From owner-freebsd-ports Mon Mar 9 17:05:47 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id RAA21090 for freebsd-ports-outgoing; Mon, 9 Mar 1998 17:05:47 -0800 (PST) (envelope-from owner-freebsd-ports@FreeBSD.ORG) Received: from mail.ruhrgebiet.individual.net (in-ruhr.ruhr.de [141.39.224.38]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id RAA21025; Mon, 9 Mar 1998 17:05:10 -0800 (PST) (envelope-from bs@devnull.ruhr.de) Received: (from admin@localhost) by mail.ruhrgebiet.individual.net (8.8.5-r-beta/8.8.5) with UUCP id BAA19847; Tue, 10 Mar 1998 01:11:47 +0100 (MET) Received: from rm.devnull.ruhr.de [192.168.22.75] by devnull.ruhr.de with smtp (Exim 1.73 #1) id 0yC88X-0000wW-00; Mon, 9 Mar 1998 20:22:57 +0100 Received: from bs by rm.devnull.ruhr.de with local (Exim 1.73 #1) id 0yC8HY-0000rt-00; Mon, 9 Mar 1998 20:32:16 +0100 To: Andreas Klemm Cc: ache@FreeBSD.ORG, isp@FreeBSD.ORG, ports@FreeBSD.ORG, asami@FreeBSD.ORG Subject: Re: bugfix procmail port and discussion about general MAILSPOOLHOME var. References: <19980307152418.16939@klemm.gtn.com> Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit From: Benedikt Stockebrand Date: 09 Mar 1998 20:32:15 +0100 In-Reply-To: Andreas Klemm's message of "Sat, 7 Mar 1998 15:24:18 +0100" Message-ID: <87pvjvpsn4.fsf@devnull.ruhr.de> Lines: 30 X-Mailer: Gnus v5.5/XEmacs 20.3 - "Vatican City" Sender: owner-freebsd-ports@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Andreas Klemm writes: > Another thing, many ISP's use procmail's ability, to store > users mails into their home directory ($HOME/.mail). So why wouldn't you want to use procmail? > Perhaps one should make a note, that then the MUA has to be > aware of the MAIL envireonment variable or pop server have to be > patched, too look for the users mailbox in $HOME/.mail/loginname. I'm not sure if I understand the security implications of this approach. However, the local mail delivery programs are usually setuid root or something and may rely on the fact that users can't create files in /var/mail. If you really want to do this you'll have to fix them so that they check for symlink attacks (like symlinking ~/.mail/loginname to /etc/master.passwd and then sending themselves a msg containing a line "toot::0:0::0:0:Charlie \&:/root:/bin/csh") and whatever else comes to the naughty mind. That's not impossible but somewhat error-prone. If procmail already provides such a feature it seems more reasonable to use it instead. So long, Ben -- Ben(edikt)? Stockebrand --- Un*x system administrator looking for a job To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ports" in the body of the message