sendmail issue.

[Mark Harshman_1]

I'm having a strange entry on my mail log, that i havent been able to figure out. I just installed sendmail 8.11.1, but was having the same messages before. This is on a HPUX L class server running HPUX11i. I'll attach a copy of the msg. I am getting quite a few of these..but am still able to use mail function. thanks in advance.

[Sridhar Bhaskarla · Accepted solution]

Hi,

Make sure you don't have world write permissions for /root directory.

-Sri

[Jeff Schussele]

Hi,

I agree with Sri, / at most should be 755 root:root
Sendmail has many "security" features & checking file/dir permissions/ownership is one of them.

Rgds,
Jeff

[Mark Greene_1]

Your / directory should have 755 permissions. Also, check to see of sendmail is running as root, that the file /etc/mail/sendmail.st exists, and is owned by bin:bin. Then run mailstats and see what errors you get.

mark

[Jeff Schussele]

Sorry - misread that somewhat...

root's home dir /root should be 700 root:sys
root's .forward file should be 600 root:sys

Having it world writable leaves it wide open for a mailicious user to drop executable - by root! - code in there to be run simply when root receives mail. Nice little way to drop a trojan on the system....

Rgds,
Jeff

[Mark Harshman_1]

thanks. i did have to /root permissions set wrong. I do not have a .forward file in my /root, what is it used for?

[Mark Harshman_1]

i dont have a sendmail.st file. i see it in the sendmail.cf file. It has a 0 in front of it. IS that keeping it from logging?
thanks

[Sridhar Bhaskarla]

Hi,

You don't need to have .forward file to get these messages.

.forward file is used to auto forward your messages to a different address or script. Look at "man sendmail" for more information.

-Sri

[Jeff Schussele]

Hi (again) Mark,

The .forward file is used to - as it's name implies - forward mail rec'd to another person or system. BUT, it can also be used to redirect mail to a file or even execute code - basically anything that can be done with an alias file.
That's why it's so importanr for root to protect it's .forward file as anything executed out of it is run as root.

Rgds.
Jeff

[Steven E. Protter]

Your /root/.forward file is world writable which means anyone can forward roots mail to anywhere they want.

You should check permissions on all mail configuration files in /etc/mail

The last line indicates a piece of mail could not be forwarded.

SEP

[Seth Parker]

In addition to fixing your permissions as others have suggested, you might consider deleting root's .forward file and editing the /etc/mail/aliases file instead. You could still forward root's mail to whomever you forward it to with .forward, but it'd be in a more standard place.

The aliases file has examples of what to do, but if you wanted to forward root's mail to joe and bob, you can add the following entry to the aliases file:

root: joe, bob

Run the command newaliases afterwards and it will take effect immediately.

[Kasper Haitsma]

Hello Mark,

WRT sendmail.st this is the place where statistics are logged. See man mailstats for an explaination

HTH
Kasper