Repository navigation
qmail-pop3d: exit 1, pronto, if running as root. - #92
Merged
Merged
Conversation
schmonz
force-pushed
the
pop3d-nonroot
branch
2 times, most recently
from
August 27, 2019 04:30
a4cdce0 to
30e3225
Compare
DerDakon
approved these changes
Aug 27, 2019
DerDakon
left a comment
DerDakon
left a comment
Member
There was a problem hiding this comment.
I still would kill the whole thing and tell people to use dovecot or whatever, but until then this should be not totally insane.
Member
Author
|
I've added the idea to treat qmail-popup and qmail-pop3d as extensions for 1.9. (We don't know what that means yet, but it might be something like moving it out of this repo.) |
schmonz
force-pushed
the
pop3d-nonroot
branch
from
September 2, 2019 15:20
30e3225 to
0a6f848
Compare
alanpost
reviewed
Sep 2, 2019
alanpost
reviewed
Sep 2, 2019
schmonz
force-pushed
the
pop3d-nonroot
branch
2 times, most recently
from
September 2, 2019 15:50
49f3471 to
5381af7
Compare
DerDakon
reviewed
May 14, 2020
At least checkpassword-pam and DJB's original checkpassword are willing to authenticate the root user and run a child program with UID 0. For POP3 service -- the canonical checkpassword use case! -- this produces runtime behavior that is inconsistent with... - qmail's design, because qmail-local will never run as root to populate a Maildir that qmail-pop3d could serve, and - qmail's security focus, because it lets abusers dictionary-attack the root password over the network. Instead, in qmail-pop3d, if getuid() returns 0, we write to the logs and exit 1. If someone manages to guess the root password, they won't know they did: it looks exactly like any other failed checkpassword login. And the sysadmin could potentially be alerted.
mbhangui
approved these changes
May 14, 2020
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
At least checkpassword-pam and DJB's original checkpassword are willing
to authenticate the root user and run a child program with UID 0. For
POP3 service -- the canonical checkpassword use case! -- this produces
runtime behavior that is inconsistent with...
qmail's design, because qmail-local will never run as root to populate
a Maildir that qmail-pop3d could serve, and
qmail's security focus, because it lets abusers dictionary-attack the
root password over the network.
Instead, in qmail-pop3d, if getuid() returns 0, we write to the logs and
exit 1. If someone manages to guess the root password, they won't know
they did: it looks exactly like any other failed checkpassword login.
And the sysadmin could potentially be alerted.