Subject: Breaking Out Of Pine - A No-no!!

From: [email-masked] (Pete Holsberg)
Date: 17 May 1997 19:08:10 GMT

Here is a response to a question I posted. Is he correct in
saying that "It takes very little effort (you only need to
barely know what you're doing) to get directly to shell
from within Pine."?

I think I barely know what I'm doing, yet I couldn't get a
shell prompt in about 10 minutes of playing around.

Thanks,
Pete

===========

On Fri, 16 May 1997, Pete Holsberg wrote:
> I will have two classes of users: one that is permitted
> to use PPP or shell account, and another that is
> restricted to shell account only (actually, their shell
> will be the "pine" email program). If necessary, the
> accounts for the latter could be on a different machine
> from those of the former.

This is completely unrelated to your question or Livingston
products, but I just thought I'd point out that if your
purpose of giving your users a shell of "pine" is intended
to secure these users against full shell access, you're in
for a nasty surprise. It takes very little effort (you only
need to barely know what you're doing) to get directly to
shell from within Pine.

A nifty thought, however, would be to modify pine to chroot
to the user's home directory, and have their mail delivered
to a mailbox in the home directory (as with qmail, for
instance). Can anyone see why that wouldn't work, offhand?
(ie. you could probably make it to some semblance of a
shell prompt, but you wouldn't be able to do much...)

---

From: "Robert de Bath" <[email-masked]>
Date: Mon, 19 May 1997 07:24:57 +0100 (BST)

Took about 15 seconds ...

1) in 'M-S-C' set enable-unix-pipe-command
2) E-xit and Y-es to save.
3) I-ndex to get message list
4) |-pipe-message to "sh -i < /dev/tty" setting Ctrl-Y for uncaptured.
5) Use the shell :-)

-- 
Rob.                           (Robert de Bath <http://www.cix.co.uk/~mayday>)

---

From: Mike Brudenell <[email-masked]>
Date: Mon, 19 May 1997 09:19:11 +0100 (BST)

You're assuming that the System Manager hasn't disabled the option of
turning on the "enable-unix-pipe-command" option.  If people are wanting
to use Pine in a restricted environment they should look not just at
setting up a systemwide default configuration file, but also a systemwide
"fixed" configuration file.  This prevents options listed in it from being
altered/overridden by users.

Cheers,

-- 
Mike Brudenell                                         <[email-masked]>
------------------------------------------------------------------------
The Computing Service, University of York, Heslington, York, YO1 5DD, UK
Tel: +44-1904-433811  FAX: +44-1904-433740  http://www.york.ac.uk/~pmb1/

* Unsolicited commercial e-mail is NOT welcome at this e-mail address. *

---

From: Joe Young <[email-masked]>
Date: Mon, 19 May 1997 06:34:40 -0400 (EDT)

On my ISP we have text accounts that allow shell access and also a PPP 
account can telnet into and get shell access. Works well for folks who
have the own personal home pages so they can create, edit and change 
their home pages. No having been a part of any other ISP's and having been
with AT&T, until I retired, and where shell accounts were the norm. I 
guess what I am saying, even though I forgot the original question, 
why would the user want to break out of pine, or is it they just don't
have access to a shell access? The second comment I have is about the
admin preventing changing of your .pinerc. I have noticed that even
though I presently own my .pinerc, at times it reverts to root ownership,
maybe through upgrade or the like, and then I again can't change the
options and have to go change it back. Certain things if changed
incorrectly will cause many many core dumps when you access pine, ie:
changing the prune option to 00.0 instead of 99.9. My 2 cents.

Joe Young
New Bern, N.C.

---

From: "Robert de Bath" <[email-masked]>
Date: Mon, 19 May 1997 19:57:19 +0100 (BST)

> altered/overridden by users.
And fixed the alternate-editor, the speller, image-viewer, upload and
download commands, display filters, sending filters, enable-suspend,
subshell for suspend, saving files and adding folders is probably
dangerous (care with enable-dot-files, enable-dot-folders), changing
mailcap, even allowing the user to change the file name of the address
book or .signature file can allow them to overwrite .profile or .pinerc
(for sendmail-path=)

It may well be possible to make a pine session secure, but you have to
be _very_ careful. Pointing $SHELL at a restricted shell or maybe even 
/bin/false will probably help, tho they may stop you being able to send
mail too.