🚀 go-pugleaf

In article <1992Aug13.151514.14735@hal.com> ables@hal.com (King Ables) writes:
#From article <1992Aug13.102249.16853@jarvis.csri.toronto.edu>, by flaps@dgp.toronto.edu (Alan J Rosenthal):
#> These
#> forgers will include system administrators and also people who break in to
#> privileged accounts.
#
#As a former sysadm, I take offense at this remark and I think many current
#ones will, too.  I will give you the benefit of the doubt and assume you are
#not trying to say that sysadms are, by nature, underhanded individuals (which
#is what it sounds like) but that you simply chose a poor way of trying to

It didn't sound that way to me.  He said that there will be some sys admins
among the forgers.  This is highly likely.

#say that only privileged users would be able to accomplish such a feat, but
#that many people could get these privileges in different ways.

You don't need any privileges to forge SMTP mail (on most systems).  This is
not because of SMTP itself, but because, for example, any process with any
privilege can connect to an SMTP port (again - most systems) and tell it who
the mail is from, etc.  As has been pointed out, any authentication
mechanism must be shared by the entities which which to communicate and
encryption is likely to be the best method (eg, using Kerberos).

However, if you protect sendmail (or whatever) access on your system,
there's likely to be plenty of places that don't where someone can connect
to and claim to be sending mail from you.

Life is hard.

Mark