From owner-freebsd-security Tue Feb 5 2: 2:40 2002 Delivered-To: freebsd-security@freebsd.org Received: from gilberto.physik.RWTH-Aachen.DE (gilberto.physik.RWTH-Aachen.DE [137.226.46.168]) by hub.freebsd.org (Postfix) with ESMTP id 04E7937B43B for ; Tue, 5 Feb 2002 02:02:29 -0800 (PST) Received: (from kuku@localhost) by gilberto.physik.RWTH-Aachen.DE (8.11.6/8.11.6) id g15A2PR56374; Tue, 5 Feb 2002 11:02:25 +0100 (CET) (envelope-from kuku) Date: Tue, 5 Feb 2002 11:02:25 +0100 From: Christoph Kukulies To: "f.johan.beisser" Cc: Christoph Kukulies , freebsd-security@FreeBSD.ORG Subject: Re: .forward+ group writable directory Message-ID: <20020205110225.B56176@gil.physik.rwth-aachen.de> References: <200202050920.g159KrP55937@gilberto.physik.RWTH-Aachen.DE> <20020205012231.Q21734-100000@localhost> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 1.0i In-Reply-To: <20020205012231.Q21734-100000@localhost>; from jan@caustic.org on Tue, Feb 05, 2002 at 01:25:28AM -0800 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Tue, Feb 05, 2002 at 01:25:28AM -0800, f.johan.beisser wrote: > On Tue, 5 Feb 2002, Christoph Kukulies wrote: > > > > > Since two days my procmail filter isn't working anymore and I > > see these logs in my maillog. > > > > It's FreeBSD 4.4 with ESMTP Sendmail 8.11.6/8.11.6 (the stock > > that comes withthe distribution). Is it likely that I have been > > hacked? I see otherwise no signs thereof. > > > > > > Feb 5 00:00:04 host sendmail[52966]: g14N03M52963: forward /home/user/.forward.host+: Group writable directory > > Feb 5 00:00:04 host sendmail[52966]: g14N03M52963: forward /home/user/.forward+: Group writable directory > > Feb 5 00:00:04 host sendmail[52966]: g14N03M52963: forward /home/user/.forward.host: Group writable directory > > Feb 5 00:00:04 host sendmail[52966]: g14N03M52963: forward /home/user/.forward: Group writable directory > > i would start with checking your permissions on those files. most likely > either A) the .forward file has 660 permissions (it *should* default to > 755, i think.. depending on your umask), or B) your home directory has a > similar permissions issue. Neither .forward+ nor .forward.host exist. But the problem immediately went away when I changed the homedirectory /home/user from mode 775 to mode 755. I have a .forward but that one has mode 600. I believe 'group writable' refers to the parent directory. But I still do not know why that happened. I cannot recall to have advertently changed the homedirectory to group writable. -- Chris Christoph P. U. Kukulies kuku@gil.physik.rwth-aachen.de To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message