Subject: Re: Argh. the spam.. make it stop...

From: Vernon Schryver <[email-masked]>
Date: Wed, 31 Mar 1999 23:49:48 -0700 (MST)

> From: Keith Moore <[email-masked]>

> >  It's trivial to fix an open relay with current software
>
> bullfeathers.
>
> Apparently your idea of "fixing" a mail relay is to configure
> it so that it will only accept local mail.  But mobile users
> need to be able to submit mail to a fixed address, regardless
> of which POP they happen to dial in to on a given day.

More bullfeathers here are your quoting my words out of context.
I also wrote:

] You only need SMTP AUTH or other mechanisms if you want to allow
] some but not all apparent strangers to relay through your system to other
] apparent strangers, and you do not have other means of authenticating the
] first strangers, such as IP address ranges.

Mobile users are "apparent strangers" to their home IPS's, at least as
far as outer IP addresses are concerned.  That's the whole point of SMTP
AUTH and the other mobile IP mechanisms, to make all legitimate users
appear local.

The main reason that closing an open SMTP relay is a "fix" is what happens
to them if you don't close it.  Haven't you had the joy of dealing with
a relay-raped system, with its disks and CPUs so choked by undeliverable
and unreturnable spam that it is dropping real work?  Do you have any
relays that you have not closed either trivially, SMTP AUTH, or otherwise?

As I also said, most systems on the net had stopped relaying long before
the appearance of SMTP AUTH.  Your implication that closing most relays
had, has or ever will have any effect on mobile users and so was other
than a valid and technically trivial fix is more bullfeathers.  Very, very
few of the 1,000,000's of hosts on the net would or ever did relay for
mobile users, while until the spam problem, essentially all hosts were
open SMTP relays.  It is possible that closing a few relays did hurt a
few of the few mobile users, but only a very few.  The main harm done by
closing open relays was to diaganosing problems.  Sending a message through
other people's SMTP servers was a very good way to figure out their and
your problems.  ISP's resisted closing many relays on grounds it would
hurt mobile users, but often dishonestly because their real motives ranged
from laziness to a lack of enthusiasm for breaking working systems they
did (and do) not understand, and sometimes because they couldn't figure
out how to configure client systems or limit relaying to their customers,
which consisted of purely non-mobile users.

> Right now, the only alternatives we have appear to be:
> ...
> Once we have SMTP AUTH widely deployed in clients, folks
> who run servers will have the option to
> ...
> which seems like a fairly optimal solution.  With any luck,
> ...

That's all entirely true.  SMTP AUTH and other reasonable MUA-MTA
protocols besides classic SMTP are overdue and Good Things(tm).  That
has little to do with the facts of life, spam in 1999, or port 25 filtering.

> It is quite possible that the push to "fix" mail relays is doing 
> nothing to reduce the amount of spam.  It is, however, causing a 
> lot of pain for folks who need to support mobile users, and it is 
> causing people to implement various half-baked measures that further 
> fragment the net.

Didn't you read my words pointing out that open relays are merely a
convenience for spammers?  There are several reasons why I don't subscribe
to ORBS, the free, open-relay blacklisting service.

How many folks are supporting how many mobile users and how much pain are
they really feeling?  How many mobile users are there, as a fraction of
total?  As many as 0.1%?

> As for ISPs filtering SYNs on port 25, any ISP that does that
> will certainly lose *my* business.

It would also lose my business, since I don't like how ISP's run their
SMTP servers and insist on running my own.  So what?  Are you a UUnet
customer?  I'm not.

It is not bullfeathers but insane to pretend that port 25 filtering is
not common and becoming more so, or to ignore its implications.  As I said
before, I suspect some of the reasons for port 25 filtering have nothing
to do with spam, but with other business reasons for "encouraging" an
ISP's customers to use its servers.  Consider "web portals."

It is worse than bullfeathers that UUnet does not simply enforce good
terms of service on their spammers, since that would end the need for
filtering port 25 on its dialups and do a far better job of fixing spam.
But again, it's insane to ignore reality.

Vernon Schryver    [email-masked]

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 1 Apr 1999 09:33:02 -0700 (MST)

> ...
> rate limiting or quotas on our incoming mail.
>
> > Do you have any relays that you have not closed either trivially, 
> > SMTP AUTH, or otherwise?
>
> yes.  we have disabled relaying on all of our client hosts but we 
> cannot do so on all of our servers.  we have our users to think 
> about.  SMTP AUTH will be a good solution when it arrives, but it 
> is not yet supported by our users' mail clients.

Why have I not seen any recently relayed spam from utk.edu?  I assume your
systems are not in the ORBS database.  Do you do as some big ISP's do,
relay but severely rate-limited?  Or use other mechanisms we both can
think of but probably should not talk about in public?  In my book, that
counts as "closed [either] trivially, [by] SMTP AUTH, or otherwise"

> ...
> the problem is the assumption that this "fix" works for all servers.

Whose assumption?
Rate limiting to 10 messages/day/IP address would effectly close a relay,
not hurt any mobile users, be easy and only barely harder than "trivial,"
esp. given the new database stuff in sendmail.cf.  Then there's POP-first.
And of course telnet-and-then-run-/usr/bin/mail.  And SSH.   Etc.

> > ISP's resisted closing many relays on grounds it would

> You're glossing over some other problems which aren't easy to solve.  
> ISPs don't always own their PoPs, and the set of addresses assigned
> to PoPs accessible to a large ISP's customers can change so frequently 
> that keeping track of which PoPs are valid and which are not is a 
> major pain.  It's also fair to mention that those mobile users trying 
> to relay through an ISP's SMTP from a PoP not owned by that ISP are 
> often *customers* of the ISP who owns the SMTP server, who rightfully 
> complain when the ISP denies them the ability to relay their mail.

On the contrary, POP-before-SMTP or draconian rate limiting are easy if
not quite trivial fixes for the tiny number of hosts that cannot be
"trivially" completely closed.  They can be challenging for people whose
programing experience is a few lines of PERL, but if you're a C hack, it's
quick and easy to add code to sendmail and/or your POP server.  ISP's or
other outfits that can't be bothered to hire the talent necessary to run
their busineses right get no sympathy from me.

Most ISP's have always been run with a "convenient" attitude to doing
what's right.  I recently collected money from an ISP for a junk FAX using
Small Claims Court and Title 47, Section 227.  The ISP told me sob stories
about how much email spam has hurt them by crashing their systems and how
anti-email-spam they are.  Without pausing, they blathered the familiar
spammer excuses for their junk FAX, including "we get lots of junk FAX so
everyone is doing it", "just throw it away", "you've spent more time on
this than it's worth", and "we didn't know it was illegal (but we omitted
our address and phone number to minimize complaints)."

> > As I said before, I suspect some of the reasons for port 25 filtering 
> > have nothing to do with spam, but with other business reasons for 
> > "encouraging" an ISP's customers to use its servers.
>
> IMHO, an ISP that does that should not claim to be supporting "I" service.

If you're fixing dishonest or silly claims about the InfoSuperHypeWay,
you have plenty of work.  Last night I saw a TV ad for AOL in which an
actor said "AOL is the internet."

---

From: "Stephen Sprunk" <[email-masked]>
Date: Thu, 1 Apr 1999 10:51:57 -0600

There was a proposal to fix that a while back, but it was killed for lack of
interest.  The idea was to create a pseudo-tld for "mobile" services like
smtp; 'smtp.local.' would resolve to whatever the local smtp server's
address was, etc.

Perhaps this should be revived?

Stephen

     |          |         Stephen Sprunk, K5SSS, CCIE #3723
    :|:        :|:        NSA, Network Consulting Engineer
   :|||:      :|||:       14875 Landmark Blvd #400; Dallas, TX
.:|||||||:..:|||||||:.    Pager: 800-365-4578 / 800-901-6078
C I S C O S Y S T E M S   Email: [email-masked]

-----Original Message-----
From: Keith Moore <[email-masked]>
To: Vernon Schryver <[email-masked]>
Cc: [email-masked] <[email-masked]>
Date: Wednesday, March 31, 1999 22:25
Subject: Re: Argh. the spam.. make it stop...

>- run completely open and allow spammers to exploit us
>- close down relaying and break our users' ability to send mail
>- ask the user to authenticate to a POP or IMAP server,
>  which (given the current state of authentication in mail
>  clients) is tantamount to expecting the user to send his/her
>  password over the wire.  (okay, a lot of them will do that
>  anyway, but we're trying to discourage that)
>
>- allow relaying for authenticated, authorized users, and
>  accept only local mail for everyone else
>
>the clients that are updated to use SMTP AUTH will also
>implement better (non cleartext) authentication in POP and IMAP.
>
>Keith

---

From: "Stephen Sprunk" <[email-masked]>
Date: Thu, 1 Apr 1999 11:35:11 -0600

But you'd be coming from an IP address in joe's ISP, and his mail relay
should be set up to allow that.

Stephen

-----Original Message-----
From: [email-masked] <[email-masked]>
To: Stephen Sprunk <[email-masked]>
Cc: [email-masked] <[email-masked]>
Date: Thursday, April 01, 1999 11:27
Subject: Re: Argh. the spam.. make it stop...

>On Thu, 01 Apr 1999 10:51:57 CST, "Stephen Sprunk" said:
>I suspect that RFC2165 addresses the problem in a more general way.
>
>However, this doesn't fix the problem.  Let's say I go on a road trip,
>take a laptop along, and I connect to Joes' ISP.  smtp.local. resolves
>to mail.joes-isp.com, I try to relay my mail through there.
>
>And it gets rejected because neither my From: nor To: are affiliated
>with joes-isp.com, I'm merely getting connectivity from them.
>
>You have to use *another* mechanism so that either joes-isp.com
>knows that you're a "real" mobile user as opposed to a spammer,
>or one to allow your home SMTP server to know that you're you
>and not a dialup spammer.  Thus the growth of SMTP AUTH and
>SMTP-after-POP and the like.
>
>--
> Valdis Kletnieks
> Computer Systems Senior Engineer
> Virginia Tech
>
>
>

---

From: "Stephen Sprunk" <[email-masked]>
Date: Thu, 1 Apr 1999 11:35:11 -0600

Stephen

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 1 Apr 1999 14:03:10 -0700 (MST)

> should be set up to allow that.

New top level domains are not needed for that.  Allowing relaying by some
clients based on their IP addresses is an old, widely available and used
mechanism that is now supported by installation knobs.  Consider the README
that has come with sendmail for the last year or two:

|                                       You can allow certain domains to
|   relay through your server by adding their domain name or IP address to
|   class 'R' ($=R) using RELAY_DOMAIN() and RELAY_DOMAIN_FILE() or via the
|   access database (described below).

The filtering by ISP's of port 25 SYN's from their dialup customers is to
force customers to use the ISP's SMTP server.  In this example, Joe's ISP
filters all SYN's to port 25 and not addressed to mail.joes-isp.com.  That
forces you to connect to port 25 at mail.joes-isp.com instead of your home
ISP (or targets of spam if you are a spammer).  Mail.joes-isp.com then
relays your email because Joe has told sendmail about all of his IP
addresses, or not if you send too much, have naughty headers, or other
signs of abuse.

SMTP AUTH and SMTP-after-POP are not needed on mail.joes-isp.com.  Instead,
those mechanisms are for your home ISP to recognize that while your laptop
is coming from a strange and distant IP address, it is really yours, you
are not a spammer, and the mail your laptop wants your home ISP to relay
is legitimate.

SMTP AUTH and SMTP-after-POP are also supposed to allow Joe's ISP to avoid
filtering port 25.  However, as I keep saying, port 25 filtering is already
here.  It will only grow because Joe has many reasons to force as many
people as possible to use his servers.  Besides "WWW portals," it's easier
for Joe to handle his spamming customers.  Instead of employing people
who can read SMTP headers to validate spam complaints and then having
unpleasant converstations, Joe can filter port 25, rate limit his server,
and make spam a small enough problem to ignore.  Whether you or I would
deal with Joe if he does that is irrelevant.

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 1 Apr 1999 14:03:10 -0700 (MST)

---

From: David Borman <[email-masked]>
Date: Fri, 2 Apr 1999 11:06:53 -0600 (CST)

Jeff,

> Date: Thu, 01 Apr 1999 18:56:37 -0500
> From: "Jeffrey I. Schiller" <[email-masked]>
> ...
> Now if
> perhaps the dialup ISP can count the number of SYN packets sent to port
> 25 and only cutoff access say after 100 connections in a 10 minute
> period, that might be reasonable... Of course this requires technology
> we don't yet have.

Well, I wouldn't say that.  The IP filters in BSD/OS 4.0 can be used to
implement this without too much work.  The infrastructure is all there.
You set up an IP filter to divert all the SYN packets to port 25 up to
an application.  That application just keeps a database of source
addresses and packet counts.  If you are below the threshhold for a
particular source address, it would just write the packet back down via
a raw socket and send it on its way.

So, the technology does exist, and in a released product.

			-David Borman, [email-masked]

---

From: David Borman <[email-masked]>
Date: Fri, 2 Apr 1999 11:06:53 -0600 (CST)

Jeff,

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 2 Apr 1999 12:02:50 -0700 (MST)

> From: David Borman <[email-masked]>

> So, the technology does exist, and in a released product.

Moreover, while port 25 filtering is objectionable on various grounds, it
is unwise and wrong to apply the C word to it.  An ISP filtering port 25
is no more prime facie guilty of censorship (or even of content checking
that might make it vulnerable to complaints about libel, porn, etc.) than
if it filters UDP packets to and from port 7 (echo), 64K ICMP Echo-
Requests, or port 137 or 139 UDP packets (NetBIOS).  Many of us would
consider those desirable protections against abuse, which is the same
justification used by those who like port 25 filtering.

Filtering port 25 is less like censorship than an ISP disabling port
80 (HTTP) or 21 (FTP) or interactive game servers, whether by filtering,
by not offering static IP addresses, or by administrative fiat.  Port 25
filtering generally does not censor what you have to say (as long as you
don't spam it), unlike not allowing you to maintain your own web pages.
(I've heard some cable modem or *DSL ISPs do disallow some kinds of
"servers".  The complaints I've read have concerned interactive games,
but the quoted terms of service seemed to apply to all kinds of servers.)

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 2 Apr 1999 12:02:50 -0700 (MST)