In Memoriam Ardath Mayhar Home •  Help •  WebNews •  WebMail •  WebChat People Pages •  Features •  Store •  Member Services •  Join SFF Net
SFF Net Newsgroup Access

Last update: 22 Sep 2003, 2:09 p.m. CDT

Current Status:

• WebNews is back up and will stay that way
• news.sff.net is back up, but
  1. You must use port 1119 instead of port 119 for direct news access (i.e., Free Agent or other dedicated newsreader)
     • Instructions for Agent and Free Agent
     • Instructions for Outlook Express
     • Instructions for Mozilla Mail & News (Netscape 7x)
     • Instructions for Mozilla Thunderbird
     • Instructions for Tin in a *nix environment
     • Instructions for MT-Newswatcher on the Mac
     • Instructions for MacSOUP
     • Instructions for Microplanet Gravity
     • Instructions for Macintosh Entourage
     • General setup instructions
  2. If you access through WebNews with your browser, you don't have to change anything
  3. This change may or may not be permanent (depends on the worm)

Swen Worm Traffic

The Swen worm reads newsgroups to gather email addresses. Since the method the worm uses cannot be distinguished from normal news server access, it is not possible to block the worm's access without blocking your access, too.

After spending all night and the better part of a day trying to distinguish worm traffic from normal news traffic, we have given up for now and just changed the news port. The worm will continue trying to connect to the news server, but get nowhere. You, however, being a real-live person, can get around the block by changing your news reader's port.

We are experiencing the equivalent of a DDoS attack on our news server. Hundreds of thousands of pseudo-clients are reading the newsgroups over and over, presumably to harvest email addresses.

The excessive traffic is not only bogging down the news server (to the point where it occasionally starts refusing new connections), but is filling our T1.

Please watch http://www.sff.net/maintenance.asp for information. If the news server goes off the air, the reason and expected downtime will be listed here.

Check your port setting on your news reader. To cope with the worm, we have had to stop listening on port 119. The news server now listens on port 1119 instead.

No Permission To Talk

If you are a regular SFF Netter, and you get an error message saying "No permission to talk" when you try to connect to the news server, write to Tech Support and tell us your current IP number.

1. Close Agent.
2. Find the AGENT.INI file - in most cases, this will be in the C:\Program Files\Agent\Data directory. If you use Agent to connect to more than one news server, be sure you're editing the one for SFF Net.
3. Make a backup copy of the file before editing it.
4. Edit the file - find the [Servers] section of the file (it should be fairly near the top).
5. Use notepad or another plain-text editor -- do not use Word or another word-processor!
6. Change the line:
       NNTPPort=119
   to read:
       NNTPPort=1119
7. Save the file and restart Agent.

Instructions for Tin in a *nix environment

Add "-p 1119" to the command line, or include it in your alias, if you're using one.

1. Select the Special... menu
2. Choose News Servers.... from the Special menu
3. Select the SFF server (however you've named it) in the display area on the left side of the dialog
4. Select the server options tab
5. Change news.sff.net to news.sff.net:1119

1. Start MacSOUP
2. On version 2.5, go to the MacSOUP menu, and select Preferences (alternately, hit Command-,)
3. On version 2.5b2, go to the File menu, and select Settings
4. Select "Servers" from the drop-down menu
5. For NNTP Host, change it from news.sff.net to news.sff.net:1119
6. Close the dialogue box
7. You're done!

1. Go to Tools
2. Move down to Accounts
3. Choose News tab
4. Highlight "news.sff.net" in list of news accounts
5. Go to options (on the right side) and click Properties
6. Choose the Advanced tab--the server port number should be on the top
7. Enter 1119, then click Apply

1. Click on Window in the menu bar, and select Mail and Newsgroups, or press Ctrl-2
2. Hightlight the SFF.Net account, and right-click
3. Select Properties
4. Under Mail and Newsgroups Account Settings, select Server Settings
5. Change 119 in the Port box to 1119
6. Click OK

1. Select Tools
2. Select Account Settings
3. Select the SFF.Net news account from the list of accounts
4. Select server settings under the SFF.Net news account
5. change the port setting from 119 to 1119
6. click OK

1. Pull down the "Server" menu.
2. Make sure SFF's server is checked as being active then click on "Properties."
3. Click on the "Servers" tab.
4. At bottom of tab there is an entry for "Server Ports", change the NNTP one to 1119.
5. Click "Ok"
6. Shutdown and restart Gravity.

1. Choose Accounts from the Tools menu
2. Pick the appropriate account from the News tab.
3. On the Account Settings tab, click "Click here for advanced receiving options."
4. Check the box that says "Override default NNTP port:" and type 1119 in the field provided.
5. Close it and choose OK to save the new setting.