Subject: Re: AD's

From: Gunnar Lindberg <[email-masked]>
Date: Fri, 22 Jan 1999 08:40:22 +0100 (MET)

Fighting "real spam" - the spam that is to come - probably means a
zillion new problems, but as of today there are two major ones:

    o	Various SMTP sw, e.g. old sendmail distributed by some vendors,
	neither has anti-spam functionaily nor trace info (Received).

    o	The people operating those hosts usually don't have a clue; if
	they had, they'd get new sw and at least do something (e.g stop
	acting as unauthorized Mail Relay) and they'd probably start
	reading Postmaster mail.

Spammers have developed great skill in finding such hosts; how that
happens - and if it can be prevented - would be an interesting and
quite different view on spam fight. Anyone?

	Gunnar Lindberg

>From [email-masked]  Thu Jan 21 23:05:39 1999
>Message-ID: <[email-masked]>
>Date: Thu, 21 Jan 1999 21:38:40 +0000
>From: "A. Wik" <[email-masked]>
>To: Vernon Schryver <[email-masked]>
>CC: Lloyd Wood <[email-masked]>, [email-masked]
>Subject: Re: AD's

> ...

>And an increasing amount of spam seems to be going via sites like this:
>Received: from there by sgu-ns1.sg-u.ac.jp (8.8.8+2.7Wbeta7/3.3W9-NEC)

>The sender can choose any "DNS" name he wants ("there" was my test) and
>what's really annoying is the lack of an IP address, not to mention the
>fact that all complaints to these sites' postmaster and root accounts seem
>to be going right to /dev/null.  These TCP wrappers we've heard so much
>about do nothing about it since the relay is fully DNS registered.

---

From: "A. Wik" <[email-masked]>
Date: Fri, 22 Jan 1999 10:41:02 +0200 (EET)

> 	acting as unauthorized Mail Relay) and they'd probably start

Ironically, turning off relaying in new servers forces spammers to use
older ones, which - in some cases - makes tracing more difficult or
impossible.

---

From: "A. Wik" <[email-masked]>
Date: Fri, 22 Jan 1999 10:41:02 +0200 (EET)

---

From: "James D. Wilson" <[email-masked]>
Date: Fri, 22 Jan 1999 06:12:49 -1000

There are several resources out there to fight the various methods of
spammers:

There is MAPS RBL, which is run by Paul Vixie and which lists various
sites who have spammed and refused to stop.

There is ORCA, which maintains a list of dialup IP addresses.  This is
to combat the "direct injection" spammers who run software on their
Windoze boxes and bypass their ISP's mail server in order to hide
their activity from their ISP.  The theory is that any dialup user
should use their ISP's mail server.  

There is ORBS and IMRSS, which maintain lists of unprotected mail
servers.  This lets to refuse connections to known sources of
relay-raped spam.  

The last three (ORCA, ORBS and IMRSS) catch the most spam; the RBL
catches a lower percentage.

All of these are used via DNS like this, for example, to look up
127.0.0.2 (the test address:)

$1 represents the IP address, reversed (in-addr style), such as
2.0.0.127

#!/usr/sbin/sh
TEST=`dig a $1.rbl.maps.vix.com | grep "127.0.0.2" | wc`
exit $TEST
 
If it returns > 0, the site is on the list.  This one checks the RBL. 
The others work the same way with different addresses where it reads
maps.vix.com.

Sendmail 8.9.1+ supports the ability to enable this via configuration
changes.

- -
James D. Wilson

"non sunt multiplicanda entia praeter necessitatem"
    William of Ockham (1285-1347/49)

- -----Original Message-----
From: Gunnar Lindberg [mailto:[email-masked]]
Sent: Thursday, January 21, 1999 9:40 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: AD's

	Gunnar Lindberg

---

From: "James D. Wilson" <[email-masked]>
Date: Fri, 22 Jan 1999 06:12:49 -1000

#!/usr/sbin/sh

- -
James D. Wilson

	Gunnar Lindberg