topic Re: sendmail and .forward in Operating System - HP-UX

sendmail and .forward

marco_123 — Wed, 21 Jul 2004 09:50:04 GMT

Under /var/syslogd/mail i have 150 mb of

Jul 20 18:13:19 smsc1a sendmail[7606]: i6KG0HW02946: forward /home/smsc/.forward: World writable directory
Jul 20 18:13:19 smsc1a sendmail[7606]: i6KG0HW02946: to=smsc, ctladdr=smsc (20001/3), delay=00:13:02, xdelay=00:00:00, mailer=local, pri=570526
, dsn=4.0.0, stat=Deferred
Jul 20 18:13:19 smsc1a sendmail[7606]: i6KG0OR03332: forward /home/smsc/.forward: World writable directory
Jul 20 18:13:19 smsc1a sendmail[7606]: i6KG0OR03332: to=smsc, ctladdr=smsc (20001/3), delay=00:12:55, xdelay=00:00:00, mailer=local, pri=571034
, dsn=4.0.0, stat=Deferred
Jul 20 18:13:19 smsc1a sendmail[7606]: i6KFwGu01182: forward /home/smsc/.forward: World writable directory
Jul 20 18:13:19 smsc1a sendmail[7606]: i6KFwGu01182: to=smsc, ctladdr=smsc (20001/3), delay=00:15:03, xdelay=00:00:00, mailer=local, pri=660549
, dsn=4.0.0, stat=Deferred
Jul 20 18:13:19 smsc1a sendmail[7606]: i6KFjLR26064: forward /home/smsc/.forward: World writable directory
Jul 20 18:13:19 smsc1a sendmail[7606]: i6KFjLR26064: to=smsc, ctladdr=smsc (20001/3), delay=00:27:58, xdelay=00:00:00, mailer=local, pri=111103
4, dsn=4.0.0, stat=Deferred
Jul 20 18:13:19 smsc1a sendmail[7606]: i6KFeEp23326: forward /home/smsc/.forward: World writable directory
Jul 20 18:13:19 smsc1a sendmail[7606]: i6KFeEp23326: to=smsc, ctladdr=smsc (20001/3), delay=00:33:05, xdelay=00:00:00, mailer=local, pri=138052
6, dsn=4.0.0, stat=Deferred
.
.
.

30 Messages replicate in one second!!!i don't understand why
/home/smsc isn't a World writable directory

drwxr-xr-x 17 smsc sys 2048 Jul 12 14:45 smsc

Can someone help me?

Thanks a lot
Marco

Re: sendmail and .forward

Jeff Schussele — Wed, 21 Jul 2004 09:54:15 GMT

Hi Marco,

You simply have to modify /home/smsc perms to remove other wirte perms - i.e. it's probably drwxr-xrw- or such & should be drwxr-xr-x
do the following
chmod 755 /home/smsc

HTH,
Jeff

Re: sendmail and .forward

Geoff Wild — Wed, 21 Jul 2004 09:55:03 GMT

What about permission on .forward as well as /etc/mail?

Rgds...Geoff

Re: sendmail and .forward

Jeff Schussele — Wed, 21 Jul 2004 09:55:55 GMT

Oh & I should mention that even though the file is not writable, the dir is so the file could be deleted & replaced. That's what it's warning you about.

Jeff

Re: sendmail and .forward

Geoff Wild — Wed, 21 Jul 2004 09:58:22 GMT

Also, I believe it's backward recursive - so check permissions on /home as well.

Rgds...Geoff

Re: sendmail and .forward

marco_123 — Wed, 21 Jul 2004 09:58:49 GMT

Thanks Jeff but actually the permission is this one:

drwxr-xr-x 17 smsc sys 2048 Jul 12 14:45 smsc

Any ideas?

Marco

Re: sendmail and .forward

marco_123 — Wed, 21 Jul 2004 10:01:34 GMT

Geoff this is permission of /home

drwxrwxrwx 15 omni sys 1024 Mar 11 14:34 home

Thanks Marco

Re: sendmail and .forward

Geoff Wild — Wed, 21 Jul 2004 10:03:55 GMT

Aha!

/home should be 755

Rgds...Geoff

Re: sendmail and .forward

Steven E. Protter — Wed, 21 Jul 2004 10:08:23 GMT

General Discussion:

Any file that has control of sendmail setup, even for one user can trigger this security complaint.

If the directory(bad but nor horrible) is world writable or the file is(very bad) a spammer can modify this file and then send all their nice garbage through the one user. If the spammer is really good, he/she/it can create an open relay.

A good way to scan your system totally for these kind of issues is to run bastille on it.

Here is a copy of the free utility:
http://software.hp.com/portal/swdepot/displayProductInfo.do?productNumber=B6849AA

SEP