Mail vulnerable
Michael Schwendt
ms-nospam-0306 at arcor.de
Fri Nov 28 14:34:33 UTC 2003
On Thu, 27 Nov 2003 22:11:29 -0600, Ferry Boor wrote:
> Hi guys,
>
> I just install fedora everything running smooth. however when I peek on
> my /var/log/maillog
> there was a line says
>
> Nov 22 21:02:20 Cheyenne ipop3d [774]: Mailbox vulnerable - directory
> /var/spool/mail must have 1777 protection
> how do I get rid of this error message?
Ignore it. It's misleading. It's not vulnerable. ipop3 just disagrees with
the permission bits that are found on /var/spool/mail.
If you feel the need to shut up ipop3d, however, eiher change the
permissions bits or patch ipop3d.
> here is the permissions/ownership on /var/spool/mail
>
> drwxrwxr-x 2 root mail 4096 Nov 25 11:01 mail
Which is more secure than 01777, because it's not world-writable like
01777 would be. With 01777 everyone could create files in
/var/spool/mail.
> and all users have -rw-rw----
> root has -rw-------
> I install fedora on 2 machines and both have the same problem.
>
> I can send or receiving email with no problem.
"same problem" ./. "no problem"?
Kind of contracticting itself. ;)
FWIW, procmail also doesn't like Red Hat's choice of permissions on
/var/spool/mail. But unliked ipop3d, it fails to create a non-existant
mail folder due to that.
--
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/fedora-list/attachments/20031128/4be7354b/attachment-0001.sig>
More information about the fedora-list
mailing list