Re: Email accounts on FreeBSD 5.1-RELEASE

"Alex Ayala" writes:
> Ok, maybe...yes I read what I wrote and didn't quite explain what I really
> wanted to say.
> 
> I want to setup accounts on my box so users can retrieve emails by accessing
> my pop server. Do I need to setup user accounts on my box with the "adduser"
> command? I don't want them to be able to have access to the shell by any
> means.  Is like when I wanted to give someone access to my ftp server I just
> created an account and took out the shell part in the passwd file.  Sorry my
> english is not the greatest.  Trying to explain something and can't find the
> right words.
> 
> Is that a bit better to understand?

Sort of. But you need to understand how to specify and set up a secure
system.

What is your threat model? What resources are your (ab)users most likely
to throw at you, and what are the consequences if they succeed? How much
can you afford to spend to prevent this compared with what you guess they
are prepared to spend to attack you?

Only you can answer these questions. Once you know the comprehensive answer
to these questions, you know what to ask of the software and hardware you
investigate to perform the task.

While you are asking the questions, _experiment_ with what you have, and
look for real-life holes in your setup. Try to think like the attacker you
are trying to thwart. Attack yourself. Get paranoid.

M
--
Mark Murray
iumop ap!sdn w,I idlaH