Re: Checkpassword 0.90 + Redhat 9.0

Paul Jarc wrote:

>asdf <[email protected]> wrote:
>  
>
>>The problem is, I've got this working on another mail server where
>>it's being run as qmaild.
>>    
>>
>
>I don't believe you do.  Given the way checkpassword is written, if
>what you describe were possible, the system would be entirely
>insecure; the kernel would allow any user to run code as any other
>user.  I think it's much more likely that you've misunderstood how the
>other system is set up.
>
>Only qmail-smtpd is supposed to run as qmaild.  qmail-popup is
>supposed to run as root; checkpassword will change its uid to match
>the user who authenticated, and will run qmail-pop3d as that user.
>
>
>paul
>  
>
[root@xxx qmail-smtpd]# su qmaild
sh-2.05$ /var/qmail/bin/qmail-popup blah /bin/checkpassword pwd
+OK <23007.1057166631@blah>
user test
+OK
pass test
/home/test

This is what I get on the machine that it's setup and working on.  Now, 
maybe that machine is insecure, but I don't think so.

You are correct in that qmaild is supposed to be used for qmail-smtpd.  
I am using this user because I need to make checkpassword work for them, 
the pop3 thing was just a test.

Granted, I don't know the internals of this program, but I thought all 
it does was check the username/password against /etc/passwd and 
/etc/shadow, and if I make those available to the qmaild user, I don't 
see how or why checkpassword would need to change uid to root.  But 
again, I don't know the internals.

Thanks for the help!