docs/diploma: thesis/tex/5-Improvements.tex comparison

comparison thesis/tex/5-Improvements.tex @ 348:4ced91b9a2ca

reworked last part of permissions

author	meillo@marmaro.de
date	Tue, 27 Jan 2009 12:13:58 +0100
parents	f44603443e2d
children	c42c49f33228

comparison

equal deleted inserted replaced

-:d1ea058c0949
+:4ced91b9a2ca
-\subsubsection*{Rights and permission} %fixme: singular, plural?
+\subsubsection*{Rights and permissions}
-This section leaves quite a few questions open. It is more a discussion on the topic. More information needs to be collected and further studies of the situations in existing \MTA{}s should be made. %fixme: this sentence at the end?
 The set of system users that is required for \qmail\ seems to be too complex for \masqmail. One system user, like \postfix\ uses, is more appropriate. \name{root} privilege and \name{setuid} permission should to be avoided as feasible.
 The \name{queue-in} module is the part of the system that is most critical about permission. It either needs to run as deamon (as a specific user) or be \name{setuid} or \name{setgid} in order to avoid a world-writable queue. \person{Ian~R.\ Justman} recommends to use \name{setgid} in this situation:
 The modules \name{scanning} and \name{queue-out} are candidates for all-time running daemon processes. But they could also get periodically started by \name{cron}. Another possibility is to run a master process as daemon which starts and restarts the system parts. \postfix\ has such a master process, \qmail\ lacks it. The jobs of a master process can be done by the other tools of the operating system too, thus making the master process abdicable. \masqmail\ does probably better go without a master process because it aims to save resources, not to get the best performance.
-In general is a sane permission management very important for secure software. The \name{principle of least privilege}, as it is often called, should be respected. If it is possible to use lower privilege then it should be done. An example for doing so is the \name{smtpd} module. It is a server module which listens on a port. One way is to start it as root, let it bind to the port and drop all privilege before it does any other work. But root privilege is avoidable completely if \name{inetd} or a similar ``super-server'' listens on the port instead of the \name{smtpd} module, but invokes the module as a connection attempt to the port is made. The \name{smtpd} module needs no privilege at all this way.
+In general is a sane permission management very important for secure software. The \name{principle of least privilege}, as it is often called, should be respected. If it is possible to use lower privilege then it should be done. An example for doing so is the \name{smtpd} module. It is a server module which listens on a port. One way is to start it as root, let it bind to the port, and drop all privilege before it does any other work. But root privilege is avoidable completely if \name{inetd} or one of its substitutes listens on the port instead of the \name{smtpd} module. The \name{smtpd} module gets launched by \name{inetd} to handle the connection when a connection attempt to the port is made. The \name{smtpd} module needs no privilege at all this way.
-The important goal with privilege management is to prevent unauthorized users from modifying or damaging the system. Unauthorized users are especially attackers. What can happen if an attacker breaks into \masqmail?
-All revceiving modules communicate only with \name{queue-in} which puts new mail into the queue. They run as user \name{nobody}\footnote{\name{nobody} is on \unix\ systems usually the name for a system user with no privilege.} and write only to log files. Apart of during-\SMTP-dialog spam prevention is their funtionality straight forward: They talk the specific protocol to the sender, receive the message on this way, and pass it over to \name{queue-in}.
-The queue is only modified by \name{queue-in}, \name{scanning}, and \name{queue-out}. All of them need to run with either the owner or the group \name{masqmail}. The queue directories must be of owner and group \name{masqmail} and only readable and modifiable by them.
-%XXX
-%fixme
-%Table \ref{tab:new-masqmail-permissions} shows the suggested ownership and permissions of the modules.
-%
-%\begin{table}
-%	\begin{center}
-%		\input{tbl/new-masqmail-permissions.tbl}
-%	\end{center}
-%	\caption{Ownership and permissions of the modules}
-%	\label{tab:new-masqmail-permission}
-%\end{table}
-%
-%These are the permissions and ownership used for the queue:
-%\codeinput{input/new-masqmail-queue.txt}

Mercurial > docs > diploma

comparison thesis/tex/5-Improvements.tex @ 348:4ced91b9a2ca