Great Circle Associates List-Managers
(October 2000)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re: Securing majordomo
From: James M Galvin <galvin @ acm . org>
Date: Tue, 31 Oct 2000 08:10:05 -0500 (EST)
To: leigh @ whoopi . net
Cc: list-managers @ GreatCircle . COM
In-reply-to: <00b201c042ef$b3261bd0$cbfc59cb@production2>

    Hi, I have setup majordomo, but I only wish to allow certain people
    to access the lists, I have found that when I make an access file
    and put my email address only in it, that it is very easy to get
    access to the list and post to it by faking email and sending email
    to the lists as me.

Some might consider this a feature.  :-)

Setting aside the use of "real" secure email, the next level of access
control you're looking for is to use the envelope addresses instead of
the message header addresses.  Although these can also be forged, it is
one bar more difficult to do so.  However, since you're using majordomo,
this option is not directly available to you without some development
work on your part to integrate the SMTP server with your elist
application.

Instead, one thing you can do with majordomo -- actually with most elist
technologies -- is force the message through the approval function.  Set
up the elist with no entries in the access control file so that all
messages get forwarded to the "owner" for review.  The owner can then
add the approval password, if appropriate, and send the message back to
majordomo for distribution.  The owner (or owners) can avoid the "extra
roundtrip" on his/her own messages by including the approval password in
the original message.  Majordomo is always careful to remove the
approval password before it distributes the message.  Of course, this
option can be problematic for a "high" volume elist.

Hope this helps,

Jim
--
James M. Galvin                                         <galvin@acm.org>
------------------------------------------------------------------------
Public mailing lists hosted free at <http://www.elistx.com>





References:
Indexed By Date Previous: Re: [nanook@eskimo.com: Netzero.Net Cause Mail Problems]
From: murr rhame <murr@vnet.net>
Next: Re: [nanook@eskimo.com: Netzero.Net Cause Mail Problems]
From: Tim Pierce <twp@rootsweb.com>
Indexed By Thread Previous: Securing majordomo
From: leigh@whoopi.net
Next:
From: (nil)

Google
 
Search Internet Search www.greatcircle.com