my past domain i3way.com on sales

I received the following email from a domain name reseller :

******** Extract ********
Date: Mon, 15 Feb 2010 13:04:39 +0000 (GMT)
From: John Timmers
To: "warren@bya.org.hk"
Subject: i3way.com

i3way.com is coming available for sale in a few days.

Since you own the domain i3way.net, we thought you'd be interested in i3way.com. If you do have interest in acquiring i3way.com, please fill up priority notice form availble here:

http://initrustnetwork.org/store/prioritynotice/a2aeb084-0ec5-4937-ad8e-ba264718442f

and we will contact you as soon as the domain is available for purchase.

We look forward to hearing back from you.

Kind regards,

John Timmers
InTrust Domains
11590 Black Forest Road
Colorado Springs, CO 80908-6000
=========

Actually, the domain i3way.com was owned by me from 2000 to 2006. I decided to give it up and used i3way.net due to large amount of spam sending to users of i3way.com. Coupled with DNSBL of Spamhaus and Spamcop, I have eliminated over 95 % of spam emails.

Wooo..a bit of memory recall.

NAT in 3G mobile networks

I like to dedicate the picture below to 3G mobile operators that deploy NAT in their networks:



The picture just say one part of the stories - congestion due to limited port numbers in a NATed outgoing IP address. There are other harms such as lack of end-to-end security and quick battery drain of mobile devices.

You think that 16 million private addresses in 10.0.0.0/8 (Class A, RFC1918) are large enough to serve all your subscribers. That's shit. Your subscribers deserve better quality of service.

Shame on you, 3G mobile operators !

ip6tables to do bandwidth throttling

Now that I have an autoreply email facility on v6 by way of Postfix, I need to make sure this facility is not abused. Unlike Sendmail, parameters for bandwidth throttling are not provided in Postfix. Hopefully, I can make use of ip6tables to limit the number of concurrent connections from an IPv6 address to 5. The following has been tested successfully:

#ip6tables -A INPUT -p tcp --syn --dport 25 -m connlimit --connlimit-above 5 -j REJECT

Once again, I witness the power of iptables and ip6tables.

IPv6 email autoreply facility

In the past two days, I was busy setting up an autoreply facility for IPv6 email. My experience is that if system administrators set up their IPv6 SMTP servers, it is difficult for them to find IPv6-enabled mail servers for mail transaction tests. Even if they found some, how can they make request to ask some body to help the test. What I try to do is to set up an IPv6 only SMTP server, dedicate an email account with autoreply so that other system administrators can perform IPv6 mail transaction without bothering to call me.

Luckily, I got the domain “v6-mail.com”. Logically, the email account for autoreply function is “autoreply@v6-mail.com”. I continued to configure my DNS to handle MX and AAAA records. Next, I installed Postfix on a dual-stack Linux server with 6to4 tunnelling and I forced Postfix to listen to IPv6 address only. Then came the most difficult task. How to enable autoreply function on the user “autoreply”. I used .forward and vacation but the problem is vacation only reply to sender once within a day and any other subsequent email received from the sender will not be replied. I recalled that flushing vacation.db will clear all previous locked records so I added an cron job to do “/usr/bin/vacation –I” on a per minute basis. This solved all problem plus it added anti-spam feature. If the sender sends more than one request to “autoreply@v6-mail.com” for testing, only one autoreply message will be delivered within a minute.

All these bundled together work up to my expectation. I am very glad that I have developed something helpful to the IPv6 community.

Risk of Windows 6to4 IPv6 address

Some network administrators are considering launching their IPv6 websites with the use of 6to4 address.

Windows 2003 Server has the function of auto-config 6to4 IPv6 address and the associated gateway. I like to stress that there is a security concern in using Windows default 6to4 IPv6 address. Take an example, for the IP addresss 202.81.1.1, the IPv6 address will become 2002:ca51:101::ca51:101. The 3rd - 6th octets exactly matching 13th - 16th octets tells outsiders that this IPv6 address is assigned to a Windows Server and if it is running web service, IIS is adopted. Hackers can initiate attacks targetted at Windows and IIS vulnerabilities.

Unfortunately, for Windows OS, network administrators have no way to change the auto 6to4 address or to remove it permanently. For the example above, a work-around solution is to manual assign another 6to4 address within the range 2002:ca51:101::/48 to that interface and publish the AAAA record with the manual assigned IPv6 address. This way, things should work without a clue to outsiders what OS are behind.

sixy.ch

Sixy.ch is a directory of web sites that are accessible by IPv6. There are now 2952 sites listed. Today, I added my three IPv6 websites into the directory, namely :

www.i3way.net, www.bya.org.hk and www.hoimun-spa.com

All are binded with the IPv6 address of 2001:470:18:16c::2 through tunnel broker of Hurricane Electric.

TTL of A and AAAA records assigned to a FQDN

Today, I talked with some IT friends about the importance of having identical TTL of A and AAAA records assigned to a fully qualified domain name (FQDN). Take a look at the illustration below:

www.example.com. IN A 300 1.2.3.4
www.example.com. IN AAAA 100 2001:aaaa::1

In an resolver, the AAAA record will disappear in cache after 100 seconds. After that time, an IPv6 only host interrogates the resolver for www.example.com will only get the A records and the target site can not be reached. Similarly, in the case of TTL of AAAA > A, an IPv4 host can only get the AAAA records but due to the lack of IPv6 connectivity, the site can not be reached.

As a rule of thumb, TTL of A and AAAA records assigned to a FQDN must be equal.

Lack of authoritative IPv6 NTP Servers in Hong Kong

The number of IPv6 servers and hosts in Hong Kong are increasing. Yet there is not an authoritative IPv6 time server to be used by the Internet community in Hong Kong. Though there are IPv6 NTP servers in US or Europe, we can not rely on them to sync server clock due to the latency issue.

In terms of security, all access and event logs must be accompanied accurate time stamp in order to make them trustworthy. The lack of an authoritative IPv6-based standard time server in Hong Kong really affect security aspects of IPv6 servers.

The current Internet standard time service on IPv4 (stdtime.gov.hk) is provided by the Hong Kong Observatory (HKO). I have talked with people in the HKO and they say they might look into the issue in due course. I have no hope this can be resolved quickly as I fully understand that ISPs are reluctant to offer native IPv6 connectivity.

A new dual-core desktop PC

Over the week-end, I assmbled a new dual-core desktop PC at a cost of HK$2510. I picked the following components:

ASROCK G31M-S motherboard, $300
Intel Dual Core E5400 (2.7 GHz), $530
500 Watt power supply, $ 280
ATX Case, $100
DVD R/W drive, $220
2GB DDR2 800 MHz RAM, $340
Geforce 210 512MB Display card, $340
500 GB Hard Disk, $ 400

The configurartion is not really high-end but it should meet the requirements of a game station.

HTTPS in Gmail

Congratulation to Google for adopting HTTPS in Gmail in both the authentication session and after-login session. Yahoo mail only uses HTTPS in the login part and everything afterward is unprotected.

高鐵與我

高鐵與我

一月十六日 (星期六) ，我在立法會門外皇后像廣塲站了一整天，參與「反高鐵，停撥款」的活動。我不是反對興建高鐵香港段接駁國內高速鐵路網，而是覺得這條香港段造價太離普、完全沒有充份諮詢及將來建成後只惠及小部份人。

廣塲有近一萬人，我們全神貫注留意大瑩幕上即時播放議會內的一問一答。當有十五分鐘休會時，我們以唱歌作為輕鬆減壓。奇怪，不單是議員有壓力，連關心的市民也感受到壓力。我可以衷心講句，冗長的發問不是「拉布」，而是涉及很多法律(一地兩檢)、選址 (西九對錦上路)、環保、躁音、交通擠塞、清拆、搬遷及賠償等問題。一眾官員都是問非所答，模稜兩可，絕大部份問題都未有解决方法。

廣塲附近有近百人的苦行隊伍，由幾歲小學生到七十多歲公公婆婆，由「八十後」帶領。他們以齊整的步伐，二十六步一跪，違繞著立法會前行，不讓手上拿着的幾粒米和種子跌下，路過的途人，眼見這情景，無不感動，有些還掉下眼淚。很想向「八十後」和苦行人士說聲多謝，你們喚起港人的良知，不要盲目追求發展，要珍惜現有的環境，愛護家園。

立法會另一邊的遮打花園，有數百名支持興建高鐵的人士，分別是飲食界、旅遊界、建造工人及民建聯支持者。他們真的很有錢呵，可以舞龍舞獅助興，還請不同的舞蹈團表演肚皮舞及流行舞，對於議會內進行討論的事，相信他們都沒有興趣。

其實，以建制派及功能組別的票數，高鐵撥款一定可以通過，但通過之餘，可否考慮一些額外措施，減小受影響，以彌補資詢不足呢。到四時左右，泛民開始提出動議，大部份動議都是對市民及受影響的居民有利的。例如有兩項動議要求港鐵給予新界西和新界東居民乘車優惠，因為日後這两區居民要長途拔涉才可乘拾高鐵，很不幸地兩項動議全被否決。最令人髮指的是有一項動議要求在施工期間，給予大角咀受影響的居民定期發放資訊，也遭否决。既然施工影響居民生活，提供資訊是理所當然的，為何這卑微的要求都不被接納呀 ！

撥款通過後，我即時擔心菜園村的命運，我希望用這次活動為菜園村居民所作的一首歌，作為對他們的打氣：

菜園之光 (調寄友誼之光)

人生於世上最緊要個家
一生種下人地情
早上落田用我雙手創豐收
晚來閒話句句溫暖

簡單的快樂
可否再續弦下半生
你的發財大路
可否不進入我家

鄉土共發展(唏)
也可以共存(哈)
只須這路
不兜進我家
這縈縈樂土可不變
Repeat

撥款雖獲通過，但不要忘記這次民間活動也有很多成功的地方。第一，在譽論壓力下，迫使有利益衝突的何鐘泰 (中國建築董事)、石禮磏(港鐵董事)、 林健鋒 (新昌營造非執行董事)，陳健波(競投西鐵工程保險項目) 缺席投票。其次政府日後在影響民生的大型基建上要做足諮詢。最重要的還是市民巳察覺到建制派和功能組別的禍害。

人在做，天在看，一月十六日所有投票都是記名的，每位議員的一言一行都會赤裸地暴露在立法會會議紀錄上，一字不漏，千秋萬世，直到永遠。

ISACA's Business Model for Information Security Model

This picture is the ISACA's Business Model for Information Security.



According to ISACA, the Business Model for Information Security is made up of four elements and six dynamic interconnections. It can be viewed as a three-dimensional model, best visualized as a pyramid. All aspects of the Model interact with each other. If any one part of the Model is changed, not addressed or managed inappropriately, it will distort the balance of the Model.

The Elements are : Organization Design and Strategy, People, Process and Technology.
The Dynamic Interconnections linking these elements are : Culture, Architecture, Governance, Emergence, Enabling and Support, and Human Factor.

Really impressive illustration.

wildcard domains

I have tried configuring wildcard domains for Bind and Apache to work together. In Bind, the syntax of a zone file (example.com) is simple :

*.example.com. 1H IN A 1.2.3.4

As for Apache, the directive for supporting named-based virtual hosting must be enabled:

NameVirtualHost 1.2.3.4

Next comes the ServerAlias to align with the virtualhost:

# comment: this one accepts any subdomain
#
< VirtualHost 1.2.3.4:80>
DocumentRoot /var/www/html/subdomain
ServerName www.example.com
ServerAlias *.example.com
< /virtualhost>

The above configuration is easily understood. Any URL ending with example.com will access www.example.com. The sequence of wildcard entry is worthy of precaution. The wildcard entry must be the last and must come after valid subdomain name because Apache looks at lines and files and uses the first one that has matched.

I can not think of any practical applications of wildcard domains. Some might argue that if the subdomain part is mistyped, users can still reach the correct website.

One question I have in mind is can IIS support wildcard domains?

IPv6 and IPv4 gateway services

SixXS is providing IPv6 and IPv4 gateway services through the use of domain names. Suppose an IPv6 only host wants to access IPv4-based www.cnn.com, the URL is www.cnn.com.sixxs.org. Converserly, for an IPv4 host to access IPv6 servers such as ipv6.google.com, the URL will be ipv6.google.com.ipv4.sixxs.org.

Great work. The is another way for people to access IPv6 web sites without using tunneling.

US Cybersecurity Chief

Mr Howard Schmidt, our ISC2 Director has been appointed by President Obama as the US Cybersecurity Chief. This is a great honor to all ISC2 members.

Perhaps PISA should announce this good news at the Annual Dinner next month.

一台獨立的主機

國內的朋友，在網上討論 IT技術時要打醒十二分精神。例如說 "一台獨立的主機，可架設多個虛擬網站"。「台獨」二字引致GFW 追踪發訊者所在，而公安亦會請你協助調查。不知這是可笑還是荒謬 !

.google top level domain

Google has conquered the cyber world, why not having its own top level domain. I bet the TLD ".google" will appear very soon. What are the results then ? Google search at search.google, Gmail at mail.google, Google Map at map.google, blogger at blog.google etc…

Wooo.. Google will become bigger, stronger and more powerful than any companies in the world.

6to4 Reverse DNS Delegation

A visitor to my blog informed me that the Number Resource Organization (NRO) is the authority for 6to4 reverse DNS delegation. The delegation is done at https://6to4.nro.net/. I am really surprised as I have always wanted to set reverse lookup of my 6to4 address in order to set up SMTP service.

Since I am using the IP address 202.81.252.116, upon converting to 6to4 address, I own the IPv6 address prefix of 2002:ca51:fc74::/48. The requirements to meet 6to4 RDNS delegation are very strict:

1. The requester must use a 6to4 IPv6 address to visit the web site.

2. Only RDNS delegation of a /48 prefix related to the visiting IPv6 address is allowed.

3. The website knows which /48 prefix is to be delegated by checking on the visiting 6to4 address. There is no need for the requester to make any input.

4. The nameservers must have the proper configuration in place to handle the reverse lookup of the /48 prefix before requesting the delegation. Once the submit button is clicked, reverse lookup will be checked and if there is anything wrong, the delegation will not be successful.

I fully support these rules as they are designed to verify who own a 6to4 address range.

Hopefully, I passed all the check. I am now able to do “dig –x 2002:ca51:fc74::1” which points to “ipv6.warrenkwok.com”.

I like to give a big thank to the Number Resource Organisation.

IPv6 Reverse DNS Configuration

On IPv6, I do have some good news this week.

By now I am able to do configurations for IPv6 reverse DNS delegation on /48, /56 and /64 subnets. For a couple of months, the syntax of the Bind config files and the zone files for IPv6 reverse lookup scared me to death. However, after playing around and looking at the settings of existing working IPv6 systems through "dig -x", I was able to figure out how these things worked together.

It has been a great learning exercise. I will create sample templates for /48, /56 and /64 subntes for my future reference.

IPv6 Certification Scorecard

After 100 days of daily ping6, traceroute6, dig and whois, I have made a top score of 1400 for my IPv6 Sage Certification. That says, I do not need to log on Hurricane Electric's certification web site any more. However, in order to keep abreast of IPv6 development, I still read the discussions in HE's Forum.