- NANOG - lists.nanog.org

Re: Rootshell pages hacked
by Adam D. McKenna 31 Oct '98

31 Oct '98

You need to 1) take a chill pill 2) understand that there are plenty of people around that know more than you. I didn't say it might be an ssh exploit based on some idiot's misinterpretation of the bugtraq post. I said it because I have heard rumours that an exploit is *circulating*. If you have *real* information then do not hesitate to post it. But conjecture and denial gets us nowhere. --Adam -----Original Message----- From: Michael Freeman <mikef(a)boris.talentsoft.com> To: Adam D. McKenna <adam(a)flounder.net> Cc: Joe Shaw <jshaw(a)insync.net>; JR Mayberry <rick(a)magpage.com>; neil <neil(a)junior.uwc.ac.za>; Russ Haynal <russ(a)navigators.com>; nanog(a)merit.edu <nanog(a)merit.edu> Date: Saturday, October 31, 1998 3:41 PM Subject: Re: Rootshell pages hacked It is not a fucking problem in SSH! Jesus christ, people do not listen. If it had anything to do with ssh, heres what happened. (speculation) A trusted host was compromised that Kit Knox or another rootshell staff member used, ssh was trojaned and passwords were snagged, and the intruder simply walked right in through the front door. Nothing sophisticated, nothing fancy, no ssh remote exploits. On Thu, 29 Oct 1998, Adam D. McKenna wrote: > They claim they were running only qmail, apache and ssh, but who knows if > that's true. > > I have heard rumours about an ssh exploit but nothing concrete. > > --Adam > > -----Original Message----- > From: Joe Shaw <jshaw(a)insync.net> > To: JR Mayberry <rick(a)magpage.com> > Cc: neil <neil(a)junior.uwc.ac.za>; Russ Haynal <russ(a)navigators.com>; > nanog(a)merit.edu <nanog(a)merit.edu> > Date: Thursday, October 29, 1998 2:36 PM > Subject: Re: Rootshell pages hacked > > > I thought they were runnign qmail? > > Joe > > On Thu, 29 Oct 1998, JR Mayberry wrote: > > > Supposedly sendmail 8.9.1 is to blame, not ssh. > > http://www.sendmail.com/sendmail.8.9.1a.html > > > >

1 0

Re: 2U chassis (was Linux Router Kit)
by shields＠crosslink.net 31 Oct '98

31 Oct '98

In article <Pine.SO4.4.05.9810310808380.14448-100000(a)precipice.v-site.net>, Geoff White <geoffw(a)precipice.v-site.net> wrote: > We are trying to roll our own server/router/accounting box and > have everything speced out but the chassis, we need to find a PC rack > mount chassis that is no higher than 2U ( 3.5"). The co-los we use charge http://www.varesearch.com has these; I haven't tried them. However they are very deep. -- Shields, CrossLink.

1 0

NANOG 14 ATTENDE LIST
by Pam Ciesla 31 Oct '98

31 Oct '98

Is up to date through Friday, 10/30. If you are not on the list and have registered or have any questions please contact me. Thanks __________________ Pam Ciesla Merit Network, Inc. 734-936-0172 - phone 4251 Plymouth Road 734-647-3185 - fax Bldg. I, Suite C Ann Arbor, MI 48105-2785

1 0

Re: Linux Router KIT
by Adam D. McKenna 31 Oct '98

31 Oct '98

So does linux. Linux can be: A packet forwarder (router) A packet filter (firewall) An IP masquerading packet filter (NAT firewall) Can run RIP, BGP, EGP, OSPF (via gated) Maybe I'm being naiive here, but what does Cisco offer beyond this (besides the availability of higher performance)? --Adam -----Original Message----- From: Michael Shields <shields(a)crosslink.net> To: dirk(a)power.net <dirk(a)power.net> Cc: nanog(a)merit.edu <nanog(a)merit.edu>; list(a)inet-access.net <list(a)inet-access.net> Date: Wednesday, October 28, 1998 4:01 PM Subject: Re: Linux Router KIT In article <19981028100541.00359(a)orlando.power.net>, dirk(a)power.net wrote: > Linux doesn't just kill Microsoft's NT and Solaris. It also eats > Cisco for lunch. This isn't true. IOS does a lot more than just get packets from interface A to interface B. (In terms of managability as well as functionality) -- Shields, CrossLink.

17 26

Re: Xedia vs Packeteer Comparsion
by matthew zeier 31 Oct '98

31 Oct '98

On Fri, Oct 30, 1998 at 01:35:02PM -0800, Christofer Hoff wrote: > Matthew: > > What version of code are you running in your 4000 -- I see no such latency > issues nor packet drop and we regularly push 20+ Mb through our boxes... > sits between a Cisco 75xx and Catalyst 5000 Switch. PacketShaper v3.1.3g14 1998-09-15. > Are you using the same cable/cables when you place the packetshaper > in the network vs. when it is out? Also, have you looked at the CLI for > the NIC stats? Yeah, same cables. I believe the issues was in the number of sessions the box was handling, not the amount of bandwidth. I believe we were looking at "mib tcp" - some of the values we were seeing were nearing the limits of the box. One of the websites that we host, but don't shape, typically gets 200-300 hits per second during peak. Which, of course, has a direct impact on bandwidth. The technical explaination that made the most sense to me was the increase in hits per second meant an increase is hosts the p4k was managing. I can track down my emails and talk to you offline about this, if you're interested. - mz -- matthew zeier - "Chance is irrelevant - we will succeed." - 7 of 9

1 0

Re: Despamming wholesale dialup
by Dean Anderson 31 Oct '98

31 Oct '98

Unless you use Microsoft products. Outlook smtp's, then pops. --Dean At 02:45 PM 10/30/98 -0800, Derek Balling wrote: >There are solutions available to this problem, the primary one being the >"smtp-after-pop" hack that is widely available and fairly widely used. > >Essentially, issuing a STAT command opens up an SMTP relay window for ><admin-definable> minutes, whereupon if the user hasn't issued another STAT >in the mean time [e.g. they logged off] the "hole" goes away. > >We were using that at my last job and it works just fine. > >At 12:38 PM 10/30/98 -0600, Phil Howard wrote: >>Bryan Bradsby wrote: >> >>> Block port 25 (only) from all "open modem banks" (TM) to my SMTP servers. >>> If implemented on a large enough scale, the modem user will be >>> 'encouraged' to use the SMTP server supplied with their account. Make each >>> dialup customer go through, and be authenticated by their own SMTP server. >> >>I think I see an additional problem creeping in here. >> >>The question is whether a dialup user should use the SMTP server of the >>facility provider, or of the ISP that actually resells the account. You >>could have virtual ISP resellers with no facilities at all, but lets take >>a look at a small ISP that does have facilities, and is reselling dialup >>to a national provider so his local business customers can have roaming >>access without calling an 800 number. >> >>If the small ISP opens their SMTP server to the IP addresses of the big >>national dialup provider, which they would have to do in order to be able >>to handle that roaming customer who could be just about anywhere, will >>they not also be opening themselves up to being a relay for any spammer >>that uses any reseller of that national provider? Will not such spammers >>then have access to every ISP doing reselling via that national one? >> >>I think the SMTP server that should be used when dialing that national >>provider is the SMTP server provided by that national provider, unless >>some kind of VPN is used (to be more technically correct, use the SMTP >>server of the provider of IP addressing). >> >>Roeland's issue still applies when the dialup customer is using his domain >>name as the FROM/REPLY. But if the national provider SMTP servers accept >>any domain name in the FROM/REPLY, and just log the reality as it sees it >>in the header (e.g. dialup port and time which can be cross checked with >>the access logs), then anyone can use these dialups, and spammers won't >>get an advantage of being able to spew their filth to other than the SMTP >>server of the dialup provider. >> >>-- >> -- *-----------------------------* Phil Howard KA9WGN * -- >> -- | Inturnet, Inc. | Director of Internet Services | -- >> -- | Business Internet Solutions | eng at intur.net | -- >> -- *-----------------------------* philh at intur.net * -- > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 1

Re: Despamming wholesale dialup
by Dean Anderson 31 Oct '98

31 Oct '98

Give it a rest. You won't be stopping spam. Dream on if you like. But take it off Nanog. --Dean At 04:30 PM 10/30/98 -0500, Steven J. Sobol wrote: >On Fri, Oct 30, 1998 at 01:52:19PM -0500, Dean Anderson wrote: > >> One problem is that the wholesale provider may not have permission to do >> this. You must obtain permission from a party to the communication prior to >> interfering with it, unless it qualifies as an abuse. > >Don't start again, Dean. > >> You should be aware that the pro-spammers have a bill in Congress to >> explicitly define spam as a legitimate activity, ie not an abuse. It will >> likely be passed in this session. > >Wrong. It died. Unfortunately, the telephone anti-slamming bill died with >it - the spam rider was attached to the anti-slamming bill. > >>I tried to tell people a year and a half >> ago that spammers were closely associated with an advertising lobby that >> would be effective on this is issue, and that they needed to try a more >> reasonable approach. But they insisted "I was wrong". > >You're still wrong. The DMA and its members seem to be adopting a wait-and- >see attitude, although they seem to be moving towards action... > >> So "Spam fighting" is now a lost cause > >Whatever. > >> which should not be discussed on Nanog anyway. > >Which doesn't stop you from whining about spamfighters every few months >anyhow. > > >-- >Steve Sobol [sjsobol(a)nacs.net] >Part-time Support Droid [support(a)nacs.net] >NACS Spaminator [abuse(a)nacs.net] > >Spotted on a bumper sticker: "Possum. The other white meat." > > > ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

3 2

xedia-cisco OSPF
by Michael Gibson 31 Oct '98

31 Oct '98

Anybody tried using an area other then zero within OSPF between a Cisco and Xedia. If so, any simple config commands on the xedia to try. Thanks in advance Michael Gibson Team Leader, Network Operations - Netcom Canada Telephone: 416-341-5751 Fax: 416-341-5725 magibson(a)netcom.ca

1 0

Re: Linux Router KIT
by Pete Carah 30 Oct '98

30 Oct '98

>On Thu, 29 Oct 1998, Jon Lewis wrote: >> On Wed, 28 Oct 1998, Dan Hollis wrote: >> > > Also, for a long time, Linux had a hard time with lots or routes. >> > No longer applies. In fact Linux is now faster than BSD up to about >> > 60-70,000 routes. BSD is faster at about 200,000. In between its about >> > even. >> Where/how are you doing simulations with that many routes? > >These are just numbers reported by Alan Cox and Alexey Kuznetsov. > >> Feeding full routes to a linux 2.0.3x box running gated, I get: >> # cat /proc/net/route | wc -l >> 54677 >> and that command takes 13s to complete. > >Well thats great for benchmarking procfs B) > >I wonder how long 'netstat -rn' takes on *BSD with 54k routes. % time eval 'netstat -rn | wc -l' 53606 2.6u 2.3s 0:05.74 86.4% 64+407k 0+0io 0pf+0w I don't know which process the u and s numbers refer to; it could easily be wc... This is on a box with an AMD K6/300 and 256mb ram (unneeded normally, but it was starting to swap a little at 128m. After being up a day (we upgraded hardware last night; before that it had been up a month) it looks like 144mb ram would be plenty.) It gets 4 full views and several private peers, with 4 ethernet cards and a quad (et) sync. Gated's ram is not too bad for 4 full views: root 182 0.0 15.6 40088 40440 ?? S 11:58PM 2:22.73 /usr/local/sbin/gated We normally push 10-12mbits/sec but only around 1k packets/sec. With about 50 (ipfw) filter rules, the cpu is normally around 5-15%, almost all "interrupt", as might be expected. -- Pete

1 0

Re: Despamming wholesale dialup
by Dean Anderson 30 Oct '98

30 Oct '98

At 05:33 PM 10/29/98 -0500, Scott Gifford wrote: > An interesting answer to the problem you discussed above was suggested by >somebody from the EFF at a spam BOF at USENIX this summer. He suggested >that by default, you filter on port 25. But if somebody needs access for >legitimate reasons, or even if they don't, have a letter they can fill out, >sign, and send in which states that they will not send spam, subject to a >$500/message penalty. Then if they do, just bill them. One problem is that the wholesale provider may not have permission to do this. You must obtain permission from a party to the communication prior to interfering with it, unless it qualifies as an abuse. You should be aware that the pro-spammers have a bill in Congress to explicitly define spam as a legitimate activity, ie not an abuse. It will likely be passed in this session. I tried to tell people a year and a half ago that spammers were closely associated with an advertising lobby that would be effective on this is issue, and that they needed to try a more reasonable approach. But they insisted "I was wrong". So "Spam fighting" is now a lost cause, which should not be discussed on Nanog anyway. --Dean ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Plain Aviation, Inc dean(a)av8.com LAN/WAN/UNIX/NT/TCPIP http://www.av8.com ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

4 3