Subject: Re: localhost security hole
To: Alan Barrett <apb@cequrux.com>
From: Christian Limpach <chris@pin.lu>
List: tech-security
Date: 06/28/2003 18:04:12
Quoting Alan Barrett <apb@cequrux.com>:

> The default sendmail.cf tries to handle "localhost" as a special case.
> It seems to be getting it wrong somehow.  I think we should find out why
> and fix it.

The special handling you see is not involved in finding the host to which to 
submit mail.  Our netbsd-msp.mc uses the default MTAHost value which is 
`localhost'.  The sample submit.mc explicitly sets the MTAHost to 127.0.0.1, 
our netbsd-msp.mc should do the same.

Index: gnu/usr.sbin/sendmail/cf/cf/netbsd-msp.mc
===================================================================
RCS file: /cvs/netbsd/src/gnu/usr.sbin/sendmail/cf/cf/netbsd-msp.mc,v
retrieving revision 1.2
diff -u -r1.2 netbsd-msp.mc
--- gnu/usr.sbin/sendmail/cf/cf/netbsd-msp.mc   1 Apr 2003 03:19:19 -
0000       1.2
+++ gnu/usr.sbin/sendmail/cf/cf/netbsd-msp.mc   28 Jun 2003 15:34:07 -0000
@@ -2,4 +2,4 @@
 include(`../m4/cf.m4')
 VERSIONID(`@(#)netbsd-msp.mc   $Revision: 1.2 $')
 OSTYPE(bsd4.4)dnl
-FEATURE(`msp')dnl
+FEATURE(`msp', `[127.0.0.1]')dnl

-- 
Christian Limpach <chris@pin.lu>