- NZNOG - lists.nznog.org

KSK rollover timeline and how to check if your systems are ready
by Save Vocea 11 Sep '17

11 Sep '17

Dear NZNOG list members, I’d appreciate if this is shared through your network /organizations and to check if your systems won’t be affected by the following change. The Internet Corporation for Assigned Names and Numbers (ICANN) is planning to roll, or change, the “top” pair of cryptographic keys used in the Domain Name System Security Extensions (DNSSEC) protocol, commonly known as the Root Zone KSK. This will be the first time the KSK has been changed since it was initially generated in 2010, and is considered an important security step, in much the same way that regularly changing passwords is considered a prudent practice by any Internet user. What does that mean? Rolling the KSK means generating a new cryptographic public and private key pair and distributing the new public component to parties who operate validating resolvers, including: Internet Service Providers; enterprise network administrators and other Domain Name System (DNS) resolver operators; DNS resolver software developers; system integrators; and hardware and software distributors who install or ship the root's "trust anchor." The KSK is used to cryptographically sign the Zone Signing Key (ZSK), which is used by the Root Zone Maintainer to DNSSEC-sign the root zone of the Internet's DNS. Why do you need to prepare? Currently, 25% of global Internet users, or 750 million people, use DNSSEC-validating resolvers that could be affected by the KSK rollover. If these validating resolvers do not have the new key when the KSK is rolled, end users relying on those resolvers will encounter errors and be unable to access the Internet. How to know if your systems are up-to-date? ICANN is offering a test bed for operators or any interested parties to confirm that their systems handle the automated update process correctly. Check to make sure your systems are ready by visiting: http://go.icann.org/KSKtest. What is the timeline for this process? October 27, 2016: KSK rollover process begins as the new KSK is generated. July 11, 2017: Publication of new KSK in DNS. September 19, 2017: Size increase for DNSKEY response from root name servers. October 11, 2017: New KSK begins to sign the root zone key set (the actual rollover event). January 11, 2018: Revocation of old KSK. March 22, 2018: Last day the old KSK appears in the root zone. August 2018: Old key is deleted from equipment in both ICANN Key Management Facilities. More information about the root zone KSK rollover is available here: https://www.icann.org/resources/pages/ksk-rollover. Thank you, Save vocea VP, Global Stakeholder Engagement, Oceania ICANN

1 0

New Zealand Internet Research Forum 2017 - Registrations open
by Nicole Skews-Poole 11 Sep '17

11 Sep '17

Kia ora, Registrations for this year's New Zealand Internet Research Forum are open. The Forum will be held on 8 November, the day before NetHui 2017 <https://2017.nethui.nz/> - as part of the NetHui umbrella. *You can register for free by selecting the first event here: https://nethui-2017.lilregie.com/step1 <https://nethui-2017.lilregie.com/step1>* you can also register there for NetHui 2017 should you want to come along! The programme for this year will be finalised soon, and in the meantime you can check out last year's programme <https://internetnz.nz/internet-research-forum-2016-programme> for an idea of what goes on at the NZIRF. Please consider sharing this with your networks. I look forward to seeing you there! *Ngā mihi nui,* *Nicole Skews-Poole* NZIRF Organiser InternetNZ Mobile: +64 27 323 8914 Email: nicole(a)internetnz.net.nz A better world through a better Internet

1 0

TICSA and lawful intercept
by Dave Mill 06 Sep '17

06 Sep '17

Hi all So, probably a bit a touchy subject this one but here goes.. If you are a network operator and you have more than 4000 customers in my understanding you need to have full interceptions capabilities. (I'm not a lawyer, etc, etc) This is more than just being 'interception ready'. http://www.police.govt.nz/advice/businesses-and-organisations/ticsa/interce… This will mean having a mediation system and being able to produce intercept data in the ETSI standard - again, as far as I know. What are companies/organisations out there doing about this? Is there a nice open source solution out there for this? (I haven't found one yet) Are people putting their heads in the sand and praying they never get served a warrant? Is everyone just shelling out hundreds of thousands of dollars on a vendor LI solutions? What network kit are people integrating with LI in NZ? And note, the last paragraph on the URL I linked above reads: "Can I share interception capability resources? Network operators may co-ordinate, share or contract for services (equipment or staff) in order to meet the interception capability requirements in the Act. However, it remains the responsibility of the network operator to ensure that any such arrangement does not affect any obligations that apply under the Act. Before entering into any such arrangement a network operator must notify the Director of the GCSB." Replies on or off list welcomed. Cheers Dave (AS17705)

9 20

Christchurch Hacker Conference 2017 (CHCon) Tickets and Training now on sale
by CHCon crew 05 Sep '17

05 Sep '17

Hi Everyone. The Christchurch Hacker Conference (CHCon) tickets are now up for grabs at (https://chcon.nz), along with merchandise as part of the ticket purchase process. The conference is running on Friday 27th and Saturday 28th of October We also have a collection of excellent trainings available on Thursday 26 October. A big thanks to Insomnia (platinum) and Quantum Security (silver) for sponsoring us and helping us get this far. We are still looking for additional sponsors to help make the conference even better. We look forward to seeing you at the con! CHCon Team.

1 0

NZNOG'18 - Call For Papers
by Richard Nelson 03 Sep '17

03 Sep '17

The NZNOG organising committee invites papers for its 15th annual conference, to be hosted at Rydges Hotel, Queenstown, New Zealand from 22 - 26th January 2017. There will the three day Workshops 22 – 24 January, a day of tutorials on 24 January with the main conference on 25 – 26 January. Conference objective: The NZNOG conference, workshops and tutorials are a once-a-year opportunity for individuals and organisations involved in Internet operations to meet and share the latest in Internet operations, technologies practices and receive high quality training. The event is unique in New Zealand and attracts technical, skilled individuals with a genuine interest in Internet operations and Internetworking technologies. Submit a paper: Presenters are invited to submit talk proposals for consideration by Monday 30th October. Please provide your talk title, duration, a short presenter bio and an abstract of the talk. Abstracts should be no more than one page long and provide a summary of your networking- related subject matter. Normally presentations are video streamed live and slide decks are posted to the NZNOG website. To submit your paper please e-mail: talks(a)nznog.org When considering a presentation, remember that the NZNOG audience is mainly comprised of technical network operators and engineers with a wide range of experience levels from beginners to multi-year experience. There is a strong orientation to offer core skills and basic knowledge in SIGs and to address issues relevant to the day-to-day operations of ISPs and network operators in the conference sessions. The organising committee will evaluate proposals based on fit with the conference’s objective and its ability to stimulate lively discussions around the current state of New Zealand networking. This call for submissions can also be found at: http://www.nznog.org/nznog18/call-for-papers-2018 For more information about the conference visit www.nznog.org or contact: talks(a)nznog.org

3 2

SPF for Spark Business Mail
by Matthew McTague 22 Aug '17

22 Aug '17

Hi Noggers, Hoping to find some help from someone knowledgeable here as I can't get any answers through normal channels. I'm trying to find the correct SPF record (include FQDN or IP address ranges) for customers sending email via Spark Business Hub Mail. Have tried through normal support channels (to be told the SPF record is commercially sensitive) and have tried normal escalation paths. Anyone with knowledge on the subject, please contact me (perhaps if the correct SPF record can be a reply on-list, so everyone has it on record. It would help the NZNOG community as a whole.) Warm Regards, [https://www.vetta.tech/sig/vetta_signature_logo.png] <http://www.vetta.tech> [https://www.vetta.tech/sig/facebook_signature_icon.png] <http://www.facebook.com/VettaTech> [https://www.vetta.tech/sig/twitter_signature_icon.png] <http://www.twitter.com/VettaTech> [https://www.vetta.tech/sig/linkedin_signature_icon.png] <http://www.linkedin.com/company/2840435> [https://www.vetta.tech/sig/partnersilver.png] [https://s3.amazonaws.com/htmlsig-assets/spacer.gif] Matthew McTague / Systems & Network Engineer matthew(a)vetta.tech<mailto:matthew(a)vetta.tech> / DDI: +64 3 222 6013 Vetta Technologies Ltd 0800 4 VETTA / +64 3 683 9090 Level 3, Cnr Stafford & George Streets, Timaru 16 Pope Street, Christchurch East Tamaki, Auckland PO Box 923, Timaru www.vetta.tech<http://www.vetta.tech> This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender.

2 1

Vodafone outage in Karori/Highbury/Aro Valley (Wellington)
by Joel Wirāmu Pauling 21 Aug '17

21 Aug '17

Just spoke with Vodafone NOC - there was is planned upgrade work going on Karori prod node. Whatever it is seems to have taken out Highbury CMNT network. The Public facing Network status meter however shows all good - when there has been an ongoing outage since around 0100. Change window is meant to close at 0300 so hopefully it resumes before then. I am a little annoyed when there is planned work but the Public reporting tool isn't updated or fed by these things. -Joel

1 0

NZNOG 2018
by Dave Mill 13 Aug '17

13 Aug '17

Hi all There is now a link to book accommodation at our venue at our group rate on our website - http://www.nznog.org/nznog18 . The link is on the Venue page. We will be adding other accommodation options as they get back to our conference organiser. We hope to announce a very good workshop and tutorial in the coming few weeks.. More details on these once they are locked in. If you want to sponsor NZNOG please get in contact - info(a)nznog.org . Cheers Dave

1 0

Multiple connections to UFB in server room
by Paul Adshead 10 Aug '17

10 Aug '17

Hi guys. A shared server room has an active UFB service for another business on the floor. We want UFB service to our office too. Is an additional ONT install needed (as I'm being told by <ISP>)? Or, can Chorus just enable another port on the existing ONT and have and then run a network cable out to both routers from one ONT? Is the ONT capable of multiple PPPOE sessions to the offsite hardware? Or is this just creating a problem that doesn't need to exist (- ie say yes to the second ONT install)? Many thanks, Paul Adshead. 021890258

9 9

Spark (telecom) paging pacnet interface broken ?
by Ian Batterbee 01 Aug '17

01 Aug '17

Hi all, Does anyone here look after, or know who looks after, the 026 400 1283 modem interface to spark paging ? It's currently answering calls, but not giving a modem handshake. (Please don't respond with messages about paging being end-of-life'd, the fire service is paying for it to kept alive on life-support.) Thanks

4 5