- Test - lists.nanog.org

Today's tech highlights
by Fergie (Paul Ferguson) 12 Apr '05

12 Apr '05

For your perusal: US hospital loses patient info States gang up on Vonage Calif. PUC To Withdraw Appeal Of FCC's Vonage Order VoIP Security Chief Warns of "Life And Death" Security Threats Verizon Buys Out MCI's Largest Shareholder More Big Hosts Becoming ICANN Domain Registrars Windows XP SP2 blocking tool expires Tuesday Brazilian arrested for '01 Airforce hacks Rootkit Web sites fall to DDOS attack F-Secure: "Want to work for us?" Articles & links avialble at: http://spaces.msn.com/members/fergdawg/ - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net ferg's tech blog: http://spaces.msn.com/members/fergdawg/

1 0

Spam (un)blocking
by Adam Jacob Muller 11 Apr '05

11 Apr '05

Hi, I'm a network operator at a small hosting company that has about a /20 slice of IP addresses. Recently we have suffered a few break-ins (and some fraud) which caused a large quantity of spam to find it's way onto the internet. This has resulted in some of our network space being listed in several DNS blacklists, and being blacklisted by individual ISPs. So my question is this. Firstly, what is the best way to remove myself from each of these blacklists, if there is anything aside from going to each one individually and saying "i'm not spamming anymore". Second, is there some way to mark my block of addresses is owned by responsible responsive system administrators. We have tech support on duty 24/7 and abuse complaints are dealt with in a timely manner, so I am wondering if there is a way to communicate our willingness to help in the fight against spam. Thanks, Adam Jacob Muller

9 8

RE: djbdns: An alternative to BIND
by Malayter, Christopher 11 Apr '05

11 Apr '05

Good Evening, As an FYI the mailing list administrators have been contacting users individually letting them know they have been off-topic. We're not connecting this with any warnings etc.. We have been working through the day to get the off-topic posts down in volume on a case-by-case basis. This has been done to allow the operational aspect of the thread to continue, while attempting to remove the personal attacks. Please, if you have a complaint and you would like the list administrators to attend to it please direct it to nanog-admin(a)merit.edu. Regards, Chris Malayter Nanog List Administration Team TDS Telecom - Network Services Data Network Engineering chris.malayter(a)tdstelecom.com Phone: (608) 664-4878 FAX: (608) 664-4644 -----Original Message----- From: Jim Popovitch [mailto:jimpop@yahoo.com] Sent: Monday, April 11, 2005 5:32 PM To: Dean Anderson Cc: Kevin Oberman; william(at)elan.net; nanog(a)merit.org Subject: Re: djbdns: An alternative to BIND On Mon, 2005-04-11 at 17:30 -0400, Dean Anderson wrote: > As long as we are getting history out, It was moving towards death as > a _result_ of Vixie involvment from 1987-1994. I knocked heads with > Vixie around 1989/91 several times "knocked" implies past tense. I'd say that you are still exhibiting that behavior. Give it a break guys, even I'm tiring of this. Moderators??? -Jim P.

1 0

Re: djbdns: An alternative to BIND
by Dean Anderson 11 Apr '05

11 Apr '05

On Mon, 11 Apr 2005, Thor Lancelot Simon wrote: > On Mon, Apr 11, 2005 at 03:03:37AM -0400, Dean Anderson wrote: > > > > Several previous security vulnerabilities in BIND is one strike against. > > You know perfectly well that BIND9 isn't the same code as BIND4 or BIND8; > it's a complete rewrite. It has as much in common with BIND8 as djbdns > does. You might just as reasonably claim that security vulnerabilities > in BIND4 constituted "previous security vulnerabilities in djbdns". It has in common some of the same people who worked on BIND4 and BIND8. Possibly some of the problems of BIND4/8 were systemic. Djbdns, by contrast, has no previous security vulnerabities. This is hardly news, and most consider it to be a valid point. > > These might be fixed. There might still be others. > > And your usual mud-slinging against anyone even vaguely associated with > anyone who vehemently opposes spam begins! By the way, I heard that you > might have stopped beating your wife, but you might still be abusing > small barnyard animals. This is rather odd, if you agree that SORBS is a bunch of nutjobs, where's the mudslinging? > > Violation of trust on other projects is another. e.g. Exactis V. MAPS, > > Several MAPS employees working for well-known spammer Scott Richter > > described in Spam Kings by Brian McWilliams. > > Yawn. I've snipped a bunch more of your ranting. It hangs together > about as well as djb's "BIND Company" black-helicopters theory. Most people (even the vehement anti-spammers) agree that MAPS had no business blocking Exactis, and that Exactis didn't meet the MAPS criteria. MAPS told its subscribers it would only do certain things. Then it didn't do that. That's a trust violation. Seems pretty straightforward. Where's the irrational ranting in that? Whats even more stunning is that MAPS employees went to work for a well known spammer. What would we think if Colin Powell, Rumsfeld, and Rice left and went to work for Bin Laden? What would we think of the judgement of the man who hired them? Someone really made an error in judgement in hiring at MAPS. Do we trust that person again? Or do we show them door, so to speak? > Look, everyone grasps that you got shafted by SORBS. This is not > terribly surprising, because SORBS/ORBS are well known to be a bunch > of nutjobs, and unpleasant nutjobs at that. But as you expand the > radius of your attack to include anyone anywhere who ever had > anything to do with spam prevention, all you're doing, from my > point of view anyway, is demonstrating that you are quite an > unpleasant nutjob yourself. I'm just expanding the radius to include those that have something to do with SORBS/ORBS. ISC hosted SORBS after they were booted by XO. That's a trust violation as well. And I'll note that I left that off my post above, and included only non-SORBS trust violations. And there are a few of those. There are a lot of people who actually have genuine interest in spam and spam prevention. The efforts of those people are insulted by the activities and abuse of a few. Those few who (ab)use anti-spam as a cover for their personal gain and personal vendettas only discredit those who actually do work to stop abuse. --Dean -- Av8 Internet Prepared to pay a premium for better service? www.av8.net faster, more reliable, better service 617 344 9000

2 3

SORBS Identity theft alert
by Dean Anderson 11 Apr '05

11 Apr '05

See http://www.iadl.org/sorbs/sorbs-story.html SORBS seems to be collecting a lot of sensitive information to view listings: Name: Preferred Login ID: Password: Confirm Password: Home Phone: Business Phone: Mobile Phone: Email Address: Company: Autonomous Systems Number: Security Question: Security Answer: Skill Level: None, I can play games though. A little, just use them for email. Average, familiar with them, used at home and work. A lot, sysadmin or MCSE etc. My Name is Charles Babbage, or Alan Turing. Address: Address: Town/City: State/County: Zipcode/Postcode: Country: This detailed information could be sold to IT recruiters, used for identity theft, password collection, or used for other mass marketing purposes. Security questions are often used by sensitive sites such as domain registries to authenticate users who have lost their passwords. This is very alarming information collection. -- Av8 Internet Prepared to pay a premium for better service? www.av8.net faster, more reliable, better service 617 344 9000

9 11

Maybe OT: MPLS QOS SLA Monitoring
by christian.macnevin＠uk.bnpparibas.com 11 Apr '05

11 Apr '05

Afternoon from sunny London. Feel free to let me know if there's another resource for this kinda thing, and I'll leave you to have fun reading about mail relays. I'm currently looking at what the possibilities are for monitoring network activity and SLAs against Cisco QOS mechanisms within VRFs. The most desirable method seems to be using NetFlow collectors, though it seems as though the benchmark for this is NetFlow 9, and I'm not sure if it's terribly well deployed on NetFlow collectors out there. Anyone know if it *is* well implemented for a given product? Or even if there's just a better way? Cheers, and apologies if this meets somebody's definition of spam. Christian This message and any attachments (the "message") is intended solely for the addressees and is confidential. If you receive this message in error, please delete it and immediately notify the sender. Any use not in accord with its purpose, any dissemination or disclosure, either whole or partial, is prohibited except formal approval. The internet can not guarantee the integrity of this message. BNP PARIBAS (and its subsidiaries) shall (will) not therefore be liable for the message if modified. ********************************************************************************************** BNP Paribas Private Bank London Branch is authorised by CECEI & AMF and is regulated by the Financial Services Authority for the conduct of its investment business in the United Kingdom. BNP Paribas Securities Services London Branch is authorised by CECEI & AMF and is regulated by the Financial Services Authority for the conduct of its investment business in the United Kingdom. BNP Paribas Fund Services UK Limited is authorised and regulated by the Financial Services Authority.

2 1

clued/interested LEO list
by Gadi Evron 11 Apr '05

11 Apr '05

I'm creating a list of clued and/or interested LEO's, who would like to be part of CLOSED/PRIVATE/SECRET online communities such as anti-botnets, anti-spam, anti-phishing, etc. mailing lists, and/or get information in their area of responsibility. I feel such a resource has been needed for a long time, so I just decided to sit down and get it done. If anyone has someone to add, I'll be working on it in the next couple of weeks. Gadi.

6 8

Re: The power of default configurations
by Andrew Dul 11 Apr '05

11 Apr '05

-------Original Message------- > From: "Sean Donelan" <sean(a)donelan.com> > Subject: The power of default configurations > Sent: 06 Apr 2005 14:00:05 > > On Mon, 4 Apr 2005, Paul Vixie wrote: > > adding more. oh and as long as you're considering whether to restrict > > things to your LAN/campus/ISP, i'm ready to see rfc1918 filters deployed... > > Why does BIND forward lookups for RFC1918 addresses by default? Why isn't > the default not to forward RFC1918 addresses (and martian addresses). If > a sysadmin is using BIND in a local network which uses RFC1918 address, > those sysdmins can change their configuration? There was actually a very interesting discussion about this very topic regarding the proposed new ULA addresses at ipv6 working group at the last IETF meeting. This included a discussion about who should do the filtering the routers or the DNS servers etc...see the minutes below. http://www1.ietf.org/mail-archive/web/ipv6/current/msg04554.html The IESG basically rejected this draft because of the issues of DNS queries for 1918 space. They were looking for stronger language to deal with the issue we currently see with 1918 queries. http://www.ietf.org/internet-drafts/draft-ietf-ipv6-unique-local-addr-09.txt Andrew

5 5

Re: djbdns: An alternative to BIND
by Roger Marquis 10 Apr '05

10 Apr '05

David Conrad wrote: >> - Amount of code > >Again, what should be counted? Should you include rsync? Should you >include utility programs like check-namedconf, axfr-get, rbldns, >walldns, walldns-conf, etc.? You need only count the lines of code needed by the daemon/s servicing requests. That is, IMO, bind's only major failing. Too much code, too many little used features (nobody I know needs or wants rndc), and no way to compile without them. If you read Bruce Schneier, as every developer should, you know how important that "Amount of code" is. All I really want is to "configure --minimal && make && make install" and not have to fix ISC's ill thought-out defaults (like /usr/local/etc on Solaris...). Using bind 8 and 9 but still looking for something better, -- Roger Marquis Roble Systems Consulting http://www.roble.com/

5 4

(half OT) Tool for ASN statistic freaks: webalizer_asn
by Fredy Kuenzler 10 Apr '05

10 Apr '05

Webalizer_ASN v1.2b is available since a while, and according to my tests rather stable now. The ASN Data for Webalizer_ASN is based on Netlantis backend BGP engine (someone asked recently about Netlantis). If you experience a rainy lazy sunday, this might be a tool to play with a bit and build your personal Top-Ten ASN list. http://www.init7.net/webalizer_asn/ Debian Woody users could use the precompiled package. If you have existing orignal Webalizer statistics, you need to move webalizer.current file to webalizer.current.old before running the webalizer_asn - and please note: no warranty, you use the tool on your own risk - so have your statistics backuped first. Enjoy, F.

1 0