Re: Checkpassword 0.90 + Redhat 9.0

Sean Kennedy <[email protected]> wrote:
> >
> qmail-smtpd is what needs it, and I thought about running it as root as 
> a quick and dirty way of making it work, but that would comprimise the 
> security of qmail, yes?

It breaks the careful partitioning djb designed in to prevent a bug in one
module from rendering the entire system vulnerable.

> Is having one extra suid program floating around such a bad thing?

Depends on what the program is.  Vanilla djb checkpassword, fair level of
comfort.  Many (most) other programs, especially anything invoked by a network
connection, absolutely it's a horrendous risk.

Charles
-- 
-----------------------------------------------------------------------
Charles Cazabon                         <[email protected]>
GPL'ed software available at:     http://www.qcc.ca/~charlesc/software/
-----------------------------------------------------------------------