How to disable telnet to port 25
Hey fellow punks: A while back, there was a discussion about how to fake a from address by telneting into port 25 in a site. Many people discussed the pro's and con's, but I wanted to know if anybody knows of a way to stop people from getting in there to send the message in the first place. Send any ideas or solutions to: an41389@anon.penet.fi Anonymously yours, Wintermute ------------------------------------------------------------------------- To find out more about the anon service, send mail to help@anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin@anon.penet.fi.
The Al Capone of the Info Highway says:
A while back, there was a discussion about how to fake a from address by telneting into port 25 in a site. Many people discussed the pro's and cons, but I wanted to know if anybody knows of a way to stop people from getting in there to send the message in the first place.
Sure. Turn off mail to your site. Beyond that, the store and forward nature of mail makes it impossible to stop this. The only real solution is to require digital signatures on all email. Perry
The Al Capone of the Info Highway says:
A while back, there was a discussion about how to fake a from address by telneting into port 25 in a site. Many people discussed the pro's and cons, but I wanted to know if anybody knows of a way to stop people from getting in there to send the message in the first place.
Sure. Turn off mail to your site.
Beyond that, the store and forward nature of mail makes it impossible to stop this. The only real solution is to require digital signatures on all email.
Perry
Identd is pathetic, but may help with finding who did it. (Also, a good look at the mail headers will help too.) If the mail was a forgery on the local site, a check in the mail logs will do, as sendmail is not accessed when mailing from user@localhost to anotheruser@localhost. Enough of the "FAA's... the info that everyone knows, or should.". Other than using PGP or PEM, or writing a new RFC for mail, is there any other way to verify that a message is authentic that I missed?
-----BEGIN PGP SIGNED MESSAGE----- On Sun, 27 Nov 1994 dfloyd@io.com wrote:
Other than using PGP or PEM, or writing a new RFC for mail, is there any other way to verify that a message is authentic that I missed?
I don't have an answer to your question, but you did bring up something I've been meaning to ask about for some time and I never really got around to it; Are there any short-term plans to press for an RFC utilizing digital signatures? With the exponential increase of mail users, as well and the influx of Compu$erv, AOL, Prodigy and other users, some methods for the transparent use of digital signatures needs to be worked out before it becomes too difficult to implement change because the commercial services have all the power. (or worse, before the government decides for us.) Of course the question then become one of which standard to use. PGP may seem great, but if there are nothing buy licencing problems and political backlash, maybe something else needs to be looked at. Sorry, just a-babblin'. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLtljEzokqlyVGmCFAQGP3QQAva4mpLJXa8GfxcvfkR5TUQLr7589JZtp UmdJCVS5QtEIrZUvwm+3uS4Bv/rqP29axT/OtHCxIOyayWSadu0wuxfnJ+UKIiS0 SOlqsegrHfoFEKInXANzMGMKC0JxIoDWKp3CK/RpqxnQfp/VQos6PI31OijW5g+0 Dz+LXL4xR6o= =9dbu -----END PGP SIGNATURE----- ____ Robert A. Hayden <=> hayden@krypton.mankato.msus.edu \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> I do not necessarily speak for the \/ Finger for PGP Public Key <=> City of Mankato or anyone else -=-=-=-=-=-=-=- (GEEK CODE 2.1) GJ/CM d- H-- s-:++>s-:+ g+ p? au+ a- w++ v* C++(++++) UL++++$ P+>++ L++$ 3- E---- N+++ K+++ W M+ V-- -po+(---)>$ Y++ t+ 5+++ j R+++$ G- tv+ b+ D+ B--- e+>++(*) u** h* f r-->+++ !n y++**
"Robert A. Hayden" says:
I've been meaning to ask about for some time and I never really got around to it; Are there any short-term plans to press for an RFC utilizing digital signatures?
There is already an RFC on this (and indeed has been for some years); its called "PEM", or Privacy Enhanced Mail. Thus far it's been a complete flop. Its thought that certain modifications being proposed right now (MIME integration, "mail style" names instead of X.500 distinguished names, and the ability to use non-hierarchical signature certificates) may change that. Perry
participants (4)
-
an41389＠anon.penet.fi -
dfloyd＠io.com -
Perry E. Metzger -
Robert A. Hayden