Login or Register to Ask a Question and Join Our Community

Linux and UNIX Man Pages

Linux & Unix Commands - Search Man Pages

smrsh(8) [freebsd man page]

SMRSH(8)						      System Manager's Manual							  SMRSH(8)

NAME

       smrsh - restricted shell for sendmail

SYNOPSIS

       smrsh -c command

DESCRIPTION

       The smrsh program is intended as a replacement for sh for use in the ``prog'' mailer in sendmail(8) configuration files.  It sharply limits
       the commands that can be run using the ``|program'' syntax of sendmail in order to improve the over all security of your system.   Briefly,
       even  if  a  ``bad guy'' can get sendmail to run a program without going through an alias or forward file, smrsh limits the set of programs
       that he or she can execute.

       Briefly, smrsh limits programs to be in a single directory, by default /usr/libexec/sm.bin, allowing the system administrator to choose the
       set  of	acceptable  commands,  and  to the shell builtin commands ``exec'', ``exit'', and ``echo''.  It also rejects any commands with the
       characters ``', `<', `>', `;', `$', `(', `)', `
' (carriage return), or `
' (newline) on the command line to prevent ``end run'' attacks.
       It allows ``||'' and ``&&'' to enable commands like: ``"|exec /usr/local/bin/filter || exit 75"''

       Initial	pathnames  on programs are stripped, so forwarding to ``/usr/bin/vacation'', ``/home/server/mydir/bin/vacation'', and ``vacation''
       all actually forward to ``/usr/libexec/sm.bin/vacation''.

       System administrators should be conservative about populating the sm.bin directory.  For example, a reasonable  additions  is  vacation(1),
       and  the  like.	No matter how brow-beaten you may be, never include any shell or shell-like program (such as perl(1)) in the sm.bin direc-
       tory.  Note that this does not restrict the use of shell or perl scripts in the sm.bin directory (using the ``#!'' syntax); it simply  dis-
       allows  execution  of  arbitrary  programs.   Also,  including mail filtering programs such as procmail(1) is a very bad idea.  procmail(1)
       allows users to run arbitrary programs in their procmailrc(5).

COMPILATION

       Compilation should be trivial on most systems.  You may need to use -DSMRSH_PATH="path" to adjust the default search  path  (defaults	to
       ``/bin:/usr/bin'') and/or -DSMRSH_CMDDIR="dir" to change the default program directory (defaults to ``/usr/libexec/sm.bin'').

FILES

       /usr/adm/sm.bin - default directory for restricted programs on most OSs

       /var/adm/sm.bin - directory for restricted programs on HP UX and Solaris

       /usr/libexec/sm.bin - directory for restricted programs on FreeBSD (>= 3.3) and DragonFly BSD

SEE ALSO

       sendmail(8)

							   $Date: 2013-11-22 20:52:00 $ 						  SMRSH(8)

Check Out this Related Man Page

forward(4)						     Kernel Interfaces Manual							forward(4)

NAME

       forward - forward mail

SYNOPSIS

       /var/adm/forward/username $HOME/.forward

DESCRIPTION

       The .forward file allows a user to forward messages to another host, or to invoke programs (such as vacation(1)) to process their mail.	It
       is formatted as a series of comma-separated addresses in the form: addr_1, addr_2, ...  Alternatively, each address can be  on  a  separate
       line.

       The newer sendmail.v8 program also allows the use of comments (lines that begin with a ``#'') and blank lines.

       As  with the aliases(4) file, mail messages can be forwarded to another host or given to programs for further processing.  The following is
       an example of the vacation program. Assuming that the user's name is myra, create a .forward  file  and	add  the  following  line:  myra,
       "|/usr/bin/vacation myra"

       The  previous  example  forwards mail to myra (the backslash prevents an accidental aliasing loop), and also sends a copy of the message to
       the vacation program.

       For security reasons, the file must be owned by the user or by root and it should be writable only by the file  owner.	In  addition,  the
       file must be readable by the owner (myra) or root.

       On  traditional	systems,  only	the  $HOME/.forward file is checked.  The sendmail.v8 program allows the use of the system-wide forwarding
       directory /var/adm/forward.  By default, this directory is checked for a forward file prior to examining the users $HOME directory.

FILES

       System-wide forwarding file.  The per-user forwarding file.

RESTRICTIONS

       The sendmail command can hang trying to read the user's $HOME/.forward file.  If the user's home directory is NFS-mounted  and  temporarily
       unavailable, sendmail will stall until the directory becomes available again.  The use of non-NFS mounted directories for the forwarding of
       files is recommended.

       The use of /var/adm/forward is supported only by sendmail.v8.

       The actual path for /var/adm/forward is configurable in the sendmail.cf file.

       Incorrect file permissions/ownership are quietly ignored.

       It is easy to create an accidental loop, for example, on host_a myra@host_b and on host_b myra@host_a

RELATED INFORMATION

       Commands:  aliases(4), sendmail.cf(4), sendmail(8) delim off

																	forward(4)
Man Page