| Newsgroups |
gmane.mail.getmail.user |
| Message-ID |
<[email protected]> |
Am 21.05.2020 um 04:38 schrieb Charles Cazabon:
> Elimar Riesebieter <[email protected]> wrote:
>> * [email protected] dyn <[email protected]> [2020-05-21 02:22 +0200]:
>>> Configuration error: refuse to invoke external commands as root by default
>> Running getmail as root is a bad idea! Either run it as $USER or
>> create a user, i.e uid=getmail ; gid=getmail to run it systemwide.
> Not sure, but I think Elimar meant to link to:
> http://pyropus.ca/software/getmail/troubleshooting.html#errmsg-config-root-commands
>
> To expand on this just a little bit: when you use an external filter program
> or external delivery agent, you're taking untrusted data from the net (the
> email content, under the control of a possible attacker) and feeding it as
> input to that program. For various reasons, getmail itself is unlikely to be
> susceptible to hostile data, but the external programs you feed it to -
> especially if they're doing text processing and are written in an "unsafe"
> language - may not be so immune.
>
> If you have getmail invoke external commands and run them as root, you're
> betting your whole system on that command not having any vulnerabilities
> dealing with untrusted data, rather than just a possible compromise of the
> account you run getmail as.
>
> Charles
Thank you Charles and thank you Elimar - that was the important
information for me.
I created a cronjob for user "getmail" an startet the "getmail -r
/etc/getmail/getmailrc.test" from here.
Now it works for me.
Thank you!
Tony