Re: Mailbox vulnerable?

[Hongwei Li]

After I set:

# chmod 1777 /var/spool/mail
# ls -ld /var/spool/mail*
drwxrwxrwt  2 root mail 4096 Jun 28 09:56 /var/spool/mail
drwxr-xr-x  3 root root 4096 May 20 15:02 /var/spool/mailman

My SquirrelMail immediately failed and automatically log out with "Login
failure error".  Then, I checked the system log, and found the followings:

Jun 28 09:57:46 morpheus imap(pam_unix)[29850]: authentication failure;
logname= uid=0 euid=0 tty= ruser= rhost=127.0.0.1  user=hongwei
Jun 28 09:57:49 morpheus imapd[29850]: Login failed user=hongwei
auth=hongwei host=localhost.localdomain [127.0.0.1]
Jun 28 09:57:52 morpheus imapd[29850]: Command stream end of file, while
reading line user=hongwei host=localhost.localdomain [127.0.0.1]
Jun 28 09:58:05 morpheus imap(pam_unix)[29856]: authentication failure;
logname= uid=0 euid=0 tty= ruser= rhost=127.0.0.1  user=hongwei
Jun 28 09:58:07 morpheus imapd[29856]: Login failed user=hongwei
auth=hongwei host=localhost.localdomain [127.0.0.1]
Jun 28 09:58:10 morpheus imapd[29856]: Command stream end of file, while
reading line user=hongwei host=localhost.localdomain [127.0.0.1]

I am afraid that other users will immediately complain to me, so I had to
put it back as before, then I can use my squirrelmail.

What is wrong?  Thanks!

Hongwei
> drwxrwxrwt root mail
>
> It's because Fedora 1 has a different version of imap than
> 7.3.
>
> Quoting Hongwei Li :
> > Thanks!  But my rh7.3 box has
> >
> > # ls -ld /var/spool/mail/
> > drwxr-xr-x    2 root     root         4096 Jun 28 08:00
> > /var/spool/mail/
> >
> > but never shows any warning message.  Is it because rh7.3
> > is too old?
> >
> > Also, should it be drwxrwxrwt or drwxrwxr-t? should it be
> >
> > drwxrwxrwt root mail
> >
> > or
> >
> > drwxrwxrwt root root?
> >
> > Thanks!
> > > /var/spool/mail should have the following permissions:
> > > drwxrwxrwt (it should have the sticky bit set).
> > >
> > > Quoting Hongwei Li :
> > > > Hi,
> > > >
> > > > We have a fc1 box.  We have he permissions setting as:
> > > >
> > > > # ls -ld /var/spool/mail
> > > > drwxrwxr-x  2 root mail 4096 Jun 28 08:43
> >
> > /var/spool/mail
> > > > # ls -ld /tmp
> > > > drwxrwxrwt  11 root root 24576 Jun 28 08:43 /tmp
> > > >
> > > > The LogWatch always shows the warning:
> > > >
> > > > Mailbox vulnerable - directory /var/spool/mail must
> >
> > have
> > > > 1777 protection
> > > >
> > > > When a regular user (except root) opens pine to read
> > > > mails, he also sees
> > > > this message at the very beninning for about 1 to 2
> > > > seconds.  As I
> > > > understand, the permission drwxrwxr-x is correct.
> >
> > What
> > > > is wrong?  Do I
> > > > need to change the permission on the mail directory?
> >
> > if
> > > > yes, change it to
> > > > what?
> > > >
> > > > Thanks!
> > > >
> > > > Hongwei
> > > >
> > > > --
> > > > fedora-list mailing list
> > > > [e-mail]
> > > > To unsubscribe:
> > > > http://www.redhat.com/mailman/listinfo/fedora-list
> > > This message was sent using IMP, the Internet Messaging
> >
> > Program.
> > > --
> > > fedora-list mailing list
> > > [e-mail]
> > > To unsubscribe:
> >
> > http://www.redhat.com/mailman/listinfo/fedora-list
> > >
> >
> > --
> > fedora-list mailing list
> > [e-mail]
> > To unsubscribe:
> > http://www.redhat.com/mailman/listinfo/fedora-list
>
> This message was sent using IMP, the Internet Messaging Program.
>
> --
> fedora-list mailing list
> [e-mail]
> To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list