- NZNOG - lists.nznog.org

Re: [nznog] SSH login attempts
by Anton Smith 14 Dec '04

14 Dec '04

> Moving the ssh port to something else that 22 seems to help as well. > > -- > Juha Port knocking is an interesting method of protecting your machine. If you're a debian user apt-get install knockd - comes with a fairly simple configuration file as well. The only problem with this is generating the knock sequences, especially when you are out and about and on a foreign machine (can still be done using the venerable telnet for syn packets but netcat or nemesis would be better). Regards, Anton Smith

1 0

SSH login attempts
by Philip D'Ath 14 Dec '04

14 Dec '04

We are getting lots of requests at the moment trying to log into one of our box's via SSH. It happens in 20 minute bursts, with a new request being tried every 6s. After the 20 minutes it goes away for 8 hours. It appears to be a straight dictionary attack, with the attempts cycling though usernames like root, user, test, john, henry, george, frank, alan, adam, server, backup, account, master, sybase, oracle, web, data, webmaster, noc, cip51, cip52, cosmin, pamela, jane, adm, irc, apache, operator, mysql, www-data, matt, www, wwwrun, cyrus, horde, iceuser, rolo, patrick, nobody. It spends most of its time trying to login as root. The requests are mostly coming from Russia, with a couple of other IP's from other countries. The device they are attempting to log into is not advertised in anyway, so was probably picked up during a normal port scan. For the moment I've limited connections to the box for SSH to only be accepted over IPSec, so that's the end of the login attempts. I guess what I'm posting this for is to make sure everybody has a good password policy in place. Someone is actively trying to compromise accounts via SSH.

6 6

Bedlam DL3
by James J. Guidera 14 Dec '04

14 Dec '04

As a Wednesday morning laugh, Many people read the blog on msdn on Bedlam DL3? Bit of a laugh.... http://blogs.msdn.com/exchange/archive/2004/04/08/109626.aspx Cheers James

2 1

XML schema for interface configuration
by Cameron Kerr 13 Dec '04

13 Dec '04

Does anyone know of, or has found a useful XML language for modelling network interface configuration? I just need the basics, more precisely IPv4 interfaces. Manual and DHCP configuration (maybe also ZeroConf) Subnetmask Routes (static, but dynamic would be good also) IPv6 interfaces. ??? DNS configuration Other stuff? (tunnels, p-t-p interfaces, ...) I could model one myself, but I would much prefer input from something more time-proven. I don't need anything with a formal schema. -- Cameron Kerr cameron(a)humbledown.org; http://humbledown.org

2 1

NZNOG Registrations
by Richard Nelson 09 Dec '04

09 Dec '04

Registrations for next years NZNOG Conference are now being accepted at http://www.nznog.org. The conference is again being hosted by the WAND Network Research Group at the University of Waikato. Last year we had 125 registrations. The largest lecture theatre holds 140 so places are strictly limited. There is a tutorial/workshop day before the conference. Tutorials that we have confirmed are: APNIC - IRME LinkIT - Trango Wireless InternetNZ - Spam Handling Accomodation is available on campus. Some rooms (28) are available with Ethernet ports which will be allocated first come first served. All prices and details are available on the website. Late registrations (after January 14) will incur late fees. The main overseas speakers will be confirmed shortly... Richard Nelson WAND.

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 08 Dec '04

08 Dec '04

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. The update causing these changes had the following mail headers: - From: Andy Linton <asjl(a)citylink.co.nz> - Cc: - Subject: - Date: Thu, 9 Dec 2004 12:48:25 +1300 (NZDT) - Msg-Id: <Pine.LNX.4.58.0412091247560.28480(a)jennings.citylink.co.nz> NZRR Database Notification Department --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS64597 descr: advertised to AS9439 by Araneo - AS64597 members: 202.53.189.128/29, 210.48.101.64/27^27-29, 210.48.109.224/27^27-29, 202.174.161.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: jon.brewer(a)araneo.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20041028 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS64597 descr: advertised to AS9439 by Araneo - AS64597 members: 202.53.189.128/29, 210.48.101.64/27^27-29, 210.48.101.112/29, 210.48.109.224/27^27-29, 202.174.161.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: jon.brewer(a)araneo.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20041209 source: NZRR

1 0

[Apnic-announce] Protecting historical records in the APNIC database (fwd)
by John Tran 05 Dec '04

05 Dec '04

Hi all, Just following from last week emails. Here is an announcement that could be interested to some of you. If you wish to know what happening in the APNIC community please subscribe to apnic-annouce mailing list which is available at: http://www.apnic.net/community/lists/index.html Regards son ---------- Forwarded message ---------- Date: Mon, 06 Dec 2004 14:56:11 +1000 From: APNIC Secretariat <secretariat(a)apnic.net> Reply-To: apnic-talk(a)apnic.net, secretariat(a)apnic.net To: apnic-announce(a)apnic.net Subject: [APNIC Members] [Apnic-announce] Protecting historical records in the APNIC database Dear colleagues, The APNIC Secretariat will implement a policy on 14 December 2004 to protect historical records in the APNIC database from unverified transfers, abuse, and unauthorised use. The proposal document, presentation, minutes, and discussion are available at: http://www.apnic.net/docs/policy/proposals/prop-018-v001.html Please note, after 14 December 2004, the maintainer of all historical resource registrations will be changed to "APNIC-HM". To ensure the integrity of information in the APNIC Whois Database, APNIC will not update historical information in the APNIC Whois Database unless the resource holder can establish its right to the resources and enters a formal agreement with APNIC, either as a member or as a non-member account holder. Further details and all supporting documentation will be available on 14 December. If you have any questions regarding this policy, please contact the APNIC helpdesk at: E-mail: helpdesk(a)apnic.net Phone: +61-7-3858-3188 Fax: +61-7-3858-3199 Regards ______________________________________________________________________ APNIC Secretariat <secretariat(a)apnic.net> Asia Pacific Network Information Centre (APNIC) Tel: +61-7-3858-3100 PO Box 2131 Milton, QLD 4064 Australia Fax: +61-7-3858-3199 Level 1, 33 Park Road, Milton, QLD http://www.apnic.net ---------------------------------------------------------------------- See you at APNIC 19 Kyoto, Japan, 21 - 25 February 2005 www.apnic.net/meetings ----------------------------------------------------------------------

1 0

APRICOT 2005
by Neil Fenemor 05 Dec '04

05 Dec '04

Can anyone who is going to be attending the next APRICOT in Kyoto, Japan, please drop me a message off list. I wish to discuss beer (just to keep this somewhat near being on topic) Cheers neil

1 0

Viruses originating from Xtra network
by Lesley Walker 05 Dec '04

05 Dec '04

Please forgive me if this is off-topic, I don't know anywhere else to ask for help. How does one get the attention of the abuse people at Xtra? A mailing list that I administer is being attacked by viruses that originate at a Jetstream address (details below). I sent email to abuse(a)xtra.co.nz a couple of days ago and have not had the courtesy of a response, not even a "sod off" answer, or even a bounce. The viruses come in batches from a consistent IP address - the address has changed a couple of times but I think it's the same infected machine because the messages have a consistent "look and feel". The received header looks like this: Received: from srunjn.com (210-86-89-213.jetstream.xtra.co.nz [210.86.89.213]) by [munged] with SMTP id iB1CGab26947; Thu, 2 Dec 2004 01:16:36 +1300 (NZDT) The envelope "from" appears to be randomly generated nonsense as it is different every time, but the originating IP address is consistent for each batch. The messages are designed to look like bounces from various ISPs and companies but in fact contain virus attachments. The latest originating address is 210.86.90.246, as at Sat, 4 Dec 2004 08:36:21 +1300 (NZDT) -- Lesley Walker, Wellington, New Zealand LRW(a)clear.net.nz http://home.clear.net.nz/pages/lrw http://walkinguphills.blogspot.com/

11 12

Re: [nznog] Viruses originating from Xtra network
by Lesley Walker 04 Dec '04

04 Dec '04

Glen wrote: >As one would expect, Xtra get a fair few notifications and I must admit that >I was more than a little surprised to find that their 'abuse team' are the >most responsive of all the ISPs in NZ !! They acknowledge the notifications >by automated return mail and as each incident is closed we get a closure >report. I spoke with them by phone when we were getting the system setup and >they were very supportive and helpful. Then I have to conclude that my email didn't actually get through. But I haven't received a bounce, so it must have been dropped into the bit-bucket somewhere along the way. I must admit it's easy to fall into the trap of treating email as if it were a guaranteed-delivery system so if I've maligned them unfairly I apologise, and I'll try again and see what happens. >Most of the ISPs we send the notifications to are taking them seriously and >do do something. Private companies that have no abuse, no postmaster >address etc are proving to be a pain and there are quite a few of them. I can relate to that! Thanks for your comments. Lesley.

1 0