- NANOG - lists.nanog.org

Re: Proper authentication model
by Hannigan, Martin 13 Jan '05

13 Jan '05

Think methodology, as least amount of failure points, less capex, to protect the sla, real or imagined. Bellcore/Telcordia guidelines for RBOC CO's are very suitable for datacenters/colo. Hybrids. --- Martin Hannigan hannigan(a)verisign.com Verisign, Inc. -----Original Message----- From: owner-nanog(a)merit.edu <owner-nanog(a)merit.edu> To: erik(a)office.is.nl <erik(a)office.is.nl> CC: NANOG list <nanog(a)merit.edu> Sent: Wed Jan 12 14:35:21 2005 Subject: RE: Proper authentication model On Wed, 12 Jan 2005, Hannigan, Martin wrote: > Out of band management isn't telnetting from your desktop to > the serial port. > > Mgmt and surveillance is the Bellcore standard for out of band. > It means your M/S is not riding your customer or public networks, and > it's physically seperate. Yes, this is the cadillac method, but the > only way to support five nines IMHO. > > If you have 3 sites and they're interconnected via an OC3 > and the internet, you would also have 2 frame or ppp circuits > seperately connecting the terminal server network. You'd do the > different path, different provider, etc. on these circuits. Recently I've been doing this by tunneling over ADSL circuits from the local telco. At around $60 per month per location with static IP addresses it's cheap. Since the tunnels go between two ADSL lines, they're limited to circuits' 128Kb/s upload speeds, but that's generally ok for management traffic. I've also been connecting bastion hosts to the DSL lines. This way, all that's required to get into the OOB network is Internet connectivity through some other network, rather than having to hunt around for a POTS phone line to plug a modem into in an emergency. Obviously, if you are the local telco this isn't really out of band, but works well for others who aren't sharing the local telco's infrastructure. Is it as secure as having your own diverse-path management network of private point to point circuits? Probably not, but with sufficient firewalling and encryption on the tunnels, it's good enough, and cheap enough that it's possible to talk ISP owners into paying for it. -Steve

1 0

Re: fixing insecure email infrastructure (was: Re: [eweek article] Window of "anonymity" when domain exists, whois not updated yet)
by Eric Brunner-Williams in Portland Maine 13 Jan '05

13 Jan '05

> Numerous (as in "at least hundreds, probably more") of spam gangs are > purchasing domains and "burning through" them in spam runs. In many > cases, there's a pattern to them; in others, if there's a pattern, > it's not clear to me what it might be. >From my point of view, "pattern" is which registars are getting the buys, for which registries, where the ns's are hosted, and for domains used in the return value side, hosting details. The latter to reduce to RIR CIDRs. There is more, but that is the first cut, localization of registrar(s) and registries and CIDRs. > This bunch prefers domains in .info -- no doubt motivated in part by things > like the recent $1.95 sale on such domains. OK. Now you've identified price as a significant control variable. There are registrars that don't sell .info. I don't. There are registars that don't sell to directly to registrants. I can think of half a dozen of us who only sell to corporations and bonafide people who buy reasonable names. Transcendental numbers in decimal character form are "reasonable". Your two example sets are not "reasonable". > The dirty little secret is that all this activity on the part of spammers > is a gold mine for registrars. This isn't going to make me think you can add or subtract. > It's gotten so bad that -- to a darn good first approximation -- if you > find a domain in the .biz or .info TLDs I agree, and don't sell .biz, .info or .name, or .cc or .tv or .bz or any of the obvious repurposed cctlds, with the exception of my friend Bill Semich's .nu, which actually means something in Sweden for local reasons. I do plan to sell .aero, .coop and .museum, however. In case it is inobvious, there is a possibility that part of _your_ problem (and a big part of my problems) can be placed at the figurative "door" of a 501(c)(3) located in California. > The answer? (1) no obfuscated registrations (2) mass, fast, permanent > confiscation of spammer domains (3) requirement for reasonably correct > domain registration info ... and (4) publication of all WHOIS data in > a simple, easily parseable form ... Nothing in this laundry list that makes the cost of bad business for my competitors rise, see add and subtract, above. Try the following: 1,$s/registrars/isp/g and 1,$s/registry/rir/g, and 1,$s/domain/ipv4_addr/. If you're still keen on your approach, then it might be a good one. I've replied after removing your personal identifiers back to NANOG. I appreciate the data, but I want the discourse to be multicast. Eric

2 3

RE: Proper authentication model
by Hannigan, Martin 12 Jan '05

12 Jan '05

> -----Original Message----- > From: Steve Gibbard [mailto:scg@gibbard.org] > Sent: Wednesday, January 12, 2005 5:35 PM > To: Hannigan, Martin > Cc: NANOG list > Subject: RE: Proper authentication model > > > On Wed, 12 Jan 2005, Hannigan, Martin wrote: > [ snip ] > > Obviously, if you are the local telco this isn't really out > of band, but > works well for others who aren't sharing the local telco's > infrastructure. > > Is it as secure as having your own diverse-path management network of > private point to point circuits? Probably not, but with sufficient > firewalling and encryption on the tunnels, it's good enough, and cheap > enough that it's possible to talk ISP owners into paying for it. I don't know if this specifically relates to any local telco, but there are some clear reasons on why to go through the excercise of having a true out-of-band network. I don't disagree that smaller ISP's may not neeed such a thing nor do I suggest that it offers a significant ROI to the smaller guys.

1 0

RE: Proper authentication model
by Hannigan, Martin 12 Jan '05

12 Jan '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of > Iljitsch van Beijnum > Sent: Wednesday, January 12, 2005 6:25 AM > To: Gernot W. Schmied > Cc: NANOG list > Subject: Re: Proper authentication model > > > > On 12-jan-05, at 11:30, Gernot W. Schmied wrote: > > >> True out of band management networks are very hard to > build and very > >> hard to use, and you run the risk that you can't get at your stuff > >> because the management network is down. > > > IS-IS can be highly recommended for true out of band > management, it is > > reachable when IP goes down the drain entirely. > > To me, true "out of band management" means that the > management traffic > doesn't flow over production links. You are right that IS-IS can > continue to function when IP is confused (although with integrated > IS-IS OSI will probably be just as confused as IP). But IS-IS isn't a > management protocol, of course. :-) Out of band management isn't telnetting from your desktop to the serial port. Mgmt and surveillance is the Bellcore standard for out of band. It means your M/S is not riding your customer or public networks, and it's physically seperate. Yes, this is the cadillac method, but the only way to support five nines IMHO. If you have 3 sites and they're interconnected via an OC3 and the internet, you would also have 2 frame or ppp circuits seperately connecting the terminal server network. You'd do the different path, different provider, etc. on these circuits. The ts' would be connected to the hub. If that failed, or the machine was DOA, serial port. A TS may have a modem at each site for the hail mary connection. > > IPv6 is also very useful in providing non-IPv4 management. I always knew you could get deer meat from a deer.

3 2

New IANA IPv6 allocation for RIPE NCC (2003:0000::/18)
by Doug Barton 12 Jan '05

12 Jan '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings, This is to inform you that the IANA has allocated the following one (1) IPv6 /18 block to RIPE NCC: 2003:0000::/18 RIPE NCC 12 Jan 05 For a full list of IANA IPv6 allocations please see: <http://www.iana.org/assignments/ipv6-tla-assignments> - -- Doug Barton General Manager, The Internet Assigned Numbers Authority -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (FreeBSD) iD8DBQFB5aL5wtDPyTesBYwRAm4zAJ9a/3st27eUsCQeD2WKIoL8QVNA5gCfWc9F eHLYn34mS0qj3IhwU2woMLU= =qS1+ -----END PGP SIGNATURE-----

1 0

Contact at Austrian Telecom - urgent
by Steve Birnbaum 12 Jan '05

12 Jan '05

I think I'm seeing a rather massive cut. Does anyone have a direct # for someone with clue for backbone events? Thanks, Steve

3 3

Survey of interest ..
by Robert Mathews 11 Jan '05

11 Jan '05

Just brought to my attention, and if you haven't seen it.. >From the Pew Internet & American Life Project ... "The Future of the Internet" In a survey, technology experts and scholars evaluate where the network is headed in the next ten years http://www.elon.edu/predictions/2004_experts_survey.pdf & http://www.pewinternet.org/

5 5

Cisco 2611XM as cheap border router
by Mark Bojara 11 Jan '05

11 Jan '05

Hello people of nanog :) Ive been doing some reading up and I see that that 2600 series is now supporting 256MB of memory. Do you guys think this router could handle 3/4 peers a QoS setup (RSVP or something)? http://www.cisco.com/en/US/products/hw/routers/ps259/products_qanda_item090… Regards Mark

3 2

New and interesting network abuse.
by Ejay Hire 11 Jan '05

11 Jan '05

My apologies if this strays off topic, but I wanted to share my recent experience. We had a collocation customer come in and request a t1 of pots lines for their servers, then complaints that their "security" software wasn't working because of our RPF checks. As it turns out they were dialing up to a local isp, and sending bulk email using our bandwidth, but the dial-up's ip.... And receiving the TCP ack on the dial up. Very ingenious imho, but I'm not sorry it didn't work out. Anyone else seen this before? -Ejay

3 2

Email Security Glossary
by william(at)elan.net 11 Jan '05

11 Jan '05

I recently created email security glossary out of the smaller one that was included in mta-signatures paper (its now > 5 times larger with almost 300 terms and abbreviations!), it includes primarily email and cryptography abbreviations and terms but number of related network and dns terms are also there. This glossary will be shared among several of my projects and websites, but currently its first official location is: http://www.metasignatures.org/glossary.htm Feel free to check this out and if you find any terms that you do not believe are accurately described, let me know. P.S. I sent the above info on Friday on couple other mail lists, but forgot to do this on nanog even though I did mention here before that I was working on this glossary when we were talking about botnets and even used portions of text that were sent to me when defining that term (and I would like to thank all those who answered me and helped with the glossary). -- William Leibzon Elan Networks william(a)elan.net

2 1