1.1 --- a/thesis/bib/thesis.bib	Mon Jan 26 13:36:51 2009 +0100
     1.2 +++ b/thesis/bib/thesis.bib	Mon Jan 26 16:00:51 2009 +0100
     1.3 @@ -218,7 +218,7 @@
     1.4  	author = "Rick Moen and Ted Cabeen and Bastian Blank and Sean Burlington and Simon Cooper and J. C. Lawrence",
     1.5  	title = "Subject: \emph{email server question...}",
     1.6  	year = "2002--2003",
     1.7 -	howpublished = "This is a discussion on the mailing list \emph{plug@lists.q-linux.com} in Fall 2002.",
     1.8 +	howpublished = "This is a discussion on the mailing list \emph{plug@lists.q-linux.com}",
     1.9  	note = "Available on the Internet: {\small\url{http://linuxmafia.com/faq/Mail/mtas.html} (2008-12-09)}",
    1.10  }
    1.11  
    1.12 @@ -456,3 +456,17 @@
    1.13  	howpublished = "On the Internet: {\small\url{http://fanf.livejournal.com/65203.html} (2009-01-26)}",
    1.14  	note = "Part 5 of the series ``\emph{How not to design an MTA}'' which is accessable at: {\small\url{http://dotat.at/writing/mta-arch}}. His articles ``\emph{More about log-structured queues}'' and ``\emph{More log-structured queues}'' discuss the idea in more detail.",
    1.15  }
    1.16 +
    1.17 +
    1.18 +@misc{justman:bugtraq,
    1.19 +	author = "Ian~R. Justman",
    1.20 +	title = "Subject: \emph{setuid vs. setgid}",
    1.21 +	year = "1999",
    1.22 +	month = "January",
    1.23 +	howpublished = "This is a post to the \emph{Bugtraq} mailing list \emph{bugtraq@securityfocus.com}",
    1.24 +	note = "Available on the Internet: {\small\url{http://seclists.org/bugtraq/1999/Jan/0099.html} (2009-01-26)}",
    1.25 +}
    1.26 +
    1.27 +
    1.28 +
    1.29 +

     2.1 --- a/thesis/tex/5-Improvements.tex	Mon Jan 26 13:36:51 2009 +0100
     2.2 +++ b/thesis/tex/5-Improvements.tex	Mon Jan 26 16:00:51 2009 +0100
     2.3 @@ -430,52 +430,50 @@
     2.4  
     2.5  \subsubsection*{Rights and permission}
     2.6  
     2.7 -The set of system users that is required for \qmail\ seems to be too complex. One system user, like \postfix\ uses, is more appropriate. \name{root} privilege and \name{setuid} permission needs to be avoided as feasible.
     2.8 +The set of system users that is required for \qmail\ seems to be too complex for \masqmail. One system user, like \postfix\ uses, is more appropriate. \name{root} privilege and \name{setuid} permission should to be avoided as feasible.
     2.9  
    2.10 -Table \ref{tab:new-masqmail-permissions} shows the suggested ownership and permissions of the modules.
    2.11 +The \name{queue-in} module is the part of the system that is most critical about permission. It either needs to run as deamon (as a specific user) or be \name{setuid} or \name{setgid} in order to avoid a world-writable queue. \person{Ian~R.\ Justman} recommends to use \name{setgid} in this situation:
    2.12  
    2.13 -\begin{table}
    2.14 -	\begin{center}
    2.15 -		\input{tbl/new-masqmail-permissions.tbl}
    2.16 -	\end{center}
    2.17 -	\caption{Ownership and permissions of the modules}
    2.18 -	\label{tab:new-masqmail-permission}
    2.19 -\end{table}
    2.20 +\begin{quote}
    2.21 +But if all you need to do is post a file into an area which does not have world writability but does have group writability, and you want accountability, the best, and probably easiest, way to accomplish this without the need for excess code for uid switching (which is tricky to deal with especially with setuid-to-root programs) is the setgid bit and a group-writable directory.
    2.22 +\hfill\cite{justman:bugtraq}
    2.23 +\end{quote}
    2.24  
    2.25 -These are the permissions and ownership used for the queue:
    2.26 -\codeinput{input/new-masqmail-queue.txt}
    2.27 +\person{Bernstein} chose \name{setuid} for the \name{qmail-queue} module, \person{Venema} uses \name{setgid} in \postfix, the differences are small. But each of them is better than running the module as a deamon. A deamon needs more resources and therefore become inefficient on systems with low mail amount like the ones \masqmail\ will probably run on. Short running processes are additionally higher obstacles for intruders because if an intruder managed to take one over it will die soon.
    2.28  
    2.29  
    2.30 +\subsubsection*{Daemon processes}
    2.31  
    2.32 +The modules \name{scanning} and \name{queue-out} are candidates for all-time running processes. But they could also get periodically started by \name{cron}.
    2.33  
    2.34 +how is which process invoked?
    2.35  
    2.36 -setuid/setgid or not?
    2.37 +
    2.38 +
    2.39 +master process? needed, or wanted?
    2.40 +
    2.41 +
    2.42 +
    2.43 +where to drop privilege? needed?
    2.44 +
    2.45  
    2.46  what can crash if an attacker succeeds?
    2.47  
    2.48 -where to drop privilege?
    2.49  
    2.50 -how is which process invoked?
    2.51  
    2.52 -master process? needed, or wanted?
    2.53  
    2.54 -which are the daemon processes?
    2.55  
    2.56 +%Table \ref{tab:new-masqmail-permissions} shows the suggested ownership and permissions of the modules.
    2.57 +%
    2.58 +%\begin{table}
    2.59 +%	\begin{center}
    2.60 +%		\input{tbl/new-masqmail-permissions.tbl}
    2.61 +%	\end{center}
    2.62 +%	\caption{Ownership and permissions of the modules}
    2.63 +%	\label{tab:new-masqmail-permission}
    2.64 +%\end{table}
    2.65 +%
    2.66 +%These are the permissions and ownership used for the queue:
    2.67 +%\codeinput{input/new-masqmail-queue.txt}
    2.68  
    2.69  
    2.70 -
    2.71 -
    2.72 -
    2.73 -
    2.74 -http://fanf.livejournal.com/50917.html %how not to design an mta - the sendmail command
    2.75 -http://fanf.livejournal.com/51349.html %how not to design an mta - partitioning for security
    2.76 -http://fanf.livejournal.com/61132.html %how not to design an mta - local delivery
    2.77 -http://fanf.livejournal.com/64941.html %how not to design an mta - spool file format
    2.78 -http://fanf.livejournal.com/65203.html %how not to design an mta - spool file logistics
    2.79 -http://fanf.livejournal.com/65911.html %how not to design an mta -   more about log-structured MTA queues
    2.80 -http://fanf.livejournal.com/67297.html %how not to design an mta -   more log-structured MTA queues
    2.81 -http://fanf.livejournal.com/70432.html %how not to design an mta - address verification
    2.82 -http://fanf.livejournal.com/72258.html %how not to design an mta - content scanning
    2.83 -
    2.84 -
    2.85 -