custom rules within user_prefs

[ian douglas <id...@w98.us>]

Hi all, long-time SpamAssassin user. I released an open-source web-based 
training script for CPanel hosting users to train spam/ham based on 
various configurations, and it's been very well received with a handful 
of CPanel-based hosting groups that I've shown it to. Check out 
http://iandouglas.com/page.php?3 if anyone's interested.

Introductions aside, I shut down my own hosting business in 2004 after 7 
successful years, and now host a handful of domains with various 
CPanel-based hosting groups. I found this wiki reference today after 
searching around for how to let users write their own custom SA rules 
within user_prefs:


http://wiki.apache.org/spamassassin/WritingRules
"Note: if you use spamd, rules placed in user_prefs will be IGNORED by 
default. If you add the allow_user_rules option to your local.cf you can 
get spamd to honor them. However, before you enable it, you should know 
that this is disabled by default for security reasons. In theory a 
malicious local user might be able to exploit spamd with a clever regex 
and gain root permissions. I know of no specific vulnerabilities of this 
type in spamassassin at this time, but it is a possibility. I'd only 
turn this on if you trust your local users not to try to hack root."


I was curious whether the security implications as mentioned in the wiki 
page referenced above have been addressed at all, and whether or not it 
would be considered relatively 'safe' yet to let users write their own 
SA rules within their user_prefs, or perhaps a compromise of listing the 
individual users within the local.cf file instead of a global "let 
everyone do it" setting?

Thanks for any thoughts,
-id

Re: custom rules within user_prefs

[ian douglas <id...@w98.us>]

Thanks, Matt and Loren for your responses.

Since I'm hosting with a shared hosting environment company myself, I 
was asking those questions more on a hunt for information so I could 
suggest to my provider to allow it. But I definitely get Loren's warning 
about having performance issues if parsing takes 'too long'. And I don't 
see these guys being terribly proficient at (or excited about) tinkering 
with CPanel code since they don't give us SSH access.

Guess I'll just deal with the default rules and keep training with sa-learn.

Thanks again,
Ian

Re: custom rules within user_prefs

[Loren Wilton <lw...@earthlink.net>]

While I agree completely with Matt that user rules are in general pretty 
safe, there is one more thing to be aware of.  A badly-written regex can end 
up being a DOS attack on SA itself, and by implication on the system and 
mail processing path.  Something with lots of * lengths and backtracking 
could take minutes or hours to process if crafted carefully.  Or even 
carelessly by an idiot.

Since you are going through CPanel, perhaps you could put in something that 
scans for and disallows * lengths in the allowed regexes, forcing people to 
code {0,80} or whatever in place.  That can still take a long time if 
carefully mis-crafted, but in general will prevent well-meaning accidents.

        Loren

Re: custom rules within user_prefs

[Matt Kettler <mk...@verizon.net>]

ian douglas wrote:
>
> "Note: if you use spamd, rules placed in user_prefs will be IGNORED by
> default. If you add the allow_user_rules option to your local.cf you
> can get spamd to honor them. However, before you enable it, you should
> know that this is disabled by default for security reasons. In theory
> a malicious local user might be able to exploit spamd with a clever
> regex and gain root permissions. I know of no specific vulnerabilities
> of this type in spamassassin at this time, but it is a possibility.
> I'd only turn this on if you trust your local users not to try to hack
> root."
>
>
> I was curious whether the security implications as mentioned in the
> wiki page referenced above have been addressed at all, and whether or
> not it would be considered relatively 'safe' yet to let users write
> their own SA rules within their user_prefs, or perhaps a compromise of
> listing the individual users within the local.cf file instead of a
> global "let everyone do it" setting?
Realistically, it's pretty safe. I wrote that quite a long time ago
(back in SA 2.43 days) I still know of no attack that would exploit this.

Really this isn't about an real or known threat, it's about the fact
that it's difficult to secure regular expressions in all possible cases.
Lots of evil tricks can be done to create a regex that winds up invoking
a shell script, etc. This is simply an "extra blanket" of security
against these kinds of attacks.

Over the years, spamd has also picked up an additional defense against
this attack. It *never* scans mail while running as root, and if for
some reason it is still running as root, it will setuid itself to
nobody. You can't exploit spamd for root access through this vector
unless it executes a poison regex while running as root.

I would still advise keeping it off if you have highly untrustworthy
users (ie: you're at defcon), especially if they have shell access too.
However, if your users are just doing web configs, have no shell login,
and aren't a particularly motley crew, you're probably safe enabling it.

In short: keeping it on offers you extra security, but there are other
mechanisms in place.