🚀 go-pugleaf

kanagn@athina.cc.uch.gr (Kostas Anagnostakis) writes:
>Why not implement SMTP allowing only connections from PRIVILEGED ports.

Three problems:

1) If you start doing this on your machine, you will stop being able to
exchange mail with people who aren't doing this.  I assume that sendmail
usually connects from unprivileged ports.  On our machine (running zmailer)
it looks like sendmail isn't even setuid.

2) The concept of "privileged port" is not universal to TCP; many machines
don't even have the concept of privileged users, and even some which do don't
have the concept of privileged ports.  So anyone can connect from a "privileged
port" on these machines.

3) Why do you trust privileged users more than other people?  I'm very wary of
systems which appear to increase the authenticity of communications without
necessarily doing so.  If someone forges a mail message in my name which says
something that it's important for me to establish that I did not say, I would
like to be able to say "everyone knows that forging e-mail is easy"; it would
be terrible for others to be able to say "e-mail authenticity is guaranteed
these days since smtp allows only connections from privileged ports".  These
forgers will include system administrators and also people who break in to
privileged accounts.


There are cryptographic techniques only suffering from the first problem.  If
we're going to lose compatibility, we should do it right.

In article <1992Aug13.121416.7078@csd.uch.gr> kanagn@athina.cc.uch.gr (Kostas Anagnostakis) writes:

     I had an idea I would like to share with you. Why not implement SMTP
     allowing only connections from PRIVILEGED ports. As far as I have gone
     into the matter, this would be a solution because a normal user is
     not able to use a socket port < 1000 so his attempt to connect to
     a SMTP server will fail.

Well, pretty much anyone nowdays can become "root" by buying
their own machine.  It all boils down to the question of "Can
you trust the remote machine to tell you the correct mail header?"
You can't...

--
===============================================================================
David J. Bianco 			Systems Dude & Part time Illusionist
Old Dominion University    			<bianco@cs.odu.edu>
Dept of Computer Science,		"BORGer King:  We do it our way.
Norfolk, VA 23529			 Your way is irrelevant..."
===============================================================================

kanagn@athina.cc.uch.gr (Kostas Anagnostakis) writes:
>Hello security freaks,
>
>  I had an idea I would like to share with you. Why not implement SMTP
>  allowing only connections from PRIVILEGED ports. As far as I have gone
>  into the matter, this would be a solution because a normal user is
>  not able to use a socket port < 1000 so his attempt to connect to
>  a SMTP server will fail.

Because priviledged ports aren't really priviledged. Besides, anyone
on the net who has root access on a unix box, or a PC they run, or
what have you, could still forge mail.

>  If someone wishes to start working on the idea, I would like to help.

Its not like it would be a lot of work; we are talking about 10 or 20
of lines of code here, even being generous. Its just that this doesn't
actually solve the problem.

--
Perry Metzger		pmetzger@shearson.com
--
		  Just say "NO!" to death and taxes.
			 Extropian and Proud.

In article <1992Aug13.121416.7078@csd.uch.gr> kanagn@athina.cc.uch.gr
(Kostas Anagnostakis) writes: 
>  I had an idea I would like to share with you. Why not implement SMTP
>  allowing only connections from PRIVILEGED ports. As far as I have gone
>  into the matter, this would be a solution because a normal user is
>  not able to use a socket port < 1000 so his attempt to connect to
>  a SMTP server will fail.

This has been done in many places already.  However, they can only do
it for local connections because they would bounce all the mail from
the rest of the world.

Besides, there is no such thing as a priviledged port in the RFC's.
It is something that Berkeley designed to help out security on a
network of BSD machines.  It has no meaning on a PC for example.  The
port numnbers are < 1024.

It would be better to run some sort of identity server (for a very
weak protection) or PEM (for a much stronger protection).

Warner
-- 
Warner Losh		imp@Solbourne.COM
imp@Solbourne.COM: "I should be OK, I'm basically doing the speed limit"
dworkin@rootgroup.com: "That's why BASIC is so slow.  It has a speed limit"

kanagn@athina.cc.uch.gr (Kostas Anagnostakis) writes:

    Why not implement SMTP allowing only connections from PRIVILEGED
    ports. As far as I have gone into the matter, this would be a
    solution because a normal user is not able to use a socket port <
    1000 so his attempt to connect to a SMTP server will fail.

As many others have pointed out, this isn't a universal solution.
However, when I was postmaster of a major company I attempted to
address this in an upward compatible way. I modified our SMTP to use
privileged ports, and note whether a message came in over a privileged
port. If it did not, it added:

Comment: This message was received over an unauthenticated port at <site>.

In this way, you might be able to tell if someone was spoofing a
message.  Of course, anyone who was running a workstation without the
modified SMTP also generated messages like this. It didn't interfere
with delivery, but did note when something "different" had happened. I
would guess about 30-40% of the outbound messages carried this warning,
owing to lazy sysadmins (who didn't upgrade) or machines that couldn't,
or machines morally or politically opposed to "software tampering".

Well, the users universally hated it. Said it made us look
unprofessional and insecure. Jumped all over my management until they
made me make the message go away.

Looks are much more important than security, after all!

Rick

In article <BIANCO.92Aug13092256@aelle.cs.odu.edu> bianco@aelle.cs.odu.edu (Dave) writes:
>In article <1992Aug13.121416.7078@csd.uch.gr> kanagn@athina.cc.uch.gr (Kostas Anagnostakis) writes:
>
>     I had an idea I would like to share with you. Why not implement SMTP
>     allowing only connections from PRIVILEGED ports. As far as I have gone
>     into the matter, this would be a solution because a normal user is
>     not able to use a socket port < 1000 so his attempt to connect to
>     a SMTP server will fail.
>
>Well, pretty much anyone nowdays can become "root" by buying
>their own machine.  It all boils down to the question of "Can
>you trust the remote machine to tell you the correct mail header?"
>You can't...

The ONLY possible benefit I could see to this idea would that it would stop
the forging of mail by telnetting to the SMTP port.  While people with root
access or Macs and PCs connected to the network could get around this, it does
take a bit more knowledge than simply telnetting to port 25 and forging mail
headers does.  This would at least slightly raise the difficulty factor for
wanna-bes on the Internet.

I can hardly see it being worth replacing all the software out there to
implement this, though.

-- 
/-----------------------------------------------------------------------------\
| Doug Siebert                             | "I don't have to take this abuse |
| Internet:  dsiebert@icaen.uiowa.edu      |  from you - I've got hundreds of |
| NeXTMail:  dsiebert@chop.isca.uiowa.edu  |  people waiting in line to abuse |
|     ICBM:  41d 39m 55s N, 91d 30m 43s W  |  me!"  Bill Murray, Ghostbusters |
\-----------------------------------------------------------------------------/
Hi, I'm a .signature worm.  I've already copied myself into your .signature.

In article <1992Aug13.102249.16853@jarvis.csri.toronto.edu> flaps@dgp.toronto.edu (Alan J Rosenthal) writes:
>kanagn@athina.cc.uch.gr (Kostas Anagnostakis) writes:
>>Why not implement SMTP allowing only connections from PRIVILEGED ports.

A better solution can be to accept SMTP connections only from trusted
hosts (and maybe limiting to a specified port too). Mail should be
bubbled like name server queries are bubbled through the net.

>1) If you start doing this on your machine, you will stop being able to
>exchange mail with people who aren't doing this.

Use MX record to point to your "forwarder", well there are still old
versions of mailer that do not care of MX but they are minority.
--
Israel Yedidya,         Phone:  972-3-5318682 or 972-3-5318407/8
System Administrator,   Fax:    972-3-5353325
Math & CS Department,   Email:  yedidya@bimacs.cs.biu.ac.il
Bar-Ilan University,    Bitnet: yedidya@bimacs
Ramat-Gan, ISRAEL.      Uucp:   ...!uunet!pucc.princeton.edu!bimacs!yedidya
If someone proves there is no God, I'll stop being religious!

>>>Why not implement SMTP allowing only connections from PRIVILEGED ports.
>
>A better solution can be to accept SMTP connections only from trusted
>hosts (and maybe limiting to a specified port too). Mail should be
>bubbled like name server queries are bubbled through the net.

Um, how does this help?  If you allow only connections from trusted hosts, but
you allow them to feed you mail that they got from hosts you don't trust, why
don't you just let those untrusted hosts feed you mail directly?  Or if you
assume that those hosts will be trusted by that machine you trust, how do you
go about setting up a sufficiently large network of these hosts that you can
talk to more than a few sites out there?  Why is this any easier of a task than
changing the sendmail protocol?