[ale] more NIS/NFS questions (sendmail)

[Omar Loggiodice]

Michael Ivey Writes :
:
:Question is, how do I make outgoing mail work on the other hosts?  I'll 
:set up MX records for all of them to point to mailhost, but when a user 
:logged into hosta.gstv.gsu.edu sends mail, I want it to appear to come from 
:just user at gstv.gsu.edu.

Add this lines to sendmail.cf in hosta.gstv.gsu.edu:

# who I masquerade as (null for no masquerading) (see also $=M)
DMgstv.gsu.edu

This tells sendmail to masquerade as if the sending host was gstv.gsu.edu.

BTW, the redhat libc has NIS support compiled in, and you don't need to run
ypbind.

Also the rlogind daemon has a bug that can potentially be a security hazard
Here is the patch to solve that problem (it will be included in the next
releaae of netkit):

-------------------------- 
Hi David,

    The rlogind daemon has a bug when working with NIS enabled in libc. The
    static data area of the gethostby* functions gets overwritten by libc,
    leaving a bogus peer (remote) hostname for the authentication function
    (do_rlogin) and for the exec of the login program. 
    
    Besides the obvious effects of giving a bogus remote host name to the
    login program, (and the breakage of scripts that try to set the DISPLAY
    variable), we have a potential security problem because an attacker could
    fool the rlogind authentication by providing a bogus hostname in the 
    /etc/yp.conf file.
    
    Attached is a patch to fix this problem.
    
    I suggest applying this patch even if NIS is not used.
    
    I leave it up to you whether you want to notify CERT.

    Thanks for the good work!


################ CUT HERE #######################
--- rlogind.c.orig	Sat Oct 26 13:50:34 1996
+++ rlogind.c	Sat Oct 26 13:58:51 1996
@@ -215,6 +215,8 @@
 		 */
 		hp = &hostent;
 		hp->h_name = inet_ntoa(fromp->sin_addr);
+		strncpy(remotehost, hp->h_name, sizeof(remotehost) - 1);
+		remotehost[sizeof(remotehost) - 1] = 0;
 		hostok++;
 	} 
 	else if (check_all || local_domain(hp->h_name)) {
@@ -272,7 +274,7 @@
 	        }
 	    }
 #endif
-	    if (do_rlogin(hp->h_name) == 0 && hostok)
+	    if (do_rlogin(remotehost) == 0 && hostok)
 		    authenticated++;
 	}
 	if (confirmed == 0) {
@@ -301,7 +303,7 @@
                        pam_end(pamh, PAM_SUCCESS);
 #endif
 		       execl(_PATH_LOGIN, "login", "-p",
-			     "-h", hp->h_name, "-f", lusername, 0);
+			     "-h", remotehost, "-f", lusername, 0);
                        /* should not return... */
 		} 
 		else {
@@ -313,7 +315,7 @@
 			pam_end(pamh, PAM_SUCCESS);
 #endif
 			execl(_PATH_LOGIN, "login", "-p",
-			      "-h", hp->h_name, lusername, 0);
+			      "-h", remotehost, lusername, 0);
 			/* should not return... */
 		}
 		fatal(STDERR_FILENO, _PATH_LOGIN, 1);


###################### END OF PATCH ############################




-- 
____________________________________________________________________
            /   __  __  __  - __  __ / - _  __  ologgio at vrainn.com
  Omar R.  /__ /_/ /_/ /_/ / /_/ /_/ / /_  /-_  CIS: 74040,1543
                  __/ __/                         
___C++/6_yrs____Virtual Reality/4_yrs____Vorl_____Linux(free)_______
Let your objects freely talk to each other






-- 
____________________________________________________________________
            /   __  __  __  - __  __ / - _  __  ologgio at vrainn.com
  Omar R.  /__ /_/ /_/ /_/ / /_/ /_/ / /_  /-_  CIS: 74040,1543
                  __/ __/                         
___C++/6_yrs____Virtual Reality/4_yrs____Vorl_____Linux(free)_______
Attack the problems before they happen