- NANOG - lists.nanog.org

Re: Selection of Appropriate Local SMTP Relay
by J.D. Falk 11 Jan '00

11 Jan '00

On 01/10/00, Daniel Senie <dts(a)senie.com> wrote: > There exists a DHCP option for specifying the SMTP server for a client > to use (option 69). This could be used in the case of DSL and cable > modems, but I'm unaware of anyone actually using it. I also haven't seen > anything to lead me to believe mail client applications have any way to > get this from the local system should the value be negotiated. Yes, I was about to post this as well. In fact, DHCP has all sorts of room for specifying things like this...but we have yet to see 'em implemented anywhere. The days of upgrading the entire Internet within six months are long, long past. ---------========== J.D. Falk <jdfalk(a)cybernothing.org> =========--------- | "UNIX is the answer, | | but only if you phrase the question very carefully." | | -- Jonathan H N Chin | ----========== http://www.cybernothing.org/jdfalk/home.html ==========----

1 0

Re: Selection of Appropriate Local SMTP Relay
by Joe Abley 11 Jan '00

11 Jan '00

On Mon, Jan 10, 2000 at 09:01:49AM -0500, John R. Levine wrote: > >Selection of Appropriate Local SMTP relAy (SALSA :) > > > An alternative is to provide a method for a mail client to discover a > > suitable local smart relay in some dynamic fashion. This requires some > > ubiquitous, global, standard database which every operator uses... > > ... like the DNS. > > That's much too complicated. What we need are some well-known IP > addresses, analogous to well-known ports, that are not routable on the > global Internet, but that are assigned to standard services within > each network, e.g.: I think that both approaches have some merit, and neither are without complication. For example, the overloaded well-known-address approach might lead to operational confusion in the event that a temporary ISP doesn't provide the well-known service to a roaming user: + outbound packets from the user might spiral off into the default free zone, ultimately never connecting to anything + connection requests might follow the temporary ISP's default out to their transit provider who _does_ support the address, and that relay (correctly) refuses to relay for the user + the real identity of the well-known relay box that a given user connects to might change with time, making it harder to support the user This is going to provide operational confusion, I think. In this respect, at least, the MX idea works more cleanly in the event that there are _no_ MX records to be found. Interesting idea, though; thanks for mentioning it. It seems from some of the mail I have received that there is some interest in this idea. Rather than cluttering up NANOG any further, I'll take it to the roamops wg list at roamops(a)tdmx.rutgers.edu. Joe

1 0

Re: Selection of Appropriate Local SMTP Relay
by darcy＠druid.net 10 Jan '00

10 Jan '00

Thus spake John R. Levine > That's much too complicated. What we need are some well-known IP > addresses, analogous to well-known ports, that are not routable on the > global Internet, but that are assigned to standard services within > each network, e.g.: > > 10.255.255.1 - DNS server > 10.255.255.2 - SMTP server > 10.255.255.3 - SOCKS server > 10.255.255.4 - Web proxy > > (Probably it's not a good idea to use network 10 here, better to > reclaim a /24 from the swamp or allocate a fresh one.) > > Now you set up your mail client to use 10.255.255.2 for SMTP, and wherever > you're connected, it'll be the local SMTP server. > > >Advantages > > 0. Works with all existing mail clients, no code changes needed, just a > one-time configuration. Once this is widely accepted, MTAs would > ship with it as the factory default. > > Some people have suggested something similar with a well-known-service > pseudo-TLD that each network's DNS servers would serve up with the > appropriate values for that network, e.g. > > smtp.wks > socks.wks > webproxy.wks > > I like that less because, as previously noted, lots of people never > change their DNS config when they switch ISPs or roam, so they'd get > the info for the wrong network. Better to use IPs which you know will > be routed by the routers for the network to which you are actually > connected. Why not both? Instead of a private TLD, make a real one (wks.merit.edu?) and assign the numbers there. That way it doesn't matter who your DNS server is. -- D'Arcy J.M. Cain <darcy(a){druid|vex}.net> | Democracy is three wolves http://www.druid.net/darcy/ | and a sheep voting on +1 416 425 1212 (DoD#0082) (eNTP) | what's for dinner.

3 2

Re: Netgate.net.nz/ORBS spam colusion
by Dean Anderson 10 Jan '00

10 Jan '00

Around 11:59 AM 1/9/2000 +1100, rumor has it that Adrian J Close said: >On Sat, 8 Jan 2000, Dean Anderson wrote: > >> Umm, for the record, I do make such an accusation. When they probe a >> non-public government computer, they are violating 18 USC 1030 Sections >> 2(b), 2(c), and 3. Those are criminal violations. You simply may not > >These may be criminal violations of US law, but I'm pretty sure New >Zealand is a sovereign nation with its own government, laws and legal >system. I think you'll have some trouble convincing the NZ government to >allow the ORBS maintainer(s) to be extradited, especially seeing as the >"crime" was committed on NZ soil where it likely isn't illegal. I've already spoken with FBI about juridiction. FBI considers crimes against US computers to be US crimes, even when initiated from foriegn countries. They can extradite for this. That it originated from NZ isn't an issue. While the FBI agreed that these were indeed violations, my initial complaint was not prosecuted because we could at the time only come up with $900 in damages. We are closing on the $100K mark, where I'll make an updated complaint, which I hope will get more attention. >This is notionally pretty similar to what ORBS are doing in SMTP-relay >land, which is understandable if you subscribe to their assertion that >third-party relay is a "bad thing". If you need third party relay and >deal with spammers in other ways, then ORBS become pretty annoying. Of >course, you could always just ignore them... We do ignore them. They are pretty ineffective at causing any mail problems for us. Which is another good reason not to use them. However, they enable spammers to find relays. Particularly annoying to me is they enable spammers to find our relay. When ORBS was blocked from 11/24 to 12/15, our relay troubles stopped. Spammers can't relay without a list of relays. ORBS provides that list. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

4 3

Re: Netgate.net.nz/ORBS spam colusion
by Dean Anderson 10 Jan '00

10 Jan '00

Around 05:28 PM 1/8/2000 -0800, rumor has it that Owen DeLong said: > >Noone has disputed that relays are necessary. > >I am as yet unconvinced that open relays are necessary. Thats nonsensical. Clearly, if one is going to offer outsourced services for which relays are necessary, one must operate open relays. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

3 2

Re: Netgate.net.nz/ORBS spam colusion
by owen＠dixon.delong.sj.ca.us 10 Jan '00

10 Jan '00

> Around 05:28 PM 1/8/2000 -0800, rumor has it that Owen DeLong said: > > > >Noone has disputed that relays are necessary. > > > >I am as yet unconvinced that open relays are necessary. > > Thats nonsensical. Clearly, if one is going to offer outsourced services > for which relays are necessary, one must operate open relays. Hmmm... It's not clear to me. I offer outsourced services, for which relays are necessary, but my relays are restricted to my customers. Owen

1 0

Re: Spam, Law and Reality
by Charles E. Yow, Esq. 09 Jan '00

09 Jan '00

That is fantastic. ----- Original Message ----- From: John S. Quarterman <jsq(a)mids.org> To: Charles E. Yow, Esq. <CYow(a)GulfSouthY2k.com> Cc: <nanog(a)merit.edu> Sent: Sunday, January 09, 2000 4:40 PM Subject: Re: Spam, Law and Reality > >The spam issue is serous no doubt, but unless everyone understands the >implications of attempting to apply U.S. law to please understand some basic >concepts and reality. First the alleged violation has to be according to >the letter of the law that is being applied, exactly by the letter of the >law. Lets be very realistic, do we really want to seek to apply U.S. law to >those outside the U.S? If this is the case then the end result could be the >reverse, perhaps China would seek to apply Chinese law to American ISP's, >network administrators, the end result being Americans who have never been >to China being sentenced to life in prison or to death for posting matters >the Chinese Government considers offensive. The witch hunt I see to address >spamming is illogical and futile. Let me be very blunt, until someone is >willing to take action all this talk about dealing with spammers is nothing >more than saber rattling and is useless. I am an attorney in Massachusetts, >and my experience is people get upset about spam and without exception no >one is willing to follow through, I used to be willing to deal with spammers >pro bono, but having been burned more than enough times by people "getting >over it" that has passed. Talk is cheap. We sued and won, http://www.mids.org/nospam/ but the spammer in question was inside the U.S., and I certainly understand your point of view. John S. Quarterman <jsq(a)mids.org>

1 0

Re: Netgate.net.nz/ORBS spam colusion
by Dean Anderson 09 Jan '00

09 Jan '00

Around 08:14 AM 1/8/2000 -0800, rumor has it that Owen DeLong said: > > >However, I must question whether the activity Dean discusses is actually >criminal. He does not accuse them of carrying out the attacks, he >accuses them of transporting information published by a third party >which notifies the world that his site is vulnerable to these attacks. Umm, for the record, I do make such an accusation. When they probe a non-public government computer, they are violating 18 USC 1030 Sections 2(b), 2(c), and 3. Those are criminal violations. You simply may not probe government computers. Doing so is immediately a crime. The $5000 limit is only for non-government computers. Then they do other things, some of which are criminal (fraud is criminal), and some of which may not be. >Since Dean has published information to NANOG and other public forums >stating that: > 1. His sites _ARE_ vulnerable. My customer shell servers' telnet sessions are vulnerable to password theft, and password guessing. So are yours. So what? > 2. He has no willingness to fix these vulnerabilities. There isn't anyway to fix them. There may be a protocol extension in the future, but its not here yet. I've been through this with 50 people in the last 6 months. That doesn't permit others to exploit them. > 3. He intends to make the internet at large responsible > for his negligence WRT these sites. We have no negligence. And we do not hold the internet at large responsible. Just those that exploit protocol vulnerabilites, and those who assist with the exploitation. If your customer commits crimes, and you don't do anything about it after complaints are made, I expect that you bear responsibility and liability. >I seriously doubt that publishing a list of known public-nuissances >is genuinely illegal. Further, unless Dean has presented netgate >with a court-order showing that the court has indeed found said >activity to be illegal, I think they would be negligent in turning >off said service. So publishing a list of sites which have vulnerabilities detected by SATAN scans wouldn't be illegal? Thats what you are saying. As far as court orders go, the point of this discussion is to make sure we have exhausted all non-litiguous options. >How would you like it if your ISP shut you down because I >complained to them that you were sending out messages that >contained information that was publicly available, but which >I didn't want published? That's what Dean's really saying. No, its not what I'm saying. Would you object if I published a list of your servers which could be broken into, and said that it was OK with you to break into those systems? I think you would. But if you wouldn't mind, I'll be happy to have your permission to scan your net with SATAN and publish a web page for the script kiddies. What was that? You don't give me permission? I didn't think so. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

4 3

new routing registry!
by abha 09 Jan '00

09 Jan '00

Hello Routing Registry Fans... *grin* Just wanted to let you know that there is now a free registry for your use... altb.net... Check it out http://www.altdb.net. This is a best effort service provided through the courtesy of tch.org (Thanks, Steve Rubin!) This is service is provided for those of you who only have a couple of objects and want to avoid registration fees... (money is better spent on domain names, eh?) Just kidding... So, what does best effort mean? Well, the machine is monitored and we will be paged for problems. We'll also be doing our best to answer any questions and assist with registrations, although, if you don't know what you are doing, you are better off sticking with a "real" database. :) Anyway, the service is here... Its one of those "for the community, by the community" things... So, have fun. Be good. And let us know if you have any trouble with it... Steve and I can be reached at db-admin(a)altdb.net. Automatic submissions can be sent to auto-dbm(a)altdb.net. We are mirroring the RADB, and they are mirroring us... So, as I like to say, its all good... :) -abha ;) ps - please send all comments, complaints, suggestions and spam to /dev/null, i mean db-admin(a)tch.org. *grin* thanks.

1 0

Netgate.net.nz/ORBS spam colusion
by Dean Anderson 09 Jan '00

09 Jan '00

I would like to get your opinions on this. I have been in touch with Netgate.net.nz, which now transports ORBS illegal traffic into the US. ORBS (Alan Brown) has indicated on spam-l that ORBS has (illegally by 18 USC 1030 2(b), 2(c), and 3) scanned thousands of US government computers, and that the purpose of ORBS is to enable "script kiddies" to exploit sites that relay, thus inducing those sites not to operate relay services. ORBS' advertising of our site as free misuses our trademark. ORBS commits frauds on those who believe its false advertising and then subsequently use listed sites to relay without authorization. All this has been brought to the attention of Netgate.net.nz. Netgate is unwilling to block this traffic, which results in unauthorized relay attempts on ours and others services. Netgate claims it is a "US carrier" and is exempt from any responsibility for the behavior of it customers after complaints have been made about them. Our theory is basically that Netgate must react to complaints about violations of US law by its customers or find itself named a codefendant. It seems we have reached the limit of civil discusions. Before we start suing Netgate, and listing them as the responsible party on our next relay complaint (unauthorized use of computer of more than $5000), I'd like to air out some of our non-litiguous options before some other operators. So I'd like to propose the possibility that we should start probing New Zealand sites with SATAN, and publish site vulnerabilities on a web page, just like ORBS does. We would then deny responsibility for any resulting attacks on those sites by "script kiddies". Just like ORBS does. Of course, if this were actually done, I would expect we would then find ourselves blocked, and perhaps disconnected by our upstreams. I would tend to think that most other ISP's would find this kind of behavior unacceptable. I also tend to think that our upstreams should respond to such complaints and take action to stop this activity. But perhaps I'm wrong. I'd like to find out the reaction of various operators to such activity. I'm not seriously considering using SATAN this way, but I would like to hear how others would approach the problem posed by someone who did. I hope that will be helpful in forming our response to Netgate.net.nz. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

10 9