Subject: Re: nncp-sudo

From: John Goerzen <[email-masked]>
Date: Mon, 23 Aug 2021 21:35:08 -0500

On Sat, Aug 21 2021, Sergey Matveev wrote:

>>- More security risks (think of, for instance, a world-readable 
>>set of
>>files in /var/mail).  Users have access to the secret  keys and 
>>could read
>>each other's incoming packets at the very  least.  Or delete 
>>them, etc.
>
> In that case I think that any kind of "sharing" (via 
> permissions, via
> sudo, whatever) should not be done at all. Possibly only an 
> additional
> via-hop should be shared (with intermediate copy/nncp-xfer to 
> transfer
> files to it).

So that's basically what I'm proposing, just with a different 
mechanism.  One could have each user running an nncp-daemon and 
there could be calls to localhost.  There are some downsides to 
that.  nncp-xfer/copy can be tricky to get the permissions right, 
though could be done.

But here, by authorizing one user to run nncp-daemon as another, 
you don't have to have a long-running nncp-daemon process - it 
gets spun up when needed.  It is effectively the same as listening 
on an open port but without having to be up constantly and so 
forth.

Having said all that, it's still theoretical to me; I have yet to 
actually have a case where it would help.

> Personally I just really do not like sudo. If some nncp-exec 
> target
> should be run under some specific user/rules, then I would 
> probably
> create an additional user, with his own spool and make him 
> available
> through the "via". I really have not met situations where sudo 
> was

I'm doing (nncp-exec calling sudo) for privilege separation 
reasons, but that's it.  It's not using sudo to run as root, but 
to run as me.

- John