Proper permission for sendmail.cf when apache sends mail on linux

Question

I have a web application (bugzilla) in apache that needs to use sendmail.cf . When it tries to use sendmail I get the error:

/etc/mail/sendmail.cf: line 0: cannot open: Permission denied

the web application is in group "apache"

Permissions for sendmail look like:

-rw-r--r-- 1 root root 58624 2008-03-29 05:27 sendmail.cf

What do the permissions for sendmail.cf have to look like in order to be accessed by apache but still be secure enough to lock out everyone else.

Answer 1

Set the user as root and the group as apache: chown root:apache sendmail.cf

Answer 2

You should have a different .cf file for local submissions, usually called (something like) submit.cf - this will have a slightly different batch of settings specifically for SENDING mail (whereas sendmail.cf will be the part for RECEIVING mail). The submit.cf is safe to be globally readable, because (in theory) all processes on the box should be trusted to send email.