Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines
Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.
REPEAT: Do NOT report bugs for outdated packages!
https://wiki.archlinux.org/title/Bug_reporting_guidelines
Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.
REPEAT: Do NOT report bugs for outdated packages!
FS#1802 - [SECURITY] Postfix account should not have a valid shell
Attached to Project:
Arch Linux
Opened by BlueRaven (BlueRaven) - Thursday, 18 November 2004, 14:20 GMT
Last edited by Dale Blount (dale) - Thursday, 18 November 2004, 14:34 GMT
Opened by BlueRaven (BlueRaven) - Thursday, 18 November 2004, 14:20 GMT
Last edited by Dale Blount (dale) - Thursday, 18 November 2004, 14:34 GMT
|
DetailsHi, I noticed that the Postfix post-install routine creates the required postfix account with /bin/bash as its shell.
This is potentially dangerous, as the postfix account should have no valid executable shell. This is stated in the official INSTALL file: "used by any other user account. Preferably, this is an account that no-one can log into. The account does not need an executable login shell, and needs no existing home directory." I hereby attach a simple patch against postfix.install. 
postfix.install.patch
|
This task depends upon
Comment by Dale Blount (dale) -
Thursday, 18 November 2004, 14:54 GMT
Thanks for the patch, it has been applied (slightly modified to fix existing installs) and commited.