Code Listing 9.1: Creating the MySQL database and user mysql> GRANT ALL PRIVILEGES ON maildb.* TO 'mail'@'localhost' IDENTIFIED BY 'very_secret_password'; Could be substituted by: GRANT INSERT,UPDATE,DELETE,SELECT ON maildb.* TO 'mail'@'localhost' IDENTIFIED BY 'very_secret_password'; And if the same db is not going to be used for quarantining to SQL you could likely restrict it to: GRANT SELECT ON maildb.* TO 'mail'@'localhost' IDENTIFIED BY 'very_secret_password'; Thx to Janne Pikkarainen for noting this.
Actually the same goes for Section 10 (Configuring SpamAssassin to use MySQL). There's a similar snippet: --- 10. Configuring Spamassassin to use MySQL # mysql -u root -p mysql mysql> GRANT ALL PRIVILEGES ON dbname.* TO 'dbuser'@'localhost' IDENTIFIED BY 'anoter_very_secret_password'; mysql> use dbname; --- Also note a typo: "anoter_very..." should be "another_very..."
On the Bayes and AWL DBs the user needs INSERT,UPDATE,DELETE,SELECT permissions, SELECT is not enough.
*bump* :) I just read the guide again. You may want to take a look at these parts of the guide, too: --- Note: The smtp-amavis line specifies that a maximum of two of these processes may run at any time. If you need a greater degree of concurrency tune this number to fit your needs. Remember that to match the number with $max_servers in amavisd.conf --- - Maybe it should be mentioned that amavisd-new is quite memory-intensive and raising the amount of amavisd-new processes too high can easily lead to memory starvation and swapping, which leads to heavily decreased performance. Next thing which took my attention was --- 10. Configuring Spamassassin to use MySQL As of Spamassassin 3.0 it is possible to store the Bayes and AWL data in a MySQL database. Here I will show how to easily accomplish this. --- Ok, so guide mentions people that it's possible to use MySQL as a backend for Bayes and AWL, but it doesn't tell WHY one should consider using MySQL. I, for one, took the MySQL route just because at our heavily loaded site the default BerkeleyDB backend lead to all kind of deadlocks and performance problems even after tuning its DB_CONFIG file. MySQL performs a lot better. So, mentioning about the performance would be good. Also maybe about how putting all the pieces to MySQL leads to easier overall system management?
*bump* :-) At least the ALL PRIVILEGES part would be nice to have modified as soon as possible...
Yet another *bump* ...
I read the guide one more time and I'm beginning to think this bug should be renamed as "Ironing out couple of security issues from Mailfilter Guide". ;) The guide assists people to put their MySQL connection settings to /etc/mail/spamassassin/local.cf: --- (Tell Spamassissin to use MySQL for bayes data bayes_store_module Mail::SpamAssassin::BayesStore::SQL bayes_sql_dsn DBI:mysql:sa_bayes:localhost:3306 bayes_sql_username db_name bayes_sql_password another_very_secret_password (Tell Spamassissin to use MySQL for AWL data auto_whitelist_factory Mail::SpamAssassin::SQLBasedAddrList user_awl_dsn DBI:mysql:sa_bayes:localhost:3306 user_awl_sql_username db_name user_awl_sql_password another_very_secret_password --- That's a big no-no, too! Usually local.cf is readable by world, so putting a password there is not a good thing. Instead you should put connection settings to /etc/mail/spamassassin/secrets.cf, which is only readable by root.
Great job Janne, Docs team what about to update documentation with at least the following two changesets: http://overlays.gentoo.org/proj/mysql/changeset/510?format=diff&new=510 http://overlays.gentoo.org/proj/mysql/changeset/511?format=diff&new=511 I don't want to interfere on comment #3 but that stuff is reasonable too imho.
Created attachment 105705 [details, diff] mailfilter-guide.xml.patch Proposed changes. If these look good, I will commit right away. The only thing I noticed, that I already sent an email to vivo about, is that the config file changed in one code example from /etc/mail/spamassassin/local.cf to secrets.cf. Is this supposed to be a complete local.cf --> secrets.cf filename change, or just this once, or what? There are many other references to local.cf, so I don't want to commit until I hear back on this.
CCing vivo for feedback.
Francesco responded on the secrets.cf thing, so I made one final change and committed the thing. Thanks to everyone for reporting, commenting, reviewing, etc. :) Fixed in CVS.
