Re: Checkpassword 0.90 + Redhat 9.0

[email protected] (Paul Jarc) Wed, 02 Jul 2003 14:47:00 -0400
Newsgroups gmane.comp.djb.checkpassword
Organization What did you have in mind? A short, blunt, human pyramid?
Message-ID <[email protected]>
Sean Kennedy <[email protected]> wrote:
> qmail-smtpd is what needs it

How so?  Vanilla qmail-smtpd has no way to use checkpassword.

> and I thought about running it as root as a quick and dirty way of
> making it work, but that would comprimise the security of qmail,
> yes?  Is having one extra suid program floating around such a bad
> thing?

Running qmail-smtpd as root *should* be harmless.  Making
checkpassword setuid *should* be harmless.  But if it turns out there
is a bug in one of those programs, then running as root/setuid might
lead to a security breach.


paul