Hi,
(this is bcc'ed to the mgetty announce mailing list - so don't wonder if
you receive this mail without being subscribed to the mgetty list).
I have just released mgetty+sendfax 1.1.29.
It contains a couple of new features, bug fixes, and a massive rewrite of
the way the fax queue (/var/spool/fax/ and /var/spool/fax/outgoing/)
is accessed.
New features:
* many error messages clarified
* the caller's name (Caller ID) is now exported to external scripts
as $CALLER_NAME
* voice/ has support for DLE shielding of long DTMF tones
* voice/ has support for 16 bit linear audio on V.253 modems
* lots of documentation work
Security fixes / concept changes:
* it's now possible to run faxrunq/faxrunqd (and thus sendfax) as
non-root user
* fax spool directories are no longer world-writeable, access is done
via a suid helper program (suid to a special user ID, "fax")
* possible buffer overrun when calling cnd-program (if CallerName is
too long)
* $CALLER_ID, $CALLER_NAME and so on are sanitized before passing to shell
(all quote characters and all non-printable characters are replaced by " ")
Bug fixes:
* "caller name = CONNECTICUT" is now handled correctly, and not mistaken
for "CONNECT" any more
* faxrunqd sometimes didn't obey job priority settings if combining
multiple jobs to the same destination
* some timing problems in sending ATE0 to voice modems on fast computers
Who should upgrade?
* everbody who is using faxspool/faxrunq on a machine that is shared
with other users that are not 100 per cent trustworthy
* vgetty users with V.253 modems
Distribution vendors:
- I strongly urge you to upgrade to 1.1.29 - older versions are NOT safe
if there are malicious users on the system and faxrunq/faxrunqd are in
use.
- The fax queue handling (faxspool, faxq-helper) needs a new user ID
now ("fax") which MUST own the fax queue directories and SHOULD NOT
own anything else. The user ID is configured in the Makefile.
- faxrunq/faxrunqd can run as user "fax", but in that case the user
needs access to the modem devices (via his primary group id).
Watch out for log file access permissions if this is used!
If anything is unclear, *please* talk to me before rolling out updated
packages that might break things in funny ways.
gert
--
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany gert@greenie.muc.de
fax: +49-89-35655025 gert.doering@physik.tu-muenchen.de