- Test - lists.nanog.org

RE: SMTP authentication for broadband providers
by Dan Ellis 12 Feb '04

12 Feb '04

First, a quick thanks to everyone that responded. I've received useful and excellent info from everyone. We do not block on 25 outbound/inbound, but we are considering it for the residential broadband connections - maybe filter, proxy, or at least monitor it. I should clarify one thing: We are considering REQUIRING SMTPAUTH for all connections from customers for relaying - whether they are on our IP space or not. I know this will only buy us a few months until the next round of viruses steal username/pass, but even then it will give us the ability to detect an infected/SPAMMING customer quicker and auto shut them down (vs having to shutdown the IP, and then the customer receives a new IP...) My question is: Have any or many of the larger ISP's gone the route of REQUIRING all customers to use SMTPAUTH - regardless of where they are connected. Can anyone disclose who these regional or national providers are? Thanks again --Dan -- Daniel Ellis, CTO, PenTeleData (610)826-9293 > -----Original Message----- > From: Florian Weimer [mailto:fw@deneb.enyo.de] > Sent: Thursday, February 12, 2004 2:01 AM > To: Dan Ellis > Cc: nanog(a)merit.edu > Subject: Re: SMTP authentication for broadband providers > > Dan Ellis wrote: > > > We're a medium sized regional MSO/broadband provider with 200k+ > > mailboxes, strongly considering enabling SMTP authentication on our > > customer-facing SMTP mail servers. We feel this is the next logical > > step to minimize our users UCE/virus impact (we already tarpit, virus > > scan, UCE scan, subscribe to RBL's, reject prior to SMTP close). > > Do you block incoming 25/TCP connections from customers? Some of your > hosts are listed on my mass-market IP access blacklist, so you probably > don't. 8-) > > IMHO, this is one of the next thing to consider if you want to reduce > the volume of unwanted email originating from your network. There's an > intermediate step: monitoring TCP/25 flows. The initial setup costs are > much lower, but the operating costs are higher and the effect is less > thorough. > > > Is anyone aware of any well known mail clients that do not support SMTP > > authentication (Unix, Windows or Mac)? > > qmail (as usual).

2 1

New subgroups in the IRTF ASRG
by John R Levine 12 Feb '04

12 Feb '04

The newly reorganizaed Anti-Spam Research Group has set up some new subgroups to see if we can get some work done. Our slant is sort of applied research; it's stuff that's not ready for the standards track yet, but isn't blue sky. Several of the groups have a lot of operational relevance, notably abuse reporting standards, BCP, filtering standards (eg, ways to pass around updated filtering info in real time), and the two verify groups. Each of these has a mailing list you can read at gmane.org. If interested in participating, drop me a note with a sentence or two describing your interest and I'll pass it along to the appropriate subgroup head. The list of the subgroups is as follows (http://asrg.sp.am/about/subgroups.shtml) ------------------------------------------------------------------------ o Abuse Reporting Standards - researches standard formats and protocols for reporting email and network abuse Homepage: http://asrg.sp.am/subgroups/abuse_reports.shtml) o Analysis & Characterization (A&C) - applies empirical and quantitative methods to problems and issues surrounding spam Homepage: http://asrg.sp.am/subgroups/analysis.shtml o Best Current Practices (BCP) - researches and documents best practices for spam management Homepage: http://asrg.sp.am/subgroups/bcp.shtml o Filtering Standards (FILTERING) - researches filtering standards for dynamic updating and interaction with MTAs Homepage: http://asrg.sp.am/subgroups/filtering.shtml o Inventory of Problems - research problems with the current email architechture that facilitate spam http://asrg.sp.am/subgroups/problems.shtml o Message Verification (MSG-VERIFY) - researches solutions dealing with verification and authetication in the email messages and headers http://asrg.sp.am/subgroups/msg_verify.shtml o SMTP Session Verification (SMTP-VERIFY) - researches solutions dealing with authetication and verification of the SMTP session (will encompass the old LMAP and CRI subgroups) http://asrg.sp.am/subgroups/smtp_verify.shtml Regards, John Levine, johnl(a)taugh.com, Taughannock Networks, Trumansburg NY http://www.taugh.com

1 0

Re: SMTP authentication for broadband providers
by Michael.Dillon＠radianz.com 12 Feb '04

12 Feb '04

>Right now SMTP AUTH is a bit more useful because the mailer can directly >identify the compromised subscriber. But I expect this to also be >short-lived. Eventually the compromised computers will start passing >authentication information. SMTP AUTH and 587 might not be silver bullets but they can shift the action into an arena where we can use bigger clubs to beat the spammers. Right now, if someone sends SPAM they are not breaking the law. However, if someone compromises another person's computer, steals their authentication credentials, transfers those credentials to another compromised computer and then sends SPAM, they are clearly breaking the law. They are also doing something that banks, credit card companies and law enforcement agencies are very interested in tracking down, namely the theft and transfer of authentication credentials. And if we get to the point where people can rightly claim that 94.7% of SPAM is the direct result of security flaws in Microsoft operating systems, then there is another big club in the form of the FTC and class action suits that can be applied to the problem. --Michael Dillon

1 0

Re: IPv6 reverse lookup - lame delegation?
by Paul Vixie 12 Feb '04

12 Feb '04

> > or just put <http://www.isc.org/pubs/tn/?tn=isc-tn-2002-1.txt> into effect. > > I am confused. Are DNAMEs deprecated or not (RFC3363, section 4)? A6 and bitstring labels are deprecated. DNAME remains in full force.

4 6

PING: blacklist.mail.ops.worldnet.att.net-clueful admin at AT&T
by Ben Browning 12 Feb '04

12 Feb '04

The following is an autoresponse I have been forced to make in my email client. I get, on average, 1-2 emails per week since I originally posted here asking for help with my own att.net blacklisting woes. That was in *August*. I posted this here once before, in hopes that perhaps it would get as widespread in Google as my original post has been. Today alone I have received 3 emails about this issue. I would highly appreciate an offlist email telling me what you are doing to document your blacklist and the procedure ISPs must follow to get removed. Alternately, AT&T payroll may contact me and we can discuss my consulting rates, should you wish me to continue being your only source of documentation and support for this blacklist. ~Ben ---begin autoresponse--- Here's a post I posted to NANOG and news.admin.net-abuse.email, as I have gotten a lot of replies abut this. --- Subject: ATTN: Anyone with RBL clue at att.net Something must be highly broken at ATT. I have been receiving tons of emails in response to a Usenet posting I made months ago asking if anyone knew how to get out of att.net's private RBL. The procedure: What I did: Called the contact in the whois record... Administrative Contact, Technical Contact: GNMC (VXGTRUVDOO) rm-hostmaster(a)ems.att.com 3324 Hollenberg Bridgeton, MO 63044 US 314-264-9672 fax: 281-664-9975 Asked for their abuse department. Kept asking and calling back and leaving messages, etc, until finally I got a response. It took me several days. AT&T - please document the removal procedures on your website immediately. You are apparently doing some very heavyhanded blocking and professionalism demands you at least give admins some recourse to figure out why they are blocked and how to fix their problems. ~Ben (I speak for myself here) --- Ben Browning <benb(a)theriver.com> The River Internet Access Co. WA Operations Manager 1-877-88-RIVER http://www.theriver.com

3 2

IPv6 reverse lookup - lame delegation?
by itojun＠itojun.org 11 Feb '04

11 Feb '04

if i try to log into my machines back in tokyo by IPv6 SSH, it takes very long time. i guess i found the reason - (possible) lame delegation of blah.ip6.int. ip6.arpa. query returns instantly. how could we fix it? itojun % dig e.5.5.e.2.4.e.f.f.f.e.4.5.0.2.0.0.0.0.0.0.0.0.1.0.0.7.3.e.f.f.3.ip6.int. ptr ; <<>> DiG 9.2.3 <<>> e.5.5.e.2.4.e.f.f.f.e.4.5.0.2.0.0.0.0.0.0.0.0.1.0.0.7.3.e.f.f.3.ip6.int. ptr ;; global options: printcmd ;; connection timed out; no servers could be reached % dig e.5.5.e.2.4.e.f.f.f.e.4.5.0.2.0.0.0.0.0.0.0.0.1.0.0.7.3.e.f.f.3.ip6.arpa. ptr ; <<>> DiG 9.2.3 <<>> e.5.5.e.2.4.e.f.f.f.e.4.5.0.2.0.0.0.0.0.0.0.0.1.0.0.7.3.e.f.f.3.ip6.arpa. ptr ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 19137 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;e.5.5.e.2.4.e.f.f.f.e.4.5.0.2.0.0.0.0.0.0.0.0.1.0.0.7.3.e.f.f.3.ip6.arpa. IN PTR ;; AUTHORITY SECTION: ip6.arpa. 10569 IN SOA dns1.icann.org. hostmaster.icann.org. 2003080400 3600 1800 604800 10800 ;; Query time: 1 msec ;; SERVER: 127.0.0.1#53(0.0.0.0) ;; WHEN: Tue Feb 10 21:57:17 2004 ;; MSG SIZE rcvd: 151

11 20

Question
by Tracey Webb 11 Feb '04

11 Feb '04

Does anyone on the list have any opinions on the adtran total access 1200 using Inverse Multiplexing over ATM. Tracey Webb Network Operations Cameron Communications, LLC 337-775-3097 Office 337-583-2097 337-493-4894 page tracey.webb(a)camtel.com FCC# PG-GB-022338 ************************************************************************ *** This email and any files transmitted with it from Cameron Communications are strictly confidential and intended solely for the individual or entity to whom they are addressed. If you have received this email in error please notify the sender. ************************************************************************ ***

1 0

RE: SMTP authentication for broadband providers
by Mark Segal 11 Feb '04

11 Feb '04

> I'm looking for comments on whether this is generally seen as a positive change or a waste > of time (ie - will the next virus or worm gleam your SMTP username and password from > Outlook Express and use it to replicate/SPAM)? We are planning on moving the same way. Without a doubt, a new virus or worm will emerge that will steal the SMTP-AUTH from the config file (or more likely, ALL the new variants will steal the SMTP-AUTH info). But, with SMTP-AUTH you can limit the number of connections and outbound emails, which is the real reason we are doing it. Also since some of the new variants are smart enough to bundle in a SMTP server, or use the local service in XP, we have taken to blocking emails from clearly marked residential high speed subnets (reverse DNS) in other providers space. Maybe its time there is some proposed rfc like device for this? Regards, Mark -- Mark Segal Director, Network Planning FCI Broadband Tel: 905-284-4070 Fax: 416-987-4701 http://www.fcibroadband.com <http://www.fcibroadband.com/> Futureway Communications Inc. is now FCI Broadband

1 0

Re: animations from "Making Sense of BGP" talk available
by Joe Loiacono 11 Feb '04

11 Feb '04

Cool tool! It's amazing to see BGP in action and what 'really' happens. A comment: could you define the number of prefixes a little more? E.g., is it the total imported and exported across the link, imported only, exported only, context dependent, etc. Thanks! Joe Loiacono Van Jacobson <van To: nanog(a)merit.edu @packetdesign.co cc: m> Subject: animations from "Making Sense of BGP" talk available Sent by: owner-nanog 02/11/2004 02:14 AM The animations from Tina Wong's "Making Sense of BGP" talk at NANOG-30 this morning are available at: http://www.packetdesign.com/technology/presentations/nanog-30/index.htm The animations are in SVG (a W3C graphics standard) and should be viewable in any web browser but you'll probably have to download an SVG plugin first (there's a link to Adobe's free plugin at the top of the web page). If you play with the stuff, we'd welcome coments, suggestions, whatever. Thanks. - Tina, Cengiz & Van

1 0

animations from "Making Sense of BGP" talk available
by Van Jacobson 11 Feb '04

11 Feb '04

The animations from Tina Wong's "Making Sense of BGP" talk at NANOG-30 this morning are available at: http://www.packetdesign.com/technology/presentations/nanog-30/index.htm The animations are in SVG (a W3C graphics standard) and should be viewable in any web browser but you'll probably have to download an SVG plugin first (there's a link to Adobe's free plugin at the top of the web page). If you play with the stuff, we'd welcome coments, suggestions, whatever. Thanks. - Tina, Cengiz & Van

1 0