Re: post.office

Jeff Woods ( jeff@delta.com )
Thu, 19 Dec 1996 22:14:28 -0500

At 12:40 AM 3/23/97 -0500, you wrote:
>
>Jeff, have been following the NT ISP mailing list, and read with interest
>your comments on the SPAM bug.. I run a very small installation of
>post.office, of about 150 accounts (unlimted user license) and was
>wondering if you could elaberate a bit more on the SPAM bug.
>
> What exactly is it about, and how could it damage my server?? Is there
>anything I can do NOW to prevent or cut down any risk??

No, there's not a damn thing you can do, and that is my complaint. Joe
Spammer on some other ISP knows he cannot use that ISP's mail server to
spam, or he'll get TOS'd (account cancelled for violating Terms of
Service:Spamming). So he sets his mailer up with YOUR mail server as his
SMTP host, and sends a single message to your server. It takes about 20k of
bandwidth to reach you. However, i has a blind carbon copy field of about
500,000 users on AOL, Compuserve, etc, usually about a third of which are
BOGUS addresses. Your post.office installation dutifully accepts it, and
starts spawning outbound threads, sending out these posts. YOUR T1 is now
choked with bandwidth as it sends out spam, spam, spam, spam, spam, spam,
spam, baked beans, spam, spam, spam, and spam. If you didn't have a few
gigs free, post.office clogs your hard disk, since it creates outbound files
each post, queuing them up. (2.0 lets you reserve disk space). Your other
services on that machine slow to a crawl. If post.office is allowed to, it
will spawn SO many service threads that it will exhaust the memory of the
machine, and it will spontaneously REBOOT (1.9.3 -- don't know about 2.0).
I confirmed this because when the spam was overrunning my system, I tried to
increase the threads to allow it to finish quicker, and it would reboot
every three minutes. When I restricted the number of outbound threads in
the config, it stopped rebooting, and finished the run without incident.

There's NO way in the current versions to prevent ANY spammer who knows you
are running post office from doing this, known as hijacking your server.
Sendmail and others allow you to both restrict certain IP's from sending
outbound mail, and allows you specify ONLY those networks which CAN send
outbound mail. It would be a two hour fix to make this modification to
post.office, yet they refuse to plug this hole.

This makes post.office UNFIT for commercial use. Their offer to fix it in
another version for which I must pay a hefty price hike, and for which it
may or may notbe fixed in, and will not be available for many months,
demonstrates that IMO, Software.com's management is not customer oriented,
and that they are trying to ride on the coattails of the Netscape contract
that put them on the map.

If Microsoft and Netscape can plug security holes in 48 hours, then surely
software.com could do the same if they were TRULY customer oriented.