Subject: Problem with pine/imapd permissions?

From: John Outerbridge <[email-masked]>
Date: Mon, 22 Jul 1996 14:43:41 -0400 (EDT)

We have a mail server (RedHat Linux 3.0.3) running imapd.  When 
the server is accessed via imapd by a user running pine (with
"inbox-path={<server>}inbox" in ~/.pinerc), pine reports 
"Error creating /var/spool/mail/<user>.lock.xxx: Permission denied". 

In the RedHat distribution, /var/spool/mail is writeable only by user
(root) and group (mail), and files within this directory are created with
group mail.  However /usr/sbin/imapd has owner root and group root.

Changing imapd to make it sgid to mail eliminates the error message from 
the imap client (remote pine program).  Is this a reasonable/safe solution?

--
John Outerbridge			     Internet:	[email-masked]
Centre for Nonlinear Dynamics		     Telephone:	514 398 4340
McGill University, Montreal, Canada H3G1Y6   Fax:       514 398 7452

---

From: Mark Crispin <[email-masked]>
Date: Mon, 22 Jul 1996 19:19:00 -0700

On 22 Jul 1996, John Outerbridge wrote:

> group mail.

This is a bug in RedHat.  It is caused by well-intentioned, but naive,
individuals who feel that there is more "security" by giving every email
program privileges than there is by making their /var/spool/mail work in a
secure fashion without privileges.

> However /usr/sbin/imapd has owner root and group root.

imapd logs itself in as the indicated user.

> the imap client (remote pine program).  Is this a reasonable/safe solution?

No, it is not at all reasonable or safe to add to the number of programs
which run with privileges.  Nor is it reasonable to require that mail
programs run with privileges, thus leaving users hostage to system
managers for their email software. 

The reasonable and safe thing to do is to make the mail spool work
without requiring privileged programs.  That is:

1) Protect /var/spool/mail 1777 -- world read/write with the sticky bit.

2) Make sure that every user has a mail file owned by the user and
   protected 600.

3) Make sure that your mail delivery program (typically /bin/mail) will
   not deliver to mail files which have links, are symbolic links, or are
   not owned by the intended recipient.  Do system security logging every
   time a violation of one of these rules is discovered.

4) Unless you intend to allow multiple people to read a mailbox, also
   force all mail files to have a protection of 600 in the mail delivery
   program.

-- Mark --	Read http://www.imap.org for the "best kept secret in email"

DoD #0105, R90/6 pilot, FAX: (206) 685-4045  ICBM: N 47 39'35" W 122 18'39"
Science does not emerge from voting, party politics, or public debate.