January 2005 - NZNOG - lists.nznog.org

backscatter attack
by Spencer Stapleton 30 Jan '05

30 Jan '05

One of our user domains has just been heavily hit by *huge* quantities of Non-Delivery Receipts addressed to random_string(a)domain_name. At it's peak we were seeing around 50,000 NDR's coming in per hr. The worst has passed (<fingers crossed>), but this does raise a couple of issues with the current Internet mail infrastructure. A good discussion of the attack and surrounding issues can be found here at http://www.gossamer-threads.com/lists/spf/discuss/17041. In a nutshell we need Sender Policy Framework (http://spf.pobox.com/) - or something similar ASAP. There is nothing that could stop this happening to us again tomorrow. I don't think I've ever felt so powerless. RBL lists proved useless in the line of defense, as these messages were coming from legitimate sources. We were able to temporarily remove a few IP's here and there where the remote MTA were going overkill throwing these NDR's at us. It would seem that the original spambots that delivered the original message sent it just about everywhere. An interesting stat is that we received NDR's for atleast 352,423 unique recipients (<352,423 unique strings>@domain)!!! We only had a number of things at our disposal to do to limit the damage: Stop generating any 'unknown user' NDR responses ourselves (ignoring RFC876). Split the affected domain away from the rest of our incoming mail stream and then to start removing obvious NDR's from the isolated queues. Remove more NDR's from the queue. <repeat last step again> <and again>... <etc...> Has anyone seen something similar? Did you manage to locate a better solution? I can't say I've enjoyed the last couple of days one bit! Spencer. -- Systems Engineer Compass Communications http://www.compass.net.nz

8 14

Radius?
by Craig Spiers 30 Jan '05

30 Jan '05

What Radius Software are the majority of people out there using? Small Scale.. And large scale.. with SQL Backend? Anyone know anything about freeradius? Regards Craig - ConceptNET

6 5

Multicast in NZ FAQ
by Lennon - Orcon 30 Jan '05

30 Jan '05

Hi Folks.. I have updated a little my "Multicast in NZ" FAQ (http://www.mbone.net.nz). My Wish (Yes I'm dreaming) is get all networks multicast enabled so as people can start to broadcast the content on the net in NZ and if a customer asks, "can I do it" you say "Yes I can". With UBS and Wireless it is possible to get the content out there ,and in the future, if higher speed connections are available which are multicast enabled, Video and other content can get to the customers with people want to see. Yes I know there is no content yet (maybe the big hurdle in people wanting to set it up on their network), but maybe ISP's/Other network providers will want to start to release some content (Radio Stations/Television Stations/Other Content providers) If anyone want to give any suggestions or help, please let me know.. I need some examples of how other people (if anyone else) is setting up their equipment (Like Cisco L2TP termination for UBS etc) which can be put out to other people interested. Thanks Craig

1 0

RE: [nznog] backscatter attack
by Regan Murphy 28 Jan '05

28 Jan '05

"James Riden" writes: >It's best to do SMTP rejects for unknown users; this will >help cut the load on your servers if the forged From addresses >don't exist at your domain. This is relatively straightforward >for most MTAs - I believe postfix can do LDAP queries >against AD, or can talk to a postgresql database. Since >most of the forged addresses will be nonexistent, this should >help quite a bit. >(Bonus - it will also stop you generating this kind of traffic >for other sites in the future.) My mail domain is relatively small - about 40 real users - but I still drop about 1500 mail connections a day for email sent to invalid users. About 200 of these were typically virus initiated (and therefore had attachments) and almost all the rest were spam. My MTA is Mailmarshal and it can easily be configured to do this. You can set up LDAP or Active Directory connectors to hook into your directory servers which makes managing the lookup lists simple. And before I hear cries of "argh, not mailmarshal again..." Its configured so that is does *not* send outbound notifications for viruses etc. -- Regan

2 1

PGP Key Signing at NZNOG 2005
by Joe Abley 28 Jan '05

28 Jan '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We're going to engage in a frenzy of PGP keysigning at the NZNOG meeting in Hamilton. People who know what PGP stands for should read on. People who don't know what PGP is are more than welcome to ask me off-list, or alternatively ask Google (who at least knows people who know). Here's what we will attempt to do for the meeting next week: 1. As soon as you can, generate an ASCII-armoured copy of your public key and paste it into the convenient form here: http://www.biglumber.com/x/web?keyring=5468 Consult your PGP software's documentation to find out how to generate an ASCII-armoured copy of your public key. With GnuPG you use "gpg -a - --export <your-key-id>". You're looking for a block of ASCII text which begins with the line "-----BEGIN PGP PUBLIC KEY BLOCK-----". 2. Before you set off to the NZNOG meeting, remember two things: 2.1. BRING PHOTO ID. Key signing is a process of representing trust, and if you are interested in getting signatures on your key (and you're reading, so presumably you are) you should be ready to provide proof of your identity to other people. Drivers licences, passports, things of that nature. BRING PHOTO ID. 2.2. BRING A TRUSTED COPY OF YOUR PGP KEY FINGERPRINT. This could be achieved by bringing a laptop with a trusted copy of your public key on it, or alternatively you could generate the fingerprint of your public key, write it down and bring the bit of paper with you. BRING A TRUSTED COPY OF YOUR PGP KEY FINGERPRINT. The precise procedure we use at the key signing party will depend on how many keys are uploaded in the next week; if there's a small handful we can read signatures aloud -- if there are more, we can try Len Sassaman's efficient key signing method (<http://sion.quickie.net/keysigning.txt>). I'll send more words on this closer to the time. Thanks! Joe -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (Darwin) iD8DBQFB+bVj/f+PWOTbRPIRAi5jAJ93/s+kA1HJnO82JxCqwhAj2mniPQCcC72i uxmFZl1QTdi4ZMk5AXa5u5k= =6Rnh -----END PGP SIGNATURE-----

2 2

Telecom
by Garrett Stoupe 27 Jan '05

27 Jan '05

Is it possible anyone from telecom to contact me off list in regards towards the proxy servers that Telecom uses Garrett Stoupe Network And Database Administrator Cabbage Tree Press garretts(a)te.co.nz www.te.co.nz www.jobzone.co.nz www.nzcarbuys.co.nz

3 2

IANA IPv4 allocations and bogon update: 124/8, 125/8 and 126/8
by Rob Thomas 27 Jan '05

27 Jan '05

-----BEGIN PGP SIGNED MESSAGE----- Hi, team. [ Apologies to those of you who receive this note in multiple forums. ] The numerous Team Cymru bogon projects have been updated as of 27 JAN 2005 to reflect the following IANA allocation made on 27 JAN 2005: 124/8 Jan 05 APNIC (whois.apnic.net) 125/8 Jan 05 APNIC (whois.apnic.net) 126/8 Jan 05 APNIC (whois.apnic.net) IANA allocations change over time, so please check regularly to ensure you have the latest filters if you are not using the bogon BGP feed(s). We do announce updates to the bogon projects to sundry lists, such as the bogon-announce list. We can not stress this point strongly enough - these allocations change. If you do not adjust your filters, you will be unable to access perhaps large portions of the Internet. Worse yet, you may end up blocking access for people who transit through you. Please do not apply any filters or blocks to your network without carefully considering the ramifications of doing so. As a point of reference, the Team Cymru master Bogon Reference Page can be found here: <http://www.cymru.com/Bogons/> A quick summary of the documents and projects that have been updated include the following: HTTP The Bogon List - <http://www.cymru.com/Documents/bogon-list.html> The Text Bogon Lists - <http://www.cymru.com/Documents/bogon-bn-nonagg.txt> - <http://www.cymru.com/Documents/bogon-bn-agg.txt> Secure BIND Template - <http://www.cymru.com/Documents/secure-bind-template.html> Secure IOS Template (Cisco) - <http://www.cymru.com/Documents/secure-ios-template.html> Secure BGP Template (Cisco) - <http://www.cymru.com/Documents/secure-bgp-template.html> Secure JUNOS Template (Juniper) - <http://www.cymru.com/gillsr/documents/junos-template.htm> Secure JUNOS BGP Template (Juniper) - <http://www.cymru.com/gillsr/documents/junos-bgp-template.htm> Ingress Prefix Filter Templates, Loose and Strict (Cisco) - <ftp://ftp-eng.cisco.com/cons/isp/security/Ingress-Prefix-Filter- Templates/> Ingress Prefix Filter Template, Loose (Juniper) - <http://www.cymru.com/gillsr/documents/junos-isp-prefix-filter- loose.htm> Ingress Prefix Filter Template, Strict (Juniper) - <http://www.cymru.com/gillsr/documents/junos-isp-prefix-filter- strict.htm> BGP Bogon route-server for AUTOMATED updates of bogon filters - All bogon route-server peers have already received the appropriate BGP prefix updates. - <http://www.cymru.com/BGP/bogon-rs.html> RADb fltr-unallocated fltr-martian fltr-bogons - <http://www.cymru.com/Bogons/index.html#radb> RIPE NCC fltr-unallocated fltr-martian fltr-bogons - <http://www.cymru.com/Bogons/index.html#ripe> DNS Bogon (bogons.cymru.com) zone - <http://www.cymru.com/Bogons/index.html#dns> Monitoring Bogon prefix monitoring - <http://www.cymru.com/BGP/robbgp-bogon.html> Bogus ASN monitoring - <http://www.cymru.com/BGP/asnbogusrep.html> Please feel free to contact Team Cymru <team-cymru(a)cymru.com> with any comments, questions, or concerns. Thanks, Rob. - -- Rob Thomas http://www.cymru.com Shaving with Occam's razor since 1999. -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.2 iQCVAwUBQfl/WlkX3QAo5sgJAQF9bQP9Fr8ME4sMVC27ANxUfgDjbG7SLnI2vnQK FMNkdXSoLdNSulPtcwKu9x6uMxDfQtN1s7Ks2LMC2x8aA/aAMJSgY9zaawmuy6Gv iElHI0mHsRY90YbYVS1o6nXP/RtFFK4GdOgw99LjkAjgm/tEdGrbt6dzaHkCTrAa bbvDFteCeH4= =PPS8 -----END PGP SIGNATURE-----

1 0

Nznog travel
by Scott Walsh 27 Jan '05

27 Jan '05

Hi All, I've driving down to Hamilton for nznog early Wednesday morning (leaving by 6:30) and returning Friday pretty much right the conference close. If anyone would like a ride, get in touch. Thanks Scott Walsh Service Implementation Specialist Integrated Technology Services (ITS) - Passionate about Winning IBM New Zealand Limited

2 1

Nznog dinners
by Lin Nah 26 Jan '05

26 Jan '05

Hi All I am organising the dinners on Wednesday 2 February and Friday 4 February. It won't be anything as organised as the Thursday dinner! It is definitely NOT part of the conference and so a. You have to pay for your own meal, and, b. attendance isn't limited to ppl attending the meet Please read the page about the dinners and if you wish to attend, give me an indicative reply Page on dinners: http://www.nznog.org/curry_about.php Look forward to seeing you there. regards lin Auckland Thursday Night Curry http://auckland.thursdaynightcurry.com

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 26 Jan '05

26 Jan '05

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- OBJECT BELOW CREATED: route-set: AS9560:RS-ROUTES:AS9503 descr: Route set advertised to AS9560 by FX Networks - AS9503 members: 131.203.0.0/16^16-27, 161.29.0.0/16^16-27, 161.65.0.0/16^16-27, 192.88.85.0/24^24-27, 192.133.31.0/24^24-27, 202.36.226.0/24^24-27, 202.37.86.0/23^23-27, 202.49.80.0/23^23-27, 202.50.52.0/22^22-27, 202.50.196.0/22^22-27, 202.50.200.0/21^21-27, 202.50.208.0/20^20-27 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: noc(a)fx.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20050127 source: NZRR

1 0