Retrieving queued mail on DMZ Sendmail server
Situation: we have a Sendmail server in a DMZ that is used to receive
email addressed to one of our company's domains. Unfortunately, we
cannot permit SMTP connections from this DMZ SMTP server to our
internal SMTP server. Therefore, we have to
retrieve the mail from an internal SMTP server and process it locally.
Before attempting this, please read this comp.mail.sendmail
thread. Ideally, SMTP connections from your DMZ SMTP server should be
allowed to internal SMTP hosts. This "pull queued mail" solution should
only be used when you have no alternative.
To retrieve queued mail on a DMZ Sendmail server, we need to perform
the following steps:
1. Configure the DMZ SMTP server to queue mail rather than attempt
immediate delivery. This is accomplished by adding the following to
your sendmail.mc file:
After adding this line, rebuild and install the sendmail.cf file, and send the
Sendmail daemon a SIGHUP to reread the new configuration.
kill -HUP `head -n1
2. Remove the queue runner from the Sendmail startup and shutdown
script on the DMZ SMTP server.
Example lines to change in /etc/init.d/sendmail
on DMZ SMTP server:
# Start the MTA
/usr/lib/sendmail -L sm-mta -bd -q1h
# Start the MTA; no queue runner
/usr/lib/sendmail -L sm-mta -bd
Restart Sendmail for the change to take effect.
3. On our internal SMTP server, create a separate mqueue directory for mail queued on
our DMZ SMTP server.
4. Create a script on the internal SMTP server to retrieve and process
the queued messages. I will call the script retrieve_DMZ_mail and place it in
the /etc/mail directory.
# If $REMOTE_MQUEUE_DIR is not
empty, create an archive of the messages
$SSH $DMZ_SMTP "cd
$REMOTE_MQUEUE_DIR; [ -f * ] && tar cf $$.tar * || exit 1"
# If there are no files in
[ $? -eq 1 ] && exit
# Immediately remove
$REMOTE_MQUEUE_DIR files to prevent another occurrence
# of this script from retrieving and processing the same files
$SSH $DMZ_SMTP "cd
$REMOTE_MQUEUE_DIR; tar tf $$.tar | xargs rm"
# Retrieve remove queued messages
$SCP $DMZ_SMTP:$REMOTE_MQUEUE_DIR/$$.tar .
# Remove remote archive
$SSH $DMZ_SMTP rm
# Extract queued messages locally
tar xf $$.tar
5. Add the above script to the root user's crontab to regularly
retrieve and process queued mail. In this example, I will run the
script every 5 minutes.
# Retrieve queued DMZ mail every
* * * * /etc/mail/retrieve_DMZ_mail > /dev/null 2>&1
6. Add a "persistent queue runner" to your Sendmail startup and shutdown script
for $LOCAL_MQUEUE_DIR. The persistent queue runner will regularly check $LOCAL_MQUEUE_DIR for new messages to process.
Run the following command to start the persistent queue
runner immediately, and add the command to your Sendmail
startup/shutdown script (/etc/init.d/sendmail):
Back to brandonhutchinson.com.
Last modified: 12/13/2005