From owner-freebsd-security Tue Feb 5 1:26:52 2002 Delivered-To: freebsd-security@freebsd.org Received: from pogo.caustic.org (caustic.org [64.163.147.186]) by hub.freebsd.org (Postfix) with ESMTP id 4056A37B41C for ; Tue, 5 Feb 2002 01:26:48 -0800 (PST) Received: from localhost (jan@localhost) by pogo.caustic.org (8.11.6/8.11.6) with ESMTP id g159PTD31341; Tue, 5 Feb 2002 01:25:29 -0800 (PST) (envelope-from jan@caustic.org) Date: Tue, 5 Feb 2002 01:25:28 -0800 (PST) From: "f.johan.beisser" X-X-Sender: jan@localhost To: Christoph Kukulies Cc: freebsd-security@FreeBSD.ORG Subject: Re: .forward+ group writable directory In-Reply-To: <200202050920.g159KrP55937@gilberto.physik.RWTH-Aachen.DE> Message-ID: <20020205012231.Q21734-100000@localhost> X-Ignore: This statement isn't supposed to be read by you X-TO-THE-FBI-CIA-AND-NSA: HI! HOW YA DOIN? MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Tue, 5 Feb 2002, Christoph Kukulies wrote: > > Since two days my procmail filter isn't working anymore and I > see these logs in my maillog. > > It's FreeBSD 4.4 with ESMTP Sendmail 8.11.6/8.11.6 (the stock > that comes withthe distribution). Is it likely that I have been > hacked? I see otherwise no signs thereof. > > > Feb 5 00:00:04 host sendmail[52966]: g14N03M52963: forward /home/user/.forward.host+: Group writable directory > Feb 5 00:00:04 host sendmail[52966]: g14N03M52963: forward /home/user/.forward+: Group writable directory > Feb 5 00:00:04 host sendmail[52966]: g14N03M52963: forward /home/user/.forward.host: Group writable directory > Feb 5 00:00:04 host sendmail[52966]: g14N03M52963: forward /home/user/.forward: Group writable directory i would start with checking your permissions on those files. most likely either A) the .forward file has 660 permissions (it *should* default to 755, i think.. depending on your umask), or B) your home directory has a similar permissions issue. hope this gives you something to start with.. -------/ f. johan beisser /--------------------------------------+ http://caustic.org/~jan jan@caustic.org "John Ashcroft is really just the reanimated corpse of J. Edgar Hoover." -- Tim Triche To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message