- NZNOG - lists.nznog.org

Re: [nznog] Paradise.Net SMTP server blocked.
by Ewen McNeill 09 Nov '05

09 Nov '05

In message <40972.203.97.112.6.1131571888.squirrel(a)webmail.blakjak.net>, "Mark Foster" writes: >I thought that most malware did its own MX lookups and relayed directly? >Aka bypassing the SMTP relay provided by infected-parties ISP? There's at least one common variant around now which seems to relay via the ISP mail servers. I notice it mainly through the reflections, including some where that ISP's mail server apparently tried to deliver to some nonexistant user at my domain, got rejected, and so instead delivers a bounce message to the (forged) from address at the same domain (which happens to exist; if that one didn't exist either I'd never see it). I'm not sure how much longer relaying mail without scanning it first (and rejecting anything that doesn't pass at SMTP time) is going to be a viaable strategy for both incoming and outgoing mail relays. Either that or dynamic IP addresses going away, so it's possible to assign reputation right back to the originating machine. Ewen

1 0

Paradise.Net SMTP server blocked.
by Steve Biddle 09 Nov '05

09 Nov '05

After experiencing email problems I've noticed Paradise's SMTP server is currently being blocked by SpamCop. http://www.spamcop.net/w3m?action=checkblock&ip=203.96.152.177 Anybody got any comments? These email problems have been ongoing over the last few weeks so I suspect the server (smtp1.paradise.net.nz) has been on the list for some time.

6 5

Re: [nznog] Paradise.Net SMTP server blocked.
by Nic Wise 09 Nov '05

09 Nov '05

> Warning, rant ahead. :) I see your rant, and raise you a rant and a beer (just to keep it ontopic) At my previous job, we moved from a single IP connection to a block of 8. Problem was, one of the addresses in the "new" block of 8 was black listed - and guess which one we put the mail server on <sigh> Got it cleaned up, but no outgoing (without a work around) for 48 hours. That said, on the RBL list on my server, I removed SpamCop. Why? Too many false positives, and WAY too many false negatives (letting spam in). It's close to useless.... (and there are other, GOOD ones, out there) Cheers Nic

1 0

Re: [nznog] Paradise.Net SMTP server blocked.
by Nic Wise 09 Nov '05

09 Nov '05

Paradise gets blocked about once a month (or more, some times). I've had to put a rule in, allowing *(a)paradise.net.nz :) (there again, my server is not huge - 2 users - so not really an issue for me :) ) I assume their admins are aware, as they appear to normally be on the ball..... I'm guessing they are now, anyway! Cheers Nic -- Nic Wise - Senior Developer - Microsoft MVP (.NET) AfterMail Limited > -----Original Message----- > From: Steve Biddle [mailto:sjbiddle(a)paradise.net.nz] > Sent: Wednesday, 9 November 2005 6:07 p.m. > To: nznog(a)list.waikato.ac.nz > Subject: [nznog] Paradise.Net SMTP server blocked. > > > > > After experiencing email problems I've noticed Paradise's > SMTP server is currently being blocked by SpamCop. > > http://www.spamcop.net/w3m?action=checkblock&ip=203.96.152.177 > > Anybody got any comments? These email problems have been > ongoing over the last few weeks so I suspect the server > (smtp1.paradise.net.nz) has been on the list for some time. > > > > > > > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog >

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 08 Nov '05

08 Nov '05

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. --- OBJECT BELOW CREATED: aut-num: AS24183 as-name: NZRR-AS24183 descr: DTS1 descr: WIX peering at '202.7.0.143' descr: see Citylink RT job #3580 admin-c: RPA1-NZRR tech-c: RPA1-NZRR import: from AS9439 accept ANY AND NOT fltr-bogons export: to AS9439 announce AS24183 notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: milton(a)dts.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20051109 source: NZRR

1 0

Update: Systems Administration Miniconf, linux.conf.au 2006.
by Simon Lyall 07 Nov '05

07 Nov '05

An update and 2nd Call for papers. The Systems Administration Miniconf will be part of the linux.conf.au conference to be held in Dunedin, New Zealand in January 2006 . We have had a good response to our first call for papers and have accepted several great presentations. In addition we have several others submitted after the early deadline or which didn't quite make the first cut. Please see http://sysadmin.miniconf.org/program.html for our draft programme or http://sysadmin.miniconf.org/presentations.html for more details on the accepted presentations. A reminder that we are still accepting proposals for presentations until at least the 18th of November. Presentations can be lightning talks or full presentations between 30 and 120 minutes. See: http://sysadmin.miniconf.org/cfp.html for details. Topics for presentations could include (but are not limited to) Samba, Databases, Backups, Firewalls, AAA, Troubleshooting, Buying Decisions, VPN, Virtual machines (Xen, UML, VMware), Monitoring Software, Web/Mail/LDAP/etc Server software, Wikis, PHP, Spam and Virus Filtering, VOIP, Trouble Ticket System, Best Practices, New Developments, Clustering/High Availability , Automated Installs, Automated configuration, Packaging Local Software. Speakers should assume that members of the audience have at least a couple of years experience in Unix/Linux administration. Format of Presentations ----------------------- Presentations of between 30 and 120 minutes (including questions) or Lightning Talks of 5-10 minutes. Submitting talks ---------------- Please note that in order to give a presentation you must be signed up for the main linux.conf.au conference. In order to submit a talk please see our Call for Presentations web page at: http://sysadmin.miniconf.org/cfp.html Submissions (or any questions) should be sent to: contact @ sysadmin.miniconf.org. Dates and Deadlines ------------------- 18 Nov 2005 - Deadline for Submissions Contact and Questions --------------------- Please see our website at http://sysadmin.miniconf.org/ for more information on the miniconf and presenting at it. If you have any questions please feel free to email the organisers at: contact @ sysadmin.miniconf.org

1 0

Spammers Again (pricecutter.co.nz/brands4less.co.nz)
by Craig Whitmore 07 Nov '05

07 Nov '05

People have been talking about this company lately... pricecutter.co.nz/brands4less.co.nz strike again and sends out their new batch of blatent spams today Recieved a load of spam this afternoon to email addresses which have not been used for over 7 years old. (The info on their website says they've only been running since 2005) pricecutter/brands4less registered to John Kyle (Cannot find any company owned by him) Calypso Records (cannot find any company called that) Address: 68 Lincoln Road, Henderson (This is The Lincoln Road Bible Chapel ) (I live 2 mins away and I checked !) Phone Number: 09 828 7890 (invalid number) (invalid exchange) Email: zxd(a)xtra.co.nz (when you email it you get back saying "Your email gas been removed. This is an automated message please do not reply." (same with Looks like same people as fitnessgear.co.nz with very similar style ads and invalid domain contacts and same hosting/ip address!! Be aware of this company.. (Search for brands4less.co.nz on google) I've also emailed their kliksend.com about this spam (or are they the same people and ignore me) Also.. can Domainz contact this customer of theirs and get some valid details for their domain as they are breaking Domainz's T&C and also I believe the DNC's for having false details. Thanks Craig Talking for Myself

1 0

Short notice of webcast
by Richard Naylor 05 Nov '05

05 Nov '05

Evening All, The following webcasts will take place this week at rather short notice (friday night). I doubt there will be huge traffic, but better warned...... On Monday and Tuesday, we will be streaming the 2 Opening ceremonies of Parliament, live from the grounds. (There will be cameras inside as well, just we'll be outside) The links for the streams are on http://www.r2.co.nz/20051107 Rich

1 0

Re: [nznog] DNS Servers and peering
by Webmaster 04 Nov '05

04 Nov '05

That'll teach me for being naive. I take it you meant that they are unrelated. R. >>> Joe Abley <jabley(a)isc.org> 11/05/05 4:10 PM >>> > Apologies if I appear pedagogical :-) _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

DNS Servers and peering
by Webmaster 04 Nov '05

04 Nov '05

A naive question: With the limiting of recursion (which appears to be a Good Thing) does it make it more (or less) important to have good network diversity (hint:peering) ? Or does it not matter? Richard >>> "Simon Allard" <simon.allard(a)staff.ihug.co.nz> 11/04/05 8:00 PM >>> Rob is correct (as always, Hi Rob!) There has been a plee on the ISP jungle drum network, to limit recursive DNS servers to protect the internet from evil doers. IHUG will be following very shortly, will post on here and give some notice before limiting the use of 203.109.252.42/43. Cheers, Simon Allard IHUG > -----Original Message----- > From: Rob Thomas [mailto:robt(a)cymru.com] > Sent: Friday, 4 November 2005 7:39 p.m. > To: NZNOG List > Subject: Re: [nznog] Inspire Net name servers > > Hi, team. > > ] http://www.theregister.co.uk/2005/10/24/dns_security_survey/ > > Might I also suggest: > > <http://www.dyndns.com/about/company/notify/archives/the_dangers_of_open _r > ecursive_dns.html> > > Thanks, > Rob. > -- > Rob Thomas > Team Cymru > http://www.cymru.com/ > ASSERT(coffee != empty); > > _______________________________________________ > NZNOG mailing list > NZNOG(a)list.waikato.ac.nz > http://list.waikato.ac.nz/mailman/listinfo/nznog _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

4 4