I agree. If someone has root access, you are screwed. But this stance does beg the question: Why do we hash passwords in the .tab files then?
While I prefer that passwords are hashed, I understand your stance here. Now imagine someone running PHPNuke on the same box as Xmail. What if there is a directory traversal security issue with that app that allows someone (without true root access) to view random files on your box? This is where life gets scary... The same goes for any *nix/Win machine that may run web applications on it. I happen to run web apps on my mail machine, so this is of particular importance to me. To my knowledge, I have no applications that have security issues, but lets be realistic...I just don't know about them. This goes for everyone out there. System services, default installs, insecure developers...the web is scary :) Currently I yank the logs off the box daily, but this is not really a good way to solve the problem. -tim -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Davide Libenzi Sent: Tuesday, September 23, 2003 12:55 PM To: XMail mailing list Subject: [xmail] Re: Hide password in log On Tue, 23 Sep 2003, Michal Altair Valasek wrote: > > Hello, > > |> I have enabled POP logs. Is there any way to hide passwords=20 > |in that log? > | > |What about setting the correct permissions to MAIL_ROOT ? > > It's the immediate solution, but the basic security rule is not to > give = a chance - and no not rely on one thing. It's why you should > patch your = server > even when you're behind firewall. And why you should not store sensitive > data secured only by access rights.=20 > > Especially when you recommend to run XMail in SYSTEM security context, > = and thus allow access to anyone running the same context - for > example any = other > similar server software, which may have a security hole. Look, if someone get root/SYSTEM in your machine, hiding passwords from a log file does not help at all. Password cannot be hashed since they're required in plain when doing POP3/IMAP auths, and this can have the attacker to get them. A root/SYSTEM can do anything he wants on your machine, and this is by definition. - Davide - To unsubscribe from this list: send the line "unsubscribe xmail" in the body of a message to [EMAIL PROTECTED] For general help: send the line "help" in the body of a message to [EMAIL PROTECTED] - To unsubscribe from this list: send the line "unsubscribe xmail" in the body of a message to [EMAIL PROTECTED] For general help: send the line "help" in the body of a message to [EMAIL PROTECTED]
