Digital Man wrote to Bill McGarrity <=-
Re: src/sbbs3/rechocfg.c sbbsecho.c sbbsecho.h
By: Bill McGarrity to rswindell on Mon May 09 2016 12:48 pm
Re: src/sbbs3/rechocfg.c sbbsecho.c sbbsecho.h
By: rswindell to CVS commit on Mon May 09 2016 02:28:44
Hiya Rob...
Modified Files: rechocfg.c sbbsecho.c sbbsecho.h Log Message: Introduced sbbsecho.ini advanced setting (not yet exposed in
echocfg): StrictPacketPasswords (default is "true"). If you want SBBSecho v3 to behave like SBBSecho v2 with regards to packet
passwords for linked-nodes with *no* configured packet password, set this value to "true" in your sbbsecho.ini file. I don't recommend
doing this if you care about the "security" of your echomail, but
some sysops have been bitten by the strict enforcement of the configured password in SBBSecho v3.
Just so I get this straight... if we want to accept the new feature in sbbsecho for strict pkt passwords protection then toggle this to "false". Correct??
No, strict is the default behavior of SBBSecho v3. It was the *only* behavior of SBBSecho v3 before this morning, but apparently there's
some confused FidoNet sysops out there sending out password-protected packets and not realizing it. So this little option will allow you to
use the old, less-secure, SBBSecho v2 method of password packet validation:
If StrictPacketPasswords = true (the default), then the password in the packet must match whatever you (the receiving end) has configured in
your sbbsecho.ini for the linked node. Just as it was in the initial SBBSecho v3 commits to CVS.
If StrictPacketPasswords = false, then the password in the packet is
only compared if the linked node has a password set in your (the
receiving end's) sbbsecho.ini file. I don't recommend using this mode
if you care about echomail security.
Digital Man wrote to Bill McGarrity <=-
Re: src/sbbs3/rechocfg.c sbbsecho.c sbbsecho.h
By: Bill McGarrity to rswindell on Mon May 09 2016 12:48 pm
Re: src/sbbs3/rechocfg.c sbbsecho.c sbbsecho.h
By: rswindell to CVS commit on Mon May 09 2016 02:28:44
Hiya Rob...
Modified Files: rechocfg.c sbbsecho.c sbbsecho.h Log Message: Introduced sbbsecho.ini advanced setting (not yet exposed in
echocfg): StrictPacketPasswords (default is "true"). If you want SBBSecho v3 to behave like SBBSecho v2 with regards to packet passwords for linked-nodes with *no* configured packet password, set this value to "true" in your sbbsecho.ini file. I don't recommend doing this if you care about the "security" of your echomail, but some sysops have been bitten by the strict enforcement of the configured password in SBBSecho v3.
Just so I get this straight... if we want to accept the new feature in sbbsecho for strict pkt passwords protection then toggle this to "false". Correct??
No, strict is the default behavior of SBBSecho v3. It was the *only* behavior of SBBSecho v3 before this morning, but apparently there's some confused FidoNet sysops out there sending out password-protected packets and not realizing it. So this little option will allow you to use the old, less-secure, SBBSecho v2 method of password packet validation:
If StrictPacketPasswords = true (the default), then the password in the packet must match whatever you (the receiving end) has configured in your sbbsecho.ini for the linked node. Just as it was in the initial SBBSecho v3 commits to CVS.
If StrictPacketPasswords = false, then the password in the packet is only compared if the linked node has a password set in your (the receiving end's) sbbsecho.ini file. I don't recommend using this mode if you care about echomail security.
Thank you for the clarification. When I first read your explanation above it seemed it was reverse logic. I just wanted to make sure before I processed it.
Digital Man wrote to Bill McGarrity <=-
Re: Re: src/sbbs3/rechocfg.c sbbsecho.c sbbsecho.h
By: Bill McGarrity to Digital Man on Tue May 10 2016 12:22 am
If StrictPacketPasswords = true (the default), then the password in the packet must match whatever you (the receiving end) has configured in your sbbsecho.ini for the linked node. Just as it was in the initial SBBSecho v3 commits to CVS.
If StrictPacketPasswords = false, then the password in the packet is only compared if the linked node has a password set in your (the receiving end's) sbbsecho.ini file. I don't recommend using this mode if you care about echomail security.
Thank you for the clarification. When I first read your explanation above it seemed it was reverse logic. I just wanted to make sure before I processed it.
Yes, I mistyped my CVS commit message. That should have said:
Introduced sbbsecho.ini advanced setting (not yet exposed in echocfg): StrictPacketPasswords (default is "true").
If you want SBBSecho v3 to behave like SBBSecho v2 with regards to
packet passwords for linked-nodes with *no* configured packet password, set this value to "false" in your sbbsecho.ini file.
I didn't catch that until just re-reading in your quoted text. Oops.
| Sysop: | Nelgin |
|---|---|
| Location: | Plano, TX |
| Users: | 576 |
| Nodes: | 10 (1 / 9) |
| Uptime: | 142:07:13 |
| Calls: | 9,268 |
| Calls today: | 7 |
| Files: | 16,004 |
| D/L today: |
1 files (4K bytes) |
| Messages: | 1,043,608 |