RE: Securing Sendmail 8.11.6-23 from spammers

[email protected] wrote:
> I believe the entries of:
> localhost.localdomain     RELAY
> localhost                       RELAY
> 127.0.0.1                       RELAY
>
> cause the issue.
>
> We reject all those.

You can reject all of those if you never want any email to be originated on
the actual server box and relayed or sent by sendmail.  Most people need
these statements because they want their box to relay all local "on box"
traffic such as cron msgs, if you run Pine or if you run a webmail
application like openwebmail.

stew

>
> mlc
>
> On Tuesday, March 4, 2003, at 11:52 AM, LULANI Olsi wrote:
>
>> The reason why you are listed on such a list may quite well be some
>> kind of virus that mass-emails stuff to random email addresses or
>> from your outlook address book. In the access file add a few lines
>> like: TO:zzz.com     RELAY And generate a new access.db file. At the
>> same time your sendmail.mc file is missing an important line:
>> FEATURE(`relay_hosts_only')dnl
>> This line enables relaying only for the hosts defined in the access
>> file. Personally I would dump the SMTP-AUTH. From my experience it
>> does not work with MS clients. I might be wrong but this is what I
>> have noticed. Outlook uses some kind of NTLM authentication that
>> works on Windows machines, while Unix is a different brand.
>> Try to increase the debug level for some time in sendmail and keep a
>> look in the logs. Try to find out what relaying are you providing
>> that has blacklisted you.
>>
>> Sincerely
>> Mr. Olsi Lulani
>>
>> -----Original Message-----
>> From: gti617 [mailto:[email protected]]
>> Sent: Tuesday, March 04, 2003 6:34 PM
>> To: [email protected]
>> Subject: Securing Sendmail 8.11.6-23 from spammers
>>
>> PLEASE HELP. WHAT AM I DOING WRONG?
>>
>> I was running fine for 2 years.  But, I just found out that I have
>> been listed as as a relay site.  Trying not to be on anybody's sh..
>> list; I found this board.  Following the instruction of one of
>> the board members, I followed the route of having my mail server
>> Authenticating all SMTPs (SMTP-AUTH).  What has happend now, all
>> mail including my own are being rejected. Should I try to fix 8.11
>> or simply move on to 8.12 sendmail? Would I have better luck with
>> 8.12 or not?
>>
>> We have our mail server (zzz.com) in house.  Have 3 users;
>> [email protected], [email protected] and [email protected].  Jack is a normal user on
>> the server and Pam and Joe are POP account mail only users. We want
>> all three to send and receive e-mails only.  "dow"  Obviously!
>>
>> -- Under MS Outlook I have checked the box "My Server requires
>> authentication."
>> -- I have added ( took out dn1) the following lines
>> to  /etc/mail/sendmail.mc define(`confAUTH_OPTIONS', `A')dnl
>> TRUST_AUTH_MECH(`DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
>> define(`confAUTH_MECHANISMS', `DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
>> -- I have created a new .cf file from my new .mc
>> # m4 /etc/mail/sendmail.mc > /etc/mail/sendmail.cf
>> -- I have copied new sendmail.cf file over the old one
>> /etc/sendmail.cf
>> -- I have Verified that I have an /etc/pam.d/smtp file with the
>> following contents:
>> #%PAM-1.0
>> auth       required     /lib/security/pam_stack.so
>> service=system-auth account    required    
>> /lib/security/pam_stack.so service=system-auth
>> -- I have verified have a /usr/lib/sasl/Sendmail.conf file with the
>> following contents: pwcheck_method:pam
>> -- My access file looks like:
>> # Check the /usr/share/doc/sendmail-8.11.6/README.cf file for a
>> description # of the format of this file. (search for access_db in
>> that file) # The /usr/share/doc/sendmail-8.11.6/README.cf is part of
>> the sendmail-doc # package.
>> #
>> # by default we allow relaying from localhost...
>> localhost.localdomain     RELAY
>> localhost                       RELAY
>> 127.0.0.1                       RELAY
>> -- NOTE:  ********  I DO NOT HAVE -> the file
>> /etc/mail/relay-domains; which they say should only contain the
>> domains you host.
>> -- Finally my .mc file looks like:
>> divert(-1)
>> dnl This is the sendmail macro config file. If you make changes to
>> this file, dnl you need the sendmail-cf rpm installed and then have
>> to generate a dnl new /etc/sendmail.cf by running the following
>> command: dnl dnl        m4 /etc/mail/sendmail.mc > /etc/sendmail.cf
>> dnl include(`/usr/share/sendmail-cf/m4/cf.m4')
>> VERSIONID(`linux setup for Red Hat Linux')dnl
>> OSTYPE(`linux')
>> define(`confDEF_USER_ID',``8:12'')dnl
>> undefine(`UUCP_RELAY')dnl
>> undefine(`BITNET_RELAY')dnl
>> define(`confAUTO_REBUILD')dnl
>> define(`confTO_CONNECT', `1m')dnl
>> define(`confTRY_NULL_MX_LIST',true)dnl
>> define(`confDONT_PROBE_INTERFACES',true)dnl
>> define(`PROCMAIL_MAILER_PATH',`/usr/bin/procmail')dnl
>> define(`ALIAS_FILE', `/etc/aliases')dnl
>> dnl define(`STATUS_FILE', `/etc/mail/statistics')dnl
>> define(`UUCP_MAILER_MAX', `2000000')dnl
>> define(`confUSERDB_SPEC', `/etc/mail/userdb.db')dnl
>> define(`confPRIVACY_FLAGS',
>> `authwarnings,novrfy,noexpn,restrictqrun')dnl
>> define(`confAUTH_OPTIONS', `A')dnl TRUST_AUTH_MECH(`DIGEST-MD5
>> CRAM-MD5 LOGIN PLAIN')dnl define(`confAUTH_MECHANISMS', `DIGEST-MD5
>> CRAM-MD5 LOGIN PLAIN')dnl dnl define(`confTO_QUEUEWARN', `4h')dnl
>> dnl define(`confTO_QUEUERETURN', `5d')dnl
>> dnl define(`confQUEUE_LA', `12')dnl
>> dnl define(`confREFUSE_LA', `18')dnl
>> dnl FEATURE(delay_checks)dnl
>> FEATURE(`no_default_msa',`dnl')dnl
>> FEATURE(`smrsh',`/usr/sbin/smrsh')dnl
>> FEATURE(`mailertable',`hash -o /etc/mail/mailertable.db')dnl
>> FEATURE(`virtusertable',`hash -o /etc/mail/virtusertable.db')dnl
>> FEATURE(redirect)dnl FEATURE(always_add_domain)dnl
>> FEATURE(use_cw_file)dnl
>> FEATURE(use_ct_file)dnl
>> FEATURE(local_procmail,`',`procmail -t -Y -a $h -d $u')dnl
>> FEATURE(`access_db',`hash -o /etc/mail/access.db')dnl
>> FEATURE(`blacklist_recipients')dnl
>> EXPOSED_USER(`root')dnl
>> dnl Change sendmail to only listen on the loopback interface and
>> dnl the internal network interface; never accept outside traffic.
>> dnl Add "dnl" to both DAEMON_OPTIONS lines to accept mail from dnl
>> all network interfaces. dnl
>> DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA') dnl
>> DAEMON_OPTIONS(`Port=smtp,Addr=192.168.0.1, Name=MTA') dnl NOTE:
>> binding both IPv4 and IPv6 daemon to the same port requires
>> dnl       a kernel patch dnl DAEMON_OPTIONS(`port=smtp,Addr=::1,
>> Name=MTA-v6, Family=inet6') dnl We strongly recommend to comment
>> this one out if you want to protect dnl yourself from spam. However,
>> the laptop and users on computers that do dnl not have 24x7 DNS do
>> need this. dnl FEATURE(`accept_unresolvable_domains')dnl dnl
>> FEATURE(`relay_based_on_MX')dnl MAILER(smtp)dnl
>> MAILER(procmail)dnl
>> Cwlocalhost.localdomain
>> PLEASE HELP. WHAT AM I DOING WRONG?
>>
>> Thanks Kevin
>> [email protected]
>>
>>
>>
>> _______________________________________________
>> enigma-list mailing list
>> [email protected]
>> https://listman.redhat.com/mailman/listinfo/enigma-list
>>
>
>
>
> _______________________________________________
> enigma-list mailing list
> [email protected]
> https://listman.redhat.com/mailman/listinfo/enigma-list


---
Outgoing SofTEC USA mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.459 / Virus Database: 258 - Release Date: 2/25/2003