Subject: Unable to exchange mail after yao-smap patch

From: Patrick Mahan <[email-masked]>
Date: Wed, 27 Sep 2000 10:40:04 -0400

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Greetings,

I have seen folks post with similar
problems to mine, but have seen no
resolution, so forgive me if this is
redundant.

Successfuly applied the yao-smap patch
and recompile went well. Edited my
netperm-table as follows:

smap, smapd:    userid 8
smap, smapd:    groupid 12
smap, smapd:    directory
/var/spool/smap
smapd:          executable
/usr/local/etc/smapd
smapd:          sendmail
/usr/sbin/sendmail
smap:   permit-domains mydomain.com,
*.mydomain.com
smap:   permit-hosts 192.168.101.1
smap:           timeout
3600                                             

However, no mail is going through
firewall either way. There are no
references to smap in the syslog and
telnet to port 25 produces:

telnet: Unable to connect to remote
host: Connection refused 

ps ax shows that smap is running as
daemon.    

netstat -an on the internal mailserver
shows:

tcp        0      2
192.168.101.1:1763     
206.239.xxx.xxx:25       SYN_SENT
tcp        0      2
192.168.101.1:1682     
206.239.xxx.xxx:25       SYN_SENT   

which seems a tad odd to me as the
206.239.xxx.xxx is the external
interface on the firewall.

Where have I gone wrong? My hunch is the
netperm-table (I have tried things with
and without the "permit-" prefix). Any
and all help will be greatly
appreciated.  

Running on a Linux box.

Patrick

---

From: Joseph S D Yao <[email-masked]>
Date: Wed, 27 Sep 2000 17:05:26 -0400

On Wed, Sep 27, 2000 at 10:40:04AM -0400, Patrick Mahan wrote:
...
> resolution, so forgive me if this is

Oddly enough, this has been answered several times.  ;-}

> netstat -an on the internal mailserver

The "permit-" is stripped off only for certain keywords.  Very
idiosyncratic.  I'd give that feature an "F" and not play with it.

Your source code now has tons of comments in them.  They were lovingly
placed there for a reason.  Two of them say:

**	domains
**		"smap: domains ..." specifies the DNS domains which are
**		accepted as internal to the firewall.  If you accept
**		names in both @domain fashion and @host.domain fashion,
**		you should probably list both "domain" and "*.domain".
**	hosts
**		"smap: hosts ..." specifies the mail hosts that are to
**		be considered "internal".  These hosts may send mail to
**		anybody.  Wildcards may be used.

If you take out the "permit-"s, then your config above allows incoming
mail to "[email-masked]" and "[email-masked]".  It
allows outgoing mail only from the host whose IP address is
"192.168.101.1".

It still needs code in the "sendmail.cf" file on "192.168.101.1" to
send all non-local mail to the firewall, and code in the "sendmail.cf"
file on the firewall to send all accepted e-mail to the internal mail
server [192.168.101.1?].

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.