Fwd:Re:[Full-Disclosure] Proposal: how to notify owners of compromised PC's

From: Thomas Zangl - Mobil (mobil_at_tzi.dhs.org)
Date: 01/28/04

  • Next message: Andrew Hecox: "[Full-Disclosure] Mydoom.B"
    To: full-disclosure@netsys.com
    Date: Wed, 28 Jan 2004 23:09:16 +0100
    
    

     
    Am Wed, 28 Jan 2004 18:36:34 +0000, schrieb petard <petard@freeshell.org>:

    Hi,

    >I left my ISP about 9 months ago because they implemented this very
    >policy. It entirely destroyed my ability to send email from my preferred
    >address. Our SMTP setup at example.com relays mail from people
    >claiming to be @example.com if and only if they have been authenticated
    >using a client X.509 certificate issued by the example.com root
    >certificate authority. The mechanism for achieving this is to connect to
    >smtp.example.com, port 25, and use the STARTTLS command after the EHLO,
    >as described in RFC 3207. The policy you describe broke this, and
    >therefore prevented me from sending mail to my cohorts at example.com.
    >The ISP would not make an exception, so I left. I was not the only one.

    As I said before, the ISP _HAS_ to provide an alternative mail relay, open
    for every FROM address the user whishes to use. (If its legal or not thats
    another point). If you really need access to YOUR smtp server, it should
    be possible to configure your MTA to listen to an alternative port than
    25 too. I use this kind of setup for myself as Im "smtp firewalled" the
    way Ive described above.

    The benefit (in my opinion) would be greater, in my enviroment, then the
    loss of freedom individual users will suffer. In case of static IPs ISPs might
    be able to offer exceptions.

    --
    ----------------------------------------------------------------
    ,yours Thomas Zangl -thomas@tzi.dhs.org- -TZ1-6BONE-
    -http://tzi.dhs.org - http://www.borg-kindberg.ac.at
    Use YAMC! now! Get it at http://www.borg-kindberg.ac.at/yamc/
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html
    

  • Next message: Andrew Hecox: "[Full-Disclosure] Mydoom.B"

    Relevant Pages

    • Re:[Full-Disclosure] Proposal: how to notify owners of compromised PCs
      ... Our SMTP setup at example.com relays mail from people ... The policy you describe broke this, ... If you really need access to YOUR smtp server, ...
      (Full-Disclosure)
    • Re: company name change
      ... RUS (Recipient Update Service). ... After adding the new SMTP domain in Recip Policies and making it primary, ... Re: uncheck - yes. ... If you furthermore choose to Apply the policy Now ...
      (microsoft.public.exchange.admin)
    • Re: company name change
      ... We have two Recip Policies, Default and another named Email Purge. ... Default Policy lists our current domain as SMTP, it is the only SMTP address ... CCMail for our Defaul Recip Policy? ...
      (microsoft.public.exchange.admin)
    • Re: company name change
      ... our recipient policy or in IIS on our SMTP server. ... Add new domain to Default recipient policy. ... I'm not sure how your SMTP servers are configured. ...
      (microsoft.public.exchange.admin)
    • Re: company name change
      ... If you edit the smtp address in the policy, you'll see a section for "This ... our recipient policy or in IIS on our SMTP server. ... Add new domain to Default recipient policy. ...
      (microsoft.public.exchange.admin)