[PREVIOUS CHAPTER] [NEXT CHAPTER]

9 Security

    9.1	On security

    Fundamentally
    	1	deny all
    	2	permit explicitly things we believe as secure
    	3	ask ambiguous situations to a maintainer
    		e.g. insecure syntax commands?

    9.2	Security Check Routine

    Two security policy concepts for security are typical.
    	1 deny all, permit secure conditions
    	2 permit all, deny known insecure conditions.

    fml works under policy 1.

    &SecureP function checks under the policy "1 deny all, permit secure
    conditions". It restricts the fml command syntax. The rule is

        1 	ignore \w/\w , deny both ../ and .[a.]/
    	permit special command syntax m=\d+.

        2   permit /^[\#\s\w\-\.\,\@\:]+$/

        3   A user can use %SECURE_REGEXP hash table.

    	Example:
    	$SECURE_REGEXP{'whois'} =
    	'\s*whois\s+\033\$[\@B][\041-\176]+\033\([BJ]\s*';

    	%INSECURE_REGEXP to reject special patterns,
    	which you think as insecure.

        4   errors if syntax contains others.

    Example:

       summary				(permit)
       mget 1-20,30,last:20 mp 1		(permit)
       mget 10? mp 1			(denied in default)
       mget 1[012]? mp 1			(denied in default)
       chaddr fukachan@phys.titech.ac.jp fukachan@beth.phys.titech.ac.jp (permit)

       $SECURE_REGEXP{'whois'} = '\s*whois\s+\033\$[\@B][\041-\176]+\033\([BJ]\s*';

    The pattern is related with UNIX shell.

    Quoted from 4.4BSD:/usr/share/man/cat1/sh.0
           Shell Patterns

           A pattern consists of normal characters, which match them-
           selves, and meta-characters.   The meta-characters are
           ``!'', ``*'', ``?'', and ``[''.  These  characters lose
           there special meanings if they are quoted.  When command
           or variable substitution is performed and the dollar sign
           or back quotes are not double quoted, the value of the
           variable or the output of the command is scanned for these
           characters and they are turned into meta-characters.

           An asterisk (``*'') matches any string of characters.   A
           question mark matches any single character. A left bracket
           (``['') introduces a character class.  The end of the
           character class is indicated by a ``]''; if the ``]'' is
           missing then the ``['' matches a ``['' rather than intro-
           ducing a character class.  A character class matches any
           of the characters between the square brackets.   A range
           of characters may be specified using a minus sign.  The
           character class may be complemented by making an exclama-
           tion point the first character of the character class.

           To include a ``]'' in a character class, make it the first
           character listed (after the ``!'', if any).  To include a
           minus sign, make it the first or last character listed

    NOTE: 1998/11/08 permit "admin add MAR+KUN@DOMAIN " syntax

      +'ed user <addr+ext@domain> (for sendmail users):
    	fix to permit this address syntax when automagic registration.
    	but not fix to permit command with this addr beautifully.
    	# so require more eloborate design

    9.3	DNS Spoofing

    If

    	$LOG_CONNECTION = 1;

    is defined, fml.pl logs the host address connecting to fml.pl running
    server. The value is taken by getpeername(). The result is set in
    $PeerAddr. You can use DNS check by this.

    9.4	Address Spoofing

    no answer since this spoof is in low layers.

    9.5	SYN Flooding

    no answer in lower layers.

    9.6	Email address and RFC822 representation

    For example, a famous fwtk firewall toolkit checks address
    syntax. RFC822 permits a syntax but it may be insecure related to
    sendmail's implementation.

    RFC822 is theoretical limit of representation. The syntax does not
    corresponds to usually used syntax.

    9.7	smrsh.c

    	"|program ..."

    smrsh.c restricts executables run by sendmail. For example you can
    restrict executables only in /usr/adm/sm.bin runs under this system.
    In this case you should rewrite include file /usr/adm/sm.bin/fml.pl.
    smrsh.c is in sendmail packages.

    9.8	access(2)

    smrsh.c uses access();D but ...

    --- NetBSD 1.2REL /usr/share/man/cat2/access.0

    CAVEAT
         Access() is a potential security hole and should never be used.

    4th Berkeley Distribution     September 15, 1996                             2

    --- perl5.003/perl.c

    	/* On this access check to make sure the directories are readable,
    	 * there is actually a small window that the user could use to make
    	 * filename point to an accessible directory.  So there is a faint
    	 * chance that someone could execute a setuid script down in a
    	 * non-accessible directory.  I don't know what to do about that.
    	 * But I don't think it's too important.  The manual lies when
    	 * it says access() is useful in setuid programs.
    	 */

    9.9	Precedence Priority

    sendmail 8.8.5 operations manual tells:

                 5.7.  P -- Precedence Definitions

                         Values for the "Precedence:" field may be defined
                    using  the  P  control line.  The syntax of this field
                    is:

                        Pname==num

                    When the name is found in a "Precedence:"  field,  the
                    message  class  is  set  to  num.  Higher numbers mean
                    higher precedence.  Numbers less than  zero  have  the
                    special  property  that if an error occurs during pro-
                    cessing the body of the message will not be  returned;
                    this  is  expected  to be used for "bulk" mail such as
                    through mailing  lists.   The  default  precedence  is
                    zero.  For example, our list of precedences is:

                        Pfirst-class=0
                        Pspecial-delivery=100
                        Plist=-30
                        Pbulk=-60
                        Pjunk=-100

                    People  writing  mailing list exploders are encouraged
                    to use "Precedence: list".  Older versions of sendmail
                    (which discarded all error returns for negative prece-
                    dences)  didn't  recognize  this  name,  giving  it  a
                    default  precedence  of  zero.  This allows list main-
                    tainers to see error returns on both old and new  ver-
                    sions of sendmail.

    9.10	4.4BSD vacation

         No message will be sent unless login (or an alias supplied using the -a
         option) is part of either the ``To:'' or ``Cc:'' headers of the mail.  No
         messages from ``???-REQUEST'', ``Postmaster'', ``UUCP'', ``MAILER'', or
         ``MAILER-DAEMON'' will be replied to (where these strings are case insen-
         sitive) nor is a notification sent if a ``Precedence: bulk'' or
         ``Precedence: junk'' line is included in the mail headers.  The people
         who have sent you messages are maintained as a db(3) database in the file
         .vacation.db in your home directory.

    9.11	File and Directory Permission Default

    umask(2) default is customizable.

    	$FML_UMASK	for fml.pl
    	$MSEND_UMASK	for msend.pl
    	$UMASK	is used if neither $FML_UMASK nor $MSEND_UMASK is not defined.

    9.12	Directory Permissions

    When plural maintainers maintain mailing lists directory and they uses
    fmlserv.pl also, group writable permission is required. However
    sendmail denies such settings for security today in default. It is
    desirable to prepare a user e.g. "fml" to maintenance mailing lists
    configurations. Or you can change /etc/sendmail.cf
    e.g. DontBlameSendmail.

    	$USE_FML_WITH_FMLSERV

    is automatically set up by fml.pl if fml.pl can find $DIR/../fmlserv
    directory. If it is set, fml.pl recognizes it myself works with
    fmlserv.pl. If HOME of fmlserv.pl exists not in $DIR/../fmlserv, you
    need to set this variable manually in config.ph. $GID is also a
    variable for fmlserv.pl.

    9.13	On sendmail 8.8 check_* rule sets

    Please see sendmail's book (bat book).

    9.14	SMTP and Authentication

    draft-myers-smtp-auth-11.txt (submitted to be Proposed Standard)
    RFC2222 (SASL)

    SASL: Simple Authentication and Security Layer

    draft-hoffman-smtp-ssl-06.txt (SMTP over secured layer)

    9.15	&system() function

    Fml does not use perl's system() but the original &system(). When the
    perl on OS has no fork(), we have to use perl's system(). On some
    environment, a few commands cannot work well with our &system().

    When some commands do not work well, try to set

    	$INSECURE_SYSTEM = 1;  (default 0)

    in config.ph. It may enable you to use the command.

    On NT4, fml uses perl's system() since ntperl has no fork().

    In any cases fml checks the syntax of arguments passwd to
    system(). After checks, fml calls system().

[PREVIOUS CHAPTER] [NEXT CHAPTER]