Re: Making root run fetchmail as a user?
Henrique M Holschuh wrote:
> On Mon, 26 Mar 2001, Mark Devin wrote:
> > I would like to make fetchmail run as a user rather than root when run
> > via my /etc/ppp/ip-up.d/fetchmail-up script
>
> You should consider the possibility of trying that using the fetchmail from
> unstable. It is safer... (speaking as the maintainer for fetchmail).
>
Yeah, I am running that one.
> There are much easier ways. The one that strikes me as good for root is to
> run su mail /usr/bin/fetchmail
>
> You can even have fetchmail as the default shell for user mail, and call su
> mail - I think. man su will tell you more.
>
> In most PAM configurations, root can su to another user without any sort of
> autentication checks.
>
> OR, you could simply have cron calling fetchmail for user mail...
>
> I've never heard of anyone cracking fetchmail, but it is NOT crack-proof,
> and I think there are some potential buffer overflows in the code (there
> were in the past).
>
> An hostile server could attack fetchmail. If fetchmail is running as root,
> this _could_ lead to root compromise.
>
> > Any ideas 'cause it would be useful to know how to do it anyway.
>
> Do keep in mind that if you run fetchmail as user 'mail', it cannot change
> uid to deliver mail as it would were it root. This does not make it
> impossible to do what you want, it is just something you have to take into
> account.
>
> I'll play around with the idea and maybe even add something like that to
> Debian's default fetchmail package. No promisses, though.
>
Hmmm. That was very enlightening. Thank you very much.
However, I didn't realise that doing this would cause potential problems with
delivering mail. Is this only if the mail needs to be delivered to another
user?
Because what Andrew Berger suggested was this: su - -c 'fetchmail' $USER
ie if fetchmail is run as the user that ran the pon script then would it
deliver the mail to the user OK but not other users? Thus if run as user mail
then would it have more trouble delivering to the user who called the script
even since he will have a different UID.
Plus I tried that above and it still ran as root - I guess cause root called
the script (via the pon script which was called by pppd which is suid root.)
But then I tried this: su - -c 'fetchmail' mark
and this worked fine and delivered the mail perfectly - but Nb. there is
currently only one user on this system to deliver the mail to.
Hmmm. Thanks again.
Mark.
Reply to: