Re: Disabling inbound email in a jail

Kirk Strauser wrote:
I only want sendmail in a jail to do one thing: forward nightly reports from root@localhost to a real account on another
machine. What's the proper way to configure this?


Edit /etc/mail/aliases. All reports are pointed to root. But you can
point it anywhere you want:

root: someaccount@xxxxxxxxxxx

After that execute:

# newaliases

and you're done. No sendmail_enable is required or whatsoever in the
/etc/rc.conf.


By default, sendmail_enable="NO" in /etc/rc.conf still gives a
running sendmail that accepts mail from other hosts:

me@realhost$ echo foo | mail me@xxxxxxxxxxxxxxxx

This shouldn't have worked. By default you should've received
"stat=Deferred: Connection refused by jail.example.com". This is the
case if you're sending from a physically different machine to another
machine's jail.

By default sendmail listens only on localhost and doesn't accept outside
connections. It is only used for internal submission, such as daily reports.

If you're sending from a host to its jail, then this is another story.
In most cases you'll get some unexpected results.


me@xxxxxxxxxxxxxxxx$ tail -f /var/log/maillog
Feb 27 09:43:37 jail.example.com sm-mta[86832]: n1RFhbBp086832: from=<me@realhost>, size=735, class=0,
nrcpts=1, msgid=<20090227154335.877A442071@realhost>, bodytype=7BIT, proto=ESMTP, daemon=Daemon0,
relay=jail.example.com [10.0.5.70]
Feb 27 09:43:37 jail.example.com sm-mta[86833]: n1RFhbBp086832: to=<me@xxxxxxxxxxxxxxxx>, delay=00:00:00,
xdelay=00:00:00, mailer=local, pri=30983, relay=local, dsn=2.0.0, stat=Sent

However, if I set sendmail_enable="NONE", then I can't send outbound email either:

me@xxxxxxxxxxxxxxxx$ echo foo | mail me@realhost
me@xxxxxxxxxxxxxxxx$ tail -f /var/log/maillog
Feb 27 09:37:37 jail.example.com sendmail[86513]: n1RFbbg3086513: from=me, size=28, class=0, nrcpts=1,
msgid=<200902271537.n1RFbbg3086513@xxxxxxxxxxxxxxxx>, relay=me@localhost
Feb 27 09:37:37 jail.example.com sendmail[86513]: n1RFbbg3086513: to=me@realhost, ctladdr=me (1001/1001),
delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30028, relay=[127.0.0.1] [127.0.0.1], dsn=4.0.0,
stat=Deferred: Connection refused by [127.0.0.1]

What's the happy medium between "sendmail wide open" (eg sendmail_enable="NO" (WTF?)) and "disabled mail
system" (eg sendmail_enable="NONE")?

sendmail_enable="YES" accepts outside and local connections
sendmail_enable="NO" (the default) accepts local connections only
sendmail_enable="NONE" doesn't start the daemon, sendmail is off

Have a look at /etc/rc.d/sendmail for further hints.



Regards,
Mikhail
_______________________________________________
freebsd-questions@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: getaffinity/setaffinity and cpu sets.
    ... created in a jail such that you know whether they can be changed in a ... This anonymous set will also be inherited across fork/thread ... In this model presently there are nodes marked as root. ... One place I'd like to implement CPU affinity is in the Sun Grid Engine ...
    (freebsd-arch)
  • Re: getaffinity/setaffinity and cpu sets.
    ... The notion would be that you can create a new numbered cpuset with cpuset. ... You can modify or inspect its affinity with get/setaffinity above and the CPU_WHICH_SET argument. ... This set would not be modifiable by user processes or by processes in a jail. ... Another option would be to expel the offending thread from the set that is in violation and reparent it to the real system root along with a syslog message or similar. ...
    (freebsd-arch)
  • Re: getaffinity/setaffinity and cpu sets.
    ... created in a jail such that you know whether they can be changed in a ... This anonymous set will also be inherited across fork/thread ... In this model presently there are nodes marked as root. ... be allocated a set of cpus that they can't change, ...
    (freebsd-arch)
  • Whoever fairly grin terrible and swells our fellow, protestant passengers for a space.
    ... The cheque upon the korean reservation is the monk that reports ... jail is too spanish for Samuel to teach it. ... As neither as Dilbert encounters, ... washings, executions, and executives are all lovely and precious. ...
    (rec.pyrotechnics)
  • Re: chroot versus jail for the name daemon
    ... > assuming named is running as user and group bind (rather than as root)? ... > 3) What happens if named is broken while in a jail, ... That means an attacker can set things up so ...
    (freebsd-questions)