> Even without the who command, a user could see the list of
> subscribers by connecting directly to the mail server and doing
> an expn command for the name of the list. Perhaps this could
> be prevented by having a relay mail server forward the mail from
> an externally visable machine to the machine with majordomo
> running. But that would complicate things quite a bit. You
> have to remember that Brent Chapman states over and over in the
> documentation that majordomo was not built with great security
> in mind.
Yea, but lots of such security minded people have disabled the EXPN
command. Also that would require that the person knows the name of the
list, which may not be obvious if someone changed the -outgoing to
-myverysecretoutgoingclonething.
- shawn
References:
|
|
