swinog

swinog@lists.swinog.ch

2916 discussions

DNS issue @ metanet?
by Benoit Panizzon 17 Jan '20

17 Jan '20

Hi Community Since yesterday we see more and more message of the kind: (host mail.zabli.ch[80.74.146.90] said: 450 4.7.1 Client host rejected: cannot find your hostname, [157.161.13.198] (host mx03.sui-inter.net[80.74.146.163] said: 554 IP name lookup failed. No PTR record found (host mx03.sui-inter.net[2a00:1128:0:146::163] said: 554 IP name lookup failed. No PTR record found (host mx01.sui-inter.net[2a00:1128:0:143::111] said: 554 IP name lookup failed. No PTR record found (host mail.musikstunden.ch[80.74.153.11] said: 450 4.7.1 Client host rejected: cannot find your hostname (host mail.schreinerei-furler.ch[80.74.145.2] said: 450 4.7.1 Client host rejected: cannot find your hostname (host mail.von-rickenbach.com[80.74.155.60] said: 450 4.7.1 Client host rejected: cannot find your hostname It looks like all those cases are hosted @ metanet. But there are some mailserver @ metanet which do accept emails. Is there any known DNS issue with metanet? According to their status page there are no issues. Or is something wrong with the readability of our DNS from outside AS6772? (ns1.imp.ch, ns2.imp.ch) Mit freundlichen Grüssen -Benoît Panizzon- -- I m p r o W a r e A G - Leiter Commerce Kunden ______________________________________________________ Zurlindenstrasse 29 Tel +41 61 826 93 00 CH-4133 Pratteln Fax +41 61 826 93 01 Schweiz Web http://www.imp.ch ______________________________________________________

1 0

FYI: admin.ch broken DNSSEC thus DNS down!
by Jeroen Massar 11 Jan '20

11 Jan '20

As mentioned on Swinog IRC (yes we are alive there, join us! :): admin.ch is unreachable due to broken DNSSEC. See: https://dnsviz.net/d/admin.ch/dnssec/ 8<---- ch to admin.ch: No valid RRSIGs made by a key corresponding to a DS RR were found covering the DNSKEY RRset, resulting in no secure entry point (SEP) into the zone. (162.23.37.16, 162.23.37.160, 212.103.72.85, 2a00:c38:2:28:0:ffff:d467:4855, UDP_-_EDNS0_4096_D_K) ch to admin.ch: The DS RRset for the zone included algorithm 8 (RSASHA256), but no DS RR matched a DNSKEY with algorithm 8 that signs the zone's DNSKEY RRset. (162.23.37.16, 162.23.37.160, 212.103.72.85, 2a00:c38:2:28:0:ffff:d467:4855, UDP_-_EDNS0_4096_D_K) ------>8 (I got a screencap of the page for later, just in case it get fixed/changed in the meantime; swinog only allows 40KiB attachments which would ruin the res too much for it to be useful :) Thus for all ISPs on this list: tell your customers that it is an admin.ch issue, not something you can solve (unless you disable dnssec validation for admin.ch, which is an option, but kinda against dnssec). (Fortunately it is not tax time or something like that) For folks working at admin.ch: I offer myself pro bono to help out resolving the issue, don't hesitate to reach out (email or contact details on my homepage). We can then replicate a stable environment as described in: https://jeroen.massar.ch/presentations/vid/SwiNOG35-Managing_sleep_with_a_r… or otherwise likely improve the situation to avoid such outages. Good luck folks at admin.ch in resolving this.. Greets, Jeroen

1 1

DNSSEC admin.ch
by Samuel Aymon 10 Jan '20

10 Jan '20

Hello everyone, If someone at admin.ch read this before it is too late, please check your DNSSEC config. All admin.ch domains and subdomains are unresolvable due to an errors in your DNSSEC. More infos here: https://www.admin.ch/ or here: https://dnssec-debugger.verisignlabs.com/admin.ch or here: https://dnsviz.net/d/admin.ch/dnssec/ Best regards Samuel

1 0

Fwd: [ncc-announce] [news] De-bogonising 2a10::/12
by Arnold Nipper 09 Jan '20

09 Jan '20

Happy New Year and a successful 2020 to all of you. Cheers Arnold -------- Weitergeleitete Nachricht -------- Betreff: [ncc-announce] [news] De-bogonising 2a10::/12 Datum: Wed, 8 Jan 2020 12:23:17 +0100 Von: Nikolas Pediaditis <npediaditi(a)ripe.net> An: ncc-announce(a)ripe.net Dear colleagues, A few months ago the RIPE NCC became the first RIR to receive an additional /12 IPv6 allocation (2a10::/12) from IANA. We will soon begin to delegate space from this IPv6 block to LIRs. Prior to this, in order to improve routability and minimise the risk of filtering, the RIPE NCC will perform several de-bogonising activities in the next few weeks. We plan to start announcing the full /12, as well as a few /32 or longer blocks out of 2a10::/12 from AS12654 (RIPE Routing Information System (RIS)), within the next few days. We will analyse data from RIS and RIPE Atlas and we plan to write up an analysis around this effort. We want to remind everybody to update their bogon filters and allow routes originating from 2a10::/12 in their network. Kind regards, Nikolas Pediaditis Registration Services and Policy Development Manager RIPE NCC -- Arnold Nipper email: arnold(a)nipper.de mobile: +49 172 2650958

1 0

Fwd: [ncc-announce] [news] De-bogonising 2a10::/12
by Massimiliano Stucchi 08 Jan '20

08 Jan '20

Guys, update your filters! -------- Forwarded Message -------- Subject: [ncc-announce] [news] De-bogonising 2a10::/12 Date: Wed, 8 Jan 2020 12:23:17 +0100 From: Nikolas Pediaditis <npediaditi(a)ripe.net> To: ncc-announce(a)ripe.net Dear colleagues, A few months ago the RIPE NCC became the first RIR to receive an additional /12 IPv6 allocation (2a10::/12) from IANA. We will soon begin to delegate space from this IPv6 block to LIRs. Prior to this, in order to improve routability and minimise the risk of filtering, the RIPE NCC will perform several de-bogonising activities in the next few weeks. We plan to start announcing the full /12, as well as a few /32 or longer blocks out of 2a10::/12 from AS12654 (RIPE Routing Information System (RIS)), within the next few days. We will analyse data from RIS and RIPE Atlas and we plan to write up an analysis around this effort. We want to remind everybody to update their bogon filters and allow routes originating from 2a10::/12 in their network. Kind regards, Nikolas Pediaditis Registration Services and Policy Development Manager RIPE NCC

1 0

Cleanmail contact
by Patrick Velder 11 Dec '19

11 Dec '19

Hi there Is there anyone from cleanmail? They are rejecting mails from my server (Reason: "Host blocked. Request whitelisting"). Forward/reverse DNS/HELO matches, no blacklist entries, no spamming, ... Nobody is answering mails (sent using another server). Best regards Patrick

1 0

Equinix PIN
by Michael Koloff 05 Dec '19

05 Dec '19

Hello I assume that some of you also have an account / access to Equinix data centers. And that you have been informed that you have to define a new 6-digit PIN in your account. Two things make me wonder, see the FAQ here: https://equinix.app.box.com/s/lcrutseubx9vebi4m21dir8fp66fmmlq Extract: I'm trying to select my 6-digit PIN but am receiving an error message. --> OUR SECURITY SYSTEMS ONLY ALLOW EACH PIN/COMBINATION TO BE USED FOR ONE PERSON. If you are receiving an error, please input a new combination of numbers or use the "Generate PIN" selection to generate a random, unique PIN. I forgot my 6-digit PIN, what should I do? / I want to change my 6-digit PIN DUE TO SECURITY REASONS, where can I change it? --> ....Your 6-digit PIN cannot be changed.... In concrete terms, this means that every person has a PIN, but no other person in the world can have the same PIN. This means that a maximum of 900,000 people worldwide can have access to Equinix data centres. (PINs with leading zero are not allowed) And if someone knows your PIN, at least your first authentication factor is broken and cannot be changed. Support has confirmed this behavior to me so far. Am I the only one here who finds that very weird? How do you deal with it? Best regards Michi -- Michael Koloff System- & Networkengineer sasag Kabelkommunikation AG Mühlenstrasse 21 8201 Schaffhausen Telefon: +41 52 633 01 72 mkoloff(a)sasag.ch www.sasag.ch

3 2

Fwd: RIPE NCC sucht einen neuen CEO
by Steven Glogger 05 Dec '19

05 Dec '19

CEO @ RIPE? see below (and yes: by purpose not posted on swinog-jobs) gruss -steven Anfang der weitergeleiteten Nachricht: > Von: Falk.vonbornstaedt(a)ripe.net > Datum: 5. Dezember 2019 um 12:09:23 MEZ > An: denog(a)lists.denog.de > Betreff: RIPE NCC sucht einen neuen CEO > > > Hallo, > leider habe ich es nicht nach Hamburg geschafft. Deshalb auf diesem Wege: > > RIPE NCC sucht einen neuen CEO. Ein tolles Team, herausfordernde Aufgabe, angemessene Bezahlung. Bewerbung bis 31.12.2019 möglich. > > https://www.ripe.net/about-us/staff/careers-at-the-ripe-ncc/vacancy/148244 > > Grüsse > Falk > > Dr. Falk von Bornstaedt > Executive Board > RIPE NCC > Stationsplein 11, 1012 AB Amsterdam, The Netherlands > Mobile +49 171 22 88 625 > mailto:Falk.vonBornstaedt@ripe.net > > > > Social Media > > Twitter > @RIPENCC for tweets from the RIPE NCC > @RIPELABS for tweets about RIPE Labs articles and the community > @RIPEMeeting for RIPE Meeting tweets > Hashtags we use: #RIPEstat, #RIPEAtlas, #RIPEness, #RIPENCC > > Facebook > RIPE NCC Facebook page > RIPE Meetings > > SlideShare > slideshare.net/ripencc > LinkedIn > RIPE NCC > RIPE community > > YouTube > RIPE NCC's Channel > > GitHub > RIPE NCC's git repository > > > >

1 0

Strange IPv6 scans from big networks
by Klaus Ethgen 02 Dec '19

02 Dec '19

Hi, Currently I see day long IPv6 scans from networks of Akamai (2a02:26f0:f3::/48), Google (2a00:1450:4000::/37), Apple (2a01:110::/31), Microsoft (2a01:b740::/29), Swisscom (2001:918::/32) and Init7 (2001:1620::/32) to my Network @HOME. They all try to enumerate hosts and ports in 2a02:168:4e82:0:* that does not and never have exists. The net is a fiber7 port. Anybody an idea what is going on here? On request I can provide more informations like pcaps. The scans are sourced from all over that mentioned networks above. While I have no scruples to block Apple, Microsoft, Akamai or other bad behaving networks, I do not want to block Swisscom or Init7 if not needed. Needless to say that I do not have any public service behind my fiber7 port. Gruß Klaus -- Klaus Ethgen http://www.ethgen.ch/ pub 4096R/4E20AF1C 2011-05-16 Klaus Ethgen <Klaus(a)Ethgen.ch> Fingerprint: 85D4 CA42 952C 949B 1753 62B3 79D0 B06F 4E20 AF1C

4 4

dnssec-failure for "admin.ch"
by Tom 21 Nov '19

21 Nov '19

Hi list Is a dnsadmin of "admin.ch" here? 21-Nov-2019 14:07:56.096 dnssec: info: validating admin.ch/A: verify failed due to bad signature (keyid=61614): RRSIG has expired 21-Nov-2019 14:07:56.096 dnssec: info: validating admin.ch/A: no valid signature found 21-Nov-2019 14:07:56.096 lame-servers: info: RRSIG has expired resolving 'admin.ch/A/IN': 162.23.37.16#53 Regards, Tom

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

swinog