Debian exim4 security patch

 
Thread Tools Search this Thread
Operating Systems Linux Debian Debian exim4 security patch
# 1  
Old 12-17-2010
Debian exim4 security patch

I have just had to fix a debian5 system which suddenly started rejecting correctly addressed emails as '550 relay not permitted.' It turned out that rogue exim4 config files had been injected into the system at /etc/exim4/exim4.conf and /etc/exim4/exim.conf and these were messing up mail routing.

The system had been compromised similar to this description: Details of the root kit that got installed on my Debian Lenny boxes due to the exim remote root exploit : netsec

I also found a few strange processes running which were started around the same time as the problem started. Note that you must restore a valid version of ps (see the link) before you use it to look for rogue processes.

The security patch is described here: [SECURITY] [DSA-2131-1] New exim4 packages fix remote code execution

I strongly recommed that you apply this patch if it applies to you.
Login or Register to Ask a Question

Previous Thread | Next Thread

2 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

EXim4 on Debian - setting up multiple mailboxes

I have exim4 smtp server running on Debian. I tend to use only one user account to login. The machine is running multiple websites and I have assigned unique email addresses for each of the websites. Emails sent to these addresses do not seem to get delivered. Emails sent to the alias that I... (0 Replies)
Discussion started by: shikarishambu
0 Replies

2. UNIX for Advanced & Expert Users

Problems with debian linux + exim4 + MS Outlook 2003

This seems to be a rather constant question that pops up on a lot of forums but as of yet I have not found a complete solutions on any of the forums so I'm asking everyone who might know about this in an attempt to find a complete solution for this: I have bought 3 domain names and they all... (0 Replies)
Discussion started by: liviutudor
0 Replies
Login or Register to Ask a Question
greylistd-setup-exim4(8)					Mail Administration					  greylistd-setup-exim4(8)

NAME
greylistd-setup-exim4 - add/remove support for greylistd in Exim 4 SYNOPSIS
greylistd-setup-exim4 {add|remove|test} [file acl_name] [-option ...] DESCRIPTION
This utility configures, deconfigures, or tests for greylistd support in the given Exim 4 configuration file and Access Control List (ACL). If no file or ACL name is supplied, changes are made to the default configuration files and ACLs for your distribution. USAGE
The following commands are available: add Adds greylistd statement(s). remove Removes existing greylistd statement(s). test Tests for the presence of greylistd statement(s), without making any changes. A zero exit status indicates that the statement(s) exist(s). The following options are available: -quiet Normally, the result of the operation is printed on standard error; this option inhibits output. -no-fail Always exit with a zero status, even on failure. If this option is given, only the result of successful operations are printed. -no-reload Normally, if any changes were made to the Exim 4 configuration files, greylistd-setup-exim4 invokes the Exim 4 init script, telling Exim to reload its configuration files. This option inhibits this behavior. -netmask=size In the statement that is inserted in the Exim 4 configuration file, the remote host address is one of the items that is passed on to greylistd. This option causes the host address to be filtered through a netmask of the given size first. Useful values are between 16 and 31 for IPv4. -acltype={rcpt|data} Used in conjunction with the add command to insert a statement suitable for use in an ACL used to validate the SMTP RCPT TO: command or the message DATA, respectively. This is implicit when the supplied ACL name contains either of the substrings "rcpt" or "data" (such as Debian's default "acl_check_rcpt" and "acl_check_data" ACLs). Otherwise, this option has to be present for the add com- mand. EXAMPLES
greylistd-setup-exim4 add -netmask=24 Adds greylistd statements to any acl_check_rcpt and acl_check_data ACLs found in any of the following files: - /etc/exim4/exim4.conf.template - /etc/exim4/conf.d/acl/30_exim4-config_check_rcpt - /etc/exim4/conf.d/acl/40_exim4-config_check_data In these statements, the data passed to greylistd includes the host address filtered through a 24-bit netmask, rather than the host's unique IP address. This allows for pools of several Mail Sending Agents (MSAs) within a given network to be treated as a single host. If successful, Exim 4 is told to reload its configuration files. If a statement already exists, nothing happens - but the program exits unsuccessfully (non-zero return code). greylistd-setup-exim4 remove -quiet Remove greylisting support from the above configuration files and ACLs. If greylistd statements exist in these files and ACLs, they are removed, and Exim 4 will reload its configuration files. The exit code indicates whether the statements were present and are now successfully removed; but no results are printed. greylistd-setup-exim4 add /etc/exim4/exim4.conf.template acl_check_rcpt -no-reload If no greylistd statements already exists in the acl_check_rcpt ACL in the file /etc/exim4/exim4.conf.template, one is inserted. In this case, the Exim 4 daemon is then NOT told to reload its configuration files. BUGS
The statement that is inserted by this utility presumes that the Exim 4 configuration comes from Debian's "exim4-config" package. Specifi- cally, it makes use of the +relay_from_hosts host list, the +local_domains and +relay_to_domains domain lists, and the acl_local_deny_exceptions ACL. A more generalized approach is on my, ahem, to-do list. AUTHOR
This python script and manual page is written by Tor Slettnes, originally for Debian GNU/Linux. COPYRIGHT
Copyright (C) 2004-2005 Tor Slettnes. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MER- CHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. On a Debian GNU/Linux system, the full text of the GPL is available in /usr/share/common-licenses/GPL. It is also available at: http://www.gnu.org/licenses/gpl.html SEE ALSO
greylist(1), greylistd(8), /usr/share/doc/exim4/spec.txt.gz Tor Slettnes 0.8 greylistd-setup-exim4(8)