- NLNOG - mailman3.nlnog.net

Memcached server list
by niels=nlnog＠bakker.net 09 Mar '18

09 Mar '18

Hoi allemaal, Recent is een lijst met open memcached server en een simpel exploit van memcrashed gepost. Hier is de lijst, voorzien van AS-nummers: http://swm.pp.se/memcached-verbose.txt Zoek op je ASN (of op '| NL |' als je mensen kent). KPN, SURFnet, XS4ALL, AMSIO, Ziggo, Interconnect, Zeelandnet, Trueserver, We-Dare, TransIP, Caveo, Netholding, NedZone, ReasonNet, Denit, Edutel, NForce, Greenhost, Netrouting, i3D, SpeakUp, A2B, Leaseweb, Tilaa, HostNet zijn enkele voorbeelden van service providers die ik verwacht deze mailing list te lezen. Groeten, -- Niels. --

2 2

memcached UDP/11211 IOS XR ratelimit example
by Job Snijders 01 Mar '18

01 Mar '18

Dear all, As you've probably read by now, there we're facing a significant threat in the shape of the memcached UDP protocol. The current best practise is to apply rate-limits on all external facing ports and police UDP/11211 traffic down to something managable. This protects both your own infrastructure and your customers. Here are numerous pointers: http://www.senki.org/memcached-on-port-11211-udp-tcp-being-exploited/ I recommend adding memcached UDP/11211 to the same "exploitable ports" list as NTP, CHARGEN and SSDP. Below is a configuration example for IOS XR to rate-limit these amplification-sensitive UDP ports to 1% of of the port's capacity. ipv4 access-list exploitable-ports permit udp any eq ntp any permit udp any eq 1900 any permit udp any eq 19 any permit udp any eq 11211 any ! ipv6 access-list exploitable-ports-v6 permit udp any eq ntp any permit udp any eq 1900 any permit udp any eq 19 any permit udp any eq 11211 any ! class-map match-any exploitable-ports match access-group ipv4 exploitable-ports match access-group ipv6 exploitable-ports-v6 end-class-map ! policy-map ntt-external-in class exploitable-ports police rate percent 1 conform-action transmit exceed-action drop ! set precedence 0 set mpls experimental topmost 0 ! class class-default set mpls experimental imposition 0 set precedence 0 ! end-policy-map ! interface Bundle-Ether19 description Customer: the best customer service-policy input ntt-external-in ipv4 address xxx/x ipv6 address yyy/y ... ! interface Bundle-Ether20 service-policy input ntt-external-in ... ... etc ... Please share your own examples too! Kind regards, Job

1 0

Fwd: [nznog] Removing the four stale TAL from the APNIC RPKI validation set.
by Job Snijders 27 Feb '18

27 Feb '18

FYI ---------- Forwarded message --------- From: George Michaelson <ggm(a)apnic.net> Date: Tue, 27 Feb 2018 at 05:34 Subject: [nznog] Removing the four stale TAL from the APNIC RPKI validation set. To: <nznog(a)list.waikato.ac.nz> Updating RPKI trust anchor configuration ------------------------------------------------------- APNIC has completed the process of transitioning from its previous Resource Public Key Infrastructure (RPKI) trust anchor arrangement to a new single trust anchor configuration. Each RIR will publish an 'all resources' global trust anchor, under which its own regional resources (IP addresses and ASNs) will be certified. APNICs trust anchor is one of the previous five, which has been retained as the sole trust anchor over all APNIC resource certificate products. If you are using relying-party software, such as the Dragon Research Labs RPKI Toolkit, RPSTIR or the RIPE NCC’s RPKI Validator, you are advised to update your software’s configuration to use only the current APNIC trust anchor, rather than the set of five APNIC trust anchors that were previously in use. The update is to remove four of the five: One has been retained as the current live Trust Anchor. Note: this update is not critical. However, if it is not done, the software will log or report warnings about being unable to retrieve the trust anchors that are no longer being used. All resources now validate under the single active trust anchor and no orphan products are valid under the other prior trust anchors. The current APNIC TAL is as follows: ------ rsync://rpki.apnic.net/repository/apnic-rpki-root-iana-origin.cer MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx9RWSL61YAAYumEiU8z8 qH2ETVIL01ilxZlzIL9JYSORMN5Cmtf8V2JblIealSqgOTGjvSjEsiV73s67zYQI 7C/iSOb96uf3/s86NqbxDiFQGN8qG7RNcdgVuUlAidl8WxvLNI8VhqbAB5uSg/Mr LeSOvXRja041VptAxIhcGzDMvlAJRwkrYK/Mo8P4E2rSQgwqCgae0ebY1CsJ3Cjf i67C1nw7oXqJJovvXJ4apGmEv8az23OLC6Ki54Ul/E6xk227BFttqFV3YMtKx42H cCcDVZZy01n7JjzvO8ccaXmHIgR7utnqhBRNNq5Xc5ZhbkrUsNtiJmrZzVlgU6Ou 0wIDAQAB ------ Configuring Relying Party Software ----------------------------------------------- RIPE NCC RPKI Validator: If you upgrade to RIPE validator rpki-validator-app-2.24 the correct Trust Anchor is configured. No further work is required. Dragon Research Labs Rcynic Validator: If you run rcynic, you need to remove all the TAL, TA or CER entries in rcynic.conf except ones which point to apnic-rpki-root-iana-origin.cer or the related TAL. If you use the trusted-certs/ directory, simply remove the four files which are named for the non-APNIC RIR as follows: cd /etc/trust-anchors # or wherever you place the TAL files rm apnic-rpki-root-ripe-origin.tal rm apnic-rpki-root-arin-origin.tal rm apnic-rpki-root-lacnic-origin.tal rm apnic-rpki-root-afrinic-origin.tal RPSTIR To modify an installed RPSTIR system, locate the /usr/local/etc/rpstir directory and remove all but the current live APNIC TAL. More information is in the attached PDF describing how to update the trust anchor configuration in these three popular relying-partner software systems. -George _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz https://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

What if… DNS over TCP?
by Mark Schouten 09 Feb '18

09 Feb '18

Hi, I've had this idea, read about it and let me know what you think. https://www.tuxis.nl/blog/what-if-dns-over-tcp-20180207/ -- Kerio Operator in de Cloud? https://www.kerioindecloud.nl/ Mark Schouten | Tuxis Internet Engineering KvK: 61527076 | http://www.tuxis.nl/ T: 0318 200208 | info(a)tuxis.nl

3 3

Call for presentations RIPE 76
by Benno Overeinder 23 Jan '18

23 Jan '18

Dear colleagues, Please find the CFP for RIPE 76 below or at: https://ripe76.ripe.net/submit-topic/cfp/. The deadline for submissions is *11 March 2018*. Please also note that speakers do not receive any extra reduction or funding towards the meeting fee at the RIPE Meetings, see the "Speakers" paragraph in CFP for more information. Kind regards, Benno Overeinder RIPE PC Chair https://ripe76.ripe.net/ripe-pc/ -------------------->>><<<-------------------- Call for Presentations A RIPE Meeting is an open event where Internet Service Providers, network operators and other interested parties get together. Although the meeting is mostly technical, it is also a chance for people to meet and network with others in their field. RIPE 76 will take place from 14-18 May in Marseille, France. The RIPE Programme Committee (PC) is now seeking content proposals from the RIPE community for the plenary sessions, BoFs (Birds of a Feather sessions), panels, workshops, tutorials and lightning talks at RIPE 76. See the full descriptions of the different presentation formats, https://ripe76.ripe.net/submit-topic/presentation-formats/. Proposals for plenary sessions, BoFs, panels, workshops and tutorials must be submitted for full consideration no later than *11 March 2018*. Proposals submitted after this date will be considered depending on the remaining available space in the programme. The PC is looking for presentations covering topics of network engineering and operations, including but not limited to: - IPv6 deployment - Managing IPv4 scarcity - Data centre technologies - Network and DNS operations - Internet governance and regulatory practices - Network and routing security - Content delivery - Internet peering and mobile data exchange - Connected Things (aka. Internet of Things - IoT) Speakers Presenters, RIPE Working Group Chairs and the RIPE Programme Committee are required to cover their own costs to attend a RIPE Meeting (meeting ticket, travel and accommodation). We have various ticket options available depending on your needs. In extraordinary circumstances, the RIPE Chair can waive the meeting fee for presenters. These requests are dealt with on a case-by-case basis via pc(a)ripe.net. Also note that, on an individual basis, participants can apply for a RIPE Fellowship to develop their professional or academic career. For more information, please visit: https://www.ripe.net/participate/ripe/ripe-fellowship Submissions Presenters should be clear on whether they wish to submit a presentation for a plenary or working group (WG) session. At present, most working groups will solicit policy proposals, discussion points or other content directly via their mailing lists. If you’re not sure what kind of session you should be presenting at, please visit: https://ripe76.ripe.net/plenary-or-wg/ RIPE Meeting attendees are quite sensitive to keeping presentations non-commercial, and product marketing talks are strongly discouraged. Repeated audience feedback shows that the most successful talks focus on operational experience, research results, or case studies. For example, presenters wishing to describe a commercial solution should focus on the underlying technology and not attempt a product demonstration. Presenters should indicate how much time they will require. In general, the time allocated for the different presentation formats is as follows: - Plenary presentations: 20-25 minutes presentation with 5-10 minutes discussion - Tutorials: up to two hours (Monday morning) - Workshops: one hour (during evening sessions) to two hours (Monday morning) - BoFs: approximately one hour (during evening sessions) - Lightning talks: 10 minutes total for both presentation and any discussion The following general requirements apply: - Proposals must be submitted using the meeting submission system, https://ripe76.ripe.net/submit-topic/ - Lightning talks should also be submitted using the meeting submission system (https://ripe76.ripe.net/submit-topic/) and can be submitted any time up to and including the meeting week. The allocation of lightning talks will be announced on short notice, in some cases on the same day but often one day prior to the time slot allocated. - Presenters who propose a panel or BoF are encouraged to include speakers from several (perhaps even competing) companies and/or a neutral facilitator. - All presentation proposals will only be considered by the PC if they contain at least draft presentation slides (slides may be updated later on). For panels, proposals must contain a clear description, as well as the names of invited panellists, presenters and moderators. If you have any questions or requests concerning content submissions, please email pc(a)ripe.net. -- Benno J. Overeinder NLnet Labs https://www.nlnetlabs.nl/

1 0

BGP Filter Guides toegevoegd aan Github versie routing security measures
by Ad Bresser 19 Jan '18

19 Jan '18

Beste NLNOG'rs, Zojuist heb ik de link naar de BGP Filter Guides toegevoegd aan de Github versie van de quickscan van routing maatregelen om het Internet veiliger te maken: https://github.com/AdBresser/measures-to-increase-IP-security Andere suggesties voor aanpassing zijn natuurlijk altijd welkom, of je kan in Github hier zelf het initiatief voor nemen. Met vriendelijke groet, Ad Bresser PS: Om te delen in je LinkedIN netwerk staat er een versie van de quickscan op LinkedIN: https://www.linkedin.com/pulse/measures-increase-routing-security-internet-… (ook likes worden zeer gewaardeerd 😉 )

1 0

New Years Drink 2018
by Job Snijders 16 Jan '18

16 Jan '18

Howdy, howdy, howdy, NLNOG! [ English summary: Friday January 19th 2018, we'll congregate in Utrecht to celebrate the new year! Please register at the below URL. ] Yes - het is weer bijna zover! De immer legendarische NLNOG Nieuwjaarsborrel komt eraan. Een verfijnde traditie om met vrienden en collega's het nieuwe jaar in te luiden met een biertje en een bittergarnituur. Dit jaar hebben we een dedicated zaaltje gehuurd! Details: -------- Tijd: vanaf 19:00 Datum: 19 januari 2018 Plaats: Zoudenbalchzaal, Stadskasteel Oudaen, Oudegracht 99, Utrecht (vlakbij Utrecht CS) https://www.oudaen.nl/ De nieuwjaarsborrel word dit jaar mede mogelijk gemaakt door i3D.net, Duocast, Megaport, Triple, AMS-IX, Netflix, PCextreme, PowerDNS, LONAP, NTT Communications, ECIX, RIPE NCC, Leaseweb, NL-IX & Asteroid International! Aanmelden: ---------- Hoe meer zielen, hoe meer vreugd, dus neem ook eens een collega mee die nog nooit van NLNOG heeft gehoord ;-) Aanmelden kan op deze website: https://nlnog.com/nieuwjaarsborrel2018/ Alvast hele fijne dagen, en we hopen jullie allemaal te zien op 19de! Job, Nathalie, Niels, Sander & Thomas

1 1

ADSL over nat touw
by Job Snijders 13 Dec '17

13 Dec '17

NLNOG, Er is nog vollop ADSL innovatie! Andrew & Arnolds (een Engelse ISP) demonstreerden ADSL over nat touw: http://www.revk.uk/2017/12/its-official-adsl-works-over-wet-string.html XS4ALL, jullie zijn nu aan zet ;-) Groeten, Job

1 0

Opruiming van X2/XENPAK/XFP ER/ZR optics
by Rinse Kloek 28 Nov '17

28 Nov '17

Beste NLNOG'ers Na wat opgeruimd te hebben in onze optic voorraad, kan ik de volgende optics tegen een zacht prijsje aanbieden (> 99% off list price): Aantal Type Merk 4 X2-10GB-ZR Solid Optics 2 XFP-10GD-LR2 (ZR/1550) MRV 3 XENPAK-10GB-ZR Cisco 5 XENPAK-10GB-ER Cisco Bij interesse, neem even contact op met ondergetekende per e-mail of op IRC #nlnog. groet, Rinse Kloek Solcon Internetdiensten B.V

1 0

NIPAP to RIPE db sync
by Jurrian van Iersel 26 Nov '17

26 Nov '17

Dear NLNOG members, During NLNOG day 2015, Kristian Larsson told us about NIPAP, an great IP management system (video: https://www.youtube.com/watch?v=MUqHtNElE0c) At the end of the presentation, Job mentioned the script Ive written for Coloclue to sync the allocations from NIPAP to RIPE db. Since that day, people keep on asking about this tool. Unfortunately, during last 2 years, I didnt have time to rewrite this tool and make it usable for everyone. So I decided to remove all stuff like hardcoded passwords and maintainer-objects from the script and put it on github: https://github.com/jviersel/nipap-ripe-sync Use it, improve it, share the improvements, leave some credits and have fun! Regards, Jurrian

1 0