Re: external access and passwd mgmt (was Re: SSH on Cisco ...)
Folks seem to be concentrating on locking down the front door. You also need to watch all the backdoors. With multi-protocol equipment, there are a lot of backdoors. Is syslog sending plaintext information, when was the last time you changed snmp community strings, do you have read-write snmp or rsh/rcp access enabled, are ancilliary services like ntp, ospf and bgp authenticated? Have you turned off any services you aren't using such as MOP? If you network load your configuration, how do you know you got your configuration? Do you understand how arp works/doesn't work. After securing your network, one security issue I rarely see explicitly addressed is what do you do when your authentication stops working for whatever reason. Have you made plans for breaking into your own network. Vendor backdoors should require physical access to the equipment (e.g. moving a switch) not just knowledge of a "secret" maintenance password or special signal over a remote control line (e.g. break).
2000-04-30-17:16:41 Sean Donelan:
Folks seem to be concentrating on locking down the front door. You also need to watch all the backdoors. With multi-protocol equipment, there are a lot of backdoors.
Excellent point. Personally I think it's easier to balkanize than to really secure. So use access lists so telnet access is either entirely disabled, or if it's needed is restricted to the local LAN. Restrict all questionable services to the local LAN, making sure there's a bastion on that LAN, and use ingress/egress filtering wherever possible to break address forging between LANs. What this turns up is that it's exceptionally helpful if you can have a really solid bastion host on every LAN. Fortunately, that doesn't have to be too hard. I _still_ wish someone would make e.g. a PCI card with say 32 or 64 10BaseT ports on it, but a civilized approximation for many purposes is a nice 100Mbps port talking 802.1Q VLANs to a switch dedicated to this purpose. But back to the wealth of possible, worrisome backdoors in modern multiprotocol gear, what are people doing to try and get a grip on config management for piles and stacks of Cisco? (my apologies if this thread has already been pounded to death, I just joined). Seems to me like a lot could be done with some simple m4 work, but so far a lot of the parameterizing I'd like to achieve (e.g. interfaces, access-list rules) has evaded me. The fantasy of course would be to get hip to a new thought --- a new kind of filtering you want to add to your access lists, or whatever --- and do it in one place, with the confidence that it'll take effect on every box it applies to. The distribution I can handle, it's the structured config management that's evading me. -Bennett
Unnamed Administration sources reported that Bennett Todd said:
I _still_ wish someone would make e.g. a PCI card with say 32 or 64 10BaseT ports on it, but a civilized approximation for many purposes is a nice 100Mbps port talking 802.1Q VLANs to a switch dedicated to this purpose.
There are $40 4-port 10BaseT PCI cards. While not 64 ports, you can put 4 or 5 in a Linux box..... -- A host is a host from coast to coast.................wb8foz@nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433
participants (3)
-
Bennett Todd -
David Lesher -
Sean Donelan