Great Circle Associates Majordomo-Users
(February 1994)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re: insecure usage?
From: Brent Chapman <brent @ mycroft . GreatCircle . COM>
Date: Sun, 27 Feb 1994 11:08:02 -0800
To: jjoy @ akamai . sps . mot . com (Jennifer Joy)
Cc: majordomo-users
In-reply-to: Your message of Sat, 26 Feb 94 23:13:15 CST

jjoy@akamai.sps.mot.com (Jennifer Joy) writes:

# > 
# > The argument to ".../wrapper" should be simply "majordomo", not
# > "/usr/local/udla/etc/majordomo".  "wrapper" has where to look
# > (/usr/local/udla/etc) compiled in to it (the "W_BIN" setting in the
# > Makefile), for security reasons.
# 
# Brent,
# 
# It is late, and I may be misremembering, but I'm fairly sure that
# in your original paper it specifically shows how to reference wrapper
# and majordomo wrong -- that is, the path name to majordomo is
# specified.  
# 
# If I could remember while I'm at work I can look it up, but I know
# if I wait, I'll never remember.
# 
# I'm not complaining, I just think this is why a lot of people are
# doing this wrong.  Maybe?  I'll check.

I just checked, and you're right.  The paper predates the security
changes to "wrapper" that require the use of non-absolute path names.

The paper is pretty out of date at this point.  Anything specific that
it says about how Majordomo works or how to configure Majordomo is
probably wrong by now.  The paper is more valuable as a "why"
document, and something to get a general feel for Majordomo from, than
as a reference for the current version of Majordomo.  I'm tempted to
remove it from the distribution, or at least put a big warning at the
top of it that says it doesn't reflect current reality in the details.
The right thing to do would be to revise the paper, of course...

-Brent
--
Brent Chapman                                   Great Circle Associates
Brent@GreatCircle.COM                           1057 West Dana Street
+1 415 962 0841                                 Mountain View, CA  94041


Follow-Ups:
Indexed By Date Previous: Gotcha with arcive subdirectory permissions
From: Brent Chapman <brent@mycroft.GreatCircle.COM>
Next: Re: insecure usage?
From: Alan Millar <amillar@bolis.sf-bay.org>
Indexed By Thread Previous: Re: insecure usage?
From: Brent Chapman <brent@mycroft.GreatCircle.COM>
Next: Re: insecure usage?
From: Alan Millar <amillar@bolis.sf-bay.org>

Google
 
Search Internet Search www.greatcircle.com