Tales from Techsupport

[Eremius]

"Slam you head in a car door a few times, the answer will come!" sounds like a logical answer to give

[Mileron]

Coworker comes to my desk today. She's in the "usage" half of the Support department.
She describes the situation. Customer has a client file that, when accessing a certain window, isn't displaying expected options to change certain dates.
So I poke around for 2 minutes, find a certain setting that determines what type of client file return it is.
I say to coworker, "Is it because it's this type of return?"
She says no
I go to my desk with a copy of the client's data, change the return type, and wallah, that previous date window is now working correctly.
So I take one of the sample client files, change it to match the return type of the customer, and waddyaknow, the date window doesn't work. I change it back, and now it works.
I go back to coworker's desk and say "it's cuz the return is this type of return" and she says "no, you're wrong."

Hokay.

[Alikat Astrae]

I got that a lot from people who were certain of something but didn't actually know shit about it. The worst is the "My Email is broken!" people who absolutely don't get it that their ISP has blocked port 25 for some arcane idiotic reason.

[Filthy]

their ISP has blocked port 25 for some arcane idiotic reason.

Spam control. Blocking port 25 to outside mail servers prevents an infected machine from spewing junk on to the Internet. It has become relatively common.

Not that anyone uses it, but port 587 is actually the defined port for SMTP submission. Port 25 was originally intended for server to server traffic. That's my interpretation of the RFC, anyway.

[Eremius]

Spam control. Blocking port 25 to outside mail servers prevents an infected machine from spewing junk on to the Internet. It has become relatively common.

Not that anyone uses it, but port 587 is actually the defined port for SMTP submission. Port 25 was originally intended for server to server traffic. That's my interpretation of the RFC, anyway.

587 is frequently blocked as well.

[FilanFyretracker]

587 at least on Comcast requires authentication to sendmail too, I personally see no issue with Port 25 being blocked. any properly configured SMTP server should be able to accept on 587.

[Filthy]

587 is frequently blocked as well.

I've never seen 587 blocked, but it's probably only a matter of time until the spammers start using it as well.

[Filthy]

587 at least on Comcast requires authentication to sendmail too, I personally see no issue with Port 25 being blocked. any properly configured SMTP server should be able to accept on 587.

Are you sure authentication is what you're trying to say? If you can reach the server to authenticate, the port isn't being blocked.

587 seems to be Comcast's preferred port, anyway. The language on their page amuses me.

[FilanFyretracker]

I thought use of port 587 always required your mail server login while 25 was just open. and that is why the ISPs forced everyone onto 587 to use the in house mail and blocked 25. or do the spambots have their own built in SMTP servers and simply use 25 and never touch your ISP server?

[Alikat Astrae]

From what I understand, the dialers tend to use YOUR system as an SMTP server, and it connects to destination servers via port 25, which is now more intended for server-to-server connections. This way, your PC can't be used as a mail server because you can't make direct SMTP server-to-server connections.

[Filthy]

I thought use of port 587 always required your mail server login while 25 was just open. and that is why the ISPs forced everyone onto 587 to use the in house mail and blocked 25. or do the spambots have their own built in SMTP servers and simply use 25 and never touch your ISP server?

587 does require SMTP-Auth.

The conversation was on port blocking when you brought up authentication on 587. I was just making sure you actually meant authentication and weren't misusing it to mean port blocking on 587. (I work in a place where authentication, port blocking, wireless problems, solar flares, and horoscopes all get thrown in the 'Email No Work' bucket. Since they all have different solutions, it forces me to ask for clarification.)

Back in Ye Olde Days, SMTP servers were set up to be totally open relays, that is no sort of verification for sending or receiving email. This was considered a polite thing to do so others could use your email server to send email if theirs happened to be down.

Then came spammers. Now being an open relay was a bad thing as it allowed spammers to use your server to send their junk. As a response, people started requiring verification that you were one of their users in order to use their servers. Because SMTP was not originally designed with any sort of authentication in mind, POP-Before-SMTP became common. POP-Before-SMTP required a client to authenticate via POP before sending email. Once you had authenticated, POP-Before-SMTP would typically put the client IP address into a hash file the SMTP engine could check. Not in the hash file or in relays? Though shit, no sending email from here. If you're still using port 25 to send email and your SMTP server doesn't require SMTP-Auth on port 25, there's a good chance it's using POP-Before-SMTP.

Suddenly bereft of open relays, malware authors started including an SMTP engine in their viruses. Now they were skipping the infectee's SMTP server all together and delivering their junk directly to the target. As a response, ISP's began blocking outgoing traffic on port 25 to servers outside of their network. Just because you're on one company's network doesn't necessarily mean you want to use their SMTP servers, so a way to contact outside SMTP servers was needed. Enter SMTP Submission, port 587, and SMTP-Auth.

Once the balance shifts in favor of using 587 over port 25, the next step for malware authors to begin using packet sniffing to pick the SMTP-Auth string out of the data stream for SMTP-Auth. Which will likely force server admins to require TSL/SSL. After that, spammers will likely extend the packet sniffing to data injection/man-in-the-middle after the authentication takes place, substituting their data for legitimate data. No idea where it will go from there, but shit will likely get weird.

[Eremius]

From what I understand, the dialers tend to use YOUR system as an SMTP server, and it connects to destination servers via port 25, which is now more intended for server-to-server connections. This way, your PC can't be used as a mail server because you can't make direct SMTP server-to-server connections.

Mostly correct. There really isn't any difference between your mail client (technically a mail server) and an actual server sending mail. They both connect to port 25 from a random port. ISPs block traffic travelling to port 25 anywhere except their own mail servers.

Interestingly, most of the ISPs I have also set their own mail servers to allow relaying which seems odd to me...

[Mitebe]

Coworker comes to my desk today. She's in the "usage" half of the Support department.
She describes the situation. Customer has a client file that, when accessing a certain window, isn't displaying expected options to change certain dates.
So I poke around for 2 minutes, find a certain setting that determines what type of client file return it is.
I say to coworker, "Is it because it's this type of return?"
She says no
I go to my desk with a copy of the client's data, change the return type, and wallah, that previous date window is now working correctly.
So I take one of the sample client files, change it to match the return type of the customer, and waddyaknow, the date window doesn't work. I change it back, and now it works.
I go back to coworker's desk and say "it's cuz the return is this type of return" and she says "no, you're wrong."

Hokay.

She obviously suffers from the Dunning-Kruger effect.

http://en.wikipedia.org/wiki/Dunning-Kruger

[Mileron]

We sent out a mass email to customers today about one of our products as a combination "major update/revamp" and "Hey peeps check out this redone product."

I've "sold" a license for it already; rather, I talked someone into buying it. I had tried to transfer them to Sales, but Sales is too busy being in their "beginning of the month" BS meeting.

Quote of the day: "You're SO much easier to get answers from than those Sales people."

[Melcar]

So other IT staff member just calls me over "come help for a sec"... sure what do you need...

Blah blah blah - can't see all stuff in a users "My Documents" (we do folder redirection so My documents is actually a network location)...

Systray has "offline files" & "Network Cable Unplugged" icons...




Can anybody guess the answer?

[FilanFyretracker]

They had unplugged their network cable to use it to stir creamer into their coffee because the kitchen was out of those little sticks?

[Charbok]

They had unplugged their network cable to use it to stir creamer into their coffee because the kitchen was out of those little sticks?

That's stupid. Nobody ever does that. Instead, I'm guessing his internet was full and he was draining it.
(http://dilbert.com/strips/comic/2006-02-22/)

[Mileron]

More website outages last night and today.

Customer called up with an error 403 forbidden. I'm getting it too. He says "can't we do this a manual code entry way?" and I had to tell him "nope"... cuz I need the website to be able to do that.

Of course.

And all management wants are screenshots from customers including the date and time so they can "build a case" against the ISP.
FUCK BUILDING IT. I've done that for the last FOUR MONTHS.

[Eremius]

So other IT staff member just calls me over "come help for a sec"... sure what do you need...

Blah blah blah - can't see all stuff in a users "My Documents" (we do folder redirection so My documents is actually a network location)...

Systray has "offline files" & "Network Cable Unplugged" icons...




Can anybody guess the answer?

Layer 8?

[Melcar]

To all Incompetent Admins out there: Pay some fucking attention to what you are doing.

I know it's complicated when you have a "Windows Explorer window " open in one spot - and a "backup database window" on another -- I know they look similar - THAT IS WHY YOU HAVE TO PAY SOME FUCKING ATTENTION, they are not the same fucking thing. Make SURE of what you are clicking delete on.

Especially since YOU are a Domain Admin! You can cause Damage -- Yes, the fact that I can fix Most of your fuckups is not the issue, they should not happen to begin with.

and don't tell me you know when you obviously didn't.

Lets see -- Overwritten word file, still in original location... Backup database -- hmmm, the file is missing. You didn't have the right window selected when you hit the delete key. Go right ahead and tell me all you want that you KNOW to pay attention to that, when You Obviously didn't pay attention to that. There is no other physical way that scenario could have happened.