- NANOG - lists.nanog.org

Enable BIND cache server to resolve chinese domain name?
by Joe Shen 06 Jul '05

06 Jul '05

Hi, Some of our customer complaint they could not visit back to their web site, which use chinese domain name. I google the net and found some one recommend to use public-root.com servers in hint file. I found domain name like xn--8pru44h.xn--55qx5d could not be resolved either. Our cache server runs BIND9.3.1 with root server list from rs.internic.net. Do I need to modify our cache server configuration to enable it? regards Joe __________________________________ Meet your soulmate! Yahoo! Asia presents Meetic - where millions of singles gather http://asia.yahoo.com/meetic

16 22

Re: Need BOGIES list
by william(at)elan.net 06 Jul '05

06 Jul '05

On Wed, 6 Jul 2005, Geoff White wrote: > Hello All. > I'm having trouble with Cracking Attempts and DoS attacks from a lot of > places in China :) > My client doesn't do any business in that region so they don't mind If I > block the entire sub-continent :) > Does anyone have a bad-guy list (or part of one) that I can use to get > started? > I'm using pf under OpenBSD 3.7 as a firewall box. IP blocks allocated to organizations in various countries (updated daily): http://www.completewhois.com/statistics/data/ips-bycountry/rirstats/ Configuring firewall (openbsd way on the buttom, replace bogon example with appropriate other list you want): http://www.completewhois.com/bogons/using_bogon_lists.htm#firewall_examples CIDR -> firewall scripts for some systems (not needed for openbsd which accepts cidr ip block list directly with ph): http://www.completewhois.com/bogons/data/scripts/ P.S. Still looking for somebody to document and if necessary provide scripts on how to do it with netbsd, aix, hpux. Volunteers? (and I'll do solaris myself if I ever get around to it...) -- William Leibzon Elan Networks william(a)elan.net

1 0

Re: Report: Major Newspaper Sites Hobbled by Power Woes
by MARLON BORBA 06 Jul '05

06 Jul '05

This leads us to the old fact that several ISPs and hosting providers protect their servers with every network perimeter security resource (firewalls, IPSs, virus-and-spam-appliances etc) but forget that "availability" as a security principle requires adequate physical and utility safeguards also (backup site, automated failover, redundant communication links between sites and backbones, capable UPS, air-conditioning, fire-extinguishing...). Not all, as you see, are computer-related "per se", but they are "sine-qua-non" for 24x7 availability. Abraços, Marlon Borba, CISSP. -- Nova campanha: Centro de Resposta a Incidentes de Segurança da Justiça Federal - Vamos criar! -- >>> "Fergie (Paul Ferguson)" <fergdawg(a)netzero.net> 07/06/05 1:12 PM >>> Netcraft reports that: [snip] A power outage at an Advance Internet hosting facility has hobbled the web sites for the company's chain of more than 30 newspapers, including many large metropolitan dailies. [...]

3 2

IANA IPv4 allocations and bogon updates: 89/8, 90/8 and 91/8
by Rob Thomas 06 Jul '05

06 Jul '05

-----BEGIN PGP SIGNED MESSAGE----- [ Apologies to those of you who receive this note in multiple forums. ] Hi, team. The numerous Team Cymru bogon projects have been updated as of 30 JUN 2005 to reflect the following IANA allocation made on 30 JUN 2005: 089/8 Jun 05 RIPE NCC (whois.ripe.net) 090/8 Jun 05 RIPE NCC (whois.ripe.net) 091/8 Jun 05 RIPE NCC (whois.ripe.net) IANA allocations change over time, so please check regularly to ensure you have the latest filters if you are not using the bogon BGP feed(s). We do announce updates to the bogon projects to sundry lists, such as the bogon-announce list. We can not stress this point strongly enough - these allocations change. If you do not adjust your filters, you will be unable to access perhaps large portions of the Internet. Worse yet, you may end up blocking access for people who transit through you. Please do not apply any filters or blocks to your network without carefully considering the ramifications of doing so. As a point of reference, the Team Cymru master Bogon Reference Page can be found here: <http://www.cymru.com/Bogons/> A quick summary of the documents and projects that have been updated include the following: HTTP The Bogon List - <http://www.cymru.com/Documents/bogon-list.html> The Text Bogon Lists - <http://www.cymru.com/Documents/bogon-bn-nonagg.txt> - <http://www.cymru.com/Documents/bogon-bn-agg.txt> Secure BIND Template - <http://www.cymru.com/Documents/secure-bind-template.html> Secure IOS Template (Cisco) - <http://www.cymru.com/Documents/secure-ios-template.html> Secure BGP Template (Cisco) - <http://www.cymru.com/Documents/secure-bgp-template.html> Secure JUNOS Template (Juniper) - <http://www.cymru.com/gillsr/documents/junos-template.htm> Secure JUNOS BGP Template (Juniper) - <http://www.cymru.com/gillsr/documents/junos-bgp-template.htm> Ingress Prefix Filter Templates, Loose and Strict (Cisco) - <ftp://ftp-eng.cisco.com/cons/isp/security/Ingress-Prefix- Filter-Templates/> Ingress Prefix Filter Template, Loose (Juniper) - <http://www.cymru.com/gillsr/documents/junos-isp-prefix-filter-loose.htm> Ingress Prefix Filter Template, Strict (Juniper) - <http://www.cymru.com/gillsr/documents/junos-isp-prefix-filter-strict.htm> BGP Bogon route-server for AUTOMATED updates of bogon filters - All bogon route-server peers have already received the appropriate BGP prefix updates. - <http://www.cymru.com/BGP/bogon-rs.html> RADb fltr-unallocated fltr-martian fltr-bogons - <http://www.cymru.com/Bogons/index.html#radb> RIPE NCC fltr-unallocated fltr-martian fltr-bogons - <http://www.cymru.com/Bogons/index.html#ripe> DNS Bogon (bogons.cymru.com) zone - <http://www.cymru.com/Bogons/index.html#dns> Monitoring Bogon prefix monitoring - <http://www.cymru.com/BGP/robbgp-bogon.html> Bogus ASN monitoring - <http://www.cymru.com/BGP/asnbogusrep.html> Please feel free to contact Team Cymru <team-cymru(a)cymru.com> with any comments, questions, or concerns. Thank you for your continued support. Thanks! Rob. - -- Rob Thomas http://www.cymru.com Shaving with Occam's razor since 1999. -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.2 iQCVAwUBQswL+1kX3QAo5sgJAQHcQgP/RDehEvRBiaN0nFApyeQroJzb6NfOmd88 VScVbNj08xn7jkovVjXndQ8roQzDEVhLZyhHa0+dp8cLEETnjVYXNd6Ir9/bajRj 3mybhQefzaPlKJjLOhjWmoU3maUMN8oTrWGkE5YQOe+6Ef8HDrI0inT+mhhyqdhF V/I5kb6mNBw= =qVJI -----END PGP SIGNATURE-----

1 0

Re: Recall: SORBs
by Gregory Hicks 06 Jul '05

06 Jul '05

> Date: Wed, 6 Jul 2005 21:20:10 +0530 > From: Suresh Ramasubramanian <ops.lists(a)gmail.com> > > On 06/07/05, Alex Rubenstein <alex(a)nac.net> wrote: > > What is scarier -- > > > > a) microsoft providing this feature > > > > b) someone with the ability to type "conf t, router bgp", > > connected to the global internet, and thinking > > that recalling a message would work? > > [b] most assuredly > > [a] has its uses, when used internally in an exchange groupware > environment Yeah BUT! A message can only be "recalled" if it has NOT been read. If the message goes to a 'list' of people, the ones that have NOT read the message will not see it. Those that HAVE read it, get to keep the original message. So it really doesn't do what one would think it does. Regards, Gregory Hicks > > -- > Suresh Ramasubramanian (ops.lists(a)gmail.com) > --------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3479 San Jose, CA 95134 | Internet: ghicks(a)cadence.com I am perfectly capable of learning from my mistakes. I will surely learn a great deal today. "A democracy is a sheep and two wolves deciding on what to have for lunch. Freedom is a well armed sheep contesting the results of the decision." - Benjamin Franklin "The best we can hope for concerning the people at large is that they be properly armed." --Alexander Hamilton

2 1

Report: Major Newspaper Sites Hobbled by Power Woes
by Fergie (Paul Ferguson) 06 Jul '05

06 Jul '05

Netcraft reports that: [snip] A power outage at an Advance Internet hosting facility has hobbled the web sites for the company's chain of more than 30 newspapers, including many large metropolitan dailies. The Advance newspapers have switched to text-based sites to continue publishing, but are currently unable to display advertising, making the outage a potentially costly event. Affected sites include NJ.com, Michigan Live, Cleveland.com, The Portland Oregonian and the online classifieds site BestLocalJobs.com and Best LocalAutos.com. One of the affected papers, The New Orleans Times-Picayune, is in the midst of covering the impact of Tropical Storm Cindy, which hit the New Orleans area yesterday and has left more than 240,000 local residents without power as well. [snip] http://news.netcraft.com/archives/2005/07/06/major_newspaper_sites_hobbled_… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Recall: SORBs
by Sanfilippo, Ted 06 Jul '05

06 Jul '05

Sanfilippo, Ted would like to recall the message, "SORBs".

3 2

SORBs
by Sanfilippo, Ted 06 Jul '05

06 Jul '05

Does anyone know of an easier way to remove IP blocks from a blacklist? We received a /16 from ARIN in May and have been trying to get SORB's to remove the blacklist association on these addresses. They seem to take forever to remove the blacklist association. Thanks Ted

3 2

Re: OT? /dev/null 5.1.1 email
by Valdis.Kletnieks＠vt.edu 06 Jul '05

06 Jul '05

On Tue, 05 Jul 2005 21:27:23 PDT, Justin Mason said: > BTW, someone (possibly Randal L. Schwartz) came up with a neat related > trick to the above -- set up an interface alias on *the same machine* as > the primary MX, list that as the last MX in the list, and (assuming that > the software side of the primary MX is reliable) you're then assured that > any SMTP traffic that arrives on that IP's port 25 is spam, since when > the primary MX's hardware goes down, this MX will, too. (Damn, left out a paragraph somehow) And in fact, given that most link hiccups *are* transitory, the chances are *good* that if our attempts at the first MX fail, the link will be back before we finish running through the MX's - at which point we find ourselves talking to a spamtrap.

2 1

Re: The whole alternate-root ${STATE}horse (was Re: Enable BIND cache server to resolve chinese domain name?)
by Steve Gibbard 06 Jul '05

06 Jul '05

On Tue, 5 Jul 2005, Jay R. Ashworth wrote: > But Steve appeared to be suggesting that there was no reasonable way to > *avoid* problems -- and that's clearly not the case. If I misinterpreted > Steve, no doubt he'll correct me. But there are two fairly prominent, I don't think that was what I said. What I was attempting to say is that the issue of alternate roots probably isn't something that's worth worrying about. I see no reason why they'll catch on, other than perhaps in limited cases where they'll work ok. In the general case, with alternate roots, there's a chicken and egg problem. Right now, if you're an end user doing your DNS lookups via the ICANN root, you can get to just about everything. If you're something that end users want to connect to, using an ICANN-recognized domain will mean almost everybody can get to you, while an "alternative" TLD would mean only a tiny fraction of the Internet would be able to get to you. So, if you're a content provider, why would you use anything other than a real ICANN-recognized domain? And, if the content providers aren't using real domain names, why would an end user care about whether they can get to the TLDs that nobody is using? This is the same phonomenon we saw ten years ago, as the various "online services," GENIE, Prodigy, MCIMail, Compuserve, AOL, etc. either interconnected their e-mail systems with the Internet or faded away and died. As the Internet got more and more critical mass, there was less and less incentive to be using something else. It's been a long time since I've seen a business card with several different, incompatible, e-mail addresses printed on it, and that's because something simpler worked, not because people screamed loudly about the falling sky. The exceptions to this that I see would be either when somebody comes out with something that is so much better that it's useful in spite of a lack of an installed userbase (Skype may be doing this to phone calls), or when something is rolled out to a large enough self-contained user community that the lack of ability to communicate outside that region won't be a significant barrier. If a few large countries were to roll out alternate root zones nation-wide, in such a way that they worked well for domestic communication, but couldn't be used for international stuff, *maybe* that would be good enough to catch on. But still, anybody wanting to communicate outside that region or userbase would probably find they were much happier using addresses that met global standards. So anyhow, that's a long way of saying that, just as this hasn't gone anywhere any of the many other times it's been raised over the last several years, it's unlikely to go anywhere, or cause problems, this time. -Steve

5 4