🚀 go-pugleaf

In article <betuCzyD79.LIt@netcom.com>, VITAL <betu@netcom.com> wrote:

| I have a UUCP question which hopefully has a simple answer. 
| 
| I have my uucp machine named as "ABC" [output of uuname -l] . The host that I 
| connect to expects the name "EFG" as a registered system. Is their a simple 
| way that when my machine dials out, it shows its name as "EFG" instead of 
| "ABC". For business reasins, I cannot change my hostname.

Because this ability can be used to forge a connection to a remote
machine, I suggest that people not provide this information. It's very
easy for the remote system to add access for system ABC if they want
that system to have access.

I also assume that the poster does not have or has not read the
appropriate manual pages on this.
-- 
Bill Davidsen (davidsen@tmr.com) UNIX Codger
	Will solve problems for money.
Stupidity, like virtue, is its own reward.

In article <betuCzyD79.LIt@netcom.com>, VITAL <betu@netcom.com> wrote:
>
>Hello,
>
>I have a UUCP question which hopefully has a simple answer. 
>
>I have my uucp machine named as "ABC" [output of uuname -l] . The host that I 
>connect to expects the name "EFG" as a registered system. Is their a simple 
>way that when my machine dials out, it shows its name as "EFG" instead of 
>"ABC". For business reasins, I cannot change my hostname.

Sure.  Just include a MYNAME=EFG in your /etc/lib/uucp/Permissions file.
I also recommend picking up a copy of the Managing UUCP and Usenet book
from O'Reilly & Associates.

Ciao,
-- 
   _     gwa1@bluecross.on.ca  |  "But there's one thing I must say
 _| |_   Greg Walker           |  Before they lock me up again:
|_   _|  Technical Specialist  |  `You'd be safer at the back!'"
  |_|    Ontario Blue Cross    |     -Thomas Dolby, "Hyperactive"

[ Followups redirected. ]

davidsen@tmr.com (bill davidsen) writes:

>In article <betuCzyD79.LIt@netcom.com>, VITAL <betu@netcom.com> wrote:

>| I have a UUCP question which hopefully has a simple answer. 
>| 
>| I have my uucp machine named as "ABC" [output of uuname -l] . The host that I 
>| connect to expects the name "EFG" as a registered system. Is their a simple 
>| way that when my machine dials out, it shows its name as "EFG" instead of 
>| "ABC". For business reasins, I cannot change my hostname.

>Because this ability can be used to forge a connection to a remote
>machine, I suggest that people not provide this information. It's very
>easy for the remote system to add access for system ABC if they want
>that system to have access.

I believe this is misguided.  Anybody who is truly interested in
forging a connection can simply change the hostname of their machine.
Knowledge of the ``myname'' command in a Taylor UUCP sys file or the
MYNAME keyword in an HDB Permissions file does not provide any
additional ammunition to would-be crackers.

Also, it is always worth remembering that security by obscurity, while
tempting, is ill advised.  It is safest to assume that your opponent
knows everything.  If you protect against that case, then you have
certainly protected yourself against people who do not know
everything.

For example, it is easy to assign a different password to every UUCP
system permitted to call your local system.  If you do this, your UUCP
transfers will be as secure as your password file.

The Taylor UUCP documentation has a brief discussion of UUCP security.
Suggestions for improvement are always welcome.  Contributed text is
even more welcome.
-- 
Ian Taylor | ian@airs.com | First to identify quote wins free e-mail message:
``You don't have to sleep.  That's just something *they* tell you to keep
  *control* over you.  Nobody has to sleep; you're *taught* to sleep when
  you're a kid.  If you're really determined, you can get over it.''

bill davidsen (davidsen@tmr.com) wrote:
> In article <betuCzyD79.LIt@netcom.com>, VITAL <betu@netcom.com> wrote:

>| I have a UUCP question which hopefully has a simple answer. 
>| 
>| I have my uucp machine named as "ABC" [output of uuname -l] . The host that I 
>| connect to expects the name "EFG" as a registered system. Is their a simple 
>| way that when my machine dials out, it shows its name as "EFG" instead of 
>| "ABC". For business reasins, I cannot change my hostname.

> Because this ability can be used to forge a connection to a remote
> machine, I suggest that people not provide this information. It's very
> easy for the remote system to add access for system ABC if they want
> that system to have access.

If I wanted to 'forge a connection' to a remote machine, I would simply
change my own hostname if necessary.  Forgery implies an attempt at illegal
access.  If I'm willing to break the law and violate somebody's security, I
would certainly do it from a machine where I have total and absolute control.

You are also correct that it's covered in the UUCP documentation, so it's
hardly a secret.

					Tom
--
Tom Myers, Network Manager; IC Design Center, P.O. Box 9005, M/S D18
Delco Electronics Corporation, Kokomo  IN, 46904-9005
E-Mail: tvmyers@icdc.delcoelect.com  Voice:(317)451-3051 GM: 8-322-3051

>> Because this ability can be used to forge a connection to a remote
>> machine, I suggest that people not provide this information. It's very
>> easy for the remote system to add access for system ABC if they want
>> that system to have access.
>
>If I wanted to 'forge a connection' to a remote machine, I would simply
>change my own hostname if necessary.  Forgery implies an attempt at illegal
>access.  If I'm willing to break the law and violate somebody's security, I
>would certainly do it from a machine where I have total and absolute control.
>
>You are also correct that it's covered in the UUCP documentation, so it's
>hardly a secret.

And, this is why most modern variants of uucp (including the HoneyDanBer
version used on Suns and elsewhere, and the Taylor package) have a
Permissions file which can be used to block such forgery.

Basically, the Permissions file can (and should!) be used to associate
each remote uucp system's name with a specific login username.  These
login usernames should be set up with unique passwords, known only to
the sysadmin of the specific remote site to which the username is
assigned.

That way, if my system has two neighbors "foo" and "bar", there will be
two logins (e.g. "Ufoo" and "Ubar") each with a unique password.  If the
sysadmin at "foo" tries to forge a connection as "bar", he won't be able
to log in as "Ubar" because he doesn't know the password for that
account... and if he logs in as "Ufoo" and tries to connect as uucp site
"bar", the uucp Permissions file setup will reject the connection
because "Ufoo" and "bar" are not allowed to be used in combination.

uucp site admins who don't set up the Permissions file properly, or who
set up only one uucp login for all of their neighbors, or who allow
"anonymous" uucp connections, are indeed leaving the door open to forged
connections.  This is a well-understood security loophole, and site
admins who don't close it are taking a definite risk of penetration.
--
Dave Platt    dplatt@3do.com
      USNAIL: The 3DO Company, Systems Software group
              600 Galveston Drive
              Redwood City, CA  94063

bill davidsen aka davidsen@tmr.com wrote:
{ | I have my uucp machine named as "ABC" [output of uuname -l] . The host that I 
{ | connect to expects the name "EFG" as a registered system. Is their a simple 
{ | way that when my machine dials out, it shows its name as "EFG" instead of 
{ | "ABC". For business reasins, I cannot change my hostname.

{ Because this ability can be used to forge a connection to a remote
{ machine, I suggest that people not provide this information. It's very
{ easy for the remote system to add access for system ABC if they want
{ that system to have access.

I can't believe I'm actually disagreeing with Bill but, when you outlaw 
information, only outlaws will have information.  (If you outlaw guns 
only outlaws will have guns)  

I _still_ say, the more information you give a sysadmin the better 
prepared he/she is to handle problems.  If you don't have the info, 
_someone_ does.  Crackers and Hackers, Inc. have a lot more free time to 
figure out how to break in than Admins have to stop them as it is.
 
Non-disclosure is a dangerous thing when it comes to system security.
-- 
gburnore@garys.arasmith.com
--------------------------------------------------------------------------
                How you look depends on where you go.
--------------------------------------------------------------------------
                                     | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Gary L. Burnore                      | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Director, Programming & Development  | �۳�ݳ޳�ݳ�۳�ݳ޳�ݳݳ޳�ݳ����
Myers Information Systems, Inc.      | �۳ 3 4 1 4 2 �ݳ޳ 6 9 0 6 9 ���
                                     |     Official Proof of Purchase
==========================================================================