From owner-freebsd-security Fri Aug 13 8:57:44 1999 Delivered-To: freebsd-security@freebsd.org Received: from lariat.lariat.org (lariat.lariat.org [206.100.185.2]) by hub.freebsd.org (Postfix) with ESMTP id 73BFC151F2 for ; Fri, 13 Aug 1999 08:57:40 -0700 (PDT) (envelope-from brett@lariat.org) Received: from mustang (IDENT:ppp0.lariat.org@lariat.lariat.org [206.100.185.2]) by lariat.lariat.org (8.9.3/8.9.3) with ESMTP id JAA19902; Fri, 13 Aug 1999 09:57:08 -0600 (MDT) Message-Id: <4.2.0.58.19990813091645.048468a0@localhost> X-Sender: brett@localhost X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.0.58 Date: Fri, 13 Aug 1999 09:57:03 -0600 To: Ollivier Robert , security@freebsd.org From: Brett Glass Subject: Re: Another SMTP name-guessing attack In-Reply-To: <19990813143148.A73411@keltia.freenix.fr> References: <4.2.0.58.19990812185216.043c1160@localhost> <4.2.0.58.19990812185216.043c1160@localhost> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org At 02:31 PM 8/13/99 +0200, Ollivier Robert wrote: >According to Brett Glass: > > Aug 11 211612 myhost sendmail[5126] VAA05126 lost input channel from ip176.albuquerque3.nm.pub-ip.psi.net [38.29.68.176] > >Why do you allow dialups POPs to directly connect to your mail server ? Use >the DUL system and be happy (and put others manually into your access file). We do use the RBL. But as far as I can tell, the DUL system doesn't reject the mail until after the whole message is sent; it doesn't stop Sendmail from listening to the dial-in node beforehand. So, I am not sure that it would defeat this attack. --Brett Glass To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message