Running fetchmail as root

dinakumar12 · 04-27-2011, 03:43 PM

Hi all,

I run fetchmail to download all my emails from remote mail server to my linux server.

But every time when i run fetchmail -v i am getting a warning that

" Running as root is discouraged"

I just want to know whether it is unsecure to run fetchmail as root user.

Can anyone explain me the effects of running fetchmail as root.

Thanks in advance,
Dinesh.

TB0ne · 04-27-2011, 04:10 PM

Quote:

Originally Posted by dinakumar12

Hi all,
I run fetchmail to download all my emails from remote mail server to my linux server. But every time when i run fetchmail -v i am getting a warning that

" Running as root is discouraged"

I just want to know whether it is unsecure to run fetchmail as root user.

Obviously, or you wouldn't get that message.

Quote:

Can anyone explain me the effects of running fetchmail as root.

Thanks in advance,
Dinesh.

Yes...the man page for Fetchmail can shed some light, as can Google. From the man page:

Code:

...could open a security hole, because they pass text manipulable by an attacker to a shell command. Potential shell characters are 
replaced by '_' before execution. The hole is further reduced by the fact that fetchmail temporarily discards any suid privileges it 
may have while running the MDA. For maximum safety, however, don't use an mda command containing %F or %T when fetchmail is run from 
the root account itself.

dinakumar12 · 04-28-2011, 07:54 AM

Hi TB0ne,

Thanks for your reply. I will now change my fetchmail process to own by user other than root.

But still i cant understand the risks involved in running fetchmail as root clearly. But i will google for that.

Thank you again.

TB0ne · 04-28-2011, 09:23 AM

Quote:

Originally Posted by dinakumar12

Hi TB0ne,
Thanks for your reply. I will now change my fetchmail process to own by user other than root.

But still i cant understand the risks involved in running fetchmail as root clearly. But i will google for that.
Thank you again.

You can't?? Even after reading the piece from the man page I posted?

Think about it...fetchmail processes an email with a script attached. Again, reading the man page will explain things further, but if you're running as root, that script can do ANYTHING. Not running as root? It can't.

Noway2 · 04-28-2011, 11:59 AM

dinakumar12, You need to think of this in terms of "what if this were to happen". See this CVE regarding Fetchmail. It is an example where a bug allowed a user to execute arbitrary code with the privilege of the user that Fetchmail is executing as. If you are running as root, the attacker would have root access to your machine and the data on the machine would now be forfeit.