Bug 1158493 - smartmontools update pulls ssmtp and make cron jobs output open to the public network
Summary: smartmontools update pulls ssmtp and make cron jobs output open to the public...
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: smartmontools
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Michal Hlavinka
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-10-29 13:51 UTC by Robert Marcano
Modified: 2015-01-14 09:29 UTC (History)
2 users (show)

Fixed In Version: smartmontools-6.3-3.fc22
Clone Of:
Environment:
Last Closed: 2015-01-14 09:29:58 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Robert Marcano 2014-10-29 13:51:15 UTC
an old update pulled ssmtp as a dependency

Apr 20 19:06:14 Installed: ssmtp-2.64-11.fc20.x86_64
Apr 20 19:06:15 Updated: 1:smartmontools-6.2-5.fc20.x86_64

ssmtp default configuration is to send all mail to a host named mail, if there is a host with that name in your domain, all your cron output is send to a probably random server, it could be your ISP mail server for example.

Fedora 20 documentation promote the feature of a no MTA installed by default, so all cron job output was logged locally and not sent to the local delivery agent. This updated opened all workstations without a MTA to leak cron output to random servers.

I personally think the using ssmtp is not a problem by itself, that the ssmtp should not be configured with a random server, that it should require user intervention to define which server to use, but the ssmtp bug 1157727 related to this problem doesn't consider it a security problem to have bad defaults. So the other option is to revert the change on smartmontools that require a mailer.

There is another sender only package providing /usr/sbin/sendmail, estmp, but this one is not maintained anymore (at its web site).

I send an email to the devel list if more discussion is needed https://lists.fedoraproject.org/pipermail/devel/2014-October/203781.html not responses yet

redhat-lsb pulls ssmtp too, so there should be some kind of discussion of what to do before I post another bug for redhat-lsb, be use another mailer, remove the dependencies, or change ssmtp defaults.

The security flag was removed for the ssmtp bug, so I am not flagging it like that, I still think this is a security problem.

Comment 1 Robert Marcano 2014-10-29 13:59:27 UTC
I forgot to say that this was discovered by chance, as explained on the devel list email. My laptop has months sending emails to random servers of my cron jobs. I received the email because one of those jobs ran when I was near a server named mail that I manage, so the root email was forwarded to me.


Note You need to log in before you can comment on or make changes to this bug.