From 0f3e091d19c9ed02a522a5e8d9efc9ec725b5382 Mon Sep 17 00:00:00 2001 From: pdmef Date: Thu, 18 Aug 2005 12:24:25 +0000 Subject: [PATCH] Rocco Rutte: - add Security chapter to manual git-svn-id: svn://svn.berlios.de/mutt-ng/trunk@408 e385b8ad-14ed-0310-8656-cc95a2468c6d --- doc/manual.sgml.head | 155 +++ doc/manual.txt | 2348 ++++++++++++++++++++++-------------------- 2 files changed, 1393 insertions(+), 1110 deletions(-) diff --git a/doc/manual.sgml.head b/doc/manual.sgml.head index 6469349..eace2af 100644 --- a/doc/manual.sgml.head +++ b/doc/manual.sgml.head @@ -4298,6 +4298,161 @@ muttrc. +Security Considerations + +

First of all, mutt-ng contains no security holes included by + intention but may contain unknown security holes. As a consequence, + please run mutt-ng only with as few permissions as possible. + +

Please do not run mutt-ng as the super user. + +

When configuring mutt-ng, there're some points to note about secure + setups. + +

In practice, mutt-ng can be easily made as vulnerable as even the + most insecure mail user agents (in their default configuration) just + by changing mutt-ng's configuration files: it then can execute + arbitrary programs and scripts attached to messages, send out private + data on its own, etc. Although this is not believed to the common type + of setup, please read this chapter carefully. + + Passwords + +

Although mutt-ng can be told the various passwords for accounts, + please never store passwords in configuration files. Besides the + fact that the system's operator can always read them, you could + forget to replace the actual password with asterisks when reporting + a bug or asking for help via, for example, a mailing list so that + your mail including your password could be archived by internet + search engines, etc. Please never store passwords on disk. + + + + Temporary Files + +

Mutt-ng uses many temporary files for viewing messages, verifying + digital signatures, etc. The + variable can be used to change the default permissions of these + files. Please only change it if you really know what you are doing. + Also, a different location for these files may be desired which can + be changed via the variable. + + + + Information Leaks + + Message-ID: headers + +

In the default configuration, mutt-ng will leak some information + to the outside world when sending messages: the generation of + variable. Please make sure that + you really know how local parts of these + + mailto:-style links + +

As mutt-ng be can be set up to be the mail client to handle + variable is For example, following a link like + + +mailto:joe@host?Attach=~/.gnupg/secring.gpg + + will send out the user's private gnupg keyring to When variable, mutt-ng will + + + + be less strict when interpreting these links by + prepending a turn on the variable by + force to let the user see all the headers + (because they still may leak information.) + + + + + + + + External applications + +

Mutt-ng in many places has to rely on external applications or + for convenience supports mechanisms involving external + applications. + + mailcap + +

One of these is the + variable for details.) These utilities may have security issues + like overriding arbitrary files, contain exploitable bugs or just + leak information which is a bad in combination with running them + without prompting. When using mutt-ng's autoview mechanism + involing use of mailcap files, please make sure that + + + + you manually select trustworthy applications with a + reasonable calling sequence + + you check the contents of mailcap files from time to time + (for example after doing software installations/upgrades) + + you, if you're the system's operator, always keep the + software packages involved up-to-date + + you never ever change the default value of the + variable + + + + + + Other + +

Besides the mailcap mechanism, mutt-ng uses a number of other + external utilities for operation. + +

The same security considerations apply for these as for tools + involved via mailcap (for example, mutt-ng is vulnerable to Denial + of Service Attacks with compressed folders support if the + uncompressed mailbox is too large for the disk it is saved to.) + +

As already noted, most of these problems are not built in but + caused by wrong configuration, so please check your configuration. + + + + + + + Reference Command line options