README revision 90792
138032Speter 238032SpeterREADME smrsh - sendmail restricted shell. 338032Speter 438032SpeterThis README file is provided as a courtesy of the CERT Coordination Center, 564562SgshapiroSoftware Engineering Institute, Carnegie Mellon University. This file is 638032Speterintended as a supplement to the CERT advisory CA-93:16.sendmail.vulnerability, 738032Speterand to the software, smrsh.c, written by Eric Allman. 838032Speter 938032Speter 1038032Speter 1138032SpeterThe smrsh(8) program is intended as a replacement for /bin/sh in the 1238032Speterprogram mailer definition of sendmail(8). This README file describes 1338032Speterthe steps needed to compile and install smrsh. 1438032Speter 1538032Spetersmrsh is a restricted shell utility that provides the ability to 1638032Speterspecify, through a configuration, an explicit list of executable 1738032Speterprograms. When used in conjunction with sendmail, smrsh effectively 1838032Speterlimits sendmail's scope of program execution to only those programs 1938032Speterspecified in smrsh's configuration. 2038032Speter 2164562Sgshapirosmrsh has been written with portability in mind, and uses traditional 2238032SpeterUnix library utilities. As such, smrsh should compile on most 2338032SpeterUnix C compilers. 2438032Speter 2564562Sgshapirosmrsh should build on most systems with the enclosed Build script: 2638032Speter 2764562Sgshapiro host.domain% sh Build 2838032Speter 2964562SgshapiroTo compile smrsh.c by hand, use the following command: 3038032Speter 3164562Sgshapiro host.domain% cc -o smrsh smrsh.c 3238032Speter 3338032SpeterFor machines that provide dynamic linking, it is advisable to compile 3438032Spetersmrsh without dynamic linking. As an example with the Sun Microsystems 3538032Spetercompiler, you should compile with the -Bstatic option. 3638032Speter 3764562Sgshapiro host.domain% cc -Bstatic -o smrsh smrsh.c 3864562Sgshapiro or 3964562Sgshapiro host.domain% sh Build LDOPTS=-Bstatic 4038032Speter 4164562SgshapiroWith gcc, the GNU C compiler, use the -static option. 4238032Speter 4364562Sgshapiro host.domain% cc -static -o smrsh smrsh.c 4464562Sgshapiro or 4564562Sgshapiro host.domain% sh Build LDOPTS=-static 4638032Speter 4738032Speter 4838032Speter 4964562SgshapiroAs root, install smrsh in /usr/libexec. Using the Build script: 5038032Speter 5164562Sgshapiro host.domain# sh Build install 5238032Speter 5364562SgshapiroFor manual installation: install smrsh in the /usr/libexec 5464562Sgshapirodirectory, with mode 511. 5564562Sgshapiro 5664562Sgshapiro host.domain# mv smrsh /usr/libexec 5764562Sgshapiro host.domain# chmod 511 /usr/libexec/smrsh 5864562Sgshapiro 5964562Sgshapiro 6064562Sgshapiro 6138032SpeterNext, determine the list of commands that smrsh should allow sendmail 6238032Speterto run. This list of allowable commands can be determined by: 6338032Speter 6464562Sgshapiro 1. examining your /etc/mail/aliases file, to indicate what commands 6564562Sgshapiro are being used by the system. 6638032Speter 6764562Sgshapiro 2. surveying your host's .forward files, to determine what 6864562Sgshapiro commands users have specified. 6938032Speter 7064562SgshapiroSee the man page for aliases(5) if you are unfamiliar with the format of 7164562Sgshapirothese specifications. Additionally, you should include in the list, 7238032Speterpopular commands such as /usr/ucb/vacation. 7338032Speter 7438032SpeterYou should NOT include interpreter programs such as sh(1), csh(1), 7564562Sgshapiroperl(1), uudecode(1) or the stream editor sed(1) in your list of 7638032Speteracceptable commands. 7738032Speter 7890792SgshapiroIf your platform doesn't have a default SMRSH_CMDDIR setting, you will 7971345Sgshapironext need to create the directory /usr/adm/sm.bin and populate 8038032Speterit with the programs that your site feels are allowable for sendmail 8138032Speterto execute. This directory is explicitly specified in the source 8238032Spetercode for smrsh, so changing this directory must be accompanied with 8338032Spetera change in smrsh.c. 8438032Speter 8538032Speter 8638032SpeterYou will have to be root to make these modifications. 8738032Speter 8838032SpeterAfter creating the /usr/adm/sm.bin directory, either copy the programs 8938032Speterto the directory, or establish links to the allowable programs from 9038032Speter/usr/adm/sm.bin. Change the file permissions, so that these programs 9138032Spetercan not be modified by non-root users. If you use links, you should 9238032Speterensure that the target programs are not modifiable. 9338032Speter 9464562SgshapiroTo allow the popular vacation(1) program by creating a link in the 9538032Speter/usr/adm/sm.bin directory, you should: 9638032Speter 9764562Sgshapiro host.domain# cd /usr/adm/sm.bin 9864562Sgshapiro host.domain# ln -s /usr/ucb/vacation vacation 9938032Speter 10038032Speter 10138032Speter 10238032Speter 10338032SpeterAfter populating the /usr/adm/sm.bin directory, you can now configure 10438032Spetersendmail to use the restricted shell. Save the current sendmail.cf 10538032Speterfile prior to modifying it, as a prudent precaution. 10638032Speter 10764562SgshapiroTypically, the program mailer is defined by a single line in the 10838032Spetersendmail configuration file, sendmail.cf. This file is traditionally 10964562Sgshapirofound in the /etc, /usr/lib or /etc/mail directories, depending on 11038032Speterthe UNIX vendor. 11138032Speter 11238032SpeterIf you are unsure of the location of the actual sendmail configuration 11338032Speterfile, a search of the strings(1) output of the sendmail binary, will 11438032Speterhelp to locate it. 11538032Speter 11664562SgshapiroIn order to configure sendmail to use smrsh, you must modify the Mprog 11764562Sgshapirodefinition in the sendmail.cf file, by replacing the /bin/sh specification 11864562Sgshapirowith /usr/libexec/smrsh. 11938032Speter 12038032SpeterAs an example: 12138032Speter 12238032SpeterIn most Sun Microsystems' sendmail.cf files, the line is: 12338032SpeterMprog, P=/bin/sh, F=lsDFMeuP, S=10, R=20, A=sh -c $u 12438032Speter 12538032Speterwhich should be changed to: 12664562SgshapiroMprog, P=/usr/libexec/smrsh, F=lsDFMeuP, S=10, R=20, A=sh -c $u 12764562Sgshapiro ^^^^^^^^^^^^^^^^^^ 12838032Speter 12938032SpeterA more generic line may be: 13038032SpeterMprog, P=/bin/sh, F=lsDFM, A=sh -c $u 13138032Speter 13238032Speterand should be changed to; 13364562SgshapiroMprog, P=/usr/libexec/smrsh, F=lsDFM, A=sh -c $u 13438032Speter 13538032Speter 13664562SgshapiroAfter modifying the Mprog definition in the sendmail.cf file, if a frozen 13738032Speterconfiguration file is being used, it is essential to create a new one. 13838032SpeterYou can determine if you need a frozen configuration by discovering 13938032Speterif a sendmail.fc file currently exists in either the /etc/, /usr/lib, 14038032Speteror /etc/mail directories. The specific location can be determined using 14138032Spetera search of the strings(1) output of the sendmail binary. 14238032Speter 14338032SpeterIn order to create a new frozen configuration, if it is required: 14464562Sgshapiro host.domain# /usr/lib/sendmail -bz 14538032Speter 14664562SgshapiroNow re-start the sendmail process. An example of how to do this on 14738032Spetera typical system follows: 14864562Sgshapiro 14964562Sgshapiro host.domain# cat /var/run/sendmail.pid 15064562Sgshapiro 130 15164562Sgshapiro /usr/sbin/sendmail -bd -q30m 15264562Sgshapiro host.domain# /bin/kill -15 130 15364562Sgshapiro host.domain# /usr/sbin/sendmail -bd -q30m 15464562Sgshapiro 15564562Sgshapiro 15690792Sgshapiro$Revision: 8.8 $, Last updated $Date: 2001/01/24 00:05:58 $ 157