February 2001 - Test - lists.nanog.org

RE: Reasons why BIND isn't being upgraded
by Carter, Gregory 01 Feb '01

01 Feb '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I think if anything is to be stressed here is that it should be left up to the administrator of the network to choose whether they wish the version records to be available or not. Theory can be argued for it to either be enabled or disabled but honestly I wouldn't care either way if the choice was left to me and by default it was not enabled until I specified otherwise. I had no idea that named had ever responded this way until it was posted to this list to my surprise. I am not an advocate of security through obscurity however I don't feel that administrators should be removing all doubt to script kiddies of what versions of software they are running so easily. Make them work for it. Greg +(gcarter(a)infoDNS.com)-------------------------------------------------+ | infoDNS http://www.infodns.com/ | | Senior Network Administrator bits/keyID 1024/7DF9C285 | | Need help? Ask an expert. -------------> http://www.infoforums.com/ | +--------[ DC 50 57 59 C3 76 46 E8 EB 75 A8 94 FE 96 9E D3 ]----------+ - -----Original Message----- From: Adam McKenna [mailto:adam@flounder.net] Sent: Thursday, February 01, 2001 6:13 PM To: nanog(a)merit.edu Subject: Re: Reasons why BIND isn't being upgraded On Thu, Feb 01, 2001 at 06:07:44PM -0800, Paul Vixie wrote: > Simon(a)wretched.demon.co.uk (Simon Waters) writes: > > I remain unconvinced that showing the version string helps much. > > it helped you with your survey, didn't it? > > hiding it doesn't help at all. people who want to know if you're vulnerable > and to what have tools to find out. > > hiding it DOES however make it harder for people (including network owners) > to do surveys. I always thought that it was regarded as generally good security practice to give out as little information about your systems as possible, and none at all if you can help it. The BIND version should at least only be accessible from a set of defined IP addresses, defaulting to 127/8. - --Adam - -- Adam McKenna <adam-sig(a)flounder.net> | "No matter how much it changes, http://flounder.net/publickey.html | technology's just a bunch of wires GPG: 17A4 11F7 5E7E C2E7 08AA | connected to a bunch of other wires." 38B0 05D0 8BF7 2C6D 110A | Joe Rogan, _NewsRadio_ 9:10pm up 236 days, 19:28, 8 users, load average: 0.00, 0.00, 0.00 -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQA/AwUBOnoajygrak0xvB4zEQI8PACg6QEbINrVYiEtOO/XzPs+AIwVt8IAoMsq 8x9K6g6r4P+hHrJNhnijJQux =IGS6 -----END PGP SIGNATURE-----

2 1

Re: [NANOG] Re: Reasons why BIND isn't being upgraded
by Paul Vixie 01 Feb '01

01 Feb '01

pi(a)vuurwerk.nl (Pim van Riezen) writes: > bogosity while updating 8.2.2-P7 to 8.2.3: > > (1) 8.2.3 Doesn't accept the "(" in the SOA string to be on the next line > after the IN SOA. Our script-generated zonefiles, about 45000 of them, > all had this. Neither do the relevant RFC's, or any other DNS implementation. Pre-8.2.3 was simply _wrong_ to accept that syntax. > (2) 8.2.3 Changed the meaning of the last field of the SOA record and > needs a $TTL directive to cover the default TTL. This also affected > all of our zones (86400 seconds timeout on negative caching is, you > must agree, way over the top so not a value you want to propagate). This also is per several (recent) RFC's, and again, pre-8.2.3 was simply _wrong_ in its use of the SOA.MINTTL as a default TTL for the whole zone. > (3) 8.2.3 Is unforgiving against errors in zonefiles. Where previously > individual records were rejected (or served as-is), bind now insists > on dropping the entire zone if something went wrong. Needless to say > in a reload of 45K domains it takes a bit of time to fish out the > bad ones. A zone either has an identity or it doesn't. There's no such thing as a best effort identity. If the file is not syntactically valid, it's not a zone and ought not be served, since it has no specific identity for the serial number to map to. > When downloading I expected a security upgrade, not a service pack. You and a lot of other people. 8.2.2-P8 will be along shortly.

2 1

Re: Scalable Mail solution with NAS
by Mike Johnson 01 Feb '01

01 Feb '01

Ron Snyder [snyder(a)roguewave.com] wrote: > On Thu, Feb 01, 2001 at 10:12:51AM -0500, Mike Johnson wrote: > > to deal with concurrent access. I've yet to find a version of > > this software that runs on Linux (or any other Open Sourceish OS), > > so it's not even a consideration for me. > > You mean something like > http://www.missioncriticallinux.com/technology/cluster/ ? Nope, I don't. See page 4 of their white paper: http://www.missioncriticallinux.com/technology/cluster/kimberlite.pdf Quote: Although both systems can access shared disk storage, to ensure data integrity, only one cluster system can run a service and access service data at one time. To prevent a service from running on multiple systems and corrupting data, each cluster system is remotely connected to the other cluster system's power switch through a serial line. This remote connection enables each cluster system to completely disable the other cluster system by cycling its power. Once a cluster system has been disabled, its services can be safely restarted on the other cluster system. They go to great lengths to ensure that no more than one system is accessing a single piece of data at the same time. Lots of companies do this (maybe not with this amount of paranoia, but it's still done). The hard part is to allow both systems to have access to the same data at the same time. Write operations on the same file are prevented by distributed lock managers. This is what Veritas Cluster and Sun Cluster do. It seems to be relatively difficult, otherwise I'm sure we'd already see plenty of options. I looked into the various options (about six months ago) and arrived at the conclusion that this was best done via NAS boxes. They handle locks pretty well, allowing concurrent access to the same file (best implemented with write locks, allowing read-only access). This allows the option of placing a bank of otherwise identical SMTP/IMAP servers behind a load-balancing switch attached to the NAS. The end users only ever see one hostname, but their request would be handled by the least loaded box. Need more capacity for more users? Add more servers. Need more storage space? Max out the capacity of the NAS, then add more NAS boxes. They're just mount points on the host. Mike -- Mike Johnson Network Engineer / iSun Networks, Inc. Morrisville, NC All opinions are mine, not those of my employer

1 0

Re: Wierd portscans
by Elric 01 Feb '01

01 Feb '01

On Wed, 31 Jan 2001, Justin Hinderliter wrote: > > One thought that comes to mind in regards to the high-numbered ports is > whether they might think that that's a firewall running PAT/NAT, in which > case, private IPs behind the firewall would end up showing up as > high-numbered ports on the firewall. Is this on a gateway/firewall, and if > so, are you running NAT/PAT? Nope, we aren't running NAT or PAT. - Elric -------------------------------------------------------------------------- Network Administrator Dierking Scott Enterprises --------------------------------------------------------------------------

1 0

Scalable Mail solution with NAS
by Patrick Hollowell 01 Feb '01

01 Feb '01

My company is in the process of evaluating several mail solutions, scalable to 150k to 200k mailboxes. One thing we'd like to do is run the message store over Gig-E on network attached storage. Two of the vendors we've been looking at claim performance issues running this solution over NFS. Does anyone know of a carrier-class mail solution that will run well on NAS? Patrick Hollowell Sr. Network Engineer CTC Internet Services phollowell(a)vnet.net 800-377-3282 x3527

14 15

Re: sorry to ruin several of your evenings...
by Paul Vixie 01 Feb '01

01 Feb '01

vince(a)penguin-power.com ("Vincent Power") writes: > the only thing that I had to do when upgrading between 8.x and 9.x was at > add $TTL line to the top of every zone file. BIND 8.2.3 makes you do that, too.

13 18

Re: Not a good day now stuff from here is on BBC
by brandon＠rd.bbc.co.uk 01 Feb '01

01 Feb '01

> I understand that, the issue I had with this is in the presentation > "Major net security holes identified", Should have read "Major net > security holes fixed " this would have been fair to Paul and crew. > is all I am saying..... I don't think they got that far yet, write how you see the follow up should be and send to newsonline(a)bbc.co.uk as long as it's not "major bad stuff averted, nothing to see here, move along" (they are journalists, they need some story) I'd expect them to cover it If they'd asked us we would have tried to get something into the original regards brandon

1 0

Wierd portscans
by Elric 31 Jan '01

31 Jan '01

I've been going though my scanlogs and in the past couple of days I have seen someone trying to come in. Thier not getting in but im noticing them hitting a number of ports over and over. Primarily attempting udp port 0, but also 35072, 41612, and 63240. I've done searches on Google, Dejanews, Bugtraq etc but can't seem to find out what these ports are. Just wondering if anyone had come across them ever.... - Elric -------------------------------------------------------------------------- Network Administrator Dierking Scott Enterprises --------------------------------------------------------------------------

2 1

Re: Wierd portscans
by Justin Hinderliter 31 Jan '01

31 Jan '01

As an added note, there's no match for those UDP ports on l0pht, phrack, etc. either. Justin ----- Original Message ----- From: "Justin Hinderliter" <justin(a)interaccess.com> To: "Elric" <elric(a)dse-nets.com>; "North America Network Operators Group Mailing List" <nanog(a)merit.edu> Sent: Wednesday, January 31, 2001 7:21 PM Subject: Re: Wierd portscans > Here's a list of services and their known port numbers. > > However, it appears that they're scanning for ports in the "reserved" or > "unassigned" zones. It could be that they're scanning those ports just to > see if you're allowing scans or blocking them/dropping them to a null > route... before running a subsequent scan. Other than that, I'm not quite > sure what they're looking for, to be truthful. > > One thought that comes to mind in regards to the high-numbered ports is > whether they might think that that's a firewall running PAT/NAT, in which > case, private IPs behind the firewall would end up showing up as > high-numbered ports on the firewall. Is this on a gateway/firewall, and if > so, are you running NAT/PAT? > > Justin Hinderliter > Network Analyst > InterAccess Co. Data CLEC > > ----- Original Message ----- > From: "Elric" <elric(a)dse-nets.com> > To: "North America Network Operators Group Mailing List" <nanog(a)merit.edu> > Sent: Wednesday, January 31, 2001 5:12 PM > Subject: Wierd portscans > > > > > > > > I've been going though my scanlogs and in the past couple of days I have > > seen someone trying to come in. Thier not getting in but im noticing them > > hitting a number of ports over and over. Primarily attempting udp port 0, > > but also 35072, 41612, and 63240. I've done searches on Google, Dejanews, > > Bugtraq etc but can't seem to find out what these ports are. Just > > wondering if anyone had come across them ever.... > > > > > > - Elric > > > > > > -------------------------------------------------------------------------- > > Network Administrator Dierking Scott Enterprises > > -------------------------------------------------------------------------- > > > > > > >

1 1

RE: netsol and host records.
by Carter, Gregory 31 Jan '01

31 Jan '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Marc, I've had a similar experience with a domain I had transferred. The domain name (interx.net) had a host, which was relied upon by 400 other domains (ns1.interx.net) I transferred the domain name to OpenSRS (as I am a reseller) and noticed that when I created nameservers on OpenSRS for the domain name that NSI's old host records for it were overriding since we also changed the nameserver IP address for the host record. Unfortunately the only solution we had (since the host was replied upon by other domains) was to fix the host on NSI as well to reflect the new address. In an ideal world, NSI should also be able to resolve nameserver hosts on other registrars but I suppose we can all dream can't we? In your situation, you should be able to delete the nameserver host if it's not being relied upon by other domain names. They don't remove it automatically because they probably don't have any auditing tools coded to check on a regular basis whether or not a nameserver host is needed. They've always sent through the host records up to the root servers when you create them whether they are in use by a domain or not. Perhaps they should give OpenXRS a try. In short I don't think you'll ever get a straight answer from them however what they told you "because it's www" is not correct. It happens for ALL nameserver hosts unfortunately and is just something we have to deal with until they go bankrupt (wishful thinking?) Greg +(gcarter(a)infoDNS.com)-------------------------------------------------+ | infoDNS http://www.infodns.com/ | | Senior Network Administrator bits/keyID 1024/7DF9C285 | | Need help? Ask an expert. -------------> http://www.infoforums.com/ | +--------[ DC 50 57 59 C3 76 46 E8 EB 75 A8 94 FE 96 9E D3 ]----------+ - -----Original Message----- From: Marc MERLIN [mailto:marc_news@valinux.com] Sent: Wednesday, January 31, 2001 3:03 PM To: nanog(a)merit.edu Subject: OT: netsol and host records. I've really tried, but I'm giving up. I know this is only vaguely related to routers, but since I couldn't find anyone at netsol who understands their own system, I'm hoping that someone here has a better idea (through trial and error) So, I had a host, www.svlug.org which sat on one net (209.81.8.0) and as we migrated to a portable netblock, it migrated to 198.186.203.43. To avoid disruption of service, we had the two nets configured on our router, and the machine had both IPs. We updated DNS to switch everything to the 198.186.203.x IPs, all was nice and dandy. Later (1 year later), we move locations to a place where 209.81.8.0 isn't routed anymore, bring the host back up, everything looks cool. However people start complaining that they can't reach www.svlug.org. We find out that it still resolves to 209.81.8.243 (the old IP) for some folks. After a lot of searching, we realize that netsol is still feeding the old IP to the root name servers who answer the query before the resolvers are refered to our name servers. End up finding this: http://www.networksolutions.com/cgi-bin/whois/whois;?STRING=host+WWW7974-HS… ING=Search It's now been a month and a half that I've been trying to get rid of that stupid www.svlug.org host record Of course, we never created that host record, it was created when svcs.net and svcs.org (domains owned by someone else) were as they unfortunately specified www.svlug.org as a name server (something I only found out about way later because there is no way to know who's using your host record unless someone really high up at netsol looks that up for you). So, after moving svlug.org away from netsol (to opensrs), and noticing they were still feeding www.svlug.org to the root name servers, I called them up several times, having to dodge the clueless level 1 people who don't know what a host record is or told me it was not their problem since they don't serve svlug.org. (I've stopped using their mail system, I find it much easier to yank the domain away from them and move it to a registrar who actually knows how to write a couple of CGI scripts and set up an https server) Eventually, they tell me about svcs.net which was very unfortunately registered with www.svlug.org as a name server (instead of ns.svlug.org) I move that over to opensrs (with the help of the owner who clicks on the URL that opensrs sends you to confirm the domain move), fix the name servers, and it still doesn't work. The owner mentions to me that there is an svcs.org too (they could have told me, but no...), so wash, rince, and repeat... Both domains are moved, name servers are fixed, wait a few days. (so far so good, nothing in this process involves sending mail to their stupid mail system which never works when I use it anyway, besides I don't get the answers because after 10 years+, they still haven't fixed their script to add a 'To:' field in the Email they send) A week later, they're still feeding the bad data to the root name server. Call them up 3 times, waste time to go through the clueless level 1 people, get level 2 folks who kind of understand the problem but who are now "not habilitated to do a reverse lookup on a host record" to see if any domain is still using the bad host record. I insist, ask for a supervisor, ask for someone who can do the damn lookup, but no, no one is available. - - Why don't you send a host delete request? - - Well, if a domain is pointing to it, it won't work now, will it? - - Err yeah. - - And you can't tell me what is pointing to it if anything. - - Err no. "Send us letterhead" Yeah, as soon as I go to kinkos and make SVLUG letterhead, I'll do that. "I'll send you the forms you need to fax" I never get them because she misspelled my Email address and apparently never got/saw the bounce from my mail server and insisted that it went through. Call again, get escalated again as soon as I confused the level 1 tech enough. Ok, this guy can actually confirm that nothing is pointing to www.svlug.org. (never mind that no one was there to do that 10mn ago when I called) - - But then why are you still feeding the bad IP to the root name servers? - - Because it's our database - - Grrrmm. Ok, look at this: http://www.networksolutions.com/cgi-bin/whois/whois;?STRING=host+ns2.merlin… Notice the bad IP? Well, it stopped mattering the day I moved my domain to opensrs. If you have no domains pointing to a host record, you stop feeding that host record to the root name servers, as you should. Are you sure nothing whatsoever is pointing to it anymore? - - Yes. - - Ok, then why are you still feeding it to the root name servers - - Because it's in our databasse - - And why don't you do it for ns2.merlins.org? - - Errr.... Hold on. (wait) That's because the hostname is 'www' - - Let me get this straight. You're telling me that you continue to feed an orphaned host name record because it has 'www' in its name? - - Yes - - Aaaarrrrgggghhh! (eating desk) - - So what now? - - Ok, submit the deletion form by Email, get the tracking number, print this different form, add the tracking number on there, and fax it to us Swell. I fill the form (http://www.networksolutions.com/en_US/makechanges/fax/hostform.html) confirm: "Domain Not Found! "svlug.org" domain cannot be found in WHOIS Database. Please go back to the previous screen and enter a valid domain name." (of course, svlug.org was moved to opensrs) Arggggh! I'm going to kill someone.... I printed the unconfirmed web form, added their error message and faxed all that to two of their fax numbers (with picture ID). Their cluelessness allows for very nice denial of service attacks (www.svlug.org has been unusable for 2 months now) This is probably going to get fixed after a lot of wasted time, but I'd like to understand why the hell they're still feeding the www.svlug.org host record to the root name servers (sorry, but I didn't quite buy the "because it has www in its name" explaination) In this case, the web server isn't the most important thing in the world (and svlug.org resolves right), but understanding what's happening would help if one day the same happens to an revenue generating web server. Thanks, Marc - -- Microsoft is to operating systems & security .... .... what McDonalds is to gourmet cooking Home page: http://marc.merlins.org/ | Finger marc_f(a)merlins.org for PGP key -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.8 for non-commercial use <http://www.pgp.com> iQA/AwUBOnifqCgrak0xvB4zEQJnYACffM+L1xH5Sw00Mb7qHN75qU68WmYAnjZo XDQJra+eiKXOlElHLx0/Y7MN =UKyh -----END PGP SIGNATURE-----

2 1