[2040] in Moira
Re: access service for outgoing mailers
daemon@ATHENA.MIT.EDU (Mark Silis)
Mon Oct 20 18:33:25 2003
Date: Mon, 20 Oct 2003 18:33:20 -0400
Content-Type: text/plain; delsp=yes; charset=US-ASCII; format=flowed
Mime-Version: 1.0 (Apple Message framework v552)
Cc: Mark Silis <mark@mit.edu>, moiradev@mit.edu
To: Jonathon Weiss <jweiss@mit.edu>
From: Mark Silis <mark@MIT.EDU>
In-Reply-To: <200310201925.h9KJPOZq019959@the-other-woman.mit.edu>
Message-Id: <684896CA-034D-11D8-931A-000A959D0696@mit.edu>
Content-Transfer-Encoding: 7bit
Hi Jonathon,
On Monday, October 20, 2003, at 03:25 PM, Jonathon Weiss wrote:
>
> I have a few comments here. The simple ones first:
>
> When selecting users, you have 'WHERE status != 3' I think you want to
> exclude status 0 too (which is users who have not yet selected a
> username, and the placeholder in moira is '#<uid>'.) Statuses 4, 8,
> and 9 are also questionable to me, but I'm not 100% sure it is safe to
> exclude these, so I'd leave them in, unless Garry says otherwise.
>
> In the 'catch the zero case' code block in the sh script you should
> probably also test -s access.new, since a non-zero-length
> $root/etc/efl-access may throw off your results.
>
I thought of that but the threshold of 10% change would catch that
case so I had not explicitly coded it that way. Making it more explicit
is not a problem, and I will go ahead and do so.
> When swapping the new files into place you probably want to do the
> ln/mv dance so you never end up with no file there, even for a
> fraction of a second.
>
Good point I have gone ahead and made this change.
> And finally, a policy request. If I understand correctly, after this
> change is deployed outgoing will no longer relay for foo@bar.mit.edu
> for any values of foo and bar. If I've misunderstood, please let me
> know, but assuming I haven't... I know that athena machines still
> assume this works in a few cases. If the machine is mkserv mail or
> has a hostname that is not in the mit.edu domain, it will DTRT on its
> own, but if it is not (and not explicitly configured) it may send mail
> form user@machine.mit.edu in certain cases. The most common case I
> can think of is a private machine where someone has re-pointed the
> root@machine.mit.edu alias somewhere, and a cron job generates mail.
> Another possibility is that if for some reason the machine generates a
> mail bounce, it will come from mailer-daemon@machine.mit.edu. Would
> it be possible, at the very least, to relay mail from these two
> classes of address? Including daemon@machine.mit.edu might also be
> wise, but is probably less important than the first two. I believe
> that these exceptions will become unnecessary after athena machines
> start using authentication when sending mail, and I believe we're
> hoping to include that in an IAP patch release (though there will
> obviously be some stragglers who don't take the patch right away.) If
> necessary, release-team can certainly talk about whether it is
> practical to get that change out sooner than later, but I'm not going
> to make an estimate on the outcome of any such discussion right now.
> (FWIW, I think the IAP date was partially chosen based on last
> summer's expectation that the mailhubs would require auth sometime
> next summer, and it look slike the world may have chnaged since then.)
>
Yes, your assumption is correct, mail of the form described above will
no longer work as expected. It would be great to identify the possible
machines or numbers that may be affected if there is any possibility of
obtaining such information. I will need to discuss any possible special
cases with my team, before I can provide a definitive answer on your
request. Unfortunately you also point out that our time table has been
accelerated because of spammers and other ISPs raising the bar we are
being held to. Also allow me to offer that we're willing to sit down
and meet with you or the release-team if it would help develop a
solution.
-- Mark
> Jonathon
>
>
>
>>
>> As a result of AOL blacklisting us, we need to very quickly begin to
>> tighten
>> the controls of how we accept e-mail for sending into the MIT mail
>> system.
>> We've opted to require all users sending mail through the outgoing
>> mailers
>> to use a valid sender (ie either a user e-mail address or list e-mail
>> address)
>> instead of simply ending in @*MIT.EDU. This will hopefully prevent
>> the case
>> of dwx12345@MIT.EDU being used to relay mail through the outgoing
>> mailers
>> and upsetting other ISPs such as AOL. I have submitted below changes
>> for an
>> access service to generate the sendmail access file which will be
>> used to
>> further restrict relaying. We'd like to get these changes into
>> production
>> as quickly as possible.
>>
>> Cheers,
>>
>> -- Mark
>>
>> --- /dev/null Mon Oct 20 13:37:22 2003
>> +++ access.gen Mon Oct 20 14:22:18 2003
>> @@ -0,0 +1,50 @@
>> +#!/moira/bin/perl -Tw
>> +
>> +# $Id$
>> +
>> +use DBI;
>> +
>> +# The following exit codes are defined and MUST BE CONSISTENT withh
>> the
>> +# error codes the library uses:
>> +$MR_DBMS_ERR = 47836421;
>> +$MR_OCONFIG = 47836460;
>> +%users = ();
>> +
>> +$outfile = '/moira/dcm/access.out';
>> +
>> +$dbh = DBI->connect("dbi:Oracle:moira", "moira", "moira")
>> + || exit $MR_DBMS_ERR;
>> +
>> +# Get the list of valid MIT.EDU user e-mail addresses
>> +$sth = $dbh->prepare("SELECT login FROM users WHERE status != 3");
>> +
>> +$sth->execute;
>> +
>> +umask 022;
>> +open(OUT, ">$outfile") || exit $MR_OCONFIG;
>> +
>> +while(($login) = $sth->fetchrow_array) {
>> + $login =~ s/\0//g;
>> + $users{$login} = $login;
>> +
>> + print OUT "From:$login\@MIT.EDU RELAY\n";
>> +}
>> +
>> +# Get all the valid MIT.EDU mailing list addresses
>> +$sth = $dbh->prepare("SELECT name FROM list WHERE active !=0 " .
>> + "AND maillist = 1");
>> +
>> +$sth->execute;
>> +
>> +while(($name) = $sth->fetchrow_array) {
>> + $name =~ s/\0//g;
>> +
>> + # Ensure we do not re-print an entry that may be a personal user
>> group
>> + # and was already handled by the user e-mail addresses
>> + if(!$users{$name}) {
>> + print OUT "From:$name\@MIT.EDU RELAY\n";
>> + }
>> +}
>> +
>> +close(OUT);
>> +exit;
>>
>> --- /dev/null Mon Oct 20 13:37:22 2003
>> +++ access.sh Mon Oct 20 14:20:44 2003
>> @@ -0,0 +1,72 @@
>> +#!/bin/sh
>> +#
>> +# $Header$
>> +
>> +PATH=/sbin:/bin:/usr/sbin:/usr/bin:/etc:/usr/etc:/usr/athena/bin:/
>> usr/local/bin
>> +export PATH
>> +
>> +if [ -d /var/athena ] && [ -w /var/athena ]; then
>> + exec >/var/athena/moira_update.log 2>&1
>> +else
>> + exec >/tmp/moira_update.log 2>&1
>> +fi
>> +
>> +# The following exit codes are defined and MUST BE CONSISTENT with
>> +# error codes the library uses:
>> +MR_MKCRED=47836474
>> +MR_MISSINGFILE=47836473
>> +MR_NOCRED=47836470
>> +
>> +root=/usr/local/sendmail
>> +
>> +if [ -r $root/etc/access.new ]; then
>> + cp /dev/null $root/etc/access.tmp
>> +
>> + if [ -f $root/etc/efl-access ]; then
>> + cat $root/etc/efl-access >> $root/etc/access.tmp
>> + fi
>> +
>> + cat $root/etc/access.new >> $root/etc/access.tmp
>> + mv $root/etc/access.tmp $root/etc/access.new
>> + chmod 644 $root/etc/access.new
>> +else
>> + exit $MR_MISSINGFILE
>> +fi
>> +
>> +if [ ! -r $root/etc/access ]; then
>> + logger -p mail.error -t access.sh "No current access file,
>> aborting."
>> + exit $MR_NOCRED
>> +fi
>> +
>> +# Play it safe and be sure we have reasonable data
>> +olines=`wc -l $root/etc/access | awk '{print $1}'`
>> +nlines=`wc -l $root/etc/access.new | awk '{print $1}'`
>> +diff=`expr $nlines - $olines`
>> +thresh=`expr $olines / 10`
>> +
>> +# Catch the zero case
>> +if [ $nlines -eq 0 ]; then
>> + logger -p mail.error -t access.sh "Recieved empty access file,
>> aborting."
>> + exit $MR_MISSINGFILE
>> +fi
>> +
>> +# If its a greater than 10% shift bomb out to be safe
>> +if [ $diff -gt $thresh ]; then
>> + logger -p mail.error -t access.sh "Access changes threshold
>> exceeded, aborting."
>> + exit $MR_NOCRED
>> +fi
>> +
>> +cp /dev/null $root/etc/access.new.db
>> +
>> +$root/sbin/makemap btree $root/etc/access.new < $root/etc/access.new
>> +if [ $? != 0 ]; then
>> + exit $MR_MKCRED
>> +fi
>> +
>> +mv $root/etc/access $root/etc/access.old
>> +mv $root/etc/access.db $root/etc/access.old.db
>> +mv $root/etc/access.new $root/etc/access
>> +mv $root/etc/access.new.db $root/etc/access.db
>> +
>> +rm -f $0
>> +exit 0
>
>
