Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
From: Christian Weisgerber (naddymips.inka.de)
Date: Sat Jan 13 2001 - 06:31:00 CST
Ryan Thompson <ryansasknow.com> wrote:
> Is there a GOOD reason that, by default, /usr/local/majordomo/lists is
> world readable? Does not just the "majordom" user/group ever read the
> files contained therein?
No, sendmail reads the subscriber list. It's just an :include:d
alias expansion, after all.
> I was notably concerned when I saw the administrative password
> for each list stored clear text in a predictable world readable
> file/directory. :-)
You may get away with o-r on the .config files (aren't they already?),
but the subscriber list itself must remain world-readable.
-- Christian "naddy" Weisgerber naddymips.inka.de
To Unsubscribe: send mail to majordomoFreeBSD.org with "unsubscribe freebsd-security" in the body of the message