Re: I'd like to be able to recieve mail, but not send it out (re: sendmail)

Michael Schwager <[email protected]> Tue, 14 Jan 2003 13:41:28 -0600
Newsgroups gmane.linux.redhat.release.guinness
Message-ID <14047228.1042551688@[192.168.100.250]>
>> I take it you mean you only want to accept incoming mail.
>
> Yep.

Ok, I can see I wasn't clear either... :)  The issue is, what is the 
definition of "receive" and what is the definition of "send it out"?  In 
order to answer this question, you need to specify with greater precision 
where the mail is coming from and where it may go to.

For example, receive may mean "From the Internet to any host in our 
domain."  Or it may mean, "From any host anywhere to this host."  The 
latter could (or could not) include the Internet at large, or it could 
include machines in your intranet.

> The concept is really simple: no mail goes out of this machine, except
> via POP3 - mail never originates from it.

I think I understand now.  Although again the terminology of "going out" 
implies some SMTP-based communication, originating on the local host; with 
POP3 clients we usually think of them as "picking up" the mail.
I don't mean to be anal (though I don't deny I am :), but rather I want to 
say that proper definition of the problem could garner quicker responses 
from your audience and a quicker reply.

And- finally- in this case, I would suggest the question would be worded 
like this:
"I have a host that is a POP3 server.  I would like it to receive 
SMTP-based email, but I don't want it to be able to initiate an SMTP 
conversation.  Any attempt by a local POP3 or Internet user to send or 
relay mail through this host should fail.  In other words, I want sendmail 
to be able to deliver locally and that's all."

Now for the answers:
For a quick-and-ugly hack, find every line in the sendmail.cf that contains 
"$#esmtp" or "$#smtp".  Replace everything after the "$#esmtp" or "$#smtp" 
with this text:
$#error<tab>$@ 5.1.2<tab>$: "553 Sorry, this computer can not send mail. 
Local deliveries only."

That should all be one line.  Anytime you see <tab>, make it a real tab 
character (1 character) rather than that 5 character string.

For example, if you see this (this is all on one line and is an actual line 
taken from an existing sendmail.cf; you should have a similar one):
R$* < @ [ $+ ] : > $*           $#esmtp $@ [$2] $: $1 < @ [$2] > $3     no 
smarthost: send

...replace it with this:

R$* < @ [ $+ ] : > $*           $#error $@ 5.1.2<tab>$: "553 Sorry, this 
computer can not send mail. Local deliveries only."

...and so on, throughout the entire file.  Then restart sendmail.

> Isn't there a preprocessor variable that can be adjusted, instead of
> editing the sendmail.cf directly?

Not for the above hack, but that's the simplest thing I can think of; I 
can't think of any circumstance that would allow a mail to squeak by.
If you wanted to do it the legal way, you would probably need to write some 
rules that end up in ParseLocal... it may be as simple as

R$* < @ $+ > $+ <tab>$#error  $@ 5.1.2<tab>$: "553 Sorry, blah blah"

...because you only want to allow local deliveries.  What this statement 
says is that:  "By the time you get to this rule in ruleset 0, if we 
haven't delivered it yet, and if it still has a hostname in the email 
address- that is, if it's not a local recipient, then it must be destined 
for a user on a host which is not this host.  So return it as an error."

If that's what you want then you can use that rule, but test it first!

I forget how to include ParseLocal via the preprocessor but I don't think 
it's too hard.

> Are there other smtp type programs that simply receive mail and never
> forward, relay or allow sending of  anykind?

What you want is an MTA that only does local deliveries and I can't think 
of any.

--
-Mike Schwager               "btw the people who make open source software
 [email protected]         generally don't have much sympathy for users"
                                                            (Dave Winer)