November 2014 - Test - lists.nanog.org

The state of TACACS+
by Robert Drake 05 Jan '15

05 Jan '15

Ever since first using it I've always liked tacacs+. Having said that I've grown to dislike some things about it recently. I guess, there have always been problems but I've been willing to leave them alone. I don't have time to give the code a real deep inspection, so I'm interested in others thoughts about it. I suspect people have just left it alone because it works. Also I apologize if this is too verbose or technical, or not technical enough, or just hard to read. History: TACACS+ was proposed as a standard to the IETF. They never adopted it and let the standards draft expire in 1998. Since then there have been no official changes to the code. Much has happened between now and then. I specifically was interested in parsing tac_plus logs correctly. After finding idiosyncrasies I decided to look at the source and the RFC to see what was really happening. Logging, or why I got into this mess: In the accounting log, fields are sometimes logged in different order. It appears the client is logging whatever it receives without parsing it or modifying it. That means the remote system is sending them in different orders, so technically the fault lies with them. However, it seems too trusting to take in data and log it without looking at it. This can also cause issues when you send a command like (Cisco) "dir /all nvram:" on a box with many files. The device expands the command to include everything on the nvram (important because you might want to deny access to that command based on something it expanded), but it gets truncated somewhere (not sure if it's the device buffer that is full, tac_plus, or the logging part. I might tcpdump for a while to see if I can figure out what it looks like on the wire) I'm not sure if there are security implications there. Encryption: The existing security consists of md5 XOR <content> with the md5 being composed of a running series of 16 byte hashes, taking the previous hash as part of the seed of the next hash. A sequence number is used so simple replay shouldn't be a factor. Depending on how vulnerable iterative md5 is to it, and how much time you had to sniff the traffic, I would think this would be highly vulnerable to chosen plaintext if you already have a user-level login, or at least partial known plaintext (with the assumption they make backups, you can guess that at least some of the packets will have "show running-config" and other common commands). They also don't pad the encrypted string so you can guess the command (or password) based on the length of the encrypted data. For a better description of the encryption you can read the draft: http://tools.ietf.org/html/draft-grant-tacacs-02 I found an article from May, 2000 which shows that the encryption scheme chosen was insufficient even then. http://www.openwall.com/articles/TACACS+-Protocol-Security For new crypto I would advise multiple cipher support with negotiation so you know what each client and server is capable of. If the client and server supported multiple keys (with a keyid) it would be easier to roll keys frequently, or if it isn't too much overhead they could use public key. Clients: As for clients, Wikipedia lists several that seem to be based on the original open-source tac_plus from Cisco. shrubbery.net has the "official" version that debian and freebsd use. I looked at some of the others and they all seemed to derive from Cisco's code directly or shrubbery.net code, but they retained the name and started doing their own versioning. All the webpages look like they're from 1995. In some cases I think it's intentional but in some ways it shows a lack of care for the code, like it's been dropped since 2000. Documentation is old: This only applies to shrubbery.net's version. I didn't look at the other ones that closely. While all of it appears valid, one Q&A in the FAQ was about IOS 10.3/11.0. Performance questions use the sparc 2 as a target machine. There isn't an INSTALL or README, just the FAQ/CHANGES/COPYING (and a tac_plus.conf manpage), so the learning curve for new users is probably pretty steep. Also there isn't a clear maintainer. The best email address I found was listed in the tacacs+.spec file, for packaging on rpm systems. If you hit the website they give some hints with some outdated, though still functional links. And they list the official email as tac_plus(a)shrubbery.net Conclusion: Did everyone already know this but me? If so have you moved to Kerberos? Can Kerberos do everything TACACS+ was doing for router authorization? I've got gear that only supports radius and tacacsplus, so in some cases I have no choice but to use one of those, neither of which I would trust over an unencrypted wire. If TACACS+ isn't a dead end then it needs a push to bring the protocol to a new version. There are big name vendors involved in making supported clients and servers. There should be someone invested in keeping it secure and adding features.

19 30

How do I handle a supplier that delivered a faulty product?
by Baldur Norddahl 16 Dec '14

16 Dec '14

Hello, We are a small FTTH provider and our main business is selling 1000/1000 internet. Our network is GPON based. We recently made the mistake of buying a large shipment of Zhone 2301 modems (ONU). We did test this device before purchase, but unfortunately we failed to notice a severe fault with the product. Soon after putting it into production we got many complaints from customers that the modem would crash daily. Turns out that the device can not handle download streams at or near 1000 Mbps. Especially if the download originates with a server that is 10G connected. GPON downstream is actually 2.4 Gbps. The modem has to deliver on an ordinary 1 Gbps ethernet port. This means the packets can arrive faster than the modem can hand it off on the ethernet side. And when that happens, it will simply crash. The vendor then told us to limit download speed to 750 Mbps with a small buffer of 50 KB. Any faster and the modem can crash amongst other issues. When I told them I do not think I can sell 1000/1000 Mbps internet if I limit the modems to 750 Mbps, as that would be false advertising, I was simply told that the 2301 is a low cost solution, so deal with it. They are not going to work more on fixing the issue. The website and the datasheet does not say anything that would warn you that this product can only handle 750 Mbps: http://www.zhone.com/products/ZNID-GPON-2301/ZNID-GPON-2301.pdf So what do I do now? I am thinking Zhone needs to resolve this in a satisfactory way, which is to either return my money or switch the product to something, that actually delivers what was promised. We have some of their 24xx series and that works perfectly well. So we know it is just the 2301 that is bad. Unfortunately we are apparently to small a customer to them. As this is an USA supplier, will suing them help me any? Yes I know, don't ask for legal advice on a mailing list, and I am not - I just want to know some opinions if that is even worth considering. Or if I will just have to eat it and drive the whole shipment into the harbor. Regards, Baldur

9 12

Re: 10Gb iPerf kit?
by Randy Carpenter 09 Dec '14

09 Dec '14

I have not tried doing that myself, but the only thing that would even be possible that I know of is thunderbolt. A new MacBook Pro and one of these maybe: http://www.sonnettech.com/product/echoexpresssel_10gbeadapter.html -Randy ----- On Nov 10, 2014, at 7:26 PM, Daniel Rohan drohan(a)gmail.com wrote: > We're looking for a semi-portable solution to validate 10Gb customer > circuits and hitting walls surrounding PCI lanes and the amount of data > laptops can push via their busses. We'd prefer to not have techs lugging > around server equipment for these tests. > > Anyone out there testing 10gbE with iPerf? If so, what are you using? > > Thanks, > > > Dan

10 11

A case against vendor-locking optical modules
by Jérôme Nicolle 06 Dec '14

06 Dec '14

Hello, I'm having a discussion with Arista, trying to explain to them why I _can't_ buy any hardware unable to run with compatible optical modules. My points are : - I need specific modules, mostly *WDM and BiDi, some still unavailable in their product line - I run at least two other vendors on every locations and can't stack up every spare optics for each of them, neither could remote-hands safely re-program optics to match a specific vendor when needed. - I have an established relationship with a trusted optics supplier, providing support, warranty and re-coding hardware for their entire (impressive) lineup. And this supplier is still 2-5x times cheaper than any vendor-labeled optics even with NFR-like discounts. Based on these points, I discourage every customers of ever using locked-in equipments, and forbid them on my own network. Of course, Arista can't be pleased because their hardware never stepped chord in my customer's networks. But they seem to deliberatly miss my points every time the subject comes up. What are other arguments against vendor lock-in ? Is there any argument FOR such locks (please spare me the support issues, if you can't read specs and SNMP, you shouldn't even try networking) ? Did you ever experience a shift in a vendor's position regarding the use of compatible modules ? Thanks ! -- Jérôme Nicolle +33 6 19 31 27 14

20 29

10Gb iPerf kit?
by Daniel Rohan 06 Dec '14

06 Dec '14

We're looking for a semi-portable solution to validate 10Gb customer circuits and hitting walls surrounding PCI lanes and the amount of data laptops can push via their busses. We'd prefer to not have techs lugging around server equipment for these tests. Anyone out there testing 10gbE with iPerf? If so, what are you using? Thanks, Dan

3 2

RE: Cisco CCNA Training (Udemy Discounted Training)
by Wakefield, Thad M. 05 Dec '14

05 Dec '14

Since there was some interest in the Udemy CCNA training, I'll risk forwarding these additional discounts: Remember that this is ONLY for the month of NOVEMBER! *** CCNA Course is now $24 with coupon code: THANKS24 https://www.udemy.com/the-complete-ccna-200-120-course/?couponCode=THANKS24 *** ROUTING Course is now $14 with coupon code: THANKS14 https://www.udemy.com/routing-configuration-router-administration/?couponCo… *** SWITCHING Course is now $9 with coupon code: THANKS9 https://www.udemy.com/layer-2-switching-vlans/?couponCode=THANKS9 *** IPv4 Course is now $9 with coupon code: THANKS9 https://www.udemy.com/everything-you-need-to-know-about-ipv4-and-its-config… *** IPv6 Course is now $9 with coupon code: THANKS9 https://www.udemy.com/the_abcs_of_ipv6/?couponCode=THANKS9 *** VLANs Course is now $5 with coupon code: THANKS5 https://www.udemy.com/overview-of-vlans-access-list-nat-bonus-material/?cou… *** OSPF Course is now $14 with coupon code: THANKS14 https://www.udemy.com/ospf-breakdown/?couponCode=THANKS14 *** HEX Course is FREE *** use coupon code: THANKSFREE https://www.udemy.com/learn-how-to-do-hex-conversions-in-under-30-seconds/?…

5 5

determine relationship between the operators based on import and export statements in aut-num object?
by Martin T 05 Dec '14

05 Dec '14

Hi, bit weird question, but is it possible to determine relationship(Internet transit, settlement-free peering, etc) between the operators based on import and export statements in aut-num object? Often aut-num objects in RIR database contain the remarks which describe such relationships. However, for example here I have following import and export attributes from an aut-num object of an ISP: import: from AS65133 action pref=100; accept ANY import: from AS65798 accept AS65798 import: from AS65084 accept AS65084 import: from AS65485 action pref=100; accept ANY import: from AS65751 accept AS65751 import: from AS65059 action pref=100; accept ANY import: from AS65128 accept AS65128 export: to AS65133 announce AS-SET export: to AS65798 announce ANY export: to AS65084 announce ANY export: to AS65485 announce AS-SET export: to AS65751 announce ANY export: to AS650835 announce AS-SET export: to AS65128 announce ANY Am I correct that it is safe to say that probably AS65133, AS65485 and AS65059 are the uplink providers and AS65798, AS65084, AS65751 and AS65128 are the customers of this ISP? Last but not least, maybe there is altogether a more reliable way to understand the relationship between the operators than aut-num objects(often not updated) in RIR database? thanks, Martin

3 3

Transparent hijacking of SMTP submission...
by joel jaeggli 03 Dec '14

03 Dec '14

I don't see this in my home market, but I do see it in someone else's... I kind of expect this for port 25 but... J@mb-aye:~$telnet 147.28.0.81 587 Trying 147.28.0.81... Connected to nagasaki.bogus.com. Escape character is '^]'. 220 nagasaki.bogus.com ESMTP Sendmail 8.14.9/8.14.9; Thu, 27 Nov 2014 19:17:44 GMT ehlo bogus.com 250-nagasaki.bogus.com Hello XXXXXXXXXXXXXXX.wa.comcast.net [XXX.XXX.XXX.XXX], pleased to meet you 250 ENHANCEDSTATUSCODES J@mb-aye:~$telnet 2001:418:1::81 587 Trying 2001:418:1::81... Connected to nagasaki.bogus.com. Escape character is '^]'. 220 nagasaki.bogus.com ESMTP Sendmail 8.14.9/8.14.9; Thu, 27 Nov 2014 19:18:33 GMT ehlo bogus.com 250-nagasaki.bogus.com Hello [IPv6:2601:7:2380:XXXX:XXXX:XXXX:c1ae:7d73], pleased to meet you 250-ENHANCEDSTATUSCODES 250-PIPELINING 250-8BITMIME 250-SIZE 250-DSN 250-AUTH DIGEST-MD5 CRAM-MD5 LOGIN 250-STARTTLS 250-DELIVERBY 250 HELP that's essentially a downgrade attack on my ability to use encryption which seems to be in pretty poor taste frankly.

14 27

Phasing out of copper
by Jean-Francois Mezei 03 Dec '14

03 Dec '14

Currently in the midst of a CRTC policy hearing in Canada on future of competition in ISPs. Incumbents claim they have no plans to retire their copper plant after deploying FTTP/FTTH. (strategically to convince regulator that keeping ISPs on copper is fine and no need to let them access FTTP). For my reply I am trying to get more authoritative info to show that incumbents do have plans to retire the copper plant once enough customers have migrated to FTTP ( I heard that 80% migration is the tip-ver where they convert the rest of customers to FTTP to be able to shutddown the copper). Anyone have pointers to documents or experiences that would help me convince the regulator that incumbents deploy FTTP with eventual goal to be able to shutdown their old copper instead of perpetually maintaining both systems ? Also being discussed is removing regulations for access to ULL (unbundled local loops). In areas being upgraded to FTTP, are there services that really need copper ULLs and do not have an FTTP equivalent ? (home alarm systems ?). When an incumbent states for the record that "retiring copper is not in their current plans", I know that it means that it isn't in their short term plans. But I need some evidence of what other telcos do to help show the incumbent is "spinning". Any help appreciated.

12 15

Buying IP Bandwidth Across a Peering Exchange
by Colton Conor 02 Dec '14

02 Dec '14

I know typically peering exchanges are made for peering traffic between providers, but can you buy IP transit from a provider on an exchange? An example, buy a 10G port on an exchange, peer 5Gbps of traffic with multiple providers on the exchange, and buy 5Gbps of IP transit from others on the exchange? Some might ask why not get a cross connect to the provider. It is cheaper to buy an port on the exchange (which includes the cross connect to the exchange) than buy multiple cross connects. Plus we are planning on getting a wave to the exchange, and not having any physical routers or switches at the datacenter where the exchange/wave terminates at. Is this possible?

18 27