Bug#356877: mailman: private archive dir permissions insecure

2006-08-09 Thread Thijs Kinkhorst
Hello all, I suggest the following solution: chmod g=x,o= /var/lib/mailman/archives/private chgrp www-data /var/lib/mailman/archives/private Give group www-data, the standardised group the webserver runs at in Debian, the right permissions on that dir and other none, and chgrp th

Bug#356877: mailman: private archive dir permissions insecure

2006-03-15 Thread Lionel Elie Mamane
On Wed, Mar 15, 2006 at 11:05:34AM +, Roger Lynn wrote: > On 15/03/2006 07:34, Lionel Elie Mamane wrote: >> We're open to suggestions. That thing must be group list so that >> mailman can write there. Putting www-data as user would give >> www-data too much power there. We cannot put the files

Bug#356877: mailman: private archive dir permissions insecure

2006-03-15 Thread Roger Lynn
On 15/03/2006 07:34, Lionel Elie Mamane wrote: > We're open to suggestions. That thing must be group list so that > mailman can write there. Putting www-data as user would give www-data > too much power there. We cannot put the files themselves non world > readable, as Apache won't serve anything t

Bug#356877: mailman: private archive dir permissions insecure

2006-03-14 Thread Lionel Elie Mamane
On Tue, Mar 14, 2006 at 09:23:13AM -0600, Max Bowsher wrote: > Mailman's postinst currently contains the following command: > chmod o-r,o+x /var/lib/mailman/archives/private > The effect of o+x permissions on this directory is that ANY local > user has read access to ALL mailman mail archi

Bug#356877: mailman: private archive dir permissions insecure

2006-03-14 Thread Max Bowsher
Package: mailman Version: 2.1.7-1 Severity: important Mailman's postinst currently contains the following command: chmod o-r,o+x /var/lib/mailman/archives/private The effect of o+x permissions on this directory is that ANY local user has read access to ALL mailman mail archives, if they