- Test - lists.nanog.org

UDP packet/DNS server
by Tatsuya Kawasaki 29 Sep '98

29 Sep '98

Hello Nanog, I am trying get zone trasfer from a host, but it seems that because of firewals?, I can not get any record. They acknowelged that there is a host behind the firewalls but they claim it should not affect it. (I don't believe it.) But I don't know how to check/prove that if certain host can receive/send an UDP packet. TIA, Tatsuya かわさき TK3197 = = = = = = Business Network Telecom (BNT) ビジネスネットワークテレコム株式会社〒111-0053　東京都台東区浅草橋3-8-5 31山京ビル6階 TEL 03-5687-3945 FAX 03-5687-6009 http://www.giganet.net

6 7

Your class 'B' address space (fwd)
by howland＠Priss.com 29 Sep '98

29 Sep '98

Just to add fuel to the fire, he seems to have sent out *another* one. This is really getting old, Mark. Curt- ----- Forwarded message from Curt Howland ----- >From mvickers(a)real.com Tue Sep 29 11:04:32 1998 X-Sender: mvickers(a)mail.prognet.com X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.2 (32) Date: Tue, 29 Sep 1998 11:01:23 -0700 To: bquijalv(a)ENCORE.COM, mdavison(a)UNLINFO.UNL.EDU, boening.pad(a)SNI.DE, system(a)BEACH.UTMB.EDU, D.Nash(a)UTEXAS.EDU, copeland(a)UNT.EDU, tribunes(a)KODAK.COM, jackie(a)TRAVIS.CSD.HARRIS.COM, Fred.Lowe(a)SUN.COM, dalewl(a)RADIAN.COM, benbenek(a)SED.JSC.NASA.GOV, NSIOPS(a)NSIPO.NASA.GOV, NSIOPS(a)NSIPO.NASA.GOV, lncc(a)lerc.nasa.gov, pbl(a)SEBANK.SE, Patrick.RAMAHEFA(a)BULL.NET, norm(a)TC.FLUKE.COM, lm-nic(a)LMCO.COM, shearer(a)THOMAS.GE.COM, lm-nic(a)LMCO.COM From: Mark Vickers <mvickers(a)real.com> Subject: Your class 'B' address space Content-Length: 291 You appear to have a class B net that isn't reachable from my site, or perhaps your net is entirely behind a fire wall? Anyway, I'm wondering if you want to try to sell your class -B address space? Best price someone has offered me so far was $200,000 Mark Vickers RealNetworks, Inc. ----- End Included Message -----

1 0

PSInet?
by sigma＠pair.com 29 Sep '98

29 Sep '98

Is anyone else seeing that PSInet has disappeared this morning? Or mostly disappeared? I can reach them only via Sprint to MAE-East. UUnet and Digex both go nowhere. Something wrong with PSInet's private peerings? Kevin

4 5

RE: Any Cisco-experienced folks wanna tackle this one?
by Bonin, Brad T 29 Sep '98

29 Sep '98

99.9% sure it is not a hw problem nor is it your IOS version. If flash is not being loaded or is crashing during load, you might have to reload microcode. If flash is loaded and an attempt is made to load the config file from NVRAM and it crashes, then I suggest you go into ROMMON> and erase your NVRAM and reload. This has fixed the same problem for me in the past. The problem usually lies in a file being corrupted during a power down. If you need more assistance, please respond directly. Brad Bonin Internetwork Engineering - EDS -----Original Message----- From: Jason Lixfeld [mailto:jlixfeld@idirect.com] Sent: Tuesday, September 29, 1998 12:32 AM To: Kevin Brown Cc: nanog(a)merit.edu Subject: Re: Any Cisco-experienced folks wanna tackle this one? So I take it you cannot load the IOS in the flash? Have you tried getting into ROMMON> by breaking the boot? That may help decipher where the problem lies. It may be the pre-boot flash (I think the Ciscos have a shrunken bootflash and then a full size IOS image in flash). My $0.02. On Mon, 28 Sep 1998, Kevin Brown wrote: > I will expect replies to this message directly as it doesn't really fit > into the normal fodder for nanog, but it is a last ditch effort for problem > resolution. > > I have a customer who I am integrating into our network via a T1 link and > have already gotten all the nominal routing setup prepared. This customer > is using RFC1918 addressing on his LAN, and requires a firewall-type > solution with NAT capabilities. Bless this customer for thinking ahead > with his internal addressing :=) > > Anyway, I have run into a problem with his hardware/software provisioning > and I think this can be recreated in a lab environment: > > Cisco 1601 router > 6 MB Flash > 4 MB DRAM > WIC-1DSU-56K4 > IP Plus/Firewall IOS version 11.3 > (actual image name: c1600-nosy-mz.113-3.T ) > > Everytime I have start the router, I get a software crash that TAC says > should not be happening. > > If anyone else might have this equipment setting around, and be willing to > replicate this and see what happens for you, I would much appreciate > hearing about it. I'm thinking I've found an ewps in the code/hardware > configuration and have just provisioned a non-working solution. I'd like to > hear what the rest of you might come up with. Yes, I know it's a small > configuration, but surely we've all got lessor routers in the field with > similar requirements. > > > Thanks in advance if you would assist > > Kevin Brown >

1 0

Re: Remote Shell
by Adam D. McKenna 29 Sep '98

29 Sep '98

This will work if you have no passphrase on your RSA key. This is a *really* stupid thing to do, IMHO, especially to a root account, as anyone who manages to get access to your ~/.ssh/identity file will be able to log into any host that you have set this up on, without a password. While it's a little more secure than .rhosts authentication, the absence of any kind of password/passphrase validation makes it (again IMHO) an undesirable option for the security conscious. --Adam -----Original Message----- From: Zachary McGibbon <mzac(a)uunet.ca> To: Roeland M.J. Meyer <rmeyer(a)mhsc.com> Cc: Benicio Miguel Sanchez Fuentes <bsanchez(a)alestra.com.mx>; NorthAm Net Ops Grp List <nanog(a)merit.edu> Date: Tuesday, September 29, 1998 1:42 AM Subject: Re: Remote Shell You can perform 'rsh' type commands with ssh as well... here's an example: /# ssh servername w root@servername's password: <type password here> 10:45pm up 19 days, 6:31, 2 users, load average: 0.18, 0.11, 0.09 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT root ttyp0 client 8:08pm 2:37m 0.27s 0.10s You can also setup authorized keys on the server side. In your home dir on the server, go into the '.ssh' dir, and create a file called 'authorized_keys', then on your workstation, type 'ssh-keygen'. In your home dir, go into '.ssh' and take the contents of 'identity.pub' and copy that to the 'authorized_keys' on the server side. Then 'chmod 600 authorized_keys' on the server side. Then it won't ask you for a password when you ssh to that machine. It's usefull if you want to set this up as a cronjob to do something on a remote machine. On Mon, 28 Sep 1998, Roeland M.J. Meyer wrote: > Set up SSH <http://www.datafellows.com> and open port 22. I would NOT allow > plain ol' telnet over the Internet. SSH is free for non-commercial use and > is works quite well under HP-UX. > > > > At 01:32 PM 9/28/98 -0500, you wrote: > >I need to give remote shell access to a user in a server (an HP-9000 k410 > >running HP-UX 10.10) conected to mine through a 3Com router, I have done > >some investigation and what I have found is that I have to open port 514 > >for tcp, for some reason this did not work, so I opened (temporarily of > >course) all the ports on the router....and it worked, but I donŽt want to > >leave it like that, Does anyone now what port(s) I need to leave open to > >alow the remote shells?. > > > >Is there any configuration needed other than the equiv.hosts and (or) the > >.rhosts files ? > > > >Thanks in advance for your answers > > > >Benicio Sanchez > >Network Operations Engineer > >Alestra > > > > _________________________________________________ > Morgan Hill Software Company, Inc. > Colorado Springs, CO - Livermore, CA - Morgan Hill, > CA > Domain Administrator > MHSC2-DOM and MHSC3-DOM > Administrative and Technical contact > ____________________________________________ > InterNIC Id: MHSC hostmaster (HM239-ORG) > e-mail: <mailto:hostmaster@mhsc.com>mailto:hostmaster@mhsc.com > web -pages: <http://www.mhsc.com/>http://www.mhsc.com/ > ____________________________________________ > A group of politicians deciding to dump a President because his morals > are bad is like the Mafia getting together to bump off the Godfather for > not going to church on Sunday. > -- Russell Baker > Zachary McGibbon mzac(a)uunet.ca

3 2

Re: UDP packet/DNS server
by shields＠crosslink.net 29 Sep '98

29 Sep '98

In article <19980928210036.A24460(a)qual.net>, Christopher Neill <chrisn(a)qual.net> wrote: > Allowable characters in hostnames are: > > a-zA-Z0-9 > > I think / is also allowable, and there is an RFC on this subject. Go to > ftp://nic.ddn.mil/pub/rfc to check. No it is not. However, hyphens are. But, the element "*" is a special case, with different semantics to go with its different syntax. -- Shields, CrossLink.

1 0

Any Cisco-experienced folks wanna tackle this one?
by Kevin Brown 29 Sep '98

29 Sep '98

I will expect replies to this message directly as it doesn't really fit into the normal fodder for nanog, but it is a last ditch effort for problem resolution. I have a customer who I am integrating into our network via a T1 link and have already gotten all the nominal routing setup prepared. This customer is using RFC1918 addressing on his LAN, and requires a firewall-type solution with NAT capabilities. Bless this customer for thinking ahead with his internal addressing :=) Anyway, I have run into a problem with his hardware/software provisioning and I think this can be recreated in a lab environment: Cisco 1601 router 6 MB Flash 4 MB DRAM WIC-1DSU-56K4 IP Plus/Firewall IOS version 11.3 (actual image name: c1600-nosy-mz.113-3.T ) Everytime I have start the router, I get a software crash that TAC says should not be happening. If anyone else might have this equipment setting around, and be willing to replicate this and see what happens for you, I would much appreciate hearing about it. I'm thinking I've found an ewps in the code/hardware configuration and have just provisioned a non-working solution. I'd like to hear what the rest of you might come up with. Yes, I know it's a small configuration, but surely we've all got lessor routers in the field with similar requirements. Thanks in advance if you would assist Kevin Brown

2 1

Remote Shell
by Benicio Miguel Sanchez Fuentes 29 Sep '98

29 Sep '98

I need to give remote shell access to a user in a server (an HP-9000 k410 running HP-UX 10.10) conected to mine through a 3Com router, I have done some investigation and what I have found is that I have to open port 514 for tcp, for some reason this did not work, so I opened (temporarily of course) all the ports on the router....and it worked, but I don´t want to leave it like that, Does anyone now what port(s) I need to leave open to alow the remote shells?. Is there any configuration needed other than the equiv.hosts and (or) the .rhosts files ? Thanks in advance for your answers Benicio Sanchez Network Operations Engineer Alestra

4 3

WEATHER: update Puerto Rico/South Florida
by Sean Donelan 29 Sep '98

29 Sep '98

300 dead so far (200 Dominican Republic, 87 Haiti, others spread out over several different islands) Once again, my information is limited to where DRA has customers. So I don't know about other areas. South Florida: Light to moderate damage. Power outage in the keys and spot outages in south Florida. Most telephone and Internet service continued to function. Puerto Rico: Latest word I have from people on the island, is they are still without telephone, electricity or water. At least 50% of the telephone poles on the island have been knocked down. I don't have word specifically about the satellite teleport in Puerto Rico. Currently emergency officials are working on restoring utility service to these facilities, in this order 1. Emergency services, hospitals, designated shelters 2. Water and sewerage plants 3. Telephone and other communication services Estimates are it will be Monday before priority services have been restored. Major urban areas by the end of next week (Oct 2). Other News: Does anyone have any more information about Worldcom's outage last night in Mississippi? The only information we received was it involved hazardous materials. BTW, last Friday I attended a briefing at the Department of Commerce about the process the US Government is embarking on to work on a "private-public" partnership with the "Information and Communications" sector as part of their Critical Infrastructure Assurance Program. I didn't recognize anyone from a "post cold war" company in attendence. Essentially no Internet backbone representation, with maybe the possible exception of AT&T. Not that anyone missed anything. I wonder what the press thought of the briefing. -- Sean Donelan, Data Research Associates, Inc, St. Louis, MO Affiliation given for identification not representation

3 2

Re: Remote Shell
by Sudeep_Khuraijam＠3com.com 28 Sep '98

28 Sep '98

Benicio, The Firewall services can be configured to log in varying degrees of detail , so you should be able to see the ports and policies following which it is denied. A sample of such a syslog would look like:: Aug 19 09:55:13 3ComFirewall-Router #206 Sun Aug 19 08:56:28 1998 R.R.R.1 FireWall "Rx !5 X.X.X.69(33004)->Y.Y.Y.11(DNS) UDP Deny SrcSpoof" IPs::R-Firewall router X-Source (port) Y-Destination (port) Sudeep At 01:32 PM 9/28/98 -0500, you wrote: >I need to give remote shell access to a user in a server (an HP-9000 k410 >running HP-UX 10.10) conected to mine through a 3Com router, I have done >some investigation and what I have found is that I have to open port 514 >for tcp, for some reason this did not work, so I opened (temporarily of >course) all the ports on the router....and it worked, but I don´t want to >leave it like that, Does anyone now what port(s) I need to leave open to >alow the remote shells?. > >Is there any configuration needed other than the equiv.hosts and (or) the >.rhosts files ? > >Thanks in advance for your answers > >Benicio Sanchez >Network Operations Engineer >Alestra >

1 0