- NANOG - lists.nanog.org

Morons?
by John Fraizer 03 Nov '98

03 Nov '98

At 06:50 PM 11/1/98 -0500, you wrote: >Hey morons argueing over the ssh bug, rootshell just posted an email >advisory, they have written code on an ssh-1.2.26 exploit. They were >hacked via ssh, and they have stated so on their web page as well. > > Dave McKay > themonk(a)lower.org > Systems/Security Admin > > Hello Mr. McKay. Firstly, I do wonder where you get off addressing NANOG as morons. Do you suppose to be the only individual in the readership with a clue? Before you crotch-check yourself and belt out "hell yes," perhaps you should re-read the email from mr Knox. I realize that being a the hero to network admins everywhere must take up an enormous amount of your time so, I have included the paragraph to which I am referring: [ Date: Sun, 1 Nov 1998 12:45:13 -0800 (PST) From: Kit Knox <kit(a)connectnet.com> X-Sender: kit(a)kit.rootshell.com To: nanog(a)merit.edu Subject: [rootshell] Security Bulletin #25 <snip> They appear to have jumped the gun slightly and do not have working exploit code, but have found possible buffer overflows in the ssh 1.2.26 code. Rootshell has also received further reports of exploit code going around in various circles. SSH Communications Security Ltd. has evaluated this bulletin and now believes it is actually not a problem. <snip> ] "reports of exploit code" and actual WORKING exploits are nowhere near the same. Hell, some marketing people would like you to believe "reports" of windows boxes outperforming *nix boxes on identical hardware running the same tasks. So, please tell all of us supposed "morons," where is the mention of the "code on an ssh-1.2.26 exploit" that they have written? Could you do us the service of posting a URL or are you too busy saving us from our feeble selves? What I'm seeing on the webpage live and in technicolor is the same email from IBM-ERS that was posted to NANOG with rootshell comments added in [] to each paragraph. There is no mention of their having a working exploit and there is no mention of them being "hacked" via SSH. The site states: [ On Wed Oct 28th at 5:12AM PST the main Rootshell page was defaced by a group of crackers. Entry to the machine was made via SSH (secure shell) which is an encrypted interface to the machine at 04:57AM PST this morning. Rootshell was first informed of this incident at 6:00 AM PST and the site was immediately brought offline. The site was back up and operational by 8:00AM PST. ] If you contend that this is being "hacked via ssh" I contend that you are making a huge leap. For all we know, and what I personally suspect, another box on the net was compromised that had a valid key with empty passphrase to login to the rootshell box. ------- John Fraizer | __ _ The System Administrator | / / (_)__ __ ____ __ | The choice mailto:John.Fraizer@EnterZone.Net | / /__/ / _ \/ // /\ \/ / | of a GNU http://www.EnterZone.Net/ | /____/_/_//_/\_,_/ /_/\_\ | Generation A 486 is a terrible thing to waste...

2 1

digex smurf amplifiers
by Dan Hollis 03 Nov '98

03 Nov '98

Ok who do I talk to at digex to get their smurf amplifiers closed. I have a ticket open with them since Oct 21. -Dan

4 3

Re: [rootshell] Security Bulletin #25
by Richard Steenbergen 03 Nov '98

03 Nov '98

>Well, seeing how 2.0 is actually a commercial product and supposedly >re-written, I can see why they'd want to sell it. If you want to run ssh >and don't want to pay for it, you're stuck with the 1.x version. Those >that can pay do, and those that don't whine for some reason. It's not >like you couldn't take the source to 1.2.26 and alter it now, is it? Have you ever stopped to look at the src to 2.0? Large portions of it is unfinished. Hell the only symetric ciphers they have are DES (do we even have to go here), RC4 (a stream cipher that has been implimented wrong in SSH before), and Mars (an AES candidate from IBM which has known attacks against it). -- Richard Steenbergen <humble(a)lightning.net> Data Innovations System Admin http://www.bitchx.com/~humble - humble@EFnet - PGP KeyID: 0x21581362 PGP Fingerprint: 7552 6AB2 B9C7 5A1B F1B6 8EA3 DFCF 793D 2158 1362 Remember - Boss spelled backwards is "double S.O.B"

4 3

more on ticket systems...
by Rich Sena 03 Nov '98

03 Nov '98

found this on the jitterbug page - it's a link to a page full of ticket and helpdesk systems for linux... http://linas.org/linux/pm.html like I said pv - I need to pay attention... -- I am nothing if not net-Q! - ras(a)poppa.clubrich.tiac.net

1 0

Outage Archives/Outage Studies
by William B. Norton 03 Nov '98

03 Nov '98

Hi all - Have any of you stumbled upon an Internet outage study? I'm looking for classifications of outages by cause (circuits, router SW, misconfigurations, physical facilities like power, accidental pulled cables, etc) If not, has anyone assembled anything like an aggregated outage-archive page? Thanks in advance - Bill ---------------------------------------------------------------- William B. Norton <wbn(a)equinix.com> 734.662.0748 (Work/Home) http://www-personal.umich.edu/~wbn/ 734.604.1133 (cell)

1 0

Re: time for a new list?
by Dave Crocker 03 Nov '98

03 Nov '98

At 09:01 PM 11/2/98 -0600, Joe Shaw wrote: > >I think moderating the group might not be such a bad idea. The only >problem with this would be getting someone who had enough time to actually The constrained-posting approach might solve the dis-satisfactions that triggered this thread. However, let me suggest two, other approaches to consider. 1. This was pioneered by Harald Alvestrand, for the IETF main list, and seems to be quite successful. The premise to his approach is to run an unofficial, subsidiary list, off of the main, official one. On its face, it is just a distributor of the main list. Why subscribe to it? Well, the value-add is that he has filters in place, according to whatever rules he feels appropriate. What he feels appropriate, for the IETF list, is to filter out the common sources of "noise". Those subscribed to it seem satisfied with the results. The nice things about this approach are that 1) it doesn't create the massive burden that moderating does, and 2) it maintain utterly open participation for the official list and, therefore, doesn't run afoul of the usual expectations and requirements for open access to the official list. 2. This was pioneered by the "ORSC" folks who are active with the IANA re-working. I'm not happy with they way they are running their list, but the idea they are using strikes me as quite good: Create rules for acceptable conduct on the list. Create an arbitration panel to pass judgement when someone is claimed to violate those rules. When someone exceeds the limits in the rules, such as 3 rules violations, they can be banned from the list. d/ =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Dave Crocker Tel: +60 (19) 3299 445 <mailto:dcrocker@brandenburg.com> Post Office Box 296, U.P.M. Serdang, Selangor 43400 MALAYSIA Brandenburg Consulting <http://www.brandenburg.com> Tel: +1 (408) 246 8253 Fax: +1(408)273 6464 675 Spruce Dr., Sunnyvale, CA 94086 USA

1 0

What do you use for <5kVA UPSs?
by calemon＠uplink.on.ca 03 Nov '98

03 Nov '98

I was just wondering what some people are using for small (<5kVA) UPSs that are left in unmanned locations running critical network equipment (so management and monitoring are also critical). I'm curious about units in the 2, 3 and 5kVA ballparks since different solutions will be needed for these two different capacities. What vendors support 20A 120VAC outlets on their products? How reliable have your units been? Any comments on SNMP management? Thanks in advance, -- Craig A. Lemon, B.A.Sc. | WWW: http://www.net/~calemon/ VE3XCL (CL184) | amprNET: ve3xcl(a)ve3uow.ampr.org calemon(a)uplink.on.ca | PGP: http://www.net/~calemon/pgpkey.txt

1 0

Re: Linux Router KIT
by Paul Vixie 03 Nov '98

03 Nov '98

> > > I wonder how long 'netstat -rn' takes on *BSD with 54k routes. > > 6 seconds (output to /dev/null) on a Pentium something-or-other > > running BSD/OS 3.1. > How about 'netstat -rn | wc -l' [bgw1.pa:i386] head /var/db/dmesg.boot BSDI BSD/OS 3.1 Kernel #3: Sun Apr 26 10:03:00 PDT 1998 root@bb.rc.vix.com:/tmp_mnt/db/db2/proj/src/BSDI/3.1/sys/compile/VIXLADDR cpu = Pentium (about 200 MHz) model 2, stepping 12, type 0, features 1bf delay multiplier 5111 real mem = 134217728 (128.00 MB) avail mem = 129523712 (123.52 MB) buffer cache = 13258752 (12.64 MB) isa0 (root) pci0 at root: configuration mechanism 1 keyboard disconnected? (code fe) [bgw1.pa:i386] time sh -c 'netstat -rn | wc -l' 53217 4.047u 3.730s 0:07.71 100.7% 0+0k 0+3io 0pf+0w [bgw1.pa:i386] uptime 12:59PM up 120 days, 5:22, 2 users, load averages: 0.25, 0.16, 0.10 [bgw1.pa:i386] netstat -i Name Mtu Network Address Ipkts Ierrs Opkts Oerrs Coll de0* 1500 <link1> 00:00:f8:23:92:dd 0 0 0 0 0 de1 1500 <link2> 00:c0:95:e0:1e:1c 454157833 0 3149262405 695 11267799 de1 1500 core-net.pa bgw1-core 454157833 0 3149262405 695 11267799 de2 1500 <link3> 00:c0:95:e0:1e:1d 54420576 0 14698905052 1458728 85038844 de2 1500 iana-net.pa bgw1-iana 54420576 0 14698905052 1458728 85038844 de3* 1500 <link4> 00:c0:95:e0:1e:1e 0 0 0 0 0 de4* 1500 <link5> 00:c0:95:e0:1e:1f 0 0 0 0 0 fpa0 4470 <link6> 00:00:f8:41:02:34 17887289596 0 90176835 0 0 fpa0 4470 net.ix.pa-x xfw1-paix 17887289596 0 90176835 0 0 lo0 1536 <link7> 154949 0 154949 0 0 lo0 1536 bgw1.pa.vix bgw1 154949 0 154949 0 0 lo0 1536 loopback-ne localhost 154949 0 154949 0 0 sl0* 308 <link8> 0 0 0 0 0 ppp0* 1500 <link9> 0 0 0 0 0 ppp1* 1500 <link10> 0 0 0 0 0 pif0* 576 <link11> 0 0 0 0 0 tun0* 1500 <link12> 0 0 0 0 0 tun1* 1500 <link13> 0 0 0 0 0 -- Paul Vixie <paul(a)vix.com>

2 1

Re: Despamming wholesale dialup
by Dean Anderson 03 Nov '98

03 Nov '98

You are so full of it. You are the one who takes every opportunity to talk about spam. I just debunk you every once in while when the sh*t gets too deep. You are the one who can be accused of "preaching". I'll note that "preaching" requires a religous belief unsupported by fact or reason. A "believer" must deny reality to have faith in something that one is not likely to obtain in their lifetime. I think that your unrealistic anti-spamming efforts fit that discription more than my revealing your fallacies does. Not only have you been proven wrong in your claims on spam costs, etc, as well as wrong about the relevant laws which might be applicable, but more importantly and more critical to a political movement of any kind, you have been proven wrong about the nature and capabilities of your political enemies. In short, you have been a complete fool, by any measure. So perhaps you can shut up now. --Dean At 10:17 PM 10/30/1998 -0500, Steven J. Sobol wrote: >On Fri, Oct 30, 1998 at 05:42:50PM -0500, Dean Anderson wrote: >> Give it a rest. You won't be stopping spam. Dream on if you like. > >I already said, at the beginning of the thread, that it's off-topic. > >But of course you jumped at the chance to start preaching again. As I >pointed out, and as Ray Everrett-Church also pointed out, you're wrong. >End of discussion, and I am not going to post anything further on this topic >to NANOG. > >-- >Steve Sobol [sjsobol(a)nacs.net] >Part-time Support Droid [support(a)nacs.net] >NACS Spaminator [abuse(a)nacs.net] > >Spotted on a bumper sticker: "Possum. The other white meat." > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

4 3

internic.net zone not updating on noc.cerf.net
by Marc Slemko 02 Nov '98

02 Nov '98

(cc to nanog in case anyone is wondering why they are having sporadic problems reaching rs.internic.net...) $ dig internic.net soa @noc.cerf.net ; <<>> DiG 2.2 <<>> internic.net soa @noc.cerf.net ; (1 server found) ;; res options: init recurs defnam dnsrch ;; got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10 ;; flags: qr aa rd ra; Ques: 1, Ans: 1, Auth: 5, Addit: 5 ;; QUESTIONS: ;; internic.net, type = SOA, class = IN ;; ANSWERS: internic.net. 86400 SOA ops.internic.net. markk.internic.net. ( 98103001 ; serial 3600 ; refresh (1 hour) 3600 ; retry (1 hour) 432000 ; expire (5 days) 86400 ) ; minimum (1 day) [...] All the other servers have 98104001. This is a problem because (one of) the changes made between those two revisions are to change rs.internic.net from having: rs.internic.net. 900 A 198.41.0.12 rs.internic.net. 900 A 198.41.0.13 rs.internic.net. 900 A 198.41.0.6 rs.internic.net. 900 A 198.41.0.7 rs.internic.net. 900 A 198.41.0.8 rs.internic.net. 900 A 198.41.0.9 to: rs.internic.net. 900 A 198.41.0.6 Currently, rs.internic.net doesn't resolve to a functioning host when a resolver asks noc.cerf.net for an answer, unless it happens to pick .6 out of the list. It has been this way for at least a few hours and since the refresh is 1h... people will see intermittent problems reaching rs.internic.net Of course, right now whois seems hosed anyway, but...: $ whois internic.net Registrant: $

2 1