Re: [Exim] Protecting Percent-Hack exploitable machines with…

Top Page
Delete this message
Reply to this message
Author: Marc Haber
Date:  
To: exim-users
Subject: Re: [Exim] Protecting Percent-Hack exploitable machines with exim
On Tue, 21 Aug 2001 15:17:51 +0100 (BST), Philip Hazel
<ph10@???> wrote:
>Run a test with -d9 -bh to see what is actually going on in your
>configuration.


With "* localhost" in the router, -d9 -bh goes
|haber@testhost[3/502]:~$ exim -d9 -C exim.conf -bh 212.126.200.160
|Exim version 3.31 debug level 9 uid=5310 gid=5310
|Berkeley DB: Sleepycat Software: DB 2.4.14: (6/2/98)
|Removed setuid privilege: uid=5310 gid=5310 euid=5310 egid=5310
|testhost.example.com in local_domains? yes (matched testhost.example.com)
|Configured local interface address is 127.0.0.1
|Configured local interface address is 192.168.26.14
|Configured local interface address is 192.168.25.129
|Configured local interface address is 172.17.0.1
|Configured local interface address is 172.16.10.1
|Caller is an admin user
|user name "Marc Haber" extracted from gecos field "Marc Haber,,,"
|originator: uid=5310 gid=5310 login=haber name=Marc Haber
|sender address = haber@???
|sender_fullhost = [212.126.200.160]
|sender_rcvhost = [212.126.200.160]
|
|**** SMTP testing session as if from host 212.126.200.160
|**** Not for real!
|
|host in host_lookup? yes (*)
|looking up host name for 212.126.200.160
|IP address lookup yielded q.bofh.de
|sender_fullhost = q.bofh.de [212.126.200.160]
|sender_rcvhost = q.bofh.de ([212.126.200.160])
|set_process_info: 14797 handling incoming connection from q.bofh.de [212.126.200.160]
|host in host_reject? no (option unset)
|host in host_reject_recipients? no (option unset)
|host in auth_hosts? no (option unset)
|host in sender_unqualified_hosts? no (option unset)
|host in receiver_unqualified_hosts? no (option unset)
|host in helo_verify? no (option unset)
|host in helo_accept_junk_hosts? no (option unset)
|SMTP>> 220 testhost.example.com ESMTP Tue, 21 Aug 2001 16:51:23 +0200. Everything you do is logged, don't spam us or our customers.
|220 testhost.example.com ESMTP Tue, 21 Aug 2001 16:51:23 +0200. Everything you do is logged, don't spam us or our customers.
|smtp_setup_msg entered
|helo q.bofh.de
|SMTP<< helo q.bofh.de
|sender_fullhost = q.bofh.de [212.126.200.160]
|sender_rcvhost = q.bofh.de ([212.126.200.160])
|set_process_info: 14797 handling incoming connection from q.bofh.de [212.126.200.160]
|250 testhost.example.com Hello q.bofh.de [212.126.200.160]
|SMTP>> 250 testhost.example.com Hello q.bofh.de [212.126.200.160]
|mail from: <a%b%c@???>
|SMTP<< mail from: <a%b%c@???>
|spool directory /var/spool/exim space = 216675 blocks; inodes = 182240; check_space = 524288000 (128000 blocks); inodes = 1000; msg_size = 0 (0 blocks)
|log directory /var/log/exim space = 216675 blocks; inodes = 182240; check_space = 104857600 (25600 blocks); inodes = 1000
|a%b%c@??? in sender_reject? no (option unset)
|a%b%c@??? in sender_reject_recipients? no (option unset)
|host in sender_verify_hosts? yes (*)
|verifying sender a%b%c@???
|>>>>>>>>>>>>>>>>>>>>>>>>
|Verifying a%b%c@???
|a%b%c@??? in ^(?i)(root|postmaster|mailer-daemon)@testhost.example.com? no (end of list)
|a%b%c@??? in ^(?i)(root|postmaster|mailer-daemon)@localhost? no (end of list)
|a%b%c@??? in *@*.testhost.example.com? no (end of list)
|a%b%c@??? in *@localhost? no (end of list)
|a%b%c@??? in *@in.limbo? no (end of list)
|a%b%c@??? in *@testhost.example.com? no (end of list)
|bofh.de in local_domains? no (end of list)
|address a%b%c@???
| local_part=a%b%c domain=bofh.de
| domain is not local

|>>>>>>>>>>>>>>>>>>>>>>>>
|routing a%b%c@???, domain bofh.de
|a%b%c in "^.*%"? yes (matched ^.*%)
|fail_percent router called for a%b%c@???
| route_domain = bofh.de

|routelist_item = * localhost
|after handling route_lists items, matched = 1
|original hostlist=localhost options=
|expanded hostlist="localhost" options=
|fail_percent router passed; "more" overridden
|domain bofh.de rewritten as localhost
|R: hubbed_hosts for bofh.de
|hubbed_hosts router called for a%b%c@???
| route_domain = localhost

|after handling route_lists items, matched = 0
|hubbed_hosts router: lsearch key=localhost
| file="/etc/exim/hubbed_hosts"

|search_open: lsearch "/etc/exim/hubbed_hosts"
|search_find: file="/etc/exim/hubbed_hosts"
| key="localhost" partial=2

|LRU list:
| 7/etc/exim/hubbed_hosts
| End

|internal_search_find: file="/etc/exim/hubbed_hosts"
| type=lsearch key="localhost"

|file lookup required for localhost
| in /etc/exim/hubbed_hosts

|lookup failed
|trying partial match *.localhost
|internal_search_find: file="/etc/exim/hubbed_hosts"
| type=lsearch key="*.localhost"

|file lookup required for *.localhost
| in /etc/exim/hubbed_hosts

|lookup failed
|search_find failed:
|hubbed_hosts router declined
|lookuphost router called for a%b%c@???
| dns lookup: route_domain = localhost

|DNS lookup of localhost (MX) gave NO_DATA
|returning DNS_NOMATCH
|DNS lookup of localhost (A6) gave NO_DATA
|returning DNS_NOMATCH
|DNS lookup of localhost (AAAA) gave NO_DATA
|returning DNS_NOMATCH
|DNS lookup of localhost (A) succeeded
|Configured local interface address is 127.0.0.1
|Configured local interface address is 192.168.26.14
|Configured local interface address is 192.168.25.129
|Configured local interface address is 172.17.0.1
|Configured local interface address is 172.16.10.1
|local host found for non-MX address
|fully qualified name = localhost.example.com
|localhost.example.com 127.0.0.1 mx=-1 sort=-90
|localhost.example.com in local_domains? no (end of list)
|rewriting after lookuphost router
|lookuphost router found localhost to be local, or locally MX'd
|routing a%b%c@??? caused it to become local
|bofh.de in local_domains? no (end of list)
|address a%b%c@???
| local_part=a%b%c domain=bofh.de
| domain is not local

|>>>>>>>>>>>>>>>>>>>>>>>>
|routing a%b%c@???, domain bofh.de
|a%b%c in "^.*%"? yes (matched ^.*%)
|fail_percent router called for a%b%c@???
| route_domain = bofh.de

|routelist_item = * localhost
|after handling route_lists items, matched = 1
|original hostlist=localhost options=
|expanded hostlist="localhost" options=
|fail_percent router passed; "more" overridden
|domain bofh.de rewritten as localhost
|R: hubbed_hosts for bofh.de
|hubbed_hosts router called for a%b%c@???
| route_domain = localhost

|after handling route_lists items, matched = 0
|hubbed_hosts router: lsearch key=localhost
| file="/etc/exim/hubbed_hosts"

|search_open: lsearch "/etc/exim/hubbed_hosts"
| cached open

|search_find: file="/etc/exim/hubbed_hosts"
| key="localhost" partial=2

|LRU list:
| 7/etc/exim/hubbed_hosts
| End

|internal_search_find: file="/etc/exim/hubbed_hosts"
| type=lsearch key="localhost"

|file lookup required for localhost
| in /etc/exim/hubbed_hosts

|lookup failed
|trying partial match *.localhost
|internal_search_find: file="/etc/exim/hubbed_hosts"
| type=lsearch key="*.localhost"

|file lookup required for *.localhost
| in /etc/exim/hubbed_hosts

|lookup failed
|search_find failed:
|hubbed_hosts router declined
|lookuphost router called for a%b%c@???
| dns lookup: route_domain = localhost

|DNS lookup of localhost-MX: using cached value DNS_NOMATCH
|DNS lookup of localhost-A6: using cached value DNS_NOMATCH
|DNS lookup of localhost-AAAA: using cached value DNS_NOMATCH
|DNS lookup of localhost (A) succeeded
|local host found for non-MX address
|fully qualified name = localhost.example.com
|localhost.example.com 127.0.0.1 mx=-1 sort=-53
|localhost.example.com in local_domains? no (end of list)
|rewriting after lookuphost router
|lookuphost router found localhost to be local, or locally MX'd
|routing a%b%c@??? caused it to become local
|bofh.de in local_domains? no (end of list)
|address a%b%c@???
| local_part=a%b%c domain=bofh.de
| domain is not local

|>>>>>>>>>>>>>>>>>>>>>>>>
|routing a%b%c@???, domain bofh.de
|a%b%c in "^.*%"? yes (matched ^.*%)
|fail_percent router called for a%b%c@???
| route_domain = bofh.de

|routelist_item = * localhost
|after handling route_lists items, matched = 1
|original hostlist=localhost options=
|expanded hostlist="localhost" options=
|fail_percent router passed; "more" overridden
|domain bofh.de rewritten as localhost
|R: hubbed_hosts for bofh.de
|hubbed_hosts router called for a%b%c@???
| route_domain = localhost

|after handling route_lists items, matched = 0
|hubbed_hosts router: lsearch key=localhost
| file="/etc/exim/hubbed_hosts"

|search_open: lsearch "/etc/exim/hubbed_hosts"
| cached open

|search_find: file="/etc/exim/hubbed_hosts"
| key="localhost" partial=2

|LRU list:
| 7/etc/exim/hubbed_hosts
| End

|internal_search_find: file="/etc/exim/hubbed_hosts"
| type=lsearch key="localhost"

|file lookup required for localhost
| in /etc/exim/hubbed_hosts

|lookup failed
|trying partial match *.localhost
|internal_search_find: file="/etc/exim/hubbed_hosts"
| type=lsearch key="*.localhost"

|file lookup required for *.localhost
| in /etc/exim/hubbed_hosts

|lookup failed
|search_find failed:
|hubbed_hosts router declined
|lookuphost router called for a%b%c@???
| dns lookup: route_domain = localhost

|DNS lookup of localhost-MX: using cached value DNS_NOMATCH
|DNS lookup of localhost-A6: using cached value DNS_NOMATCH
|DNS lookup of localhost-AAAA: using cached value DNS_NOMATCH
|DNS lookup of localhost (A) succeeded
|local host found for non-MX address
|fully qualified name = localhost.example.com
|localhost.example.com 127.0.0.1 mx=-1 sort=-18
|localhost.example.com in local_domains? no (end of list)
|rewriting after lookuphost router
|lookuphost router found localhost to be local, or locally MX'd
|routing a%b%c@??? caused it to become local
|bofh.de in local_domains? no (end of list)
|address a%b%c@???
| local_part=a%b%c domain=bofh.de
| domain is not local

|>>>>>>>>>>>>>>>>>>>>>>>>
|routing a%b%c@???, domain bofh.de
|a%b%c in "^.*%"? yes (matched ^.*%)
|fail_percent router called for a%b%c@???
| route_domain = bofh.de

|routelist_item = * localhost
|after handling route_lists items, matched = 1
|original hostlist=localhost options=
|expanded hostlist="localhost" options=
|fail_percent router passed; "more" overridden
|domain bofh.de rewritten as localhost
|R: hubbed_hosts for bofh.de
|hubbed_hosts router called for a%b%c@???
| route_domain = localhost

|after handling route_lists items, matched = 0
|hubbed_hosts router: lsearch key=localhost
| file="/etc/exim/hubbed_hosts"

|search_open: lsearch "/etc/exim/hubbed_hosts"
| cached open

|search_find: file="/etc/exim/hubbed_hosts"
| key="localhost" partial=2

|LRU list:
| 7/etc/exim/hubbed_hosts
| End

|internal_search_find: file="/etc/exim/hubbed_hosts"
| type=lsearch key="localhost"


This looks like an endless loop for me.

With the "localhost byname" option, this looks like:
|haber@testhost[5/503]:~$ exim -d9 -bh 212.126.200.160
|Exim version 3.31 debug level 9 uid=5310 gid=5310
|Berkeley DB: Sleepycat Software: DB 2.4.14: (6/2/98)
|testhost.example.com in local_domains? yes (matched testhost.example.com)
|Configured local interface address is 127.0.0.1
|Configured local interface address is 192.168.26.14
|Configured local interface address is 192.168.25.129
|Configured local interface address is 172.17.0.1
|Configured local interface address is 172.16.10.1
|Caller is an admin user
|user name "Marc Haber" extracted from gecos field "Marc Haber,,,"
|originator: uid=5310 gid=5310 login=haber name=Marc Haber
|sender address = haber@???
|sender_fullhost = [212.126.200.160]
|sender_rcvhost = [212.126.200.160]
|
|**** SMTP testing session as if from host 212.126.200.160
|**** Not for real!
|
|host in host_lookup? yes (*)
|looking up host name for 212.126.200.160
|IP address lookup yielded q.bofh.de
|sender_fullhost = q.bofh.de [212.126.200.160]
|sender_rcvhost = q.bofh.de ([212.126.200.160])
|set_process_info: 14848 handling incoming connection from q.bofh.de [212.126.200.160]
|host in host_reject? no (option unset)
|host in host_reject_recipients? no (option unset)
|host in auth_hosts? no (option unset)
|host in sender_unqualified_hosts? no (option unset)
|host in receiver_unqualified_hosts? no (option unset)
|host in helo_verify? no (option unset)
|host in helo_accept_junk_hosts? no (option unset)
|SMTP>> 220 testhost.example.com ESMTP Tue, 21 Aug 2001 17:03:23 +0200. Everything you do is logged, don't spam us or our customers.
|220 testhost.example.com ESMTP Tue, 21 Aug 2001 17:03:23 +0200. Everything you do is logged, don't spam us or our customers.
|smtp_setup_msg entered
|helo q.bofh.de
|SMTP<< helo q.bofh.de
|sender_fullhost = q.bofh.de [212.126.200.160]
|sender_rcvhost = q.bofh.de ([212.126.200.160])
|set_process_info: 14848 handling incoming connection from q.bofh.de [212.126.200.160]
|250 testhost.example.com Hello q.bofh.de [212.126.200.160]
|SMTP>> 250 testhost.example.com Hello q.bofh.de [212.126.200.160]
|mail from: <a%b%c@???>
|SMTP<< mail from: <a%b%c@???>
|spool directory /var/spool/exim space = 217629 blocks; inodes = 182249; check_space = 524288000 (128000 blocks); inodes = 1000; msg_size = 0 (0 blocks)
|log directory /var/log/exim space = 217629 blocks; inodes = 182249; check_space = 104857600 (25600 blocks); inodes = 1000
|a%b%c@??? in sender_reject? no (option unset)
|a%b%c@??? in sender_reject_recipients? no (option unset)
|host in sender_verify_hosts? yes (*)
|verifying sender a%b%c@???
|>>>>>>>>>>>>>>>>>>>>>>>>
|Verifying a%b%c@???
|a%b%c@??? in ^(?i)(root|postmaster|mailer-daemon)@testhost.example.com? no (end of list)
|a%b%c@??? in ^(?i)(root|postmaster|mailer-daemon)@localhost? no (end of list)
|a%b%c@??? in *@*.testhost.example.com? no (end of list)
|a%b%c@??? in *@localhost? no (end of list)
|a%b%c@??? in *@in.limbo? no (end of list)
|a%b%c@??? in *@testhost.example.com? no (end of list)
|bofh.de in local_domains? no (end of list)
|address a%b%c@???
| local_part=a%b%c domain=bofh.de
| domain is not local

|>>>>>>>>>>>>>>>>>>>>>>>>
|routing a%b%c@???, domain bofh.de
|a%b%c in "^.*%"? yes (matched ^.*%)
|fail_percent router called for a%b%c@???
| route_domain = bofh.de

|routelist_item = * localhost byname
|after handling route_lists items, matched = 1
|original hostlist=localhost options=byname
|expanded hostlist="localhost" options=byname
|Configured local interface address is 127.0.0.1
|Configured local interface address is 192.168.26.14
|Configured local interface address is 192.168.25.129
|Configured local interface address is 172.17.0.1
|Configured local interface address is 172.16.10.1
|local host found for non-MX address
|fully qualified name = localhost
|localhost 127.0.0.1 mx=-1
|remote host address is the local host: bofh.de
| address passed to directors: self_host = localhost

|fail_percent router found bofh.de to be local, or locally MX'd
|routing a%b%c@??? caused it to become local
|bofh.de in percent_hack_domains? no (end of list)
|address a%b%c@???
| local_part=a%b%c domain=bofh.de
| domain is local

|>>>>>>>>>>>>>>>>>>>>>>>>
|directing a%b%c@???
|real_local director skipped: prefix mismatch
|calling system_aliases director
|df_lookup entered: search type = lsearch
|system_aliases director: lsearch key=a%b%c
| file="/etc/aliases"

|search_open: lsearch "/etc/aliases"
|search_find: file="/etc/aliases"
| key="a%b%c" partial=-1

|LRU list:
| 7/etc/aliases
| End

|internal_search_find: file="/etc/aliases"
| type=lsearch key="a%b%c"

|file lookup required for a%b%c
| in /etc/aliases

|lookup failed
|system_aliases director declined for a%b%c:
|a%b%c in "^.*%"? yes (matched ^.*%)
|calling fail_percent director
|fail_percent director called for a%b%c@???
|parse_extract_addresses: :fail: no percent in local part here
|extract item: :fail: no percent in local part here
|locked /var/spool/exim/db/reject.lockfile
|opened DB file /var/spool/exim/db/reject: flags=2
|dbfn_read: key=a%b%c@???:q.bofh.de
|a%b%c@??? verification failed - will give error after DATA
|SMTP>> 250 <a%b%c@???> is syntactically correct
|250 <a%b%c@???> is syntactically correct
|rcpt to: <postmaster@???>
|SMTP<< rcpt to: <postmaster@???>
|example.com in local_domains? no (end of list)
|search_open: lsearch "/etc/exim/relay_domains"
|search_find: file="/etc/exim/relay_domains"
| key="example.com" partial=2

|LRU list:
| 7/etc/exim/relay_domains
| 7/etc/aliases
| End

|internal_search_find: file="/etc/exim/relay_domains"
| type=lsearch key="example.com"

|file lookup required for example.com
| in /etc/exim/relay_domains

|lookup yielded:
|example.com in relay_domains? yes (matched partial-lsearch;/etc/exim/relay_domains)
|host in receiver_verify_hosts? yes (*)
|>>>>>>>>>>>>>>>>>>>>>>>>
|Verifying postmaster@???
|example.com in local_domains? no (end of list)
|address postmaster@???
| local_part=postmaster domain=example.com
| domain is not local

|>>>>>>>>>>>>>>>>>>>>>>>>
|routing postmaster@???, domain example.com
|postmaster in "^.*%"? no (end of list)
|fail_percent router skipped: local part mismatch
|R: hubbed_hosts for example.com
|hubbed_hosts router called for postmaster@???
| route_domain = example.com

|after handling route_lists items, matched = 0
|hubbed_hosts router: lsearch key=example.com
| file="/etc/exim/hubbed_hosts"

|search_open: lsearch "/etc/exim/hubbed_hosts"
|search_find: file="/etc/exim/hubbed_hosts"
| key="example.com" partial=2

|LRU list:
| 7/etc/exim/hubbed_hosts
| 7/etc/exim/relay_domains
| 7/etc/aliases
| End

|internal_search_find: file="/etc/exim/hubbed_hosts"
| type=lsearch key="example.com"

|file lookup required for example.com
| in /etc/exim/hubbed_hosts

|lookup yielded: netscape-crap.example.com         bydns_a
|original hostlist=netscape-crap.example.com options=bydns_a
|expanded hostlist="netscape-crap.example.com" options=bydns_a
|DNS lookup of netscape-crap.example.com (A6) gave NO_DATA
|returning DNS_NOMATCH
|DNS lookup of netscape-crap.example.com (AAAA) gave NO_DATA
|returning DNS_NOMATCH
|DNS lookup of netscape-crap.example.com (A) succeeded
|fully qualified name = netscape-crap.example.com
|netscape-crap.example.com 192.168.25.131 mx=-1 sort=-16
|routed by hubbed_hosts router:

| deliver to postmaster@???
| transport: remote_smtp
| host netscape-crap.example.com [192.168.25.131]

|SMTP>> 250 <postmaster@???> verified
|250 <postmaster@???> verified
|data
|SMTP<< data
|SMTP>> 354 Enter message, ending with "." on a line by itself
|354 Enter message, ending with "." on a line by itself
|search_tidyup called
|test
|.
|host in ignore_fromline_hosts? no (option unset)
|>>Original headers (size=4):
|
|test
|a%b%c@??? in ^(?i)(root|postmaster|mailer-daemon)@testhost.example.com? no (end of list)
|a%b%c@??? in ^(?i)(root|postmaster|mailer-daemon)@localhost? no (end of list)
|a%b%c@??? in *@*.testhost.example.com? no (end of list)
|a%b%c@??? in *@localhost? no (end of list)
|a%b%c@??? in *@in.limbo? no (end of list)
|a%b%c@??? in *@testhost.example.com? no (end of list)
|rewritten sender = a%b%c@???
|rewrite_one_header: type=F:
| From: a%b%c@???

|a%b%c@??? in ^(?i)(root|postmaster|mailer-daemon)@testhost.example.com? no (end of list)
|a%b%c@??? in ^(?i)(root|postmaster|mailer-daemon)@localhost? no (end of list)
|a%b%c@??? in *@*.testhost.example.com? no (end of list)
|a%b%c@??? in *@localhost? no (end of list)
|a%b%c@??? in *@in.limbo? no (end of list)
|a%b%c@??? in *@testhost.example.com? no (end of list)
|>>Final headers:
|P Received: from q.bofh.de ([212.126.200.160])
|        by testhost.example.com with smtp (Exim 3.31 #4 (Debian))
|        id 15ZD4I-0003rU-00
|        for <postmaster@???>; Tue, 21 Aug 2001 17:03:53 +0200

|I Message-Id: <E15ZD4I-0003rU-00@???>
|F From: a%b%c@???
|B Bcc:
| Date: Tue, 21 Aug 2001 17:03:53 +0200

|
|test
|search_tidyup called
|locked /var/spool/exim/db/reject.lockfile
|opened DB file /var/spool/exim/db/reject: flags=42
|dbfn_write: key=a%b%c@???:q.bofh.de
|LOG: 3 MAIN REJECT
| rejected from q.bofh.de [212.126.200.160]: unknown local part in sender <a%b%c@???>

|SMTP>> 550 rejected: unknown local part in sender <a%b%c@???>
|550 rejected: unknown local part in sender <a%b%c@???>
|smtp_setup_msg entered
|quit
|SMTP<< quit
|SMTP>> 221 testhost.example.com closing connection
|221 testhost.example.com closing connection
|search_tidyup called
|haber@testhost[6/503]:~$

With "localhost byname", exim gives a confusing error message and
refuses the message, although it should be verifiable.

Setting sender_verify=no in the fail_percent router seems to solve
this. Is this the way to do it, or could this have further side
effects?

Greetings
Marc

-- 
-------------------------------------- !! No courtesy copies, please !! -----
Marc Haber          |   " Questions are the         | Mailadresse im Header
Karlsruhe, Germany  |     Beginning of Wisdom "     | Fon: *49 721 966 32 15
Nordisch by Nature  | Lt. Worf, TNG "Rightful Heir" | Fax: *49 721 966 31 29