wildcard domains

I have tried configuring wildcard domains for Bind and Apache to work together. In Bind, the syntax of a zone file (example.com) is simple :

*.example.com. 1H IN A 1.2.3.4

As for Apache, the directive for supporting named-based virtual hosting must be enabled:

NameVirtualHost 1.2.3.4

Next comes the ServerAlias to align with the virtualhost:

# comment: this one accepts any subdomain
#
< VirtualHost 1.2.3.4:80>
DocumentRoot /var/www/html/subdomain
ServerName www.example.com
ServerAlias *.example.com
< /virtualhost>

The above configuration is easily understood. Any URL ending with example.com will access www.example.com. The sequence of wildcard entry is worthy of precaution. The wildcard entry must be the last and must come after valid subdomain name because Apache looks at lines and files and uses the first one that has matched.

I can not think of any practical applications of wildcard domains. Some might argue that if the subdomain part is mistyped, users can still reach the correct website.

One question I have in mind is can IIS support wildcard domains?

IPv6 and IPv4 gateway services

SixXS is providing IPv6 and IPv4 gateway services through the use of domain names. Suppose an IPv6 only host wants to access IPv4-based www.cnn.com, the URL is www.cnn.com.sixxs.org. Converserly, for an IPv4 host to access IPv6 servers such as ipv6.google.com, the URL will be ipv6.google.com.ipv4.sixxs.org.

Great work. The is another way for people to access IPv6 web sites without using tunneling.

US Cybersecurity Chief

Mr Howard Schmidt, our ISC2 Director has been appointed by President Obama as the US Cybersecurity Chief. This is a great honor to all ISC2 members.

Perhaps PISA should announce this good news at the Annual Dinner next month.

一台獨立的主機

國內的朋友，在網上討論 IT技術時要打醒十二分精神。例如說 "一台獨立的主機，可架設多個虛擬網站"。「台獨」二字引致GFW 追踪發訊者所在，而公安亦會請你協助調查。不知這是可笑還是荒謬 !

.google top level domain

Google has conquered the cyber world, why not having its own top level domain. I bet the TLD ".google" will appear very soon. What are the results then ? Google search at search.google, Gmail at mail.google, Google Map at map.google, blogger at blog.google etc…

Wooo.. Google will become bigger, stronger and more powerful than any companies in the world.

6to4 Reverse DNS Delegation

A visitor to my blog informed me that the Number Resource Organization (NRO) is the authority for 6to4 reverse DNS delegation. The delegation is done at https://6to4.nro.net/. I am really surprised as I have always wanted to set reverse lookup of my 6to4 address in order to set up SMTP service.

Since I am using the IP address 202.81.252.116, upon converting to 6to4 address, I own the IPv6 address prefix of 2002:ca51:fc74::/48. The requirements to meet 6to4 RDNS delegation are very strict:

1. The requester must use a 6to4 IPv6 address to visit the web site.

2. Only RDNS delegation of a /48 prefix related to the visiting IPv6 address is allowed.

3. The website knows which /48 prefix is to be delegated by checking on the visiting 6to4 address. There is no need for the requester to make any input.

4. The nameservers must have the proper configuration in place to handle the reverse lookup of the /48 prefix before requesting the delegation. Once the submit button is clicked, reverse lookup will be checked and if there is anything wrong, the delegation will not be successful.

I fully support these rules as they are designed to verify who own a 6to4 address range.

Hopefully, I passed all the check. I am now able to do “dig –x 2002:ca51:fc74::1” which points to “ipv6.warrenkwok.com”.

I like to give a big thank to the Number Resource Organisation.

IPv6 Reverse DNS Configuration

On IPv6, I do have some good news this week.

By now I am able to do configurations for IPv6 reverse DNS delegation on /48, /56 and /64 subnets. For a couple of months, the syntax of the Bind config files and the zone files for IPv6 reverse lookup scared me to death. However, after playing around and looking at the settings of existing working IPv6 systems through "dig -x", I was able to figure out how these things worked together.

It has been a great learning exercise. I will create sample templates for /48, /56 and /64 subntes for my future reference.

IPv6 Certification Scorecard

After 100 days of daily ping6, traceroute6, dig and whois, I have made a top score of 1400 for my IPv6 Sage Certification. That says, I do not need to log on Hurricane Electric's certification web site any more. However, in order to keep abreast of IPv6 development, I still read the discussions in HE's Forum.

4-byte Autonomous System Numbers

Some ISP friends told me that they found AS numbers larger than 65536 in advertised BGP routes in the range of 13XXXX. This is a good sign since some service providers are using 4-byte AS numbers for their routing. Without resorting to 4-byte AS numbers, new comers can not have their routers hooked up to the Internet.

In fact, APNIC is administering 2.xxxxxx prefix for 4-byte AS numbers. The first 4 byte AS assigned to Hong Kong is 2.155 or written as AS131227 (2 x 65536 + 155). It is good to see that whois search can also support AS number larger than 65536.

[root@localhostl]# whois –h whois.apnic.net AS131227
aut-num: AS131227
as-name: ASIADC-HK-AP
descr: Asia Data Center Limited
country: HK
admin-c: ADCL1-AP
tech-c: ADCL1-AP
mnt-by: MAINT-ASIADC-HK
changed: hm-changed@apnic.net 20090914
source: APNIC

Internode brings surprise to the IPv6 world

Australian ISP Internode brings surprise to the IPv6 world. It rolls out a native IPv6 trial service over ADSL. Users will be offered a /60 prefix and it is up to the broadband routers of users to allocate IPv6 addresses to their hosts. This is the first time that IPv6 trial service involves prefix delegation to end users. However, as reported by some Australian users, the only compatible CPE is Cisco 877 ADSL router running IOS 12.4 which can handle prefix delegation and IPv6 address allocation to hosts.

The trial service of Internode is more advanced than the current residential IPv6 service of NTT. NTT only offer one single IPv6 address instead of a /60 or /64 prefix.

Number of friends in a facebook account

I recently found that there is a limit on the number of friends in a facebook account. The limit is set at 5000. My question is if someone opens two accounts, how can the status update be propagated to friends of both accounts.

Still on facebook. The word "unfriend" now appears in Oxford dictionary. It has the meaning of pulling out a friend from the facebook friend list. Personally, I think "defriend" might be better. I can quote good examples of starting with de to mean doing something opposite.

Facebook scam

I received serveral email about Facebook scam for stealing login information:

"Dear Facebook user,

In an effort to make your online experience safer and more enjoyable, Facebook will be implementing a new login system that will affect all Facebook users. These changes will offer new features and increased account security.
Before you are able to use the new login system, you will be required to update your account.

Click here to update your account online now.
If you have any questions, reference our New User Guide.

Thanks,
The Facebook Team"

The sending domain is "facebookmail.com". This domain is very questionable and is registered with malicious intent. Just wonder why domain name registra can not deny the registration.

40th anniversary of Sesame Street

Any organizations remind us about the 40th anniversary of Sesame Street. Google does.

Look at this lovely picture in Google page:

rsync to download Fedora Core iso image

More and more mirror sites of Fedora Core offer the rsync capability for getting the iso images. It is therefore necessary for me to practise downloading by rsync. I have tried the following with success :

#rsync -zvP rsync://fedora.mirrors.hkt.cc/fedora/releases/11/Fedora/i386/iso/Fedora-11-i386-DVD.iso .

Note the -P attribute which is quite important to monitor progress of transfer and the estimated time remaining.

HKDNR now supports IPv6 glue records

Last Friday, I was informed by the IT Manager of HKDNR that the .hk TLD nameservers can now support the hosts with IPv6 addresses as glue records. I have tetsted the glue functionality and the results were perfect.

This is a major development in the DNS infrastructure. By allowing IPv6 glue, HKDNR is helping the Internet community in Hong Kong to better prepare for transition to IPv6. By now, I can tell my friends that Hong Kong is not far lagging behind in IPv6 preparedness.

naming of Windows 7

Microsoft said Windows 7 is named because it is the 7th generation of Windows OS. Can anyone still recall all the previous six generations. It's not difficult. I can say they were Windows 3, Windows 95, Windows 98, Windows 2000, Windows XP, Windows Vista.

Still history again, TCP/IP stack was added starting from Windows 95. IPv6 stack was available in Windows 2000, Windows XP and Windows Vista but Windows 2000 and Windows XP require users to install and enabled it. For Vista, IPv6 is enabled by default. Of course, as Windows 7 is an improvement over Windows Vista, all IPv6 features are retained.

Wa.., the photo below is interesting, a burger with 7 layers of beef:

HSBC's dual-password logon

Recently, I was shocked by the HSBC's dual password logon to its Internet banking services. For this scheme, the authentication page requires users to give the first password in the exact string sequence while for the second password, users are only required to input 3 characters and the positions of which characters to be inputted are random. I have a screen capture to illustrate.



Malware-infected keyloggers can capture all the key strings including usernames, 1st password, and any inputted characters of the 2nd password. What a hacker needs to do is to find the position in the screen and inject the known characters in order to get access. I am of the view that this protection scheme is much weaker than using security tokens. HSBC advises that this is to give more convenience to the users given that some users might not bring their tokens with them all the time.

I myself would not use this kind of authentication.

Safe Internet banking by using Linux live CD

Some security experts have suggested to use Linux live CD for safe Internet banking. This makes good sense considering that malware is targeted to steal data from Windows-based systems and won't load or work when the user is booting from LiveCD.

Some might argue that not many people have understanding of burning iso image of Linux live CD and use it for a single application. If that is the case, they should consider using an Apple Mac PC instead of Windows PC.

IPv6 Proxy

I have added one of my website to an IPv6 Proxy (http://www.ipv6proxy.nl/).

If a website is configured with an IPv4 address, there is no way hosts in the IPv6only cloud can access this web site. IPv6 Proxy turns out to be a solution.

The IPv6 proxy listens to 2a00:d00:ff:131:94:228:131:131 and it will fetch website contents over IPv4 and then pass to the visiting IPv6 browser clients. The website owner is required to add an AAAA record 2a00:d00:ff:131:94:228:131:131 to the website such as:

"www.example.com. 1H IN AAAA 2a00:d00:ff:131:94:228:131:131"

The last step is of course to register the website name with the proxy.

This is a cool application from an IPv6 implementation perspective.

Facebook Extended Maintenance

For the past 5 days, I was not able to login facebook. Today, the situation had not changed but Facebook tried to give a different error message:

"Sorry, due to site maintenance your account is unavailable at this time. We are currently experiencing an extended site maintenance issue that is preventing some users from accessing their accounts or Pages they may administer. Rest assured that your account has not been deleted or compromised. Your original account will be restored as soon as possible so there is no need to create a new one. We sincerely apologize for any inconvenience you've encountered while attempting to log in to Facebook during this time.

You can stay updated with the progress of this bug by visiting the Help Center."

I am sure that a huge number of account holders could not wait for so many days and they have already created new accounts. Sigh... the proper message prompt comes a bit too late.