RE: Securing Sendmail 8.11.6-23 from spammers

Correction: FYI, I am _NOT_ using sendmail in a closed LAN, we re using it
on the internet.

-----Original Message-----
From: [email protected]
[mailto:[email protected]]On Behalf Of gti617
Sent: Wednesday, March 05, 2003 4:45 PM
To: [email protected]
Subject: RE: Securing Sendmail 8.11.6-23 from spammers


FYI, I am using sendmail in a closed LAN, we re using it on the internet.

To answer your questions:

> I still can send e-mail to myself. Any comments! Thanks
Can, or cannot?  -->>Yes, I could send messages to my myself.

> # Check the /usr/share/doc/sendmail-8.11.6/README.cf file for a
description
> # of the format of this file. (search for access_db in that file)
(did you do that?) -->>No I did not check.  I will do it now.

Ahh, you _do_ have access defined in your sendmail.mc (and
sendmail.cf) file, don't you?  -->>I have enclosed my sendmail.mc file (Just
in case)

divert(-1)
dnl This is the sendmail macro config file. If you make changes to this
file,
dnl you need the sendmail-cf rpm installed and then have to generate a
dnl new /etc/sendmail.cf by running the following command:
dnl
dnl        m4 /etc/mail/sendmail.mc > /etc/sendmail.cf
dnl
include(`/usr/share/sendmail-cf/m4/cf.m4')
VERSIONID(`linux setup for Red Hat Linux')dnl
OSTYPE(`linux')
dnl Uncomment and edit the following line if your mail needs to be sent out
dnl through an external mail server:
dnl define(`SMART_HOST',`smtp.your.provider')
define(`confDEF_USER_ID',``8:12'')dnl
undefine(`UUCP_RELAY')dnl
undefine(`BITNET_RELAY')dnl
define(`confAUTO_REBUILD')dnl
define(`confTO_CONNECT', `1m')dnl
define(`confTRY_NULL_MX_LIST',true)dnl
define(`confDONT_PROBE_INTERFACES',true)dnl
define(`PROCMAIL_MAILER_PATH',`/usr/bin/procmail')dnl
define(`ALIAS_FILE', `/etc/aliases')dnl
dnl define(`STATUS_FILE', `/etc/mail/statistics')dnl
define(`UUCP_MAILER_MAX', `2000000')dnl
define(`confUSERDB_SPEC', `/etc/mail/userdb.db')dnl
define(`confPRIVACY_FLAGS', `authwarnings,novrfy,noexpn,restrictqrun')dnl
define(`confAUTH_OPTIONS', `A')dnl
dnl TRUST_AUTH_MECH(`DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
dnl define(`confAUTH_MECHANISMS', `DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
dnl define(`confTO_QUEUEWARN', `4h')dnl
dnl define(`confTO_QUEUERETURN', `5d')dnl
dnl define(`confQUEUE_LA', `12')dnl
dnl define(`confREFUSE_LA', `18')dnl
dnl FEATURE(delay_checks)dnl
FEATURE(`no_default_msa',`dnl')dnl
FEATURE(`smrsh',`/usr/sbin/smrsh')dnl
FEATURE(`mailertable',`hash -o /etc/mail/mailertable.db')dnl
FEATURE(`virtusertable',`hash -o /etc/mail/virtusertable.db')dnl
FEATURE(redirect)dnl
FEATURE(always_add_domain)dnl
FEATURE(use_cw_file)dnl
FEATURE(use_ct_file)dnl
dnl The '-t' option will retry delivery if e.g. the user runs over his
quota.
FEATURE(local_procmail,`',`procmail -t -Y -a $h -d $u')dnl
FEATURE(`access_db',`hash -o /etc/mail/access.db')dnl
FEATURE(`blacklist_recipients')dnl
EXPOSED_USER(`root')dnl
dnl This changes sendmail to only listen on the loopback device 127.0.0.1
dnl and not on any other network devices. Comment this out if you want
dnl to accept email over the network.
DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')
dnl NOTE: binding both IPv4 and IPv6 daemon to the same port requires
dnl       a kernel patch
dnl DAEMON_OPTIONS(`port=smtp,Addr=::1, Name=MTA-v6, Family=inet6')
dnl We strongly recommend to comment this one out if you want to protect
dnl yourself from spam. However, the laptop and users on computers that do
dnl not have 24x7 DNS do need this.
dnl FEATURE(`accept_unresolvable_domains')dnl
dnl FEATURE(`relay_based_on_MX')dnl
MAILER(smtp)dnl
MAILER(procmail)dnl
Cwlocalhost.localdomain

That's it.  Thanks



-----Original Message-----
From: [email protected]
[mailto:[email protected]]On Behalf Of Tony Nugent
Sent: Wednesday, March 05, 2003 4:21 PM
To: Redhat 7. 2 Enigma Mailing List
Subject: Re: Securing Sendmail 8.11.6-23 from spammers


On Wed Mar 05 2003 at 15:51, gti617 wrote:

> OK lets fix this up a little. It seems that sendmail has no access to
> /etc/mail/access file.

Huh?

> When I type the changes in the following cases; from REJECT to RELAY. And
> creating the access.db file. And restarting sendmail.

What you have below _needs_ to be "RELAY".


> # Check the /usr/share/doc/sendmail-8.11.6/README.cf file for a
description
> # of the format of this file. (search for access_db in that file)

(did you do that?)

> localhost.localdomain RELAY
> localhost RELAY
> 127.0.0.1 RELAY

Now start adding domains, IPs and networks for whom you will allow
relay.  For example, if you have a private LAN on 192.168.0.0/24
and/or an entire domain to relay for, then you need to add this:

192.168.0	RELAY
.mydomain.com	RELAY

Everything else will be rejected.

Ahh, you _do_ have access defined in your sendmail.mc (and
sendmail.cf) file, don't you?

I've been using sendmail for years to relay email out of many
networks, never had a problem (with spammers, or with access denied
from otherwise authorised places).  You seem to be doing something
fundamentally wrong.

Cheers
Tony



_______________________________________________
enigma-list mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/enigma-list



_______________________________________________
enigma-list mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/enigma-list