- NZNOG - lists.nznog.org

Agenda for spam session on Wednesday
by David Farrar 31 Jan '05

31 Jan '05

Hi all - for those attending the spam session tomorrow as part of NZNOG Conference, the revised agenda FYI is below. You can sleep in :-) 1030 Morning Tea 1100 Welcome - Rodney Prescott 1110 Anti-Spam Technology (David Harris, Richard Jowsey, Simon Lyall) - Sender-ID/SPF (Microsoft) - DomainKeys (Yahoo) - Cisco Initiative - Cascaded statistical filtering 1200 Spam - A dose of reality Simon Lyall, Telecom NZ 1230 Lunch 1330 Spam Trends and Changes (David Harris, Richard Jowsey, Simon Lyall) - Web-bugs/Beacons - Phishing, Mafia links - Trojans - Disposable domains - Zombies - Collateral damage - Blacklists/Blocklists 1500 Afternoon Tea 1530 NZ Anti-Spam Legislation - consequences for industry - Likely shape of legislation (David Farrar) - Code of Practice (Pete Macaulay) 1630 Drinks -- David Farrar e-mail: david(a)farrar.com mob: 027 447 0216, ph: 04 471 0956, fax: 04 471 0946 blog: http://www.kiwiblog.co.nz msn: dpf666(a)hotmail.com, icq: 29964527 Director, Curia Market Research http://www.curia.co.nz Vice-President, InternetNZ http://www.internetnz.net.nz Director, .nz Registry Services, http://www.nzrs.net.nz

1 0

bandwidth in AKL
by Richard Naylor 31 Jan '05

31 Jan '05

Hi There, I have a possible major webcast in AKL at the Showgrounds in mid March. I'm going to need 2 carriers with around 2.5-3 mbps each. I just need to get back to APE, so traffic upstream isn't too great. Current plans are to use Wired Country and IP Star via ICONZ. Any one (incl Telecom and TCL) with something better and do-able before mid March, please contact me off list. Its 3 days live and allowing for set up etc, is a total of maybe 5 days. Thanks - Rich

1 0

The New Zealand Network Operators' Group
by Donald Neal 31 Jan '05

31 Jan '05

The New Zealand Network Operators' Group The New Zealand Network Operators' Group (NZNOG) has no king, president or formal membership. It consists of the subscribers to this mailing list, which anyone is free to join. Conference Our next conference starts tomorrow. See http://www.nznog.org/ for more information about the conference, including how to get there. You may be out of luck if you haven't already registered. If you are going, see http://www.nznog.org/curry_about.php for dinners on Wednesday and Friday. Other Meetings See http://auckland.thursdaynightcurry.com/ or http://wellington.thursdaynightcurry.com/ if you live in or near Auckland or Wellington. Operators' Contact List See http://www.usenet.net.nz/noc/ for operational contact details for most New Zealand ISP's. These are intended for use by other network operators, not by most customers. Internet Exchanges See http://nzix.net/ for details of the Auckland, Palmerston North and Wellington exchanges, and some information on others under construction. About This Mailing List This list has around 750 addresses subscribed. You may only post to the list from a subscribed address. A number of people subscribe addresses which do not receive email purely to allow posting from them. You may choose to receive postings as they come in, or just to receive daily "digests". See the bottom of the page http://list.waikato.ac.nz/mailman/listinfo/nznog/ to change the form in which you receive postings. The NZNOG mailing list is provided through a server at The University of Waikato, and is administered by employees of Alcatel NZ Ltd, Citylink and Telecom. None of these organisations, nor any administrator, is responsible for its content. NZNOG Mailing List Acceptable Use Policy The NZNOG mailing list exists to provide a forum for the exchange of technical information and the discussion of implementation issues that require cooperation among New Zealand network service providers. In order to continue to provide a useful forum for discussion of relevant technical issues, users of the list are asked to respect the following guidelines. 1. Discussion will focus on Internet operational and technical issues. 2. Discussion related to meetings of network service providers is appropriate. 3. Discussion unrelated to these topics is not appropriate. 4. Postings to multiple mailing lists are discouraged. 5. Postings that include foul language, character assassination, and lack of respect for other participants are unacceptable. 6. Blatant product or service marketing is unacceptable. 7. Postings of a political, philosophical or legal nature are discouraged. 8. Postings to the list should be in ASCII or MIME encoded as text/plain. Attachments should not be sent to the list. To present a document, a suitable URL may be referred to. For documents of general interest, the use of proprietary file formats is discouraged. 9. Breaches of list etiquette should be dealt with privately with the offending list user, and should not result in complaints being sent to the list. 10. A person repeatedly breaching list etiquette shall receive warnings from the list administrator. A further breach after the second such warning within thirty days shall result in the offender being unsubscribed from the list. Other action may also be taken to block postings to the list by the offender. Any such unsubscription is to be immediately announced to the list. Mailing List Archives A full archive is available at http://list.waikato.ac.nz/pipermail/nznog/ Any message sent to the list will be archived and made available on the web automatically. Changes are not made to the archive on request, though the administrators remain happy to assist the Office of the Privacy Commissioner should any complaint be laid with that office. One way to search the archive is to use google and prefix your search with site:list.waikato.ac.nz . Subscribing to the List See http://list.waikato.ac.nz/mailman/listinfo/nznog to subscribe. Donald Neal NZNOG Mailing List Owner/Administrator/Muggins ------------------------------------------------------------------------------ "This communication, including any attachments, is confidential. If you are not the intended recipient, you should not read it - please contact me immediately, destroy it, and do not copy or use any part of this communication or disclose anything about it. Thank you. Please note that this communication does not designate an information system for the purposes of the Electronic Transactions Act 2002." ------------------------------------------------------------------------------

1 0

backscatter attack
by Spencer Stapleton 30 Jan '05

30 Jan '05

One of our user domains has just been heavily hit by *huge* quantities of Non-Delivery Receipts addressed to random_string(a)domain_name. At it's peak we were seeing around 50,000 NDR's coming in per hr. The worst has passed (<fingers crossed>), but this does raise a couple of issues with the current Internet mail infrastructure. A good discussion of the attack and surrounding issues can be found here at http://www.gossamer-threads.com/lists/spf/discuss/17041. In a nutshell we need Sender Policy Framework (http://spf.pobox.com/) - or something similar ASAP. There is nothing that could stop this happening to us again tomorrow. I don't think I've ever felt so powerless. RBL lists proved useless in the line of defense, as these messages were coming from legitimate sources. We were able to temporarily remove a few IP's here and there where the remote MTA were going overkill throwing these NDR's at us. It would seem that the original spambots that delivered the original message sent it just about everywhere. An interesting stat is that we received NDR's for atleast 352,423 unique recipients (<352,423 unique strings>@domain)!!! We only had a number of things at our disposal to do to limit the damage: Stop generating any 'unknown user' NDR responses ourselves (ignoring RFC876). Split the affected domain away from the rest of our incoming mail stream and then to start removing obvious NDR's from the isolated queues. Remove more NDR's from the queue. <repeat last step again> <and again>... <etc...> Has anyone seen something similar? Did you manage to locate a better solution? I can't say I've enjoyed the last couple of days one bit! Spencer. -- Systems Engineer Compass Communications http://www.compass.net.nz

8 14

Radius?
by Craig Spiers 30 Jan '05

30 Jan '05

What Radius Software are the majority of people out there using? Small Scale.. And large scale.. with SQL Backend? Anyone know anything about freeradius? Regards Craig - ConceptNET

6 5

Multicast in NZ FAQ
by Lennon - Orcon 30 Jan '05

30 Jan '05

Hi Folks.. I have updated a little my "Multicast in NZ" FAQ (http://www.mbone.net.nz) My Wish (Yes I'm dreaming) is get all networks multicast enabled so as people can start to broadcast the content on the net in NZ and if a customer asks, "can I do it" you say "Yes I can". With UBS and Wireless it is possible to get the content out there ,and in the future, if higher speed connections are available which are multicast enabled, Video and other content can get to the customers with people want to see. Yes I know there is no content yet (maybe the big hurdle in people wanting to set it up on their network), but maybe ISP's/Other network providers will want to start to release some content (Radio Stations/Television Stations/Other Content providers) If anyone want to give any suggestions or help, please let me know.. I need some examples of how other people (if anyone else) is setting up their equipment (Like Cisco L2TP termination for UBS etc) which can be put out to other people interested. Thanks Craig

1 0

RE: [nznog] backscatter attack
by Regan Murphy 28 Jan '05

28 Jan '05

"James Riden" writes: >It's best to do SMTP rejects for unknown users; this will >help cut the load on your servers if the forged From addresses >don't exist at your domain. This is relatively straightforward >for most MTAs - I believe postfix can do LDAP queries >against AD, or can talk to a postgresql database. Since >most of the forged addresses will be nonexistent, this should >help quite a bit. >(Bonus - it will also stop you generating this kind of traffic >for other sites in the future.) My mail domain is relatively small - about 40 real users - but I still drop about 1500 mail connections a day for email sent to invalid users. About 200 of these were typically virus initiated (and therefore had attachments) and almost all the rest were spam. My MTA is Mailmarshal and it can easily be configured to do this. You can set up LDAP or Active Directory connectors to hook into your directory servers which makes managing the lookup lists simple. And before I hear cries of "argh, not mailmarshal again..." Its configured so that is does *not* send outbound notifications for viruses etc. -- Regan

2 1

PGP Key Signing at NZNOG 2005
by Joe Abley 28 Jan '05

28 Jan '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We're going to engage in a frenzy of PGP keysigning at the NZNOG meeting in Hamilton. People who know what PGP stands for should read on. People who don't know what PGP is are more than welcome to ask me off-list, or alternatively ask Google (who at least knows people who know). Here's what we will attempt to do for the meeting next week: 1. As soon as you can, generate an ASCII-armoured copy of your public key and paste it into the convenient form here: http://www.biglumber.com/x/web?keyring=5468 Consult your PGP software's documentation to find out how to generate an ASCII-armoured copy of your public key. With GnuPG you use "gpg -a - --export <your-key-id>". You're looking for a block of ASCII text which begins with the line "-----BEGIN PGP PUBLIC KEY BLOCK-----". 2. Before you set off to the NZNOG meeting, remember two things: 2.1. BRING PHOTO ID. Key signing is a process of representing trust, and if you are interested in getting signatures on your key (and you're reading, so presumably you are) you should be ready to provide proof of your identity to other people. Drivers licences, passports, things of that nature. BRING PHOTO ID. 2.2. BRING A TRUSTED COPY OF YOUR PGP KEY FINGERPRINT. This could be achieved by bringing a laptop with a trusted copy of your public key on it, or alternatively you could generate the fingerprint of your public key, write it down and bring the bit of paper with you. BRING A TRUSTED COPY OF YOUR PGP KEY FINGERPRINT. The precise procedure we use at the key signing party will depend on how many keys are uploaded in the next week; if there's a small handful we can read signatures aloud -- if there are more, we can try Len Sassaman's efficient key signing method (<http://sion.quickie.net/keysigning.txt>). I'll send more words on this closer to the time. Thanks! Joe -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (Darwin) iD8DBQFB+bVj/f+PWOTbRPIRAi5jAJ93/s+kA1HJnO82JxCqwhAj2mniPQCcC72i uxmFZl1QTdi4ZMk5AXa5u5k= =6Rnh -----END PGP SIGNATURE-----

2 2

Telecom
by Garrett Stoupe 27 Jan '05

27 Jan '05

Is it possible anyone from telecom to contact me off list in regards towards the proxy servers that Telecom uses Garrett Stoupe Network And Database Administrator Cabbage Tree Press garretts(a)te.co.nz www.te.co.nz www.jobzone.co.nz www.nzcarbuys.co.nz

3 2

IANA IPv4 allocations and bogon update: 124/8, 125/8 and 126/8
by Rob Thomas 27 Jan '05

27 Jan '05

-----BEGIN PGP SIGNED MESSAGE----- Hi, team. [ Apologies to those of you who receive this note in multiple forums. ] The numerous Team Cymru bogon projects have been updated as of 27 JAN 2005 to reflect the following IANA allocation made on 27 JAN 2005: 124/8 Jan 05 APNIC (whois.apnic.net) 125/8 Jan 05 APNIC (whois.apnic.net) 126/8 Jan 05 APNIC (whois.apnic.net) IANA allocations change over time, so please check regularly to ensure you have the latest filters if you are not using the bogon BGP feed(s). We do announce updates to the bogon projects to sundry lists, such as the bogon-announce list. We can not stress this point strongly enough - these allocations change. If you do not adjust your filters, you will be unable to access perhaps large portions of the Internet. Worse yet, you may end up blocking access for people who transit through you. Please do not apply any filters or blocks to your network without carefully considering the ramifications of doing so. As a point of reference, the Team Cymru master Bogon Reference Page can be found here: <http://www.cymru.com/Bogons/> A quick summary of the documents and projects that have been updated include the following: HTTP The Bogon List - <http://www.cymru.com/Documents/bogon-list.html> The Text Bogon Lists - <http://www.cymru.com/Documents/bogon-bn-nonagg.txt> - <http://www.cymru.com/Documents/bogon-bn-agg.txt> Secure BIND Template - <http://www.cymru.com/Documents/secure-bind-template.html> Secure IOS Template (Cisco) - <http://www.cymru.com/Documents/secure-ios-template.html> Secure BGP Template (Cisco) - <http://www.cymru.com/Documents/secure-bgp-template.html> Secure JUNOS Template (Juniper) - <http://www.cymru.com/gillsr/documents/junos-template.htm> Secure JUNOS BGP Template (Juniper) - <http://www.cymru.com/gillsr/documents/junos-bgp-template.htm> Ingress Prefix Filter Templates, Loose and Strict (Cisco) - <ftp://ftp-eng.cisco.com/cons/isp/security/Ingress-Prefix-Filter- Templates/> Ingress Prefix Filter Template, Loose (Juniper) - <http://www.cymru.com/gillsr/documents/junos-isp-prefix-filter- loose.htm> Ingress Prefix Filter Template, Strict (Juniper) - <http://www.cymru.com/gillsr/documents/junos-isp-prefix-filter- strict.htm> BGP Bogon route-server for AUTOMATED updates of bogon filters - All bogon route-server peers have already received the appropriate BGP prefix updates. - <http://www.cymru.com/BGP/bogon-rs.html> RADb fltr-unallocated fltr-martian fltr-bogons - <http://www.cymru.com/Bogons/index.html#radb> RIPE NCC fltr-unallocated fltr-martian fltr-bogons - <http://www.cymru.com/Bogons/index.html#ripe> DNS Bogon (bogons.cymru.com) zone - <http://www.cymru.com/Bogons/index.html#dns> Monitoring Bogon prefix monitoring - <http://www.cymru.com/BGP/robbgp-bogon.html> Bogus ASN monitoring - <http://www.cymru.com/BGP/asnbogusrep.html> Please feel free to contact Team Cymru <team-cymru(a)cymru.com> with any comments, questions, or concerns. Thanks, Rob. - -- Rob Thomas http://www.cymru.com Shaving with Occam's razor since 1999. -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.2 iQCVAwUBQfl/WlkX3QAo5sgJAQF9bQP9Fr8ME4sMVC27ANxUfgDjbG7SLnI2vnQK FMNkdXSoLdNSulPtcwKu9x6uMxDfQtN1s7Ks2LMC2x8aA/aAMJSgY9zaawmuy6Gv iElHI0mHsRY90YbYVS1o6nXP/RtFFK4GdOgw99LjkAjgm/tEdGrbt6dzaHkCTrAa bbvDFteCeH4= =PPS8 -----END PGP SIGNATURE-----

1 0