September 2008 - postfix-users

[postfix-users] Erscheinungstermin Postfix-Buch
by Werner D. 05 Sep '08

05 Sep '08

Hi Ralf, Servus Patrick, ich wollt mich kurz erkundigen, was denn der anvisierte Erscheinungstermin für euer überarbeitetes Postfix-Buch ist. Auf Amazon ist der 01.08.08 genannt, der Artikel ist aber noch nicht verfügbar. Bei Dpunkt, wo auch ich vorbestellt habe, ist lediglich August 2008 genannt. Wie weit seit ihr denn ? lg, Werner Detter

9 44

[postfix-users] Problem mit eingehenden Mails
by gbalzer＠balzer-computing.ch 03 Sep '08

03 Sep '08

Hi, ich habe bei eingehenden Mails von einigen Servern folgende Logeinträge festgestellt: Aug 31 05:39:38 srv1 postfix/smtpd[22638]: lost connection after DATA from mta.ecostemail.com[64.132.92.129] Bei der überwiegenden Mehrheit der eingehenden Mails funktioniert es. Da ich (noch) nicht der Postfix-Guru bin, würde ich mich freuen, falls mir jemand hier weiter helfen kann. Rechner: CentOS 5.2 Postfix: 2.3.3 Danke Gerald

3 4

[postfix-users] [Übersetzung] Postfix Linux-only local denial of service
by Ralf Hildebrandt 02 Sep '08

02 Sep '08

In Deutsch: http://de.postfix.org/advisory2/ ----- Forwarded message from Wietse Venema <wietse(a)porcupine.org> ----- From: Wietse Venema <wietse(a)porcupine.org> Date: Tue, 2 Sep 2008 08:52:44 -0400 (EDT) To: Postfix announce <postfix-announce(a)postfix.org> CC: Postfix users <postfix-users(a)postfix.org> Subject: Postfix Linux-only local denial of service Reply-To: Postfix users <postfix-users(a)postfix.org> X-Mailer: ELM [version 2.4ME+ PL82 (25)] An on-line version of this announcement is available at http://www.postfix.org/announcements/20080902.html Summary: ======== Postfix 2.4 and later, on Linux kernel 2.6, is vulnerable to a denial of service attack by a local user. There is no breach of data confidentiality or data integrity. This problem was found by the Postfix author during routine source code maintenance. Discussion: =========== Postfix is an open-source mail transfer agent (MTA) that runs on multiple types of UNIX systems. Postfix 2.4 (released 2007) introduces input/output event handling based on high-performance primitives: BSD kqueue (also present in MacOS X), Linux epoll, and Solaris /dev/poll. These implement more scalable event handling than the older select() and poll() primitives. With 2.6 Linux kernels, Postfix 2.4 and later has an epoll file descriptor leak when it executes non-Postfix commands in, for example, a user's $HOME/.forward file. A local user can access a leaked epoll file descriptor to implement a denial of service attack on Postfix. The attack may result in reduced Postfix performance, or in automatic Postfix shutdown when an internal safety mechanism triggers. Some possible attacks are discussed in the last paragraph of this section. Not affected is Postfix input/output event handling based on BSD kqueue and Solaris /dev/poll. There, the kernel effectively revokes access to the underlying kernel object when it creates a child process with fork(), keeping the kernel object normally accessible only by the process that creates it. The above approaches could help to improve the consistency of Linux input/output event notification. Currently, 1) different Linux processes may make conflicting updates to a shared epoll instance; 2) therefore, the Linux kernel may report input/output events to processes that didn't ask for those events; and 3) those events may involve activity on pipes, sockets, etc. that aren't open in those processes. Such inconsistency could be avoided when an epoll instance were normally accessible only by the process that creates it. Workaround: =========== Allow only trusted users to control delivery to non-Postfix commands. In the following example, the directory /var/forward is not writable by users, and Postfix is configured to search for /var/forward/username (plus optional address extension) instead of the default location ~username/.forward (plus optional address extension). /etc/postfix/main.cf: forward_path = /var/forward/${user}${recipient_delimiter}${extension}, /var/forward/${user} Other workarounds would be required for other mail filtering software that executes commands in user-controlled configuration files. Solution: ========= Apply the source code patch below, or install an updated Postfix version. Postfix versions 2.4.9, 2.5.5, and 2.6-20080902 are made available via http://www.postfix.org/. Vendors will make updated versions available according to their own support policies. Patch: ====== Begin of patch *** src/util/events.c.orig Mon Mar 24 13:19:23 2008 --- src/util/events.c Tue Aug 26 17:43:41 2008 *************** *** 426,431 **** --- 427,433 ---- #define EVENT_REG_INIT_HANDLE(er, n) do { \ er = event_epollfd = epoll_create(n); \ + if (event_epollfd >= 0) close_on_exec(event_epollfd, CLOSE_ON_EXEC); \ } while (0) #define EVENT_REG_INIT_TEXT "epoll_create" End of patch -- Ralf Hildebrandt (Ralf.Hildebrandt(a)charite.de) snickebo(a)charite.de Postfix - Einrichtung, Betrieb und Wartung Tel. +49 (0)30-450 570-155 http://www.arschkrebs.de I'm looking for a job Buying Microsoft anymore is like saying: Please, treat me like a two year old, stifle my creativity and learning, keep me in the dark and feed me crap, and whatever you do, don't let me question your 'authority'.

1 0