Bugtraq mailing list archives

Re: procmail


From: ficusk () on-ramp ior com (Ficus Kirkpatrick)
Date: Wed, 7 Aug 1996 13:57:19 -0700


   >   I'm sure procmail MUST have some security feature to disallow this
   > sort of thing? But I could be wrong, and haven't checked the manual
   > pages yet.

   Sendmail disallows this short things by not allowing pipes in .forward
   if user have not valid shell (listed in /etc/shells). Yes, if you
   use procmail as local delivery agent, then you need same kind mechanism
   in procmail also (if it allows piping mail to programs).

The problem there is that for an 'ftp only' account, the shell has to
be in /etc/shells, or FTP will not work (with most FTP servers).

Ficus



Current thread: