🚀 go-pugleaf

In article <3ghioe$q83@trance.helix.net>,
Eric Gisin <ericg@trance.helix.net> wrote:
>$ finger @direct.ca
>[direct.ca]
>           Thank you for connecting to Internet Direct.

>The service you attempted to connect to on this host is for the 
>internal use of Internet Direct only.  We ask that you do not 
>attempt to connect to it again.  

>All connection attempts are logged.  If unauthorized connection 
>attempts continue from a single source CERT/RCMP/CIA/Scotland Yard 
>will be informed.

>Thanks for your co-operation.

>-----
>Who do these people think they are?
>Finger is a *public* service, there is nothing "unauthorized" in using it.
>If they don't want the outside world to use it, they should just disable it.
>Would CERT even listen to Internet Direct?

This is probably idiosyncratic of how their protection facilities work.
Probably TCP/IP security wrappers.

Say they have only one machine and it's connected to the Internet.

If they turn off the port entirely, then their internal users can't
use the service at all.

If they turn off the port to outside requests, then people get
connection failures (or maybe their software needs to connect first
before killing it), without knowing why, and keep trying.  So they
try to be "nice" and give you a "go away, we mean it!" message.  The
"we mean it" part seems rather excessive about "finger", but imagine
that this was telnet or ftp.

They probably could try to use different messages for different services,
but maybe their software doesn't allow that (it may simply be "if we
get an external connect on any port other than x,y,z, issue the following 
message), or they explicitly decided to reduce support complexity by using
the same one.

I can't imagine how you can claim that use of finger against a privately
owned machine is a "public service" that an Internet-connected machine
is somehow required to perform.  It is not.  No machine on the Internet
is obligated to do *anything* for anyone.

Further, finger is a security hole, and smart administrators have their
Internet firewalls prohibit it.  Ours certainly do, but we're not "nice",
and simply refuse connects - if they only have one machine, they may
not even be able to do that - the connection may need to be established
first before their software can decide whether to kill it or not.

If someone started messing around with indirect.ca's finger port, even
with it disabled, that caused service impairment at indirect.ca (eg:
ping storms of the finger port that impaired bandwidth over indirect's
IP link), you can bet that CERT will be interested - once they've satisfied
themselves that indirect is doing the right thing technically.
-- 
Every once in a while I write something that someone might use
in a signature.  So I go back and make it real spiffy.  No luck.
Then some guy goes and uses *that* dog.  Argh!