Re: Fw: Anonymous Qmail Denial of Service

[Mate Wierdl]

   > But does qmail-queue have to be executable by o?  If a user cannot
   > execute qmail-queue directly, the identification problem disappear,
   > does not it?
   
   That would require qmail-inject and qmail-smtpd, among others, to be suid
   or sgid to some uid/gid that will allow them to execute qmail-queue.
   That would be Wrong(tm).

So what could happen if qmail-inject is sgid qmail?

If this is wrong, then qmail-queue should just immediately write the
invoking uid in the received line.

It still would not prevent a DoS, like

while true; do
      qmail-queue&
      killall qmail-queue
done

but at least invoking uid identification is possible.

Mate