Bug#435598: apply autocreate patch

[Benjamin Seidenberg]

Jack Bates wrote:
> Package: cyrus-imapd-2.2
> Version: 2.2.13-13
> Severity: wishlist
> Tags: patch
>
> We find ourselves in the same situation as the University of Athens: A
> small percentage of users ever use their Cyrus mailbox. So instead of
> creating Cyrus mailboxes for all our users, we apply the University of
> Athens' autocreate patch and rebuild the Debian Cyrus packages:
> http://email.uoa.gr/projects/cyrus/autocreate/
> http://email.uoa.gr/download/cyrus/cyrus-imapd-2.2.13/
>
> This patch allows configuring Cyrus to create mailboxes when users login
> for the first time, or mail arrives for a user without an existing
> mailbox.
>
> We heeded the warning accompanying this patch: Before configuring Cyrus
> to create mailboxes on message delivery, we configured our MTA to check
> mail is addressed to a valid user. This prevents potential attackers from
> flooding Cyrus with invalid mailboxes.
>
> We've been manually applying the autocreate patch and rebuilding the
> Debian Cyrus packages since 2004; the patch has proven quite stable.  It
> doesn't by default change any Cyrus behavior unless one of its
> configuration options is set. However maintaining modified Debian
> packages is a bit of overhead and we hope the Debian Cyrus maintainers
> would consider applying the autocreate patch to the official Debian
> packages?
>
> Thanks for maintaining Cyrus in Debian, Jack
>   

We'll have to review the patch, but my personal feeling is that assuming
it's a well written patch, it shouldn't be a problem. I'll look at it
when I next get to working on cyrus.

Benjamin

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 252 bytes
Desc: OpenPGP digital signature
Url : http://lists.alioth.debian.org/pipermail/pkg-cyrus-imapd-debian-devel/attachments/20070801/cc07e6af/attachment.pgp