Re: spamd security

[Justin Mason <jm...@jmason.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Matt Kettler writes:
> At 05:26 PM 7/13/2004, Dimitrios wrote:
> >I would run to run spamd on a Linux server which also hosts several other 
> >peoples domains.
> >
> >Thus, i want to limit spamd use for me only.
> >
> >1) is it possible to disable spamd from binding to an IP address? even 
> >127.0.0.1? so that nobody can communicate to it that way. Though spamd 
> >should still be able to run network tests.
> 
> No, because spamd only supports inet sockets for communication with spamc. 
> If it did not bind any IP nobody running spamc would be able to communicate 
> with it, not even you.

actually -- I think --listen-ip would do that.   Tell it to bind to just
one interface with that.

> >2) i can force it to use a Unix socket within my home dir, with restricted 
> >permissions. is there any other way someone could access spamd that i need 
> >to know?
> 
> No, the spamd/spamc pair doesn't support unix sockets at this time, only 
> inet socekts.

actually, it does too support unix-domain sockets ;)

> >3) spamd seems to use syslog for logging. since i dont have root access to 
> >the machine, i dont have access to syslogd. is there a way i can tell 
> >spamd to log to a file (and i'd like to avoid runing my own syslogd)?
> 
> No, at present there's no way to defeat spamd's use of syslog.
> 
> Really, spamd is intended to be a system daemon. It's not intended to be a 
> "restricted to one user" tool.

...and, actually, in 3.0.0 you can log to file or to stderr.

(Sorry Matt -- just had to catch you on those ;)

- --j.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Exmh CVS

iD8DBQFA9GvtQTcbUG5Y7woRAq8OAKCmACubTUbe46mylwd/qYsHWlCyLgCdHVfn
RveiQagvg/biFBq3mGFsr9w=
=1Uiq
-----END PGP SIGNATURE-----

Re: spamd security

[Dimitrios <se...@altered.com>]

On Tue, 13 Jul 2004 16:10:37 -0700 "Justin Mason" <jm...@jmason.org> wrote:

> actually -- I think --listen-ip would do that.   Tell it to bind to just
> one interface with that.

though even if i restrict it to 127.0.0.1, another local user can still access my spamd.

 
> actually, it does too support unix-domain sockets ;)

indeed! :)
 

> ...and, actually, in 3.0.0 you can log to file or to stderr.

i'm going to try what Keith suggested and use "spamd -s stderr" to log to a file.

i dont want to upgrade to 3.0.0 yet, i'll wait for several months to make
sure its stable enough.

Re: spamd security

[Dimitrios <se...@altered.com>]

On Tue, 13 Jul 2004 22:12:35 -0400 "Matt Kettler" <mk...@comcast.net> wrote:

> So can you do --listen-ip 0.0.0.0 or some such to disable inet binding 
> entirely?

0.0.0.0 means to bind to all inet interfaces.

Matt, thanks for the suggestions, i'll try the unix socket and see how that works.

Re: spamd security

[Matt Kettler <mk...@comcast.net>]

At 04:10 PM 7/13/04 -0700, Justin Mason wrote:
> > >1) is it possible to disable spamd from binding to an IP address? even
> > >127.0.0.1? so that nobody can communicate to it that way. Though spamd
> > >should still be able to run network tests.
> >
> > No, because spamd only supports inet sockets for communication with spamc.
> > If it did not bind any IP nobody running spamc would be able to 
> communicate
> > with it, not even you.
>
>actually -- I think --listen-ip would do that.   Tell it to bind to just
>one interface with that.

Actualy justin, that's exactly what he wanted to prevent.. I wanted it to 
NOT bind. Not to an interface, not to a loopback, not anything in the inet 
domain.

So can you do --listen-ip 0.0.0.0 or some such to disable inet binding 
entirely?

>actually, it does too support unix-domain sockets ;)

Yes, I self corrected on that one. Does binding to a unix domain socket 
disable inet binding?

>...and, actually, in 3.0.0 you can log to file or to stderr.

That's good to know. There are a few people, such as Dimitrios, who have a 
legitamate use for it. However, my money is that 90% of the people who use 
it are people who just don't know how to configure syslogd. :)


>(Sorry Matt -- just had to catch you on those ;)

Hey, I'm hardly perfect, although I am at least good. :)

Re: spamd security

["Keith C. Ivey" <kc...@cpcug.org>]

Justin Mason <jm...@jmason.org> wrote:
> Matt Kettler writes:

> > No, at present there's no way to defeat spamd's use of syslog.
> > 
> > Really, spamd is intended to be a system daemon. It's not
> > intended to be a "restricted to one user" tool.
> 
> ...and, actually, in 3.0.0 you can log to file or to stderr.

Even in 2.63 you can use "spamd -s stderr" to log to stderr.  
It's what those of us who run it under daemontools generally do 
(redirecting then to stdout, which gets handled by multilog).
So the original poster should be able to redirect it from there 
to a file.

-- 
Keith C. Ivey <kc...@cpcug.org>
Washington, DC