Date: Tue, 5 Feb 2002 11:02:25 +0100 From: Christoph Kukulies <kuku@gilberto.physik.RWTH-Aachen.DE> To: "f.johan.beisser" <jan@caustic.org> Cc: Christoph Kukulies <kuku@gilberto.physik.RWTH-Aachen.DE>, freebsd-security@FreeBSD.ORG Subject: Re: .forward+ group writable directory Message-ID: <20020205110225.B56176@gil.physik.rwth-aachen.de> In-Reply-To: <20020205012231.Q21734-100000@localhost>; from jan@caustic.org on Tue, Feb 05, 2002 at 01:25:28AM -0800 References: <200202050920.g159KrP55937@gilberto.physik.RWTH-Aachen.DE> <20020205012231.Q21734-100000@localhost>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tue, Feb 05, 2002 at 01:25:28AM -0800, f.johan.beisser wrote: > On Tue, 5 Feb 2002, Christoph Kukulies wrote: > > > > > Since two days my procmail filter isn't working anymore and I > > see these logs in my maillog. > > > > It's FreeBSD 4.4 with ESMTP Sendmail 8.11.6/8.11.6 (the stock > > that comes withthe distribution). Is it likely that I have been > > hacked? I see otherwise no signs thereof. > > > > > > Feb 5 00:00:04 host sendmail[52966]: g14N03M52963: forward /home/user/.forward.host+: Group writable directory > > Feb 5 00:00:04 host sendmail[52966]: g14N03M52963: forward /home/user/.forward+: Group writable directory > > Feb 5 00:00:04 host sendmail[52966]: g14N03M52963: forward /home/user/.forward.host: Group writable directory > > Feb 5 00:00:04 host sendmail[52966]: g14N03M52963: forward /home/user/.forward: Group writable directory > > i would start with checking your permissions on those files. most likely > either A) the .forward file has 660 permissions (it *should* default to > 755, i think.. depending on your umask), or B) your home directory has a > similar permissions issue. Neither .forward+ nor .forward.host exist. But the problem immediately went away when I changed the homedirectory /home/user from mode 775 to mode 755. I have a .forward but that one has mode 600. I believe 'group writable' refers to the parent directory. But I still do not know why that happened. I cannot recall to have advertently changed the homedirectory to group writable. -- Chris Christoph P. U. Kukulies kuku@gil.physik.rwth-aachen.de To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020205110225.B56176>