September 2003 - Test - lists.nanog.org

Providers removing blocks on port 135?
by Adam Hall 22 Sep '03

22 Sep '03

Anyone know anything about prorviders removing ACLs from their routers to allow ports 135/445/4444 back into their network? Curious only because customers are calling in saying that Verizon, Cox, Bellsouth, and DSL.net are doing so and seem to have a big problem with the fact that we're hesitent follow their lead. Adam

19 34

Need help with Ex-Pat project
by Douglas S. Peeples 22 Sep '03

22 Sep '03

I am helping on several areas for the design, testing, and deployment of a Metro Ethernet network (based on MPLS) in the Pacific rim. If you or if you know anyone interested in working over seas for a year or so drop me an email with contact information. Cheers, Doug Peeples

1 1

[Administrativia] Posting rules: are messages silently dropped?
by Stephane Bortzmeyer 22 Sep '03

22 Sep '03

Messages I send from an email address which is not subscribed to nanog-post are apparently silently dropped. I do not receive a bounce (like it is typically the case when a list is closed) but, according to the archives, they are not distributed either (which may be good for the S/N ratio but I digress). Isn't it too harsh? <URL:http://www.nanog.org/email.html> explains how to post but does not mention what happens to posts from non-subscribers.

1 0

Riverhead or Lancope?
by John Obi 22 Sep '03

22 Sep '03

Nanogers, Did you ever tested Riverhead or Lancope? I know rackspace uses one or both of them. Are they good products and worth the try? Can they really decrease the the DDoS damage? Are they better than CISCO products? Are there any tips? Thanks, -J __________________________________ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software http://sitebuilder.yahoo.com

3 2

Re: Windows updates and dial up users
by Jonathan Hunter 22 Sep '03

22 Sep '03

On Sun, 21 Sep 2003, Sean Donelan wrote: > "It occurred to me that one way to make things easier for dial-up users, > and even broadband users in many cases, would be to issue periodic update > CDs. Imagine a disc with all of the updates on it and a program, it could > even be written in Windows Script Host, to check a system for which > updates need to be installed, apply them in the correct order and even > reboot in between. Such a program would not be hard to write." > > [...] > > "I recently put this suggestion to Microsoft and their response basically > avoided the whole issue. Why wouldn't the company want to offer such a CD, > assuming that's the motivation behind their stonewalling?" >From this month's issue of /PC Pro/ magazine (UK, Issue 109) : "please accept our apologies for the lack of Microsoft patches or DirectX on our cover discs. Microsoft US has banned the inclusion of any of its code on magazine discs. Presumably, the company assumes we all have broadband to download up to 166MB for DirectX 9b or 134MB for Windows XP Service Pack 1a." And that's without mentioning the mean-time-till-infection of an unpatched system, of course... Regards, Jonathan

1 0

Re: VeriSign SMTP reject server updated
by Michael.Dillon＠radianz.com 22 Sep '03

22 Sep '03

>> Wrong protocol. There should be *NO* SMTP transactions for >> non-extistant domains. >After being bit by this over the weekend I would have to agree, due to >a screwup at netSOL a companies domain I manage was resolving to their >sitefinder service, and all mail just went *poof*. At anytime, Verisign could remove your .COM domain from their DNS for a short period of time which would result in all of your inbound email going to the Verisign collector servers. If this was only done for a brief interval, say 10 minutes, you might never notice that it had happened. But Versign's industrial espionage department would have your email in their hands and could do whatever they wish with it. How profitable might that be? Of course, the right way to do this would be to resend the email onward so that you never notice any missing messages at all. In fact, if I were designing the system to do this, I wouldn't log anything at the mailserver. I'd let the mail server and web server technical folks have plausible deniability. Meanwhile, I would have diverted a copy of the mailserver communications at the Ethernet switch to a secret server that does the actual logging of addresses and messages. Son of Carnivore? --Michael Dillon

2 1

Verisign's Threat to Infrastructure Stability
by Curt Akin 22 Sep '03

22 Sep '03

FWIW: To: The Department of Homeland Security Sent (via dhs.gov site form) Dated: 21 Sep 2003 14:24:37 -0000 Category: Security Threats Message: Threat to the stability and predictability of the Internet infrastructure: Verisign is solely and exclusively responsible for the maintenance (and therefore stability) of the root GTLD domain name servers for .com and .net top level domains. Verisign has recently "wildcarded" address records in such a way that attempts to access nonexistant (ie unregistered or mistyped) domain names results in a redirection to a Verisign site at sitefinder.verisign.com. This obviously profit-motive-driven act is not only in violation of certain terms of its contract with ICANN, but has had a destabilizing effect on the network operators community who expect the Internet name service to operate in a designed and predictable way. DHS would be well advised to consider the potential threat that Internet unpredictability has on this country's cyber infrastructure and to seriously consider the relocation of root server responsibility to non-profit-motive-driven organizations. We are all too busy maintaining stable environments to have to consider reactions and countermeasures to Verisign's autonomous and arrogant behavior.

3 2

Re: VeriSign SMTP reject server updated
by Michael.Dillon＠radianz.com 22 Sep '03

22 Sep '03

>before we deployed root-delegation-only here, i was also annoyed that my >e-mail tool could not tell me about misspelled domain names at "send" time >and i had to wait for the wildcard mail servers to bounce the traffic. In other words, Verisign is actually increasing the amount of misspelled domain name traffic by sabotaging the spell-checking feature of your email program. Under normal circumstances you would have noticed your error and corrected it before sending the email. This implies that Verisign could be collecting a much larger number of valid email addresses by logging these seemingly misspelled domain names and then "correcting" the misspelling by closest match against the .COM database. This would be an immensely valuable list for spammers to acquire, whether they do it by paying Verisign or by infiltrating the company to steal it. And don't pay any attention to Matt Larson's comments regarding logging. If he is unable to shut off the wildcard redirection then he has no say over what data is collected and what is done with it. Verisign could easily reassign him with a promotion and then turn on the logging and collection of email addresses. We already know that this company is unscrupulous and not to be trusted. In future we need to ensure that the registry operating the .COM domain works under some sort of contract that controls how they function. This is a public resource that we ourselves have created and not a commercial asset to be milked for profit. --Michael Dillon

1 0

Re: When is Verisign's registry contract up for renewal
by Brandon Butterworth 22 Sep '03

22 Sep '03

> DNS piracy is DNS piracy if Verisign gets away with it others will have a go too brandon

1 0

Home Storage Area Network security
by Sean Donelan 22 Sep '03

22 Sep '03

I received a few comments about file servers not serving files by default. There are a bunch of home SAN products on the market. They are designed to make it very easy for customers to set up and use a home storage area network. I think these are very cool products, and although some geeks like building stuff from scratch, other folks like buying stuff assembled and working out of the box. But they seem very dangerous when connected directly to the open Internet without some access control turned on. Instead they "assume" there will always be a secure firewall in place, protecting the devices. But in all the discussion about how secure their products are, you rarely see an explicit requirement for these SAN devices to be installed behind a firewall. Just because you use Linux does not make SMB secure on the Internet. http://www.mirra.com/ Ease of Use: Just plug in Mirra, run the installer, and let it auto-detect your network settings. Name your Mirra, say .ok. to the recommended backup set (or select your own), then forget it. Remote access is simple to use as well. No IPs to configure, no firewalls to penetrate. Mirra does it for you. http://www.martian.com/howtouseit.html The NetDrive comes pre-configured from the factory, so you don't have to worry about reading a long manual or learning about setting up file serving software. Of course, if you do want to enable password protection for your files or use a special network configuration, the NetDrive's simple web-based configuration interface will let you. What protocols does it serve files under? The NetDrive uses the standard SMB protocol to share its files. This makes it compatible with Windows PCs, Macs running OS X, and Linux boxes.

4 5