Sendmail Relaying and Masquerading

The requirement was simple. Relay email from the CentOS Web Server in the DMZ back through the FireWall to the European corporate SMTP server for onward relay out to external customers.

Simple, huh?
Pah!

The default sendmail configuration that comes with CentOS is pretty good. But whilst the FireWall on the server would allow SMTP out the FireWall controlling the DMZ would only allow that SMTP traffic back throught the internal facing FireWall to a specific internal SMTP server. Also since the server is out in the DMZ, not only must the company FireWall "whitelist" every allowed port on each server, but each server must also only whitelist the bare minimum of required ports to function properly. So this server is only listening on http, https, SMTP and SSH.

With all that in mind, I sent a test email:
# echo "Hello, World" | mailx -s "Test" me@company.com

And that worked.

However
# echo "Is there anybody out there?" | mailx -s "Test" me@gmail.com
didn't work.

Although, I wasn't allowing DNS through the FireWall, /etc/resolv.conf contained
search emea.company.com
server 10.10.10.10

(All domain names and IPs are fictitious.)

Changing the resolv.conf file for an empty file will cause the email to me@company.com to fail to relay. It will simply be queued locally. Sendmail is trying to use DNS to look up the MX records of the email recipients. As this server is in the DMZ and we employ a split horizon DNS, this situation can't be resolved by just openning up port 53 on the server FireWall to talk to the external facing DNS server. This server isn't allowed to send email directly to the internet, and it wouldn't be able to relay email to the companies main SMTP servers as they are in a different DMZ and the network routing between the two DMZ is internal.

The DNS lookup needs to be turned off. Reading the documentation, you might think that just defining a SMART_HOST in the sendmail.mc, regenerating sendmail.cf and restarting the sendmail service would be sufficient. But it is not. DNS would still rear its ugly head.

In addition to adding
define(`SMART_HOST',`mailhost.emea.company.com') dnl
to sendmail.mc (and adding an entry for mailhost into /etc/hosts) it is also necessary to add
FEATURE(`accept_unresolvable_domains')dnl
FEATURE(`nocanonify')dnl

These two directives tells sendmail to accept email for domains that it cannot resolve and to not to canonify provided email addresses.

Command to generate the sendmail.cf file
m4 /etc/mail/sendmail.mc > /etc/mail/sendmail.cf

Command to restart Linux Sendmail service
service sendmail restart

Debugging
It is very useful to increase the log level temporarily for debugging purposes. This can be changed in sendmail.mc by changing the value of the following definition
define(`confLOG_LEVEL', `15')dnl
The default value is 9. The documentation lists 15 as the maximum for administration with the values of 16 up to 99 being of interest only to developers.

The logfile location is /var/log/maillog

Masquerading
There was an additional problem. An upstream SMTP server at our Data centre provider was performing a reserve lookup up on the originating relay server. Our SLA with the external company only allowed us to utilize specific sub-domains, and emea.company.com wasn't one of them. It was necessary to configure masquerading, too.

The following settings were added to sendmail.mc:
FEATURE(always_add_domain)dnl
MASQUERADE_AS(`company.com')dnl
MASQUERADE_DOMAIN(`company.com')dnl
FEATURE(masquerade_envelope)dnl
FEATURE(masquerade_entire_domain)dnl
FEATURE(`allmasquerade')dnl

The following feature was also commented out.
dnl EXPOSED_USER(`root')dnl
I was logged in as root when testing! D'Oh!

Resources
The following link provides a good description of sendmail on CentOS 5, but you really have to know a little bit about what you are doing first, otherwise it is confusing: linuxtopia
Another closely related link.

sendmail.org is also a good source of detail, especially on what all those options/FEATURES in the sendmail.mc file are for, and for Masquerading & Relaying.

An excellent HP website on how Sendmail works.

Sendmail nullclient configuration on CentOS v5.2

Sendmail is the work of the devil.

Here, however, is how to set up a nullclient, which will enable all mail from a server to be forwarded to a central mail hub.

[root@server1 mail]# rpm -qa | grep sendmail
sendmail-cf-8.13.8-2
sendmail-8.13.8-2
[root@server1 mail]# cat /etc/mail/sendmail.mc
divert(-1)dnl
dnl #
dnl # This is the sendmail macro config file for m4. If you make changes to
dnl # /etc/mail/sendmail.mc, you will need to regenerate the
dnl # /etc/mail/sendmail.cf file by confirming that the sendmail-cf package is
dnl # installed and then performing a
dnl #
dnl # make -C /etc/mail
dnl #
include(`/usr/share/sendmail-cf/m4/cf.m4')dnl
VERSIONID(`Nullclient for Linux')dnl
OSTYPE(`linux')dnl
DOMAIN(`generic')dnl
FEATURE(`nullclient',`example.com')dnl
undefine(`ALIAS_FILE')dnl

[root@server1 mail]# cat /etc/hosts
# Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1 localhost.localdomain localhost
192.168.0.1 server1.example.com server1

[root@server1 mail]# make -C /etc/mail
make: Entering directory `/etc/mail'
make: Leaving directory `/etc/mail'
[root@server1 mail]# service sendmail restart.
Shutting down sm-client: [ OK ]
Shutting down sendmail: [ OK ]
Starting sendmail: [ OK ]
Starting sm-client: [ OK ]
[root@server1 mail]#

Oviously, you could always add those lines into a file called something like null.mc and then create your sendmail.cf file with a command line like:

[root@server1 mail]# m4 null.mc > sendmail.cf


Just discovered that much of this is covered over at faqs.org.

Vista as a Virus #1

Among many other duties and responsibilities, I am also a Domain Admin of my company's Active Directory. Despite having a normal user account, I must confess to frequently logging into my desktop with my Domain Admin account. On one such occasion, I was trying to track down a DNS issue that our Sydney office was suffering, when I realised that I needed to flush my local DNS resolver cache. Pretty straight forward? Just open a Command Prompt:

C:\>"ipconfig /flushdns"

The requested operation requires elevation

C:\>

Oh! That didn't work! What the heck is "elevation"? Other than sounding like a U2 song!

Well, having googled around and found this thread on a Microsoft site, it appears that as an Active Directory Domain Admin I was insufficiently priviledged on my Desktop to perform that operation from a Command Prompt!

To be able to perform that sort of operation in a Command Prompt I should have started the Command Prompt with "Run as Administrator".

Some may argue that this is merely improving security, but I would not be one of them. Since then, I was started up FileZilla which informed me there was an update available and did I want to install it. I said yes. FileZilla downloaded the file successfully, and then failed. Guess what! Actually running the install program was an operation which required elevation. Grrr!

RVTools

I've just used RVTools for the first time.

What an absolutely excellent tool. It isn't graphical, but it's tabular presentation of information reveals information that I would have had to drill down into each VM's data to find. I thoroughly recommend it to anyone using VMware ESX.

And best of all, its free!

Suppliers' Websites

If ever an application crashes on Windows, I never hit the button to send information about it to Microsoft. I guess I was conditioned in the futility of attempting to engage Microsoft Support over 15 years ago. Ever since I haven't bothered with them. There is only so much hitting your head against a brick wall that is good for you after all. That said in this age of the Internet the resources provided on Microsoft's website are pretty good. Even the things that I might want to see might be there. If only I could find them.

I remember possibly 10 years ago, a colleague slamming the phone receiver down in frustration after talking to IBM when trying to get a licence for some software we had purchased. I took over and finally got a licence. I wasn't completely sure it was "our" licence, but it was a licence and it worked and we were able to move on. Even after its recent re-vamp - actually I'm sure that it is probably a continuous process in play here - it is still damn difficult to find what you really want. Try and use the IBM search for the bios update for a specific server, e.g. a x346. The results will list just about any IBM server.

The solution?

Just use Google. We all know it makes sense. I just wish for a higher signal to noise ratio. But no matter how bad it is, its still better than trying to use these two Vendors own search engines.

VMware VDM Agent - Access is Denied

When trying to RDP onto the VM that had been set up, the RDP screen comes up and then a box with a red cross saying "VMware VDM Agent - Access is Denied".

What's Up?

By default, VDM 2.1 blocks non-VDM RDP connections. This can be disabled by Group Policy or a registry setting on the VMs.

The group policy file is included on the VDM connection server install under the ADM subfolder.

The registry key that should be set is "AllowDirectRDP"="true" which can be found in either of the following two locations:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\VMware, Inc\VMware VDM\Agent\Configuration
or
HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc\VMware VDM\Agent\Configuration

If there is no VMware, Inc tree under Policies or if the key does not exist under the latter subtree, just create it under the latter tree.

Deskilling

13 or so years ago, when I first started at my current company, I would cheerfully jumpstart a server to an appropriate Solaris OS revision, download the source of an application, build it, install it and configure it as needed.

Then sites like sunfreeware came online. And the order of business became, jumpstart the server, download the application, install it, and then configure as needed.

Recently, it has been a case of "I wonder if there is a VM to do that?" Lets download that and configure it.