[ Noah White writes: ]
> I'm trying to set up a list from which only certain people can post
> to. I set it up such that in the config file it looks for a file to get
> a list of authorized addresses. In doing so I noticed that X-Sender
> gets tacked on to the headers and that anyone with Netscape can forge
> this address nullifying any protection this gives.
Resend doesn't pay any attention to X-Sender.
> So I decided to use the approval header as a further protection.
> This works but I've come across a broader flaw in that in the Recieved
> header shows what the outgoing alias is. Anyone who wishes to post to
> the list could bypass the resend alias and go directly to the outgoing
> aliases (which as I said it posted in the Recieved header). Thus
> bypassing all checks.
Note that if you put the Approval header in the body and don't provide a
subsequent To header (in the body, separated from the real body by a
blank line) you'll get Apparently-To headers. Stick with restrict_post.
> Is there any whay to protect from this?
[ This is a canned message ]
Here's how you hide your actual mail list alias from list spammers:
1. Pick a non-obvious outgoing list alias name, e.g. "testlist-uzpl"
instead of "testlist-outgoing".
2. Turn off EXPN and VRFY in sendmail.cf (Opnoexpn,novrfy).
3. Use a parameter file for resend parameters:
testlist: "|/.../wrapper resend @/.../testlist.parms"
4. In the parameter file, specify more recipients than just the
outgoing list alias, e.g.:
(Don't forget to alias "nobody" to /dev/null.)
5. Don't allow any more file permissions than absolutely necessary on
any of the Mj files and/or don't allow user logons on the Mj server
machine and don't export the file system where the Mj files live.
I.e., is it *really* necessary to have world read permissions on
anything but the subscriber list file itself? I get along fine with
0660 on all the list.* files and 0664 on the list files.
Dave Wolfe *Not a spokesman for Motorola*
Motorola MMTG 6501 Wm. Cannon Dr. W. OE112 Austin TX 78735-8598