Re: Checkpassword 0.90 + Redhat 9.0
[email protected] (Paul Jarc) Wed, 02 Jul 2003 14:47:00 -0400
| Newsgroups | gmane.comp.djb.checkpassword |
|---|---|
| Organization | What did you have in mind? A short, blunt, human pyramid? |
| Message-ID | <[email protected]> |
Sean Kennedy <[email protected]> wrote: > qmail-smtpd is what needs it How so? Vanilla qmail-smtpd has no way to use checkpassword. > and I thought about running it as root as a quick and dirty way of > making it work, but that would comprimise the security of qmail, > yes? Is having one extra suid program floating around such a bad > thing? Running qmail-smtpd as root *should* be harmless. Making checkpassword setuid *should* be harmless. But if it turns out there is a bug in one of those programs, then running as root/setuid might lead to a security breach. paul