CRITICAL: very dangerous behavior identified

Jerry Benton jerry.benton at mailborder.com
Sun Oct 30 23:57:15 UTC 2016


This is a rare occurance, but you should be aware of it and update
your ms-clean-quarantine file. I will be updating the next version
with the changes.


-
Jerry Benton
www.mailborder.com
+1 - 844-436-6245


-----Original Message-----
From: Paul Williamson <paul.williamson at digitalpacific.com.au>
Reply: Paul Williamson <paul.williamson at digitalpacific.com.au>
Date: October 30, 2016 at 6:56:59 PM
To: mailscanner at mailborder.com <mailscanner at mailborder.com>
Subject:  Script malfunction (ms-clean-quarantine) causing disaster

> Hi Jerry,
>
> I just wanted to report that a bug in the following script had a disastrous
> effect for us, and I wanted to raise this to your attention so as to ensure
> nobody else is affected in the future.
>
> https://github.com/MailScanner/v5/blob/master/common/usr/sbin/ms-clean-quarantine
>
> We identified that one of the if statements does not appear to behave as
> expected, which caused the ms-clean-quarantine script to delete any files
> older than 7 days from the entire file-system, starting in /. The result
> for us was disastrous - many of our servers were wiped and needed to be
> restored from backups.
>
> *How this happened:*
> We had removed MailScanner.conf across a number of our servers (no longer
> using MailScanner) which then caused this script to run in a cron and
> delete everything on the filesystem older than 7 days, due to the
> validation of if directory $QUARDIR failing.
>
> QUICKPEEK=/usr/sbin/ms-peek
> ms_conf=/etc/MailScanner/MailScanner.conf
> QUARDIR=`${QUICKPEEK} QuarantineDir ${ms_conf}`
>
> QUARDIR in this case (when MailScanner.conf is missing) returns a
> whitespace/blank value which actually passes "# die if does not exist”
> check which then cd’s into / and runs "find . -type f -mtime +7 -exec rm -f
> {} \; >/dev/null 2>&1”.
>
> If $QUARDIR was double quoted in the if statement it would have been fine.
>
> # die if does not exist
> *if [ ! -d $QUARDIR ]; then*
> logger -i -p mail.notice "ERROR: ms-clean-quarantine - quarantine directory
> not found"
> echo "Aborted: cannot find quarantine directory. Check the
> /etc/MailScanner/MailScanner.conf file"
> echo "'Quarantine Dir' setting."
> exit 1
> fi
>
> # if not disabled
> if [ $q_days -gt 0 ]; then
> * if [ -d $QUARDIR ]; then*
> * cd $QUARDIR*
> logger -i -p mail.notice "ms-clean-quarantine: cleaning quarantine older
> than $q_days days"
> *find . -type f -mtime +$q_days -exec rm -f {} \; >/dev/null 2>&1*
> find . -type d -empty -delete >/dev/null 2>&1
> fi
> exit 0
> else
> logger -i -p mail.notice "WARN: ms-clean-quarantine called but is disabled"
> echo "Aborted: quarantine cleaning is disabled"
> exit 1
> fi
>
>
> If you would like any further information, please do not hesitate to
> contact me.
>
> Kind regards,
>
> Paul Williamson
> Technical Operations Manager
>
> Digital Pacific & Crucial Paradigm
> Phone: 1300 694 678 / 1300 884 839
> Email: paul.williamson at digitalpacific.com.au
> Website: https://www.digitalpacific.com.au/ &
> https://www.crucial.com.au/
>


More information about the MailScanner mailing list