January 2002 - Test - lists.nanog.org

Network Security Policies
by Hauser, Dewitt C, IV (Clint), SOBUS 21 Jan '02

21 Jan '02

At the moment, we're firming up our policy on access to Networking Devices and the like. In support of this, I'm looking for any links to white papers or other such sources that discuss/support the following things: - Limiting the number of people with access - Scheduled password change/rotation - Password change when someone with access leaves I'm going to be doing research on this to drag things up myself, but I figured I would put this out here to ask to provide some narrowing down of the search and speeding it up. Thanks in advance. -- Clint Hauser AT&T Solutions

4 3

RE: DNS DOS increasing?
by Curtis Maurand 21 Jan '02

21 Jan '02

I'm not seeing this behavior with RH 7.2 128MB and bind 9.n ---- Original Message ---- From: Karyn Ulriksen Date: Mon 1/21/02 11:49 To: LIST, NANOG Subject: RE: DNS DOS increasing? RE: DNS DOS increasing?I've seen this behavior before, also. I thought it was interesting that two servers side by side recieving the same attacks/ratios only serving DNS (BIND 8.2.x*) and acted in this manner: Redhat 6.2 w/dual proc 833 512/ram started "loosing" RR records Solaris 7 on a Sparc 10 (hehe) w/256 rebooted and served the correct records I'm curious to see how other OSes react to these attacks. My guess is that BSD systems (such as FreeBSD and BSDi) will react similarly to the Solaris based on my past experience with these systems. So I am curious too see if the RR record "loss" is an OS specific behaviour, especially since Redhat has priors in misplacing information in earlier versions of the OS. * I say BIND 8.2.x, because this continued to occur through the various BIND 8.2 releases. Best regards, Karyn Ulriksen Valkaryn Internet Group URL: http://www.valkaryn.net email: valkaryn(a)valkaryn.net =========================================== "Decisions should be made in the space of seven breaths." -----Original Message----- From: Karyn Ulriksen [mailto:valkaryn@valkaryn.net] Sent: Monday, January 21, 2002 8:39 AM To: James Smith Subject: RE: DNS DOS increasing? I've seen this behavior before, also. I thought it was interesting that two servers side by side recieving the same attacks/ratios only serving DNS (BIND 8.2.x*) and acted in this manner: Redhat 6.2 w/dual proc 833 512/ram started "loosing" RR records Solaris 7 on a Sparc 10 (hehe) w/256 rebooted and served the correct records I'm curious to see how other OSes react to these attacks. My guess is that BSD systems (such as FreeBSD and BSDi) will react similarly to the Solaris based on my past experience with these systems. So I am curious too see if the RR record "loss" is an OS specific behaviour, especially since Redhat has priors in misplacing information in earlier versions of the OS. * I say BIND 8.2.x, because this continued to occur through the various BIND 8.2 releases. Best regards, Karyn Ulriksen Valkaryn Internet Group URL: http://www.valkaryn.net email: valkaryn(a)valkaryn.net =========================================== "Decisions should be made in the space of seven breaths." -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of James Smith Sent: Monday, January 21, 2002 7:08 AM To: nanog(a)merit.edu Subject: RE: DNS DOS increasing? I've seen DOS-type behavior where a client will query a resolver for a name that doesn't exist, and the client does not accept the answer that the name does not exist and immediately sends another query, regardless of whether or not the resolver declared itself authoritative for the negative answer. -- /ak Get ready for more DOS-like behavior as systems get deployed that have 10 second TTLs in the DNS. These systems are used to provide multi-isp redundancy by pinging each upstreams router, and when a ping fails, start giving out a dns response using the other ISP IP range. Same FQDN, new IP. This of course is driven by the desire for redundancy in small businesses who make the Internet an integral part of their business plan. Either they can't get PI space and don't have (or don't want to spend) the $$$ to do BGP, or are unable to convince their upstream to cut a hole in their CIDR block and allow a 2nd party to announce that chunk (which for some is as small as /28). James H. Smith II NNCDS NNCSE Systems Engineer The Presidio Corporation

1 0

RE: DNS DOS increasing?
by Curtis Maurand 21 Jan '02

21 Jan '02

Except that everyone complains long and hard about BGP advertising /24's or smaller. I know a small operator who's setting up a webhosting company. He's got a single T1 and a /25 for now, but as soon as he gets multi-homed ( and plans that in the next year or so) with a different provider. He'll have the need to run BGP at that point will advertise the /25 or a /24. Numbering requirements and name based hosting as is highly recommended by ARIN will be the cause. The short answer is that small companies will start advertising small blocks in the name of address conservation. We either give out addresses willy nilly or we allow the announcement of small blocks and stop complaining about it. You can't have it both ways. Curtis ---- Original Message ---- From: James Smith Date: Mon 1/21/02 12:38 To: nanog(a)merit.edu Subject: RE: DNS DOS increasing? -----Original Message----- From: E.B. Dreger [mailto:eddy+public+spam@noc.everquick.net] Sent: Monday, January 21, 2002 12:08 PM To: James Smith Cc: nanog(a)merit.edu Subject: RE: DNS DOS increasing? BGP isn't that expensive. ---- For some, it is a cost that can be mitigated by "workaround" technologies that are cheaper. Of course, it could be argued that if you're not willing to make the investment to do it the BGP way, you don't really need it bad enough. Enter the salesman who is heard to tell his prospects "...you don't have the cost of BGP, you get the same effect as BGP, and you don't even have to tell your ISP!". James H. Smith II NNCDS NNCSE Systems Engineer The Presidio Corporation By the way, I speak only for myself, which gets me in enough trouble...

1 0

RE: DNS DOS increasing?
by Karyn Ulriksen 21 Jan '02

21 Jan '02

RE: DNS DOS increasing?I've seen this behavior before, also. I thought it was interesting that two servers side by side recieving the same attacks/ratios only serving DNS (BIND 8.2.x*) and acted in this manner: Redhat 6.2 w/dual proc 833 512/ram started "loosing" RR records Solaris 7 on a Sparc 10 (hehe) w/256 rebooted and served the correct records I'm curious to see how other OSes react to these attacks. My guess is that BSD systems (such as FreeBSD and BSDi) will react similarly to the Solaris based on my past experience with these systems. So I am curious too see if the RR record "loss" is an OS specific behaviour, especially since Redhat has priors in misplacing information in earlier versions of the OS. * I say BIND 8.2.x, because this continued to occur through the various BIND 8.2 releases. Best regards, Karyn Ulriksen Valkaryn Internet Group URL: http://www.valkaryn.net email: valkaryn(a)valkaryn.net =========================================== "Decisions should be made in the space of seven breaths." -----Original Message----- From: Karyn Ulriksen [mailto:valkaryn@valkaryn.net] Sent: Monday, January 21, 2002 8:39 AM To: James Smith Subject: RE: DNS DOS increasing? I've seen this behavior before, also. I thought it was interesting that two servers side by side recieving the same attacks/ratios only serving DNS (BIND 8.2.x*) and acted in this manner: Redhat 6.2 w/dual proc 833 512/ram started "loosing" RR records Solaris 7 on a Sparc 10 (hehe) w/256 rebooted and served the correct records I'm curious to see how other OSes react to these attacks. My guess is that BSD systems (such as FreeBSD and BSDi) will react similarly to the Solaris based on my past experience with these systems. So I am curious too see if the RR record "loss" is an OS specific behaviour, especially since Redhat has priors in misplacing information in earlier versions of the OS. * I say BIND 8.2.x, because this continued to occur through the various BIND 8.2 releases. Best regards, Karyn Ulriksen Valkaryn Internet Group URL: http://www.valkaryn.net email: valkaryn(a)valkaryn.net =========================================== "Decisions should be made in the space of seven breaths." -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of James Smith Sent: Monday, January 21, 2002 7:08 AM To: nanog(a)merit.edu Subject: RE: DNS DOS increasing? I've seen DOS-type behavior where a client will query a resolver for a name that doesn't exist, and the client does not accept the answer that the name does not exist and immediately sends another query, regardless of whether or not the resolver declared itself authoritative for the negative answer. -- /ak Get ready for more DOS-like behavior as systems get deployed that have 10 second TTLs in the DNS. These systems are used to provide multi-isp redundancy by pinging each upstreams router, and when a ping fails, start giving out a dns response using the other ISP IP range. Same FQDN, new IP. This of course is driven by the desire for redundancy in small businesses who make the Internet an integral part of their business plan. Either they can't get PI space and don't have (or don't want to spend) the $$$ to do BGP, or are unable to convince their upstream to cut a hole in their CIDR block and allow a 2nd party to announce that chunk (which for some is as small as /28). James H. Smith II NNCDS NNCSE Systems Engineer The Presidio Corporation

2 1

RE: Network Security Policies
by Steve Smith 21 Jan '02

21 Jan '02

This may or may not help. http://net-services.ufl.edu/~security/security-links.html Steve -----Original Message----- From: Hauser, Dewitt C, IV (Clint), SOBUS [mailto:dchauser@att.com] Sent: Monday, January 21, 2002 11:13 AM To: 'nanog(a)nanog.org' Subject: Network Security Policies At the moment, we're firming up our policy on access to Networking Devices and the like. In support of this, I'm looking for any links to white papers or other such sources that discuss/support the following things: - Limiting the number of people with access - Scheduled password change/rotation - Password change when someone with access leaves I'm going to be doing research on this to drag things up myself, but I figured I would put this out here to ask to provide some narrowing down of the search and speeding it up. Thanks in advance. -- Clint Hauser AT&T Solutions

1 0

NANOG 24 (Miami) Meeting Updates
by Carol Wadsworth 21 Jan '02

21 Jan '02

NANOG 24 Meeting Updates A partial list of presentation topics for NANOG 24, February 10-12, in Miami is now posted on the web: http://www.nanog.org/mtg-0202/topics.html For additional meeting information, please see: http://www.nanog.org/mtg-0202/index.html For those of you who have registered to attend the meeting, we look forward to seeing you in Miami and would like to remind you about two upcoming deadlines: January 24 -- the NANOG room block at the hotel expires. For reservation information, please see: http://www.nanog.org/mtg-0202/hotel.html January 25 -- if your registration fee is unpaid by this date, the fee increases $50. To check on your payment status, please reference the attendee list at: http://www.nanog.org/mtg-0202/attendee.list.html See you there!

1 0

state of the art in router configuration
by Ratul Mahajan 21 Jan '02

21 Jan '02

after a study on bgp misconfiguration (http://www.cs.washington.edu/homes/ratul/bgp/index.html) i am beginning to wonder what the state of the art in router configuration is. a quick search on the web did not yield anything interesting. thoughts on the matter from guys who configure routers would be appreciated. 1. how do most operators configure their bgp (text editor or some high-level configuration tool)? 2. are there "configuration checkers" out there that would check whether an operator has not made a common error while modifying configuration? 3. when misconfigurations do happen, how are they detected? thanks, -- ratul

2 1

[OT] Routeing `listeners' for BGP and ISIS
by Richard Mortier 20 Jan '02

20 Jan '02

Hi, I believe this is appropriate for the NANOG list according to the AUP; my apologies if it isn't or if you receive multiple copies. I'd like to announce the release of `PyRT' the `Python Routeing Toolkit' available at http://www.sprintlabs.com/Department/IP-Interworking/Routing/PyRT/index.html >From the web-page: "The Python Routeing Toolkit (`PyRT') enables routeing information in a network to be collected. The purpose of this software is to enable routeing information in a network to be collected. This package currently supports BGPv4 and ISIS and will dump MRTD format files. It also supports parsing of MRTD TABLE_DUMP files (as available from, eg., RouteViews and RIPE/RIS). A number of utilities for manipulating these dumps are also provided." Information is collected by forming adjacencies with a router, and then acting as a `passive' router (ie. no routes are injected). It is released under the GPLv2 and was developed as part of work done at Sprint ATL, Burlingame CA. -- Richard Mortier ---------------------- ----------------- ---- Intern, 1 Aug--28 Feb, mort(a)sprintlabs.com ----- Sprint ATL, Burlingame, CA mort(a)ieee.org ----- http://www.cl.cam.ac.uk/~rmm1002/

2 1

Re: Persistent BGP peer flapping - do you care?
by Dave Israel 20 Jan '02

20 Jan '02

On 1/17/2002 at 14:21:59 -0800, Jake Khuon said: > As for propogation of the bad prefix... well that soapbox has worn paint on > top. If people aren't going to bother following specs in the first place > I'm not sure a new spec will solve anything. It's a question of robustness; if the new spec includes a way to be tolerant of how the spec is (or can be) commonly abused, then the followers of the spec will not be at the mercy of those who deviate. In this case, I think that having the option to keep a session that gives bad routes up, and just dropping the route, is a good answer. That would allow the user to determine which is preferable for a given peer: possible corruption or certain disconnection. -Dave

4 3

Re: Persistent BGP peer flapping - do you care?
by Susan Hares 19 Jan '02

19 Jan '02

vijay: What else causes repeative peer bounces other than the broken prefix? sue PS - I'm away from work from now until Monday morning.. At 05:42 PM 1/17/2002 -0500, Vijay Gill wrote: >On Thu, 17 Jan 2002, Dave Israel wrote: > > > It's a question of robustness; if the new spec includes a way to be > > tolerant of how the spec is (or can be) commonly abused, then the > > followers of the spec will not be at the mercy of those who deviate. > > > > In this case, I think that having the option to keep a session that > > gives bad routes up, and just dropping the route, is a good answer. > > That would allow the user to determine which is preferable for a given > > peer: possible corruption or certain disconnection. > >If you have a "bad route" how do you know the rest of the update is good? >The nlri may have gotten corrupted on the wire or between the interface >and the processor (parity error, or some sort of corruption on the bus). >Given that case, in an update, I am not sure you can make a determination >of what is good nlri and selectively propogate and process those. See also >meltdowns circa nov 1998. > >/vijay

3 2