- NZNOG - lists.nznog.org

ORBS.
by Roger De Salis 07 May '00

07 May '00

By chance... since you lot have been particularly noisy this weekend on the subject of ORBS, I wanted to obtain a more rounded opinion of the value of ORBS with respect to SPAM Prevention. ISOCNZ has charged myself and three others with coming up with a policy concerning ORBS and potentially other SPAM prevention methods. :-( My understanding of the situation is as follows:- Paul Vixie contributes to/manages???? an RBL repository of Open Mail Relays on the side of www.vix.com. ie MAPS and RBL. How many carriers (even carriers with only 6 staff...) in NZ piggyback off this effort? And contribute? ORBS is a similar idea, run by AB of Manawatu Internet Services. An area of concern is that ORBS uses a method of publicity to shame Open-Relay holders into changing their status. However the publicity mechanism can also be used by Spammers to work out best SPAM procreation locations. How useful is this, and are their better ways of doing it? ========================================================= Should NZ ISP's all support RBL/MAPS? (realising that there is no requirement today, other than best customer service and best endeavours.) Is ORBS complementary? Is it appropriate? What do others think? Should ISOCNZ but out of this matter, and stick to mindlessly boring meetings with 10,000 points of order? Flames to myself at Cisco. Fabulously written, illuminating, insightful pieces will certainly receive a direct response of thanks and comments. All others >/dev/null. Rgds Roger De Salis -- \_ Roger De Salis Cisco Systems NZ Ltd </' +64 25 481 452 L3, 117 Customhouse Qy /) +64 4 473 4912 Wellington, New Zealand (/ roger(a)desalis.gen.nz rdesalis(a)cisco.com ` --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

[off-topic] Re: 2.7 ordering (fwd)
by Joe Abley 06 May '00

06 May '00

Ah. Looks like I jumped the gun :) ---------- Forwarded message ---------- Date: Sat, 06 May 2000 20:00:07 -0600 From: Theo de Raadt <deraadt(a)cvs.openbsd.org> To: Joe Abley <jabley(a)automagic.org> Cc: misc(a)openbsd.org Subject: Re: 2.7 ordering > Am I correct in thinking that the aim is a 2.7 release on May 19? No. June 15 this time around. > Anybody know when the on-line ordering page will be taking orders on 2.7 > media? When we have artwork :-) --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

ORBS blocking
by Andy Linton 06 May '00

06 May '00

I haven't seen all of the messages posted in nznog on this subject so forgive me if I go over some ground that has been covered already. I'd like to make it quite clear to all NZ operators reading this that neither Telstra Saturn or any of its operating companies have any rules in place on their routers which are blocking traffic from the ORBS tester, relaytest.orbs.vuurwerk.nl We have not had any such rules and I am more than happy to make arrangements for an independant party to inspect the relevant router configurations and the audit trail of those configurations which is kept under RCS. Alan Brown has published a traceroute which he says demonstrates that Telstra Australia is blocking traffic. I have inspected the configuration of the pad19 router and no such filter exists on that host. Let me remind you of his posting: [RelayTst(a)amersfoort alan]$ /usr/sbin/traceroute 203.97.144.41 traceroute to 203.97.144.41 (203.97.144.41), 30 hops max, 40 byte packets 1 router (194.178.232.1) 0.871 ms 0.928 ms 1.077 ms 2 border (194.178.232.125) 0.834 ms 0.726 ms 0.688 ms 3 Vuurwerk.cust.ip.versatel.net (212.189.159.237) 1.132 ms 1.047 ms 1.152 m ... 16 199.37.127.190 (199.37.127.190) 284.622 ms 277.222 ms 288.499 ms 17 205.174.74.34 (205.174.74.34) 414.984 ms 406.353 ms 396.054 ms 18 FastEthernet0-0-0.pad19.Sydney.telstra.net (203.50.13.68) 399.113 ms 381.658 ms 405.766 ms 19 * * * 20 * * * 21 * * * 22 * * * He says this demonstrates that Telstra is blocking his tester. It does no such thing. The explanation is straightforward but not obvious. Traffic to 203.97.144.41 under the above traceroute was taking a path to New Zealand via Sydney at the time of the traceroute. The return path from Sydney is: pad19.Sydney>traceroute 194.178.232.55 Type escape sequence to abort. Tracing the route to relaytest.orbs.vuurwerk.nl (194.178.232.55) 1 FastEthernet1-0-0.pad16.Sydney.telstra.net (203.50.13.67) 0 msec 0 msec 0 msec 2 205.174.74.33 220 msec 220 msec 224 msec 3 199.37.127.193 [AS 5727] 220 msec 220 msec 224 msec 4 POS2-0-0.GW5.SFO4.ALTER.NET (157.130.197.77) [AS 701] 224 msec 220 msec 224 msec 5 145.ATM3-0.XR2.SFO4.ALTER.NET (146.188.149.38) [AS 701] 224 msec 220 msec 224 msec 6 190.at-1-0-0.TR2.SAC1.ALTER.NET (152.63.51.10) [AS 701] 224 msec 228 msec 228 msec 7 127.at-6-1-0.TR2.NYC9.ALTER.NET (152.63.6.81) [AS 701] 304 msec 308 msec 308 msec 8 186.ATM6-0.XR2.NYC1.ALTER.NET (152.63.21.73) [AS 701] 304 msec 308 msec 304 msec .... The next hop that a packet takes on route to 203.97.144.41 is to Telstra Australia's router in Auckland. This is Telstra Saturn's interconnect point with Telstra Australia. The nzsx-core1 router has two paths out of New Zealand, one to pad19 and the other to above.net at the PAIX. The preferred path for return packets to relaytest.orbs.vuurwerk.nl on that router in Auckland is via the direct route to Palo Alto. So we have an assymetric path from the site in the Netherlands to 203.97.144.41 on that trans Pacific part of the packet flow. Why is this important? Because above.net appear to have something on one of their routers which drops packets to/from relaytest.orbs.vuurwerk.nl Compare this trace: $ traceroute relaytest.orbs.vuurwerk.nl traceroute: Warning: ckecksums disabled traceroute to relaytest.orbs.vuurwerk.nl (194.178.232.55), 30 hops max, 40 byte packets 1 router.wlg.office.netlink.net.nz (203.97.244.1) 1.458 ms 1.202 ms 3.674 ms 2 b1.wlg.netlink.net.nz (203.97.132.129) 2.402 ms 2.696 ms 1.383 ms 3 Fe0-0.nzlq1.Wellington.telstra.net.nz (203.98.56.177) 1.584 ms 1.324 ms 1.474 ms 4 FastEthernet0-0-0.nzsx-core1.Auckland.telstra.net.nz (203.98.21.26) 31.880 ms 24.598 ms 21.631 ms 5 Serial0-1-0.paix1.PaloAlto.telstra.net (203.50.126.18) 155.577 ms 155.112 ms 290.211 ms 6 core1-gige.pao.above.net (209.249.0.244) 155.199 ms 155.356 ms 155.082 ms 7 sjc-pao-oc12.sjc.above.net (209.133.31.149) 159.880 ms !H 155.972 ms !H 156.138 ms !H with: $ traceroute 194.178.232.1 traceroute: Warning: ckecksums disabled traceroute to 194.178.232.1 (194.178.232.1), 30 hops max, 40 byte packets 1 router.wlg.office.netlink.net.nz (203.97.244.1) 1.687 ms 1.436 ms 1.317 ms 2 b1.wlg.netlink.net.nz (203.97.132.129) 1.806 ms 1.753 ms 1.545 ms 3 Fe0-0.nzlq1.Wellington.telstra.net.nz (203.98.56.177) 1.834 ms 1.755 ms 1.652 ms 4 FastEthernet0-0-0.nzsx-core1.Auckland.telstra.net.nz (203.98.21.26) 22.730 ms 21.084 ms 23.203 ms 5 Serial0-1-0.paix1.PaloAlto.telstra.net (203.50.126.18) 156.800 ms 159.412 ms 382.058 ms 6 core1-gige.pao.above.net (209.249.0.244) 195.495 ms 154.912 ms 155.196 ms 7 core3.sjc2-core1.pao-oc12.sjc2.above.net (216.200.254.185) 157.541 ms 156.235 ms 159.225 ms 8 core5.sjc2-core3.sjc2.above.net (208.185.156.66) 156.049 ms 155.687 ms 157.684 ms 9 nyc-sjc-oc12.nyc.above.net (208.185.156.162) 232.711 ms 233.514 ms 232.355 ms 10 core2-core1-oc12.nyc.above.net (209.133.31.202) 232.135 ms 231.995 ms 232.695 ms 11 POS3-0-0.GW4.NYC4.ALTER.NET (157.130.31.45) 237.016 ms 242.895 ms 241.483 ms 12 146.ATM2-0.XR2.NYC4.ALTER.NET (146.188.179.174) 237.683 ms 238.036 ms 237.969 ms .... So let me summarise this for you all. 1) We are not blocking nor have we been blocking traffic from this particular ORBS tester or any other ORBS tester. Until this incident occurred we had no knowledge that this address hosted such a tester. 2) My technical staff have reiterated this on a number of occasions on this list and directly to Alan Brown. He has consistently refused to accept their explanations and assurances. 3) We have a customer who had a misconfigured host. They have taken steps to rectify that. Our published Terms & Conditions make it clear that we do not tolerate spam and we acted promptly on notification of the problem. 4) We are guilty of having an assymetric routing path. I am not aware that this is an "ORBSable" offence. 5) Any discussion on 'filters' needs to be with above.net who provide connectivity for Telstra and a number of other NZ providers. Now can I please get back to my weekend? Regards, andy --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

[off-topic] OpenBSD 2.7
by Joe Abley 06 May '00

06 May '00

Hey, OpenBSD 2.7 will be released on CD some time in the next few weeks. OpenBSD is a free unix-like operating system derived from NetBSD, and actively developed with a focus on security, stability and anal- retentive correctness-of-approach. For details see http://www.openbsd.org/ Since there's no local distributor (and, last time I checked, the Australian distributors wouldn't ship to NZ since the CDs contain strong crypto) the recommended method of obtaining CDs is to order them direct from the Computer Store of Calgary at US$30 + postage each. However, there is a 40% discount available for orders of more than 20 CDs. If anybody is interested in getting hold of a discounted copy, please drop me a line privately -- if there is enough interest, I'll do a bulk order and redistribute at cost. [there are bulk discounts on T-shirts too, so be sure to mention if you want some of those] Details at http://www.openbsd.org/orders.html -- the mid-year release is usually frozen on May 19, which is Theo's birthday. 2.7 beta releases suitable for a network install are available for download from the following local mirror: ftp://ftp.nz.openbsd.org/pub/OpenBSD/snapshots/ Joe --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

APOLOGIES was Re: Spammers in our midst.
by PhoneNet 06 May '00

06 May '00

My apologies to all concerned... I am the owner of 203.97.144.41 - our consultants assured me this site had been secured when it was originally set up and they have again told me it is secure following the spamming attack of the third and fourth of May. I will be contacting them again today to get it remedied URGENTLY. At 21:13 6/05/00 +1200, you wrote: > >Hey Phil, > >Why is it that ORBS can't verify this host when every other site in the >world can? > >Nice bit of RBL fodder, really.... > >---------- Forwarded message ---------- >Date: Sat, 6 May 2000 18:58:04 +1000 >From: tom minchin <tom(a)interact.net.au> >To: blocked-tests(a)orbs.org >Subject: SMTP relaying, previously not >Resent-Date: Sat, 6 May 2000 21:09:05 +1200 (NZST) >Resent-From: ORBS blocked relay catcher <obs-blok(a)manawatu.co.nz> >Resent-To: alan(a)manawatu.gen.nz >Resent-Subject: SMTP relaying, previously not > >Hi, > 203.97.144.41 is vulnerable to the rcpt to: <"blah"> trick. Sample >spam below. > >tom(a)asiaonline.net > >Return-Path: <stupidgrl(a)loveable.com> >Received: from C12.local.domain (cousins-cl41.netlink.net.nz [203.97.144.41]) > by orange.interact.net.au (8.10.1/8.10.1) with SMTP id e468hjG08743 > for <puckdefender(a)interact.net.au>; Sat, 6 May 2000 18:43:46 +1000 (EST) >Message-Id: <200005060843.e468hjG08743(a)orange.interact.net.au> >From: <stupidgrl(a)lovable.com> >To: <puckdefender(a)interact.net.au> >Subject: Mark, Heres the software site you need!! >Mime-Version: 1.0 >Content-Type: text/plain; charset="iso-8859-1" >Date: Sat, 6 May 2000 20:38:26 > >Hi Mark > >This site has over 1200 programs with all major titles and the latest versions. >Prices are, in most cases, over 90% off 'normal' retail prices. >There is NO other site like this on the net!! > >http://www.liftware.am > >If you have any queries, feel free to email me > >enjoy >Susie >stupidgrl(a)lovable.com > > > > > > > > > > > > > > > > > > > > >. > >-------------------------------------------------------------- >This message was sent by an individual using an unregistered >copy of a shareware mailer. >Registering will remove this message and entitle the user to >a fully functional program with Stealth Capabilities, and a >FREE Resellers Web Site! > >--e468hmG08747.957602628/orange.interact.net.au-- > > >--e468hmH08747.957602635/orange.interact.net.au-- > >----- End forwarded message ----- > >--------- >To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz >where the body of your message reads: >unsubscribe nznog > --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Spammers in our midst.
by Alan Brown 05 May '00

05 May '00

Hey Phil, Why is it that ORBS can't verify this host when every other site in the world can? Nice bit of RBL fodder, really.... ---------- Forwarded message ---------- Date: Sat, 6 May 2000 18:58:04 +1000 From: tom minchin <tom(a)interact.net.au> To: blocked-tests(a)orbs.org Subject: SMTP relaying, previously not Resent-Date: Sat, 6 May 2000 21:09:05 +1200 (NZST) Resent-From: ORBS blocked relay catcher <obs-blok(a)manawatu.co.nz> Resent-To: alan(a)manawatu.gen.nz Resent-Subject: SMTP relaying, previously not Hi, 203.97.144.41 is vulnerable to the rcpt to: <"blah"> trick. Sample spam below. tom(a)asiaonline.net Return-Path: <stupidgrl(a)loveable.com> Received: from C12.local.domain (cousins-cl41.netlink.net.nz [203.97.144.41]) by orange.interact.net.au (8.10.1/8.10.1) with SMTP id e468hjG08743 for <puckdefender(a)interact.net.au>; Sat, 6 May 2000 18:43:46 +1000 (EST) Message-Id: <200005060843.e468hjG08743(a)orange.interact.net.au> From: <stupidgrl(a)lovable.com> To: <puckdefender(a)interact.net.au> Subject: Mark, Heres the software site you need!! Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Date: Sat, 6 May 2000 20:38:26 Hi Mark This site has over 1200 programs with all major titles and the latest versions. Prices are, in most cases, over 90% off 'normal' retail prices. There is NO other site like this on the net!! http://www.liftware.am If you have any queries, feel free to email me enjoy Susie stupidgrl(a)lovable.com . -------------------------------------------------------------- This message was sent by an individual using an unregistered copy of a shareware mailer. Registering will remove this message and entitle the user to a fully functional program with Stealth Capabilities, and a FREE Resellers Web Site! --e468hmG08747.957602628/orange.interact.net.au-- --e468hmH08747.957602635/orange.interact.net.au-- ----- End forwarded message ----- --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

7 10

None
by None 05 May '00

05 May '00

by kithrup.com (8.8.8/8.8.8) with ESMTP id CAA19931 for <user(a)kithrup.com>; Sat, 6 May 2000 02:30:14 -0700 (PDT) (envelope-from spamtest(a)cousins.in-newzealand.com) Received: from dante.mail-abuse.org (dante.mail-abuse.org [204.152.184.35]) by cousins.in-newzealand.com (8.9.3/8.8.7) with SMTP id WAA06164 for <"user(a)kithrup.com">; Sat, 6 May 2000 22:36:03 +1200 Date: Sat, 6 May 2000 22:36:03 +1200 To: user(a)kithrup.com From: nobody(a)cousins.in-newzealand.com Subject: test for susceptibility to third-party mail relay Message-Id: <rlytest-957605401-16129(a)dante.mail-abuse.org> Sender: iverson(a)dante.mail-abuse.org X-Envelope: <spamtest(a)[203.97.144.41]> -> <"user(a)kithrup.com"> This is a test of third-party mail relay, generated by the MAPS LLC RSS relay protection system. Target host = 203.97.144.41 Test performed by <iverson(a)dante.mail-abuse.org> ==== That's the MAPS RSS tester, less than an hour ago. And the host _is_ reachable from hosts other than the ORBS testers. The manual ORBS netblock entries kick in around midnight. I suggest you run host -t ns(and soa) relays.orbs.org to see where the zone SOA is and who secondary it. AB --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

Telstra heading for MAPS RBL
by Alan Brown 04 May '00

04 May '00

http://maps.vix.com/rbl/ev/203.44.57-24.txt for details of one /24 already there. It's likely that Telstra will end up fully RBLed before much longer due to their spam-tolerant policy statements. AB --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

4 3

Another networking position....
by Steve Lang 04 May '00

04 May '00

Yes, we too are looking for an networking guru/internet god(ess). Senior Network Engineer/Manager An enthusiastic and self-motivated Senior Network Engineer/Manager required to work in a very busy, friendly and focused telecommunications environment from our central Auckland headoffice. Responsibilities; - overall management of internel Cisco systems - ensure excellent levels of client support - good interpersonal and communication skills - commitment to effective project management - contractual reporting ability - highly organised with sound judgement Qualifications; - Need to be an expert with Cisco router management, maintenance and configuration; Cisco soho router configuration; Cisco PIX Firewall configuration; Cisco AS5300; BGP4, OSPF; LAN (Ethernet, FastEthernet, Switches); WAN (G.703, X.21, V.35, DDS, MDDS, DEDW, Stacked E1) and Linux - Need to have experience with Newbridge 46020 Network management station, and 3600 TDM's. - Preferable knowledge of DNS, Sendmail/SMTP, FTP, Apache, Radius, Perl, Shell, Pop3 - tertiary qualifications well acknowledged - An acknowledged expert in their field If there's any interest out there, drop me a line. Cheers - --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0

[apops] Filtering: APNIC Policy changes (fwd)
by Joe Abley 03 May '00

03 May '00

For those who prefer to protect their networks against remote outages by route filtering, this may be of interest. ---------- Forwarded message ---------- Date: Thu, 4 May 2000 11:14:28 +1000 (EST) From: APNIC Secretariat <secretariat(a)apnic.net> To: apnic-announce(a)lists.apnic.net, nanog(a)merit.edu, ripe-list(a)ripe.net, eof-list(a)ripe.net, apops(a)lists.apnic.net Subject: [apops] Filtering: APNIC Policy changes ** Apologies for duplicate messages ** Important Public Announcement CHANGES IN APNIC ADDRESS POLICY If you ingress filter on any of the following APNIC address ranges - 61/8, 202/7, or 210/7 - then please note the following important changes to APNIC address policy which were approved at the recent APNIC Member Meeting in March, in Seoul, Korea. * APNIC will lower its initial minimum allocation from a /19 to a /20 (this will apply across all address ranges held by APNIC). * APNIC will begin making allocations from network 61/8 as routine allocations from its total address pool. These policy changes will take effect three months from this announcement, on 4 August 2000. This email is intended to allow the ISP community sufficient advance notice to make any necessary filtering changes. For more detailed information on these proposals and decisions, or other discussion items, copies of presentations and discussion papers are available on the APNIC web site at http://www.apnic.net/amm2000/ . With best wishes, Anne Lord Manager Member Services -- + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + APNIC Secretariat <secretariat(a)apnic.net> Tel: +61-7-3367-0490 Asia Pacific Network Information Centre (APNIC) Ltd Fax: +61-7-3367-0482 Level 1, 33 Park Road, PO Box 2131, Milton, QLD 4064, Australia + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + * APOPS: Asia Pacific Operations Forum * * To unsubscribe: send "unsubscribe" to apops-request(a)apnic.net * --------- To unsubscribe from nznog, send email to majordomo(a)list.waikato.ac.nz where the body of your message reads: unsubscribe nznog

1 0