Re: How to use procmail

Adam Shostack writes:

> Rule introductions  of the form :# are depreciated.  You should always
> use :0, which means any line starting with * is a rule.
> [...]
> And :0: means use a lockfile on the folder.
> [...]
> :0
> *^Subject:.*unsub
> /dev/null

> :0:
> *^TOcypherpunks
> cypherpunks

Thanks, Adam.  I created my .procmailrc a long time ago, using the
old 2.?? version, and now just cut and paste as required.

New procmail users, listen to Adam!  (And read the man page, even
though it's a bit intimidating at first.)

MJ

Martin Janzen wrote:

| New procmail users, listen to Adam!  (And read the man page, even
| though it's a bit intimidating at first.)

Yeah, Listen to me! Listen to me! (Its the new cypherpunks theme
song!)

More seriously, here's my .procmailrc.  I'm fond of it, but the cpunks
section could use some more work.  Other parts may be useful basis
for other people's hacking.

Adam

# $Id: .procmailrc,v 1.10 1996/08/05 04:54:46 adam Exp $
PATH=/bin:/usr/bin:/usr/local/bin:/usr/local/lib/mh
MAILDIR=$HOME/Mail/=      	#you'd better make sure it exists
DEFAULT=/var/spool/mail/adam
LOGFILE=$MAILDIR/.procmail.log
REALLF=$LOGFILE			# So I only have one path to LF
COMSAT=no			# don't tell comsat; its obstelete.
# VERBOSE=on		# bad bad bad!


#This first ruleset protets me from mailbombs from an automated service
#that I often send incorrect commands to, generating 5mb of reply.
# It also sorts based on sucsess of the command.

:0c :
.safe

:0
* From bal@swissnet.ai.mit.edu
{
   :0 h
   * >10000
   /dev/null

   :0 h
   *^Subject:.*no keys match
   /dev/null

   :0:
   *Subject: Your command, ADD
   $DEFAULT


   :0E
   | pgp +batchmode -fka
}


# This is a backup. Don't forget to cycle safe boxes.


# this is here because I don't want to hear about everything going in .safe.
# prevent duplicate messages from showing up in several folders.

LOGABSTRACT=all
# doesn't work
:0 Wh: msgid.lock
| formail -D 65536 .msgid.cache

# auto key retreival
#
# I have an elm alias, pgp, points to a keyserver
# The logfile gets unset briefly to keep the elm lines out of my
# logfile.

:0BW
* -----BEGIN PGP
*!^FROM_DAEMON
KEYID=|/home/adam/bin/sender_unknown

LOGFILE=

:0 ahc	# added h 8 jan 95
* ! ^X-Loop: Adams autokey retreival.
| formail -a"X-Loop: Adams akr" |elm -s"mget $KEYID" pgp



LOGFILE=$REALLF

:0
* (^TOCypherpunks|Sender:.*cypherpunks|^From owner-cypherpunks@toad.com)
{
   :0:
   * From.*owner-cp-lite@comsec.com
   cp-lite

   :0 h
   * Subject:.*(Delete|u*n*Sub*| add |leave|help|Undeliverable Message)
   * < 1000
   /dev/null
   
   :0 :rml.lock
   * ^From: Raph Levien
   * ^Subject: List of reliable remailers
   | cat /dev/null - > ~/sec/remailer-list

   :0:
   * 1^1 ^(From|To|Cc):.*david@sternlight.com
   * 1^1 ^Subject:.*CDA
   * 1^1 ^Subject:.*Assasination
   * 1^1 ^Subject:.*Reasons in support of crypto-anarchy
   * 1^1 ^Subject:.*Noise
   * 1^1 ^Subject:.*FV
   * 1^1 ^Subject:.*(PLEASE REPLY|test)
   cjunk


   :0B:
   * ^Alice de 'nonymous
   * an455120@anon.penet.fi
   * ^P.S.  This post is in the public domain.
   | formail -a "Status: O" >> cjunk



# I really ought to make this a wieghted rule.
   :0:
   * ^From:.*(aba@atlas|adam@lighthouse|blancw|cdodhner|cfrye|chen|cman|cme|colin@|daw@cs|ddt|ebrandt|eric@remail|futplex|frissell|gnu|gtoal|habs|hallam|hfinney|hugh|jis|karn|loewenste|loki|mab|froomki|mpj|nate|nsb|perry|pfarrel|rah|rjc|rsalz|sameer|sandfort|schneier|ses|smb|stewarts|szabo|tcmay|trei|unicorn|usura@berserk|warlord|weidai|whitaker|Zimmerman)
   * !^From.*(anonymous|perry@jpunix.com|jonathan@Memexis|perry@psii.persci.com|gertstein|Schartman|don@cs.byu.edu|senate.gov|doug@eng)
   cpunks

   :0:
   cpunks-noise
}
:0:
* ^TOfirewalls
firewalls


:0:
*^From owner-fwtk-users@tis.com
fwtk

:0
*^TOcyberia-l
{
#   VERBOSE=on

   :0 HW
   FROM=|formail -x "From: "

   :0 f
   | formail -I"Reply-To: $FROM"

   :0 fw:cyberia.sed.lock
   * ^From: Timothy Arnold-Moore <tja@kbs.citri.edu.au>
   |sed 's/^ //g'

   :0:
   cyberia
}

:0:
* ^From procmail-request@informatik.rwth-aachen.de
procmail


# Thats it for the high volume lists.  Low volume lists I don't push
# through formail.

:0:
* ^TOyucks@cs.purdue.edu
* ^Subject: Yucks Digest
| formail +1 -ds cat >> yucks

:0:
* ^TObugtraq
bugtraq

:0
* ^TO .*(ietf|rfc-dist)
{
   :0h
   *^Subject:.*ON-SITE
   /dev/null
 
   :0:
   ietf
}


:0
* ^TOwww-buyinfo
{
   :0
   * ^From: rah@shipwright
   * ^Subject: .*(cpx)
   /dev/null

   :0:
   | formail -a "Status: O" >> wwwb
}

:0:
*^TOspki
spki

:0
*^TOssl-talk
{
   :0
   *^Subject:.*remove
   * < 2000
   /dev/null

   :0:
   ssl
}

:0:
*^TOwww-security@ns2.rutgers.edu
wwws

:0:
*^From owner-ssh
ssh


:0:
*^TOremailer-operators@c2.org
remailers

:0:
*From best-of-security
bos


:0:
* ^TObblisa
bblisa

:0:
*^TOcoderpunks
coderpunks


:0:
*^TOmix-l
mix-l

:0:
* ^TOphrack
v/phrack

:0:
*^TOsdadmin
sdadmin

:0:
* Precedence: (junk|bulk)
junk

:0:
* To: postmaster
postmaster

# basic file server.  Only sends whats in .outbound
:0 
* ^Subject: (SEND|get) [0-9a-z][-_/0-9a-z.]+$
* !^Subject:.*[ /.]\.
* !^FROM_DAEMON
{
   # FILE=`formail -x Subject: | sed 's/.* //'`
   FILE=`sed -n -e '/Subject:/s/.* //p' -e '/^$/q'`

  :0c 
  | (formail -rt -A"Precedence: junk";\
     cat $HOME/.outbound/$FILE) | $SENDMAIL -t

  :0: 
  $MAILDIR/.log
}


# This handles vacation messages.  Make sure .vacation.msg and
# .vacationlist exist

:0 hc:vaction.lock 	#  untested
* ?  [ -r $MAILDIR/.vacationlist ]
* !? [ -r $MAILDIR/.vacation.msg ]
| rm -f $MAILDIR/.vacationlist


:0
* ? [ -s $MAILDIR/.vacation.msg ] 
* !^Precedence:(junk|bulk)
* !^FROM_DAEMON
{
 FROM=`formail -rx To:`
 ALREADYSENT=$MAILDIR/.vacationlist
   :0 hc:
   * !? fgrep -e "$FROM" $ALREADYSENT
   | echo "$FROM" >> $ALREADYSENT;\
 	(formail -rA"Precedence: junk";\
	cat $MAILDIR/.vacation.msg ;\
   ) | $SENDMAIL -t
}





-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume

Adam Shostack wrote:
> :0
> * From bal@swissnet.ai.mit.edu
> {
>    :0 h
>    * >10000
>    /dev/null
> 
>    :0 h
>    *^Subject:.*no keys match
>    /dev/null
> 
>    :0:
>    *Subject: Your command, ADD
>    $DEFAULT
> 
> 
>    :0E
>    | pgp +batchmode -fka

Isn't this vulnerable to "deadbeef" attacks? I can also see an attack when 
someone sends you an email with the spooofed "From " address and a user
name that is the same (or almost the same) as that of your trusted parties.

Suppose that you correspond with mrx@provider.com and you use encryption
command 

pgp -eaf mrx

Then I can send you a bogus email containing a key for mrx@bogus.com 
and next time you encrypt something for your friend nrx@provider.com,
you will actually encrypt it with the wron key. If I intercept your
email, your message to mrx can be compromised.

> # basic file server.  Only sends whats in .outbound
> :0 
> * ^Subject: (SEND|get) [0-9a-z][-_/0-9a-z.]+$
> * !^Subject:.*[ /.]\.
> * !^FROM_DAEMON
> {
>    # FILE=`formail -x Subject: | sed 's/.* //'`
>    FILE=`sed -n -e '/Subject:/s/.* //p' -e '/^$/q'`
> 
>   :0c 
>   | (formail -rt -A"Precedence: junk";\
>      cat $HOME/.outbound/$FILE) | $SENDMAIL -t

*If* .outbound has some subdirectories (say subdir), How about this email: 

From: dumbass@aol.com
Subject: GET subdir/../../../../etc/passwd
Reply-To: blin@algebra.com

xxx


	- Igor.

Igor Chudov @ home wrote:

| Adam Shostack wrote:
| > :0
| > * From bal@swissnet.ai.mit.edu
| > {
| >    :0E
| >    | pgp +batchmode -fka
| 
| Isn't this vulnerable to "deadbeef" attacks? I can also see an attack when 
| someone sends you an email with the spooofed "From " address and a user
| name that is the same (or almost the same) as that of your trusted parties.

| Then I can send you a bogus email containing a key for mrx@bogus.com 
| and next time you encrypt something for your friend nrx@provider.com,
| you will actually encrypt it with the wron key. If I intercept your
| email, your message to mrx can be compromised.

	Yes its vulnerable.  I might see it in the logs, but I've
personally verified most of the keys I care about, and they carry my
signature, at least on my local keyring.

| > # basic file server.  Only sends whats in .outbound
| > :0 
| > * ^Subject: (SEND|get) [0-9a-z][-_/0-9a-z.]+$
| > * !^Subject:.*[ /.]\.
| > * !^FROM_DAEMON
| > {
| >    # FILE=`formail -x Subject: | sed 's/.* //'`
| >    FILE=`sed -n -e '/Subject:/s/.* //p' -e '/^$/q'`
| > 
| >   :0c 
| >   | (formail -rt -A"Precedence: junk";\
| >      cat $HOME/.outbound/$FILE) | $SENDMAIL -t
| 
| *If* .outbound has some subdirectories (say subdir), How about this email: 
| 
| From: dumbass@aol.com
| Subject: GET subdir/../../../../etc/passwd
| Reply-To: blin@algebra.com

That will fail in the second subject line:
 * !^Subject:.*[ /.]\.
 Subject: does not match '/' or '.' followed by '.'

The first Subject: line prevents absolute pathnames.
 * ^Subject: (SEND|get) [0-9a-z][-_/0-9a-z.]+$

So, AFAIK, you can't get anything but real subdirectories.  Feel free
to install it on localhost & experiment.  I was pretty careful when I
wrote it to make it safe.

Adam

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume