You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Kārlis Repsons <ka...@gmail.com> on 2011/07/08 18:41:36 UTC
Securing spamd
All,
I'd like you to review approximately how I'm running spamd. My concern
is security. You can see that the child processes are run by spamd user,
but the main process is still run by root:
ps -C spamd -o user,cmd
USER CMD
root /usr/sbin/spamd -d -r /var/run/spamd.pid -m 2 -u spamd --nouser-config --helper-home-dir=/sysram/spamassassin --allow-tell
spamd spamd child
spamd spamd child
How secure is that (no I didn't make any crazed chroots or so) and what
would you suggest to isolate spamd from possible outside intrusions?
Thanks...
Re: Securing spamd [single (non root) OS user]
Posted by "ml@smtp.fakessh.eu" <ml...@smtp.fakessh.eu>.
Le vendredi 8 juillet 2011 19:00, Andrzej Adam Filip a écrit :
> Kārlis Repsons <ka...@gmail.com> wrote:
> > All,
> > I'd like you to review approximately how I'm running spamd. My concern
> > is security. You can see that the child processes are run by spamd user,
> > but the main process is still run by root:
> >
> > ps -C spamd -o user,cmd
> > USER CMD
> > root /usr/sbin/spamd -d -r /var/run/spamd.pid -m 2 -u spamd
> > --nouser-config --helper-home-dir=/sysram/spamassassin --allow-tell spamd
> > spamd child
> > spamd spamd child
> >
> > How secure is that (no I didn't make any crazed chroots or so) and what
> > would you suggest to isolate spamd from possible outside intrusions?
> > Thanks...
>
> Do you need spamd changing OS user ids? (e.g. to access ~/.spamassassin/ )
>
> I have used "personal" [single (non root) OS user] spamd without any
> problems.
e.g in my system
folder .spamassassin is owned by group users
r13151 ~]# ls -al /home/fakessh/.spamassassin/
total 44
drwx------ 2 fakessh users 4096 jui 6 20:31 .
drwxr-xr-x 19 fakessh users 4096 jui 6 01:38 ..
-rw------- 1 fakessh users 12288 jui 6 00:17 auto-whitelist
-rw------- 1 fakessh users 12288 jui 6 00:16 bayes_seen
-rw------- 1 fakessh users 12288 jui 6 20:31 bayes_toks
-rw------- 1 fakessh users 1869 jui 5 23:54 user_prefs
--
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x092164A7
gpg --keyserver pgp.mit.edu --recv-key 092164A7
Re: Securing spamd [single (non root) OS user]
Posted by Andrzej Adam Filip <an...@gmail.com>.
Kārlis Repsons <ka...@gmail.com> wrote:
> All,
> I'd like you to review approximately how I'm running spamd. My concern
> is security. You can see that the child processes are run by spamd user,
> but the main process is still run by root:
>
> ps -C spamd -o user,cmd
> USER CMD
> root /usr/sbin/spamd -d -r /var/run/spamd.pid -m 2 -u spamd --nouser-config --helper-home-dir=/sysram/spamassassin --allow-tell
> spamd spamd child
> spamd spamd child
>
> How secure is that (no I didn't make any crazed chroots or so) and what
> would you suggest to isolate spamd from possible outside intrusions?
> Thanks...
Do you need spamd changing OS user ids? (e.g. to access ~/.spamassassin/ )
I have used "personal" [single (non root) OS user] spamd without any problems.
--
[pl>en: Andrew] Andrzej Adam Filip : anfi@onet.eu
I have made this letter longer than usual because I lack the time to
make it shorter.
-- Blaise Pascal
Re: Securing spamd
Posted by Kārlis Repsons <ka...@gmail.com>.
On Friday 08 July 2011 17:34:13 Benny Pedersen wrote:
> > On Friday 08 July 2011 17:00:50 Andrzej Adam Filip wrote:
> >> Do you need spamd changing OS user ids? (e.g. to access
> >> ~/.spamassassin/ )
> >
> > No, I don't!
>
> one could ask how to configure it
A small server. And configuration is group-writable!
Re: Securing spamd
Posted by Benny Pedersen <me...@junc.org>.
On Fri, 8 Jul 2011 17:03:35 +0000, Kārlis Repsons wrote:
> Stop what?
questions ?
> I tried with --port=2580, but still one root process. But you meant
> it's not
> worth worrying about?
some have answered this already
>
> On Friday 08 July 2011 17:00:50 Andrzej Adam Filip wrote:
>> Do you need spamd changing OS user ids? (e.g. to access
>> ~/.spamassassin/ )
> No, I don't!
one could ask how to configure it
Re: Securing spamd
Posted by Andrzej Adam Filip <an...@gmail.com>.
Kārlis Repsons <ka...@gmail.com> wrote:
> On Friday 08 July 2011 16:54:22 Benny Pedersen wrote:
>> On Fri, 8 Jul 2011 16:41:36 +0000, Kārlis Repsons wrote:
>> > All,
>> > I'd like you to review approximately how I'm running spamd. My
>> > concern
>> > is security. You can see that the child processes are run by spamd
>> > user,
>> > but the main process is still run by root:
>> >
>> > ps -C spamd -o user,cmd
>> > USER CMD
>> > root /usr/sbin/spamd -d -r /var/run/spamd.pid -m 2 -u spamd
>> > --nouser-config --helper-home-dir=/sysram/spamassassin --allow-tell
>> > spamd spamd child
>> > spamd spamd child
>> >
>> > How secure is that (no I didn't make any crazed chroots or so) and
>> > what
>> > would you suggest to isolate spamd from possible outside intrusions?
>> > Thanks...
>>
>> 1: root is needed for any bind ports below 1024
>>
>> 2: but the root user do no threads for spamd
>>
>> same goes for eg apache, maybe i should stop it ? -)
> Stop what?
> I tried with --port=2580, but still one root process. But you meant it's not
> worth worrying about?
>
> On Friday 08 July 2011 17:00:50 Andrzej Adam Filip wrote:
>> Do you need spamd changing OS user ids? (e.g. to access ~/.spamassassin/ )
> No, I don't!
As "the non root user" execute spamd with parameters reported by ps with
--port=2580 added.
If you want more detailed instructions then name your OS/Distribution.
I have used "personal spamd" for my not root OS account. The spamd had
been listening on unix socket, spamc had been executed with --config (file)
option.
I needed automatic classification spam/?/ham before fast automatic reporting on spamtrap server :-)
--
[pl>en: Andrew] Andrzej Adam Filip : anfi@onet.eu
The less a statesman amounts to, the more he loves the flag.
-- Kin Hubbard
Re: Securing spamd
Posted by Kārlis Repsons <ka...@gmail.com>.
On Friday 08 July 2011 16:54:22 Benny Pedersen wrote:
> On Fri, 8 Jul 2011 16:41:36 +0000, Kārlis Repsons wrote:
> > All,
> > I'd like you to review approximately how I'm running spamd. My
> > concern
> > is security. You can see that the child processes are run by spamd
> > user,
> > but the main process is still run by root:
> >
> > ps -C spamd -o user,cmd
> > USER CMD
> > root /usr/sbin/spamd -d -r /var/run/spamd.pid -m 2 -u spamd
> > --nouser-config --helper-home-dir=/sysram/spamassassin --allow-tell
> > spamd spamd child
> > spamd spamd child
> >
> > How secure is that (no I didn't make any crazed chroots or so) and
> > what
> > would you suggest to isolate spamd from possible outside intrusions?
> > Thanks...
>
> 1: root is needed for any bind ports below 1024
>
> 2: but the root user do no threads for spamd
>
> same goes for eg apache, maybe i should stop it ? -)
Stop what?
I tried with --port=2580, but still one root process. But you meant it's not
worth worrying about?
On Friday 08 July 2011 17:00:50 Andrzej Adam Filip wrote:
> Do you need spamd changing OS user ids? (e.g. to access ~/.spamassassin/ )
No, I don't!
Re: Securing spamd
Posted by Benny Pedersen <me...@junc.org>.
On Fri, 8 Jul 2011 16:41:36 +0000, Kārlis Repsons wrote:
> All,
> I'd like you to review approximately how I'm running spamd. My
> concern
> is security. You can see that the child processes are run by spamd
> user,
> but the main process is still run by root:
>
> ps -C spamd -o user,cmd
> USER CMD
> root /usr/sbin/spamd -d -r /var/run/spamd.pid -m 2 -u spamd
> --nouser-config --helper-home-dir=/sysram/spamassassin --allow-tell
> spamd spamd child
> spamd spamd child
>
> How secure is that (no I didn't make any crazed chroots or so) and
> what
> would you suggest to isolate spamd from possible outside intrusions?
> Thanks...
1: root is needed for any bind ports below 1024
2: but the root user do no threads for spamd
same goes for eg apache, maybe i should stop it ? -)