Subject: Re: Writing or adding files via email

From: [email-masked] (David W. Tamkin)
Date: Wed, 19 Oct 1994 21:27:42 -0500 (CDT)

Mark Anderson asked,

| I have a remote account I need to access but it costs me $$ to do so.  As 
| a result, I'd like to send email messages that would allow me to add or 
| update existing files in that account without telnetting or ftp. (Which 
| can be really slow at times too!)  So, basically what I wish to do is 
| send in the body of the message the file which gets written to the 
| location defined either in the Subject: line or elsewhere.  Since I use a 
| signature, I'd also like it to strip that off and not include it in the 
| file to be written.  ie.  everything after the "--" and the end of message.

You have a couple choices regarding the signature: you could leave it off,
or you could have the receiving machine strip it:

 :0bf
 * conditions
 | sed 's/^-- $/,$ d'

assuming that the traditional signature separator (two hyphens and a trailing
space) doesn't occur in the text.

Another possibility [which, perhaps, is even riskier] is this:

 :0b
 * conditions
 | sh # or some other shell

That would treat the entire body as a shell script.  You could finish it
with "exit" and then the signature separator and the signature itself, since
they follow the exit command, wouldn't be a problem.  To send text to be
saved in a file, you could have the body read like this (flush left except
where the text has indentations to save):

	cat > filename << \EOF_marker
	text here
	text here
	EOF_marker
	exit
	-- 
	your sig

Maybe some of the risk can be lessened if there is a restricted shell to
which procmail can feed the body.

| Finally, this feature is to be set so that only I can send files to be 
| written or added to the account.

That's your big problem; someone else might fake mail from you and do
anything he or she pleases under your permissions.

One thing that might help is testing for an additional header that only
you would know and continually changing that required additional header.
It's security through obscurity but it's better than nothing.