HP Visualize J210XC IRIX to HP-UX Migration Guide - Page 113

Making sendmail Executable, Creating System-wide Mail Aliases, Invoking the sendmail Daemon

Page 113 highlights

sendmail Making sendmail Executable To make sendmail executable, as superuser, issue the command: # chmod 5555 /usr/lib/sendmail sendmail is normally run setuid to root (mode 5555). The default configuration is believed to be safe. However, it is possible to misconfigure sendmail so that it inappropriately promotes the privilege of ordinary users. If sendmail does not run setuid to root, this risk is eliminated. In this case, sendmail ignores the S mailer flag (not specified in the mailers defined in the default configuration file) and the values of the u and g configuration options, since it is unable to setuid to these users when executing mailers. sendmail can be run non-setuid (mode 1555) if the following changes to the default configuration are made: 1. The queue directory (by default, /usr/spool/mqueue) must be writeable by all (mode 0777). 2. The alias database (by default, /usr/lib/aliases.dir and /usr/lib/aliases.pag) must be writeable by all (mode 0666). If these files do not already exist, the superuser must first create them and then chmod them: # /usr/lib/sendmail -bi # chmod 666 /usr/lib/aliases.dir /usr/lib/aliases.pag Making these changes creates some security risk. Anyone will be able to delete mail from the mail queue. However, no one will be able to read other people's mail in the mail queue. Creating System-wide Mail Aliases The /etc/newconfig aliases file is an example alias file that contains default aliases needed by sendmail. To create system-wide mail aliases, copy /etc/newconfig/aliases to /usr/lib/aliases. You can add any aliases that are appropriate for your system by editing the /usr/lib/aliases file. Once sendmail is executable, issue the following command: # newaliases This creates the alias database files /usr/lib/aliases.dir and /usr/lib/aliases.pag. Invoking the sendmail Daemon To start the sendmail daemon, as superuser, issue the following command: # /usr/lib/sendmail -bd -q30m The -bd mode initializes the sendmail daemon to receive mail from the network. The -q30m flag causes sendmail to process the mail queue every 30 minutes. Whenever your system is rebooted, if sendmail is executable, the /etc/netbsdsrc script does the following: 1. Starts the sendmail daemon to accept SMTP connections from the network and to process the mail queue every 30 minutes. 2. Logs the restart of the sendmail daemon in the mail log, usually /usr/spool/mqueue/syslog. 108

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125

sendmail
108
Making sendmail Executable
To make
sendmail
executable, as
superuser
, issue the command:
# chmod 5555 /usr/lib/sendmail
sendmail
is normally run
setuid
to
root
(mode 5555). The default configuration is believed to be safe.
However, it is possible to misconfigure
sendmail
so that it inappropriately promotes the privilege of
ordinary users.
If
sendmail
does not run
setuid
to
root
, this risk is eliminated. In this case,
sendmail
ignores the
S
mailer
flag (not specified in the mailers defined in the default configuration file) and the values of the
u
and
g
configuration options, since it is unable to
setuid
to these users when executing mailers.
sendmail
can be run non-
setuid
(mode 1555) if the following changes to the default configuration are
made:
1.
The queue directory (by default,
/usr/spool/mqueue
) must be writeable by all (mode 0777).
2.
The
alias
database (by default,
/usr/lib/aliases.dir
and
/usr/lib/aliases.pag
) must be writeable by all
(mode 0666). If these files do not already exist, the
superuser
must first create them and then
chmod
them:
# /usr/lib/sendmail -bi
# chmod 666 /usr/lib/aliases.dir /usr/lib/aliases.pag
Making these changes creates some security risk. Anyone will be able to delete mail from the mail queue.
However, no one will be able to read other peopleĀ±s mail in the mail queue.
Creating System-wide Mail Aliases
The
/etc/newconfig aliases
file is an example
alias
file that contains default
aliases
needed by
sendmail
.
To create system-wide mail
aliases
, copy
/etc/newconfig/aliases
to
/usr/lib/aliases
. You can add any
aliases
that are appropriate for your system by editing the
/usr/lib/aliases
file. Once
sendmail
is
executable, issue the following command:
# newaliases
This creates the
alias
database files
/usr/lib/aliases.dir
and
/usr/lib/aliases.pag
.
Invoking the sendmail Daemon
To start the
sendmail
daemon, as
superuser
, issue the following command:
# /usr/lib/sendmail -bd -q30m
The
-bd
mode initializes the
sendmail
daemon to receive mail from the network. The
-q30m
flag causes
sendmail
to process the mail queue every 30 minutes.
Whenever your system is rebooted, if
sendmail
is executable, the
/etc/netbsdsrc
script does
the following:
1.
Starts the
sendmail
daemon to accept SMTP connections from the network and to process the mail
queue every 30 minutes.
2.
Logs the restart of the
sendmail
daemon in the mail log, usually
/usr/spool/mqueue/syslog
.