January 2005 - Test - lists.nanog.org

Proper authentication model
by Kim Onnel 16 Jan '05

16 Jan '05

Hello, I'd like everyones 2 cents on the BCP for network management of an ISP PoPs, with a non-security oriented NOC, Most of my routers doesnt have crypto IOS images, couldnt agree with core members to do a major upgrade, just a promise of doign that when other needs to an IOS upgrade come up, So i need to workaround it and secure management traffic somehow, Usually the NOC logs to the PoPs 24x7, so i definitely need to hit a balance between encryption/security and usability, thats why i excluded OTP, My homework concluded: 1) Establishing an ipsec tunnel from each NOC Pc to a VPN concentrator, and of course on every PC, there would be static routes injected to take management traffic through the tunnel, Major advantage is usability and transperancy to the user, One major pitfall here is when ipsec tunnels break, my presence would be needed to troubleshoot that, 2) An OpenBSD bastion host(s), where the NOC would ssh in, get authenticated from TACACS+ or ssh certs, and then just telnet from there all day, One major advantage here is the heavy monitoring/limiting i can do on a *nix box, systrace their login shell to a policy (telnet/ping/traceroute only) 3) Or just an IOS based bastion router that also runs ssh, This has the advantage of IOS limitations in a way, not much maintaining is needed but being limited with 16 vtys is a problem, also vtys may get stuck and all these ssh sessions would kill the memory of the router, I would of course have multiple setups one at the Datacenter, another at some PoP, redundant solutions incase one fails, and For the record, I do run rancid, syslogging and we do AAA, so its just down to whats others experiences/ideas about secure management?

9 13

Re: panix.com hijacked
by Thor Lancelot Simon 16 Jan '05

16 Jan '05

Apologies for what may be another duplicate message, probably with broken threading. This is Alexis Rosen's original posting to this thread; we think the mail chaos caused by the hijacking of panix.com kept it from ever reaching the list (but, flying mostly-blind, we aren't sure). > On Sat, Jan 15, 2005 at 10:27:31PM -0500, Steven M. Bellovin said: > > panix.com has apparently been hijacked. It's now associated with a > > different registrar -- melbourneit instead of dotster -- and a > > different owner. Can anyone suggest appropriate people to contact to > > try to get this straightened out? > > Hi, all. > > I hate to pop my head up after years of lurking, only when things are > going bad, but probably better that than remaining silent. > > First of all, I'm going to be bounced from this list once its cache of > my DNS times out, which will probably be in about 2-3 hours, so if you have > anything to say that you'd like me to see, please copy me. We're temporarily > accepting mail at panix.net in addition to panix.com, so use alexis (at) > panix.net. > > A few points to respond to: > First, Eric, thanks for contacting Bruce and Eric on my behalf. While > nothing has happened so far, I hope that it will soon, and in any case > I appreciate your efforts to help a total stranger. > > Someone asked if we had registrar-lock set. It's not clear to me what > happened. Our understanding is that we had locks on all of our domains. > However, when we looked, locks were off on panix.net and panix.org, which > we own but don't normally use. It's not clear how that happened; dotster > has yet to contact us with any information about, well, anything at all. > They did answer a call this morning; they're apprently in the middle of > an ice storm. All I was able to larn from them is that according to the > person I talked to, they had no records of any transfer requests on our > domain from today back through last October. > > Someone suggested invoking a dispute procedure. We'll do that, as soon as > we can get someone to actually accept the dispute, but if it goes through > that process to completion, many people will suffer, and Panix itself will > be tremendously damaged. How long do you think even our customers will > stay loyal? (Forever, for many of them, but that doesn't mean the won't be > forced to start using a different service.) > > While it's true that MelbourneIT won't do anything before (their) Monday > morning, I don't want to paint them as bad guys in this drama. I don't > know how they're organized and I don't know how difficult it is for them > logistically. Of course I want them to move faster. Much faster. But I'll > take what I can get. > > And speaking of MIT, I don't intend to send them "nastygrams" - nor NSI > either. Neither of them owes me anything (at least directly) and being > heavyhanded would not be a good way to get what I want (restoral of the > panix.com domain to dotster) even if I thought they deserved it. I expect > that there will be criminal prosecutions arising out of this, but the time > for that sort of thing is later, when things are back to normal, and we've > fixed any systemic vulnerabilities that can be fixed before they're used > to wreak mass havoc. And it's anyone's guess who the target of those > prosecutions will be, but I doubt MIT or NSI will be among them. > > Lastly, someone expressed surprise that I'd call MIT's lawyer directly. > I didn't. I spent *hours* trying to find working contact info for MIT and > Dotster. I didn't find useful 24-hour NOC-type info anywhere. (Someone > obviously has this info; I expect it's restricted to a list of registrars.) > I reached Dotster's customer support when they opened for business Saturday > morning; the guy was polite, and did what he could, but I saw no evidence > whatsoever of the promised attempt to assist me after he got off the phone. > MIT apparently has no weekend support at all; I finally located their CEO's > cellphone in an investor-relations web page. I caled him, and he had his > lawyer call me back. That was his choice. FWIW, she's not "just" a lawyer; > she's apparently the person who has to make decisions about reverting > control of the domain. So she at least needs to be aware of our position. > My impression is that she didn't fully grasp the gravity of the situation, > and so treated us like she'd treat any other annoying customer who managed > to track her down on her day off. This is somewhat understandable (though > infuriating) which is why I'd hoped to talk to someone on their tech side > first. No luck there, but if any of this reaches them, maybe that will > start things going. > > Thanks again to everyone who has tried to help us today. > > /a

1 0

Re: panix.com hijacked
by Chris Adams 16 Jan '05

16 Jan '05

Once upon a time, Robert Kryger <bobk(a)panix.com> said: > On Sat, 15 Jan 2005, Chris Adams wrote: > >Good luck dealing with melbourneit.com; that's the place where domains > >go to die. > > Can you be a little more specific? > You imply that you have experience or anecdotes about this outfit and > this sort of situation. Not exactly this sort of situation, no. I do know that we've had hosting customers that have had domains with melbourneit.com as the registrar that they were unable to ever transfer to another registrar (despite emails, faxes, and phone calls; IIRC one customer tried for most of a year to transfer a domain to another registrar or at least get the nameservers changed without success). -- Chris Adams <cmadams(a)hiwaay.net> Systems and Network Administrator - HiWAAY Internet Services I don't speak for anybody but myself - that's enough trouble.

2 1

Re: panix.com hijacked
by Mark Jeftovic 16 Jan '05

16 Jan '05

On Sat, 15 Jan 2005, Steven M. Bellovin wrote: > >MelbourneIT needs to demonstrate a proper FOA (Form of Authorization) > >to have initiated the transfer and if its found to be invalid the > >domain will be re-instated and Melbourne-IT fined. > > Thanks. I'm told that dotster says they have no record of anything > resembling this request.... > Anyone happen to know if panix.com had their registrar-lock set when this happened? -mark -- Mark Jeftovic <markjr(a)easydns.com> Co-founder, easyDNS Technologies Inc. ph. +1-(416)-535-8672 ext 225 fx. +1-(416)-535-0237

1 0

Man accused of 'zombie' web blitz
by Fergie (Paul Ferguson) 15 Jan '05

15 Jan '05

Given the amount of discussion on botnets and zombies, I thought this article was rather interesting: "A man has been arrested on suspicion of launching attacks over the internet after an operation between Scottish police and the US Secret Service." http://news.bbc.co.uk/2/hi/uk_news/scotland/4175801.stm - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

RE: $50,000 reward for Verizon cable cutter
by Church, Chuck 15 Jan '05

15 Jan '05

Maybe a current Verizon employee looking for extra OT... Chuck Church Lead Design Engineer CCIE #8776, MCNE, MCSE Netco Government Services - Design & Implementation Team 1210 N. Parker Rd. Greenville, SC 29609 Home office: 864-335-9473 Cell: 703-819-3495 cchurch(a)netcogov.com PGP key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x4371A48D -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Joshua Brady Sent: Friday, January 14, 2005 10:32 PM To: Hannigan, Martin Cc: wsimpson(a)greendragon.com; nanog(a)merit.edu Subject: Re: $50,000 reward for Verizon cable cutter Your not giving customers enough credit, your a customer yourself arn't you? Do you know how to cut those cables? Would anyone else on the list who isn't a disgruntled verizon employee? On Fri, 14 Jan 2005 22:26:04 -0500, Hannigan, Martin <hannigan(a)verisign.com> wrote: > > > Disgruntled customers don't know how to cut X hundred pair cables. > > --- > Martin Hannigan > hannigan(a)verisign.com > Verisign, Inc. > > > -----Original Message----- > From: owner-nanog(a)merit.edu <owner-nanog(a)merit.edu> > To: nanog(a)merit.edu <nanog(a)merit.edu> > Sent: Fri Jan 14 19:10:35 2005 > Subject: Re: $50,000 reward for Verizon cable cutter > > Sean Donelan wrote: > > >Verizon is offering a $50,000 reward for information about several > >acts of cut cables in the last couple of months. At least three lines > >were cut in the last week. > > > >http://www.boston.com/news/local/massachusetts/articles/2005/01/13/veri zon_ > seeking_information_about_cable_cutter/ > > > > > > > With a power saw? Goodness, that sounds noisy in the middle of the > night. I'd have thought a low tech ax would do the job. :-) > > Probably a disgruntled customer, with cable bundles that repair says > were supposed to be replaced 12 years ago, but engineering says isn't > in the budget (like my SBC/Ameritech neighborhood in Ann Arbor). > > Sigh, not enough criminal instinct here. > > -- > William Allen Simpson > Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32 > -- Joshua Brady

1 0

RE: Cisco 2611XM as cheap border router
by Majid Farid 15 Jan '05

15 Jan '05

Foundry routes fall into your "2" argument :) -- Majid -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Daniel Golding Sent: Tuesday, January 11, 2005 12:52 PM To: Rodney Dunn; Mark Bojara Cc: nanog(a)nanog.org Subject: Re: Cisco 2611XM as cheap border router It would be fairly useful if Cisco had a published document that detailed the minimum configuration for each major router line to support BGP with 1 to 4 full views. Of course, this would have to be periodically updated. By this, I mean a separate overlay document for their entire router product line. This would be very helpful to operators and integrators who get asked about minimum configurations fairly frequently... (I'm only picking on Cisco because they are 1) big and 2) have routers that support BGP but don't have enough memory for full tables) - Dan On 1/11/05 12:21 PM, "Rodney Dunn" <rodunn(a)cisco.com> wrote: > > This will not work for full routes. > The memory upgrade is utilized for larger > IOS images with new features. > > An update to the product bulletin is > in the works to clarify it. > > Further specific questions in regards to > the memory can be moved over to the > cisco-nsp alias. > > Rodney > > On Tue, Jan 11, 2005 at 07:39:49AM +0200, Mark Bojara wrote: >> Hello people of nanog :) >> >> Ive been doing some reading up and I see that that 2600 series is now >> supporting 256MB of memory. Do you guys think this router could handle >> 3/4 peers a QoS setup (RSVP or something)? >> >> http://www.cisco.com/en/US/products/hw/routers/ps259/products_qanda_item 0900a >> ecd800f71dd.shtml >> >> Regards >> Mark >>

1 0

Re: $50,000 reward for Verizon cable cutter
by Hannigan, Martin 15 Jan '05

15 Jan '05

Nate, customers are not OSP savvy. The ones that could be would be like you, me, and vin. Those are few and between. If I were DHS/FBI/SS? Employee or ex employee involvement. Circa 98 possibly. It is familiar for Boston area transmission. -M --- Martin Hannigan hannigan(a)verisign.com Verisign, Inc. -----Original Message----- From: Nathan Allen Stratton <nathan(a)robotics.net> To: Hannigan, Martin <hannigan(a)verisign.com> CC: somitho(a)gmail.com <somitho(a)gmail.com>; wsimpson(a)greendragon.com <wsimpson(a)greendragon.com>; nanog(a)merit.edu <nanog(a)merit.edu> Sent: Fri Jan 14 19:58:04 2005 Subject: Re: $50,000 reward for Verizon cable cutter On Fri, 14 Jan 2005, Hannigan, Martin wrote: > I know how to cut those cables from experience. A customer isn't showing up > with a battery powered Makita to do it. And they don't know where to cut to > do max damage. If they were cutting SLC splice boxes, sure. Not this. IMHO. > These cuts indicate knowledge. I may be wrong. @shrug@ You have not talked to enough ISPs who have been killed by the ILECs. They know what to do... I am not defending them in any way, it is wrong, but they have a lot of customers who have clue to get back at them if they are ticked off. -Nathan

2 1

Re: $50,000 reward for Verizon cable cutter
by Hannigan, Martin 14 Jan '05

14 Jan '05

I know how to cut those cables from experience. A customer isn't showing up with a battery powered Makita to do it. And they don't know where to cut to do max damage. If they were cutting SLC splice boxes, sure. Not this. IMHO. These cuts indicate knowledge. I may be wrong. @shrug@ -M --- Martin Hannigan hannigan(a)verisign.com Verisign, Inc. -----Original Message----- From: Joshua Brady <somitho(a)gmail.com> To: Hannigan, Martin <hannigan(a)verisign.com> CC: wsimpson(a)greendragon.com <wsimpson(a)greendragon.com>; nanog(a)merit.edu <nanog(a)merit.edu> Sent: Fri Jan 14 19:31:30 2005 Subject: Re: $50,000 reward for Verizon cable cutter Your not giving customers enough credit, your a customer yourself arn't you? Do you know how to cut those cables? Would anyone else on the list who isn't a disgruntled verizon employee? On Fri, 14 Jan 2005 22:26:04 -0500, Hannigan, Martin <hannigan(a)verisign.com> wrote: > > > Disgruntled customers don't know how to cut X hundred pair cables. > > --- > Martin Hannigan > hannigan(a)verisign.com > Verisign, Inc. > > > -----Original Message----- > From: owner-nanog(a)merit.edu <owner-nanog(a)merit.edu> > To: nanog(a)merit.edu <nanog(a)merit.edu> > Sent: Fri Jan 14 19:10:35 2005 > Subject: Re: $50,000 reward for Verizon cable cutter > > Sean Donelan wrote: > > >Verizon is offering a $50,000 reward for information about several > >acts of cut cables in the last couple of months. At least three lines > >were cut in the last week. > > > >http://www.boston.com/news/local/massachusetts/articles/2005/01/13/verizon_ > seeking_information_about_cable_cutter/ > > > > > > > With a power saw? Goodness, that sounds noisy in the middle of the > night. I'd have thought a low tech ax would do the job. :-) > > Probably a disgruntled customer, with cable bundles that repair says > were supposed to be replaced 12 years ago, but engineering says isn't > in the budget (like my SBC/Ameritech neighborhood in Ann Arbor). > > Sigh, not enough criminal instinct here. > > -- > William Allen Simpson > Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32 > -- Joshua Brady

2 1

Re: $50,000 reward for Verizon cable cutter
by Hannigan, Martin 14 Jan '05

14 Jan '05

Disgruntled customers don't know how to cut X hundred pair cables. --- Martin Hannigan hannigan(a)verisign.com Verisign, Inc. -----Original Message----- From: owner-nanog(a)merit.edu <owner-nanog(a)merit.edu> To: nanog(a)merit.edu <nanog(a)merit.edu> Sent: Fri Jan 14 19:10:35 2005 Subject: Re: $50,000 reward for Verizon cable cutter Sean Donelan wrote: >Verizon is offering a $50,000 reward for information about several >acts of cut cables in the last couple of months. At least three lines >were cut in the last week. > >http://www.boston.com/news/local/massachusetts/articles/2005/01/13/verizon_ seeking_information_about_cable_cutter/ > > > With a power saw? Goodness, that sounds noisy in the middle of the night. I'd have thought a low tech ax would do the job. :-) Probably a disgruntled customer, with cable bundles that repair says were supposed to be replaced 12 years ago, but engineering says isn't in the budget (like my SBC/Ameritech neighborhood in Ann Arbor). Sigh, not enough criminal instinct here. -- William Allen Simpson Key fingerprint = 17 40 5E 67 15 6F 31 26 DD 0D B9 9B 6A 15 2C 32

2 1