README revision 38032
138032Speter 238032Speter 338032Speter 438032SpeterREADME smrsh - sendmail restricted shell. 538032Speter 638032Speter @(#)README 8.2 11/11/95 738032Speter 838032Speter 938032SpeterThis README file is provided as a courtesy of the CERT Coordination Center, 1038032SpeterSoftware Engineering Institute, Carnegie Mellon University. This file is 1138032Speterintended as a supplement to the CERT advisory CA-93:16.sendmail.vulnerability, 1238032Speterand to the software, smrsh.c, written by Eric Allman. 1338032Speter 1438032Speter 1538032Speter 1638032SpeterThe smrsh(8) program is intended as a replacement for /bin/sh in the 1738032Speterprogram mailer definition of sendmail(8). This README file describes 1838032Speterthe steps needed to compile and install smrsh. 1938032Speter 2038032Spetersmrsh is a restricted shell utility that provides the ability to 2138032Speterspecify, through a configuration, an explicit list of executable 2238032Speterprograms. When used in conjunction with sendmail, smrsh effectively 2338032Speterlimits sendmail's scope of program execution to only those programs 2438032Speterspecified in smrsh's configuration. 2538032Speter 2638032Spetersmrsh has been written with portability in mind, and uses traditional 2738032SpeterUnix library utilities. As such, smrsh should compile on most 2838032SpeterUnix C compilers. 2938032Speter 3038032Speter 3138032Speter 3238032SpeterTo compile smrsh.c, use the following command: 3338032Speter 3438032Speterhost.domain% cc -o smrsh smrsh.c 3538032Speter 3638032SpeterFor machines that provide dynamic linking, it is advisable to compile 3738032Spetersmrsh without dynamic linking. As an example with the Sun Microsystems 3838032Spetercompiler, you should compile with the -Bstatic option. 3938032Speter 4038032Speterhost.domain% cc -Bstatic -o smrsh smrsh.c 4138032Speter 4238032Speter 4338032SpeterChoose a directory that smrsh will reside in. We will use the traditional 4438032Speter/usr/local/etc directory for the remainder of this document. 4538032Speter 4638032SpeterAs root, install smrsh in /usr/local/etc directory, with mode 511. 4738032Speter 4838032Speterhost.domain# mv smrsh /usr/local/etc 4938032Speterhost.domain# chmod 511 /usr/local/etc/smrsh 5038032Speter 5138032Speter 5238032Speter 5338032SpeterNext, determine the list of commands that smrsh should allow sendmail 5438032Speterto run. This list of allowable commands can be determined by: 5538032Speter 5638032Speter 1. examining your /etc/aliases file, to indicate what commands 5738032Speter are being used by the system. 5838032Speter 5938032Speter 2. surveying your host's .forward files, to determine what 6038032Speter commands users have specified. 6138032Speter 6238032SpeterSee the man page for aliases(5) if you are unfamiliar with the format of 6338032Speterthese specifications. Additionally, you should include in the list, 6438032Speterpopular commands such as /usr/ucb/vacation. 6538032Speter 6638032SpeterYou should NOT include interpreter programs such as sh(1), csh(1), 6738032Speterperl(1), uudecode(1) or the stream editor sed(1) in your list of 6838032Speteracceptable commands. 6938032Speter 7038032Speter 7138032SpeterYou will next need to create the directory /usr/adm/sm.bin and populate 7238032Speterit with the programs that your site feels are allowable for sendmail 7338032Speterto execute. This directory is explicitly specified in the source 7438032Spetercode for smrsh, so changing this directory must be accompanied with 7538032Spetera change in smrsh.c. 7638032Speter 7738032Speter 7838032SpeterYou will have to be root to make these modifications. 7938032Speter 8038032SpeterAfter creating the /usr/adm/sm.bin directory, either copy the programs 8138032Speterto the directory, or establish links to the allowable programs from 8238032Speter/usr/adm/sm.bin. Change the file permissions, so that these programs 8338032Spetercan not be modified by non-root users. If you use links, you should 8438032Speterensure that the target programs are not modifiable. 8538032Speter 8638032SpeterTo allow the popular vacation(1) program by creating a link in the 8738032Speter/usr/adm/sm.bin directory, you should: 8838032Speter 8938032Speterhost.domain# cd /usr/adm/sm.bin 9038032Speterhost.domain# ln -s /usr/ucb/vacation vacation 9138032Speter 9238032Speter 9338032Speter 9438032Speter 9538032SpeterAfter populating the /usr/adm/sm.bin directory, you can now configure 9638032Spetersendmail to use the restricted shell. Save the current sendmail.cf 9738032Speterfile prior to modifying it, as a prudent precaution. 9838032Speter 9938032SpeterTypically, the program mailer is defined by a single line in the 10038032Spetersendmail configuration file, sendmail.cf. This file is traditionally 10138032Speterfound in the /etc, /usr/lib or /etc/mail directories, depending on 10238032Speterthe UNIX vendor. 10338032Speter 10438032SpeterIf you are unsure of the location of the actual sendmail configuration 10538032Speterfile, a search of the strings(1) output of the sendmail binary, will 10638032Speterhelp to locate it. 10738032Speter 10838032SpeterIn order to configure sendmail to use smrsh, you must modify the Mprog 10938032Speterdefinition in the sendmail.cf file, by replacing the /bin/sh specification 11038032Speterwith /usr/local/etc/smrsh. 11138032Speter 11238032SpeterAs an example: 11338032Speter 11438032SpeterIn most Sun Microsystems' sendmail.cf files, the line is: 11538032SpeterMprog, P=/bin/sh, F=lsDFMeuP, S=10, R=20, A=sh -c $u 11638032Speter 11738032Speterwhich should be changed to: 11838032SpeterMprog, P=/usr/local/etc/smrsh, F=lsDFMeuP, S=10, R=20, A=sh -c $u 11938032Speter ^^^^^^^^^^^^^^^^^^^^ 12038032Speter 12138032SpeterA more generic line may be: 12238032SpeterMprog, P=/bin/sh, F=lsDFM, A=sh -c $u 12338032Speter 12438032Speterand should be changed to; 12538032SpeterMprog, P=/usr/local/etc/smrsh, F=lsDFM, A=sh -c $u 12638032Speter 12738032Speter 12838032SpeterAfter modifying the Mprog definition in the sendmail.cf file, if a frozen 12938032Speterconfiguration file is being used, it is essential to create a new one. 13038032SpeterYou can determine if you need a frozen configuration by discovering 13138032Speterif a sendmail.fc file currently exists in either the /etc/, /usr/lib, 13238032Speteror /etc/mail directories. The specific location can be determined using 13338032Spetera search of the strings(1) output of the sendmail binary. 13438032Speter 13538032SpeterIn order to create a new frozen configuration, if it is required: 13638032Speterhost.domain# /usr/lib/sendmail -bz 13738032Speter 13838032SpeterNow re-start the sendmail process. An example of how to do this on 13938032Spetera typical system follows: 14038032Speter 14138032Speterhost.domain# /usr/bin/ps aux | /usr/bin/grep sendmail 14238032Speterroot 130 0.0 0.0 168 0 ? IW Oct 2 0:10 /usr/lib/sendmail -bd -q 14338032Speterhost.domain# /bin/kill -9 130 14438032Speterhost.domain# /usr/lib/sendmail -bd -q30m 145