- NZNOG - lists.nznog.org

SSH login attempts
by Philip D'Ath 14 Dec '04

14 Dec '04

We are getting lots of requests at the moment trying to log into one of our box's via SSH. It happens in 20 minute bursts, with a new request being tried every 6s. After the 20 minutes it goes away for 8 hours. It appears to be a straight dictionary attack, with the attempts cycling though usernames like root, user, test, john, henry, george, frank, alan, adam, server, backup, account, master, sybase, oracle, web, data, webmaster, noc, cip51, cip52, cosmin, pamela, jane, adm, irc, apache, operator, mysql, www-data, matt, www, wwwrun, cyrus, horde, iceuser, rolo, patrick, nobody. It spends most of its time trying to login as root. The requests are mostly coming from Russia, with a couple of other IP's from other countries. The device they are attempting to log into is not advertised in anyway, so was probably picked up during a normal port scan. For the moment I've limited connections to the box for SSH to only be accepted over IPSec, so that's the end of the login attempts. I guess what I'm posting this for is to make sure everybody has a good password policy in place. Someone is actively trying to compromise accounts via SSH.

6 6

Bedlam DL3
by James J. Guidera 14 Dec '04

14 Dec '04

As a Wednesday morning laugh, Many people read the blog on msdn on Bedlam DL3? Bit of a laugh.... http://blogs.msdn.com/exchange/archive/2004/04/08/109626.aspx Cheers James

2 1

XML schema for interface configuration
by Cameron Kerr 13 Dec '04

13 Dec '04

Does anyone know of, or has found a useful XML language for modelling network interface configuration? I just need the basics, more precisely IPv4 interfaces. Manual and DHCP configuration (maybe also ZeroConf) Subnetmask Routes (static, but dynamic would be good also) IPv6 interfaces. ??? DNS configuration Other stuff? (tunnels, p-t-p interfaces, ...) I could model one myself, but I would much prefer input from something more time-proven. I don't need anything with a formal schema. -- Cameron Kerr cameron(a)humbledown.org; http://humbledown.org

2 1

NZNOG Registrations
by Richard Nelson 09 Dec '04

09 Dec '04

Registrations for next years NZNOG Conference are now being accepted at http://www.nznog.org. The conference is again being hosted by the WAND Network Research Group at the University of Waikato. Last year we had 125 registrations. The largest lecture theatre holds 140 so places are strictly limited. There is a tutorial/workshop day before the conference. Tutorials that we have confirmed are: APNIC - IRME LinkIT - Trango Wireless InternetNZ - Spam Handling Accomodation is available on campus. Some rooms (28) are available with Ethernet ports which will be allocated first come first served. All prices and details are available on the website. Late registrations (after January 14) will incur late fees. The main overseas speakers will be confirmed shortly... Richard Nelson WAND.

1 0

Notification of NZRR Database changes
by NZRR Database Notifications 08 Dec '04

08 Dec '04

Dear Colleague, This is to notify you that some object(s) in NZRR database which you either maintain or are listed as to-be-notified have been added, deleted or changed. These objects are used to configure the various NZIX route servers (http://nzix.net/) so you can expect the relevant servers to be reloaded in the near future. The reloading of the servers is staggered over a period of time so that if you are peering with both servers at an exchange, you can maintain at least one BGP session at all times and consequently a full set of routes. The update causing these changes had the following mail headers: - From: Andy Linton <asjl(a)citylink.co.nz> - Cc: - Subject: - Date: Thu, 9 Dec 2004 12:48:25 +1300 (NZDT) - Msg-Id: <Pine.LNX.4.58.0412091247560.28480(a)jennings.citylink.co.nz> NZRR Database Notification Department --- PREVIOUS OBJECT: route-set: AS9439:RS-ROUTES:AS64597 descr: advertised to AS9439 by Araneo - AS64597 members: 202.53.189.128/29, 210.48.101.64/27^27-29, 210.48.109.224/27^27-29, 202.174.161.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: jon.brewer(a)araneo.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20041028 source: NZRR REPLACED BY: route-set: AS9439:RS-ROUTES:AS64597 descr: advertised to AS9439 by Araneo - AS64597 members: 202.53.189.128/29, 210.48.101.64/27^27-29, 210.48.101.112/29, 210.48.109.224/27^27-29, 202.174.161.0/24^24-29 admin-c: RPA1-NZRR tech-c: RPA1-NZRR notify: rpsl-admin(a)nzix.net notify: nznog(a)list.waikato.ac.nz notify: jon.brewer(a)araneo.net.nz mnt-by: MAINT-NZRR-NZ changed: rpsl-admin(a)nzix.net 20041209 source: NZRR

1 0

[Apnic-announce] Protecting historical records in the APNIC database (fwd)
by John Tran 05 Dec '04

05 Dec '04

Hi all, Just following from last week emails. Here is an announcement that could be interested to some of you. If you wish to know what happening in the APNIC community please subscribe to apnic-annouce mailing list which is available at: http://www.apnic.net/community/lists/index.html Regards son ---------- Forwarded message ---------- Date: Mon, 06 Dec 2004 14:56:11 +1000 From: APNIC Secretariat <secretariat(a)apnic.net> Reply-To: apnic-talk(a)apnic.net, secretariat(a)apnic.net To: apnic-announce(a)apnic.net Subject: [APNIC Members] [Apnic-announce] Protecting historical records in the APNIC database Dear colleagues, The APNIC Secretariat will implement a policy on 14 December 2004 to protect historical records in the APNIC database from unverified transfers, abuse, and unauthorised use. The proposal document, presentation, minutes, and discussion are available at: http://www.apnic.net/docs/policy/proposals/prop-018-v001.html Please note, after 14 December 2004, the maintainer of all historical resource registrations will be changed to "APNIC-HM". To ensure the integrity of information in the APNIC Whois Database, APNIC will not update historical information in the APNIC Whois Database unless the resource holder can establish its right to the resources and enters a formal agreement with APNIC, either as a member or as a non-member account holder. Further details and all supporting documentation will be available on 14 December. If you have any questions regarding this policy, please contact the APNIC helpdesk at: E-mail: helpdesk(a)apnic.net Phone: +61-7-3858-3188 Fax: +61-7-3858-3199 Regards ______________________________________________________________________ APNIC Secretariat <secretariat(a)apnic.net> Asia Pacific Network Information Centre (APNIC) Tel: +61-7-3858-3100 PO Box 2131 Milton, QLD 4064 Australia Fax: +61-7-3858-3199 Level 1, 33 Park Road, Milton, QLD http://www.apnic.net ---------------------------------------------------------------------- See you at APNIC 19 Kyoto, Japan, 21 - 25 February 2005 www.apnic.net/meetings ----------------------------------------------------------------------

1 0

APRICOT 2005
by Neil Fenemor 05 Dec '04

05 Dec '04

Can anyone who is going to be attending the next APRICOT in Kyoto, Japan, please drop me a message off list. I wish to discuss beer (just to keep this somewhat near being on topic) Cheers neil

1 0

Viruses originating from Xtra network
by Lesley Walker 05 Dec '04

05 Dec '04

Please forgive me if this is off-topic, I don't know anywhere else to ask for help. How does one get the attention of the abuse people at Xtra? A mailing list that I administer is being attacked by viruses that originate at a Jetstream address (details below). I sent email to abuse(a)xtra.co.nz a couple of days ago and have not had the courtesy of a response, not even a "sod off" answer, or even a bounce. The viruses come in batches from a consistent IP address - the address has changed a couple of times but I think it's the same infected machine because the messages have a consistent "look and feel". The received header looks like this: Received: from srunjn.com (210-86-89-213.jetstream.xtra.co.nz [210.86.89.213]) by [munged] with SMTP id iB1CGab26947; Thu, 2 Dec 2004 01:16:36 +1300 (NZDT) The envelope "from" appears to be randomly generated nonsense as it is different every time, but the originating IP address is consistent for each batch. The messages are designed to look like bounces from various ISPs and companies but in fact contain virus attachments. The latest originating address is 210.86.90.246, as at Sat, 4 Dec 2004 08:36:21 +1300 (NZDT) -- Lesley Walker, Wellington, New Zealand LRW(a)clear.net.nz http://home.clear.net.nz/pages/lrw http://walkinguphills.blogspot.com/

11 12

Re: [nznog] Viruses originating from Xtra network
by Lesley Walker 04 Dec '04

04 Dec '04

Glen wrote: >As one would expect, Xtra get a fair few notifications and I must admit that >I was more than a little surprised to find that their 'abuse team' are the >most responsive of all the ISPs in NZ !! They acknowledge the notifications >by automated return mail and as each incident is closed we get a closure >report. I spoke with them by phone when we were getting the system setup and >they were very supportive and helpful. Then I have to conclude that my email didn't actually get through. But I haven't received a bounce, so it must have been dropped into the bit-bucket somewhere along the way. I must admit it's easy to fall into the trap of treating email as if it were a guaranteed-delivery system so if I've maligned them unfairly I apologise, and I'll try again and see what happens. >Most of the ISPs we send the notifications to are taking them seriously and >do do something. Private companies that have no abuse, no postmaster >address etc are proving to be a pain and there are quite a few of them. I can relate to that! Thanks for your comments. Lesley.

1 0

Re: [nznog] Viruses originating from Xtra network
by Lesley Walker 03 Dec '04

03 Dec '04

Thanks to all who have commented. I will try again when I have time to wait out the infinite hold, and I may try that "Complex" number. I do understand about the need for the IVR to do the right thing for the company's needs, it just bugs the hell out of me that it keeps trying to send me to a sales dude when I'm trying to reach support people. I'm prepared for coping with call centre helpdesk people, if only I can get through to them. I know I sent them enough information to track the user when I emailed them, but what I don't know is whether anyone is paying any attention to the email. A response with a trouble ticket number would be nice, but even an auto-responder would let me know for sure that the mail got through. In the absence of a bounce, I would expect at least an auto-response. Mark Foster wrote: >Noone you talk to over the telephone is going to give you real time >support on a virus infection issue. Of course not. All I want them to do is log a trouble ticket and send it to someone who can (a) understand it, and (b) do something about it. >Their security team do deal with all valid emails to abuse@ even if they >don't acknowledge them directly. Also please bear in mind that nomatter >what ISP is involved, all customers need time to be warned, and get fixed, >before theyll have their accounts nuked. Its a tough call to take someone >off the internet when their only hope is software that needs to be >downloaded _from_ the internet... Sure. But someone who is sufficiently Internet-enabled to have Jetstream probably either has a clue or knows somebody who does, and I would hope that they just need to to be told about it. >Disclaimer: I don't represent Xtra or Telecom or anyone else except yours >truly. This is based on my experiences as an Xtra customer and someone who >has reported virus to Xtra Abuse Team many times! Accepted. >PS: The 'Dial 0' trick is a cop out. With a company as big as Xtra, you >can't realistically expect them to leave a Dial 0 option in there _and >then_ expect to keep call durations down - you wont get the answer you >want from a receptionist, will you? No, but if the IVR doesn't provide appropriate options, I expect a receptionist to be able to put me through to somebody appropriate. They're supposed to know who does what in their organisation. > If their support staff are busy, >theyre busy. Sit on hold, try again later, or email them. (And hope that >they realise their Queues are busy (and they will, theres enough software >there tracking their Queue stats) and modify staffing levels as a result >(also standard callcentre practise.) I hope I don't have to keep waiting while they go out and hire more staff. That'd be a pretty long call! :-) (The batteries in my phone woulf go flat) Thanks again. Lesley.

1 0