From: ned@sigurd.innosoft.com (Ned Freed)
Newsgroups: vmsnet.mail.pmdf
Subject: Information about access checks in PMDF's MAILSERV (corrected posting)
Date: 8 Sep 92 00:51:33 GMT
Organization: The Internet
Return-Path: <epmdf@YMIR.CLAREMONT.EDU>
Resent-Date: 07 Sep 1992 17:51:33 -0700 (PDT)
Resent-From: epmdf@YMIR.CLAREMONT.EDU
Errors-To: epmdf@YMIR.CLAREMONT.EDU
Resent-Message-ID: <01GOIG3840GI96VREK@YMIR.CLAREMONT.EDU>
X-Vms-To: IPMDF
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Content-Transfer-Encoding: 7BIT

1 Access control

Access to each type of mail server functionality is controlled using the
"MAILSERV_ACCESS" mapping in the PMDF mapping file. Use of this mapping is
optional; reasonable defaults are taken for each sort of access if no mapping
is specified.

Access control is necessarily based on addressing information. Since it is in
practice possible to forge any sort of address information access checks offer
only marginal protection at best. Although they may make it difficult for
unsophisticated users to unintentionally cause damage they offer no protection
at all against malicious attack.

2 Access check strings

Each command presented to the mail server is used to compose one or more access
query strings. The access mapping is then applied to each of these strings. The
result of the mapping is examined and determines whether or not the requested
operation is allowed. If the operation is not allowed the mail server returns
an indication to the requestor indicating that an access failure has occurred.

The access query strings are always in one of the following two formats:

  command-keyword|command-parameter|address
  command-keyword|command-parameter|address1|address2

"command-keyword" is derived from the name of the command being checked. It
will be "DIRECTORY" for the DIRECTORY command, "DIRECTLIST" for the
DIRECTORY/LIST command, "SEND" for the SEND command, "SENDLIST" for the
SEND/LIST command, "SUBSCRIBE" for the SUBSCRIBE command, and "UNSUBSCRIBE" for
the UNSUBSCRIBE command. Although commands can be abbreviated abbreviations do
not carry over into the "command-keyword" strings.

The "command-parameter" depends on the command. In the case of the file
access commands DIRECTORY and SEND the parameter is the name of the particular
file being accessed. The file name string consists of the directory
specification (if any), the file name, and the file type. Wildcards don't carry
over into access strings; the wildcard expansion process is done first and then
each resultant file generates a separate access check. In the case of the list
access commands DIRECTORY/LIST, SEND/LIST, SUBSCRIBE, and UNSUBSCRIBE the
"command-parameter" is the name of the list. Wildcards are once again
expanded prior to doing any access checks.

When a mail server request involves only one address the single-address form of
access check string is built, and "address" is address of the party responsible
for the request. In some cases, notably the SUBSCRIBE and UNSUBSCRIBE commands,
two addresses may be involved -- the address responsible for the request and
the address the request is acting on. In this case the two-address form of
access check string is used, where "address1" is the responsible party's
address and "address2" is the address being acted on.

PMDF V4.1 uses the envelope From: address as the responsible party's address.
Please keep in mind that given the nature of contemporary messaging protocols
it is fairly easy to forge an envelope from address. As a result, the security
offered by mail server access checks is extremely fragile at best.

3 Access check mapping results

Access check mapping entries set flags to indicate whether or not the request
should be honored. A "$Y" or "$T" specifies that the request should be honored.
A "$N" or "$F" indicates that the request should be rejected.

A "<" specifies that the entry has returned a file name. The file name should
be specified as a full absolute path. This file is opened and read as a series
of addresses. The request is rejected if the requestor's address does not
appear in the list. A ">" does the same thing except that rejection occurs if
the requestor's address is in the list. "<" and ">" cannot be used in the same
entry; if they are the result is unpredictable.

4 Access defaults

The DIRECTORY, DIRECTORY/LIST, SEND, and SUBSCRIBE commands all allow full
access if no access mapping is provided or the access check string does not
match any mapping entry. The SEND/LIST command refuses all access and the
UNSUBSCRIBE command only allows access to the requestor's address.

5 Access examples

The following mapping controls access to the INFO-BOINK list. It specifies that
user@a.b.c.d has full access to the list. Users in domain f.g.h.i cannot access
the list in any way. It also specifies that anyone can retrieve a copy of the
list membership.

  MAILSERV_ACCESS

      *|INFO-BOINK|user@a.b.c.d                      $Y
      *|INFO-BOINK|user@a.b.c.d|*                    $Y
      *|INFO-BOINK|*@f.g.h.i                         $N
      *|INFO-BOINK|*@f.g.h.i|*                       $N
      SENDLIST|INFO-BOINK|*                          $Y