- Test - lists.nanog.org

Re: spam from aol (was Re: ARIN whois)
by shields＠msrl.com 23 Nov '99

23 Nov '99

In article <19991122100516.E12588(a)puck.nether.net>, Jared Mauch <jared(a)puck.Nether.net> wrote: > If you plug-gw it, you can also just tcp_wrap it, and then use > your hosts.allow, etc.. to stop spammers. Not if you want inbound mail from the Internet at large to be delivered. -- Shields.

1 0

Majore North Jersey outage...
by Alex Rubenstein 23 Nov '99

23 Nov '99

Reports coming in from throughout the state show Fast Packet services (Frame, ATM), 411, 911, 0, 800, 900 services not working in much of north jersey (LATA 224). Details to follow...

2 2

How does Murphy know, need mail access east and west coast
by Sean Donelan 23 Nov '99

23 Nov '99

How does Murphy know when to strike. Argh, I went almost 15 years without losing a single mail message. Less than two months of using a "modern" mailer and they're all gone. I want my VAX/VMS back. Everyone who sent me mail about needing a reporting channel for the Y2K rollover on New Year's, could you please send me another message. I had not copied the names down before my mailbox disappeared. Thanks. Yes, I was thinking about a backup. I sent this message early this morning, before I lost all my mail. Sean Donelan [05:19 AM 11/22/99 -0800] wrote: >Perhaps a strange request but I'm looking for two mail accounts I can >access via a dialup (Shell or PPP) and Internet (POP3 or IMAP). > >Here are the requirements: > >One server on the Eastern US power grid >One server on the Western US power grid >Each served via a minimum of two backbone providers (I prefer > the east and west server be on seperate backbones) >Each acting as a secondary MX and DNS server for the other >Mail server will accept mail addressed with a designated domain name >Mail will be sent using a designated domain name >Dialup access will be via a dial access server using at most > a LAN connection to the mail server (no WAN links) >The facility housing the mail server will have a UPS and > standby generator >Inbound mail: a minumum of 50mb mail storage >Outbound mail: 1,000 5kb messages every four hours (LISTSERV and LSMTP >or similar) > >I estimate I need the mailboxes from approximately December 1 through >January 15.

1 0

Re: ARIN whois
by Dean Anderson 23 Nov '99

23 Nov '99

Gee. We operated relay services for almost 4 years with only one incident before this summer. Since the antispammers started inciting attacks, we've been attacked more than 2 dozen times since July. Coincidence? I think not. Also, there aren't very many _real spams_ in the attacks. The attacks are spamlike, but generally not spam. But the content of the messages doesn't matter. I don't care if its spam or not spam. Services rendered are worth money. We are entitled to collect the money regardless of the purpose of the relayed messages. If the money exceeds $5000, the unauthorized access becomes criminal. We complain to FBI. The "relayer" will be found. And we are still entitled to the money for the services provided. --Dean Around 10:16 PM 11/21/1999 -0700, rumor has it that Forrest W. Christian said: > >On Sun, 21 Nov 1999, Kai Schlichting wrote: > >> THEY WILL FIND YOUR RELAYS ON THEIR OWN, AND THEY WILL ABUSE THEM, NO >> MATTER HOW LOUD YOU SCREAM. > >In transition to a new mail server (with a new address), I installed a >plug-gateway on the old server to redirect mail. > >Unfortunately, plugd hides the ip address of the sender, and since I trust >my netblocks, all of the ip addresses on the old server became "spam relay >entry points". > >It took the spammers 96 hours to find 3 of the addresses on that box and >for us to be listed in orbs. I figured I would have at least had a week >or two to figure out a better way. > >I ended up staying up all night getting transparent proxying to work right >on the new server and making it work with a cisco route-map. > >- Forrest W. Christian (forrestc(a)imach.com) KD7EHZ >---------------------------------------------------------------------- >iMach, Ltd., P.O. Box 5749, Helena, MT 59604 http://www.imach.com >Solutions for your high-tech problems. (406)-442-6648 >---------------------------------------------------------------------- > > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

Re: ARIN whois
by Dean Anderson 22 Nov '99

22 Nov '99

We're up to 80K and rising. 2 big ones. Some smaller ones over 5K. Most the rest are under $500. Unless we can pin them to one or a small group of people. Then all their attacks are summed. A number of small attacks over a short period can then be criminal. This amount interests both lawyers and collections companies. --Dean Around 04:07 PM 11/22/1999 -0600, rumor has it that Joe Shaw said: > >What "legitimate business purposes" necessitate leaving SMTP relays open >to the world? While I think spammers shouldn't be spamming, I think >you'd find it better to do what you can to stop them from spamming via >means you control, i.e. your servers, as opposed to going through the >FBI. > >The FBI has recently stated that their computer crimes people are entirely >overworked and way behind. So, while they will look into the matter, my >previous experience with the FBI and computer crime shows a decided lack >of interest in crimes that don't involve a high dollar figure for damages >or stolen goods/services except for the purposes of profiling attacks and >doing trend analysis. Unless you're looking at a six figure loss, you >probably won't get far. > >Your best bet is to find a solution to restrict access to your relays. > >-- >Joseph W. Shaw - jshaw(a)insync.net >Free UNIX advocate - "I hack, therefore I am." > >On Mon, 22 Nov 1999, Dean Anderson wrote: > >> >> These are coming from Mass, Cleveland, Ohio, and Virginia. >> >> We use our relays for legitimate business purposes. They are not "accidentally left open". >> >> --Dean > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

Postmaster notify: Host unknown (Name server: servertest.com: host not found)
by Dean Anderson 22 Nov '99

22 Nov '99

Look. Just got 30 of these. First international relay. Coincidence that it happened today? Or is it more likely the culprit is on this list? That is, a malicious antispammer. Actually, we were probed by someone at dansk telecom a few weeks ago. From a non-customer machine. Hmm. --Dean >X-Persona: <Av8> >>From MAILER-DAEMON Mon Nov 22 16:53:46 1999 >Date: Mon, 22 Nov 1999 16:53:46 -0500 (EST) >From: Mail Delivery Subsystem <MAILER-DAEMON> >To: postmaster >Subject: Postmaster notify: Host unknown (Name server: servertest.com: host not found) >Auto-Submitted: auto-generated (postmaster-notification) > >The original message was received at Mon, 22 Nov 1999 16:53:46 -0500 (EST) >from localhost > > ----- The following addresses had permanent fatal errors ----- ><mail_from(a)servertest.com> > > ----- Transcript of session follows ----- >550 <mail_from(a)servertest.com>... Host unknown (Name server: servertest.com: host not found) >Reporting-MTA: dns; odie.av8.com >Received-From-MTA: DNS; ip111.arcnxr5.ras.tele.dk >Arrival-Date: Mon, 22 Nov 1999 16:53:46 -0500 (EST) > >Final-Recipient: RFC822; mail_from(a)servertest.com >Action: failed >Status: 5.1.2 >Remote-MTA: DNS; servertest.com >Last-Attempt-Date: Mon, 22 Nov 1999 16:53:46 -0500 (EST) >Return-Path: <MAILER-DAEMON> >Received: from localhost (localhost) > by odie.av8.com (8.9.3/8.8.5) with internal id QAA28557; > Mon, 22 Nov 1999 16:53:46 -0500 (EST) >Date: Mon, 22 Nov 1999 16:53:46 -0500 (EST) >From: Mail Delivery Subsystem <MAILER-DAEMON> >Message-Id: <199911222153.QAA28557(a)odie.av8.com> >To: <mail_from(a)servertest.com> >MIME-Version: 1.0 >Content-Type: multipart/report; report-type=delivery-status; > boundary="QAA28557.943307626/odie.av8.com" >Subject: Returned mail: Host unknown (Name server: servertest.com: host not found) >Auto-Submitted: auto-generated (failure) > >The original message was received at Mon, 22 Nov 1999 16:53:45 -0500 (EST) >from ip111.arcnxr5.ras.tele.dk [195.249.99.111] > > ----- The following addresses had permanent fatal errors ----- ><rcpt_to(a)servertest.com> > > ----- Transcript of session follows ----- >550 <rcpt_to(a)servertest.com>... Host unknown (Name server: servertest.com: host not found) >Reporting-MTA: dns; odie.av8.com >Received-From-MTA: DNS; ip111.arcnxr5.ras.tele.dk >Arrival-Date: Mon, 22 Nov 1999 16:53:45 -0500 (EST) > >Final-Recipient: RFC822; rcpt_to(a)servertest.com >Action: failed >Status: 5.1.2 >Remote-MTA: DNS; servertest.com >Last-Attempt-Date: Mon, 22 Nov 1999 16:53:46 -0500 (EST) >Return-Path: <mail_from(a)servertest.com> >Received: from server-test (ip111.arcnxr5.ras.tele.dk [195.249.99.111]) > by odie.av8.com (8.9.3/8.8.5) with SMTP id QAA28555 > for <rcpt_to(a)servertest.com>; Mon, 22 Nov 1999 16:53:45 -0500 (EST) >Date: Mon, 22 Nov 1999 16:53:45 -0500 (EST) >From: mail_from(a)servertest.com >Message-Id: <199911222153.QAA28555(a)odie.av8.com> >Subject: SERVER_TEST > >TEST MESSAGE > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

Re: ARIN whois
by Derek J. Balling 22 Nov '99

22 Nov '99

No offense to all, but you are ALL wasting your time trying to convince Dean through logic on this topic. We've all been round and round the same discussions on the anti-spam mailing lists, and Dean continues to insist that he MUST run open relays. Dean appears to be completely impervious to logic, so don't waste your time sending it his way. :) D At 04:07 PM 11/22/99 -0600, Joe Shaw wrote: >What "legitimate business purposes" necessitate leaving SMTP relays open >to the world? While I think spammers shouldn't be spamming, I think >you'd find it better to do what you can to stop them from spamming via >means you control, i.e. your servers, as opposed to going through the >FBI. > >The FBI has recently stated that their computer crimes people are entirely >overworked and way behind. So, while they will look into the matter, my >previous experience with the FBI and computer crime shows a decided lack >of interest in crimes that don't involve a high dollar figure for damages >or stolen goods/services except for the purposes of profiling attacks and >doing trend analysis. Unless you're looking at a six figure loss, you >probably won't get far. > >Your best bet is to find a solution to restrict access to your relays. > >-- >Joseph W. Shaw - jshaw(a)insync.net >Free UNIX advocate - "I hack, therefore I am." > >On Mon, 22 Nov 1999, Dean Anderson wrote: > > > > > These are coming from Mass, Cleveland, Ohio, and Virginia. > > > > We use our relays for legitimate business purposes. They are not > "accidentally left open". > > > > --Dean

3 2

History question, Morris worm
by Sean Donelan 22 Nov '99

22 Nov '99

>and what's more fun, when they come back up on jan 3 or whatever, they will >have whatever y2k problems then. I recall after the Morris worm hit the Internet, reading a report sites which unplugged their ARPANET connection were down longer than sites which remain connected and got repair information over the net. Does anyone else remember that, and knows a citation for the report (or news story) I'm recalling? Thanks.

4 3

Re: History question, Morris worm
by Dean Anderson 22 Nov '99

22 Nov '99

I don't have paper or email documentation. I know what I know because the friend was Andy Sudduth. He was the first postmaster at the OSF. I came to work at the OSF a several months after the worm was released, and heard the story from the other Computer Facilities people who were there at the time. I think that Sudduth testified at the trial, but he had left the OSF by the time the case went to trial. So I think this was all discussed in the court documents of Morris' prosecution. Those should be public domain. --Dean At 06:24 PM 11/21/1999 -0800, George Herbert supposedly said: > >I have printouts of all the Usenet traffic which was Worm-related >(not 100%, but close) over the few months immediately after. >I don't recall that story coming out. That doesn't mean it >didn't happen, but I'd like to see some documentation. > > >-george william herbert >gherbert(a)crl.com > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

1 0

Re: History question, Morris worm
by George Herbert 22 Nov '99

22 Nov '99

I have printouts of all the Usenet traffic which was Worm-related (not 100%, but close) over the few months immediately after. I don't recall that story coming out. That doesn't mean it didn't happen, but I'd like to see some documentation. -george william herbert gherbert(a)crl.com

1 0