- NANOG - lists.nanog.org

Re: customer mail relay
by johnl＠iecc.com 23 Nov '99

23 Nov '99

> They are denying legitimate service, to legitimate users, whilst > attacking a legitimate business, because they don't want to > understand anything outside of their little parochial world. Some > call that ignorance. Uh, huh. > The real answer is putting an authentication layer into SMTP. No kidding. I don't know what life is like on the planets where .FTN et al exist, but here on this planet, SMTP AUTH exists, and is available in most mail clients and MTAs. The the only major MTA that doesn't support it is sendmail (surprise) but it'll be there in 8.10. -- John R. Levine, IECC, POB 727, Trumansburg NY 14886 +1 607 387 6869 johnl(a)iecc.com, Village Trustee and Sewer Commissioner, http://iecc.com/johnl, Member, Provisional board, Coalition Against Unsolicited Commercial E-mail

1 0

re: Major outage
by Robert Cannon 23 Nov '99

23 Nov '99

Speaking of network outages, I wanted to make sure that you were aware of the following. The FCC's Network Reliability and Interoperability Council (NRIC) has recommended a one year trial voluntary period of ISP outage reporting to NRIC. NRIC is a Federal Advisory Council that exists pursuant to the Federal Advisory Council Act to provide advice and information to the Federal Communications Commission. It was set up to look at reliability issues in the public telecommunications network (how to keep the PSTN reliable in the face of hurricanes rolling up the east coast, etc.). NRIC's report recommending ISP outage reporting is suppose to be released today. The following is from the NRIC presentation on October 14 (full presentation available at www.nric.org - Focus Group III - Oct 14 meeting): <QUOTE> Focus Group III PJ Auduskevicz ATT n A voluntary trial is recommended with participation by service providers of CMRS (Commercial Mobile Radio Service), satellite, cable, data networking and ISPs to alert NCS/NCC of "widespread outages" that have significant public impact. n A process for reporting data during the voluntary trial including what report fields need to be populated and time frames for filing reports has been addressed and will be included in the Final Report. n Industry associations should provide an informational notice to their members to inform them of the voluntary outage reporting trial and encourage their participation. n Analysis of the data from the voluntary trial should be done by a neutral party similar to the analysis conducted on wireline carrier segments. u At the completion of the voluntary trial period (minimum 1 year) an evaluation of the effectiveness of the data for usefulness to participants and the FCC should be undertaken. Data to be held confidential (potential FOIA exemption may be needed in order to facilitate participation in the voluntary trial). . . . . . ISPs Alert Situation Criteria: A failure that would cause a loss of service to a large number of customers for 30 minutes or more. Outage examples: A DNS failure Focus Group III will place its proposal online for comments. The comment period proposed is as follows: Reports posted on FCC web site Nov. 23 Comment period for NRIC members Nov. 23 - Dec. 7 Comment period closed Dec. 7 Reports revised as appropriate Dec. 15 Final reports available on FCC web site Dec. 16 </QUOTE> ------Original Message------ From: Sean Donelan <sean(a)donelan.com> To: <nanog(a)merit.edu> Sent: November 23, 1999 12:20:05 PM GMT Subject: Majore New Jersey outage... >Just spoke to Bell Atl, major DACS failure in 'newark-2', aka 95 williams >st., newark. This wasn't a good night, two fiber cuts on the east coast, a power failure and a DACs failure. __________________________________________________ FREE Email for ALL! Sign up at http://www.mail.com

1 0

Majore New Jersey outage...
by Sean Donelan 23 Nov '99

23 Nov '99

>Just spoke to Bell Atl, major DACS failure in 'newark-2', aka 95 williams >st., newark. This wasn't a good night, two fiber cuts on the east coast, a power failure and a DACs failure.

1 0

Y2K reporting channel...
by Sean Donelan 23 Nov '99

23 Nov '99

I received a question about how will it work. Essentially it will be a moderated mailing list. Approximately every 4-12 hours a summary status will be sent out, along with a very simple template asking the participants about their current status. We'll then take the responses and prepare the next summary report at the next interval. The interval will be shorter on Dec 31-Jan 1, and longer on the days before and days after (Dec 28-Jan 3). So everyone will know precisely when to expect a message, I will be sending the schedule to the participants. This is what I'm calling positive reporting. The assumption is the majority of the participants will report everything is Ok. The "two-way handshake" will show at least e-mail is working. If we don't receive any report from a participant we will list them as unknown, and try to contact them via out-of-band means (e.g. telephone). Participants make trouble reports at any time, and we'll be including a summary of any wide-spread trouble in the reports sent out. Individual participants won't be identified from their reports, however the summary may include reports from other sources, e.g. newswires, which do identify companies. I also hope to include some aggregate internet performance figures from Keynote, RSNG, MAE and other exchange point traffic pages. The summary report will also be sent to the US Information Cordination Center and the International Y2K Coordination Center to be combined with reports sent through other reporting channels. Because the media contact will be handled through the ICC, I'm using a limited subscriber mailing list. Since Time-Warner has RoadRunner and other media conglomerates own several services on the Internet, I think they will know something is up (or rather down). I say "we" because I hope to have 6 volunteers who agree to monitor the list and prepare the summary for a shift or two. I am trying to do it all virtually, so no one will get stuck in the "bunker" in Washington DC. Laptop roadwarriors with their own batteries and cell phones. If I or one of the other volunteers is incommunicado, a designated backup volunteer would handle the shift.

1 0

Re: spam from aol (was Re: ARIN whois)
by shields＠msrl.com 23 Nov '99

23 Nov '99

In article <19991122100516.E12588(a)puck.nether.net>, Jared Mauch <jared(a)puck.Nether.net> wrote: > If you plug-gw it, you can also just tcp_wrap it, and then use > your hosts.allow, etc.. to stop spammers. Not if you want inbound mail from the Internet at large to be delivered. -- Shields.

1 0

Majore North Jersey outage...
by Alex Rubenstein 23 Nov '99

23 Nov '99

Reports coming in from throughout the state show Fast Packet services (Frame, ATM), 411, 911, 0, 800, 900 services not working in much of north jersey (LATA 224). Details to follow...

2 2

How does Murphy know, need mail access east and west coast
by Sean Donelan 23 Nov '99

23 Nov '99

How does Murphy know when to strike. Argh, I went almost 15 years without losing a single mail message. Less than two months of using a "modern" mailer and they're all gone. I want my VAX/VMS back. Everyone who sent me mail about needing a reporting channel for the Y2K rollover on New Year's, could you please send me another message. I had not copied the names down before my mailbox disappeared. Thanks. Yes, I was thinking about a backup. I sent this message early this morning, before I lost all my mail. Sean Donelan [05:19 AM 11/22/99 -0800] wrote: >Perhaps a strange request but I'm looking for two mail accounts I can >access via a dialup (Shell or PPP) and Internet (POP3 or IMAP). > >Here are the requirements: > >One server on the Eastern US power grid >One server on the Western US power grid >Each served via a minimum of two backbone providers (I prefer > the east and west server be on seperate backbones) >Each acting as a secondary MX and DNS server for the other >Mail server will accept mail addressed with a designated domain name >Mail will be sent using a designated domain name >Dialup access will be via a dial access server using at most > a LAN connection to the mail server (no WAN links) >The facility housing the mail server will have a UPS and > standby generator >Inbound mail: a minumum of 50mb mail storage >Outbound mail: 1,000 5kb messages every four hours (LISTSERV and LSMTP >or similar) > >I estimate I need the mailboxes from approximately December 1 through >January 15.

1 0

Re: ARIN whois
by Dean Anderson 23 Nov '99

23 Nov '99

Gee. We operated relay services for almost 4 years with only one incident before this summer. Since the antispammers started inciting attacks, we've been attacked more than 2 dozen times since July. Coincidence? I think not. Also, there aren't very many _real spams_ in the attacks. The attacks are spamlike, but generally not spam. But the content of the messages doesn't matter. I don't care if its spam or not spam. Services rendered are worth money. We are entitled to collect the money regardless of the purpose of the relayed messages. If the money exceeds $5000, the unauthorized access becomes criminal. We complain to FBI. The "relayer" will be found. And we are still entitled to the money for the services provided. --Dean Around 10:16 PM 11/21/1999 -0700, rumor has it that Forrest W. Christian said: > >On Sun, 21 Nov 1999, Kai Schlichting wrote: > >> THEY WILL FIND YOUR RELAYS ON THEIR OWN, AND THEY WILL ABUSE THEM, NO >> MATTER HOW LOUD YOU SCREAM. > >In transition to a new mail server (with a new address), I installed a >plug-gateway on the old server to redirect mail. > >Unfortunately, plugd hides the ip address of the sender, and since I trust >my netblocks, all of the ip addresses on the old server became "spam relay >entry points". > >It took the spammers 96 hours to find 3 of the addresses on that box and >for us to be listed in orbs. I figured I would have at least had a week >or two to figure out a better way. > >I ended up staying up all night getting transparent proxying to work right >on the new server and making it work with a cisco route-map. > >- Forrest W. Christian (forrestc(a)imach.com) KD7EHZ >---------------------------------------------------------------------- >iMach, Ltd., P.O. Box 5749, Helena, MT 59604 http://www.imach.com >Solutions for your high-tech problems. (406)-442-6648 >---------------------------------------------------------------------- > > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

Re: ARIN whois
by Dean Anderson 22 Nov '99

22 Nov '99

We're up to 80K and rising. 2 big ones. Some smaller ones over 5K. Most the rest are under $500. Unless we can pin them to one or a small group of people. Then all their attacks are summed. A number of small attacks over a short period can then be criminal. This amount interests both lawyers and collections companies. --Dean Around 04:07 PM 11/22/1999 -0600, rumor has it that Joe Shaw said: > >What "legitimate business purposes" necessitate leaving SMTP relays open >to the world? While I think spammers shouldn't be spamming, I think >you'd find it better to do what you can to stop them from spamming via >means you control, i.e. your servers, as opposed to going through the >FBI. > >The FBI has recently stated that their computer crimes people are entirely >overworked and way behind. So, while they will look into the matter, my >previous experience with the FBI and computer crime shows a decided lack >of interest in crimes that don't involve a high dollar figure for damages >or stolen goods/services except for the purposes of profiling attacks and >doing trend analysis. Unless you're looking at a six figure loss, you >probably won't get far. > >Your best bet is to find a solution to restrict access to your relays. > >-- >Joseph W. Shaw - jshaw(a)insync.net >Free UNIX advocate - "I hack, therefore I am." > >On Mon, 22 Nov 1999, Dean Anderson wrote: > >> >> These are coming from Mass, Cleveland, Ohio, and Virginia. >> >> We use our relays for legitimate business purposes. They are not "accidentally left open". >> >> --Dean > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

Postmaster notify: Host unknown (Name server: servertest.com: host not found)
by Dean Anderson 22 Nov '99

22 Nov '99

Look. Just got 30 of these. First international relay. Coincidence that it happened today? Or is it more likely the culprit is on this list? That is, a malicious antispammer. Actually, we were probed by someone at dansk telecom a few weeks ago. From a non-customer machine. Hmm. --Dean >X-Persona: <Av8> >>From MAILER-DAEMON Mon Nov 22 16:53:46 1999 >Date: Mon, 22 Nov 1999 16:53:46 -0500 (EST) >From: Mail Delivery Subsystem <MAILER-DAEMON> >To: postmaster >Subject: Postmaster notify: Host unknown (Name server: servertest.com: host not found) >Auto-Submitted: auto-generated (postmaster-notification) > >The original message was received at Mon, 22 Nov 1999 16:53:46 -0500 (EST) >from localhost > > ----- The following addresses had permanent fatal errors ----- ><mail_from(a)servertest.com> > > ----- Transcript of session follows ----- >550 <mail_from(a)servertest.com>... Host unknown (Name server: servertest.com: host not found) >Reporting-MTA: dns; odie.av8.com >Received-From-MTA: DNS; ip111.arcnxr5.ras.tele.dk >Arrival-Date: Mon, 22 Nov 1999 16:53:46 -0500 (EST) > >Final-Recipient: RFC822; mail_from(a)servertest.com >Action: failed >Status: 5.1.2 >Remote-MTA: DNS; servertest.com >Last-Attempt-Date: Mon, 22 Nov 1999 16:53:46 -0500 (EST) >Return-Path: <MAILER-DAEMON> >Received: from localhost (localhost) > by odie.av8.com (8.9.3/8.8.5) with internal id QAA28557; > Mon, 22 Nov 1999 16:53:46 -0500 (EST) >Date: Mon, 22 Nov 1999 16:53:46 -0500 (EST) >From: Mail Delivery Subsystem <MAILER-DAEMON> >Message-Id: <199911222153.QAA28557(a)odie.av8.com> >To: <mail_from(a)servertest.com> >MIME-Version: 1.0 >Content-Type: multipart/report; report-type=delivery-status; > boundary="QAA28557.943307626/odie.av8.com" >Subject: Returned mail: Host unknown (Name server: servertest.com: host not found) >Auto-Submitted: auto-generated (failure) > >The original message was received at Mon, 22 Nov 1999 16:53:45 -0500 (EST) >from ip111.arcnxr5.ras.tele.dk [195.249.99.111] > > ----- The following addresses had permanent fatal errors ----- ><rcpt_to(a)servertest.com> > > ----- Transcript of session follows ----- >550 <rcpt_to(a)servertest.com>... Host unknown (Name server: servertest.com: host not found) >Reporting-MTA: dns; odie.av8.com >Received-From-MTA: DNS; ip111.arcnxr5.ras.tele.dk >Arrival-Date: Mon, 22 Nov 1999 16:53:45 -0500 (EST) > >Final-Recipient: RFC822; rcpt_to(a)servertest.com >Action: failed >Status: 5.1.2 >Remote-MTA: DNS; servertest.com >Last-Attempt-Date: Mon, 22 Nov 1999 16:53:46 -0500 (EST) >Return-Path: <mail_from(a)servertest.com> >Received: from server-test (ip111.arcnxr5.ras.tele.dk [195.249.99.111]) > by odie.av8.com (8.9.3/8.8.5) with SMTP id QAA28555 > for <rcpt_to(a)servertest.com>; Mon, 22 Nov 1999 16:53:45 -0500 (EST) >Date: Mon, 22 Nov 1999 16:53:45 -0500 (EST) >From: mail_from(a)servertest.com >Message-Id: <199911222153.QAA28555(a)odie.av8.com> >Subject: SERVER_TEST > >TEST MESSAGE > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1