Re: [SM-PLUGINS] server side filter plugin problem

[Bu X. <bus...@gm...>]

On 2013-6-27 15:14, Paul Lesniewski wrote:
> On Thu, Jun 27, 2013 at 12:09 AM, Bu Xiaobing <bus...@gm...> wrote:
>> On 2013-6-25 7:14, Paul Lesniewski wrote:
>>>> I think the problem with setgroups(0, NULL): Operation not permitted has
>>>> been resolved.
>>>
>>> If you don't say *how* -- explain carefully what you changed, what
>>> your current settings are, then you leave us to guess.  This is
>>> frustrating and you are less likely to receive any help this way.
>>>
>>>> At the first time I set
>>>> 'SUID_LOCATION'  => array('VALUE' =>
>>>> '/var/www/html/webmail/plugins/server_settings_backend/suid_backend/squirrelmail_server_settings_suid_backend'),
>>>>
>>>> I find in the /var/www/html/webmail/plugins/server_settings_backend also has
>>>> a squirrelmail_server_settings_suid_backend, and the file permission is
>>>> -rwsr-xr-x.
>>>>
>>>> So I change the SUID_LOCATION value to
>>>> /var/www/html/webmail/plugins/server_settings_backend/squirrelmail_server_settings_suid_backend
>>>
>>> The only examples I can find point to the server_settings_backend
>>> directory.  The copy of the suid_wrapper in the suid_backend directory
>>> shouldn't be used in your configuration.  (I believe this is your
>>> oversight, unless you can point out where there was a misleading
>>> example.)
>>>
>>>> But get another error "Remote file name cannot contain "/"" in the
>>>> /var/log/httpd/error_log.
>>>
>>> This is good in general.  If you really need directory traversal
>>> (why?), read the docs on how to compile the suid wrapper.  And once
>>> again, READ THE DOCS **BEFORE** you ask for help.
>>>
>>>> And if I set "$ssf_debug_server_settings_backend = 1" in the
>>>> server_side_filters/config.php, and after I click "Options->Message Filters"
>>>> on the web browser, the web page only display the following message:
>>>>
>>>> Unable to retrieve file from command
>>>> "/var/www/html/webmail/plugins/server_settings_backend/squirrelmail_server_settings_suid_backend
>>>> 'localhost' 'buxiaobing' 'get_file' '/home/buxiaobing/.mailfiter'
>>>> '/var/local/squirrelmail/attach/xo4HqZ6WpSq6iUazfx1TLAmw3SEg6p9D'"
>>>>
>>>> Can't understand why will it retrieve the
>>>> /var/local/squirrelmail/attach/xo4HqZ6WpSq6iUazfx1TLAmw3SEg6p9D file and
>>>> this file is not exist.
>>>>
>>>>
>>>> Bu Xiaobing
>>>
>>>
>>>
>>
>> Thanks for your help. I read the server_settings_backend/docs/SUID_BACKEND_ERRORS
>> and find the problems and it works now!
>
> Thanks for reading the docs.  I'd just caution you again *against*
> allowing directory traversal.  There is no reason you should need that
> and it is less secure.
>

Do you mean I should not use SUID backend?

For now, I need SUID to save a kickoff file .forward which contains "|exec /usr/bin/procmail || exit 75" at /home/USER, So I can invoke procmail to do filter. And I compiled SUID with --enable-auth=imap to do authentication.

Bu xiaobing