<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Chapter 7. Security Considerations</title><meta name="generator" content="DocBook XSL Stylesheets V1.74.3" /><link rel="home" href="index.html" title="The Mutt E-Mail Client" /><link rel="up" href="index.html" title="The Mutt E-Mail Client" /><link rel="prev" href="optionalfeatures.html" title="Chapter 6. Optional Features" /><link rel="next" href="tuning.html" title="Chapter 8. Performance Tuning" /><style xmlns="" type="text/css">
+<html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Chapter 7. Security Considerations</title><meta name="generator" content="DocBook XSL Stylesheets V1.75.2" /><link rel="home" href="index.html" title="The Mutt E-Mail Client" /><link rel="up" href="index.html" title="The Mutt E-Mail Client" /><link rel="prev" href="optionalfeatures.html" title="Chapter 6. Optional Features" /><link rel="next" href="tuning.html" title="Chapter 8. Performance Tuning" /><style xmlns="" type="text/css">
body { margin-left:2%; margin-right:2%; font-family:serif; }
.toc, .list-of-tables, .list-of-examples { font-family:sans-serif; }
h1, h2, h3, h4, h5, h6 { font-family:sans-serif; }
div.note h3 { font-size:small; font-style:italic; font-variant: small-caps; }
div.note h3:after { content: ":" }
div.note { margin-bottom: 5px; }
-strong.command { font-family: monospace; font-weight: normal; }
+.command { font-family: monospace; font-weight: normal; }
+.command strong { font-weight: normal; }
tr { vertical-align: top; }
+.comment { color:#707070; }
- </style></head><body><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 7. Security Considerations</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="optionalfeatures.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="tuning.html">Next</a></td></tr></table><hr /></div><div class="chapter"
lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title"><a id="security"></a>Chapter 7. Security Considerations</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="security.html#security-passwords">1. Passwords</a></span></dt><dt><span class="sect1"><a href="security.html#security-tempfiles">2. Temporary Files</a></span></dt><dt><span class="sect1"><a href="security.html#security-leaks">3. Information Leaks</a></span></dt><dd><dl><dt><span class="sect2"><a href="security.html#security-leaks-mid">3.1. Message-Id: headers</a></span></dt><dt><span class="sect2"><a href="security.html#security-leaks-mailto">3.2. mailto:-style Links</a></span></dt></dl></dd><dt><span class="sect1"><a href="security.html#security-external">4. External Applications</a></span></dt></dl></div><p>
+ </style></head><body><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 7. Security Considerations</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="optionalfeatures.html">Prev</a> </td><th width="60%" align="center"> </th><td width="20%" align="right"> <a accesskey="n" href="tuning.html">Next</a></td></tr></table><hr /></div><div class="chapter"
title="Chapter 7. Security Considerations"><div class="titlepage"><div><div><h2 class="title"><a id="security"></a>Chapter 7. Security Considerations</h2></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="security.html#security-passwords">1. Passwords</a></span></dt><dt><span class="sect1"><a href="security.html#security-tempfiles">2. Temporary Files</a></span></dt><dt><span class="sect1"><a href="security.html#security-leaks">3. Information Leaks</a></span></dt><dd><dl><dt><span class="sect2"><a href="security.html#security-leaks-mid">3.1. Message-Id: headers</a></span></dt><dt><span class="sect2"><a href="security.html#security-leaks-mailto">3.2. <code class="literal">mailto:</code>-style Links</a></span></dt></dl></dd><dt><span class="sect1"><a href="security.html#security-external">4. External Applications</a></span></dt></dl></div><p>
First of all, Mutt contains no security holes included by intention but
may contain unknown security holes. As a consequence, please run Mutt
only with as few permissions as possible. Especially, do not run Mutt as
</p><p>
When configuring Mutt, there're some points to note about secure setups
so please read this chapter carefully.
-</p><div class="sect1"
lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="security-passwords"></a>1. Passwords</h2></div></div></div><p>
+</p><div class="sect1"
title="1. Passwords"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="security-passwords"></a>1. Passwords</h2></div></div></div><p>
Although Mutt can be told the various passwords for accounts, please
never store passwords in configuration files. Besides the fact that the
system's operator can always read them, you could forget to mask it out
your mail including your password could be archived by internet search
engines, mail-to-news gateways etc. It may already be too late before
you notice your mistake.
-</p></div><div class="sect1"
lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="security-tempfiles"></a>2. Temporary Files</h2></div></div></div><p>
+</p></div><div class="sect1"
title="2. Temporary Files"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="security-tempfiles"></a>2. Temporary Files</h2></div></div></div><p>
Mutt uses many temporary files for viewing messages, verifying digital
signatures, etc. As long as being used, these files are visible by other
users and maybe even readable in case of misconfiguration. Also, a
different location for these files may be desired which can be changed
-via the <a class="link" href="reference.html#tmpdir" title="3.292. tmpdir">$tmpdir</a> variable.
-</p></div><div class="sect1"
lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="security-leaks"></a>3. Information Leaks</h2></div></div></div><div class="sect2" lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="security-leaks-mid"></a>3.1. Message-Id: headers</h3></div></div></div><p>
+via the <a class="link" href="reference.html#tmpdir" title="3.293. tmpdir">$tmpdir</a> variable.
+</p></div><div class="sect1"
title="3. Information Leaks"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="security-leaks"></a>3. Information Leaks</h2></div></div></div><div class="sect2" title="3.1. Message-Id: headers"><div class="titlepage"><div><div><h3 class="title"><a id="security-leaks-mid"></a>3.1. Message-Id: headers</h3></div></div></div><p>
Message-Id: headers contain a local part that is to be created in a
-unique fashion. In order to do so, Mutt will “<span class="quote">leak</span>” some
+unique fashion. In order to do so, Mutt will <span class="quote">“<span class="quote">leak</span>”</span> some
information to the outside world when sending messages: the generation
of this header includes a step counter which is increased (and rotated)
with every message sent. In a longer running mutt session, others can
-make assumptions about your mailing habbits depending on the number of
+make assumptions about your mailing habits depending on the number of
messages sent. If this is not desired, the header can be manually
-provided using <a class="link" href="reference.html#edit-headers" title="3.57. edit_headers">$edit_headers</a> (though not
-recommended).
-</p></div><div class="sect2"
lang="en" xml:lang="en"><div class="titlepage"><div><div><h3 class="title"><a id="security-leaks-mailto"></a>3.2. <code class="literal">mailto:</code>-style Links</h3></div></div></div><p>
+provided using <a class="link" href="reference.html#edit-headers" title="3.57. edit_headers">$edit_headers</a> (though
+not recommended).
+</p></div><div class="sect2"
title="3.2. mailto:-style Links"><div class="titlepage"><div><div><h3 class="title"><a id="security-leaks-mailto"></a>3.2. <code class="literal">mailto:</code>-style Links</h3></div></div></div><p>
As Mutt be can be set up to be the mail client to handle
<code class="literal">mailto:</code> style links in websites, there're security
considerations, too. Arbitrary header fields can be embedded in these
links which could override existing header fields or attach arbitrary
files using <a class="link" href="gettingstarted.html#attach-header" title="6.2.2. Attach: Pseudo Header">the Attach:
-ps
uedoheader</a>. This may be problematic if the <a class="link" href="reference.html#edit-headers" title="3.57. edit_headers">$edit-headers</a> variable is
+ps
eudoheader</a>. This may be problematic if the <a class="link" href="reference.html#edit-headers" title="3.57. edit_headers">$edit-headers</a> variable is
<span class="emphasis"><em>unset</em></span>, i.e. the user doesn't want to see header
fields while editing the message and doesn't pay enough attention to the
compose menu's listing of attachments.
will send out the user's private gnupg keyring to
<code class="literal">joe@host</code> if the user doesn't follow the information
on screen carefully enough.
-</p></div></div><div class="sect1"
lang="en" xml:lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="security-external"></a>4. External Applications</h2></div></div></div><p>
+</p></div></div><div class="sect1"
title="4. External Applications"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="security-external"></a>4. External Applications</h2></div></div></div><p>
Mutt in many places has to rely on external applications or for
convenience supports mechanisms involving external applications.
</p><p>
projects / software / mutt-debian.git / blobdiff