How to disable telnet to port 25

Hey fellow punks:
	A while back, there was a discussion about how to fake a from address
by telneting into port 25 in a site. Many people discussed the pro's and con's,
but I wanted to know if anybody knows of a way to stop people from getting in
there to send the message in the first place.
		Send any ideas or solutions to: an41389@anon.penet.fi

			Anonymously yours,
				Wintermute
-------------------------------------------------------------------------
To find out more about the anon service, send mail to help@anon.penet.fi.
Due to the double-blind, any mail replies to this message will be anonymized,
and an anonymous id will be allocated automatically. You have been warned.
Please report any problems, inappropriate use etc. to admin@anon.penet.fi.

The Al Capone of the Info Highway says:
> A while back, there was a discussion about how to fake a from
> address by telneting into port 25 in a site. Many people discussed
> the pro's and cons, but I wanted to know if anybody knows of a way
> to stop people from getting in there to send the message in the
> first place.

Sure. Turn off mail to your site.

Beyond that, the store and forward nature of mail makes it impossible
to stop this. The only real solution is to require digital signatures
on all email.

Perry

> 
> 
> The Al Capone of the Info Highway says:
> > A while back, there was a discussion about how to fake a from
> > address by telneting into port 25 in a site. Many people discussed
> > the pro's and cons, but I wanted to know if anybody knows of a way
> > to stop people from getting in there to send the message in the
> > first place.
> 
> Sure. Turn off mail to your site.
> 
> Beyond that, the store and forward nature of mail makes it impossible
> to stop this. The only real solution is to require digital signatures
> on all email.
> 
> Perry
> 

Identd is pathetic, but may help with finding who did it.
(Also, a good look at the mail headers will help too.)

If the mail was a forgery on the local site, a check in the mail
logs will do, as sendmail is not accessed when mailing from
user@localhost to anotheruser@localhost.

Enough of the "FAA's... the info that everyone knows, or should.".

Other than using PGP or PEM, or writing a new RFC for mail, is there
any other way to verify that a message is authentic that I missed?

-----BEGIN PGP SIGNED MESSAGE-----

On Sun, 27 Nov 1994 dfloyd@io.com wrote:

> Other than using PGP or PEM, or writing a new RFC for mail, is there
> any other way to verify that a message is authentic that I missed?

I don't have an answer to your question, but you did bring up something 
I've been meaning to ask about for some time and I never really got 
around to it; Are there any short-term plans to press for an RFC 
utilizing digital signatures?  With the exponential increase of mail 
users, as well and the influx of Compu$erv, AOL, Prodigy and other users, 
some methods for the transparent use of digital signatures needs to be 
worked out before it becomes too difficult to implement change because 
the commercial services have all the power.  (or worse, before the 
government decides for us.)

Of course the question then become one of which standard to use.  PGP may 
seem great, but if there are nothing buy licencing problems and political 
backlash, maybe something else needs to be looked at.

Sorry, just a-babblin'.



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBLtljEzokqlyVGmCFAQGP3QQAva4mpLJXa8GfxcvfkR5TUQLr7589JZtp
UmdJCVS5QtEIrZUvwm+3uS4Bv/rqP29axT/OtHCxIOyayWSadu0wuxfnJ+UKIiS0
SOlqsegrHfoFEKInXANzMGMKC0JxIoDWKp3CK/RpqxnQfp/VQos6PI31OijW5g+0
Dz+LXL4xR6o=
=9dbu
-----END PGP SIGNATURE-----


____        Robert A. Hayden       <=> hayden@krypton.mankato.msus.edu
\  /__          -=-=-=-=-          <=>          -=-=-=-=-
 \/  /  Finger for Geek Code Info  <=> I do not necessarily speak for the
   \/   Finger for PGP Public Key  <=> City of Mankato or anyone else
-=-=-=-=-=-=-=-
(GEEK CODE 2.1) GJ/CM d- H-- s-:++>s-:+ g+ p? au+ a- w++ v* C++(++++) UL++++$ 
		P+>++ L++$ 3- E---- N+++ K+++ W M+ V-- -po+(---)>$ Y++ t+ 5+++
		j R+++$ G- tv+ b+ D+ B--- e+>++(*) u** h* f r-->+++ !n y++**

"Robert A. Hayden" says:
> I've been meaning to ask about for some time and I never really got 
> around to it; Are there any short-term plans to press for an RFC 
> utilizing digital signatures?

There is already an RFC on this (and indeed has been for some years);
its called "PEM", or Privacy Enhanced Mail. Thus far it's been a
complete flop. Its thought that certain modifications being proposed
right now (MIME integration, "mail style" names instead of X.500
distinguished names, and the ability to use non-hierarchical signature
certificates) may change that.

Perry