Subject: SMAP giving me a headache

From: Don Pro <[email-masked]>
Date: Wed, 25 Apr 2001 10:24:26 -0400

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi all,

I'm running sendmail 8.9.3 on RedHat Linux 6.2
Relaying is denied by default.
I run fwtk 2.1

When I run SMAP, relaying is allowed.  However, if I try to run the
system without SMAP, internal users can no longer send mail to the
outside world as I get relaying denied messages.  How do I trouble shoot
this?  I would like to allow internal users to send mail out but keep
external users from using my server as a relay.

---

From: [email-masked]
Date: Wed, 25 Apr 2001 16:36:57 -0000 (GMT)

> this?  

You've got two choices: Either you run sendmail without the smap
wrapper and add your domain name in /etc/mail/relay-domains (or
whatever your sendmail.cf points at) or you apply the 'Yao patch' or
Ted Keller's patch for smap and adjust netperm-table accordingly. 

Btw: The sendmail issue is a FAQ. 

-- 
Radio HUNDERT,6 Medien GmbH Berlin
- EDV -
[email-masked]

---

From: Keith Young <[email-masked]>
Date: Wed, 25 Apr 2001 10:50:17 -0400

> external users from using my server as a relay.

Check your "/etc/sendmail.cf" file... it sounds like your
"/etc/mail/access" file is denying relays from anyone except for
127.0.0.1....

-- 
--Keith Young
-Director of Customer Care/Support, V-ONE Corp.
[email-masked]

---

From: Don Pro <[email-masked]>
Date: Wed, 25 Apr 2001 11:06:25 -0400

> Ted Keller's patch for smap and adjust netperm-table accordingly.

I've tried to use Ted's patch but when I install it, I can no longer send

or receive e-mail from the outside world.  I'll have a look at the 'Yao
patch'.  Failing that, I'll just ditch SMAP.

Thanks,
Don

---

From: [email-masked]
Date: Wed, 25 Apr 2001 16:34:52 -0000 (GMT)

---

From: Ted Keller <[email-masked]>
Date: Wed, 25 Apr 2001 11:45:11 -0400 (EDT)

Don,

I can help you through that problem if you forward the snippits in the
message log.  Check and verify the netperm table.  There are specific
settings indicating which hosts are allowed to "relay" to the outside
world and which have to have valid internal domain names.  Suspect the yao
patch has something very similar.  I sure wouldn't advise running sendmail
naked....

tek

---

From: Don Pro <[email-masked]>
Date: Wed, 25 Apr 2001 12:25:32 -0400

Hi Ted,

One thing I noticed is that there were no messages in my message log.  This was my
first red flag.   In order to allow relaying from my hosts (I have five domains), do
I have to configure this in my netperm-table file or simply add the domains to my
/etc/mail/access or /etc/mail/relay-comains file(s)?

Thanks,
Don

---

From: Ted Keller <[email-masked]>
Date: Wed, 25 Apr 2001 14:28:15 -0400 (EDT)

Don,

My method of implementing this is as follows.....

Using sendmail features - mailertable

internaldomain.com		smtp:internal-mailhub.internaldomain.com

example:

bfg.com		smtp:mh.bfg.com

Then in netperm-table

smap:		local-domain	internaldomain.com *.internaldomain.com

for example

smap:		local-domain	bfg.com *.bfg.com
or
smap:		local-domain	bfgoodrich.com

The first example allows all sub-domains.  The second example is an
individual domain without subdomains.

When using smap, all mail comes from localhost - so the sendmail
anti-relaying features are disabled because sendmail thinks it is making
local deliveries.  Therefore, anti-relaying features must be handled by
the smap routines.  Appropraite entries in netperm-table are:

smap:	local-domain	bfg.com *.bfg.com

and

smap:	check-relay	1

Also to turn on the DNS validation on from addresses...

smap:	check_domain	1

The logging funtions have not been modified.  However, on some systems I
noted that syslog does not work across a chrooted environment.  This is an
issue in early solaris systems.  For initial testing, I would recommend
getting things working in a non-chrooted environment - then migrate to a
chroot environment once you know what works and what doesn't.

tedkeller

---

From: Scott Campbell <[email-masked]>
Date: Wed, 25 Apr 2001 14:23:20 -0700 (PDT)

Is there a patch out there to add the userid option to plug-gw?  The man
page says it comes with it but that isn't what I see - plugs run as root.
I can find the code in the other proxies (http-gw, tn-gw, smap,ftp-gw...)
but the code isn't there in plug-gw.c to read in the netperm option.  I
found other people mentioning this in the mail archives but no-one posted
a solution that I could find.  If not then I will start trying to do one
but no guarantees on my c ability and turnaround time.

Thanks in advance

Scott E. Campbell
_______________________________
Computer Operations
Greater Victoria Public Library
Victoria BC CANADA

[email-masked]