Q How can we prevent spammers from using our intranet's Simple Mail Transfer Protocol gateway, which is running sendmail, to propogate junk e-mail?

A In the simplest case, the spammers are using your gateway as a smart relay host. Turning off the relay host functionality is a matter of editing your sendmail configuration file. Specifics depend on which version of the program you're running. More sophisticated e-mail spoofing is harder to stop. One method is to use one mail gateway inside the firewall for processing outbound mail sent from your domain and one gateway outside the firewall that will only accept and deliver mail destined for your internal domain. Configure the inside machine to accept only mail originating from the internal domain. In particular, the machine should deny SMTP connections from your external mail gateway to prevent spamming. Unfortunately, there are still ways these folks can generate spam that looks as if it has come from your domain. While server certificates and digital signatures can add security, the problem of keeping your domain name out of the "From: line'' of junk e-mail sent by a dedicated antagonist is like trying to stop someone from writing your return address on a piece of mail and dropping it in a mailbox.

FrontPage follow-up

In my December 1997 column, I said security permissions are inherited from the root web and cannot be assigned independently for each child web when using Microsoft Corp.'s FrontPage.

But Pam Edwards, Web administrator at Wheat First Butcher Singer, Inc., of Richmond, Va., says: "An option under Tools, Permissions, lets you change the permission structure - you can choose 'Use same permissions as root web' or 'Use unique permissions for this web.' This option only appears when you have the child web open.

"By changing this option, you are allowed to set security permissions that are independent of the root web.

"It's a simple process that doesn't require additional ports or editing of files. And it works: No associate can edit another's child web, and no associate who is not a member of an authoring group can edit anything."

Blass is a network architect at Houston-based Sprint Paranet, a distributed computing systems services provider.