author | Mike Sullivan <Mike.Sullivan@Oracle.COM> |
Thu, 20 Oct 2016 23:00:49 -0700 | |
changeset 7144 | 75dd46f584db |
parent 3649 | 4006eaaa7d29 |
permissions | -rw-r--r-- |
3649
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
1 |
#!/bin/sh -- |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
2 |
# |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
3 |
# CDDL HEADER START |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
4 |
# |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
5 |
# The contents of this file are subject to the terms of the |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
6 |
# Common Development and Distribution License (the "License"). |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
7 |
# You may not use this file except in compliance with the License. |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
8 |
# |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
9 |
# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
10 |
# or http://www.opensolaris.org/os/licensing. |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
11 |
# See the License for the specific language governing permissions |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
12 |
# and limitations under the License. |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
13 |
# |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
14 |
# When distributing Covered Code, include this CDDL HEADER in each |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
15 |
# file and include the License file at usr/src/OPENSOLARIS.LICENSE. |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
16 |
# If applicable, add the following below this CDDL HEADER, with the |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
17 |
# fields enclosed by brackets "[]" replaced with your own identifying |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
18 |
# information: Portions Copyright [yyyy] [name of copyright owner] |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
19 |
# |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
20 |
# CDDL HEADER END |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
21 |
# |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
22 |
|
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
23 |
# Check :include: aliases (in files configured in sendmail.cf) and .forward |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
24 |
# files to make sure the files and their parent directory paths all have |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
25 |
# proper permissions. And check the master alias file(s) too. |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
26 |
# |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
27 |
# See http://www.sendmail.org/vendor/sun/migration.html#Security for details. |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
28 |
# |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
29 |
# Copyright (c) 1998, 2011, Oracle and/or its affiliates. All rights reserved. |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
30 |
# |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
31 |
|
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
32 |
PATH=/bin |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
33 |
|
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
34 |
# Check the group- and world-writable bits on the given file. |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
35 |
|
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
36 |
analyze() { |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
37 |
case "`ls -Lldn $1`" in |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
38 |
?????w??w?*) |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
39 |
echo $2: $1 is group and world writable |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
40 |
bogus_dirs=true ;; |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
41 |
????????w?*) |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
42 |
echo $2: $1 is world writable |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
43 |
bogus_dirs=true ;; |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
44 |
?????w????*) |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
45 |
echo $2: $1 is group writable |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
46 |
bogus_dirs=true ;; |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
47 |
esac |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
48 |
} |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
49 |
|
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
50 |
# Break down the given file name into its components, and call analyze with |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
51 |
# each of them. E.g., an argument of /usr/local/aliases/foo.list would call |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
52 |
# analyze in turn with arguments: |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
53 |
# * /usr/local/aliases/foo.list |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
54 |
# * /usr/local/aliases |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
55 |
# * /usr/local |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
56 |
# * /usr |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
57 |
|
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
58 |
break_down() { |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
59 |
for j in `echo $1 | \ |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
60 |
awk '{ |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
61 |
n = split($0, parts, "/"); |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
62 |
for (i = n; i >= 2; i--){ |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
63 |
string = ""; |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
64 |
for (j = 2; j <= i; j++){ |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
65 |
string = sprintf("%s/%s", string, parts[j]); |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
66 |
} |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
67 |
print string |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
68 |
} |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
69 |
}'` "/" |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
70 |
do |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
71 |
analyze $j $1 |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
72 |
done |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
73 |
} |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
74 |
|
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
75 |
config=/etc/mail/sendmail.cf |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
76 |
bogus_dirs=false |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
77 |
|
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
78 |
afl1=`grep "^OA" $config | sed 's/^OA//' | sed 's/,/ /g' | sed 's/.*://'` |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
79 |
afl2=`grep "^O AliasFile=" $config | sed 's/^O AliasFile=//' | \ |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
80 |
sed 's/,/ /g' | sed 's/.*://'` |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
81 |
|
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
82 |
# These should be OK themselves, but other packages may have screwed up the |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
83 |
# permissions on /etc or /etc/mail . And best to check in case non-standard |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
84 |
# alias paths are used. |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
85 |
|
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
86 |
break_down $afl1 $afl2 |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
87 |
|
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
88 |
# Find all valid :include: files used in alias files configured in sendmail.cf |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
89 |
|
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
90 |
for i in `sed 's/^[#].*$//' $afl1 $afl2 | \ |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
91 |
grep :include: | \ |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
92 |
sed 's/.*:include://' | \ |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
93 |
sed 's/,.*$//'` |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
94 |
do |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
95 |
break_down $i |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
96 |
done |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
97 |
|
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
98 |
# Check .forward files as well. If the argument "ALL" is given, do it for |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
99 |
# everyone. If no argument to the script is given, just do it for the current |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
100 |
# user. O/w, do it for all arguments. |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
101 |
|
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
102 |
if [ $# -eq 0 ] ; then |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
103 |
arg="$(id -u -n -r)" |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
104 |
elif [ $1 = "ALL" ] ; then |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
105 |
arg="" |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
106 |
else |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
107 |
arg="$*" |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
108 |
fi |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
109 |
|
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
110 |
for i in `getent passwd $arg | nawk -F: '{print $6}'` |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
111 |
do |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
112 |
if [ -f $i/.forward ] ; then |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
113 |
break_down $i/.forward |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
114 |
fi |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
115 |
done |
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
116 |
|
4006eaaa7d29
20355401 add sendmail to Userland
John Beck <John.Beck@Oracle.COM>
parents:
diff
changeset
|
117 |
$bogus_dirs || echo "No unsafe directories found." |