- Test - lists.nanog.org

Re: heads up ... another imapd attack source
by Roeland M.J. Meyer 15 Dec '98

15 Dec '98

At 04:54 AM 12/15/98 , Dave Crocker wrote: >At 05:17 PM 12/14/98 -0800, Roeland M.J. Meyer wrote: >>FYI: Not that I sell shell accounts anyway, but I additionally block all >>non-http access, from *.EDU, with tcp_wrappers and my POP3 is wrapped up in >>SSH. IMAPD was shot and buried(deleted) a long time ago. > >this means that any user who is traveling, and happens to try to get their >mail while accessing from a .edu site won't be able to pick it up. Only if they are accessing mail on MHSC systems, from an *.EDU dial-up. There are other dial-up options and MHSC has direct dial-up ports available. Also, we do allow VPN tunnels from *.EDU, but only to directed hosts with no routing and on advanced arrangement. The user that does so, does it under our TOS and AUP. >since imap popularity is growing, lack of imap service is also problematic. It's balance of problems. We consider the rootkit risk more severe than the loss of business from *.EDU sites. We have secure POP3 and Web-based (SSL) mail, we are investigating POP3 over SSL. Those services are allowed to *.EDU, from MHSC. As has been shown by others, IMAPD attacks are on the rise. It would not do for a security advocate to get rootkit'd, just think of the publicity <grin>. It's one of the things that keep me up at night. Many of the vulnerable systems are in *.EDU, as has already been shown to my satisfaction. Granted, MHSC has always viewed *.EDU is a huge potential security risk. That is an unapologized bias on our part. It is the nature of the beast. When the reference code, for IMAPD, becomes better written, or we (MHSC) re-write it ourselves, we will reinstantiate the IMAPD service. Until then, it remains dead. A current example is a spammer that I've been tracing for weeks. They always come from a different host, but it's obviously the same guys, they are very good. Many of the relays they use have been root'd. The latest one I've found is at sun.soci.niu.edu. So a SAINT run against it yourself and see how vulnerable they are. If they aren't root'd now, they soon will be, IMHO. I am quickly gaining the unsupported suspicion that spammers may be behind many of the IMAPD attacks. They are looking for hosts to send their spew from. Note that this *is* an unsupported view/suspicion, I claim no solid evidence. _________________________________________________ Morgan Hill Software Company, Inc. Roeland M.J. Meyer, ISOC (RM993) President and CEO. e-mail: <mailto:rmeyer@mhsc.com>mailto:rmeyer@mhsc.com Web-pages: <http://www.mhsc.com/~rmeyer>http://www.mhsc.com/~rmeyer Web-site: <http://www.mhsc.com>http://www.mhsc.com Colorado Springs, CO - Livermore, CA - Morgan Hill, CA -----------------------------------------(legal notice)-------- Note: Statements made in this message do not necessarily reflect the position of MHSC. All forcasts and projections are to be considered as forward-looking and presume conditions which may not be referenced herein. -----------------------------------------(/legal notice)-------

2 1

NANOG 15 Hotel
by Pam Ciesla 15 Dec '98

15 Dec '98

Possible hotel shortage in Denver for NANOG 15. The hotel people informed me that they have several meetings going on at the same time as NANOG 15. If you are planning on attending the NANOG 15 Meeting in Denver book your hotel early. The room block for NANOG is available until January 8, after that it's on space available only. Hotel and other info can be found on the NANOG webpage http://www.nanog.org. Any questions please contact me. Thanks Pam Pam Ciesla Merit Network,Inc. 734-936-0172 - phone 4251 Plymouth Road 734-647-3185 Bldg.I, Suite C pam(a)merit.edu Ann Arbor, MI 48107

1 0

Anyone on this list from Australia?
by Pete Kruckenberg 15 Dec '98

15 Dec '98

Or are you familiar with ISPs in Australia? If so, would you please contact me privately so I might ask you a few questions about ISPs there? Thanks. Pete.

1 0

The Path to Fame and Riches -- NANOG Summer'99 Host
by Craig Labovitz 15 Dec '98

15 Dec '98

We are still looking for a NANOG Summer (sometime during the beginning of June'99) host. The main responsibilities of the host include: * Provide connectivity to the conference site (at least a T1) * Help provide ~10 PC/Macs and a printer for the terminal room (terminal room equipment is also often donated) * Provide staff to help with local logistics (e.g. identifying hotels) and conference setup (mainly wiring the terminal room and hubs in the conference room) All hotel costs (catering, lighting, room rental, cookies, etc.) are covered by the NANOG registration fees. In addition, the conference room hubs and wireless equipment are usually donated equipment (and some are owned by NANOG). The benefits of NANOG hosting include: * Reduced travel expenses for your staff to attend NANOG * Your company name forever engraved on the official NANOG t-shirt * Life-time, official membership in NANOG * Fame and riches Please send email to nanog-support(a)nanog.org if you are interested in hosting a future NANOG. - Craig -- Craig Labovitz labovit(a)merit.edu Merit Network, Inc. http://www.merit.edu/~labovit 4251 Plymouth Road, Suite C. (734) 764-0252 (office) Ann Arbor, MI 48105-2785 (734) 647-3185 (fax)

1 0

Spaghetti routes.
by Roeland M.J. Meyer 14 Dec '98

14 Dec '98

I seem to be getting one hell of a lot of hops between here and Toronto. It looks like they have a serious case of spaghetti routing in cerf.net. Does anyone know what's up? > ~ > traceroute www.mhsc.com >traceroute to falcon.lvrmr.mhsc.com (199.108.175.225), 30 hops max, 40 byte packets > 1 209.82.43.1 (209.82.43.1) 2.344 ms 2.176 ms 2.160 ms > 2 172.17.18.177 (172.17.18.177) 4.429 ms 4.436 ms 4.284 ms > 3 207.245.35.65 (207.245.35.65) 4.334 ms 4.411 ms 4.647 ms > 4 205.150.154.141 (205.150.154.141) 4.563 ms 13.403 ms 13.971 ms > 5 f000-10.bb2.tor2.f000-10.bb1.tor2.uunet.ca (205.150.242.109) 37.502 ms 190.594 ms 17.974 ms > 6 224.Atm4-0-0.GW3.NYC4.Alter.Net (137.39.75.21) 17.302 ms 18.527 ms 17.855 ms > 7 140.ATM2-0.XR1.NYC4.ALTER.NET (146.188.179.146) 17.266 ms 17.609 ms 22.412 ms > 8 189.ATM3-0.XR1.NYC1.ALTER.NET (146.188.178.86) 18.167 ms 19.935 ms 27.089 ms > 9 195.ATM11-0-0.BR1.NYC1.ALTER.NET (146.188.177.153) 20.739 ms 29.381 ms 34.891 ms >10 atm12-0.nyc-bb2.cerf.net (134.24.32.49) 24.081 ms 21.021 ms 19.815 ms >11 pos2-0-155M.nyc-bb4.cerf.net (134.24.29.162) 19.283 ms 22.170 ms 21.047 ms >12 pos12-0-0-155M.nyc-bb3.cerf.net (134.24.29.165) 20.439 ms 20.227 ms 20.116 ms >13 atm3-0-155M.phl-bb1.cerf.net (134.24.46.9) 549.826 ms 559.131 ms 507.581 ms >14 pos4-0-0-155M.nyc-bb1.cerf.net (134.24.46.169) 455.182 ms 454.303 ms 471.459 ms >15 atm9-0-3-155M.san-bb1.cerf.net (134.24.29.45) 1267.546 ms 1257.430 ms 1138.974 ms >16 pos0-0-155.san-bb6.cerf.net (134.24.29.130) 418.926 ms 410.702 ms 434.318 ms >17 atm6-0-622M.lax-bb4.cerf.net (134.24.29.142) 425.456 ms 362.121 ms 364.302 ms >18 pos3-0-0-155M.lax-bb1.cerf.net (134.24.29.133) 1190.588 ms 1130.962 ms 1180.913 ms >19 atm3-0-155M.sfo-bb1.cerf.net (134.24.29.42) 340.919 ms 297.623 ms 285.305 ms >20 fe9-0-0.sfo-bb2.cerf.net (134.24.29.118) 282.859 ms 287.957 ms 300.554 ms >21 atm3-0-155M.sjc-bb3.cerf.net (134.24.29.22) 337.961 ms 396.046 ms 412.056 ms >22 199.108.168.1 (199.108.168.1) 1133.342 ms 1299.682 ms 1149.291 ms >23 199.108.168.51 (199.108.168.51) 380.942 ms 307.255 ms 301.474 ms >24 falcon.lvrmr.mhsc.com (199.108.175.225) 309.010 ms 298.941 ms 309.333 ms > ___________________________________________________ Roeland M.J. Meyer - e-mail: mailto:rmeyer@mhsc.com Internet phone: hawk.lvrmr.mhsc.com Personal web pages: http://staff.mhsc.com/~rmeyer Company web-site: http://www.mhsc.com ___________________________________________________ Who is John Galt? - "Atlas Shrugged" - Ayn Rand

1 0

RE: Space in 55 South Market St
by Chris Mauritz 14 Dec '98

14 Dec '98

Why was ANY of this on the list in the first place? Geez. C Chris Mauritz Director, Systems Administration Rare Medium, Inc. chrism(a)raremedium.com -----Original Message----- From: Mike Leber [mailto:mleber@he.net] Sent: Monday, December 14, 1998 4:12 PM To: Alex Bligh Cc: nanog(a)merit.edu Subject: Re: Space in 55 South Market St On Mon, 14 Dec 1998, Alex Bligh wrote: > > We can provide you with 1 rack or even a cage of 6 if you like. We have > > generator power, battery backup, aircon, fiber to worldcom and pacbell, > > and it's staffed 24 x 7. > > In 55 South Market St itself? Yes. > If so, what floor and how much? 2nd floor and 14th floor. > Any cross connect (i.e. per circuit) charges? No charge for copper. Small charge for fiber in our conduit. > Can your guys do remote > feeding and watering of Cisco's (both 24x7 and we occasionally send > out new cards etc. that need fitting, circuits that need commissioning > etc. and expect to be charged by the hour)? Yes. Contact me off the list by phone or email. Mike. +------------------- H U R R I C A N E - E L E C T R I C -------------------+ | Mike Leber Direct Internet Connections Voice 408 282 1540 | | Hurricane Electric Web Hosting & Co-location Fax 408 971 3340 | | mleber(a)he.net http://www.he.net | +--------------------------------------------------------------------------- +

1 0

Space in 55 South Market St
by Alex Bligh 14 Dec '98

14 Dec '98

Does anyone have space in 55 South Market St SJ sufficient to house 1 rack? (or failing that 1x7507). UPS, Aircon & preferably Generator. Worldcom & PacBell fiber appreciated. GTEI need not apply. Has to be in the building, not down the road. -- Alex Bligh GX Networks (formerly Xara Networks)

2 4

[Fwd: fwd: Black Hole Vixie/RBL]
by Sean Rolinson 14 Dec '98

14 Dec '98

Hello, I apologize for responding to a thread that is over a week old. I had some technical difficulties in sending this email. Anyway, here it is: Do we know how many ISPs are actually using the RBL and what percentage of the total users of the net this covers?? I read an article in Info World talking about commercialization of Sendmail which estimated that 75% of the mailers on the net were using Sendmail. (Info World, December 7, 1998. Page 76) For the record, I think the RBL is a good idea. If you want to use it great, if you don't want to use it great. Today, you still have a choice. If you didn't have the choice I'd be singing a different tune. :) I've had to deal with Paul and the MAPS group in the past from being RBL'ed (actually one of our servers is currently RBL'ed). IMHO, they are quite reasonable when putting people on or taking them off the list. Just my $0.02... Sean Rolinson snowdog(a)bigfoot.com Director of Operations Bigfoot International Inc.

1 0

[whoisdatabase@hotmail.com: Re: Network Solutions Lists] (fwd)
by larrys＠lexis-nexis.com 14 Dec '98

14 Dec '98

The problem is that it is and has to be (reasonably) public information. For any restriction that could be put in place, someone will certainly write a programatic workaround. This specific mailing is in violation of qual.net's AUP III.B.3....so gripe to them. And support Smith. ..."an Opt-In list of".......Get Real! -ls- (LS11) >>>>> Forwarded message from James Rishaw <jamie(a)dilbert.ais.net> Ugh! There's *got* to be a way to keep people from walking the database... -- jamie rishaw (efnet:gavroche) American Information Systems, Inc. jamie at ais dot net infrastructure engineering "I will NOT go to a party with a version number." -davidr << End forwarded message

6 5

Re: Another Domain list seller
by Paul Vixie 14 Dec '98

14 Dec '98

two things. first: > http://www.targetedlists.com/ i just blackholed the /24 this web server lives on. it's part of a much larger block but there's no evidence that the entire block is infested. second, and this is just piggybacking since i've used up launch slot, i wanted to let everyone know how things came out with the blackholing of network solutions. it turns out that it's not going to be necessary -- i met with david holtzman in DC on the saturday before usenix and ietf, and NSI plans to beef up the ability of domain contacts to opt out of their marketing materials. it's hoped, though not promised, that this added beef will appear before they send any more marketing material. for background, it's not spam if there's a preexisting relationship, as is certainly true for netsol and the internet's domain contacts. my reason for thinking i might have to blackhole them is (a) there's no way to choose a non-netsol registrar (yet!) and (b) there's been no way to reliably get oneself removed from the marketing list. if either one of these and preferrably both are fixed, then i'll have no reason to black- hole NSI at this time. "that's the news -- so, now you know." -- Paul Vixie <paul(a)vix.com>

1 0