Bug#448712: exim4-daemon-heavy: too wide file permissions: /var/lib/exim4/config.autogenerated

Jurgen V. Uzbekoff j.uzbekov at ngs.uz
Wed Oct 31 10:26:18 UTC 2007


Package: exim4-daemon-heavy
Version: 4.63-17
Severity: normal

File /var/lib/exim4/config.autogenerated has permissions 0644. Even if 
we have configuration options starting with 'hide' string - they are 
visible for everybody. For example, string from Exim4 documentation:

	hide mysql_servers = localhost/users/admin/secret-password

contains password for access to MySQL database in clear-text format.

-- Package-specific info:
Exim version 4.63 #1 built 20-Jan-2007 10:42:32
Copyright (c) University of Cambridge 2006
Berkeley DB: Sleepycat Software: Berkeley DB 4.3.29: (September  6, 2005)
Support for: crypteq iconv() IPv6 PAM Perl GnuTLS move_frozen_messages Content_Scanning Old_Demime
Lookups: lsearch wildlsearch nwildlsearch iplsearch cdb dbm dbmnz dnsdb dsearch ldap ldapdn ldapm mysql nis nis0 passwd pgsql sqlite
Authenticators: cram_md5 cyrus_sasl plaintext spa
Routers: accept dnslookup ipliteral iplookup manualroute queryprogram redirect
Transports: appendfile/maildir/mailstore/mbx autoreply lmtp pipe smtp
Fixed never_users: 0
Size of off_t: 8
Configuration file is /var/lib/exim4/config.autogenerated

-- System Information:
Debian Release: 4.0
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18-5-686
Locale: LANG=ru_RU.KOI8-R, LC_CTYPE=ru_RU.KOI8-R (charmap=KOI8-R)

Versions of packages exim4-daemon-heavy depends on:
ii  debconf [debconf-2.0]  1.5.11            Debian configuration management sy
ii  exim4-base             4.63-17           support files for all exim MTA (v4
ii  libc6                  2.3.6.ds1-13etch4 GNU C Library: Shared libraries
ii  libdb4.3               4.3.29-8          Berkeley v4.3 Database Libraries [
ii  libgnutls13            1.4.4-3           the GNU TLS library - runtime libr
ii  libldap2               2.1.30-13.3       OpenLDAP libraries
ii  libmysqlclient15off    5.0.32-7etch1     mysql database client library
ii  libpam0g               0.79-4            Pluggable Authentication Modules l
ii  libpcre3               6.7-1             Perl 5 Compatible Regular Expressi
ii  libperl5.8             5.8.8-7           Shared Perl library
ii  libpq4                 8.1.9-0etch2      PostgreSQL C client library
ii  libsasl2-2             2.1.22.dfsg1-8    Authentication abstraction library
ii  libsqlite3-0           3.3.8-1.1         SQLite 3 shared library

exim4-daemon-heavy recommends no packages.

-- debconf information:
  exim4-daemon-heavy/drec:





More information about the Pkg-exim4-maintainers mailing list