Python-SMTP-UNIX

You will implement in Python some email exchange applications that supports the SMTP-CRAM protocol. This includes a client, a server and an eavesdropper (middle-man

attacker), which can apply MitM attack to the authentication mechanism. Unix tools like netcat and telnet can help test your program.

To limit the workload, we provide a simplification on the original SMTP and SMTP-CRAM protocols. We assume all programs are supposed to be run and tested locally and they are not required to be extensible to support TCP connection via the Internet or to be used in real world. No actual data should be sent and received from the Internet, and everything should be contained in the local loopback. We also assume any syntactically valid message under the protocol can be accepted. E.g., No actual check is needed on any email or IP address, we accept any syntactically valid messages including addresses.

The communication between the email exchange applications has to follow a popular protocol for email exchanging, the Simple Mail Transfer Protocol ( SMTP ) protocol with one authentication extension ( CRAM-MD5 ), the SMTP Service Extension for Authentication by Challenge-Response Authentication Mechanism. The authentication type associated is called CRAM-MD5 and the full protocol is named SMTP-CRAM .

The communication between the email exchange applications has to follow a popular protocol for email exchanging, the Simple Mail Transfer Protocol ( SMTP ) protocol with one authentication extension ( CRAM-MD5 ), the SMTP Service Extension for Authentication by Challenge-Response Authentication Mechanism. The authentication type associated is called CRAM-MD5 and the full protocol is named SMTP-CRAM .

However, CRAM-MD5 only allows the server to verify the client and doesn't provide any server authentication, therefore its usage is limited and less preferable than other stronger mechanisms. To demonstrate CRAM-MD5 indeed has its weakness, the eavesdropper should be implemented and a MitM attack can be performed.

On the high level, the following needs to be implemented: All programs are capable of:

Log all socket transactions in a specific format and output to stdout . The SMTP-CRAM server is capable of:

i. Prepare for any incoming client connection.

ii. Receive emails from a client and save to disk.

iii. Additionally, allow client authentication.

iv. Allow multiple clients to connect simultaneously.

v. Termination upon receiving a SIGINT signal.

The SMTP-CRAM client is capable of:

i. Read mail messages on disk.

ii. Send emails to the server.

iii. Additionally, allow client authentication.

iv. Termination after finishing sending all emails.

The SMTP-CRAM eavesdropper (middle-man attacker) can do active eavesdropping between a pair of given server (E.g.,the real server) and client (E.g.,the real client). It can intercept all socket messages passing between the real server and the real client without being discovered. You can think of the eavesdropper as a combination of one valid client and one valid server, in such way it can impersonate the real client without letting the real server to discover its eavesdropping. This means it is capable of:

i. Prepare for being connected to by the real client and connecting to the real server.

ii. Capture the email sent by the real client and save to disk, without altering the content.

iii. iii. Additionally, comprise any client authentication.

iv. iv. Termination.

The assignment has four tasks that you will need to implement and thoroughly test. You will be provided a test suite to assist in developing your solutions.

The four tasks are:

1. Implement a client that supports the SMTP-CRAM protocol.

2. Implement a server that supports the SMTP-CRAM protocol.

3. Implement an eavesdropper (middle-man attacker) that secretly relays the communications between the client and the server that supports the SMTP-CRAM protocol.

4. Write a report in your own words on the SMTP-CRAM protocol.

Java Linux Python SMTP Arhitectură software

ID Proiect: #36263139

Detalii despre proiect