topic Sendmail Vulnerability Question in Operating System - HP-UX

Sendmail Vulnerability Question

Tom Jackson — Thu, 06 Mar 2003 15:31:39 GMT

Hi:

I've notified management about the sendmail vulnerability problem, now I'm waiting for them to decide if I should take immediate action.

First question: Since we don't use our unix mail for anything except to report on cron jobs, can I disable its startup without affecting anything else?

Second question: How should I disable the startup?

Tom

Re: Sendmail Vulnerability Question

Pete Randall — Thu, 06 Mar 2003 15:33:55 GMT

Edit /etc/rc.config.d/mailservs
and set "export SENDMAIL_SERVER" to 0.

Pete

Re: Sendmail Vulnerability Question

Paul Sperry — Thu, 06 Mar 2003 15:36:07 GMT

To disable it at startup edit
/etc/rc.config.d/mailservs

export SENDMAIL_SERVER=0

Re: Sendmail Vulnerability Question

Hai Nguyen_1 — Thu, 06 Mar 2003 15:37:58 GMT

Tom,

1) Yes, disabling it will not cause any harm.

2) Fist stop sendmail daemon, then disabling it from coming up at bootup.
# /sbin/init.d/sendmail stop

# vi /etc/rc.config.d/mailsevrs
to change:
export SENDMAIL_SERVER=1
to:
export SENDMAIL_SERVER=0

Hai

Re: Sendmail Vulnerability Question

Helen French — Thu, 06 Mar 2003 15:45:15 GMT

You can also use this command to kill the current running sendmail:

# killsm

This is exactly similar like doing:

# /sbin/init.d/sendmail stop

But before doing that, remember that the root mail messages and the mail message from your cron jobs are important.

Re: Sendmail Vulnerability Question

Tom Jackson — Thu, 06 Mar 2003 15:46:49 GMT

Pete, Paul, and Hai:

Thanks for your fast response. Sendmail is down and I'll test the reboot tomorrow.

Tom