O'Reilly - Practical UNIX & Internet Sec... 7015KB

[Chapter 22] 22.2 sendmail (smap/smapd) Wrapper
To take advantage of ident, your software needs to know how to query the remote server, if it exists. It then needs to
log that information appropriately. Modern versions of sendmail have this built in, to help cut down on mail
forging. The tcpwrapper program also knows how to query ident.
Keep in mind that if you record information from an ident server, it may not be correct. In fact, if you are
investigating a problem that is actually being caused by the system administrator of the remote system, he or she
may have altered the ident service. The service may thus return information designed to throw you off by pointing
at someone else.
Currently, identd is shipped standard with few systems. For example, it is shipped with Linux, but is not usually
enabled in the /etc/inetd.conf file.
A more serious shortcoming is that versions of sendmail with built-in support for the ident protocol will no longer
be able to obtain information about the sending user. The use of the ident protocol is discussed in the sidebar "Using
identd".
If using ident makes sense in your environment, you won't be able to use it with smap unless you spawn smap from
another wrapper that implements ident, such as the tcpwrapper program, which is described in the next section.
22.1 Why Wrappers? 22.3 tcpwrapper
[ Library Home | DNS & BIND | TCP/IP | sendmail | sendmail Reference | Firewalls | Practical Security ]
file:///C|/Oreilly Unix etc/O'Reilly Reference Library/networking/puis/ch22_02.htm (5 of 5) [2002-04-12 10:45:58]