0

We run a sendmail 8.14 server for a domain which has its user database managed in NIS. My nsswitch.conf is pretty vanilla:

passwd:         compat
group:          compat
shadow:         compat

hosts:          files mdns4_minimal [NOTFOUND=return] nis dns mdns4
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

If the NIS service is for some reason down, sendmail permanently rejects emails to our users, which is really undesirable. When DNS is down, other pathologies also occur.

I'd like to have sendmail refuse to receive email if the NIS or DNS services are down. Is there a way to configure sendmail to do so?

  • Possibly you could set up a sendmail access database that uses only names that require DNS or NIS lookups, and when the name service is broken it'll refuse access to the client. – Mark Plotnick Mar 22 '16 at 18:43
  • That's interesting -- can you give me a bit more detail as to what that might look like? Which names could I use to ensure that? – kiko Mar 26 '16 at 17:15
  • What I'd try is to edit /etc/mail/access. For every client that can send mail to your server, add a Connect:theclient'sFQDN RELAY line (you can add one with just the domain name if that makes things easier), followed by a Connect:theclient'sIPaddr ERROR:421 Not now, DNS is broken for each IP address. The goal is that, when the name service is down, the ERROR lines will be reached. See the doc on how to use makemap after making any edits. In my limited testing on Fedora just now, it looks like DNS info is cached, so you may need to tweak nscd or whatever caching mechanism you use. – Mark Plotnick Mar 29 '16 at 4:06
  • It may be easier just to make your mail server be a slave NIS server and make sure it's bound to itself. That way, it may have slightly stale data, but it will never have no data. – Mark Plotnick Mar 29 '16 at 4:13
  • Mark, that's obviously the right answer. I just did it and it is trivial (and works like a charm). Could you add it as an answer so I can upvote it? – kiko Apr 2 '16 at 17:22
0

How about a monitoring script that shuts down sendmail if NIS or DNS is unavailable? Mail will remain queued for a few days before it gets tossed, so that should be plenty of time to get the services back online and have it restart sendmail.

  • Thanks. Yeah, that was my initial instinct, but I am curious whether sendmail has something built-in that allows a check to be run when deciding whether to accept connections. Do you have a suggestion on how to run the monitoring script? Cron might introduce undesirable latency and force polling, but I'm not sure how else to check for a process being alive. – kiko Mar 26 '16 at 17:13
  • There's usually a local cache for DNS which will work if NIS is unavailable but only if you've recently done a request. So what you really need to do is check on the health of the NIS server. If you can't ping the NIS server, have the script run /etc/init.d/sendmail stop or the equivalent. If it can, you run /etc/init.d/sendmail start. You'd want this as polling, so a continuous script that checks every 15 or 30 seconds or whatever. – mkomarinski Mar 28 '16 at 12:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.