October 2003 - NZNOG - lists.nznog.org

list.waikato.ac.nz Has Moved
by Donald Neal 12 Dec '24

12 Dec '24

NZNOG-People, I have just finished migrating all of the mailing lists held at The University of Waikato from one server to another. I don't have any reason to believe that anything's gone wrong, but please bear with me for today if it turns out that something has. - Donald Neal -- Donald Neal | Q: How many Aucklanders does it take to change Systems Programmer/Analyst | a light bulb? The University of Waikato | A: Pass me that candle and I'll tell you. Hamilton, New Zealand | --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

RE: Sort of OT: are there any "Internet enabled" temperature sens ors/servers for Auckland?
by Greg Clare 18 Aug '21

18 Aug '21

May not be exactly what you are after? However DSE have an Internet weather station at the Albany HQ. http://www.dse.gen.nz/public/webdata/weather.htm Regards Greg > -----Original Message----- > From: Juha Saarinen [mailto:juha(a)saarinen.org] > Sent: Wednesday, 2 January 2002 2:47 pm > To: NZNOG > Subject: Sort of OT: are there any "Internet enabled" temperature > sensors/servers for Auckland? > > > Measuring the outside temperature, with geographic location given. > > -- > Juha > Take off every sig! > > - > To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz > where the body of your message reads: > unsubscribe nznog > - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

problems with NTP on bigben?
by Simon Blake 04 Mar '05

04 Mar '05

Anybody else observed that bigben gained about 19 years at about 1:25pm this arvo? $ date Tue Jan 1 14:54:33 NZDT 2002 $ /usr/sbin/ntpdate -q truechimer.waikato.ac.nz server 130.217.76.32, stratum 2, offset -0.001089, delay 0.04276 1 Jan 14:49:38 ntpdate[17537]: adjust time server 130.217.76.32 offset -0.001089 sec $ /usr/sbin/ntpdate -q bigben.clix.net.nz server 203.167.224.60, stratum 1, offset 619315199.998172, delay 0.03613 1 Jan 14:49:55 ntpdate[17540]: step time server 203.167.224.60 offset 619315199.998172 sec - To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

13 20

Sale of Domainz
by DPF 28 Nov '03

28 Nov '03

Notice of the sale of Domainz is being sent by post to ISPs, but a quick e-mail here may also prove effective in reaching any interested purchasers. The advert relating to the sale of Domainz is at http://www.internetnz.net.nz/sale-of-domainz-nbr-ad.pdf, as per the announcement below. All inquiries are best directed to Tim Russell of Deloitte Corporate Finance at the details below. DPF On Fri, 30 May 2003 13:35:44 +1200, Peter Macaulay <exedir(a)internetnz.net.nz> wrote: >Further to our earlier announcements, the public aspect of the sale of >Domainz is under way. An advertisement is in today's (Friday 29 May) >National Business Review. A copy will be posted on the web site at 1830 >tonight. >Feel free to pass on this information to any parties that may have a >genuine interest. The contact is >Tim Russell >+64 9 303 0857 >timrussell(a)deloitte.co.nz > >-- >Peter Macaulay >Executive Director >InternetNZ >Direct +64 4 495 2113 -- E-mail: david(a)farrar.com ICQ: 29964527 MSN: dpf666(a)hotmail.com

22 42

Strange BGP 'problem'
by Nathan Ward 02 Nov '03

02 Nov '03

At the risk of posting something on topic.. I have 2 routers (lets call them A and B), talking to different upstream providers, advertising 202.6.75.0/24 via BGP. 202.6.75.0/24 is subnetted, each subnet is on a different VLAN. These routers talk to each other with iBGP, giving each other everything (including 202.6.75.0/24 le 32). I run HSRP between the 2 routers. Router B prepends my ASN several times before advertising 202.6.75.0. Relevant stuff (on both boxes): router bgp 23729 network 202.6.75.0 no synchronization ! ip route 202.6.75.0 255.255.255.0 Null0 With this config, reachability for 202.6.75.0/24 hosts alternates on and off roughly every minute. 47% total loss over 10 minutes (ie 5 'bursts' of loss). These packets are all hitting my AS at router A. I've turned HSRP off and on again to see if that was causing problems (it wasn't). Several solutions I've found: - Turning the iBGP session to router B off. (uhh..) - Turning syncronization on. My understanding of BGP synchronization, is that BGP will only re-advertise with eBGP prefixes learned via iBGP after learning them via another IGP if one is running. <snip> ec-br-1(config-router)#do sh run | inc router router bgp 23729 bgp router-id 202.6.75.1 </snip> I'm not running any IGPs, so synchronization shouldn't be part of the equation. In any case, I'm not a transit provider. And, there seems to be no relation to readvertising routes here, the packets AFAICT are getting to router A and being dropped. I've got no problem running running with synchronization on at the moment, but thats not the point. :-) Any ideas/thoughts? -- Nathan Ward

3 3

RE: [nznog] Domain Names NZ scam
by Tim John - Domainz 02 Nov '03

02 Nov '03

Yep ! Had calls dribbling in here all morning ... The DNC is aware and I'm sure things will be taken up by her. Tim -----Original Message----- From: jfp [mailto:jfp(a)clearfield.com] Sent: Wednesday, 29 October 2003 10:42 a.m. To: nznog(a)list.waikato.ac.nz Subject: [nznog] Domain Names NZ scam Some of our customers have just received scam domain renewal letters from Domain Names NZ. ($237 for two years) (www.domainnamesnz.com) People might want to warn their customers. jfp. ------------------------------------------------------------------------ Jean-Francois Pirus <jfp(a)clearfield.com> Clearfield Software Ltd Phone (+64-9) 358 2081 4th Floor 8-10 Whitaker Place Fax (+64-9) 358 2083 P O Box 2348 Auckland, New Zealand ------------------------------------------------------------------------ _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog DISCLAIMER: The content of this email is confidential and may contain legally privileged information intended only for the individual or entity named above. Access to this message by anyone else is unauthorised. If you are not the intended recipient, please be advised that the use, distribution and publication of the above information is prohibited. If you have received this email in error, please contact Domainz by returning the email and destroying the original. Thank you.

9 10

RE: [nznog] Domain Names NZ scam
by Geoff Williams 01 Nov '03

01 Nov '03

We have been through this here on the other side of the creek. Some years ago when this guy first started this scam I actually spoke to him trying to recover money that a client had inadvertently paid. Even though the money had not been passed to the sole registrar of .au domains at that time (we had already paid for the domain's renewal) the most that we were able to threaten was a civil action for not refunding monies that had not been applied for the purpose that they were collected. He just didn't give a @#$% about it and continued on his merry way. Unfortunately the problem is that the person paying the money doesn't know enough about what the invoice means and also they don't read the thing in detail. The most success was had here when the registrar used the domain contacts list and emailed a warning to all domain owners. Perhaps your registrar should consider something similar. The warning is probably still on the site at www.inww.com if you need text. The other thing is to get it into the tabloid press, perhaps someone should approach some of your shock jocks to run the story. Maybe Holmes could turn it into a global news story :)) -----Original Message----- From: Tikiri Wicks [mailto:tcwicks(a)maxnet.co.nz] Sent: Saturday, 1 November 2003 3:21 PM To: nznog(a)list.waikato.ac.nz Subject: Re: [nznog] Domain Names NZ scam Re: Domain Names NZ scam Just wondering is anyone on this list a lawyer I just got my second mail from these bastards. It's made out just like an invoice telling me to register my domain.net.nz Unauthorized use of the domain name registry for commercial solicitation perhaps ? New Zealand Privacy law perhaps ? Is there anything like class action lawsuits in New Zealand and Australia? ----- Original Message ----- From: "Juha Saarinen" <juha(a)saarinen.org> To: "Steven Heath" <sheath(a)paradise.net.nz> Cc: <nznog(a)list.waikato.ac.nz>; "'Matthew G Brown'" <Matt(a)Brh.Co.Nz> Sent: Thursday, October 30, 2003 3:09 PM Subject: Re: [nznog] Domain Names NZ scam > Steven Heath wrote: > > > In my opinion it is just more of the many scum aussie operators that just > > extend thier scams to include NZ. > > Was just informed that the AuDA and ACCC court proceedings against > Domain Names Pty Ltd will be heard on the 19th of next month. > > -- > Juha > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Spamcop.net DNS
by Peter Macaulay 01 Nov '03

01 Nov '03

Looks like someone has killed spamcop. Can anyone explain how this happened? I can't see their registrar (joker.com) doing it unless they have been conned. -- Peter Macaulay Executive Director InternetNZ Direct +64 4 495 2113

6 5

elevated icmp traffic
by Anton Smith 29 Oct '03

29 Oct '03

Hi guys, Was just wondering if anyone else has been experiencing a lot of icmp traffic (pings) lately, seems to a lot of pinging of entire ranges going on. Another new worm or the left overs from the last lot? Regards, Anton Smith nzwireless Ltd

2 1

RE: [nznog] New and unacknowledged Exchange / Win2k SMTPvulnerability?
by Geoff Williams 29 Oct '03

29 Oct '03

Right, but due to no SMTP AUTH logging in Exchange 2000, we cannot easily track any attempt to intrude using the brute force password crack method. We only get to see badmail folders filling up and so on. Additionaly we cannot see exactly which account's password has been compromised. A more comprehensive anti-relay option which checked for the existence of the recipient and/or sender in Active Directory, as this ORF thing does, would be beneficial in future releases. I haven't seen Exchange 2003 yet so can't comment on whether it has any such functionality. Regards Geoff Williams -----Original Message----- From: Nathan Mercer [mailto:nmercer(a)microsoft.com] Sent: Wednesday, 29 October 2003 10:27 AM To: Geoff Williams; nznog(a)list.waikato.ac.nz Subject: RE: [nznog] New and unacknowledged Exchange / Win2k SMTPvulnerability? So just to be clear, a new and unacknowledged Exchange or Windows 2000 vulnerability has not been discovered here right? We want to know about vulnerabilities (not mis-configurations) If you do wish to report a suspected security vulnerability please either contact myself directly, log the details on https://s.microsoft.com/technet/security/bulletin/alertus.asp or email secure(a)microsoft.com (PGP key is on https://s.microsoft.com/technet/security/MSRC.asc ) Details of our vulnerability handling processes are on http://microsoft.com/technet/security/bulletin/msrpracs.asp Regards Nathan Technology Specialist Microsoft NZ _____ From: Geoff Williams [mailto:geoff(a)katnet.com.au] Sent: Tuesday, 28 October 2003 11:26 a.m. To: nznog(a)list.waikato.ac.nz Subject: FW: [nznog] New and unacknowledged Exchange / Win2k SMTPvulnerability? Further to my earlier post, Neil G has pointed me correctly to an SMTP AUTH attack. I have used the logs of the ORF tool to pinpoint which accounts have been compromised. Strangely the spammers are trying to work out why, even if they authenticate, they can't relay, so there is a lot of traffic to watch and learn from. A large number of their connections are being blocked by the IP blacklists I have selected. I had originally blocked 2 Class A IP ranges at our router after watching the traffic and finding that they were allocated to a provider in China. But I am not 100% sure that IP addresses are not being spoofed as they seem to have a huge range of Class A and B addresses available to them and I was really chasing my tail trying to block them at that level. So now I have a new password generator and will start training the mind to work with 12 or more character passwords. Hope this is of assistance to others. Geoff Williams -----Original Message----- From: Geoff Williams Sent: Monday, 27 October 2003 11:01 PM To: nznog(a)list.waikato.ac.nz Subject: [nznog] New and unacknowledged Exchange / Win2k SMTP vulnerability? Hi All I have exactly the same open-relay problem, including the sending servers and addresses, and have been struggling to diagnose for a few weeks. I had a hunch that the hack may involve the SystemMailbox account (which of course is disabled), but this was based on checking security logs and seeing who was logged in at the same time as the spam was dumped into the queue. I have got around it for the moment (I hope) by loading the ORF relay and spam tool but I would really like to know how this hack is being perpetrated as I have a whole stack of other Exchange servers to look after and I really don't want this to get out of control... So if anyone has made any progress I would really appreciated you sharing your experience. Thanks ______________ Geoffrey Williams KAT International T: 02 9904 3137 F: 02 9904 0232 M: 0417 281 905 _____ size=2 width="100%" align=center> This email is confidential and intended for the recipient only. If you have received it in error please delete it immediately.

1 0