Sendmail

[hokiegal99]

How do you convince “web masters’ to patch the software on their servers? The site in question has been broken into several times (the latest about a year and a half ago) and used in several DDoS attacks. The “web master” installed a newer version of Red Hat Linux after the last break-in, but once again has not patched it since the original install. The server has old versions of Sendmail, BIND, Apache, etc. all with exploits of some kind... especially Sendmail and BIND. If it hasn’t been broken into already, it will be soon, and I’d like to avoid it if possible as I’ll be asked to help reinstall the thing again. But as soon as the site is back up and running, they won’t let me near the machine, and when I ask them if they’ve patched it, they’ll say they have, but when I telnet to the machine’s port 25 and see Sendmail 8.11.6 I *know* they have not and that they are asking for trouble... any advice?

[kenny]

I know several people that visit these forums have all had to deal with shit like this. Sadly there are not too many options, for me it was easy... My boss who was guilty of shit like this got fired. The best thing i could tell you is go above his head. It sounds shitty, but if you like the place you are working at and don't want to see it continue to go downward go above his head.

On your own time, and without the knowledge of others you could always audit the network and prepare a write up for whoever runs the business and show them the holes, the risks they face with these holes and how you or they could fix them. The downside to this though is that by doing this you could put your job at risk, loose it and/or make plenty of enemies that could make work a shitty place.

[cold]

Sendmail is the 'default' mail server with most UNIX-based systems. If I were you, I would convince the posse to migrate to qmail. It was based on sendmail, but is faster and more secure. There is also a security package that includes qmail, spam-killers, etc. You can get that @ qmailrocks.org. Hope this helps.

PS I know I'm late as shit, but I couldn't help myself.. The compultions! The compultions!!!