Subject: [homegate] Default Outbound Portblocks, Logging, Egress Filters

From: Sabahattin Gucukoglu <[email-masked]>
Date: Sat, 13 Feb 2010 17:40:37 +0000

I understand that making filtering decisions on behalf of others is unwise.  However, it seems to me that homegate can recommend a default, user-revertable (or, if management requires it, an ISP-revertable and ISP-managed) block against "Commonly-abused services", or SMTP for short, as a best practice.  It's contentious whether this makes any difference to the spam problem, as much that it would hurt an ISP's business any less when done by a home gateway than by a border router.  However, I think it's a good idea, for all the reasons those wishing to run leaf MTAs and yet familiar with the spam problem and the effectiveness of the solutions available to date know.

The same stance can probably be made concerning egress filtering, and logging of the "Bad" traffic at the consumer's premises.  All of this will doubtless become somewhat more attractive when ISPs have to take on CGNs and whatnot in the face of an increasingly interested legislative mindset in parts of the world wishing to retain customer data.  Smart edges, fast core, angry businesses on dynamic range blacklists, etc.

What do people say?

Cheers,
Sabahattin

---

From: Jason Livingood <[email-masked]>
Date: Mon, 15 Feb 2010 11:34:37 -0500

Interesting question, and I know that the Messaging Anti-Abuse Working Group
(aka MAAWG) has focused on this over the years.  I believe they also have a
recommendation document regarding Port 25 management in ISP networks.  That
document recommends (among other things):

1.    Provide Email Submission services on port 587, as described in RFC
2476. 2.    Require authentication for Email Submission, as described in RFC
2554.

If I understand the question you then, does that mean that port 25 is shut
by default (which is configurable), or does port 25 translate you to 587?
Or are you suggesting something entirely different?

Regards
Jason

On 2/13/10 12:40 PM, "Sabahattin Gucukoglu" <[email-masked]>
wrote:

> I understand that making filtering decisions on behalf of others is unwise.
> However, it seems to me that homegate can recommend a default, user-revertable
> (or, if management requires it, an ISP-revertable and ISP-managed) block
> against "Commonly-abused services", or SMTP for short, as a best practice.
> It's contentious whether this makes any difference to the spam problem, as
> much that it would hurt an ISP's business any less when done by a home gateway
> than by a border router.  However, I think it's a good idea, for all the
> reasons those wishing to run leaf MTAs and yet familiar with the spam problem
> and the effectiveness of the solutions available to date know.
> 
> The same stance can probably be made concerning egress filtering, and logging
> of the "Bad" traffic at the consumer's premises.  All of this will doubtless
> become somewhat more attractive when ISPs have to take on CGNs and whatnot in
> the face of an increasingly interested legislative mindset in parts of the
> world wishing to retain customer data.  Smart edges, fast core, angry
> businesses on dynamic range blacklists, etc.
> 
> What do people say?
> 
> Cheers,
> Sabahattin
> 
> _______________________________________________
> homegate mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/homegate

---

From: Sabahattin Gucukoglu <[email-masked]>
Date: Mon, 15 Feb 2010 17:52:48 +0000

> Or are you suggesting something entirely different?

Shut by default and configurable by end-user (or, less preferably, by ISP, but that's a whole different argument).  I did read the MAAWG recommendation; your mentioning redirects suggests a possible workaround for the end-user configuration hassle implied by port 587, although that's very shaky ground, indeed.  The idea is to prevent zombies from being able to unleash themselves on victim MTAs without some sort of impediment from our home gateways.  It means there's more of an incentive for ISPs to be less careful (or more generous) with their own port 25 blockages, which may be necessary in the near future with the address crunch putting businesses alongside residents, and so on, and which neatly facilitates the best practice without so much help from ISPs and so much inconvenience to legitimate users.  The zombie spam present on today's Internet certainly gives credence to the argument that making it an ISP-only responsibility isn't notably useful.

Cheers,
Sabahattin