Re: security problem with sender in config

[Jason L Tibbitts III <tibbs @ hpc . uh . edu>]

>>>>> "JG" == Jeffrey Goldberg <J.Goldberg@Cranfield.ac.uk> writes:

[By setting sender you can make it look like mail comes from anywhere.]

JG> Is this true?

Well, sure.

JG> Is it a problem?

Is it a problem that most MUAs let you change the From: header?  You can
send mail through Majordomo with any From: header you like.  Being able to
change the envelope sender isn't any more of a big deal, because you can do
that with 'telnet localhost 25' anyway.  Most people these days can't even
see the envelope sender.

You can't do anything with downstream Received: headers, so you still can't
forge anything any better than you can using any other method.

If this still bothers you, with the development version you could make
'sender' a variable that you need additional privileges to change.

 - J<