89 lines
2.7 KiB
Groff
89 lines
2.7 KiB
Groff
.\" Copyright (c) 1998-2001 Sendmail, Inc. and its suppliers.
|
|
.\" All rights reserved.
|
|
.\" Copyright (c) 1993 Eric P. Allman. All rights reserved.
|
|
.\" Copyright (c) 1993
|
|
.\" The Regents of the University of California. All rights reserved.
|
|
.\"
|
|
.\" By using this file, you agree to the terms and conditions set
|
|
.\" forth in the LICENSE file which can be found at the top level of
|
|
.\" the sendmail distribution.
|
|
.\"
|
|
.\"
|
|
.\" $Id: smrsh.8,v 1.1.1.5 2002/02/17 21:56:43 gshapiro Exp $
|
|
.\"
|
|
.TH SMRSH 8 "$Date: 2002/02/17 21:56:43 $"
|
|
.SH NAME
|
|
smrsh \- restricted shell for sendmail
|
|
.SH SYNOPSIS
|
|
.B smrsh
|
|
.B \-c
|
|
command
|
|
.SH DESCRIPTION
|
|
The
|
|
.I smrsh
|
|
program is intended as a replacement for
|
|
.I sh
|
|
for use in the ``prog'' mailer in
|
|
.IR sendmail (8)
|
|
configuration files.
|
|
It sharply limits the commands that can be run using the
|
|
``|program'' syntax of
|
|
.I sendmail
|
|
in order to improve the over all security of your system.
|
|
Briefly, even if a ``bad guy'' can get sendmail to run a program
|
|
without going through an alias or forward file,
|
|
.I smrsh
|
|
limits the set of programs that he or she can execute.
|
|
.PP
|
|
Briefly,
|
|
.I smrsh
|
|
limits programs to be in a single directory,
|
|
by default
|
|
/usr/adm/sm.bin,
|
|
allowing the system administrator to choose the set of acceptable commands,
|
|
and to the shell builtin commands ``exec'', ``exit'', and ``echo''.
|
|
It also rejects any commands with the characters
|
|
`\`', `<', `>', `;', `$', `(', `)', `\er' (carriage return),
|
|
or `\en' (newline)
|
|
on the command line to prevent ``end run'' attacks.
|
|
It allows ``||'' and ``&&'' to enable commands like:
|
|
``"|exec /usr/local/bin/procmail -f- /etc/procmailrcs/user || exit 75"''
|
|
.PP
|
|
Initial pathnames on programs are stripped,
|
|
so forwarding to ``/usr/ucb/vacation'',
|
|
``/usr/bin/vacation'',
|
|
``/home/server/mydir/bin/vacation'',
|
|
and
|
|
``vacation''
|
|
all actually forward to
|
|
``/usr/adm/sm.bin/vacation''.
|
|
.PP
|
|
System administrators should be conservative about populating
|
|
the sm.bin directory.
|
|
Reasonable additions are
|
|
.IR vacation (1),
|
|
.IR procmail (1),
|
|
and the like.
|
|
No matter how brow-beaten you may be,
|
|
never include any shell or shell-like program
|
|
(such as
|
|
.IR perl (1))
|
|
in the
|
|
sm.bin
|
|
directory.
|
|
Note that this does not restrict the use of shell or perl scripts
|
|
in the sm.bin directory (using the ``#!'' syntax);
|
|
it simply disallows execution of arbitrary programs.
|
|
.SH COMPILATION
|
|
Compilation should be trivial on most systems.
|
|
You may need to use \-DSMRSH_PATH=\e"\fIpath\fP\e"
|
|
to adjust the default search path
|
|
(defaults to ``/bin:/usr/bin:/usr/ucb'')
|
|
and/or \-DSMRSH_CMDBIN=\e"\fIdir\fP\e"
|
|
to change the default program directory
|
|
(defaults to ``/usr/adm/sm.bin'').
|
|
.SH FILES
|
|
/usr/adm/sm.bin \- directory for restricted programs
|
|
.SH SEE ALSO
|
|
sendmail(8)
|