- NZNOG - lists.nznog.org

FW: Help! Cistron major failure in production! (fwd)
by Matt Camp 26 Jul '01

26 Jul '01

Anyone had any experience with cistron radius? I'm suffering some sort of major magic weridy problem, if anyone has any ideas. --- Matt Camp ---------- Forwarded message ---------- Date: Wed, 25 Jul 2001 17:24:51 +1200 (NZST) From: Matt Camp <gargoyle(a)noise.net.nz> To: cistron-radius(a)lists.cistron.nl Subject: Help! Cistron major failure in production! I run a network of 4 cistron 1.6.3 servers on FreeBSD machines. This afternoon, all 4 of them stopped responding. Its as like the radiusd process isn't running. Neither our lucent NAS gear, radtest, or the various people who have proxys pointed at our servers get any response at all. The server logs, and console when running in -xxx mode show that the server starts, and then is just waiting for connections. Every 5 minutes, i propagate a new raddb/users file out from a central host. This system has worked fine for around 18 months now. On _ONE_ of the servers, if i restart it (totally. Kill and restart radiusd), the log shows "Wed Jul 25 17:21:38 2001: Info: Starting - reading configuration files ...", then there is nothing for approximately 4 minutes, after which it appears to process all the requests that have been sent to it during that time. (of course, most of them actually fail in reality since the NAS has long since dropped the call). Then it will run fine, up until it detects a new users file, and reloads the config files, at which point its back into total non-responsiveness until i manually restart it. This only works on one server. The other 3 don't come back at all, even after a restart. ANd they're all on the same config. (Which i rsync to them after making a change) radtest tests from localhost which normally work fine just act exactly as if the radiusd process isn't even running. I've tried everything i can think of, including the microsoft approach of power-cycling all machines involved. Load averages are normal, disk space is fine. Heaps of memory available. File descriptor loads seem ok, in that there are only around 100 or so connections to each box in total. (for the other services they run) Any ideas? This is urgent... I've got thousands customers who can't log in right now. --- Matt Camp --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

7 8

xtra rejecting mail from mailing lists?
by Simon Blake 25 Jul '01

25 Jul '01

Hi folks I've got a mailing list on one of my servers that appears to have a bunch of xtra subscribers on it. Postings to the list get sent to about the first 10 xtra users, and then I start getting: Jul 25 21:49:03 wilbur qmail: 996054543.173139 delivery 2330: deferral: Connected_to_203.96.92.131_but_greeting_failed./Remote_host_said: _421_mta4-rme.xtra.co.nz_connection_refused_from_[203.97.152.50]/ It's a fairly unhelpful message from xtra, I assume it's some kind of antispam rate limiting thing - anybody know what they're up to? These things appear to get delivered later, since I've not had any grizzles about non delivery of mail (and there's nothing in the qmail queue). Cheers Si --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

9 13

RE: IDG article.
by David Buckingham 25 Jul '01

25 Jul '01

Privacy Act 1993 028 Commenced: 1 Jul 1993 VI: Codes of Practice and Exemptions from Information Privacy Principles Specific Exemptions 55 Certain personal information excluded 55. Certain personal information excluded---Nothing in principle 6 or principle 7 applies in respect of--- (a) Personal information in the course of transmission by post, telegram, cable, telex, facsimile transmission, electronic mail, or other similar means of communication; or (b) Evidence given or submissions made to--- (i) A Royal Commission; or (ii) A commission of inquiry appointed by an Order in Council made under the Commissions of Inquiry Act 1908,--- at any time before the report of the Royal Commission or commission of inquiry has been published or, in the case of evidence or submissions given or made in the course of a sitting open to the public, at any time before the Royal Commission or commission of inquiry has reported to the Governor-General; or (c) Evidence given or submissions made to a commission of inquiry or board of inquiry or court of inquiry or committee of inquiry appointed, pursuant to, and not by, any provision of an Act, to inquire into a specified matter; or (d) Information contained in any correspondence or communication that has taken place between the office of the Ombudsmen and any agency and that relates to any investigation conducted by an Ombudsman under the Ombudsmen Act 1975 or the Official Information Act 1982 or the Local Government Official Information and Meetings Act 1987, other than information that came into existence before the commencement of that investigation; or (e) Information contained in any correspondence or communication that has taken place between the office of the Commissioner and any agency and that relates to any investigation conducted by the Commissioner under this Act, other than information that came into existence before the commencement of that investigation. PRINCIPLE 6 Access to personal information (1) Where an agency holds personal information in such a way that it can readily be retrieved, the individual concerned shall be entitled--- (a) To obtain from the agency confirmation of whether or not the agency holds such personal information; and (b) To have access to that information. (2) Where, in accordance with subclause (1) (b) of this principle, an individual is given access to personal information, the individual shall be advised that, under principle 7, the individual may request the correction of that information. (3) The application of this principle is subject to the provisions of Parts IV and V of this Act. (This part is from section 6 of the act)... PRINCIPLE 7 Correction of personal information (1) Where an agency holds personal information, the individual concerned shall be entitled--- (a) To request correction of the information; and (b) To request that there be attached to the information a statement of the correction sought but not made. (2) An agency that holds personal information shall, if so requested by the individual concerned or on its own initiative, take such steps (if any) to correct that information as are, in the circumstances, reasonable to ensure that, having regard to the purposes for which the information may lawfully be used, the information is accurate, up to date, complete, and not misleading. (3) Where an agency that holds personal information is not willing to correct that information in accordance with a request by the individual concerned, the agency shall, if so requested by the individual concerned, take such steps (if any) as are reasonable in the circumstances to attach to the information, in such a manner that it will always be read with the information, any statement provided by that individual of the correction sought. (4) Where the agency has taken steps under subclause (2) or subclause (3) of this principle, the agency shall, if reasonably practicable, inform each person or body or agency to whom the personal information has been disclosed of those steps. (5) Where an agency receives a request made pursuant to subclause (1) of this principle, the agency shall inform the individual concerned of the action taken as a result of the request. -----Original Message----- From: owner-nznog(a)list.waikato.ac.nz [mailto:owner-nznog(a)list.waikato.ac.nz]On Behalf Of Greg Clare Sent: Thursday, 26 July 2001 1:23 p.m. To: nznog(a)list.waikato.ac.nz Subject: RE: IDG article. Does this mean that what was originally reported and quoted as having been said by someone, has now been edited and changed? Does this constitute creative reporting? By chance does the article include an addendum to state that it has since been edited due to people or terms being mis-quoted... for the archive of course ;) Greg > -----Original Message----- > From: Simon Lyall [mailto:simon.lyall(a)ihug.co.nz] > Sent: Thursday, 26 July 2001 12:46 pm > To: nznog(a)list.waikato.ac.nz > Subject: IDG article. > > > Looks like they have gone through and changed all the mentions of > "newsgroups" to "mailing list" and changed other stuff around. > > This includes the the stuff in quotes. > > -- > Simon Lyall. | Newsmaster | Work: > simon.lyall(a)ihug.co.nz > Senior Network/System Admin | Postmaster | Home: > simon(a)darkmere.gen.nz > ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

IDG article.
by Simon Lyall 25 Jul '01

25 Jul '01

Looks like they have gone through and changed all the mentions of "newsgroups" to "mailing list" and changed other stuff around. This includes the the stuff in quotes. -- Simon Lyall. | Newsmaster | Work: simon.lyall(a)ihug.co.nz Senior Network/System Admin | Postmaster | Home: simon(a)darkmere.gen.nz ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

RE: IDG article.
by Greg Clare 25 Jul '01

25 Jul '01

Does this mean that what was originally reported and quoted as having been said by someone, has now been edited and changed? Does this constitute creative reporting? By chance does the article include an addendum to state that it has since been edited due to people or terms being mis-quoted... for the archive of course ;) Greg > -----Original Message----- > From: Simon Lyall [mailto:simon.lyall(a)ihug.co.nz] > Sent: Thursday, 26 July 2001 12:46 pm > To: nznog(a)list.waikato.ac.nz > Subject: IDG article. > > > Looks like they have gone through and changed all the mentions of > "newsgroups" to "mailing list" and changed other stuff around. > > This includes the the stuff in quotes. > > -- > Simon Lyall. | Newsmaster | Work: > simon.lyall(a)ihug.co.nz > Senior Network/System Admin | Postmaster | Home: > simon(a)darkmere.gen.nz > ihug, Auckland, NZ | Asst Doorman | Web: http://www.darkmere.gen.nz --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

prefix list update
by James Tyson 25 Jul '01

25 Jul '01

Can all Attica's BGP peers please update their filters: ip prefix-list attica-networks seq 5 permit 202.180.96.0/19 ip prefix-list attica-networks seq 10 permit 202.180.64.0/18 le 19 ip prefix-list attica-networks seq 15 permit 210.55.254.0/24 ip prefix-list attica-networks seq 20 permit 210.55.5.0/24 ip prefix-list attica-networks seq 25 permit 202.50.170.0/24 ip prefix-list attica-networks seq 30 permit 202.55.111.0/24 Cheers. James Tyson --- Samizdat New Media Solutions --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

3 5

RE: xtra rejecting mail from mailing lists?
by Jeremy Clyma 25 Jul '01

25 Jul '01

At 08:17 26/07/2001 +1200, Tech Support wrote: > >On Wed, 25 Jul 2001, Simon Blake wrote: > >> I've got a mailing list on one of my servers that appears to have a > >> bunch of xtra subscribers on it. Postings to the list get sent to about > >> the first 10 xtra users, and then I start getting: > >I had someone come up to me with this too. > >Apparently when they rang up the helpdesk about it they were told > >it wasn't xtra's problem. All I did was suggest they forward the > >bounce to postmaster(a)xtra hoping someone does read email there. > > > >With the 2 examples I saw, it was bouncing emails sent to domains that > >were not hosted at xtra. However emails were sent by xtra customers > >using xtra's smtp server. One of them tried xtra's smtp server after > >they had a problem sending from their own in-house smtp server (thus > >eliminating perhaps a possible problem with their server). > > > >I'll try to get the actual bounce emailed to me. I think it said > >something about being unable to relay email > > > >Lin > >Hmmm, perhaps Xtra subscribe to ORBS, and have blacklisted their own >server..... ;) /sv_tui_ad Yeah. Right. Looks like its a transient error, one which could be caused by the backoff limits we've got in place. Simon, do you know how many concurrent smtp connections was your server attempting to open? --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Fwd: 'we should all be uncomfortable with the extent to which luck..' (fwd)
by n.brownlee＠auckland.ac.nz 25 Jul '01

25 Jul '01

Hello all: You might find this article interesting reading ... Cheers, Nevil ------------------------------------------------------------- Nevil Brownlee Internet Researcher Phone: (858) 534 8338 CAIDA, San Diego ---------- Forwarded message ---------- Date: Tue, 24 Jul 2001 22:35:37 -0700 From: k claffy <kc(a)caida.org> To: nanog(a)nanog.org Cc: caida(a)caida.org Subject: 'we should all be uncomfortable with the extent to which luck..' david moore's analysis of code red: episode 0/1 is at http://www.caida.org/analysis/security/code-red/ [funded by DARPA's ITO office NGI/NMS programs, NSF ANIR, and CAIDA members, david a caida PI] definitely check out jeff brown's animation at bottom; watch carefully around 15:00 for pretty ominous elbow in infection rate (get an epidemiologist to look at it without telling them what it is...) 360,000 machines (well, IP addresses) infected in under 14 hours. from conclusion: // ..in the final analysis, we should all be uncomfortable with the extent to which luck, rather than proactive diligence, maintains the stability of the Internet infrastructure. // it goes without saying that many hosts are still vulnerable. and will likely remain so (to this or the next poison) until our luck runs out. do we expect the next version to have the two weaknesses christopher pointed out today? do we expect the next version won't clear every 3rd bit on the hard drive? almost makes me wonder if some white hat might (should?) have been behind CodeRed as some 'vaccination' attempt. "The bad news is, nobody will do anything about critical infrastructure protection until there's a global catastrophic failure," said Rasch. The good news is, there will be a global catastrophic failure." -- http://www.nando.net/technology/story/44887p-694372c.html the worse news is: protecting 'critical infrastructure' is far from enough. again from http://www.caida.org/analysis/security/code-red/ This assault also demonstrates that machines operated by home users or small businesses (hosts less likely to be maintained by a professional sysadmin) are integral to the robustness of the global Internet. As is the case with biologically active pathogens, vulnerable hosts can and do put everyone at risk, regardless of the significance of their role in the population. fwiw, caida trying to do gentle survey of patching speed, see http://worm-security-survey.caida.org/ k ps: john maddog hall (linux int'l) had a great slide a few months ago at UCSD talk; upshot something like INSTALLED BASE (EARTH) + 20 million linux systems + 450 million gates licenses ==> 4.4 - 6.6 % of the population total ... world population: ~6B ==> 5.4 billion people haven't selected an OS yet [k: maybe we can get them on OS-antioxidants before it's too late] --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

RE: xtra rejecting mail from mailing lists?
by Tech Support 25 Jul '01

25 Jul '01

>On Wed, 25 Jul 2001, Simon Blake wrote: >> I've got a mailing list on one of my servers that appears to have a >> bunch of xtra subscribers on it. Postings to the list get sent to about >> the first 10 xtra users, and then I start getting: >I had someone come up to me with this too. >Apparently when they rang up the helpdesk about it they were told >it wasn't xtra's problem. All I did was suggest they forward the >bounce to postmaster(a)xtra hoping someone does read email there. > >With the 2 examples I saw, it was bouncing emails sent to domains that >were not hosted at xtra. However emails were sent by xtra customers >using xtra's smtp server. One of them tried xtra's smtp server after >they had a problem sending from their own in-house smtp server (thus >eliminating perhaps a possible problem with their server). > >I'll try to get the actual bounce emailed to me. I think it said >something about being unable to relay email > >Lin Hmmm, perhaps Xtra subscribe to ORBS, and have blacklisted their own server..... ;) Peter Gray Telstra Saturn Tech Support E-mail: tech(a)tsnz.net Phone: 0800 949 000 Fax: 04 922 8401 Website: www.netlink.net.nz PO Box 5358, Wellington, New Zealand "Smile," they said "things could be worse!" So I smiled, and things were worse.... --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

'we should all be uncomfortable with the extent to which luck..'
by k claffy 24 Jul '01

24 Jul '01

david moore's analysis of code red: episode 0/1 is at http://www.caida.org/analysis/security/code-red/ [funded by DARPA's ITO office NGI/NMS programs, NSF ANIR, and CAIDA members, david a caida PI] definitely check out jeff brown's animation at bottom; watch carefully around 15:00 for pretty ominous elbow in infection rate (get an epidemiologist to look at it without telling them what it is...) 360,000 machines (well, IP addresses) infected in under 14 hours. from conclusion: // ..in the final analysis, we should all be uncomfortable with the extent to which luck, rather than proactive diligence, maintains the stability of the Internet infrastructure. // it goes without saying that many hosts are still vulnerable. and will likely remain so (to this or the next poison) until our luck runs out. do we expect the next version to have the two weaknesses christopher pointed out today? do we expect the next version won't clear every 3rd bit on the hard drive? almost makes me wonder if some white hat might (should?) have been behind CodeRed as some 'vaccination' attempt. "The bad news is, nobody will do anything about critical infrastructure protection until there's a global catastrophic failure," said Rasch. The good news is, there will be a global catastrophic failure." -- http://www.nando.net/technology/story/44887p-694372c.html the worse news is: protecting 'critical infrastructure' is far from enough. again from http://www.caida.org/analysis/security/code-red/ This assault also demonstrates that machines operated by home users or small businesses (hosts less likely to be maintained by a professional sysadmin) are integral to the robustness of the global Internet. As is the case with biologically active pathogens, vulnerable hosts can and do put everyone at risk, regardless of the significance of their role in the population. fwiw, caida trying to do gentle survey of patching speed, see http://worm-security-survey.caida.org/ k ps: john maddog hall (linux int'l) had a great slide a few months ago at UCSD talk; upshot something like INSTALLED BASE (EARTH) + 20 million linux systems + 450 million gates licenses ==> 4.4 - 6.6 % of the population total ... world population: ~6B ==> 5.4 billion people haven't selected an OS yet [k: maybe we can get them on OS-antioxidants before it's too late] --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0