Red Hat Bugzilla – Bug 143033
sendmail no longer appears to be using tcp_wrappers
Last modified: 2009-08-19 23:28:23 EDT
From Bugzilla Helper: User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4.3) Gecko/20040924 Description of problem: The hosts.allow and hosts.deny no longer impact on sendmail connections. Version-Release number of selected component (if applicable): sendmail-8.12.11-4.RHEL3.1 How reproducible: Always Steps to Reproduce: 1. Block hosts using the /etc/hosts.deny file. 2. 3. Actual Results: Blocked hosts still get through. Expected Results: Blocked hosts shouldn't get through. Additional info: Although sendmail doesn't run under xinetd, I thought sendmail was linked with a tcp_wrappers aware library so that sendmail was effectively a wrapped service (like vsftpd). I am 99% sure this used to be the case. A major issue is that in tcp_wrappers you can block partial networks using the ip_address/mask syntax, which you cannot do in sendmail.
On further investigation, I found this in the Red Hat Enterprise Linux 3 Reference Guide, section 16.1: "Because TCP wrappers are a valuable addition to any server administrator's arsenal of security tools, most network services within Red Hat Enterprise Linux are linked against the libwrap.a library. Some such applications include /usr/sbin/sshd, /usr/sbin/sendmail, and /usr/sbin/xinetd." The suggested test: strings -f /usr/sbin/sendmail | grep hosts_access Doesn't find the string.
the sendmail binary is linked against tcp_wrappers: ldd /usr/sbin/sendmail.sendmail ... libwrap.so.0 => /usr/lib/libwrap.so.0 ... Please append your hosts.deny file.
I have found my problem. The syntax expectations of tcp_wrappers for the address/mask syntax was not as I expected. For example, 192.168.1.235/255.255.255.254 failed to match the host 192.168.1.235 whereas I thought it should match. It seems the address component must have zeros in the part of the address for which the mask part has zeros. So 192.168.1.234/255.255.255.254 would match 192.168.1.235. I thought the address component could be any address inside the range, whereas it seems it must be the *lowest* address in the range. Is this behavior intentional? Perhaps the tcp_wrappers test in the manual should be changed to the one used by Thomas, since that method works and the one in the manual doesn't.
In which manual?
Manual mentioned in comment #1: "Red Hat Enterprise Linux 3 Reference Guide", section 16.1, in the blue colored "Notes" box. Your test for the presence of tcp_wrappers worked, whereas the one in the manual didn't (at least not for the EL version).
rpm -q --whatrequires tcp_wrappers should also be added per a dicussion with twoerner... Also need to investigate the RHEL4-Beta docs as well for this issue.
This is weird..... on the same RHEL3 box: server# rpm -q --whatrequires tcp_wrappers no package requires tcp_wrappers server# On my Fedora Core 3 box: zaurak# rpm -q --whatrequires tcp_wrappers netatalk-1.6.4-4 zaurak#
Is this solved for you?
No it isn't. The error is with the documentation as stated in comment #1. The manual says to use: strings -f <binary_name> | grep hosts_access But that does not work. However this works: ldd <binary_name> | grep libwrap as per your comment #2. BTW the same bug is in RHEL4's reference manual as well.
Reassigning to documentation.
This bug is filed against RHEL 3, which is in maintenance phase. During the maintenance phase, only security errata and select mission critical bug fixes will be released for enterprise products. Since this bug does not meet that criteria, it is now being closed. For more information of the RHEL errata support policy, please visit: http://www.redhat.com/security/updates/errata/ If you feel this bug is indeed mission critical, please contact your support representative. You may be asked to provide detailed information on how this bug is affecting you.