Mailman GID problem

Paul Schmehl pauls at utdallas.edu
Sat Apr 21 02:26:22 UTC 2007 

--On April 20, 2007 7:54:45 PM -0500 Jeffrey Goldberg 
<jeffrey at goldmark.org> wrote:
>
> I think I'm beginning to understand where that "nobody" comes from and
> why you are right about that.
>
> Here is an excerpt from the postfix aliases(5)
>
>    In the absence of a user context,  the  local(8)  daemon  uses  the
> owner
>    rights  of  the :include: file or alias database.  When those files
> are
>    owned by the superuser, delivery is made with the rights specified
> with
>    the default_privs configuration parameter.
>
> I had been looking at the first half of that (which I was already aware
> of).  So I thought that if the wrapper were compiled to only run as
> "nobody" than the relevant alias files had to be owned by "nobody".  I
> wasn't, until looking this up, aware of what happens when the aliases
> file is owned by root.
>
> In the postfix out of ports on FreeBSD, default_privs is set to "nobody".
>
> So the first fix (modifying the owner of data/aliases{,.db}) is the
> right way to go, but instead of making those files owned by "nobody"
> (which does seem dangerous because than anything running as "nobody"
> could change those file) they should be owned by root with mailman as
> the group and permissions like 664.
>
Nobody is an unprivileged user.
grep nobody /etc/passwd
nobody:*:65534:65534:Unprivileged user:/nonexistent:/usr/sbin/nologin

So, using that account would *increase*, not decrease, security. 
However....

> Let me just test that now... Yes.  Mail delivery seems to work with
>
> [jeffrey at dobby /usr/local/mailman/data]$ ls -la .
> total 78
> drwxrwsr-x   2 root     mailman   1024 Apr 19 16:03 .
> drwxrwsr-x  20 mailman  mailman    512 Mar 30 13:57 ..
> -rw-r-----   1 root     mailman     41 Sep 11  2006 adm.pw
> -rw-rw----   1 root     mailman   3523 Mar 31 16:10 aliases
> -rw-rw-r--   1 root     mailman  16384 Mar 31 16:10 aliases.db
> -rw-rw-r--   1 root     mailman  12288 Sep 13  2006 aliases.db.rpmsave
> -rw-r-----   1 root     mailman     41 Sep 11  2006 creator.pw
> -rw-r--r--   1 root     mailman     10 Mar 30 13:57 last_mailman_version
> -rw-rw----   1 root     mailman      4 Apr 17 14:34 master-qrunner.pid
> -rw-r--r--   1 root     mailman  14114 Mar 30 13:57 sitelist.cfg
> -rw-rw----   1 root     mailman   3334 Mar 31 16:10 virtual-mailman
> -rw-rw-r--   1 root     mailman  16384 Mar 31 16:10 virtual-mailman.db
>
> I haven't yet tested list creation, but the permissions look fine to me.
> All of the relevant files (as well as the data directory itself) are
> writable by members of the mailman group.
>
> But I think I now see the problem
>
> $ ../bin/check_perms
> /usr/local/mailman/data/aliases.db owned by root (must be owned by
> mailman
> /usr/local/mailman/data/virtual-mailman.db owned by root (must be owned
> by mailman
> Problems found: 2
> Re-run as mailman (or root) with -f flag to fix
>
> Somehow check_perms doesn't seem to know how postfix does things.  If I
> were to actually run
>
>    check_perms -f
>
> it would break to ownership of the aliases file so that we would have
> the mismatch between what the uid postfix gives the the wrapper
> ("mailman") and what the wrapper demands ("nobody").
>
Nope.  I've been running mailman for years now, and it works perfectly 
fine.  The owner of the data directory is mailman, and the group is 
mailman.
ls -lsa /usr/local/mailman/data/
total 132
 2 drwxrwsr-x   2 mailman  mailman    512 Apr  7 19:47 .
 2 drwxrwsr-x  20 mailman  mailman    512 Nov 28 17:48 ..
48 -rw-r--r--   1 mailman  mailman  65536 Sep  6  2005 .db
 2 -rw-r-----   1 mailman  mailman     41 Sep  6  2005 adm.pw
 6 -rw-r--r--   1 root     mailman   4383 Oct 14  2005 aliases
 4 -rw-r-----   1 mailman  mailman   3984 Sep  8  2005 aliases.bak
48 -rw-r-----   1 mailman  mailman  49152 May  5  2006 aliases.db
 0 -rw-rw-rw-   1 mailman  mailman      0 Sep  9  2005 
bounce-events-00446.pck
 0 -rw-rw-rw-   1 mailman  mailman      0 Sep  9  2005 
bounce-events-00449.pck
 0 -rw-rw-rw-   1 mailman  mailman      0 Sep  9  2005 
bounce-events-00467.pck
 0 -rw-rw-rw-   1 mailman  mailman      0 Jan 27  2006 
bounce-events-00567.pck
 0 -rw-rw-rw-   1 mailman  mailman      0 Oct 13  2005 
bounce-events-38840.pck
 2 -rw-r-----   1 mailman  mailman     41 Sep  6  2005 creator.pw
 2 -rw-r--r--   1 root     mailman     10 Nov 28 17:48 last_mailman_version
 2 -rw-rw----   1 mailman  mailman      4 Apr  1 08:31 master-qrunner.pid
14 -rw-r--r--   1 root     mailman  14114 Nov 28 17:48 sitelist.cfg

It is the *group* that matters to postfix, *not* the owner.  Per the 
pkg-message file:
Mailman has been installed, but requires further configuration before use!

You will have to configure both your MTA (mail server) and web server to
integrate with Mailman.  If the port's documentation has been installed,
extensive post-installation instructions may be found in:

  %%DOCSDIR%%/FreeBSD-post-install-notes

Note (1):  If you use an alternate (non-Sendmail) MTA, you MUST be sure
that the correct value of MAIL_GID was used when this port or package
was built.  Performing a "make options" in the Mailman port directory
will list required values for various mail servers.

Note that MAIL_GID is what matters.  That is the *group* not the owner of 
the files.  Note also that the group only has read writes to the aliases 
file, although it does have read/write access to the bounce-events files.

> So maybe the problem is with check_perms and not with the port at all
> (well the port would still need to get the aliases files owned by root).
>
There's nothing at all wrong with the check_perms script.

> While setting the aliases files to be owned by "nobody" or by making the
> wrapper want "mailman" instead of "nobody" would be work-arounds, both
> of those lose out on the security achieved by having the aliases files
> owned by root.
>
There's no increased benefit of having root own the aliases file.  In 
fact, while root owns the aliases db for postfix:
ls -lsa /usr/local/etc/postfix/aliases*
 4 -rw-r--r--  1 root  wheel   2923 Feb 11 22:11 
/usr/local/etc/postfix/aliases
48 -rw-r--r--  1 root  wheel  49152 Feb 11 22:11 
/usr/local/etc/postfix/aliases.db

mailman owns the aliases db for mailman:
ls -lsa /usr/local/mailman/data/aliases*
 6 -rw-r--r--  1 root     mailman   4383 Oct 14  2005 
/usr/local/mailman/data/aliases
 4 -rw-r-----  1 mailman  mailman   3984 Sep  8  2005 
/usr/local/mailman/data/aliases.bak
48 -rw-r-----  1 mailman  mailman  49152 May  5  2006 
/usr/local/mailman/data/aliases.db

And this is a working setup of mailman and postfix that's been running for 
years.

> Of course my two previous "understandings" of how things were supposed
> to work were wrong.  So please take my current analysis with a large
> grain of salt.
>
Done.

Paul Schmehl (pauls at utdallas.edu)
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/

More information about the freebsd-ports mailing list