February 2010 - Test - lists.nanog.org

Re: dns interceptors
by charles＠knownelement.com 15 Feb '10

15 Feb '10

Not familiar with --outform argument. Will have to look into it. Presume you are doing site to site/network to network? Or are you setting this up for end users to terminate to? I've done the latter many many times, but not net to net. Happy to provide docs if you/nanog like. I think that everyone should run a vpn to secure remote access to services they are operating. You integrating this with an existing ski infrastructure? If so is it openssl based? Or maybe ad based? Lots of openvpn variables.... Might be worth starting a new thread on the subject. As I said, I feel its vital for folks to have a deep familiarity with openvpn and best practices etc. ------Original Message------ From: Randy Bush To: Charles Wyble Cc: nanog(a)nanog.org Subject: Re: dns interceptors Sent: Feb 14, 2010 7:10 PM > I run openvpn on my linux box to do exactly that. i am in the midst of setting up some openvpn servers now, westin, ashburn, tokyo, but westin first. having problems sorting in what --outform it wants the bleeping certs. randy Sent via BlackBerry from T-Mobile

5 7

Re: dns interceptors
by charles＠knownelement.com 14 Feb '10

14 Feb '10

Yes. Easy rsa is the way to go. They are normal certs. Check the scripts if you want to roll your own openssl wrapper scripts. ------Original Message------ From: Larry Brower To: nanog(a)nanog.org Subject: Re: dns interceptors Sent: Feb 14, 2010 7:44 PM Randy Bush wrote: > end user to network > > having probs with certs, i.e. what --outform it wants. not finding in > docs. tried raw, but now guessing pem. same for client and server > > server > ca.crt > server.crt > server.key > > client > ca.crt > client.crt > client.key > > and i presume i have to dump all client.crt files in the server's > ../openvpn dir, but under what names? or does it just wantonly trust > anyone under that ca? > > randy > > What error is getting logged? They are just normal cert's and should be in the keys directory under openvpn's user directory. OpenVPN includes scripts that can make the certificates for you under the directory easy-rsa Sent via BlackBerry from T-Mobile

1 0

Time out for a terminology check--"resolver" vs "server".
by Larry Sheldon 14 Feb '10

14 Feb '10

I thought I understood but from recent contexts here it is clear that I do not. I thought a resolver was code in your local machine that provide hostname (FQDN?), given address; or address, given host name (with assists to build FQDN). And I thought a "server" was a separate program, might be on the same machine, might be on another machine (might be on the local net, might be distant) that the resolver code called for information that was not in local cache. Just what is the straight scoop? -- "Government big enough to supply everything you need is big enough to take everything you have." Remember: The Ark was built by amateurs, the Titanic by professionals. Requiescas in pace o email Ex turpi causa non oritur actio Eppure si rinfresca ICBM Targeting Information: http://tinyurl.com/4sqczs http://tinyurl.com/7tp8ml

6 9

Re: dns interceptors
by charles＠knownelement.com 14 Feb '10

14 Feb '10

I run openvpn on my linux box to do exactly that. Already running apache/bind/postfix/xmpp with legacy Im bridges so adding openvpn was a logical next step. #protip run it on port 443. :) makes it much easier to get around firewalls. Even with deep packet inspection, SSL traffic is expected on that port. I have business class att dsl and 7 static ip addresses. I run a dell optiplex desktop 24x7 and it sips power. You could also just host services in a Colo for around 20.00 a month for dedicated virtual server. You would probably pay that anyway to a company who provided the services you mentioned. Lots of risk with being smtp relay for the world. Just ask yahoo/sbc who provide large swaths of southern California with net access. They provide dns and authenticated/encrypted smtp outbound and charge 14.95 a month for the cheap package. Sent via BlackBerry from T-Mobile

2 1

Re: Time out for a terminology check--"resolver" vs "server".
by Larry Sheldon 14 Feb '10

14 Feb '10

On 2/14/2010 6:10 PM, Rob Austein wrote: > At Sun, 14 Feb 2010 18:02:48 -0600, Laurence F Sheldon, Jr wrote: >> >> I thought I understood but from recent contexts here it is clear that I >> do not. >> >> I thought a resolver was code in your local machine that provide >> hostname (FQDN?), given address; or address, given host name (with >> assists to build FQDN). >> >> And I thought a "server" was a separate program, might be on the same >> machine, might be on another machine (might be on the local net, might >> be distant) that the resolver code called for information that was not >> in local cache. >> >> Just what is the straight scoop? > > No doubt Olafur will beat me up yet again for not having written the > DNS lexicon years ago, but: > > - A "resolver" is something that implements the "resolver" (ie, > client) role in the DNS protocol. It might be a stub resolver, the > client side of a recursive nameserver, a pure iterative resolver, > .... > > The defining characteristic is that it send queries (QR=0) and > receives responses (QR=1). > > - A "name sever" is something that implements the "nameserver" (ie, > server) role in the DNS protocol. It might be an authoritative > nameserver, the server side of a recursive nameserver, .... > > The defining characteristic is that it receives queries (QR=0) and > sends responses (QR=1). > > Clear enough? Yes--tracks with what I thought, pretty much--I was missing the clientness of the resolver code to go with the serverness of the server. > Mapping protocol definitions onto the plethora of terms used by > operators in the field is left as an exercise for the reader, no > sarcasm intended. DNS is an old protocol, there are an awful lot of > people who think they understand it, I am one of those is sure he understands it--which belief crumbles when I try to explain it to somebody else. and each of those people has > their own set of terms that they're comfortable using. The > definitions above are what I rammed through the IETF during several > rounds of standards writing, but I would be the first to admit that > not everybody uses the terms the same way as I do. DNS arcana is one of the things that somebody should document on the internet-history list while there are still people around who can do so with some authority. Thanks. -- "Government big enough to supply everything you need is big enough to take everything you have." Remember: The Ark was built by amateurs, the Titanic by professionals. Requiescas in pace o email Ex turpi causa non oritur actio Eppure si rinfresca ICBM Targeting Information: http://tinyurl.com/4sqczs http://tinyurl.com/7tp8ml

1 0

Yahoo abuse
by John Peach 14 Feb '10

14 Feb '10

Does anyone know how to get Yahoo abuse to recognize that they're hosting a phishing site? All I can ever get back from them is boilerplate telling me they know how frustrating it is to get spam, that it did not originate from them and how to read the headers. Not half as frustrating as their ignorance. -- John

10 16

AT&T Mind Boggles...
by Mark Tinka 14 Feb '10

14 Feb '10

<not usually my style to whine, but...> So I send an online request for Wholesale IP Transit to AT&T via their web site, and several days later, I get an e-mail from one of their staff directing me to another link where I should fill up my information (again). Suffice it to say her e-mail to me already included my information, but anyway... So I hit the link, fill in my data, hit "Submit" and bam! "Page not found". I send an e-mail back to the lady who asked me to follow that link and ask her for help on how to proceed. She writes back to say, in many words, "Sorry, that link is the only way you can get your query answered. Oh by the way, here's a toll-free number you can call, it's not the actual department, but they should be able to direct you". Several more e-mails go back and forth arguing why this is such rocket science - meanwhile, I'm thinking, "She is staff, she can put me in touch since it's their web site that's flaky". The final option I was given was to have a friend in the States help me call AT&T on the toll-free number given. I live outside the States, toll-free numbers don't work for me (yes, they are free on Skype, but that's beside the point). The whole experience was robotic and efficient; efficient at me thinking, "There goes my business". AT&T, what gives? </not usually my style to whine, but...> Mark.

4 3

Re: dns interceptors [SEC=UNCLASSIFIED]
by Valdis.Kletnieks＠vt.edu 13 Feb '10

13 Feb '10

On Sat, 13 Feb 2010 17:53:19 EST, Dean Anderson said: (One of these days, somebody will find a way to correct things for the benefit of those googling and reading the thread in the list archives in the future, without feeding the trolls) > Robert Bonomi appears to have no valid premise of first sale because > there was no sale, so its seems impossible to invoke anything from the > so-called doctrine of first sale. The federal district court ruling in UMG Recordings v. Augusto held otherwise, when they ruled that first sale applied to promotional recordings sent to DJs for free and stamped 'Not for resale'. It held that they were gifts, and first sale has long applied to gifts as well as sales: 10 Although this statutory limitation is commonly referred to as the first sale doctrine, its 11 protection does not require a "sale." The doctrine applies after the "first authorized disposition by 12 which title passes." 2 Nimmer § 8.12[B][1][a]. This passing of title may occur through a transfer 13 by gift. See 4 William F. Patry, Patry on Copyright § 13:15 ("Since the principle [of the first sale 14 doctrine] applies when copies are given away or are otherwise permanently transferred without 15 the accoutrements of a sale, 'exhaustion' is the better description."); 2 Paul Goldstein, Goldstein 16 on Copyright § 7.6.1 n.4 (3d ed.) ("[A] gift of copies or phonorecords will qualify as a 'first sale' to 17 the same extent as an actual sale for consideration."). http://www.eff.org/files/filenode/umg_v_augusto/LA07CV03106SJO-O.pdf So a sale is obviously not required. > But this is the same Bonomi who sent the following email (below). > Apparently Bonomi thinks he has a "legal right" not to get responses to > his emails on public lists, and that he can imply that "legal right" to > prevent others from responding to his nonsense. You're actually probably right, and his notice is likely not legally binding. But you know Dean - if you feel that you have to raise the point whether there's any legal validity to a "Dear Dean: Please don't email me. Ever", that's saying something. And the world would be a much better place if you ever figure out what that something is. > Many organizations (particularly law firms) have similar declarations of > ownership of the content automatically attached by the mailserver. I'm > sure he has seen such declarations before. The fact that lots of people do it doesn't imply it has validity (as you hopefully realize yourself, when you question if Robert Bonomi's notice has any legal standing). Law firms in particular have a long history of making as many far-reaching claims as they think they can get away without getting censured.

1 0

RE: Google to offer fiber to end users
by David Hubbard 13 Feb '10

13 Feb '10

On 2/10/2010 12:30, Charles N Wyble wrote: > > http://www.businessweek.com/news/2010-02-10/google-plans-to-build-high-s peed-fiber-optic-networks-update2-.html > > http://googleblog.blogspot.com/2010/02/think-big-with-gig-our-experiment al.html > > What do folks think? > > Residential computers with enough bandwidth to DoS hosting providers; that should be fun. Maybe it will encourage the incumbant ISP's to start offering users meaningful bgp communities since they won't be able to keep up with the abuse reports. David

9 9

Re: dns interceptors [SEC=UNCLASSIFIED]
by Robert Bonomi 13 Feb '10

13 Feb '10

[ getting afield from 'operational' issues, off-list responses recommended ] > From: Barry Shein <bzs(a)world.std.com> > Date: Sat, 13 Feb 2010 13:43:17 -0500 > Subject: Re: dns interceptors [SEC=UNCLASSIFIED] > > On February 13, 2010 at 12:12 Valdis.Kletnieks(a)vt.edu (Valdis.Kletnieks(a)vt.edu) wrote: > > On Sat, 13 Feb 2010 12:02:48 +0800, "Wilkinson, Alex" said: > > > > > IMPORTANT: This email remains the property of the Australian Defence Organisation > > > > Have fun trying to enforce that after posting to a public mailing list > > in North America, with recipients all over the world. Care to cite any > > relevant legal basis for the claim that would hold outside Australia? > > I know I'm an idiot to respond to this BUT part of the implication of > copyright ownership is: Note well that the 'disclaimer' is claiming ownership of the email _ITSELF_, Not just to the intellectual property rights to the contents of the message. This claim _is_ inconsistent with the 'established body of law' in any juris0 diction that holds to the 'doctrine of first sale'. [[.. sneck ..]] > IANAL, but it doesn't strike me as half as preposterous as you say. What would you think about a notice on a flyer that showed up in your _snail-mail_ mailbox that said "this document remains the property of XYZ Marketing, PLC. -- you must retain it, and return it to us upon demand" ? Absent an _agreement_ (in avance!) between the parties, _any_ such bombast in email (or snail-mail, for that matter) is -- at *best* -- a CYA attempt by the sender against a claim _against_the_sender_ of a lack of due care in handling potentially sensitive material. The presense of such statements in a message -- in the absense of advance agreement to terms -- has absolutely _no_ effect with regard to what the recipient 'may' do with the message, or it's contents. Any claims to the contrary are; (a) attempts to bamboozle the uninformed, (b) mandated by those who do -not- understand the law on the matter, or (c) included for 'self-protection' -- in the off-chance 'hope' that in the event of an actual screw-up on the sender's part, the presense of that claim will mitigate their liabilty. TTBOMK, this premise has -never- been tested in court, so the effacicy of the approch is an open question. OTOH, if 'everybody else' _is_ doing it, one can be accused of 'negligence' for not following the 'best practice' of rest of the sheeple. <wry grin>

1 0