28 Feb
2000
28 Feb
'00
9:44 a.m.
On Feb 24, 21:15, Eric Smith wrote:
Hans wrote:
My ISP runs two SMTP mail servers, one open, the other not; for a very good
reason. A large number of customers travel across Europe, and it is not
practical for them to always dial the ISP at international rates. Hence,
there are a number of agreements between several ISPs in several European
countries, which allow customers registered with one ISP to use the
points-of-presence of another. However, the roaming user typically wants
to keep his normal email address (ie, have mail appear to originate from
his normal address). To do so, he must either use his "home" server
despite his temporary IP address/hostname not matching that server's domain
(which would look like an attempted forgery to a spam-blocking server) or
must use the "local" server and forge the sender address (which would also
fail on any normal spam-blocking server).
This practice is quite widespread in Europe. Jay's use of MAPS doesn't
bother me, because I can (almost) always use the blocking server, and I
expect that for most roaming users the inconvenience is minimal. However,
until there's a sensible system to deal with roaming users' need to send
mail as well as receive it, there will be open relays.
--
Pete Peter Turnbull
Dept. of Computer Science
University of York
What's proper or not is a matter of opinion,
and in my mind
open relays are a basic part of the mail system.
Can you cite any legitimate use for a completely open relay? I can't
think of any. Lacking such examples, I agree with Scott G. Taylor's
statement:
> The simple fact-of-the-matter is, open relays are wrong. 
28 Feb
28 Feb
10:35 a.m.
On Mon, Feb 28, 2000 at 11:44:09PM +0000, Pete Turnbull wrote:
until there's a sensible system to deal with
roaming users' need to send
mail as well as receive it, there will be open relays.
There is an RFC for a roaming IP scheme that allows you to get the same
address even when plugging into a "foreign" network. However I've yet to
see a working implementation of it anywhere. Seemed like a good idea.
At one point there was talk in the ham community of using this method to
give the Mir continuous connectivity via an array of amateur packet
stations around the globe but I don't think it actually got done (and it's
too late now).
--
_______ http://www.bigfoot.com/~ecloud
(_ | |_) ecloud(a)bigfoot.com finger rutledge(a)cx47646-a.phnx1.az.home.com
__) | | \__________________________________________________________________
Join the ProcessTree Network: For-pay Internet distributed processing.
http://www.ProcessTree.com/?sponsor=5903
10:55 a.m.
"Shawn T. Rutledge" <rutledge(a)cx47646-a.phnx1.az.home.com> wrote:
There is an RFC for a roaming IP scheme that allows
you to get the same
address even when plugging into a "foreign" network. However I've yet to
see a working implementation of it anywhere. Seemed like a good idea.
There are at least two working, publicly-available implementations for
Linux.
Neat stuff!
10:35 a.m.
It was thus said that the Great Pete Turnbull once stated:
Hiway (a subsidiary of Verio and their primary web hosting division) set
up a system whereby you have to check your mail first before sending. They
have a modified POP server that records the IP address of the person
requesting their mail. Sendmail will then allow relaying from that IP
address for a period of time before being disallowed again.
Since most people check their email before sending, it's not that
inconvienent to use. Something similar could probably be set up.
-spc
Can you cite any legitimate use for a completely
open relay? I can't
think of any. Lacking such examples, I agree with Scott G. Taylor's
statement:
> The simple fact-of-the-matter is, open relays are wrong.
My ISP runs two SMTP mail servers, one open, the other not; for a very good
reason. A large number of customers travel across Europe, and it is not
practical for them to always dial the ISP at international rates.
10:53 a.m.
Pete writes:
My ISP runs two SMTP mail servers, one open, the other
not; for a very good
reason. A large number of customers travel across Europe, and it is not
practical for them to always dial the ISP at international rates. Hence,
This can be solved by having your POP or IMAP daemon open up temporary
access to your SMTP server from the roaming IP address after the POP or
IMAP connection is authenticated. This is what I do for some of my users.
If you use qmail there's a readymade program available, but it should be
easy to set it up for Sendmail.
Another approach is for the "roaming" relay to only accept email with both
envelope sender and from headers of legitimate customers. This isn't as
secure, but is still much better than a wide-open relay. If a spammer
discovers the relay by scanning IP addresses for SMTP ports, they still
won't be able to use it unless they also can determine who the legitimate
users of that SMTP server are.
IMNSHO, the disadvantages of the open relay *far* outweigh the benefit.
However, until there's a sensible system to deal
with roaming users' need to
send mail as well as receive it, there will be open relays.
Lots of sites are starting to refuse mail from open relays. Your ISP is
going to have to come up with a better solution.
11:49 a.m.
Pete wrote....
My ISP runs two SMTP mail servers, one open, the other
not; for a very
good
reason. A large number of customers travel across
Europe, and it is not
practical for them to always dial the ISP at international rates. Hence,
there are a number of agreements between several ISPs in several European
countries, which allow customers registered with one ISP to use the
points-of-presence of another. However, the roaming user typically wants
to keep his normal email address (ie, have mail appear to originate from
his normal address). To do so, he must either use his "home" server
despite his temporary IP address/hostname not matching that server's
domain
(which would look like an attempted forgery to a
spam-blocking server) or
must use the "local" server and forge the sender address (which would also
fail on any normal spam-blocking server).
Open relays have NOTHING to do with the above situation - talk about
throwing the baby out with the bathwater - the above scenario is akin to
saying "gee, I want to allow http through my firewall, so lets just open the
firewall up for all ports and all services to and from anywhere". Sheesh.
There are two other much more "standard" methods of allowing the above.
First, the user could still check his email at his original/local provider
via pop or imap, and he could send mail from the smtp server at his
nonlocal/traveling provider. Second, any time an ISP sets up an agreement
with another ISP to let their users roam, they could just add the roaming
ISP's domain name to their sendmail.cw file to allow relaying from that
domain only. The easy (and recommended) approach is to do BOTH of the
above - one for inbound and one for outbound.
On a properly configured pop and smtp server, neither of the above methods
appear as forgeries, and neither method is blocked by any spam-blocking
methods I've ever seen.
Both of these situations are very easily handled by any modern mail client
which lets you have more than one mail account configuration and for each
account lets you specify inbound vs. outbound servers. Yes, this type of
setup would cause really antique mail clients problems, but the hardware
those old mail clients run on isn't exactly something portable you'd be
carrying around the country <like a PDP - GRIN>.
I might add also that neither of the above scenarious are problematic with
MAPS either. Anyone have any other scenarious where a completely open relay
is a <shudder> good idea? :)
Jay West
8846
days inactive
8846
days old
5 comments
5 participants
participants (5)
-
eric＠brouhaha.com -
pete＠dunnington.u-net.com -
rutledge＠cx47646-a.phnx1.az.home.com -
spc＠armigeron.com -
west＠tseinc.com