Network mail security issues in LINUX

For network mail security issues in the LINUX operating system-Linux Enterprise Application-Linux server application information, see the following for details. SMTP server work procedure:

Check the address of the received message. If the message address is a local address, save the message for retrieval. If it is a remote address, forward the message.

The SMTP server functions the same as the package router, except for the SMTP service for mail. Most SMTP servers can store and forward messages as needed.

The SMTP server puts forward security requirements on two different tasks:

Protect the server against attacks. You must add protective armor to the server to prevent external attacks. If an external attack succeeds, the attacker will be able to access your system without authorization.

Protect the SMTP service to avoid improper use. For example, outsiders use your email server to send fake emails and spam.

The second problem is even more terrible. Some may use unprotected SMTP servers to forward thousands of ads to Internet mail accounts without thinking about them. If they use your machine, it will overload the network.

Unless otherwise specified, LINUX will use sendmail as your email transmission proxy during installation. Telnet to port 25 to determine the sendmail version. An example of the output result is as follows:

[Jray @ pointy jray] $ telent virtuontooth.com 25

Trying 24.93.119.226...

Conneted to ontooth.com.

Escape character is

220 pointy. pythontooth.com ESMTP Sendmail 8.9.3/8.9.3

→ Sat, 10 Jul 1999 16:27:14-0400

Here we can see that pointy.onontooth.com is running sendmail/8.9.3.

Intruders initiate attacks on sendmail mainly because:

Sendmail is a public service. Once it runs, anyone can connect to and use it.

Sendmail is usually run as root. Therefore, if an attacker discovers a vulnerability that can be exploited, the attacker can obtain the access permission with a higher priority.

Sendmail is very difficult to configure, And intruders assume that you have problems with the installation (usually successful ). The following are some typical sendmail Attacks:

The first is the MIME Buffer Overflow Vulnerability. This attack does not affect sendmail itself, but the customer who sent the mail by sendmail. Here, sendmail is a tool rather than a target. The Computer Emergency Response Team described the attack as follows:

How can an attacker remove a vulnerability from a crispy South region? What is the starting point of the snack frequency ?? Ⅲ? Are you smart? Why? Why? Why can I start to scratch? Look! 8? Start? Abrupt? Why can't the dam-shaped zombie be scratched at the beginning? Are you sure you want? Too many? Why can't I turn around in the upper-right corner? Low tide view! H? Why? No renewal? What are the disadvantages of an acre ?? Are you sure you want to write a video? Why is the tomb of a low-speed car?

Let's take a look at HELO Buffer Overflow:
In versions earlier than sendmail8.9, attackers can use the HELO command to send strings with abnormal lengths to disguise their own initiated addresses. If an attacker sends at least 1024 bytes of abc after HELO, the message header is as follows:

From attacker@attack.place.net Web Feb 5 22 31: 51 1998

Received: from abcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcabcab → abcabcabcabcabcabcabcabc

Date: Wed, 5 Feb 1998 12:32:22 + 0300

From attacker@attack.place.net

The abnormal string hides the information that the sender's IP address should be properly displayed. Although this attack method is not dangerous, attackers can use it to forward mail spam and create emails that are difficult to track.

There is also a password file/Root access, which is a more terrible attack, it affects sendmail8.8.4. Local users can use the link to obtain root access. This attack method relies on sendmail to save undelivered messages after/var/tmp/dead. letter.

All users can perform write operations on/var/tmp. Therefore, local attackers can create a hard link between/etc/passwd and/var/tmp/dead. letter. Then, send a message that cannot be delivered to the sendmail server. In the message body, attackers can insert a user account that can be added to the password file.

When the message is marked as undeliverable, it will be added to/var/tmp/dead. and in/var/tmp/dead. letter has a hard link with/etc/passwd. This leads to a new system account with Root permissions.

As a prominent and frequently accessed server, Sendmail is often the target of attacks. The latest attack method is concentrated on a vulnerability in the sendmail header parsing code. By creating a large number of TO: Header messages, the attacker can stop the server. This attack method is effective for sendmail8.9.2 and earlier versions, so even the recently installed sendmail is also affected.