Background: Every few months CERT announces Yet Another Security Hole In
Sendmail---something that lets local or even remote users take complete
control of the machine. I'm sure there are many more holes waiting to be
discovered; sendmail's design means that any minor bug in 46000 lines of
code is a major security risk. Other popular mailers, such as Smail, and
even mailing-list managers, such as Majordomo, seem nearly as bad.

Note added in 1998: I wrote the above paragraph in December 1995, when
the latest version of sendmail was 8.6.12 (with 41000 lines of code).
Fourteen security holes were discovered from sendmail 8.6.12 through
8.8.5. See http://pobox.com/~djb/docs/maildisasters/sendmail.html.

I started working on qmail because I was sick of this cycle of doom.
Here are some of the things I did to make sure that qmail will never let
an intruder into your machine.


1. Programs and files are not addresses. Don't treat them as addresses.

sendmail treats programs and files as addresses. Obviously random people
can't be allowed to execute arbitrary programs or write to arbitrary
files, so sendmail goes through horrendous contortions trying to keep
track of whether a local user was ``responsible'' for an address. This
has proven to be an unmitigated disaster.

In qmail, programs and files are not addresses. The local delivery
agent, qmail-local, can run programs or write to files as directed by
~user/.qmail, but it's always running as that user. (The notion of
``user'' is configurable, but root is never a user. To prevent silly
mistakes, qmail-local makes sure that neither ~user nor ~user/.qmail is
group-writable or world-writable.)

Security impact: .qmail, like .cshrc and .exrc and various other files,
means that anyone who can write arbitrary files as a user can execute
arbitrary programs as that user. That's it.


2. Do as little as possible in setuid programs.

A setuid program must operate in a very dangerous environment: a user is
under complete control of its fds, args, environ, cwd, tty, rlimits,
timers, signals, and more. Even worse, the list of controlled items
varies from one vendor's UNIX to the next, so it is very difficult to
write portable code that cleans up everything.

Of the twenty most recent sendmail security holes, eleven worked only
because the entire sendmail system is setuid.

Only one qmail program is setuid: qmail-queue. Its only purpose is to
add a new mail message to the outgoing queue.


3. Do as little as possible as root.

The entire sendmail system runs as root, so there's no wa                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              