On 2007-08-22, at 1952, John Simpson wrote:
On 2007-08-22, at 1534, Bob wrote:
Many of us use either qmail-scanner-queue or simscan via patched
qmail ahead of vpopmail. If, as is good prcatice, we allow the
scanner to run under its own user ID, vchkpw will fail because
instead of running as user "vchkpw" it is running as the scanner
user which doesn't have access to the password files. I would like
to suggest that in the make install, the permission for vchkpw be
set to 4711 so that it will always execute as the vchkpw user.
Doing this will eliminate a bit of extra work when upgrading and
will stop the large number of user questions when they do their
qmail installs.
i've been doing this for several years.
let me correct this statement... i DID this for years, but i don't do
it any longer.
the problem that bob is talking about is this- if somebody is using
the normal AUTH patch for qmail, and wants to use "vchkpw" as a
method of allowing qmail-smtpd to validate AUTH commands, the
"vchkpw" command needs to have permission to read the vpasswd.cdb
files. and if it runs as the "qmaild" user, it doesn't have that
permission.
one solution, and what i did myself for a few years, is to make
"vchkpw" run setuid root. however, some people set up vpopmail
domains using different system uid's (i.e. vadddomain with the "-u"
option) for different domains, as a way to implement "domain quotas"
by setting a filesystem quota on the uid which controls the domain.
in this situation, you do NOT want vchkpw to be setuid to the
vpopmail user.
a better solution is to make qmail-smtpd use something other than a
checkpassword program (which is what "vchkpw" actually is) to verify
passwords. this was the reason that i wrote an addition to my
combined qmail patch, which teaches qmail-smtpd to use an "auth.cdb"
file, with email addresses as keys and encrypted passwords as values,
to validate AUTH commands. since i've started using this, i haven't
needed "vchkpw" to be setuid, and in fact it's not setuid on my
server any more.
one of these days i'll get around to writing an AUTH_CDB patch for
djb's virgin qmail-1.03 code, and probably for netqmail-1.05 as well,
but for now it's available in my combined patch (which has lots of
other yummy features as well.)
| John M. Simpson--- KG4ZOW ---Programmer At Large |
| http://www.jms1.net/ <[EMAIL PROTECTED]> |
| http://video.google.com/videoplay?docid=-1656880303867390173 |
PGP.sig
Description: This is a digitally signed message part
