topic Bizarre sendmail issue. in Operating System - HP-UX

Bizarre sendmail issue.

Eric Ladner — Tue, 29 May 2001 18:11:04 GMT

On HP-UX 11.0, running sendmail 8.9.3 (PHNE_18546), I 'm having a strange problem.

Logged on to the machine as root, when I send mail to somebody not on the machine (goes through the relay to another machine) the mail appears to be from someone besides root. It actually shows up as being from another user on the box.

I've scoured the config files, even reset them to the ones from /usr/newconfig, but it still does the same thing. Currently, it is running under the default files that come with sendmail with NO modifications..

I did a sendmail -d21.12 -v gwol@chevron.com to look at the rules as they are applied, but they don't make much sense to me.

One interesting thing is that through the trace, it's root, up to some point where it appears to just arbitrarily call another ruleset with the users name. See the attached file.

Any ideas?

Re: Bizarre sendmail issue.

Rita C Workman — Tue, 29 May 2001 19:12:19 GMT

Hmmm...
Well, here's one thought.
Check your /etc/mail/sendmail.cf file and see if there is a line that is uncommented that looks like this:
UserDatabaseSpec=/etc/mail/

If there is, than I would say that somebody created a database whereby the FROM is changed to whatever this filename.db has assigned it to be. There is an HP document regarding this (KBRC00001457). If you don't have access to it...and your sendmail.cf files looks like this is what happened, I'll post it for you.

Just a thought,
Rita

Re: Bizarre sendmail issue.

Mark Fenton — Wed, 30 May 2001 00:40:36 GMT

That is peculiar.

When I tried to replicate the problem:

1) log in as me
2) su to root
3) sendmail mark@xyz.com
4) mail received from me@localhost

5) log in as root
6) sendmail mark@xyz.com
7) mail received from root@localhost

Re: Bizarre sendmail issue.

David Chamberlain — Wed, 30 May 2001 06:52:59 GMT

Just to avoid confusion over the 'su' issue, sendmail will always use the original login as the "MAIL From: " address (not root if 'su' was used). To display who the "real" user is:

# whoami
root

# who am i
user1 pts/1 May 24 14:47

The former shows the 'su' user (root), the latter shows the original login.