>>>>> "MD" == Marilyn Davis <marilyn@deliberate.com> writes:
MD> The exim people have the solution, a configuration parameter, that's
MD> all. I tell you, exim is dynomite!
Yes, I use it myself.
MD> Do you know what he's saying about the "auth hash seed"?
Yes. The confirmation method Mj1 uses is stateless; it generates a token
based entirely on some data in your majordomo.cf and the address. When it
gets the auth command back, it makes sure the token matches the address
it's working with. Unfortunately the algorithm is dumb and it's easy to
extract the seed and thus generate tokens for your site at will.
How to fix this:
1) Use Mj2; we use a stateful method and our tokens are random numbers.
2) Use something like SHA1 or MD5 to generate the token. Easy and much
more secure. (This would take someone who knows what they're doing
something like ten minutes to do.)
- J<
References:
|
|
