topic Re: Restrict sendmail recipients in Operating System - HP-UX

Restrict sendmail recipients

Dwyane Everts_1 — Wed, 05 May 2004 12:19:52 GMT

All,

Does anyone know of a way to restrict who is authorized to use sendmail/mailx and who is authorized to receive emails from an HPUX 11.11 system? (sendmail version: 8.9.3)

Scenerio:
On a development server, I want the developers to only send emails to themselves, regardless of the "To:" addressee they specify.

Perhaps, is there a script I can create?

Dwyane

Re: Restrict sendmail recipients

Mel Burslan — Wed, 05 May 2004 12:38:08 GMT

Nothing simple comes to mind but few ideas to toy with:

Part of your question was to prevent developers to send mails to anyone else to themselves and I believe you can do this by not configuring a smart relay server in the sendmail.cf file. So the mail sent by sendmail should stay inside the system. Developers should login to their accounts on the server to read them. But I believe this is not what you want. you want them to send mail to themselves on your organization's, for instance, exchange server to be read by their outlook client. If this is the case, sorry I do not know how to relay messages selectively to some addresses but with the complexite of sendmail.cf, I would not be surprised to see a macro in it to facilitate this functionality.

The other part of your question is to decide who can use mailx/sendmail or any other mail sender to send mails out I believe. Well, there is a very draconian approach that I can think of. Force all users of the system to use a restricted shell. Shell we mention here should be able to use all commands but the mail related ones that you pick out. And let the developers, who I think you would allow to send mails out, use unrestricted shells, or enhance their restricted shell capabilities by the mail sending commands that you can let them use.

Sorry, no simple solutions from my end.

Re: Restrict sendmail recipients

Steven E. Protter — Wed, 05 May 2004 12:56:43 GMT

You can block certain repipients pretty easily:

Add them to the /etc/mail/access file and there will be no inbound or outbound mail for all users on the list. You would need to run the gen_cf utility to implement these setting.

You could shut down the accounts themsleves totally. If leroy should not send mail, then leroy in the access file will get reject on anything he sends.

Sendmail is a pretty open tool which is designed to let you send to any recipient anywhere, any legal name.

If there are specific people you don't want the system sending mail to, then /etc/mail/access will work.

To implement this you might need a sendmail macro script. Here is a location: http://www.hpux.ws/buildmail.hpux.txt

The link is currently down due to a DSL outage. It should be up shortly.

SEP

Re: Restrict sendmail recipients

Dwyane Everts_1 — Wed, 05 May 2004 13:04:15 GMT

Thanks for the input, and quick responses!

As I suspected, since trusting a programmer is not an option :), and the options will require time I don't have; I have disabled sendmail completely on the development server.

That'll teach'm to write ugly code! :)

Thanks again!!
D

Re: Restrict sendmail recipients

Tom Danzig — Wed, 05 May 2004 14:07:48 GMT

FYI, based on your last posting, it sounds like you have shutdown the sendmail daemon. Note that this will NOT dis-allow sending mail; only receiving it on that host.

Re: Restrict sendmail recipients

Steven E. Protter — Wed, 05 May 2004 14:24:51 GMT

You need to change permissions on the the sendmail file as follows to prevent execution:

#for sure...
chmod o-x /usr/sbin/sendmail

#maybe...
chmod g-x /usr/sbin/sendmail

If you disabled the daemon in the /etc/rc.config.d/sendmail file by changing the first variable from 1 to zero, sendmail will be invoked with mailx calls.

Too bad you can't trust your developers.

SEP

Re: Restrict sendmail recipients

Dwyane Everts_1 — Wed, 05 May 2004 14:30:58 GMT

THANKS for pointing that out. I renamed sendmail to sendmail.old. :)

D