[Mailman-Users] Creating New List via Web Interface

[Todd Pfaff]

On Fri, 17 Sep 1999, Darren Boyd wrote:

> It also presents an entire new set of security concerns.  With sendmail,
> updating the aliases file is not enough, you also *as root* have to run
> 'newaliases'.  Mailman's great as it doesn't run as root (or doesn't have
> to, anyway).  That is a great option.

not true!

newaliases does not have to be run as root.  typically, newaliases is a
link to sendmail and sendmail is suid-root.  however, sendmail
(newaliases) does check the ownership and permissions of the source 
aliases file and the aliases.dir and aliases.pag files.  i have found the
following combination to work and then the mailman user can update the
sendmail aliases with newaliases.  this is sendmail-8.9.3 i think.

root(104)ls -lgd ~mailman/. ~mailman/aliases*
drwxr-sr-x  18 mailman  mailman       512 Sep 11 11:10 /usr/local/mailman/./
-rw-r--r--   1 mailman  mailman     10835 Sep 18 22:55 /usr/local/mailman/aliases
-rw-r--r--   1 root     mailman      4096 Sep 18 22:55 /usr/local/mailman/aliases.dir
-rw-r--r--   1 root     mailman     16384 Sep 18 22:55 /usr/local/mailman/aliases.pag

--
Todd Pfaff                         \  Email: pfaff at mcmaster.ca
Computing and Information Services  \ Voice: (905) 525-9140 x22920
ABB 132                              \  FAX: (905) 528-3773
McMaster University                   \
Hamilton, Ontario, Canada  L8S 4M1     \