JSOTTILE@LOYVAX.BITNET (01/12/88)
A lot of folks have asked me what I am talking about when I say DECNET and
MAIL bugs (I believed I used the term security hole). Here's a what I
am talking about.
There is a program that was published in a magazine that allows a user with
NETMBX privileges to send mail across DECNET and "fudge" the FROM: field (any
field for that matter).
That is to say, that I can make a mail message appear in your mail file from
ANY user to ANY USER. For example, I could send you mail from your boss
saying that you are fired. I agree, it cannot do much more than that, but
I still consider it a major problem here at our academic site. Most users
here thrive on that sort of playing and all I want to do is to put a stop
to it BEFORE it happens.
Now, at our site, if I remove NETMBX privs and install RTPAD with netmbx that
solves most of my problems. We have a Vax cluster of 2 nodes with shared UAFs
and disks. This alieviates a problem that a gentleman pointed out to me: "ANY
MACHINE THAT COULD TALK DECNET TO YOUR MACHINE COULD LIE." A point well
taken, but since I can control both machines totally, I don't feel that I
have this problem.
Unfortunately, this does take away the user's ability to use TASK to TASK
communications. At our site, this is not a problem since we have BATCH
queues that both systems can get at. So, if a user needs to send a task
command to the other machine, he/she need only submit a command file to
batch and examine the log file (there are many ways of getting output).
I have received many 'words of caution' which I am extremely grateful for. I
have answered most of them (numerous duplicates only received a few answers,
sorry). All the questions and possible problems that were posed to me only
affirmed the solution. That is, none of the anticipated problems seemed to
put up a front that could not be avoided. Please keep the questions and
problems coming because I may still be overlooking something.
Also, I must agree with the same person above that said (para-phrase) 'I
wouldn't bet on the fact that this will solve all mail forging problems.'
So very true, but at least I've corked up a hole that might cause problems
in the early future.
Thanks.
- john sottile
Student Systems Programmer
Loyola College in Maryland
(JSOTTILE@LOYVAX.BITNET)
Disclaimer: The view expressed here are those of my own and are no reflection
of those of my employeer. Hell, even my employeer doesn't want
to take credit for the many mistakes I do.eal@tut.fi (Lehtim{ki Erkki) (01/13/88)
That feature is not nice when misused, but it can be very usefull, too.
If i want to send a short (one line) message to somebody, i use that
sendmail program like this:
$ SENDMAIL/TO=OPER/ORIG=OPER/FROM="ERKKI The modem line is free now" NL:
And user OPER gets mail from user ERKKI whos personal name seems to be
"The modem line is free now" and OPER gets the message immediatelly
(except if he had SET TERM/NOBROADCAST)
--
Erkki A. Lehtim{ki eal@tut.uucp