Linux

I design based on risk, and I have been in infosec all my very long career.

This is nothing wrong with having a .forward file in the situation posted by the original poster, IMHO.

There is no risks identified, there are no vulnerabilities identified, there are no threats identified.

I have been in infosec all my very long UNIX and Linux career, and have a CISSP, yadda, yadda, yadda... Security is based on risk, not speculation.

One of my biggest "pet peeves" are people who make blanket "this is not good" statements in the absence of any risk analysis. This is the biggest mistake many technical people make in IT security.

If you are going to make "sweeping statements" about "this is good" and "this is not good" here, you need to be prepared to completely back it up, technically, since I run the forums, LOL... You are not going to "beat me into submission, I assure you"

There is no technical argument (that you have made) where in a low risk situation on a shared server with an unprivileged user that a .forward file is such a high risk.

If you are willing to stop "hand waving" and provide technical facts on what the vulnerability, threat and risk of this original posters application, I'm all ears

Otherwise, move on. Thanks.

---------- Post updated at 17:27 ---------- Previous update was at 17:24 ----------

Note:

I did a Google search on these terms:

...and after looking at around 8 pages, found nothing interesting.

Might be dated (14 years seems long but my local OS seems to be 1997 era) or inapplicable, but you know how managers can be:

CERT Advisory CA-1996-20 Sendmail Vulnerabilities

It's dated..... nearly 15 years old.

To me, it seems you are playing the role of "bureaucratic manager" because you are really grasping at straws to pull up a 15 year old vulnerability in sendmail to try to make a point.

Please don't pull up 15 year old vulnerabilities to make points based on sendmail releases that have not been installed for over a decade.

Thanks.

Should I close this thread before it further degenerates into a pointless debate with on purpose only to debate a point that has irrelevant to the original posters question?

Frankly, I am inclined to do so.... because these are not the "debate moot and irrelevant points endlessly forums", LOL.

---------- Post updated at 19:50 ---------- Previous update was at 19:45 ----------

Heck, based on your logic, we need to shut down the Internet, LOL. Think of all the Apache, PHP, MySQL, Linux bugs in the last 15 years.

Better not run Linux! No MySQL !! No PHP either, there was a bug a few months ago! No NT, don't run Windows either. Better not run Solaris, AIX.... !! Better turn them all off !! All of these systems have had vulnerabilities, and most a lot sooner than 15 years ago!


I'm closing this thread.