- Users - KICTANet

Exim Remote Memory Corruption Vulnerability
by Gordon Dickens 11 Dec '10

11 Dec '10

A memory corruption vulnerability exists in Exim versions 4.69 and older. This vulnerability may lead to arbitrary code execution with the privileges of the user executing the Exim daemon. The vulnerability relies upon "rejected_header" being enabled (default setting) in the log_selector configuration. To resolve this issue on Linux systems, users are urged to upgrade to a version of exim that is 4.70 or higher. FreeBSD systems should be running Exim 4.72 by default, which is not affected by this issue. Additional information regarding this vulnerability is discussed on the exim mailing list. The following post includes the Exim development team's response: http://www.exim.org/lurker/message/20101210.164935.385e04d0.en.html In summary, the exim team responded in the aformentioned post as follows: > Given that the remote flaw was fixed over a year ago and does not affect > current releases of Exim, and given the existence of the > ALT_CONFIG_ROOT_ONLY option to avoid the local privilege escalation, the > Exim team has decided that there is no immediate need to rush a new > release of Exim out the door. > > We plan to remove the ALT_CONFIG_ROOT_ONLY option (making the code > always behave as it currently does if that option is set), and then take > steps to restore the esoteric functionality that is lost by doing so, > and release a new version of Exim in good time. FYI, Gordon

1 0

spamassassin user
by Udo Hortian 28 Oct '10

28 Oct '10

Hello, I am evaluating exim4u for some time. I made two installations on Debian squeeze systems. The first I made in February this year and the second yesterday. I liked vexim and now I am going to change to exim4u. Thank you very much for your work, Gordon! There are only a few (minor) problems. One of them is the following on my new installation: In /var/log/mail.info I see the following errors from SpamAssassin: Sep 16 09:32:58 myhost spamd[24356]: spamd: still running as root: user not specified with -u, not found, or set to root, falling back to nobody Sep 16 09:32:58 myhost spamd[24356]: spamd: checking message <replaced> for spamd:65534 Sep 16 09:33:00 myhost spamd[24356]: plugin: eval failed: bayes: (in learn) locker: safe_lock: cannot create tmp lockfile /nonexistent/.spamassassin/bayes.lock.replaced.24356 for /nonexistent/.spamassassin/bayes.lock: No such file or directory The first of these lines also appears in my old installation, but the last of these lines only on the new installation. I guess one may solve this problem by disabling bayes. Can someone indicate me how to do this? Another possibility would be to create a user that will be used for spamassassin checks of exim4u. But I am not so sure if one really wants bayes for such a global user. Where in the exim4u configuration do I find the call of spamc / spamassassin? Kind regards, Udo

3 11

Virtual Domain Logins with Exim4u
by Odhiambo Washington 26 Oct '10

26 Oct '10

Hi Gordon, I have traced this issue and found what needs to be done. In webmail/imp/config/hooks.php, there is this function which is disabled/commented out by default: // if (!function_exists('_imp_hook_vinfo')) { // function _imp_hook_vinfo($type = 'username') // { // $vdomain = getenv('HTTP_HOST'); // $vdomain = preg_replace('|^mail\.|i', '', $vdomain); // $vdomain = String::lower($vdomain); // // if ($type == 'username') { // return preg_replace('|\.|', '_', $_SESSION['imp']['user'] . '_' . $vdomain); // } elseif ($type == 'vdomain') { // return $vdomain; // } else { // return PEAR::raiseError('invalid type: ' . $type); // } // } // } If you need virtual domain users to login, using just username instead of username(a)domain, there are a number of things to consider. 1. If you use one virtual host for all the domains you host, then each domain will need to have a DNS A record, like webmail.DOMAIN.NAME 2. IIRC, this will require Apache to use NameVirtualHost *:PORT and ALL webmail.DOMAIN.NAME will have to point to this vhost. This line: $vdomain = preg_replace('|^mail\.|i', '', $vdomain); Should then be changed to: $vdomain = preg_replace('|^webmail\.|i', '', $vdomain); And this line: return preg_replace('|\.|', '_', $_SESSION['imp']['user'] . '_' . $vdomain); Should be made to look like: return preg_replace('|\.|', '.', $_SESSION['imp']['user'] . '@' . $vdomain); Actually, I see that what that line does is that it replaces @ with and underscore and any dots in the domain portion with and underscore too. Such that if I went to http://webmail.wash.or.ke (which is the root for my webmail tree) and I put in the username johndoe, then what is submitted by IMP to the IMAP server as the login name becomes johndoe_wash_or_ke. I don't know why they do this (perhaps some security issue) but I changed mine as shown, so that the login name submitted is johndoe(a)wash.or.ke 3. You also need to edit webmail/imp/config/conf.php line 50 and change this line: $conf['hooks']['vinfo'] = false; To $conf['hooks']['vinfo'] = true; Someone needs to tell me the danger posed by my having return preg_replace('|\.|', '.', $_SESSION['imp']['user'] . '@' . $vdomain); I just did not need the replacements and to be honest I don't understand the dangers of doing this. Someone who knows php better should tell me. PS: I don't know if these changes affect the other groupware components. Someone should tell me:-) -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254733744121/+254722743223 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ Damn!!

2 2

Setting up groupware webmail with Exim4U
by Odhiambo Washington 26 Oct '10

26 Oct '10

For the life of me, I just cannot get the webmail interface working, which is very annoying. For some strange reason, I cannot even get to see any login attempts from the application on my dovecot logs. I have read the webmail installation/configuration over and over and I am on FreeBSD. First, where does the groupware write its logs to? Perhaps when I find that, I can figure out the rest. My ErrorLog directive in Apache doesn't even seem to capture anything:( I have copied my webmail folder to /usr/local/www/apache22/data/webmail. Is there a path I need to change, other than referring to this as DocumentRoot in Apache? I am not even able to login to the interface as the predefined admin user (during setup)! And I am also wondering if in a virtual domain setup one has to login with full e-mail address (which sux!) or just the username. Please help me diagnose this problem. I need to log everything related to this in order to find where the problem is. -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254733744121/+254722743223 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ Damn!!

2 3

Exim4U integration with pure-ftpd
by Odhiambo Washington 25 Oct '10

25 Oct '10

I am interested in the integration of Exim4U with pure-ftpd, but I am not a php programmer. There have been some offers by some programmers on this forum and I wonder if anyone is willing to take the gauntlet:-) So I start the debate. The details of the bits required to be used are already there. What needs to be done is just to incorporate the logic into the relevant php scripts for managing the domains and users. What I have used before (actually from web sources - http://osdir.com/ml/mail.exim.vexim.devel/2003-11/msg00056.html\ http://www.howtoforge.com/virtual-hosting-pureftpd-mysql-mandriva-2008-spri… ): ALTER TABLE `users` ADD `ftp_dir` VARCHAR(255); ALTER TABLE `users` ADD `ftp_enable` TINYINT(1) DEFAULT '0' NOT NULL; ALTER TABLE `users` ADD `ftp_quota` INT DEFAULT '100'; ALTER TABLE `users` ADD `ULBandwidth` SMALLINT(5) DEFAULT '0' NOT NULL; ALTER TABLE `users` ADD `DLBandwidth` SMALLINT(5) DEFAULT '0' NOT NULL; ALTER TABLE `users` ADD `ipaccess` varchar(15) DEFAULT '*' NOT NULL; ALTER TABLE `users` ADD `QuotaFiles` int(11) DEFAULT '0' NOT NULL; update users set ftp_enable ='1'; update users set ftp_dir = '/var/spool/virtual/DOMAIN/ftpdata/USER1' where username = 'USER1(a)DOMAIN'; update users set ftp_quota ='100'; /var/spool/virtual = $mailroot When a user is added 1 we need to decide whether or not ftp_enable = 0 or 1. Default should be inherited from domain settings, whether it is enabled for domain or not. 2. decide on what is the ftp_quota for the user. Default should not exceed domain ftp_quota, just like mail_quota. So maybe we need: ALTER TABLE `domains` ADD `ftp_quota` INT DEFAULT '100'; 3. Assign the user ftp_dir relative to domain's $mailroot . ftp quota should not interfere with mail quota if both are implemented. Just some ideas. -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254733744121/+254722743223 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ Damn!!

1 0

Exim4U Version 1.2.4
by Gordon Dickens 21 Oct '10

21 Oct '10

Hello Everybody, Exim4U version 1.2.4 was released today. The primary purpose of this release is to incorporate the latest version of Horde Webmail Groupware (version 1.2.7) into Exim4U's Webmail Groupware. Most of the other changes are of minor significance except for a change to the exim configuration file (exim.conf) that causes sender address callout verifications to be performed only for spammy mail (spam score > 0). Exim4U version 1.2.4 may be downloaded from here: http://exim4u.org/html/download.html A summary of the changes and enhancements in version 1.2.4 may be reviewed here: http://exim4u.org/svn/exim4u_src/tags/1.2.4/VERSION Instructions for upgrading Exim4U version 1.2.3 to 1.2.4 are included in the changelog here: http://exim4u.org/svn/exim4u_src/tags/1.2.4/CHANGELOG FYI, Gordon Dickens

1 0

SpamBox
by Udo Hortian 18 Oct '10

18 Oct '10

Dear Gordon, dear list, first I would like to thank the vexim developers for their work and Gordon for the great job to create exim4u. I have a question concerning SpamBox. It seems that the functionality is not very well documented. I would like to know what happens if I activate the Spam Box. I guess that mails that are identified as Spam are stored in this SpamBox. What is the score for this? And are these Mails still taged as Spam or is the tagging replaced by the move to the Spam folder? Personally I would like to achieve a situation such that mails with score higher than a given value are stored in the Spam folder and all others in the normal inbox. I do not want tagging at all. Is this possible? I would appreciate if this could be added to the documentation. Kind regards, Udo

2 3

procmail
by Udo Hortian 18 Oct '10

18 Oct '10

Dear Gordon, dear list, I have another question: Is there a way to use procmail on a user-based level? That is, could procmailrc files be created for each user to do mail filtering? This would be great. Kind regards, Udo

2 1

Bindhack - Program To Allow Telnet To Bind To Any IP address For Its Outbound Session
by Gordon Dickens 04 Oct '10

04 Oct '10

Since several people are now using the Multi-IP capabilities of Exim4U I thought that I would make mention of a very useful little program called Bindhack. Bindhack allows you to bind any IP address for telnet execution. That is, in its native implementation, telnet uses the machines default (or primary) IP address and does not have any option for changing the outbound IP address. However, with Bindhack, you can have telnet use any outbound IP address that has been configured for your server. This is quite useful when you need to simulate your smtp sessions with telnet, typically on port 25, and have your telnet session use a different outbound IP address other than the machines primary interface. Bindhack's source code can be obtained here: http://wari.mckay.com/~rm/bindhack.c.txt The instructions for compiling and using Bindhack are included in the code's comments. I have written two quick and dirty little scrips for using bind hack which are attached. These scripts are not fancy (and come without any warranties) and so, if you are interested, I encourage you to write your own bindhack scripts and share them with the community. FYI, Gordon

1 0

Outgoing IP
by Udo Hortian 04 Oct '10

04 Oct '10

Hello, If I understand correctly, the value of primary_hostname in the file /etc/exim/exim4u_local.conf.inc is used as outgoing IP address if MULTI_IP is NO in this file. After installing exim4u on a host with primary_hostname a FQDN, say FQDN1 that points to an ip address IP1 of this box everything worked fine. Now I changed this value to another FQDN, say FQDN2 that points to another ip address IP2 of this box. In the outgoing_ip field of the domains table in the MySQL database also IP2 appears. But when sending outgoing mails from the domains I configured in exim4u, IP1 is used for the SMTP connection. What am I doing wrong? In principle I want that outgoing connections are everytime made from IP2. Note that I use MULTI_IP = NO. Best, Udo

2 2