- Test - lists.nanog.org

Re: BIND 9 (Re: ISC Patches)
by Len Sassaman 17 Sep '03

17 Sep '03

On Wed, 17 Sep 2003, Paul Vixie wrote: > it's under consideration now. bind8 is not a priority for the bind forum, > and isc would rather put it in feature-freeze, but we're looking into it. > bind9's internals make "delegation-only" easy to implement. bind8's > internals are pretty twisty. This would certainly be appreciated. I have my BIND 8 name servers patched with a modified version of this: http://sam.zoy.org/writings/internet/verisign/patch-bind-8.4.1.0-dickhead.d… ... but it certainly isn't as clean as I'd like. --Len.

1 0

RE: new openssh issue
by Buhrmaster, Gary 17 Sep '03

17 Sep '03

According to Cisco at: http://www.cisco.com/warp/public/707/cisco-sa-20030917-openssh.shtml. this impacts CatOS, their storage router line, their HSE line, and their WLSE lines, and is not an IOS issue. Details on the web page. No fixed versions of software are available yet. Gary > -----Original Message----- > From: Avleen Vig [mailto:lists-nanog@silverwraith.com] > Sent: Wednesday, September 17, 2003 10:27 AM > To: Valdis.Kletnieks(a)vt.edu > Cc: Richard A Steenbergen; William Allen Simpson; nanog(a)nanog.org > Subject: Re: new openssh issue > > > > On Tue, Sep 16, 2003 at 03:50:04PM -0400, > Valdis.Kletnieks(a)vt.edu wrote: > > A posting to full-disclosure quotes Theo as saying HP and > Cisco are affected, > > and I don't see any reason that Juniper would *NOT* be, > given the common code > > base of the OpenSSH implementations. I'm not going to say > the routers are > > vulnerable, but I *would* say that ACLs blocking port 22 to > the router might > > be a good idea..... > > Isn't this a common practice anyway? Has been anywhere sensible I've > seen :-) >

1 0

Sabotage not backhoes: More cable cuts
by Sean Donelan 17 Sep '03

17 Sep '03

Someone climbed a 15-foot tower in Southern Arizona cutting a fiber optic cable used by Broadwing and Tucson Electric Power. This was within five feet of the 138,000-volt power line. The site was also guarded by barbed wire. This is not your typical backhoe. Rural areas have long dealt with the occasional shotgun damaged cable or microwave horn; or the farmer burying the dead cow in the back pasture. But I don't recall two reported acts of sabotage in less than 30 days before. http://www.fox11az.com/news/local/stories/KMSB_local_fiberoptic_091203.9d8b…

2 1

RE: Not the best solution, but it takes VeriSign out of the loop
by Mike Damm 17 Sep '03

17 Sep '03

I never said anything in my original posting regarding assistance from the root operators; god knows you guys have a hard enough job already. And frankly blocking non-cooperative servers would hurt the net just as much as what VeriSign's doing. My suggestion was to simply create a viable alternative source of com/net zones that operators could use if they choose to do so. If you don't like what VeriSign is doing with them, don't use VS zones anymore. Hopefully, eventually, IANA will be telling you to switch the roots. Not me. Not likely, but ORG managed to pull off a transition to other ownership. For anyone who's interested, you can "opt-in" to the new zones I'm building here: http://www.symetrix.net/gtld/ -Mike --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: Paul Vixie [mailto:vixie@vix.com] Sent: Tuesday, September 16, 2003 9:27 PM To: nanog(a)merit.edu Subject: Re: Not the best solution, but it takes VeriSign out of the loop > > Who's up for creating a network of new gTLD servers? > This would require cooperation from the root-servers operators. speaking for f-root, we won't be cooperating with anything like that. we do not edit the zone files we serve. they come from iana, and if you want something different served, you'll have to talk to iana. i cannot speak for the other rootops but i suspect that their answers might be compatible with, if not downright similar to, f-root's. > And a serious effort from ISP/NSP community to block network access to > root-servers that don't cooperate. > > I agree that it's a good idea at this point. I see nothing else as a > serious long-term technical solution. sounds like mob rule to me -- count me out. so, block me first, i guess? -- Paul Vixie

1 0

What *are* they smoking?
by Niels Bakker 17 Sep '03

17 Sep '03

A wildcard A record in the net TLD. $ host does.really-not-exist.net does.really-not-exist.net has address 64.94.110.11 $ host 64.94.110.11 11.110.94.64.IN-ADDR.ARPA domain name pointer sitefinder-idn.verisign.com It even responds on port 25 (says 550 on every RCPT TO). Gah. -- Niels.

61 89

Re: [Re: Change to .com/.net behavior]
by Joshua Sahala 17 Sep '03

17 Sep '03

i'm not sure if it could be cached, but i still see verisign pretending to 0wn the net... as is usually suggested on this list, do your talking with your money, pull your zones from verisign, and never do business with them again, file complaints with all relevant state and federal authorities, and let the l33t Kiddi35 and spammers have some fun ;) of course, the dept of greed^Wcommerce will likely give verisign an 'attaboy' for coming up with this stunt while i am sure all of us (excepting the netsol/verisign lurkers) would like to null route everything attached to them, it will do nothing but make us look like the 'bad guys'. this is not the time for knee-jerk reactions...but damn it would be nice to descend upon verisign's corporate hq with clue-by-fours in hand ;) /joshua ; <<>> DiG 9.2.1 <<>> jklkwekcie.com ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25772 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 0 ;; QUESTION SECTION: ;jklkwekcie.com. IN A ;; ANSWER SECTION: jklkwekcie.com. 900 IN A 64.94.110.11 ; <<>> DiG 9.2.1 <<>> jklkwekcie.net ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11930 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 0 ;; QUESTION SECTION: ;jklkwekcie.net. IN A ;; ANSWER SECTION: jklkwekcie.com. 900 IN A 64.94.110.11 [cut] "Walk with me through the Universe, And along the way see how all of us are Connected. Feast the eyes of your Soul, On the Love that abounds. In all places at once, seemingly endless, Like your own existence." - Stephen Hawking -

3 2

<OT> Mad DNS Disease
by Martin Hepworth 17 Sep '03

17 Sep '03

Guys Kinda off topic, but for those that don't userfriendly.org regularly.... http://ars.userfriendly.org/cartoons/?id=20030917 -- Martin Hepworth Senior Systems Administrator Solid State Logic Ltd +44 (0)1865 842300 ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses. www.mimesweeper.com **********************************************************************

1 0

OT - fiber optic power meter for 1383 nm
by Bill Owens 17 Sep '03

17 Sep '03

I'm fishing for some experience here - does anyone know of a vendor who sells a fiber optic power meter that works at or near 1383 nm (the so-called water peak)? We have a new install of SMF-28e fiber, and need to qualify it at that point in addition to the standard testing at 1310 and 1550 nm. So far I haven't located anyone with such a device. . . Thanks, Bill. - - - Bill Owens Manager, Network Development NYSERNet, Inc.

1 0

Re: Root Server Operators (Re: What *are* they smoking?)
by Paul Vixie 17 Sep '03

17 Sep '03

> Something like this can be seen on www.airow.com: > $ dig www.airow.com @a.gtld-servers.net > ... looks good to me, man. ; <<>> DiG 8.3 <<>> @f.6to4-servers.net www.airow.com a ; (2 servers found) ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1 ;; QUERY SECTION: ;; www.airow.com, type = A, class = IN ;; ANSWER SECTION: www.airow.com. 2D IN A 66.82.206.10 ;; AUTHORITY SECTION: airow.com. 2D IN NS ns1.rfwwp.com. airow.com. 2D IN NS www.airow.com. ;; ADDITIONAL SECTION: ns1.rfwwp.com. 2D IN A 208.191.129.185 ;; Total query time: 37 msec ;; FROM: stick.isc.org to SERVER: f.6to4-servers.net 2001:4f8:0:2::14 ;; WHEN: Wed Sep 17 14:31:48 2003 ;; MSG SIZE sent: 31 rcvd: 101 > After delegation-only, they will start to return > 208.191.129.189. Which is probably an improvement, but a change no > less. see above. > So I'm unsure about ISC's approach. me too.

1 0

Re: Root Server Operators (Re: What *are* they smoking?)
by Paul Vixie 17 Sep '03

17 Sep '03

> > : zone "com" { type delegation-only; }; > > : zone "net" { type delegation-only; }; > > My first reaction to this was: 'yuck'. mine also. > I'm not sure of the side-effects this will introduce. Anyone? if verisign served a subdomain of com or net on the same server they use for com or net, and if they issue "minimal responses" (no ns rrs) then this patch would be a barrier.

1 0