Archive for sendmail

2 results.

Sendmail TLS handshake errors (dh key too small)

Jul06
by Frank on July 6, 2015 at 07:42
Posted In: sendmail

Ooops – some recent openssl update seems to have “broken” things. Well, technically they’re just dismissing weak keys (Logjam), but still – annoying side effect.

TL;DR fix:
openssl dhparam -out /etc/pki/tls/certs/dhparams.pem 1024

Then edit your sendmail.mc by adding (if you have old versions – Fedora 10 or similar, comment out the two SSLOptions):
LOCAL_CONFIG
O CipherList=HIGH:!ADH
O DHParameters=/etc/pki/tls/certs/dhparams.pem
O ServerSSLOptions=+SSL_OP_NO_SSLv2 +SSL_OP_NO_SSLv3 +SSL_OP_CIPHER_SERVER_PREFERENCE
O ClientSSLOptions=+SSL_OP_NO_SSLv2 +SSL_OP_NO_SSLv3

run “make” or whatever to re-create your sendmail.cf, then restart sendmail.

Quick little test-command:
openssl s_client -starttls smtp -crlf -connect mail.example.com:smtp

For more info, see these links:
http://serverfault.com/questions/700655/sendmail-rejecting-some-connections-with-handshake-failure-ssl-alert-number-40
http://www.reddit.com/r/sysadmin/comments/3ay2ez/openssls_logjam_cve20154000_fixes_break_smtp/
https://weakdh.org/sysadmin.html

 Comment 

Sendmail Recipient rewrite

Jun18
by Frank on June 18, 2012 at 12:38
Posted In: sendmail

Thanks to Sendmail/Unix GURU Gernot, here’s an m4 file (stick it in /usr/share/sendmail-cf/cf) that rewrites recipients: OS_special

We had the insane situation at work where emails had to get addressed to “it@acme.com”, but “acme.com” didn’t have an “it”, and the email was actually supposed to go to “smurf@wileycoyote.com”. Don’t ask – it’s ridiculous.

A more realistic implementation would be, for instance, that an email destined to “smurf@acme.com” is not supposed to go to the default mail server, but rather some test-box/honeypot/whatever system. So instead of routing it to “smurf@exchange.acme.com”, we can route it to “smurf@testme.acme.com”

Changes to your existing sendmail.mc file:

At the beginning, do a
include(`/usr/share/sendmail-cf/cf/OS_special.m4')

At the end, after “LOCAL_CONFIG”, but before “LOCAL_RULESETS” (or at the very end if you have neither, do this:
LOCAL_RULE_0
OS_SPECIAL(`smurf@acme.com',smurf,testme.acme.com)

And then rebuild your sendmail.cf

 Comment