lkml.org 
[lkml]   [2000]   [Jan]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [Semi-OT,important] ORBS globally blocks users of these lists
On Mon, 17 Jan 2000, Khimenko Victor wrote:
> They cannot find exact border. It's easy to find out that some of
> Above.net's servers are blocked and what adresses are assigned to
> Above.net. It's not easy (or perhaps even impossible for outsiders) to
> find out what exactly is blocked. So the whole net is marked as "bloking
> one".

It certainly is easy to find an exact border. You have three types of
servers. Open relays, blocked/untestable servers and compliant servers. It
takes more work to dig up the net blocks than it does to automatically
tally.

Being that all the servers I touch fit 100% into the compliant group as is
reported by ORBS itself with a couple of clicks, I'd say it's pretty darn
easy to tally it correctly.

> B> Read again what I wrote. In specific, mail.linux.com has been probed by
> B> ORBS and is listed as compliant. The ORBS probe HAS checked it and it IS
> B> anti-spam but it is STILL blacklisted because another section of above.net
> B> is blocking ORBS.
>
> This is strange :-( If they are in ORBS static list them why ORBS tried
> to probe them ? Hmm. Anyway I can not find mail.linux.com (210.201.200.216) in
> ORBS right now. Neither as "Open Relay" (216.201.200.206.relays.orbs.org) nor
> as "Non Open Relay" (216.201.200.206.ok.orbs.org)... If you are using different
> IP address as source for outgoing traffic then you can just tune you system
> slightly, that's all.

Go to the verify page and type in the IP, it'll come back in a moment with
an 'OK' status.

The IP fits into an above.net netblock which is in their hallofshame.html
page.

> I can not see how mail.linux.com is affected :-(

Look at http://www.orbs.org/hallofshame.html, 1/2 down the page. Netblock
216.200/16 neatly surrounds mail.linux.com.

> B> If you are a US citizen, you have the right to vote and affect legislation.
>
> B> It's not a problem until it's your problem?
>
> If it'll become my problem I know how to fix it :-) I can not change ISP
> (it's school and we had no choice) but I have quite a few friends who can
> work as mail relay for me if our ISP will be stupid enough to try to block
> ORBS. BTW my first discovery of ORBS was when it sent me mail where I was
> notified about possibility to use our system as open-relay.

When your school becomes blocked, you goto your friends, when your friends
become blocked, you go where? How many times are you going to pack up and
move your email before enough is enough?

> Not nazi police but more like phone company master :-) And yes, phone company
> master CAN ask me to show him what's connected to my phone line. And it WILL
> shut up phone line if I'll refuse to do this. It's perfectly legal here (though
> usually phone master is to lazy to go to my home :-)

Yes, -your- fone line. Not your neighbors or anyone else you call. Only
-your- fone line.

> And which address is affected ? 210.201.200.216 is not there.

Yes it is. Look at the above URL. Also look at
http://www.orbs.org/bugtraq.html and http://www.orbs.org/above.net.txt.

> They are added there. As "open relay piked up by automated system".
> -- cut --
> [khim@dell khim]$ host mail.above.net
> mail.above.net has address 207.126.96.177
> mail.above.net mail is handled (pri=5) by email.above.net
> [khim@dell khim]$ host 177.96.126.207.relays.orbs.org.
> 177.96.126.207.relays.orbs.org has address 127.0.0.2
> [khim@dell khim]$ host -t TXT 177.96.126.207.relays.orbs.org.
> 177.96.126.207.relays.orbs.org descriptive text "Open relay - see http://www.orbs.org/verify.cgi?address=207.126.96.177"
> -- cut --

Now look at mail.linux.com:
-- cut --
# host 210.201.200.216.relays.orbs.org.
210.201.200.216.relays.orbs.org has address 127.0.0.4
# host -t TXT 210.201.200.216.relays.orbs.org.
210.201.200.216.relays.orbs.org descriptive text "above.net has multiple
open relays and has blocked the ORBS tester."
-- cut --

> Exactly. There are NO WAY to automatically find out which servers are bloking
> ORBS and which are not. So they are all marked as "netblock entry":
> -- cut --
> [khim@dell khim]$ host 177.196.126.207.relays.orbs.org.
> 177.196.126.207.relays.orbs.org has address 127.0.0.4
> -- cut --

Yes, there certainly is. Think about it. How do you test the entire
internet address space for open relays? Do you start by blacklisting the
entire thing because "there is no way to tell" which ones are good and bad?

No. You list the servers that return 400/500 responses to relay injection,
you list servers that are unknown status (blocked) and you list servers that
grant 200 responses.

> It's up to admin to allow or refuse "netblock entries". Hmm. Perhaps I should
> add check for .ok.orbs.org. before check for relays.orbs.org. ...

# host -t TXT 210.201.200.216.ok.orbs.org.
210.201.200.216.ok.orbs.org is a nickname for 2.0.127.127.ok.orbs.org
2.0.127.127.ok.orbs.org descriptive text "This server has been tested by
ORBS and appears to be secure against relaying"

Funny how it's a compliant server by ORBS but ORBS feels it's fine and dandy
to levy the blacklist, eh?

> There are NO automatic procedure to find blocking. Thus all automatisation
> works ONLY till bloking attempts are detected.

You have three types: Compliant, Unknown, and Non-compliant. Systems that
fit in Unknown could be broken, down, bad routing, and they could be
firewalling ORBS.

It doesn't matter. Compliant servers should NOT be blocked.

This entire discussion about blocking is not relevant to the rest of the
address space served by above.net, above.net is blocking a segment, we exist
in a different segment.

-d


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:55    [from the cache]
©2003-2011 Jasper Spaans