[cobalt-users] Raq2 email DOS issue

[flash22@xxxxxxx]

Ok, in poking about on a raq 2 i found something interesting, both 'news'
and 'mail' had recieved email (spam).

Aside from the fact that this is silly, it raises a more serious issue,
because those users, and the mail group, have unlimited quota, so someone
could in theory mailbomb the server and fill the disk :(

[root mail]# quota -g news
Disk quotas for group news (gid 13): none
[root mail]# quota -g mail
Disk quotas for group mail (gid 12): none
[root mail]# quota -u mail
Disk quotas for user mail (uid 8): none
[root mail]# quota -u news
Disk quotas for user news (uid 9): none

In addition i seem to be able to address mail to other privilaged users
like 'lp' ...

My 'quick fix' is to leave the spool files and zero perms, but this is
admittidly not pretty-

I suppose i have to go through the entire password file looking for stupid
things people can email to and add them all to the access tables, yeash

Cobalt: This is *sloppy* :(

gsh

ps: stray thing, 'listserv' is listed as a trusted user in .ct but isn't
exposed in .cf - hmm, is this normal ?