6 ms·

> Tier 1 transit providers doing port filtering is EXTREMELY alarming. I was admining a small ISP when blaster and its variants hit. Port filtering 139 and the

> Tier 1 transit providers doing port filtering is EXTREMELY alarming. I was admining a small ISP when blaster and its variants hit. Port filtering 139 and the rest was the easiest way to deal with it, and almost over night most of the ISPs blocked it, and we were better for it. There was a time when if you'd put a fresh XP install on the Internet you'd get 5-10 minutes until it would get restarted. I guess if you're really an admin that needs telnet, you can move it to another port and go around it? Surely you'd tunnel that "old box that needs to stay alive" if that's the usecase? Is there anyone seriously running default telnet on 23 and is really affected by this filtering?

RulerOf 9mo ago
The GP's concern isn't a practical one, it's ultimately about net neutrality. It's not the ISP's job to discriminate against traffic—it's their job to deliver it. This may seem like a good idea, and frankly is likely a net-positive thing, but it is literally the definition of "ISP decides what apps its customers can and cannot use." I share the concern and don't really like it either.
- tosti 9mo ago
  It's not a net-neutrality issue because they're not banking on any alternative. Net-neutrality law doesn't work like that. Service providers still get to filter stuff. What's illegal for an ISP is e.g. to give VoIP services other than their own a lower priority. That would tie in customers to use their own service and they could even charge more for it. Net neutrality means a level playing field for services on the Internet. If you ask your ISP to do filtering, that's perfectly legal. If they filter specific traffic for the purpose of maintaining service, that's okay too. Now if there was no alternative and they'd try to sell their product by blocking telnet, they could be sued.
  - ncruces 9mo ago
    This is not an ISP. It's a Tier 1 transit provider.
    - tosti 9mo ago
      The more unlikely they would violate net neutrality unless they would be tied in to CDNs and accept a bribe to favour one service over another. Possible but unlikely.
    - sophacles 9mo ago
      My ISP (AT&T) is a tier 1 transit provider.
- PunchyHamster 9mo ago
  There is some merit to the end user ISPs doing that - for example one I used before filtered SMTP traffic (and iirc some other) to the client unless you opted out from it. Which was mildly annoying workaround for the power users (disabling it was just changing the ppp login), but stopped a lot of accidentally open open relays and a lot of other cruft
deleted 9mo ago
[deleted]
miki123211 9mo ago
Changes like these lend even more credibility to the approach of putting everything on port 443 over TLS, and distinguishing protocols based on hostname / HTTP path.
- tosti 9mo ago
  Wireguard over 443/udp is also a neat trick. No need to make it look like quic although I wouldn't be surprised if someone takes the effort to make it that stealthy.
- trashb 9mo ago
  If everything was on port 443 why would we even need ports. The ports are there for a reason, it is idiotic to serve everything over http as you would need a mechanism to distinguish the different flows of traffic anyhow.
  - allknowingfrog 9mo ago
    Preventing the traffic from being distinguished is the whole premise. Port 23 gets blocked because everyone uses it for telnet, and everyone expects bad actors to know that. If everything moves to 433, we'll end up with a variety of routing systems and no focal point for attack. The only alternative is to disallow port filtering in core internet infrastructure. We can either have a standard and accept that bad actors will use it against us, or we can accept the chaos that results from abandoning it.
    - trashb 9mo ago
      > The only alternative is to disallow port filtering in core internet infrastructure I think this is an acceptable alternative. In the same way that your mail service is legally required to deliver your mail as part of their universal service obligation (without reading it).
  - Sohcahtoa82 9mo ago
    You've got it wrong. It doesn't have to be HTTP[S] traffic. Reverse proxies can disambiguate based on the SNI. I could run telnetd on port 23, but have port 23 firewalled off, and have my reverse proxy listening on port 443 with TLS forward anything going to telnet.mydomain.com to telnetd. Obviously, my client would need to support that, but a client-side proxy could easily handle that just as well.
VadimPR 9mo ago
Lots of text games - MUDs - still play over telnet using dedicated MUD clients that implement their own telnet stack. Outright blocking the port has an outsized side efffe on them, this is simply not right.
- RupertSalt 9mo ago
  If MUDs and other games were indeed using port 23/tcp for player access, they were not only incorrect but rather dangerous. Since 23/tcp is a well-known IANA-registered port for the Telnet service, it is an RFC violation to use it for a service that is not telnetd/remote logins via TELNET protocol. Any port below 1024 signifies that it is a "privileged port". This is an archaic distinction that developed in high-trust R&E networks, but it did signify that the listener on the port had administrative/root access to spawn a service there, so it was kind of a signal that you could "trust" the remote server with your login credentials. The privileged ports were also priority, because if the unprivileged ones were "first come, first served" for unprivileged users, the administrator would have the ability to enforce the uniqueness of "privileged ports", and disable or kill any process that shouldn't be using one. A MUD Wizard who finds their port in-use (bound) on start is on their own. Typically there were no MUDs running with, or needing, root privileges. They were run under user accounts, or specific unprivileged role accounts. They had no need of a privileged port, and many were clandestine or unauthorized, and forced to use a higher port number. That's why the 4-digit ports became so popular. Anyway, the custom has already developed of blocking port 23 to protect users from unwittingly opening a management or login interface. Most shrewd admins would choose a port that isn't routinely blocked and filtered... and port-scanned. If your favorite MUD runs on port 23 today, such as nethack or something, then I am glad for this change, which will force the administrator to select a unique port that does not imply privilege, TELNET protocol, or shell login credentials. It is totally RFC-compliant to select an unassigned port above 1023, and MUD conventions have popularized several numbers that are still recognizable to players today.
  - Kim_Bruning 9mo ago
    They're remote terminal applications? Remote interactive text sessions. Over TELetype NETworking? You're saying that connecting my tty (emulator), to a remote host is not the purpose of telnet? <backs away slowly> Though ... I suppose by now a switch to port 22 could make sense.
Suzuran 9mo ago
I run a PDP-10 during the colder parts of the year. It's for historical preservation reasons. There are others doing the same thing. We still offer telnet access because that's how it worked back then. I guess we aren't going to be doing that anymore.
- varenc 9mo ago
  If you can get it on IPv6, maybe via a gateway, port 23 filtering doesn't seem to be applied to IPv6 yet! (I assume because the v6 address space is too large to mass scan?)
  - Suzuran 9mo ago
    If I am rewriting the network stack or making other substantial changes, that defeats the purpose of historical preservation.
    - RupertSalt 9mo ago
      If moving it to another port from the OS is beyond the pale for you, your router should implement PAT (port translation) or forwarding, so that from the outside, users could connect on, say, 443 or 2323, and the router rewrites the segments to connect to your immutable port 23/tcp. It makes no sense that IPv6 is treated differently than IPv4. If GNU telnetd is vulnerable and it's running on port 23/tcp, it will be found on IPv6. I would definitely not bind anything to listen on port 23 on any protocol, because I would expect it to become filtered shortly. Port 23 is permanently burned everywhere. Conversely, a vintage PDP-10 telnetd is not affected by the CVE for GNU. It is a classic rookie mistake to treat the two protocols differently, so if Tier-1 providers have done this, they must be overly optimistic, or foolish, or met with some technical obstacles, or perhaps OSI Layer 8?
      - Suzuran 9mo ago
        I meant rewriting it for IPv6 instead of IPv4.
Sohcahtoa82 9mo ago
> There was a time when if you'd put a fresh XP install on the Internet you'd get 5-10 minutes until it would get restarted. This is still true, though 5-10 minutes is slightly pessimistic. Source: https://youtu.be/6uSVVCmOH5w https://youtu.be/6uSVVCmOH5w TL;DW - Guy installs XP and makes it internet accessible, only takes 15 minutes before the first malware appears on it.

RulerOf 9mo ago

The GP's concern isn't a practical one, it's ultimately about net neutrality. It's not the ISP's job to discriminate against traffic—it's their job to deliver it. This may seem like a good idea, and frankly is likely a net-positive thing, but it is literally the definition of "ISP decides what apps its customers can and cannot use." I share the concern and don't really like it either.

tosti 9mo ago
It's not a net-neutrality issue because they're not banking on any alternative. Net-neutrality law doesn't work like that. Service providers still get to filter stuff. What's illegal for an ISP is e.g. to give VoIP services other than their own a lower priority. That would tie in customers to use their own service and they could even charge more for it. Net neutrality means a level playing field for services on the Internet. If you ask your ISP to do filtering, that's perfectly legal. If they filter specific traffic for the purpose of maintaining service, that's okay too. Now if there was no alternative and they'd try to sell their product by blocking telnet, they could be sued.
- ncruces 9mo ago
  This is not an ISP. It's a Tier 1 transit provider.
  - tosti 9mo ago
    The more unlikely they would violate net neutrality unless they would be tied in to CDNs and accept a bribe to favour one service over another. Possible but unlikely.
  - sophacles 9mo ago
    My ISP (AT&T) is a tier 1 transit provider.
PunchyHamster 9mo ago
There is some merit to the end user ISPs doing that - for example one I used before filtered SMTP traffic (and iirc some other) to the client unless you opted out from it. Which was mildly annoying workaround for the power users (disabling it was just changing the ppp login), but stopped a lot of accidentally open open relays and a lot of other cruft

deleted 9mo ago

[deleted]

miki123211 9mo ago

Changes like these lend even more credibility to the approach of putting everything on port 443 over TLS, and distinguishing protocols based on hostname / HTTP path.

tosti 9mo ago
Wireguard over 443/udp is also a neat trick. No need to make it look like quic although I wouldn't be surprised if someone takes the effort to make it that stealthy.
trashb 9mo ago
If everything was on port 443 why would we even need ports. The ports are there for a reason, it is idiotic to serve everything over http as you would need a mechanism to distinguish the different flows of traffic anyhow.
- allknowingfrog 9mo ago
  Preventing the traffic from being distinguished is the whole premise. Port 23 gets blocked because everyone uses it for telnet, and everyone expects bad actors to know that. If everything moves to 433, we'll end up with a variety of routing systems and no focal point for attack. The only alternative is to disallow port filtering in core internet infrastructure. We can either have a standard and accept that bad actors will use it against us, or we can accept the chaos that results from abandoning it.
  - trashb 9mo ago
    > The only alternative is to disallow port filtering in core internet infrastructure I think this is an acceptable alternative. In the same way that your mail service is legally required to deliver your mail as part of their universal service obligation (without reading it).
- Sohcahtoa82 9mo ago
  You've got it wrong. It doesn't have to be HTTP[S] traffic. Reverse proxies can disambiguate based on the SNI. I could run telnetd on port 23, but have port 23 firewalled off, and have my reverse proxy listening on port 443 with TLS forward anything going to telnet.mydomain.com to telnetd. Obviously, my client would need to support that, but a client-side proxy could easily handle that just as well.

VadimPR 9mo ago

Lots of text games - MUDs - still play over telnet using dedicated MUD clients that implement their own telnet stack. Outright blocking the port has an outsized side efffe on them, this is simply not right.

RupertSalt 9mo ago
If MUDs and other games were indeed using port 23/tcp for player access, they were not only incorrect but rather dangerous. Since 23/tcp is a well-known IANA-registered port for the Telnet service, it is an RFC violation to use it for a service that is not telnetd/remote logins via TELNET protocol. Any port below 1024 signifies that it is a "privileged port". This is an archaic distinction that developed in high-trust R&E networks, but it did signify that the listener on the port had administrative/root access to spawn a service there, so it was kind of a signal that you could "trust" the remote server with your login credentials. The privileged ports were also priority, because if the unprivileged ones were "first come, first served" for unprivileged users, the administrator would have the ability to enforce the uniqueness of "privileged ports", and disable or kill any process that shouldn't be using one. A MUD Wizard who finds their port in-use (bound) on start is on their own. Typically there were no MUDs running with, or needing, root privileges. They were run under user accounts, or specific unprivileged role accounts. They had no need of a privileged port, and many were clandestine or unauthorized, and forced to use a higher port number. That's why the 4-digit ports became so popular. Anyway, the custom has already developed of blocking port 23 to protect users from unwittingly opening a management or login interface. Most shrewd admins would choose a port that isn't routinely blocked and filtered... and port-scanned. If your favorite MUD runs on port 23 today, such as nethack or something, then I am glad for this change, which will force the administrator to select a unique port that does not imply privilege, TELNET protocol, or shell login credentials. It is totally RFC-compliant to select an unassigned port above 1023, and MUD conventions have popularized several numbers that are still recognizable to players today.
- Kim_Bruning 9mo ago
  They're remote terminal applications? Remote interactive text sessions. Over TELetype NETworking? You're saying that connecting my tty (emulator), to a remote host is not the purpose of telnet? <backs away slowly> Though ... I suppose by now a switch to port 22 could make sense.

Suzuran 9mo ago

I run a PDP-10 during the colder parts of the year. It's for historical preservation reasons. There are others doing the same thing. We still offer telnet access because that's how it worked back then. I guess we aren't going to be doing that anymore.

varenc 9mo ago
If you can get it on IPv6, maybe via a gateway, port 23 filtering doesn't seem to be applied to IPv6 yet! (I assume because the v6 address space is too large to mass scan?)
- Suzuran 9mo ago
  If I am rewriting the network stack or making other substantial changes, that defeats the purpose of historical preservation.
  - RupertSalt 9mo ago
    If moving it to another port from the OS is beyond the pale for you, your router should implement PAT (port translation) or forwarding, so that from the outside, users could connect on, say, 443 or 2323, and the router rewrites the segments to connect to your immutable port 23/tcp. It makes no sense that IPv6 is treated differently than IPv4. If GNU telnetd is vulnerable and it's running on port 23/tcp, it will be found on IPv6. I would definitely not bind anything to listen on port 23 on any protocol, because I would expect it to become filtered shortly. Port 23 is permanently burned everywhere. Conversely, a vintage PDP-10 telnetd is not affected by the CVE for GNU. It is a classic rookie mistake to treat the two protocols differently, so if Tier-1 providers have done this, they must be overly optimistic, or foolish, or met with some technical obstacles, or perhaps OSI Layer 8?
    - Suzuran 9mo ago
      I meant rewriting it for IPv6 instead of IPv4.

Sohcahtoa82 9mo ago

> There was a time when if you'd put a fresh XP install on the Internet you'd get 5-10 minutes until it would get restarted. This is still true, though 5-10 minutes is slightly pessimistic. Source: https://youtu.be/6uSVVCmOH5w https://youtu.be/6uSVVCmOH5w TL;DW - Guy installs XP and makes it internet accessible, only takes 15 minutes before the first malware appears on it.