Sendmail and tcp_wrappers

Question

Hi all,
According to the documentation, in solaris 10 access to sendmail should be controllable through tcp_wrappers, but I can't seem to get it to work like it should.
I've edited the /etc/hosts.allow to this:
sendmail: 127.0.0.1
But when I try and connect from another machine it still allows me access:
[user@othermachine ~]$ telnet box 25
Trying 10.37.5.91...
Connected to box.
Escape character is '^]'.
220 box ESMTP Sendmail 8.13.6+Sun/8.13.6; Mon, 24 Apr 2006 14:57:08 +0200 (MEST)
I've used truss on the sendmail process, and can see it actually opening /etc/hosts.allow:
507: open("/etc/hosts.allow", O_RDONLY) = 6
507: fstat64(6, 0xFFBFCF58) = 0
507: fstat64(6, 0xFFBFCE00) = 0
507: ioctl(6, TCGETA, 0xFFBFCEE4) Err#25 ENOTTY
507: read(6, " s e n d m a i l : l o c".., 8192) = 122
507: read(6, 0x0016B71C, 8192) = 0
507: llseek(6, 0, SEEK_CUR) = 122
507: close(6) = 0
507: open("/etc/hosts.deny", O_RDONLY) = 6
507: fstat64(6, 0xFFBFCF58) = 0
507: fstat64(6, 0xFFBFCE00) = 0
507: ioctl(6, TCGETA, 0xFFBFCEE4) Err#25 ENOTTY
507: read(6, " A L L : A L L\n s e n d".., 8192) = 21
507: llseek(6, 0xFFFFFFFFFFFFFFF3, SEEK_CUR) = 8
507: close(6) = 0
507: fstat(4, 0xFFBFD338) = 0
507: time() = 1145882218
507: getpid() = 507 [475]
507: putmsg(4, 0xFFBFC9F0, 0xFFBFC9E4, 0) = 0
507: open("/var/run/syslog_door", O_RDONLY) = 6
I've also installed the latest sendmail patch ( 122856-01 ).
If anyone can shed some light on this i'd be appreciated.
Thanks in advance!

Answer 1

Just went through this with support. Sendmail should use tcp wrappers by default.
Check:
If you run the command:
# /usr/lib/sendmail -d0.1 < /dev/null
Does the output show tcpwrappers as it does below:
# /usr/lib/sendmail -d0.1 < /dev/null
Version 8.13.4+Sun
Compiled with: DNSMAP LDAPMAP LOG MAP_REGEX MATCHGECOS MILTER MIME7TO8
MIME8TO7 NAMED_BIND NDBM NETINET NETINET6 NETUNIX NEWDB NIS
NISPLUS PIPELINING SCANF STARTTLS TCPWRAPPERS USERDB
USE_LDAP_INIT XDEBUG
*** Now, the meat... if tcp wrappers is indicated as above, connect & try mail from command. sendmail always allows the connection, but if blocked by wrappers, mail from will be disallowed. It's not intuitive, since other tcp wrappers don't allow any connection when a host is denied. And, Sun ought to document better, since we're counting on them!
E.g. (mconnect is Solaris command, like telnet to port 25, actual info changed to protect us):
mconnect mailserver
connecting to host mailserver (10.1.1.25), port 25
connection open
220 mailserver.domain.net ESMTP Sendmail 8.13.6+Sun/8.13.6; Tue, 25 Apr 2006 14:54:45 -0400 (EDT)
MAIL FROM:[email protected]
550 5.0.0 Access denied