On 14-Mar-01 at 09:00, The Hermit Hacker ([EMAIL PROTECTED]) wrote:
>
> Trying to convince a group that Cyrus is more secure, but my arguments are
> about as lame as can be :(
I assume that you've pointed out that no exploits have ever been
reported for Cyrus and that even if an exploit is ever discovered,
it would only give access to the 'cyrus' user, not to root.
Also, it is quite easy with Cyrus to setup mailboxes for people
who do not have a unix login at all. I believe that UofW still
requires an entry in /etc/passwd.
If you want even greater security, under FreeBSD you can run Cyrus
in a jail so that even access to the cyrus user can't possibly be
expanded into full root access on the host machine. (For those
unfamiliar with recent versions of FreeBSD, a 'jail' is basicly an
enhanced chroot environment.)
-Pat
