[sqwebmail 5.0.1]
There is an installation bug which causes sqwebpasswd to be installed setgid
wheel instead of setgid mail. This is likely to cause password changing to
fail in many installations.
...
chown: @mailuser@: Invalid argument
gmake[6]: [install-exec-hook] Error 1 (ignored)
chgrp: @mailgroup@: Invalid argument
gmake[6]: [install-exec-hook] Error 1 (ignored)
...
At very least:
AC_SUBST(mailuser)
AC_SUBST(mailgroup)
are missing, although I can't see how those values are set (presumably from
the output of courierauthconfig somehow). In any case I don't have the right
versions of autoconf and friends installed to test this out.
It does seem to me that sqwebpasswd is something of a system security hole,
as it's unprotected and can bump you up into the wheel group (currently), or
the mail group (when this bug is fixed). If all sqwebmail users are allowed
to change their passwords then it would be equally secure (or more so) just
to set courier-authlib's authdaemonvar directory to mode 755.
Regards,
Brian.
3 messages in net.sourceforge.lists.courier-sqwebmail[sqwebmail] sqwebpasswd installation bug
