linux-kernel - Re: [ANNOUNCE] Kernel Blocking Firewall

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 9 Jan 2009 01:43:46 -0700 (MST)
From:	jmerkey@...fmountaingroup.com
To:	"Willy Tarreau" <w@....eu>
Cc:	jmerkey@...fmountaingroup.com, linux-kernel@...r.kernel.org
Subject: Re: [ANNOUNCE] Kernel Blocking Firewall

... snip

>> From my experience with dealing with these systems, and observation of
>> how
>> RBL databases work, when an infected system gets blacklisted, it stays
>> that way until the user goes to the websites and requests removal.  I
>> have
>> found these zombie systems tend to stay that way, and no, by default you
>> NEVER want to unblock them for at least 6 months.
>
> This is stupid considering that most of them change their IP address every
> 24 hours, or at most every 7 days. This is just used to show that spam
> rate
> drops, hiding the fact that valid mails drop for similar reasons. For your
> own use, you might consider that you'll never receive mails from people
> hosted at the same ISP as the bots you block, but doing this on a large
> scale or for companies who do their business around e-mail is plain
> stupid.
>
> I'm on a static IP, but a lot of people I know are not. It would be
> unfair to block them from posting to, say, LKML just because the week
> before, someone with their address had been sending spam. And no, it
> does not help getting the problem solved since the only users annoyed
> are not the ones with the faulty installation.
>
> Willy
>
>

Allowing a server on a dynamic IP range to act as a mail server is what is
stupid.  Most email blockers also block dynamic IP ranges since these
systems are typically the ones most commonly infected, and the RBL
databases.  They just use a different technique, they base it on DNS maps
of internet address ranges, and not behavior.  It will only block the smtp
port for these systems -- and mail servers originating from dynamic ranges
should be blocked anyway -- and are by most commercial email gateway
boxes.

Jeff


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/