|
|
|
|
|
|
|
|
|
|
|
|
| home | help | back | first | fref | pref | prev | next | nref | lref | last | post |
From: "Mark R. Ludwig" <Mark-Ludwig@uai.com> To: Brad Templeton <brad@looking.clarinet.com> Cc: macnabr@cc.ims.disa.mil, In-Reply-To: <9311180339.aa25864@looking.clarinet.com> Date: Thu, 18 Nov 1993 06:43:30 -0800 Brad> I believe most people will feel that this proposal is very Brad> ill-advised. I agree; the proposal may well cause more problems than it solves. Brad> It should be possible to disconnect the networks but still allow Brad> seamless e-mail addressing. It will take a bit of work but it Brad> will be worth it. Brad> You don't want open SMTP connections, I assume. So what you Brad> must do is create nameservice on the internet that says all Brad> Milnet mail must use the gateway as a mail exchanger (MX), and Brad> similar nameservice on the milnet going the other way. We do business with a MILNET site, and it was a major step when they were able to FTP to our open machine using its name and not its IP address. They still do not have their reverse mapping working, so all the logs identify their connections by address. Peachy, just peachy. When we asked them for their e-mail addresses they kept giving us foo@[n.n.n.n], until I insisted that they just send us something and we started using the return address which the mail system itself gave us and which actually works! That's the short version of our DNS experience with a MILNET site -- and it's not a small site. Unless they are the exception, the "bit of work" you suggest, Brad, will be insurmountable. The administrators of machines on MILNET are struggling with configuring the straight-forward DNS right now. Brad> Sites on the internet will ask, "how do I mail to foo.mil" and Brad> the gateway nameserver (on the internet) will tell them to send Brad> the mail to the gateway. It can then send the mail through some Brad> fortified channel to the gateway machine on the milnet. And Brad> vice versa. I can imagine that for non-MILNET sites to e-mail into MILNET, an MX of *.mil pointing to the gateway might actually work. The reverse will be more problematical, unless MILNET were to have some sort of shadow DNS which fakes everything else on the Internet and points all mail to the gateway. Otherwise, making it work requires reconfiguring every single machine which currently sends mail such that it "defaults" to sending the mail to the gateway as the first outbound hop. This is not a small task! If all this is in response to the most-recent sendmail problem, it smells of over-reaction. The holes which the infamous worm exploited acquired root privilege, and did it much more quietly. This one can't acquire root directly, and the standard sendmail configuration logs it all verbosely.$$ -- INET: Mark-Ludwig@UAI.COM NIC: ML255 ICBM: USA; Lower Left Coast "Anything worth doing in Japan is worth doing in a crowd." -- T. R. Reid
|
|
|
|
|
|
|
|
|
|
|
|
| home | help | back | first | fref | pref | prev | next | nref | lref | last | post |