November 2005 - Test - lists.nanog.org

RE: BGP Security and PKI Hierarchies (was: Re: Wifi Security)
by Bora Akyol 23 Nov '05

23 Nov '05

> -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Steven M. Bellovin > Sent: Tuesday, November 22, 2005 12:54 PM > To: Randy Bush > Cc: nanog(a)nanog.org > Subject: Re: BGP Security and PKI Hierarchies (was: Re: Wifi Security) > <..> > Furthermore, given that a trust algebra may yield a trust > value, rather than a simple 0/1, is it reasonable to use that > assessment as a BGP preference selector? That would tie the > security very deeply -- too deeply? -- into BGP's guts. If you take the web of trust model, I think a security value can be assigned to announced information based on a couple variables: 1) Distance from an absolute trusted authority. 2) The feedback rating of the announcer (like Ebay ;-) 3) A statically configured metric based on a field match with a set of extracted fields from the ID presented by the announcer. Or a combination of both. I think this was discussed in detail in the pre-formation stages of the BGP Sec. Req. document. I also remember reading about a paper on a PGP like trust mesh with variable trust values assigned based on distance etc, but I can't recall the authors. All in all, this is not totally different from Viterbi decoding of digital signals in the presence of noise in the way the trust values would be constructed.

2 1

Re: BGP Security and PKI Hierarchies (was: Re: Wifi Security)
by Sandy Murphy 22 Nov '05

22 Nov '05

>Otherwise, you have to be storing a plethora of >> different signers' certificates to be able to validate all the >> institution's certificates that come in. > >you need those certs to verify the live data anyway Yes, the reason why you want to validate the institution's certificates is so you can verify the data signed with that cert (signed with the private key associated with the public key in the cert, to be explicit). --Sandy

1 0

route-views.routeviews.org down?
by Hank Nussbacher 22 Nov '05

22 Nov '05

I am unable to telnet or ping route-views.routeviews.org. No event listed at http://www.routeviews.org/update.html Is it just me? -Hank

5 7

Box with (H)VPLS hub+spoke (martini EoMPLS) support in the market?
by Saku Ytti 22 Nov '05

22 Nov '05

Hey, Could someone please point me out if there is already boxes that support acting as (H)VLPS HUB's for Martini EoMPLS spokes, with VLAN rewrite? Hopefully this helps more than hurts: L2_cust--L2--PE1-------EoMPLS-----+ | L2_cust--L2--PE2-------EoMPLS----PE4-----L2-----L3_Cust_Router | L2_cust--L2--PE3-------EoMPLS-----+ PE4 would be running (H)VPLS aggregating the EoMPLS + native L2 to single broadcast domain. L2_custs would need to take round-trip via L3_Cust_Router to reach each other (so local-proxy-arp). PE1-PE3 would be running plain old martini EoMPLS without any MAC knownledge, they could be running on different VLAN, which PE4 would then rewrite. Is there any box in market doing this yet? My top runners would be Timetra (now alcatel) and Riverstone 15[12]00. Thanks, -- ++ytti

1 0

Wifi Security
by Ross Hosman 22 Nov '05

22 Nov '05

So my question is pretty simple. You have all these major companies such as google/earthlink/sprint/etc. building wifi networks. Lets say I want to collect peoples information so I setup an AP with the same ssid as google's ap so people connect to it and I log all of their traffic. Most people won't check beyond the ssid to look at the mac address but even that could be spoofed. Is there anyway to verify a certain ap beyond mac/ssid, will there be in the future? How do these companies plan to mitigate this threat or are they just going to hope consumers are smart enough to figure it out? Ross Hosman Network/Systems Administrator E: rhosman(a)corp.hometel.com P: 618-644-2111 x 238 C: 314-898-3381 Y!: rosshosman

16 30

RE: Wifi Security
by matthew.ford＠bt.com 21 Nov '05

21 Nov '05

> * steve(a)telecomplete.co.uk (Stephen J. Wilcox) [Mon 21 Nov > 2005, 16:07 CET]: > >On Mon, 21 Nov 2005, Patrick W. Gilmore wrote: > >>Why would you even need to set up an AP? Why not just sit > and sniff > >>traffic? Gets you the _exact_ same information. > >man in the middle is easier if you are the gateway, no need > to steal arp > > It's *wireless*! You can just sit and sniff traffic, no need to play > ARP games to redirect traffic to you. *Active* attacks are facilitated by rogue APs and arp spoofing. Mat.

2 1

RE: a record?
by Church, Chuck 21 Nov '05

21 Nov '05

Isn't it just good security practice to limit telnet/SSH access to only a few choice hosts/subnets? I know I'd never allow the 0/0 net access to a signon screen, even if it is SSH. If you're on vacation and need to access something, call your NOC, and have them temporarily allow your dynamic address for SSH. When a hacker finds an open SSH host, they think two things - This host is important to someone, and that they need more doughnuts... Chuck -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Frank Louwers Sent: Tuesday, November 15, 2005 3:03 AM To: nanog(a)nanog.org Subject: Re: a record? On Tue, Nov 15, 2005 at 12:01:00AM +0100, Peter Dambier wrote: > > Moving sshd from port 22 to port 137, 138 or 139. Nasty eh? don't do that! Lots of (access) isps around the world (esp here in Europe) block those ports (in and out), so if you ever need emergency access to your system from a network you don't know, you'll find yourself blocked. Kind Regards, Frank Louwers -- Openminds bvba www.openminds.be Tweebruggenstraat 16 - 9000 Gent - Belgium

8 14

Re: a record?
by Robert Bonomi 20 Nov '05

20 Nov '05

> From: "Patrick W. Gilmore" <patrick(a)ianai.net> > Subject: Re: a record? > Date: Sun, 20 Nov 2005 10:45:21 -0500 > > On Nov 20, 2005, at 6:17 AM, Elmar K. Bins wrote: > > >> Unfortunately, we now have decades of experience in cybersecurity > >> that > >> this isn't true. It appears to work for a while, but on the Internet > >> bears are always hungry and learn. There are people actively > >> scanning > >> for any open ports running any protocol, without a SPECIFIC > >> interest in > >> your computer. > > > > Funnily, I see many many more scanning attempts for the same port (or > > handful of ports) across entire networks than the other way around. > > > > And as stated before: If somebody scans 63023, he has interest in your > > site and is worth the effort of doing something about it. That's the > > whole point in changing the port. > > > > Changing the port is not making the system more secure, it only > > filters > > out passers-by. > > I'm going to repeat what Sean said, because you clearly didn't read > what he said: > > "There are people actively scanning for any open ports running any > protocol, without a SPECIFIC interest in your computer." > > Allow me to re-state again in slightly different language so you > understand this time: > > Changing your port may (will?) lower the number of automated scans > you see hitting your daemon, but it will _NOT_ eliminate them. You know, you and he are "having an agreement", in large part. He *expressly*disclaimed* any increase in security. that his approach *only* eliminated the casual 'passers-by'. > IOW: > Just because someone is probing for an SSH daemon on 65K ports > against your box does _NOT_ mean he has a specific interest in your box. A sweep across all ports on each box, for a specific protocol, is orders of magnitude slower than scanning only the (be it a single one or a handful) 'well known' ports for that service. A scan-all-ports search can only check 16 machines in the time a single-port scan can check _over_a_milliion_ machines. The scan-all-ports searcher is clearly more interested in finding an exploit on "one of a relatively small number of boxes" than he is in 'finding an exploitable box, "somewhere"'. He is concentrating his attack efforts on a _comparatively_small_ range of addresses, rather than on a broad-based 'opportunistic' search. And he has a 'reason' for doing that. It may well *NOT* be "because of who the boxes belong to", nor "what 'interesting' data can be found on them" -- it may simmply be that they're on a 'fat pipe' connection. or 'who knows what.' > If you honestly believe that just 'cause someone tried "ssh -p 63xxx > $YOUR.BOX" it means he is specifically targeting your box, well, that > is your prerogative. You are almost certain to be wrong at least > part of the time, though. The guy who does that _is_ "more worrisome" than the 'casual door knocker' on 'port 22'. Whether or not he's after me _in_particular_, I don't really care. He is mounting a 'more determined' attack against my resources, than the average clown. *AS*SUCH*, the 'wise man' takes faster, and more aggressive, defensive actions when this type shows his face. He is considerably more determined, and quite probably somewhat more skilfull, than the 'typical' doorknob rattler. This is true, whether or not he's deliberately going after _me_. <grin> Lastly, by setting things up such that you don't have to examine all the port 22 doorknob rattling to see if there's any thing 'more determined' going on -- that 'noise reduction' makes the serious attempts *much* more visible. "Security by obscurity" is _not_ a complete solution, in-and-of itself, no question. However, it _can_ be a big 'first step' to help in weeding out the 'casual' stuff from the more determined attempts.

1 0

Re: AOL Postmaster contact?
by Suresh Ramasubramanian 20 Nov '05

20 Nov '05

On 11/20/05, Mark Costlow <cheeks(a)swcp.com> wrote: > > Someone might look at the ticket Monday. Meanwhile, I've got thousands of > queued messages frrom users that are upset with ME because I can't get > their mail to AOL. > AOL's whitelist + feedback loop is not really a whitelist If the numbers theyre seeing on your servers get too high .. they'll start rate limiting you down by putting in anywhere upto 48 hour tempfailing of your IPs The last time this happened to us, it got very quickly resolved when we ran numbers on our scomp complaints from AOL to see what was going on. Turns out the reason was a lot of users with .forwards to AOL accounts, then reporting .forwarded email as spam. This email was also going out through our standard outbound mail relays, and the combination of our outbound spam levels (pretty low for an ISP our size) AND .forwarded email tipped the balance. So what we did was to set things up so that .forward traffic was routed out a separate IP. And we told AOL what that IP was and also told them that the only thing coming out of it would be .forward traffic. They took that into account I guess, because the haven't gone and 4xx'ed us since we set this up (and when they do 4xx it hurts - we're just over a third their size so there's a substantial amount of email traffic from our users to AOL ..) -- Suresh Ramasubramanian (ops.lists(a)gmail.com)

1 1

Cisco 7200 + NPE-G1 / 7301
by Ben Butler 18 Nov '05

18 Nov '05

Hi, Anyone got any comments about how good or otherwise the Cisco 7200 + NPE-G1 or 7301, both with 1GB of RAM, is as a eBGP router + L2TP terminator for DSL subs, in terms of scalability for bandwidth through put & the number of VPDN sessions it can terminate before it dies. Are the two solutions effectively the same box or are there more technical differences beyond the obvious number of slots. Without wanting to start one of those sorts of threads is it time to look at something else, i.e. Juniper, for cost / performance, or should I stick with the heard and what I know in Cisco. Kind Regards Ben Butler ++++++++++++++++++++++++++++++++++++++ C2 Internet Ltd Globe House The Gullet Nantwich Cheshire CW5 5RL W http://www.c2internet.net/ T +44-(0)845-658-0020 F +44-(0)845-658-0070 All quotes & services from C2 are bound by our standard terms and conditions which are available on our website at: http://www.c2internet.net/legal/main.htm#tandc

5 4