- Test - lists.nanog.org

Re: Cutting to the chase (was RE: ABOVE.NET SECURITY TRUTHS?)
by Danny McPherson 01 May '00

01 May '00

> Since I value your input, I'm not sure if you are joking, or serious. > > I understand the humorous issues involved here (believe me, I do), > I'm really serious about this, and I need serious feedback. I was obviously joking about the "disinformation experts" comment, at least to some degree. However, I certainly do agree that it's a good idea to discuss this as you propose at the upcoming NANOG, especially in lieu of recent occurrences. I don't believe some folks realize how much people read into topics discussed on this list, or understand the impact that seemingly simple posts (accusations about Vendor A's broken software, Vendor B's broken hardware, ISP A's broken network, ISP B's poor customer service, ISP C's security practices, etc..) have on these businesses, and more so, the individuals involved, especially since those accusations are often [demonstrated] premature or completely unfounded. -danny

4 3

Re: external access and passwd mgmt (was Re: SSH on Cisco ...)
by Sean Donelan 01 May '00

01 May '00

Folks seem to be concentrating on locking down the front door. You also need to watch all the backdoors. With multi-protocol equipment, there are a lot of backdoors. Is syslog sending plaintext information, when was the last time you changed snmp community strings, do you have read-write snmp or rsh/rcp access enabled, are ancilliary services like ntp, ospf and bgp authenticated? Have you turned off any services you aren't using such as MOP? If you network load your configuration, how do you know you got your configuration? Do you understand how arp works/doesn't work. After securing your network, one security issue I rarely see explicitly addressed is what do you do when your authentication stops working for whatever reason. Have you made plans for breaking into your own network. Vendor backdoors should require physical access to the equipment (e.g. moving a switch) not just knowledge of a "secret" maintenance password or special signal over a remote control line (e.g. break).

3 2

Re: ICQ & AOL
by sthaug＠nethelp.no 01 May '00

01 May '00

> I'd venture to say that this is the result of the following phenomena: > > Block all APNIC and RIPE assigned networks at the border and all of the > sudden, hack attempts and CC fraud disappear. > > It's fan-%^&#ing-tasticly simple to do and so very effective. And if I block the ARIN assigned networks, most of the spam I receive disappears. It's very effective. In fact, I can limit myself to blocking all email from Hotmail, AOL and a few other large ISPs in the US, and that'll take care of most of the spam too... Steinar Haug, Nethelp consulting, sthaug(a)nethelp.no

3 2

Re: ABOVE.NET SECURITY TRUTHS?
by Danny McPherson 01 May '00

01 May '00

> As you pointed out to Barry Greene and myself previously, the "aaa > accounting" command as below will log commands typed in at "enable" level. > So, if you are changing the onboard router password, yes, you will see the > new password in your accounting logs, in clear text. > > However, I don't consider it good practice to keep any critical passwords > on a router when an authentication mechanism such as TACACS+ is in place. Unfornately, auth servers fail and you have to keep VTY and fallback passwords locally configured on the router. > Also, if I was modifying the onboard enable secret (last resort password > when TACACS+ or Radius is configured) at any stage, I'd tftp-load the > configuration from a remote server, not ever type it in live. I don't see how this actually changes anything though, aren't tftp'd files authorized (and therefore, logged) in a similar manner? And as wonderful as it sounds, it's not always possible in real networks. However, entering the encrypted *enable* password (w/level) would accommodate this. Though, of course, the BGP TCP MD5 stuff and the VTY passwords (and most other passwords) still don't support the ~non-reversible encryption algorithm. As for this entire thread, it's seems now to be more appropriate for cisco-nsp or the like. -danny

1 0

Avoid Fines And Speeding Tickets!!!
by fiy10＠box.nl 01 May '00

01 May '00

INTERNATIONAL DRIVER'S LICENSE Need a new driver's license? Too many points or other trouble? Want a license that can never be suspended or revoked? Want ID for nightclubs or hotel check-in? Avoid tickets, fines, and mandatory driver's education. Protect your privacy, and hide your identity. The United Nations gave you the privilege to drive freely throughout the world! (Convention on International Road Traffic of September 19, 1949 & World Court Decision, The Hague, Netherlands, January 21, 1958) Take advantage of your rights. Order a valid International Driver's License that can never be suspended or revoked. Confidentiality assured. CALL NOW!!! 1-937-586-9313 rem-- fikle445(a)netexecutive.com

1 0

Re: How long before NIPC decides we need one of these?
by Chris Adams 01 May '00

01 May '00

On 04/30/00 11:00:12 PM gfresen(a)ais.net wrote: >No, it's worse than that. With your private key in their hands, they can >write >messages, put on appropriate dates and sign them ... then say that you wrote >them. (depending upon the technology that is used) Yes. Couple that with treating key confiscation as a minor thing and I'd be surprised if someone's key didn't end up accidentally being sent to a well- connected competitor. One possible line of defense other than complete civil disobediance might be providing only the session key(s) used for encrypted documents instead of the key-pair. It'd be interesting to see if the courts accept this.

1 0

SSH on Cisco Routers (was RE: ABOVE.NET SECURITY TRUTHS?)
by Ron Buchalski 01 May '00

01 May '00

SSH1 is supported on the following platforms starting in 12.1(1)T: C17x0, C25xx, C26xx, C36xx, C4x00, C7x00 See: http://www.cisco.com/warp/customer/cc/cisco/mkt/ios/rel/121/prodlit/1065_pp… -rb >From: "Mr. James W. Laferriere" <babydr(a)baby-dragons.com> >To: "Greene, Dylan" <DGreene(a)NaviSite.com> >CC: "'Paul Froutan'" <pfroutan(a)rackspace.com>, rmeyer(a)mhsc.com, >nanog(a)merit.edu >Subject: RE: ABOVE.NET SECURITY TRUTHS? >Date: Fri, 28 Apr 2000 14:34:14 -0700 (PDT) > > > > Hello Dylan, Knew this was coming . But I'd hoped that > the supported platforms would have been a little larger . > Just the 7200 & UP . Seems cisco thinks ssh puts a bit > of load on a cpu ? I can't see that for just a terminal > session though . Twyl, JimL ________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com

4 3

RE: ABOVE.NET SECURITY TRUTHS?
by Greene, Dylan 01 May '00

01 May '00

Maybe I should read the entire message before responding.. hehe.. =) A switched private management lan resolves the cleartext problem. SSH version 1 is apparently supported in 12.0 as well (never played w/ it, so dunno how well it works); http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/120newft/120 limit/120s/120s5/sshv1.htm ..Dylan | -----Original Message----- | From: Paul Froutan [mailto:pfroutan@rackspace.com] | Sent: Friday, April 28, 2000 4:46 PM | To: rmeyer(a)mhsc.com | Cc: nanog(a)merit.edu | Subject: RE: ABOVE.NET SECURITY TRUTHS? | | | | I don't think you can. However, I use TACACS on all my switches and | routers. From what I know, TACACS passwords are encrypted | using the key on | your network devices and the TACACS server. So, that, in | combination with | a private management LAN not accessible by your customers | should lock down | your network pretty effectively. Any comments? | | At 4/28/00 -0700, you wrote: | | > > Exiled Dave | > > Sent: Friday, April 28, 2000 1:10 PM | > | > > Lets think about this, cisco in no way has such a flaw | > > that would allow someone to 'root' and erase all the | > > info on switches. The password was sniffed. | > | >Can one setup SSH on a Cisco 6509? | | Paul Froutan Email: | pfroutan(a)rackspace.com | Rackspace, Ltd <http://www.rackspace.com> | |

7 8

Re: ABOVE.NET SECURITY TRUTHS?
by Danny McPherson 01 May '00

01 May '00

IMO, it requires more than this. Ideally, one-time, token-based (i.e. SecurID) passwords, coupled with SSH, is the best solution, especially with the turnover rates at providers these days. Of course, this also requires that all the backend (RADIUS, configuration management, etc..) and out-of-band systems are secure, which is another rathole altogether. As for this incident, well, I think if the intial intent of the "divulging message" was simply to remind folks to change their passwords, the points been made. -danny > > I don't think you can. However, I use TACACS on all my switches and > routers. From what I know, TACACS passwords are encrypted using the key on > your network devices and the TACACS server. So, that, in combination with > a private management LAN not accessible by your customers should lock down > your network pretty effectively. Any comments?

2 1

Re: ABOVE.NET SECURITY TRUTHS?
by Exiled Dave 30 Apr '00

30 Apr '00

Ive had some private messages asking if i was involved in this. I wasnt. I was asked to write this initial email by someone who KNOWS the real truth of what happened at above, and why they are being so tight-lipped. Lets think about this, cisco in no way has such a flaw that would allow someone to 'root' and erase all the info on switches. The password was sniffed. Unless above has some employee who felt the need to do do this. But, my Above rep laughling CONFIRMED that this was the problem. COMMON PASSWORDS. Cant we make it a LITTLE tougher on the script kiddies? And not make EVERY MAJOR switch the same password? This is safe to post, because my above sales rep told me what the old password was. God. THATS SECURITY. Sales reps telling Clients OLD PASSWORDS. So, if we wanna verify my authenticity, Here's what she told me: whY2Ghay/1Pee-Fr331y Sound framiliar Above? Im suprised by lack of comment from you. Im out to HELP. Not to hurt. __________________________________________________ Do You Yahoo!? Talk to your friends online and get email alerts with Yahoo! Messenger. http://im.yahoo.com/

10 10