README revision 266527
138032Speter 238032SpeterREADME smrsh - sendmail restricted shell. 338032Speter 438032SpeterThis README file is provided as a courtesy of the CERT Coordination Center, 564562SgshapiroSoftware Engineering Institute, Carnegie Mellon University. This file is 638032Speterintended as a supplement to the CERT advisory CA-93:16.sendmail.vulnerability, 738032Speterand to the software, smrsh.c, written by Eric Allman. 838032Speter 938032Speter 1038032Speter 1138032SpeterThe smrsh(8) program is intended as a replacement for /bin/sh in the 1238032Speterprogram mailer definition of sendmail(8). This README file describes 1338032Speterthe steps needed to compile and install smrsh. 1438032Speter 1538032Spetersmrsh is a restricted shell utility that provides the ability to 1638032Speterspecify, through a configuration, an explicit list of executable 1738032Speterprograms. When used in conjunction with sendmail, smrsh effectively 1838032Speterlimits sendmail's scope of program execution to only those programs 1938032Speterspecified in smrsh's configuration. 2038032Speter 2164562Sgshapirosmrsh has been written with portability in mind, and uses traditional 2238032SpeterUnix library utilities. As such, smrsh should compile on most 2338032SpeterUnix C compilers. 2438032Speter 2564562Sgshapirosmrsh should build on most systems with the enclosed Build script: 2638032Speter 27182352Sgshapiro host.domain% sh ./Build 2838032Speter 2964562SgshapiroTo compile smrsh.c by hand, use the following command: 3038032Speter 3164562Sgshapiro host.domain% cc -o smrsh smrsh.c 3238032Speter 3338032SpeterFor machines that provide dynamic linking, it is advisable to compile 3438032Spetersmrsh without dynamic linking. As an example with the Sun Microsystems 3538032Spetercompiler, you should compile with the -Bstatic option. 3638032Speter 3764562Sgshapiro host.domain% cc -Bstatic -o smrsh smrsh.c 3864562Sgshapiro or 39182352Sgshapiro host.domain% sh ./Build LDOPTS=-Bstatic 4038032Speter 4164562SgshapiroWith gcc, the GNU C compiler, use the -static option. 4238032Speter 4364562Sgshapiro host.domain% cc -static -o smrsh smrsh.c 4464562Sgshapiro or 45182352Sgshapiro host.domain% sh ./Build LDOPTS=-static 4638032Speter 47120256SgshapiroThe following C defines can be set defined to change the search path and 48120256Sgshapirothe bin directory used by smrsh. 4938032Speter 50120256Sgshapiro-DSMRSH_PATH=\"path\" \"/bin:/usr/bin:/usr/ucb\" The default search 51120256Sgshapiro path. 52120256Sgshapiro-DSMRSH_CMDDIR=\"dir\" \"/usr/adm/sm.bin\" The default smrsh 53120256Sgshapiro program directory 54120256Sgshapiro 55120256SgshapiroThese can be added to the devtools/Site/site.config.m4 file using the 56120256Sgshapiroglobal M4 macro confENVDEF or the smrsh specific M4 macro 57120256Sgshapiroconf_smrsh_ENVDEF. 5838032Speter 5964562SgshapiroAs root, install smrsh in /usr/libexec. Using the Build script: 6038032Speter 61182352Sgshapiro host.domain# sh ./Build install 6238032Speter 6364562SgshapiroFor manual installation: install smrsh in the /usr/libexec 6464562Sgshapirodirectory, with mode 511. 6564562Sgshapiro 6664562Sgshapiro host.domain# mv smrsh /usr/libexec 6764562Sgshapiro host.domain# chmod 511 /usr/libexec/smrsh 6864562Sgshapiro 6964562Sgshapiro 7064562Sgshapiro 7138032SpeterNext, determine the list of commands that smrsh should allow sendmail 7238032Speterto run. This list of allowable commands can be determined by: 7338032Speter 7464562Sgshapiro 1. examining your /etc/mail/aliases file, to indicate what commands 7564562Sgshapiro are being used by the system. 7638032Speter 7764562Sgshapiro 2. surveying your host's .forward files, to determine what 7864562Sgshapiro commands users have specified. 7938032Speter 8064562SgshapiroSee the man page for aliases(5) if you are unfamiliar with the format of 8164562Sgshapirothese specifications. Additionally, you should include in the list, 8238032Speterpopular commands such as /usr/ucb/vacation. 8338032Speter 8438032SpeterYou should NOT include interpreter programs such as sh(1), csh(1), 8564562Sgshapiroperl(1), uudecode(1) or the stream editor sed(1) in your list of 8638032Speteracceptable commands. 8738032Speter 8890792SgshapiroIf your platform doesn't have a default SMRSH_CMDDIR setting, you will 8971345Sgshapironext need to create the directory /usr/adm/sm.bin and populate 9038032Speterit with the programs that your site feels are allowable for sendmail 9138032Speterto execute. This directory is explicitly specified in the source 9238032Spetercode for smrsh, so changing this directory must be accompanied with 9338032Spetera change in smrsh.c. 9438032Speter 9538032Speter 9638032SpeterYou will have to be root to make these modifications. 9738032Speter 9838032SpeterAfter creating the /usr/adm/sm.bin directory, either copy the programs 9938032Speterto the directory, or establish links to the allowable programs from 10038032Speter/usr/adm/sm.bin. Change the file permissions, so that these programs 10138032Spetercan not be modified by non-root users. If you use links, you should 10238032Speterensure that the target programs are not modifiable. 10338032Speter 10464562SgshapiroTo allow the popular vacation(1) program by creating a link in the 10538032Speter/usr/adm/sm.bin directory, you should: 10638032Speter 10764562Sgshapiro host.domain# cd /usr/adm/sm.bin 10864562Sgshapiro host.domain# ln -s /usr/ucb/vacation vacation 10938032Speter 11038032Speter 11138032Speter 11238032Speter 11338032SpeterAfter populating the /usr/adm/sm.bin directory, you can now configure 11438032Spetersendmail to use the restricted shell. Save the current sendmail.cf 11538032Speterfile prior to modifying it, as a prudent precaution. 11638032Speter 11764562SgshapiroTypically, the program mailer is defined by a single line in the 11838032Spetersendmail configuration file, sendmail.cf. This file is traditionally 11964562Sgshapirofound in the /etc, /usr/lib or /etc/mail directories, depending on 12038032Speterthe UNIX vendor. 12138032Speter 12238032SpeterIf you are unsure of the location of the actual sendmail configuration 12338032Speterfile, a search of the strings(1) output of the sendmail binary, will 12438032Speterhelp to locate it. 12538032Speter 12664562SgshapiroIn order to configure sendmail to use smrsh, you must modify the Mprog 12764562Sgshapirodefinition in the sendmail.cf file, by replacing the /bin/sh specification 12864562Sgshapirowith /usr/libexec/smrsh. 12938032Speter 13038032SpeterAs an example: 13138032Speter 13238032SpeterIn most Sun Microsystems' sendmail.cf files, the line is: 13338032SpeterMprog, P=/bin/sh, F=lsDFMeuP, S=10, R=20, A=sh -c $u 13438032Speter 13538032Speterwhich should be changed to: 13664562SgshapiroMprog, P=/usr/libexec/smrsh, F=lsDFMeuP, S=10, R=20, A=sh -c $u 13764562Sgshapiro ^^^^^^^^^^^^^^^^^^ 13838032Speter 13938032SpeterA more generic line may be: 14038032SpeterMprog, P=/bin/sh, F=lsDFM, A=sh -c $u 14138032Speter 14238032Speterand should be changed to; 14364562SgshapiroMprog, P=/usr/libexec/smrsh, F=lsDFM, A=sh -c $u 14438032Speter 14538032Speter 14664562SgshapiroAfter modifying the Mprog definition in the sendmail.cf file, if a frozen 14738032Speterconfiguration file is being used, it is essential to create a new one. 14838032SpeterYou can determine if you need a frozen configuration by discovering 14938032Speterif a sendmail.fc file currently exists in either the /etc/, /usr/lib, 15038032Speteror /etc/mail directories. The specific location can be determined using 15138032Spetera search of the strings(1) output of the sendmail binary. 15238032Speter 15338032SpeterIn order to create a new frozen configuration, if it is required: 15464562Sgshapiro host.domain# /usr/lib/sendmail -bz 15538032Speter 15664562SgshapiroNow re-start the sendmail process. An example of how to do this on 15738032Spetera typical system follows: 15864562Sgshapiro 15964562Sgshapiro host.domain# cat /var/run/sendmail.pid 16064562Sgshapiro 130 16164562Sgshapiro /usr/sbin/sendmail -bd -q30m 16264562Sgshapiro host.domain# /bin/kill -15 130 16364562Sgshapiro host.domain# /usr/sbin/sendmail -bd -q30m 16464562Sgshapiro 16564562Sgshapiro 166266527Sgshapiro$Revision: 8.10 $, Last updated $Date: 2008-02-12 16:40:06 $ 167