On Mon, 2008-01-21 at 09:16 +0200, Sim Zacks wrote: > Are there any server-side security possibilities involved in dbmail?
Yes. > For > example, is it at all possible that a received email attachment will > actually execute on the server? That case is not likely, but there are other ways to get things to execute, eg. if you found and exploited a buffer overflow or point of sql injection. > Or could a mail with specific headers > cause the dbmail to execute shell commands or run an application? It's not designed to execute commands from the headers, but that doesn't mean there will never be any errors found that would allow that to happen, or even that libraries dbmail uses (eg. gmime) wouldn't have an error and allow that. > I'm trying to decide if it makes sense to put the dbmail on my > production server or if I should lock it down on its own server. It would be more secure to keep it isolated, though you can do that on one physical box as well (eg. in a virtual machine, or maybe even running chroot). If you have users on the shared server, or any other access (eg. a webserver running), or use a shared database, then the installation procedures (eg. file permissions and whatnot) are of much greater consequence. But security is complex, there's no one-size-fits-all answer. -- Jesse Norell Kentec Communications, Inc. [EMAIL PROTECTED] _______________________________________________ DBmail mailing list [email protected] https://mailman.fastxs.nl/mailman/listinfo/dbmail
