From znerd@FreeBSD.org  Thu Jul 26 15:10:16 2007
Return-Path: <znerd@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 96E6616A41F
	for <FreeBSD-gnats-submit@freebsd.org>; Thu, 26 Jul 2007 15:10:16 +0000 (UTC)
	(envelope-from znerd@FreeBSD.org)
Received: from sumo.dreamhost.com (sumo.dreamhost.com [66.33.216.29])
	by mx1.freebsd.org (Postfix) with ESMTP id 8219E13C481
	for <FreeBSD-gnats-submit@freebsd.org>; Thu, 26 Jul 2007 15:10:16 +0000 (UTC)
	(envelope-from znerd@FreeBSD.org)
Received: from spaceymail-a2.g.dreamhost.com (sd-green-bigip-83.dreamhost.com [208.97.132.83])
	by sumo.dreamhost.com (Postfix) with ESMTP id 92AD1179406
	for <FreeBSD-gnats-submit@freebsd.org>; Thu, 26 Jul 2007 07:39:36 -0700 (PDT)
Received: from andes.pensioenpage.com (unknown [217.148.84.60])
	by spaceymail-a2.g.dreamhost.com (Postfix) with ESMTP id E965E10A02B
	for <FreeBSD-gnats-submit@freebsd.org>; Thu, 26 Jul 2007 07:39:35 -0700 (PDT)
Received: by andes.pensioenpage.com (sSMTP sendmail emulation); Thu, 26 Jul 2007 16:39:33 +0200
Message-Id: <20070726143935.E965E10A02B@spaceymail-a2.g.dreamhost.com>
Date: Thu, 26 Jul 2007 16:39:33 +0200
From: Ernst de Haan <znerd@FreeBSD.org>
Reply-To: Ernst de Haan <znerd@FreeBSD.org>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: [request] Protect mail/ssmtp configuration files
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         114945
>Category:       ports
>Synopsis:       [request] Protect mail/ssmtp configuration files
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    glarkin
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          change-request
>Submitter-Id:   current-users
>Arrival-Date:   Thu Jul 26 15:20:02 GMT 2007
>Closed-Date:    Wed Nov 19 16:24:29 EST 2008
>Last-Modified:  Wed Nov 19 21:30:06 UTC 2008
>Originator:     Ernst de Haan
>Release:        FreeBSD 6.2-RELEASE-p6 amd64
>Organization:
>Environment:
System: FreeBSD andes.pensioenpage.com 6.2-RELEASE-p6 FreeBSD 6.2-RELEASE-p6 #2: Wed Jul 25 11:33:08 CEST 2007 root@andes.pensioenpage.com:/usr/obj/usr/src/sys/ANDES amd64
>Description:
mail/ssmtp is a minimalistic tool that allows sending of e-mail from the host it is installed on, using the SMTP services provided by another host.

The following would -in my opinion- be a normal situation:
1. the SMTP service requires SSL;
2. the SMTP service requires authentication;
3. the authentication details are considered confidential.

This is hard to accomplish with the current mail/ssmtp port, since the /usr/local/etc/ssmtp.conf file is world-readable. This is required, since the ssmtp binary runs as the current user.

Hereby I request a solution is implemented for this. I propose the following:
1. During installation, add a user 'ssmtp' with no home directory, password and shell
2. Protect the /usr/local/etc/ssmtp/ directory by setting owner=ssmtp, group=wheel and permissions=rwxr-x---, so outside wheel nobody can read the files.
3. Make the 'ssmtp' executable owned by the user 'ssmtp' and mark it SUID.
>How-To-Repeat:
>Fix:
>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-ports-bugs->clement 
Responsible-Changed-By: edwin 
Responsible-Changed-When: Thu Jul 26 15:20:28 UTC 2007 
Responsible-Changed-Why:  
Over to maintainer 

http://www.freebsd.org/cgi/query-pr.cgi?pr=114945 
Responsible-Changed-From-To: clement->freebsd-ports-bugs 
Responsible-Changed-By: clement 
Responsible-Changed-When: Tue Sep 2 07:42:01 UTC 2008 
Responsible-Changed-Why:  
I dopped maintainership. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=114945 
Responsible-Changed-From-To: freebsd-ports-bugs->glarkin 
Responsible-Changed-By: glarkin 
Responsible-Changed-When: Thu Sep 11 14:55:20 EDT 2008 
Responsible-Changed-Why:  
I'll take it. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=114945 
State-Changed-From-To: open->closed 
State-Changed-By: glarkin 
State-Changed-When: Wed Nov 19 16:24:12 EST 2008 
State-Changed-Why:  
Closed with modifications, thanks! 

http://www.freebsd.org/cgi/query-pr.cgi?pr=114945 

From: dfilter@FreeBSD.ORG (dfilter service)
To: bug-followup@FreeBSD.org
Cc:  
Subject: Re: ports/114945: commit references a PR
Date: Wed, 19 Nov 2008 21:23:58 +0000 (UTC)

 glarkin     2008-11-19 21:23:49 UTC
 
   FreeBSD ports repository
 
   Modified files:
     .                    GIDs 
     mail/ssmtp           Makefile pkg-descr 
     mail/ssmtp/files     patch-ssmtp.c 
   Added files:
     mail/ssmtp/files     patch-base64.c patch-ssmtp.h 
                          pkg-deinstall.in pkg-install.in 
                          pkg-message.in 
   Removed files:
     mail/ssmtp           pkg-message 
   Log:
   - Take maintainership
   - Various Makefile cleanups
   - Added protection for config files, including group creation/
     deletion
   - Incorporated patches from http://bugs.debian.org/ssmtp to fix
     compiler warnings
   
   PR:             ports/114945
   Submitted by:   znerd
   Reviewed by:    stas
   
   Revision  Changes    Path
   1.65      +2 -1      ports/GIDs
   1.26      +22 -9     ports/mail/ssmtp/Makefile
   1.1       +20 -0     ports/mail/ssmtp/files/patch-base64.c (new)
   1.3       +511 -10   ports/mail/ssmtp/files/patch-ssmtp.c
   1.1       +10 -0     ports/mail/ssmtp/files/patch-ssmtp.h (new)
   1.1       +21 -0     ports/mail/ssmtp/files/pkg-deinstall.in (new)
   1.1       +33 -0     ports/mail/ssmtp/files/pkg-install.in (new)
   1.1       +8 -0      ports/mail/ssmtp/files/pkg-message.in (new)
   1.4       +8 -7      ports/mail/ssmtp/pkg-descr
   1.3       +0 -5      ports/mail/ssmtp/pkg-message (dead)
 _______________________________________________
 cvs-all@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/cvs-all
 To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org"
 
>Unformatted:
