Linux Network Administrator Guide, Second Edition

####################
# pablo
system          pablo
...
forward         uchile
####################
# uchile
system          uchile
...
forward-to      pablo

The forward-to entry for uchile is necessary so that any files returned by it are actually passed on to pablo. Otherwise UUCP would drop them. This entry uses a variation of the forward command that permits uchile to send files only to pablo through seci, not the other way round.

To permit forwarding to any system, use the special keyword ANY (capital letters required).

Setting Up Your System for Dialing In

If you want to set up your site for dialing in, you have to permit logins on your serial port and customize some system files to provide UUCP accounts, which we will cover in this section.

Providing UUCP Accounts

To begin with, you have to set up user accounts that let remote sites log into your system and establish a UUCP connection. Generally, you will provide a separate login name to each system that polls you. When setting up an account for system pablo, you might give it the username Upablo. There is no enforced policy on login names; they can be just about anything, but it will be convenient for you if the login name is easily related to the remote host name.

For systems that dial in through the serial port, you usually have to add these accounts to the system password file /etc/passwd. It is good practice to put all UUCP logins in a special group, such as uuguest. The account's home directory should be set to the public spool directory /var/spool/uucppublic; its login shell must be uucico.

To serve UUCP systems that connect to your site over TCP, you have to set up inetd to handle incoming connections on the uucp port by adding the following line to /etc/inetd.conf:[101]

uucp stream tcp nowait root /usr/sbin/tcpd /usr/lib/uucp/uucico -l

The -l option makes uucico perform its own login authorization. It prompts for a login name and a password just like the standard login program, but relies on its private password database instead of /etc/passwd. This private password file is named /etc/uucp/passwd and contains pairs of login names and passwords:

Upablo  IslaNegra
Ulorca  co'rdoba

This file must be owned by uucp and have permissions of 600.

Does this database sound like such a good idea that you would like to use it on normal serial logins, too? Well, in some cases you can. What you need is a getty program that you can tell to invoke uucico instead of /bin/login for your UUCP users.[102] The invocation of uucico would look like this:

/usr/lib/uucp/uucico -l -u user

The -u option tells it to use the specified user name rather than prompting for it.[103]

To protect your UUCP users from callers who might give a false system name and snarf all their mail, you should add called-login commands to each system entry in the sys file. This is described in the next section.

Protecting Yourself Against Swindlers

A major problem with UUCP is that the calling system can lie about its name; it announces its name to the called system after logging in, but the server doesn't have any way to check it. Thus, an attacker could log into his or her own UUCP account, pretend to be someone else, and pick up that other site's mail. This is particularly troublesome if you offer login via anonymous UUCP, where the password is made public.

You must guard against this sort of impostor. The cure for this disease is to require each system to use a particular login name by specifying a called-login in sys. A sample system entry may look like this:

system          pablo
... usual options ...
called-login    Upablo

The upshot is that whenever a system logs in and pretends it is pablo, uucico checks whether it has logged in as Upablo. If it hasn't, the calling system is turned down, and the connection is dropped. You should make it a habit to add the called-login command to every system entry you add to your sys file. It is important that you do this for all systems in your sys file, regardless of whether they will ever call your site or not. For those sites that never call you, you should probably set called-login to some totally bogus user name, such as neverlogsin.

Be Paranoid: Call Sequence Checks

Another way to fend off and detect impostors is to use call sequence checks. These help you protect against intruders who somehow manage to find out the password with which you log into your UUCP system.

When using call sequence checks, both machines keep track of the number of connections established so far. The counter is incremented with each connection. After logging in, the caller sends its call sequence number, and the receiver checks it against its own number. If they don't match, the connection attempt is rejected. If the initial number is chosen at random, attackers will have a hard time guessing the correct call sequence number.

But call sequence checks do more for you. Even if some very clever person should detect your call sequence number as well as your password, you will find out. When the attacker calls your UUCP feed and steals your mail, this will increase the feeds call sequence number by one. The next time you call your feed and try to log in, the remote uucico will refuse you, because the numbers don't match anymore!