- NZNOG - lists.nznog.org

Open Source LI project
by Shane Alcock 09 Nov '17

09 Nov '17

Hi all, A couple of months back, there was a discussion on this list about the ETSI standard for lawful intercept and the lack of available open source implementations of the standard. After some preliminary research and consultation with a handful of operators, WAND (and myself in particular) are putting together a proposal to develop an ETSI-compliant lawful intercept software tool, provided that this is still something that will be of use to people in the NZNOG community. We propose that the resulting software will be open-source and freely available to anyone, but that anyone who wants to see this project progress quickly should consider chipping in some funding to help cover the cost of having a dedicated programmer working on this for ~10-20 hours a week. The total funding pool doesn't need to be overly large: I am confident we will need much less than some of the numbers I've been hearing as the likely cost of a single piece of ETSI-compliant vendor kit. Of course, anyone who is providing funding would be consulted during the development process to ensure that the resulting software will be compatible with their particular network configuration. For now, I'd be interested in hearing from anyone who would like to use this software, regardless of whether you are able to fund the development or not. Replies can be on or off list. If we get enough interest, we would be looking at holding a meeting with anyone interested in funding later on this month (probably in Hamilton) to discuss the requirements for the software and how the funding model is going to work. The goal is to try and have the software in a deployable state (including being signed-off by police as being compliant) by April. I'm happy to take further questions or comments, either on or off list. Thanks, Shane Alcock Research Programmer WAND University of Waikato

2 2

NZNOG conference registrations are open!
by Dave Mill 08 Nov '17

08 Nov '17

Hi all Registrations are open - https://nznog-2018.lilregie.com . Our conference is being held at the Rydges Hotel, Queenstown from 22 - 26 January, 2018 - http://www.nznog.org/nznog18/venue Conference schedule and general information : http://www.nznog.org/nznog18 Available training : http://www.nznog.org/nznog18/nznog-2018-training . Please note, Facebook are handling their own registrations for the Wednesday Facebook event. If you are taking part in the Mikrotik training please note the prerequisites on our training page. We'll be publishing details on the talks/speakers at the conference proper (Thur/Fri) when we accept the talks. Expect the first details on those in the next couple of weeks. Any questions please ask. Cheers Dave

2 2

Important announcement from Microsoft
by Peter Tobin 07 Nov '17

07 Nov '17

On behalf of Microsoft Auckland (APE), Wellington (WIX) and AKL-IX Exchange peers, Microsoft is in the process of refining our peering policies to better serve our customers and the internet community. As part of this we are reaching out to peers for direct or bilateral BGP sessions, as we will stop advertising routes via the public route servers shorty. If you wish bring up a direct BGP session with us, review our peering policy at www.microsoft.com/peering<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.microso…> and request a session using the peering request form<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.micros…>. Please also ensure your PeeringDB record is up to date and has a 24x7 NOC role email and phone number listed, and only request a session if we are not already directly peered. This change is a reflection of Microsoft’s evolving IX policy, and is in the process of being implemented across various exchanges. The drivers behind this are many, and include more predictable routing, cleaner ASN path metrics as well as internal tool changes. Thank you for peering with Microsoft. AS8075 [osoft] http://www.peeringdb.com/view.php?asn=8075<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.peering…> ……………………………….. If any peers have difficulty in achieving a bi-lat across exchange fabric please reach out to the CityLink team (peering(a)citylink.co.nz)<mailto:peering(a)citylink.co.nz)> as we may be able to assist with facilitation via our contacts within Microsoft. CityLink Peering Team

1 0

Important announcement from Microsoft
by Peter Tobin 07 Nov '17

07 Nov '17

On behalf of Microsoft Auckland (APE), Wellington (WIX) and AKL-IX Exchange peers, Microsoft is in the process of refining our peering policies to better serve our customers and the internet community. As part of this we are reaching out to peers for direct or bilateral BGP sessions, as we will stop advertising routes via the public route servers shorty. If you wish bring up a direct BGP session with us, review our peering policy at www.microsoft.com/peering<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.microso…> and request a session using the peering request form<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.micros…>. Please also ensure your PeeringDB record is up to date and has a 24x7 NOC role email and phone number listed, and only request a session if we are not already directly peered. This change is a reflection of Microsoft’s evolving IX policy, and is in the process of being implemented across various exchanges. The drivers behind this are many, and include more predictable routing, cleaner ASN path metrics as well as internal tool changes. Thank you for peering with Microsoft. AS8075 [rosoft] http://www.peeringdb.com/view.php?asn=8075<https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.peering…> ……………………………….. If any peers have difficulty in achieving a bi-lat across exchange fabric please reach out to the CityLink team (peering(a)citylink.co.nz)<mailto:peering(a)citylink.co.nz)> as we may be able to assist with facilitation via our contacts within Microsoft. CityLink Peering Team

1 0

NZNOG 2018 Update
by Dave Mill 31 Oct '17

31 Oct '17

Hi all Our CFP has now officially closed. We've received a lot of good submissions and will begin accepting talks soon. If you have missed the CFP close and still want to talk definitely let us know. However, we will first be accepting the on time submissions. We've added a page about the training events we're offering to our website - http://www.nznog.org/nznog18/nznog-2018-training . The Mikrotik training has some pre-requisite details on that page. Go Wireless are offering the required pre-requisite training in the near future. Links to Go Wireless' training page is on our training page. We're just waiting to lock in the Facebook training and maybe one other training session and we'll then open registrations. Apologies for the delays - we're chasing the other parties as much as we can. Cheers Dave (on behalf of the NZNOG Trust)

1 0

Sysadmin Miniconf 2018 - Call for Presentations
by Simon Lyall 24 Oct '17

24 Oct '17

There will be a one day mini conference on Linux Systems Administration held as part of linux.conf.au 2018 (held in Sydney, Australia on 22 - 26 January 2018). The organisers of the Systems Administration Miniconf would like to invite proposals for presentations to be delivered at the Miniconf, https://sysadmin.miniconf.org/cfp18.html (A copy of the CFP text is included below for your convenience.) Please forward this CFP to your colleagues, peers, social networks, and other relevant mailing lists. Please help by encouraging submissions from people you would like to hear present at this Miniconf. This is our 12th Sysadmin Miniconf at Linux.conf.au. Previous presentations can be found at the website: https://sysadmin.miniconf.org/ -=+ Presentation Topics +=- We welcome talks on best current practice, new developments in Systems Administration, cutting edge techniques and technologies, and ways to better manage Linux environments large and small. Topics for presentations could include (but are not limited to): * Systems Administration Best Practice * Virtualisation and Cloud Computing * Containers and orchestration * Sysadmin Administration in a "serverless" environment (FAAS) * TLS everywhere * Monitoring and metrics. Collection, storage and presentation * Infrastructure/Platform/Software as a Service (IAAS, PAAS, SAAS) * Networkng: IPv6, SDN (Software Defined Networking), performance * DevOps, Configuration Management and provisioning * Bootstrapping systems, Lifecycle Management * Dealing with BYOD * Backups in a virtual/distributed world * Troubleshooting techniques * DevOps and SysAdmin Culture * Web and Email management * Keeping legacy systems functioning * War stories from the "Real World" Presentations should be of a technical nature and speakers should assume that members of the audience have at least a couple of years experience in Unix/Linux administration. -=+ Format of Presentations +=- We are now seeking proposals for presentations at the mini-conference. We have openings for: 15-25 minute short presentations 5-10 minute "lightning talks" Please note, due to the single day available (and whole-LCA keynote before morning tea), we expect the majority of available timeslots to be 20 minutes or less, with possibly 1-2 slightly longer talks if there is space in the schedule. We have a general policy of accepting a high proportion of proposals but handing out relatively short timeslots. Please see previous years Miniconf schedules for examples of how the programme is organised. -=+ Submitting talks +=- Please note that in order to give a presentation or attend the Miniconf you must be registered (and paid up by the time the conference happens) for the main linux.conf.au conference. Presenting at the Miniconf does not entitle you to discounted or free registration at the main conference nor to priority with registration. Unfortunately the Miniconf has no budget for sponsorship of speakers. To submit a talk to the LCA2017 Sysadmin Miniconf, create an account on the LCA2018 website: https://linux.conf.au/dashboard create a speaker profile, and then select "New Proposal" and "System Administration Miniconf Presentation", or while logged into the LCA2018 site, go directly to: https://rego.linux.conf.au/proposals/submit/sysadmin-miniconf/ If you have a preferred length of your Short Presentation (15/20/25 minutes) or Lightning Talk (5/10 minutes) please use the Private Abstract field to describe what would work best for your talk. Otherwise we will pick a length that best suits the gaps in the programme as we put the final programme together. In some cases we maybe able to add a few extra minutes to a few Short Presentations if there is any spare time left in the programme. -=+ Dates and Deadlines +=- To encourage early submissions, priority (both of inclusion and scheduling) will be given to presentations submitted by 23:59 UTC on the 5th of November 2017. I f you have a good presentation idea, please let us know early, even if you need time to finalise the presentation abstract. Please indicate if you need an early confirmation to aid you in arranging time off work or travel; we will do our best to assist. 2017-11-05 - Deadline for early submissions 2017-12-03 - Deadline for submissions 2017-12-10 - Miniconf programme published 2018-01-22 - Sysadmin Miniconf held. -=+ Contact and Questions +=- Please see our website at https://sysadmin.miniconf.org for more information on the Miniconf, past presentations and presenting at it. If you have any questions please feel free to email the organisers at: lca2018 @ sysadmin.miniconf.org Ewen McNeill and Simon Lyall LCA2018 Sysadmin Miniconf Conveners -- Simon Lyall | Very Busy | Web: http://www.simonlyall.com/ "To stay awake all night adds a day to your life" - Stilgar

1 0

ntp.net.nz changes and update
by Josh Simpson 16 Oct '17

16 Oct '17

Hi NZNOG, Time for a ntp.net.nz update and upcoming changes. ntp1.ntp.net.nz needs to be migrated to a new router, this will mean the IPv4 and IPv6 addresses will change, currently scheduled for 2017-10-22. 202.46.191.123 to 202.46.177.18 2001:dce:4000:2::123 to 2001:dce:3:17a::18 ntp2.ntp.net.nz is still IPv4 only, we are working on restoring IPv6 once we have upstream connectivity sorted. ntp3.ntp.net.nz has had IPv6 turned back on, this has been operating with v6 since 2017-09-25. ntp4.ntp.net.nz has been live for over 14 months, IPv4 only, this is located in Christchurch. We are working with our upstream to have IPv6 connectivity. We have also been testing a number of the servers in pool.ntp.org in the New Zealand and Oceania Pools, this has been going well and we have seen a jump in NTP packets per second on each node from a max of ~7 to a max of ~1000. We plan to add the rest of the servers in shortly. Details of the service can be found at https://ntp.net.nz As always let us know if you have any queries. Cheers Josh -- Josh Simpson Systems Administrator NZRS Ltd M: +64 21 783 399 P: +64 4 555 0124 GPG: 6516 B4EA 413B CAED 57B5 0956 124C 8AC3 A362 8080 www.nzrs.net.nz

1 0

[Owasp-New_Zealand] OWASP NZ Day 2018 - Registration, call for presentations, trainers and sponsors
by Kim Carter 03 Oct '17

03 Oct '17

Hi All, The OWASP NZ crew are pleased to announce the 9th OWASP New Zealand Day conference, to be held at the University of Auckland. As per previous years, OWASP NZ Day 2018 will be a free conference dedicated to information security with an emphasis on secure development techniques and management. The con will be held on the 5th of February, with training being run the day before (4th of February). Further information is available on the event wiki page here: https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2018 The registration link can be found here: https://owaspnz2018.eventbrite.com/ Please note that registration cut off is the 29th of January. We have plenty of seats, and though we've come to expect the flood of last minute emails from those of you that are either forgetful or just plain lazy, it messes with our numbers. It also hurts our collective feelings. So register. Do it. We have a large number of presenter slots to fill. We're interested in topics covering everything from introductory topics, to deeply technical subjects to risk and compliance. Presentation submissions are welcome from all interested parties, and we're especially keen to hear from the developers and other technical communities, not just the professional infosec nerds. We will not consider vendor pitches, commercial content or other such attempts to pedal your filthy, filthy wares. More info is available here: https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2018#tab=Call_For_Pre…<https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2017#tab=Call_For_Pre…> CFP Deadline: 8th of December. This year we have a number of training slots to fill. If you have a security related training you'd like to give the day before the main con, then please sub! More info is available here: https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2018#tab=Call_For_Tra…<https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2017#tab=Call_For_Tra…> CFT Deadline: 8th of December. OWASP is strictly not for profit and to keep our conference free we need sponsors to support us. The sponsorship cash is used to help make OWASP NZ Day a free and valuable experience for the audience. More details on sponsorship specifics available here: https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2018#tab=Call_For_Spo… Event Website: https://www.owasp.org/index.php/OWASP_New_Zealand_Day_2018 About OWASP: https://www.owasp.org/ About the NZ Chapter: https://www.owasp.org/index.php/New_Zealand Cheers! Denis Andzakovic, Kim Carter and Kirk Jackson OWASP NZ Chapter Leaders

1 0

TICSA and Lawful Interception
by ticsa＠police.govt.nz 01 Oct '17

01 Oct '17

Hi NZNOG The TICSA Registrar invites you to a Technical Discussion about Lawful Interception. There has been a lot of discussion about LI recently and we would like to clarify what it means to be Compliant. The aim of this meeting is to work through ‘the how’ and to answer any questions you may have. This is targeted at Network Engineers to whom PCAP, ASN.1 and ETSI 102.232-1 means something. Please register your interest by emailing off list, as space is limited (attendance by invitation only). Meeting will be held in Wellington on the 16th of October. Cheers Neil =============================================================== WARNING The information contained in this email message is intended for the addressee only and may contain privileged information. It may also be subject to the provisions of section 50 of the Policing Act 2008, which creates an offence to have unlawful possession of Police property. If you are not the intended recipient of this message or have received this message in error, you must not peruse, use, distribute or copy this message or any of its contents. Also note, the views expressed in this message may not necessarily reflect those of the New Zealand Police. If you have received this message in error, please email or telephone the sender immediately

1 0

KSK Rollover Postponed
by Save Vocea 28 Sep '17

28 Sep '17

Dear NZNOG community, A couple of weeks ago I posted ICANNs’ KSK rollover timelines in here. It was announced today that the plan to change the cryptographic key that helps protect the Domain Name System (DNS) is being postponed. The changing or "rolling" of the KSK Key was originally scheduled to occur on 11 October, but it is being delayed because some recently obtained data shows that a significant number of resolvers used by Internet Service Providers (ISPs) and Network Operators are not yet ready for the Key Rollover. The availability of this new data is due to a very recent DNS protocol feature that adds the ability for a resolver to report back to the root servers which keys it has configured. Full announcement is here: https://www.icann.org/news/announcement-2017-09-27-en Regards, Save Vocea ICANN staff in the region From: Save Vocea <save.vocea(a)icann.org> Date: Tuesday, September 12, 2017 at 4:53 PM To: NZNOG <nznog(a)list.waikato.ac.nz> Subject: KSK rollover timeline and how to check if your systems are ready Dear NZNOG list members, I’d appreciate if this is shared through your network /organizations and to check if your systems won’t be affected by the following change. The Internet Corporation for Assigned Names and Numbers (ICANN) is planning to roll, or change, the “top” pair of cryptographic keys used in the Domain Name System Security Extensions (DNSSEC) protocol, commonly known as the Root Zone KSK. This will be the first time the KSK has been changed since it was initially generated in 2010, and is considered an important security step, in much the same way that regularly changing passwords is considered a prudent practice by any Internet user. What does that mean? Rolling the KSK means generating a new cryptographic public and private key pair and distributing the new public component to parties who operate validating resolvers, including: Internet Service Providers; enterprise network administrators and other Domain Name System (DNS) resolver operators; DNS resolver software developers; system integrators; and hardware and software distributors who install or ship the root's "trust anchor." The KSK is used to cryptographically sign the Zone Signing Key (ZSK), which is used by the Root Zone Maintainer to DNSSEC-sign the root zone of the Internet's DNS. Why do you need to prepare? Currently, 25% of global Internet users, or 750 million people, use DNSSEC-validating resolvers that could be affected by the KSK rollover. If these validating resolvers do not have the new key when the KSK is rolled, end users relying on those resolvers will encounter errors and be unable to access the Internet. How to know if your systems are up-to-date? ICANN is offering a test bed for operators or any interested parties to confirm that their systems handle the automated update process correctly. Check to make sure your systems are ready by visiting: http://go.icann.org/KSKtest. What is the timeline for this process? October 27, 2016: KSK rollover process begins as the new KSK is generated. July 11, 2017: Publication of new KSK in DNS. September 19, 2017: Size increase for DNSKEY response from root name servers. October 11, 2017: New KSK begins to sign the root zone key set (the actual rollover event). January 11, 2018: Revocation of old KSK. March 22, 2018: Last day the old KSK appears in the root zone. August 2018: Old key is deleted from equipment in both ICANN Key Management Facilities. More information about the root zone KSK rollover is available here: https://www.icann.org/resources/pages/ksk-rollover. Thank you, Save vocea VP, Global Stakeholder Engagement, Oceania ICANN

2 1