[25861] in North American Network Operators' Group

home help back first fref pref prev next nref lref last post

spam from aol (was Re: ARIN whois)

daemon@ATHENA.MIT.EDU (Jared Mauch)
Mon Nov 22 10:09:11 1999

Date: Mon, 22 Nov 1999 10:05:16 -0500
From: Jared Mauch <jared@puck.Nether.net>
To: "Forrest W. Christian" <forrestc@iMach.com>
Cc: Kai Schlichting <kai@pac-rim.net>, nanog@merit.edu
Message-ID: <19991122100516.E12588@puck.nether.net>
Mail-Followup-To: "Forrest W. Christian" <forrestc@iMach.com>,
	Kai Schlichting <kai@pac-rim.net>, nanog@merit.edu
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
In-Reply-To: <Pine.BSF.3.96.991121221114.20965A-100000@workhorse.iMach.com>
Errors-To: owner-nanog-outgoing@merit.edu


	If you plug-gw it, you can also just tcp_wrap it, and then use
your hosts.allow, etc.. to stop spammers.

On Sun, Nov 21, 1999 at 10:16:39PM -0700, Forrest W. Christian wrote:
> On Sun, 21 Nov 1999, Kai Schlichting wrote:
> > THEY WILL FIND YOUR RELAYS ON THEIR OWN, AND THEY WILL ABUSE THEM, NO
> > MATTER HOW LOUD YOU SCREAM.
> 
> In transition to a new mail server (with a new address), I installed a
> plug-gateway on the old server to redirect mail.
> 
> Unfortunately, plugd hides the ip address of the sender, and since I trust
> my netblocks, all of the ip addresses on the old server became "spam relay
> entry points".
> 
> It took the spammers 96 hours to find 3 of the addresses on that box and
> for us to be listed in orbs.  I figured I would have at least had a week
> or two to figure out a better way.
> 
> I ended up staying up all night getting transparent proxying to work right
> on the new server and making it work with a cisco route-map.

-- 
Jared Mauch  | pgp key available via finger from jared@puck.nether.net
clue++;      | http://puck.nether.net/~jared/  My statements are only mine.
END OF LINE  |


home help back first fref pref prev next nref lref last post