Subject: Re: localhost security hole
To: NetBSD security list <tech-security@netbsd.org>
From: Alan Barrett <apb@cequrux.com>
List: current-users
Date: 06/29/2003 10:56:57
On Sun, 29 Jun 2003, Andrew Brown wrote:
> >  -D{MTAHost}[localhost]
> >  +D{MTAHost}[127.0.0.1]
> >
> >and, with that change, sendmail on my test system no longer connects to
> >10.2.3.4 (which is the IP address of localhost.example.net in my test
> >environment).
> 
> that may be, but it's specific to ipv4.  what about about ipv6
> systems, where 127.0.0.1 is not a local ip address?

Then use D{MTAHost}[::1] on IPv6 systems.

> otoh, the name localhost maps to an address in both spaces.

OK, so use D{MTAHost}[localhost.] (with a trailing dot).  This setting
is used to create network connections from smmsp to sendmail on the
local host; it is not used as part of any email address, so trailing
dots are legal here.  Using localhost without a trailing dot means that it is
subject to sendmail's stupid host name qualification, so it could be
redirected to the wrong IP address if localhost.${domain} does not map to
127.0.0.1 or ::1.

--apb (Alan Barrett)