RE: Securing Sendmail 8.11.6-23 from spammers

The reason why you are listed on such a list may quite well be some kind of
virus that mass-emails stuff to random email addresses or from your outlook
address book. In the access file add a few lines like:
TO:zzz.com     RELAY
And generate a new access.db file. At the same time your sendmail.mc file is
missing an important line:
FEATURE(`relay_hosts_only')dnl
This line enables relaying only for the hosts defined in the access file.
Personally I would dump the SMTP-AUTH. From my experience it does not work
with MS clients. I might be wrong but this is what I have noticed. Outlook
uses some kind of NTLM authentication that works on Windows machines, while
Unix is a different brand.
Try to increase the debug level for some time in sendmail and keep a look in
the logs. Try to find out what relaying are you providing that has
blacklisted you.

Sincerely
Mr. Olsi Lulani

-----Original Message-----
From: gti617 [mailto:[email protected]] 
Sent: Tuesday, March 04, 2003 6:34 PM
To: [email protected]
Subject: Securing Sendmail 8.11.6-23 from spammers

PLEASE HELP. WHAT AM I DOING WRONG?
 
I was running fine for 2 years.  But, I just found out that I have been
listed as as a relay site.  Trying not to be on anybody's sh.. list; I found
this board.  Following the instruction of one of the board members, I
followed the route of having my mail server Authenticating all SMTPs
(SMTP-AUTH).  What has happend now, all mail including my own are being
rejected. Should I try to fix 8.11 or simply move on to 8.12 sendmail? 
Would I have better luck with 8.12 or not?
 
We have our mail server (zzz.com) in house.  Have 3 users; [email protected],
[email protected] and [email protected].  Jack is a normal user on the server and Pam
and Joe are POP account mail only users. We want all three to send and
receive e-mails only.  "dow"  Obviously!
 
-- Under MS Outlook I have checked the box "My Server requires
authentication."
-- I have added ( took out dn1) the following lines
to  /etc/mail/sendmail.mc 
define(`confAUTH_OPTIONS', `A')dnl
TRUST_AUTH_MECH(`DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
-- I have created a new .cf file from my new .mc
# m4 /etc/mail/sendmail.mc > /etc/mail/sendmail.cf
-- I have copied new sendmail.cf file over the old one  /etc/sendmail.cf
-- I have Verified that I have an /etc/pam.d/smtp file with the following
contents:
#%PAM-1.0
auth       required     /lib/security/pam_stack.so service=system-auth
account    required     /lib/security/pam_stack.so service=system-auth
-- I have verified have a /usr/lib/sasl/Sendmail.conf file with the
following contents:
pwcheck_method:pam
-- My access file looks like:
# Check the /usr/share/doc/sendmail-8.11.6/README.cf file for a description
# of the format of this file. (search for access_db in that file)
# The /usr/share/doc/sendmail-8.11.6/README.cf is part of the sendmail-doc
# package.
#
# by default we allow relaying from localhost...
localhost.localdomain     RELAY
localhost                       RELAY
127.0.0.1                       RELAY
-- NOTE:  ********  I DO NOT HAVE -> the file /etc/mail/relay-domains; which
they say should only contain the domains you host.
-- Finally my .mc file looks like:
divert(-1)
dnl This is the sendmail macro config file. If you make changes to this
file,
dnl you need the sendmail-cf rpm installed and then have to generate a
dnl new /etc/sendmail.cf by running the following command:
dnl
dnl        m4 /etc/mail/sendmail.mc > /etc/sendmail.cf
dnl
include(`/usr/share/sendmail-cf/m4/cf.m4')
VERSIONID(`linux setup for Red Hat Linux')dnl
OSTYPE(`linux')
define(`confDEF_USER_ID',``8:12'')dnl
undefine(`UUCP_RELAY')dnl
undefine(`BITNET_RELAY')dnl
define(`confAUTO_REBUILD')dnl
define(`confTO_CONNECT', `1m')dnl
define(`confTRY_NULL_MX_LIST',true)dnl
define(`confDONT_PROBE_INTERFACES',true)dnl
define(`PROCMAIL_MAILER_PATH',`/usr/bin/procmail')dnl
define(`ALIAS_FILE', `/etc/aliases')dnl
dnl define(`STATUS_FILE', `/etc/mail/statistics')dnl
define(`UUCP_MAILER_MAX', `2000000')dnl
define(`confUSERDB_SPEC', `/etc/mail/userdb.db')dnl
define(`confPRIVACY_FLAGS', `authwarnings,novrfy,noexpn,restrictqrun')dnl
define(`confAUTH_OPTIONS', `A')dnl
TRUST_AUTH_MECH(`DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
dnl define(`confTO_QUEUEWARN', `4h')dnl
dnl define(`confTO_QUEUERETURN', `5d')dnl
dnl define(`confQUEUE_LA', `12')dnl
dnl define(`confREFUSE_LA', `18')dnl
dnl FEATURE(delay_checks)dnl
FEATURE(`no_default_msa',`dnl')dnl
FEATURE(`smrsh',`/usr/sbin/smrsh')dnl
FEATURE(`mailertable',`hash -o /etc/mail/mailertable.db')dnl
FEATURE(`virtusertable',`hash -o /etc/mail/virtusertable.db')dnl
FEATURE(redirect)dnl
FEATURE(always_add_domain)dnl
FEATURE(use_cw_file)dnl
FEATURE(use_ct_file)dnl
FEATURE(local_procmail,`',`procmail -t -Y -a $h -d $u')dnl
FEATURE(`access_db',`hash -o /etc/mail/access.db')dnl
FEATURE(`blacklist_recipients')dnl
EXPOSED_USER(`root')dnl
dnl Change sendmail to only listen on the loopback interface and
dnl the internal network interface; never accept outside traffic.
dnl Add "dnl" to both DAEMON_OPTIONS lines to accept mail from
dnl all network interfaces.
dnl DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')
dnl DAEMON_OPTIONS(`Port=smtp,Addr=192.168.0.1, Name=MTA')
dnl NOTE: binding both IPv4 and IPv6 daemon to the same port requires
dnl       a kernel patch
dnl DAEMON_OPTIONS(`port=smtp,Addr=::1, Name=MTA-v6, Family=inet6')
dnl We strongly recommend to comment this one out if you want to protect
dnl yourself from spam. However, the laptop and users on computers that do
dnl not have 24x7 DNS do need this.
dnl FEATURE(`accept_unresolvable_domains')dnl
dnl FEATURE(`relay_based_on_MX')dnl
MAILER(smtp)dnl
MAILER(procmail)dnl
Cwlocalhost.localdomain
PLEASE HELP. WHAT AM I DOING WRONG?

Thanks Kevin
[email protected]