linux-kernel - Re: [ANNOUNCE] Kernel Blocking Firewall

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <37451.166.70.238.44.1231524844.squirrel@webmail.wolfmountaingroup.com>
Date:	Fri, 9 Jan 2009 11:14:04 -0700 (MST)
From:	jmerkey@...fmountaingroup.com
To:	"David Newall" <davidn@...idnewall.com>
Cc:	jmerkey@...fmountaingroup.com, "Willy Tarreau" <w@....eu>,
	linux-kernel@...r.kernel.org
Subject: Re: [ANNOUNCE] Kernel Blocking Firewall

> jmerkey@...fmountaingroup.com wrote:
>> Allowing a server on a dynamic IP range to act as a mail server is what
>> is
>> stupid.
>
> Sorry to be argue semantics, but I think it's SMTP clients that are the
> major cause of spam.  Many, probably most, ISPs provide an SMTP relay
> for their subscribers, and blocking these dynamic addresses doesn't
> present a hard impediment for delivery of their mail to you.  None the
> less, to say that people on a dynamic IP address should be *obliged* to
> go through a relay is offensive.  (Not that you did say that, but I
> think it's what you had in mind.)
>

That's good point, but not what I see in actual practice.  These zombie
systems don't seem to use the smtp gateway for their ranges, they send the
emails direct.  From my observations, most of these systems tend to stay
zombies, since almost all of them are windows systems.

I have discovered that by using this method to block them, once they open
a connection and I start dropping traffic while the connection is left
open it "tarpits" the bots and causes a cascade failure in the botnet
network for about 20 minutes until the systems start skipping the mail
server doing the bocking.

Jeff

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/