From: "David J. Fiander" <davidf@golem.waterloo.on.ca>
Subject: LONG: Re: Help?? MMDF authorization example needed..
Resent-From: mmdf@xenitec.on.ca
Submit-To: scogen@xenitec.on.ca
Organization: [resent by] The SCOGEN gateway and Propagation Society
Date: Sat, 19 Dec 1992 18:39:29 GMT
Summary: how it all works
Keywords: mmdf, authorization, tutorial
Precedence: bulk

According to peter@DIALix.oz.au (Peter Wemm):
>I'm trying to set up MMDF Authorization on a public access unix
>system.  We'd like to be able to control the mail going out on our
>link to the world.  Any mail within our domain would be free, and
>anybody should be able to recieve mail from anywhere.

This part is relatively easy.

>From what I've read, the instructions are not all that clear and
>only cover one particualar type of authorization - which is no good
>to us.  We need to allow anybody on specified machines to pass mail,
>or specified users on this machine or another particular machine to
>pass mail.

Well, the SCO documentation is fantastic compared to the stuff
that comes with the university source distribution (but then
I'm biased; the SCO documentation is closely related to an
internal paper that I wrote).

All MMDF authorization is centered around the channels.  An
administrator can permit or deny mail access based on the
originating channel, departing channel, or (sort of) user's
name but, in the case of restricting access based on the user,
entire channels are allowed or denied.  Authorization is the
most common reason for having multiple channels which use the
same protocol; different channels using the same protocol may
have different policies associated with them.

Let's study your problem.  I said that the first part was
easy.  That's because it's just the default situation; no
authorization is required.  You need (at least) two channels.
One you already have: the local channel.  The second, and
subsequent, channels give access to the rest of the domain, and
no other hosts.  These channels should all be configured like
this:

	MCHN local, auth=free, ...
	MCHN internal, auth=free, ...

"auth=free" is the default authorization level; I have listed
it so that it is clear that every channel has some sort of
authorization associated with it.  This configuration should
apply on _all_ the internal machines.

Now for the second part.  This is where you really care about
authorization.  I will assume that you have exactly one gateway
to the outside world, that all your internal hosts communicate
via SMTP, and that internal hosts use the "badhosts" channel to
forward mail bound for the outside world to the gateway and for
nothing else.  Properly configuring the authorization will
involve some configuration on the internal machines and some on
the gateway.

Let's look at the hosts which are allowed to send mail to
anybody they want.  On these hosts, create a badhosts channel
which has no authorization restrictions:

	MCHN badhosts, auth=free, host=gateway, ...

There.  Any user on hosts with this configuration can send mail
anywhere they wish.

For those hosts from which no mail is allowed to travel
offsite, don't configure a badhosts channel.  This, by itself,
won't stop users from sending mail to the rest of the world,
but it will make it harder.  Determined users will always be
able to say "user%destination@gateway" to get the mail off
their machine.  So you have to configure the gateway so that it
won't allow this trick to work.  Create a channel (called
full, say) on the gateway machine that lists all the internal
hosts that are allowed to pass mail to the outside world.  It
should be declared like this:

	MCHN full, tbl=full, ...

No authorization is required on this channel; it is just a
collection of hosts which have different authorization than the
others.  Then, create a channel through which all mail leaving
the domain must travel (or one for each protocol).  It should be
configured like this:

	MCHN world, auth=outblock, outsrc="full-auth", ...

The "auth" parameter says that mail departing via the channel
should be blocked unless it satisfies the authorization
criteria set down in the authorization file "full-auth" (this
authorization file is declared using an MTBL line in the
mmdftailor file just like any other table).  An "outsrc"
authorization table lists inbound hosts or channels and their
corresponding permitted destination hosts.  So, create the
"full-auth" table, with the one line

	full:

What this does is allow mail arriving at the gateway via the
"full" channel to go anywhere at all, and all other mail will
be blocked, or returned to the sender with a message explaining
why.

Now, there is one thing left to do.  This is where my
assumption that you are using SMTP within the domain comes into
play (if you're using UUCP instead, then there is a way to do
the same thing).  You have to edit /etc/inetd.conf in order to
make sure that MMDF figures out which channel the message
arrived on.  It currently looks like this:

	smtp stream tcp nowait mmdf /usr/mmdf/chans/smtpd \
		smtpd /usr/mmdf/chans/smtpsrvr smtp

(without the line break).  What you have to do is change the
last field from "smtp" to "full,smtp".  What that field is is
the list of smtp channels that are configured into your
system.  When the inbound smtp server starts up it searches
that list in order so that it can find out the name of the
channel to report to submit.

The only part left is the fact that some users can send mail to
the world, even though others on the same computer can't.  This
is harder.  How hard would it be to move these users to a
different computer :-)?

Actually, it's not that hard.  Create the badhosts channel on
the computers that have a mixed population, but restrict access
to it by saying

	MCHN badhosts, auth=outblock, ...

but don't associate an authorization table with the channel as
we did previously.  Then create a user authorization table.
The table will contain one line for each user on the machine
which is allowed to send mail through the badhosts channel:

	user: both badhosts

This says that the given user is permitted to send and recieve
mail via the badhosts channel.  All users are still allowed to
receive mail from the badhosts channel, because inbound traffic
is not restricted.  All you have to do now is tell MMDF to
perform per-user authorization.  This is done by declaring a
table, using the MTBL declaration, called "auth":

	MTBL auth, file="users.auth",
		show="Per-User authorization information"

You _must_ call the table "auth" for this to work.  You also
have to create the same table on the gateway machine, because
mail from the authorized users on the mixed machines will not be
arriving via the "full" channel that you declared.  On the
gateway machine, the auth table should look like:

	user@internal.node: both world

where internal.node is the name of the machine on which they
live.

NOTE:  this may not all work exactly as I've described it, but
it's close.  I don't use authorization, since I'm the only one
that logs onto golem.waterloo.on.ca.

- David
Newsgroups: biz.sco.general