- NANOG - lists.nanog.org

nanog nazi-ism
by jamie rishaw 03 Feb '01

03 Feb '01

Okay, I've had to resubscribe to nanog-post 3 times in the past week. Who is trying to censor nanog? What's going on here? Who controls nanog-post? Am I the only one experiencing this? -- i am jamie at arpa dot com .. and this is my .sig. core1.dns.microsoft.com# sho access-list 101 Extended IP access list 101 deny udp any any eq domain (874572345872345 matches)

1 0

Network Solutions Bilking ex-customers
by Daniel Senie 03 Feb '01

03 Feb '01

For those who haven't already seen this, Network Solutions is sending "FINAL NOTICE" bills to domain holders who've transferred their names to other registrars. Many people get nervious when they receive something which looks official and says "your domain name will be repossessed" or something like that. I have been advising clients to file complaints with the Federal Trade Commission. This is a flagrant attempt to bilk end users. It is unclear if those who DO pay wind up getting their domains transferred back to Network Solutions, or if they just pocket the money. Anyone from the press who wants some choice quotes from me on this matter, feel free to contact me. -- ----------------------------------------------------------------- Daniel Senie dts(a)senie.com Amaranth Networks Inc. http://www.amaranth.com

6 6

RE: More 6509 problems...
by Danny Snyder 03 Feb '01

03 Feb '01

Ya got me on that one....Cisco didn't really say why and I didn't think to ask them either.... --Danny -----Original Message----- From: Kenny Sallee [mailto:k_sallee@yahoo.com] Sent: Tuesday, January 30, 2001 11:28 AM To: agudgeon(a)firstnet.co.uk; 'Danny Snyder' Cc: nanog(a)merit.edu Subject: Re: More 6509 problems... How would CEF cause an interface to be up/down? Just curious....Kenny ----- Original Message ----- From: "Alison Gudgeon" <agudgeon(a)firstnet.co.uk> To: "'Danny Snyder'" <dsnyder(a)nowdocs.com>; <nanog(a)merit.edu> Sent: Tuesday, January 30, 2001 8:36 AM Subject: RE: More 6509 problems... > > Hi > > Hybrid IOS > > I've got IP CEF DISTRIBUTED set globally. Did you have it enabled or > disabled on the T3 interface? > > Ali > > -----Original Message----- > From: Danny Snyder [mailto:dsnyder@nowdocs.com] > Sent: 30 January 2001 16:21 > To: agudgeon(a)firstnet.co.uk; nanog(a)merit.edu > Subject: RE: More 6509 problems... > > > Alison, > > I've had VERY similar problems with a 6509 (Sup 1a + MSFC2) with a FlexWAN > and a PA-2T3+. After spending the better part of two weeks on the phone > with Cisco, we finally determined that ip cef distributed needed to be > turned on in global configuration. > > Also, are you running native IOS or Catalyst OS on the Supervisor and IOS on > the MSFC ? > > Danny Snyder > Network Administrator > NowDocs, Inc. > > > > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Alison Gudgeon > Sent: Tuesday, January 30, 2001 10:18 AM > To: nanog(a)merit.edu > Subject: More 6509 problems... > > > > Hi, > > Is anyone doing the following: > > 6509 (supervisor 1a + msfc) - with a flexWAN adapter to take a Packet Over > Sonet OC-3 card. > > I'm having great problems getting up/up on the interface, the current > situation is up/down, a hardware loop at the telco kit brings the line up/up > but otherwise just up/down. Config is default I've just put IP's on. > > I'm running very new code - 12.1(4)E1 > > many thanks in advance for any help. > > > Kind Regards > > > Alison > >

3 5

Re: Operate until failure
by Sean Donelan 03 Feb '01

03 Feb '01

On Mon, 08 January 2001, Henry Yen wrote: > And if you are running a late-model linux (preferably RedHat), you can > download APC's own "award-winning PowerChute Plus" software for linux from > their website. It seems to be identical to PowerChutePlus running on > any other platforms, except that the interface is through X86. And what if you are not using APCs? One issue with highly redudandent data centers is the failure modes are "interesting." You don't want to shutdown due to a single UPS failure, so you don't use something simple like PowerChute Plus. You most likely don't want to shutdown based on any automatic signal. However, you do want a way for an operator to gracefully shutdown a lot of equipment quickly when the decision is made. For a server farm, with potentially thousands of individual systems, is there any standard piece of software you can install on all of the systems to act as a receiver of a signal to begin a graceful shutdown that does not depend on a vendor's proprietary interface? Preferabally one which does not involve running a lot of additional wires. I know, everyone says their systems will never fail. Think of this as the "else" statement for the condition which will never happen. Again this is only needed if people want a gracefull shutdown. If you can live with a hard shutdown, you wouldn't require this. If you use ctrl-alt-del as a normal management practice, I suspect you don't really require a graceful shutdown.

8 7

Quasi-operational re. Exim
by Steve Sobol 02 Feb '01

02 Feb '01

In light of the recent thread about a carrier-class mail server, and since I don't have the address of the mailing list mentioned there, I was wondering how people felt about Exim. I apologize in advance to those NANOG readers who are going to yell at me about operational content, but I couldn't come up with a better mailing list to send this to. I've installed Exim. I like what I've seen so far. Robust, lots of features... and I was mightily impressed when my out-of-the-box RPM installation passed all of abuse.net's spam relay tests. So... Can Exim handle large queues, and delivery to tens of thousands of mailboxes? (I'm not at the point where I'd need that kind of scalability yet, but I don't want to have to switch mail servers any time soon.) -- Steve Sobol, BOFH, President 888.480.4NET 866.DSL.EXPRESS 216.619.2NET North Shore Technologies Corporation http://NorthShoreTechnologies.net JustTheNet/JustTheNet EXPRESS DSL (ISP Services) http://JustThe.net mailto:sjsobol@NorthShoreTechnologies.net Proud resident of Cleveland, OH

2 1

Re: Reasons why BIND isn't being upgraded
by Simon Waters 02 Feb '01

02 Feb '01

> From: Paul Vixie <vixie(a)mfnx.net> > Simon(a)wretched.demon.co.uk (Simon Waters) writes: > > > I remain unconvinced that showing the version string helps much. > hiding it doesn't help at all. people who want to know if you're vulnerable > and to what have tools to find out. No - they or their tools then have to try known exploits sequentially to find out if I'm vulnerable - which is completely different to just asking for a version string. In some cases the failed exploits will be logged, or cause a crash. Thus perhaps allowing DoS but saving someone altering the DNS contents, or perhaps giving the owner time to respond. > hiding it DOES however make it harder for people (including network owners) > to do surveys. Network owners can run "named -v", or get an audit program that does it for them. BIND is not alone most major Internet software (My mail program does for starter... at the moment anyway) is only too keen to tell you who it is in tedious detail, I think they should report what protocols they support (although this could be a give away as well). BTW I'm not saying "lie" about the version string as someone seemed to think, I'm saying just don't give it to anyone who asks. If someone phoned you up out of the blue, and said "Hi, I'm Simon, what version DNS server are you running?" you'd probably hang up or ask why I want to know, you wouldn't just say 8.2.3 and hang up, so why let your most sensitive servers do something you wouldn't. > From: Jim Mercer <jim(a)reptiles.org> > > yeah, i'm pissed with isc and that vixie guy too. > > after all, i paid them 0's and 0's of dollars to come up with a timely > fix to the security hole, and what do they do? I'm hoping HP pay them a reasonable amount out of what my clients pay HP, but HP probably squandered it paying Jean to write all that wireless network card code for Linux *8-) -- Business http://www.eighth-layer.com/ Personal http://www.wretched.demon.co.uk/

1 0

Re: [NANOG] Re: Reasons why BIND isn't being upgraded
by Sean Donelan 02 Feb '01

02 Feb '01

On Fri, 02 February 2001, Pim van Riezen wrote: > On Thu, 1 Feb 2001, Eric A. Hall wrote: > > The real culprit in this story is the script-generator. It should have > > been cranking out standard-compliant zone files from day one. > > Absolutely. The guilty party for that script has long left the > organization. This is real world, where people have to deal with other > people's messes :). Don't worry, someday people will say the same thing about the messes you leave behind.

1 0

RE: Reasons why BIND isn't being upgraded
by Karyn Ulriksen 02 Feb '01

02 Feb '01

For several services, we keep a table of inhouse daemon/versions to real daemons/versions. We haven't done this on bind yet, but thinking about it now. We starting using it on FTP services a few years ago. That way we know what version of wu-ftpd or apache (or whatever) we are running on a server, but the script kiddies don't off the bat. Some of it *is* customized, but we have version identifiers for those customized versions as well. It's not that big of a hassle to keep track of the map - just a simple hash to manage. Best of both worlds. K > -----Original Message----- > From: Patrick Greenwell [mailto:patrick@cybernothing.org] > Sent: Friday, February 02, 2001 11:14 AM > To: Bill Woodcock > Cc: nanog(a)merit.edu > Subject: Re: Reasons why BIND isn't being upgraded > > > > On Fri, 2 Feb 2001, Bill Woodcock wrote: > > > On Fri, 2 Feb 2001, Patrick Greenwell wrote: > > > By the same token one might argue that atempting to > hide vunerabilities > > > to those paying you for "early warnings" doesn't help at all. > > > > Not at all... If you're trying to hide a vulnerability by > lying about > > your version number, that presupposes generally-held knowledge of an > > association between a vulnerability and a version number. > > > > "Early warning" is specifically a means of delaying the general > > availability of knowledge of that association. > > Which leaves those that have not been informed of such vunerabilities > acutely vunerable. > > Script kiddies may be stupid, but the people writing the > program that they > utilize generally aren't. > > Without rehashing the whole "open-disclosure" vs. "non-disclosure" > arguments related to security issues in software, or the historically > extreme inadequacies of CERT in offering timely notification of ANY > security-related issues, it's very disappointing to see ISC > resort to a > fee-based, non-public-disclosure-at-the-time-of-discovery, NDA'd and > "we'll update people via CERT" method of dealing with the > community they > have served for so long. > > I would have hoped by now that lists such as Bugtraq would > have adequately > exhibited the folly of such methodologies. > > Obviously that is not the case. > > >

1 0

RE: [NANOG] RE: [NANOG] Re: Reasons why BIND isn't being upgraded
by Roeland Meyer 02 Feb '01

02 Feb '01

> From: Pim van Riezen [mailto:pi@vuurwerk.nl] > Sent: Friday, February 02, 2001 3:59 AM > > On Fri, 2 Feb 2001, Roeland Meyer wrote: > > > > Pete Elke's point about preproduction testing could perhaps be > > > turned from a combative tone to the constructive without loss of > > > information. > > > > Isn't that why NSI is running a stealth master root server > ... so they _are > > able_ to do pre-production testing of zone files? In the > past few years, > > there were a lot of root server outages that would have > been prevented by > > that practice. > > To be honest, yes it wuold've saved me some extra frustration if I had > known there would be such issues. Yes, a test situation is > ideal to get > these changes figured out. I just counted on it to be a > trivial upgrade > and it wasn't. Repeat after me; There is no such thing as a trivial upgrade.

1 0

Re: Reasons why BIND isn't being upgraded
by Simon Waters 02 Feb '01

02 Feb '01

Apologies for the delay - but I read the list in digest and this is my first post. I have done a slightly bigger survey of BIND version strings as of 16:00GMT Thursday February 1st, taking the nameservers for Keynote40 Business to Consumer sites and a selection of the domainnames from the front page of www.persiankitty.com. Of 440 DNS servers surveyed; 35% are reporting strings that clearly indicate use of 8.2.3 or better (Hardly anyone is revealed to be using 9.0 or 9.1). 35% are reporting strings that strongly suggest they are susceptable to known BIND bugs (Some are rather old versions of BIND are out there). These figures charitably assume that; people who don't reveal version strings are not afflicted by BIND bugs. Bind variants that have source code modifications aren't affected - they probably are, but I said we were being charitable. So in answer to the question - are people too busy to upgrade BIND - clearly 35% of admins found time to do it already. Those who had upgraded to 8.2.2-P7 to avoid the previous DoS bugs should have had nothing more to do than replace the binaries and test at 8.2.3, so I think the time excuse is a bit thin. Interestingly the sexsites were only marginally behind the Keynote40 sites, in terms of DNS versions. So perhaps your credit card number is nearly as safe as your share portfolio. Of the strings returned the most humorous was "SIN" from a sexsite. The most constructive administrator entry was the admin e-mail address (But since this is in the SOA resource record and RFC2142 (you do have all the RFC2142 mail addresses don't you?!) I'm not awarding any prizes). The ISC.ORG web site recommends leaving the BIND version string unchanged to assist in troubleshooting. I remain unconvinced that showing the version string helps much. Certainly any site with 7x24 hour technical support should consider putting a relevant contact phone number IMHO - such that anyone trying to diagnose a genuine problem can get help, whilst nosey crackers can revert back to social engineering. (E-mail addresses may not be a good choice if your DNS or their DNS is playing up?!). Whilst you can add a "bind" zone of type Chaos and overwrite the default behaviour, as given in an earlier post. Later versions of BIND let you drop the version string in the options section, which is a lot less typing, and a lot easier to understand. An extract of my BIND 9.1rc1 named.conf is given below, clearly my server is only listening to the loopback address, but you'd be amazed how many times it has been queried in the last couple of weeks whilst I got the scripts sorted. options { directory "/etc/namedb"; // Working directory pid-file "named.pid"; // Put pid file in working dir listen-on { 127.0.0.1; }; // private server for performance listen-on-v6 { none; } ; // No version 6 IP version "Contact +44(0)1395 232769"; // Don't release version number }; version ""; doesn't do what I expected at 9.1rc1..... The survey mentioned above will form part of a bigger report, which was inspired by the Microsoft debacle (Aren't those Akamai DNS servers weird, oh and all Microsoft's e-mail relays have sequential IP addresses - what planet are they on), so I will be checking which domains have all their DNS servers (for which glue records exist) in the same network (Based on 'NetName' - better ideas welcome from routing experts - can I easily get IP to ASN?). If I have time I may include mail servers and relays as well as DNS servers, of course if all your DNS servers are on one network having off network mail relays won't help much when you muck up the routing. HTH Simon

7 11