Text 10393, 101 rader
Skriven 2013-09-23 12:19:31 av mark lewis (1:3634/12.0)
     Kommentar till en text av Michiel van der Vlist (2:280/5555)
Ärende: Connecting 2:280/5555...
================================
 On Mon, 23 Sep 2013, Michiel van der Vlist wrote to mark lewis:

 ml> to the entry and how often entry updates have to be made to keep 
 ml> an entry alive...

 MvdV> Never. It is kept alive as long as I keep paying the yearly
 MvdV> fee... 

ahhh... so there is no updater program that you have to use to tell the static
domain name provider what the current IP for said domain is? what do you do if
your IP changes? is it handled automatically or manually?

[trim]

 ml>  it could take even less time than that if there were more than 
 ml> one attempt per minute... if you change IPs and kept doing it, it 
 ml> would simply apply the block to each new IP...

 MvdV> I haven't set up an automated defence like that. I did not feel
 MvdV> the need. I may change my mind...

FWIW: mine is for the protection of all my servers... it is definitely not
limited to fidonet operations... i have several web servers, mail servers and
ftp servers all in operation here... hackers, spammers and script kiddies
attempt to beat on them all the time... even attempting to use the web servers
as proxies to mail servers to shovel their spam out... that is one way that
spam gets sent with barely a clue as to how it happens... the only way to see
it is to actually find the CONNECT entries in the web server logs... and then
there's the proxy servers and what they may or may not allow or be configured
for...

 ml> in any case, once the block went into effect, it would appear on 
 ml> your end as if the system simply didn't exist... the packets would 
 ml> be dropped into the bitbucket and your end would have to wait for 
 ml> the configured timeout period to elapse... one of the goals of 
 ml> this is to slow down the 'attack'...

 MvdV> A call once a minute is annoying because it pollutes the log.
 MvdV> Otherwise it is pretty harmless.

yup on both accounts... in addition to polluting the logs, it can cause them to
become so large that they may be extremely hard to analyze or peruse... i
remember one of my downlinks was polling here every five minutes... they were
not delivering any mail and there was none waiting for them since my processing
is done on a specific time schedule which they were told about when they asked
for their connection... my binkd log went from a few tens of megs a month to
over one hundred megs a month... the term "painful" doesn't begin to express
the feeling of processing that log to break it down for analysis...

 ml> the situation with my firewall is that once blocked, there it a 
 ml> expiration time given... each additional attempt to connect that 
 ml> raises another alert extends that expiration time... depending on 
 ml> certain things, the extension could be linear or exponential... 
 ml> based on the severity of the attack and other factors...

 MvdV> That is what I gathered from previous postings of yours.

it works, too... very much so... while others running the same mail server as i
am are complaining about being inundated by spammers, my solution keeps them
out quite effectively... these others refuse to implement a perimeter firewall
solution like i keep suggesting... they say it is because of the cost... then i
point out that there is no cost if one uses recycled machines from dumpsters or
from clients upgrading their machines and wanting to throw out the old ones
because they don't need them any more... the conversation generally goes like
this...

     "What do I do with the old machine now that I don't need it any
      longer? It will cost me $$$ if I take it to the dump or the
      recycle place. Can you get rid of it for me?"

     "Yes, I can dispose of that old machine for you. I'll do ya a
      favor, too. Since you're such a good client, there's no charge
      for this disposal service. How's that?"

 O:) O:) O:)

the software i use is free, too... the only cost is the electricity and that's
minimal compared to what they are already spending on anything else... even
their current electrical usage would hardly see the addition of one more
machine...

but they'd rather have their customers complaining to them all the time about
not being able to connect for their mail (the spammers have used up all the
connection slots available)... those customers make things worse by attempting
to connect to the same account every minute from multiple devices...

in the specific situation i'm talking about, the operator (apparently) refuses
to tell his customers that they are causing some of their own problems and to
back off their connections... they won't implement any kind of time limited
blocking to alleviate the problem and instead they carry on about how they are
losing customers due to the problems...

i won't even mention their 12+ hour days they spend manually trying to protect
their network after the attacks have already happened... there's just no way in
hell that a human can react fast enough to block or even clean up after them...

well, uh... duh! sheesh :/

)\/(ark

 * Origin:  (1:3634/12)