Date: Mon, 10 Jun 1996 00:15:35 -0600 (MDT) From: Ade Barkah <mbarkah@hemi.com> To: rgrimes@GndRsh.aac.dev.com (Rodney W. Grimes) Cc: freebsd-security@freebsd.org Subject: Re: setuid root sendmail vs. mode 1733 /var/spool/mqueue? Message-ID: <199606100615.AAA05361@hemi.com> In-Reply-To: <199606100512.WAA15320@GndRsh.aac.dev.com> from "Rodney W. Grimes" at Jun 9, 96 10:12:05 pm
next in thread | previous in thread | raw e-mail | index | archive | help
Rodney Grimes wrote: > On mail hub servers I usually make /tmp and /var/tmp a seperate > partition to avoid this denial of service attack, makeing > /var/spool/mqueue 1733 would open it back up :-(. > > It is impossible to totally close, as the user can mail himself > or someone else a large file, or lots of smaller files :-(. Like /tmp, we have a separate filesystem for /var/mail, and we put the mqueue directory as /var/mail/mqueue (you can either do this by making /var/spool/mqueue a link to /var/mail/mqueue or explicitly in the sendmail.cf file.) | Filesystem 1K-blocks Used Avail Capacity Mounted on | /dev/sd0s2f 127151 6619 110359 6% /tmp | /dev/sd0s2g 127151 18397 98581 16% /var/mail We hope to minimize damage this way in case of a denial of service via mail. Regards, -Ade ------------------------------------------------------------------- Inet: mbarkah@hemi.com - HEMISPHERE ONLINE - <http://www.hemi.com/>; -------------------------------------------------------------------
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199606100615.AAA05361>