Subject: Securing PINE

From: [email-masked] (Bradley Bristow-Stagg)
Date: 15 Aug 1995 08:23:42 GMT

Greetins,
	My name is Brad J B Bristow-Stagg and I am a sys admin at the
Central Queensland University for CQ-PAN.  We are thinking of using PINE as
our new mail reader.  Currently all users have a menu a/c (none but admin
have bash a/c's).  I was wondering if someone could either point me in the
direction of where in the source code that I have to change so that users
can't read in any other file other than the .sig specified in the .pinerc,
and also if there are any other things I have to take into consideration. 
My thanks for your time.  I would ask that all replies are send via e-mail
as I don't get much time to check news.  Once again my thanks..

Brad J B Bristow-Stagg
CQ-PAN Systems Administrator.

--
/---------------------------------------------------------------------\
| Bradley J B Bristow-Stagg     | IRC/MUD : Shanor                    |
| B. Information Technology     | E-Mail : [email-masked] |
| Central Queensland University |   Or   : [email-masked]  | 
\---------------------------------------------------------------------/

---

From: Paul O Bartlett <[email-masked]>
Date: Tue, 15 Aug 1995 11:48:19 -0400

On 15 Aug 1995, Bradley Bristow-Stagg wrote (excerpted):

|                    I was wondering if someone could either point me in the
| direction of where in the source code that I have to change so that users
| can't read in any other file other than the .sig specified in the .pinerc,
| and also if there are any other things I have to take into consideration. 

    Although I do not have the source code at hand, it seems to me that
you would have to disable completely the Ctrl-R function which allows a
user to read in any external file into the body of a composed message. 
This is a very useful function.  Why are you advocating disallowing it? 

Paul
--------------------------------------------------
Paul O. Bartlett         <[email-masked]>
P. O. Box 857     Vienna, VA 22183-0857     U.S.A.
Finger, keyserver, or email for PGP 2.6 public key
--------------------------------------------------

---

From: [email-masked] (Kevin Kadow)
Date: 16 Aug 1995 18:40:26 GMT

In article <[email-masked]>,
>| and also if there are any other things I have to take into consideration. 

My personal preference is to have a single version of the binary that behaves
different depending on whether it's invoked as 'pine' or 'rpine', I've modified
Elm to support this behavior. Some things to be taken into account:

	* Subshells
	* Preferences settings for editor,spellcheck, paginator, etc.
	* Any function that uses system(),popen(), or execv().
	* Load/Include from file (only allow from files user owns)
	* Save to file (a thorny issue)

>This is a very useful function.  Why are you advocating disallowing it? 

The same reasoning as applies to my crippled ELM (relm).

It's better to offer user's with restricted access a crippled version of a
good mail user agent than to take one of the only two other options:

	1. Don't give them any mail access at all

	2. Write an agent from scratch than only includes certain functions.

I've designed several systems intended as a BBS, where the majority of
users MUST not be able to load external files, open subshells, or pipe
messages to commands.