tor, 25.12.2003 kl. 04.37 skrev James Sasitorn:
> Is there a need to chroot exim? I'm running exim for all my mail on 10 domains.
> I was using a webhost, but now I'm trying to host apache/mail/bind. I notice
> that postfix is chroot. I can hardly find anything on google regarding a chroot
> exim environment. I dont relay mail. Is there any other security measures I
> should be aware of?
Correction: Wietse Venema gave Postfix the possibility of running in a
chroot jail, and some *n?x flavors and distros implement this, totally
unnecessarily. chrooted daemons are only required when exploits of that
daemon mean that an attacker can gain another identity on an exploited
host. This happens widely, time after time with Sendmail - in spite of
constant updates - but in years experience with Exim and months with
Postfix I've never heard of such an exploit with these two MTAs.
Using daemons in a chroot jail gives *all* sorts of problems in
practice, since libraries, subdirectories, AUTH databases, etc. all have
to be duplicated in the chroot jail - and symlinks to the real
directories do not work. Wietse V. has answered, time after time, the
question as to whether Postfix should be run chrooted with: "No, I don't
run chrooted Postfix and I don't recommend it in any case where one
isn't running it on a specially hardened server. Avoid it wherever
possible".
OTOH, running Apache, ftpds of all kinds, BIND and certain other daemons
like sshd that have been exploited time after time is probably to be
recommended.
HTH,
--Tonni
--
mail: billy - at - billy.demon.nl
http://billy.demon.nl
