- NANOG - lists.nanog.org

Fw: Administrivia: ORBS
by Sehmel, William C. 19 Jan '00

19 Jan '00

Got this from bugtraq. Bill Sehmel Peninsula School District Information Services Jr. Network Engineer. 253-857-8180 bsehmel(a)mail.peninsiula.wednet.edu -----Original Message----- From: Elias Levy <aleph1(a)SECURITYFOCUS.COM> To: BUGTRAQ(a)SECURITYFOCUS.COM <BUGTRAQ(a)SECURITYFOCUS.COM> Date: Wednesday, January 12, 2000 1:48 PM Subject: Administrivia: ORBS >It seems the folks at ORBS (orbs.org) have decided that since our mail >server its hosted of above.net, and above.net is filtering their >probes since they claim they are a DoS, ORBS is adding any mail servers >connected via above.net (including ours) to their spam relaying list, >regardless that our servers have never perform relaying functions. >I've emailed them but so far they have not responded. You may wish >to email them (orbs(a)orbs.org) and voice your dissatisfaction. >Of curse if our email to you is being blocked by ORBS then you will >probably not receive this message ;-) > >-- >Elias Levy >Security Focus >http://www.securityfocus.com/

22 61

Re: Fw: Administrivia: ORBS
by Martin Cooper 19 Jan '00

19 Jan '00

woods(a)most.weird.com (Greg A. Woods) wrote: > [ On , January 15, 2000 at 22:24:53 (-0800), Paul Vixie wrote: ] > > Subject: Re: Fw: Administrivia: ORBS > > > > So, Greg, have you stopped beating your wife? (Never mind.) > > Oh, boy, you were being a real asshole the other day.... > > I'll have you know that I didn't see this until today because I've been > in the hospital caring for my wife who fell and broke her ankle very > badly the other day. > > If I were an American I'd have your ass in court. But I'm not a > slandering inconsiderate bastard. Oh dear - I think you've misunderstood. "Have you stopped beating your wife?" is irony - the point being that you can't answer "Yes" or "No" without logically acknowledging that you have at some point beaten your wife, even if you haven't. You seem to want people to accept that imposing your will on other people without asking (allegory: "beating your wife") is ok in one context (ORBS scanning people's mail servers without asking), but not in another (spammers using people's mail relays without asking). The "I don't want anyone imposing their will on me without asking." option doesn't exist in your argument, just as the "I've never beaten my wife." option didn't exist in Paul's question. M.

2 1

Re: Fw: Administrivia: ORBS
by Paul Vixie 19 Jan '00

19 Jan '00

Just hit D now. Move along. There's nothing to see. I warned you. > So far AboveNet hasn't denied that there are/were open relays on "their" > networks either, at least not to my knowledge. Well, if they didn't deny it, then it MUST be true. Q.E.D. > All we know now is that > ORBS can no longer be used to prove that there are none remaining. So, Greg, have you stopped beating your wife? (Never mind.) > ORBS also maintains that they do not, nor have they ever, systematically > and preemptively scanned any networks. They also actively discourage > users of their web interface from doing such scanning and I've heard > second hand that they do in fact cut off access to the web interface > by anyone attempting such scans. Your second hand information differs significantly from mine. > Eg. even though my own network is assigned from a UUNET block, I am the > only one who owns the rights to receive packets at my IP addresses, or > indeed the right to block such packets (to the extent that packets to or > from my network don't cause some transit provider grief in the form of a > denial of service attack or such). You're assuming that packets with your IP address on either end of them are sacred in some way and have the right to pass unmolested on any wire no matter who pays for that wire or what their preferences are. I find that reasoning strikingly similar to what spammers say about THEIR traffic, and I'm starting to wonder why you are defending the efforts of an anti-spam organization (ORBS) if your ethical sympathies are all completely compatible with "theft of service"? > ... -- it should only be AboveNet's customers who have any > right to refuse service to anyone, not AboveNet themselves. So your provider ought not do anything about smurf attacks forged in your name, either? > That's certainly what I expect of my provider. I'm very happy that you have a choice of providers, and that you can find one who will sell you the kind of service you want. It sounds, though, as if you're not quite as happy that I have the same choice, or that I exercise it differently than you exercise yours. Why is that? > Your absolutely right on that > last point though -- AboveNet's customers can decide with their feet. > It won't be an easy decision though as in all other aspects AboveNet > seems to be a premium service. Gee, I wonder if there's a connection between this aspect and all others, or if the premium aspect is merely accidental or in spite of the blocking aspect? (HINT! That's a rhetorial question, the answer being "yes, there is a connection.") > > They are looking for port 25 on all addresses within /16'. You call it > > what you want, I'll call it a port scanner. > > Are they really? Can you prove it? ORBS and MAPS have a mutual nonaggression pact, which I'm skating near the edge of by entering this discussion at all. No, I won't be "proving it." -- Paul Vixie <vixie(a)mibh.net> >> But what *IS* the internet? > It's the largest equivalence class in the reflexive transitive > symmetric closure of the relationship "can be reached by an IP > packet from". --Seth Breidbart

4 3

Problems in Seattle/Northwest
by Sean Donelan 19 Jan '00

19 Jan '00

The northwest and seattle appear to be having a variety of problems. This weekend several people were killed in storms and downed power lines serving some 300,000 customers. Besides those problems, I've also noticed ongoing internet problems in the Northwest area since the weekend. It seemed concentrated to Sprint and UUNET, but I've had problems reaching sites in the Northwest with several providers sporadically. This is the first news story I've seen on the subject. http://www.seattlep-i.com/local/smrf18.shtml

1 0

Re: Fw: Administrivia: ORBS
by Paul Vixie 19 Jan '00

19 Jan '00

> Perhaps AboveNet would openly submit to testing by someone independent > of ORBS who would agree not to release the detailed results (except to > AboveNet) but who would check the validity of ORBS claims and provide a > summary report. ORBS would of course have to be allowed to review the > validity of the tests done. ORBS has made no claims that there are open relays inside Abovenet. They are preemptively scanning Abovenet's address space IN CASE THERE ARE ANY relays, either belonging to Abovenet, or belonging to an Abovenet customer. > In this case AboveNet is a transport provider and in my opinion they're > risking their status as a network carrier to be filtering in they way > they are. (Not that I know anything about carrier rights! :-). Right, like you said, YANAL. Abovenet also runs the MAPS RBL in BGP mode, and this hasn't hurt their status that I can tell from here. > Your own filtering of your own network when your own hosts are involved > is a much different scenario. It *is* Abovenet's own network. They sell transit to other people via their own network, but that doesn't change the ownership of Abovenet's network to somehow not include Abovenet. If you think Abovenet doesn't have the right to refuse service to anyone, then your property ethics are the same as any spammer's. And if Abovenet loses customers because they don't allow ORBS to probe them, then that's a matter for Abovenet's customers to decide. (MIBH uses the old Partan/Doran "maximum prefix length" filters on our BGP input side, which means we can't reach various nets who break up a /20 into a lot of discontiguous /24's each singly homed by a different transit provider. Do we, also, risk "losing our carrier status" because we exercise control over what routes and what traffic we carry?) > Finally can we please stop using the incorrect term "port scanner" here? > ORBS does not "scan" and it most certainly doesn't scan arbitrary ports. They are looking for port 25 on all addresses within /16'. You call it what you want, I'll call it a port scanner. -- Paul Vixie <vixie(a)mibh.net> >> But what *IS* the internet? > It's the largest equivalence class in the reflexive transitive > symmetric closure of the relationship "can be reached by an IP > packet from". --Seth Breidbart

4 4

Take Advantage .....
by kkgjfj6uur3d＠aol.com 18 Jan '00

18 Jan '00

INTERNATIONAL DRIVER'S LICENSE Need a new driver's license? Too many points or other trouble? Want a license that can never be suspended or revoked? Want ID for nightclubs or hotel check-in? Avoid tickets, fines, and mandatory driver's education. Protect your privacy, and hide your identity. The United Nations gave you the privilege to drive freely throughout the world! (Convention on International Road Traffic of September 19, 1949 & World Court Decision, The Hague, Netherlands, January 21, 1958) Take advantage of your rights. Order a valid International Driver's License that can never be suspended or revoked. Confidentiality assured. CALL NOW!!! 1-937-586-9313 rem- nypd55(a)angelfire.com

1 0

Re: Fw: Administrivia: ORBS
by Michael Shields 18 Jan '00

18 Jan '00

In article <Pine.LNX.4.10.10001152253220.17784-100000(a)pimlico.magmom.net>, Patrick Evans <pre(a)pre.org> wrote: > The only thing we can do which allows all of our customers to send > mail out with their address as the From: header, and not force them to > use our dialup service (if we had one) is to run a completely open > relay. I don't understand why you ca'n't allow relaying only for people with an envelope sender that has one of your customer's domains. -- Shields.

3 2

Re: ICMP rate limiting on EGRESS (Warning, operational contentinside)
by Paul Ferguson 18 Jan '00

18 Jan '00

At 11:26 AM 01/18/2000 +1030, Glen Turner wrote: > > This is the principle reason to encourage everyone to implement > > RFC2267-style filtering. :-/ > >It would be nice if this shipped "on" by default in a particular >major vendor's products. This would at least take care of the >clueless majority, and would force all ISPs to address the issue. > >It is only the router vendors and routing code authors that can >*force* source address checking throughout the Internet. Most >users will simply install it during a normal software update. Well, we don't _force_ anyone to use amything, but we do have a little knob called "Unicast RPF". I'll leave it to the rest of the of the readership to discuss it's merits (or perhaps move the dicussion to the cisco-nsp list instead). Cheers, - paul

1 0

Need @home and Mae-West Help
by Derrick Bennett 18 Jan '00

18 Jan '00

First my appologies to the list. I hate to reach people this way but the truth is it works very well. I need someone from @home or @work's NOC or management staff to contact me off list ASAP. My attempts to escalate an issue via tickets has failed and most of my contacts voicemail boxes are full. There is a peering point congestion problem at Mae-West that is killing bandwidth during peak times and we have not been able to get any resolution to the issue. Thank you. Sincerely, Derrick Bennett

2 1

Re: Fw: Administrivia: ORBS
by Brian Dickson 18 Jan '00

18 Jan '00

> > These days I've been unable to find any justifiable need for an > > unprotected relay of any sort whatsoever. > > We do domain hosting and mail redirection (among other things), but we > don't do dialup. [...] When they want to send mail out, > they have to do it through their IAP's mail server. As much as it's a small hassle, any user stuck behind a horrible IAP, what about setting the SMTP to the *recipient's* MX host. Since this would be local delivery, would it not be accepted, regardless of source? (The hassle is, of course, changing SMTP for each receipient domain...) > POP before SMTP is a crufty hack, IMNSHO, and SMTP auth isn't > implemented to enough of an extent that I'd be comfortable running it. It is crufty, and also crafty. A horrible, but most importantly, effective, kludge. Nearly everyone I've talked to eventually came up with this. It's not the only solution, however, to your particular requirement. Assuming your SMTP gateway is suitably configurable (eg some variant of sendmail or some equally extensible package), you could easily enough set up special rules, on a relay-only box: Call the box "relay.yourdomain.com". Users who use it, configure their outgoing id as "user.name.with.dots.cryptpw(a)hosted-domain.com". Your ruleset for relay, is to strip the ".cryptpw", do RADIUS-auth on the result with the encrypted password. Iff it passes, relay the mail. (You want it to be used only for this purpose, and only with this mechanism, for greatest likelyhood of avoiding screw-ups.) A simple web interface, with password protection, can give out the cryptpw value, or any other "cookie"-type equivalent. Since your box, relay.yourdomain.com is the SMTP, and rewrites the headers, the "cryptpw" value isn't stored anywhere, and except for routers and any sniffers on broadcast domains (Ethernet or FDDI hubs), nothing will see the packets with this magic value - which is user-specific, to boot. > Anyone who says there's absolutely no reason to run an open relay is > talking absolute codswallop - as with every situation like this it > requires a reasoned political decision at the site in question. Open, in this case, is absolute, but there is no absolute closed, only various shades of grey. Any political decision, if made by a reasoning entity, has some chance of being trumped by an adequate technical solution. The only question is what the technical solution costs. I've given it for free; if you use it, please attribute it to me. :-) > We don't use ORBS, either - Alex Rudnev has it spot on, to my mind. MAPS has both the RBL and RSS - both reasonable alternatives to ORBS. Highly recommended. -- Brian Dickson, Email: briand(a)teleglobe.net Director, Backbone Engineering Tel : +1 703 755 2056 Teleglobe Communications Corp., Fax : +1 703 755 2648 Rm 3214, 11480 Commerce Park Drive, Cell : +1 703 851 9053 Reston, Virginia, USA, 20191 http://www.teleglobe.com

2 1