May 2004 - Test - lists.nanog.org

Re: ntp config tech note
by Peter Lothberg 20 May '04

20 May '04

> One minor (operational! -- gasp) addition: > > More modern copies of ntpd have a '-g' option that will allow > the clock to jump once at boot time. If you have not told the kernel to refuce to change the time when the system is in multiuser mode for security reasons. -Peter There is an easy workaround, just make sure your local clock in the computer is as close to UTC as you can....

1 0

Cisco's Statement about IPR Claimed in draft-ietf-tcpm-tcpsecure
by David Krause 19 May '04

19 May '04

Looks like Cisco is now trying to patent security.... http://www.ietf.org/ietf/IPR/cisco-ipr-draft-ietf-tcpm-tcpsecure.txt Title: Cisco's Statement about IPR Claimed in draft-ietf-tcpm-tcpsecure Received: April 26, 2004 From: Robert Barr <rbarr(a)cisco.com> Cisco is the owner of one or more pending patent applications relating to the subject matter of "Transmission Control Protocol security considerations" <draft-ietf-tcpm-tcpsecure-00.txt>. If technology in this document is included in a standard adopted by IETF and any claims of any Cisco patents are necessary for practicing the standard, any party will be able to obtain a license from Cisco to use any such patent claims under reasonable, non-discriminatory terms, with reciprocity, to implement and fully comply with the standard. For information contact: Robert Barr Worldwide Patent Counsel Cisco Systems 408-525-9706 rbarr(a)cisco.com

10 12

RE: Barracuda Networks Spam Firewall
by Brian Battle 19 May '04

19 May '04

Eric, > There's one rule that will wipe out ~90% of spam, but nobody seems to have > written it yet. > > if URL IP addr is in China then score=100 > > support for a generic lookup list of cidr blocks would get another 9% I agree that geographically classifying the URL's embedded in the spams would be pretty slick, using the china.blackholes.us and cn-kr.blackholes.us RBLs has been pretty effective at reducing our spamload, as a supplement to the standard lookup services. They do not descriminate between legit mails and spam mails from china. Everything from those IP blocks gets classified as spam. Luckily we don't ever get any client emails from those countries at this point and can use these filters without worrying about false-positives. (I think the doubleclick.blackholes.us is pretty funny too) There are others at: http://www.blackholes.us/ Is anyone else out there using these blackholes? I wonder how often they get updated. Brian Battle Confluence

1 0

FW: RE: List of dynamic IP's
by Nicole 19 May '04

19 May '04

Not Ip's but domain names etc I block. You can perhaps generate some from this? http://www.unixgirl.com/blockeddomains.html Nicole On 19-May-04 the GW commando coersion squad reported Bob Martin said : > > Does anyone know of a list of dynamic IP's by ISP? > I'm looking for something akin to this list from AOL > http://postmaster.info.aol.com/info/servers.html > > TIA > > Bob Martin -- |\ __ /| (`\ | o_o |__ ) ) // \\ - nmh(a)daemontech.com - Powered by FreeBSD - ------------------------------------------------------ "The term "daemons" is a Judeo-Christian pejorative. Such processes will now be known as "spiritual guides" -Politicaly Correct UNIX Page http://www.nonsenseband.com *** Spam Sucks and I get tons of it. So I have some tight spam filters. If any email to me bounces, please use your secret decoder ring and please send to blabgoo at yahoo dot com :)

1 0

Slides for NANOG31 IPsec tutorial
by Duane Wessels 19 May '04

19 May '04

If you plan to attend Sunday's hands-on tutorial for using the IPsec server at NANOG, you may want to have a look at the slides in advance. You can find them at: http://www.packet-pushers.net/NANOG/ipsec/ Unix users, in particular, may need to prepare their systems by building a new kernel and/or installing an IKE daemon. The slides contain URLs for sample configuration files and startup scripts. Those files are also available at the above URL. Duane W.

1 0

Secondary MX user list filter for Sendmail
by Todd Vierling 19 May '04

19 May '04

A colleague asked me offlist about how to make a Sendmail secondary MX properly return 550 for invalid recipient addresses. For smaller sites -- or even larger sites if the list is autogenerated and the access_db uses "btree" storage (it's rather fast) -- the below solution will do just that. ===== In your secondary MX's sendmail.mc, add the following FEATUREs if you don't already have them. FEATURE(`access_db')dnl FEATURE(`blacklist_recipients')dnl Rebuild your sendmail.cf from this, and then put entries like the following in your /etc/mail/access file (assuming "foo.com" is your domain). I'm also assuming that "foo.com" is already in /etc/mail/relay-domains (or /etc/mail/sendmail.cR depending on your sendmail install), so that relayed mail can get through. userone(a)foo.com RELAY usertwo(a)foo.com RELAY To:foo.com "550 User unknown" The RELAY lines designate explicitly allowed recipient addresses for relaying to the primary MX. The To:...550 line, which requires the "blacklist_recipients" feature, is a fallback rule that matches after the email addresses and returns the expected "User unknown" error. Now rebuild your access.db file, restart sendmail, and voila, you have a secondary MX explicit user list. -- -- Todd Vierling <tv(a)duh.org> <tv(a)pobox.com>

2 1

Goddard SFC
by Jason McCormick 19 May '04

19 May '04

If anyone at Goddard Space Flight Center (gsfc.nava.gov) is on the list, can you please contact me off-list about an e-mail blocking issue? -- Jason McCormick jason(a)devrandom.org GPG Fingerprint: 66C5 2B15 3E34 2B5E 5321 6147 303A DCE6 0A74 A19C

1 0

Re: Barracuda Networks Spam Firewall
by Valdis.Kletnieks＠vt.edu 19 May '04

19 May '04

On Tue, 18 May 2004 14:31:21 CDT, Steve Drees said: > if I 0wn your mail gateway I can generate a list of valid accounts over > time. On a busy host over a short period of time. So your auditor wouldn't mind if you kept an unencrypted list of credit card numbers on a DMZ box, because if somebody hacks the box they can gather those over time? :)

8 20

Suppressed Routes AS30174 & 17090 ?
by P.Schroebel 19 May '04

19 May '04

Hello Folk, I was wondering if in-fact any of our routes are being suppressed either via our ASN 30174 or any of our ip space 66.164.0.0/16 or 66.79.96.0/20. Given and Granted that we have had rotten history of sorts. However, we really have cleaned up our networks and rid ourselves of all vermin, spammers, spam-hosters, spam related affiliates and were are working with authorities; helping out where we can. Therefore, if in-fact we were being suppressed, null routed or otherwise black-holed either via ip or ASN. Then, I would apprieciate if this could resolved by the removal of any such suppressions. Best Regards, Peter

1 0

Re: Off-Topic: Sunday night beer @ Zeitgeist, NANOG31
by Hannigan, Martin 18 May '04

18 May '04

Thers also a Saturday night gathering at www.dnalounge.com Mail me direct for info. Thanks. Regards, -- Martin Hannigan (c) 617-388-2663 VeriSign, Inc. (w) 703-948-7018 <http://www.verisign.com/> -----Original Message----- From: owner-nanog(a)merit.edu <owner-nanog(a)merit.edu> To: Rob Nelson <ronelson(a)vt.edu>; Jeff Rizzo <riz(a)boogers.sf.ca.us>; nanog(a)merit.edu <nanog(a)merit.edu> Sent: Sun May 16 12:39:46 2004 Subject: RE: Off-Topic: Sunday night beer @ Zeitgeist, NANOG31 > Rob Nelson > Um. State, City, Zip Code? :) California, San Francisco, 94103-1117 Michel.

2 1