Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #239302 > unrolled thread

Courier Authdeamon problem after upgrade

Back to article view | Back to linux.debian.user

Contents

  Courier Authdeamon problem after upgrade Philipp Ewald <philipp.ewald@digionline.de> - 2021-08-25 16:40 +0200
    Re: Courier Authdeamon problem after upgrade Greg Wooledge <greg@wooledge.org> - 2021-08-25 17:10 +0200
      Re: Courier Authdeamon problem after upgrade Philipp Ewald <philipp.ewald@digionline.de> - 2021-08-26 10:30 +0200
        Re: Courier Authdeamon problem after upgrade Greg Wooledge <greg@wooledge.org> - 2021-08-26 13:10 +0200
          Re: Courier Authdeamon problem after upgrade Philipp Ewald <philipp.ewald@digionline.de> - 2021-08-26 13:50 +0200

#239302 — Courier Authdeamon problem after upgrade

Hello,

i have upgrade my Debian 10 to 11 and notice that courier-authdeamon got problem with new permissions in /var/run/courier


Since upgrade this file has changed:
/usr/lib/tmpfiles.d/courier-authdaemon.conf

Debian 10:
#Type Path                    Mode UID     GID     Age Argument
     d /run/courier            0775 root    courier -   -
     d /run/courier/authdaemon 0755 courier courier -   -


Debian 11:
#Type Path                    Mode UID     GID     Age Argument
     d /run/courier            0775 root    courier -   -
     d /run/courier/authdaemon 0750 courier courier -   -

But with this configuration authdaemon not working:

  ERR: authdaemon: s_connect() failed: Permission denied
  /usr/bin/maildrop: Temporary authentication failure.
status: deferred



Workaround:

Add "chmod 755 /run/courier/authdaemon" to rc.local....


or should that work?


dpkg -l | grep courier
ii  courier-authdaemon                0.71.1-2                       amd64        Courier authentication daemon
ii  courier-authlib                   0.71.1-2                       amd64        Courier authentication library
ii  courier-authlib-pipe              0.71.1-2                       amd64        External authentication support for the Courier authentication library
ii  courier-authlib-userdb            0.71.1-2                       amd64        userdb support for the Courier authentication library
ii  courier-base                      1.0.16-3                       amd64        Courier mail server - base system
ii  courier-mta                       1.0.16-3                       amd64        Courier mail server - ESMTP daemon
ii  libcourier-unicode4:amd64         2.1.2-2                        amd64        Courier Unicode library (shared runtime library)


kind regards
Philipp


-- 
Philipp Ewald
Administrator

DigiOnline GmbH, Probsteigasse 15 - 19, 50670 Köln
Fax: +49 221 6500-690,

AG Köln HRB 27711, St.-Nr. 5215 5811 0640
Geschäftsführer: Werner Grafenhain

Informationen zum Datenschutz: www.digionline.de/ds

[toc] | [next] | [standalone]

#239303

On Wed, Aug 25, 2021 at 04:14:51PM +0200, Philipp Ewald wrote:
> i have upgrade my Debian 10 to 11 and notice that courier-authdeamon got problem with new permissions in /var/run/courier

This appears to be intentional and security-related.
See <http://bugs.debian.org/984810> and
<https://security-tracker.debian.org/tracker/CVE-2021-28374>.

> Debian 11:
> #Type Path                    Mode UID     GID     Age Argument
>     d /run/courier            0775 root    courier -   -
>     d /run/courier/authdaemon 0750 courier courier -   -
> 
> But with this configuration authdaemon not working:
> 
>  ERR: authdaemon: s_connect() failed: Permission denied
>  /usr/bin/maildrop: Temporary authentication failure.
> status: deferred

Perhaps this should be considered a bug in maildrop, rather than in
courier-authdaemon.  I'm not familiar with maildrop or what privileges
it requires.  The package description says it runs setgid "mail", whereas
this authdaemon directory is only accessible to group "courier".  But I
don't know how to fix it without breaking other things.

[toc] | [prev] | [next] | [standalone]

#239319

Thank you for your advise!

i will add user to mail group and try again.



On 8/25/21 5:01 PM, Greg Wooledge wrote:
> On Wed, Aug 25, 2021 at 04:14:51PM +0200, Philipp Ewald wrote:
>> i have upgrade my Debian 10 to 11 and notice that courier-authdeamon got problem with new permissions in /var/run/courier
> 
> This appears to be intentional and security-related.
> See <http://bugs.debian.org/984810> and
> <https://security-tracker.debian.org/tracker/CVE-2021-28374>.
> 
>> Debian 11:
>> #Type Path                    Mode UID     GID     Age Argument
>>      d /run/courier            0775 root    courier -   -
>>      d /run/courier/authdaemon 0750 courier courier -   -
>>
>> But with this configuration authdaemon not working:
>>
>>   ERR: authdaemon: s_connect() failed: Permission denied
>>   /usr/bin/maildrop: Temporary authentication failure.
>> status: deferred
> 
> Perhaps this should be considered a bug in maildrop, rather than in
> courier-authdaemon.  I'm not familiar with maildrop or what privileges
> it requires.  The package description says it runs setgid "mail", whereas
> this authdaemon directory is only accessible to group "courier".  But I
> don't know how to fix it without breaking other things.
> 

-- 
Philipp Ewald
Administrator

DigiOnline GmbH, Probsteigasse 15 - 19, 50670 Köln
Fax: +49 221 6500-690, E-Mail: philipp.ewald@digionline.de

AG Köln HRB 27711, St.-Nr. 5215 5811 0640
Geschäftsführer: Werner Grafenhain

Informationen zum Datenschutz: www.digionline.de/ds

[toc] | [prev] | [next] | [standalone]

#239324

On Thu, Aug 26, 2021 at 10:21:55AM +0200, Philipp Ewald wrote:
> Thank you for your advise!
> 
> i will add user to mail group and try again.

That is absolutely *not* what I advised.  Ordinary users should not
be in the "mail" or "courier" group.  Those groups are for mail
programs/daemons only.  Putting a user in the mail group will (among
other things) allow that user to delete *other* users' mailboxes
from /var/mail/, if you keep them there.

drwxrwsr-x 2 root mail 4096 Jan 11  2018 /var/mail/

Your original plan (change the permissions on the /run subdirectory)
is better than that, even if it means your system is "vulnerable" to
the information disclosure that the change is trying to prevent.  The
severity of this disclosure depends on what type of users you have on
your system.  If it's just you, then there's nothing to worry about.

If you have multiple real human users on your system and feel that
keeping your password hashes a secret is a high priority, then you
should talk to the maildrop support people and see what *they* suggest.

[toc] | [prev] | [next] | [standalone]

#239325

Oh sorry.

As wourkaround we allready changed the permission on that directory.

We are not affectied by this security problem, as we dont print the password hash from authdaemon.

Thanks for help!

On 8/26/21 1:02 PM, Greg Wooledge wrote:
> On Thu, Aug 26, 2021 at 10:21:55AM +0200, Philipp Ewald wrote:
>> Thank you for your advise!
>>
>> i will add user to mail group and try again.
> 
> That is absolutely *not* what I advised.  Ordinary users should not
> be in the "mail" or "courier" group.  Those groups are for mail
> programs/daemons only.  Putting a user in the mail group will (among
> other things) allow that user to delete *other* users' mailboxes
> from /var/mail/, if you keep them there.
> 
> drwxrwsr-x 2 root mail 4096 Jan 11  2018 /var/mail/
> 
> Your original plan (change the permissions on the /run subdirectory)
> is better than that, even if it means your system is "vulnerable" to
> the information disclosure that the change is trying to prevent.  The
> severity of this disclosure depends on what type of users you have on
> your system.  If it's just you, then there's nothing to worry about.
> 
> If you have multiple real human users on your system and feel that
> keeping your password hashes a secret is a high priority, then you
> should talk to the maildrop support people and see what *they* suggest.
> 

-- 
Philipp Ewald
Administrator

DigiOnline GmbH, Probsteigasse 15 - 19, 50670 Köln
Fax: +49 221 6500-690, E-Mail: philipp.ewald@digionline.de

AG Köln HRB 27711, St.-Nr. 5215 5811 0640
Geschäftsführer: Werner Grafenhain

Informationen zum Datenschutz: www.digionline.de/ds

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web