SMRSH(8)

💅 SMRSH — restricted shell for sendmail 💅

Okay so first things first, bestie: this is from the System Manager's Manual, and it's giving "security guard for your mail server" energy. Let's get into it. ✨

---

🌸 NAME 🌸

smrsh — the restricted shell for sendmail, and no, it's not here to play games. 🔒

---

🎀 SYNOPSIS 🎀

smrsh -c command

That's the whole vibe. One flag, one argument, zero drama. 💅

---

🦋 DESCRIPTION 🦋

So smrsh is literally intended as a replacement for sh when you're using the "prog" mailer in your sendmail(8) config files. Periodt. It sharply limits which commands can be run through the "|program" syntax in sendmail, all to improve the overall security of your system. 🛡️

Like, briefly: even if a "bad guy" somehow gets sendmail to run a program without going through an alias or forward file, smrsh limits the set of programs they can execute. It's giving "you shall not pass" energy, fr fr. 🙅‍♀️

Here's the tea: smrsh limits programs to a single directory — by default /etc/smrsh — which lets the system administrator choose the set of acceptable commands. It also only allows the shell builtin commands exec, exit, and echo. That's it. That's the whole list. 👑

It also rejects any commands containing these characters on the command line, to prevent "end run" attacks:

• '
• <
• >
• ;
• $
• (
• )
• \r (carriage return)
• \n (newline)

⚠️ Bestie, those characters are banned on the command line. Not "maybe banned." Banned. 💀

But it does allow || and && so you can still enable commands like this iconic little number:

"|exec /usr/local/bin/filter || exit 75"

See? Not a total hater. It gets it. 😌

Initial pathnames on programs are stripped, so like… all of these actually forward to /etc/smrsh/vacation:

/usr/ucb/vacation
/usr/bin/vacation
/home/server/mydir/bin/vacation
vacation

The path is not the moment. The directory is the moment. 🎯

System administrators should be conservative about populating the /etc/smrsh directory. For example, a reasonable addition is vacation(1) and the like. But no matter how brow-beaten you may be, never include any shell or shell-like program (such as perl(1)) in the /etc/smrsh directory. 🚫

💀 Note: this does not restrict the use of shell or perl scripts in the sm.bin directory (using the #! syntax). It simply disallows execution of arbitrary programs. Big difference, iykyk.

Also? Including mail filtering programs such as procmail(1) is a very bad idea. Why? Because procmail(1) allows users to run arbitrary programs in their procmailrc(5). So like… yeah. Don't do that. Not today, not ever. 🙈

---

🍓 FILES 🍓

• /etc/smrsh — directory for restricted programs

That's the one. That's the directory. Protect it. 🫶

---

💜 SEE ALSO 💜

• sendmail(8)

---

✨ And that's the whole manual, bestie. Stay safe, stay restricted, and never put perl in /etc/smrsh. 💖

$Date: 2013-11-22 20:52:00 $ — SMRSH(8) out. Slay. 💅🌈