ATTENTION! SPAM over fidonet!
ZXNet echo conference «zxnet.pc»
From: Kirill Frolov
Newsgroups: fido7.ru.unix.ftn
Subject: ATTENTION! SPAM over fidonet!
Date: Wed, 29 Jun 2005 02:54:38 +0000 (UTC)
Press RESET immediately, Dmitry Pankov!
On Sun, 26 Jun 05 21:28:19 +0400, Dmitry Pankov wrote:
PV>>> Where is @CHRS ?
KF>> Where is @LANG? Because it’s completely unclear what language to read in
KF>> letter, even if it is written in CP866 encoding. :-(
DP> Did you read Romanovsky for the night? ;-))
I don’t know who Romanovskaya is, but @LANG is clearly needed...
I would like to once again remind those installing all kinds of
e-mail gateways like fidogate and ifmail. I won’t tell you exactly how he behaves
fidogate, but ifmail clearly allows the sender to forward
mail outside the FTN network through your node. This is not a bug, this is a feature...
Otherwise, how would the well-known Internet<->Fido gateways work? Problem
in another. By default, everything sent into it passes through this “hole”,
and in any FAQ the existence of the “hole” is often not even mentioned.
As a result, we have a situation where many people who have installed ifmail can
forward transit mail anywhere, but don’t even talk about that
guess.
How this happens: write a letter to the address of your system, instead of
For the recipient's name, substitute (in quotes) his name and/or e-mail address.Seeing this, your ifmail passes such a letter through sendmail, substituting
address extracted from the "To" field: sendmail -oi -f $F $T, where $F and $T
replaced with whatever is needed. In fact, a letter arriving at your address
may have a different address in the “To” field, where it will be redirected.
And most often - according to some general routing rule, for example
to your Internet provider.
This opens up wide opportunities for mass mailing of unsolicited
mail through your system. Not as massive as they make it out to be
real spammers, limited to the limits that can allow
FTN technology. And she can allow tens of thousands of messages
per day.
What does this give to a spammer: it’s easy to use any search engine
system for extracting from conference groups lists of nodes using
ifmail or fidogate. Test each node for ability
Transit mail forwarding is also not difficult. After which, having already
hundreds of nodes allowing uncontrolled forwarding of transit mail
you can... A lot of things are possible.
What can you do to prevent your knot from getting hit (this also applies to points!)
into various troubles. The simplest thing is to prohibit forwarding
transit mail in cases where you are not obliged to do so,
at your MTA. This refers to sendmail and analogues.
For Exim. For the (already outdated) version 3.x, a rule is written
routing:
fidospamfilter:
condition = ${if and { \n{eq{$sender_ident}{fido}} \n
{eq{$received_protocol}{local}} \n
{!match {$sender_address_domain}{(\.fk0.pp.ru|\.zxnet)$}} \n
} {yes}{no}}
debug_print = "debug_my: $sender_ident, $received_protocol,
$sender_address_domain"
driver = domainlist
transport = fido_disabled
route_list = * localhost byname
И также пишется правило транспортировки таких "отфильтрованных"
сообщений (они просто возвращаются взад):
fido_disabled:
# debug_print = "return_path=$return_path, sender_address=$sender_address, to
$local_part@$domain"
driver = autoreply
log = "message delivery disabled!"
user = mail
from = SysOp@p2.f827.n5030.z2.fidonet.org
to = "System Operator <$return_path>"
reply_to = sysop@p2.f827.n5030.z2.fidonet.org
subject = "Delivery of your message abandoned!"
return_message = true
headers = "Mime-Version: 1.0
Content-Type: text/plain;
charset=koi8-r
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
"
file = /etc/exim/fido_disabled
file_expand = true
Содержимое файла /etc/exim/fido_disabled:
=== cut here ===
ВHИМАHИЕ!
Сообщение посланное вами на адрес <$original_local_part@$original_domain>
HЕ БЫЛО ПРОПУЩЕHО через узел 2:5030/827.2 по причине явного на то ЗАПРЕТА
со стороны владельца узла. Вероятно, что вы попытались переслать письмо в
internet через узел 2:5030/827.2. Узел 2:5030/827.2 HЕ ЯВЛЯЕТСЯ официальнымa gateway from fidonet to the internet, as well as formally NOT A NODE OF THE fidonet NETWORK
(you can find detailed explanations in the fidonet network charter), and that means
DO NOT forward your mail. Please don't try again
forward transit mail through node 2:5030/827.2.
If you think you have received this message by mistake, please
report this to the owner of node 2:5030/827.2.
fidonet: 2:5030/827.2
e-mail: sysop@p2.f827.n5030.z2.fidonet.org
sysop@fk0.pp.ru
Attention!
Message was sent by you to the address of
<$original_local_part@$original_domain>
was NOT PASSED over the node 2:5030/827.2. This is because of the owner
of this node is firmly DISABLED doing this. It is possible, you are
trying to send message to internet over the node 2:5030/827.2. Node
2:5030/827.2 IS NOT A GATE from fidonet to internet, and in a fact IS NOT
A MEMBER OF FIDONET network at all (you can find more detailed explanation
of this fact in the Fidonet Policy), and so, the node 2:5030/827.2 is not
should to pass your mail over the itself. Please, do not try to send
transit mail over the node 2:5030/827.2 in the future.
If you consider, what you will see this message because of some mistake,
please inform the owner of the node 2:5030/827.2
fidonet: 2:5030/827.2
e-mail: sysop@p2.f827.n5030.z2.fidonet.org
sysop@fk0.pp.ru
=== cut here ===What does this give in my case: everything received from ifmail goes nowhere except
like to other FTN addresses, it is not routed (only sent back),
unless it is received from a number of special addresses that can
forward transit mail. Routing rule "fidospamfilter"
(see above) is written /after/ routing rules in fidonet, but
/before/ other (Internet) routing rules.
Of course, in this case there is a hole: you can send from Fido
in Fido, and in addition you can try to fake the sender's address so that
to get through the filter. At least it reduces
possible risks. In addition, it literally allows you not to pay
your money for forwarding someone's mail to the Internet.
PS:
This also applies to various types of “gating” software, not just ifmail.