September 1998 - Test - lists.nanog.org

Re: Remote Shell
by Adam D. McKenna 29 Sep '98

29 Sep '98

This will work if you have no passphrase on your RSA key. This is a *really* stupid thing to do, IMHO, especially to a root account, as anyone who manages to get access to your ~/.ssh/identity file will be able to log into any host that you have set this up on, without a password. While it's a little more secure than .rhosts authentication, the absence of any kind of password/passphrase validation makes it (again IMHO) an undesirable option for the security conscious. --Adam -----Original Message----- From: Zachary McGibbon <mzac(a)uunet.ca> To: Roeland M.J. Meyer <rmeyer(a)mhsc.com> Cc: Benicio Miguel Sanchez Fuentes <bsanchez(a)alestra.com.mx>; NorthAm Net Ops Grp List <nanog(a)merit.edu> Date: Tuesday, September 29, 1998 1:42 AM Subject: Re: Remote Shell You can perform 'rsh' type commands with ssh as well... here's an example: /# ssh servername w root@servername's password: <type password here> 10:45pm up 19 days, 6:31, 2 users, load average: 0.18, 0.11, 0.09 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT root ttyp0 client 8:08pm 2:37m 0.27s 0.10s You can also setup authorized keys on the server side. In your home dir on the server, go into the '.ssh' dir, and create a file called 'authorized_keys', then on your workstation, type 'ssh-keygen'. In your home dir, go into '.ssh' and take the contents of 'identity.pub' and copy that to the 'authorized_keys' on the server side. Then 'chmod 600 authorized_keys' on the server side. Then it won't ask you for a password when you ssh to that machine. It's usefull if you want to set this up as a cronjob to do something on a remote machine. On Mon, 28 Sep 1998, Roeland M.J. Meyer wrote: > Set up SSH <http://www.datafellows.com> and open port 22. I would NOT allow > plain ol' telnet over the Internet. SSH is free for non-commercial use and > is works quite well under HP-UX. > > > > At 01:32 PM 9/28/98 -0500, you wrote: > >I need to give remote shell access to a user in a server (an HP-9000 k410 > >running HP-UX 10.10) conected to mine through a 3Com router, I have done > >some investigation and what I have found is that I have to open port 514 > >for tcp, for some reason this did not work, so I opened (temporarily of > >course) all the ports on the router....and it worked, but I donŽt want to > >leave it like that, Does anyone now what port(s) I need to leave open to > >alow the remote shells?. > > > >Is there any configuration needed other than the equiv.hosts and (or) the > >.rhosts files ? > > > >Thanks in advance for your answers > > > >Benicio Sanchez > >Network Operations Engineer > >Alestra > > > > _________________________________________________ > Morgan Hill Software Company, Inc. > Colorado Springs, CO - Livermore, CA - Morgan Hill, > CA > Domain Administrator > MHSC2-DOM and MHSC3-DOM > Administrative and Technical contact > ____________________________________________ > InterNIC Id: MHSC hostmaster (HM239-ORG) > e-mail: <mailto:hostmaster@mhsc.com>mailto:hostmaster@mhsc.com > web -pages: <http://www.mhsc.com/>http://www.mhsc.com/ > ____________________________________________ > A group of politicians deciding to dump a President because his morals > are bad is like the Mafia getting together to bump off the Godfather for > not going to church on Sunday. > -- Russell Baker > Zachary McGibbon mzac(a)uunet.ca

3 2

Re: UDP packet/DNS server
by shields＠crosslink.net 29 Sep '98

29 Sep '98

In article <19980928210036.A24460(a)qual.net>, Christopher Neill <chrisn(a)qual.net> wrote: > Allowable characters in hostnames are: > > a-zA-Z0-9 > > I think / is also allowable, and there is an RFC on this subject. Go to > ftp://nic.ddn.mil/pub/rfc to check. No it is not. However, hyphens are. But, the element "*" is a special case, with different semantics to go with its different syntax. -- Shields, CrossLink.

1 0

Any Cisco-experienced folks wanna tackle this one?
by Kevin Brown 29 Sep '98

29 Sep '98

I will expect replies to this message directly as it doesn't really fit into the normal fodder for nanog, but it is a last ditch effort for problem resolution. I have a customer who I am integrating into our network via a T1 link and have already gotten all the nominal routing setup prepared. This customer is using RFC1918 addressing on his LAN, and requires a firewall-type solution with NAT capabilities. Bless this customer for thinking ahead with his internal addressing :=) Anyway, I have run into a problem with his hardware/software provisioning and I think this can be recreated in a lab environment: Cisco 1601 router 6 MB Flash 4 MB DRAM WIC-1DSU-56K4 IP Plus/Firewall IOS version 11.3 (actual image name: c1600-nosy-mz.113-3.T ) Everytime I have start the router, I get a software crash that TAC says should not be happening. If anyone else might have this equipment setting around, and be willing to replicate this and see what happens for you, I would much appreciate hearing about it. I'm thinking I've found an ewps in the code/hardware configuration and have just provisioned a non-working solution. I'd like to hear what the rest of you might come up with. Yes, I know it's a small configuration, but surely we've all got lessor routers in the field with similar requirements. Thanks in advance if you would assist Kevin Brown

2 1

Remote Shell
by Benicio Miguel Sanchez Fuentes 28 Sep '98

28 Sep '98

I need to give remote shell access to a user in a server (an HP-9000 k410 running HP-UX 10.10) conected to mine through a 3Com router, I have done some investigation and what I have found is that I have to open port 514 for tcp, for some reason this did not work, so I opened (temporarily of course) all the ports on the router....and it worked, but I don´t want to leave it like that, Does anyone now what port(s) I need to leave open to alow the remote shells?. Is there any configuration needed other than the equiv.hosts and (or) the .rhosts files ? Thanks in advance for your answers Benicio Sanchez Network Operations Engineer Alestra

4 3

WEATHER: update Puerto Rico/South Florida
by Sean Donelan 28 Sep '98

28 Sep '98

300 dead so far (200 Dominican Republic, 87 Haiti, others spread out over several different islands) Once again, my information is limited to where DRA has customers. So I don't know about other areas. South Florida: Light to moderate damage. Power outage in the keys and spot outages in south Florida. Most telephone and Internet service continued to function. Puerto Rico: Latest word I have from people on the island, is they are still without telephone, electricity or water. At least 50% of the telephone poles on the island have been knocked down. I don't have word specifically about the satellite teleport in Puerto Rico. Currently emergency officials are working on restoring utility service to these facilities, in this order 1. Emergency services, hospitals, designated shelters 2. Water and sewerage plants 3. Telephone and other communication services Estimates are it will be Monday before priority services have been restored. Major urban areas by the end of next week (Oct 2). Other News: Does anyone have any more information about Worldcom's outage last night in Mississippi? The only information we received was it involved hazardous materials. BTW, last Friday I attended a briefing at the Department of Commerce about the process the US Government is embarking on to work on a "private-public" partnership with the "Information and Communications" sector as part of their Critical Infrastructure Assurance Program. I didn't recognize anyone from a "post cold war" company in attendence. Essentially no Internet backbone representation, with maybe the possible exception of AT&T. Not that anyone missed anything. I wonder what the press thought of the briefing. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

3 2

Re: Remote Shell
by Sudeep_Khuraijam＠3com.com 28 Sep '98

28 Sep '98

Benicio, The Firewall services can be configured to log in varying degrees of detail , so you should be able to see the ports and policies following which it is denied. A sample of such a syslog would look like:: Aug 19 09:55:13 3ComFirewall-Router #206 Sun Aug 19 08:56:28 1998 R.R.R.1 FireWall "Rx !5 X.X.X.69(33004)->Y.Y.Y.11(DNS) UDP Deny SrcSpoof" IPs::R-Firewall router X-Source (port) Y-Destination (port) Sudeep At 01:32 PM 9/28/98 -0500, you wrote: >I need to give remote shell access to a user in a server (an HP-9000 k410 >running HP-UX 10.10) conected to mine through a 3Com router, I have done >some investigation and what I have found is that I have to open port 514 >for tcp, for some reason this did not work, so I opened (temporarily of >course) all the ports on the router....and it worked, but I don´t want to >leave it like that, Does anyone now what port(s) I need to leave open to >alow the remote shells?. > >Is there any configuration needed other than the equiv.hosts and (or) the >.rhosts files ? > >Thanks in advance for your answers > >Benicio Sanchez >Network Operations Engineer >Alestra >

1 0

Domains for sale ? (This is not spam...)
by James R. Fisher 28 Sep '98

28 Sep '98

Greetings: Does anyone know of a website on which domain names are offered for sale ? This would be something of an underground enterprise if it exists ? I ask because it appears that a domain in which I have some interest has apparently come up for sale (usgs.com) You can see this just from the top of whois output for usgs.com . Thanks. -jrf

2 1

domainspace.com punished
by Rodney Joffe 28 Sep '98

28 Sep '98

A cursory look at the web page advertised in the recent .cc spam indicates "DOMAINSPACE HAS STOPPED SENDING EMAIL DUE TO COMPLAINTS 9/28/98.". In case anyone wondered if the RBL works....

1 0

Re: UDP packet/DNS server
by Adam D. McKenna 27 Sep '98

27 Sep '98

nmap, the port scanner, has a UDP scan. you can find it at http://www.insecure.org/nmap --Adam -----Original Message----- From: Tatsuya Kawasaki <tatsuya(a)giganet.net> To: nanog ml <nanog(a)merit.edu> Date: Monday, September 28, 1998 12:51 AM Subject: UDP packet/DNS server Hello Nanog, I am trying get zone trasfer from a host, but it seems that because of firewals?, I can not get any record. They acknowelged that there is a host behind the firewalls but they claim it should not affect it. (I don't believe it.) But I don't know how to check/prove that if certain host can receive/send an UDP packet. TIA, Tatsuya $B$+$o$5$-(B TK3197 = = = = = = Business Network Telecom (BNT) $B%S%8%M%9%M%C%H%o!<%/%F%l%3%`3t<02q<R(B $B")(B111-0053$B!!El5~ETBfEl6h@uAp66(B3-8-5 31$B;35~%S%k(B6$B3,(B TEL 03-5687-3945 FAX 03-5687-6009 http://www.giganet.net

1 0

Fractals Reemerge in the New Math of the Internet
by Hank Nussbacher 27 Sep '98

27 Sep '98

Worth reading: Fractals Reemerge in the New Math of the Internet by Gary Taubes Science Magazine, Volume 281, Number 5385 Issue of 25 Sep 1998, pp. 1947 - 1948 Vern Paxson mentioned a number of times. AT&T researchers have shown that IP traffic over the Internet is fractal in nature. Could be soon we will have an Internet Erlang value. -Hank

3 2