This is correct. The default configuration allows for a site-specified
selection of the userid who will own everything. Creating a new "courier"
userid is a valid option, but so is recycling some suitable stock system
userid, such as "daemon". Ditto for the groupid. Notwithstanding the
selected userid/groupid, the authdaemon socket has mode 777, while the
ownership of the socket directory is set to the selected owner
userid/groupid, and mode 750.
If prior to building the rpm you create a "courier" userid and groupid,
that userid/groupid will take ownership of the authdaemon directory, and
the other files, otherwise it's going to be "daemon".
Hmm. The current Debian package creates a socket directory with
permissions 755. Is there any disadvantage to doing so? As far as I can
tell it is not a security issue, since the old password is required to
set the new password, unless repeated failed attempts to do so aren't
throttled. I guess it might be a privacy issue because you could view
userinfo for other users?
Charles
6 messages in net.sourceforge.lists.courier-usersRe: [courier-users] Courier auth appl...
