1N/A#!/bin/sh --
1N/A#
1N/A# CDDL HEADER START
1N/A#
1N/A# The contents of this file are subject to the terms of the
1N/A# Common Development and Distribution License (the "License").
1N/A# You may not use this file except in compliance with the License.
1N/A#
1N/A# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
1N/A# or http://www.opensolaris.org/os/licensing.
1N/A# See the License for the specific language governing permissions
1N/A# and limitations under the License.
1N/A#
1N/A# When distributing Covered Code, include this CDDL HEADER in each
1N/A# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
1N/A# If applicable, add the following below this CDDL HEADER, with the
1N/A# fields enclosed by brackets "[]" replaced with your own identifying
1N/A# information: Portions Copyright [yyyy] [name of copyright owner]
1N/A#
1N/A# CDDL HEADER END
1N/A#
1N/A
1N/A# Check :include: aliases (in files configured in sendmail.cf) and .forward
1N/A# files to make sure the files and their parent directory paths all have
1N/A# proper permissions. And check the master alias file(s) too.
1N/A#
1N/A# See http://www.sendmail.org/vendor/sun/migration.html#Security for details.
1N/A#
1N/A# Copyright (c) 1998, 2011, Oracle and/or its affiliates. All rights reserved.
1N/A#
1N/A
1N/APATH=/bin
1N/A
1N/A# Check the group- and world-writable bits on the given file.
1N/A
1N/Aanalyze() {
1N/A case "`ls -Lldn $1`" in
1N/A ?????w??w?*)
1N/A echo $2: $1 is group and world writable
1N/A bogus_dirs=true ;;
1N/A ????????w?*)
1N/A echo $2: $1 is world writable
1N/A bogus_dirs=true ;;
1N/A ?????w????*)
1N/A echo $2: $1 is group writable
1N/A bogus_dirs=true ;;
1N/A esac
1N/A}
1N/A
1N/A# Break down the given file name into its components, and call analyze with
1N/A# each of them. E.g., an argument of /usr/local/aliases/foo.list would call
1N/A# analyze in turn with arguments:
1N/A# * /usr/local/aliases/foo.list
1N/A# * /usr/local/aliases
1N/A# * /usr/local
1N/A# * /usr
1N/A
1N/Abreak_down() {
1N/A for j in `echo $1 | \
1N/A awk '{
1N/A n = split($0, parts, "/");
1N/A for (i = n; i >= 2; i--){
1N/A string = "";
1N/A for (j = 2; j <= i; j++){
1N/A string = sprintf("%s/%s", string, parts[j]);
1N/A }
1N/A print string
1N/A }
1N/A }'` "/"
1N/A do
1N/A analyze $j $1
1N/A done
1N/A}
1N/A
1N/Aconfig=/etc/mail/sendmail.cf
1N/Abogus_dirs=false
1N/A
1N/Aafl1=`grep "^OA" $config | sed 's/^OA//' | sed 's/,/ /g' | sed 's/.*://'`
1N/Aafl2=`grep "^O AliasFile=" $config | sed 's/^O AliasFile=//' | \
1N/A sed 's/,/ /g' | sed 's/.*://'`
1N/A
1N/A# These should be OK themselves, but other packages may have screwed up the
1N/A# permissions on /etc or /etc/mail . And best to check in case non-standard
1N/A# alias paths are used.
1N/A
1N/Abreak_down $afl1 $afl2
1N/A
1N/A# Find all valid :include: files used in alias files configured in sendmail.cf
1N/A
1N/Afor i in `sed 's/^[#].*$//' $afl1 $afl2 | \
1N/A grep :include: | \
1N/A sed 's/.*:include://' | \
1N/A sed 's/,.*$//'`
1N/Ado
1N/A break_down $i
1N/Adone
1N/A
1N/A# Check .forward files as well. If the argument "ALL" is given, do it for
1N/A# everyone. If no argument to the script is given, just do it for the current
1N/A# user. O/w, do it for all arguments.
1N/A
1N/Aif [ $# -eq 0 ] ; then
1N/A arg="$(id -u -n -r)"
1N/Aelif [ $1 = "ALL" ] ; then
1N/A arg=""
1N/Aelse
1N/A arg="$*"
1N/Afi
1N/A
1N/Afor i in `getent passwd $arg | nawk -F: '{print $6}'`
1N/Ado
1N/A if [ -f $i/.forward ] ; then
1N/A break_down $i/.forward
1N/A fi
1N/Adone
1N/A
1N/A$bogus_dirs || echo "No unsafe directories found."