmail. But because of that, my contact forms using php mail() don't work (requires sendmail). I was told that "there is no way to use SMTP on a server and have a secure server." But I'm less certain of this.

On a clean, uninfected system with ideal security, could sendmail be targeted from the outside and used to send spam email? In other words, are there any secure ways to send emails server side? Or will I have to convert all my contact forms to "mailto:" links, etc?

To be clear: the location of the mail is to a support email we use. It is hardcoded; all email gets sent to this email address and the user cannot change this (unless there are hacking techniques I'm unaware of, which is really my question). The only fields the user can type in are Subject, Message, and From.

There obviously has to be some solution because I see email contact forms all the time on huge, powerful websites. If it was a security weakness, you'd think google, yahoo, facebook, cnn, times, and all those other popular websites would have stopped using it long ago, right?

  • 1
    There are some very troubling ideas in your post. First there is a disconnect levying security requirements and designating you as the responsible party. There are descriptions that make me think that someone wants this server to be very secure, but I don't see anything to indicate that the email traffic is significantly valueable (to a potential adversary). Why are you adding a potentially insecure email server to a mission critical server? Do you have legal obligations to protect the email? Are you being given resources suitable for the task? – this.josh Aug 23 '11 at 3:17
  • 2
    Holy f**. You are not a security expert, and you're not going to become one overnight. A big company really really should spend the extra money for an actual security expert for their mission critical systems, and leave you to do the things you're good at. This is not the place to cut corners. – tdammers Aug 23 '11 at 8:18
  • Put the email stuff on a different server. Let some other company host and run that server. Also, email is never mission critical, because email can fail for a bunch of different reasons outside your control. – DanBeale Aug 23 '11 at 12:15

There is a difference between a mail server that sends emails and a mail server that receives emails from outside. In your case you do not need to receive emails from the outside, so the mail server does not need to listen on port 25.

It is true that sendmail has a long history of security issues and a extremely complex configuration language (there is even a macro language to make configuration simpler).

sendmail is not used on current Linux distribution anymore but there is a number of drop in replacements such as qmail, exim or postfix that will provide a compatible interface and a symlink called /usr/bin/sendmail. If that symlink is used, they will parse the common command line parameters the same way as the original sendmail did.

On Windows you need to edit the [mail function] section of php.ini to point to an external email server. Since you are sending emails to a fix target domain, it can be the mail exchange server that is responsible to receive emails for that domain. Use host -t mx example.com to learn the name.

  • +1 for qmail. "Some thoughts on security after ten years of qmail 1.0" starts off with a deserved dig at sendmail "I started writing an MTA, qmail, in 1995, because I was sick of the security holes in Eric Allman’s 'Sendmail' software." and goes on to give a great explanation of the design decisions that made qmail a much more secure alternative. – Mike Samuel Aug 23 '11 at 21:11

If you allow your mail server to send mail on behalf of a user on the internet, then prepare to be abused. This scenario has been deprecated for some time now.

If you run a mail server accessible from the internet, you require some form of appropriate authentication. For many, this is too complex, so rewriting your application to either use mailto: links to force the user's mail client to send the email, or a mail form which enforces the email recipients serverside.

Essentially, you should take the stance that if it is on the Internet it should not be trusted.

It may help if you explained what type of email you are trying to send. Is it just email to a support mailbox? If so, hard code it. If there are a range of mailboxes, again - have them specified in drop down boxes and validate serverside.

If you are trying to act as an open mail relay, you'll probably want to rethink that decision as you will get blacklisted pretty quickly.

  • All the emails go the same place, it is hardcoded in. The only form fields are Subject, Message, and From. I sanitize the form input as it's grabbed in PHP, too, in order to prevent injection. – stoicfury Aug 23 '11 at 0:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.