- NZNOG - lists.nznog.org

Updating tech contact info at Domainz
by Joe Abley 08 May '00

08 May '00

Hey, Perhaps someone who has stuck with the Domainz/Glazier testing for longer than me could tell me how to do this: I want to update my contact details in all the domain records for which I am listed as technical contact. I don't have an accurate list of domains that fit that criteria; I just want to change _all_ of them. In the old system, accomplishing this would be a case of performing a zone transfer, enumerating every possible domain I could be associated with, pulling the registry data for each domain in turn and discarding those that don't match a proscribed regular expression on the tech_contact field (or whatever it was called). Does the new system provide anything better than this? I have an inkling that holder_contact fields are normalised, but I don't think the tech contact fields are. If anybody can tell me an easy way to do this, I'd be keen to hear it. [Interesting to note that this is a trivial exercise in the original InterNIC and RIPE database schemas, which featured published database keys for person/contact objects (NIC handles) and were designed more or less by accident twenty years ago :)] --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

2 1

FW: [DRS] DRS roll-out
by Peter Mott 07 May '00

07 May '00

Looks like the monopoly .nz registrar DOMAINZ is going to be yet another day off line. I wonder what the next delay will be, an earthquake in wellington? p.s. Looks like somebody needs to donate them a UPS or two, apparently they haven't thought of the need for them yet. Regards Peter Mott Chief Enthusiast 2day.com -/- > -----Original Message----- > From: drs-admin(a)domainz.net.nz [mailto:drs-admin(a)domainz.net.nz]On > Behalf Of Andrew McEwen Mason > Sent: Monday, 8 May 2000 8:24 p.m. > To: DRS(a)domainz.net.nz > Subject: [DRS] DRS roll-out > > > Greetings to all > > > This is an update on where we are with the roll-out. > > As Andrew Jamieson notified earlier today, we have made good progress, but > unfortunately we have been struck with a number of problems effectively > outside our control, especially power cuts which (while they haven't done > any damage to the servers) have made it very difficult for staff > to connect > to the systems for testing. The situation was compounded by a major fire > alarm which also happened this morning! > > Be that as it may, we are confident that the name-nameholder data > on the new > system is as it should be, and that the zone file creation process is > working as we expected. There are a few issues to clear up with some > accounting data on a small number of domains, and we still need > to generate > randomised IDs and passwords, but apart from that we are looking pretty > good. > > We obviously want to be entirely sure that the system, the data > and the zone > files are absolutely as they should be before releasing them. We are > therefore planning to work through the night on them with a view to > releasing the system with everything working to Registrars at 09.00am > tomorrow (9th May 2000). We then plan to have the system fully > live to the > world on Wednesday 10th May 2000. > > Our apologies that the system roll-out has been delayed by a day > or so. We > hope it has not been too much of an inconvenience for you. We will notify > you as soon as the system is ready for use, with your Registrar > logon ID and > password for testing. > > _________________________________ > Andrew McEwen Mason > BSA Consulting Group > 7 Mariri Road, Kelburn > Wellington, NZ > > Phone +64 4 934-3178 Mobile +64 21 466-181 > > > _______________________________________________ > DRS mailing list > DRS(a)domainz.net.nz > http://listserver.actrix.co.nz/mailman/listinfo/drs --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

ORBS.
by Roger De Salis 07 May '00

07 May '00

By chance... since you lot have been particularly noisy this weekend on the subject of ORBS, I wanted to obtain a more rounded opinion of the value of ORBS with respect to SPAM Prevention. ISOCNZ has charged myself and three others with coming up with a policy concerning ORBS and potentially other SPAM prevention methods. :-( My understanding of the situation is as follows:- Paul Vixie contributes to/manages???? an RBL repository of Open Mail Relays on the side of www.vix.com. ie MAPS and RBL. How many carriers (even carriers with only 6 staff...) in NZ piggyback off this effort? And contribute? ORBS is a similar idea, run by AB of Manawatu Internet Services. An area of concern is that ORBS uses a method of publicity to shame Open-Relay holders into changing their status. However the publicity mechanism can also be used by Spammers to work out best SPAM procreation locations. How useful is this, and are their better ways of doing it? ========================================================= Should NZ ISP's all support RBL/MAPS? (realising that there is no requirement today, other than best customer service and best endeavours.) Is ORBS complementary? Is it appropriate? What do others think? Should ISOCNZ but out of this matter, and stick to mindlessly boring meetings with 10,000 points of order? Flames to myself at Cisco. Fabulously written, illuminating, insightful pieces will certainly receive a direct response of thanks and comments. All others >/dev/null. Rgds Roger De Salis -- \_ Roger De Salis Cisco Systems NZ Ltd </' +64 25 481 452 L3, 117 Customhouse Qy /) +64 4 473 4912 Wellington, New Zealand (/ roger(a)desalis.gen.nz rdesalis(a)cisco.com ` --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

[off-topic] Re: 2.7 ordering (fwd)
by Joe Abley 06 May '00

06 May '00

Ah. Looks like I jumped the gun :) ---------- Forwarded message ---------- Date: Sat, 06 May 2000 20:00:07 -0600 From: Theo de Raadt <deraadt(a)cvs.openbsd.org> To: Joe Abley <jabley(a)automagic.org> Cc: misc(a)openbsd.org Subject: Re: 2.7 ordering > Am I correct in thinking that the aim is a 2.7 release on May 19? No. June 15 this time around. > Anybody know when the on-line ordering page will be taking orders on 2.7 > media? When we have artwork :-) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

ORBS blocking
by Andy Linton 06 May '00

06 May '00

I haven't seen all of the messages posted in nznog on this subject so forgive me if I go over some ground that has been covered already. I'd like to make it quite clear to all NZ operators reading this that neither Telstra Saturn or any of its operating companies have any rules in place on their routers which are blocking traffic from the ORBS tester, relaytest.orbs.vuurwerk.nl We have not had any such rules and I am more than happy to make arrangements for an independant party to inspect the relevant router configurations and the audit trail of those configurations which is kept under RCS. Alan Brown has published a traceroute which he says demonstrates that Telstra Australia is blocking traffic. I have inspected the configuration of the pad19 router and no such filter exists on that host. Let me remind you of his posting: [RelayTst(a)amersfoort alan]$ /usr/sbin/traceroute 203.97.144.41 traceroute to 203.97.144.41 (203.97.144.41), 30 hops max, 40 byte packets 1 router (194.178.232.1) 0.871 ms 0.928 ms 1.077 ms 2 border (194.178.232.125) 0.834 ms 0.726 ms 0.688 ms 3 Vuurwerk.cust.ip.versatel.net (212.189.159.237) 1.132 ms 1.047 ms 1.152 m ... 16 199.37.127.190 (199.37.127.190) 284.622 ms 277.222 ms 288.499 ms 17 205.174.74.34 (205.174.74.34) 414.984 ms 406.353 ms 396.054 ms 18 FastEthernet0-0-0.pad19.Sydney.telstra.net (203.50.13.68) 399.113 ms 381.658 ms 405.766 ms 19 * * * 20 * * * 21 * * * 22 * * * He says this demonstrates that Telstra is blocking his tester. It does no such thing. The explanation is straightforward but not obvious. Traffic to 203.97.144.41 under the above traceroute was taking a path to New Zealand via Sydney at the time of the traceroute. The return path from Sydney is: pad19.Sydney>traceroute 194.178.232.55 Type escape sequence to abort. Tracing the route to relaytest.orbs.vuurwerk.nl (194.178.232.55) 1 FastEthernet1-0-0.pad16.Sydney.telstra.net (203.50.13.67) 0 msec 0 msec 0 msec 2 205.174.74.33 220 msec 220 msec 224 msec 3 199.37.127.193 [AS 5727] 220 msec 220 msec 224 msec 4 POS2-0-0.GW5.SFO4.ALTER.NET (157.130.197.77) [AS 701] 224 msec 220 msec 224 msec 5 145.ATM3-0.XR2.SFO4.ALTER.NET (146.188.149.38) [AS 701] 224 msec 220 msec 224 msec 6 190.at-1-0-0.TR2.SAC1.ALTER.NET (152.63.51.10) [AS 701] 224 msec 228 msec 228 msec 7 127.at-6-1-0.TR2.NYC9.ALTER.NET (152.63.6.81) [AS 701] 304 msec 308 msec 308 msec 8 186.ATM6-0.XR2.NYC1.ALTER.NET (152.63.21.73) [AS 701] 304 msec 308 msec 304 msec .... The next hop that a packet takes on route to 203.97.144.41 is to Telstra Australia's router in Auckland. This is Telstra Saturn's interconnect point with Telstra Australia. The nzsx-core1 router has two paths out of New Zealand, one to pad19 and the other to above.net at the PAIX. The preferred path for return packets to relaytest.orbs.vuurwerk.nl on that router in Auckland is via the direct route to Palo Alto. So we have an assymetric path from the site in the Netherlands to 203.97.144.41 on that trans Pacific part of the packet flow. Why is this important? Because above.net appear to have something on one of their routers which drops packets to/from relaytest.orbs.vuurwerk.nl Compare this trace: $ traceroute relaytest.orbs.vuurwerk.nl traceroute: Warning: ckecksums disabled traceroute to relaytest.orbs.vuurwerk.nl (194.178.232.55), 30 hops max, 40 byte packets 1 router.wlg.office.netlink.net.nz (203.97.244.1) 1.458 ms 1.202 ms 3.674 ms 2 b1.wlg.netlink.net.nz (203.97.132.129) 2.402 ms 2.696 ms 1.383 ms 3 Fe0-0.nzlq1.Wellington.telstra.net.nz (203.98.56.177) 1.584 ms 1.324 ms 1.474 ms 4 FastEthernet0-0-0.nzsx-core1.Auckland.telstra.net.nz (203.98.21.26) 31.880 ms 24.598 ms 21.631 ms 5 Serial0-1-0.paix1.PaloAlto.telstra.net (203.50.126.18) 155.577 ms 155.112 ms 290.211 ms 6 core1-gige.pao.above.net (209.249.0.244) 155.199 ms 155.356 ms 155.082 ms 7 sjc-pao-oc12.sjc.above.net (209.133.31.149) 159.880 ms !H 155.972 ms !H 156.138 ms !H with: $ traceroute 194.178.232.1 traceroute: Warning: ckecksums disabled traceroute to 194.178.232.1 (194.178.232.1), 30 hops max, 40 byte packets 1 router.wlg.office.netlink.net.nz (203.97.244.1) 1.687 ms 1.436 ms 1.317 ms 2 b1.wlg.netlink.net.nz (203.97.132.129) 1.806 ms 1.753 ms 1.545 ms 3 Fe0-0.nzlq1.Wellington.telstra.net.nz (203.98.56.177) 1.834 ms 1.755 ms 1.652 ms 4 FastEthernet0-0-0.nzsx-core1.Auckland.telstra.net.nz (203.98.21.26) 22.730 ms 21.084 ms 23.203 ms 5 Serial0-1-0.paix1.PaloAlto.telstra.net (203.50.126.18) 156.800 ms 159.412 ms 382.058 ms 6 core1-gige.pao.above.net (209.249.0.244) 195.495 ms 154.912 ms 155.196 ms 7 core3.sjc2-core1.pao-oc12.sjc2.above.net (216.200.254.185) 157.541 ms 156.235 ms 159.225 ms 8 core5.sjc2-core3.sjc2.above.net (208.185.156.66) 156.049 ms 155.687 ms 157.684 ms 9 nyc-sjc-oc12.nyc.above.net (208.185.156.162) 232.711 ms 233.514 ms 232.355 ms 10 core2-core1-oc12.nyc.above.net (209.133.31.202) 232.135 ms 231.995 ms 232.695 ms 11 POS3-0-0.GW4.NYC4.ALTER.NET (157.130.31.45) 237.016 ms 242.895 ms 241.483 ms 12 146.ATM2-0.XR2.NYC4.ALTER.NET (146.188.179.174) 237.683 ms 238.036 ms 237.969 ms .... So let me summarise this for you all. 1) We are not blocking nor have we been blocking traffic from this particular ORBS tester or any other ORBS tester. Until this incident occurred we had no knowledge that this address hosted such a tester. 2) My technical staff have reiterated this on a number of occasions on this list and directly to Alan Brown. He has consistently refused to accept their explanations and assurances. 3) We have a customer who had a misconfigured host. They have taken steps to rectify that. Our published Terms & Conditions make it clear that we do not tolerate spam and we acted promptly on notification of the problem. 4) We are guilty of having an assymetric routing path. I am not aware that this is an "ORBSable" offence. 5) Any discussion on 'filters' needs to be with above.net who provide connectivity for Telstra and a number of other NZ providers. Now can I please get back to my weekend? Regards, andy --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

[off-topic] OpenBSD 2.7
by Joe Abley 06 May '00

06 May '00

Hey, OpenBSD 2.7 will be released on CD some time in the next few weeks. OpenBSD is a free unix-like operating system derived from NetBSD, and actively developed with a focus on security, stability and anal- retentive correctness-of-approach. For details see http://www.openbsd.org/ Since there's no local distributor (and, last time I checked, the Australian distributors wouldn't ship to NZ since the CDs contain strong crypto) the recommended method of obtaining CDs is to order them direct from the Computer Store of Calgary at US$30 + postage each. However, there is a 40% discount available for orders of more than 20 CDs. If anybody is interested in getting hold of a discounted copy, please drop me a line privately -- if there is enough interest, I'll do a bulk order and redistribute at cost. [there are bulk discounts on T-shirts too, so be sure to mention if you want some of those] Details at http://www.openbsd.org/orders.html -- the mid-year release is usually frozen on May 19, which is Theo's birthday. 2.7 beta releases suitable for a network install are available for download from the following local mirror: ftp://ftp.nz.openbsd.org/pub/OpenBSD/snapshots/ Joe --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

APOLOGIES was Re: Spammers in our midst.
by PhoneNet 06 May '00

06 May '00

My apologies to all concerned... I am the owner of 203.97.144.41 - our consultants assured me this site had been secured when it was originally set up and they have again told me it is secure following the spamming attack of the third and fourth of May. I will be contacting them again today to get it remedied URGENTLY. At 21:13 6/05/00 +1200, you wrote: > >Hey Phil, > >Why is it that ORBS can't verify this host when every other site in the >world can? > >Nice bit of RBL fodder, really.... > >---------- Forwarded message ---------- >Date: Sat, 6 May 2000 18:58:04 +1000 >From: tom minchin <tom(a)interact.net.au> >To: blocked-tests(a)orbs.org >Subject: SMTP relaying, previously not >Resent-Date: Sat, 6 May 2000 21:09:05 +1200 (NZST) >Resent-From: ORBS blocked relay catcher <obs-blok(a)manawatu.co.nz> >Resent-To: alan(a)manawatu.gen.nz >Resent-Subject: SMTP relaying, previously not > >Hi, > 203.97.144.41 is vulnerable to the rcpt to: <"blah"> trick. Sample >spam below. > >tom(a)asiaonline.net > >Return-Path: <stupidgrl(a)loveable.com> >Received: from C12.local.domain (cousins-cl41.netlink.net.nz [203.97.144.41]) > by orange.interact.net.au (8.10.1/8.10.1) with SMTP id e468hjG08743 > for <puckdefender(a)interact.net.au>; Sat, 6 May 2000 18:43:46 +1000 (EST) >Message-Id: <200005060843.e468hjG08743(a)orange.interact.net.au> >From: <stupidgrl(a)lovable.com> >To: <puckdefender(a)interact.net.au> >Subject: Mark, Heres the software site you need!! >Mime-Version: 1.0 >Content-Type: text/plain; charset="iso-8859-1" >Date: Sat, 6 May 2000 20:38:26 > >Hi Mark > >This site has over 1200 programs with all major titles and the latest versions. >Prices are, in most cases, over 90% off 'normal' retail prices. >There is NO other site like this on the net!! > >http://www.liftware.am > >If you have any queries, feel free to email me > >enjoy >Susie >stupidgrl(a)lovable.com > > > > > > > > > > > > > > > > > > > > >. > >-------------------------------------------------------------- >This message was sent by an individual using an unregistered >copy of a shareware mailer. >Registering will remove this message and entitle the user to >a fully functional program with Stealth Capabilities, and a >FREE Resellers Web Site! > >--e468hmG08747.957602628/orange.interact.net.au-- > > >--e468hmH08747.957602635/orange.interact.net.au-- > >----- End forwarded message ----- > >--------- >To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz >where the body of your message reads: >unsubscribe nznog > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Spammers in our midst.
by Alan Brown 05 May '00

05 May '00

Hey Phil, Why is it that ORBS can't verify this host when every other site in the world can? Nice bit of RBL fodder, really.... ---------- Forwarded message ---------- Date: Sat, 6 May 2000 18:58:04 +1000 From: tom minchin <tom(a)interact.net.au> To: blocked-tests(a)orbs.org Subject: SMTP relaying, previously not Resent-Date: Sat, 6 May 2000 21:09:05 +1200 (NZST) Resent-From: ORBS blocked relay catcher <obs-blok(a)manawatu.co.nz> Resent-To: alan(a)manawatu.gen.nz Resent-Subject: SMTP relaying, previously not Hi, 203.97.144.41 is vulnerable to the rcpt to: <"blah"> trick. Sample spam below. tom(a)asiaonline.net Return-Path: <stupidgrl(a)loveable.com> Received: from C12.local.domain (cousins-cl41.netlink.net.nz [203.97.144.41]) by orange.interact.net.au (8.10.1/8.10.1) with SMTP id e468hjG08743 for <puckdefender(a)interact.net.au>; Sat, 6 May 2000 18:43:46 +1000 (EST) Message-Id: <200005060843.e468hjG08743(a)orange.interact.net.au> From: <stupidgrl(a)lovable.com> To: <puckdefender(a)interact.net.au> Subject: Mark, Heres the software site you need!! Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Date: Sat, 6 May 2000 20:38:26 Hi Mark This site has over 1200 programs with all major titles and the latest versions. Prices are, in most cases, over 90% off 'normal' retail prices. There is NO other site like this on the net!! http://www.liftware.am If you have any queries, feel free to email me enjoy Susie stupidgrl(a)lovable.com . -------------------------------------------------------------- This message was sent by an individual using an unregistered copy of a shareware mailer. Registering will remove this message and entitle the user to a fully functional program with Stealth Capabilities, and a FREE Resellers Web Site! --e468hmG08747.957602628/orange.interact.net.au-- --e468hmH08747.957602635/orange.interact.net.au-- ----- End forwarded message ----- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

7 10

None
by None 05 May '00

05 May '00

by kithrup.com (8.8.8/8.8.8) with ESMTP id CAA19931 for <user(a)kithrup.com>; Sat, 6 May 2000 02:30:14 -0700 (PDT) (envelope-from spamtest(a)cousins.in-newzealand.com) Received: from dante.mail-abuse.org (dante.mail-abuse.org [204.152.184.35]) by cousins.in-newzealand.com (8.9.3/8.8.7) with SMTP id WAA06164 for <"user(a)kithrup.com">; Sat, 6 May 2000 22:36:03 +1200 Date: Sat, 6 May 2000 22:36:03 +1200 To: user(a)kithrup.com From: nobody(a)cousins.in-newzealand.com Subject: test for susceptibility to third-party mail relay Message-Id: <rlytest-957605401-16129(a)dante.mail-abuse.org> Sender: iverson(a)dante.mail-abuse.org X-Envelope: <spamtest(a)[203.97.144.41]> -> <"user(a)kithrup.com"> This is a test of third-party mail relay, generated by the MAPS LLC RSS relay protection system. Target host = 203.97.144.41 Test performed by <iverson(a)dante.mail-abuse.org> ==== That's the MAPS RSS tester, less than an hour ago. And the host _is_ reachable from hosts other than the ORBS testers. The manual ORBS netblock entries kick in around midnight. I suggest you run host -t ns(and soa) relays.orbs.org to see where the zone SOA is and who secondary it. AB --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Telstra heading for MAPS RBL
by Alan Brown 04 May '00

04 May '00

http://maps.vix.com/rbl/ev/203.44.57-24.txt for details of one /24 already there. It's likely that Telstra will end up fully RBLed before much longer due to their spam-tolerant policy statements. AB --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3