🚀 go-pugleaf

[ Followups redirected. ]

davidsen@tmr.com (bill davidsen) writes:

>In article <betuCzyD79.LIt@netcom.com>, VITAL <betu@netcom.com> wrote:

>| I have a UUCP question which hopefully has a simple answer. 
>| 
>| I have my uucp machine named as "ABC" [output of uuname -l] . The host that I 
>| connect to expects the name "EFG" as a registered system. Is their a simple 
>| way that when my machine dials out, it shows its name as "EFG" instead of 
>| "ABC". For business reasins, I cannot change my hostname.

>Because this ability can be used to forge a connection to a remote
>machine, I suggest that people not provide this information. It's very
>easy for the remote system to add access for system ABC if they want
>that system to have access.

I believe this is misguided.  Anybody who is truly interested in
forging a connection can simply change the hostname of their machine.
Knowledge of the ``myname'' command in a Taylor UUCP sys file or the
MYNAME keyword in an HDB Permissions file does not provide any
additional ammunition to would-be crackers.

Also, it is always worth remembering that security by obscurity, while
tempting, is ill advised.  It is safest to assume that your opponent
knows everything.  If you protect against that case, then you have
certainly protected yourself against people who do not know
everything.

For example, it is easy to assign a different password to every UUCP
system permitted to call your local system.  If you do this, your UUCP
transfers will be as secure as your password file.

The Taylor UUCP documentation has a brief discussion of UUCP security.
Suggestions for improvement are always welcome.  Contributed text is
even more welcome.
-- 
Ian Taylor | ian@airs.com | First to identify quote wins free e-mail message:
``You don't have to sleep.  That's just something *they* tell you to keep
  *control* over you.  Nobody has to sleep; you're *taught* to sleep when
  you're a kid.  If you're really determined, you can get over it.''