Re: rspamc / rspamd with getmail
Charles Cazabon <[email protected]>
| Newsgroups | gmane.mail.getmail.user |
|---|---|
| Message-ID | <[email protected]> |
Elimar Riesebieter <[email protected]> wrote: > * [email protected] dyn <[email protected]> [2020-05-21 02:22 +0200]: > > Configuration error: refuse to invoke external commands as root by default > > Running getmail as root is a bad idea! Either run it as $USER or > create a user, i.e uid=getmail ; gid=getmail to run it systemwide. Not sure, but I think Elimar meant to link to: http://pyropus.ca/software/getmail/troubleshooting.html#errmsg-config-root-commands To expand on this just a little bit: when you use an external filter program or external delivery agent, you're taking untrusted data from the net (the email content, under the control of a possible attacker) and feeding it as input to that program. For various reasons, getmail itself is unlikely to be susceptible to hostile data, but the external programs you feed it to - especially if they're doing text processing and are written in an "unsafe" language - may not be so immune. If you have getmail invoke external commands and run them as root, you're betting your whole system on that command not having any vulnerabilities dealing with untrusted data, rather than just a possible compromise of the account you run getmail as. Charles -- ----------------------------------------------------------------------- Charles Cazabon GPL'ed software available at: http://pyropus.ca/software/ -----------------------------------------------------------------------