Thursday, September 23, 2010

Sendmail - Sandwich Mode How TO

It is used in scenario when we want sendmail to listen on port 25 which have anti-relay feature instead of any SMTP Proxy that many Anti-Virus or Anti-Spam used like TrendMicro Interscan or IMSS (Interscan Messaging Security Suite), because it don’t have any Anti-relay or SMTP Auth features.

This document describes the procedures to configure sendmail to use InterScan as an anti-virus solution and still benefit from sendmail’s anti-relay feature.

The following instructions provide the details to setup IMSS and sendmail on a single Unix box. Only one sendmail daemon is run alongside IMSS.

This configuration has a performance hit when IMSS deliver’s mail after scanning. The performance hit occurs when IMSS starts the sendmail program to do the mail delivery. The performance hit is directly proportional to the time and resources required to execute a sendmail program as this is exactly what IMSS is doing. For heavy mail traffic, this configuration will not work well, for that we can have separate machine for each instance like one machine for Incoming Sendmail which delivers mail to IMSS running on same or different machine which in turn delivers to Outgoing Sendmail (Delivery Mode) running on different machine.

We recommend pre-spawning another sendmail daemon and have it listen to port 19000. Then have IMSS running on port 18000 does the Anti-Spam and Anti-Virus check and then connect to delivery sendmail on port 19000 to deliver mail.

Sendmail daemon and InterScan on one box

The following illustration depicts the scenario of running a sendmail daemon and InterScan on the same Unix box.

Note: Port 18000 is an arbitrary port number. Please select a free port when doing the configuration below. Port 25 is the standard SMTP port. This should not be changed.

The instructions to configure the mail daemons for this configuration are as follows.

Configure sendmail,
1.      Make a copy of sendmail.cf file called sendmail.cf.delivery.
2.      Change the A option in sendmail.cf for Msmtp, Mesmtp, Msmtp8, and Mrelay from “IPC $h” to “IPC localhost 18000” where 18000 is an arbitrary free port on box_1.
3.      Add the k flag to the F option for Msmtp, Mesmtp, Msmtp8, and Mrelay in sendmail.cf.

At this point the changes for Msmtp (as an example) look as follows:
Before:
Msmtp,                   P=[IPC], F=mDFMuX, S=11/31, R=21, E=\r\n, L=990,
                                T=DNS/RFC822/SMTP,
                                A=IPC $h
After:
Msmtp,                   P=[IPC], F=kmDFMuX, S=11/31, R=21, E=\r\n, L=990,
                                T=DNS/RFC822/SMTP,
                                A=IPC localhost 18000

4.      Replace the local mailer with [IPC] for Mlocal in sendmail.cf.
5.      Change the A option to “IPC localhost 18000” for Mlocal in sendmail.cf.
6.      Add the k flag to the F option for Mlocal in sendmail.cf.

At this point the changes for Mlocal look as follows:
Before:
Mlocal,                  P=/usr/lib/mail.local, F=lsDFMAw5:/|@qfSmn9, S=10/30, R=20/40,
                                T=DNS/RFC822/X-Unix,
                                A=mail.local -d $u
After:
Mlocal,                  P=[IPC], F=klsDFMAw5:/|@qSmn9, S=10/30, R=20/40,
                                T=DNS/RFC822/X-Unix,
                                A=IPC localhost 18000

IMPORTANT: Make sure the F option of Mlocal does not include the ‘f’ flag. This flag is standard on Solaris 7 distribution of sendmail and needs to be removed.

Configure the delivery sendmail used by InterScan,
7.      Change the Pid of the delivery Sendmail in sendmail.cf.delivery.

Before:
O PidFile=/var/run/sendmail.pid
After:
O PidFile=/var/run/sendmail.pid.delivery

8.      Change the mail queue to a different directory in sendmail.cf.delivery.

Before:
O QueueDirectory=/var/spool/mqueue
After:
O QueueDirectory=/var/spool/mqueuedelivery

9.      Create the directory /var/spool/mqueuedelivery and make sure it has the same ownership and permission as the original in /var/spool/mqueue.
10.  Add the k flag to the F option for Mlocal, Msmtp, Mesmtp, Msmtp8, and Mrelay in sendmail.cf.delivery.

Now there are two configuration one for new TrendMicro IMSS version and other for old TrendMicro Interscan version so out of these we can chose and configure one of them depending upon your setup.

Configure IMSS

11.  Copy the original IMSS configuration file using following command.

cp /opt/trend/imss/imss.ini /opt/trend/imss/imss.ini.org

12.  Change all these entry as stated below :-

vi /opt/trend/imss/imss.ini
            downstream_smtp_server_addr=127.0.0.1
            downstream_smtp_server_port=19000
            smtp_greeting_msg=IMSS SMTP proxy
            #smtp_allow_client_ip=addr:192.168.8.88 addr:127.0.0.1
            [socket_1]
            proxy_service=SMTP_SERVICE
            proxy_port=18000
           
            [General-Notification]
            NotificationSMTPAddr=127.0.0.1:18000

13.  Start the sendmail and IMSS service and check using the following command :-

          /etc/rc.d/init.d/sendmail stop
/etc/rc.d/init.d/sendmail stop

/usr/sbin/sendmail -bd -C/etc/mail/sendmail.cf.delivery
          /usr/sbin/sendmail -bd -C/etc/mail/sendmail.cf

/etc/rc.d/init.d/S99ISIMSS stop
/etc/rc.d/init.d/S99ISIMSS start

Now check the Incoming Sendmail instance

telnet 127.0.0.1 25

Now check the Outgoing instance of Sendmail (Delivery Mode)

telnet 127.0.0.1 19000


Now check the IMSS instance :-

telnet 127.0.0.1 18000

14.  Edit the /etc/init.d/sendmail to start both instance of Sendmail for Incoming and Outgoing delivery of Mail.

vi /etc/init.d/sendmail

            Edit these line in that start section of the script
Before
daemon /usr/sbin/sendmail $([ "x$DAEMON" = xyes ] && echo -bd) \
$([ -n "$QUEUE" ] && echo -q$QUEUE) $SENDMAIL_OPTARG
After
#daemon /usr/sbin/sendmail $([ "x$DAEMON" = xyes ] && echo -bd) \
#$([ -n "$QUEUE" ] && echo -q$QUEUE) $SENDMAIL_OPTARG
            daemon /usr/sbin/sendmail -bd -C/etc/mail/sendmail.cf.delivery
daemon /usr/sbin/sendmail -bd -C/etc/mail/sendmail.cf

            Add these line in that stop section of the script to stop two instances of sendmail.

            echo -n $"Shutting down Sendmail Delivery: "
killproc sendmail
killproc sendmail

Check the script is working or not using following command.

/etc/init.d/sendmail stop
/etc/init.d/sendmail start

Configure InterScan

15.  Make sure the sendmail version of ISVW is installed and not the plugin version.
16.  Edit intscan.ini and change the InterScan SMTP service port to 18000.
17.  In intscan.ini, change the original SMTP server location to include “-C /etc/mail/sendmail.cf.delivery” where the sendmail.cf.delivery file is assumed to be in /etc/mail.

Under [smtp],
Before:
svcport=25
original=/usr/lib/sendmail -bs
After:
svcport=18000
original=/usr/lib/sendmail –bs –C/etc/mail/sendmail.cf.delivery

18.  Restart InterScan SMTP by “/etc/iscan/sendmail”.
19.  Restart a new sendmail daemon to process the new mail queue by “/usr/lib/sendmail –q1h –C/etc/mail/sendmail.cf.delivery”
20.  Restart sendmail to handle SMTP traffic on port 25 by “/usr/lib/sendmail –bd –q1h”.

Note: although there is a second sendmail daemon running, this daemon’s only responsibility is to process any mail that has been queued up. If this second daemon is not running, then the user will need to manually and periodically flush the queue.

The S88sendmail rc script must be modified to correctly start the mail servers:
1.      The start script should now start 3 daemons (started in steps 12, 13, and 14).

Under start section of the script,
Before:
/etc/iscan/sendmail; /usr/lib/sendmail –q1h
After:
/etc/iscan/sendmail; /usr/lib/sendmail –q1h –C/etc/mail/sendmail.cf.delivery; /usr/lib/sendmail –bd –q1h


Note that this document comes without warranty of any kind. But every effort has been made to provide the information as accurate as possible. I welcome emails from any readers with comments, suggestions, and corrections at webmaster_at admin@linuxhowto.in

Copyright © 2012 LINUXHOWTO.IN

5 comments:

  1. Good Job Pankaj......

    ReplyDelete
  2. Hi Pankaj,

    If I built IMSS in other server, which configuration in sendmail.cf I need to change?

    ReplyDelete
  3. How to read and understand Sendmail 8.14 log files

    ReplyDelete
    Replies
    1. Jun 13 18:32:38 serv1 sendmail[7441]: q5DMWcS2007441: from=rohit, size=315, class=0, nrcpts=1, msgid=<20120613223237.GA7436'#'serv1.home.com>, relay=root'#'localhost
      Jun 13 18:32:38 serv1 sm-mta[7442]: q5DMWcDD007442: from=, size=466, class=0, nrcpts=1, msgid=<20120613223237.GA7436'#'serv1.home.com>, proto=ESMTP, daemon=MTA, relay=localhost.localdomain [127.0.0.1]
      Jun 13 18:32:38 serv1 sendmail[7441]: q5DMWcS2007441: to=rohit'#'serv1.home.com, ctladdr=rohit (502/505), delay=00:00:00, xdelay=00:00:00, mailer=relay, pri=30315, relay=[127.0.0.1] [127.0.0.1], dsn=2.0.0, stat=Sent (q5DMWcDD007442 Message accepted for delivery)
      Jun 13 18:32:38 serv1 sm-mta[7443]: q5DMWcDD007442: to=, ctladdr= (502/505), delay=00:00:00, xdelay=00:00:00, mailer=local, pri=30663, dsn=2.0.0, stat=Sent
      Jun 13 18:32:38 Date of Mail received to the Mail Transfer Agent
      serv1 = Hostname
      sm-mta[7443]: = MTA or Application Name with PID for the Mai
      q5DMWcDD007442: = Queue ID
      from= (Sender Address)
      to= (Reciepient Address)
      size=315 Size in Bytes
      nrcpts=1 Number of Recepients
      msgid=<20120613223237.GA7436'#'serv1.home.com> = Message ID (Unique of every Mail)
      proto=ESMTP = Protocol Used
      daemon=MTA = Application Handler In Sendmail it could be MSP or MTA
      relay=localhost.localdomain [127.0.0.1] = Mail relayed to the next Destination Server / Recipient Server
      dsn=2.0.0 = Delivery Status Notification, It can be 2.x.x, 4.x.x, 5.x.x Where 2.x.x is Successfully Sent, 4.x.x Is Mail Temporarily Deferred, 5.x.x stands for Permanent Failure
      stat=Sent = Status of the Message. Values Sent,Deferred,Bounced
      q5DMWcDD007442 Message accepted for delivery = Unique ID on which the mail was delivered on the targeted server

      Delete