topic Re: sendmail issue. in Operating System - HP-UX

sendmail issue.

Mark Harshman_1 — Tue, 10 Feb 2004 11:04:21 GMT

I'm having a strange entry on my mail log, that i havent been able to figure out. I just installed sendmail 8.11.1, but was having the same messages before. This is on a HPUX L class server running HPUX11i. I'll attach a copy of the msg. I am getting quite a few of these..but am still able to use mail function. thanks in advance.

Re: sendmail issue.

Sridhar Bhaskarla — Tue, 10 Feb 2004 11:08:19 GMT

Hi,

Make sure you don't have world write permissions for /root directory.

-Sri

Re: sendmail issue.

Jeff Schussele — Tue, 10 Feb 2004 11:14:03 GMT

Hi,

I agree with Sri, / at most should be 755 root:root
Sendmail has many "security" features & checking file/dir permissions/ownership is one of them.

Rgds,
Jeff

Re: sendmail issue.

Mark Greene_1 — Tue, 10 Feb 2004 11:18:11 GMT

Your / directory should have 755 permissions. Also, check to see of sendmail is running as root, that the file /etc/mail/sendmail.st exists, and is owned by bin:bin. Then run mailstats and see what errors you get.

mark

Re: sendmail issue.

Jeff Schussele — Tue, 10 Feb 2004 11:19:56 GMT

Sorry - misread that somewhat...

root's home dir /root should be 700 root:sys
root's .forward file should be 600 root:sys

Having it world writable leaves it wide open for a mailicious user to drop executable - by root! - code in there to be run simply when root receives mail. Nice little way to drop a trojan on the system....

Rgds,
Jeff

Re: sendmail issue.

Mark Harshman_1 — Tue, 10 Feb 2004 11:22:54 GMT

thanks. i did have to /root permissions set wrong. I do not have a .forward file in my /root, what is it used for?

Re: sendmail issue.

Mark Harshman_1 — Tue, 10 Feb 2004 11:27:38 GMT

i dont have a sendmail.st file. i see it in the sendmail.cf file. It has a 0 in front of it. IS that keeping it from logging?
thanks

Re: sendmail issue.

Sridhar Bhaskarla — Tue, 10 Feb 2004 11:35:31 GMT

Hi,

You don't need to have .forward file to get these messages.

.forward file is used to auto forward your messages to a different address or script. Look at "man sendmail" for more information.

-Sri

Re: sendmail issue.

Jeff Schussele — Tue, 10 Feb 2004 11:38:46 GMT

Hi (again) Mark,

The .forward file is used to - as it's name implies - forward mail rec'd to another person or system. BUT, it can also be used to redirect mail to a file or even execute code - basically anything that can be done with an alias file.
That's why it's so importanr for root to protect it's .forward file as anything executed out of it is run as root.

Rgds.
Jeff

Re: sendmail issue.

Steven E. Protter — Tue, 10 Feb 2004 13:07:10 GMT

Your /root/.forward file is world writable which means anyone can forward roots mail to anywhere they want.

You should check permissions on all mail configuration files in /etc/mail

The last line indicates a piece of mail could not be forwarded.

SEP

Re: sendmail issue.

Seth Parker — Wed, 11 Feb 2004 00:32:12 GMT

In addition to fixing your permissions as others have suggested, you might consider deleting root's .forward file and editing the /etc/mail/aliases file instead. You could still forward root's mail to whomever you forward it to with .forward, but it'd be in a more standard place.

The aliases file has examples of what to do, but if you wanted to forward root's mail to joe and bob, you can add the following entry to the aliases file:

root: joe, bob

Run the command newaliases afterwards and it will take effect immediately.

Re: sendmail issue.

Kasper Haitsma — Thu, 12 Feb 2004 09:20:46 GMT

Hello Mark,

WRT sendmail.st this is the place where statistics are logged. See man mailstats for an explaination

HTH
Kasper