>Number:         2409
>Category:       misc
>Synopsis:       /etc/daily sends security output to wrong addr w/ MAILTO
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    misc-bug-people (Misc Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue May 14 11:05:01 1996
>Last-Modified:
>Originator:     Erik Bertelsen
>Organization:
UNI-C
>Release:        NetBSD-current, 13 May 1996.
>Environment:
System: NetBSD erik-be.uni-c.dk 1.1B NetBSD 1.1B (EBE) #28: Tue May 7 19:21:32 MET DST 1996 erik@erik-be.uni-c.dk:/usr/sup/netbsd/src/sys/arch/i386/compile/EBE i386


>Description:
	The script /etc/daily is run from the crontab distributed with
	NetBSD. As part of its work, it also executes the script 
	/etc/security, but it always mails the security output to root
	even if a MAILTO is defined in root's crontab.
>How-To-Repeat:
	Define MAILTO to another user than root in root's crontab and
	observe that the output from /etc/daily is mailed to the desti-
	nationa defined in MAILTO, while the output from /etc/security
	is still mailed to root.
>Fix:

A possible correction is shown in the diff listing below:
*** daily.orig	Mon May 13 16:09:24 1996
--- daily	Mon May 13 16:15:05 1996
***************
*** 6,11 ****
--- 6,15 ----
  #
  PATH=/bin:/usr/bin:/sbin:/usr/sbin:/usr/local
  host=`hostname -s`
+ if [ -z "$MAILTO" ]; then
+  MAILTO=$USER
+  export MAILTO
+ fi
  echo "Subject: $host daily run output"
  
  echo ""
***************
*** 122,125 ****
  	rdist -f /etc/Distfile
  fi
  
! sh /etc/security 2>&1 | mail -s "daily insecurity output" root
--- 126,129 ----
  	rdist -f /etc/Distfile
  fi
  
! sh /etc/security 2>&1 | mail -s "daily insecurity output" $MAILTO
------------------------------------------------------------------------
>Audit-Trail:
>Unformatted: