May 2000 - Test - lists.nanog.org

NANOG 19, June 11-13, 2000 (in Albuquerque, New Mexico)
by Carol Wadsworth 01 May '00

01 May '00

All, Even though the June 2 deadline to register for NANOG 19 (June 11-13, 2000, in Albuquerque, New Mexico) is a month away, early registration is encouraged because the meeting will be limited to the first 500 registrants. To date, registration is already over half full. Registration will be closed early if the 500 limit is reached prior to the deadline, and therefore walk-in attendees will *not* be permitted. REGISTER: https://www.merit.edu/nanog/registration.form.html PAYMENT STATUS: If you already registered for the meeting, your payment must be received by June 2, or the registration fee will increase $50. Please check your payment status on the attendee list on the web: http://www.nanog.org/mtg-0006/Registration.List.html HOTEL: May 20 is the hotel's cut-off date to receive a discounted room rate. For online reservations see: http://www.hyatt.com/albuq/gnano/index.html Thanks. Carol Wadsworth Merit Network, Inc.

1 0

[political, off-topic] bureaucrats and technocrats vs. network operators
by smd＠clock.org 01 May '00

01 May '00

I realize this is nearly wholly off-topic, however it is sometimes worth considering _why_ so many governments are so keen on making our lives more difficult by attempting to control the use of cryptographic technology, and to force operators to make ugly architectural compromises in order to comply with "wiretap" laws. Nearly every modern government is a flavour of bureaucracy or technocracy, notwithstanding the differences in how the top ranks of government came into power or how or if they can be removed from it. Both technocracies and bureaucracies are fundamentally illiberal. They are based on the premise that the people in government are either better thinkers with better training, or simply have better access to official information, than those that they govern; therefore they have the right to countermand the individual decisions taken by individual citizens, because the technocrats and bureaucrats KNOW BETTER. This is not particularly strange; monarchists, theocrats and Leninist-type socialists have a penchant for telling people how to live their lives, because of divine right, because it is required by divine rules, or for the good of the people. The commonality is that the people who are better than you, or better informed than you, fundamentally believe that they are doing the right thing, and that any complaining provoked by their decisions is wrong because, quite simply, you aren't as smart or as well informed as the are. If you were, you would take the same decisions. Enter the Internet. This is a tool which places at nearly everyone's fingertips the ability to access nearly as much stored knowledge and information on nearly any topic as one could imagine. Moreover, it is a tool which allows for the nearly-instant global propagation of new knowledge and information as it arises. Let's return to the bureaucrat who honestly believes he or she (it's usually he, I'm afraid) is in the best position to make decisions on behalf of the people he helps govern, because he has access to information that nobody outside of the bureaucracy has. He has two fears: firstly, that the bureaucracy ultimately will fail to supply him with sufficient information to make the correct governmental decision, and secondly, that people outside the bureaucracy will have equal access to information as the people inside, and that individuals will misguidedly attempt to work around the careful consideration of any issue that a bureaucracy's vast resources usually allows for. Likewise, the technocrat, who formulates rules because he (it's usually a he) has specialised knowledge that nobody else has. Technocrats usually run environmental agencies, food-safety evaluation offices, economics ministries, and the like. One might consider them "government scientists" of a sort, however the specialised knowledge might not be exclusively scientific (think of diplomats, for example). Our technocrat shares one of the bureaucrat's fears: that the specialised knowledge will be so available through the Internet that other people will attempt to make their own decisions based on it, and that without proper training, this information will be misapplied, and people will make faulty decisions that may cause harm. Enter their responses to the Internet: 1/ make sure that a bureaucracy is supplied with ALL information so that it can make correct decisions for the benefit of those governed hidden information -- whether because it's encrypted or because it's merely hard to access -- may contain critical knowledge that may save lives, prevent monopolistic behaviour by companies, or avert the exploitation of minors it is always better for the bureaucracy to have ALL knowledge as soon as possible, so that it can rigorously analyse and consider it. this type of studying admittedly takes some time, and given the explosion of information in the Internet, it is wise to have access to copies of all the messages that traverse the Internet, rather than slowing things down by imposing restraints upon the bureaucracy (such as a judicial warrant process). the process of gathering up copies of ALL Internet messages is rather expensive without the cooperation of ISPs and the like. we must convince them that their help is essential so that the bureaucracy can continue to make the best- possible, best-informed decision for the good of those they govern. 2/ it is very clear that a supply of specialised information without specialised training can lead people to make poor, unscientific decisions. this is witnessed very clearly in the genetically modified food controversy, where the supply of scientific and technical data to non-specialists such as the media and individuals, has led people to avoid g.m. foodstuffs, when embracing g.m. technology is clearly the most logical thing to do. because of the total failure of the technocracy in this case and cases like it, it is in the interests of everyone to equip the government with means to counter the "spin" vested interests put on disclosed information, or perhaps to withhold the information altogether. in particular, when a critical decision made for good of everyone might become controversial because of initial negative reactions by less intelligent, less informed people, it may be a wise idea to temporarily weaken these individuals' ordinary civil rights, in order to protect society from the negative effects of not implementing a well-thought-out policy emanating from government specialists. We have seen an unfortunately large amount of reactions #1 and #2 lately... Government faces one final major challenge posed by the growth of the Internet: the best and brightest technical and administrative minds are no longer automatically choosing a career inside government. It is growing clear that unless something is done, there will not be the base of talent in government to allow the best possible decisions to be made. Finally, it is worth bearing in mind that: -- any group of people who honestly believe that they are the best people to rule, because they have uniquely strong administrative talents or specialised training/knowledge, will tend to be dismissive of other people's technical or administrative opinions -- any such group of people are also very concerned whenever someone who is clearly more knowledgeable than they are does not work with the bureaucracy/technocracy to help them make decisions that will better the lives of everyone that they govern "non-players" are therefore a sad waste of talent that would optimise government decision-making, or are perhaps dangerous, if they reject carefully-considered government policy without having considered all of the factors studied by the professionals in the bureaucracy It is worth bearing in mind the radical liberal sentiment expressed by Sir Rhys Hopkin-Morris, as quoted by Samuel Beer: ` [My] thoughts turn back to a dinner I attended in 1954 with virtually the whole of the Parliamentary Liberal Party. Reduced to a mere six MPs and supported by only 2.6% of the voters, the Liberals and their cause were, according to all expert opinion, destined for extinction. Yet the senior at the table, Sir Rhys Hopkin-Morris, stated his political creed with clarity and conviction. "No one", he said, "is to tell anyone else what is good for him." He rejected the claim to such authority, whether asserted on "the aristocratic principle" or on behalf of "the community". This is my mantra for today's 1st of May celebrations. Forgive the political nature of the posting. Now I will go across the street to a park filled with thousands of 1st of May celebrators enjoying spectacular summer weather. My agenda: grab a falafel off the Red Front's illiberal vegan barbecue, and have some beer with a few not-very-revolutionary local anarchists. Sean. - -- Sean Doran <smd(a)clock.org> Copenhagen, Denmark

1 0

Re: Cutting to the chase (was RE: ABOVE.NET SECURITY TRUTHS?)
by Danny McPherson 01 May '00

01 May '00

> Since I value your input, I'm not sure if you are joking, or serious. > > I understand the humorous issues involved here (believe me, I do), > I'm really serious about this, and I need serious feedback. I was obviously joking about the "disinformation experts" comment, at least to some degree. However, I certainly do agree that it's a good idea to discuss this as you propose at the upcoming NANOG, especially in lieu of recent occurrences. I don't believe some folks realize how much people read into topics discussed on this list, or understand the impact that seemingly simple posts (accusations about Vendor A's broken software, Vendor B's broken hardware, ISP A's broken network, ISP B's poor customer service, ISP C's security practices, etc..) have on these businesses, and more so, the individuals involved, especially since those accusations are often [demonstrated] premature or completely unfounded. -danny

4 3

Re: external access and passwd mgmt (was Re: SSH on Cisco ...)
by Sean Donelan 01 May '00

01 May '00

Folks seem to be concentrating on locking down the front door. You also need to watch all the backdoors. With multi-protocol equipment, there are a lot of backdoors. Is syslog sending plaintext information, when was the last time you changed snmp community strings, do you have read-write snmp or rsh/rcp access enabled, are ancilliary services like ntp, ospf and bgp authenticated? Have you turned off any services you aren't using such as MOP? If you network load your configuration, how do you know you got your configuration? Do you understand how arp works/doesn't work. After securing your network, one security issue I rarely see explicitly addressed is what do you do when your authentication stops working for whatever reason. Have you made plans for breaking into your own network. Vendor backdoors should require physical access to the equipment (e.g. moving a switch) not just knowledge of a "secret" maintenance password or special signal over a remote control line (e.g. break).

3 2

Re: ICQ & AOL
by sthaug＠nethelp.no 01 May '00

01 May '00

> I'd venture to say that this is the result of the following phenomena: > > Block all APNIC and RIPE assigned networks at the border and all of the > sudden, hack attempts and CC fraud disappear. > > It's fan-%^&#ing-tasticly simple to do and so very effective. And if I block the ARIN assigned networks, most of the spam I receive disappears. It's very effective. In fact, I can limit myself to blocking all email from Hotmail, AOL and a few other large ISPs in the US, and that'll take care of most of the spam too... Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

3 2

Re: ABOVE.NET SECURITY TRUTHS?
by Danny McPherson 01 May '00

01 May '00

> As you pointed out to Barry Greene and myself previously, the "aaa > accounting" command as below will log commands typed in at "enable" level. > So, if you are changing the onboard router password, yes, you will see the > new password in your accounting logs, in clear text. > > However, I don't consider it good practice to keep any critical passwords > on a router when an authentication mechanism such as TACACS+ is in place. Unfornately, auth servers fail and you have to keep VTY and fallback passwords locally configured on the router. > Also, if I was modifying the onboard enable secret (last resort password > when TACACS+ or Radius is configured) at any stage, I'd tftp-load the > configuration from a remote server, not ever type it in live. I don't see how this actually changes anything though, aren't tftp'd files authorized (and therefore, logged) in a similar manner? And as wonderful as it sounds, it's not always possible in real networks. However, entering the encrypted *enable* password (w/level) would accommodate this. Though, of course, the BGP TCP MD5 stuff and the VTY passwords (and most other passwords) still don't support the ~non-reversible encryption algorithm. As for this entire thread, it's seems now to be more appropriate for cisco-nsp or the like. -danny

1 0

Avoid Fines And Speeding Tickets!!!
by fiy10＠box.nl 01 May '00

01 May '00

INTERNATIONAL DRIVER'S LICENSE Need a new driver's license? Too many points or other trouble? Want a license that can never be suspended or revoked? Want ID for nightclubs or hotel check-in? Avoid tickets, fines, and mandatory driver's education. Protect your privacy, and hide your identity. The United Nations gave you the privilege to drive freely throughout the world! (Convention on International Road Traffic of September 19, 1949 & World Court Decision, The Hague, Netherlands, January 21, 1958) Take advantage of your rights. Order a valid International Driver's License that can never be suspended or revoked. Confidentiality assured. CALL NOW!!! 1-937-586-9313 rem-- fikle445(a)netexecutive.com

1 0

Re: How long before NIPC decides we need one of these?
by Chris Adams 01 May '00

01 May '00

On 04/30/00 11:00:12 PM gfresen(a)ais.net wrote: >No, it's worse than that. With your private key in their hands, they can >write >messages, put on appropriate dates and sign them ... then say that you wrote >them. (depending upon the technology that is used) Yes. Couple that with treating key confiscation as a minor thing and I'd be surprised if someone's key didn't end up accidentally being sent to a well- connected competitor. One possible line of defense other than complete civil disobediance might be providing only the session key(s) used for encrypted documents instead of the key-pair. It'd be interesting to see if the courts accept this.

1 0

SSH on Cisco Routers (was RE: ABOVE.NET SECURITY TRUTHS?)
by Ron Buchalski 30 Apr '00

30 Apr '00

SSH1 is supported on the following platforms starting in 12.1(1)T: C17x0, C25xx, C26xx, C36xx, C4x00, C7x00 See: http://www.cisco.com/warp/customer/cc/cisco/mkt/ios/rel/121/prodlit/1065_pp… -rb >From: "Mr. James W. Laferriere" <babydr(a)baby-dragons.com> >To: "Greene, Dylan" <DGreene(a)NaviSite.com> >CC: "'Paul Froutan'" <pfroutan(a)rackspace.com>, rmeyer(a)mhsc.com, >nanog(a)merit.edu >Subject: RE: ABOVE.NET SECURITY TRUTHS? >Date: Fri, 28 Apr 2000 14:34:14 -0700 (PDT) > > > > Hello Dylan, Knew this was coming . But I'd hoped that > the supported platforms would have been a little larger . > Just the 7200 & UP . Seems cisco thinks ssh puts a bit > of load on a cpu ? I can't see that for just a terminal > session though . Twyl, JimL ________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com

4 3

RE: ABOVE.NET SECURITY TRUTHS?
by Greene, Dylan 30 Apr '00

30 Apr '00

Maybe I should read the entire message before responding.. hehe.. =) A switched private management lan resolves the cleartext problem. SSH version 1 is apparently supported in 12.0 as well (never played w/ it, so dunno how well it works); http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/120newft/120 limit/120s/120s5/sshv1.htm ..Dylan | -----Original Message----- | From: Paul Froutan [mailto:pfroutan@rackspace.com] | Sent: Friday, April 28, 2000 4:46 PM | To: rmeyer(a)mhsc.com | Cc: nanog(a)merit.edu | Subject: RE: ABOVE.NET SECURITY TRUTHS? | | | | I don't think you can. However, I use TACACS on all my switches and | routers. From what I know, TACACS passwords are encrypted | using the key on | your network devices and the TACACS server. So, that, in | combination with | a private management LAN not accessible by your customers | should lock down | your network pretty effectively. Any comments? | | At 4/28/00 -0700, you wrote: | | > > Exiled Dave | > > Sent: Friday, April 28, 2000 1:10 PM | > | > > Lets think about this, cisco in no way has such a flaw | > > that would allow someone to 'root' and erase all the | > > info on switches. The password was sniffed. | > | >Can one setup SSH on a Cisco 6509? | | Paul Froutan Email: | pfroutan(a)rackspace.com | Rackspace, Ltd <http://www.rackspace.com> | |

7 8