[9059] in athena10
Re: Changing How MIT's VPN & Dial-Up Servers Handle Unauthenticated Email
daemon@ATHENA.MIT.EDU (Jonathan Reed)
Tue May 22 11:20:17 2012
Mime-Version: 1.0 (Apple Message framework v1084)
Content-Type: text/plain; charset=us-ascii
From: Jonathan Reed <jdreed@MIT.EDU>
In-Reply-To: <alpine.DEB.2.00.1205221110240.24065@dr-wily.mit.edu>
Date: Tue, 22 May 2012 11:20:14 -0400
Cc: Jonathon Weiss <jweiss@MIT.EDU>, debathena@MIT.EDU, linerva@MIT.EDU
Message-Id: <CAD77087-1397-491C-A310-2E273F19D010@mit.edu>
To: Geoffrey Thomas <geofft@MIT.EDU>
Content-Transfer-Encoding: 8bit
> OK, we need to find a way for daemons on Linerva to send authenticated mail. We might as well do something that's reasonable Debathena-wide; thoughts (on the technical side) on trying to get tickets with the default keytab, e.g., something vaguely on the order of
>
> system(qw(klist -s));
> +my $have_tickets = $?;
> +if ($have_tickets == 0 && $< == 0) {
> + system(qw(kinit -k));
> +}
> if (($? == 0) &&
> (`klist 2>/dev/null` =~ /Default principal: (.*?)\@ATHENA.MIT.EDU/)) {
> $kuser = $1;
> # Remove any instances
> $kuser =~ s|/.*||g;
> }
>
> ?
>
> (possibly with a non-default ccache and a kdestroy)
>
> I haven't checked if Linerva has any daemons that send mail that don't run as root.
What if there's no keytab? We still need a way to gracefully deal with timeouts. I also want to talk with Garry or Mark or someone about what we might see in the future. Since the spammers were able to log into the dialups, they clearly have valid usernames and passwords, and they're unlikely to simply give up. I want to avoid trying to hit a moving target as much as possible.
-Jon
