November 2000 - Test - lists.nanog.org

ssh access to cisco and "unfriendlies"
by Jim Mercer 24 Nov '00

24 Nov '00

i've been trying to get ssh access to cisco IOS 12.1.2 working, but no matter what i do, the openssh client says "3des not supported by server". so, i fired up a local copy of win32 SecureCRT, and use just "des" encryption, and lo, and behold, it worked. so, i started poking around and discovered that likely what i need is a version of IOS with 3des support. as i understand it, in order to get a 3des IOS, you need to agree to: We will not supply network services (e.g., running a virtual private network) to, or for government organizations/enterprises other than those of, or in: Austria, Australia, Belgium, Canada, Czech Republic, Denmark, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Japan, Luxembourg, Netherlands, New Zealand, Norway, Poland, Portugal, Spain, Sweden, Switzerland, United Kingdom, United States without written authorization from Cisco Systems Inc. and/or the governments of the U.S., United Kingdom, and The Netherlands. now, considering some of my clients, i need to pay heed to this. in smaller countries, the first and only internet service is generally run by the PTT, which is usually a "government organization or enterprise". that being said, i find it extremely draconian that i can't run a 3des IOS on a router in Canada, if i supply network services in countries not on that list. so, when i go to set up a connection to Ghana, i am going to need Cisco's permission if i want 3des ssh enabled on the canadian router? and Brazil? and Mexico? -- [ Jim Mercer jim(a)reptiles.org +1 416 410-5633 ] [ Reptilian Research -- Longer Life through Colder Blood ] [ Don't be fooled by cheap Finnish imitations; BSD is the One True Code. ]

4 6

Re: Carnivore Update - Washington Post 11/21/00
by Sean Donelan 24 Nov '00

24 Nov '00

On Thu, 23 November 2000, Vadim Antonov wrote: > I do not think that carnivore is doing that, but SSL is not resistant to > the man-in-the-middle attack. The problem here is in the lack of any > useful certificate validation support. How many users actually check that > site certificate indeed belongs to whoever is identified as the site owner > on the Web pages? My understanding of Carnivore is it sits as a Man-On-The-Side, not a man-in- the-middle. Carnivore is exactly the type of evesdropping Diffie-Hillman is supposed to protect against. > (Plus, it depends on the security of certification autority's private > keys, their public parts being non-revokable, because they are bundled > with browser software. I have a little doubt that it is all too easy for > law enforcement to obtain these keys if they need to. Interests of my > privacy definitely do not match interests of RSA Cert. Auth., Inc, a > commercial entity. Of course, i have no proof that this happened, but I > have no reason to trust that it didn't happen, too.) I was not aware that Terrorists'R'Us got their certificates from RSA. Besides wouldn't it violate some trading with the enemy law for a reputable certificate authority to sell certificates to known terrorists? Unless, of course, the real targets for the survellience are someone else.

1 0

Someone flucked up...
by Jason Lixfeld 23 Nov '00

23 Nov '00

Sluice is your friend... Lookie what we have here... [root@cflow sluice-1.0.3]# less chart-199.60.228.224 Organization Traffic AS Most routes <normal stuff> usage: fwhois user[@<whois.ser 0.04 KB/s 64621 701(UUNet) <normal stuff> [jlixfeld@cflow jlixfeld]$ whois 64621(a)arin.net [arin.net] Internet Assigned Numbers Authority (ASN-IANA-RSVD2-ASNBLOCK) Information Sciences Institute University of Southern California 4676 Admiralty Way, Suite 330 Marina del Rey, CA 90292-6695 Autonomous System Name: IANA-RSVD2 Autonomous System Block: 64512 - 65535 Coordinator: Internet Corporation for Assigned Names and Numbers (IANA-ARIN) iana(a)IANA.ORG (310) 823-9358 Record last updated on 14-Oct-1999. Database last updated on 23-Nov-2000 18:45:07 EDT. The ARIN Registration Services Host contains ONLY Internet Network Information: Networks, ASN's, and related POC's. Please use the whois server at rs.internic.net for DOMAIN related Information and whois.nic.mil for NIPRNET Information. [jlixfeld@cflow jlixfeld]$ whois 152.121.2(a)arin.net [arin.net] U.S. Department of Transportation (NETBLK-DOTNETA) DOTNETA 152.121.0.0 - 152.123.0.0 U.S. Department of Transportation (NET-DOTNETA1) DOTNETA1 152.121.0.0 To single out one record, look it up with "!xxx", where xxx is the handle, shown in parenthesis following the name, which comes first. The ARIN Registration Services Host contains ONLY Internet Network Information: Networks, ASN's, and related POC's. Please use the whois server at rs.internic.net for DOMAIN related Information and whois.nic.mil for NIPRNET Information. bc-van-hbr-r75-01#sh ip bgp reg 64621 BGP table version is 6006164, local router ID is 199.60.228.224 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path * 152.121.2.0/24 207.136.65.153 85 0 7271 701 64621 i *> 157.130.158.9 90 0 701 64621 i * 207.136.65.150 85 0 13705 3493 701 64621 i * 152.121.3.0/24 207.136.65.153 85 0 7271 701 64621 i *> 157.130.158.9 90 0 701 64621 i * 207.136.65.150 85 0 13705 3493 701 64621 i * 152.121.4.0/24 207.136.65.153 85 0 7271 701 64621 i *> 157.130.158.9 90 0 701 64621 i * 207.136.65.150 85 0 13705 3493 701 64621 i * 152.121.33.0/24 207.136.65.153 85 0 7271 701 64621 i *> 157.130.158.9 90 0 701 64621 i * 207.136.65.150 85 0 13705 3493 701 64621 i * 152.121.49.0/24 207.136.65.153 85 0 7271 701 64621 i *> 157.130.158.9 90 0 701 64621 i * 207.136.65.150 85 0 13705 3493 701 64621 i * 152.121.100.0/24 207.136.65.153 85 0 7271 701 64621 i *> 157.130.158.9 90 0 701 64621 i * 207.136.65.150 85 0 13705 3493 701 64621 i Network Next Hop Metric LocPrf Weight Path * 152.121.200.0/24 207.136.65.153 85 0 7271 701 64621 i *> 157.130.158.9 90 0 701 64621 i * 207.136.65.150 85 0 13705 3493 701 64621 i * 152.121.255.0/24 207.136.65.153 85 0 7271 701 64621 i *> 157.130.158.9 90 0 701 64621 i * 207.136.65.150 85 0 13705 3493 701 64621 i bc-van-hbr-r75-01# --- BRAVO USDoT. BRAVO UUNet. -Anonymous :)

1 0

Determining what AS' are being announced
by Jason Lixfeld 23 Nov '00

23 Nov '00

I'm doing traffic analysis to try and determine the amount of traffic I'm sending to or through a particular AS. I'm wondering if there is a documented matrix or a utility that can determine what AS' a particular AS is announcing. Once a reasonably accurate as-path has been generated, I can tell flowscan to grab statistics for all the AS' in the path, but until I know that as-path, I can only get stats for say PSI, but not for it's customers. Thanx in advance.

1 0

RE: ISPs as content-police or method-police
by Mathew Butler 22 Nov '00

22 Nov '00

About 2 years ago, when I got cable modem service from Cox@Home in Mesa, AZ, I tried to go through their standard tech support channels to get filters removed from my IP line. My request was bounced back and forth between several places until I was told by a tech support manager that "there would be no special-case configurations" -- meaning that the filters on my line were never going to be removed. I also found that it was -much- more possible to talk to someone with a clue if I posed as someone on the global Internet, trying to use services which were operationally impacting me (such as DNS and rDNS). When trying to get something done at any NOC, -don't- say "I'm a customer of yours" at any point in time, else you get transferred to the tech support lines and nothing -ever- gets done. (In the case I'm referring to, @home's rDNS service kept dying, and I ended up having to keep calling their NOC and tell them that it was broken, from the standpoint of someone who was doing log analysis on Apache logs, and noticed a bunch of 'lame zone' errors from their servers in their IP blocks. This issue also operationally impacted me being able to get to certain FTP sites that required rDNS to resolve properly. Guess which way got the problem fixed.) -Mat Butler -----Original Message----- From: Christian Kuhtz [mailto:ck@arch.bellsouth.net] Sent: Monday, November 20, 2000 9:36 AM To: nanog(a)merit.edu Subject: RE: ISPs as content-police or method-police > >What doesn't make sense in that argument is why you couldn't just > simply upsell the customer to a managed fw solution etc > >if that's the concern. > > This doesn't work for a consumer broadband ISP, > where the customers won't be upsold to anything and > the average consumer just expects the network to be "safe". Hmm. I disagree, and consumers with those expectations would be advised to read their service agreements which they signed and accepted closely. > >Educate them, and let them decide based on the education they received. > > Education does not work for a consumer ISP, > whether broadband or dialup, due to scaling limits. > Might or might not work for a lease-line business ISP. Sure it does. Depends on what you consider education. I wasn't referring to a two hour class, but the type of discussion a sales rep has with their customer when you sign up for service. Doesn't a regular cable sales rep offer you HBO, Showtime etc packages when you sign up? Why not offer you a no-charge filter service? (granted, I said upsell in my first post, perhaps that was the wrong term). I do not believe that by default, opt-out filtering is a good practice for an ISP. > >Well, again, I don't believe in 'censoring' traffic by default. > > My perspective isn't about philosophy, but rather what > is practical and sensible from a business perspective. Quit splitting hairs. I do not believe that by default, opt-out filtering is a practical and sensible from a business perspective for an ISP. You may disagree, this is a free country last time I checked. > >I wouldn't be so sure, particularly because of the legal exposure... > > The major consumer broadband ISPs have already > discovered that their legal exposure would be higher > if they did not filter a small number of protocols, > than it is with filtering that small number of protocols, > which is the current common case with consumer broadband > ISPs today. Pointers, background please. And how is that sold and presented to the customer? What sort of legal ramifications have been discovered? How is the tech support role addressed? > >> And as has been pointed out, you can ALWAYS punch a hole > >> in the filter for customers who like to live risky, > >> or they can find other ways to tunnel their packets. > > > >At SP scale? Think again. > > Filtering by default and punching holes upon request > works fine for Media-One's cable modem service in the US > Northeast, so that approach CAN work fine at a large-sized > service provider scale (they are an existence proof). Oh yeah? While I happen to use MediaOne (because I can't get anything else where I live) and it seems to work most of the time, it is damn near impossible to find anyone who has a clue about anything (or cares) thru the tech support channels. And I don't consider spending 1.5hrs+ on hold to speak with a junior tech support person an accessible alternative. I do know from my fw at home that no filtering whatsoever is done. In fact, the service agreement clearly states that you're basically on your own. If this is available (and accessible) in the northeast, consider yourself *very* fortunate. If MediaOne (or my employer if I were be able to get DSL) were to start filtering traffic and gave me no reasonable way to opt-out or customize, I would probably be a very dissatisfied customer. Currently, some of these support channels only work well if you don't need support. > Different service providers might well make different > business decisions, but lets not confuse a business decision > with what is/isn't technically feasible. They aren't the > same thing. I don't think I said anything to that affect. Further, a less presumptious stance would be appreciated. I do believe that an opt-in approach is the better one, rather than opt-out. Cheers, Chris -- Christian Kuhtz <ck(a)arch.bellsouth.net> -wk, <ck(a)gnu.org> -hm Sr. Architect, Engineering & Architecture, BellSouth.net, Atlanta, GA, U.S. "I speak for myself only."

2 1

Carnivore Update - Washington Post 11/21/00
by Pickett, Mclean 22 Nov '00

22 Nov '00

To view the entire article, go to http://washingtonpost.com/wp-dyn/articles/A48737-2000Nov21.html Study: FBI Tool Needs Honing The FBI's hotly debated Internet wiretap program is a sound law enforcement tool but needs modification to protect people's routine e-mail and other communications from being intercepted unlawfully, according to a draft study released yesterday by the Justice Department. The study, undertaken by the Illinois Institute of Technology Research at the request of the Justice Department, said although "Carnivore" can be "more effective" in protecting privacy and enabling lawful surveillance than other alternatives, it does not eliminate the risk of unauthorized monitoring of electronic communications by FBI agents. The report recommended that Carnivore be modified, subjected to further outside review and ultimately have its underlying "source code"--the technical details of how its software works--released to the public. Some privacy advocates say the institute, which the Justice Department paid $175,000 to review Carnivore, was biased in favor of the new technology. They also sa! y the FBI cannot be trusted to use Carnivore because the program can pick up all communications that pass through an Internet service provider--such as America Online--rather than monitoring e-mail traffic between suspects under surveillance. House Majority Leader Richard K. Armey (R-Tex.), a longtime Carnivore critic, said the selection of the evaluation team determined the nature of the report. "The Department of Justice selected reviewers and set the rules in order to ensure they would get the best possible review," Armey said. Justice officials said yesterday that the study confirms Carnivore is a legitimate law enforcement tool that can be refined to address concerns. They said the recommendations in the study would enable them to simplify and improve Carnivore's operation. "We are pleased with the findings and the constructive recommendations made in today's draft report," said Donald M. Kerr, head of the FBI's laboratory division. "From the beginning, we have welc! omed this review for two main reasons: First, subjecting Carnivore to outside scrutiny allows for practical criticism, feedback and suggestions for improvements which will ultimately benefit everyone," Kerr said. "Secondly, a review such as this presents the public with a clearer understanding of the facts, which is critical in maintaining public confidence in law enforcement's ability to effectively investigate and prevent serious crimes." The study said Carnivore poses no operational or security risks to Internet service providers, some of which feared that having the program installed would disrupt communications. The report also said that when the technology is used correctly under a valid court order, it gives investigators appropriate access to information. However, it said that since Carnivore poses the risk of going beyond court-permitted information collection in some instances, multiple versions of the wiretap system need to be developed. "This is a very fair repo! rt," a Clinton administration official said. "It doesn't give [Carnivore] a clean bill of health, but says Carnivore has better safeguards than other alternatives and has recommendations for how to improve the use of this technique. It also has suggestions for how to avoid accidental over-use." The report warned that while Carnivore was designed to perform fine-tuned searches, it is also capable of broad ones. "Incorrectly configured, Carnivore can record any traffic it monitors," the study said. But the study rejected fears that FBI agents would be reading all of the routine e-mail traffic of a given Internet service provider, saying that Carnivore "does not have nearly enough power" to do so. The FBI has legitimate reasons to oppose public release of Carnivore's underlying source code; the current version's technical limitations could enable hackers and others to defeat surveillance, the study said. The bureau needs to work toward public release of Carnivore's source code! by eliminating "exploitable weaknesses." Until that public release, outside, independent monitoring is needed to assess the effectiveness and risk of over- or under-collection of data, the study said. In addition, the bureau needs to simplify Carnivore and employ a formal development process in its next version to reduce errors. James Lewis, senior fellow at the Washington-based Center for Strategic and International Studies, said Carnivore is critical for law enforcement, but said selecting the name "Carnivore" has created a public relations problem for the bureau. "Right before Thanksgiving, 'Vegetarian' is the name I would go for," he said. McLean Pickett digex, Inc.

2 1

Re: Carnivore Update - Washington Post 11/21/00
by Steven M. Bellovin 22 Nov '00

22 Nov '00

You can find the draft report itself (and a request for comments) at http://www.usdoj.gov/jmd/publications/carniv_entry.htm or you can get an html version at http://cryptome.org/carnivore-rev.htm --Steve Bellovin

1 0

Server Monitoring
by Bora Akyol 22 Nov '00

22 Nov '00

Does anyone out there have a set of scripts (or a commercial product) that is used to monitor a set of servers including sendmail, dns, etc and page/email people as necessary. I had written such a set of scripts a while back but that was too many years ago. Thanks Bora

10 9

Summary: Server Monitoring
by Bora Akyol 22 Nov '00

22 Nov '00

Thanks everyone, I am overwhelmed with the number of responses: Just to summarize: netsaint sysmon big brother ip sentry sitescope were among the names suggested. I think I am going to start in this order and go down. Thanks Bora

2 1

Mike Muuss - confirmation?
by jmora 22 Nov '00

22 Nov '00

Something I found.. http://www.mdnewsnet.com/mnn_top_stories/fire_police_news.html -jmora > From: Sean Donelan <sean(a)donelan.com> > Subject: The author of PING is reported dead > > Since many network operators consider PING as one of their essential > tools, I thought this would be of interest to the list. > > I haven't been able to confirm this, but I haven't been able > to reach Mike. > > Forwarded message: > > >Subject: The Creator of Ping is dead... > > > >Mike Muuss, the author of the PING program used on networks everywhere, > >died last night in a traffic accident on US route 95 in Maryland. He was > >an alumnus of Johns Hopkins (BS1978 or 1979 I think). > > > >Funeral arrangements have not been made yet, but I'll probably be going > >back to Maryland almost immediately to attend. > > > http://ftp.arl.army.mil/~mike/ping.html

1 0