[2036] in Moira
Re: access service for outgoing mailers
daemon@ATHENA.MIT.EDU (Jonathon Weiss)
Mon Oct 20 15:25:25 2003
Message-Id: <200310201925.h9KJPOZq019959@the-other-woman.mit.edu>
From: Jonathon Weiss <jweiss@MIT.EDU>
To: Mark Silis <mark@MIT.EDU>
cc: moiradev@MIT.EDU
In-reply-to: Your message of "Mon, 20 Oct 2003 14:29:26 EDT."
<200310201829.h9KITQx5026955@I-fear-reorgs.mit.edu>
Date: Mon, 20 Oct 2003 15:25:24 -0400
I have a few comments here. The simple ones first:
When selecting users, you have 'WHERE status != 3' I think you want to
exclude status 0 too (which is users who have not yet selected a
username, and the placeholder in moira is '#<uid>'.) Statuses 4, 8,
and 9 are also questionable to me, but I'm not 100% sure it is safe to
exclude these, so I'd leave them in, unless Garry says otherwise.
In the 'catch the zero case' code block in the sh script you should
probably also test -s access.new, since a non-zero-length
$root/etc/efl-access may throw off your results.
When swapping the new files into place you probably want to do the
ln/mv dance so you never end up with no file there, even for a
fraction of a second.
And finally, a policy request. If I understand correctly, after this
change is deployed outgoing will no longer relay for foo@bar.mit.edu
for any values of foo and bar. If I've misunderstood, please let me
know, but assuming I haven't... I know that athena machines still
assume this works in a few cases. If the machine is mkserv mail or
has a hostname that is not in the mit.edu domain, it will DTRT on its
own, but if it is not (and not explicitly configured) it may send mail
form user@machine.mit.edu in certain cases. The most common case I
can think of is a private machine where someone has re-pointed the
root@machine.mit.edu alias somewhere, and a cron job generates mail.
Another possibility is that if for some reason the machine generates a
mail bounce, it will come from mailer-daemon@machine.mit.edu. Would
it be possible, at the very least, to relay mail from these two
classes of address? Including daemon@machine.mit.edu might also be
wise, but is probably less important than the first two. I believe
that these exceptions will become unnecessary after athena machines
start using authentication when sending mail, and I believe we're
hoping to include that in an IAP patch release (though there will
obviously be some stragglers who don't take the patch right away.) If
necessary, release-team can certainly talk about whether it is
practical to get that change out sooner than later, but I'm not going
to make an estimate on the outcome of any such discussion right now.
(FWIW, I think the IAP date was partially chosen based on last
summer's expectation that the mailhubs would require auth sometime
next summer, and it look slike the world may have chnaged since then.)
Jonathon
>
> As a result of AOL blacklisting us, we need to very quickly begin to tighten
> the controls of how we accept e-mail for sending into the MIT mail system.
> We've opted to require all users sending mail through the outgoing mailers
> to use a valid sender (ie either a user e-mail address or list e-mail address)
> instead of simply ending in @*MIT.EDU. This will hopefully prevent the case
> of dwx12345@MIT.EDU being used to relay mail through the outgoing mailers
> and upsetting other ISPs such as AOL. I have submitted below changes for an
> access service to generate the sendmail access file which will be used to
> further restrict relaying. We'd like to get these changes into production
> as quickly as possible.
>
> Cheers,
>
> -- Mark
>
> --- /dev/null Mon Oct 20 13:37:22 2003
> +++ access.gen Mon Oct 20 14:22:18 2003
> @@ -0,0 +1,50 @@
> +#!/moira/bin/perl -Tw
> +
> +# $Id$
> +
> +use DBI;
> +
> +# The following exit codes are defined and MUST BE CONSISTENT withh the
> +# error codes the library uses:
> +$MR_DBMS_ERR = 47836421;
> +$MR_OCONFIG = 47836460;
> +%users = ();
> +
> +$outfile = '/moira/dcm/access.out';
> +
> +$dbh = DBI->connect("dbi:Oracle:moira", "moira", "moira")
> + || exit $MR_DBMS_ERR;
> +
> +# Get the list of valid MIT.EDU user e-mail addresses
> +$sth = $dbh->prepare("SELECT login FROM users WHERE status != 3");
> +
> +$sth->execute;
> +
> +umask 022;
> +open(OUT, ">$outfile") || exit $MR_OCONFIG;
> +
> +while(($login) = $sth->fetchrow_array) {
> + $login =~ s/\0//g;
> + $users{$login} = $login;
> +
> + print OUT "From:$login\@MIT.EDU RELAY\n";
> +}
> +
> +# Get all the valid MIT.EDU mailing list addresses
> +$sth = $dbh->prepare("SELECT name FROM list WHERE active !=0 " .
> + "AND maillist = 1");
> +
> +$sth->execute;
> +
> +while(($name) = $sth->fetchrow_array) {
> + $name =~ s/\0//g;
> +
> + # Ensure we do not re-print an entry that may be a personal user group
> + # and was already handled by the user e-mail addresses
> + if(!$users{$name}) {
> + print OUT "From:$name\@MIT.EDU RELAY\n";
> + }
> +}
> +
> +close(OUT);
> +exit;
>
> --- /dev/null Mon Oct 20 13:37:22 2003
> +++ access.sh Mon Oct 20 14:20:44 2003
> @@ -0,0 +1,72 @@
> +#!/bin/sh
> +#
> +# $Header$
> +
> +PATH=/sbin:/bin:/usr/sbin:/usr/bin:/etc:/usr/etc:/usr/athena/bin:/usr/local/bin
> +export PATH
> +
> +if [ -d /var/athena ] && [ -w /var/athena ]; then
> + exec >/var/athena/moira_update.log 2>&1
> +else
> + exec >/tmp/moira_update.log 2>&1
> +fi
> +
> +# The following exit codes are defined and MUST BE CONSISTENT with
> +# error codes the library uses:
> +MR_MKCRED=47836474
> +MR_MISSINGFILE=47836473
> +MR_NOCRED=47836470
> +
> +root=/usr/local/sendmail
> +
> +if [ -r $root/etc/access.new ]; then
> + cp /dev/null $root/etc/access.tmp
> +
> + if [ -f $root/etc/efl-access ]; then
> + cat $root/etc/efl-access >> $root/etc/access.tmp
> + fi
> +
> + cat $root/etc/access.new >> $root/etc/access.tmp
> + mv $root/etc/access.tmp $root/etc/access.new
> + chmod 644 $root/etc/access.new
> +else
> + exit $MR_MISSINGFILE
> +fi
> +
> +if [ ! -r $root/etc/access ]; then
> + logger -p mail.error -t access.sh "No current access file, aborting."
> + exit $MR_NOCRED
> +fi
> +
> +# Play it safe and be sure we have reasonable data
> +olines=`wc -l $root/etc/access | awk '{print $1}'`
> +nlines=`wc -l $root/etc/access.new | awk '{print $1}'`
> +diff=`expr $nlines - $olines`
> +thresh=`expr $olines / 10`
> +
> +# Catch the zero case
> +if [ $nlines -eq 0 ]; then
> + logger -p mail.error -t access.sh "Recieved empty access file, aborting."
> + exit $MR_MISSINGFILE
> +fi
> +
> +# If its a greater than 10% shift bomb out to be safe
> +if [ $diff -gt $thresh ]; then
> + logger -p mail.error -t access.sh "Access changes threshold exceeded, aborting."
> + exit $MR_NOCRED
> +fi
> +
> +cp /dev/null $root/etc/access.new.db
> +
> +$root/sbin/makemap btree $root/etc/access.new < $root/etc/access.new
> +if [ $? != 0 ]; then
> + exit $MR_MKCRED
> +fi
> +
> +mv $root/etc/access $root/etc/access.old
> +mv $root/etc/access.db $root/etc/access.old.db
> +mv $root/etc/access.new $root/etc/access
> +mv $root/etc/access.new.db $root/etc/access.db
> +
> +rm -f $0
> +exit 0
