Subject: Winsock PC-Pine and SENDMAIL with SETGID.

From: "Michael H. Martel" <[email-masked]>
Date: Tue, 30 Jan 1996 11:56:11 -0500 (EST)

Hello!

I recently received a complaint about two users getting the same piece of 
mail. Normally this would be normal, except that the sender swears that 
the message was sent to only one of them.  Ok fine.  I verified that 
there are no aliases and no .forward files that would account for this 
behavior.  

Then I remembered that sendmail on this machine (AIX 3.2.5) is configured 
for SETGID.  I then further remembered that this is a shared lab, where 
PC-Pine (Windoze/Winsock version) resides on the local workstation and  
prompts users for their username and password.  It occured to me that it 
is possible that PC-Pine (3.91) is not correctly deciding what spool file 
to use when it connects.  

User 1 connects to the mailhost and retrieves mail.  They then quit 
PC-Pine and User 2 fires it up.  User 2 connects to the mailhost, 
authenticated as User 2, but is able to access User 1's mailbox because 
of SENDMAIL being SETGID.

I'm still waiting for the actual mail messages with full headers to 
verify this problem, as I cannot re-produce it on demand.  Is there any 
way that PC-Pine could be acting as I've described ? (Maybe without 
exiting it before the next person goes into it ?)

On a related subject, should SENDMAIL be run with or without the SETGID 
option ? Is it safer and more secure or is it more of a problem ?

Thanks!

Michael

 ----------------------------------------------------------------
 Michael H. Martel              | Vermont State Colleges        
 [email-masked]           | Technical Support Specialist
 http://www.vsc.edu/~michael    | PH:802-241-2535 FX:802-241-3363