.forward file

[Philip J. Priest_1]

Any security issues should i be aware of when using a .forward file?

Phil

[James R. Ferguson · Accepted solution]

Hi Phil:

I'd keep in readable to only its owner. Conferring write privileges could mean that someone could intercept mail that was not destined to him/her.

Regards!

...JRF...

[Sajid_1]

Make sure that the world doesn't get write access to the file. Also while configuring .forward file, keep the $HOME directory to permission -755. Sometimes, the forward function does not work if the $HOME directory has a permission other than this. You can always look at the /var/adm/syslog/mail.log file for warnings and errors.

gl,

[PIYUSH D. PATEL]

Hi Phil,

Dont give write permissions to others. Give only read permissions to owner.

Piyush

[Christopher Caldwell]

security
consider running sendmail with smrsh (sendmail restricted shell).

.forward can contain programs. users must have a valid shell (defined in /etc/shells) to run programs with a .forward. Consider giving users that don't need to run programs with .forward a shell that's not defined in /etc/shells.

make sure the group and other directory write permissions in the path to the .forward file are not set -- [if you're running sendmail >= sendmail 8.9]

don't use
ODontBlameSendmail=forwardfileinunsafedirpath,forwardfileinunsafedirpathsafe

operational
Depending on your set up, .forward can be more expensive for delivery than virusertable or aliases.

[Jochen Sprick]

An issue overlooked by the other techies: you certainly should we aware of the security issue of having the CONTENTS of your mail eventually routed over the public internet and thereby read on the internet.
Having your company mails being routed to your home account is nice, but be aware that there may be confidential contents in your company mail.

[Bill Thorsteinson]

Don't allow group or world
write access to any directories
in the tree. Some versions od sendmail will verify this and
refuse to forward.

Check the man page for aliases.