🚀 go-pugleaf

In article <3A97B353.F5610BBA@mynetwatchman.com>,
Lawrence Baldwin  <baldwinlSPAMMENOT@mynetwatchman.com> wrote:
>
>YOU define who is authorized.  If you put up a firewall which blocks
>port 25, then you have established a policy that 25 is not authorized. 
>If you receive unsolicited scans against port 25, then report it.
>If you block port 25 AND have your public mail server behind this
>firewall, then you are a perplexing individual indeed.

Suppose that someone from your site sends me mail or posts to Usenet
with an improper From: or Reply-To: header.  If I try to send mail
to that person, I might end up trying to connect to your port 25.
Should this make me a criminal?

Suppose I happen to personally know someone at your site, but have
forgotten his full first name.  Should I be put behind bars for trying
to connect to port 25 of your MX host to do an EXPN command on that
person's username so that I can look up his name in order to then
use the phone book to get his phone number and call him?

Suppose I try to "finger" the person?  Should the FBI break down
my door and arrest me if your site happens to have disabled finger
access?

>I actually DON'T advocate escalating every port probe activity an
>individual user sees...our system statistics indicate that 80-90% of
>attack data can't conclusively identify an attack.  
>
>See: http://www.mynetwatchman.com/listincidentsummary.asp
>
>I do advocate that anyone who wants to forward ALL attack to an
>aggregation filter.  This is a responsible way to be proactive without
>risking crying wolf all the time.

This approach sounds far more reasonable...