gmane.mail.postfix.policyd-weight

Updated RPM - SUSE and Redhat

Morgan Weetman — 2008-06-03T06:53:26

Hi all, I've updated the rpm on SourceForge, the init script now works on SuSE and Redhat so the release id has changed. Tested on openSUSE 10.3 and RHEL4, pls let me know if you find any issues, thnx ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

Re: missing subfolders in /tmp/.policyd-weight

Andre Hübner — 2008-04-01T14:20:07

oh, alles klar. Ich dachte nur weil der autor auf der homepage schreibt das hier nicht viel los wäre. ok, ich ändere nun mein setup ein bisschen ab, ist wohl das beste. ich entferne den kram aus der master und starte den policyd-weight als separaten daemon. in der main.cf notiere ich dann check_policy_service inet:127.0.0.1:12525 so wie vorgesehen. nur beim stop -> start hab ich die erfahrung gemacht das er da ab und zu hängt. dies kann ich aber umgehen wenn ich /tmp/.policyd-weight entferne nach dem stop. ich baus mal so in das postfix startscript ein, wird das beste sein. mal sehen vielen dank andre ----- Original Message ----- From: "Daniel Hackenberg" public.gmane.org> To: "Andre Hübner" public.gmane.org> Sent: Tuesday, April 01, 2008 2:02 PM Subject: Re: missing subfolders in /tmp/.policyd-weight So inaktiv ist die Liste gar nicht. Das siehst du, wenn du mal in das Listen-Archiv unter http://news.gmane.org/gmane.mail.postfix.policyd%2dweight

Re: missing subfolders in /tmp/.policyd-weight

Whit Blauvelt — 2008-04-01T13:22:55

monit is good for that too. - Whit On Tue, Apr 01, 2008 at 03:02:26PM +0200, Robert Felber wrote: ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

Re: missing subfolders in /tmp/.policyd-weight

Robert Felber — 2008-04-01T13:02:26

Yes one someone needs to fix policyd-weight which creates this directories also in non-damon mode. Policyd-weight itself doesn't have a nice routine for easily creating directory X with correct perms, owners and symlink checks. I would say 'policyd-weight start' is better. Probably that it promises some failover-redundancy because postfix would start the program for each smtpd session. If policyd-weight crashes, it would be re-called the next time a smtpd session is made. However, if you fear that policyd-weight (or any other daemon for that matter) crashes and want to restart it automatically you may want to have a look at runit [1] or daemontools [2]. Personally I use none of those as I rather have crashed services than undiscovered problems. 1: http://smarden.org/runit/ 2: http://cr.yp.to/daemontools.html

missing subfolders in /tmp/.policyd-weight

Andre Hübner — 2008-04-01T11:27:30

Hi List, i hope there is enough traffic here to get answers. ;) Im updateing my postfix-configuration to the new policyd-weight Version: 0.1.14 beta-17 Only difference to ./policyd-weight defaults is: $GROUP = "nogroup"; policyd-weight.conf is in /etc/ I do not start policyd-weight by ./policyd-weight start, i have this in my master.cf: policy-pdw unix - n n - - spawn user=polw argv=/usr/lib/postfix/policyd-weight i cannot say the reason why this is made that way, this was made by other people policyd-weight is running and gives a correct checkresult, but between the checks are also warnings in the log. Apr 1 12:41:46 servername postfix/policyd-weight[8958]: warning: cache_query: $csock couln't be created: connect: No such file or directory, calling spawn_cache () Apr 1 12:41:46 servername postfix/policyd-weight[8981]: warning: cache: err: cache: chdir /tmp/.policyd-weight/: No such file or directory at /usr/lib/postfix/p olicyd-weight lin

Re: security: version update: version 0.1.14 beta-17

Robert Felber — 2008-03-29T20:18:26

A misguiding log-message. Following patch makes it not more clear, but more correct. --- old/policyd-weight Fri Mar 28 15:55:22 2008 +++ new/policyd-weight Sat Mar 29 20:50:44 2008 < at >< at > -2945,7 +2945,8 < at >< at > # change directory to $LOCKPATH in order to get some # coredumps just in case. - chdir "$LOCKPATH/cores/cache" or die "cache: chdir $LOCKPATH: $!"; + chdir "$LOCKPATH/cores/cache" or die + "cache: chdir $LOCKPATH/cores/cache: $!"; mylog(info=>'cache spawned'); Manually killing policyd-weight implies to kill the cache instance. The way to completely shut down policyd-weight is policyd-weight -k stop This doesn't work anymore if the directory has been deleted, in such cases you need to do a ps xauww | grep policyd-weight and kill the pids by verifying that it is a policyd-weight process. Policyd-weight needs completely to be shut down _before_ you change the $LOCKPATH config parameter.

Re: security: version update: version 0.1.14 beta-17

Whit Blauvelt — 2008-03-29T18:12:43

Hi Robert, What's this: postfix/policyd-weight[18125]: warning: cache: err: cache: chdir /tmp/.policyd-weight/: No such file or directory at /usr/sbin/policyd-weight line 2948, line 100 That's with beta-17, yet # ls -ld /tmp/.policyd-weight/ drwx------ 2 polw polw 4096 2008-03-29 14:09 /tmp/.policyd-weight/ So "No such" message yet such a directory? That directory in this case has been recreated by policyd-weight - I misread your "workaround" suggestion as instructions to go ahead and delete it. Maybe if I hadn't it wouldn't be broken? Thanks, Whit On Fri, Mar 28, 2008 at 04:16:29PM +0100, Robert Felber wrote: ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

Re: security: version update: version 0.1.14 beta-17

Robert Felber — 2008-03-29T08:50:48

Which? I'll use /var/run in some of the next releases.

Re: security: version update: version 0.1.14 beta-17

Paul B. Henson — 2008-03-28T23:30:28

If you have a trailing slash, Linux follows the symbolic link and runs lstat on what the link points to, not the link itself. You can demonstrate the same behavior with ls: henson< at >gentoo ~/tmp $ mkdir foo henson< at >gentoo ~/tmp $ ln -s foo bar henson< at >gentoo ~/tmp $ touch foo/baz henson< at >gentoo ~/tmp $ ls -l bar lrwxrwxrwx 1 henson henson 3 Mar 28 16:21 bar -> foo henson< at >gentoo ~/tmp $ ls -l bar/ total 0-rw-r--r-- 1 henson henson 0 Mar 28 16:21 baz Interestingly, other operating systems display different behavior. For example, under Solaris 8: $ ls -l bar/ lrwxrwxrwx 1 henson csupomona 3 Mar 28 15:20 bar/ -> foo I'm not sure which is the more correct behavior... Also, the S_IFDIR output from strace isn't an argument to lstat, it's the return value of the lstat call. There are still race conditions present in the code. It is rather difficult to securely create files/directories in a world writable directory. If you are running on a multiuser system, it's probably best to have the lock direc

Re: Thanks for fix, Website slightly confused

Henrik K — 2008-03-28T17:08:15

I keep a somewhat updated reference of everything at: http://hege.li/howto/spam/etc/ Maybe you can get some ideas from the postfix setup too. ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

Re: Thanks for fix, Website slightly confused

Steve — 2008-03-28T17:01:56

-------- Original-Nachricht -------- Care to share your rules for postfwd?

Re: Thanks for fix, Website slightly confused

Henrik K — 2008-03-28T16:49:12

I've been running postfwd for several weeks on production already and it's developing forward very quickly. You can do pretty much everything that policyd-weight does and some better (like async DNS). It's missing some checks like MX relations etc, but I don't know if thats really even needed. The developer is very active and knowable, so I think we are in good shape there. ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

Re: Thanks for fix, Website slightly confused

Robert Felber — 2008-03-28T16:46:59

Empty the cache, force a reload. It is 0.1.14 beta-17 for both (beta, devel) versions. Fixed. Sorry.

Thanks for fix, Website slightly confused

Whit Blauvelt — 2008-03-28T16:34:28

Hi, At the moment "policyd-weight Version: 0.1.14 beta-17" links to beta-15, while "devel version 0.1.14 beta-17" does link to beta-17, and "You are encouraged to update to a version newer than 0.1.14 beta-17" is nicely proactive. No complaints here. If policyd-weight doesn't get a maintainer, guess we'll be moving to postfwd. But I tried running that overnight instead, and while it's a very promising framework it seemed not quite as mature yet. Best, Whit ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

security: version update: version 0.1.14 beta-17

Robert Felber — 2008-03-28T15:16:29

Hello, policyd-weight still did not check the working directory correctly. 1st: I assumed [ -L /foo/bar ] is the same as [ -L /foo/bar/ ] because the -L tells the file test what to look for. But in the latter form it is checked with S_IFDIR. We normalize the path with File::Spec->canonpath as s,/+$,, is not sufficient. 2nd: policyd-weight didn't check the ownership of real directories which might have been resulted in a race attack. Policyd-weight once gets the stat/lstat and reuses that information in order to provide some sort of atomicity of the check_symlnk() sub-routine. MD5 (policyd-weight) = 68373b7cfeda52b78df6229ed658771e SHA256 (policyd-weight) = 4245495685e516e00a363a97aaa17456f48c51fcbdb4458989a9d68db64083bc MD5 (policyd-weight-0.1.14.17.tar.gz) = c90128d2442ba343e8127dc0dbdcfd9a SHA256 (policyd-weight-0.1.14.17.tar.gz) = c13bac397cbd8c018b41686da4e4ce9450fb045752d7f0ab518d9836b

Re: security: version update: version 0.1.14 beta-15 (was: Insecure lockfile creation - vulnerability report)

Robert Felber — 2008-03-28T09:19:05

I'll update the releases today. Patch below: --- /old/policyd-weight Tue Mar 25 00:25:39 2008 +++ /new/policyd-weight Fri Mar 28 10:06:46 2008 < at >< at > -23,9 +23,9 < at >< at > # see http://spf.pobox.com/ # # AUTHOR: r.felber-MtC3HXRotUOzQB+pC5nmwQ< at >public.gmane.org -# DATE: Mon Mar 24 23:59:00 CET 2008 +# DATE: Fri Mar 28 10:08:42 CET 2008 # NAME: policyd-weight -# VERSION: 0.1.14 beta-15 +# VERSION: 0.1.14 beta-16 # URL: http://www.policyd-weight.org/ < at >< at > -78,7 +78,7 < at >< at > use vars qw($csock $s $tcp_socket $sock $new_sock $old_mtime); -our $VERSION = "0.1.14 beta-15"; +our $VERSION = "0.1.14 beta-16"; our $CVERSION = 5; # cache interface version our $CMD_DEBUG = 0; # -d switch our $KILL; # -k switch < at >< at > -3624,7 +3624,13 < at >< at > my $who = shift; for ( < at >_ ) { - if( -l $_ ) + + # strip trailing '/' + # perl and test(1) ignore the request for -l/-L and + # do a lstat with S_IFDIR (added in 0.1.

Re: security: version update: version 0.1.14 beta-15 (was: Insecure lockfile creation - vulnerability report)

Robert Felber — 2008-03-28T08:51:08

strace of policyd-weight: lstat("/tmp/.policyd-weight/", {st_mode=S_IFDIR|0700, st_size=512, ...}) = 0 strace of command line perl: lstat("/tmp/.policyd-weight", {st_mode=S_IFLNK|0700, st_size=18, ...}) = 0 strace of command line perl with trailing slash: lstat("/tmp/.policyd-weight/", {st_mode=S_IFDIR|0700, st_size=512, ...}) = 0 other test: # if [ -L /tmp/.policyd-weight ]; then echo err; fi err # if [ -L /tmp/.policyd-weight/ ]; then echo err; fi # What the? If I want a check for -d then I'd say so. I am a bit puzzled on how to handle this, and - who to blame. However, I will strip trailing / as a workaround.

Re: security: version update: version 0.1.14 beta-15 (was: Insecure lockfile creation - vulnerability report)

Robert Felber — 2008-03-28T08:40:47

Thanks for reporting. This is weird, and I am a little bit confused: # perl -wle 'if(-l "/tmp/.policyd-weight"){ print "err" }' err The question is now, why the same test in policyd-weight is not resulting in a true value.

Re: security: version update: version 0.1.14 beta-15 (was: Insecure lockfile creation - vulnerability report)

Andrej Kacian — 2008-03-27T22:52:40

pw rpm for RHEL / Fedora uploaded to sourceforge

Morgan Weetman — 2008-03-27T03:05:21

Hi all, I have uploaded policyd-weight-0.1.14b15-1rh.noarch.rpm to the sourceforge page - please note this is a Redhat based release. I performed some basic testing on RHEL4, RHEL5 and Fedora 8 but please let me know if you find any problems. The init script in this package is not compatible with SuSE but I hope to release a SuSE-specific rpm shortly depending on work commitments, cheers, Morgan ____________________________________________________________ Policyd-weight Mailinglist - http://www.policyd-weight.org/

Re: errors regarding cache

Robert Felber — 2008-03-25T08:46:37

This might be due to the version update. Delete the directory and let policyd-weight rebuild it. kill all policyd-weight instances. rm -rf /tmp/.policyd-weight policyd-weight start The latter message "warning: cache_query: $csock couln't be created" is normal at startups. It should appear once after each startup but not during runtime.