mail from: field question

Thu Jan 10 07:32:23 PST 2008

--On Thursday, January 10, 2008 13:22:47 +0000 Jim Bow <jimbow at darq.net> wrote:

> Mike Bristow wrote:
>> On Thu, Jan 10, 2008 at 10:46:30AM +0000, Jim Bow wrote:
>>> If I run the script (or just send a mail) on the command line using sudo,
>>> then it's sent as me and not root. Same happens if I su to root first.
>>
>> use 'su -'.  It means you get a login shell (which sets up the enviroment
>> in the same way that login does).
>
> That makes perfect sense, but doesn't seem to work. Here's the output of my
> terminal session:
>
> host% whoami
> jim
> host% sudo su - (tried doing "su -" also, with same results)
> Password:
> host# whoami
> root
> host# env
> USER=root
> HOME=/root
> SHELL=/bin/csh
> PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/games:/usr/local/sbin:/usr/local/bin:
> /usr/X11R6/bin:/root/bin
> MAIL=/var/mail/root
> BLOCKSIZE=K
> FTP_PASSIVE_MODE=YES
> TERM=screen
> HOSTTYPE=FreeBSD
> VENDOR=intel
> OSTYPE=FreeBSD
> MACHTYPE=i386
> SHLVL=1
> PWD=/root
> LOGNAME=root
> GROUP=wheel
> HOST=host.example.com
> EDITOR=vi
> PAGER=more
> host# cat /etc/motd  | mail -s "hello" test at example.com
>
> This results in the mail from: header of jim at host.example.com. I've tried
> this on two different hosts with the same result.
>
> The actual thing Im trying to do is to email something from a script that
> runs as root from devd, but I run into the same problem of the email arriving
> from somebody other than root, hence trying this manually on the command line.
>
> There is definitely something that I am overlooking, but what is it? I'm
> extremely curious to work-out why I'm seeing such behavior as its defeating
> all my expectations so far.
>
> Thanks for reading.
>
I'm not sure what, but something is wrong.  I did the exact same thing you did, 
but the results are completely different.

root at utd59514# env
HOST=utd59514.utdallas.edu
TERM=xterm
SHELL=/bin/csh
GROUP=wheel
USER=root
HOSTTYPE=FreeBSD
PAGER=more
FTP_PASSIVE_MODE=YES
MAIL=/var/mail/root
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/games:/usr/local/sbin:/usr/local/bin:/usr/X11R6/bin:/root/bin
BLOCKSIZE=K
PWD=/usr/ports/dns/noip
EDITOR=vi
PS1=\u@\h#
SHLVL=2
HOME=/root
OSTYPE=FreeBSD
VENDOR=intel
LOGNAME=root
MACHTYPE=i386
_=/usr/bin/env
OLDPWD=/usr/ports
root at utd59514# cat /etc/motd | mail -s "hello" pauls at utdallas.edu
root at utd59514# tail /var/log/maillog
Jan 10 03:44:29 utd59514 postfix/qmgr[816]: 6EDD1261839: 
from=<root at utd59514.utdallas.edu>, size=13491, nrcpt=1 (queue active)
Jan 10 03:44:29 utd59514 postfix/smtp[37291]: 6D39E261838: 
to=<pauls at utdallas.edu>, orig_to=<root>, 
relay=smtp.utdallas.edu[129.110.10.33]:25, delay=0.16, 
delays=0.01/0.06/0.05/0.04, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 
855C65AEAC)
Jan 10 03:44:29 utd59514 postfix/qmgr[816]: 6D39E261838: removed
Jan 10 03:44:29 utd59514 postfix/smtp[37292]: 6EDD1261839: 
to=<pauls at utdallas.edu>, orig_to=<root>, 
relay=smtp.utdallas.edu[129.110.10.33]:25, delay=0.17, delays=0/0.06/0.05/0.06, 
dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 853C95AEA9)
Jan 10 03:44:29 utd59514 postfix/qmgr[816]: 6EDD1261839: removed
Jan 10 09:28:00 utd59514 postfix/pickup[37968]: 3A037261834: uid=0 from=<root>
Jan 10 09:28:00 utd59514 postfix/cleanup[38056]: 3A037261834: 
message-id=<20080110152800.3A037261834 at utd59514.utdallas.edu>
Jan 10 09:28:00 utd59514 postfix/qmgr[816]: 3A037261834: 
from=<root at utd59514.utdallas.edu>, size=641, nrcpt=1 (queue active)
Jan 10 09:28:00 utd59514 postfix/smtp[38058]: 3A037261834: 
to=<pauls at utdallas.edu>, relay=smtp.utdallas.edu[129.110.10.33]:25, delay=0.07, 
delays=0.02/0.01/0.01/0.04, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 
3E1575ADDD)
Jan 10 09:28:00 utd59514 postfix/qmgr[816]: 3A037261834: removed
root at utd59514# whoami
root

And the message received was sent by root.

Received: from smtp2.utdallas.edu ([129.110.10.33]) by 
UTDEVS08.campus.ad.utdallas.edu with Microsoft SMTPSVC(6.0.3790.3959);
	 Thu, 10 Jan 2008 09:29:03 -0600
Received: from utd59514.utdallas.edu (utd59514.utdallas.edu [129.110.3.28])
	by smtp2.utdallas.edu (Postfix) with ESMTP id 3E1575ADDD
	for <pauls at utdallas.edu>; Thu, 10 Jan 2008 09:28:00 -0600 (CST)
Received: by utd59514.utdallas.edu (Postfix, from userid 0)
	id 3A037261834; Thu, 10 Jan 2008 09:28:00 -0600 (CST)
To: pauls at utdallas.edu
Subject: hello
Message-Id: <20080110152800.3A037261834 at utd59514.utdallas.edu>
Date: Thu, 10 Jan 2008 09:28:00 -0600 (CST)
From: root+utd59514 at utdallas.edu (Charlie Root)
Return-Path: root+utd59514 at utdallas.edu
X-OriginalArrivalTime: 10 Jan 2008 15:29:03.0486 (UTC) 
FILETIME=[87E371E0:01C8539D]

FreeBSD 6.2-RELEASE-p9 (GENERIC) #2: Wed Dec  5 16:16:36 CST 2007

  (1) Unauthorized use is prohibited;

  (2) Usage may be subject to security testing and monitoring;

  (3) Misuse is subject to criminal prosecution; and

  (4) No expectation of privacy except as otherwise provided by applicable 
privacy laws.

-- 
Paul Schmehl (pauls at utdallas.edu)
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/