- NANOG - lists.nanog.org

Re: ICQ & AOL
by sthaug＠nethelp.no 01 May '00

01 May '00

> I'd venture to say that this is the result of the following phenomena: > > Block all APNIC and RIPE assigned networks at the border and all of the > sudden, hack attempts and CC fraud disappear. > > It's fan-%^&#ing-tasticly simple to do and so very effective. And if I block the ARIN assigned networks, most of the spam I receive disappears. It's very effective. In fact, I can limit myself to blocking all email from Hotmail, AOL and a few other large ISPs in the US, and that'll take care of most of the spam too... Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

3 2

Re: ABOVE.NET SECURITY TRUTHS?
by Danny McPherson 01 May '00

01 May '00

> As you pointed out to Barry Greene and myself previously, the "aaa > accounting" command as below will log commands typed in at "enable" level. > So, if you are changing the onboard router password, yes, you will see the > new password in your accounting logs, in clear text. > > However, I don't consider it good practice to keep any critical passwords > on a router when an authentication mechanism such as TACACS+ is in place. Unfornately, auth servers fail and you have to keep VTY and fallback passwords locally configured on the router. > Also, if I was modifying the onboard enable secret (last resort password > when TACACS+ or Radius is configured) at any stage, I'd tftp-load the > configuration from a remote server, not ever type it in live. I don't see how this actually changes anything though, aren't tftp'd files authorized (and therefore, logged) in a similar manner? And as wonderful as it sounds, it's not always possible in real networks. However, entering the encrypted *enable* password (w/level) would accommodate this. Though, of course, the BGP TCP MD5 stuff and the VTY passwords (and most other passwords) still don't support the ~non-reversible encryption algorithm. As for this entire thread, it's seems now to be more appropriate for cisco-nsp or the like. -danny

1 0

Avoid Fines And Speeding Tickets!!!
by fiy10＠box.nl 01 May '00

01 May '00

INTERNATIONAL DRIVER'S LICENSE Need a new driver's license? Too many points or other trouble? Want a license that can never be suspended or revoked? Want ID for nightclubs or hotel check-in? Avoid tickets, fines, and mandatory driver's education. Protect your privacy, and hide your identity. The United Nations gave you the privilege to drive freely throughout the world! (Convention on International Road Traffic of September 19, 1949 & World Court Decision, The Hague, Netherlands, January 21, 1958) Take advantage of your rights. Order a valid International Driver's License that can never be suspended or revoked. Confidentiality assured. CALL NOW!!! 1-937-586-9313 rem-- fikle445(a)netexecutive.com

1 0

Re: How long before NIPC decides we need one of these?
by Chris Adams 01 May '00

01 May '00

On 04/30/00 11:00:12 PM gfresen(a)ais.net wrote: >No, it's worse than that. With your private key in their hands, they can >write >messages, put on appropriate dates and sign them ... then say that you wrote >them. (depending upon the technology that is used) Yes. Couple that with treating key confiscation as a minor thing and I'd be surprised if someone's key didn't end up accidentally being sent to a well- connected competitor. One possible line of defense other than complete civil disobediance might be providing only the session key(s) used for encrypted documents instead of the key-pair. It'd be interesting to see if the courts accept this.

1 0

SSH on Cisco Routers (was RE: ABOVE.NET SECURITY TRUTHS?)
by Ron Buchalski 01 May '00

01 May '00

SSH1 is supported on the following platforms starting in 12.1(1)T: C17x0, C25xx, C26xx, C36xx, C4x00, C7x00 See: http://www.cisco.com/warp/customer/cc/cisco/mkt/ios/rel/121/prodlit/1065_pp… -rb >From: "Mr. James W. Laferriere" <babydr(a)baby-dragons.com> >To: "Greene, Dylan" <DGreene(a)NaviSite.com> >CC: "'Paul Froutan'" <pfroutan(a)rackspace.com>, rmeyer(a)mhsc.com, >nanog(a)merit.edu >Subject: RE: ABOVE.NET SECURITY TRUTHS? >Date: Fri, 28 Apr 2000 14:34:14 -0700 (PDT) > > > > Hello Dylan, Knew this was coming . But I'd hoped that > the supported platforms would have been a little larger . > Just the 7200 & UP . Seems cisco thinks ssh puts a bit > of load on a cpu ? I can't see that for just a terminal > session though . Twyl, JimL ________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com

4 3

RE: ABOVE.NET SECURITY TRUTHS?
by Greene, Dylan 01 May '00

01 May '00

Maybe I should read the entire message before responding.. hehe.. =) A switched private management lan resolves the cleartext problem. SSH version 1 is apparently supported in 12.0 as well (never played w/ it, so dunno how well it works); http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/120newft/120 limit/120s/120s5/sshv1.htm ..Dylan | -----Original Message----- | From: Paul Froutan [mailto:pfroutan@rackspace.com] | Sent: Friday, April 28, 2000 4:46 PM | To: rmeyer(a)mhsc.com | Cc: nanog(a)merit.edu | Subject: RE: ABOVE.NET SECURITY TRUTHS? | | | | I don't think you can. However, I use TACACS on all my switches and | routers. From what I know, TACACS passwords are encrypted | using the key on | your network devices and the TACACS server. So, that, in | combination with | a private management LAN not accessible by your customers | should lock down | your network pretty effectively. Any comments? | | At 4/28/00 -0700, you wrote: | | > > Exiled Dave | > > Sent: Friday, April 28, 2000 1:10 PM | > | > > Lets think about this, cisco in no way has such a flaw | > > that would allow someone to 'root' and erase all the | > > info on switches. The password was sniffed. | > | >Can one setup SSH on a Cisco 6509? | | Paul Froutan Email: | pfroutan(a)rackspace.com | Rackspace, Ltd <http://www.rackspace.com> | |

7 8

Re: ABOVE.NET SECURITY TRUTHS?
by Danny McPherson 01 May '00

01 May '00

IMO, it requires more than this. Ideally, one-time, token-based (i.e. SecurID) passwords, coupled with SSH, is the best solution, especially with the turnover rates at providers these days. Of course, this also requires that all the backend (RADIUS, configuration management, etc..) and out-of-band systems are secure, which is another rathole altogether. As for this incident, well, I think if the intial intent of the "divulging message" was simply to remind folks to change their passwords, the points been made. -danny > > I don't think you can. However, I use TACACS on all my switches and > routers. From what I know, TACACS passwords are encrypted using the key on > your network devices and the TACACS server. So, that, in combination with > a private management LAN not accessible by your customers should lock down > your network pretty effectively. Any comments?

2 1

Re: ABOVE.NET SECURITY TRUTHS?
by Exiled Dave 30 Apr '00

30 Apr '00

Ive had some private messages asking if i was involved in this. I wasnt. I was asked to write this initial email by someone who KNOWS the real truth of what happened at above, and why they are being so tight-lipped. Lets think about this, cisco in no way has such a flaw that would allow someone to 'root' and erase all the info on switches. The password was sniffed. Unless above has some employee who felt the need to do do this. But, my Above rep laughling CONFIRMED that this was the problem. COMMON PASSWORDS. Cant we make it a LITTLE tougher on the script kiddies? And not make EVERY MAJOR switch the same password? This is safe to post, because my above sales rep told me what the old password was. God. THATS SECURITY. Sales reps telling Clients OLD PASSWORDS. So, if we wanna verify my authenticity, Here's what she told me: whY2Ghay/1Pee-Fr331y Sound framiliar Above? Im suprised by lack of comment from you. Im out to HELP. Not to hurt. __________________________________________________ Do You Yahoo!? Talk to your friends online and get email alerts with Yahoo! Messenger. http://im.yahoo.com/

10 10

Re: external access and passwd mgmt (was Re: SSH on Cisco ...)
by Shawn McMahon 30 Apr '00

30 Apr '00

On Sun, 30 Apr 2000, Bennett Todd wrote: > > GNU Keyring <URL:http://gnukeyring.sourceforge.net/> is your friend. > Store passwords in your Palm, with no fears for the security of the > backups or the loss of the Palm. And it can generate nice passwords, > too. However, it marks the database file as "no backup" by default, and you have to use third-party tools to change that. Oh, and that stuff about having a week to change the battery before you lose your data after the screen goes blank; rubbish. :-) Since it's entirely likely that you'll pick a weak passphrase to protect the Palm keyring, if you *DO* change the backup bit on that database, don't sync it at work. Or, leave the backup bit alone, so it doesn't back up on hotsync, but use a third-party backup tool to grab the whole shebang frequently. Yes, I learned this the hard way.

1 0

Re: RE: SSH on IOS (was RE: ABOVE.NET SECURITY TRUTHS?)
by Shawn McMahon 30 Apr '00

30 Apr '00

There are lots of ways to make this work: Digiboard or Rocketport in the Linux box. Real terminal server (Livingston is good, Computone Powerrack is cheaper, has more ports per Rack Unit, and is good enough for this usage) in the rack with direct Ethernet connect to a Linux box racked right above it, so physical security is still easy, then SSH to the Linux box. If you lock that Linux (or Open/Free/Net-BSD) box down so it accepts NOTHING other than that SSH traffic, you could even slap a hub down and use it to direct Ethernet management traffic, although that opens you up to possible sniffing if a router is cracked. Best to stick with the serial solutions, but they can be pretty damn cheap. Certainly cheaper than breakins. Figure anywhere from $500 to $1,500 for the Linux server (depending upon the quality of components, and whether you put it in a rack-mount case or just drop it on top of the terminal server), and $2,500 for a Computone Powerrack (with ISP discounts, and using the pricing I remember from years ago, which could very well have changed), with no expenditure on software at all (unless you count $1.99 for a CD from CheapBytes) and you're looking at a damned cheap, damned secure system that your entire staff can use. You could even log all the traffic on the Linux box, provide scripts for common tasks and keep them on the isolated server where they're safe, or even (if you needed to) tcpdump all the traffic to the terminal server for infinite levels of security micromanagement. All for less than the cost of the consultants who'd sell you the less-secure versions of securing this traffic. On Fri, 28 Apr 2000, "Roeland Meyer (E-mail)" wrote: > Date: Fri, 28 Apr 2000 19:24:32 -0700 > To: "'John Fraizer'" <nanog(a)EnterZone.Net>, > "'Jason Ackley'" <jason(a)ackley.net> > From: "Roeland Meyer (E-mail)" <rmeyer(a)mhsc.com> > Reply-To: <rmeyer(a)mhsc.com> > Subject: RE: SSH on IOS (was RE: ABOVE.NET SECURITY TRUTHS?) > > > Actually doing that now, with a Linux box and an old Livingston PM2E. > Linux box runs SSHD, the portmaster runs directly into console ports > 'stead of modems. I figured that was obvious. However, I don't run a > co-lo either. Most of my systems reside in them. This is okay, until your > ladders have to run through semi-public space. There is also a 50 foot > length restriction, on RS-232 lines, unless you like running at less than > 115K baud. Also, figure the expense of the extra hardware. In my case, it > was unused sunk-cost anyway (surplus, for you non-suits).

3 2