ports/51680: security/cyrus-sasl?: Group readable file when sending locally

[Scot W. Hetzel]

>Number:         51680
>Category:       ports
>Synopsis:       security/cyrus-sasl?: Group readable file when sending locally
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-ports-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          maintainer-update
>Submitter-Id:   current-users
>Arrival-Date:   Thu May 01 18:50:14 PDT 2003
>Closed-Date:
>Last-Modified:
>Originator:     Scot W. Hetzel
>Release:        FreeBSD 4.8-STABLE i386
>Organization:
West Bend Internet
>Environment:
System: FreeBSD WBIw009.westbend.net 4.8-STABLE FreeBSD 4.8-STABLE #2: Tue Apr 22 02:28:52 CDT 2003 root at WBIw009.westbend.net:/usr/obj/usr/src/4x/sys/GENERIC-SMP i386


>Description:
	When sending mail localy on a system compiled woth SASL AUTH, the sendmail
	mail submission program will log the following error on the sasldb file:

	    error: safesasl(/usr/local/etc/sasldb) failed: Group readable file

	This problem was reported on the FreeBSD-ports mailing list by
	David Babler <dbabler at rigel.orionsys.com>

	NOTE: sendmail.cf has DontBlameSendmail set to GroupReadableSASLDBFile.

>How-To-Repeat:
	Install sendmail with SASL AUTH, and follow directions in the Sendmail.README
	file installed by the security/cyrus-sasl* ports to set up the sendmail.cf file.
	Then send a message from that system and check /var/log/maillog for the above
	error.
>Fix:
	The fix is in the attached patch to the files/Sendmail.README file.

	NOTE: This patch needs to be applied to both cyrus-sasl and cyrus-sasl2 ports.

Index: Sendmail.README
===================================================================
RCS file: /home/ncvs/ports/security/cyrus-sasl/files/Sendmail.README,v
retrieving revision 1.8
diff -u -r1.8 Sendmail.README
--- Sendmail.README	5 Oct 2002 19:38:18 -0000	1.8
+++ Sendmail.README	2 May 2003 00:53:56 -0000
@@ -41,6 +41,19 @@
    dnl Use the following for Sendmail 8.10 - 8.11
    define(`confDONT_BLAME_SENDMAIL',`GroupReadableSASLFile')dnl
 
+5) Add the following before FEATURE(msp) in your sendmail 8.12 submit.mc file:
+
+   define(`confRUN_AS_USER',`smmsp:mail')dnl
+   define(`confTRUSTED_USER',`smmsp')dnl
+   define(`confDONT_BLAME_SENDMAIL',`GroupReadableSASLDBFile')dnl
+
+   If this is not added to the submit.mc file, then sendmail will give
+   this error in the log:
+
+	error: safesasl(/usr/local/etc/sasldb) failed: Group readable file
+
+   when sending mail locally.
+
  ----
 
    Additional AUTH Mechanisms are LOGIN, PLAIN, GSSAPI, and KERBEROS_V4.
>Release-Note:
>Audit-Trail:
>Unformatted: