From owner-freebsd-security Mon Oct 25 13:38:12 1999 Delivered-To: freebsd-security@freebsd.org Received: from glitnir.cfar.umd.edu (glitnir.cfar.umd.edu [128.8.132.40]) by hub.freebsd.org (Postfix) with ESMTP id 8017A14A0B for ; Mon, 25 Oct 1999 13:38:00 -0700 (PDT) (envelope-from arensb@cfar.umd.edu) Received: from glitnir.cfar.umd.edu (localhost [127.0.0.1]) by glitnir.cfar.umd.edu (8.9.3/8.9.1) with ESMTP id QAA03330; Mon, 25 Oct 1999 16:38:34 -0400 (EDT) Message-Id: <199910252038.QAA03330@glitnir.cfar.umd.edu> To: Paulo Fragoso Cc: freebsd-security@FreeBSD.ORG Subject: Re: Procmail + Sendmail In-reply-to: Your message of "Mon, 25 Oct 1999 08:37:33 -0200." Date: Mon, 25 Oct 1999 16:38:34 -0400 From: Andrew Arensburger Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Mon, 25 Oct 1999 08:37:33 -0200, Paulo Fragoso wrote: > We've got one server without shell access, only POP3, FTP and HTTP > protocol are permited. We're upgrading this machine to FreeBSD 3.3-RELEASE > and we're thinking use procmail instead mail.local. > > Are there any possible to use .procmailrc like .forward to exec any > programa (like gcc) in this machine? To block .forward we're using SMRSH > on sendmail, works fine. Any user can put anything they like in their .procmailrc, so this is a problem. One solution I've come across is to patch 'procmail' to use 'smrsh' instead of /bin/sh when executing commands. I haven't tried this yet, though, so I don't know how easy this is to do. -- Andrew Arensburger, Systems guy Center for Automation Research arensb@cfar.umd.edu University of Maryland Nine hundred years ago, I couldn't spell transcendent parahuman deity, and now I are one. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message