- NANOG - lists.nanog.org

Apache.ORG Website
by Branden R. Williams 02 May '00

02 May '00

Ironically, the webserver on this machine has appeared to crash. FTP and other services work, but the HTTP service is dead. Thought I'd email and see if there was anyone who might be able to fix it. Cheers, Branden R. Williams <brw(a)netvitality.net> Vice President, Systems - NetVitality, Inc. http://www.netvitality.net/ Internet Commerce Specialists

1 0

4-port Ethernet
by David Lesher 01 May '00

01 May '00

After a slug of requests: IC Intracom 800-881-7325 The 10BaseT are Realtek chipsets, the 100 is Tulip (or so they said). I have no idea re: xBSD, but Don Becker told me the Linux drivers would be OK. (Note neither he nor I has handled the cards yet...) -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

2 5

Re: Re: external access and passwd mgmt (was Re: SSH on Cisco ...)
by Shawn McMahon 01 May '00

01 May '00

A lengthy discussion of why wouldn't be on topic here in NANOG, but it's a basic principle of computer security that if your password is so long that you must write it down to remember it, it is by definition too long. It is better to have a less-"secure" password that is not written down anywhere. If you must write a password down somewhere, it should be in a safe-deposit box that nobody has access to, so that it can only be recovered after your death. If you must write a password down electronically, it should encrypted, which makes it no better than the password of the encrypted database, so passwords should just plain flat never be so long that you have to write them down. The Gnu Keyring exists so that: 1) We can keep track of more passwords as securely as possible. 2) We can keep track of too-long passwords assigned to us by well-meaning folks. 3) We can keep track of long non-password numbers without having to haul around dangerous things like credit cards. :-) If you worked for me, I'd ask you to destroy that piece of paper and not do it again. On Mon, 1 May 2000, Bennett Todd wrote: > > I recommend instead picking an _exceptionally_ strong, > computer-generated random password for the keyring itself, and > writing it down on a slip of paper in your wallet until you've used > it enough times to memorize it.

2 1

Re: Cutting to the chase (was RE: ABOVE.NET SECURITY TRUTHS?)
by Sean Donelan 01 May '00

01 May '00

On Mon, 01 May 2000, Jeff Haas wrote: > Even when one exposes the issues in one's network/equipment/etc. one > still airs dirty laundry. The trick is to make sure it stinks as > little as possible. Unfortunately, the longer the dirty laundry sits > at the bottom of the pile, the worse it will stink when it ends up on > the top. Has anyone yet gotten a formal explaination from MCI/Worldcom about their frame-relay outage last summer. Last word I heard was their lawyers were reviewing a statement, but I never heard anything more. While its true corporations and people are more likely to publicize their successes rather than their failures, its also important to remember most of the early comments are just speculation. Is that good or bad? Its good to brainstorm all possibilities. Its bad because sometimes someone may take the early speculation as confirmation of fact. For example, shortly after the Abovenet incident, Computerworld wrote this characterization of a conversation with one of the executives involved. "Vixie says the company has speculated widely as to the motive for the attack and concluded that it could have emerged from one of two "completely useless categories." One category includes competitors that the company took a customer away from, disgruntled former employees or customers who had been disconnected because they were spamming. The other category, said Vixie, includes "someone who has something to prove and wants to bring our network down and wants to brag about it." Looking at the historical record, Paul's categorization is probable. But it is also possible Paul was completely wrong, and the cause or motivation was something other than the possibilities listed. Should we gag executives to prevent them from speculating because some of their speculation will be wrong? No. Its important we get as many possibilities on the table. But we need to remember, some of it will be incomplete or just wrong. We shouldn't crucify them for being wrong. Knowingly giving out misleading or false information is a different matter. I still think this industry will eventually need some method to obtain independent review of incidents.

2 1

RE: ABOVE.NET SECURITY TRUTHS?
by Exiled Dave 01 May '00

01 May '00

A thought just came to me. My experience with above.net, and exodus.net, leaves me to KNOW that a certain exodus engineer's wife works as an engineer at above.net. Reading the quote at http://www.cnn.com/2000/TECH/computing/04/28/fbi.abovenet.idg/index.html Quoted: "Vixie says the company has speculated widely as to the motive for the attack and concluded that it could have emerged from one of two "completely useless categories." One category includes competitors that the company took a customer away from, disgruntled former employees or customers who had been disconnected because they were spamming. The other category, said Vixie, includes "someone who has something to prove and wants to bring our network down and wants to brag about it." " Ebay WAS at exodus, then half of it went to above. Maybe this is just the "conspirator" in me, but, what if that husband/wife team was 'contracted' for revenge, for the ebay move, and participated in paid corporate espionage? :) __________________________________________________ Do You Yahoo!? Talk to your friends online and get email alerts with Yahoo! Messenger. http://im.yahoo.com/

8 8

Reminder - NANOG proposal deadline
by Susan R. Harris 01 May '00

01 May '00

* * * * * * * * * * * * * * * * * CALL FOR PRESENTATIONS * * NANOG 19 * * June 11 - 13, 2000 * * * * * * * * * * * * * * * * * The North American Network Operators Group (NANOG) will hold its 19th meeting in Albuquerque, NM, between June 11 - 13, 2000. The meeting will be hosted by iHighway. NANOG conferences provide a forum for the coordination and dissemination of technical information related to large-scale (i.e., national/international) Internet backbone networking technologies and operational practices. NANOG meetings, held three times each year, include two days of short presentations, plus afternoon/evening tutorial sessions. Meetings are informal, with an emphasis on relevance to current backbone engineering practices. The conference draws around 500 participants, mainly consisting of engineering staff from large national service providers, and members of the research and education community. Now in its fifth year, NANOG evolved from the NSFNET "regional-techs" meetings, where technical staff from the regional networks met to discuss operational issues of common concern. With the emergence of the commercial Internet, NANOG meetings evolved to include a broader base of providers, network operators, and researchers. The meeting will be held at the Albuquerque Hyatt Regency. For more information about NANOG meetings, schedules, and logistics, see: http://www.nanog.org ------------------------------------------------------------------------------ CALL FOR PRESENTATIONS NANOG invites presentations on backbone engineering, coordination, and research topics. Presentations should highlight issues relating to technology already deployed or soon to be deployed in core Internet backbones and exchange points. Previous meetings have included presentations on: - Backbone traffic engineering - Coordination of inter-provider QoS - Deployment experience with queueing disciplines (CAR, RED) - Inter-provider security and routing protocol authentication - Routing scalability in backbone infrastructures - Security issues for the Internet core - Routing policy specification and backbone router configuration - Building large-scale measurement infrastructure - Cooperative inter-provider caching - Alternatives to hot-potato routing - Recommendations on queue management and congestion avoidance - Experience with differentiated services - Reports from next-generation networks (Internet2, CA*net, etc.) - Inter-domain multicast deployment - Backbone network failure analysis Tutorials have covered topics such as: - BGP case studies - MPLS fundamentals - External route selection - IP multicast technologies - Distributed content caching in large IP networks ------------------------------------------------------------------------------ HOW TO PRESENT Submit an informal one- or two-paragraph abstract describing the presentation in email to nanog-support(a)nanog.org. The deadline for proposals is May 8, 2000. The majority of speaking slots will be filled by May 8; a limited number of slots will be available after that date for topics that are exceptionally timely and important. Presenters will be notified of acceptance by May 22, 2000. NANOG also welcomes suggestions/recommendations for tutorials, panels and other presentation topics. ------------------------------------------------------------------------------

1 0

NANOG 19, June 11-13, 2000 (in Albuquerque, New Mexico)
by Carol Wadsworth 01 May '00

01 May '00

All, Even though the June 2 deadline to register for NANOG 19 (June 11-13, 2000, in Albuquerque, New Mexico) is a month away, early registration is encouraged because the meeting will be limited to the first 500 registrants. To date, registration is already over half full. Registration will be closed early if the 500 limit is reached prior to the deadline, and therefore walk-in attendees will *not* be permitted. REGISTER: https://www.merit.edu/nanog/registration.form.html PAYMENT STATUS: If you already registered for the meeting, your payment must be received by June 2, or the registration fee will increase $50. Please check your payment status on the attendee list on the web: http://www.nanog.org/mtg-0006/Registration.List.html HOTEL: May 20 is the hotel's cut-off date to receive a discounted room rate. For online reservations see: http://www.hyatt.com/albuq/gnano/index.html Thanks. Carol Wadsworth Merit Network, Inc.

1 0

[political, off-topic] bureaucrats and technocrats vs. network operators
by smd＠clock.org 01 May '00

01 May '00

I realize this is nearly wholly off-topic, however it is sometimes worth considering _why_ so many governments are so keen on making our lives more difficult by attempting to control the use of cryptographic technology, and to force operators to make ugly architectural compromises in order to comply with "wiretap" laws. Nearly every modern government is a flavour of bureaucracy or technocracy, notwithstanding the differences in how the top ranks of government came into power or how or if they can be removed from it. Both technocracies and bureaucracies are fundamentally illiberal. They are based on the premise that the people in government are either better thinkers with better training, or simply have better access to official information, than those that they govern; therefore they have the right to countermand the individual decisions taken by individual citizens, because the technocrats and bureaucrats KNOW BETTER. This is not particularly strange; monarchists, theocrats and Leninist-type socialists have a penchant for telling people how to live their lives, because of divine right, because it is required by divine rules, or for the good of the people. The commonality is that the people who are better than you, or better informed than you, fundamentally believe that they are doing the right thing, and that any complaining provoked by their decisions is wrong because, quite simply, you aren't as smart or as well informed as the are. If you were, you would take the same decisions. Enter the Internet. This is a tool which places at nearly everyone's fingertips the ability to access nearly as much stored knowledge and information on nearly any topic as one could imagine. Moreover, it is a tool which allows for the nearly-instant global propagation of new knowledge and information as it arises. Let's return to the bureaucrat who honestly believes he or she (it's usually he, I'm afraid) is in the best position to make decisions on behalf of the people he helps govern, because he has access to information that nobody outside of the bureaucracy has. He has two fears: firstly, that the bureaucracy ultimately will fail to supply him with sufficient information to make the correct governmental decision, and secondly, that people outside the bureaucracy will have equal access to information as the people inside, and that individuals will misguidedly attempt to work around the careful consideration of any issue that a bureaucracy's vast resources usually allows for. Likewise, the technocrat, who formulates rules because he (it's usually a he) has specialised knowledge that nobody else has. Technocrats usually run environmental agencies, food-safety evaluation offices, economics ministries, and the like. One might consider them "government scientists" of a sort, however the specialised knowledge might not be exclusively scientific (think of diplomats, for example). Our technocrat shares one of the bureaucrat's fears: that the specialised knowledge will be so available through the Internet that other people will attempt to make their own decisions based on it, and that without proper training, this information will be misapplied, and people will make faulty decisions that may cause harm. Enter their responses to the Internet: 1/ make sure that a bureaucracy is supplied with ALL information so that it can make correct decisions for the benefit of those governed hidden information -- whether because it's encrypted or because it's merely hard to access -- may contain critical knowledge that may save lives, prevent monopolistic behaviour by companies, or avert the exploitation of minors it is always better for the bureaucracy to have ALL knowledge as soon as possible, so that it can rigorously analyse and consider it. this type of studying admittedly takes some time, and given the explosion of information in the Internet, it is wise to have access to copies of all the messages that traverse the Internet, rather than slowing things down by imposing restraints upon the bureaucracy (such as a judicial warrant process). the process of gathering up copies of ALL Internet messages is rather expensive without the cooperation of ISPs and the like. we must convince them that their help is essential so that the bureaucracy can continue to make the best- possible, best-informed decision for the good of those they govern. 2/ it is very clear that a supply of specialised information without specialised training can lead people to make poor, unscientific decisions. this is witnessed very clearly in the genetically modified food controversy, where the supply of scientific and technical data to non-specialists such as the media and individuals, has led people to avoid g.m. foodstuffs, when embracing g.m. technology is clearly the most logical thing to do. because of the total failure of the technocracy in this case and cases like it, it is in the interests of everyone to equip the government with means to counter the "spin" vested interests put on disclosed information, or perhaps to withhold the information altogether. in particular, when a critical decision made for good of everyone might become controversial because of initial negative reactions by less intelligent, less informed people, it may be a wise idea to temporarily weaken these individuals' ordinary civil rights, in order to protect society from the negative effects of not implementing a well-thought-out policy emanating from government specialists. We have seen an unfortunately large amount of reactions #1 and #2 lately... Government faces one final major challenge posed by the growth of the Internet: the best and brightest technical and administrative minds are no longer automatically choosing a career inside government. It is growing clear that unless something is done, there will not be the base of talent in government to allow the best possible decisions to be made. Finally, it is worth bearing in mind that: -- any group of people who honestly believe that they are the best people to rule, because they have uniquely strong administrative talents or specialised training/knowledge, will tend to be dismissive of other people's technical or administrative opinions -- any such group of people are also very concerned whenever someone who is clearly more knowledgeable than they are does not work with the bureaucracy/technocracy to help them make decisions that will better the lives of everyone that they govern "non-players" are therefore a sad waste of talent that would optimise government decision-making, or are perhaps dangerous, if they reject carefully-considered government policy without having considered all of the factors studied by the professionals in the bureaucracy It is worth bearing in mind the radical liberal sentiment expressed by Sir Rhys Hopkin-Morris, as quoted by Samuel Beer: ` [My] thoughts turn back to a dinner I attended in 1954 with virtually the whole of the Parliamentary Liberal Party. Reduced to a mere six MPs and supported by only 2.6% of the voters, the Liberals and their cause were, according to all expert opinion, destined for extinction. Yet the senior at the table, Sir Rhys Hopkin-Morris, stated his political creed with clarity and conviction. "No one", he said, "is to tell anyone else what is good for him." He rejected the claim to such authority, whether asserted on "the aristocratic principle" or on behalf of "the community". This is my mantra for today's 1st of May celebrations. Forgive the political nature of the posting. Now I will go across the street to a park filled with thousands of 1st of May celebrators enjoying spectacular summer weather. My agenda: grab a falafel off the Red Front's illiberal vegan barbecue, and have some beer with a few not-very-revolutionary local anarchists. Sean. - -- Sean Doran <smd(a)clock.org> Copenhagen, Denmark

1 0

Re: Cutting to the chase (was RE: ABOVE.NET SECURITY TRUTHS?)
by Danny McPherson 01 May '00

01 May '00

> Since I value your input, I'm not sure if you are joking, or serious. > > I understand the humorous issues involved here (believe me, I do), > I'm really serious about this, and I need serious feedback. I was obviously joking about the "disinformation experts" comment, at least to some degree. However, I certainly do agree that it's a good idea to discuss this as you propose at the upcoming NANOG, especially in lieu of recent occurrences. I don't believe some folks realize how much people read into topics discussed on this list, or understand the impact that seemingly simple posts (accusations about Vendor A's broken software, Vendor B's broken hardware, ISP A's broken network, ISP B's poor customer service, ISP C's security practices, etc..) have on these businesses, and more so, the individuals involved, especially since those accusations are often [demonstrated] premature or completely unfounded. -danny

4 3

Re: external access and passwd mgmt (was Re: SSH on Cisco ...)
by Sean Donelan 01 May '00

01 May '00

Folks seem to be concentrating on locking down the front door. You also need to watch all the backdoors. With multi-protocol equipment, there are a lot of backdoors. Is syslog sending plaintext information, when was the last time you changed snmp community strings, do you have read-write snmp or rsh/rcp access enabled, are ancilliary services like ntp, ospf and bgp authenticated? Have you turned off any services you aren't using such as MOP? If you network load your configuration, how do you know you got your configuration? Do you understand how arp works/doesn't work. After securing your network, one security issue I rarely see explicitly addressed is what do you do when your authentication stops working for whatever reason. Have you made plans for breaking into your own network. Vendor backdoors should require physical access to the equipment (e.g. moving a switch) not just knowledge of a "secret" maintenance password or special signal over a remote control line (e.g. break).

3 2