🚀 go-pugleaf

rickert@mp.cs.niu.edu (Neil Rickert) writes:

>  If the mail forger is halfway competent, he will ensure that this
>authentication stamp reads:

>	(rfc931-sender: root@realhostid)

>  It is not at all clear to me why this buys you anything.

The point is that it is the Sendmail daemon that adds this stamp. Of course
a forger can add his own addition "Received: " line, or he can use a PC (or
a Unix machine where he has root access) to run his own IDENT daemon, but then
all odds are off anyway. And there will still be the Sendmail-added stamp
in the mail...

Something like this:

Received: from glenlivet.ohm.york.ac.uk ([144.32.128.21]) by lysator.liu.se  with SMTP
          (5.65c8/1.34/Lysator-3.1) id AA16950; Tue, 21 Jul 1992 19:48:09 +0200          (rfc931-sender: root@[144.32.128.21])
Received: from efd.lth.se (oddput.efd.lth.se) by glenlivet.ohm.york.ac.uk  with SMTP
          (5.65c8/1.34) id AA02312; Wed, 6 May 1992 19:03:56 +0200
	  (rfc931-sender: forger@realhostid)
Received: from faked.host.xy (realhostid) by efd.lth.se  with SMTP
          (5.65c8/1.99) id AA02313; Tue, 5 May 1992 19:00:56 +0200
	  (rfc931-sender: root@realhostid)

Then one can check the Received: lines to see at which point someone
did fake the message... And of course the Sendmail daemon also logs the
"rfc931-sender" user identifier in it's log file.

Of course there are a number of ways to circumstance this, but it will
atleast make it harder for forgers. And they can atleast not Telnet
into *your* Sendmail daemon and use that as the entry point of a forged
letter. (If the machine the forger is using has a running IDENT server and
it has not been compromised.)

To get real authentication one has to go the Kerberos way I'm afraid
(or use PEM or things like that).

/Peter




--
Peter Eriksson                                              pen@lysator.liu.se
Lysator Academic Computer Society                 ...!uunet!lysator.liu.se!pen
University of Linkoping, Sweden                           I'm bored. Flame me.