- Test - lists.nanog.org

Re: Firewall opinions wanted please
by Rachael Treu 17 Mar '04

17 Mar '04

On Wed, Mar 17, 2004 at 02:01:59PM -0500, Matthew Silvey said something to the effect of: > On Wed, Mar 17, 2004 at 11:57:33AM -0600, Rachael Treu wrote: > > > > As for your assertion that firewalls "reduce the overall security of the > > 'net."...can you please elaborate on that, as well? Other factions might/do > > argue that it's the other team refusing to lock their doors at night that > > are perpetuating the flux of bad behavior as a close second to the ignorant > > and infected. > > > > > to extend an abstraction: > > these factions are arguing about the lock on the door, but it is the door > that is important. it is a feature of the house, a means of entering and > exiting. if you argue that all doors must have a lock then you can no longer > have the freedom of design and creation to decide whether your house will > have a door for pigeons, hamster, cats, or humans without deciding how each > specific door can be accessed by each specific creature. By that rationale, why must any houses have doors at all? Further, your analogy doesn't, I feel, hold water in this case. Let's reverse that portion of said abstraction. I said all doors must have locks and all edges filters. I did not expound upon to what extent those edges are filtered. Saying that the doors must be locked does not have anything to do with whether the doors are for pigeons, hamster, cats, or humans... Access control balances this equation. You can lock a pigeon door with a key that the pigeon can bear and the hamster... Okay...this is getting absurd. Let's revert to netspeak. :) Access control. "if you argue that all doors must have a lock then you can no longer have the freedom of design and creation to decide whether your house will have a door for pigeons, hamster, cats, or humans without deciding how each specific door can be accessed by each specific creature." Exactly. Absolutely! What is wrong with that? That is my point. This is not an "information wants to be free" argument, guys. You have a network connection, you have a responsibility to ensure that you manage your risks and also that you do not enable it to be used to harm others. You build a corporate intranet server and I want to get into it. Are you going to let me? Or are you going to design it with the intent that only corporate hamsters...er...employees can access that specific door. How about your home network? Mind if I do a little recon and raid your personal systems for password and personal info harvesting? Do you _use_ passwords, for that matter? If the argument is really about a means of entering and exiting and not locking or restricting access, then why bother? Do you lock the front door to your house? These wide-swinging doors of which you speak are not practical in terms of government intelligence. Or physical border control. If your doors-- which given what you are describing are actually doorless doorways and more closely resemble gaping maws--were appropriate edge deployments, then guards should drop from perimeter and border walls, passwords should come off machines, encryption should die, ATM PINs should be decommissioned, and so on and so forth. Inarguably people complain that passwords are annoying to maintain and enter and that firewalls are in the way a lot of the time. Thankfully, many of those complaining are outsiders and intruders that shouldn't be getting in, too. I imagine that vehicle thieves find door locks to be a bit of an impairment to their livelihood, too. This is about access control. Not everything out there is meant to be collected and used by everyone else. Why do you have doors? So that people can get in. Why do you lock them? So that only the appropriate people can. The tenet of effective network security is to make the holes punched into a network small enough to prevent unauthorized access, but not so small that functionality is impaired. It is the goal of security engineers (the decent ones at least) to determine how things like access controls can best serve and protect, interoperate with, and withstand the rigors of the network, not the other way around. Now...how is it that a firewall deployed to protect the deployer's network is crushing the fundamental network purism or kills our inner rogue or pens in our data (free range packets, anyone?) These methodologies are not conjured up in order to irritate those managing the movement of traffic (legitimately). This is about flow control of payload, as are stoplights and turnstyles and credit card companies asking for your mother's maiden name and photo IDs and taking a number at the butcher or DMV... > if you're selling services that consist of pushing http/dns/smtp/pop3 traffic > then you have a much easier time inserting and using any kind of filtering > system. but if your preventative system stifles the development of new > applications then you have a losing situation. any kind of filtering > automatically creates a roadblock for network application development. If there is no network, there is no netapp development. Denial of Service then presents something other than a roadblock? Or the hijacking or prevention of development details and trade secrets? The owning of a device or deletion of throngs of data to make room for warez...? Bandwidth consumption due to other security violations...? Develop in-house, behind edge filters. The only development that edge filtering gets in the way of is rootkits that the nefarious are testing. Make use of a competent security professional who knows how to tweak filters properly for the task at hand and you won't have any "roadblocks" except for those trying to roadblock the criminal element... > all > in all the cost of the IT staff is probably less than the cost of lost > development time. it sucks, but any delays on a development schedule can > translate to potential revenue lost. And what kind of cost do you think is realized by your providers who are required by contract and law to maintain security teams and respond to security incidents? You are merely passing the buck here and shifting collateral damage. I'm going to try to climb down from this soapbox now. Remember...we're all friends here. Neither side wants to halt innovation or network utilization. --ra -- k. rachael treu, CISSP rara(a)navigo.com ..quis costodiet ipsos custodes?..

1 0

who offers cheap (personal) 1U colo?
by Janet Sullivan 17 Mar '04

17 Mar '04

> I have been aching for this now for about six years. In every > professional setting I've ever been in, a need for this kind of thing > arises and my advice to my employer/client is always the same: pay the > $x per month for a colo server for your network/system engineers to use > as an outpost for emergencies, external analysis, and monitoring. Exactly! While route servers are great, sometimes I need the flexablity of an outside shell account to do troubleshooting. I know a few other people at work who also keep outside shell accounts somewhere for this very purpose. > It seems like approaching one of the larger colo providers and > coordinating some sort of "NANOG Discount" might be one quick route. I'm of two minds on this. Obviously, if a group of us go to provider X and say we want Z amount of rack space, we can probably get a good deal. On the other hand, I'm also interested in a community of like minded folks with servers located in diverse environments who would trade access with one another. If we're all in one rack in one datacenter, there is more of a chance we'll all go down together. If we have a diverse footprint, that is much less likely to happen. > The discount could be restricted to those who are appropriately vetted. > This program would be of value to the colo provider because of the > potential for discount recipients to direct business their way. How would this vetting process work? I'm willing to give other nanog folks shell accounts on my machine in return for same, but I really don't want to hand out accounts to packet kiddies. > Suffice it to say, I'm interested, both to address current work-day > issues and for personal use. I'm also interested. I do currently have a dedicated FreeBSD server in Australia for personal use. Those of us who are running our own personal mail & DNS servers could get together to back each other up.

5 4

Cisco switch CPU overload
by Priyantha 17 Mar '04

17 Mar '04

I've a core switch (cisco 5505) with 10+ VLANs configured on that and a cisco 7204 directly connected to it. 7204 then connects to my upstream and we run BGP. we announce two different /21 blocks and was fine until last week. We got new /20 IP block and we advertised it (added to 7204 config). Everything is working fine but since than we see CPU overload from time to time on 5505. The following further explains the physical connection. |-----------| |-----------| Internal | |-----------| |-------->Upstream <-----|5505 | |7204 | |-----------| |-----------| We have Rip (ver 2) running on 5505 but not on 7204. (Those two are not talking any routing protocols each other.) I can't figure out the reason but want urgently get this resolved. You may contact me off list too for further info necessary. Thanks in advance, Priyantha Pushpa Kumara Wightman Internet Ltd.

1 0

New route-views collector up at the LINX
by David Meyer 17 Mar '04

17 Mar '04

Folks, We are now up and running at the LINX (London Internet Exchange) and would like to invite folks at the LINX to peer with route-views. You can get to the open CLI via 'telnet route-views.linx.routeviews.org' (of course, nothing much there yet). Please contact us at help(a)routeviews.org if you would like to contribute your view. In addition, I've included our standard boilerplate below. Thanks, The Route-Views Team ----- AS : 6447 University of Oregon: route-views : 128.223.60.103 (multi-hop IPv4) route-views2 : 128.223.60.102 (multi-hop IPv4) route-views3 : 128.223.60.108 (multi-hop IPv4) : 2001:468:d01:3c::80df:3c6c (multi-hop IPv6) route-views6 : 128.223.60.194 (v6 peering only) : 2001:468:d01:3c::80df:3c6d (multi-hop IPv6) route-views.wide: 202.249.2.166 (WIDE peering only) route-views.paix: 198.32.176.5 (PAIX peering only) route-views.linx: 195.66.225.222 (LINX peering only) route-views.linx: 195.66.227.222 (LINX peering only) - Route-views does not announce _any_ prefixes. - We would like to receive a full default-free table from all sessions with all peers. - In order for our multihop-ebgp sessions to survive transient network failures, we would like to increase the BGP hold-timer to 10 minutes (600 seconds). A value of zero does not work for several cases. If possible, peers should set their hold-timer to the max value which allows Route-Views to change without your intervention. cisco: neighbor 128.223.60.x timers 21845 65535 juniper: set protocols bgp group routeviews hold-time 65535 - Please send your communities. If possible, please describe the communities you advertise. - Please provide your NOC's email and telephone number(s). - Route information from these sessions is made publicly available in two forms: manufacturer-style "show ip bgp" and MRT format. -- Short questionnaire. These data will only be shared with researchers. - What type of router(s) are we peering with? - We have a (closed) mail list which we use to announce outages to our peers. If you would like your noc added to this list, please let us know. Thanks!

1 0

Re: who offers cheap (personal) 1U colo?
by Janet Sullivan 17 Mar '04

17 Mar '04

Mike Damm wrote: > That being said, I've had the idea for a couple years now of getting enough > geeky folks together to rent a rack on both coasts and populate it with a > few different operating systems and bits of gear for just the reasons > outlined in this thread. > > So if you decide to put something together, I'm up for it. I got an email from Eric Brunner-Williams who hangs out on freebsd-isp and nanog that really sparked my interest. Go to http://wampumpeag.net/vixie-personal-1U-colo.html At the bottom of the page it reads: "We've started the paperwork with the NCBA to form a real honest-to-goodness member-owned cooperative for bloggers, and a real honest-to-goodness member-owned cooperative for personal 1U colo is just a second set of paper. This is about as vague as a price sheet can get, but this was where we were headed before Paul popped the question on NANOG, and in April we'll be accepting member 1U units."

1 0

House Panel Slams Federal IT Security
by John Obi 17 Mar '04

17 Mar '04

Hi, Federal agencies aren't doing enough to secure their network systems, even as documented cyber-attacks against the U.S. government continue to dramatically rise, U.S. Rep. Adam Putnam (R-FL) said Thursday. For more info check http://www.internetnews.com/infra/article.php/3327081 Thanks, -J __________________________________ Do you Yahoo!? Yahoo! Mail - More reliable, more storage, less spam http://mail.yahoo.com

1 0

Re: Firewall opinions wanted please
by Michael.Dillon＠radianz.com 17 Mar '04

17 Mar '04

>> _Everyone_ (network connected) should have a firewall. > Why? Every network-connected device should have a security layer. Firewalls provide a nice modular security layer and they are cheap compared to the devices/networks that they protect. > When did the end2end nature of the Internet suddenly > sprout these mutant bits of extra complexity that reduce > the overall security of the 'net? The security issue has always been there. You can either build security into the network or into the endpoints. Given that the Internet model is to keep complexity out of the network and in the endpoints, the next question is for site administrators to ask themselves, do I manage *MY* network, like the Internet, or do I manage it like an endpoint? If the answer is to treat it as an endpoint, then it is quite appropriate to install a firewall as a gateway between the network and the Internet. Consider that many endpoints in today's world now encapsulate networks within a single physical device. Routers, switches, cellphones, cars and any embedded device using I2C. Just as the distinction between a router and a switch has been blurred by the advance of technology, so too has the distinction between an endpoint and a network. --Michael Dillon

1 0

[Fwd: Re: who offers cheap (personal) 1U colo?]
by Janet Sullivan 17 Mar '04

17 Mar '04

Stephen J. Wilcox wrote: > if the market for this is nanog and you're just looking for smtp/shell surely we > can manage this between ourselves without charge (ask your nanog buddy for a > shell as a favour).. I know I can and will do this Well, I do have motives beyond outbound smtp. I actually looked at some of the mail only services, but I really want someplace that will do IMAP and authenticated SMTP. I want to be able to configure how I filter spam, which I don't want to do at the MUA level because I'll need to access mail various ways from various locations. Besides mail, I want to be able to create and control firewall rules on the box. I also want to be able to setup Apache exactly like I want it, etc. And sometimes its nice to have shell access on a machine in a different location for troubleshooting purposes. However, I do like the idea of setting up a community of like minded individuals who would be willing to do secondary MX and/or DNS for each other, and perhaps provide basic shell accounts... On the other hand, I'm a little leary of giving someone I don't know access to one of my boxes. I'm curious how a virtual colocation or dedicated server co-op could work, with values statements on how servers must be run (secure, no SPAM), etc. Would there be member fees? Would members have to democratically vote to let new members in after some kind of vetting process? Would anyone even be interested in such an idea? It would also be interesting to see what kind of monitoring tools could be developed with a diverse set of servers in different parts of the world... could we set up a co-op version of keynote monitoring, where we helped monitor each other?

1 0

Firewall opinions wanted please
by Nicole 17 Mar '04

17 Mar '04

Hi I am looking for a good but reasonably priced firewall for a 40 or so server site. Some people swear by Pix, others swear at it a lot. Also I have heard good things about Netscreen. Or any others you would recommend for protecting servers on a busy network. Don't really need anything with VPN just the standard http, ftp, ssh, https, type traffic up to 100mb throughput. From what I have heard a proxy firewall would be best? Thanks in advance!! Nicole -- |\ __ /| (`\ | o_o |__ ) ) // \\ - nmh(a)daemontech.com - Powered by FreeBSD - ------------------------------------------------------ " Daemons" will now be known as "spiritual guides" -Politically Correct UNIX Page

8 8

ANNOUNCEMENT: RIPE NCC's Second Remote Route Collector in North America Deployed at the NYIIX (RRC11)
by Matthew Williams 17 Mar '04

17 Mar '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear All, The RIPE NCC is pleased to announce that the Routing Information Service's (RIS) second Remote Route Collector in North America, RRC11, is now ready to peer with members at the New York International Internet Exchange (NYIIX). The collector is our first outside of the RIPE region to accept IPv6 peering sessions. The RIS is also present at MAE-West in San Jose and we are currently looking for more peers there too. Please see the following URLs for peering details: - - http://www.ripe.net/ris/rrc11.html - - http://www.ripe.net/ris/rrc08.html Your BGP feeds are warmly welcome :) +++ Other RIS Developments: - ----------------------- * New web interface for RISwhois - RIPE NCC IPv4/IPv6 address to origin mapping The service looks up IPv4 or IPv6 addresses in the RIB dumps most recently collected by the RIS, and reports the prefixes and origin AS numbers which match the specified IP, as well as the RRCs that observed the prefixes. URL: http://www.ris.ripe.net/cgi-bin/riswhois.cgi * RIS 'MOAS' Report List of prefixes being advertised by Multiple Origin Autonomous Systems. URL: http://www.ris.ripe.net/moas/moas.html * Documentation on how to set up the RISng database and the associated tools An in-depth overview of the RIS database structure written by two students at the Technical University of Munich. URL: http://www.ripe.net/ris/analysis.html * Libbgpdump 1.4 is now available on the RIS web site Libbgpdump is a C library for reading Zebra/Quagga dump files with IPv4 and IPv6 support. The software package also includes 'bgpdump', a drop-in replacement for route_btoa with IPv6 support and better handling of corrupt data. URL: http://www.ris.ripe.net/source/ +++ For more info about the RIS: http://www.ripe.net/ris. Feel free to drop us a line at ris(a)ripe.net. Best regards, The RIS Team --- > Matthew Williams (MW243-RIPE) > Customer Liaison Engineer > RIPE NCC - http://www.ripe.net/np/ -----BEGIN PGP SIGNATURE----- Version: PGP 7.0.4 iQA/AwUBQFg4NMHkFbJe+GdoEQJCNACePKtzxSUuGEH41Aa8ECLgqkBFekMAoKop mq+MIgrl4q9rQ2NBhdcD5XZP =ygY7 -----END PGP SIGNATURE-----

1 0