From owner-freebsd-hackers  Fri Apr 11 21:03:26 1997
Return-Path: <owner-hackers>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.5/8.8.5) id VAA11782
          for hackers-outgoing; Fri, 11 Apr 1997 21:03:26 -0700 (PDT)
Received: from apolo.biblos.unal.edu.co ([168.176.37.75])
          by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id VAA11777
          for <hackers@freebsd.org>; Fri, 11 Apr 1997 21:03:21 -0700 (PDT)
Received: from unalmodem.usc.unal.edu.co (unalmodem06.usc.unal.edu.co [168.176.3.36])
	by apolo.biblos.unal.edu.co (8.8.5/8.8.5) with SMTP id XAA10651;
	Fri, 11 Apr 1997 23:05:20 -0500 (COT)
Message-ID: <334F24C2.6A21@fps.biblos.unal.edu.co>
Date: Fri, 11 Apr 1997 22:59:30 -0700
From: Pedro Giffuni <pgiffuni@fps.biblos.unal.edu.co>
X-Mailer: Mozilla 3.0 (Win16; I)
MIME-Version: 1.0
To: Giles Lean <giles@nemeton.com.au>
CC: "Jordan K. Hubbard" <jkh@time.cdrom.com>, hackers@freebsd.org
Subject: Re: on the subject of changes to -RELEASEs...
References: <199704120213.MAA10732@topaz.nemeton.com.au>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-hackers@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

Giles Lean wrote:
> 
> On Fri, 11 Apr 1997 17:52:20 -0500 (EST)  pgiffuni@fps.biblos.unal.edu.co wrote:

> > I have not heard of cracking attempts to sendmail RECENTLY,
> 
> These days they're just a given.  Only worth a comment when someone
> breaks (publically) the latest released version.
> 
> >  but it IS
> > recommended to use smrsh (included with sendmail) on all versions. Why
> > aren't we including this?
> 
> Because this requires (as you know) that vacation, procmail and
> whatever else people use from .forward files be installed in the one
> directory that smrsh will run programs from.  This will break existing
> installations.
> 
vacation yes, but AFAIK procmail won't be affected. "ln -s" would
unbreak existing installations :).
 
> I recommend that we make this change for the 3.0 release.
>
I also use the unprivileged mailer, both options were suggested in an
old CERT advisory. Furthermore, I turn sendmail on from inetd under
tcp-wrapper control. Crackers got tired of trying my big box (I think
8-)).

Pedro.  


> Giles