Subject: [Asrg] 6. Proposals - rDNS / MTA MARK

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 02 Dec 2003 17:36:40 -0500

The following response has been received from someone off-list. The 
person asked for his name to be kept private.

Yakov

-------- Original Message --------
Subject: Re: rDNS draft for spam

 >I wanted to get your quick thoughts on something. One of the proposals we
>have called MTA MARK, uses the rDNS records to mark a specific IP as a 
>mail server or not a mail server. The purpose of this is to allow ISPs to 
>mark their IP space as such in order to reduce the impact caused by 
>hijacked computers sending spam. This proposal has also been suggested to 
>be expanded into a more general one, to let the IP address owner to be 
>able to mark any IP and the services allowed from that IP.

Putting things in the reverse map has both advantages and disadvantages.
I used for a while ISP that marked their whole IP range as spam source,
and at the same time refusing to forward email that did not conform
to <user>@<isp>.net. So I do not trust ISP's to do the right thing
and most of them do not have egress filtering thus allowing spoofed
packets to leave their networks.
TXT records are fine for experimentation a new record type is
the way to go if this is good approach but the cost of
backwards compatibility is high.
The argument that it is expensive to upgrade to a new type are
historic, most modern DNS software can handle unknown types [RFC3597].

>Many people have raised concerns about the fact that things like this 
>should not be present in the rDNS zone at all. I wanted to get your 
>feedback on that issue and the draft in general.

This is a issue that should be discussed in DNSOPS but my feeling
is reverse tree should be used better and this is as a good place as
any other for capability of a host.
I (personally) think the approach that uses the forward map to
list mail sources at zone apex, is better as that requires far
fewer entries.

The draft example seems to suffer from a common misunderstanding
that wildcard will match an existing name in a zone if the type
does not exist, this is false see:
http://www.ietf.org/internet-drafts/draft-ietf-dnsext-wcard-clarify-02.txt

-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"Power tends to corrupt, and absolute power corrupts absolutely" (Lord 
Acton)
-------

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Markus Stumpf <[email-masked]>
Date: Wed, 3 Dec 2003 00:36:52 +0100

> packets to leave their networks.

There is a contract bewteen an ISP and a customer. The contract
regulates rights and liabilities of both parties. If the ISP does
not conform to the contract one can terminate it at any time and
probably even sue the ISP for breach of a contract. This is nothing
that is related to trust. With the same arguments you could say HTTP
is bad, because the ISP does transparent proxy and they probably modify
the contents of the web pages.
If an ISP has a contract that clearly says: "you are not allowed to offer
services, this is a surf account only" they might as well block incoming
ports like smtp, http, ... they don't need to use something like MTA MARK.

> historic, most modern DNS software can handle unknown types [RFC3597].

RFC3597 was released Spetember 2003.
With up to 5% of installations running even bind-4.x how long do you
think it will take for rfc3597 to propagate? Even modern BIND servers
didn't get it right. How about DNS proxies in firewalls, stub resolvers, ...

While I agree that a new query type should be the way to go, it still is
expensive, even with RFC3597. And the IETF is sometimes sloooow. Spam is
hitting hard each day and we want a solution ASAP and not in some years
when all have approved the new QTYPE.

> any other for capability of a host.

There are people (even in IETF DNSOP) that think revDNS is obsolete
and if not for IPv4 it will be at least for IPv6 ;-)

> http://www.ietf.org/internet-drafts/draft-ietf-dnsext-wcard-clarify-02.txt

We are/were aware of that. The warning about wildcards not being applied
to subdomains should probably be extended with a notice about that.

--------------------------------

Today I had a very valuable talk with Arnt Gulbrandsen who made some
good comments and suggestions.

Currently we tend to a more structured approach like

  _perm._smtp._tcp.8.0.30.195.in-addr.arpa	IN	TXT	"1"
  _perm._smtp._tcp.1.0.30.195.in-addr.arpa	IN	TXT	"0"

or like

  _smtp._tcp.8.0.30.195.in-addr.arpa		IN	PERM	1
  _smtp._tcp.1.0.30.195.in-addr.arpa		IN	PERM	0

The LHS used is derived from the hierarchy defined for SRV records
and is well defined. For TXT records the "_perm" is necessary to define
an object that is queried, aka a "question". If there is a special
QTYPE like PERM this is not needed. The IESG doesn't like non questions ;-)

It would also be possible to use another level of subdomains like

  _send._smtp._tcp.8.0.30.195.in-addr.arpa		IN	PERM	1

as this provides more flexibility and could be extended to

  _send._smtp._tcp.8.0.30.195.in-addr.arpa		IN	PERM	0
  _send-crammd5._smtp._tcp.8.0.30.195.in-addr.arpa	IN	PERM	1

to indicate that one should allow only authenticated connections.
This could be used to transport company policies like "from this (sub-)net
accept only connections with ciphered passwords. we don't want that our
employees use plaintext passwords accross the Internet".
The drawback is that it uses a lot of DNS bandwidth and the server has
to do a lot of queries for all possible "options".

A solution to that would be to make the RHS not a boolean but e.g.
a 64 bit integer and give it a meaning:
   0    dont allow connections
   1	allow unauthenticated connections (aka outgoing MTA)
   2	allow only authenticated connections
   3	allow only authenticated connections with ciphered passwords
The same could of course also be achieved with TXT records.

One question raised today was:
  Why is this useful at all? MTA MARK could also be accomplished much
  more effective by a firewall rule.
This is IMHO a good and valid question ;-)
An answer might be that firewalls rules are expensive, the more rules
a firewall has to check the more expensive they get. So with large
networks MTA MARK (or a more generalized form) could be a alternative.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"

---

From: "Chris" <[email-masked]>
Date: Wed, 3 Dec 2003 13:05:10 +1030

Yavkov said...

> So I do not trust ISP's to do the right thing

I think it has been amply shown in the past that any system that relies on
an ISP to "do the right thing" is destined to fail.

laziness, cost, lack of knowledge or whatever will prevent many from doing
so.

ISP's could prevent much of the abuse (not just mail) that occurs on the net
today with such things as your example above, egress filtering. but do they?

So a system (whichever) must not rely on the ISP, but (IMHO) is better if
the ISP is "left out in the cold" if he doesn't conform.

that way when mail stops coming in or going out they must upgrade.

That is also why I feel that any system must be at zero dollars or as low as
possible to implement.

Would the web have grown as fast as it did if people were forced to pay M$
dollars for web servers ?

somehow I doubt it.

Regards
Chris

---

From: "Chris" <[email-masked]>
Date: Wed, 3 Dec 2003 13:20:37 +1030

My apologies Yakov for the typo

Regards
Chris

> -----Original Message-----
> 
> 
> Yavkov said...
> 

snip...

---

From: "Mark E. Mallett" <[email-masked]>
Date: Tue, 2 Dec 2003 21:54:43 -0500

> packets to leave their networks.

Marking would only be one element in the total picture.  An ISP that
marked every address as an MTA would probably be subject to other
sorts of classification.  Re filters: MTA Marking has the advantage of
merely providing advice.  If I choose to accept SMTP connections from
my friend Joe's DSL system, I can do so even if his IP address is
marked as "not an MTA" (or more properly, "not an MTA that the owner
of the IP infrastructure operates).  I couldn't do so if the marking
was via firewall.  I prefer the approach that provides information and
lets participants act on that information.

You're always going to have bad actors (in this example, ISPs); I
don't think that's anything specific to MTAMark.  (That's similar to
that comment about how LMAP is bad because it will encourage viral
infections:  you can't not do something because somebody will do
something else bad.)

> any other for capability of a host.

Indeed.

> list mail sources at zone apex, is better as that requires far

But that's a different thing.  There's domain/MTA scope a la LMAP, and
there's IP marking a la MTAMark.  Unless I miss your point (which is
altogether likely).

> http://www.ietf.org/internet-drafts/draft-ietf-dnsext-wcard-clarify-02.txt

D'oh.  It's easy to make that mistake, even when one knows better.

-mm-

---

From: Markus Stumpf <[email-masked]>
Date: Wed, 3 Dec 2003 04:48:16 +0100

> an ISP to "do the right thing" is destined to fail.

This is also true for everything an end user does. And it is also true
for everything that so called "consultants" do. To cite a customer:
   "no our mailserver can't be an open relay. we have just paid
    15000 bucks for a firewall and 10000 bucks for a consultant to set
    things up".
This is also true for anything programmers do, just look at bugtraq.

> today with such things as your example above, egress filtering. but do they?

Enduser could prevent much of the abuse by simply not being so ignorant
and updating their software. Microsoft could prevent much of the abuse
by fixing their broken software. OpenSource programmers could prevent
much of the abuse by learning how to write programs.

I have blocked a customer that relayed viri through our mailserver and
notified him via phone. First he nearly called me names then they tried
to sue us. It's hard to find a judge that isn't ignorant and for whom
sending viri is really something that is evil and not something that
"you must live with".

> the ISP is "left out in the cold" if he doesn't conform.

A system (whichever) must not rely on any human without a clue or it
will not work. The best would be if everyone had to pay 10 bucks for
every email that he'd like to send, to a worldwide central authority.
9.90 will go to some human organisations and 0.10 will be used to
make the central authority.
Then after about 6 weeks we can shut down email completely as all will
fall back to send CDs and letters and make phone calls. Shutting down
SMTP and email will then solve the spam problem. Mission accomplished.

> dollars for web servers ?

Would we have so much spammers if email weren't free and cheap?
Would the web be such a mess if HTML would be really complicated?
Would the Internet be so fsck'ed up if everyone would have to do a
   really hard exam before getting access and an even harder one before
   s/he is allowed to connect a computer to the Internet?

If you don't like your ISP, get a new one. If everyone does it the bad
ISPs will die. BUT: the bad ISPs are cheap, so everyone chooses them and
all cry about how bad the world is. Don't cry, do something about it.
It costs money? Only death is for free - and then it costs life.

	\Maex

---

From: "Chris" <[email-masked]>
Date: Wed, 3 Dec 2003 14:49:34 +1030

and your point is?

Regards
Chris

> From: Markus Stumpf [mailto:[email-masked]]
> Sent: Wednesday, December 03, 2003 2:18 PM
> To: Chris
> Cc: Markus Stumpf; ASRG
> Subject: Re: [Asrg] Re: 6. Proposals - rDNS / MTA MARK
>
>

---

From: Markus Stumpf <[email-masked]>
Date: Wed, 3 Dec 2003 05:29:56 +0100

> and your point is?

Bashing anyone will not solve the problem.
Either you have some substantial comments to make or you better make no
comments at all.

Even more if you top quote some 10 unaltered lines just for 4 words.

	\Maex

---

From: "Chris" <[email-masked]>
Date: Wed, 3 Dec 2003 15:06:56 +1030

Now I may be wrong but.

It appears our Mr Markus Stumpf runs, administers or has something to do
with an IP blacklist (blackhole)

I must assume he has objected to comments I have made regarding blacklists.

Therefore it seems he has dropped my ISP into his IP blackhole

so rather than simply filter me out individually, he has blocked a few
thousand subscribers (many are businesses)

Sort of proves my point!

Chris

Reporting-MTA: dns; mail.chariot.net.au
Arrival-Date: Wed,  3 Dec 2003 14:45:46 +1030 (CST)

Final-Recipient: rfc822; [email-masked]
Action: failed
Status: 5.0.0
Diagnostic-Code: X-Postfix; host moebius.space.net[195.30.1.25] said: 553
    Blocked (203.87.95.38 / 20031117) Your mailserver is sending spam/UCE,
    probably an open relay. See http://www.space.net/abuse/rbl/ (in reply to
    RCPT TO command)

---

From: Yakov Shafranovich <[email-masked]>
Date: Tue, 02 Dec 2003 23:43:52 -0500

This is not a message for the public list, bashing each other is not 
going to help. If you have a problem with someone in the group, PLEASE 
contact the person, or the co-chairs OFF-LIST first.

If you look at the message closely, "Blocked (203.87.95.38 / 20031117)", 
the second number appears to be a date, which is at least three weeks 
earlier than today. If you want to follow up on this, do it off-list.

Sincerely,
Yakov Shafranovich
Co-Chair, ASRG

-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"I ate your Web page. / Forgive me. It was juicy / And tart on my 
tongue." (MIT's 404 Message)
-------

---

From: Markus Stumpf <[email-masked]>
Date: Wed, 3 Dec 2003 06:05:29 +0100

> Now I may be wrong but.

You are.

> I must assume he has objected to comments I have made regarding blacklists.

No you must not.
Btw. I haven't seen/can't remember comments from you regarding blacklists
and I don't care either.

> Therefore it seems he has dropped my ISP into his IP blackhole

No, it is because the mailserver is sending spam as the message says.
The block was put in 17-11-2003 (22:30 GMT+1)
    See:    http://rblsrv.space.net/history/203/87/95/38
These are a few samples.
[email-masked]  btw. is an address for which we receive some 10 spams
a day and the domain @bllv.de receives dictionary attacks every other week.

>     probably an open relay. See http://www.space.net/abuse/rbl/ (in reply to

If you have a problem with the block there is a contact form at
    http://www.space.net/abuse/rbl/
Use it. This list is not the appropriate place.

At least I can understand now why you are bashing ISPs ...

	\Maex

---

From: "Chris" <[email-masked]>
Date: Wed, 3 Dec 2003 16:22:39 +1030

I must apologise to Markus

He is correct my ISP has been blacklisted for a while and I have worked out
why I have only just started receiving the bounces. (stupid of me not to
figure it out earlier)

Coincidence has a lot to do with this.

I am sending this to the group not offlist because I want to make it public
and because If I send directly to him it will bounce :(

Regards
Chris

> Sent: Wednesday, December 03, 2003 3:35 PM
> To: Chris
> Cc: ASRG; Markus Stumpf

---

From: "Jon Kyme" <[email-masked]>
Date: Wed, 03 Dec 2003 10:27:56 +0000

> Now I may be wrong but.

 http://openrbl.org/ip/203/87/95/38.htm

--