🚀 go-pugleaf

ivory@e7sa.crd.ge.com (John Ivory) writes:

>A site I've been working with is considering obtaining a UUCP e-mail feed
>so that they can e-mail to/fro the world.  Myself and several others have
>been strongly encouraging this.  This is new territory for the company
>though, so they are cautious.  They are concerned that they are opening
>themselves up to some level of danger, point to the Morris worm of a couple
>years ago as an example.

>These are open minded and intelligent people, but they want more than just
>my word that they really are not that much in danger.  What documents can
>I bring down from the net to help validate my argument?  My spin is that
>their greatest danger is themselves; bringing in and casually running things.

The documentation for Taylor UUCP has a section on UUCP security.  It
is, naturally, oriented toward Taylor UUCP, but is fairly applicable
to other packages.

Basically, UUCP does not provide much security for the users of a
system against users of the same system (for example, there are often
ways for one user to look at any files that another user is receiving
via uucp).  Mail is usually fairly secure.

Assuming that that is not an issue (users at the site mostly trust
one another), then UUCP can be very secure.  It is obviously better
for them to dial out, rather than to accept phone calls, because if
another system can dial in then they must protect all their accounts
from intruders.  However, assuming they do that, or assuming that they
always place the call, UUCP can be configured to eliminate any
possibility of remote access to their files.  In fact, it is normally
configured this way by default.

Ian Taylor