November 1998 - Test - lists.nanog.org

[Dag.Peak@qwest.net: A question from a new nanog reader.]
by Steven J. Sobol 03 Nov '98

03 Nov '98

This looks like it might be something of operational interest... -----Forwarded message from "Peak, Dag" <Dag.Peak(a)qwest.net>----- From: "Peak, Dag" <Dag.Peak(a)qwest.net> To: "'Steven J. Sobol'" <sjsobol(a)nacs.net> Subject: A question from a new nanog reader. Date: Tue, 3 Nov 1998 12:26:23 -0700 Steven, Given the current discussions on what is and what is not appropriate for the list, and given that I've only been reading it for a week or so, I though I'd ask you whether this information would be relevant or not (and you got picked because I've seen 7 messages from you in that time ;). Qwest Communications just put up a traceroute server. Would the list be interested in that information? For your own personal edification, its at http://www.iptools.qwest.net. Username qwestip, password elvis. (Even though its behind a password, it is for public consumption. It was developed as a sales tool.) Disclaimer: I work for Qwest in a sales engineering role. I'd personally like to see some discussion on what we're doing in the IP space. I think what we're doing is actually pretty cool. If you think its appropriate, forward on the URL to the list. If not, cool. I'll leave judgement up to you. Dag Peak Technical Consultant III, National Accounts Qwest Communications dag.peak(a)qwest.net 303.260.4602 (office) 303.229.0087 (cell) 303.260.4617 (fax) Identification given does not imply authorization, merely affiliation. -----End of forwarded message----- -- Steve Sobol [sjsobol(a)nacs.net] Part-time Support Droid [support(a)nacs.net] NACS Spaminator [abuse(a)nacs.net] Spotted on a bumper sticker: "Possum. The other white meat."

2 1

RE: 2U chassis (was Linux Router Kit)
by Chris Mauritz 03 Nov '98

03 Nov '98

It hardly seems useful for our purposes since it seems to be a single cpu Pentium 200mmx system. Any idea if they sell the cases alone? C -----Original Message----- From: brandon(a)rd.bbc.co.uk [mailto:brandon@rd.bbc.co.uk] Sent: Saturday, October 31, 1998 6:34 PM To: nanog(a)merit.edu Cc: list(a)inet-access.net Subject: Re: 2U chassis (was Linux Router Kit) For embedded Linux systems we've used these 2U boxes. http://www.capax.co.uk/products/sys/rack/er2200/er2200.htm regards, brandon

2 1

Re: [rootshell] Security Bulletin #25
by Roeland M.J. Meyer 03 Nov '98

03 Nov '98

I just got this. MHSC is also on the SSH mailer-list. It looks as if ALL accusations of SSH being exploitable are thinly founded at best. >Date: Mon, 2 Nov 1998 11:45:53 +0200 (EET) >From: Tatu Ylonen <ylo(a)ssh.fi> >To: ssh(a)clinet.fi, info(a)rootshell.com >Subject: Important information about IBM-ERS's "ssh" advisory (fwd) >Message-ID: <Pine.OSF.4.05.9811021143180.19300-100000(a)torni.ssh.fi> >MIME-Version: 1.0 >Content-Type: TEXT/PLAIN; charset=US-ASCII >Sender: owner-ssh(a)clinet.fi >Precedence: bulk >X-UIDL: a3533f8bef2d09b2dd5c56b653ba57e1 > >Please find enclosed a copy of a message from the IBM Emergency response >team. > > Tatu > >SSH Communications Security http://www.ssh.fi/ >SSH IPSEC Toolkit http://www.ipsec.com/ >Free Unix SSH http://www.ssh.fi/sshprotocols2/ > >---------- Forwarded message ---------- >Date: Mon, 02 Nov 1998 04:15:28 EST > >From: David A. Curry <davy(a)ers.ibm.com> >To: bugtraq(a)netspace.org, first-info(a)first.org, first-teams(a)first.org, > ssh-bugs(a)cs.hut.fi >Subject: Important information about IBM-ERS's "ssh" advisory > >-----BEGIN PGP SIGNED MESSAGE----- > >On Friday, Oct. 30th, IBM-ERS sent out a draft advisory to be released on >Monday, Nov. 2nd that described a buffer overflow condition in Version >1.2.x "sshd." This draft was sent to the Forum of Incident Response and >Security Teams, and also to the "ssh-bugs" list for their comment/review. >The draft was identified as ERS-SVA-E01-1998:005.1. > >Rootshell has unfortunately chosen to include a copy of this draft advisory >in their recent newsletter, apparently for the purposes of defending itself >against charges that it was unfairly disparaging "sshd." Use of IBM-ERS's >draft advisory in this manner was not approved or authorized by IBM-ERS, >and does a disservice to all. > >Here are the facts about this advisory: > >1. IBM-ERS advisory ERS-SVA-E01-1998:005.1 was never issued publicly by > IBM. > >2. In response to a telephone query from Kit Knox of Rootshell, IBM-ERS > attempted to contact Kit on Friday evening, and was unable to reach > him. Specific contact information for IBM-ERS, as well as a brief > status update, were left on Mr. Knox's voice mail. Mr. Knox never > contacted IBM-ERS after that time. > >3. IBM has been working closely with Tatu Ylonen, author of "ssh," to make > sure that the potential vulnerability described in the advisory is not > exploitable. Upon further investigation, the problem originally > described appears to have been influenced by outside factors and does > not appear to be an exploitable problem in "sshd." > >4. IBM-ERS advisory ERS-SVA-E01-1998:005.1 was CANCELLED on the morning > of Sunday, Nov. 1st, *before* Mr. Knox issued his newsletter. > >5. At this time, IBM-ERS has NO KNOWLEDGE of any security vulnerabilities, > exploitable or otherwise, in the "sshd" program. > >We hope that this clarifies IBM's involvement in this situation. > >- --------------------------------------------------------------------------- > >The information in this document is provided as a service to customers of >the IBM Emergency Response Service. Neither International Business Machines >Corporation, nor any of its employees, makes any warranty, express or implied, >or assumes any legal liability or responsibility for the accuracy, complete- >ness, or usefulness of any information, apparatus, product, or process >contained herein, or represents that its use would not infringe any privately >owned rights. Reference herein to any specific commercial products, process, >or service by trade name, trademark, manufacturer, or otherwise, does not >necessarily constitute or imply its endorsement, recommendation or favoring > >by IBM or its subsidiaries. The views and opinions of authors expressed >herein do not necessarily state or reflect those of IBM or its subsidiaries, >and may not be used for advertising or product endorsement purposes. > >-----BEGIN PGP SIGNATURE----- >Version: 2.7.1 > >iQCVAwUBNj12ufWDLGpfj4rlAQGbNAQAhxLTKJh8H0s9uS0KbUVO3IxjfAYrcSuf >TTpwZjQ3qciBr+8+LVU/WIk4OLGX7WLl2ZLqisUzNkBra4k0xPd2vKbKp6Pfd+6o >DlNwfiwpty1wzPD/7eiu4xclHt0emMpDC6QMkJldk4/lv7iQmPltpeXdGqRVYja8 >fXtGXZO90UM= >=hlDX >-----END PGP SIGNATURE----- and then found this. >To: runge(a)crl.com >CC: ssh(a)clinet.fi >Subject: Re: ssh 1.2.26 and root compromise >References: <3.0.3.32.19981030195825.005a2a78(a)mail.mpim-bonn.mpg.de>, <slrn73psi8.h9i.bem(a)thorin.cmc.net> <4n7%1.49$y_6.390462(a)lwnws01.ne.mediaone.net> >Content-Type: text/plain; charset=us-ascii >Content-Transfer-Encoding: 7bit >Sender: owner-ssh(a)clinet.fi >Precedence: bulk >X-UIDL: 82af265d49d9ab5f1da6706787093894 > >Karl J. Runge wrote: > >> Maybe. I see about 125 calls to log_msg() in the ssh 1.2.x source code. >> Does anyone see one (or more?) calls that might be passing unprotected >> strings? I assume the unlimited %s are the place to start... >> [info: IBM's announcement points us to log_msg() as the source >> of the buffer overrun, but does not say which one. See rootshell >> statement which has the IBM announcement] >> >> I doubt the logging of "log_msg" has to do with the use of the word >> "log", but the IBM announcement is dated 10/30 ... (I just saw it today >> for the first time). > >The IBM advisory was cancelled within 24 hours. The appearent buffer >overflow IBM found was not reproducable on any other systems, and >appearently was due to some local problem with the Linux installation on >one particular machine. See > >http://www.ers.ibm.com/tech-info/advisories/sva/1998/ERS-SVA-E01-1998:005.1 .txt, > >http://www.ssh/fi/sshprotocols2/rootshell.html and > >http://www.rootshell.com/ > >Personally, I am very disappointed with rootshell's unprofessional >handling of that incident. Their continuing stubborn insistance - in >spite of all contrary evidence - that something other than their >security policy must be at fault fatally resembles the worst exemples >I've ever seen in corporate IT security. > >Sevo > > >-- >Sevo Stille >sevo(a)inm.de > ___________________________________________________ Roeland M.J. Meyer, ISOC (InterNIC RM993) e-mail: <mailto:rmeyer@mhsc.com>rmeyer(a)mhsc.com Internet phone: hawk.mhsc.com Personal web pages: <http://www.mhsc.com/~rmeyer>www.mhsc.com/~rmeyer Company web-site: <http://www.mhsc.com/>www.mhsc.com/ ___________________________________________ I bet the human brain is a kludge. -- Marvin Minsky

1 0

AT&T Noc?
by alex＠nac.net 03 Nov '98

03 Nov '98

I hate to use the NANOG list as a phone directory, but surprisingly, AT&T's contact information in the whois returns lots of voicemail and disconnections. I need a NOC contact there; please either email me at alex(a)nac.net or call me at 973.442.3401. -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- Atheism is a non-prophet organization. I route, therefore I am. Alex Rubenstein, alex(a)nac.net, KC2BUO, ISP/C Charter Member Father of the Network and Head Bottle-Washer Net Access Corporation, 9 Mt. Pleasant Tpk., Denville, NJ 07834 Don't choose a spineless ISP; we have more backbone! http://www.nac.net -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --

1 0

machine specs for Netflow collector & Analyzer
by Roy Hockett 03 Nov '98

03 Nov '98

I know this is not in the spirit of this list, however, I am sure those who have addressed this issue are participants in this list. If you have web resources, or FAQs please point me in this direction. I have seen a fair amount of threads on related to this topic on this list, but none of them address the equipment that is being used for the collection and analyzing of netflow data. We are looking to collect about Gig of netflow data/hour. We are looking into how we can purge unneeded details, and keep just stats. That said we will atleast want to keeps a weeks worth of data, and backup old data to tape. We most likely will us Solaris as the platform of choice, but are open to others recommendations. What memory and disk storage setups are people using to collect and analyze data set of this size? Any recommendations are welcome. Please respond to me directly. Thanks, -Roy Hockett

2 1

Fix for BSDi TCP Header Issue
by Jonathan A. Zdziarski 03 Nov '98

03 Nov '98

Turns out that BSDi (HTTP and possibly FTP) isn't sending a CR at EOL, but only a LF. That's fine and doesn't break EOL protocol, however the packetshaper isn't pushing the packets through until it gets a CR. The guys at packetshaper are writing a fix for it, but it probably won't hit the release stages for a few weeks. If you're interested in the pre-release fix, and are having the same problems that myself, and other folks are having, contact rick at packeteer support and he can probably get you in on the list. We have about 80% BSDi machines here, so it's a big deal for us including customer platforms. If it's not a big deal for you, I appologize for filling up your nanog box. Thank you, Jonathan A. Zdziarski Sr. Systems Administrator Netrail, inc. 888.NET.RAIL x240

1 0

apology
by Michael Freeman 03 Nov '98

03 Nov '98

I would like to take the time and bandwidth to apologize to everyone who saw my posts about the rootshell hack, my choice of words that I used were wrong and innappropriate. I had a rough day that day dealing with the ssh issues from customers at my work and everything so..no hard feelings anyone. Thanks.

1 0

Xedia vs Packeteer Comparsion
by Michael Gibson 03 Nov '98

03 Nov '98

I wonder if anybody one there has had experience with both xedia and packeteer and would let me know what the strengths and weaknesses was of each Michael Gibson Team Leader, Network Operations - Netcom Canada Telephone: 416-341-5751 Fax: 416-341-5725 magibson(a)netcom.ca

7 9

FW: time for a new list?
by Lawrence A. Deleski 03 Nov '98

03 Nov '98

---------- >From: Brett_Watson(a)enron.net >To: nanog(a)merit.edu >Subject: Re: time for a new list? >Date: Tue, Nov 3, 1998, 5:29 PM > >na... the only thing that will ever work on this list is marshall law. or >better yet, a dictator. > >-brett > > I nominate Brett Watson. :-) Larry Deleski Program Manager Cisco PSO ldeleski(a)cisco.com

1 0

Re: time for a new list?
by Brett_Watson＠enron.net 03 Nov '98

03 Nov '98

na... the only thing that will ever work on this list is marshall law. or better yet, a dictator. -brett Peter Polasek <pete(a)cobra.brass.com> on 11/03/98 07:27:48 AM To: Josh Gluck <josh(a)tricreations.com> cc: nanog(a)merit.edu, Peter Polasek <pete(a)cobra.brass.com> (bcc: Brett Watson/Enron Communications) Subject: Re: time for a new list? I think that all that's needed are some loose guidelines. The sun-managers list, for example, loosely requires that all issues be discussed off-line (i.e. through direct e-mail to the submitter) after an issue has been initially submitted to the list. The submitter is then required to issue a summary of the results after all responses have been received. The only management that is in place (that I know of) is that the group mail-server rejects replies to the list address (which eliminates 95% of off-line discussions from being broadcast to the list). There are some habitual offenders of the rules, but it is largely an effective arrangement. I'm sure there are very many people (myself included) who have an interest in the NANOG discussions but simply can not take the sheer volume of messages. Peter On Tue, 3 Nov 1998, Josh Gluck wrote: > I have been reading this list for a while now, and for the most part, > just sitting back reading posts that interest me. I appreciate the early > heads up on outages, new info on networking technology and the like. > However, I do believe that moderating or "policing" the list would be a good > idea. I hate downloading my mail sometimes, for all the nonsense posts that > have been being sent to NANOG lately. Some of the threads go on forever or > seem to attract many of the following replies: > > { > > From: whoever(a)nowhere.com > To: Nanog(a)merit.edu > Subject: One REALLY LONG THREAD ABOUT NOTHING > > <<< > <<< Some quoted non needed long email from the thread > <<< that everyone has already seen about 20 times > <<< > > Agreed > > :) > > ------------------------------------------------------------ > >A 20 line sig that no one really cares about anyway > ------------------------------------------------------------ > > } > > These kind of replies are not needed. When I see these in my inbox, I > will stop reading the list and just delete everything. Most of us that > receive the list, don't need 3 pages of quoted material from the previous > post. All of the subscribers recieve the threads, I personally dont need it > more than once. Just use the original subject line and throw in a Re: > > As for a subscription requirement, that may be a little difficult as the > "good" information that passes through this list, is interesting to a great > deal of people that may not fit into the subscription group. It wouldn't be > fair to have them be denied from the right to see what is going on, however > a posting credentials requirement might be a good idea, but then again who > would enforce this, and what would the requirements be? > > I like this list a great deal, and use some of the information that I > gather from reading posts. I am willing to add any additional thoughts or > what have you, in an attempt to get NANOG more stream lined. I don't want > people to think that I am standing on a soap box, preaching, especially > because I don't really post to the list, but I am just letting everyone know > I would like to help make the list "a better place" > > > Josh Gluck - josh(a)tricreations.com > Senior Unix System Administrator > Tri Star Web Technical Support > 888-757-4248 > > > *The views expressed are my own and > do not reflect at all on the part of my > employer. > >

1 0