Implementing Procmail on a Sendmail Gateway

Implementing procmail on a sendmail gateway is an excellent way to implement procmail. It reduces the burden on the organizations mail server and allows the use of procmail to protect mail servers that do not normally support procmail (e.g., Microsoft Exchange). Much of the guidance in this section comes form John D. Harden’s E-mail Sanitizer Web page (http://www.impsec.org/email-tools/procmail-security.html) [Hard02]:

Mlocal, P=/usr/bin/procmail, F=lsDFMAw5:/|@qSPfhn9, S=10/30, R=20/40,

A=procmail -Y -a $h -d $u

 Add “procmail” to class P with close to the top of the sendmail.cf configuration file:

CPprocmail

 Add the following to rule set 0, between the “handle virtual users” and “short-circuit local delivery” entries:

# pipe through procmail for processing

R$*<@example.com>$* $#procmail $@/etc/procmail/filter.rc $:$1<@example.com.procmail.>$2

R$*<@example.com.>$* $#procmail $@/etc/procmail/filter.rc $:$1<@example.com.procmail.>$2

R$*<@$*.procmail.>$* $1<@$2.>$3

Note: vary the domain name and script name (/etc/procmail/filter.rc) for your needs.

If relaying mail for more than one domain is required, use the following entries instead: R$*<@$=w>$* $#procmail $@/etc/procmail/filter.rc $:$1<@$2.procmail.>$3 R$*<@$=w.>$* $#procmail $@/etc/procmail/filter.rc $:$1<@$2.procmail.>$3 R$*<@$*.procmail.>$* $1<@$2.>$3

 Here is a sample filter.rc file—add the appropriate local configuration settings before using it:

############################################################## ##

#

# procmail rules to filter mail on a gateway #

LOGFILE=/var/log/procmail.log NL="

"

LOGABSTRACT=no

# Configuration settings go here...

# See the discussion of what to put in /etc/procmailrc at #http://www.impsec.org/email-tools/sanitizer-

configuration.html

# /etc/procmailrc is the "master procmail script" for local # delivery, this file is the "master procmail script" for relay

# The settings in one DO NOT affect the other. POISONED_EXECUTABLES=/etc/procmail/poisoned

# etc... - you NEED to put configuration settings here. # NB: DO NOT enable RECIPIENT notification on a relay... # run the sanitizer

INCLUDERC=/etc/procmail/local-rules.procmail INCLUDERC=/etc/procmail/html-trap.procmail # send the mail on to the next relay

:0

! -oi -f "$@" #

############################################################## ##

 If the next hop is a Microsoft Exchange Server, make ensure that it is configured so that it will accept mail addressed to its fully qualified domain name in addition to the simple domain name. For example, if the domain is “myorg.com” and the Exchange Server is running on the computer named “myexchange,” configure it to accept mail addressed to “@myexchange.myorg.com” as well as just “@myorg.com.”

$SSHQGL[*2QOLQH6HFXULW\5HVRXUFHV

5HVRXUFH7LWOH 85/

CERT/CC, How the FBI Investigates Computer Crime

http://www.cert.org/tech_tips/FBI_investigates_crime.html

CERT/CC, Responding to Intrusions http://www.cert.org/security-improvement/modules/m06.html CERT/CC, Detecting Signs of Intrusion http://www.cert.org/security-improvement/modules/m09.html Computer Evidence Processing Steps http://www.forensics-intl.com/evidguid.html

Federal Guidelines on Searching and Seizing Computers

http://www.usdoj.gov/criminal/cybercrime/searching.html Federal Code Related to Cybercrime http://www.usdoj.gov/criminal/cybercrime/fedcode.htm NIST ITL Bulletin, September 1999: Securing

Web Servers

http://csrc.nist.gov/publications/nistbul/09-99.pdf NIST SP 800-3, Establishing a Computer Security

Incident Response Capability

http://csrc.nist.gov/publications/nistpubs/800-3/800-3.pdf

)HGHUDO *RYHUQPHQW 6HFXULW\ 5HVRXUFHV

5HVRXUFH7LWOH 85/

Defense Information System Agency (DISA) Security Checklist

http://iase.disa.mil/techguid/checklist.html Federal Computer Incident Response Center

(FedCIRC)

http://www.fedcirc.gov/ National Infrastructure Protection Center http://www.nipc.gov/ National Information Assurance Partnership http://www.niap.nist.gov/

National Security Agency Rainbow Series http://www.radium.ncsc.mil/tpep/library/rainbow/index.html National Security Agency Security

Recommendation Guides

http://nsa1.www.conxion.com/ NIST Computer Security Resource Center http://csrc.nist.gov/

NIST ICAT Vulnerability Metabase http://icat.nist.gov/ Office of Management and Budget Circular No.

A-130

http://www.whitehouse.gov/omb/circulars/a130/ U.S. Department of Energy Computer Incident

Advisory Capability (CIAC)

*HQHUDO 6HFXULW\ 5HVRXUFHV

5HVRXUFH7LWOH 85/

CERIAS http://www.cerias.purdue.edu/ Computer Emergency Response Team (CERT) http://www.cert.org/ NIST ICAT Vulnerability Metabase http://icat.nist.gov/ RISKS Forum http://catless.ncl.ac.uk/Risks/ Security Administration, Networking, and

Security (SANS) Institute

http://www.sans.org/ SANS Twenty Most Critical Internet Security

Vulnerabilities

http://www.sans.org/top20.htm

0DLO (QFU\SWLRQ 5HVRXUFHV

5HVRXUFH7LWOH 85/

Securing Email Through Proxies: Smap and Stunnel

http://rr.sans.org/email/smap.php

Securing POP Mail on Windows Clients http://sewpsc.sewp.nasa.gov/documents/pop.mail.pdf Securing POP Mail on Windows Clients http://csrc.nist.gov/fasp/FASPDocs/SecurPOPwSSH.htm 0LVFHOODQHRXV 0DLO 6HUYHU 6HFXULW\ 5HVRXUFHV

5HVRXUFH7LWOH 85/

dominosecurity.org http://www.dominosecurity.org/

Lotus Domino Security Page http://www.lotus.com/home.nsf/welcome/securityzone Netcraft http://www.netcraft.com/