Package: nullmailer
Version: 1:1.13-1.2

To reproduce, install nullmailer, add a remote servers using smtp with
user/password via debian configuration.
The stmp server user and password will be stored in
/etc/nullmailer/remotes with mode 600, user mail:mail.
When e-mails are send the smtp helper is called with the credentials in
the command line. Any local user can now see the password using ps, etc:

heinz@.....:~$ ps ax | grep smtp
11252 ?        S      0:00 /usr/lib/nullmailer/smtp -d -s --ssl
--user=...@abstracture.de --pass=XXXX smtp.mail.com
11254 pts/0    S+     0:00 grep smtp

I have replaced the actual password with XXXX in this example.

Expected behaviour is not to show the smtp password in the command line
to any user.

Regards,

Martin Wache

Martin Wache <wache@abstracture.de> writes:

Hi Martin

I believe this bug is fixed in the 2.x series of nullmailer, which
changed the way that arguments are passed to the helper. If you would
like to test, 2.1 is available from stretch backports. There could be
configuration incompatibilities between 1.x and 2.x, so I would
recommend testing on a non-mission-critical machine.

d

Martin Wache <wache@abstracture.de> writes:

Hi Martin

I believe this bug is fixed in the 2.x series of nullmailer, which
changed the way that arguments are passed to the helper. If you would
like to test, 2.1 is available from stretch backports. There could be
configuration incompatibilities between 1.x and 2.x, so I would
recommend testing on a non-mission-critical machine.

d

Hi David,

Thank you for your fast answer.

I've installed nullmailer_2.1-7~bpo9+1_amd64.deb from backports, run
dpkg-reconfigure and checked again.
You are right, this seems to be fixed.

Are there any plans to backport the fix into debian stable?
To me it was very surprising to see the e-mail password in the output of
ps. I checked the documentation, but I didn't find any hints or warnings
about this. Did I miss anything?

Regards,

Martin

Martin Wache <wache@abstracture.de> writes:

At the moment I don't see a good way to backport the fix. It would
require some quite intrusive changes to upstream code, and break any
existing custom helpers.

I'm not aware of anything like that, but I wasn't involved with
maintaining the 1.x series, so I might have missed something.

d

Hi David,

Ok, thank you for your answers.

I guess I will migrate to the 2.1 version where possible.

Regards,

Martin