🚀 go-pugleaf

morgan@ms.uky.edu (Wes Morgan) writes:

>felix@escape.vsse.in-berlin.de (Felix the double Helix) writes:
>>
>>[deleted]

>Logging the actual transactions, i.e. the actual contents of each message,
>would be both unethical and useless, IMHO.

>HOWEVER.....

>Logging the transaction data (the sender/recipient addresses) can be VERY
>useful.  For instance, I've used that information (extracted from syslog)

To log even more information about who really sent a mail one can use
the RFC931/IDENT/TAP protocol. With this and if the machine the user
is connecting from is running an Ident server it is possible to retreive
the username of who Telnet:ed to your SMTP port and tried to send a
faked email. (Yes yes, it is possible to circumstance this, for example
by using a PC, or by being root on a machine, but most lusers faking
email is probably hiding behind the shelter of a multiuser machine with
many users...)

To add this capability to Sendmail, FTP to ftp.lysator.liu.se, cd to the
directory pub/ident/patches and get the file sendmail-5.65c-IDA1.4.4.1.patch
and apply that to the Sendmail-5.65c-IDA1.4.4.1 sources (the same patch
will probably also work on other versions of the same Sendmail, but one
might have to apply it by hand).

Then it's just a matter of changing the "Received: " format line to
something like:

  HReceived: $?sfrom $s $.by $j $?r with $r$.
             ($v/$Z/Lysator-3.1) id $i; $b $?F
             (rfc931-sender: $F@$S)$.

And all mails received by the Sendmail daemon will contain a line
something like: (rfc931-sender: pen@robin.lysator.liu.se) if
I telnet into it and robin is running a Pidentd server.

And the log lines in the syslog file will look something like:

  Jul 29 06:39:51 lysator sendmail[8796]: AA08796: from=<foo@bar.xy>, size=491, class=0, received from pen@robin.lysator.liu.se (130.236.254.21)

Where the "from=<foo@bar.xy>" is the user supplied sender, which
can be anything and "received from pen@robin.lysator.liu.se (130.236.254.21)"
is the real sender.

Sorry, if all this is old info.

/Peter



--
Peter Eriksson                                              pen@lysator.liu.se
Lysator Academic Computer Society                 ...!uunet!lysator.liu.se!pen
University of Linkoping, Sweden                           I'm bored. Flame me.