- Test - lists.nanog.org

RE: "top secret" security does require blocking SSH
by rdobbins＠netmore.net 10 Jul '00

10 Jul '00

They're well aware of the excellent points you make, I assure you. -----Original Message----- From: Alexei Roudnev [mailto:alex@relcom.net] Sent: Monday, July 10, 2000 10:29 AM To: rdobbins(a)netmore.net; nanog(a)merit.edu; gwoods(a)acm.org Subject: Re: "top secret" security does require blocking SSH Btw, it's NOT ENOUGPH. I mean - if , for example, Dod have hight classifyed network, and they cut all connections to the Internet (that's obvious) - they are not yet SAFE. They should prevent access to their network from the computers used for the Internet network - too. It can be - notebooks which are used for the classified access, but sometimes are used to read a public mail; that should not be dialup access, etc etc. On the other hand, it's not difficult to allow mail exchange with Internet (of course, no any objects, word files, attachments; but text messages are non unsecure from the network (not content) piont of view. And talking about original message - it's not about 22'th port; the problem appear if you allow ANY kind of access not controlled by the network admin. In my practice, we restricted 22 port and allowed telnet port, because we have used one time passwords (but ssh with OTP is much more secure than telnet with OTP). And just again, this is only a small brick in the wall. ----- Original Message ----- From: <rdobbins(a)netmore.net> To: <nanog(a)merit.edu>; <gwoods(a)acm.org> Sent: Sunday, July 09, 2000 1:48 PM Subject: "top secret" security does require blocking SSH > > > You are correct, it cannot. > > I've spent a good portion of my career working on networks which are > CLASSIFIED or higher. There are very strong restrictions on > simultaneous interconnection between systems of varying > classifications. In most cases, complete -physical- isolation is > required, although waivers may be obtained on a case-by-case basis. The > enforcement of these policies of course varies between agencies, > bureaus, and departments. I remember just a year-and-a-half ago > installing fibre switchboxes on some USAF nodes which at various times > needed to have connectivity to networks of varying security levels. > This is slowly changing at the lower levels due to the advances in > proxying technology, etc., but when you reach TS/SCI or SAP/SAR it's a > different story, and understandably so. > > As a side note, the reason the first version of Microsoft Exchange, 4.0, > was so late was due in large part to the fact that Microsoft wanted to > bid on the Defense Messaging System, or DMS contract. DMS supports all > levels of classification and types from UNCLASSIFIED all the way through > FLASH, CRITIC, etc. The powers that be understand that an > application-level service like messaging has to be able to cross such > boundaries, but only with strong rules which prevent the dissemination > of information of higher sensitivity to those who aren't cleared for > same. > > To the best of my knowledge, there are no networks in DoD, the armed > forces, or various other arms of the U.S. government which are ranked as > SECRET or above which have any form of Internet connectivity at anything > less than two removes. One of the reasons that it's so hard for them to > come up with a coherent and workable overall information security policy > is because of the (very necessary, more so than the typical slashdotter > tends to believe) compartmentalization of information - and hence, IT > resources - within various organizations which deal with sensitive > information and issues. > > "Greg A. Woods" wrote: > > > > [ On Sunday, July 9, 2000 at 08:22:46 (-0700), Roeland M.J. Meyer wrote: ] > > > Subject: RE: RBL-type BGP service for known rogue networks? > > > > > > In many organizations, a system isn't considered secure unless > > > port 22 is blocked, at the firewall. It is, after all, the secure > > > port, that must mean that you have to block it to be secure, > > > right? > > > > Yes, that's exactly right, but not for the reasons you imply. > > > > If the primary concern of a security policy is that covert channels must > > be prevented then it is absolutely mandatory that port-22 be blocked > > since it is by definition a covert channel. > > > > However having any kind of Internet connection, proxied or not, into a > > site where sensitive information must not be allowed to be leaked is in > > effect a violation of the policy. > > > > Unfortunately we're rapidly approaching (if we're not already there) a > > state of affairs where it is impossible to technically prevent inbound > > and outbound covert channels wherever people are required to interact in > > a privileged way with security sensitive systems. A paper given at last > > year's ACM New Security Paradigms Workshop by Dean Povey ("Optomistic > > Security: A New Access Control Paradigm") suggests that it might be > > better to adopt the view that security officers should "Make the users > > ask forgivness not permission." Whether this paradigm can successfully > > be delployed in top secret (or higher) environments or not is yet to be > > discussed. I suspect it can but then I'm not an expert in traditional > > forms of high security. > > > > -- > > Greg A. Woods > > > > +1 416 218-0098 VE3TCP <gwoods(a)acm.org> <robohack!woods> > > Planix, Inc. <woods(a)planix.com>; Secrets of the Weird <woods(a)weird.com> > > -- > ----------------------------------------------------------- > Roland Dobbins <mordant(a)gothik.org> // 818.535.5024 voice > > One of the surest signs of the philistine is his reverence > for the superior tastes of those who put him down. > > -- Pauline Kael > >

1 0

Re: Open Question About AS Number assignments...
by Scott Marcus 10 Jul '00

10 Jul '00

At 02:54 07/10/2000 -0700, David R Huberman wrote: > ... >> 5) Is there a advantage to having a lower AS number? > >Some network operators measure the size of their, um, "networks", by >the lowness of their primary AS (Scott Marcus-envy). :> ... Ummm, thanks, I think. :-) Yes, the lower numbers have sort of a nice cachet to them, and we're certainly happy with ours; however, I would think of it as being more like having a low employee number on your company ID badge. It says more about your longevity and seniority than it does about your rank (or in this case, network size). - Scott Marcus (CTO, Genuity [AS 1])

3 2

A Conversation With Stratton Sclavos (WashPost)
by David Lesher 10 Jul '00

10 Jul '00

http://www.washingtonpost.com/cgi-bin/gx.cgi/AppLogic+FTContentServer?pagen… By Leslie Walker Monday , July 10, 2000 ; F05 The $15.3 billion merger of electronic security firm VeriSign Inc. and domain name king Network Solutions Inc. was the largest deal in Internet history. Analysts say the combined company likely will be one the Internet's most powerful players because it will maintain the Web address infrastructure and be well positioned to to offer e-commerce services to companies registering Internet domains. ............ He outlined many other projects underway: Network Solutions is taking over from volunteer groups the big computers that have run much of the dot-com address system for years....... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Open Question About AS Number assignments...
by Aaron Moreau-Cook 10 Jul '00

10 Jul '00

I was noticing that larger backbone providers, who have merged with other large backbone providers, seem to keep both AS numbers. Let's take Verio as a example, though Verio is only one of many who have multiple AS numbers. Verio has 8 AS numbers, AS 93, 97, 114, 275, 280, 253, 1225 and 2914. I noticed that there are no IP routes associated with 6 of the 8 AS numbers and that only AS 97 & AS 2914 has any IP routes. My questions are: 1) Is there a easy mechnisim to give back AS numbers to the ARIN? 2) Would ARIN even reallocate those AS numbers to new requesters? 3) Could those AS numbers be transfered over to new organizations? 4) Is there a advantage for a organzation to have multiple AS numbers? 5) Is there a advantage to having a lower AS number? Thanks!

4 3

RE: RBL-type BGP service for known rogue networks?
by Hal Murray 10 Jul '00

10 Jul '00

From: "Roeland M.J. Meyer" <rmeyer(a)mhsc.com> > I agree. MHSC lost an entire market plan, hosting third-party secure > mail, becasue third-party mail services must allow relaying that > is at minimum semi-open. At the time SMTP AUTH didn't exist (Until > it's use becomes more wide-spread it still isn't real useful). The > anti-relay bunch are killing a valid business model. This brings up an interesting point that I haven't seen discussed much. What should happen when various business models for using the internet conflict? Who gets to decide? Or how do we collect and distribute the information so individual sites can decide for themselves? I think all the examples I know about involve network abuse, or at least activities that will be considered as network abuse by many sensible people. Maybe the common theme is cost-shifting. I'm including support costs as well as up-front traffic/server costs. The obvious example is an ISP who wants to take spammers as customers, or host web servers for spammers. The next example is an ISP with a good looking anti-spam section in their AUP but they take a long time to enforce it. How long should it take to disconnect a flagrant spammer? ... How about ISPs that tolerate crackers or smurfers? What about ISPs that are just slow or incompetent at backtracking abusive traffic with forged headers or setting up filters to drop forged headers from their customers? AllAdvantage is another good example to consider. I have no interest in what they offer and I generally like having new/different businesses connected to the internet. But their system encourages spam, so we all get to pay for AllAdvantage's business in increased spam-fighting costs. I'm sure they could stop the spam (or rather almost all of it), but that would increase their costs. Another example that was recently mentioned was ISPs that are teaming up with phone companies. The phone company does the billing and gives the ISP a cut so the ISP doesn't have to keep customer records and hence those ISPs will have troubles disconnecting crackers. Again, the ISPs could do a reasonable job of making sure their customers are good netizens, but it will raise their cost of doing business.

4 3

RE: RBL-type BGP service for known rogue networks?
by Richard A. Steenbergen 10 Jul '00

10 Jul '00

On Sun, 9 Jul 2000, Hal Murray wrote: > I think all the examples I know about involve network abuse, or at > least activities that will be considered as network abuse by many > sensible people. Maybe the common theme is cost-shifting. I'm > including support costs as well as up-front traffic/server costs. > > The obvious example is an ISP who wants to take spammers as customers, > or host web servers for spammers. The next example is an ISP with a > good looking anti-spam section in their AUP but they take a long time > to enforce it. How long should it take to disconnect a flagrant > spammer? ... > > How about ISPs that tolerate crackers or smurfers? What about ISPs > that are just slow or incompetent at backtracking abusive traffic with > forged headers or setting up filters to drop forged headers from their > customers? I suspect there isn't anyone on this list who has told someone (or at least thought about telling someone) "you're too stupid to use the internet, go away". Stupid people generally don't like being told they are stupid, and as much as we may not like it, they continue to use the internet anyways. There is no IQ test given to those who get internet connections, no licensing, no qualification exam, so we'll pretty much have to accept that stupid people will find their way into our lives, then proceed to setup open mail relays, networks with open directed broadcasts, and RedHat Linux machines. These people may later go on to realize the errors of their ways, but as long as experienced people keep dieing and new people keep getting born, people will make mistakes. Auditing and security your servers and mail relays, having people trained in tracing spoofed packet streams or catching the crackers, having equipment capable of DOING it (if this is even possible), and having sufficient numbers of people necessary to handle the tasks (ever tried responding to the number of spam complaints a fair sized ISP gets, and seperating the false claims from the real ones? Its not fun), is NOT a cheap or easy proposition. So the question is, how do we want to get "other networks" to provide the things? Educate them? Motivate them? Threaten them? Sue them? Ignore them? What do we consider to be an acceptable level of time where we try to be nice, before we decide that they're not going to respond without being not-nice? Who makes this decision? The only way it will be sufficiently "under control" for some people's tastes will be government regulation forcing people to meet a certain level of standards in these things. Thats obviously not what we want. But let me ask this... how many of us who complain about other people's networks and lack of response when we need help, actually run perfect networks outselves? Can you honestly say you have every mail relay in your network accounted for and secured? Can you honestly say you have every one of your customers RFC2267 filtered so they can't attack others? Can you honestly say you have training and policies in place for the expiditious tracing of spoofed packets across your network? Can you honestly say you look into every spam and abuse complain you receive, correctly seperate the real incidents from the paranoia, and handle all issues in a timely fashion? I suspect if your network is of any real size, the answer is NO. So why don't we all take a little bit of time to go work on these things in our own networks now, then encourage our customers to do the same. Just a thought. :P -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/humble PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

1 0

Alright, ORBS sucks - next topic, please ;) [was RE: RBL-type BGP service for known rogue networks?]
by rdobbins＠netmore.net 10 Jul '00

10 Jul '00

I -do- have a postmaster account, and there's nothing broken on my mail server. I *don't run an open relay*. I provide SMTP service to my clients *in conformance with the relevant RFCs*, as well as reasonable and prudent security practices. I'm not a spam-house; I have internal mechanisms for detecting such activity before it becomes a problem for others, in most cases. When something slips through the cracks, I jump on it immediately. It's great that their 'service' helped you; however, some of us would prefer to rely upon our own skills and experience to ensure that our systems are properly set-up. I no more want the ORBS people forging mail via my server than I do the 'MAKE MONEY FAST' people, and their attitude belies a stunning arrogance coupled with extreme shortsightedness, which isn't something any of us should wish for in an organization whose stated aim is to improve the user experience. And that's enough of that. -----Original Message----- From: Eric A. Hall [mailto:ehall@ehsco.com] Sent: Saturday, July 08, 2000 12:08 PM To: rdobbins(a)netmore.net Cc: nanog(a)merit.edu Subject: Re: RBL-type BGP service for known rogue networks? > ORBS forge headers (thereby violating the RFC) to look as if they're > coming from domains you host, then if it goes through, they put you > in their little black book for being an 'open relay'. No notice, > nothing. The last part of that statement is simply untrue. I got ORBS'd once and they notified me via postmaster@domain. If you don't get notified then you don't have a postmaster account for the domain, and it is you who are in violation of the RFCs. As for the "forge headers in violation" part, they have to test the common variations. Who cares if they do that as a one-off probe. If they were doing it all the time it would be a problem, but once is nothing. Of course, the spammers who are using your server as an open relay are certainly violating that and much more, so if it really bothers you close your freaking relay. ;) I for one was happy for the free and comprehensive testing. It pointed out a whole I had missed in my config. Once patched, I was out of the ORBS database in less than 24 hourse, and was able to get out on my own just by filling out a form on their web site that kicked off an automated retesting. I think ORBS provides an excellent service, and I say that because my experience says that they rely entirely upon factual evidence before they block, and it is easy to get out of the database once you provide evidence that you have fixed your server. -- Eric A. Hall http://www.ehsco.com/ Internet Core Protocols http://www.oreilly.com/catalog/coreprot/

7 9

"top secret" security does require blocking SSH
by rdobbins＠netmore.net 09 Jul '00

09 Jul '00

You are correct, it cannot. I've spent a good portion of my career working on networks which are CLASSIFIED or higher. There are very strong restrictions on simultaneous interconnection between systems of varying classifications. In most cases, complete -physical- isolation is required, although waivers may be obtained on a case-by-case basis. The enforcement of these policies of course varies between agencies, bureaus, and departments. I remember just a year-and-a-half ago installing fibre switchboxes on some USAF nodes which at various times needed to have connectivity to networks of varying security levels. This is slowly changing at the lower levels due to the advances in proxying technology, etc., but when you reach TS/SCI or SAP/SAR it's a different story, and understandably so. As a side note, the reason the first version of Microsoft Exchange, 4.0, was so late was due in large part to the fact that Microsoft wanted to bid on the Defense Messaging System, or DMS contract. DMS supports all levels of classification and types from UNCLASSIFIED all the way through FLASH, CRITIC, etc. The powers that be understand that an application-level service like messaging has to be able to cross such boundaries, but only with strong rules which prevent the dissemination of information of higher sensitivity to those who aren't cleared for same. To the best of my knowledge, there are no networks in DoD, the armed forces, or various other arms of the U.S. government which are ranked as SECRET or above which have any form of Internet connectivity at anything less than two removes. One of the reasons that it's so hard for them to come up with a coherent and workable overall information security policy is because of the (very necessary, more so than the typical slashdotter tends to believe) compartmentalization of information - and hence, IT resources - within various organizations which deal with sensitive information and issues. "Greg A. Woods" wrote: > > [ On Sunday, July 9, 2000 at 08:22:46 (-0700), Roeland M.J. Meyer wrote: ] > > Subject: RE: RBL-type BGP service for known rogue networks? > > > > In many organizations, a system isn't considered secure unless > > port 22 is blocked, at the firewall. It is, after all, the secure > > port, that must mean that you have to block it to be secure, > > right? > > Yes, that's exactly right, but not for the reasons you imply. > > If the primary concern of a security policy is that covert channels must > be prevented then it is absolutely mandatory that port-22 be blocked > since it is by definition a covert channel. > > However having any kind of Internet connection, proxied or not, into a > site where sensitive information must not be allowed to be leaked is in > effect a violation of the policy. > > Unfortunately we're rapidly approaching (if we're not already there) a > state of affairs where it is impossible to technically prevent inbound > and outbound covert channels wherever people are required to interact in > a privileged way with security sensitive systems. A paper given at last > year's ACM New Security Paradigms Workshop by Dean Povey ("Optomistic > Security: A New Access Control Paradigm") suggests that it might be > better to adopt the view that security officers should "Make the users > ask forgivness not permission." Whether this paradigm can successfully > be delployed in top secret (or higher) environments or not is yet to be > discussed. I suspect it can but then I'm not an expert in traditional > forms of high security. > > -- > Greg A. Woods > > +1 416 218-0098 VE3TCP <gwoods(a)acm.org> <robohack!woods> > Planix, Inc. <woods(a)planix.com>; Secrets of the Weird <woods(a)weird.com> -- ----------------------------------------------------------- Roland Dobbins <mordant(a)gothik.org> // 818.535.5024 voice One of the surest signs of the philistine is his reverence for the superior tastes of those who put him down. -- Pauline Kael

1 0

Lurking lawyers
by Sean Donelan 09 Jul '00

09 Jul '00

On Thu, 06 July 2000, Steve Sobol wrote: > However, unless there's something I don't know about you guys, > there are no lawyers or judges amongst the readers of NANOG. Actually, there are several lawyers lurking on NANOG. The direct and indirect readership of NANOG is rather diverse, extending far beyond network operators. I don't know if either of the inventors of the Internet (Al Gore or Vint Cerf) get copies of any of the messages, but lots of reporters, researchers, spies, hackers, law enforcement officers, regulators, inspector generals, policy makers, lobbyists and wonks do.

5 5

PacBell: San Jose equipment problems
by Sean Donelan 09 Jul '00

09 Jul '00

Pacific Bell has equipment problems affecting PBI Internet access for subscribers in the San Jose area. As far as I can tell, it is only affecting PBI customers. Subscribers using other ISPs as their uplink seem ok. PBI's service level promise is a bit weak. Quoting from PBI's terms and conditions for DSL service: "You understand and agree that temporary interruptions of the Service may occur as normal events in the provision of the Service." Its a sad day when service interruptions are viewed as normal events. In other news, the San Bruno Fire Department issued a preliminary report saying an accident by workers using cutting torches above the cable manhole led to the cable fire June 26. Pacific Bell is expected to be the first one with a claim for damages.

1 0