Sendmail and Virtual Hosts

[vonleigh]

Hello,

Today I was trying to wrestle sendmail into accepting virtual hosts. I tried following the writeup on it from the sendmail.org site, but ran into some problems.

<http://www.sendmail.org/virtual-hosting.html>

Since I am a Unix newby I'm hoping I can get some help.

My first problem is that the page there list a 'Mailserver.mc' file. I tried locating it, but I guess this distribution doesn't have that file.

I tried creating a mailserver.mc file using the command "m4 /m4/cf.m4 mailserver.mc > mailserver.cf" but I get "permission denied".

I'm wondering exactly where do I need to add the "FEATURE(`virtusertable', `dbm /etc/mail/virtusertable')dnl". Since it seems you shouldn't add it to a file existing there, but generate the config file.

As you can see I am very lost and appreciate any and all help.



Sincerely,
Vonleigh

[vonleigh]

One more thing: How do you Sighup sendmail?


thanks,
Vonleigh

[pmccann]

This one should be easy! (I have, unfortunately, no idea about the virtual hosts stuff. )

I'm assuming that you've got your machine set up as a mailserver, and have your domain and hostname set appropriately (etc etc). Just find the sendmail process and send it a "kill -HUP" signal. The daemon will catch that signal and (I imagine) reread/re-evaluate all of its configuration files.

In commands:

% ps -wwax | grep "[s]endmail"

This should give you a line something like:

246 ?? Ss 0:00.71 sendmail

The first entry there is the PID (process identification number) of the sendmail process. To send a hangup signal to this process you just need to use

% sudo kill -HUP 246
password: ******

Just enter your usual password here. If you see more than one sendmail process it'll probably be the smallest PID that'll be the daemon! Oh yeah, you might also sometimes see people write

% sudo kill -1 246

That's exactly the same as the above (-1 == -HUP), but makes me kind of nervous. I always dread forgetting the minus in front of the 1, and well, let's just say that on a machine with a hundred users or so that's not a very pretty sight to behold!! Not *so* bad on a personal OSX box, but still a nasty shock!

(In case anyone doesn't see what happens then: PID 1 is "init", the primordial unix process, a mother who gathers all the orphaned processes of the unix world to her side and gently coddles them until they're killed manually. All processes on your machine are descended from this "African Eve(nt)". Kill PID 1 and you make your machine go BANG in a big way. "kill" takes a list of processes to wipe out, so "sudo kill 1 246" is not nice. Don't cut and paste this last command!)

Cheers,
Paul

[vonleigh]

Hello,

Thanks for responding Paul.

I tried getting the PID using the method you described and it didn't seem to work. I believe sendmail to be running though, is there anywhere to check?

I know that getting the PID is a black art, I still haven't figured it out but it involves grep.

When trying "ps -wwax | grep "[s]endmail"" nothing came up. I tried just putting sendmail between quotes (without the brackets), and I got what I think is the PID of the grep "434 std R+ 0:00.00 grep sendmail"

Could it be that sendmail isn't running?

For an update. I finally got virtusertable to exist. I used m4 to create a sendmail.cf file with the mentioned Feature.

It wasn't working because of the bug that involves sudo and the > character to add stuff to a file (mt figured this one out somewhere in another thread). So I did it with sudo -s and it worked ok.

In any case, now when I try out sendmail by using "sendmail -bt", when I put in:

"/map virtusert @domain.com", I get:
"map_lookup: virtuser (@domain.com) returns name@domainIwant.com (0)"

Now up to this point it all seems fine and dandy, since that is exactly the behavior I want. The problem is when I send a message using mail.app to "anything@domain.com", It never gets there, nor do I get an error.

If I use "mail anything@domain.com" the message goes to my username, which is odd as the virtusertable only has a catch-all pointing to my username, on a domain I haven't moved to this machine yet.

This is getting harder and harder, I hope I'm moving in the right direction.



Thanks,
Vonleigh

[vonleigh]

Hello,

Well I restarted and it's all working, now the grep works as it should. I had a mistake in my /etc/hostconfig file, Mailserver was OFF. Thanks Paul for the explanation, I'll clip it and save it for future reference.

One question though, why did you write sendmail with brackets? ("[s]endmail").

OK, now the question is completely different. What must I do so that my sendmail doesn't become something used by hackers.

When checking my logs for apache, there were bunches and bunches of attacks for stupid IIS hacks. I'm sure If I leave Mailserver=ON I'm going to get attacked.

Since I don't want to become an unwilling spammer, how do I secure it?


thanks,
Vonleigh

[stetner]

WRT the grep and the square brackets... If you just do a ps -aux | grep sendmail You find (as you did) that the grep finds itself (sometimes) in the process list because it too has a sendmail in the process name area. To avoid this people use:ps -aux | grep sendmail | grep -v grepwhich say don't match lines with grep in it. Too much typing!

Grep has a feature where you can search for multiple characters in one position. IE if you want to find lines that contain both 'cat' and 'can' you would grep like:ps -aux | grep "ca[nt]"It say search for lines with a c, then an a, then either an n or a t.

By using the feature of grep that allows you to search for multiple characters in one position you can search for "[s]endmail" which says search for an s or, oh, no more letters, just an s then followed by 'endmail', in otherwords 'sendmail'. But now the grep command has the string [s]endmail in it, including the square brackets, which doesn't get matched.

Whew

Cheers

[pmccann]

Hi again,

I wouldn't be *too* worried about having the mailserver on: default permissions/security on sendmail are a whole lot safer and more restrictive than they used to be . People don't like ending being blacklisted, so open relaying isn't the norm any more! I should add the *strong* warning that I'm anything but a sendmail expert, so do some digging to convince yourself (or otherwise!).

For the easy question: the square brackets just stop the grep from matching itself. More technically, what's happening is that you're feeding grep a one character "character class" (eg, the [s] in "[s]endmail"). What's a character class? Just a list of characters, any of which can match that position in the string. So something like

grep "[sm]endmail"

would match both sendmail and mendmail, both of which you're trying to achieve. You can also use ranges inside there:

grep "[s-v]endmail"

and so on, or number ranges as well. But this is all off-track. The key point is that the string that grep is looking for when we use "[s]endmail" is still just "sendmail", but the grep process itself nowhere contains the string sendmail, because of those brackets in there: very sneaky stuff! The other, much more common (downright "garden variety", in fact) way to do this is to feed the output to a second grep:

ps -wwaux | grep sendmail | grep -v grep

Here the -v means "print anything that *doesn't* contain the following string". I just think the first version is distinctly groovier. Now I've just got to find a decent way of making a tcsh alias to do it! My existing one is a bit ugly, and badly needs a massage. Maybe that'll be tonight's fun. Nup, it's going to inevitably be uglier than just throwing in the extra grep. Law of diminishing returns and all that. So in my .cshrc I should have something like:

alias psa 'ps -wwaux "\!*" | grep -v grep'

which you can use by just entering:

% psa cron

or whatever else you're hunting for. (Apologies if this is obvious.)

If I dig up anything helpful re sendmail security in osx I'll pass it through. (Aaargh! Just noticed that someone else has posted a reply before I've finished this: prepare for redundancy in 10,9,8,7,6,5,4,3,2,1 seconds....)

Cheers,
Paul

[pmccann]

I *knew* it: beaten by a short half head. Which means there's only one thing left to add:



+-+-+-+-+
|s|n|a|p|
+-+-+-+-+



(send those proportional fonts to the pits of hell: what is this "information superhighway" thing anyway? What's wrong with usenet?

"Now, where are my glasses: Waldo? Presley?")