Hello All,

When I try to make a binkp connect to 2:5030/74, I get a "Connection refused" on IPv6. On IPv4 I get a normal connect.

+ 14:46 [1796] call to 2:5030/74@fidonet
14:46 [1796] trying f74.n5030.z2.binkp.net [2a05:3580:de00:1687:21f:c6ff:fe1e:b46a]...
? 14:46 [1796] connection to 2:5030/74@fidonet failed: {W32 API error
10061} Connection refused
14:46 [1796] trying f74.n5030.z2.binkp.net [188.242.45.253]:24554...
14:46 [1796] connected
+ 14:46 [1796] outgoing session with f74.n5030.z2.binkp.net:24554 [188.242.45.253]
- 14:46 [1796] OPT CRAM-MD5-6eb76112e5d5c6080fa14db4b8d095ee
+ 14:46 [1796] Remote requests MD mode
- 14:46 [1796] SYS Cat's Shadow
- 14:46 [1796] ZYZ Michael Skolsky

An IPv6 port scan says that port 24554 is open. When I try Putty at the IPv6 adress, I see the initial response from hin binkp.

I have not seen this behaviour before. Anyone have any idea what causes the IPv6 connect to be refused and the IPv4 connect accepted?


Cheers, Michiel

--- GoldED+/W32-MSVC 1.1.5-b20170303
* Origin: he.net certified sage (2:280/5555)

Hi Michiel,

On 2017-12-18 14:46:28, you wrote to All:

MvdV> When I try to make a binkp connect to 2:5030/74, I get a "Connection
MvdV> refused" on IPv6. On IPv4 I get a normal connect.

MvdV> + 14:46 [1796] call to 2:5030/74@fidonet
MvdV> 14:46 [1796] trying f74.n5030.z2.binkp.net
MvdV> [2a05:3580:de00:1687:21f:c6ff:fe1e:b46a]... ? 14:46 [1796] connection to
MvdV> 2:5030/74@fidonet failed: {W32 API error
MvdV> 10061} Connection refused
MvdV> 14:46 [1796] trying f74.n5030.z2.binkp.net [188.242.45.253]:24554...
MvdV> 14:46 [1796] connected
MvdV> + 14:46 [1796] outgoing session with f74.n5030.z2.binkp.net:24554
MvdV> [188.242.45.253] - 14:46 [1796] OPT
MvdV> CRAM-MD5-6eb76112e5d5c6080fa14db4b8d095ee + 14:46 [1796] Remote requests
MD
MvdV> mode - 14:46 [1796] SYS Cat's Shadow - 14:46 [1796] ZYZ Michael Skolsky

MvdV> An IPv6 port scan says that port 24554 is open.

How dit you do the scan?

# nmap -pbinkp -6 2a05:3580:de00:1687:21f:c6ff:fe1e:b46a

Starting Nmap 6.47 ( http://nmap.org ) at 2017-12-18 15:18 CET
Nmap scan report for SkyNet-Best-ISP-in-StPetersburg-Russia.sknt.ru (2a05:3580:de00:1687:21f:c6ff:fe1e:b46a)
Host is up (0.052s latency).
PORT STATE SERVICE
24554/tcp closed binkp

MvdV> When I try Putty at the IPv6 adress, I see the initial response from
MvdV> hin binkp.

I'm seeing the same result for every way I try the IPv6 address (binkd, telnet using the hostname, telnet using the direct IPv6 address)...

# telnet 2a05:3580:de00:1687:21f:c6ff:fe1e:b46a binkp
Trying 2a05:3580:de00:1687:21f:c6ff:fe1e:b46a...
telnet: connect to address 2a05:3580:de00:1687:21f:c6ff:fe1e:b46a: Connection refused


Bye, Wilfred.

--- FMail-lnx64 2.1.0.18-B20170815
* Origin: FMail development HQ (2:280/464)

18 Dec 17 14:46:28, you wrote to All:

An IPv6 port scan says that port 24554 is open. When I try Putty at the IPv6 adress, I see the initial response from hin binkp.

Oh? To me it is closed. "Connection refused".

I have not seen this behaviour before. Anyone have any idea what causes

the

IPv6 connect to be refused and the IPv4 connect accepted?

Firewall?

Perhaps his "VER binkd/1.1a-47/Linux binkp/1.1" is not compiled for ipv6?

'Tommi

---
* Origin: telnet://v6.fidonet.fi (2:221/1)

On 2017-12-18 15:19, Wilfred van Velzen : Michiel van der Vlist wrote:

How dit you do the scan?

# nmap -pbinkp -6 2a05:3580:de00:1687:21f:c6ff:fe1e:b46a

Starting Nmap 6.47 ( http://nmap.org ) at 2017-12-18 15:18 CET
Nmap scan report for SkyNet-Best-ISP-in-StPetersburg-Russia.sknt.ru (2a05:3580:de00:1687:21f:c6ff:fe1e:b46a)
Host is up (0.052s latency).
PORT STATE SERVICE
24554/tcp closed binkp

Confirmed from here too, its closed:
$ nmap -6 -p 24554-24555 2a05:3580:de00:1687:21f:c6ff:fe1e:b46a

Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-18 15:59 CET
Nmap scan report for SkyNet-Best-ISP-in-StPetersburg-Russia.sknt.ru (2a05:3580:de00:1687:21f:c6ff:fe1e:b46a)
Host is up (0.014s latency).

PORT STATE SERVICE
24554/tcp closed binkp
24555/tcp closed unknown

---
* Origin: *** nntp://fidonews.mine.nu *** Finland *** (2:221/6.0)

On Mon, 18 Dec 2017, Michiel van der Vlist wrote to All:

MvdV> An IPv6 port scan says that port 24554 is open. When I try Putty
MvdV> at the IPv6 adress, I see the initial response from hin binkp.

MvdV> I have not seen this behaviour before. Anyone have any idea what
MvdV> causes the IPv6 connect to be refused and the IPv4 connect
MvdV> accepted?

has he limited the number of servers available?

)\/(ark


* Origin: (1:3634/12)

SEEN-BY: 280/464 154/120 130 140 30 0

Hello Wilfred,

On Monday December 18 2017 15:19, you wrote to me:

MvdV>> An IPv6 port scan says that port 24554 is open.

How dit you do the scan?

http://www.ipv6scanner.com/

If the port is closed the expected response is "timeout".

Oops.... I see that I made an error performing the scan. I entered the wrong IPv6 address.

So... the port is closed. That explains the "connection refused".

Redo from start..


Cheers, Michiel

--- GoldED+/W32-MSVC 1.1.5-b20170303
* Origin: he.net certified sage (2:280/5555)

Hello Tommi,

On Monday December 18 2017 16:39, you wrote to me:

An IPv6 port scan says that port 24554 is open. When I try Putty
at the IPv6 adress, I see the initial response from hin binkp.

Oh? To me it is closed. "Connection refused".

Sorry, my bad. The port is closed indeed.

I have not seen this behaviour before. Anyone have any idea what
causes the IPv6 connect to be refused and the IPv4 connect
accepted?

Firewall?

Most likely.

Perhaps his "VER binkd/1.1a-47/Linux binkp/1.1" is not compiled for
ipv6?

That may be the next hurdle, but first we got him to open that port...

Any of out Russian speaking fellows interested in helping him? He does not respond to my netmail. Maybe he can not read English...


Cheers, Michiel

--- GoldED+/W32-MSVC 1.1.5-b20170303
* Origin: he.net certified sage (2:280/5555)

Michiel van der Vlist wrote:

http://www.ipv6scanner.com/

Are you sure "I am authorized to initiate this port scan." ? :)

--
'Tommi
---
* Origin: nntp://news.fidonet.fi:911 (2:221/6)

Hello mark,

On Monday December 18 2017 09:44, you wrote to me:

MvdV>> An IPv6 port scan says that port 24554 is open.

Not so.

has he limited the number of servers available?

Not that I know of. I had no communication with him yet. But if he has such a limitation, I do not see how that would explain the observed behaviour.


Cheers, Michiel

--- GoldED+/W32-MSVC 1.1.5-b20170303
* Origin: he.net certified sage (2:280/5555)

Hello Tommi,

On Monday December 18 2017 17:11, you wrote to me:

http://www.ipv6scanner.com/

Are you sure "I am authorized to initiate this port scan." ? :)

Of course. I am a Sage. ;-) http://www.vlist.eu/fotos/sage-f.jpg


Cheers, Michiel

--- GoldED+/W32-MSVC 1.1.5-b20170303
* Origin: he.net certified sage (2:280/5555)

Hello Tommi!

18 Dec 17 17:11, you wrote to Michiel van der Vlist:

Michiel van der Vlist wrote:

http://www.ipv6scanner.com/

Are you sure "I am authorized to initiate this port scan." ? :)

In Russia, ofcourse, the ports of my system are scanned all day from
ip adresses assigned to Russia. Why shouldn't I be allowed to return
the courtesy.

Kees

--- GoldED+/LNX 1.1.5
* Origin: As for me, all I know is that, I know nothing. (2:280/5003.4)

Hello, Kees van Eeten.
On 18/12/17 17:22 you wrote:

Hello Tommi! 18 Dec 17 17:11, you wrote to Michiel van der Vlist:

Michiel van der Vlist wrote:

http://www.ipv6scanner.com/

Are you sure "I am authorized to initiate this port scan." ? :)

In Russia, ofcourse, the ports of my system are scanned all day from
ip adresses assigned to Russia. Why shouldn't I be allowed to return
the courtesy.

Sure. See the smiley. ;)

--
'Tommi
---
* Origin: nntp://news.fidonet.fi:911 (2:221/6)

Hi Kees!

Dec 18 17:22 2017, Kees van Eeten wrote to Tommi Koivula:

Are you sure "I am authorized to initiate this port scan." ? :)

In Russia, ofcourse, the ports of my system are scanned all day from
ip adresses assigned to Russia. Why shouldn't I be allowed to return
the courtesy.

They are just checking if you have applied a proper security policy :)

ciao,
Markus

---
* Origin: *** theca tabellaria *** (2:240/1661)

Good ${greeting_time}, Kees!

18 Dec 2017 17:22:12, you wrote to Tommi Koivula:

http://www.ipv6scanner.com/

Are you sure "I am authorized to initiate this port scan." ? :)

In Russia, ofcourse, the ports of my system are scanned all day
from ip adresses assigned to Russia. Why shouldn't I be allowed
to return the courtesy.

People who perform the scanning never use their own IP addresses: whether I'd need to scan some host here in Russia, I'd use a zombie host from some other part of the world (most likely from the US: most people there have very low knowledge level in the information security, so there are lots of zombie hosts which are either cheap or easy to gain control over).


--
Alexey V. Vissarionov aka Gremlin from Kremlin
gremlin.ru!gremlin; +vii-cmiii-cmlxxvii-mmxlviii

... GPG: 8832FE9FA791F7968AC96E4E909DAC45EF3B1FA8 @ hkp://keys.gnupg.net
--- /bin/vi
* Origin: http://openwall.com/Owl (2:5020/545)

Hello Alexey!

18 Dec 17 20:30, you wrote to me:

http://www.ipv6scanner.com/

Are you sure "I am authorized to initiate this port scan." ? :)

In Russia, ofcourse, the ports of my system are scanned all day
from ip adresses assigned to Russia. Why shouldn't I be allowed
to return the courtesy.

People who perform the scanning never use their own IP addresses: whether I'd need to scan some host here in Russia, I'd use a zombie host from some other part of the world (most likely from the US: most people there have very low knowledge level in the information security, so there are lots of zombie hosts which are either cheap or easy to gain control over).

OK, so the scans I see coming from Russian IP adresses are actually scans
performed from the USA. ;)

Kees

--- GoldED+/LNX 1.1.5
* Origin: As for me, all I know is that, I know nothing. (2:280/5003.4)

Hi Kees!

Dec 18 19:58 2017, Kees van Eeten wrote to Alexey Vissarionov:

OK, so the scans I see coming from Russian IP adresses are actually scans performed from the USA. ;)

Or China :) But I haven't seen any ssh dictionary attacks on IPv6 addresses so far.

ciao,
Markus

---
* Origin: *** theca tabellaria *** (2:240/1661)

On 2017 Dec 18 16:12:48, you wrote to me:

has he limited the number of servers available?

Not that I know of. I had no communication with him yet. But if he
has such a limitation, I do not see how that would explain the
observed behaviour.

i forget what the remote sees when they connect to a limited server will full ports... i'm limited here but only for ease of studying the logs while working on a problem...

)\/(ark

Always Mount a Scratch Monkey
Do you manage your own servers? If you are not running an IDS/IPS yer doin' it wrong...
... I'm glad Congress is passing a bill giving Bush intelligence.
---
* Origin: (1:3634/12.73)

Hello mark,

On Monday December 18 2017 15:07, you wrote to me:

has he limited the number of servers available?

Not that I know of. I had no communication with him yet. But if
he has such a limitation, I do not see how that would explain the
observed behaviour.

i forget what the remote sees when they connect to a limited server
will full ports...

"no AKAs in common domains or all AKAs are busy" IIRC. Anyway it does not match
what I observe. Wnat I observe is that when I try to connect, my system first tries IPv6 and it immidiately gets a "connection refused". Without any delay it
then tries to connect via IPv4 and succeeds. This behaviour is consistent. It happens every time I try. If all servers were bysy, one would expect it to be busy on IPv4 as well, at least occasionally.


Cheers, Michiel

--- GoldED+/W32-MSVC 1.1.5-b20170303
* Origin: he.net certified sage (2:280/5555)

On 2017 Dec 18 22:30:06, you wrote to me:

If all servers were bysy, one would expect it to be busy on IPv4 as
well, at least occasionally.

i was thinking of a situation where one would have two different configs sharing the same in/out dirs but having other settings different... eg: bonding
to an address, limiting servers, online at certain times only...

)\/(ark

Always Mount a Scratch Monkey
Do you manage your own servers? If you are not running an IDS/IPS yer doin' it wrong...
... I is knot dain bramaged!!!
---
* Origin: (1:3634/12.73)

Hello mark,

On Monday December 18 2017 20:11, you wrote to me:

If all servers were bysy, one would expect it to be busy on IPv4
as well, at least occasionally.

i was thinking of a situation where one would have two different
configs sharing the same in/out dirs but having other settings different... eg: bonding to an address, limiting servers, online at certain times only...

Ah, one of your exotic scenarios... ;-) I suppose such a setup is possible, binkd can be configured to listen only on IPv6 or IPv4 (listen [::] or listen 0.0.0.0) and it can be forced to only make IPv6 or IPv4 outgoing call with the -6 or -4 option for every node and the default line in the config. But I see no
added value for such a complication in the setup, I do not know of any IPv6 capable node set up this way and it is certainly not something one would expect
from a beginner in the IPv6 environment.

In case of a system with native IPv6 it is almost always either a firewall problem or a version of the mailer that does not support IPv6. So those are the
first things to look at.

Whatever. Het got it fixed already. I have no feedback yet as to the nature of the problem, but if I were to put my money where my mouth is, your scenario is not what I'd put my money on.

Firewall is nr one on my list, IPv4 only binkd version second.


Cheers, Michiel

--- GoldED+/W32-MSVC 1.1.5-b20170303
* Origin: he.net certified sage (2:280/5555)

Monday December 18 2017 20:27, Markus Reschke wrote to Kees van Eeten:

OK, so the scans I see coming from Russian IP adresses are actually
scans performed from the USA. ;)

Or China :) But I haven't seen any ssh dictionary attacks on IPv6 addresses so far.

Or telnet. That's why I have ipv6 port 23 open to my bbs / emsi mailer.

No attacks but not so many real connections either. :D

'Tommi

---
* Origin: 2001:470:1f15:cb0:f1d0:2:221:1 (2:221/1)

Hello Michiel!

19 Dec 17 13:10, you wrote to mark lewis:

MvdV> Whatever. Het got it fixed already. I have no feedback yet as to the
MvdV> nature of the problem, but if I were to put my money where my mouth is,
MvdV> your scenario is not what I'd put my money on.

MvdV> Firewall is nr one on my list, IPv4 only binkd version second.

Beside, for binkd/1.1a-47/Linux binkp/1.1 all precompiled versions for
sensible OS's have IPv6 compiled in. If you do not want it you have to
take extra measures. Usually not the first choice.


Kees

--- GoldED+/LNX 1.1.5
* Origin: As for me, all I know is that, I know nothing. (2:280/5003.4)

On 2017 Dec 19 13:10:18, you wrote to me:

If all servers were bysy, one would expect it to be busy on IPv4 as
well, at least occasionally.

i was thinking of a situation where one would have two different
configs sharing the same in/out dirs but having other settings
different... eg: bonding to an address, limiting servers, online at
certain times only...

Ah, one of your exotic scenarios... ;-)

maybe but not really... i've done it a few times here on my network to keep a system up while moving it to another system... in this case, i would add more IP addresses to one system and then bind binkd instances to some of them so they would take in the mail for the moving system(s)... once the system(s) was moved, then everything was switched to the new installation... simple firewall rules and port forwarding changes from one address to another... it is especially fun when you're NATting your connection and have a block of IPs coming through that NAT ;)

Firewall is nr one on my list, IPv4 only binkd version second.

i hadn't gotten there, yet... i was looking at the software configuration :)

)\/(ark

Always Mount a Scratch Monkey
Do you manage your own servers? If you are not running an IDS/IPS yer doin' it wrong...
... Chile Sauce - Ketchup with an attitude.
---
* Origin: (1:3634/12.73)

Hello Kees,

On Tuesday December 19 2017 13:50, you wrote to me:

MvdV>> Firewall is nr one on my list, IPv4 only binkd version second.

Beside, for binkd/1.1a-47/Linux binkp/1.1 all precompiled versions
for sensible OS's have IPv6 compiled in. If you do not want it you
have to take extra measures. Usually not the first choice.

I didn't know that, but including IPv6 by default makes sense. That a sysop who
wishes to add IPv6 to his node would not knowingly and willingly install a binkd version that does not support IPv6 is a reasonable assumption.

So we can move "binkp version supports IPv6?" to the bottom of the checklist?


Cheers, Michiel

--- GoldED+/W32-MSVC 1.1.5-b20170303
* Origin: he.net certified sage (2:280/5555)

Hello mark,

On Tuesday December 19 2017 13:04, you wrote to me:

i was thinking of a situation where one would have two different
configs sharing the same in/out dirs but having other settings
different... eg: bonding to an address, limiting servers, online
at certain times only...

Ah, one of your exotic scenarios... ;-)

maybe but not really... i've done it a few times here on my network to keep a system up while moving it to another system...

He was not moving to another system, he was merely adding IPv6 to his internet connection. Having two different configs one for IPv4 and one for IPv6 /is/ an exotic scenario in that case.

Firewall is nr one on my list, IPv4 only binkd version second.

i hadn't gotten there, yet... i was looking at the software
configuration :)

Wrong layer. IPv6/IPv6 is internet layer. Software configuration is application
layer.


Cheers, Michiel

--- GoldED+/W32-MSVC 1.1.5-b20170303
* Origin: he.net certified sage (2:280/5555)

Hi! Kees,

On 19 Dec 17 13:50, you wrote to Michiel van der Vlist:

Beside, for binkd/1.1a-47/Linux binkp/1.1 all precompiled versions
for sensible OS's have IPv6 compiled in. If you do not want it you
have to take extra measures. Usually not the first choice.

What measures? I used to think that I was a pretty good hacker but I could not
find a way to compile a recent binkD without IPv6. There again, in Linux terms
I'm still a "new hatchling".

Oh, a precise answer isn't required as I've given up on the notion and am happy
to use older versions. ;)

Cheers,
Paul.

... ((Start.Date <= end.date) AND (Finish.Date >= first.date))
--- GoldED+/LNX 1.1.5-b20110213
* Origin: Quinn's Rock - Live from Paul's Xubuntu desktop! (3:640/1384)

Hello Paul!

20 Dec 17 20:18, you wrote to me:

Beside, for binkd/1.1a-47/Linux binkp/1.1 all precompiled versions
for sensible OS's have IPv6 compiled in. If you do not want it you
have to take extra measures. Usually not the first choice.

What measures? I used to think that I was a pretty good hacker but I could not find a way to compile a recent binkD without IPv6. There again, in Linux terms I'm still a "new hatchling".

Oh, a precise answer isn't required as I've given up on the notion and am happy to use older versions. ;)

As ipv6 support is listed in the facillities, I was under the impression,
that there would be a compiler option. Moreover, because there are also
versions for OS's that do not support ipv6.

This is all I could find.

Add IPv6 support - default if building system supports RFC2553
API, except under Win32 where it needs to be enabled explicitly
(set IPV6=1 during make). Under Win32 at least WinXP SP2 is
required. Outbound IPv4 or IPv6 usage can be limited by using
-4 or -6 node parameters respectively.

But why would you want to remove the ipv6 support on a linux system.
There are other ways to disable IPv6 in Linux alltogether.

I would have to look for those. I do use IPV6, so disabling it is unknown
territory for me.

Kees

--- GoldED+/LNX 1.1.5
* Origin: As for me, all I know is that, I know nothing. (2:280/5003.4)

Hello Michiel!

20 Dec 2017 10:39, Michiel van der Vlist wrote to Kees van Eeten:

MvdV> I didn't know that, but including IPv6 by default makes sense. That
MvdV> a sysop who wishes to add IPv6 to his node would not knowingly and
MvdV> willingly install a binkd version that does not support IPv6 is a
MvdV> reasonable assumption.

if he adds ipv6 address to his binkp server on dns he might know his own error ?

do not add ipv6 to dns if not have servers that can serve it !

MvdV> So we can move "binkp version supports IPv6?" to the bottom of the
MvdV> checklist?

nodelists supports ip addresses, fail


Regards Benny

... there can only be one way of life, and it works :)

--- Msged/LNX 6.2.0 (Linux/4.14.7-gentoo (i686))
* Origin: I will always keep a PC running CPM 3.0 (1:261/38.20)

Hi! Kees,

On 20 Dec 17 12:27, you wrote to me:

As ipv6 support is listed in the facillities

Yes, it is _always_ provided.

, I was under the impression, that there would be a compiler option.

So was I. I could not find one.

But why would you want to remove the ipv6 support on a linux system.
There are other ways to disable IPv6 in Linux alltogether.

Because the newly-compiled binkD executables kept failing. I was using an older Linux that was un-upgradable, unless the admin wanted to trip through more hoop tests than any benefit perceived to be derived by the exercise. Short version: it just wasn't worth the goddam hassle.

The eventual node turned out to be... oh, look... it's this one! Yay!

Cheers,
Paul.

... Click ... click ... click ... damn, out of taglines!
--- GoldED+/LNX 1.1.5-b20110213
* Origin: Quinn's Rock - Live from Paul's Xubuntu desktop! (3:640/1384)