Onderwerp: sqwebmail web login

platform:
linux 2.4 i386
pachages: qmail+sqwebmail+qmailadmin+vpopmail-vchkpw-auth.

When user root try loggin in on the web on http://domain/cgi-bin/sqwebmail,
if does it with right root password, sqwebmail gives an error "maildir
doesn't exist or has incorrect ownership or permission". This, ONLY if you
give right root password, if not, you have error "invalid user or password"
(as any other wrong password, for any user).
I think this should be a good method for guessing root password, in fact
failure logging in on the sqewebmail are not logged (generally!).


Regards,
Marco Marabelli

This is actually very similar to another problem that some on BugTraq may
be interested in. There is at least one major "Unix-based" OS (AIX) that
in it's default configuration will provide a unique reply for a correctly
guessed password when direct remote login is disabled for the userid in
question. For example, the message reply for an incorrectly guessed
password might be "Incorrect userid or password" whereas a correct guess
would yield a message such as "Remote logins for this account are not
allowed".

It's an issue that I have submitted to BugTraq in the past and had rejected
as being a known issue / not a bug / configuration issue. In my mind it is
simply incorrect and unnecessary to advertise the fact that you have found
the valid password for a given account, this type of information is only
useful to an attacker. Presumably if you legitimately have access to a
given account you will be aware that remote logins are not permitted for
that account. I realize that even if a password is guessed for an account
with remote logins disabled that you have to gain access to the host with
some other method or id for this information to be of any use, but it's
still a shortcoming with no good reason to exist and could allow privilege
escalation in some circumstances. Spare me replies that point out that
with a password of sufficient complexity and login delay mechanisms it
would take inordinately long to brute-force a password in this method, I
know. For those interested that would like related reading material, the
paper "Brute Force Attack on UNIX Passwords with SIMD Computer" by Kedem
and Ishihara from Usenix Security 8 is excellent, Google for it.

I suspect that this issue may exist with many Unix-based operating systems,
Dave Ahmad suggested that this same behaviour exists on Solaris.
Personally I can only confirm this result on AIX 4.3.3 - AIX 5.1. I went
so far as to open a problem ticket with IBM for AIX, if anyone else would
like further details contact me off-list.

SJ.

> platform:
> linux 2.4 i386
> pachages: qmail+sqwebmail+qmailadmin+vpopmail-vchkpw-auth.

NOT with FreeBSD 4.5, kernel GENERIC, sqwebmail 3.3.3, vpopmail 5.2

However, I think it's due to a misconfiguration. Root mailbox does NOT
exist in default qmail installation: it's just an alias, not a real
valid user.

Mail for root is usually handled by the "alias" pseudo-user.

And with vpopmail you must create such user by hand (or via qmailadmin).

> I think this should be a good method for guessing root password, in fact
> failure logging in on the sqewebmail are not logged (generally!).

Failures are logged by vpopmail. Check your configuration.

> Regards,
> Marco Marabelli

ciao

--Signature=_Mon__2_Feb_2004_20_53_24_-0800_4pJK.Kto=pDs4f00
Content-Type: text/plain; charset=US-ASCII
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

On Sat, 31 Jan 2004 10:54:12 +0100
"Marco Marabelli" <mm@smrt.it> wrote:

> When user root try loggin in on the web on http://domain/cgi-bin/sqwebmail,
> if does it with right root password, sqwebmail gives an error "maildir
> doesn't exist or has incorrect ownership or permission". This, ONLY if you
> give right root password, if not, you have error "invalid user or password"
> (as any other wrong password, for any user).
> I think this should be a good method for guessing root password, in fact
> failure logging in on the sqewebmail are not logged (generally!).

sorry if this is inappropriate, but if any admin has their mail server setup to allow passwd authenticated root access is just asking for trouble. my belief is that this account should not be real. if you need root@yourserver.com then just setup an alias
to forward the mail to another account.

--Signature=_Mon__2_Feb_2004_20_53_24_-0800_4pJK.Kto=pDs4f00
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQFAHylEXFoaje2SLvERAkpbAJ4zVCpDWr+eHPU57T7IU2 RLNOJIcwCeKY2v
7532lfBKyd+eyC4O1TBskyw=
=Zu7Q
-----END PGP SIGNATURE-----

--Signature=_Mon__2_Feb_2004_20_53_24_-0800_4pJK.Kto=pDs4f00--

On Tue, 3 Feb 2004, Antonio Messina wrote:

> > platform:
> > linux 2.4 i386
> > pachages: qmail+sqwebmail+qmailadmin+vpopmail-vchkpw-auth.
>
> NOT with FreeBSD 4.5, kernel GENERIC, sqwebmail 3.3.3, vpopmail 5.2
>
> However, I think it's due to a misconfiguration. Root mailbox does NOT
> exist in default qmail installation: it's just an alias, not a real
> valid user.

Sqwebmail reads the filesystem directly, so will be doing this
itself. It doesn't depend on the qmail setup. Sqwebmail is part of the
Courier suite. While I am using all the other software in the courier
suite, I'm using SquirrelMail instead of sqwebmail. Sqwebmail accesses
the filesystem directly for performance reasons. But I prefer to keep my
web server and mail servers separate.

http://www.inter7.com/sqwebmail.html

So, I place the blame squarely on sqwebmail. However, I know the
Courier folks are quite responsive to security issues, so I've included
MrSam on this message.



--
Tim Nelson
Systems Administrator
Sunet Internet
Tel: +61 3 5241 1155
Fax: +61 3 5241 6187
Web: http://www.sunet.com.au/
Email: sysadmin@sunet.com.au