Subject: Why not #define OUTBOUND_NETWORK?

From: Andrew Wilson <[email-masked]>
Date: Sun, 25 Oct 1992 06:07:55 -0800

Hi,

	in options.h of the 1.7 server release we see:

 * Define OUTBOUND_NETWORK to enable the built-in MOO function
 * open_network_connection(), which allows (only) wizard-owned MOO code to make
 * outbound network connections from the server.
 * *** THINK VERY HARD BEFORE ENABLING THIS FUNCTION ***
 * In some contexts, this could represent a serious breach of security.  By
 * default, the open_network_connection() function is disabled, always raising
 * E_PERM when called.

	For the benefit of those not in the know (including me, I'm ashamed
to say), and more specifically to allay the concerns of my system boss,
could someone please say which 'contexts' really could 'represent a serious
breach of security'.
	Your answer may be sent in a plain brown wrapper (email) to avoid
insult to the 'morally challenged'.

Thanks,

  Andrew Wilson (Networker - proud to be a part of the 'social experiment')

---

From: Pavel Curtis <[email-masked]>
Date: Sun, 25 Oct 1992 14:49:08 -0800

> Date:	Sun, 25 Oct 1992 06:07:55 -0800
> From:	Andrew Wilson <[email-masked]>
> 

We do not #define OUTBOUND_NETWORK on LambdaMOO itself, for example, because
lambda.parc.xerox.com is directly connected to an internal network within
Xerox.  Packets only reach lambda from the outside because of a special
dispensation in our boundary routers; most outside packets are simply dropped.
Were we to allow arbitrary outbound connections from lambda, that would allow
people outside of Xerox to connect to other machines inside of Xerox,
compromising their security assumptions.

This is the kind of context I had in mind when I wrote that comment.

	Pavel

---

From: Judy Anderson <[email-masked]>
Date: Sun, 25 Oct 1992 17:01:00 -0800

Using slightly plainer english than Pavel, if your computer already
allows incoming network connections from the outside world for telnet,
FTP, etc., then you won't incur any additional risk by allowing
open_network_connection.  NFS is done with UDP, not TCP, so it's not a
risk.

---

From: Roger Crew <[email-masked]>
Date: Sun, 25 Oct 1992 17:23:30 -0800

>   open_network_connection.  NFS is done with UDP, not TCP, so it's not a

Actually, there are still some (minor) risks.  If you enable outbound
connections and your MOO's internal security fails somehow (e.g.,
someone cracks a wizard bit -- keep in mind that this happens
occasionally), then what you have, effectively, is a way for some
random person on the network to use your machine to initiate any kind
of TCP connection he wants that your machine is able to do.  And there are 
services out there that might be relying on your machine to have done
some sort of authentication before initating such a connection.

Consider, e.g., someone using open_network_connection() to port 25 to
forge email.  It would be traceable only as far back as your machine
(unless there are records internal to the MOO, though if someone's
cracked a wizard bit, you might not be able to trust these)

--
Roger Crew
Internet:   [email-masked]
LambdaMOO:  Rog