15.5.1 Permissions File

The Permissions file consists of commands, possibly multi-line, and often separated by blank lines, that are used to determine what users and remote machines can and cannot do with the UUCP system.

Here is a sample Permissions file. For now, don't worry about what all the commands mean: we'll explain them shortly.

LOGNAME=Ugarp READ=/usr/spool/uucppublic WRITE=/usr/spool/uucppublic MACHINE=garp READ=/usr/spool/uucppublic WRITE=/usr/spool/uucppublic

15.5.2 Permissions Commands

BNU UUCP has 13 different commands that can be included in the Permissions file. These commands help provide the flexibility that BNU allows over UUCP connections. These commands are placed in the same command block as the MACHINE= and LOGNAME= commands described above. You can specify as many commands in a block as you wish.

A MACHINE= entry in the Permissions file is used when a specific remote site is contacted by the local computer. Specify a MACHINE= OTHER entry to define a Permissions entry for any machine that is not explicitly referenced.

For example:

# Setup for when we call garp MACHINE=garp

LOGNAME= is used when a remote site logs in with a specific login name. Each UUCP login name should appear in only one LOGNAME entry.

For example:

# Setup login for when garp calls LOGNAME=Ugarp 

You can specify a LOGNAME=OTHER entry to define a Permissions entry for any machine that is not explicitly referenced.

For example:

# Setup login for everybody else LOGNAME=OTHER

REQUEST= specifies whether the remote system can request file transfers with your computer. The default is "no," which means that files can be transferred only if the uucp command is issued on your computer.

For example:

# Let garp request files MACHINE=garp LOGNAME=Ugarp REQUEST=YES

SENDFILES= specifies whether files that are queued on the local system should be sent to the calling system when it contacts the local system. The default is "call," which means "no, don't send any queued files when the other computer calls me; hold the files until I call the other computer." The reason for this option is that you are more sure of the identity of a remote computer when you call it than when it calls you . If you set this entry to "yes," all of the queued files will be sent whenever the remote system calls you, or when you call it, whichever happens first. This option makes sense only with the LOGNAME entries. If this option is used with a MACHINE entry, it is ignored.

For example:

# Send files to garp when it calls us LOGNAME=Ugarp SENDFILES=YES

PUBDIR= allows you to specify directories for public access. The default is /usr/spool/uucppublic.

For example:

# Let garp use two public directories MACHINE=garp LOGNAME=Ugarp READ=/ WRITE=/ \ PUBDIR=/usr/spool/uucppublic:/usr/spool/garp

READ= and WRITE= specify the directories that uucico can use to read from or write to. The default is the PUBDIR .

You can specify access to all of the temporary directories on your system with the following command:

# Let garp read lots MACHINE=garp LOGNAME=Ugarp \ READ=/usr/spool/uucppublic:/tmp:/usr/tmp \ WRITE=/usr/spool/uucppublic:/tmp:/usr/tmp

You can let garp access every file on your system with the command:

# Let garp read even more MACHINE=garp LOGNAME=Ugarp \ READ=/ WRITE=/

We don't recommend this!

NOREAD= and NOWRITE= specify directories that uucico may not read to or write from, even if those directories are included in a READ or a WRITE command. You might want to use the NOREAD and NOWRITE directives to exclude directories like /etc and /usr/lib/uucp , so that there is no way that people on machines connected to yours via UUCP can read files like /etc/passwd and / usr/lib/uucp/Systems .

For example:

MACHINE=garp LOGNAME=Ugarp \ READ=/ \ WRITE=/usr/spool/uucppublic:/tmp:/usr/tmp \ NOREAD=/etc:/usr/lib/uucp \ NOWRITE=/etc:/usr/lib/uucp

CALLBACK= specifies whether or not the local system must call back the calling system before file transfer can occur. The default is "no." CALLBACK enhances security in some environments. Normally, it is possible with UUCP for one machine to masquerade as another. If you call a remote machine, however, it is unlikely that such a masquerade is taking place. CALLBACK is also useful for situations where one computer is equipped with a low-cost, long-distance telephone line, so that the majority of the call will be billed at the lower rate. The CALLBACK command makes sense only for LOGNAME entries. If two sites have CALLBACK=yes specified for each other, the machines will continually call back and forth, but no data will be transferred.

For example:

# We'll call garp LOGNAME=Ugarp CALLBACK=YES

For further information, see our comments on callback in Chapter 14 .

COMMANDS= specifies commands that the remote system can execute on the local computer. When uuxqt executes a command, it searches the Permissions file for the MACHINE= entry associated with the particular system from which the commands were sent. The MACHINE= entry is the one that is used, even if the uucico connection was originated by the remote machine and a different LOGNAME= entry is being used.

The default value for COMMANDS is compiled into your version of uuxqt ; if you have source code, it is defined in the file params.h . The COMMANDS= entry often has the single form:

COMMANDS=rmail

You can specify a full pathname:

COMMANDS=rmail:/usr/bin/rnews:/usr/ucb/lpr

You can specify the value ALL , which allows any command to be executed:

COMMANDS=ALL

You probably don't want to specify ALL unless you have complete control over all of the machines that you connect to with UUCP .

For example:

# Let garp send us mail, netnews, and print files MACHINE=garp LOGNAME=Ugarp \ COMMANDS=rmail:rnews:lpr

VALIDATE= is used with a LOGNAME entry to provide a small additional degree of security. Specifying a machine name (or many machine names) in the VALIDATE= entry will allow that UUCP login to be used only by those machines.

For example:

# Let's be sure about garp LOGNAME=Ugarp VALIDATE=garp 

This command prevents any UUCP computer other than garp from using the Ugarp login. Of course, anybody interested in using UUCP to break into your computer could as easily change their UUCP name to be garp , so this command really doesn't provide very much security.

MYNAME= can be used to change the UUCP name of your computer when it initiates a UUCP connection. This command is useful for testing. It is also helpful when you use a generic name for your site, but it is not the same as your UUCP machine. For example:

# When we call garp, present ourselves as bigcorp MACHINE=garp \ MYNAME=bigcorp

Got that? You can make your computer have any UUCP name that you want! Anybody else can do this as well, so be careful if you let any machine execute commands (specified in the COMMANDS= entry) that might be considered potentially unsafe (e.g., rm , shutdown ).

NOTE: If you wish to run a secure system, the directory /usr/lib/uucp (or /etc/uucp ) must not be in the WRITE directory list (or it must be in the NOWRITE list)! If users from the outside are allowed to transfer into these directories, they can change the Permissions file to allow them to execute any command that they wish. Similarly, local users can use the uucp command to change these files, and then subvert UUCP . Giving all access from the / directory is also dangerous - as such, people outside your organization can subvert your system easily. Furthermore, the home directory for the uucp user should not be in the / usr/spool/uucp/uucppublic directory, or in any other directory that can be written to by a uucp user. Doing so allows an outside user to subvert the system.

15.5.3 uucheck: Checking Your Permissions File

Verifying the Permissions file can be tricky. To help with this important task, BNU includes a program called uucheck that does it for you.

Normally, the uucheck program only reports security problems. However, it has a -v option which causes the program to produce a full report.

Below is a sample Permissions file that lets the computer garp (or anybody using the UUCP login Ugarp ) access a variety of files and execute a number of commands:

# cat Permissions MACHINE=garp LOGNAME=Ugarp \ COMMANDS=rmail:rnews:uucp \ READ=/usr/spool/uucppublic:/usr/tmp \ WRITE=/usr/spool/uucppublic:/usr/tmp \ SENDFILES=yes REQUEST=no

Here is the output from the uucheck program run with the above Permissions file: