semi-problem starting sendmail

[Chuck Swiger]

On Dec 8, 2009, at 9:42 AM, Robert Huff wrote:
> STARTTLS=server, error: SSL_CTX_use_PrivateKey_file(/etc/mail/CA/private/cakey.pem) failed
> 
> 	appears in the log.  The file exists and has permissions 0600.
> 	What am I probably looking at, and how do I find more specific information on the cause?

Make sure none of the directories in that path have 022 perms (go+write).  From the main sendmail README:

"Sendmail often gets blamed for many problems that are actually the
result of other problems, such as overly permissive modes on directories.
For this reason, sendmail checks the modes on system directories and
files to determine if they can be trusted.  For sendmail to run without
complaining, you MUST execute the following command:

        chmod go-w / /etc /etc/mail /usr /var /var/spool /var/spool/mqueue
        chown root / /etc /etc/mail /usr /var /var/spool /var/spool/mqueue

You will probably have to tweak this for your environment (for example,
some systems put the spool directory into /usr/spool instead of
/var/spool).  If you set the RunAsUser option in your sendmail.cf, the
/var/spool/mqueue directory will have to be owned by the RunAsUser user.
As a general rule, after you have compiled sendmail, run the command

        sendmail -v -bi

to initialize the alias database.  If it gives messages such as

        WARNING: writable directory /etc
        WARNING: writable directory /var/spool/mqueue

then the directories listed have inappropriate write permissions and
should be secured to avoid various possible security attacks."

Regards,
-- 
-Chuck