🚀 go-pugleaf

I'm posting to asau.patches a short script that I think might help with
some of the queries people come up with about AmigaUUCP's dire security.
It requires the UUCP/UUX/UUXQT from AmigaUUCP 1.17b4, although it can
use just about any version of UUCICO, and it requires UseSubDirs to be
turned on. Oh yes, and it requires AmigaDOS 2.04 or better. But then you
knew that already... ;-)


THE PROBLEM

AmigaUUCP has a, IMHO, *massive* security hole in it that means that any
system with a valid password for logging in to an AmigaUUCP system can
pretend to be any system it wants. The node names given while two UUCICOs
handshake are taken at face value, there is no way of forcing only one
node name to be accepted by a UUCICO receiving a call.

This means two things: it means that a AmigaUUCP sysop needs a fair
amount of trust in any users sie gives an account to. And it also means
that no sysop in their right mind is going to provide anonymous UUCP
access unless they provide no normal UUCP accounts.


WHAT MY SCRIPT DOES

AUUCP 1.17b4 introduces the concept of "safe directories", where all the
jobs for a specific system are stored. The idea has more to do with
ensuring that systems aren't tripped up for, for example, having names
of more than 7 letters or whatever, but I get the impression that a
security angle was being envisaged too. Unfortunately it does nothing
to relate a system to a login still, so it is still possible login using
one username and password, and then tell a host UUCICO you're some
system that your not.

My script sits in between GETTY & UUCICO. It's called by Getty as a
standard login program, takes as an argument the nodename expected, and
forces all UUCICO activity to occur in the safe directory for the
given node. So if the wrong nodename is given by the caller, it makes no
difference whatsoever - except that the calling node wont be able to
access its own files, let alone everyone elses.

It works by using shell variables to override UUCONFIG, setting UUSPOOL
to UUSPOOL:<nodename> while UUCICO runs. This means that UUCICO thinks
that the spool directory is the safe directory for the specified system.
Because UUX/UUCP/UUXQT all support safe directories now, this has
suddenly become possible.

It also allows anonymous UUCP. All activity occurs in AnonUUCP, and at
the end of the transfer session anything in UUSPOOL:AnonUUCP is deleted,
so an anonymous user can't send or receive email, but they can still
transfer files [which is what anonymous UUCP is for after all]

If a sysop wants only certain directories accessable by certain users,
a few if...endif statements in the script should make it possible. I
suggest something like:

	if exists UULIB:Security.$System
		copy UULIB:Security.$System UULIB:Security
	else
		copy UULIB:Security-Default UULIB:Security
	endif


WHAT MY SCRIPT DOES NOT DO:

There are still holes to be filled however. The most important is that
email and news from a specific system can still contain forged headers.
If anyone wants to write "Safe" email and news, checking the beginning
of each email for "From <system>!<etc>" and news for
"Path: <system><etc>", I suggest making use of the $System variable that
this script makes available - UUXQT will end up running programs with
this set.


I hope this script solves a few of the security problems, and means that
people feel a little safer about providing UUCP logins to their systems.
Anyone with any queries is welcome to contact me.

-- 
Paul Harrison                                    paul@phszx81.gn.apc.org
I blame the government               PGP public key available on request

      Public, free, non-profitmaking UK UUCP network: email & news
            Help us build it! To join the mailing list, email
                   ukuulist-request@phszx81.gn.apc.org