Re: ipsvd $USER

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 26 May 2004, Charlie Brady wrote:

> ipsvd can run as root, and whatever it spawns can do whatever it likes.
> But what are you really trying to do?
============================

what i'm trying to do: set up an IMAP connection to the server via SSH
port forward that does not require a manual login. my ssh connection is
made using ssh-agent/ public-key so i don't have to type a password; it
knows who i am when i connect.

let's say i want my desktop MUA to connect to localhost:443 and that
forwards (via ssh) to remotehost:1234

i want remotehost to answer on port 1234 with an IMAP server.

now, if i run (as root) on remotehost:
	# /usr/local/sbin/tcpsvd 0 1234 ./test
then ANY connection to port 1234 executes the "test" script as root.

of course, i can run the IMAP server as a non-root user (me), but then ANY
connection can read MY mail.

the simple solution doesn't seem to exist, currently: that `tcpsvd` can
drop to the permissions of the connection being made to it, instead of
being stuck at the permissions used to invoke the command.

i might just have to keep hacking at ssh and port forwarding.... tcpsvd
might not be the right solution for this problem...


	...atom

 _________________________________________
 PGP key - http://atom.smasher.org/pgp.txt
 762A 3B98 A3C3 96C9 C6B7 582A B88D 52E4 D9F5 7808
 -------------------------------------------------

	"Wars not make one great." -- Yoda
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (FreeBSD)
Comment: What is this gibberish?  -  http://atom.smasher.org/links/#digital_signatures

iEYEARECAAYFAkC1YMYACgkQnCgLvz19QeNYAACgnDhM/mGSM3p96st1wikVUZm+
08UAoJBl3WhSm2/NvJ95VJinuEPQBJrG
=Mc1D
-----END PGP SIGNATURE-----