🚀 go-pugleaf

rickert@mp.cs.niu.edu (Neil Rickert) writes:

>In article <1513@lysator.liu.se> pen@lysator.liu.se (Peter Eriksson) writes:
>>
>>If one applies the Sendmail patch in pub/ident/patches at ftp.lysator.liu.se
>>or pub/networking/ident/patches at ftp.uu.net, then all mail that are received
>>via the SMTP TCP/IP port will, if the sending host is running an IDENT server,
>>have a line "(rfc931-sender: realuserid@realhostid)" added to the "Received: "
>>line in the message header. (Where "realuserid" is the user name of the luser
>>at "realhostid" who initiated the connection to the SMTP port).

>  If the mail forger is halfway competent, he will ensure that this
>authentication stamp reads:

>	(rfc931-sender: root@realhostid)

>  It is not at all clear to me why this buys you anything.

I don't understand what all this complaining against RFC 931 is about.
It's as trustworthy as reserved ports, yet people complain bitterly
about RFC 931, which has no impact on security, but hardly
about the use of reserved ports.

RFC 931 enables you to trace accesses to your site to
a <user@host> pair. This information can and has been used to
find compromised accounts at otehr sites.

RFC 931 helps against the most common SMTP fakes. Of course, it
doesn't guard against faking mail. But it is no longer
just ``telnet smoehost smtp'', they must do more than that.
Locally, the number of faked messages has dropped of dramatically.,

Casper

-- 
						|	Casper H.S. Dik
						|	casper@fwi.uva.nl