🚀 go-pugleaf

>> Because this ability can be used to forge a connection to a remote
>> machine, I suggest that people not provide this information. It's very
>> easy for the remote system to add access for system ABC if they want
>> that system to have access.
>
>If I wanted to 'forge a connection' to a remote machine, I would simply
>change my own hostname if necessary.  Forgery implies an attempt at illegal
>access.  If I'm willing to break the law and violate somebody's security, I
>would certainly do it from a machine where I have total and absolute control.
>
>You are also correct that it's covered in the UUCP documentation, so it's
>hardly a secret.

And, this is why most modern variants of uucp (including the HoneyDanBer
version used on Suns and elsewhere, and the Taylor package) have a
Permissions file which can be used to block such forgery.

Basically, the Permissions file can (and should!) be used to associate
each remote uucp system's name with a specific login username.  These
login usernames should be set up with unique passwords, known only to
the sysadmin of the specific remote site to which the username is
assigned.

That way, if my system has two neighbors "foo" and "bar", there will be
two logins (e.g. "Ufoo" and "Ubar") each with a unique password.  If the
sysadmin at "foo" tries to forge a connection as "bar", he won't be able
to log in as "Ubar" because he doesn't know the password for that
account... and if he logs in as "Ufoo" and tries to connect as uucp site
"bar", the uucp Permissions file setup will reject the connection
because "Ufoo" and "bar" are not allowed to be used in combination.

uucp site admins who don't set up the Permissions file properly, or who
set up only one uucp login for all of their neighbors, or who allow
"anonymous" uucp connections, are indeed leaving the door open to forged
connections.  This is a well-understood security loophole, and site
admins who don't close it are taking a definite risk of penetration.
--
Dave Platt    dplatt@3do.com
      USNAIL: The 3DO Company, Systems Software group
              600 Galveston Drive
              Redwood City, CA  94063