Subject: smap

From: Don Pro <[email-masked]>
Date: Tue, 29 May 2001 11:57:30 -0400

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi,

My mail server cannot except or send mail from/to the internet after I
have installed the anti-relay, anti-spam patch for smap.  I have been
playing with this for some time, put it on the shelf for a bit and came
back to it with some new ideas.  I think I have most of it licked.  In
my /var/log./messages file, I see the error below.  Unfortunately, I
wish it were more descriptive as in what temp file, where and what
permission it is expecting.

May 29 11:55:14 lclweb smap[971]: fwtksyserr: cannot open temp file
Permission denied

Thanks,
Don

---

From: Ted Keller <[email-masked]>
Date: Tue, 29 May 2001 15:21:09 -0400 (EDT)

Don,

The temp file location is specified in your netperm-table under the
directory setting - normally something like /var/inspool

This directory should be owned by the uid of your smap process.

ted keller

---

From: Don Pro <[email-masked]>
Date: Tue, 29 May 2001 15:35:23 -0400

Hi Ted,

That is what I thought.  However, following is snippet from my netperm-table:

smap, smapd:    userid uucp
# Chroot location - note - you have to build the environment for sendmail....
# If you don't want to chroot - remove this line and all other addresses
# will be absolute
# smap, smapd:  rootdir /
# smap/smapd spool directory - relative to rootdir
smap, smapd:    spooldir /var/spool/smap
# smapd baddir - relative to rootdir
smapd:          baddir /var/spool/smap/baddir

ownership and permission of  /var/spool/smap is
drwx-r-xr-x    uucp    uucp

ownership and permission of  /var/spool/smap/baddir is
drwx-r-xr-x    uucp    uucp

Don

---

From: Rick Murphy <[email-masked]>
Date: Tue, 29 May 2001 17:25:14 -0400

At 11:57 AM 5/29/01 -0400, Don Pro wrote:
>Unfortunately, I wish it were more descriptive as in what temp file, where 
>and what

When receiving an incoming mail message, smap creates a temporary file to 
store it.
Whatever directory you run smap chrooted to (the "smap: directory xxx" line 
in your netperm-table) should be owned by the userid that you run smap 
under ("smap: userid xxx" line).
         -Rick

---

From: Ted Keller <[email-masked]>
Date: Tue, 29 May 2001 20:00:02 -0400 (EDT)

Rick,

That's somewhat dependent on who's copy of smap he is using.  When I
implemented my changes (done in parrallel to Jos), I changed the directory
setting to better implement the chroot environment for both smap/smapd
(smapd never did implement a chroot environment) then used spooldir to
make this relative to the rootdir chrooted area.  This may be a bit
unfortunate - and I appologise.  However, it did allow better control in
this area.

I suspect Don's issue may be dealing with the relative nature of the
spooldir netperm-entry - especially if the has maintained a rootdir entry
for his chroot environment.

For testing - it probably makes more sense to eliminate the rootdir
entries - and test using the native file structure.

ted keller

On Tue, 29 May 2001, Rick Murphy wrote:

> At 03:35 PM 5/29/01 -0400, Don Pro wrote:
> That's the problem - change "spooldir" to "directory".
>          -Rick
>
>

---

From: Rick Murphy <[email-masked]>
Date: Tue, 29 May 2001 20:12:19 -0400

>unfortunate - and I appologise.  However, it did allow better control in

Ah. That explains the entry I didn't recognize.
Gee - your changes finally fix a mistake I've made in the past (stating 
that smapd ran sendmail chrooted.)

>entries - and test using the native file structure.
I'll defer to you on this one.

It's getting to be time to have only one smap, I think. I've got a few 
weeks off at school in mid-june; maybe I should work on consolidating the 
patches?
         -Rick

---

From: Ted Keller <[email-masked]>
Date: Tue, 29 May 2001 21:59:57 -0400 (EDT)

Rick,

I should have all the changes in my version except the rbl block feature
that you added.  Now.... If I created a patch list - they would be bigger
than the original source ...  I've worked this puppy over pretty hard over
the past couple of years.  The big stuff I added was the strict syntax
checking code - and the spam block stuff based on the message header and
content.  The rest of it parrallels features that Jos added - evelop spam
checks, DNS validation, block from/to combinations - and retrofitted
patches that others (Tor for example) submitted.  Also eliminated most of
the malloc features - opting for fixed buffers whenever possible (no
memory leaks that way - well there's still one in there that I'm
ignoring).

Message body Spam filtering....

>From Line,
To line,
Subject Line
Header in general (any line)

First n lines of the text - html tags ignored
First m lines of html tags
First n lines of non-delimited strings

Flushes out some 20,000 messages weekly in my environment (of coarse I
tend to process some 200,000 messages weekly anyway).

ted keller

---

From: Don Pro <[email-masked]>
Date: Wed, 30 May 2001 09:55:12 -0400

> for his chroot environment.

Hmmm....maybe my problem is my misunderstanding is in my understanding of chroot.
The following is a snippet of code from your example netperm-table file.  If I
understand correctly:

*********************
smap, smapd:    userid 5
# Chroot location - note - you have to build the environment for sendmail....
# If you don't want to chroot - remove this line and all other addresses
# will be absolute
smap, smapd:    rootdir /fwroot
# smap/smapd spool directory - relative to rootdir
smap, smapd:    spooldir /var/inspool
# smapd baddir - relative to rootdir
smapd:          baddir  /var/spool/baddir
# location of sendmail - relative to rootdir
smapd:          sendmail /usr/lib/sendmail
*********************

smap temp files created it /fwroot/var/inspool
smap baddir file created in /fwroot/var/inspool/baddir
sendmail located in /fwroot/usr/lib/sendmail

As I was confused by above, I followed the directive in the first comment and
commented out the chroot line.  So, I am assuming that the paths are:

smap temp files created it /var/inspool
smap baddir file created in /var/inspool/baddir
sendmail located in /usr/lib/sendmail

I seem to be assuming wrong but as the error message does not state "where" it is
trying to create the temp file (and failing), hence the conundrum.

Any ideas?

Don

---

From: Joseph S D Yao <[email-masked]>
Date: Wed, 30 May 2001 12:30:03 -0400

> weeks off at school in mid-june; maybe I should work on consolidating the 

That was the whole point of my package - consolidating, debugging, AND
DOCUMENTING.  Some more consolidation can be done within that package,
but addition of other and perhaps better fixes is a great idea.  AND
DOCUMENTING.  ;-)

Meanwhile, I'm afraid my spare time is still running in the high
negatives.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
OSIS Center Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: Rick Murphy <[email-masked]>
Date: Tue, 29 May 2001 18:53:49 -0400

---

From: [email-masked]
Date: Thu, 31 May 2001 15:28:43 +0400

-----BEGIN PGP SIGNED MESSAGE-----

nuqneH,

The original TIS code has chroot commented out of smapd:

                chdir("/");
                if(chdir(cp->argv[0])) {
                        syslog(LLEV,"fwtksyserr: cannot chdir to spool directory
 %.512s: %m",cp->argv[0]);
                        exit(1);
                }
/*              if(chroot(cp->argv[0])) {
                        syslog(LLEV,"fwtksyserr: cannot chdir to spool directory
 %.512s: %m",cp->argv[0]);
                        exit(1);
                }
                chdir("/");
*/

> The following is a snippet of code from your example netperm-table file.  If I

                                     _     _  _  _  _      _  _
 {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
 (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
 [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!