February 2001 - Test - lists.nanog.org

Re: Reasons why BIND isn't being upgraded
by Paul A Vixie 03 Feb '01

03 Feb '01

> > Will these 141 organizations many of whose business relies on BIND be > > eligible for your fee-based list? Do they consitute providers > > of "critical infrastructure" in your eyes? No. 90% of the name servers on the Internet fit that classification. "Restricted notification" is not practical on that scale. > Considering that they have a positive revenue model (vs TLD registries that > don't, or have negative revenue models) I would suggest that they pay for it > and help support ISC/BIND. Of course, everyone should support ISC. And the Sierra Club for that matter. But "should they support ISC?" is a completely different question than "if we don't get them upgraded before the whole world knows about it, are we doomed?"

1 0

Re:BIND, djbdns, commercialization
by rkuhljr＠uol.com.br 03 Feb '01

03 Feb '01

>While the idea of another program to serve DNS isn't all that bad, >I think jumping ship just because of one new policy isn't necessarily >the most prudent thing to do. The new policy may not be the only reason; the bugs in BIND 4/BIND 8 are making everyone consider what to use as replacement: BIND 9, djbdns or something else. Both BIND 9 and djbdns have non-technical issues; BIND 9 licensing is good, but ISC sticks to security notification methods that are not. Licensing is a djbdns weakness. >WRT djbdns: I've had a moderate level of experience with it, and, >while it seems interesting to an extent, operationally I've had several >annoying encounters with it. >When challenged, I seem to get the reply of "maybe some time later >it will have that" or "that is insecure, djb doesn't support that". What operational issues are annoying and in what daemons (dnscache, tiny-dns, axfr-dns, wall-dns) ? Needs like authoritative servers and recursive resolvers are different, and may be a djbdns/BIND9 mix can perform better. >djbdns is also very infant - it's probably not popular enough for all >the skr1pt k1dd13s to have an interest in hacking at, because finding >a vulnerability in djbdns is about as useful to the "wreaker or havoc" >as finding a master door and ignition key to a '58 pinto -- there's >about 17 of them on the planet :-) djb himself seems not to be very popular; I bet that are many people out there trying to find bugs in his software just to make him look silly. Rubens Kuhl Jr.

2 1

Re: Reasons why BIND isn't being upgraded
by Paul Vixie 03 Feb '01

03 Feb '01

meltzer(a)villageworld.com (Jeffrey Meltzer) writes: > I'm confused. I get the TLD server operators part. But you're saying > that you'd only give OS vendors access to this information. How long does > it take, say, Sun, to issue a patch update? Wouldn't it be much more > efficient, and useful, to issue the information directly to the people > using the software? How many people actually use the default vendor > binaries anyways? CERT handles notification. The bind-members forum is for people who receive such notifications to coordinate with ISC on actual patch details. Check your paranoia at the door.

1 0

RE: Reasons why BIND isn't being upgraded
by Roeland Meyer 03 Feb '01

03 Feb '01

> From: Adam Rothschild [mailto:asr@latency.net] > Sent: Saturday, February 03, 2001 1:20 PM > Why not just notify everyone at once? That way, when vulnerabilities > are discovered, people can take whatever action they deem appropriate > to protect their infrastructure (write/release their own set of BIND > patches? upgrade to djbdns? decide DNS is too daunting to manage > in-house, and outsource to Nominum or UltraDNS instead?), rather than > remain vulnerable, pending an official announcement from the > appropriate sources. Perhaps I'm missing something, isn't that what ISC does on the web-site already?

1 0

RE: nanog nazi-ism
by Roeland Meyer 03 Feb '01

03 Feb '01

I haven't had a problem and I certainly published some unpopular views. > -----Original Message----- > From: jamie rishaw [mailto:jamie@arpa.com] > Sent: Saturday, February 03, 2001 12:12 PM > To: nanog(a)merit.edu > Subject: nanog nazi-ism > > > > Okay, > > I've had to resubscribe to nanog-post 3 times in the past week. > > Who is trying to censor nanog? What's going on here? Who controls > nanog-post? > > Am I the only one experiencing this? > > -- > i am jamie at arpa dot com .. and this is my .sig. > > core1.dns.microsoft.com# sho access-list 101 > Extended IP access list 101 > deny udp any any eq domain (874572345872345 matches) >

1 0

nanog nazi-ism
by jamie rishaw 03 Feb '01

03 Feb '01

Okay, I've had to resubscribe to nanog-post 3 times in the past week. Who is trying to censor nanog? What's going on here? Who controls nanog-post? Am I the only one experiencing this? -- i am jamie at arpa dot com .. and this is my .sig. core1.dns.microsoft.com# sho access-list 101 Extended IP access list 101 deny udp any any eq domain (874572345872345 matches)

1 0

Network Solutions Bilking ex-customers
by Daniel Senie 03 Feb '01

03 Feb '01

For those who haven't already seen this, Network Solutions is sending "FINAL NOTICE" bills to domain holders who've transferred their names to other registrars. Many people get nervious when they receive something which looks official and says "your domain name will be repossessed" or something like that. I have been advising clients to file complaints with the Federal Trade Commission. This is a flagrant attempt to bilk end users. It is unclear if those who DO pay wind up getting their domains transferred back to Network Solutions, or if they just pocket the money. Anyone from the press who wants some choice quotes from me on this matter, feel free to contact me. -- ----------------------------------------------------------------- Daniel Senie dts(a)senie.com Amaranth Networks Inc. http://www.amaranth.com

6 6

RE: More 6509 problems...
by Danny Snyder 03 Feb '01

03 Feb '01

Ya got me on that one....Cisco didn't really say why and I didn't think to ask them either.... --Danny -----Original Message----- From: Kenny Sallee [mailto:k_sallee@yahoo.com] Sent: Tuesday, January 30, 2001 11:28 AM To: agudgeon(a)firstnet.co.uk; 'Danny Snyder' Cc: nanog(a)merit.edu Subject: Re: More 6509 problems... How would CEF cause an interface to be up/down? Just curious....Kenny ----- Original Message ----- From: "Alison Gudgeon" <agudgeon(a)firstnet.co.uk> To: "'Danny Snyder'" <dsnyder(a)nowdocs.com>; <nanog(a)merit.edu> Sent: Tuesday, January 30, 2001 8:36 AM Subject: RE: More 6509 problems... > > Hi > > Hybrid IOS > > I've got IP CEF DISTRIBUTED set globally. Did you have it enabled or > disabled on the T3 interface? > > Ali > > -----Original Message----- > From: Danny Snyder [mailto:dsnyder@nowdocs.com] > Sent: 30 January 2001 16:21 > To: agudgeon(a)firstnet.co.uk; nanog(a)merit.edu > Subject: RE: More 6509 problems... > > > Alison, > > I've had VERY similar problems with a 6509 (Sup 1a + MSFC2) with a FlexWAN > and a PA-2T3+. After spending the better part of two weeks on the phone > with Cisco, we finally determined that ip cef distributed needed to be > turned on in global configuration. > > Also, are you running native IOS or Catalyst OS on the Supervisor and IOS on > the MSFC ? > > Danny Snyder > Network Administrator > NowDocs, Inc. > > > > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Alison Gudgeon > Sent: Tuesday, January 30, 2001 10:18 AM > To: nanog(a)merit.edu > Subject: More 6509 problems... > > > > Hi, > > Is anyone doing the following: > > 6509 (supervisor 1a + msfc) - with a flexWAN adapter to take a Packet Over > Sonet OC-3 card. > > I'm having great problems getting up/up on the interface, the current > situation is up/down, a hardware loop at the telco kit brings the line up/up > but otherwise just up/down. Config is default I've just put IP's on. > > I'm running very new code - 12.1(4)E1 > > many thanks in advance for any help. > > > Kind Regards > > > Alison > >

3 5

Re: Operate until failure
by Sean Donelan 03 Feb '01

03 Feb '01

On Mon, 08 January 2001, Henry Yen wrote: > And if you are running a late-model linux (preferably RedHat), you can > download APC's own "award-winning PowerChute Plus" software for linux from > their website. It seems to be identical to PowerChutePlus running on > any other platforms, except that the interface is through X86. And what if you are not using APCs? One issue with highly redudandent data centers is the failure modes are "interesting." You don't want to shutdown due to a single UPS failure, so you don't use something simple like PowerChute Plus. You most likely don't want to shutdown based on any automatic signal. However, you do want a way for an operator to gracefully shutdown a lot of equipment quickly when the decision is made. For a server farm, with potentially thousands of individual systems, is there any standard piece of software you can install on all of the systems to act as a receiver of a signal to begin a graceful shutdown that does not depend on a vendor's proprietary interface? Preferabally one which does not involve running a lot of additional wires. I know, everyone says their systems will never fail. Think of this as the "else" statement for the condition which will never happen. Again this is only needed if people want a gracefull shutdown. If you can live with a hard shutdown, you wouldn't require this. If you use ctrl-alt-del as a normal management practice, I suspect you don't really require a graceful shutdown.

8 7

Quasi-operational re. Exim
by Steve Sobol 02 Feb '01

02 Feb '01

In light of the recent thread about a carrier-class mail server, and since I don't have the address of the mailing list mentioned there, I was wondering how people felt about Exim. I apologize in advance to those NANOG readers who are going to yell at me about operational content, but I couldn't come up with a better mailing list to send this to. I've installed Exim. I like what I've seen so far. Robust, lots of features... and I was mightily impressed when my out-of-the-box RPM installation passed all of abuse.net's spam relay tests. So... Can Exim handle large queues, and delivery to tens of thousands of mailboxes? (I'm not at the point where I'd need that kind of scalability yet, but I don't want to have to switch mail servers any time soon.) -- Steve Sobol, BOFH, President 888.480.4NET 866.DSL.EXPRESS 216.619.2NET North Shore Technologies Corporation http://NorthShoreTechnologies.net JustTheNet/JustTheNet EXPRESS DSL (ISP Services) http://JustThe.net mailto:sjsobol@NorthShoreTechnologies.net Proud resident of Cleveland, OH

2 1