topic Re: .forward file in Operating System - HP-UX

.forward file

Philip J. Priest_1 — Wed, 28 Aug 2002 20:04:10 GMT

Any security issues should i be aware of when using a .forward file?

Phil

Re: .forward file

James R. Ferguson — Wed, 28 Aug 2002 20:07:28 GMT

Hi Phil:

I'd keep in readable to only its owner. Conferring write privileges could mean that someone could intercept mail that was not destined to him/her.

Regards!

...JRF...

Re: .forward file

Sajid_1 — Wed, 28 Aug 2002 20:10:25 GMT

Make sure that the world doesn't get write access to the file. Also while configuring .forward file, keep the $HOME directory to permission -755. Sometimes, the forward function does not work if the $HOME directory has a permission other than this. You can always look at the /var/adm/syslog/mail.log file for warnings and errors.

gl,

Re: .forward file

PIYUSH D. PATEL — Wed, 28 Aug 2002 20:14:33 GMT

Hi Phil,

Dont give write permissions to others. Give only read permissions to owner.

Piyush

Re: .forward file

Christopher Caldwell — Wed, 28 Aug 2002 20:39:25 GMT

security
consider running sendmail with smrsh (sendmail restricted shell).

.forward can contain programs. users must have a valid shell (defined in /etc/shells) to run programs with a .forward. Consider giving users that don't need to run programs with .forward a shell that's not defined in /etc/shells.

make sure the group and other directory write permissions in the path to the .forward file are not set -- [if you're running sendmail >= sendmail 8.9]

don't use
ODontBlameSendmail=forwardfileinunsafedirpath,forwardfileinunsafedirpathsafe

operational
Depending on your set up, .forward can be more expensive for delivery than virusertable or aliases.

Re: .forward file

Jochen Sprick — Fri, 30 Aug 2002 02:26:42 GMT

An issue overlooked by the other techies: you certainly should we aware of the security issue of having the CONTENTS of your mail eventually routed over the public internet and thereby read on the internet.
Having your company mails being routed to your home account is nice, but be aware that there may be confidential contents in your company mail.

Re: .forward file

Bill Thorsteinson — Fri, 30 Aug 2002 12:19:37 GMT

Don't allow group or world
write access to any directories
in the tree. Some versions od sendmail will verify this and
refuse to forward.

Check the man page for aliases.