- NANOG - lists.nanog.org

new openssh issue
by Len Rose 17 Sep '03

17 Sep '03

Just in case no one has seen this: http://slashdot.org/articles/03/09/16/1327248.shtml?tid=126&tid=172

7 6

anyone from telia online
by Peter Galbavy 17 Sep '03

17 Sep '03

I need a little help with (what appears to be) an IGP issue withing Telia's UK network. I am stuck in a twisty maze of little resellers. Any response would be appreciated. Peter

1 0

Change to .com/.net behavior
by Matt Larson 17 Sep '03

17 Sep '03

Today VeriSign is adding a wildcard A record to the .com and .net zones. The wildcard record in the .net zone was activated from 10:45AM EDT to 13:30PM EDT. The wildcard record in the .com zone is being added now. We have prepared a white paper describing VeriSign's wildcard implementation, which is available here: http://www.verisign.com/resources/gd/sitefinder/implementation.pdf By way of background, over the course of last year, VeriSign has been engaged in various aspects of web navigation work and study. These activities were prompted by analysis of the IAB's recommendations regarding IDN navigation and discussions within the Council of European National Top-Level Domain Registries (CENTR) prompted by DNS wildcard testing in the .biz and .us top-level domains. Understanding that some registries have already implemented wildcards and that others may in the future, we believe that it would be helpful to have a set of guidelines for registries and would like to make them publicly available for that purpose. Accordingly, we drafted a white paper describing guidelines for the use of DNS wildcards in top-level domain zones. This document, which may be of interest to the NANOG community, is available here: http://www.verisign.com/resources/gd/sitefinder/bestpractices.pdf Matt -- Matt Larson <mlarson(a)verisign.com> VeriSign Naming and Directory Services

29 34

Re: Change to .com/.net behavior
by sthaug＠nethelp.no 17 Sep '03

17 Sep '03

> While I too am outraged by the actions of Verisign, I've decided to NOT > modify my servers in any way. > I might decide to block the sitefinder IP, but I will not change my > nameservers into modifying DNS responses. Doing so would be to break things, *You* cannot modify DNS responses, but it's okay for Verisign to do so? Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

3 2

Re: BIND 9 (Re: ISC Patches)
by Len Sassaman 17 Sep '03

17 Sep '03

On Wed, 17 Sep 2003, Paul Vixie wrote: > it's under consideration now. bind8 is not a priority for the bind forum, > and isc would rather put it in feature-freeze, but we're looking into it. > bind9's internals make "delegation-only" easy to implement. bind8's > internals are pretty twisty. This would certainly be appreciated. I have my BIND 8 name servers patched with a modified version of this: http://sam.zoy.org/writings/internet/verisign/patch-bind-8.4.1.0-dickhead.d… ... but it certainly isn't as clean as I'd like. --Len.

1 0

RE: new openssh issue
by Buhrmaster, Gary 17 Sep '03

17 Sep '03

According to Cisco at: http://www.cisco.com/warp/public/707/cisco-sa-20030917-openssh.shtml. this impacts CatOS, their storage router line, their HSE line, and their WLSE lines, and is not an IOS issue. Details on the web page. No fixed versions of software are available yet. Gary > -----Original Message----- > From: Avleen Vig [mailto:lists-nanog@silverwraith.com] > Sent: Wednesday, September 17, 2003 10:27 AM > To: Valdis.Kletnieks(a)vt.edu > Cc: Richard A Steenbergen; William Allen Simpson; nanog(a)nanog.org > Subject: Re: new openssh issue > > > > On Tue, Sep 16, 2003 at 03:50:04PM -0400, > Valdis.Kletnieks(a)vt.edu wrote: > > A posting to full-disclosure quotes Theo as saying HP and > Cisco are affected, > > and I don't see any reason that Juniper would *NOT* be, > given the common code > > base of the OpenSSH implementations. I'm not going to say > the routers are > > vulnerable, but I *would* say that ACLs blocking port 22 to > the router might > > be a good idea..... > > Isn't this a common practice anyway? Has been anywhere sensible I've > seen :-) >

1 0

Sabotage not backhoes: More cable cuts
by Sean Donelan 17 Sep '03

17 Sep '03

Someone climbed a 15-foot tower in Southern Arizona cutting a fiber optic cable used by Broadwing and Tucson Electric Power. This was within five feet of the 138,000-volt power line. The site was also guarded by barbed wire. This is not your typical backhoe. Rural areas have long dealt with the occasional shotgun damaged cable or microwave horn; or the farmer burying the dead cow in the back pasture. But I don't recall two reported acts of sabotage in less than 30 days before. http://www.fox11az.com/news/local/stories/KMSB_local_fiberoptic_091203.9d8b…

2 1

RE: Not the best solution, but it takes VeriSign out of the loop
by Mike Damm 17 Sep '03

17 Sep '03

I never said anything in my original posting regarding assistance from the root operators; god knows you guys have a hard enough job already. And frankly blocking non-cooperative servers would hurt the net just as much as what VeriSign's doing. My suggestion was to simply create a viable alternative source of com/net zones that operators could use if they choose to do so. If you don't like what VeriSign is doing with them, don't use VS zones anymore. Hopefully, eventually, IANA will be telling you to switch the roots. Not me. Not likely, but ORG managed to pull off a transition to other ownership. For anyone who's interested, you can "opt-in" to the new zones I'm building here: http://www.symetrix.net/gtld/ -Mike --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: Paul Vixie [mailto:vixie@vix.com] Sent: Tuesday, September 16, 2003 9:27 PM To: nanog(a)merit.edu Subject: Re: Not the best solution, but it takes VeriSign out of the loop > > Who's up for creating a network of new gTLD servers? > This would require cooperation from the root-servers operators. speaking for f-root, we won't be cooperating with anything like that. we do not edit the zone files we serve. they come from iana, and if you want something different served, you'll have to talk to iana. i cannot speak for the other rootops but i suspect that their answers might be compatible with, if not downright similar to, f-root's. > And a serious effort from ISP/NSP community to block network access to > root-servers that don't cooperate. > > I agree that it's a good idea at this point. I see nothing else as a > serious long-term technical solution. sounds like mob rule to me -- count me out. so, block me first, i guess? -- Paul Vixie

1 0

What *are* they smoking?
by Niels Bakker 17 Sep '03

17 Sep '03

A wildcard A record in the net TLD. $ host does.really-not-exist.net does.really-not-exist.net has address 64.94.110.11 $ host 64.94.110.11 11.110.94.64.IN-ADDR.ARPA domain name pointer sitefinder-idn.verisign.com It even responds on port 25 (says 550 on every RCPT TO). Gah. -- Niels.

61 89

Re: [Re: Change to .com/.net behavior]
by Joshua Sahala 17 Sep '03

17 Sep '03

i'm not sure if it could be cached, but i still see verisign pretending to 0wn the net... as is usually suggested on this list, do your talking with your money, pull your zones from verisign, and never do business with them again, file complaints with all relevant state and federal authorities, and let the l33t Kiddi35 and spammers have some fun ;) of course, the dept of greed^Wcommerce will likely give verisign an 'attaboy' for coming up with this stunt while i am sure all of us (excepting the netsol/verisign lurkers) would like to null route everything attached to them, it will do nothing but make us look like the 'bad guys'. this is not the time for knee-jerk reactions...but damn it would be nice to descend upon verisign's corporate hq with clue-by-fours in hand ;) /joshua ; <<>> DiG 9.2.1 <<>> jklkwekcie.com ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25772 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 0 ;; QUESTION SECTION: ;jklkwekcie.com. IN A ;; ANSWER SECTION: jklkwekcie.com. 900 IN A 64.94.110.11 ; <<>> DiG 9.2.1 <<>> jklkwekcie.net ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11930 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 0 ;; QUESTION SECTION: ;jklkwekcie.net. IN A ;; ANSWER SECTION: jklkwekcie.com. 900 IN A 64.94.110.11 [cut] "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

3 2