- Test - lists.nanog.org

Whois and the DoD
by Hank Nussbacher 05 Jun '07

05 Jun '07

We are all familiar with whois.ripe.net and whois.arin.net and the other whois services of the other RIRs. It allows us to know who has been assigned the IP address in question and if needed, it gives us an initial pointer in how to contact the "IP leaser" in case some network problem has arisen that would involve them. Unfortunately, the whois server for the DoD - whois.nic.mil no longer exists and therefore large chunks of active IP address space are unknown. For example: 138.138.0.0/16 158.0.0.0/13 [I am sure others can make an exhaustive list]. http://www.nic.mil/ used to have an online whois service which is also no longer accessible. I have contacted the RIRs and they admit there is a problem here that they can't solve. Based on http://www.iana.org/assignments/ipv4-address-space I would assume IANA might be interested in mandating that any organization having IP space from them must operate an accessible whois server. So is there anyone out in NANOG-land that has a solution? Thanks, Hank

3 2

NANOG40 webcasting
by MARLON BORBA 05 Jun '07

05 Jun '07

fellow NANOGers, are there live webcasts of NANOG presentations and talks? if so, where can I point my media player to? Abraços, Marlon Borba, CISSP, APC DataCenter Associate Técnico Judiciário - Segurança da Informação TRF 3 Região (11) 3012-1683 -- Dont just sit there and think it does not matter. -Security is the problem we love to ignore. (David Clark, 1992) --

3 2

RE: Security gain from NAT (was: Re: Cool IPv6 Stuff)
by David Schwartz 05 Jun '07

05 Jun '07

> Again, whether the lock/deadbolt come as a package deal with the screen > door or not, it is the lock/deadbolt that provide the security, not > the screen > door. Wow, I don't know what to say. I've never heard of a screen door that came with, and could not work without, a lock and deadbolt. It's totally obvious that you had no intention of implying that typical NAT implementations didn't provide any security. And, by the way, in all of my real examples, it was the actual NAT that provided the security. The Windows machines are behind a device that has but one rule configured in it, and it's a NAT rule. The NAT rule is the only thing that causes the machine to do any stateful inspection at all. That is, one single element provides the NAT and the SI, SI is the means by which the NAT is implemented, and SI is the only way to provide NAT. The device is *NOT* configured to reject inbound by default. Other machines on other parts of my private network *can* reach it through its NAT on its private addresses. Our wireless network, for example, has its own NAT to reach the Internet and its own block of private addresses, but can reach the wired Windows boxes on their private addresses. Yet you *STILL* can't log into my Linux box even with the root password. You still can't access my Windows network shares even with the administrator password. If it was on a public IP address, all other things being the same, it would take you ten seconds to get into it. These machines have never been compromised. All other things being precisely the same, without the private addresses, they would never have lasted. It is simply a fact that private addresses and NAT itself do provide some security. You can get this same security without the private addresses and without the NAT, but that changes nothing. This is the claim you are defending: "There's no security gain from not having real IPs on machines. Any belief that there is results from a lack of understanding." So why can't you break into these machines when the only thing stopping you is that they don't have real IPs. There is no other security of any kind in place. There is no "reject inbound by default", no firewall rules (except NAT itself). The only stateful inspection is used to make NAT work and is the *implementation* of NAT itself. All I have is the very thing you claim provides "no security gain". And it's what's stopping you. DS

1 0

NANOG40 Lightning Talks for Tuesday, June 5
by Steve Feldman 05 Jun '07

05 Jun '07

These three lightning talks will be presented this morning at 10:00: What is LISP? by Dino Farinacci root attack, end-user view by Yoshinobu Matsuzaki RouteViews Futures: Where from here? by David Meyer Submissions are still open until 3:00 pm for the three slots tomorrow, go to http://www.nanog.org/lightning/ to submit yours. Steve Feldman for the program committee

1 1

Providers that carry IPv6
by Krichbaum, Eric 05 Jun '07

05 Jun '07

I saw this question a while ago but no (maybe one) answers. Who does have IPv6 in production today. Of the fixedorbit.com top ten for example? 701 (MCI) - ? 7018 (AT&T) - ? 1239 (Sprint) - ? 174 (Cogent) - No. 3356 (Level3) - ? 209 (Qwest) - No. 3549 (Global Crossing) - ? 4323 (Time Warner Telecom) - ? 6461 (Abovenet) - ? 7132 (SBC) - ? Is there anyone out that would supply an ISP with a tunnel to v6 routes? Eric Krichbaum, PhD Director, Retail Network Engineering Citynet 113 Platinum Drive, Suite B Bridgeport WV 26330 Support: 800-881-2638 Fax: 304-848-5410 www.citynet.net

7 6

Re: Security gain from NAT
by Roger Marquis 05 Jun '07

05 Jun '07

Matthew Palmer wrote: > While "protection from mistakes" is a valid reason, it's a pretty > weak one. It is indeed a weak reason but, evidently, much stronger as a straw man argument. NAT is A security tool, not THE security tool. > I would say that those who rely on NAT for security are the ones > with the narrow world-view. Depends wholly on the security requirements of the client. Then again, I can't say I've ever seen a site that relies on NAT exclusively. This is another straw man argument. A core but often neglected factor in IT security is KIS. NAT, particularly in the form of PAT, is an order of magnitude simpler to administer than a stateful firewall with one-to-one address mappings. Given the degree to which complexity negatively correlates with security, for non-server addresses at least, NAT has far and away the better ROI. Any security auditor will tell you that, in the real world, stateful one-to-one firewalls are rarely as secure as NAT gateways for the simple reason that the non-NAT firewalls have more rules. This debate mirrors one that took place in a large university where I worked several years ago. The network admins made passionate arguments against NAT but did little to firewall vulnerable departments. The risk was obvious but so was the underlying motivation. They were simply protecting their turf. In this case multiple class-B allocations, awarded decades ago, before NAT and PAT became affordable technologies. Perhaps they also did a lot of peer-to-peer filesharing behind those non-NATed subnets. I don't know all of the reasons but, having managed thousands of clients behind NAT and unNATted gateways I'll take NAT any day. -- Roger Marquis Roble Systems Consulting http://www.roble.com/

3 2

Fwd: NIST Special Publication 800-54 Draft - BGP Security
by ge＠linuxbox.org 04 Jun '07

04 Jun '07

----- Forwarded message from ksriram(a)nist.gov ----- Date: Mon, 4 Jun 2007 18:58:26 -0400 From: ksriram(a)nist.gov To: nanog(a)nanog.org Subject: NIST Special Publication 800-54 Draft - BGP Security I made an announcement today during the ISP Security session (at NANOG40) about the release the following publication from NIST: Special Publication 800-54 Draft Version 2, Border Gateway Protocol Security http://csrc.nist.gov/publications/drafts/800-54/Draft-SP800-54-version2-Jun… This is a revised version incorporating many comments received on the first version that was issued in September 2006. The document remains open for comments and further revisions. Please email comments/suggestions to the authors: kuhn(a)nist.gov, ksriram(a)nist.gov, dougm(a)nist.gov Thank you. Sriram K. Sriram, Ph.D. Advanced Network Technologies Division National Institute of Standards and Technology 100 Bureau Drive, Stop 8920 Gaithersburg, MD 20899-8920 Phone: (301) 975-3973 E-Mail: ksriram(a)nist.gov Web: http://www.antd.nist.gov/~ksriram/ ----- End forwarded message ----- -- -- "beepbeep it, i leave work, stop reading sec lists and im still hearing gadi" - HD Moore to Gadi Evron on IM, on Gadi's interview on npr, March 2007.

1 0

Re: Security gain from NAT (was: Re: Cool IPv6 Stuff)
by Brandon Butterworth 04 Jun '07

04 Jun '07

> I posit that a screen door does not provide any security. A lock and > deadbolt provide some security. NAT/PAT is a screen door. > Not having public addresses is a screen door. A stateful inspection > firewall is a lock and deadbolt. It's tedious getting in and out with a lock and a deadbolt so we don't bother. The screen door stops some bugs flying in. I don't see why people make a big deal of this, to the extent of trying to stop people doing NAT if they want to in v6. People can break their connection if they want, for some a box that does what a pre configured NAT box does is more security than they would have if left to configure something else (child wants some p2p, child opens ports and a few others over time, firewall is pointless) Assuming NAT cannot exist is what annoys me as it also breaks a lot of proxy firewalls too by trying to force an end to end model that doesn't suit all. Back to "rabbit season" "duck season" discussion... brandon

1 0

NIST Special Publication 800-54 Draft - BGP Security
by ksriram＠nist.gov 04 Jun '07

04 Jun '07

I made an announcement today during the ISP Security session (at NANOG40) about the release the following publication from NIST: Special Publication 800-54 Draft Version 2, Border Gateway Protocol Security http://csrc.nist.gov/publications/drafts/800-54/Draft-SP800-54-version2-Jun… This is a revised version incorporating many comments received on the first version that was issued in September 2006. The document remains open for comments and further revisions. Please email comments/suggestions to the authors: kuhn(a)nist.gov, ksriram(a)nist.gov, dougm(a)nist.gov Thank you. Sriram K. Sriram, Ph.D. Advanced Network Technologies Division National Institute of Standards and Technology 100 Bureau Drive, Stop 8920 Gaithersburg, MD 20899-8920 Phone: (301) 975-3973 E-Mail: ksriram(a)nist.gov Web: http://www.antd.nist.gov/~ksriram/

1 0

RFC4864 - Local Network Protection for IPv6
by Jeroen Massar 04 Jun '07

04 Jun '07

For all you "NAT is soo secure I need to NAT" folks please take the time and read the following RFC that the IETF has carefully put together to address all those arguments. URL: http://myietf.unfix.org/documents/rfc4864.txt Abstract: 8<---------------------------------------------------------------------------- Although there are many perceived benefits to Network Address Translation (NAT), its primary benefit of "amplifying" available address space is not needed in IPv6. In addition to NAT's many serious disadvantages, there is a perception that other benefits exist, such as a variety of management and security attributes that could be useful for an Internet Protocol site. IPv6 was designed with the intention of making NAT unnecessary, and this document shows how Local Network Protection (LNP) using IPv6 can provide the same or more benefits without the need for address translation. ---------------------------------------------------------------------------->8 Now, if you have a problem with that document and the way it solves your problems, please raise them in the v6ops WG of the IETF so that they know about them and can address your concerns. Greets, Jeroen

1 0