- NANOG - lists.nanog.org

pc world+mtu+meltdown
by Jared Mauch 05 Nov '98

05 Nov '98

incase you see more pps stressing your network, or something of the sort, check this out for possible reason why: http://cnn.com/TECH/computing/9809/29/unclog.idg/ please follow reply-to header. -- Jared Mauch | pgp key available via finger from jared(a)puck.nether.net | http://puck.nether.net/~jared/

2 1

RE: time for a new list?
by Chad Skidmore 05 Nov '98

05 Nov '98

The other problem is how to identify what is appropriate and what is not. It does not seem difficult to find folks on the list who do not agree so it could be tough to appoint the NANOG god that strikes people from the list. Oh well, I guess I'll just keep making good use of my mail filters to catch the garbage. :-) --------------------------------------------- Chad Skidmore Director of Network Engineering Northwest Nexus, Inc. http://www.nwnexus.com 1-888-NWNEXUS > -----Original Message----- > From: Eric Kozowski [mailto:eric@haydenisland.verio.net] > Sent: Monday, November 02, 1998 7:59 PM > To: Joe Shaw > Cc: nanog(a)merit.edu > Subject: Re: time for a new list? > > > At 07:01 PM 11/2/98 , Joe Shaw wrote: > > > >I think moderating the group might not be such a bad idea. The only > >problem with this would be getting someone who had enough > time to actually > >moderate the list. I don't know what is going on lately, > but it seems > >egos and animosity are running rampant on both inet-access > and nanog. I > >have been caught up in it myself, and for that I apologize. > > i didn't, and don't, propose a moderated list. i propose a > list with some > sort of subscription requirement, at least for the ability > post, that will > only allow nano's to post. i also propose that the list be > stringently > policed. one warning re: content of your postings, then your > ability to > post is revoked. > > i'd like to see a list that lives up to the intent of the > nanog list, but > w/o all the useless drivel and chatter. if i wanted that, > i'd still be > subscribed to inet-access. > > -- > Eric Kozowski > eric(a)haydenisland.verio.net > Non carborundum illigitimi >

5 4

time for a new list?
by Eric Kozowski 04 Nov '98

04 Nov '98

i know it's come up in the past, but i think it's way past time for a new list for nano's with tighter subscription and posting requirements. the only reason i haven't unsubscribed to nanog, yet, is everytime i've had enough of the useless crap, someone actually posts something useful.... -- Eric Kozowski eric(a)haydenisland.verio.net Non carborundum illigitimi

8 8

Re: Linux router (don't laugh)
by shields＠crosslink.net 04 Nov '98

04 Nov '98

In article <Pine.BSF.4.05.9810271807300.215-100000(a)skipper.robotics.net>, Nathan Stratton <nathan(a)robotics.net> wrote: > I tried that several years ago and it blew up, I had to switch to FreeBSD. This says nothing about the ability or stability of today's Linux or FreeBSD. -- Shields, CrossLink.

5 7

Re: FW: time for a new list?
by Brett_Watson＠enron.net 04 Nov '98

04 Nov '98

On 11/03/98 09:32:02 AM Lawrence A. Deleski wrote: > > >>na... the only thing that will ever work on this list is marshall law. or >>better yet, a dictator. >> >>-brett >> >> > >I nominate Brett Watson. :-) not me, i failed the spelling portion of the entrance exam. however, i did learn something on nanog for the first time in months; marshall is spelled martial. -brett

1 0

Spam by one of Exodus Sales Person
by Exodus Abuse Investigations 04 Nov '98

04 Nov '98

Dear Mr. Rothschild and persons of NANOG, May I introduce myself, I am Janis Purl and I am the Abuse Manager at Exodus Communications, Inc.. I have been told that you and NANOG have been spammed by one of our new employees. This letter is meant as an apology to anyone having received that spam. Exodus has a policy strictly forbidding anyone on staff or connected with Exodus in anyway from spamming. My position here at Exodus is to enforce that policy and this is the first time I have had to enforce it to someone from within our staff. Any new hire at Exodus is given an orientation day which is when our policies on such things are presented by our Director of Security (Leroy Lacy). This is not possible for new hires at other sites around the country. For those new hires, are to receive printed copies of these policies. I don't know where the breakdown happened and have been told by the Director of Security that the procedure will be reviewed and changed to ensure that all new hires understand that spamming is not authorized in any circumstance here at Exodus. To ensure that this policy is clear to all present employees Mr. Lacy will be sending an email to all our current employees stating clearly spamming is NOT OK. I am truly sorry one of our employees punished you with a spam. Let me assure you that we are actively taking steps to assure that this never happens again. We are not advocators of spam and do our best to stop any spam related to us or our customers. Again let me say I am sorry that someone from Exodus bothered you in such a deplorable manner. Janis Purl Abuse Manager Exodus Communications, Inc. 1-888-2-EXODUS x 2574

2 2

Re: time for a new list?
by Josh Gluck 04 Nov '98

04 Nov '98

I have been reading this list for a while now, and for the most part, just sitting back reading posts that interest me. I appreciate the early heads up on outages, new info on networking technology and the like. However, I do believe that moderating or "policing" the list would be a good idea. I hate downloading my mail sometimes, for all the nonsense posts that have been being sent to NANOG lately. Some of the threads go on forever or seem to attract many of the following replies: { From: whoever(a)nowhere.com To: Nanog(a)merit.edu Subject: One REALLY LONG THREAD ABOUT NOTHING <<< <<< Some quoted non needed long email from the thread <<< that everyone has already seen about 20 times <<< Agreed :) ------------------------------------------------------------ >A 20 line sig that no one really cares about anyway ------------------------------------------------------------ } These kind of replies are not needed. When I see these in my inbox, I will stop reading the list and just delete everything. Most of us that receive the list, don't need 3 pages of quoted material from the previous post. All of the subscribers recieve the threads, I personally dont need it more than once. Just use the original subject line and throw in a Re: As for a subscription requirement, that may be a little difficult as the "good" information that passes through this list, is interesting to a great deal of people that may not fit into the subscription group. It wouldn't be fair to have them be denied from the right to see what is going on, however a posting credentials requirement might be a good idea, but then again who would enforce this, and what would the requirements be? I like this list a great deal, and use some of the information that I gather from reading posts. I am willing to add any additional thoughts or what have you, in an attempt to get NANOG more stream lined. I don't want people to think that I am standing on a soap box, preaching, especially because I don't really post to the list, but I am just letting everyone know I would like to help make the list "a better place" Josh Gluck - josh(a)tricreations.com Senior Unix System Administrator Tri Star Web Technical Support 888-757-4248 *The views expressed are my own and do not reflect at all on the part of my employer.

4 3

[Dag.Peak@qwest.net: A question from a new nanog reader.]
by Steven J. Sobol 04 Nov '98

04 Nov '98

This looks like it might be something of operational interest... -----Forwarded message from "Peak, Dag" <Dag.Peak(a)qwest.net>----- From: "Peak, Dag" <Dag.Peak(a)qwest.net> To: "'Steven J. Sobol'" <sjsobol(a)nacs.net> Subject: A question from a new nanog reader. Date: Tue, 3 Nov 1998 12:26:23 -0700 Steven, Given the current discussions on what is and what is not appropriate for the list, and given that I've only been reading it for a week or so, I though I'd ask you whether this information would be relevant or not (and you got picked because I've seen 7 messages from you in that time ;). Qwest Communications just put up a traceroute server. Would the list be interested in that information? For your own personal edification, its at http://www.iptools.qwest.net. Username qwestip, password elvis. (Even though its behind a password, it is for public consumption. It was developed as a sales tool.) Disclaimer: I work for Qwest in a sales engineering role. I'd personally like to see some discussion on what we're doing in the IP space. I think what we're doing is actually pretty cool. If you think its appropriate, forward on the URL to the list. If not, cool. I'll leave judgement up to you. Dag Peak Technical Consultant III, National Accounts Qwest Communications dag.peak(a)qwest.net 303.260.4602 (office) 303.229.0087 (cell) 303.260.4617 (fax) Identification given does not imply authorization, merely affiliation. -----End of forwarded message----- -- Steve Sobol [sjsobol(a)nacs.net] Part-time Support Droid [support(a)nacs.net] NACS Spaminator [abuse(a)nacs.net] Spotted on a bumper sticker: "Possum. The other white meat."

2 1

RE: 2U chassis (was Linux Router Kit)
by Chris Mauritz 03 Nov '98

03 Nov '98

It hardly seems useful for our purposes since it seems to be a single cpu Pentium 200mmx system. Any idea if they sell the cases alone? C -----Original Message----- From: brandon(a)rd.bbc.co.uk [mailto:brandon@rd.bbc.co.uk] Sent: Saturday, October 31, 1998 6:34 PM To: nanog(a)merit.edu Cc: list(a)inet-access.net Subject: Re: 2U chassis (was Linux Router Kit) For embedded Linux systems we've used these 2U boxes. http://www.capax.co.uk/products/sys/rack/er2200/er2200.htm regards, brandon

2 1

Re: [rootshell] Security Bulletin #25
by Roeland M.J. Meyer 03 Nov '98

03 Nov '98

I just got this. MHSC is also on the SSH mailer-list. It looks as if ALL accusations of SSH being exploitable are thinly founded at best. >Date: Mon, 2 Nov 1998 11:45:53 +0200 (EET) >From: Tatu Ylonen <ylo(a)ssh.fi> >To: ssh(a)clinet.fi, info(a)rootshell.com >Subject: Important information about IBM-ERS's "ssh" advisory (fwd) >Message-ID: <Pine.OSF.4.05.9811021143180.19300-100000(a)torni.ssh.fi> >MIME-Version: 1.0 >Content-Type: TEXT/PLAIN; charset=US-ASCII >Sender: owner-ssh(a)clinet.fi >Precedence: bulk >X-UIDL: a3533f8bef2d09b2dd5c56b653ba57e1 > >Please find enclosed a copy of a message from the IBM Emergency response >team. > > Tatu > >SSH Communications Security http://www.ssh.fi/ >SSH IPSEC Toolkit http://www.ipsec.com/ >Free Unix SSH http://www.ssh.fi/sshprotocols2/ > >---------- Forwarded message ---------- >Date: Mon, 02 Nov 1998 04:15:28 EST > >From: David A. Curry <davy(a)ers.ibm.com> >To: bugtraq(a)netspace.org, first-info(a)first.org, first-teams(a)first.org, > ssh-bugs(a)cs.hut.fi >Subject: Important information about IBM-ERS's "ssh" advisory > >-----BEGIN PGP SIGNED MESSAGE----- > >On Friday, Oct. 30th, IBM-ERS sent out a draft advisory to be released on >Monday, Nov. 2nd that described a buffer overflow condition in Version >1.2.x "sshd." This draft was sent to the Forum of Incident Response and >Security Teams, and also to the "ssh-bugs" list for their comment/review. >The draft was identified as ERS-SVA-E01-1998:005.1. > >Rootshell has unfortunately chosen to include a copy of this draft advisory >in their recent newsletter, apparently for the purposes of defending itself >against charges that it was unfairly disparaging "sshd." Use of IBM-ERS's >draft advisory in this manner was not approved or authorized by IBM-ERS, >and does a disservice to all. > >Here are the facts about this advisory: > >1. IBM-ERS advisory ERS-SVA-E01-1998:005.1 was never issued publicly by > IBM. > >2. In response to a telephone query from Kit Knox of Rootshell, IBM-ERS > attempted to contact Kit on Friday evening, and was unable to reach > him. Specific contact information for IBM-ERS, as well as a brief > status update, were left on Mr. Knox's voice mail. Mr. Knox never > contacted IBM-ERS after that time. > >3. IBM has been working closely with Tatu Ylonen, author of "ssh," to make > sure that the potential vulnerability described in the advisory is not > exploitable. Upon further investigation, the problem originally > described appears to have been influenced by outside factors and does > not appear to be an exploitable problem in "sshd." > >4. IBM-ERS advisory ERS-SVA-E01-1998:005.1 was CANCELLED on the morning > of Sunday, Nov. 1st, *before* Mr. Knox issued his newsletter. > >5. At this time, IBM-ERS has NO KNOWLEDGE of any security vulnerabilities, > exploitable or otherwise, in the "sshd" program. > >We hope that this clarifies IBM's involvement in this situation. > >- --------------------------------------------------------------------------- > >The information in this document is provided as a service to customers of >the IBM Emergency Response Service. Neither International Business Machines >Corporation, nor any of its employees, makes any warranty, express or implied, >or assumes any legal liability or responsibility for the accuracy, complete- >ness, or usefulness of any information, apparatus, product, or process >contained herein, or represents that its use would not infringe any privately >owned rights. Reference herein to any specific commercial products, process, >or service by trade name, trademark, manufacturer, or otherwise, does not >necessarily constitute or imply its endorsement, recommendation or favoring > >by IBM or its subsidiaries. The views and opinions of authors expressed >herein do not necessarily state or reflect those of IBM or its subsidiaries, >and may not be used for advertising or product endorsement purposes. > >-----BEGIN PGP SIGNATURE----- >Version: 2.7.1 > >iQCVAwUBNj12ufWDLGpfj4rlAQGbNAQAhxLTKJh8H0s9uS0KbUVO3IxjfAYrcSuf >TTpwZjQ3qciBr+8+LVU/WIk4OLGX7WLl2ZLqisUzNkBra4k0xPd2vKbKp6Pfd+6o >DlNwfiwpty1wzPD/7eiu4xclHt0emMpDC6QMkJldk4/lv7iQmPltpeXdGqRVYja8 >fXtGXZO90UM= >=hlDX >-----END PGP SIGNATURE----- and then found this. >To: runge(a)crl.com >CC: ssh(a)clinet.fi >Subject: Re: ssh 1.2.26 and root compromise >References: <3.0.3.32.19981030195825.005a2a78(a)mail.mpim-bonn.mpg.de>, <slrn73psi8.h9i.bem(a)thorin.cmc.net> <4n7%1.49$y_6.390462(a)lwnws01.ne.mediaone.net> >Content-Type: text/plain; charset=us-ascii >Content-Transfer-Encoding: 7bit >Sender: owner-ssh(a)clinet.fi >Precedence: bulk >X-UIDL: 82af265d49d9ab5f1da6706787093894 > >Karl J. Runge wrote: > >> Maybe. I see about 125 calls to log_msg() in the ssh 1.2.x source code. >> Does anyone see one (or more?) calls that might be passing unprotected >> strings? I assume the unlimited %s are the place to start... >> [info: IBM's announcement points us to log_msg() as the source >> of the buffer overrun, but does not say which one. See rootshell >> statement which has the IBM announcement] >> >> I doubt the logging of "log_msg" has to do with the use of the word >> "log", but the IBM announcement is dated 10/30 ... (I just saw it today >> for the first time). > >The IBM advisory was cancelled within 24 hours. The appearent buffer >overflow IBM found was not reproducable on any other systems, and >appearently was due to some local problem with the Linux installation on >one particular machine. See > >http://www.ers.ibm.com/tech-info/advisories/sva/1998/ERS-SVA-E01-1998:005.1 .txt, > >http://www.ssh/fi/sshprotocols2/rootshell.html and > >http://www.rootshell.com/ > >Personally, I am very disappointed with rootshell's unprofessional >handling of that incident. Their continuing stubborn insistance - in >spite of all contrary evidence - that something other than their >security policy must be at fault fatally resembles the worst exemples >I've ever seen in corporate IT security. > >Sevo > > >-- >Sevo Stille >sevo(a)inm.de > ___________________________________________________ Roeland M.J. Meyer, ISOC (InterNIC RM993) e-mail: <mailto:rmeyer@mhsc.com>rmeyer(a)mhsc.com Internet phone: hawk.mhsc.com Personal web pages: <http://www.mhsc.com/~rmeyer>www.mhsc.com/~rmeyer Company web-site: <http://www.mhsc.com/>www.mhsc.com/ ___________________________________________ I bet the human brain is a kludge. -- Marvin Minsky

1 0