From owner-freebsd-ports@freebsd.org Sun Dec 10 13:21:22 2017 Return-Path: Delivered-To: freebsd-ports@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 2762EE8C5F5 for ; Sun, 10 Dec 2017 13:21:22 +0000 (UTC) (envelope-from matthew@FreeBSD.org) Received: from smtp.infracaninophile.co.uk (smtp.infracaninophile.co.uk [IPv6:2001:8b0:151:1:c4ea:bd49:619b:6cb3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "smtp.infracaninophile.co.uk", Issuer "infracaninophile.co.uk" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id C515870BFE for ; Sun, 10 Dec 2017 13:21:21 +0000 (UTC) (envelope-from matthew@FreeBSD.org) Received: from liminal.local (unknown [IPv6:2001:8b0:151:1:9987:5863:73dd:de7d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: m.seaman@infracaninophile.co.uk) by smtp.infracaninophile.co.uk (Postfix) with ESMTPSA id 38207D777 for ; Sun, 10 Dec 2017 13:21:20 +0000 (UTC) Authentication-Results: smtp.infracaninophile.co.uk; dmarc=none (p=none dis=none) header.from=FreeBSD.org From: Matthew Seaman Subject: Re: Procmail Vulnerabilities check To: freebsd-ports@freebsd.org References: <20171208180905.GA96560@troutmask.apl.washington.edu> <20171209012522.GA42506@troutmask.apl.washington.edu> Message-ID: Date: Sun, 10 Dec 2017 13:21:13 +0000 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:52.0) Gecko/20100101 Thunderbird/52.5.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="DfwP1X39huRuPFik7SagnHdHL6h36JBMM" X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Dec 2017 13:21:22 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --DfwP1X39huRuPFik7SagnHdHL6h36JBMM Content-Type: multipart/mixed; boundary="6LvSSxsDT2nQa77DoVdt3FuoH4pluGXD4"; protected-headers="v1" From: Matthew Seaman To: freebsd-ports@freebsd.org Message-ID: Subject: Re: Procmail Vulnerabilities check References: <20171208180905.GA96560@troutmask.apl.washington.edu> <20171209012522.GA42506@troutmask.apl.washington.edu> In-Reply-To: --6LvSSxsDT2nQa77DoVdt3FuoH4pluGXD4 Content-Type: text/plain; charset=utf-8 Content-Language: en-GB Content-Transfer-Encoding: quoted-printable On 09/12/2017 04:12, Dave Horsfall wrote: > On Fri, 8 Dec 2017, Steve Kargl wrote: >=20 >> https://lists.freebsd.org/pipermail/freebsd-arch/2017-December/018712.= html >> >=20 > Well, I saw no reason to subscribe to freebsd-arch (I'm on enough lists= > as it is)...=C2=A0 Are there any other lists that we should be followin= g? >=20 > I guess a suit and tie will be required soon :-( >=20 > I'm bemused by Bapt's remark that "it does not support anything an > entreprised [sic] grade mta setup would require: ldap support for > example"; funny, as I had it working just fine with OpenLDAP with > hundreds of users spread over many offices in my last job, with no > trouble at all; there's even a schema for it, FFS: >=20 > =C2=A0=C2=A0=C2=A0 aneurin% locate -i sendmail.schema > =C2=A0=C2=A0=C2=A0 /usr/share/sendmail/cf/sendmail.schema >=20 > with all the right gear in it: >=20 > =C2=A0=C2=A0=C2=A0 # OID arcs for Sendmail > =C2=A0=C2=A0=C2=A0 # enterprise:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0 1.3.6.1.4.1 > =C2=A0=C2=A0=C2=A0 # sendmail:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 enterprise.6152 >=20 > WTF?=C2=A0 Sure as hell looks like Sendmail supports LDAP to me... >=20 Bapt's point here is that the version of sendmail in base is quite limited since, for instance, it is not compiled with ldap client support or various other optional features. On the other hand, the version of sendmail in ports can be compiled with all the different bells and whistles enabled. If your machine is configured as a smarthost MTA, then generally you'll want to install one of the more fully capable MTA packages from ports -- sendmail, postfix, exim etc. For most other setups, a machine does not need to do anything more with e-mail than deliver locally generated mails (from cron or whatever) either to a local mailbox or to a smarthost. Hence the current sendmail in base is neither fish nor fowl: way overpowered for almost all installations, but with significant limitations for a machine providing a full-blown mail service. Personally I agree with his reasoning: unless the primary function of your FreeBSD machine is to be an MTA, you really don't need any more capability than to either deliver to a local mailbox, or forward all e-mails to a smart host. Certainly you don't need anything capable of receiving incoming e-mails. Cheers, Matthew --6LvSSxsDT2nQa77DoVdt3FuoH4pluGXD4-- --DfwP1X39huRuPFik7SagnHdHL6h36JBMM Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- iQKoBAEBCgCSFiEEGfFU7L8RLlBUTj8wAFE/EOCp5OcFAlotNMpfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDE5 RjE1NEVDQkYxMTJFNTA1NDRFM0YzMDAwNTEzRjEwRTBBOUU0RTcUHG1hdHRoZXdA ZnJlZWJzZC5vcmcACgkQAFE/EOCp5OfweQ/+MzqPvke5+U5u4p3rC6TUn5rmkmQI NPezgZQSegWvRrZsD9ji/MRmxKJvKlvouRm6+YhAvM9OdzNxwkDralrILyviZ6d1 UD6xC7Gh0jCsgwS+qhklew67YsWeRq+SBTjzcvoMMvmJrV0KZGTP0DngotfUf4xA TCxQOzWdQiIWKtxPCcx5EuFb1SYhEie7t+DCGgE0BNz4eZyTq5jnIKaktK/JkfIb 1rjFsyZxvKikXQ8euj4mla1ptL7iBTmWcz9TdzKp4GCNBp39H1HLvqHoAUwQrkqS TLiv88PtRZf96iKPdsCAlHxigw1DBlPP6zmVlI/6i6uDNDvkqr9+7qAFnxOU9pNO aCKbskFegDRE/ogjN0ZgpDyAzY1Vf8BO11FBlQoRUZGqOxkrhlHEXhCS9BARqsnH WJx9rZr4FW8H+wsFNBaCVqbBHbEGVMm9MO1WhUZBtZisNSHOpvVanVrDjKCxKxnF lHiVVAWgWNOtqkN+HVBe4Ail5ZlvyljNtNIeAVmVKSnasMO1xJm+qjPovZ0aeu2Y SDkDzB3JPO1C0DGURKKYUkARR0NGtxMLdHTkzaBcLVuUgtmidbNf5c7lO0tmyjYg HlWTr4HMs3Pkf6G37oilMW9WsqAB1q65vhhbXbL8DsVNRMvhTFRIIy5eSkAuHHRc ugWwlCJycoFgprw= =j3p2 -----END PGP SIGNATURE----- --DfwP1X39huRuPFik7SagnHdHL6h36JBMM--