sendmail: make some users local only

[Fred Martin_1]

We have one internal mail server (HPUX: sendmail).

It currently has our anti-spam gateway as the relay host. All non-local email is sent on to the anti-spam gateway via sendmail.

We have a company policy here - only certain users are permiited to use "internet" (non-local) email.

I need to find some method of preventing these users from sending email to domains other than ours.

I already have the list of users permitted to send outside email. They are in the sendmail user db:

/etc/mail/userdb.db

This was orginally set up for another reason, to give them "pretty" email addresses and to mask their ugly login ID, such as:

aem:mailname emiller@applicatorssales.com
emiller:maildrop aem

So the list of allowed users is already in there. Anyone without a userdb entry should be only be using email locally.

Anyway perhaps that's not useful but does anyone know of a good method for accomplishing this?

Thanks,

Fred

[Steven E. Protter]

Shalom Fred,

You are using a standard sendmail function to do the job. There is nothing wrong with it.

Other options to let users go to the gateway.

/etc/aliases

local outside@yahoo.com:

This will push the mail to an outside user which can be on your network.

virtusertables genericstables entries do the same thing, tell the system to look for a domain on outside accounts (genericstable) same basic system as aliases without the colon on the end.

However all methods are equally ugly and yours works. If its not broken why are you trying to fix it? What are we trying to prove?

SEP

[Court Campbell · Accepted solution]

You can try this:

http://www.sendmail.org/~ca/email/restrict.html

[Fred Martin_1]

Steven, sorry I wasn't clear. The userdb works in that it does replace the user's name with the prety version (i.e. fmartin instead of xfm).

What I'm trying to do is to prevent users that are -not- in the userdb, from sending external mail at all, only local email.

Fred

[Steven E. Protter]

Shalom,

Then redirect them to local accounts with genericstables. That should be the default anyway. I like the link you bunnied thats where I learned this stuff.

SEP

[Fred Martin_1]

Court,

The rule described in that link looks like it would do the trick. I can easily come up with a script to create an intern.only list based on local users that are not already in my userdb.

I'm not sure where to insert the ruleset into the cf file though.

Is the F command as shown to be taken literally or is {Internal} a parameter that I replace with something meaningful?

Thanks,
Fred

[Court Campbell]

As you should already know you will want to do the following first.

cp /etc/mail/sendmail.cf /etc/mail/sendmail.cf.bak

then vi the file. Go to the section labeled

################
# local info #
################


add the line

F{Internal}/etc/mail/intern.only

around there.

Then search for

SLocal_check_rcpt

add the ruleset lines there. Save the file, restart sendmail, then test it out.

[Fred Martin_1]

I get no errors from sendmail when restarting but the additions don't seem to have any effect.

Wasn't sure of the format of the intern.only file, but I put a local user name (xfm) in there by itself on a line.

I also ran sendmail -bt and test things like:
> Check_local_rcpt xfm

I've attached the "check RCPT TO:" section of my sendmail.cf file, without the new rules, hoping someone can recommend where the lines should be placed.

I tried putting them in several spots in the attached section without any luck.

I think the trouble is, I've only a vague understanding of how the rules section works. I've been browsing the sendmail manual but still don't understand the general program flow.

Thanks in advance for help.

Fred

[Fred Martin_1]

I inserted the code directly below the SLocal_check_rcpt line. To verify that it was being read, I changed the occurances of "OK" in the new rules to "oK" and ran sendmail -bt.

> Local_check_rcpt xfm
Local_check_rcpt input: xfm
canonify input:
canonify returns: < @ >
Local_check_rcpt returns: oK
>

So - the new rules certainly are being read.

Still, it isn't working.

[Fred Martin_1]

I think I have some idea now but I'm not there yet.

If you look at the rules, it checks the sender first, then the recipient.

It returns an "OK" on the "someone else" line every time.

So, it thinks the sender xfm is not a local user. Therefore it quits, assuming that I am not a user that needs to be restricted.

When in -bt, I tested the contents of my intern.only file with this:

> $={Internal}
xfm

So, that works.

I'm guessing this has something to do with the "w" in the tests for $=w.

Not sure how to read that, other than $= should list the members of w.

Can someone help explain what this rule is doing exactly?

R$* $| $={Internal} <@$=w.> $: $1

[Fred Martin_1]

Well I'm not sure what to make of this. I've been testing this all weekend.

Referring to the link provided by Court:

http://www.sendmail.org/~ca/email/restrict.html

I placed the rules directly below the line:

SLocal_check_rcpt

In my sendmail.cf file, it looked like this before inserting the rules:

SLocal_check_rcpt
Scheck_rcpt
...etc...

So I placed them right between the two 'S' lines, above.

I created the file 'intern.only' and put the required 'F' line in the .cf file. In -bt mode, I tested that, it properly reads and displays the contents of the file.

I've learned quite a bit about rule writing, the operators, and LHS/RHS by reading in the O'Reilly Sendmail book, and by reading tutorials online.

It appears that this should work, yet it seems to be completely ignored.

Any advise?

[Fred Martin_1]

I began to suspect that this rule is not being called at all. So I wrote this:

SLocal_check_rcpt
R$* $#error $@ 5.1.8 $: "Error"

Then using -bt I tried it:

> Local_check_rcpt xfm
> Local_check_rcpt xfm
Local_check_rcpt input: xfm
Local_check_rcpt returns: $# error $@ 5 . 1 . 8 $: "error"

So that's good. Then I did this:

$ echo hey | sendmail xfm

The mail was delivered, no errors, no bounce.

Can I assume that Local_check_rcpt is not being called at all?