Care to explain just why you didn't follow the only sensible measure, which is to go through your ISPs mailserver, which *must* relay for you?

If you're on dialup, there's absolutely no reason to do it any other way - and if you had a valid reason, wtf are you doing on a dialup line with no fixed IP?

Also, there's a great many mailservers that are filtering based on DULs, i.e. if you're on a dialup, there's quite some chances that your emails won't be accepted at the other end anyway.

No, you weren't using the service correctly, IMHO. And you haven't read your ISPs terms of use, probably.

You probably also haven't ever had the "luck" of handling a larger network's abuse@ account.

Your ISP offers an email service - which goes through it's mailserver. They deliver - it's not the ISPs problem that you didn't use the service properly.

I'd also say that they offer due diligence - protecting everybody else from misconfigured mailservers (open relays), from zombies (think trojans exploited by spammers) etc. on their network - I consider that a good thing.

[I'll add a remark that I've encountered quite some admins who can't properly configure a mailserver - so it's definitely not something I want to see done and put on the 'net by Mr. anybody, when I have to bear the consequences of that incompetence.]

Invalid comparison. I'd see it rather as an airbag on the driver's side which you can't switch off [hint: there's no reason to want an off switch there, although there are good reasons to have it for the other seat].

I've got LuxDSL. I constantly send mail from here with other domains than pt.lu. mailsvr.pt.lu relays it for me - as I'm on the P&T network. As you know about SMTP servers, I'll just say "smarthost".

Of course! You're on his network, he knows who you are - the

moment you're dialing in! If you abuse the service, bye bye your account, and chances are you'll hear from the ISPs lawyers or at least from their billing service.

There is no security in checking To: and From: fields (i.e. the mail's body). There's not even much point in checking the envelope From:. That's for the case of users *on the ISPs network*.

Maybe so that spammers can easily open up an account, use it for a spam run, and forget it afterwards? It's not like GMX, web.de & Co do a thorough job of verifying the data you provide them when opening up an account... Using a company mailserver that way would make more sense.

Indeed, authenticated SMTP can help there - it would be a grave mistake for such a setup to accept plain SMTP (open relay, as it would be trivial to fake the domain part). I still don't see a point in going to an external service - unless your ISPs mail server is extremely unreliable, which would be a reason to find another ISP.

Still, normal procedure is to use the ISP's mailserver for outgoing mail, and access the mail provider's server through POP3/IMAP/whatever to retrieve your mail.

Hmm... you said it above yourself - look at your firewall logs. Those logs are precisely the result of the lack of security out there. If ISPs did filter by default, and open up specific ports on demand by individual users, things would look much much better. Really, this isn't the Internet of 10 years ago. Keeping everything wide open for everybody would IMO be highly irresponsible. It's totally illusory to think just anybody could properly secure his/ her internet access, when even way too many supposed "experts" manage to totally botch even simple stuff.

I know perfectly well. And every normally set up mail client sends their mail through the ISPs mailserver. Using other mail servers, even through smtp-auth, is not usual.

>I have 5 years experience with mail servers, know the SMTP protocol, the >sendmail.cf file and already have worked for an ISP!!!

Eric Dondelinger wrote: Now, mail coming from mailsvr.pt.lu do not need to be from a @pt.lu address, right? It can be @sex.com and so on? Until now it was enough to block dialup address ranges in a Black List. Now it is neccessary to add mailsvr.pt.lu to the Black List, to be protected? A worm on your PC can send a mail to anybody using anybody's mail address using mailsvr.pt.lu. And the worm does not need to be ultrasmart to find the hostname mailsvr.pt.lu in the config files of your mail client.

first off - after your flood of mails - I can see that indeed you may have more of an idea about SMTP & consorts than most. I'll add that I'm responsible for some mail servers myself, and I actually have read RFCs. And no, I'm no shareholder of any ISP, and the only thing I'm defending is prevention of the disastrous effects of worms. On Thu, 1 Jul 2004, Patrick Kaell wrote: Why should you have to change your email address? Where lies security in checking a From: field? There are very many good reasons not to use an email address that wasn't given to you by your dial-up provider, it would be rather stupid for the ISP to force a customer to use only one specific domain. *that* would be very poor customer service. I've got LuxDSL. I constantly send mail from here with other domains than pt.lu. mailsvr.pt.lu relays it for me - as I'm on the P&T network. As you know about SMTP servers, I'll just say "smarthost". Of course! You're on his network, he knows who you are - the moment you're dialing in! If you abuse the service, bye bye your account, and chances are you'll hear from the ISPs lawyers or at least from their billing service. There is no security in checking To: and From: fields (i.e. the mail's body). There's not even much point in checking the envelope From:. That's for the case of users *on the ISPs network*. See above for the spammer case - ISPs worth their name (I now there's black sheep) don't take kindly to spammers. As for worms - I haven't seen any so far that didn't try to use SMTP directly, but went through the ISP's mail relay. It is a shame though that ISPs don't routinely warn customers having infected PCs though and/or cut their service until they have made sure their PCs are clean - I now of at least one large one that will do so after a couple of complaints/warnings. Maybe so that spammers can easily open up an account, use it for a spam run, and forget it afterwards? It's not like GMX, web.de & Co do a thorough job of verifying the data you provide them when opening up an account... Using a company mailserver that way would make more sense. Indeed, authenticated SMTP can help there - it would be a grave mistake for such a setup to accept plain SMTP (open relay, as it would be trivial to fake the domain part). I still don't see a point in going to an external service - unless your ISPs mail server is extremely unreliable, which would be a reason to find another ISP. Ok, I now see what you mean. To get rid of traffic generated by worms, but let through authenticated SMTP, the ISP could not use a simple packet filter then, but would have to pipe the traffic through an application-level firewall. Doable, but less simple to set up - and more error prone. Having a packet filter tie in with a sort of mailserver white list - hmm... less realistic. Still, normal procedure is to use the ISP's mailserver for outgoing mail, and access the mail provider's server through POP3/IMAP/whatever to retrieve your mail. Sorry if I formulated that a bit harshly. You do realise though that for most people, such settings actually make sense? Many even are crying out loud for more traffic filtering by ISPs. See above - many people actually want that kind of filtering. I can't say I blame them. Many ISPs will at least block NetBIOS traffic. Hmm... you said it above yourself - look at your firewall logs. Those logs are precisely the result of the lack of security out there. If ISPs did filter by default, and open up specific ports on demand by individual users, things would look much much better. Really, this isn't the Internet of 10 years ago. Keeping everything wide open for everybody would IMO be highly irresponsible. It's totally illusory to think just anybody could properly secure his/ her internet access, when even way too many supposed "experts" manage to totally botch even simple stuff. Totally open lines still exist - leased lines normally are not subject to any kind of filtering. Prices of course are very different from dial-up style lines. And you'll still get slammed in case of abuses (if your ISP doesn't react right away, he will do so when his own upstream swings the bat). Ah, I can see you're talking about Coditel's ... erm... I guess fuck-up is the only term that fits. I'm not talking about that kind of error. Of course they can't block their own mailserver for their own clients. I know perfectly well. And every normally set up mail client sends their mail through the ISPs mailserver. Using other mail servers, even through smtp-auth, is not usual. Calm down. Of course I'm not saying something stupid like that. All I'm saying is, there's normally no reason not to go through your ISPs mailserver. I know there can be special needs - which may have other solutions though. Brothers in arms, in that case [even if the place I'm working now isn't exactly an ISP]. I had heard about that first part - that can only be described as a serious fuck-up, everybody will agree. I had not heard as yet that they restored outgoing TCP 25 traffic to anywhere - is this also for the dynamic IP ranges, or only for the static IPs? There was some difference there IIRC. Greets Eric _______________________________________________ Lilux-help mailing list Lilux-help(a)lilux.lu http://lilux.lu/mailman/listinfo/lilux-help

no need to do a TOFU, you know?

Guess what, @work we have a few dialup lines, normal users of these have only a very few "standard" ports open towards the internal network.

Your normal internet-surfing 0815 guy will not need much more than DNS, FTP, HTTP, and SMTP via the ISP mailserver - maybe some high ports for stuff like chat, p2p, streaming media. That's exactly the kind of use I'm talking about.

People that actually use other stuff - say, SSH - are rather rare.

Those relatively clued users could for instance be accomodated by a filter adaptable through some webinterface.

I know this is problematic for an ISP. For companies, this is standard policy.

That's the current status, indeed. Fact is, it doesn't work out very well. "firewall logs"!

It's not "disabled". With the discussed blocking of outbound SMTP traffic except for the ISP mailserver, email still works.

For the larger organizations I know of (granted, that's more of a company setting, not ISP), everyone denies outbound SMTP traffic except from the company mailserver.

Sure. But those pesky mailservers usually listen on port 25 only.

>Your normal internet-surfing 0815 guy will not need much more >than DNS, FTP, HTTP, and SMTP via the ISP mailserver - maybe >some high ports for stuff like chat, p2p, streaming media. >That's exactly the kind of use I'm talking about. > > >People that actually use other stuff - say, SSH - are rather >rare. > >

Care to explain just why you didn't follow the only sensible measure, which is to go through your ISPs mailserver, which *must* relay for you? If you're on dialup, there's absolutely no reason to do it any other way - and if you had a valid reason, wtf are you doing on a dialup line with no fixed IP? Also, there's a great many mailservers that are filtering based on DULs, i.e. if you're on a dialup, there's quite some chances that your emails won't be accepted at the other end anyway.

I simply don't understand *why* you are defending this attitude. A attitude even Coditel now sees as wrong. Are you a shareholder???