Subject: Re: Editing my recipe

From: Brock Rozen <[email-masked]>
Date: Sat, 29 Apr 1995 13:31:36 -0700 (PDT)

On Sat, 29 Apr 1995, Adam Shostack wrote:

> Check out the procmailex man page; there are security implications to
> letting people chose arbitrary files in a directory (If you're not
> careful, they can get anything you have)

Adam,

With the following recipe, how could people get whatever they wanted?

:0 h
  * !^FROM_DAEMON
  * ^Subject: *(send|get)? Help
  | (formail -I 'From ' -r -A"Precedence: junk" -I"Subject: Information and Help on Brock Rozen's Auto-Reply System";\
    cat $PMDIR/AutoRep.txt) | $SENDMAIL -oi -t

I specify what file(s) they get according to their subject. The file I 
send them does not matter EXACTLY what they enter on the subject line 
(like I don't use FILE1.TXT as a capture on SUBJECT line and then use 
that for what I sent them). I use HELP on subject line and send them 
AutoRep.txt

Let me know, thanks.

  ------------------------------------------------------------------------
  |  Brock Rozen  | InterNet: [email-masked]             |
  |               | CompuServe: 71614,240                                |
  |               | ImagiNation: 1304 & 148501                           |
  |----------------------------------------------------------------------|
  | For automated information on various subjects, send an e-mail to my  |
  |        InterNet address with SEND HELP on the Subject line.          |
  ------------------------------------------------------------------------

---

From: Brock Rozen <[email-masked]>
Date: Sat, 29 Apr 1995 14:35:36 -0700 (PDT)

On Sat, 29 Apr 1995, David W. Tamkin wrote:

> Brock Rozen asked,
> 
> | VERBOSE=ON
> | 
> | :0 h
> |   * !^FROM_DAEMON
> |   * ^Subject: *(send|get)? Test
> |   | (formail -I 'From ' -r -A"Precedence: junk" -I"Subject: Information and Help on Brock Rozen's Auto-Reply System";\
> |     cat $PMDIR/UNavailable.txt) | $SENDMAIL -oi -t
> 
> | Anyhow, how could I add logging to this recipe?
> 
> That depends on what you want to log and where you want to log it.  Please
> give us more details.

Ok, let's say I want to log it in $PMDIR/log.test

I'd like to log WHO (e-mail address) requested the information, DATE, 
TIME and what exactly they requested (this last one could be either what 
SUBJECT they sent me, or what I sent them in response; either one is fine)

> | Also, how could I change 
> | MY from address that it uses from my default to something else? Thanks.
> 
> If you mean your From: address, add -I "From: otheraddress" to the formail
> options, but it would be HIGHLY rude to put an address there to which people
> cannot write back, unless you also add a Reply-To: header with a working
> address.

I haven't added a Reply-To: header in my address, but I wouldn't be 
interested in changing my address, just changing the name. Basically, 
instead of Brock Rozen <[email-masked]>  I'd want it to 
be Brock Rozen's Auto-Reply System <[email-masked]>. 

What would I add on to my recipe to do that? Thanks.

> If you mean your From_ address, you'll have to do that with sendmail's -f
> option at the end of the pipe.  Since mail error messages will go to that
> address, again it is not a place to get creative.

---

From: [email-masked] (David W. Tamkin)
Date: Sat, 29 Apr 1995 16:24:38 -0500 (CDT)

Brock Rozen asked Adam Shostack,

| With the following recipe, how could people get whatever they wanted?
| 
| :0 h
|   * !^FROM_DAEMON
|   * ^Subject: *(send|get)? Help
|   | (formail -I 'From ' -r -A"Precedence: junk" -I"Subject: Information and Help on Brock Rozen's Auto-Reply System";\
|     cat $PMDIR/AutoRep.txt) | $SENDMAIL -oi -t

They cannot, of course.  Those security considerations come into play only
when writers can specify the path to the file they want.

---

From: [email-masked] (David W. Tamkin)
Date: Sat, 29 Apr 1995 16:38:46 -0500 (CDT)

Brock Rozen asked,

| VERBOSE=ON
| 
| :0 h
|   * !^FROM_DAEMON

---

From: Brock Rozen <[email-masked]>
Date: Sat, 29 Apr 1995 14:20:26 -0700 (PDT)

Which brings me to another question. BTW, I'm sorry to everyone for 
asking what may seem as simple questions, but the system I use doesn't 
seem to like the recipe files that I've seen. I don't know why, but they 
don't work. I finally found a VERY basic recipe that worked, and now I'm 
trying to build it up.

Anyhow, how could I add logging to this recipe? Also, how could I change 
MY from address that it uses from my default to something else? Thanks.

VERBOSE=ON

:0 h
  * !^FROM_DAEMON
  * ^Subject: *(send|get)? Test
  | (formail -I 'From ' -r -A"Precedence: junk" -I"Subject: Information and Help on Brock Rozen's Auto-Reply System";\
    cat $PMDIR/UNavailable.txt) | $SENDMAIL -oi -t

---

From: [email-masked] (David W. Tamkin)
Date: Sat, 29 Apr 1995 17:01:42 -0500 (CDT)

Brock Rozen wrote,

| Ok, let's say I want to log it in $PMDIR/log.test
| I'd like to log WHO (e-mail address) requested the information, DATE, 
| TIME and what exactly they requested (this last one could be either what 
| SUBJECT they sent me, or what I sent them in response; either one is fine)

      :0 hc # note `c' flag
      * !^FROM_DAEMON

      :0A:
      | ( formail -XFrom: -XDate: -XSubject: ; echo ) >> $PMDIR/log.test

Now, you say "DATE" and "TIME"; if you mean the date and time of sending,
the Date: header will have that.  If you want the date and time of receipt,
the From_ header is what you want.  You can change -XFrom: to -XFrom in
the second recipe to get both From_ and From:.

| ...  I wouldn't be 
| interested in changing my address, just changing the name. Basically, 
| instead of Brock Rozen <[email-masked]>  I'd want it to 
| be Brock Rozen's Auto-Reply System <[email-masked]>. 
| What would I add on to my recipe to do that? Thanks.

Just the extra -IFrom: option to formail then as I said before:

   | (formail -I 'From ' -r -A"Precedence: junk" \
      -I"Subject: Information and Help on Brock Rozen's Auto-Reply System" \
      -I"From: Brock Rozen's Auto-Reply System <[email-masked]>" ; \
      cat $PMDIR/UNavailable.txt) | $SENDMAIL -oi -t

David W. Tamkin  Box 3284  Skokie, Illinois  60076-6284
[email-masked]    MCI Mail: 426-1818   +1 312 714 5610

---

From: Adam Shostack <[email-masked]>
Date: Sat, 29 Apr 95 17:21:42 EDT

| > Check out the procmailex man page; there are security implications to
| > letting people chose arbitrary files in a directory (If you're not
| > careful, they can get anything you have)
| 
| Adam,
| 
| With the following recipe, how could people get whatever they wanted?
| 

They can't.  The problems only crop up when their message gets parsed
for a file list, and they do something like sneak in a semicolon or
request ../../../../../etc/passwd

Adam

-- 
* Support The Phil Zimmermann legal defense fund *
          http://www.netresponse.com/zldf

"It is seldom that liberty of any kind is lost all at once."
						       -Hume

---

From: Adam Shostack <[email-masked]>
Date: Sat, 29 Apr 95 17:37:58 EDT

| Anyhow, how could I add logging to this recipe? Also, how could I change 
| MY from address that it uses from my default to something else? Thanks.

Add a c to the flags, then a rule that saves:

:0 hc
[...]

:0:
logfile

----
Adam

---

From: Frank Wang <[email-masked]>
Date: Mon, 1 May 1995 14:50:41 +0800

Hi All,

  Does anybody have a recipe for auto responding to send binary file 
request? could you please e-mail me the recipe? thanks.

Frank

---

From: Alan Stebbens <[email-masked]>
Date: Mon, 01 May 1995 10:25:14 -0700

>     cat $PMDIR/UNavailable.txt) | $SENDMAIL -oi -t

Try this one:

# ~/.commandrc
#
# procmailrc file to check for commands in the subject line
#
# Current commands are:
#
#	(send | get) (help | info)
#	(send | get) pgp key
#	(send | get) procmail lib(rary)
#	(send | get) procmailrc
#
###############################
# Check for any of the commands
###############################
:0 h
* ^Subject: *(send|get) *(help|info(rmation)?|procmail(rc| *lib(rary)?)|pgp *key)
{
    # We're forking at this point -- so shutup procmail
    COMSAT=off

    # Get the reply address and subject (sans quotes)
    FROM=`$FORMAIL -rt -xTo:`
    SUBJ=`$FORMAIL -zx'Subject:' | sed -e 's/[Rr]e: *//g' -e 's/["~]/_/g'`

    # Just in case these aren't defined
    FROMSIG="${FROMSIG:-\"The Mailer-Daemon of $USER\" <$USER>}"
    MY_ADDR="${MY_ADDR:-<$USER>}"

    # Lock up the recipe
    LOCKEXT=.lock
    LOCKFILE=$HOME/.commandrc$LOCKEXT

    #########################
    # Generate a reply header
    #########################
    JUNK=`($FORMAIL -rI"From:       $FROMSIG" \
		    -I"Reply-To:   $MY_ADDR" \
		    -I"Subject:    Re: $SUBJ" \
		    -I"Precedence: junk" \
		    -I"X-Loop:     $MY_ADDR" ; \
	    echo "This message was sent auotmatically in reponse to your recent mail" ; \
	    echo "with the subject: \"$SUBJ\"." ; \
	    echo "" ) \
	> $HOME/.commandrc.reply`

    ##########################
    # Now process each command
    ##########################

    # send help

    :0 ch
    * ^Subject:.*(help|info(rmation)?)
    | ( cat $HOME/.commandrc.reply $HOME/.commandrc.help ) \
      | $SENDMAIL -oi -t

    # send procmailrc

    :0 Ech
    * ^Subject:.*procmailrc
    | ( cd $HOME ; \
	cat $HOME/.commandrc.reply ; \
	shar -cCem .procmailrc .commandrc .commandrc.help ) \
      | $SENDMAIL -oi -t

    # Send procmail lib

    :0 Ech
    * ^Subject:.*procmail *lib(rary)?
    * ? test -f $HOME/src/mail/procmail/lib/procmail-lib.shar
    | ( cat $HOME/.commandrc.reply \
	$HOME/src/mail/procmail/lib/procmail-lib.shar ) \
      | $SENDMAIL -oi -t

    # send pgp key

    :0 Ech
    * ^Subject:.*pgp *key
    | ($FORMAIL -rI"From: $FROMSIG" \
		-I"Reply-To: $MY_ADDR" \
		-I"Subject: PGP public key" \
		-I"Mime-Version: 1.0" \
		-I"Content-Type: application/pgp; format=keys-only" \
		-I"Content-Description: PGP key of $MY_ADDR" \
		-I"Content-Transfer-Encoding: 7bit" \
		-I"X-Loop: $MY_ADDR" ;\
		sh -c "pgp -kxaf $MY_ADDR 2>/dev/null") \
      | $SENDMAIL -oi -t
    
    # Don't log anything else
    LOGABSTRACT=off

    :0 Achw: pgpkey-requests$LOCKEXT
    | echo "`date` : $FROM : $SUBJ" >> $MAILDIR/pgpkey-requests.log

    # Log this request
    :0 cw
    | echo "`date` : $FROM : $SUBJ" >> $MAILDIR/commandrc.log

    # Junk the reply, and fool procmail into thinking the mail was delivered
    :0 h
    |rm -f $HOME/.commandrc.reply

    DELIVERED=yes
    LOCKFILE
}

# End of ~/.commandrc