Red Hat Bugzilla – Bug 143033
sendmail no longer appears to be using tcp_wrappers
Last modified: 2009-08-19 23:28:23 EDT
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4.3)
Description of problem:
The hosts.allow and hosts.deny no longer impact on sendmail connections.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. Block hosts using the /etc/hosts.deny file.
Actual Results: Blocked hosts still get through.
Expected Results: Blocked hosts shouldn't get through.
Although sendmail doesn't run under xinetd, I thought sendmail was
linked with a tcp_wrappers aware library so that sendmail was
effectively a wrapped service (like vsftpd). I am 99% sure this used
to be the case.
A major issue is that in tcp_wrappers you can block partial networks
using the ip_address/mask syntax, which you cannot do in sendmail.
On further investigation, I found this in the Red Hat Enterprise Linux
3 Reference Guide, section 16.1:
"Because TCP wrappers are a valuable addition to any server
administrator's arsenal of security tools, most network services
within Red Hat Enterprise Linux are linked against the libwrap.a
library. Some such applications include /usr/sbin/sshd,
/usr/sbin/sendmail, and /usr/sbin/xinetd."
The suggested test:
strings -f /usr/sbin/sendmail | grep hosts_access
Doesn't find the string.
the sendmail binary is linked against tcp_wrappers:
libwrap.so.0 => /usr/lib/libwrap.so.0
Please append your hosts.deny file.
I have found my problem. The syntax expectations of tcp_wrappers for
the address/mask syntax was not as I expected.
For example, 192.168.1.235/255.255.255.254 failed to match the host
192.168.1.235 whereas I thought it should match. It seems the address
component must have zeros in the part of the address for which the
mask part has zeros. So 192.168.1.234/255.255.255.254 would match
I thought the address component could be any address inside the range,
whereas it seems it must be the *lowest* address in the range. Is
this behavior intentional?
Perhaps the tcp_wrappers test in the manual should be changed to the
one used by Thomas, since that method works and the one in the manual
In which manual?
Manual mentioned in comment #1: "Red Hat Enterprise Linux 3 Reference
Guide", section 16.1, in the blue colored "Notes" box.
Your test for the presence of tcp_wrappers worked, whereas the one in
the manual didn't (at least not for the EL version).
rpm -q --whatrequires tcp_wrappers
should also be added per a dicussion with twoerner... Also need to
investigate the RHEL4-Beta docs as well for this issue.
This is weird..... on the same RHEL3 box:
server# rpm -q --whatrequires tcp_wrappers
no package requires tcp_wrappers
On my Fedora Core 3 box:
zaurak# rpm -q --whatrequires tcp_wrappers
Is this solved for you?
No it isn't. The error is with the documentation as stated in comment #1.
The manual says to use:
strings -f <binary_name> | grep hosts_access
But that does not work. However this works:
ldd <binary_name> | grep libwrap
as per your comment #2.
BTW the same bug is in RHEL4's reference manual as well.
Reassigning to documentation.
This bug is filed against RHEL 3, which is in maintenance phase.
During the maintenance phase, only security errata and select mission
critical bug fixes will be released for enterprise products. Since
this bug does not meet that criteria, it is now being closed.
For more information of the RHEL errata support policy, please visit:
If you feel this bug is indeed mission critical, please contact your
support representative. You may be asked to provide detailed
information on how this bug is affecting you.