June 2007 - Test - lists.nanog.org

Re: Cool IPv6 Stuff
by Sam Stickland 06 Jun '07

06 Jun '07

Sander Steffann wrote: > Hi, > > >> In fact, and call me crazy, but I can't help but wonder how >> many enterprises >> out there will see IPv6 and its concept of "real IPs for all machines, >> internal and external!" and respond with "Hell No." >> >> Anyone got any numbers for that? I'm happy to admit I don't. :) >> > > No numbers, but the customers I talked to usually have the feeling that > public IP addresses on their machines seems to imply publicly (and thus > unprotected) reachability for those machines. They don't understand the > difference between NAT and stateful firewalls... > > This is what leads to the "Hell No" attitude in my case. Educating them > about security seems the only solution. > > I think that rather than attempting to educate their customers about security firewall vendors will probably just sell a NAT capable IPv6 firewall. It's the path of least resistance to profit. (A lot of mainstream vendors have helped push the idea that NAT is synonymous with firewalling. Take the Cisco PIX as an example, where up until very recently you had to configure NAT to allow traffic through the device.) Even people I have spoken that understand the difference between firewalling/reachability and NATing are still in favour of NAT. The argument basically goes "Yes, I understand that have a public address does not neccessarily mean being publically reachable. But having a private address means that [inbound] public reachability is simply not possible without explicit configuration to enable it". i.e. NAT is seen as a extra layer of security. I want NAT to die but I think it won't. S

4 6

Re: NANOG 40 agenda posted
by Martin Hannigan 05 Jun '07

05 Jun '07

>The NANOG Program Committee is pleased to announce that the >agenda for the upcoming meeting in Bellevue, WA has been posted: > > http://www.nanog.org/mtg-0706/topics.html > >If you haven't already registered to attend, now is a great time! Sorry to post 4 times this year, and really, it just kind of stuck out when I went to look at the agenda, but: Nothing about V6? Not a workshop, tutorial, or even a panel? Any reason why? Is V6 not happening? Best, Martin

58 193

Yahoo! clue
by Simon Waters 05 Jun '07

05 Jun '07

Is there a Yahoo! abuse contact around who will talk, and not just sended me canned responses? Their abuse team seems very responsive, but I fear they don't actually read the whole email, but just hit the button for the most appropriate "canned response" as soon as they think they know what is being said. (Let he who is without sin here, cast the first stone). Thanks, Simon

6 6

Whois and the DoD
by Hank Nussbacher 05 Jun '07

05 Jun '07

We are all familiar with whois.ripe.net and whois.arin.net and the other whois services of the other RIRs. It allows us to know who has been assigned the IP address in question and if needed, it gives us an initial pointer in how to contact the "IP leaser" in case some network problem has arisen that would involve them. Unfortunately, the whois server for the DoD - whois.nic.mil no longer exists and therefore large chunks of active IP address space are unknown. For example: 138.138.0.0/16 158.0.0.0/13 [I am sure others can make an exhaustive list]. http://www.nic.mil/ used to have an online whois service which is also no longer accessible. I have contacted the RIRs and they admit there is a problem here that they can't solve. Based on http://www.iana.org/assignments/ipv4-address-space I would assume IANA might be interested in mandating that any organization having IP space from them must operate an accessible whois server. So is there anyone out in NANOG-land that has a solution? Thanks, Hank

3 2

NANOG40 webcasting
by MARLON BORBA 05 Jun '07

05 Jun '07

fellow NANOGers, are there live webcasts of NANOG presentations and talks? if so, where can I point my media player to? Abraços, Marlon Borba, CISSP, APC DataCenter Associate Técnico Judiciário - Segurança da Informação TRF 3 Região (11) 3012-1683 -- Dont just sit there and think it does not matter. -Security is the problem we love to ignore. (David Clark, 1992) --

3 2

RE: Security gain from NAT (was: Re: Cool IPv6 Stuff)
by David Schwartz 05 Jun '07

05 Jun '07

> Again, whether the lock/deadbolt come as a package deal with the screen > door or not, it is the lock/deadbolt that provide the security, not > the screen > door. Wow, I don't know what to say. I've never heard of a screen door that came with, and could not work without, a lock and deadbolt. It's totally obvious that you had no intention of implying that typical NAT implementations didn't provide any security. And, by the way, in all of my real examples, it was the actual NAT that provided the security. The Windows machines are behind a device that has but one rule configured in it, and it's a NAT rule. The NAT rule is the only thing that causes the machine to do any stateful inspection at all. That is, one single element provides the NAT and the SI, SI is the means by which the NAT is implemented, and SI is the only way to provide NAT. The device is *NOT* configured to reject inbound by default. Other machines on other parts of my private network *can* reach it through its NAT on its private addresses. Our wireless network, for example, has its own NAT to reach the Internet and its own block of private addresses, but can reach the wired Windows boxes on their private addresses. Yet you *STILL* can't log into my Linux box even with the root password. You still can't access my Windows network shares even with the administrator password. If it was on a public IP address, all other things being the same, it would take you ten seconds to get into it. These machines have never been compromised. All other things being precisely the same, without the private addresses, they would never have lasted. It is simply a fact that private addresses and NAT itself do provide some security. You can get this same security without the private addresses and without the NAT, but that changes nothing. This is the claim you are defending: "There's no security gain from not having real IPs on machines. Any belief that there is results from a lack of understanding." So why can't you break into these machines when the only thing stopping you is that they don't have real IPs. There is no other security of any kind in place. There is no "reject inbound by default", no firewall rules (except NAT itself). The only stateful inspection is used to make NAT work and is the *implementation* of NAT itself. All I have is the very thing you claim provides "no security gain". And it's what's stopping you. DS

1 0

NANOG40 Lightning Talks for Tuesday, June 5
by Steve Feldman 05 Jun '07

05 Jun '07

These three lightning talks will be presented this morning at 10:00: What is LISP? by Dino Farinacci root attack, end-user view by Yoshinobu Matsuzaki RouteViews Futures: Where from here? by David Meyer Submissions are still open until 3:00 pm for the three slots tomorrow, go to http://www.nanog.org/lightning/ to submit yours. Steve Feldman for the program committee

1 1

Providers that carry IPv6
by Krichbaum, Eric 05 Jun '07

05 Jun '07

I saw this question a while ago but no (maybe one) answers. Who does have IPv6 in production today. Of the fixedorbit.com top ten for example? 701 (MCI) - ? 7018 (AT&T) - ? 1239 (Sprint) - ? 174 (Cogent) - No. 3356 (Level3) - ? 209 (Qwest) - No. 3549 (Global Crossing) - ? 4323 (Time Warner Telecom) - ? 6461 (Abovenet) - ? 7132 (SBC) - ? Is there anyone out that would supply an ISP with a tunnel to v6 routes? Eric Krichbaum, PhD Director, Retail Network Engineering Citynet 113 Platinum Drive, Suite B Bridgeport WV 26330 Support: 800-881-2638 Fax: 304-848-5410 www.citynet.net

7 6

Re: Security gain from NAT
by Roger Marquis 05 Jun '07

05 Jun '07

Matthew Palmer wrote: > While "protection from mistakes" is a valid reason, it's a pretty > weak one. It is indeed a weak reason but, evidently, much stronger as a straw man argument. NAT is A security tool, not THE security tool. > I would say that those who rely on NAT for security are the ones > with the narrow world-view. Depends wholly on the security requirements of the client. Then again, I can't say I've ever seen a site that relies on NAT exclusively. This is another straw man argument. A core but often neglected factor in IT security is KIS. NAT, particularly in the form of PAT, is an order of magnitude simpler to administer than a stateful firewall with one-to-one address mappings. Given the degree to which complexity negatively correlates with security, for non-server addresses at least, NAT has far and away the better ROI. Any security auditor will tell you that, in the real world, stateful one-to-one firewalls are rarely as secure as NAT gateways for the simple reason that the non-NAT firewalls have more rules. This debate mirrors one that took place in a large university where I worked several years ago. The network admins made passionate arguments against NAT but did little to firewall vulnerable departments. The risk was obvious but so was the underlying motivation. They were simply protecting their turf. In this case multiple class-B allocations, awarded decades ago, before NAT and PAT became affordable technologies. Perhaps they also did a lot of peer-to-peer filesharing behind those non-NATed subnets. I don't know all of the reasons but, having managed thousands of clients behind NAT and unNATted gateways I'll take NAT any day. -- Roger Marquis Roble Systems Consulting http://www.roble.com/

3 2

Fwd: NIST Special Publication 800-54 Draft - BGP Security
by ge＠linuxbox.org 04 Jun '07

04 Jun '07

----- Forwarded message from ksriram(a)nist.gov ----- Date: Mon, 4 Jun 2007 18:58:26 -0400 From: ksriram(a)nist.gov To: nanog(a)nanog.org Subject: NIST Special Publication 800-54 Draft - BGP Security I made an announcement today during the ISP Security session (at NANOG40) about the release the following publication from NIST: Special Publication 800-54 Draft Version 2, Border Gateway Protocol Security http://csrc.nist.gov/publications/drafts/800-54/Draft-SP800-54-version2-Jun… This is a revised version incorporating many comments received on the first version that was issued in September 2006. The document remains open for comments and further revisions. Please email comments/suggestions to the authors: kuhn(a)nist.gov, ksriram(a)nist.gov, dougm(a)nist.gov Thank you. Sriram K. Sriram, Ph.D. Advanced Network Technologies Division National Institute of Standards and Technology 100 Bureau Drive, Stop 8920 Gaithersburg, MD 20899-8920 Phone: (301) 975-3973 E-Mail: ksriram(a)nist.gov Web: http://www.antd.nist.gov/~ksriram/ ----- End forwarded message ----- -- -- "beepbeep it, i leave work, stop reading sec lists and im still hearing gadi" - HD Moore to Gadi Evron on IM, on Gadi's interview on npr, March 2007.

1 0