RE: Securing Sendmail 8.11.6-23 from spammers

After pulling my hair and kicking the wall for hours.  (I came up with
conclusion that I should get of this business! NA JUST KIDDING).
1) I came up with the conclusion that sendmail 8.11.6 works; when
sendmail.cf is generated by "linuxconf". My users can send and receive
e-mails with out any problems. At that point it does not matter what the
contents of /etc/mail/access file is; they could be all REJECTs or RELAYs or
anything in between (yes I generated access.db file by makemap hash and
restarted sendmail). Further checking the relay test by relays.osirusoft.com
company tells me that I have a beautiful open relay server (SPAMMERS: Come
and use my server!).

2) When I create sendmail.cf file by "m4 /etc/mail/sendmail.mc >
/etc/sendmail.cf" command. Non of my pop or normal users can send or receive
e-mails. But the relay problem would go away ( My server will not relay)
Using the following code.

So where am I right now?  No where. I am headed to a bookstore. I am where I
started from.  I wish someone from RedHat would be HERO and read this
message and solve the problem of a lot of People.  Sincerely -- Kevin

----- access file contained
# Check the /usr/share/doc/sendmail-8.11.6/README.cf file for a description
# of the format of this file. (search for access_db in that file)
# The /usr/share/doc/sendmail-8.11.6/README.cf is part of the sendmail-doc
# package.
#
# by default we allow relaying from localhost...
localhost.localdomain	RELAY
localhost	RELAY
127.0.0.1	RELAY
ZZZ.com	RELAY
@ZZZ.com	RELAY
[email protected]	RELAY
----- END of access
-->> after editing the /etc/mail/access to come up with the above, I type
the following to come up with /etc/mail/access.db file
# makemap hash /etc/mail/access < /etc/mail/access

----- sendmail.mc file containes
divert(-1)
dnl This is the sendmail macro config file. If you make changes to this
file,
dnl you need the sendmail-cf rpm installed and then have to generate a
dnl new /etc/sendmail.cf by running the following command:
dnl
dnl        m4 /etc/mail/sendmail.mc > /etc/sendmail.cf
dnl
include(`/usr/share/sendmail-cf/m4/cf.m4')
VERSIONID(`linux setup for Red Hat Linux')dnl
OSTYPE(`linux')
dnl Uncomment and edit the following line if your mail needs to be sent out
dnl through an external mail server:
dnl define(`SMART_HOST',`smtp.your.provider')
define(`confDEF_USER_ID',``8:12'')dnl
undefine(`UUCP_RELAY')dnl
undefine(`BITNET_RELAY')dnl
define(`confAUTO_REBUILD')dnl
define(`confTO_CONNECT', `1m')dnl
define(`confTRY_NULL_MX_LIST',true)dnl
define(`confDONT_PROBE_INTERFACES',true)dnl
define(`PROCMAIL_MAILER_PATH',`/usr/bin/procmail')dnl
define(`ALIAS_FILE', `/etc/aliases')dnl
dnl define(`STATUS_FILE', `/etc/mail/statistics')dnl
define(`UUCP_MAILER_MAX', `2000000')dnl
define(`confUSERDB_SPEC', `/etc/mail/userdb.db')dnl
define(`confPRIVACY_FLAGS', `authwarnings,novrfy,noexpn,restrictqrun')dnl
define(`confAUTH_OPTIONS', `A')dnl
TRUST_AUTH_MECH(`DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
define(`confAUTH_MECHANISMS', `DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl
dnl define(`confTO_QUEUEWARN', `4h')dnl
dnl define(`confTO_QUEUERETURN', `5d')dnl
dnl define(`confQUEUE_LA', `12')dnl
dnl define(`confREFUSE_LA', `18')dnl
dnl FEATURE(delay_checks)dnl
FEATURE(`no_default_msa',`dnl')dnl
FEATURE(`smrsh',`/usr/sbin/smrsh')dnl
FEATURE(`mailertable',`hash -o /etc/mail/mailertable.db')dnl
FEATURE(`virtusertable',`hash -o /etc/mail/virtusertable.db')dnl
FEATURE(redirect)dnl
FEATURE(always_add_domain)dnl
FEATURE(use_cw_file)dnl
FEATURE(use_ct_file)dnl
dnl The '-t' option will retry delivery if e.g. the user runs over his
quota.
FEATURE(local_procmail,`',`procmail -t -Y -a $h -d $u')dnl
FEATURE(`access_db',`hash -o /etc/mail/access.db')dnl
FEATURE(`blacklist_recipients')dnl
EXPOSED_USER(`root')dnl
dnl This changes sendmail to only listen on the loopback device 127.0.0.1
dnl and not on any other network devices. Comment this out if you want
dnl to accept email over the network.
DAEMON_OPTIONS(`Port=smtp,Addr=127.0.0.1, Name=MTA')
dnl NOTE: binding both IPv4 and IPv6 daemon to the same port requires
dnl       a kernel patch
dnl DAEMON_OPTIONS(`port=smtp,Addr=::1, Name=MTA-v6, Family=inet6')
dnl We strongly recommend to comment this one out if you want to protect
dnl yourself from spam. However, the laptop and users on computers that do
dnl not have 24x7 DNS do need this.
dnl FEATURE(`accept_unresolvable_domains')dnl
dnl FEATURE(`relay_based_on_MX')dnl
MAILER(smtp)dnl
MAILER(procmail)dnl
Cwlocalhost.localdomain
----- END of sendmail.mc
-->> after editing the /etc/mail/senmail.mc file, I type the following to
come up with /etc/sendmail.cf file.
# m4 /etc/mail/sendmail.mc > /etc/sendmail.cf

-->> Then I restart the sendmail service by typing the following:
# /etc/rc5.d/S80sendmail restart

--> Then I can neither send nor receive any e-mails.

------------------------------------------ THE
END -----------------------------


-----Original Message-----
From: [email protected]
[mailto:[email protected]]On Behalf Of Gerry Doris
Sent: Wednesday, March 05, 2003 4:39 PM
To: [email protected]
Subject: Re: Securing Sendmail 8.11.6-23 from spammers


On Wed, 5 Mar 2003, gti617 wrote:

> OK lets fix this up a little. It seems that sendmail has no access to
> /etc/mail/access file.
> When I type the changes in the following cases; from REJECT to RELAY. And
> creating the access.db file. And restarting sendmail.
> I still can send e-mail to myself. Any comments! Thanks
> CASE 1
> # Check the /usr/share/doc/sendmail-8.11.6/README.cf file for a
description
> # of the format of this file. (search for access_db in that file)
> # The /usr/share/doc/sendmail-8.11.6/README.cf is part of the sendmail-doc
> # package.
> #
> # by default we allow relaying from localhost...
> localhost.localdomain REJECT
> localhost REJECT
> 127.0.0.1 REJECT
> CASE 2
> # Check the /usr/share/doc/sendmail-8.11.6/README.cf file for a
description
> # of the format of this file. (search for access_db in that file)
> # The /usr/share/doc/sendmail-8.11.6/README.cf is part of the sendmail-doc
> # package.
> #
> # by default we allow relaying from localhost...
> localhost.localdomain RELAY
> localhost RELAY
> 127.0.0.1 RELAY

I'm not sure what you're trying to say?  After you made the changes to
/etc/mail/access did you recreate the access.db file?  It's a hash.  You
need to do

makemap hash access < access

from within the /etc/mail directory.  You don't need to restart sendmail
for this to "take".

--
Gerry

"The lyfe so short, the craft so long to learne"  Chaucer



_______________________________________________
enigma-list mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/enigma-list