Subject: Re: Argh. the spam.. make it stop...

From: Vernon Schryver <[email-masked]>
Date: Wed, 31 Mar 1999 13:50:37 -0700 (MST)

] From: "Theodore Y. Ts'o" <[email-masked]>

]    Couldn't you use an SSH tunnel between your roving laptop and your home
]    system, and pipe SMTP through the SSH tunnel?  
] 
] *I* could configure an SSH tunnel if I needed to use that to get back to
] my home system.  I don't consider that a supportable solution to tell
] our help desk to give to random users who need to be roaming and who are
] using off-the-shelf mail clients.

That sounds like at most a small user-interface problem and possibly a
business opportunity.  The SSH tunnel parameters are not complicated.
(Besides SMTP, I also use SSH tunnels to reach confidential HTTP and NNTP
servers from 1000's of miles away.)

> From: Pete Resnick <[email-masked]>

> ...
> My point was that an ISP doesn't need to filter SYN's to port 25 if 
> it runs SMTP AUTH; it can let all traffic through. If a connection 
> comes in unauthenticated, it can (if it wants) allow local 
> deliveries, but it won't relay. If authenticated, it can allow relay 
> and sending of mail anywhere the connector wants.

I doubt we talking about the same filtering.  I think it is:

  1. done by routers owned by the ISP that owns the pool of dial-up modems
    (e.g. UUnet) and that consists of discarding TCP SYN's received via
    dial-up modems and addressed to any other host except a few that are
    owned by the ISP.

  2. by spam targets within SMTP servers or on routers and that consists
    of rejecting all SMTP connections from IP addresses or domains thought
    to be dialups (e.g. da.uu.net).

UUnet has been publicly promising to implement #1 for several months, and
has been publicly recommending #2 for many months.  #2 is widely deployed
on individual SMTP servers using ad hoc lists or the automagic DNS
described at http://maps.vix.com/

In both cases, the SMTP code of the dial-up ISP is not involved.  The only
filtering done by the dialup ISP is against TCP/IP headers and is commonly
done on the ISP's routers.  I do not see how SMTP AUTH is relevant.  The
ISP will have filtered (discarded) the SYN to a distant port 25 long before
the ESMTP AUTH chit-chat.

If you mean that dial-up ISP's would use #1 to force their dial-up
customers to connect only to the ISP's port 25, then SMTP AUTH is still
irrelevant.  Other people in this thread have been saying they do not want
to use the dial-up ISP's SMTP server and object to #1 and #2 filtering.
Second, because the ISP owns the radius servers, the modem banks and
everything else, there is no honest reason why the ISP cannot use any of
the old, already available SMTP authentication mechanisms listed in RFC
2476 and largely fix the spam problem.

> This of course doesn't address our spammers who have the resources to 
> set up their own SMTP servers and connect end-to-end to everyone that 
> they want to spam. But we have other resources for limiting their 
> ability to do that.

For many months, it has been true that almost all spammers set up their
own STMP servers (actually clients) and blast away at port 25 all over
the net.  Their direct targets are generally "open relays" because
filtering of dialups (#2), spam houses, and free email providers is so
common.

No rocket science or even sendmail is required of the spammers.  The
equivalent of some scripts and `telnet domain.com 25` is enough, although
I'd choose to pervert sendmail.  (Spammers do not want a real SMTP client,
since they prefer to give up and not retry after failures.)

Because few if any ISP's are now willing to host the sending machinery of
spammers at a fixed IP address for more than a little while, the spammers
prefer to use throw-away accounts at ISP's such as UUnet that impose no
significant penalties for abuse.  They rent an account for a day or two,
connect to port 25 at open relays, and then get cancelled (or so UUnet
says.)  Another attraction of the dialup pools is that UUnet shields the
identities of their dial-up spammers, which makes it harder for individual
targets to go after spammers with the various state anti-spam laws.  (Some
are talking about using the new Virginia criminal law against UUnet itself,
which might be entertaining.)

Yes, of course, if only the ISP's would impose real penalties on their
spamming customers (e.g. $200 per day of spamming), then the current spam
problem would instantly disappear.  As long as there are major outfits
like UUnet (and UUnet's resellers) that charge $20 for a day's worth of
dial-up relay-rape spamming, technical defenses will be popular.  Moreover,
those defenses, including port-25 filtering, will remain long after the
spam problem is solved.

Vernon Schryver    [email-masked]

---

From: Pete Resnick <[email-masked]>
Date: Wed, 31 Mar 1999 15:27:38 -0600

We seem to be talking past eachother, or more likely I'm not being 
clear. Let's try one last time:

On 3/31/99 at 1:50 PM -0700, Vernon Schryver wrote:

>  1. done by routers owned by the ISP that owns the pool of dial-up 
>modems (e.g. UUnet) and that consists of discarding TCP SYN's 
>received via dial-up modems and addressed to any other host except a 
>few that are owned by the ISP.

OK, let's start with this. Why is this filtering desireable? You say below:

>...the spammers prefer to use throw-away accounts at ISP's such as 
>UUnet that impose no
>significant penalties for abuse.  They rent an account for a day or 
>two, connect to port 25 at open relays, and then get cancelled (or 
>so UUnet says.)

Exactly so. Spammers exploit open relays. That is, they don't want to 
run SMTP servers and make connections for every copy of the message 
they want to send; they want to dump off on someone running an open 
relay. SMTP AUTH removes open relays. Once you have SMTP AUTH, there 
is no need to run an open relay, and every incentive not to (i.e., 
spammers stop using your resources).

So, if open relay people install SMTP AUTH, I no longer would care 
about UUnet installing SYN filters. Furthermore, people who run SMTP 
servers in general will not have to worry (as much) about doing 
incoming router-level filtering. Only mail destined for local hosts 
would be allowed if they are running SMTP AUTH.

That's the extent of my claim.

pr
-- 
Pete Resnick <mailto:[email-masked]>
Eudora Engineering - QUALCOMM Incorporated
Ph: (217)337-6377 or (619)651-4478, Fax: (619)651-1102

---

From: Pete Resnick <[email-masked]>
Date: Wed, 31 Mar 1999 15:27:38 -0600

pr