Mail vulnerable

[Michael Schwendt]

On Thu, 27 Nov 2003 22:11:29 -0600, Ferry Boor wrote:

> Hi guys,
> 
> I just install fedora everything running smooth. however when I peek on 
> my /var/log/maillog
> there was a line says
> 
> Nov 22 21:02:20 Cheyenne ipop3d [774]: Mailbox vulnerable - directory 
> /var/spool/mail must have 1777 protection
> how do I get rid of this error message?

Ignore it. It's misleading. It's not vulnerable. ipop3 just disagrees with
the permission bits that are found on /var/spool/mail.

If you feel the need to shut up ipop3d, however, eiher change the
permissions bits or patch ipop3d.

> here is the permissions/ownership on /var/spool/mail
> 
> drwxrwxr-x 2 root mail 4096 Nov 25 11:01 mail

Which is more secure than 01777, because it's not world-writable like
01777 would be.  With 01777 everyone could create files in
/var/spool/mail.
 
> and all users have -rw-rw----
> root has -rw-------

 
> I install fedora on 2 machines and both have the same problem.
>
> I can send or receiving email with no problem.

"same problem" ./. "no problem"?
Kind of contracticting itself. ;)


FWIW, procmail also doesn't like Red Hat's choice of permissions on
/var/spool/mail. But unliked ipop3d, it fails to create a non-existant
mail folder due to that.

-- 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/fedora-list/attachments/20031128/4be7354b/attachment-0001.sig>