Date: Thu, 1 May 2003 20:43:21 -0500 (CDT) From: "Scot W. Hetzel" <hetzels@westbend.net> To: FreeBSD-gnats-submit@FreeBSD.org Cc: ume@FreeBSD.org Subject: ports/51680: security/cyrus-sasl?: Group readable file when sending locally Message-ID: <200305020143.h421hLcY046887@WBIw009.westbend.net> Resent-Message-ID: <200305020150.h421oFB4073254@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 51680
>Category: ports
>Synopsis: security/cyrus-sasl?: Group readable file when sending locally
>Confidential: no
>Severity: non-critical
>Priority: low
>Responsible: freebsd-ports-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: maintainer-update
>Submitter-Id: current-users
>Arrival-Date: Thu May 01 18:50:14 PDT 2003
>Closed-Date:
>Last-Modified:
>Originator: Scot W. Hetzel
>Release: FreeBSD 4.8-STABLE i386
>Organization:
West Bend Internet
>Environment:
System: FreeBSD WBIw009.westbend.net 4.8-STABLE FreeBSD 4.8-STABLE #2: Tue Apr 22 02:28:52 CDT 2003 root@WBIw009.westbend.net:/usr/obj/usr/src/4x/sys/GENERIC-SMP i386
>Description:
When sending mail localy on a system compiled woth SASL AUTH, the sendmail
mail submission program will log the following error on the sasldb file:
error: safesasl(/usr/local/etc/sasldb) failed: Group readable file
This problem was reported on the FreeBSD-ports mailing list by
David Babler <dbabler@rigel.orionsys.com>
NOTE: sendmail.cf has DontBlameSendmail set to GroupReadableSASLDBFile.
>How-To-Repeat:
Install sendmail with SASL AUTH, and follow directions in the Sendmail.README
file installed by the security/cyrus-sasl* ports to set up the sendmail.cf file.
Then send a message from that system and check /var/log/maillog for the above
error.
>Fix:
The fix is in the attached patch to the files/Sendmail.README file.
NOTE: This patch needs to be applied to both cyrus-sasl and cyrus-sasl2 ports.
Index: Sendmail.README
===================================================================
RCS file: /home/ncvs/ports/security/cyrus-sasl/files/Sendmail.README,v
retrieving revision 1.8
diff -u -r1.8 Sendmail.README
--- Sendmail.README 5 Oct 2002 19:38:18 -0000 1.8
+++ Sendmail.README 2 May 2003 00:53:56 -0000
@@ -41,6 +41,19 @@
dnl Use the following for Sendmail 8.10 - 8.11
define(`confDONT_BLAME_SENDMAIL',`GroupReadableSASLFile')dnl
+5) Add the following before FEATURE(msp) in your sendmail 8.12 submit.mc file:
+
+ define(`confRUN_AS_USER',`smmsp:mail')dnl
+ define(`confTRUSTED_USER',`smmsp')dnl
+ define(`confDONT_BLAME_SENDMAIL',`GroupReadableSASLDBFile')dnl
+
+ If this is not added to the submit.mc file, then sendmail will give
+ this error in the log:
+
+ error: safesasl(/usr/local/etc/sasldb) failed: Group readable file
+
+ when sending mail locally.
+
----
Additional AUTH Mechanisms are LOGIN, PLAIN, GSSAPI, and KERBEROS_V4.
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200305020143.h421hLcY046887>