ISP's role in controliing Cyber Obscenity.

A week ago, we were given instructions by some intelligence officers from the communications regulator to block one of the obscene websites that was publishing adult content and wrong information to the public. As stake holders, we did not hesitate to do as instructed and withing an few minutes, some security policies were implemented blocking any access to the same site by all our customers.

Having worked for an ISP for nearly 3 years now, it never occurred to me that this institution was so significant to national security especially regarding matters of cyber crime and obscenity. I have realized that ISP's can really play an upper role in helping a nation curb such security related issues by merely implementing filters to on-line content that is inappropriate to the public.

Big ups to all the national and private ISP's that were involved in the blocking of such websites.

./noah

IPv6 Task Force | Dar es Samaal

Well, over the past few years i have been working as a Network and Systems engineer, it never occurred to me that one day i would think of giving back to the community. The past five years i would say have been all about working on developing my carrier as an outstanding Network/Systems engineer mainly involving my self with ISP related projects.

Now that i have started feeling comfortable down here in Dar es salaam, i thought of doing something valuable during a few hours of my free time, something that is not new, but something that would help me and those interested in joining me on this journey, move fast i guess and help our communities.

The other world tends to believe that things in Africa always come/happen last, but i don't believe the same. I believe that we can move on the same pace like the rest if we decide to work together and sensitize each other on matter that affect us in all aspects of life.

IPv6 adoption and IPv4 exhaustion are some one of those factors that are going to affect the way we work, leave, play and learn. As in an Engineer who spends most of his time working with customers at an ISP level, i have become concerned about the role ISP's in the region are going to play in helping with this IPv6 adoption and transformation process. According to sources over the interner, IPv4 address space with exhaust by 2010 in the ARIN and other regions except the AfriNIC regions where v4 space is still under utilized at this point.

Therefore to cut the story short, join me in impacting and sensitizing the community on matters regarding IPv6 here in Dar es salaam. I have been developing a website that i host locally on my server, to facilitate online sensitization.

www.ipv6.or.tz will be online soon.

I hope you will all join hands in this journey as we sensitize and promote awareness on matters related to IPv6 adoption.

./noah

Killing the QoS Beast..

Ok i have been working on obtaining my CCIE SP # and along the road, i had to make some decision as i read and understand the technology. As you all know, CCIP is i would say, a good foundation for the SP Lab given the fact that it concentrates on Q0S, MPLS and BGP which i presume are the corestone for the SP Lab.

So of lately i have been reading lots of QoS stuff and now i have decided to give the 642-642 exam a shot. I am told its a tough one, but we will roll.

Lets see how it goes come January 2009.. :-) lol

Knowledge is like LOVE, the more u give the more u get.

I came across this from one of the blogs and though i would post so the visitors can read the same.

An Ancient Chinese scholar Confucius once said:

I hear and I forget.
I see and I remember.
I do and I understand.

And to that, my college professor added;

I teach others and I understand more.

Catalyst 3560 Cisco IOS QoS.

Well, sometimes i feel like the best way to understand a technology is to write about it. I was reading about QoS for Cisco based switched networks and i though maybe i could share my understanding of the technology with all visitors of this blog.

Qos which is an abbr to "Quality of Serice" according to Cisco; refers to the capability of a network to provide better service to selected network traffic over various technologies, including Frame Relay, Asynchronous Transfer Mode (ATM), Ethernet and 802.1 networks, SONET, and IP-routed networks that may use any or all of these underlying technologies. The primary goal of QoS is to provide priority including dedicated bandwidth, controlled jitter and latency (required by some real-time and interactive traffic), and improved loss characteristics. Also important is making sure that providing priority for one or more flows does not make other flows fail. QoS technologies provide the elemental building blocks that will be used for future business applications in campus, WAN, and service provider networks. This chapter outlines the features and benefits of the QoS provided by the Cisco IOS QoS.

Now that we all know what QoS is, lets see how it can be implemented on a Cisco 3560 Catalyst layer 3 switch.

Will start by classifying the type of traffic or application we need to implement QoS on.

Router#enable
Router#config terminal
Router(config)#class-map match-any junk-internet-traffic
Router(config-cmap)#match protocol kazza2
Router(config-cmap)#match protocol Gnutella
Router(config-cmap)#match protocol fasttrack
Router(config-cmap)#exit

Router(config)#class-map match-any important
Router(config-cmap)#match protocol ipsec
Router(config-cmap)#match protocol smtp
Router(config-cmap)#exit

After classifying we now need to Mark the above applications/traffic.

Router#enable
Router#config terminal
Router(config)#policy-map marking
Router(config-pmap)#class junk-internet-traffic
Router(config-pmap-c)#set precedence 0
Router(config-pmap-c)#exit
Router(config-pmap)#class important
Router(config-pmap-c)#set precedence 5
Router(config-pmap-c)#exit

After Marking the traffic we can now apply the policy to the interface.

Router#enable
Router#config terminal
Router(config)#int fa0/0
Router(config-if)#service-policy input marking


With the above, we have achieved to implement QoS with one Policy called Marking which contains a number of different classes of traffic i.e. important and junk-internet-traffic.

Google vs Locally based Search Engines

A very good friend of mine one time wanted to buy some item from the local stores in Dar-es-salaam. But in his quest to purchase the item, he spent almost 1 if not 2 days wondering around different shops and stores seeking for the same item...but with no luck.

If there is something he could not take anymore, was fatigue. Immediately he called me and asked me one simple question!!!. Noah, how long do you think it would take someone to find the an item they are looking for, in case some sort of a search engine similar to Google with information (database) about the local market and economy was available?, Well i though for a minute and then told him, it would take them a minute if not 2, and they would have the answer. He then laughed and said that is the point....1 or 2 minutes and you have what you're looking for.!!!!

The point here is, as much as Google can help us in Africa to find information globally and somewhat locally, it is not that efficient enough as very less information is availed to Google regarding our Africa's local economy. And for that matter, projects such us TAFUTA (www.tafuta.co.tz)and BONGOZA (www.bongoza.co.tz) are becoming more significant and important in East Africa.

It would also be much wiser if Google localized its information database based on local economies/countries for instance for Tanzania, www.google.co.tz would useful for searching withing Tanzania and www.google.com would be reserved for global purposes.

This of course would enable the searching of anything locally more easier...than walking street by street looking for some item which probably is just next door.

./noah

BIND 9 exploit is out. please check your DNS

This exploit targets a flaw in DNS implementations which allows the insertion of malicious DNS records into the cache of the target DNS server. Without wasting time....i had to Dig deep and find quickest solution possible to fix my own name servers.

Even though ISC and most of the security experts advised that administrators should patch their name servers with the current patches and softwares, it was not easy to take the normal path especially for those who are used to yum...ing and apt-get..ing.

Below are some few steps for those running Bind on Centos or Fedora systems.

Now....i could not wait until Dan Kaminsky come August 6th at 11:15AM Pacific time goes public again to talk at the Black Hat Briefings regarding this vulnerability in BIND.And give the fact that some folks have already leaked the ways-hows of utilizing the flaw to exploit those vulnerable systems, i had to start thinking earlier on how to fix my own name servers. Believe me they were also vulnerable as i was running the old version of BIND 9.

Now my finding as simple as it may look, only applies to those folks running BIND 9 on Centos 4 or 5 and Fedora core systems ... I tested on all this boxes in my office.

Lets start..

Prerequisites
===========
- Your firewall (iptables NAT/PAT or PIX) must have port 53 open.
- You most be running BIND 9 on Centos 4 or 5 or any Fedora core systems.
- Bind must be running in chrooted mode though not a prerequisite but a best practice.
- In your /etc/named/named.conf OR /etc/named.conf files....you must disable recursion and add an acl to only allow your networks to do recursive requests.

i.e.. acl "mynetworks" {
127/8; 172.16.0.0/12; 10.0.0.0/8; 192.168.0.0/16

i.e..view "internal" {
match-clients { mynetwork; };
allow-query { mynetwork; };
allow-recursion { mynetwork; };
match-recursive-only yes;

i.e ..view "external" {
match-clients { any; };
allow-query { any; };
allow-recursion { none; };
match-recursive-only no;

AND TO FIX the BIND VULNERABILITY
-----------------------------------------------------------------------------------

Checking if your system is vulnerable...run the command below replacing youdomain.co.tz with your organizations tld or cctl.

So do the following

[superuser@ns1 ~]# dig +short @ns1.youdomain.co.tz porttest.dns-oarc.net TXT
z.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.pt.dns-oarc.net.
"192.168.1.3 is POOR: 26 queries in 20.0 seconds from 1 ports with std dev 0.00"

Poor indicates your name server or system is vulnarable...

Solution
-----------

[superuser@ns1 /]# yum update bind bind-chroot -y


[superuser@ns1 /]#vi /etc/named.conf ## Vi into your named.conf file and do the following. After save and reload BIND

options {
directory "/var/named";
allow-transfer { 192.168.1.4; };
query-source address * port 53; ## REMOVE OR COMMENT this line so as to allow randow port selection. Do this by appending a # this line
dnssec-enable yes; ## Add this line to your named to conf to enable DNS-SEC and go a head and setup DNS-sec. Remember it is not an ultimate solution


[superuser@ns1 /]#/etc/init.d/named reload

Then Check again to test
----------------------------

[superuser@ns1 /]# dig +short @ns1.youdomain.co.tz porttest.dns-oarc.net TXT Just to confirm...:-)

z.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.pt.dns-oarc.net.
"192.168.1.3 is GOOD: 26 queries in 19.6 seconds from 26 ports with std dev 16515.27"
===========================================================================================================================================================

Good indicates that Your name server, at x.x.x.x, appears to be safe, but make sure the ports listed aren't following an obvious pattern. i.e the ports with standard deviation..16515.27..if your test clocks 10000.00 the your DNS server is more safer and your clients or users should not worry.

Do the same on all your DNS server in your organization. Suggestions and comments are welcome.

Good Luck.

./noah