Subject: Securing uw-imapd

From: Przemyslaw Wegrzyn <[email-masked]>
Date: Tue, 25 Sep 2001 17:07:51 +0200 (CEST)

I have recentyl discovered that user can do something like this:

00 LOGIN user pass
00 SELECT /etc/passwd
00 FETCH 1 RFC822.TEXT

How can I restrict users to access files below their homes only ?

-=Czaj-nick=-

-- 
------------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/imap/c-client-list.html
------------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Thu, 27 Sep 2001 19:38:56 -0700 (PDT)

> I have recentyl discovered that user can do something like this:

That is correct.  A user of a default-configured imapd can access any file
that he can access from the shell.

> How can I restrict users to access files below their homes only ?

Refer to imap-2001/docs/CONFIG for a pointer to the routine which
translates a mailbox name to a file name.  Hack that routine so that any
unapproved name doesn't work.

-- Mark --

http://staff.washington.edu/mrc
Science does not emerge from voting, party politics, or public debate.