- Test - lists.nanog.org

recap of nanog-futures on "on topic" and proposed compromise
by Gadi Evron 24 Sep '06

24 Sep '06

Basically, there is a crowd that says only network related stuff, say, trasnit ISP's (as an example, not to say them alone) would be interested in, is on topic. Others say there are other issues which are oprations related and of interest to them. We are split. A compromise has now been suggested (by me). The only thing both sides agree on is that in fact, the replies and flame wars on what is on topic or isn't, and who should speak of what, are disruptive. Thus, the compromise idea is that for now and for a predetermined period of time, we start with one small change. Debugging is done one step at a time rather than in earthshattering moves. How about we, for now, only change one thing about NANOG - the specific off topic posts that tell others to be quiet, or that they are off-topic will be disallowed. This is really a concensus and a good way to start making progress rather than escalating a conflict between people who just want to get things done and see the NANOG community as a home. I believe it's a good temporary solution which will take us ahead, to measure how things go, as well as be able to find out what we all agree on afterwards. As well as increase the value of the list almost immediately. This re-cap is from my perspective, naturally. We can keep arguing over who said what or what's on or off topic forever. Consolidating on what we all agree would be a change for the better and starting there sounds like a good idea to me. Solving this in a civil fashion just became so much more attractive. Thanks, Gadi.

2 1

Telehouse North outage?
by Cat Okita 24 Sep '06

24 Sep '06

Does anybody have details about a power outage at Telehouse North today? The first routing issues that reflected the issue appeared around 13:00BST, but I don't have any details about the cause. cheers! ========================================================================== "A cat spends her life conflicted between a deep, passionate and profound desire for fish and an equally deep, passionate and profound desire to avoid getting wet. This is the defining metaphor of my life right now."

1 0

shared hosting and attacks [FWD: [funsec] HostGator: cPanel Security Hole Exploited in Mass Hack]
by Gadi Evron 24 Sep '06

24 Sep '06

Hi, the following post is a forward of an email by Fergie to funsec. This story by itself is not relevant to NANOG, but it does illustrate a problem nearly all of us have been facing. Mass exploitation of servers in our nets, colos and hosting farms. Nearly ever (relevant, not say, just a transit one) ISP I spoke to globally has this problem. With thousands of sites on every server and virtual machines everywhere, all it takes is one insecure web application such as xxxBB or PHPxx for the server to be remote accessed, and for a remote connect-back shell to be installed. The rest is history. This is often soon followed with masses of defacements, spam, bots, ddos, etc. We all (well, never say all, every, never, ever, etc.), many of us face this. What solutions have you found? Some solutions I heard used, or utilized: 1. Remote scanning of web servers. 2. Much stronger security enforcement on servers. 3. "Quietly patching" user web applications without permission. 4. JGH - Just getting hacked. What have you encountered? What have you done, sorry, heard of someone else do, to combat this very difficult problem on your networks? The whole business of this hosting is the low cost, and everyone wastes countless man hours on killing fires. This is not about BGP, but it is an operational problem that bugs us, operators. Thanks, Gadi. ---------- Forwarded message ---------- Date: Sat, 23 Sep 2006 21:47:37 GMT From: Fergie <fergdawg(a)netzero.net> To: funsec(a)linuxbox.org Subject: [funsec] HostGator: cPanel Security Hole Exploited in Mass Hack Via Netcraft. [snip] HostGator says hackers compromised its servers using a previously unknown security hole in cPanel, the control panel software that is widely used by hosting providers. "I can tell you with all accuracy that this is definitely due to a cPanel exploit that provides root access and all cPanel servers are affected," said HostGator system administrator Tim Greer. "This issue affects all versions of cPanel, from what I can tell, from years ago to the current releases, including Stable, Release, Current and Edge." cPanel has just released a fix. "Running /scripts/upcp will fix the vulnerability in all builds," cPanel said in a message on its user forums. "Please note that this is a local exploit which requires access to a cPanel account. ... If you believe you have been exploited through this vulnerability, you are welcome to submit a support request for assistance." Hackers gained access to HostGator's servers late Thursday and began redirecting customer sites to outside web pages that exploit an unpatched VML security hole in Internet Explorer to infect web surfers with trojans. The existence of the new "0-day" exploit of cPanel leaves a large number of hosting companies vulnerable to similar attacks until they install the patch. The riusk is mitigated somewhat by the fact that it is a local exploit, meaning any attack on a host must be launched from an existing account with cPanel access. HostGator site owners said iframe code inserted into their web pages was redirecting users to the malware-laden pages. Company staff made several efforts to reconfigure servers on Friday, only to have the exploits recur. By early Saturday morning, HostGator managers were assuring users that the cause of the redirections had been isolated, and was due to a new exploit targeting cPanel. [snip] Link: http://news.netcraft.com/archives/2006/09/23/hostgator_cpanel_security_hole… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/ _______________________________________________ Fun and Misc security discussion for OT posts. https://linuxbox.org/cgi-bin/mailman/listinfo/funsec Note: funsec is a public and open mailing list.

2 1

Re: Topicality and audiences [was Re: tech support being flooded due to IE 0day]
by Laurence F. Sheldon, Jr. 24 Sep '06

24 Sep '06

It doesn't matter who wrote: > If you don't find network operations to be relevant, then by all > means STOP POSTING TO THE GOD DAMNED NETWORK OPERATIONS MAILING LIST. > Some of those, particularly those who *gasp* run networks, still find > it relevent. If there is this much disagreement about your posts, > maybe you should find a different place to make them. In spite of repeated rants like this one (I'm too tired and lazy to disguise the author of it further, the particular author here is not important), the problem is not "What kind of list is NANOG?" It really isn't. I don't think a strong case that many active posters here are confused about that it really hard to make. There really ought to be a moratorium on the question of what kind of a list is NANOG. The question has always been, in my my mind, "What the hell does "Operations" mean to the participants here. (I have on several occasions said what I think it means to others, I'll spare me the agony of doing that again just now.) I have for years incorrectly assumed (nay, insisted) that "Operations topics" include just about everything that has to do with operating a network or networks, or network of networks. I don't think it includes the mindless, repetitive, numbing harassment of somebody that has an issue affecting his or her operation that either needs help, or wants to share a lesson learned. Frankly, a scholarly analysis of the archives (edited or not) would show, I'll bet, that there are more items about what is on topic than there are about any other subject-group. -- Requiescas in pace o email Ex turpi causa non oritur actio http://members.cox.net/larrysheldon/

5 4

Re: fyi-- [dns-operations] early key rollover for dlv.isc.org
by Fergie 23 Sep '06

23 Sep '06

But of course. So ask yourself; What is special about "3" and "65537"? - ferg -- Joseph S D Yao <jsdy(a)center.osis.gov> wrote: On Fri, Sep 22, 2006 at 11:39:51PM +0000, Fergie wrote: > Hmmm. It wouldn't have anything to do with prime numbers, now would > it? :-) Well, yes, but there are an infinite number of them. Of course, 17 is the most prime of them all. [snip] -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

1 0

Potentially on-Topic: is MSNBot for real?
by Mark Foster 23 Sep '06

23 Sep '06

On a website I host with nearly 9000 unique visits month-to-date (thats visits, not hits) a full 20% of the recorded 'hits' (Hitcount is ~40,000) are being generated by 'msnbot'. We see this as a large amount of http traffic from IP addresses owned by Microsoft. I've actually seen this across a number of websites (including my own) but the guest on my server has raised the issue of loading being completely misproportionate to the perceived value of the visit - and asked about potentially blocking them off entirely. Is this unusual, or what? Are search engines supposed to be amongst the biggest user agents recorded on a typical website? How much trolling and indexing is considered 'too much' ? At what point to the search engines themselves become a menace - the load the cause outweighs the value of said load? (I'd like my cpu cycles to be for real people, please...) Off-list thoughts on this welcome if the operational relevance of this issue is questioned... Cheers Mark.

2 2

fyi-- [dns-operations] early key rollover for dlv.isc.org
by Paul Vixie 23 Sep '06

23 Sep '06

fyi:

6 7

Re: fyi-- [dns-operations] early key rollover for dlv.isc.org
by Fergie 22 Sep '06

22 Sep '06

Hmmm. It wouldn't have anything to do with prime numbers, now would it? :-) - ferg -- Joseph S D Yao <jsdy(a)center.osis.gov> wrote: [snip] Steve has pointed out that 3 is recommended for DNSSEC, and NIST likes 65537 [2^16 + 1]. I don't have the maths to say why, so I'll leave it at that. -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(at)netzero.net ferg's tech blog: http://fergdawg.blogspot.com/

2 1

Re: Removal of my name
by Don Welch, Merit Network 22 Sep '06

22 Sep '06

17 27

tech support being flooded due to IE 0day
by Gadi Evron 22 Sep '06

22 Sep '06

Hi guys, several ISP's are experiencing a flood of calls from customers who get failed installations of the recent IE 0day - VML - (vgx.dll). If you are getting such floods too, this is why. This is currently discussed on the botnets@ list, as raised by Cox, and I figured I will float it out here. No patch is currently available from Microsoft, workaround are available. Gadi.

23 34