# kill -HUP `head -1 /var/run/sendmail.pid`

$ printf "Subject: Hello\r\n\r\nI say hello"| sendmail -v -F 'Contact' someone@foo.com

# sendmail -bs -Am

# sendmail -bs -Am
220 your.host.domain ESMTP mailer ready at Wed, 26 Oct 2022 19:02:10 -0700
ehlo your.host.domain
250-your.host.domain Hello root@localhost, pleased to meet you
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-SIZE 52428800
250-STARTTLS
250-DELIVERBY
250 HELP
quit
221 2.0.0 your.host.domain closing connection

# sendmail -bs -Am
220 test.host.domain ESMTP mailer ready at Wed, 26 Oct 2022 19:13:41 -0700
ehlo localhost
250-test.host.domain Hello root@localhost, pleased to meet you
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-SIZE 52428800
250-STARTTLS
250-DELIVERBY
250 HELP
quit
221 2.0.0 test.host.domain closing connection

# grep 'Oct 26 19:13:41' /var/log/maillog | grep 'allowed mech' 
Oct 26 19:13:41 test sendmail[14440]: AUTH: available mech=GSSAPI, allowed mech=LOGIN PLAIN

# sendmail -bs -L sm-smmsp-queue -Ac
220 test.host.domain ESMTP Sendmail 8.14.4/8.14.4/Submit; Wed, 26 Oct 2022 19:59:22 -0700
ehlo localhost
250-test.host.domain Hello root@localhost, pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE
250-DSN
250-AUTH GSSAPI
250-DELIVERBY
250 HELP
quit
221 2.0.0 test.host.domain closing connection

# grep 'Oct 26 19:59:22' /var/log/maillog

# sendmail -bs -OLogLevel=13 -L sm-smmsp-queue -Ac
220 test.host.domain ESMTP Sendmail 8.14.4/8.14.4/Submit; Wed, 26 Oct 2022 19:59:59 -0700
ehlo localhost
250-test.host.domain Hello root@localhost, pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE
250-DSN
250-AUTH GSSAPI
250-DELIVERBY
250 HELP
quit
221 2.0.0 test.host.domain closing connection

# grep 'Oct 26 19:59:59' /var/log/maillog
Oct 26 19:59:59 test sm-smmsp-queue[23675]: NOQUEUE: connect from root@localhost
Oct 26 19:59:59 test sm-smmsp-queue[23675]: STARTTLS: ServerCertFile missing
Oct 26 19:59:59 test sm-smmsp-queue[23675]: AUTH: available mech=ANONYMOUS GSSAPI PLAIN LOGIN, allowed mech=EXTERNAL GSSAPI KERBEROS_V4 DIGEST-MD5 CRAM-MD5
Oct 26 19:59:59 test sm-smmsp-queue[23675]: 29R0xxvL023675: Milter: no active filter

# cd /etc/mail

# make --dry-run
# make -n 

-bt    Run in address test mode.  This mode reads addresses and shows
       the steps in parsing; it is used for debugging configuration
       tables.

+--------------------+-------------------------------------------------------+
| Command            | Usage                                                 |
+--------------------+-------------------------------------------------------+
| <ruleset address>  | Process the address through the comma-separated lists |
|                    | of rulesets.                                          |
+--------------------+-------------------------------------------------------+
| =S <ruleset>       | Display the contents of the rulesets                  |
+--------------------+-------------------------------------------------------+
| =M                 | Display all of the mailer definitions.                |
+--------------------+-------------------------------------------------------+
| $ <v>              | Display the value of macro <v>.                       |
+--------------------+-------------------------------------------------------+
| $= <c>             | Display the value of class <c>.                       |  
+--------------------+-------------------------------------------------------+
| .D <vvalue>        | Set the macro <v> to <value>.                         |
+--------------------+-------------------------------------------------------+
| .C <cvalue>        | Add <value> to class <c>.                             |  
+--------------------+-------------------------------------------------------+
| -d <value>         | Set the debug value to <value>.                       | 
+--------------------+-------------------------------------------------------+
| /tryflags <flags>  | Set the flags used for address processing by /try     |
+--------------------+-------------------------------------------------------+
| /try <mailer> <ad- | Process the address for the <mailer>.                 |
| dress>             |                                                       |
+--------------------+-------------------------------------------------------+
| /parse <address>   | Return the mailer/host/user delivery triple for       |
|                    | the address.                                          |  
+--------------------+-------------------------------------------------------+
| /canon <hostname>  | Canonify <hostname>.                                  |
+--------------------+-------------------------------------------------------+
| /mx <hostname>     | Lookup the MX records for <hostname>.                 |
+--------------------+-------------------------------------------------------+
| /map <mapname>     | Look up <key> in the database identify by <mapname>.  |
+--------------------+-------------------------------------------------------+
| /quit              | Exit address test mode.                               |
+--------------------+-------------------------------------------------------+

# cat > special-test
               /parse tyler@science.foo.edu
               /parse sara@crab
               /parse craig
               CTRL-D
# sendmail -bt < special-test | grep '^mailer'
mailer relay, host smtp.wrotethebook.com, user tyler@science.foo.edu
mailer relay, host smtp.wrotethebook.com, user sara@crab.wrotethebook.com
mailer local, user craig

# sendmail -bv dusko -C/etc/mail/sendmail.cf
-C/etc/mail/sendmail.cf... User unknown
dusko... deliverable: mailer local, user dusko

# sendmail -bv dusko@some.domain -C/etc/mail/sendmail.cf
-C/etc/mail/sendmail.cf... User unknown
dusko@some.domain... deliverable: mailer local, user dusko

# sendmail -bv duskop@some.domain -C/etc/mail/sendmail.cf
-C/etc/mail/sendmail.cf... User unknown
duskop@some.domain ... deliverable: mailer esmtp, host mail.some.domain., user duskop@mail.some.comain

# sendmail -bv dusko_pijetlovic@yahoo.ca -C/etc/mail/sendmail.cf
-C/etc/mail/sendmail.cf... User unknown
dusko_pijetlovic@yahoo.ca... deliverable: mailer esmtp, host yahoo.ca., user dusko_pijetlovic@yahoo.ca

# sendmail -bt
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>
> $=R
> /quit

# service sendmail status
sendmail (pid  538) is running...
sm-client (pid  547) is running...

# ps aux | grep -v grep | grep 538 
root       538  0.0  0.0  88884  3580 ?        Ss   Oct24   0:24 sendmail: accepting connections

# ps aux | grep -v grep | grep 547 
smmsp      547  0.0  0.0  78260  2116 ?        Ss   Oct24   0:00 sendmail: Queue runner@00:05:00 for /var/spool/clientmqueue

# cat /var/run/sendmail.pid 
538
/usr/sbin/sendmail -bd -q5m

# grep -r sendmail /etc/rc* | grep '\-bd'
/etc/rc.d/init.d/sendmail:    daemon /usr/sbin/sendmail $([ "x$DAEMON" = xyes ] && echo -bd) \

# grep -r sendmail /etc/init* | grep '\-bd'
/etc/init.d/sendmail:    daemon /usr/sbin/sendmail $([ "x$DAEMON" = xyes ] && echo -bd) \

# grep -r sendmail /etc/rc* | grep Ac
/etc/rc.d/init.d/sendmail:      daemon --check sm-client /usr/sbin/sendmail -L sm-msp-queue -Ac \

# grep -r sendmail /etc/init* | grep Ac
/etc/init.d/sendmail:   daemon --check sm-client /usr/sbin/sendmail -L sm-msp-queue -Ac \

$ grep MASQUERADE_AS /etc/mail/freebsd.submit.mc
MASQUERADE_AS(`mydomain.to.masqueradeas')dnl

$ hostname
fbsd1.mydomain.to.masqueradeas

$ su

# sendmail -bt -Ac
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>

> $M
mydomain.to.masqueradeas
 
> $w
fbsd1
 
> $j
fbsd1.mydomain.to.masqueradeas

> /quit

# sendmail -bt
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>

> $M
Undefined

> $w
fbsd1
 
> $j
fbsd1.mydomain.to.masqueradeas

> /quit

# sendmail -bt -Ac
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>
 
> /tryflags HS
> /try esmtp dusko
Trying header sender address dusko for mailer esmtp
canonify           input: dusko
Canonify2          input: dusko
Canonify2        returns: dusko
canonify         returns: dusko
1                  input: dusko
1                returns: dusko
HdrFromSMTP        input: dusko
PseudoToReal       input: dusko
PseudoToReal     returns: dusko
MasqSMTP           input: dusko
MasqSMTP         returns: dusko < @ *LOCAL* >
MasqHdr            input: dusko < @ *LOCAL* >
MasqHdr          returns: dusko < @ mydomain . to . masqueradeas . >
HdrFromSMTP      returns: dusko < @ mydomain . to . masqueradeas . >
final              input: dusko < @ mydomain . to . masqueradeas . >
final            returns: dusko @ mydomain . to . masqueradeas
Rcode = 0, addr = dusko@mydomain.to.masqueradeas
 
> /quit

# sendmail -bt
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>
 
> /tryflags HS
> /try esmtp dusko
Trying header sender address dusko for mailer esmtp
canonify           input: dusko
Canonify2          input: dusko
Canonify2        returns: dusko
canonify         returns: dusko
1                  input: dusko
1                returns: dusko
HdrFromSMTP        input: dusko
PseudoToReal       input: dusko
PseudoToReal     returns: dusko
MasqSMTP           input: dusko
MasqSMTP         returns: dusko < @ *LOCAL* >
MasqHdr            input: dusko < @ *LOCAL* >
MasqHdr          returns: dusko < @ fbsd1 . mydomain . to . masqueradeas . >
HdrFromSMTP      returns: dusko < @ fbsd1 . mydomain . to . masqueradeas . >
final              input: dusko < @ fbsd1 . mydomain . to . masqueradeas . >
final            returns: dusko @ fbsd1 . mydomain . to . masqueradeas
Rcode = 0, addr = dusko@fbsd1.mydomain.to.masqueradeas
 
> /quit

# sendmail -bt
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>
 
> $=w
localhost
fbsd1.your.local.domain
[127.0.0.1]
[123.45.67.8]
localhost.my.domain
[localhost.my.domain]

> $=m
your.local.domain

> $=M

> $={VirtHost}
 
> $=R

> $=N

> $=E
root

> /quit

# sendmail -bt
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>
 
> /tryflags ES
> /try esmtp dusko@mydomain.to.masqueradeas
Trying envelope sender address dusko@mydomain.to.masqueradeas for mailer esmtp
canonify           input: dusko @ mydomain . to . masqueradeas
Canonify2          input: dusko < @ mydomain . to . masqueradeas >
Canonify2        returns: dusko < @ mydomain . to . masqueradeas . >
canonify         returns: dusko < @ mydomain . to . masqueradeas . >
1                  input: dusko < @ mydomain . to . masqueradeas . >
1                returns: dusko < @ mydomain . to . masqueradeas . >
EnvFromSMTP        input: dusko < @ mydomain . to . masqueradeas . >
PseudoToReal       input: dusko < @ mydomain . to . masqueradeas . >
PseudoToReal     returns: dusko < @ mydomain . to . masqueradeas . >
MasqSMTP           input: dusko < @ mydomain . to . masqueradeas . >
MasqSMTP         returns: dusko < @ mydomain . to . masqueradeas . >
MasqEnv            input: dusko < @ mydomain . to . masqueradeas . >
MasqHdr            input: dusko < @ mydomain . to . masqueradeas . >
MasqHdr          returns: dusko < @ mydomain . to . masqueradeas . >
MasqEnv          returns: dusko < @ mydomain . to . masqueradeas . >
EnvFromSMTP      returns: dusko < @ mydomain . to . masqueradeas . >
final              input: dusko < @ mydomain . to . masqueradeas . >
final            returns: dusko @ mydomain . to . masqueradeas . >
Rcode = 0, addr = dusko@mydomain.to.masqueradeas
 
> /quit

# sendmail -bt
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>

> check_mail dusko@some.ext.domain
check_mail         input: dusko @ some . ext . domain
Basic_check_mail   input: dusko @ some . ext . domain
tls_client         input: $| MAIL
D                  input: < > < ? > < ! "TLS_Clt" > < >
D                returns: < ? > < > < ? > < ! "TLS_Clt" > < >
A                  input: < > < ? > < ! "TLS_Clt" > < >
A                returns: < > < ? > < ! "TLS_Clt" > < >
TLS_connection     input: $| < > < ? > < ! "TLS_Clt" > < >
TLS_connection   returns: OK
tls_client       returns: OK
CanonAddr          input: < dusko @ some . ext . domain >
canonify           input: < dusko @ some . ext . domain >
Canonify2          input: dusko < @ some . ext . domain >
Canonify2        returns: dusko < @ some . ext . domain . >
canonify         returns: dusko < @ some . ext . domain . >
Parse0             input: dusko < @ some . ext . domain . >
Parse0           returns: dusko < @ some . ext . domain . >
CanonAddr        returns: dusko < @ some . ext . domain . >
SearchList         input: < + From > $| < F : dusko @ some . ext . domain > < U : dusko @ > < D : some . ext . domain > < >
F                  input: < dusko @ some . ext . domain > < ? > < + From > < >
F                returns: < ? > < >
SearchList         input: < + From > $| < U : dusko @ > < D : some . ext . domain > < >
U                  input: < dusko @ > < ? > < + From > < >
U                returns: < ? > < >
SearchList         input: < + From > $| < D : some . ext . domain > < >
D                  input: < some . ext . domain > < ? > < + From > < >
D                  input: < ext . domain > < ? > < + From > < >
D                  input: < domain > < ? > < + From > < >
D                returns: < ? > < >
D                returns: < ? > < >
D                returns: < ? > < >
SearchList       returns: < ? >
SearchList       returns: < ? >
SearchList       returns: < ? >
Basic_check_mail returns: @ dusko < @ some . ext . domain >
check_mail       returns: @ dusko < @ some . ext . domain >

> check_relay dusko@some.external.domain
check_relay        input: dusko @ some . external . domain
check_relay      returns: dusko @ some . external . domain $| dusko @ some . external . domain

> .D{client_addr}192.168.111.68

> Basic_check_relay <>
Basic_check_rela   input: < >
Basic_check_rela returns: < >
 
> /quit

# sendmail -bt -Ac
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>
 
> check_mail dusko@some.ext.domain
check_mail         input: dusko @ some . ext . domain
Basic_check_mail   input: dusko @ some . ext . domain
tls_client         input: $| MAIL
TLS_connection     input:
TLS_connection   returns:
tls_client       returns:
CanonAddr          input: < dusko @ some . ext . domain >
canonify           input: < dusko @ some . ext . domain >
Canonify2          input: dusko < @ some . ext . domain >
Canonify2        returns: dusko < @ some . ext . domain . >
canonify         returns: dusko < @ some . ext . domain . >
Parse0             input: dusko < @ some . ext . domain . >
Parse0           returns: dusko < @ some . ext . domain . >
CanonAddr        returns: dusko < @ some . ext . domain . >
Basic_check_mail returns: @ dusko < @ some . ext . domain >
check_mail       returns: @ dusko < @ some . ext . domain >
 
> check_relay dusko@some.ext.domain
check_relay        input: dusko @ some . ext . domain
check_relay      returns: dusko @ some . ext . domain $| dusko @ some . ext . domain

> .D{client_addr}192.168.111.68     

> Basic_check_relay <>
Basic_check_rela   input: < >
Basic_check_rela returns: < >
 
> /quit

# sendmail -bt
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>
 
> Local_check_mail dusko
Local_check_mail   input: dusko
Local_check_mail returns: dusko
 
> Local_check_mail dusko@some.ext.domain
Local_check_mail   input: dusko @ some . ext . domain
Local_check_mail returns: dusko @ some . ext . domain
 
> Local_check_mail dusko_pijetlovic@yahoo.ca
Local_check_mail   input: dusko_pijetlovic @ yahoo . ca
Local_check_mail returns: dusko_pijetlovic @ yahoo . ca

> /quit

$ ps $$
  PID TT  STAT    TIME COMMAND
11825  2  Ss   0:00.09 -tcsh (tcsh)
 
$ printf %s\\n "$SHELL"
/bin/tcsh

$ su
Password:
# 

# command -v bash; type bash; whereis bash; which bash
/usr/local/bin/bash
bash is /usr/local/bin/bash
bash: /usr/local/bin/bash /usr/local/man/man1/bash.1.gz /usr/ports/shells/bash
/usr/local/bin/bash

# pkg info --regex bash
bash-5.2.2_1

# cat /etc/shells
# $FreeBSD$
#
# List of acceptable shells for chpass(1).
# Ftpd will not allow users to connect who are not using
# one of these shells.

/bin/sh
/bin/csh
/bin/tcsh
/usr/local/bin/bash
/usr/local/bin/rbash
/usr/local/libexec/git-core/git-shell
/usr/local/bin/ksh93

# bash
# 

# ps $$
  PID TT  STAT    TIME COMMAND
13555  2  S    0:00.01 bash

# echo -n "${EMAIL_CONTENT:6:-3}" | sendmail -Am -d60.5 -v dusko@some.ext.domain
map_lookup(dequote, dusko, %0=dusko) => NOT FOUND (0), ad=0
map_lookup(host, some.ext.domain, %0=some.ext.domain) => some.ext.domain. (0), ad=0
dusko@some.ext.domain... Connecting to esva.mail-relay.your.isp. via esmtp...
220 srv01.mail-relay.your.isp ESMTP
>>> EHLO fbsd1.home.arpa
250-srv01.mail-relay.your.isp 
250-8BITMIME
250-SIZE 52428800
250 STARTTLS
>>> STARTTLS
220 Go ahead with TLS
map_lookup(macro, {TLS_Name}, %0={TLS_Name}, %1=esva.mail-relay.your.isp) =>  (0), ad=0
>>> EHLO fbsd1.home.arpa
250-srv01.mail-relay.your.isp 
250-8BITMIME
250 SIZE 52428800
>>> MAIL From:<dusko@fbsd1.home.arpa>
250 sender <dusko@fbsd1.home.arpa> ok
map_lookup(macro, {TLS_Name}, %0={TLS_Name}, %1=esva.mail-relay.your.isp) =>  (0), ad=0
map_lookup(host, some.ext.domain, %0=some.ext.domain) => some.ext.domain. (0), ad=0
>>> RCPT To:<dusko@some.ext.domain>
250 recipient <dusko@some.ext.domain> ok
>>> DATA
354 go ahead
>>> .
250 ok:  Message 7580284 accepted
dusko@some.ext.domain... Sent (ok:  Message 7580284 accepted)
Closing connection to esva.mail-relay.your.isp.
>>> QUIT
221 srv01.mail-relay.your.isp

# echo -n "${EMAIL_CONTENT:6:-3}" | sendmail -Ac -d60.5 -v dusko@some.ext.domain
map_lookup(dequote, dusko, %0=dusko) => NOT FOUND (0), ad=0
map_lookup(host, some.ext.domain, %0=some.ext.domain) => some.ext.domain. (0), ad=0
dusko@some.ext.domain... Connecting to [127.0.0.1] port 1465 via smartrelay...
220 your.isp.net ESMTP mailer ready at Sat, 28 Jan 2023 21:15:03 -0800
>>> EHLO fbsd1.home.arpa
250-your.isp.net Hello fbsd1.home.arpa [123.45.67.89], pleased to meet you
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-SIZE 52428800
250-AUTH LOGIN PLAIN
250-DELIVERBY
250 HELP
map_lookup(authinfo, AuthInfo:[127.0.0.1], %0=AuthInfo:[127.0.0.1]) => "U:smmsp" "I:dusko"  "P:YourSmartHostPwd" "M:LOGIN" (0), ad=0
>>> AUTH LOGIN
334 VXNlcm5hbWU6
>>> ABCab12=
334 UGFzc3dvcmQ6
>>> ABCdEF12gHIJkLMnoPQRSt==
235 2.0.0 OK Authenticated
>>> MAIL From:<dusko@fbsd1.home.arpa> AUTH=dusko@fbsd1.home.arpa
250 2.1.0 <dusko@fbsd1.home.arpa>... Sender ok
>>> RCPT To:<dusko@some.ext.domain>
250 2.1.5 <dusko@some.ext.domain>... Recipient ok
>>> DATA
354 Enter mail, end with "." on a line by itself
>>> .
250 2.0.0 30T5F3AO022530 Message accepted for delivery
dusko@some.ext.domain... Sent (30T5F3AO022530 Message accepted for delivery)
Closing connection to [127.0.0.1]
>>> QUIT
221 2.0.0 your.isp.net closing connection

# exit

# exit
$ 

# find /etc -iname '*sasl*'
/etc/selinux/targeted/modules/active/modules/sasl.pp
/etc/sysconfig/saslauthd
/etc/rc.d/rc2.d/S65saslauthd
/etc/rc.d/rc1.d/K10saslauthd
/etc/rc.d/rc6.d/K10saslauthd
/etc/rc.d/rc4.d/S65saslauthd
/etc/rc.d/rc5.d/S65saslauthd
/etc/rc.d/rc3.d/S65saslauthd
/etc/rc.d/rc0.d/K10saslauthd
/etc/rc.d/init.d/saslauthd
/etc/sasl2

# ls -lh /etc/sasl2
total 4.0K
-rw-r--r-- 1 root root 49 Sep 25  2016 Sendmail.conf

# ls -lh /etc/sasl2/Sendmail.conf 
-rw-r--r-- 1 root root 49 Sep 25  2016 /etc/sasl2/Sendmail.conf

# cat /etc/sasl2/Sendmail.conf 
pwcheck_method:saslauthd
#mech_list: login plain

# sendmail -Am -v -t
To: dusko@example.com
From: dusko@example.dom
Subject: Test

Please ignore.

# grep AuthMechanisms /etc/mail/sendmail.cf
O AuthMechanisms=LOGIN PLAIN

# grep TrustAuthMech /etc/mail/sendmail.cf
C{TrustAuthMech}LOGIN PLAIN
R$* $| $={TrustAuthMech}        $# RELAY

# grep DaemonPortOptions /etc/mail/sendmail.cf
O DaemonPortOptions=Name=MTA, M=A
O DaemonPortOptions=Port=465, Name=MTASSL, M=s a
O DaemonPortOptions=Port=587, Name=MSA, M=a
O DaemonPortOptions=Addr=127.0.0.1, Port=10026

# grep -r Srv_Features /etc/mail/sendmail.cf
R$*             $: $>D <$&{client_name}> <?> <! "Srv_Features"> <>
R<?>$*          $: $>A <$&{client_addr}> <?> <! "Srv_Features"> <>
R<?>$*          $: <$(access "Srv_Features": $: ? $)>

# grep -r Try_TLS /etc/mail/sendmail.cf
R$*             $: $>D <$&{server_name}> <?> <! "Try_TLS"> <>
R<?>$*          $: $>A <$&{server_addr}> <?> <! "Try_TLS"> <>
R<?>$*          $: <$(access "Try_TLS": $: ? $)>

# grep QueueDirectory /etc/mail/sendmail.cf
O QueueDirectory=/var/spool/mqueue

# sendmail -bt 
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>
 
> /mx sendmail.org
getmxrr(sendmail.org) returns 1 value(s):
        mc.sendmail.org.
 
> /mx yahoo.com
getmxrr(yahoo.com) returns 3 value(s):
        mta5.am0.yahoodns.net.
        mta7.am0.yahoodns.net.
        mta6.am0.yahoodns.net.

> /mx aol.com
getmxrr(aol.com) returns 1 value(s):
        mx-aol.mail.gm0.yahoodns.net.

> /mx gmail.com
getmxrr(gmail.com) returns 5 value(s):
        gmail-smtp-in.l.google.com.
        alt1.gmail-smtp-in.l.google.com.
        alt2.gmail-smtp-in.l.google.com.
        alt3.gmail-smtp-in.l.google.com.
        alt4.gmail-smtp-in.l.google.com.

> /mx some_domain.com 
getmxrr(duskopijetlovic.com) returns 2 value(s):
        aspmx1.somemx.com.
        aspmx2.somemx.com.

> /quit

# grep '^M' /etc/mail/sendmail.cf | awk '{ print $1 $3 }'
Msmtp,F=mDFMuX,
Mesmtp,F=mDFMuXa,
Msmtp8,F=mDFMuX8,
Mdsmtp,F=mDFMuXa%,
Mrelay,F=mDFMuXa8,
Mlocal,F=lsDFMAw5:/|@qSPfhn9,
Mprog,F=lsDFMoqeu9,
Mprocmail,F=DFMSPhnu9,

# grep '^Mprog' /etc/mail/sendmail.cf
Mprog,          P=/usr/sbin/smrsh, F=lsDFMoqeu9, S=EnvFromL/HdrFromL, R=EnvToL/HdrToL, D=$z:/,

# strings /usr/sbin/smrsh | grep '^/'
/lib64/ld-linux-x86-64.so.2
/wTH
/w&H
/etc/smrsh
/bin:/usr/bin
/bin/sh

# grep '^DZ' /etc/mail/sendmail.cf
DZ8.14.4

# grep '^T' /etc/mail/sendmail.cf
Troot
Tdaemon

# grep -v \# /etc/mail/sendmail.cf | grep "/[^0-9].*/"
Fw/etc/mail/local-host-names
FR-o /etc/mail/relay-domains
Kaccess hash -T<TMPF> /etc/mail/access
Kaccess hash -o -T<TMPF> /etc/mail/access
Kmailertable hash -o /etc/mail/mailertable
Kvirtuser hash -o /etc/mail/virtusertable
O AliasFile=/etc/aliases
O HelpFile=/etc/mail/helpfile
O ForwardPath=$z/.forward.$w:$z/.forward
O QueueDirectory=/var/spool/mqueue
O CACertPath=/etc/mail/certs/alpha
O CACertFile=/etc/mail/certs/alpha/alphaintercert.crt
O ServerCertFile=/etc/mail/certs/alpha/my.domain.crt
O ServerKeyFile=/etc/mail/certs/alpha/my.domain.key
O ClientCertFile=/etc/mail/certs/alpha/my.domain.crt
O ClientKeyFile=/etc/mail/certs/alpha/my.domain.key
Ft-o /etc/mail/trusted-users
             T=DNS/RFC822/SMTP,
             T=DNS/RFC822/SMTP,
             T=DNS/RFC822/SMTP,
             T=DNS/RFC822/SMTP,
             T=DNS/RFC822/SMTP,
Mlocal,      P=/usr/bin/procmail, F=lsDFMAw5:/|@qSPfhn9, S=EnvFromL/HdrFromL, R=EnvToL/HdrToL,
             T=DNS/RFC822/X-Unix,
Mprog,       P=/usr/sbin/smrsh, F=lsDFMoqeu9, S=EnvFromL/HdrFromL, R=EnvToL/HdrToL, D=$z:/,
                T=X-Unix/X-Unix/X-Unix,
Mprocmail,   P=/usr/bin/procmail, F=DFMSPhnu9, S=EnvFromSMTP/HdrFromSMTP, R=EnvToSMTP/HdrFromSMTP,
             T=DNS/RFC822/X-Unix,

# grep -v \# /etc/mail/sendmail.cf | grep '^M'
Msmtp,       P=[IPC], F=mDFMuX, S=EnvFromSMTP/HdrFromSMTP, R=EnvToSMTP, E=\r\n, L=990,
Mesmtp,      P=[IPC], F=mDFMuXa, S=EnvFromSMTP/HdrFromSMTP, R=EnvToSMTP, E=\r\n, L=990,
Msmtp8,      P=[IPC], F=mDFMuX8, S=EnvFromSMTP/HdrFromSMTP, R=EnvToSMTP, E=\r\n, L=990,
Mdsmtp,      P=[IPC], F=mDFMuXa%, S=EnvFromSMTP/HdrFromSMTP, R=EnvToSMTP, E=\r\n, L=990,
Mrelay,      P=[IPC], F=mDFMuXa8, S=EnvFromSMTP/HdrFromSMTP, R=MasqSMTP, E=\r\n, L=2040,
Mlocal,      P=/usr/bin/procmail, F=lsDFMAw5:/|@qSPfhn9, S=EnvFromL/HdrFromL, R=EnvToL/HdrToL,
Mprog,       P=/usr/sbin/smrsh, F=lsDFMoqeu9, S=EnvFromL/HdrFromL, R=EnvToL/HdrToL, D=$z:/,
Mprocmail,   P=/usr/bin/procmail, F=DFMSPhnu9, S=EnvFromSMTP/HdrFromSMTP, R=EnvToSMTP/HdrFromSMTP,

# grep -r sendmail /etc/rc*
/etc/rc.d/init.d/sendmail:# sendmail      This shell script takes care of starting and stopping
/etc/rc.d/init.d/sendmail:#               sendmail.
/etc/rc.d/init.d/sendmail:# processname: sendmail
/etc/rc.d/init.d/sendmail:# config: /etc/mail/sendmail.cf
/etc/rc.d/init.d/sendmail:# pidfile: /var/run/sendmail.pid
/etc/rc.d/init.d/sendmail:# Provides: sendmail MTA smtpdaemon
/etc/rc.d/init.d/sendmail:# Short-Description: start and stop sendmail
/etc/rc.d/init.d/sendmail:# Description: sendmail is a Mail Transport Agent (MTA)
/etc/rc.d/init.d/sendmail:# Source sendmail configureation.
/etc/rc.d/init.d/sendmail:if [ -f /etc/sysconfig/sendmail ]; then
/etc/rc.d/init.d/sendmail:    . /etc/sysconfig/sendmail
/etc/rc.d/init.d/sendmail:[ -x /usr/sbin/sendmail ] || exit 5
/etc/rc.d/init.d/sendmail:prog="sendmail"
/etc/rc.d/init.d/sendmail:    echo -n $"Package sendmail-cf is required to update configuration."
/etc/rc.d/init.d/sendmail:    daemon /usr/sbin/sendmail $([ "x$DAEMON" = xyes ] && echo -bd) \
/etc/rc.d/init.d/sendmail:    [ $RETVAL -eq 0 ] && touch /var/lock/subsys/sendmail
/etc/rc.d/init.d/sendmail:      daemon --check sm-client /usr/sbin/sendmail -L sm-msp-queue -Ac \
/etc/rc.d/init.d/sendmail:    killproc sendmail -HUP
/etc/rc.d/init.d/sendmail:    killproc sendmail
/etc/rc.d/init.d/sendmail:    [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/sendmail
/etc/rc.d/init.d/sendmail:status -p /var/run/sendmail.pid >/dev/null || status -p /var/run/sm-client.pid >/dev/null
/etc/rc.d/init.d/sendmail:      echo -n sendmail; status -p /var/run/sendmail.pid -l sendmail

# grep -r sendmail /etc/init.d/
/etc/init.d/sendmail:# sendmail      This shell script takes care of starting and stopping
/etc/init.d/sendmail:#               sendmail.
/etc/init.d/sendmail:# processname: sendmail
/etc/init.d/sendmail:# config: /etc/mail/sendmail.cf
/etc/init.d/sendmail:# pidfile: /var/run/sendmail.pid
/etc/init.d/sendmail:# Provides: sendmail MTA smtpdaemon
/etc/init.d/sendmail:# Short-Description: start and stop sendmail
/etc/init.d/sendmail:# Description: sendmail is a Mail Transport Agent (MTA)
/etc/init.d/sendmail:# Source sendmail configureation.
/etc/init.d/sendmail:if [ -f /etc/sysconfig/sendmail ]; then
/etc/init.d/sendmail:    . /etc/sysconfig/sendmail
/etc/init.d/sendmail:[ -x /usr/sbin/sendmail ] || exit 5
/etc/init.d/sendmail:prog="sendmail"
/etc/init.d/sendmail:   echo -n $"Package sendmail-cf is required to update configuration."
/etc/init.d/sendmail:    daemon /usr/sbin/sendmail $([ "x$DAEMON" = xyes ] && echo -bd) \
/etc/init.d/sendmail:    [ $RETVAL -eq 0 ] && touch /var/lock/subsys/sendmail
/etc/init.d/sendmail:   daemon --check sm-client /usr/sbin/sendmail -L sm-msp-queue -Ac \
/etc/init.d/sendmail:    killproc sendmail -HUP
/etc/init.d/sendmail:    killproc sendmail
/etc/init.d/sendmail:    [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/sendmail
/etc/init.d/sendmail:status -p /var/run/sendmail.pid >/dev/null || status -p /var/run/sm-client.pid >/dev/null
/etc/init.d/sendmail:   echo -n sendmail; status -p /var/run/sendmail.pid -l sendmail

+----------------------------+
| MESSAGE SUBMISSION PROGRAM |
+----------------------------+
                                        
The purpose of the message submission program (MSP) is explained
in sendmail/SECURITY.  This section contains a list of caveats and
a few hints how for those who want to tweak the default configuration
for it (which is installed as submit.cf).

Notice: do not add options/features to submit.mc unless you are
absolutely sure you need them.  Options you may want to change
include:

- confTRUSTED_USERS, FEATURE(`use_ct_file'), and confCT_FILE for
  avoiding X-Authentication warnings.
- confTIME_ZONE to change it from the default `USE_TZ'.
- confDELIVERY_MODE is set to interactive in msp.m4 instead
  of the default background mode.
- FEATURE(stickyhost) and LOCAL_RELAY to send unqualified addresses
  to the LOCAL_RELAY instead of the default relay.
- confRAND_FILE if you use STARTTLS and sendmail is not compiled with
  the flag HASURANDOM.

[ . . . ]

Some things are not intended to work with the MSP.  These include
features that influence the delivery process (e.g., mailertable,
aliases), or those that are only important for a SMTP server (e.g.,
virtusertable, DaemonPortOptions, multiple queues).  Moreover,
relaxing certain restrictions (RestrictQueueRun, permissions on
queue directory) or adding features (e.g., enabling prog/file mailer)
can cause security problems.

Other things don't work well with the MSP and require tweaking or
workarounds.  For example, to allow for client authentication it
is not just sufficient to provide a client certificate and the
corresponding key, but it is also necessary to make the key group
(smmsp) readable and tell sendmail not to complain about that, i.e.,

        define(`confDONT_BLAME_SENDMAIL', `GroupReadableKeyFile')

If the MSP should actually use AUTH then the necessary data
should be placed in a map as explained in SMTP AUTHENTICATION:

FEATURE(`authinfo', `DATABASE_MAP_TYPE /etc/mail/msp-authinfo')

/etc/mail/msp-authinfo should contain an entry like:

        AuthInfo:127.0.0.1      "U:smmsp" "P:secret" "M:DIGEST-MD5"

The file and the map created by makemap should be owned by smmsp,
its group should be smmsp, and it should have mode 640.  The database
used by the MTA for AUTH must have a corresponding entry.
Additionally the MTA must trust this authentication data so the AUTH=
part will be relayed on to the next hop.  This can be achieved by
adding the following to your sendmail.mc file:

        LOCAL_RULESETS
        SLocal_trust_auth
        R$*     $: $&{auth_authen}
        Rsmmsp  $# OK

[ . . . ]

feature/msp.m4 defines almost all settings for the MSP.  Most of
those should not be changed at all.  Some of the features and options
can be overridden if really necessary.  It is a bit tricky to do
this, because it depends on the actual way the option is defined
in feature/msp.m4.  If it is directly defined (i.e., define()) then
the modified value must be defined after

        FEATURE(`msp')

If it is conditionally defined (i.e., ifdef()) then the desired
value must be defined before the FEATURE line in the .mc file.
To see how the options are defined read feature/msp.m4.

      m   This mailer can send to multiple users on the same
          host in one transaction.  When a $u macro occurs
          in the argv part of the mailer definition, that
          field will be repeated as necessary for all quali-
          fying users.  Removing this flag can defeat dupli-
          cate  suppression on a remote site as each recipi-
          ent is sent in a separate transaction.

      D*  This mailer wants a "Date:" header line.

      F*  This mailer wants a "From:" header line.
 
      u   Upper case should be preserved in user names for
          this mailer.  Standards require preservation of
          case in the local part of addresses, except for
          those address for which your system accepts  re-
          sponsibility.   RFC 2142 provides a long list of
          addresses which should be case insensitive.   If
          you use this flag, you may be violating RFC 2142.
          Note that postmaster is always treated as a case
          insensitive address regardless of this flag.

      X   This mailer wants to use the hidden dot algorithm
          as specified in RFC 821; basically, any line be-
          ginning with a  dot  will have an extra  dot
          prepended (to be stripped at the other end).  This
          insures that lines in the message containing a dot
          will not terminate the message prematurely.
 
      a   Run Extended SMTP  (ESMTP)  protocol (defined in
          RFCs 1869, 1652, and 1870).  This flag defaults on
          if the SMTP greeting message includes the word
          "ESMTP".

      k   Normally when sendmail connects to a host via
          SMTP, it checks to make sure that this isn't acci-
          dentally the same host name as might happen if
          sendmail is misconfigured or if a long-haul net-
          work interface is set in loopback mode.  This flag
          disables the loopback check.  It should only be
          used under very unusual circumstances.

$ ls /usr/local/share/doc/sendmail/
DEVTOOLS        MAIL.LOCAL      PGPKEYS         SECURITY        TRACEFLAGS
KNOWNBUGS       op.ps           README          SENDMAIL        TUNING
LICENSE         op.txt          RELEASE_NOTES   SMRSH

$ man sendmail

. . . 

  SEE ALSO
         mail(1), syslog(3), aliases(5), mailaddr(7), mail.local(8), rc(8),
         rmail(8)
  
         DARPA Internet Request For Comments RFC819, RFC821, RFC822.  Sendmail
         Installation and Operation Guide, No. 8, SMM.

Available features are:

[ . . . ]

require_rdns    Reject mail from connecting SMTP clients without proper
                rDNS (reverse DNS), functional gethostbyaddr() resolution.
                Note: this feature will cause false positives, i.e., there
                are legitimate MTAs that do not have proper DNS entries.
                Rejecting mails from those MTAs is a local policy decision.

[ . . . ]

                EXCEPTIONS:

                Exceptions based on access entries are discussed below.
                Any IP address matched using $=R (the "relay-domains" file)
                is excepted from the rules.  Since we have explicitly
                allowed relaying for this host, based on IP address, we
                ignore the rDNS failure.

[ . . . ] 
                If `delay_checks' is in effect (recommended), then any
                sender who has authenticated is also excepted from the
                restrictions.  This happens because the rules produced by
                this FEATURE() will not be applied to authenticated senders
                (assuming `delay_checks').

                ACCESS MAP ENTRIES:

                Entries such as
                        Connect:1.2.3.4         OK
                        Connect:1.2             RELAY
                will whitelist IP address 1.2.3.4, so that the rDNS
                blocking does apply to that IP address

                Entries such as
                        Connect:1.2.3.4         REJECT
                will have the effect of forcing a temporary failure for
                that address to be treated as a permanent failure.

Delay all checks
----------------

By using FEATURE(`delay_checks') the rulesets check_mail and check_relay
will not be called when a client connects or issues a MAIL command,
respectively.  Instead, those rulesets will be called by the check_rcpt
ruleset; they will be skipped if a sender has been authenticated using
a "trusted" mechanism, i.e., one that is defined via TRUST_AUTH_MECH().
If check_mail returns an error then the RCPT TO command will be rejected
with that error.  If it returns some other result starting with $# then
check_relay will be skipped.  If the sender address (or a part of it) is
listed in the access map and it has a RHS of OK or RELAY, then check_relay
will be skipped.  This has an interesting side effect: if your domain is
my.domain and you have

        my.domain       RELAY

in the access map, then any e-mail with a sender address of
<user@my.domain> will not be rejected by check_relay even though
it would match the hostname or IP address.  This allows spammers
to get around DNS based blacklist by faking the sender address.  To
avoid this problem you have to use tagged entries:

        To:my.domain            RELAY
        Connect:my.domain       RELAY

if you need those entries at all (class {R} may take care of them).

The features ratecontrol and conncontrol allow to establish connection
limits per client IP address or net.  These features can limit the
rate of connections (connections per time unit) or the number of
incoming SMTP connections, respectively.  If enabled, appropriate
rulesets are called at the end of check_relay, i.e., after DNS
blacklists and generic access_db operations.  The features require 
FEATURE(`access_db') to be listed earlier in the mc file.

Note: FEATURE(`delay_checks') delays those connection control checks
after a recipient address has been received, hence making these
connection control features less useful.  To run the checks as early
as possible, specify the parameter `nodelay', e.g.,

        FEATURE(`ratecontrol', `nodelay')

In that case, FEATURE(`delay_checks') has no effect on connection
control (and it must be specified earlier in the mc file).

An optional second argument `terminate' specifies whether the
rulesets should return the error code 421 which will cause
sendmail to terminate the session with that error if it is
returned from check_relay, i.e., not delayed as explained in
the previous paragraph.  Example:

        FEATURE(`ratecontrol', `nodelay', `terminate')

# sendmail -O LogLevel=14 -bs -Am
220 test.host.domain ESMTP mailer ready at Wed, 26 Oct 2022 20:03:40 -0700
HELO test.host.domain
250 test.host.domain Hello root@localhost, pleased to meet you
EHLO test.host.domain
250-test.host.domain Hello root@localhost, pleased to meet you
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-SIZE 52428800
250-STARTTLS
250-DELIVERBY
250 HELP
MAIL From:<dusko@test.host.domain>
250 2.1.0 <dusko@test.host.domain>... Sender ok
RCPT To:<dusko@host.domain.
250 2.1.5 <dusko@host.domain>... Recipient ok
DATA
354 Enter mail, end with "." on a line by itself
From: Dusko <dusko@foobar.com>
To: <dusko@host.domain> Dusko Pijetlovic
Subject: Test

Testing.
.
250 2.0.0 29S4ceAq025509 Message accepted for delivery
QUIT
221 2.0.0 test.host.domain closing connection

>>> AUTH PLAIN dGVzdAB0ZXN0QHdpei5leGFtcGxlLmNvbQB0RXN0NDI=
235 2.0.0 OK Authenticated

test\000test@wiz.example.com\000tEst42

>>> AUTH PLAIN dGVzdAB0ZXN0AHRFc3Q0Mg==

test\000test\000tEst42

>>> AUTH LOGIN
334 VXNlcm5hbWU6
>>> dGVzdEB3aXouZXhhbXBsZS5jb20=
334 UGFzc3dvcmQ6
>>> dEVzdDQy
235 2.0.0 OK Authenticated

test
tEst42

# man -k sasl
pluginviewer         (8)  - list loadable SASL plugins and their properties
saslauthd            (8)  - sasl authentication server
saslauthd_selinux    (8)  - Security Enhanced Linux Policy for the saslauthd processes
sasldblistusers2     (8)  - list users in sasldb
saslpasswd2          (8)  - set a user's sasl password
testsaslauthd        (8)  - test utility for the SASL authentication server

# pluginviewer -a
Installed auxprop mechanisms are:
sasldb
List of auxprop plugins follows
Plugin "sasldb" ,       API version: 4
        supports store: yes

# pluginviewer -s
Installed SASL (server side) mechanisms are:
ANONYMOUS GSSAPI PLAIN LOGIN EXTERNAL
List of server plugins follows
Plugin "anonymous" [loaded],    API version: 4
        SASL mechanism: ANONYMOUS, best SSF: 0, supports setpass: no
        security flags: NO_PLAINTEXT
        features: WANT_CLIENT_FIRST
Plugin "gssapiv2" [loaded],     API version: 4
        SASL mechanism: GSSAPI, best SSF: 56, supports setpass: no
        security flags: NO_ANONYMOUS|NO_PLAINTEXT|NO_ACTIVE|PASS_CREDENTIALS|MUTUAL_AUTH
        features: WANT_CLIENT_FIRST|PROXY_AUTHENTICATION
Plugin "plain" [loaded],        API version: 4
        SASL mechanism: PLAIN, best SSF: 0, supports setpass: no
        security flags: NO_ANONYMOUS
        features: WANT_CLIENT_FIRST|PROXY_AUTHENTICATION
Plugin "login" [loaded],        API version: 4
        SASL mechanism: LOGIN, best SSF: 0, supports setpass: no
        security flags: NO_ANONYMOUS
        features:

# pluginviewer -c
Installed SASL (client side) mechanisms are:
ANONYMOUS GSSAPI PLAIN LOGIN EXTERNAL
List of client plugins follows
[ . . . ]

# ls -ld /usr/lib64/sasl2/
drwxr-xr-x. 2 root root 4096 May 17  2015 /usr/lib64/sasl2/

# ls -lh /usr/lib64/sasl2/
total 116K
lrwxrwxrwx 1 root root  22 May 17  2015 libanonymous.so -> libanonymous.so.2.0.23
lrwxrwxrwx 1 root root  22 May 17  2015 libanonymous.so.2 -> libanonymous.so.2.0.23
-rwxr-xr-x 1 root root 19K Feb 27  2015 libanonymous.so.2.0.23
lrwxrwxrwx 1 root root  21 May 17  2015 libgssapiv2.so -> libgssapiv2.so.2.0.23
lrwxrwxrwx 1 root root  21 May 17  2015 libgssapiv2.so.2 -> libgssapiv2.so.2.0.23
-rwxr-xr-x 1 root root 31K Feb 27  2015 libgssapiv2.so.2.0.23
lrwxrwxrwx 1 root root  18 May 17  2015 liblogin.so -> liblogin.so.2.0.23
lrwxrwxrwx 1 root root  18 May 17  2015 liblogin.so.2 -> liblogin.so.2.0.23
-rwxr-xr-x 1 root root 19K Feb 27  2015 liblogin.so.2.0.23
lrwxrwxrwx 1 root root  18 May 17  2015 libplain.so -> libplain.so.2.0.23
lrwxrwxrwx 1 root root  18 May 17  2015 libplain.so.2 -> libplain.so.2.0.23
-rwxr-xr-x 1 root root 19K Feb 27  2015 libplain.so.2.0.23
lrwxrwxrwx 1 root root  19 May 17  2015 libsasldb.so -> libsasldb.so.2.0.23
lrwxrwxrwx 1 root root  19 May 17  2015 libsasldb.so.2 -> libsasldb.so.2.0.23
-rwxr-xr-x 1 root root 23K Feb 27  2015 libsasldb.so.2.0.23

# sendmail -bs -Am
220 test.host.domain ESMTP mailer ready at Wed, 26 Oct 2022 20:07:35 -0700
helo test.host.domain 
250 test.host.domain Hello root@localhost, pleased to meet you
ehlo test.host.domain 
250-test.host.domain Hello root@localhost, pleased to meet you
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-SIZE 52428800
250-STARTTLS
250-DELIVERBY
250 HELP
quit
221 2.0.0 test.host.domain closing connection

# sendmail -OLogLevel=14 -bs -Am
220 test.host.domain ESMTP mailer ready at Wed, 26 Oct 2022 20:08:32 -0700
ehlo test.host.domain 
250-test.host.domain Hello root@localhost, pleased to meet you
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-SIZE 52428800
250-STARTTLS
250-DELIVERBY
250 HELP
quit
221 2.0.0 test.host.domain closing connection

# grep 'Oct 26 20:08:32' /var/log/maillog 
Oct 26 20:08:32 test sendmail[30261]: STARTTLS=server, Diffie-Hellman init, key=1024 bit (1)
Oct 26 20:08:32 test sendmail[30261]: STARTTLS=server, init=1
Oct 26 20:08:32 test sendmail[30261]: AUTH: available mech=GSSAPI, allowed mech=LOGIN PLAIN
[ . . . ]

# command -v saslpasswd2; type -a saslpasswd2; \
 whereis saslpasswd2; which saslpasswd2 
/usr/sbin/saslpasswd2
saslpasswd2 is /usr/sbin/saslpasswd2
saslpasswd2: /usr/sbin/saslpasswd2 /usr/share/man/man8/saslpasswd2.8.gz
/usr/sbin/saslpasswd2

# cat /etc/sasl2/Sendmail.conf 
pwcheck_method:saslauthd

# command -v saslauthd; type -a saslauthd; \
 whereis saslauthd; which saslauthd
/usr/sbin/saslauthd
saslauthd is /usr/sbin/saslauthd
saslauthd: /usr/sbin/saslauthd /usr/share/man/man8/saslauthd.8.gz
/usr/sbin/saslauthd

# grep -r -i AUTH /etc/mail/ | grep -i mechanisms | grep -v \# 
/etc/mail/sendmail.cf:O AuthMechanisms=LOGIN PLAIN
/etc/mail/sendmail.mc:define(`confAUTH_MECHANISMS', `LOGIN PLAIN')dnl

# grep -r TrustAuthMech /etc/mail/
/etc/mail/sendmail.cf:C{TrustAuthMech}LOGIN PLAIN
/etc/mail/sendmail.cf:R$* $| $={TrustAuthMech}  $# RELAY
/etc/mail/submit.cf:R$* $| $={TrustAuthMech}    $# RELAY

# grep -r TRUST_AUTH_MECH /etc/mail/
/etc/mail/sendmail.mc:TRUST_AUTH_MECH(`LOGIN PLAIN')dnl

# grep -r AUTH_OPTIONS /etc/mail/
/etc/mail/sendmail.mc:define(`confAUTH_OPTIONS', `A p y')dnl

# grep -r AuthOptions /etc/mail/ | grep -v \#
/etc/mail/sendmail.cf:O AuthOptions=A p y

+--------+---------------------------+-------------------------------------------------+
| Key    |                           | Meaning                                         |
+--------+---------------------------+-------------------------------------------------+
| Addr   | DaemonPortOptions=Addr=   | The network to accept connection from           |
+--------+---------------------------+-------------------------------------------------+
| Name   | DaemonPortOptions=Name=   | User-definable name for the daemon              | 
+--------+---------------------------+-------------------------------------------------+
| Port   | DaemonPortOptions=Port=   | The port number on which sendmail should listen |
+--------+---------------------------+-------------------------------------------------+
| Modify | DaemonPortOptions=Modify= | Modify selected characteristics of the port     |
+--------+---------------------------+-------------------------------------------------+

+--------+-----------------------------------------------------------------------------------+
| Letter | Meaning                                                                           |
+--------+-----------------------------------------------------------------------------------+
| a      | Require authentication with the AUTH ESMTP keyword before continuing with         | 
|        | the connection.  Do not use this setting on a public MTA that listens on port 25! |
+--------+-----------------------------------------------------------------------------------+
| s      | Use SMTP over SSL                                                                 | 
+--------+-----------------------------------------------------------------------------------+ 
| A      | Disable authentication - overrides the a modifier above.                          |
+--------+-----------------------------------------------------------------------------------+ 
| E      | Disallow use of the ETRN command as per RFC2476.                                  |
+--------+-----------------------------------------------------------------------------------+ 

# grep -r DaemonPortOptions /etc/mail/ 
/etc/mail/sendmail.cf:O DaemonPortOptions=Name=MTA, M=A
/etc/mail/sendmail.cf:O DaemonPortOptions=Port=465, Name=MTASSL, M=s a
/etc/mail/sendmail.cf:O DaemonPortOptions=Port=587, Name=MSA, M=a
/etc/mail/sendmail.cf:O DaemonPortOptions=Addr=127.0.0.1, Port=10026
/etc/mail/submit.cf:O DaemonPortOptions=Name=NoMTA, Addr=127.0.0.1, M=E

# grep -B1 DAEMON_OPTIONS /etc/mail/sendmail.mc
FEATURE(`no_default_msa')dnl
DAEMON_OPTIONS(`Name=MTA, M=A')dnl
DAEMON_OPTIONS(`Port=465, Name=MTASSL, M=s a')dnl
DAEMON_OPTIONS(`Port=587, Name=MSA, M=a')dnl
DAEMON_OPTIONS(`Addr=127.0.0.1, Port=10026')dnl

O DaemonPortOptions=Port=26

# grep -r trust_auth /etc/mail/ | grep -v \#
/etc/mail/sendmail.cf:SLocal_trust_auth
/etc/mail/sendmail.cf:Strust_auth
/etc/mail/sendmail.cf:R$* $| $*         $: $1 $| $>"Local_trust_auth" $2
/etc/mail/submit.cf:SLocal_trust_auth
/etc/mail/submit.cf:Strust_auth
/etc/mail/submit.cf:R$* $| $*           $: $1 $| $>"Local_trust_auth" $2

# grep -r auth_authen /etc/mail/ | grep -v \#
/etc/mail/sendmail.cf:O Milter.macros.envfrom=i, {auth_type}, {auth_authen}, {auth_ssf}, {auth_author}, {mail_mailer}, {mail_host}, {mail_addr}
/etc/mail/sendmail.cf:R$* $| $&{auth_authen}            $@ identical
/etc/mail/sendmail.cf:R$* $| <$&{auth_authen}>  $@ identical
/etc/mail/submit.cf:R$* $| $&{auth_authen}              $@ identical
/etc/mail/submit.cf:R$* $| <$&{auth_authen}>    $@ identical

# grep -r auth_author /etc/mail/ | grep -v \#
/etc/mail/sendmail.cf:O Milter.macros.envfrom=i, {auth_type}, {auth_authen}, {auth_ssf}, {auth_author}, {mail_mailer}, {mail_host}, {mail_addr}

# grep -r auth_type /etc/mail/ | grep -v \#
/etc/mail/sendmail.cf:O Milter.macros.envfrom=i, {auth_type}, {auth_authen}, {auth_ssf}, {auth_author}, {mail_mailer}, {mail_host}, {mail_addr}
/etc/mail/sendmail.cf:  $.$?{auth_type}(authenticated$?{auth_ssf} bits=${auth_ssf}$.)
/etc/mail/sendmail.cf:R$*                       $: $1 $| $>"Local_Relay_Auth" $&{auth_type}
/etc/mail/sendmail.cf:R$* $| $*         $: $1 $| $&{auth_type}
/etc/mail/sendmail.cf:R$*                       $: $&{auth_type} $| $1
/etc/mail/submit.cf:    $.$?{auth_type}(authenticated$?{auth_ssf} bits=${auth_ssf}$.)
/etc/mail/submit.cf:R$*                 $: $1 $| $>"Local_Relay_Auth" $&{auth_type}
/etc/mail/submit.cf:R$* $| $*           $: $1 $| $&{auth_type}
/etc/mail/submit.cf:R$*                 $: $&{auth_type} $| $1

smtp   stream  tcp   nowait  root /usr/sbin/sendmail sendmail -bs

0 * * * * /usr/sbin/sendmail -q

/usr/sbin/sendmail -q1h

# sendmail -bt -d21.12 -d60 -d38
[ . . . ]

$ sendmail -d60.5 -bt << END
 /tryflags E
 /try relay dusko@yourdomain.com
 END

-d60.5 - trace map lookups (including genericstable lookups)
-d21.12 - trace R lines processing, use it when genericstable is not
consulted at all

/tryflags flags:
hs - header sender (genericstable rewrites only it by default)
hr - header recipient
es - evelope sender ("MAIL FROM:" in SMTP session) 

$ sendmail -d21.12 -bt 
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>
> /tryflags hs
> /try esmtp dusko

$ echo 'A <16.19.2.333><default><+Connect><passthru>' | sendmail -d60.5 -bt
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>
> A                  input: < 16 . 19 . 2 . 333 > < default > < + Connect > < passthru >
A                  input: < 16 . 19 . 2 > < default > < + Connect > < passthru >
A                  input: < 16 . 19 > < default > < + Connect > < passthru >
A                  input: < 16 > < default > < + Connect > < passthru >
A                returns: < default > < passthru >
A                returns: < default > < passthru >
A                returns: < default > < passthru >
A                returns: < default > < passthru >
> $ 

$ echo 'A <16.19.2.333><default><+Connect><passthru>' | sendmail -d60.5 -bt | tail -2 
A                returns: < default > < passthru >
> $ 

$ echo 'A <16.1.2.333><default><+Connect><passthru>' | sendmail -d60.5 -bt | tail -2 
A                returns: < default > < passthru >
> $ 

$ sendmail -d38.20 -v -oi <<END 
To: dusko@fbsd1.yourprovider.com
Subject: hello

Testing.
END
openmap()       dequote:dequote NULL: valid
Recipient names must be specified
closemaps: closing dequote (NULL)

$ sudo sendmail -d38.20 -Ac -v -i -t << END
To: dusko@yourprovider.com
Subject: Test

Testing.
END
openmap()       dequote:dequote NULL: valid
openmap()       host:host NULL: valid
getcanonname(yourprovider.com), trying dns
getcanonname(yourprovider.com), found, ad=0
dusko@yourprovider.com... Connecting to [127.0.0.1] port 1465 via smartrelay...
220 mailx.yourprovider.com ESMTP mailer ready at Wed, 7 Dec 2022 12:17:13 -0800
>>> EHLO fbsd1.yourisp.com
250-mailx.yourprovider.com Hello fbsd1.yourisp.com [123.45.67.89], pleased to meet you
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-SIZE 52428800
250-AUTH LOGIN PLAIN
250-DELIVERBY
250 HELP
hash_map_open(authinfo, /etc/mail/authinfo, 0)
openmap()       hash:authinfo /etc/mail/authinfo: valid
db_map_lookup(authinfo, AuthInfo:[127.0.0.1])
>>> AUTH LOGIN
334 VXNlcm5hbWU6
>>> ZABcd12=
334 UGFzc3dvcmQ6
>>> TABcDE1fGHIjKLmnOPQ2rS==
235 2.0.0 OK Authenticated
>>> MAIL From:<dusko@fbsd1.yourisp.com> SIZE=46 AUTH=dusko@yourisp.com
250 2.1.0 <dusko@fbsd1.yourisp.com>... Sender ok
>>> RCPT To:<dusko@yourprovider.com>
250 2.1.5 <dusko@yourprovider.com>... Recipient ok
>>> DATA
354 Enter mail, end with "." on a line by itself
>>> .
250 2.0.0 2B7KHDhI015382 Message accepted for delivery
dusko@yourprovider.com... Sent (2B7KHDhI015382 Message accepted for delivery)
Closing connection to [127.0.0.1]
>>> QUIT
221 2.0.0 mailx.yourprovider.com closing connection
closemaps: closing authinfo (/etc/mail/authinfo)
db_map_close(authinfo, /etc/mail/authinfo, 1000121)
closemaps: closing host (NULL)
closemaps: closing dequote (NULL)

FEATURE(`no_default_msa')

FEATURE(`no_default_msa')
DAEMON_OPTIONS(`Port=587,Name=MSA,M=Ea')

FEATURE(`no_default_msa')
DAEMON_OPTIONS(`Port=587,Name=MSA,M=Ea')
DAEMON_OPTIONS(`Port=smtp, Name=MTA')

# grep -n CERTISSUER /etc/mail/sendmail.cf
1774:R$+                        $: $(access CERTISSUER:$1 $)

# grep -n CERTSUBJECT /etc/mail/sendmail.cf
1777:R<@> $+                    $: <@> $(access CERTSUBJECT:$1 $)

# sed -n 1762,1779p /etc/mail/sendmail.cf
######################################################################
###  RelayTLS: allow relaying based on TLS authentication
###
###     Parameters:
###             none
######################################################################
SRelayTLS
# authenticated?
R$*                     $: <?> $&{verify}
R<?> OK                 $: OK           authenticated: continue
R<?> $*                 $@ NO           not authenticated
R$*                     $: $&{cert_issuer}
R$+                     $: $(access CERTISSUER:$1 $)
RRELAY                  $# RELAY
RSUBJECT                $: <@> $&{cert_subject}
R<@> $+                 $: <@> $(access CERTSUBJECT:$1 $)
R<@> RELAY              $# RELAY
R$*                     $: NO

# grep -n TLS_Srv /etc/mail/sendmail.cf
1679:R$*                $: $1 $| $>D <$&{server_name}> <?> <! "TLS_Srv"> <>
1680:R$* $| <?>$*       $: $1 $| $>A <$&{server_addr}> <?> <! "TLS_Srv"> <>
1681:R$* $| <?>$*       $: $1 $| <$(access "TLS_Srv": $: ? $)>

# grep -n TLS_Clt /etc/mail/sendmail.cf
1450:SDelay_TLS_Clt
1457:SDelay_TLS_Clt2
1471:R$+ $| $#$*                $@ $>"Delay_TLS_Clt" $2
1664:R$* $| $*  $: $1 $| $>D <$&{client_name}> <?> <! "TLS_Clt"> <>
1665:R$* $| <?>$*       $: $1 $| $>A <$&{client_addr}> <?> <! "TLS_Clt"> <>
1666:R$* $| <?>$*       $: $1 $| <$(access "TLS_Clt": $: ? $)>

# grep -r -n TLS_Srv /etc/mail | grep -v 'sendmail.cf' 

# grep -r -n TLS_Clt /etc/mail | grep -v 'sendmail.cf' 

# sed -n 1450,1462p /etc/mail/sendmail.cf
SDelay_TLS_Clt
# authenticated?
R$*                     $: $1 $| $>"tls_client" $&{verify} $| MAIL
R$* $| $#$+             $#$2
R$* $| $*               $# $1
R$*                     $# $1

SDelay_TLS_Clt2
# authenticated?
R$*                     $: $1 $| $>"tls_client" $&{verify} $| MAIL
R$* $| $#$+             $#$2
R$* $| $*               $@ $1
R$*                     $@ $1

# sed -n 1655,1683p /etc/mail/sendmail.cf
######################################################################
###  tls_client: is connection with client "good" enough?
###     (done in server)
###
###     Parameters:
###             ${verify} $| (MAIL|STARTTLS)
######################################################################
Stls_client
R$*             $: $(macro {TLS_Name} $@ $&{client_name} $) $1
R$* $| $*       $: $1 $| $>D <$&{client_name}> <?> <! "TLS_Clt"> <>
R$* $| <?>$*    $: $1 $| $>A <$&{client_addr}> <?> <! "TLS_Clt"> <>
R$* $| <?>$*    $: $1 $| <$(access "TLS_Clt": $: ? $)>
R$* $| <$* <TMPF>>    $#error $@ 4.3.0 $: "451 Temporary system failure. Please try again later."
R$*             $@ $>"TLS_connection" $1

######################################################################
###  tls_server: is connection with server "good" enough?
###     (done in client)
###
###     Parameter:
###             ${verify}
######################################################################
Stls_server
R$*             $: $(macro {TLS_Name} $@ $&{server_name} $) $1
R$*             $: $1 $| $>D <$&{server_name}> <?> <! "TLS_Srv"> <>
R$* $| <?>$*    $: $1 $| $>A <$&{server_addr}> <?> <! "TLS_Srv"> <>
R$* $| <?>$*    $: $1 $| <$(access "TLS_Srv": $: ? $)>
R$* $| <$* <TMPF>>    $#error $@ 4.3.0 $: "451 Temporary system failure. Please try again later."
R$*             $@ $>"TLS_connection" $1

From:postmaster@spam.com   OK
From:spam.com              REJECT

% sendmail -i -v -d35.9,21.12 dusko
[ . . . ]

FEATURE(`delay_checks')dnl
The "delay_checks" feature is useful when used in combination with the "dnsbl"
feature for SPAM control.  Without enabling this feature, the log entry for the
rejected email will not contain the destination users mail address.  Having the
destination address is very useful when troubleshooting; typically the person
calling your organizations support center is the person whom cannot receive the
email.  This feature will put the destination users address into the reject log
message allowing you to search the log for it directly.  In the other case, the
external entity can be asked whom they were trying to send to.  Otherwise, you
are stuck looking for origin SMTP servers, not a straight forward as it might
seem.  For example, the sender works for company abc.com but is sending you
email from their home cable modem.

In addition to the "access_db" declaration, however, you also want to add the
"delay_checks" feature.  Normally, the access DB and other anti-spam checks would
be consulted as soon as the remote server issues the "mail from:" command to set the
message sender.  The "delay_checks" feature tells Sendmail to wait until both the
sender and recipient addresses have been sent before deciding whether or not the message
is spam.  This is how you make sure that your "abuse@sysiphus.com" address
receives an unfiltered email stream while protecting all of your other users from spam.

#!/bin/sh
# -d60.5 turn on traking map lookups
/usr/sbin/sendmail -d60.5 -v -i -fsender_email -- receiver_email  <<END
subject: test

test
END

Sendmail.mc file approach:

Add the following definition to /etc/mail/sendmail.mc

define(`confLOG_LEVEL', `14')dnl

Rebuild /etc/mail/sendmail.cf

m4 sendmail.mc > sendmail.cf

Sendmail.cf file approach:

Change the following definition in /etc/mail/sendmail.cf

O LogLevel=14

After you have changed the logging level, restart the sendmail daemon.
 Syslog will now log any successful authentications to
/var/log/maillog.  Of interest to you are the following fields in each
authentication log entry:

authid= and relay=

authid will display the login that was used for the authentication,
and relay will display the remote IP address that was added as the
temporary relay.  If you don't recognize the relay, then it is most
likely the spammer entry.

From: Example Company <news@example.com>
To: Joe User <joe.u@example.net>
Date: Sat, 21 May 2011 17:40:11 +0300
Subject: Multipart message example
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=asdfghjkl

--asdfghjkl
Content-Type: text/plain; charset=utf-8

Hello everyone!

--asdfghjkl
Content-Type: text/html; charset=utf-8

<!DOCTYPE html>
<body>
<p>Hello everyone!</p>
</body>

--asdfghjkl--

$ host -t mx example.org
example.org mail is handled by 10 smtp.example.org.

$ telnet smtp.example.org 25
Trying 192.0.2.1...
Connected to smtp.example.org.
Escape character is '^]'.
220 smtp.example.org ESMTP Sendmail 8.13.2/8.13.2
EHLO client.example.org
250-smtp.example.org Hello client.example.org [192.0.2.7], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE 16180340
250-DSN
250-STARTTLS
250-DELIVERBY
250 HELP
STARTTLS
220 2.0.0 Ready to start TLS
...

$ openssl s_client -connect www.example.org:443 -showcerts
...
GET / HTTP/1.0

HTTP/1.1 200 OK
...
$ openssl s_client -connect mail.example.org:110 -showcerts -starttls pop3
... 
+OK POP3 mail.example.org v2003.83 server ready
quit
+OK Sayonara

$ openssl s_client -verify 2 -quiet -connect mx.youremailprovider.com:465
---- snip ----

$ openssl s_client -verify 2 -quiet -connect mx.youremailprovider.com:465 2>/dev/null || exit 75
---- snip ----

dnl # suppress IP of authenticated sender
define(`confRECEIVED_HEADER',`$?{auth_type}from auth (localhost [127.0.0.1]) $|_REC_HDR_$.
	_REC_BY_
	_REC_TLS_
	_REC_END_')

define(`confRECEIVED_HEADER', `$?{auth_type}(from $j) by $j ($v/$Z)$|$?sfrom $s $.$?_($?s$|from $.$_)
$.$?{auth_type}(authenticated$?{auth_ssf} bits=${auth_ssf}$.)
$.by $j ($v/$Z)$?r with $r$. id $i$?{tls_version}
(version=${tls_version} cipher=${cipher} bits=${cipher_bits} verify=${verify})$.$?u
for $u; $|;
$.$b$.')dnl

$ diff /usr/src/contrib/sendmail/cf/README /usr/local/share/sendmail/cf/README | wc -l
     106

$ wc -l /usr/src/contrib/sendmail/src/README /usr/local/share/sendmail/cf/README 
    1869 /usr/src/contrib/sendmail/src/README
    4831 /usr/local/share/sendmail/cf/README
    6700 total

$ ls -lh /usr/src/contrib/sendmail/src/ | grep -v '\.c' | grep -v '\.h'
total 1332
-rw-r--r--  1 root  wheel   1.4K Oct 21 17:58 aliases
-rw-r--r--  1 root  wheel   3.1K Oct 21 17:58 aliases.5
-rw-r--r--  1 root  wheel   5.5K Oct 21 17:58 helpfile
-rw-r--r--  1 root  wheel   3.5K Oct 21 17:58 mailq.1
-rw-r--r--  1 root  wheel   347B Oct 21 17:58 Makefile
-rw-r--r--  1 root  wheel   4.4K Oct 21 17:58 Makefile.m4
-rw-r--r--  1 root  wheel   1.3K Oct 21 17:58 newaliases.1
-rw-r--r--  1 root  wheel    82K Oct 21 17:58 README
-rw-r--r--  1 root  wheel   7.5K Oct 21 17:58 SECURITY
-rw-r--r--  1 root  wheel    17K Oct 21 17:58 sendmail.8
-rw-r--r--  1 root  wheel   3.1K Oct 21 17:58 TRACEFLAGS
-rw-r--r--  1 root  wheel    10K Oct 21 17:58 TUNING

$ cat /usr/src/contrib/sendmail/FAQ
The FAQ is no longer maintained with the sendmail release.  It is
available at http://www.sendmail.org/faq/ .

$Revision: 8.25 $, Last updated $Date: 2014-01-27 12:49:52 $

$ /usr/local/sbin/sendmail -d0.1 < /dev/null | head -1
Version 8.17.1

$ pkg search --regex ^sendmail-
sendmail-8.17.1_6              Reliable, highly configurable mail 
  transfer agent with utilities
sendmail-devel-8.17.1.22       Reliable, highly configurable mail
  transfer agent with utilities

$ /usr/libexec/sendmail/sendmail -d0.1 < /dev/null | head -1
Version 8.16.1

$ cat /usr/src/contrib/sendmail/FREEBSD-upgrade
$FreeBSD$

sendmail 8.16.1
        originals can be found at: ftp://ftp.sendmail.org/pub/sendmail/

For the import of sendmail, the following directories were renamed:

        sendmail -> src

Imported using the instructions at:

http://www.freebsd.org/doc/en_US.ISO8859-1/articles/committers-guide/subversion-primer.html

Then merged using:

% set FSVN=svn+ssh://repo.freebsd.org/base
% svn checkout $FSVN/head/contrib/sendmail head
% cd head
### Replace XXXXXX with import revision number in next command:
% svn merge -c rXXXXXX --accept=postpone '^/vendor/sendmail/dist' .
% svn resolve --accept working cf/cf/Build \
    cf/cf/generic-{bsd4.4,hpux{9,10},linux,mpeix,nextstep3.3,osf1,solaris,sunos4.1,ultrix4}.cf \
    devtools doc/op/op.ps editmap/editmap.0 mail.local/mail.local.0 mailstats/mailstats.0 \
    makemap/makemap.0 praliases/praliases.0 rmail/rmail.0 smrsh/smrsh.0 \
    src/{aliases,mailq,newaliases,sendmail}.0 vacation/vacation.0
% svn propset -R svn:keywords FreeBSD=%H .
% svn propdel svn:keywords libmilter/docs/*.jpg
% svn diff --no-diff-deleted --old=$FSVN/vendor/sendmail/dist --new=.
% svn status
% svn diff
% svn commit

After importing, bump the version of src/etc/sendmail/freebsd*mc
so mergemaster will merge /etc/mail/freebsd*cf by making a minor
change and committing.

To make local changes to sendmail, simply patch and commit to the head.
Never make local changes in the vendor area (/vendor/sendmail/).

All local changes should be submitted to the Sendmail Consortium
<sendmail@sendmail.org> for inclusion in the next vendor release.

The following files make up the sendmail build/install/runtime
infrastructure in FreeBSD:

        Makefile.inc1
        bin/Makefile
        bin/rmail/Makefile
        contrib/sendmail/
        etc/Makefile
        etc/defaults/make.conf (obsolete)
        etc/defaults/periodic.conf
        etc/defaults/rc.conf
        etc/mail/Makefile
        etc/mail/README
        etc/mail/access.sample
        etc/mail/aliases
        etc/mail/mailer.conf
        etc/mail/mailertable.sample
        etc/mail/virtusertable.sample
        etc/mtree/BSD.include.dist
        etc/mtree/BSD.sendmail.dist
        etc/mtree/BSD.usr.dist
        etc/mtree/BSD.var.dist
        etc/periodic/daily/440.status-mailq
        etc/periodic/daily/500.queuerun
        etc/rc
        etc/rc.sendmail
        etc/sendmail/Makefile
        etc/sendmail/freebsd.mc
        etc/sendmail/freebsd.submit.mc
        etc/sendmail/freefall.mc
        lib/Makefile
        lib/libmilter/Makefile
        lib/libsm/Makefile
        lib/libsmdb/Makefile
        lib/libsmutil/Makefile
        libexec/Makefile
        libexec/mail.local/Makefile
        libexec/smrsh/Makefile
        share/Makefile
        share/doc/smm/Makefile
        share/doc/smm/08.sendmailop/Makefile
        share/examples/etc/make.conf
        share/man/man5/make.conf.5
        share/man/man5/periodic.conf.5
        share/man/man5/rc.conf.5
        share/man/man7/hier.7
        share/man/man8/Makefile
        share/man/man8/rc.sendmail.8
        share/mk/bsd.libnames.mk
        share/sendmail/Makefile
        tools/build/mk/OptionalObsoleteFiles.inc
        usr.bin/Makefile
        usr.bin/vacation/Makefile
        usr.sbin/Makefile
        usr.sbin/editmap/Makefile
        usr.sbin/mailstats/Makefile
        usr.sbin/makemap/Makefile
        usr.sbin/praliases/Makefile
        usr.sbin/sendmail/Makefile
        usr.sbin/mailwrapper/Makefile

gshapiro@FreeBSD.org
15-July-2020

% man -k sendmail | wc -l
      11

% man -k sendmail
aliases(5) - aliases file for sendmail
aliases(5) - aliases file for sendmail
editmap(8) - query and edit single records in database maps for sendmail
editmap(8) - query and edit single records in database maps for sendmail
makemap(8) - create database maps for sendmail
makemap(8) - create database maps for sendmail
rc.sendmail(8) - sendmail 8 startup script
sendmail(8) - an electronic mail transport agent
sendmail, hoststat, purgestat(8) - an electronic mail transport agent
smrsh(8) - restricted shell for sendmail
smrsh(8) - restricted shell for sendmail

% manpath
/usr/share/man:/usr/local/share/man:/usr/local/man:/usr/share/openssl/man:/usr/local/lib/perl5/site_perl/man:/usr/local/lib/perl5/5.32/perl/man

% head -20 /etc/defaults/rc.conf
#!/bin/sh

# This is rc.conf - a file full of useful variables that you can set
# to change the default startup behavior of your system.  You should
# not edit this file!  Put any overrides into one of the ${rc_conf_files}
# instead and you will be able to update these defaults later without
# spamming your local configuration information.
#
# The ${rc_conf_files} files should only contain values which override
# values set in this file.  This eases the upgrade path when defaults
# are changed and new features are added.
#
# All arguments must be in double or single quotes.
#
# For a more detailed explanation of all the rc.conf variables, please
# refer to the rc.conf(5) manual page.
#
# $FreeBSD$

##############################################################

rc_conf_files
            (str) This option is used to specify a list of files that
            will override the settings in /etc/defaults/rc.conf.  The
            files will be read in the order in which they are specified
            and should include the full path to the file.  By default,
            the files specified are /etc/rc.conf and /etc/rc.conf.local

% grep -n sendmail /etc/defaults/rc.conf | wc -l
      16
 
% grep -n -i sendmail /etc/defaults/rc.conf | wc -l
      16

% grep sendmail /etc/defaults/rc.conf
mta_start_script="/etc/rc.sendmail"
# Settings for /etc/rc.sendmail and /etc/rc.d/sendmail:
sendmail_enable="NO"    # Run the sendmail inbound daemon (YES/NO).
sendmail_pidfile="/var/run/sendmail.pid"        # sendmail pid file
sendmail_procname="/usr/sbin/sendmail"          # sendmail process name
sendmail_flags="-L sm-mta -bd -q30m" # Flags to sendmail (as a server)
sendmail_cert_create="YES"      # Create a server certificate if none (YES/NO)
#sendmail_cert_cn="CN"          # CN of the generate certificate
sendmail_submit_enable="YES"    # Start a localhost-only MTA for mail submission
sendmail_submit_flags="-L sm-mta -bd -q30m -ODaemonPortOptions=Addr=localhost"
sendmail_outbound_enable="YES"  # Dequeue stuck mail (YES/NO).
sendmail_outbound_flags="-L sm-queue -q30m" # Flags to sendmail (outbound only)
sendmail_msp_queue_enable="YES" # Dequeue stuck clientmqueue mail (YES/NO).
sendmail_msp_queue_flags="-L sm-msp-queue -Ac -q30m"
                                # Flags for sendmail_msp_queue daemon.
sendmail_rebuild_aliases="NO"   # Run newaliases if necessary (YES/NO).

% grep sendmail /etc/defaults/rc.conf | grep flags
sendmail_flags="-L sm-mta -bd -q30m" # Flags to sendmail (as a server)
sendmail_submit_flags="-L sm-mta -bd -q30m -ODaemonPortOptions=Addr=localhost"
sendmail_outbound_flags="-L sm-queue -q30m" # Flags to sendmail (outbound only)
sendmail_msp_queue_flags="-L sm-msp-queue -Ac -q30m"

% grep sendmail /etc/defaults/rc.conf | grep submit
sendmail_submit_enable="YES"    # Start a localhost-only MTA for mail submission
sendmail_submit_flags="-L sm-mta -bd -q30m -ODaemonPortOptions=Addr=localhost"

% grep sendmail /etc/defaults/rc.conf | grep msp
sendmail_msp_queue_enable="YES" # Dequeue stuck clientmqueue mail (YES/NO).
sendmail_msp_queue_flags="-L sm-msp-queue -Ac -q30m"
                                # Flags for sendmail_msp_queue daemon.

% sudo grep -r -w sendmail_submit /etc/
/etc/rc.d/sendmail:     name="sendmail_submit"

% sudo grep -r sendmail_submit_flags /etc/
/etc/defaults/rc.conf:sendmail_submit_flags="-L sm-mta -bd -q30m -ODaemonPortOptions=Addr=localhost"
/etc/rc.sendmail:                       ${sendmail_program} ${sendmail_submit_flags}

% sudo grep -r -w sendmail_submit_enable /etc/
/etc/rc.d/sendmail:     sendmail_submit_enable="NO"
/etc/rc.d/sendmail:     sendmail_submit_enable="NO"
/etc/rc.d/sendmail:# If sendmail_submit_enable=yes, don't need outbound daemon
/etc/rc.d/sendmail:if checkyesno sendmail_submit_enable; then
/etc/rc.d/sendmail:if checkyesno sendmail_submit_enable; then
/etc/rc.d/sendmail:     rcvar="sendmail_submit_enable"
/etc/mail/README:can be disabled using the sendmail_submit_enable rc.conf option.  However,
/etc/mail/README:if both sendmail_enable and sendmail_submit_enable are set to "NO", you
/etc/defaults/rc.conf:sendmail_submit_enable="YES"      # Start a localhost-only MTA for mail submission
/etc/rc.sendmail:               case ${sendmail_submit_enable} in
/etc/rc.sendmail:               case ${sendmail_submit_enable} in
/etc/rc.sendmail:               case ${sendmail_submit_enable} in

% sudo grep -r -n mta_start_script /etc/
/etc/rc.d/othermta:15:if [ -n "${mta_start_script}" ]; then
/etc/rc.d/othermta:16:  [ "${mta_start_script}" != "/etc/rc.sendmail" ] && \
/etc/rc.d/othermta:17:      sh ${mta_start_script} "$1"
/etc/defaults/rc.conf:592:mta_start_script="/etc/rc.sendmail"
/etc/rc.sendmail:34:# MTAs.  It is only called by /etc/rc if the rc.conf mta_start_script is

% cat /etc/rc.d/othermta
#!/bin/sh
#
# $FreeBSD$
#

# PROVIDE: mail
# REQUIRE: LOGIN

# XXX - TEMPORARY SCRIPT UNTIL YOU WRITE YOUR OWN REPLACEMENT.
#
. /etc/rc.subr

load_rc_config

if [ -n "${mta_start_script}" ]; then
        [ "${mta_start_script}" != "/etc/rc.sendmail" ] && \
            sh ${mta_start_script} "$1"
fi

% ls -lh /etc/rc.sendmail
-rw-r--r--  1 root  wheel   5.6K Apr  8  2021 /etc/rc.sendmail
 
% file /etc/rc.sendmail
/etc/rc.sendmail: POSIX shell script, ASCII text executable
 
% wc -l /etc/rc.sendmail
     277 /etc/rc.sendmail

% cd /etc/mail
% sudo su
# make start    # (Or make stop, or make restart) 

% cat /etc/rc.sendmail
#!/bin/sh

#
# Copyright (c) 2002  Gregory Neil Shapiro.  All Rights Reserved.
# Copyright (c) 2000, 2002  The FreeBSD Project

[ . . . ]

# This script is used by /etc/rc at boot time to start sendmail.  It
# is meant to be sendmail specific and not a generic script for all
# MTAs.  It is only called by /etc/rc if the rc.conf mta_start_script is
# set to /etc/rc.sendmail.  This provides the opportunity for other MTAs
# to provide their own startup script.

# The script is also used by /etc/mail/Makefile to enable the
# start/stop/restart targets.

# The source for the script can be found in src/etc/sendmail/rc.sendmail.

% ls -lh /etc/rc.d/sendmail
-r-xr-xr-x  1 root  wheel   6.4K Apr  8  2021 /etc/rc.d/sendmail
 
% file /etc/rc.d/sendmail
/etc/rc.d/sendmail: POSIX shell script, ASCII text executable
 
% wc -l /etc/rc.d/sendmail
     229 /etc/rc.d/sendmail

% cat /etc/rc.d/sendmail
#!/bin/sh
#
# $FreeBSD$
#

# PROVIDE: mail
# REQUIRE: LOGIN FILESYSTEMS
#       we make mail start late, so that things like .forward's are not
#       processed until the system is fully operational
# KEYWORD: shutdown

# XXX - Get together with sendmail mantainer to figure out how to
#       better handle SENDMAIL_ENABLE and 3rd party MTAs.
#
. /etc/rc.subr

name="sendmail"
desc="Electronic mail transport agent"
rcvar="sendmail_enable"
required_files="/etc/mail/${name}.cf"
start_precmd="sendmail_precmd"

load_rc_config $name
command=${sendmail_program:-/usr/sbin/${name}}
pidfile=${sendmail_pidfile:-/var/run/${name}.pid}
procname=${sendmail_procname:-/usr/sbin/${name}}

CERTDIR=/etc/mail/certs

case ${sendmail_enable} in
[Nn][Oo][Nn][Ee])
        sendmail_enable="NO"
        sendmail_submit_enable="NO"
        sendmail_outbound_enable="NO"
        sendmail_msp_queue_enable="NO"
        ;;
esac

# If sendmail_enable=yes, don't need submit or outbound daemon
if checkyesno sendmail_enable; then
        sendmail_submit_enable="NO"
        sendmail_outbound_enable="NO"
fi

# If sendmail_submit_enable=yes, don't need outbound daemon
if checkyesno sendmail_submit_enable; then
        sendmail_outbound_enable="NO"
fi

[ . . . ]

required_files=

if checkyesno sendmail_submit_enable; then
        name="sendmail_submit"
        rcvar="sendmail_submit_enable"
        _rc_restart_done=false
        run_rc_command "$1"
fi

if checkyesno sendmail_outbound_enable; then
        name="sendmail_outbound"
        rcvar="sendmail_outbound_enable"
        _rc_restart_done=false
        run_rc_command "$1"
fi

name="sendmail_msp_queue"
rcvar="sendmail_msp_queue_enable"
pidfile="${sendmail_msp_queue_pidfile:-/var/spool/clientmqueue/sm-client.pid}"
required_files="/etc/mail/submit.cf"
_rc_restart_done=false
run_rc_command "$1"

% grep -n msp /etc/rc.d/sendmail
35:     sendmail_msp_queue_enable="NO"
224:name="sendmail_msp_queue"
225:rcvar="sendmail_msp_queue_enable"
226:pidfile="${sendmail_msp_queue_pidfile:-/var/spool/clientmqueue/sm-client.pid}"

% grep -n -i queue /etc/rc.d/sendmail
35:     sendmail_msp_queue_enable="NO"
224:name="sendmail_msp_queue"
225:rcvar="sendmail_msp_queue_enable"
226:pidfile="${sendmail_msp_queue_pidfile:-/var/spool/clientmqueue/sm-client.pid}"

% grep -n '\-L' /etc/rc.d/sendmail

% grep -n msp /etc/rc.sendmail 
55:sendmail_mspq_pidfile=${sendmail_mspq_pidfile:-/var/spool/clientmqueue/sm-client.pid}
152:start_mspq()
159:                    case ${sendmail_msp_queue_enable} in
162:                            ${sendmail_program} ${sendmail_msp_queue_flags}
170:stop_mspq()
179:                    case ${sendmail_msp_queue_enable} in
190:    if [ -r ${sendmail_mspq_pidfile} ]; then
192:            kill -TERM `head -1 ${sendmail_mspq_pidfile}`
194:            echo "$0: stop-mspq: ${sendmail_mspq_pidfile} not found"
198:restart_mspq()
207:                    case ${sendmail_msp_queue_enable} in
218:    if [ -r ${sendmail_mspq_pidfile} ]; then
220:            kill -HUP `head -1 ${sendmail_mspq_pidfile}`
222:            echo "$0: restart-mspq: ${sendmail_mspq_pidfile} not found"
232:    start_mspq
237:    stop_mspq
242:    restart_mspq
257:start-mspq)
258:    start_mspq
261:stop-mspq)
262:    stop_mspq
265:restart-mspq)
266:    restart_mspq
272:    echo "       `basename $0` {start-mspq|stop-mspq|restart-mspq}" >&2

% grep -n queue /etc/rc.sendmail 
55:sendmail_mspq_pidfile=${sendmail_mspq_pidfile:-/var/spool/clientmqueue/sm-client.pid}
159:                    case ${sendmail_msp_queue_enable} in
161:                            echo -n ' sendmail-clientmqueue'
162:                            ${sendmail_program} ${sendmail_msp_queue_flags}
172:    # Check to make sure we are configured to start an MSP queue runner
179:                    case ${sendmail_msp_queue_enable} in
191:            echo -n ' sendmail-clientmqueue'
200:    # Check to make sure we are configured to start an MSP queue runner
207:                    case ${sendmail_msp_queue_enable} in
219:            echo -n ' sendmail-clientmqueue'

% grep -n '\-L' /etc/rc.sendmail 

% sudo grep -r sendmail_outbound_enable /etc/
/etc/rc.d/sendmail:     sendmail_outbound_enable="NO"
/etc/rc.d/sendmail:     sendmail_outbound_enable="NO"
/etc/rc.d/sendmail:     sendmail_outbound_enable="NO"
/etc/rc.d/sendmail:if checkyesno sendmail_outbound_enable; then
/etc/rc.d/sendmail:     rcvar="sendmail_outbound_enable"
/etc/defaults/rc.conf:sendmail_outbound_enable="YES"    # Dequeue stuck mail (YES/NO).
/etc/rc.sendmail:                       case ${sendmail_outbound_enable} in
/etc/rc.sendmail:                       case ${sendmail_outbound_enable} in
/etc/rc.sendmail:                       case ${sendmail_outbound_enable} in

% sudo grep -n sendmail_outbound_enable /etc/defaults/rc.conf 
604:sendmail_outbound_enable="YES"      # Dequeue stuck mail (YES/NO).

% sudo grep -n sendmail_outbound /etc/defaults/rc.conf
604:sendmail_outbound_enable="YES"      # Dequeue stuck mail (YES/NO).
605:sendmail_outbound_flags="-L sm-queue -q30m" # Flags to sendmail (outbound only)

% sudo grep -n sm /etc/defaults/rc.conf | grep queue
605:sendmail_outbound_flags="-L sm-queue -q30m" # Flags to sendmail (outbound only)
607:sendmail_msp_queue_flags="-L sm-msp-queue -Ac -q30m"

% sudo grep -n msp /etc/defaults/rc.conf 
606:sendmail_msp_queue_enable="YES"     # Dequeue stuck clientmqueue mail (YES/NO).
607:sendmail_msp_queue_flags="-L sm-msp-queue -Ac -q30m"
608:                            # Flags for sendmail_msp_queue daemon.

% sed -n 605,610p /etc/defaults/rc.conf
sendmail_outbound_flags="-L sm-queue -q30m" # Flags to sendmail (outbound only)
sendmail_msp_queue_enable="YES" # Dequeue stuck clientmqueue mail (YES/NO).
sendmail_msp_queue_flags="-L sm-msp-queue -Ac -q30m"
                                # Flags for sendmail_msp_queue daemon.
sendmail_rebuild_aliases="NO"   # Run newaliases if necessary (YES/NO).
 

% grep -n '\-L' /etc/defaults/rc.conf
598:sendmail_flags="-L sm-mta -bd -q30m" # Flags to sendmail (as a server)
602:sendmail_submit_flags="-L sm-mta -bd -q30m -ODaemonPortOptions=Addr=localhost"
605:sendmail_outbound_flags="-L sm-queue -q30m" # Flags to sendmail (outbound only)
607:sendmail_msp_queue_flags="-L sm-msp-queue -Ac -q30m"

% grep -n -i msp /etc/defaults/rc.conf
606:sendmail_msp_queue_enable="YES"     # Dequeue stuck clientmqueue mail (YES/NO).
607:sendmail_msp_queue_flags="-L sm-msp-queue -Ac -q30m"
608:                            # Flags for sendmail_msp_queue daemon.

$ sed -n 11,172p /usr/src/contrib/sendmail/src/SECURITY 
This file gives some hints how to configure and run sendmail for
people who are very security conscious (you should be...).

Even though sendmail goes through great lengths to assure that it
can't be compromised even if the system it is running on is
incorrectly or insecurely configured, it can't work around everything.
This has been demonstrated by recent OS problems which have
subsequently been used to compromise the root account using sendmail
as a vector.  One way to minimize the possibility of such problems
is to install sendmail without set-user-ID root, which avoids local
exploits.  This configuration, which is the default starting with
8.12, is described in the first section of this security guide.


*****************************************************
** sendmail configuration without set-user-ID root **
*****************************************************

sendmail needs to run as root for several purposes:

- bind to port 25
- call the local delivery agent (LDA) as root (or other user) if the LDA
  isn't set-user-ID root (unless some other method of storing e-mail in
  local mailboxes is used).
- read .forward files
- write e-mail submitted via the command line to the queue directory.

Only the last item requires a set-user-ID/set-group-ID program to
avoid problems with a world-writable directory.  It is however
sufficient to have a set-group-ID program and a group-writable
queue directory.  The other requirements listed above can be
fulfilled by a sendmail daemon that is started by root.  Hence this
section explains how to use two sendmail configurations to accomplish
the goal to have a sendmail binary that is not set-user-ID root,
and hence is not open to system configuration/OS problems or at
least less problematic in presence of those.

The default configuration starting with sendmail 8.12 uses one
sendmail binary which acts differently based on operation mode and
supplied options.

sendmail must be a set-group-ID (default group: smmsp, recommended
gid: 25) program to allow for queueing mail in a group-writable
directory.  Two .cf files are required:  sendmail.cf for the daemon
and submit.cf for the submission program.  The following permissions
should be used:

-r-xr-sr-x      root   smmsp    ... /PATH/TO/sendmail
drwxrwx---      smmsp  smmsp    ... /var/spool/clientmqueue
drwx------      root   wheel    ... /var/spool/mqueue
-r--r--r--      root   wheel    ... /etc/mail/sendmail.cf
-r--r--r--      root   wheel    ... /etc/mail/submit.cf

[Notice: On some OS "wheel" is not used but "bin" or "root" instead,
however, this is not important here.]

That is, the owner of sendmail is root, the group is smmsp, and
the binary is set-group-ID.  The client mail queue is owned by
smmsp with group smmsp and is group writable.  The client mail
queue directory must be writable by smmsp, but it must not be
accessible for others. That is, do not use world read or execute
permissions.  In submit.cf the option UseMSP must be set, and
QueueFileMode must be set to 0660.  submit.cf is available in
cf/cf/, which has been built from cf/cf/submit.mc.  The file can
be used as-is, if you want to add more options, use cf/cf/submit.mc
as starting point and read cf/README:  MESSAGE SUBMISSION PROGRAM
carefully.

The .cf file is chosen based on the operation mode.  For -bm (default),
-bs, and -t it is submit.cf (if it exists) for all others it is
sendmail.cf.  This selection can be changed by -Ac or -Am (alternative
.cf file: client or mta).

The daemon must be started by root as usual, e.g.,

/PATH/TO/sendmail -L sm-mta -bd -q1h

(replace /PATH/TO with the right path for your OS, e.g.,
/usr/sbin or /usr/lib).

Notice: if you run sendmail from inetd (which in general is not a
good idea), you must specify -Am in addition to -bs.

Mail will end up in the client queue if the daemon doesn't accept
connections or if an address is temporarily not resolvable.  The
latter problem can be minimized by using

        FEATURE(`nocanonify', `canonify_hosts')
        define(`confDIRECT_SUBMISSION_MODIFIERS', `C')

which, however, may have undesired side effects.  See cf/README for
a discussion.  In general it is necessary to clean the queue either
via a cronjob or by running a daemon, e.g.,

/PATH/TO/sendmail -L sm-msp-queue -Ac -q30m

If the option UseMSP is not set, sendmail will complain during
queue runs about bogus file permission.  If you want a queue runner
for the client queue, you probably have to change OS specific
scripts to accomplish this (check the man pages of your OS for more
information.)  You can start this program as root, it will change
its user id to RunAsUser (smmsp by default, recommended uid: 25).
This way smmsp does not need a valid shell.

Summary
-------

This is a brief summary how the two configuration files are used:

sendmail.cf     For the MTA (mail transmission agent)
        The MTA is started by root as daemon:

                /PATH/TO/sendmail -L sm-mta -bd -q1h

        it accepts SMTP connections (on ports 25 and 587 by default);
        it runs the main queue (/var/spool/mqueue by default).

submit.cf       For the MSP (mail submission program)
        The MSP is used to submit e-mails, hence it is invoked
        by programs (and maybe users); it does not run as SMTP
        daemon; it uses /var/spool/clientmqueue by default; it
        can be started to run that queue periodically:

                /PATH/TO/sendmail -L sm-msp-queue -Ac -q30m


Hints and Troubleshooting
-------------------------

RunAsUser: FEATURE(`msp') sets the option RunAsUser to smmsp.
This user must have the group smmsp, i.e., the same group as the
clientmqueue directory.  If you specify a user whose primary group
is not the same as that of the clientmqueue directory, then you
should explicitly set the group, e.g.,

        FEATURE(`msp')
        define(`confRUN_AS_USER', `mailmsp:smmsp')

STARTTLS: If sendmail is compiled with STARTTLS support on a platform
that does not have HASURANDOMDEV defined, you either need to specify
the RandFile option (as for the MTA), or you have to turn off
STARTTLS in the MSP, e.g.,

        DAEMON_OPTIONS(`Name=NoMTA, Addr=127.0.0.1, M=S')
        FEATURE(`msp')
        CLIENT_OPTIONS(`Family=inet, Address=0.0.0.0, M=S')

The first option is used to turn off STARTTLS when the MSP is
invoked with -bs as some MUAs do.


What doesn't work anymore
-------------------------

Normal users can't use mailq anymore to see the MTA mail queue.
There are several ways around it, e.g., changing QueueFileMode
or giving users access via a program like sudo.

sendmail -bv may give misleading output for normal users since it
may not be able to access certain files, e.g., .forward files of
other users.

$ ls /usr/local/share/sendmail/cf/cf/submit*
/usr/local/share/sendmail/cf/cf/submit.cf
/usr/local/share/sendmail/cf/cf/submit.mc

$ wc -l /usr/local/share/sendmail/cf/feature/msp.m4
      78 /usr/local/share/sendmail/cf/feature/msp.m4

$ cat /usr/local/share/sendmail/cf/feature/msp.m4
divert(-1)
#
# Copyright (c) 2000-2002, 2004 Proofpoint, Inc. and its suppliers.
#       All rights reserved.
#
# By using this file, you agree to the terms and conditions set
# forth in the LICENSE file which can be found at the top level of
# the sendmail distribution.
#
#

divert(0)dnl
VERSIONID(`$Id: msp.m4,v 1.34 2013-11-22 20:51:11 ca Exp $')
divert(-1)
undefine(`ALIAS_FILE')
define(`confDELIVERY_MODE', `i')
define(`confUSE_MSP', `True')
define(`confFORWARD_PATH', `')
define(`confPRIVACY_FLAGS', `goaway,noetrn,restrictqrun')
define(`confDONT_PROBE_INTERFACES', `True')
dnl ---------------------------------------------
dnl run as this user (even if called by root)
ifdef(`confRUN_AS_USER',,`define(`confRUN_AS_USER', `smmsp')')
ifdef(`confTRUSTED_USER',,`define(`confTRUSTED_USER',
`ifelse(index(confRUN_AS_USER,`:'), -1, `confRUN_AS_USER',
`substr(confRUN_AS_USER,0,index(confRUN_AS_USER,`:'))')')')
dnl ---------------------------------------------
dnl This queue directory must have the same group
dnl as sendmail and it must be group-writable.
dnl notice: do not test for QUEUE_DIR, it is set in some ostype/*.m4 files
ifdef(`MSP_QUEUE_DIR',
`define(`QUEUE_DIR', `MSP_QUEUE_DIR')',
`define(`QUEUE_DIR', `/var/spool/clientmqueue')')
define(`_MTA_HOST_', ifelse(defn(`_ARG_'), `', `[localhost]', `_ARG_'))
define(`_MSP_FQHN_',`dnl used to qualify addresses
ifdef(`MASQUERADE_NAME', ifdef(`_MASQUERADE_ENVELOPE_', `$M', `$j'), `$j')')
ifelse(_ARG2_, `MSA', `define(`RELAY_MAILER_ARGS', `TCP $h 587')')
dnl ---------------------------------------------
ifdef(`confPID_FILE', `dnl',
`define(`confPID_FILE', QUEUE_DIR`/sm-client.pid')')
define(`confQUEUE_FILE_MODE', `0660')dnl
ifdef(`STATUS_FILE',
`define(`_F_',
`define(`_b_', index(STATUS_FILE, `sendmail.st'))ifelse(_b_, `-1', `STATUS_FILE', `substr(STATUS_FILE, 0, _b_)sm-client.st')')
define(`STATUS_FILE', _F_)
undefine(`_b_') undefine(`_F_')',
`define(`STATUS_FILE', QUEUE_DIR`/sm-client.st')')
FEATURE(`no_default_msa')dnl
ifelse(defn(`_DPO_'), `',
`DAEMON_OPTIONS(`Name=NoMTA, Addr=127.0.0.1, M=E')dnl')
define(`_DEF_LOCAL_MAILER_FLAGS', `')dnl
define(`_DEF_LOCAL_SHELL_FLAGS', `')dnl
define(`LOCAL_MAILER_PATH', `[IPC]')dnl
define(`LOCAL_MAILER_FLAGS', `lmDFMuXkw5')dnl
define(`LOCAL_MAILER_ARGS', `TCP $h')dnl
define(`LOCAL_MAILER_DSN_DIAGNOSTIC_CODE', `SMTP')dnl
define(`LOCAL_SHELL_PATH', `[IPC]')dnl
define(`LOCAL_SHELL_FLAGS', `lmDFMuXk5')dnl
define(`LOCAL_SHELL_ARGS', `TCP $h')dnl
MODIFY_MAILER_FLAGS(`SMTP', `+k5')dnl
MODIFY_MAILER_FLAGS(`ESMTP', `+k5')dnl
MODIFY_MAILER_FLAGS(`DSMTP', `+k5')dnl
MODIFY_MAILER_FLAGS(`SMTP8', `+k5')dnl
MODIFY_MAILER_FLAGS(`RELAY', `+k')dnl
MAILER(`local')dnl
MAILER(`smtp')dnl

LOCAL_CONFIG
D{MTAHost}_MTA_HOST_

LOCAL_RULESETS
SLocal_localaddr
R$+                     $: $>ParseRecipient $1
R$* < @ $+ > $*         $#relay $@ ${MTAHost} $: $1 < @ $2 > $3
ifdef(`_USE_DECNET_SYNTAX_',
`# DECnet
R$+ :: $+               $#relay $@ ${MTAHost} $: $1 :: $2', `dnl')
R$*                     $#relay $@ ${MTAHost} $: $1 < @ _MSP_FQHN_ >

$ grep sendmail /etc/defaults/rc.conf
mta_start_script="/etc/rc.sendmail"
# Settings for /etc/rc.sendmail and /etc/rc.d/sendmail:
sendmail_enable="NO"    # Run the sendmail inbound daemon (YES/NO).
sendmail_pidfile="/var/run/sendmail.pid"        # sendmail pid file
sendmail_procname="/usr/sbin/sendmail"          # sendmail process name
sendmail_flags="-L sm-mta -bd -q30m" # Flags to sendmail (as a server)
sendmail_cert_create="YES"      # Create a server certificate if none (YES/NO)
#sendmail_cert_cn="CN"          # CN of the generate certificate
sendmail_submit_enable="YES"    # Start a localhost-only MTA for mail submission
sendmail_submit_flags="-L sm-mta -bd -q30m -ODaemonPortOptions=Addr=localhost"
sendmail_outbound_enable="YES"  # Dequeue stuck mail (YES/NO).
sendmail_outbound_flags="-L sm-queue -q30m" # Flags to sendmail (outbound only)
sendmail_msp_queue_enable="YES" # Dequeue stuck clientmqueue mail (YES/NO).
sendmail_msp_queue_flags="-L sm-msp-queue -Ac -q30m"
                                # Flags for sendmail_msp_queue daemon.
sendmail_rebuild_aliases="NO"   # Run newaliases if necessary (YES/NO).

# The sendmail binary
sendmail_program=${sendmail_program:-/usr/sbin/sendmail}

$ /usr/sbin/sendmail -bt -d0 < /dev/null 
Version 8.17.1
 Compiled with: DANE DNSMAP IPV6_FULL LOG MAP_REGEX MATCHGECOS MILTER
                MIME7TO8 MIME8TO7 NAMED_BIND NETINET NETINET6 NETUNIX NEWDB NIS
                PICKY_HELO_CHECK PIPELINING SASLv2 SCANF STARTTLS TCPWRAPPERS
                TLS_EC TLS_VRFY_PER_CTX USERDB XDEBUG
[ . . . ]

# The pid is used to stop and restart the running daemon(s).
sendmail_pidfile=${sendmail_pidfile:-/var/run/sendmail.pid}
sendmail_mspq_pidfile=${sendmail_mspq_pidfile:-/var/spool/clientmqueue/sm-client.pid}

$ sudo service sendmail status
Password:
sendmail is running as pid 45131.
sendmail_msp_queue is running as pid 45134.

$ sudo cat /var/run/sendmail.pid
45131
/usr/sbin/sendmail -L sm-mta -bd -q30m

$ sudo cat /var/spool/clientmqueue/sm-client.pid
45134
/usr/sbin/sendmail -L sm-msp-queue -Ac -q30m

start_mta()
{
  case ${sendmail_enable} in
    [Yy][Ee][Ss])
      echo -n ' sendmail'
        ${sendmail_program} ${sendmail_flags}

[ . . . ] 
  case ${sendmail_outbound_enable} in
    [Yy][Ee][Ss])
      echo -n ' sendmail-outbound'

[ . . . ]

$ grep sendmail_flags /etc/defaults/rc.conf
sendmail_flags="-L sm-mta -bd -q30m" # Flags to sendmail (as a server)

$ grep sendmail_outbound_flags /etc/defaults/rc.conf
sendmail_outbound_flags="-L sm-queue -q30m" # Flags to sendmail (outbound only)

start_mspq()

  case ${sendmail_enable} in
    [Nn][Oo][Nn][Ee])
      ;;
  *)
    if [ -r /etc/mail/submit.cf ]; then
      case ${sendmail_msp_queue_enable} in
        [Yy][Ee][Ss])
          echo -n ' sendmail-clientmqueue'
            ${sendmail_program} ${sendmail_msp_queue_flags}
            ;;
        esac
    fi
    ;;
  esac
}

$ grep sendmail_msp_queue_flags /etc/defaults/rc.conf
sendmail_msp_queue_flags="-L sm-msp-queue -Ac -q30m"

# If no argument is given, assume we are being called at boot time.
_action=${1:-start}

case ${_action} in
start)
        start_mta
        start_mspq
        ;;

[ . . . ]

  echo "usage: `basename $0` {start|stop|restart}" >&2
  echo "       `basename $0` {start-mta|stop-mta|restart-mta}" >&2
  echo "       `basename $0` {start-mspq|stop-mspq|restart-mspq}" >&2

$ ls -lh /etc/rc.sendmail
-rw-r--r--  1 root  wheel   5.6K Aug 17  2021 /etc/rc.sendmail
 
$ /etc/rc.sendmail
/etc/rc.sendmail: Permission denied.
 
$ sudo /etc/rc.sendmail
sudo: /etc/rc.sendmail: command not found

$ sudo sh /etc/rc.sendmail
 sendmail sendmail-clientmqueue$ 

$ sudo sh /etc/rc.sendmail status
usage: rc.sendmail {start|stop|restart}
       rc.sendmail {start-mta|stop-mta|restart-mta}
       rc.sendmail {start-mspq|stop-mspq|restart-mspq}

$ sudo service sendmail stop

$ ps aux | grep -v grep | grep sendmail

$ sudo service sendmail start
Starting sendmail.
Starting sendmail_msp_queue.

$ ps aux | grep -v grep | grep sendmail
root      495   0.0  0.0    18976    8264  -  Ss   11:41        0:00.00 sendmail: accepting connections (sendmail)
smmsp     499   0.0  0.0    18316    7276  -  Is   11:41        0:00.00 sendmail: Queue runner@00:30:00 for /var/spool/clientmqueue (sendmail)

$ date
Thu 24 Nov 2022 11:41:33 PST

$ ls -lh /var/run/sendmail.pid 
-rw-------  1 root  wheel    43B Nov 24 11:41 /var/run/sendmail.pid

$ sudo cat /var/run/sendmail.pid
495
/usr/sbin/sendmail -L sm-mta -bd -q30m

$ sudo ls -lh /var/spool/clientmqueue/sm-client.pid
-rw-------  1 smmsp  smmsp    49B Nov 24 11:41 /var/spool/clientmqueue/sm-client.pid

$ sudo cat /var/spool/clientmqueue/sm-client.pid
499
/usr/sbin/sendmail -L sm-msp-queue -Ac -q30m

$ tail /var/log/maillog
[ . . . ]
Nov 24 11:41:28 fbsd1 sm-mta[495]: starting daemon (8.17.1): SMTP+queueing@00:30:00
[ . . . ]
Nov 24 11:41:28 fbsd1 sm-mta[495]: STARTTLS=server, init=1
Nov 24 11:41:28 fbsd1 sm-mta[495]: started as: /usr/sbin/sendmail -L sm-mta -bd -q30m
Nov 24 11:41:28 fbsd1 sm-msp-queue[499]: starting daemon (8.17.1): queueing@00:30:00
Nov 24 11:41:28 fbsd1 sm-msp-queue[499]: started as: /usr/sbin/sendmail -L sm-msp-queue -Ac -q30m

$ sudo service sendmail stop

$ date
Thu 24 Nov 2022 12:07:11 PST

$ tail /var/log/maillog
[ . . . ]
Nov 24 12:07:02 fbsd1 sm-mta[495]: NOQUEUE: stopping daemon, reason=signal
Nov 24 12:07:02 fbsd1 sm-msp-queue[499]: 2AOJfSZ7000498: stopping daemon, reason=signal

$ ls -lh /etc/rc.d/sendmail
-r-xr-xr-x  1 root  wheel   6.4K Aug 17  2021 /etc/rc.d/sendmail

$ /etc/rc.d/sendmail
Usage: /etc/rc.d/sendmail [fast|force|one|quiet](start|stop|restart|rcvar|enable|disable|delete|enabled|describe|extracommands|status|poll)

$ /etc/rc.d/sendmail status
sendmail is not running.
sendmail_msp_queue is not running.

$ /etc/rc.d/sendmail describe
Electronic mail transport agent
Electronic mail transport agent

$ /etc/rc.d/sendmail start
Starting sendmail.
limits: setrlimit datasize: Operation not permitted
/etc/rc.d/sendmail: WARNING: failed to start sendmail
Starting sendmail_msp_queue.
limits: setrlimit datasize: Operation not permitted
/etc/rc.d/sendmail: WARNING: failed to start sendmail_msp_queue

$ sudo /etc/rc.d/sendmail start
Password:
Starting sendmail.
Starting sendmail_msp_queue.

$ sudo /etc/rc.d/sendmail status
sendmail is running as pid 3527.
sendmail_msp_queue is running as pid 3531.

$ date
Thu 24 Nov 2022 12:36:18 PST

$ ps aux | grep -v grep | grep sendmail
root     3527   0.0  0.0    18976    8268  -  Ss   12:36        0:00.00 sendmail: accepting connections (sendmail)
smmsp    3531   0.0  0.0    18316    7284  -  Is   12:36        0:00.00 sendmail: Queue runner@00:30:00 for /var/spool/clientmqueue (sendmail)

$ ls -lh /var/run/sendmail.pid
-rw-------  1 root  wheel    44B Nov 24 12:36 /var/run/sendmail.pid

$ sudo cat /var/run/sendmail.pid
3527
/usr/sbin/sendmail -L sm-mta -bd -q30m

$ sudo ls -lh /var/spool/clientmqueue/sm-client.pid
-rw-------  1 smmsp  smmsp    50B Nov 24 12:36 /var/spool/clientmqueue/sm-client.pid

$ sudo cat /var/spool/clientmqueue/sm-client.pid
3531
/usr/sbin/sendmail -L sm-msp-queue -Ac -q30m

$ command -v dtrace ; type dtrace ; which dtrace ; whereis dtrace
/usr/sbin/dtrace
dtrace is /usr/sbin/dtrace
/usr/sbin/dtrace
dtrace: /usr/sbin/dtrace /usr/share/man/man1/dtrace.1.gz

$ pkg info --regex dtrace

$ pkg search --regex ^dtrace
dtrace-toolkit-1.0_7           Collection of useful scripts for DTrace

$ sudo pkg install dtrace-toolkit  
[ . . . ]
=====
Message from dtrace-toolkit-1.0_7:

--
Many of the DTraceToolkit scripts do not work on FreeBSD at the moment,
usually because:
- They are using Solaris-specific features
- They use probes which are not supported yet on FreeBSD

Some popular scripts are installed at:

    /usr/local/bin

The rest of the scripts and other toolkit files can be found in:

    /usr/local/share/dtrace-toolkit

To view the manual pages in the "1m" manual section,
the section has to be specified explicitly, e.g.:

    man -s 1m fddist

$ find /usr/local/bin/ -name '*dtrace*'

$ find /usr/local/bin/ -lname '*dtrace*'
/usr/local/bin/opensnoop
/usr/local/bin/dtruss
/usr/local/bin/hotkernel
/usr/local/bin/procsystime
/usr/local/bin/shellsnoop

$ stat -f "%N: %HT%SY" /usr/local/bin/* | grep dtrace
/usr/local/bin/dtruss: Symbolic Link -> ../share/dtrace-toolkit/dtruss
/usr/local/bin/hotkernel: Symbolic Link -> ../share/dtrace-toolkit/hotkernel
/usr/local/bin/opensnoop: Symbolic Link -> ../share/dtrace-toolkit/opensnoop
/usr/local/bin/procsystime: Symbolic Link -> ../share/dtrace-toolkit/procsystime
/usr/local/bin/shellsnoop: Symbolic Link -> ../share/dtrace-toolkit/Apps/shellsnoop

$ ls -F /usr/local/share/dtrace-toolkit/
Apps/           errinfo*        iosnoop*        Notes/          rwtop*
Bin/            Examples/       iotop*          opensnoop*      Shell/
CDDL@           execsnoop*      Java/           Perl/           Snippits/
Code/           FS/             JavaScript/     Php/            statsnoop*
Cpu/            Guide           Kernel/         Proc/           System/
dexplorer*      hotkernel*      Locks/          procsystime*    Tcl/
Disk/           hotuser*        Man/            Python/         User/
Docs/           Include/        Mem/            README.md       Version
dtruss*         install*        Misc/           Ruby/           Zones/
dvmstat*        iopattern*      Net/            rwsnoop*

$ sudo /usr/local/share/dtrace-toolkit/FS/vfssnoop.d > /tmp/vfssnoopout.txt

$ printf %s\\n "Testing." | mail -v -s "Test" dusko
dusko... Connecting to [127.0.0.1] via relay...
220 fbsd1.home.arpa ESMTP Sendmail 8.17.1/8.17.1; Thu, 24 Nov 2022 20:27:30 -0800 (PST)
>>> EHLO fbsd1.home.arpa
250-fbsd1.home.arpa Hello localhost [127.0.0.1], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE
250-DSN
250-STARTTLS
250-DELIVERBY
250 HELP
>>> STARTTLS
220 2.0.0 Ready to start TLS
>>> EHLO fbsd1.home.arpa
250-fbsd1.home.arpa Hello localhost [127.0.0.1], pleased to meet you
250-ENHANCEDSTATUSCODES
250-PIPELINING
250-8BITMIME
250-SIZE
250-DSN
250-DELIVERBY
250 HELP
>>> MAIL From:<dusko@fbsd1.home.arpa> SIZE=34
250 2.1.0 <dusko@fbsd1.home.arpa>... Sender ok
>>> RCPT To:<dusko@fbsd1.home.arpa>
>>> DATA
250 2.1.5 <dusko@fbsd1.home.arpa>... Recipient ok
354 Enter mail, end with "." on a line by itself
>>> .
250 2.0.0 2AP4RUKS027991 Message accepted for delivery
dusko... Sent (2AP4RUKS027991 Message accepted for delivery)
Closing connection to [127.0.0.1]
>>> QUIT
221 2.0.0 fbsd1.home.arpa closing connection

$ sudo /usr/local/share/dtrace-toolkit/FS/vfssnoop.d > /tmp/vfssnoopout.txt
^C

TIMESTAMP           UID    PID PROCESS          CALL             SIZE PATH/FILE

 UID    PID PROCESS       CALL             SIZE PATH/FILE

1001  27989 tcsh          vop_open         - /usr/bin/mail
1001  27989 mail          vop_close        - /usr/bin/mail

1001  27989 mail          vop_open         - /etc/mail.rc
1001  27989 mail          vop_read        4K /etc/mail.rc
1001  27989 mail          vop_close        - /etc/mail.rc

1001  27989 mail          vop_open         - /usr/home/dusko/.mailrc
1001  27989 mail          vop_open         - /usr/home/dusko/.mail_aliases
1001  27989 mail          vop_read        4K /usr/home/dusko/.mail_aliases
1001  27989 mail          vop_close        - /usr/home/dusko/.mail_aliases
1001  27989 mail          vop_close        - /usr/home/dusko/.mailrc

1001  27989 mail          vop_create       - /tmp/mail.RsH2UdGjzkoo
1001  27989 mail          vop_open         - /tmp/<unknown>
1001  27989 mail          vop_getattr      - /tmp/mail.RsH2UdGjzkoo
1001  27989 mail          vop_remove       - /tmp/mail.RsH2UdGjzkoo

1001  27989 mail          vop_create       - /tmp/mail.RstbRvvCU6oB
1001  27989 mail          vop_open         - /tmp/<unknown>
1001  27989 mail          vop_open         - /tmp/mail.RstbRvvCU6oB
1001  27989 mail          vop_remove       - /tmp/mail.RstbRvvCU6oB

1001  27990 mail          vop_open         - /usr/sbin/mailwrapper
1001  27990 mailwrapper   vop_close        - /usr/sbin/mailwrapper

1001  27990 mailwrapper   vop_open         - /usr/local/etc/mail/mailer.conf

1001  27990 mailwrapper   vop_open         - /usr/local/sbin/sendmail
1001  27990 sendmail      vop_close        - /usr/local/sbin/sendmail

1001  27990 sendmail      vop_open         - /etc/libmap.conf
1001  27990 sendmail      vop_getattr      - /etc/libmap.conf
1001  27990 sendmail      vop_read       47B /etc/libmap.conf
1001  27990 sendmail      vop_close        - /etc/libmap.conf

1001  27990 sendmail      vop_open         - /usr/local/etc/libmap.d
[...]
1001  27990 sendmail      vop_close        - /usr/local/etc/libmap.d

1001  27990 sendmail      vop_open         - /usr/local/etc/libmap.d/mesa.conf
[...]
1001  27990 sendmail      vop_close        - /usr/local/etc/libmap.d/mesa.conf

1001  27990 sendmail      vop_open         - /var/run/ld-elf.so.hints
[...]
1001  27990 sendmail      vop_close        - /var/run/ld-elf.so.hints

1001  27990 sendmail      vop_open         - /usr/lib/libwrap.so.6
[...]
1001  27990 sendmail      vop_close        - /usr/lib/libwrap.so.6

1001  27990 sendmail      vop_open         - /usr/local/lib/libsasl2.so.3.0.0
[...]
1001  27990 sendmail      vop_close        - /usr/local/lib/libsasl2.so.3.0.0

1001  27990 sendmail      vop_open         - /usr/lib/libblacklist.so.0
[...]
1001  27990 sendmail      vop_close        - /usr/lib/libblacklist.so.0

1001  27990 sendmail      vop_open         - /usr/lib/libssl.so.111
[...]
1001  27990 sendmail      vop_close        - /usr/lib/libssl.so.111

1001  27990 sendmail      vop_open         - /lib/libcrypto.so.111
[...]
1001  27990 sendmail      vop_close        - /lib/libcrypto.so.111

1001  27990 sendmail      vop_open         - /lib/libutil.so.9
[...] 
1001  27990 sendmail      vop_close        - /lib/libutil.so.9

1001  27990 sendmail      vop_open         - /lib/libc.so.7
[...]
1001  27990 sendmail      vop_close        - /lib/libc.so.7

1001  27990 sendmail      vop_open         - /usr/lib/libdl.so.1
[...]
1001  27990 sendmail      vop_close        - /usr/lib/libdl.so.1

1001  27990 sendmail      vop_open         - /lib/libthr.so.3
[...]
1001  27990 sendmail      vop_close        - /lib/libthr.so.3

1001  27990 sendmail      vop_getattr      - /tmp/<unknown>
1001  27990 sendmail      vop_getattr      - /dev/<unknown>

1001  27990 sendmail      vop_open         - /etc/nsswitch.conf
[...]

1001  27990 sendmail      vop_open         - /etc/pwd.db
[...]
1001  27990 sendmail      vop_close        - /etc/pwd.db

1001  27990 sendmail      vop_open         - /etc/resolv.conf
[...]
1001  27990 sendmail      vop_close        - /etc/resolv.conf

1001  27990 sendmail      vop_open         - /etc/hosts
[...]
1001  27990 sendmail      vop_close        - /etc/hosts

                                           - /etc/localtime 
                                           - /usr/share/zoneinfo/posixrules
                                           - /usr/share/zoneinfo/UTC

1001  27990 sendmail      vop_open         - /etc/mail/submit.cf

1001  27990 sendmail      vop_open         - /etc/pwd.db
[...]
1001  27990 sendmail      vop_close        - /etc/pwd.db

1001  27990 sendmail      vop_read       41K /etc/mail/submit.cf
1001  27990 sendmail      vop_close        - /etc/mail/submit.cf

1001  27990 sendmail      vop_getattr      - /var/spool/clientmqueue

1001  27990 sendmail      vop_close        - /lib/libcrypto.so.111

   0    974 syslogd       vop_write      97B /var/log/debug.log

1001  27990 sendmail      vop_read      260B /etc/pwd.db
[...]
1001  27990 sendmail      vop_close        - /etc/pwd.db

1001  27990 sendmail      vop_create       - /var/spool/clientmqueue/df2AP4RU3I027990

1001  27990 sendmail      vop_create       - /var/spool/clientmqueue/qf2AP4RU3I027990

1001  27990 sendmail      vop_open         - /etc/services
[...]
1001  27990 sendmail      vop_close        - /etc/services

1001  27990 sendmail      vop_open         - /etc/hosts
[...]
1001  27990 sendmail      vop_open         - /etc/hosts

0       974 syslogd       vop_write      90B /var/log/maillog

0     27991 sendmail      vop_getattr      - /etc/resolv.conf

0     27991 sendmail      vop_open         - /etc/hosts
0     27991 sendmail      vop_read        4K /etc/hosts
[...]
0     27991 sendmail      vop_close        - /etc/hosts

0     27991 sendmail      vop_open         - /etc/services
[...]
0     27991 sendmail      vop_close        - /etc/services

0       974 syslogd       vop_write      81B /var/log/maillog

0     27991 sendmail      vop_open         - /etc/hosts.allow
[...]
0     27991 sendmail      vop_close        - /etc/hosts.allow

0       974 syslogd       vop_write      78B /var/log/maillog
[...]
[...]

1001  27990 sendmail      vop_open         - /etc/ssl/openssl.cnf
[...]
1001  27990 sendmail      vop_close        - /etc/ssl/openssl.cnf

1001  27990 sendmail      vop_open         - /usr/lib/libssl.so.111
1001  27990 sendmail      vop_getattr      - /usr/lib/libssl.so.111
1001  27990 sendmail      vop_close        - /usr/lib/libssl.so.111

   0    974 syslogd       vop_write      63B /var/log/maillog

   0    974 syslogd       vop_write      97B /var/log/debug.log

   0  27991 sendmail      vop_open         - /var/log/sendmail.st
[...]
   0  27991 sendmail      vop_close        - /var/log/sendmail.st

   0  27991 sendmail      vop_open         - /etc/spwd.db
[...]
   0  27991 sendmail      vop_close        - /etc/spwd.db

   0    974 syslogd       vop_write     106B /var/log/maillog
[...]
[...]

   0  27991 sendmail      vop_open         - /etc/mail/aliases.db
[...]
[...]

   0  27991 sendmail      vop_open         - /etc/spwd.db
[...]
   0  27991 sendmail      vop_close        - /etc/spwd.db

   0  27991 sendmail      vop_open         - /etc/shells
[...]
   0  27991 sendmail      vop_close        - /etc/shells

   0    974 syslogd       vop_write     109B /var/log/maillog
[...]
[...]

1001  27990 sendmail      vop_read        4K /var/spool/clientmqueue/df2AP4RU3I027990

   0    974 syslogd       vop_write      75B /var/log/maillog
[...]
[...]

   0  27991 sendmail      vop_create       - /var/spool/mqueue/df2AP4RUKS027991
[...]
   0  27991 sendmail      vop_close        - /var/spool/mqueue/df2AP4RUKS027991

   0  27991 sendmail      vop_create       - /var/spool/mqueue/qf2AP4RUKS027991

   0  27991 sendmail      vop_close        - /etc/mail/aliases.db

1001  27990 sendmail      vop_close        - /var/spool/clientmqueue/sm-client.st

1001  27990 sendmail      vop_close        - /var/spool/clientmqueue/df2AP4RU3I027990
1001  27990 sendmail      vop_remove       - /var/spool/clientmqueue/df2AP4RU3I027990

1001  27990 sendmail      vop_remove       - /var/spool/clientmqueue/qf2AP4RU3I027990

   0    974 syslogd       vop_write      73B /var/log/maillog

   0  27991 sendmail      vop_open         - /var/spool/mqueue/qf2AP4RUKS027991

   0  27992 sendmail      vop_open         - /var/spool/mqueue/qf2AP4RUKS027991

   0  27991 sendmail      vop_open         - /var/log/sendmail.st
[...]
   0  27991 sendmail      vop_close        - /var/log/sendmail.st

   0  27992 sendmail      vop_open         - /etc/spwd.db
[...]
   0  27992 sendmail      vop_close        - /etc/spwd.db

   0  27992 sendmail      vop_read      260B /etc/mail/aliases.db
[...]
   0  27992 sendmail      vop_read       32K /etc/mail/aliases.db

   0  27992 sendmail      vop_open         - /etc/spwd.db
[...]
   0  27992 sendmail      vop_close        - /etc/spwd.db

   0  27992 sendmail      vop_open         - /etc/shells
[...]
   0  27992 sendmail      vop_close        - /etc/shells

   0  27992 sendmail      vop_open         - /etc/group
[...]
   0  27992 sendmail      vop_close        - /etc/group

 1001 27992 sendmail      vop_getattr      - /usr/home/dusko

   0  27992 sendmail      vop_open         - /etc/group
[...]
   0  27992 sendmail      vop_close        - /etc/group

   0  27992 sendmail      vop_read        4K /var/spool/mqueue/qf2AP4RUKS027991

   0  27992 sendmail      vop_open         - /var/spool/mqueue/df2AP4RUKS027991

   0  27992 sendmail      vop_create       - /var/spool/mqueue/tf2AP4RUKS027991

   0  27993 sendmail      vop_getattr      - /usr/local/libexec/mail.local
   0  27993 sendmail      vop_open         - /usr/local/libexec/mail.local

   0  27993 sendmail      vop_open         - /libexec/ld-elf.so.1

   0  27993 mail.local    vop_close        - /usr/local/libexec/mail.local

   0  27993 mail.local    vop_open         - /etc/libmap.conf
[...]
   0  27993 mail.local    vop_close        - /etc/libmap.conf

   0  27993 mail.local    vop_open         - /usr/local/etc/libmap.d/mesa.conf
[...]
   0  27993 mail.local    vop_close        - /usr/local/etc/libmap.d/mesa.conf

   0  27993 mail.local    vop_open         - /var/run/ld-elf.so.hints
[...]
   0  27993 mail.local    vop_close        - /var/run/ld-elf.so.hints

   0  27993 mail.local    vop_open         - /lib/libutil.so.9
[...]
   0  27993 mail.local    vop_close        - /var/run/ld-elf.so.hints

   0  27993 mail.local    vop_open         - /lib/libutil.so.9
[...]
   0  27993 mail.local    vop_close        - /lib/libutil.so.9

   0  27993 mail.local    vop_open         - /lib/libc.so.7
[...]
   0  27993 mail.local    vop_close        - /lib/libc.so.7

   0  27993 mail.local    vop_open         - /etc/nsswitch.conf
[...]
   0  27993 mail.local    vop_close        - /etc/nsswitch.conf

   0  27993 mail.local    vop_open         - /etc/services
[...]
   0  27993 mail.local    vop_close        - /etc/services

   0  27993 mail.local    vop_open         - /etc/resolv.conf
[...]
   0  27993 mail.local    vop_close        - /etc/resolv.conf

   0  27993 mail.local    vop_open         - /etc/hosts
[...]
   0  27993 mail.local    vop_close        - /etc/hosts

   0  27993 mail.local    vop_open         - /etc/spwd.db
[...]
   0  27993 mail.local    vop_close        - /etc/spwd.db

   0  27993 mail.local    vop_create       - /tmp/local.0p2YZe
[...]
   0  27993 mail.local    vop_remove       - /tmp/local.0p2YZe

   0  27993 mail.local    vop_open         - /etc/localtime
[...]
[...]

   0  27992 sendmail      vop_getattr      - /var/spool/mqueue/df2AP4RUKS027991
   0  27993 mail.local    vop_close        - /var/spool/mqueue/df2AP4RUKS027991

   0  27992 sendmail      vop_read        4K /var/spool/mqueue/df2AP4RUKS027991

   0  27993 mail.local    vop_read       40K /usr/share/zoneinfo/posixrules
[...]
   0  27993 mail.local    vop_close        - /usr/share/zoneinfo/posixrules

   0  27993 mail.local    vop_open         - /etc/spwd.db
[...]
   0  27993 mail.local    vop_close        - /etc/spwd.db

   0  27993 mail.local    vop_create       - /var/mail/dusko.lock

1001  27993 mail.local    vop_open         - /var/mail/dusko
[...]
1001  27993 mail.local    vop_write     761B /var/mail/dusko
[...]
1001  27993 mail.local    vop_close        - /var/mail/dusko

   0  27992 sendmail      vop_open         - /var/log/sendmail.st
[...]
   0  27992 sendmail      vop_close        - /var/log/sendmail.st

   0  27992 sendmail      vop_close        - /var/spool/mqueue/df2AP4RUKS027991
   0  27992 sendmail      vop_remove       - /var/spool/mqueue/df2AP4RUKS027991

   0  27992 sendmail      vop_remove       - /var/spool/mqueue/qf2AP4RUKS027991

   0  27992 sendmail      vop_close        - /<unknown>

   0    974 syslogd       vop_write      84B /var/log/
   0  27992 sendmail      vop_inactive     - /maillog
   0  27992 sendmail      vop_close        - /etc/mail/aliases.db
   0  27992 sendmail      vop_close        - /dev/<unknown>
   0  27992 sendmail      vop_close        - /dev/<unknown>

# dtrace -q -n 'syscall::open:entry { printf("%-16s %-16s\n",execname,copyinstr(arg0)); }'

# cat ip-tcp-udp-probes.d 
#!/usr/sbin/dtrace -s

#pragma D option quiet
#pragma D option switchrate=10Hz

dtrace:::BEGIN
{
    printf(" %30s %-6s %30s %-6s %-6s %s\n\n", "SADDR", "SPORT", "DADDR", "DPORT", "BYTES", "FLAGS");
}

tcp:::receive,
tcp:::send

{
    printf(" %30s %-6u %30s %-6u %-6u (%s%s%s%s%s%s\b)\n",
        args[2]->ip_saddr, args[4]->tcp_sport,
        args[2]->ip_daddr, args[4]->tcp_dport,
        args[2]->ip_plength - args[4]->tcp_offset,
        (args[4]->tcp_flags & TH_FIN) ? "FIN|" : "",
        (args[4]->tcp_flags & TH_SYN) ? "SYN|" : "",
        (args[4]->tcp_flags & TH_RST) ? "RST|" : "",
        (args[4]->tcp_flags & TH_PUSH) ? "PSH|" : "",
        (args[4]->tcp_flags & TH_ACK) ? "ACK|" : "",
        (args[4]->tcp_flags & TH_URG) ? "URG|" : "");
}

# chmod 0744 ip-tcp-udp-probes.d 

# ./ip-tcp-udp-probes.d > ipprobes.txt 

$ printf %s\\n "Hello" | mail -v -s "Test" dusko

# cat ipprobes.txt
                          SADDR SPORT                           DADDR DPORT  BYTES  FLAGS

                      127.0.0.1 39446                       127.0.0.1 25     38     (SYN|)
                      127.0.0.1 39446                       127.0.0.1 25     38     (SYN|)
                      127.0.0.1 25                          127.0.0.1 39446  38     (SYN|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  38     (SYN|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     30     (ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     30     (ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  121    (PSH|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  121    (PSH|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     54     (PSH|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     54     (PSH|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  215    (PSH|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  215    (PSH|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     40     (PSH|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     40     (PSH|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  60     (PSH|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  60     (PSH|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     319    (PSH|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     319    (PSH|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  2677   (PSH|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  2677   (PSH|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     140    (PSH|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     140    (PSH|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  285    (PSH|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  285    (PSH|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     76     (PSH|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     76     (PSH|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  285    (PSH|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  285    (PSH|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     30     (ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     30     (ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  223    (PSH|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  223    (PSH|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     97     (PSH|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     97     (PSH|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  102    (PSH|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  102    (PSH|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     93     (PSH|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     93     (PSH|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  155    (PSH|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  155    (PSH|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     423    (PSH|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     423    (PSH|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  30     (ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  30     (ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     55     (PSH|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     55     (PSH|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  108    (PSH|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  108    (PSH|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     58     (PSH|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     58     (PSH|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  100    (PSH|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  100    (PSH|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     30     (FIN|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     30     (FIN|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  54     (PSH|ACK|)
                      127.0.0.1 25                          127.0.0.1 39446  54     (PSH|ACK|)
                      127.0.0.1 39446                       127.0.0.1 25     19     (RST|)
                      127.0.0.1 39446                       127.0.0.1 25     19     (RST|)

$ nc testmx.host.domain 25
220 testmx.host.domain ESMTP mailer ready at Sun, 30 Oct 2022 15:01:48 -0700
helo my.host.domain
250 testmx.host.domain ESMTP mailer ready at Sun, 30 Oct 2022 15:01:48 -0700
Hello my.host.domain [123.45.67.8], pleased to meet you
ehlo my.host.domain
250-testmx.host.domain Hello my.host.domain [123.45.67.8], pleased to meet you
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-SIZE 52428800
250-STARTTLS
250-DELIVERBY
250 HELP
quit
221 2.0.0 testmx.host.domain closing connection

$ nc testmx.host.domain 25
220 testmx.host.domain ESMTP mailer ready at Sun, 30 Oct 2022 15:03:36 -0700
ehlo my.host.domain
250-testmx.host.domain Hello my.host.domain [123.45.67.8], pleased to meet you
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-SIZE 52428800
250-STARTTLS
250-DELIVERBY
250 HELP
AUTH LOGIN
503 5.3.3 AUTH not available
AUTH PLAIN
503 5.3.3 AUTH not available
AUTH
503 5.3.3 AUTH not available

quit
221 2.0.0 testmx.host.domain closing connection

$ openssl s_client -starttls smtp -ign_eof -crlf -connect testmx.host.domain:25 

CONNECTED(00000003)
depth=2 C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
verify return:1
depth=1 C = BE, O = GlobalSign nv-sa, CN = AlphaSSL CA - SHA256 - G2
verify return:1
depth=0 CN = *.host.domain
verify return:1
---
Certificate chain
 0 s:CN = *.host.domain
   i:C = BE, O = GlobalSign nv-sa, CN = AlphaSSL CA - SHA256 - G2
 1 s:C = BE, O = GlobalSign nv-sa, CN = AlphaSSL CA - SHA256 - G2
   i:C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIGOjCCBSKgAwIBAgIMMLyMRt1iOWV140T0MA0GCSqGSIb3DQEBCwUAMEwxCzAJ
[ . . . ]
YqHmWFAwYDjLKhyoU6w=
-----END CERTIFICATE-----
subject=CN = *.host.domain

issuer=C = BE, O = GlobalSign nv-sa, CN = AlphaSSL CA - SHA256 - G2

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA
Server Temp Key: DH, 1024 bits
---
SSL handshake has read 3992 bytes and written 542 bytes
Verification: OK
---
New, TLSv1.2, Cipher is DHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : DHE-RSA-AES256-GCM-SHA384
    Session-ID: E846518A07F0268F5A050119C0BE69CAA5D3FE6F2CE1027B5CA75AEF38BF4956
    Session-ID-ctx: 
    Master-Key: 769E3781160E13E[ . . . ]
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 1 (seconds)
    TLS session ticket:
    0000 - 7c ac ce 3e e4 ab d9 b1-fe 5f 1b c4 89 32 74 1d   |..>....._...2t.
    0010 - [ . . . ]
    0020 - [ . . . ]
    0030 - [ . . . ]
    0040 - [ . . . ]
    0050 - [ . . . ]
    0060 - [ . . . ]
    0070 - [ . . . ]
    0080 - [ . . . ]
    0090 - [ . . . ]
    00a0 - [ . . . ]
    00b0 - [ . . . ]

    Start Time: 1667166567
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
---
250 HELP
ehlo my.host.domain 
250-testmx.host.domain Hello my.host.domain [123.45.67.8], pleased to meet you
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-SIZE 52428800
250-DELIVERBY
250 HELP
MAIL From:<dusko@my.host.domain>
250 2.1.0 <dusko@my.host.domain>... Sender ok
RCPT To:<dusko@testmx.host.domain> 
250 2.1.5 <dusko@testmx.host.domain>... Recipient ok 
data
354 Enter mail, end with "." on a line by itself
From: Myname <dusko@my.host.domain>
To: <dusko@testmx.host.domain> Firstname Lastname 
Subject: Testing SMTP over TLS on port 25

Testing.
.
250 2.0.0 29ULnMCa012594 Message accepted for delivery
QUIT
221 2.0.0 testmx.host.domain closing connection
closed

# grep 29ULnMCa012594 /var/log/maillog 
Oct 30 17:00:48 testmx sendmail[30004]: 29ULnMCa012594: from=<dusko@my.host.domain>, size=110, class=0, nrcpts=1, msgid=<202210302359.29ULnMCa012594@testmx.host.domain>, proto=ESMTP, daemon=MTA, relay=my.host.domain [123.45.67.8]
Oct 30 17:00:49 testmx sendmail[30279]: 29ULnMCa012594: to=<dusko@testmx.host.domain>, delay=00:00:56, xdelay=00:00:01, mailer=local, pri=30490, dsn=2.0.0, stat=Sent
Oct 30 17:00:49 testmx sendmail[30279]: 29ULnMCa012594: done; delay=00:00:56, ntries=1

$ openssl s_client -starttls smtp -ign_eof -crlf -connect testmx.host.domain:25 
[ . . . ]
[ . . . ]
---
250 HELP
ehlo ehlo my.host.domain  
250-testmx.host.domain Hello my.host.domain [123.45.67.8], pleased to meet you
250-ENHANCEDSTATUSCODES
250-8BITMIME
250-SIZE 52428800
250-DELIVERBY
250 HELP
MAIL From:<dusko@non.existing.domain>
250 2.1.0 <dusko@non.existing.domain>... Sender ok
RCPT To:<dusko@testmx.host.domain> 
553 5.1.8 <dusko@testmx.host.domain>... Domain of sender address dusko@non.existing.domain does not exist
QUIT
221 2.0.0 testmx.host.domain closing connection 
closed

$ perl -MMIME::Base64 -le 'print decode_base64("VXNlcm5hbWU6");'
Username:
 
$ perl -MMIME::Base64 -le 'print decode_base64("UGFzc3dvcmQ6");'
Password:

$ perl -MMIME::Base64 -le 'print encode_base64("\000myusername\000MyPassword");'
AG15dXNlcm5hbWUATXlQYXNzd29yZA==

$ perl -MMIME::Base64 -le 'print decode_base64("AG15dXNlcm5hbWUATXlQYXNzd29yZA==");'
myusernameMyPassword

$ perl -MMIME::Base64 -le 'print encode_base64("myusername");'
bXl1c2VybmFtZQ==

$ perl -MMIME::Base64 -le 'print encode_base64("MyPassword");'
TXlQYXNzd29yZA==

$ perl -MMIME::Base64 -le 'print decode_base64("bXl1c2VybmFtZQ==");'
myusername
 
$ perl -MMIME::Base64 -le 'print decode_base64("TXlQYXNzd29yZA==");'
MyPassword

root@fbsd1:/etc/mail # sendmail -bt
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>

> ?
Help for test mode:
?                :this help message.
.Dmvalue         :define macro `m' to `value'.
.Ccvalue         :add `value' to class `c'.
=Sruleset        :dump the contents of the indicated ruleset.
=M               :display the known mailers.
-ddebug-spec     :equivalent to the command-line -d debug flag.
$m               :print the value of macro $m.
$=c              :print the contents of class $=c.
/mx host         :returns the MX records for `host'.
/parse address   :parse address, returning the value of crackaddr, and
                  the parsed address.
/try mailer addr :rewrite address into the form it will have when
                  presented to the indicated mailer.
/tryflags flags  :set flags used by parsing.  The flags can be `H' for
                  Header or `E' for Envelope, and `S' for Sender or `R'
                  for Recipient.  These can be combined, `HR' sets
                  flags for header recipients.
/canon hostname  :try to canonify hostname.
/map mapname key :look up `key' in the indicated `mapname'.
/quit            :quit address test mode.
rules addr       :run the indicated address through the named rules.
                  Rules can be a comma separated list of rules.
End of HELP info

# dtrace -n 'syscall::open*:entry { printf("%s %s", execname, copyinstr(arg0)); }'

# dtrace -l | sed 1d | awk '{print $2}' | sort -u

# dwatch -X open
[ . . . ]

dwatch -R syscall::read:entry
[ . . . ] 

# dwatch -X tcp-accept-established
INFO Sourcing tcp-accept-established profile [found in /usr/libexec/dwatch]
INFO Watching 'tcp:::accept-established' ...
2022 Nov 26 15:16:50 0.0 intr[12]: 127.0.0.1:25 <- 127.0.0.1:19231
^C

# dwatch -X tcp-connect-established
INFO Sourcing tcp-connect-established profile [found in /usr/libexec/dwatch]
INFO Watching 'tcp:::connect-established' ...
2022 Nov 26 15:18:10 0.0 intr[12]: 127.0.0.1:13729 -> 127.0.0.1:25
^C

# dwatch -X tcp-send
[ . . . ]

# dwatch -X tcp-receive
[ . . . ]

# dwatch -X tcp -- -c 'mail -v -s "Test" dusko'
[ . . . ]

# dwatch -X vop_lookup
INFO Sourcing vop_lookup profile [found in /usr/libexec/dwatch]
INFO Watching 'vfs:vop:vop_lookup:entry' ...
2022 Nov 26 19:02:44 1001.1001 mail[70112]: /tmp/mail.RsW228Y8ZvvR
2022 Nov 26 19:02:44 1001.1001 mail[70112]: /tmp/mail.RsW228Y8ZvvR
2022 Nov 26 19:02:44 1001.1001 mail[70112]: /tmp/mail.RsW228Y8ZvvR
2022 Nov 26 19:02:44 1001.1001 mail[70112]: /tmp/mail.RsylzXOLZtiD
2022 Nov 26 19:02:44 1001.1001 mail[70112]: /tmp/mail.RsylzXOLZtiD
2022 Nov 26 19:02:44 1001.1001 mail[70112]: /tmp/mail.RsylzXOLZtiD
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/.
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/ 
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/.
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/.
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/qf
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/df
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/xf
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/.
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/./xf2AR32ig9070113
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/xf2AR32ig9070113
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/.
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/./df2AR32ig9070113
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/df2AR32ig9070113
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/./df2AR32ig9070113
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/df2AR32ig9070113
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/./df2AR32ig9070113
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/df2AR32ig9070113
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/.
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/.
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/./df2AR32ig9070113
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/df2AR32ig9070113
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/./df2AR32ig9070113
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/df2AR32ig9070113
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/./qf2AR32ig9070113
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/qf2AR32ig9070113
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /dev/crypto
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /dev/crypto
2022 Nov 26 19:02:44 0.0 sendmail[70114]: /var/spool/mqueue/df2AR32ii1070114
2022 Nov 26 19:02:44 0.0 sendmail[70114]: /var/spool/mqueue/qf2AR32ii1070114
2022 Nov 26 19:02:44 0.0 sendmail[70114]: /var/spool/mqueue/xf2AR32ii1070114
2022 Nov 26 19:02:44 0.0 sendmail[70114]: /var/spool/mqueue/xf2AR32ii2070114
2022 Nov 26 19:02:44 0.0 sendmail[70114]: /var/spool/mqueue/df2AR32ii2070114
2022 Nov 26 19:02:44 0.0 sendmail[70114]: /var/spool/mqueue/df2AR32ii2070114
2022 Nov 26 19:02:44 0.0 sendmail[70114]: /var/spool/mqueue/df2AR32ii2070114
2022 Nov 26 19:02:44 0.0 sendmail[70114]: /var/spool/mqueue/qf2AR32ii2070114
2022 Nov 26 19:02:44 0.0 sendmail[70114]: /var/spool/mqueue/xf2AR32ii2070114
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/sm-client.st
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/sm-client.st
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/./df2AR32ig9070113
2022 Nov 26 19:02:44 0.0 sendmail[70115]: /dev/null
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/df2AR32ig9070113
2022 Nov 26 19:02:44 0.0 sendmail[70115]: /dev/null
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/./qf2AR32ig9070113
2022 Nov 26 19:02:44 0.0 sendmail[70115]: /dev/null
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/qf2AR32ig9070113
2022 Nov 26 19:02:44 0.0 sendmail[70115]: /dev/null
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/./xf2AR32ig9070113
2022 Nov 26 19:02:44 0.0 sendmail[70115]: /var/spool/mqueue/xf2AR32ii2070114
2022 Nov 26 19:02:44 1001.25 sendmail[70113]: /var/spool/clientmqueue/xf2AR32ig9070113
2022 Nov 26 19:02:44 0.0 sendmail[70115]: /var/spool/mqueue/qf2AR32ii2070114
2022 Nov 26 19:02:44 0.0 sendmail[70114]: /dev/null
2022 Nov 26 19:02:44 0.0 sendmail[70114]: /dev/null
2022 Nov 26 19:02:44 0.0 sendmail[70114]: /dev/null
2022 Nov 26 19:02:44 0.0 sendmail[70114]: /dev/null
2022 Nov 26 19:02:44 0.0 sendmail[70114]: /var/spool/mqueue/df2AR32ii3070114
2022 Nov 26 19:02:44 0.0 sendmail[70114]: /var/spool/mqueue/qf2AR32ii3070114
2022 Nov 26 19:02:44 0.0 sendmail[70114]: /var/spool/mqueue/xf2AR32ii3070114
2022 Nov 26 19:02:44 0.25 sendmail[70115]: /var/spool/mqueue/tf2AR32ii2070114
2022 Nov 26 19:02:44 0.25 sendmail[70115]: /var/spool/mqueue/tf2AR32ii2070114
2022 Nov 26 19:02:44 0.25 sendmail[70115]: /var/spool/mqueue/qf2AR32ii2070114
2022 Nov 26 19:02:44 0.0 mail.local[70116]: /tmp/local.HnQB1H
2022 Nov 26 19:02:44 0.0 mail.local[70116]: /tmp/local.HnQB1H
2022 Nov 26 19:02:44 0.0 mail.local[70116]: /var/mail/dusko.lock
2022 Nov 26 19:02:44 0.0 mail.local[70116]: /var/mail/dusko.lock
2022 Nov 26 19:02:44 0.25 sendmail[70115]: /var/spool/mqueue/df2AR32ii2070114
2022 Nov 26 19:02:44 0.25 sendmail[70115]: /var/spool/mqueue/qf2AR32ii2070114
2022 Nov 26 19:02:44 0.25 sendmail[70115]: /var/spool/mqueue/xf2AR32ii2070114
^C

# dwatch -X vop_create
INFO Sourcing vop_create profile [found in /usr/libexec/dwatch]
INFO Watching 'vfs:vop:vop_create:entry' ...
2022 Nov 26 19:09:14 1001.1001 mail[70625]: /tmp/mail.RshkOoUT6V9r
2022 Nov 26 19:09:14 1001.1001 mail[70625]: /tmp/mail.RsxKgOHLGsmf
2022 Nov 26 19:09:14 1001.25 sendmail[70626]: /var/spool/clientmqueue/df2AR39EnD070626
2022 Nov 26 19:09:14 1001.25 sendmail[70626]: /var/spool/clientmqueue/qf2AR39EnD070626
2022 Nov 26 19:09:14 0.0 sendmail[70627]: /var/spool/mqueue/df2AR39Elv070627
2022 Nov 26 19:09:14 0.0 sendmail[70627]: /var/spool/mqueue/qf2AR39Elv070627
2022 Nov 26 19:09:14 0.25 sendmail[70628]: /var/spool/mqueue/tf2AR39Elv070627
2022 Nov 26 19:09:14 0.0 mail.local[70629]: /tmp/local.5vsbk5
2022 Nov 26 19:09:14 0.0 mail.local[70629]: /var/mail/dusko.lock
^C

# dwatch -X vop_remove
[ . . . ]

# dwatch -X vop_readdir
[ . . . ]

# dwatch -X vop_rename
INFO Sourcing vop_rename profile [found in /usr/libexec/dwatch]
INFO Watching 'vfs:vop:vop_rename:entry' ...
2022 Nov 26 19:19:39 0.25 sendmail[71356]: /var/spool/mqueue/tf2AR3Jd5P071355 -> /var/spool/mqueue/qf2AR3Jd5P071355
^C

# dwatch -X write -t 'execname != "dtrace" && this->nbytes < 10'
[ . . . ]

# dtrace -n 'syscall::open:entry { printf("%s %s", execname, copyinstr(arg0)); }'
[ . . . ]

# dtrace -n 'proc:::exec-success { trace(curpsinfo->pr_psargs); }'
dtrace: description 'proc:::exec-success ' matched 1 probe
CPU     ID                    FUNCTION:NAME
  5  88556                none:exec-success   printf %s\n Testing.
  1  88556                none:exec-success   mail -v -s Test 6 dusko
  2  88556                none:exec-success   sendmail -i -v dusko
  2  88556                none:exec-success   sendmail -i -v dusko
  6  88556                none:exec-success   mail.local -l
^C

# dtrace -qn 'syscall::exec*:return { printf("%Y %s\n",walltimestamp,curpsinfo->pr_psargs); }'
[ . . . ]

# dtrace -n 'tcp:::accept-established { trace(args[3]->tcps_raddr); }'
dtrace: description 'tcp:::accept-established ' matched 1 probe
CPU     ID                    FUNCTION:NAME
  4  88667          none:accept-established   127.0.0.1
^C

# dtrace -n 'syscall::openat*:entry { printf("%s %s",execname,copyinstr(arg1)); }'
dtrace: description 'syscall::openat*:entry ' matched 2 probes
CPU     ID                    FUNCTION:NAME
  2  91306                     openat:entry mail /tmp/mail.RsdZQ34D6FcS
  2  91306                     openat:entry mail /tmp/mail.Rs0owR9iO4WP
  7  91306                     openat:entry sendmail /etc/mail/submit.cf
  7  91306                     openat:entry sendmail ./df2AQMK5BV055327
  7  91306                     openat:entry sendmail ./df2AQMK5BV055327
  7  91306                     openat:entry sendmail ./qf2AQMK5BV055327
  7  91306                     openat:entry sendmail /dev/crypto
  3  91306                     openat:entry sendmail /var/log/sendmail.st
  3  91306                     openat:entry sendmail ./df2AQMK5wg055328
  6  91306                     openat:entry sendmail ./df2AQMK5wg055328
  6  91306                     openat:entry sendmail ./qf2AQMK5wg055328
  7  91306                     openat:entry sendmail /var/spool/clientmqueue/sm-client.st
  3  91306                     openat:entry sendmail /dev/null
  3  91306                     openat:entry sendmail /dev/null
  3  91306                     openat:entry sendmail ./qf2AQMK5wg055328
  6  91306                     openat:entry sendmail /dev/null
  6  91306                     openat:entry sendmail /dev/null
  6  91306                     openat:entry sendmail /var/log/sendmail.st
  3  91306                     openat:entry sendmail ./df2AQMK5wg055328
  3  91306                     openat:entry sendmail ./tf2AQMK5wg055328
  3  91306                     openat:entry mail.local /tmp/local.iD5X5s
  3  91306                     openat:entry mail.local /var/mail/dusko.lock
  3  91306                     openat:entry mail.local /var/mail/dusko
  2  91306                     openat:entry sendmail /var/log/sendmail.st
^C

# dtrace -n 'syscall::open:entry { printf("At %Y %s file opened by PID %d UID %d using %s\n", walltimestamp, copyinstr(arg0), pid, uid, execname); }'
[ . . . ]

# dtrace -n 'tcp:::accept-established { trace(args[3]->tcps_laddr); }'
dtrace: description 'tcp:::accept-established ' matched 1 probe
CPU     ID                    FUNCTION:NAME
  0  88667          none:accept-established   127.0.0.1
^C

# dtrace -n 'tcp:::accept-established { trace(args[3]->tcps_lport); }'
dtrace: description 'tcp:::accept-established ' matched 1 probe
CPU     ID                    FUNCTION:NAME
  7  88667          none:accept-established     25
^C

# dtrace -n 'tcp:::accept-refused { trace(args[4]->tcp_dport); }'
dtrace: description 'tcp:::accept-refused ' matched 1 probe
CPU     ID                    FUNCTION:NAME
  1  88668              none:accept-refused  40691
  6  88668              none:accept-refused     25
^C

# dtrace -n 'tcp:::accept-established { trace(args[3]->tcps_lport); }'
dtrace: description 'tcp:::accept-established ' matched 1 probe
CPU     ID                    FUNCTION:NAME
  7  88667          none:accept-established     25
^C

# dtrace -n 'tcp:::receive { trace(args[3]->tcps_lport); }'

# dtrace -n 'tcp:::receive { trace(args[3]->tcps_lport); }'

# dtrace -n 'tcp:::receive { trace(args[2]->ip_daddr); }'

# cat dtrace-ex1.d
syscall::open:entry
{
    printf("%s, %s\n", execname, copyinstr(arg0));
}

# dtrace -q -s dtrace-ex1.d 
printf, /etc/libmap.conf
[ . . . ]
mail, /etc/libmap.conf
mail, /usr/local/etc/libmap.d
mail, /usr/local/etc/libmap.d/mesa.conf
mail, /var/run/ld-elf.so.hints
mail, /lib/libc.so.7
mail, /usr/share/misc/mail.rc
mail, /usr/local/etc/mail.rc
mail, /etc/mail.rc
mail, /home/dusko/.mailrc
mail, /home/dusko/.mail_aliases
mail, /etc/localtime
mail, /usr/share/zoneinfo/posixrules
mail, /tmp/mail.Rs6miNZyD4Du
mailwrapper, /etc/libmap.conf
mailwrapper, /usr/local/etc/libmap.d
mailwrapper, /usr/local/etc/libmap.d/mesa.conf
mailwrapper, /var/run/ld-elf.so.hints
mailwrapper, /lib/libutil.so.9
mailwrapper, /lib/libc.so.7
mailwrapper, /usr/local/etc/mail/mailer.conf
sendmail, /etc/libmap.conf
sendmail, /usr/local/etc/libmap.d
sendmail, /usr/local/etc/libmap.d/mesa.conf
sendmail, /var/run/ld-elf.so.hints
sendmail, /lib/libwrap.so.6
sendmail, /usr/lib/libwrap.so.6
sendmail, /lib/libsasl2.so.3
sendmail, /usr/lib/libsasl2.so.3
sendmail, /usr/lib/compat/libsasl2.so.3
sendmail, /usr/local/lib/libsasl2.so.3
sendmail, /lib/libblacklist.so.0
sendmail, /usr/lib/libblacklist.so.0
sendmail, /lib/libssl.so.111
sendmail, /usr/lib/libssl.so.111
sendmail, /lib/libcrypto.so.111
sendmail, /lib/libutil.so.9
sendmail, /lib/libc.so.7
sendmail, /lib/libdl.so.1
sendmail, /usr/lib/libdl.so.1
sendmail, /lib/libthr.so.3
sendmail, /etc/nsswitch.conf
sendmail, /etc/pwd.db
sendmail, /etc/pwd.db
sendmail, /etc/resolv.conf
sendmail, /etc/hosts
sendmail, /etc/hosts
sendmail, /etc/localtime
sendmail, /usr/share/zoneinfo/posixrules
sendmail, /usr/share/zoneinfo/UTC
sendmail, /usr/share/zoneinfo/posixrules
sendmail, /etc/pwd.db
sendmail, /etc/pwd.db
sendmail, /lib/libcrypto.so.111
sendmail, /etc/pwd.db
sendmail, /etc/pwd.db
sendmail, /etc/services
sendmail, /etc/hosts
sendmail, /etc/hosts
sendmail, /etc/hosts
sendmail, /etc/hosts
sendmail, /etc/services
sendmail, /etc/hosts.allow
sendmail, /etc/ssl/openssl.cnf
sendmail, /usr/lib/libssl.so.111
sendmail, /etc/spwd.db
sendmail, /etc/mail/aliases.db
sendmail, /etc/spwd.db
sendmail, /etc/shells
sendmail, /etc/spwd.db
sendmail, /etc/mail/aliases.db
sendmail, /etc/spwd.db
sendmail, /etc/shells
sendmail, /etc/group
sendmail, /etc/group
sendmail, /etc/group
sendmail, /etc/group
mail.local, /etc/libmap.conf
mail.local, /usr/local/etc/libmap.d
mail.local, /usr/local/etc/libmap.d/mesa.conf
mail.local, /var/run/ld-elf.so.hints
mail.local, /lib/libutil.so.9
mail.local, /lib/libc.so.7
mail.local, /etc/nsswitch.conf
mail.local, /etc/services
mail.local, /etc/resolv.conf
mail.local, /etc/hosts
mail.local, /etc/spwd.db
mail.local, /etc/localtime
mail.local, /usr/share/zoneinfo/posixrules
mail.local, /etc/spwd.db
[ . . . ]

# cat dtrace-ex2.d
syscall::write:entry
{
        printf("%s", stringof(copyin(arg1, arg2)));
}

# dtrace -q -s dtrace-ex2.d > sendmailTRACE
^C#

# file sendmailTRACE
sendmailTRACE: data

# wc -l sendmailTRACE
     791 sendmailTRACE

# cat sendmailTRACE
  
Received: from fbsd1.home.arpa (localhost [127.0.0.1])
[ . . . ]

# strings sendmailTRACE | wc -l
     898

# strings sendmailTRACE
0.re\
|Testing.
Testing.
To: dusko
Subject: Test 01
[ . . . ]
1 sendmail[51179]: 2AO3Up92051179: SMTP outgoing connect on localhost

$ grep 2AO3Up92051179 /var/log/maillog
[ . . . ]

$ tail -21 ~/mbox
 
From dusko@fbsd1.home.arpa Wed Nov 23 19:30:52 2022
Return-Path: <dusko@fbsd1.home.arpa>
Received: from fbsd1.home.arpa (localhost [127.0.0.1])
        by fbsd1.home.arpa (8.17.1/8.17.1) with ESMTPS id 2AO3UpXe051180
        (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NO)
        for <dusko@fbsd1.home.arpa>; Wed, 23 Nov 2022 19:30:51 -0800 (PST)
        (envelope-from dusko@fbsd1.home.arpa)
Received: (from dusko@localhost)
        by fbsd1.home.arpa (8.17.1/8.17.1/Submit) id 2AO3Up92051179
        for dusko; Wed, 23 Nov 2022 19:30:51 -0800 (PST)
        (envelope-from dusko)
Date: Wed, 23 Nov 2022 19:30:51 -0800 (PST)
From: dusko <dusko@fbsd1.home.arpa>
Message-Id: <202211240330.2AO3Up92051179@fbsd1.home.arpa>
To: dusko@fbsd1.home.arpa
Subject: Test 01
Status: RO

Testing.

# dtrace -n 'syscall:::entry { @[execname, probefunc] = count(); }'

# dtrace -n 'syscall::read:return /execname == "sshd"/ { @ = quantize(arg0); }'

# dtrace -n 'syscall::read:entry { self->ts = timestamp; } syscall::read:return /self->ts / \
 { @ = quantize(timestamp - self->ts); self->ts = 0; }'

# dtrace -n 'syscall::read:entry { self->vts = vtimestamp; } syscall::read:return /self->vts/ \
 { @["On-CPU us:"] = lquantize((vtimestamp - self->vts) / 1000, 0, 10000, 10); self->vts = 0; }'

# dtrace -n 'proc::: { @[probename] = count(); } tick-5s { exit(0); }'

# dtrace -x stackframes=100 -n 'profile-99 /arg0/ { @[stack()] = count(); }'

# dtrace -n 'sched:::off-cpu { @[stack(8)] = count(); }'

# dtrace -n 'tcp:::accept-established { @[args[3]->tcps_raddr] = count(); }'

# dtruss -n sendmail
[ . . . ]

# dtruss 'printf %s\\n "Hello" | mail -v -s "Test" dusko'
[ . . . ]

# dtruss -a mail -v dusko
[ . . . ]

# truss mail -v dusko
[ . . . ]

# ktrace -i mail -v dusko
[ . . . ]

# kdump -f ktrace.out

# strings ktrace.out

$ hostname
fbsd1.home.arpa

$ sendmail -bt
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>
> /parse dusko@fbsd1.home.arpa
Cracked address = $g
Parsing envelope recipient address
canonify           input: dusko @ fbsd1 . home . arpa
.
.   (output deleted)
.
final            returns: dusko
mailer local, user dusko

$ sendmail -bt
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>
> /parse testuser1@yahoo.com 
Cracked address = $g
Parsing envelope recipient address
canonify           input: testuser1 @ yahoo . com
.
.   (output deleted)
.
final            returns: testuser1 @ yahoo . com
mailer esmtp, host yahoo.com., user testuser1@yahoo.com

Rlhs    rhs   comment
    ↑       ↑
    tabs    tabs

configfile: line number: R line: null LHS

# text            ← a comment
tabtext            ← a continuation line
            ← a blank line
tab            ← an "empty-looking line"

$ sed -n 4647,4672p /usr/local/share/sendmail/cf/README 

+--------------------------+
| FORMAT OF FILES AND MAPS |
+--------------------------+

Files that define classes, i.e., F{classname}, consist of lines
each of which contains a single element of the class.  For example,
/etc/mail/local-host-names may have the following content:

my.domain
another.domain

Maps must be created using makemap(8) , e.g.,

        makemap hash MAP < MAP

In general, a text file from which a map is created contains lines
of the form

key     value

where 'key' and 'value' are also called LHS and RHS, respectively.
By default, the delimiter between LHS and RHS is a non-empty sequence
of white space characters.

CWlocalhost mailhost  # This is a comment
                    ↑
                    from here to end of line ignored

DM16\#megs

DZzoos
       lions and bears
↑
line begins with a tab character

DZzoos\n       lions and bears
       ↑
       newline and tab retained

$ grep '^ .*$' /etc/mail/sendmail.cf

# `Here we define $m as our domain'

$ diff /etc/mail/sendmail.cf oursite.cf
19c19
< ##### built by you@oursite.com on Sat Nov  3  11:26:39 PDT 2007
---
> ##### built by you@oursite.com on Fri Dec 14 04:14:25 PDT 2007

FEATURE(`nouucp')               ← recommended through V8.9
FEATURE(`nouucp',`reject')      ← recommended with V8.10 and later

bad rule set number (max max)
Undefined rule set number

R $+ @ $+		$: $1 < @ $2 >	focus on domain
R $+ < $+ @ $+ >	$1 $2 < @ $3 >	move gaze right

V10/Berkeley                       ← good
V10/Berkeley                       ← bad, does not begin a line
V10/Berkeley Fw/etc/mail/mxhosts   ← bad, two commands on one line
Fw/etc/mail/mxhosts                ← good

# a comment
V10
     /Berkeley  ← continuation of V line above
  ↑ tab

R$-				# If a plain username
	$@ $1 @ ${REMOTE}	#    append "@" remote host

Rlhs    rhs   comment
    ↑       ↑
    tabs    tabs

V10
Stest
DAvalue1
R $A	$A.new
DAvalue2
R $A	$A.new

Warning: .cf file is out of date: sendmail 8.12.6 supports version 10,
.cf file is version 0

$ printf =Stest | sendmail -bt -Ctest.cf
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>
> Rvalue1               value1 . new 
Rvalue2                 value2 . new 
> $ 

V10
Stest
DAvalue1
R $A	$A.$B
DAvalue2
R $A	$A.$B

$ printf =Stest | sendmail -bt -Ctest.cf
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>
> Rvalue1               value1 . 
Rvalue2                 value2 . 
> $ 

D{YOURDOMAIN}us.edu
R ${YOURDOMAIN}    localhost.${YOURDOMAIN}

DAroot@my.site (Operator)
R $A  <tab>RHS
   ↓
R root@my.site (Operator)  <tab>RHS        ← expanded
   ↓
R root@my.site  <tab>RHS      ← comment stripped prior to version 8 configs only

configfile : line number: expression  ...Unbalanced '"'
configfile : line number: expression ...Unbalanced ''

V8
Stest
R x      RHS"
R y      RHS>

$ printf =Stest | sendmail -bt -Ctest.cf
test.cf: line 3: RHS"... Unbalanced '"'
test.cf: line 4: RHS>... Unbalanced '>'
R x              RHS ""
R y              RHS

SCheck_Subject
R ----> test <----         $#discard $: discard

                       ← workspace is "gw" "@" "wash" "." "dc" "." "gov"
R <lhs> <rhs>  R <lhs> <rhs>                ← rules rewrite the workspace
R <lhs> <rhs>                        ← workspace is "gw" "." "LOCAL"

STranslate
R $* $$| $*	$: $1 $| $2	fake for -bt mode, remove for real version

$ sudo su

# sendmail -bt
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>
> Translate,Local_check_relay bogus.host.domain $| 123.45.67.89
Translate          input: bogus . host . domain $| 123 . 45 . 67 . 89
Translate        returns: bogus . host . domain $| 123 . 45 . 67 . 89
Local_check_rela   input: bogus . host . domain $| 123 . 45 . 67 . 89
Local_check_rela returns: bogus . host . domain $| 123 . 45 . 67 . 89
> 
> /quit

$ sed -n 2910,2950p /usr/local/share/sendmail/cf/README
Header Checks
-------------

You can also reject mail on the basis of the contents of headers.
This is done by adding a ruleset call to the 'H' header definition command
in sendmail.cf.  For example, this can be used to check the validity of
a Message-ID: header:

        LOCAL_CONFIG
        HMessage-Id: $>CheckMessageId

        LOCAL_RULESETS
        SCheckMessageId
        R< $+ @ $+ >            $@ OK
        R$*                     $#error $: 553 Header Error


The alternative format:

        HSubject: $>+CheckSubject

that is, $>+ instead of $>, gives the full Subject: header including
comments to the ruleset (comments in parentheses () are stripped
by default).

A default ruleset for headers which don't have a specific ruleset
defined for them can be given by:

        H*: $>CheckHdr

Notice:
1. All rules act on tokens as explained in doc/op/op.{me,ps,txt}.
That may cause problems with simple header checks due to the
tokenization.  It might be simpler to use a regex map and apply it
to $&{currHeader}.
2. There are no default rulesets coming with this distribution of
sendmail.  You can write your own, can search the WWW for examples,
or take a look at cf/cf/knecht.mc.
3. When using a default ruleset for headers, the name of the header
currently being checked can be found in the $&{hdr_name} macro.

+---------+------------------------------------------------------------+
| Command | Description                                                |
+---------+------------------------------------------------------------+
| C       | Define a class macro.                                      |
+---------+------------------------------------------------------------+
| D       | Define a macro.                                            |
+---------+------------------------------------------------------------+
| E       | Define an environment variable (beginning with V8.7).      |
+---------+------------------------------------------------------------+
| F       | Define a class macro from a file, pipe, or database map.   |
+---------+------------------------------------------------------------+
| H       | Define a header.                                           |
+---------+------------------------------------------------------------+
| K       | Declare a keyed database (beginning with V8.1).            |
+---------+------------------------------------------------------------+
| L       | Include extended load average support (contributed         |
|         | software, not covered).                                    |
+---------+------------------------------------------------------------+
| M       | Define a mail delivery agent.                              |
+---------+------------------------------------------------------------+
| O       | Define an option.                                          |
+---------+------------------------------------------------------------+
| P       | Define delivery priorities.                                | 
+---------+------------------------------------------------------------+
| Q       | Define a queue (beginning with V8.12).                     |
+---------+------------------------------------------------------------+
| R       | Define a rewriting rule.                                   |
+---------+------------------------------------------------------------+
| S       | Declare a rule-set start.                                  |
+---------+------------------------------------------------------------+
| T       | Declare trusted users (ignored in V8.1, restored in V8.7). | 
+---------+------------------------------------------------------------+
| V       | Define configuration file version (beginning with V8.1).   |
+---------+------------------------------------------------------------+
| X       | Define a mail filter (beginning with V8.12).               | 
+---------+------------------------------------------------------------+

+----------+-------------------------+---------------------------------------+
| Operator | §                       | Description or use                    |
+----------+-------------------------+---------------------------------------+
| $*       |                         | Match zero or more tokens.            |
+----------+-------------------------+---------------------------------------+
| $+       |                         | Match one or more tokens.             |
+----------+-------------------------+---------------------------------------+
| $-       |                         | Match exactly one token.              |
+----------+-------------------------+---------------------------------------+
| $@       |                         | Match exactly zero tokens (V8 only).  |
+----------+-------------------------+---------------------------------------+
| $=       | Matching Any in         | Match any tokens in                   |
|          | a Class: $=             | a class.  [a]                         |
+----------+-------------------------+---------------------------------------+
| $˜       | Matching Any Token Not  | Match any single token not            |
|          | in a Class: $~          | in a class.                           |
+----------+-------------------------+---------------------------------------+
| $#       |                         | Match a literal $#.                   |
+----------+-------------------------+---------------------------------------+
| $|       |                         | Match a literal $|.                   |
+----------+-------------------------+---------------------------------------+
| $&       | Use Value As Is with $& | Delay macro expansion until runtime.  |
+----------+-------------------------+---------------------------------------+

R<tab>RHS                ← won't work
R $@<tab>RHS                ← will work

+----------+-------------------------+---------------------------------------+
| RHS      | §                       | Description or use                    |
+----------+-------------------------+---------------------------------------+
| $ digit  | Copy by Position:       | Copy by position.                     | 
|          | $digit                  |                                       |
+----------+-------------------------+---------------------------------------+
| $:       | Rewrite Once Prefix: $: | Rewrite once (when used as a prefix), |
|          |                         | or specify the user in a delivery     |
|          |                         | agent "triple," or specify the        |
|          |                         | default value to return on a failed   |
|          |                         | database-map lookup.                  | 
+----------+-------------------------+---------------------------------------+
| $@       | Rewrite-and-Return      | Rewrite and return (when used as a    |
|          | Prefix: $@              | prefix), or specify the host in a     |
|          |                         | delivery-agent "triple," or specify   |
|          |                         | an argument to pass in a database-map |
|          |                         | lookup or action.                     | 
+----------+-------------------------+---------------------------------------+
| $> set   | Rewrite Through a Rule  | Rewrite through another rule set      |
|          | Set: $>set              | (such as a subroutine call that       |  
|          |                         | returns to the current position).     | 
+----------+-------------------------+---------------------------------------+
| $#       | Return a Selection: $#  | Specify a delivery agent or choose an |
|          |                         | action, such as to reject or discard  |
|          |                         | a recipient, sender, connection, or   |
|          |                         | message.                              |
+----------+-------------------------+---------------------------------------+
| $[ $]    | Canonicalize Hostname:  | Canonicalize the hostname.            | 
|          | $[ and $]               |                                       |
+----------+-------------------------+---------------------------------------+
| $( $)    | Use $( and $) in Rules  | Perform a lookup in an external       |
|          |                         | database, file, or network service,   |
|          |                         | or perform a change (such as          |
|          |                         | dequoting), or store a value into     |
|          |                         | a macro.                              |
+----------+-------------------------+---------------------------------------+
| $&       | Use Value As Is with $& | Delay conversion of a macro until     |
|          |                         | runtime.                              |
+----------+-------------------------+---------------------------------------+