Smrsh

Aus UUGRN
Version vom 7. Mai 2007, 09:47 Uhr von Rabe (Diskussion | Beiträge) (loopback-wikilink.)
(Unterschied) ← Nächstältere Version | Aktuelle Version (Unterschied) | Nächstjüngere Version → (Unterschied)

Beschreibung[Bearbeiten]

aus smrsh(8)
The smrsh program is intended as a replacement for sh for use in the
"prog" mailer in sendmail(8) configuration files. It sharply limits
the commands that can be run using the "|program" syntax of sendmail
in order to improve the over all security of your system. Briefly,
even if a "bad guy" can get sendmail to run a program without going
through an alias or forward file, smrsh limits the set of programs that
he or she can execute.

Fehler mit procmail[Bearbeiten]

aus /var/log/maillog
May  5 18:22:54 example sm-mta[26361]: l45GMlcv026361: from=<user@example.com>, size=1415, class=0, nrcpts=1, msgid=<463CAF19.6040700@example.com>, proto=ESMTP, daemon=Daemon0, relay=mail.example.com [195.49.138.11]
May  5 18:22:54 example smrsh: uid 32765: attempt to use "procmail" (stat failed)
May  5 18:22:54 example sm-mta[26362]: l45GMlcv026361: to="|exec /usr/local/bin/procmail", ctladdr=<dest@example.com> (32765/32765),  delay=00:00:00, xdelay=00:00:00, mailer=prog, pri=31643, dsn=5.0.0, stat=Service unavailable
May  5 18:22:54 example sm-mta[26362]: l45GMlcv026361: l45GMscv026362: DSN: Service unavailable
Abhilfe
Hinweis gibt smrsh(8). Soll procmail oder ein anderes Programm von smrsh aufgerufen werden, so muss dieses in /usr/libexec/sm.bin/ (FreeBSD) ge(sym)linkt werden. Andere Systeme haben ggf. andere Locations dafür.