Slashdot Mirror


User: lanner

lanner's activity in the archive.

Stories
0
Comments
440
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 440

  1. How to secure your cisco router on CERT Finds Routers Increasingly Being Cracked · · Score: 5, Informative

    first, we will assume that you have a cisco, IOS based. If you are using something else, there are other ways to secure your system. I place actual commands in "" quotes. Many of these commands are applicable for IOS based switches too.

    Juniper, Unisphere, whatever, has similar precautions that you can take.

    http://www.cisco.com/warp/public/707/

    Common sense should apply. If you are an idiot, then there is no helping you, and please read no further. Just take your router offline so that you do not harm my network when the time comes for you...

    Secure the console;

    Turn HTTP servicing OFF!!!

    If you use the internal web server to configure your router, you are probably not qualified to work on the thing period. There have been a string of exploits to the http server function, and if someone get's your browser history, you are screwed. Use telnet. Same thing for any cisco CBOS based router (DSL, cable, ISDN).

    "no ip http server"

    If you have a 12000 or some of the higher end routers, you can ssh to it. Lesser routers, such as anything less than a 7500 can only use telnet. This sucks, but it is what cisco offers. (if you have a PIX firewall, ssh is available from version 5+ or something similar). You can always use IPsec if you have the IOS for it.

    Require local authentication to the console, add a 15 minute idle timeout, and other good stuff;

    "line con 0"
    "exec-timeout 15 0"
    "logging synchronous"
    "login local"
    "transport input none"

    Same thing for telnet sessions;

    "line vty 0 4"
    "exec-timeout 15 0"
    "logging synchronous"
    "login local"
    "transport preferred none"
    "transport input telnet"

    Access list telnet access to special subnets! This is VERY VERY important;

    Add "access-class 5 in" where you have the following access list on the router;

    "access-list 5 remark VTY.ACCESS.CONTROL"
    "access-list 5 remark 10.3.4.1/32"
    "access-list 5 permit 10.3.4.1"
    "access-list 5 remark 10.22.33.136/29"
    "access-list 5 deny 10.22.33.128 0.0.0.7"
    "access-list 5 permit 10.22.33.128 0.0.0.15"

    Do not forget the aux port;

    "line aux 0"
    "login local"
    "transport output none"

    Authentication;

    Use enable secret, NOT enable password!;

    enable secret blah-blah-blah-md5-encrypted

    Make at least one local user;

    username bob password goldfish

    Use TACACS+ if you can, and if you have multiple routers. Otherwise, just use a local login. Cisco lets you download TACACS+ if you know where to look;

    http://www.cisco.com/warp/public/480/tacplus.sht ml

    Encrypt your passwords too;

    service password-encryption

    Log stuff, and know when stuff happens;

    Turn on logging;

    "service timestamps debug datetime msec localtime show-timezone"
    "service timestamps log datetime msec localtime show-timezone"
    "logging buffered 32000 debugging"

    Hate log messages on the console?

    "no logging console"

    Use "term mon" when telnetting to get live logging messages. Use "term no mon" to turn it off.

    Synch to an NTP server so you know when stuff happens;

    "ntp server 1.2.3.4 prefer"

    Get NTP servers here;

    http://www.eecis.udel.edu/~mills/ntp/servers.htm

    Interfaces;

    EVERY DAMN interface should have the following, unless you know better;

    "no ip redirects"
    "no ip directed-broadcast"
    "no ip proxy-arp"
    "no cdp enable"

    Route RFC1918 traffic to null0. RFC1918 specifies that this traffic should not be routed. I do not know what NANOG's position on it is;

    ip route 10.0.0.0 255.0.0.0 Null0
    ip route 172.16.0.0 255.240.0.0 Null0
    ip route 192.168.0.0 255.255.0.0 Null0

    Turn CDP off, if you can. There is little reason to use it;

    Turn it off, on ALL interfaces;

    "no cdp run"

    Turn it off on an individual interface;

    "no cdp enable"

    Damn, now wasn't that easy? No? Of course not! People who do networking get paid some serious cash, because it is serious business. Put a fool on the console and your business is going to take it in the ass! Way too many businesses let fools take care of their networking, or better yet have nobody do it at all.

  2. I was defrauded on What Can You Do When Defrauded on eBay? · · Score: 2, Informative

    I, along with a bunch of other people, were defrauded by a business with an eBay ID of bayco.

    It looks like feedback for this user is still around. You can see the feedback.
    http://cgi2.ebay.com/aw-cgi/eBayISAPI.dll?ViewFe ed back&userid=bayco

    Basically, what happened was this person was selling RAM and processors. Selling more than hey had in stock, and buying after they have received funds from the buyers. Then RAM prices rose dramatically. Whoops, not enough money to buy the parts we promised to the buyers. Screwed.

    This was also a case of a user with a preexisting high feedback rating, suddenly going bad. The buyers could not have helped the situation by researching on the seller.

    Do I blame eBay for this? NO!!! I support eBay. They are just a trading marketplace, I would not want to endanger them or make their lives more difficult by trying to blame this on anyone other than myself, or the bad seller. This would cause problems that would make eBay !eBay.

    I believe the San Jose police got in on the case, and they requested eMails from a lot of us asking to document our experience. I think I have that eMail around somewhere still, but am not willing to dig it up right now.

    I got repayment through eBay's insurance system. I finally got a check from Loyds of London some time afterwards.

    Bottom line; bad seller, not my fault, not eBay's fault, sellers's fault, seller is responsible. You sent a check somewhere, go find them, enter their home during the night, and cut off their testicles with a dull rusty butter knife.
    Problem solved!

  3. Those who help themselves vs. those who want help on Ask A Tech-Savvy Lobbyist About The Politics Of Computing · · Score: 1

    I have been thinking about this recently, and what I think the struggle for rights in the United States comes down to is that there are two groups of people, on opposing sides of given issues. One group is the kind of who wants to be able to help themselves. The other group are those who want to be helped.

    Those who want to help themselves are hackers (technologist, medical, social, etc), gun owners, people who are reaching out for something far away. These people want to have the ability to go after what they want, unimpeded by the government, which can get in the way and prevent them from getting what they want. These people do not want someone to protect them -- they want to protect themselves. They do not want someone to feed them -- they want to feed themselves.

    Those who want help are asking for more laws to help them feel safer, they want laws to protect them against "that fangled internet thing" the fourth generation welfare recipient. They are having trouble living, and need some help. They figure that the government is there, that they are paying taxes (or maybe not) and they want something out of it. They want someone to work under them.

    Government needs to balance the needs of these two kinds of people. It needs to take care of those who want to be taken care of, yet let those who want to take care of themselves do so. Do those in government recognize this idea? That there are people who want to take care of themselves, like myself, that do not want them in the way?

    I remember there being a survey some time back of youth in the United States. It was something along the lines of the majority of youth thought that the government would stop them from achieving their goals in life, rather than help them archive them.

    Does the government prevent you from doing what you want to do in life? Do you fear your government? Would you ever work for the government?

    Or

    Do you want the government to help you do things in life? Do you love your government? Would you ever work for the government?

    What do legislators think about this?

  4. my experience with disk drive failures on IBM DeskStar 75GXP Hard Drive Failures? · · Score: 1

    I have a 45GB 75GXP at home that has been there since the drives came out. No problems, ever.

    We have about ten 40GB 60GXPs here at work that were purcahses four months ago -- no problems here either.

    I have been sysadmining for about seven years now. Very few times have I had a disk drive go bad on me. I had an old full height 5.25" Wren SCSI drive die on me, causing data loss about four years ago, but it was on a non critical old server. I have had a few Western Digital sub 1GB IDE drives die, but they had been slapped around pretty badly.

    Here at work, we had two SCSI disk drives from HP g o bad on us. They were actually Seagates, I think?

  5. Re:I am sorry to hear about your data loss, but... on IBM DeskStar 75GXP Hard Drive Failures? · · Score: 1

    Onstream drives are high capacity and pretty nice. They are actually made by Philips, I think?

    Also, look into Travan. A good cheap solution.

    DAT is pretty expensive. CDRW does not have the capacity per disk.

    You can mirror your drives pretty cheaply these days, but that does not prevent issues such as cracking and whatnot.

  6. Business opportunity misses on Apple Still Says No To Aqua-Like Themes · · Score: 1


    I would pay $5 for a really nice Aqua theme. Would you?

  7. I agree on Shutting Down Worm-Infected Broadband Users · · Score: 1


    I completely agree with the tactic of shutting down infected users. They are causing harm to other users and thus are not a good part of the community -- remove them from the community.

    I DO NOT support the blocking of ports. I might support the temporary blocking of ports upon individual users for a limited time, and they be notified very clearly, but I use by DSL line for legitimate web page serving and do so responsibly -- with Apache.

    If a user does not know how to control their software in their lives, then the software will control their lives. Be in control, or they are out of control.

    I thank the ISPs who would support such measures, so long as they do so fairly and make it possible for a user to rejoin the network after they have fixed their problem.

  8. Experiences on Choosing a Router/Firewall for the Home LAN · · Score: 4, Informative

    I am a CCNA and CCNP, I work with networking equipment for a living.

    A friend recently bought a Netgear MR314. It seemed okay. I rather like using my unix box to do filtering, mail, and other stuff, so I would never use one of these boxes. The http interface was fairly nice and easy to follow. Easy is good for networking novices.

    One problem that I encountered was the telnet support. This one had me calling their support department, not that they helped any. They command line will only accept 8 character hostnames. My friend had a 10 character @Home hostname for his authentication, and the only way to enter it was through the http interface. That sucked. Telnet is not intuitive, like Cisco IOS, but not horribly horrible.

    The MR314 is overall a good router, but I like more powerful stuff. The wireless interface was good. The construction of the box was very nice -- we took it apart. I think that it was using a Motorola processor.

    I have also dealt with the Cisco 600, 700, and 800 series routers in my time. They are pretty decent. I wish that the CBOS would allow for access lists greater than 18 (or is it 16?) lines. They take set, show, and debug style commands. Pretty intuitive. Upgrading the OS on them is easy. They can do NAT and PAT very well.

    Efficient Networks, formerly Flowpoint, routers are decent. They are command line based, and while help and documentation is really poor, they take some pretty good commands, do good syslogging, and a few other really neat things in their operating system. unfortunately, the commands are cryptic and you have to be a real networking pro to know what they are talking about.

    Netopia routers are really great. One of the fantastic features about them is that they do IPSec (DES only, no 3DES)! That is incredible for a router of it's type. They also do GRE tunnels. The next thing up if you want to do IPsec is a small Cisco router or PIX firewall, or a unix box. Netopia's do great system logging and SNMP. Their are configured through a telnet menu interface -- no telnet. They do excellent filtering, but entering filters is sort of a pain. Good construction of the boxes.

    A word about Qwest DSL. They only use DMT these days for DSL -- NO CAP. That means that you can no longer use the Cisco 675 on their networks. Use the 678 instead. If you own a 675 and move, you are fscked. I bought a 675 about a year and a half ago, recently moved, and was screwed for $300. I managed to hassle a poor Qwest tech into sending me a 658 at a very steep discount, nearly free -- it took a lot of work and insider knowledge to pull off though. CAP, DMT, and G.lite are like line codes or modem modulation types. They are the analog modulation codes that the DSL interface uses to get it's data across the line. Wrong modulation = no workie.

    BTW: Are there linux 2.4 kernel driver for the Intel 2200 DSL NIC? I have two of these things that Qwest sent me, and I would love to use them in my boxen. I do not know of drivers existing though. I need to google that.

  9. Re:Hey! It worked for Cyrix!! on AMD To Hide MHz Rating From Consumers · · Score: 1

    I have to agree. This would be a bad thing, in my opinion. AMD is the power user's CPU. By hiding rating information from the power consumer, they would drastically loose their interest to the power user customers, who in turn tell the non-power user customers.

    This stunt did NOT work for Cyrix -- look at where they are today. Nowhere to be found on the market.

    AMD should be scared right now. The common public has a PID of STU. They will buy MHz instead of power.

    Here in my office, we used to buy Dell systems that had Intel processors in them. But, the last six systems that we have purchased have had AMD processors and we have left the Dell and Intel thing for custom built Inside Loop systems with AMD processors. This occurred due to lobbying by a technical person in our Quality Assurance department and myself. We showed and convinced that for the price, the performance, and overall value, that AMD was better for our office than Intel was.

    And, we have been proven right. The people with AMD based systems are aspired to. Those with Intel systems have special RAM needs and nothing about upgrading their systems is easy. As a result, they have associated Intel based systems with "hassle" when it comes to upgrading RAM. This is because our Dell systems use PC100 and PC133 ECC SDRAM in pairs only and some RDRAM.

  10. Legality on Broadband Crackdown · · Score: 1

    What is the legality of this.

    What is "The internet"? If they filter ports, can they adverstise their service as being "the internet"?

  11. Small laptops, like Sony's Picturebook? on Which Laptop To Buy? · · Score: 1


    This is excellent! I am just considering purchasing a laptop to put linux on.

    I am very seriously considering a little Sony Picturebook. I know that there are a lot of unix Picturebook enthusiasts out there. Does anyone on Slashdot have experience with this laptop? And, more importantly, other competitors? I am mostly out for the size -- I do not care about the camera. It is all about size and performance.

    Thanks!

  12. No go on Verizon - No DSL Over Hybrid Copper/Fiber Lines? · · Score: 2


    Ait', first, let us talk about my qualifications to talk about this subject a bit.

    I am cisco CCNP certified, have worked for GlobalCenter, GlobalCrossing, and have been working with networking for the last seven years or so.

    The problem with fiber in the line is that when copper meets fiber, there is a medium conversion. The fiber only cares about vocal audio, which is the analog communication on the copper from about 20-20000 Hz -- the human voice (relatively). All else is killed off and this analog communication is translated into a digital pattern for transport on the fiber.

    The result of this conversion is that the frequency range that is used by DSL for communication gets cut off. The multiplexor that does this conversion was only designed to transport audio -- not data, and was never designed for DSL.

    You are fscked.

  13. Get even with the help of Slashdot on Extortion and the UGO Network? · · Score: 1


    >What did you do to resolve this kind of problem?

    I guess you get an article posted on Slashdot slandering them all over about their tactics to get even.

  14. We give, the author should give too on National Governments and the Internet? · · Score: 1

    The author of this post wants. Well, give too.

    Where will the users of Slashdot, and anyone else who may be interested in the subject, be able to download a copy of your end work and resources when you have completed this project?

  15. Re:I'm not worried -- I'm unemployed on Even Programmers Get the Job Search Blues · · Score: 1

    Need a CCNP?

  16. Get a SPARC on Booting Linux In Three Seconds · · Score: 1

    I have a Sun Microsystems Sparcsation 10 that was manufactured in 1992 - 1993.

    In the PROM (BIOS), I have a basic unix OS, can boot from CDROM, boot from the network, boot from a tape drive, compile, IO to a serial port, and do a host of other things.

    That was like nine years ago. If there is no demand on the consumer level for these things, you will not see it no matter how long you wait. Start harassing the PC BIOS manufactures to get off of their asses and start programming per your demands.

  17. Sabrina Online! on Web-Based Comics · · Score: 1

    Here is my favorite strip, Sabrina Online

    The modern strip location;
    http://sabrina-online.com/

    The old strip location;
    http://www.coax.net/people/erics/Sabrina.htm

    And, the author's website. He is an Amiga fan and has some cool Amiga art;
    http://www.compsoc.net/ericschwartz/

  18. Re:Permanent no-login links on New Boxes For Captain Crunch · · Score: 1


    I think that the New York Times needs to realize that people are going to circumvent their registration methods no matter what they do. If they finally perfect it to where we are forced to fool around with registration, people will just stop using their service. There are other news organizations out there that readily give away this information.

    Why am I going to fool around when I can more easily get it from somewhere else?

  19. Stop making the ACLU do your job! on ACLU Takes on ICANN · · Score: 2

    In this case, I would tell the ACLU to back down. The internet does not need defending. The internet needs to defend itself, and if it does not, it deserves to die. I would not care to see it any other way. We either fight for it or give it up to someone else who is fighting for it.

    Fixing this problem is very simple, and it has been said by others so many times. But, the ACLU can not fix it. The users of this network must fix it. Use different DNS servers.

    Go check out http://alternic.org/. Put 208.130.10.122 and 208.130.10.123 in your DNS list.

    Damn, Alternic even has a howto, though it needs work;

    http://alternic.org/howto/

    What excuse do you have now lazy ass?

    You are giving ICANN their power by using them. If you do not like them, knock it off!

    So, what am I doing to help this situation? I would like to try and talk my superiors into adding some alternative DNS servers in our network for our customers. This may yet happen after some time, but someone has to speak up or it will never happen.

  20. Re:Spread it around... on Linux PPC Boots On The Powerbook G4 Titanium · · Score: 1
    You write;

    Microsoft itself has found that only 10% of users even use a right click AT ALL, EVER.

    Can you please specify a reference for this information? I am genuinely interested. I seemed sort of shocked by that number at first, but then again I can almost believe it true.

  21. Trying to get myself fired here... on Excite@Home Claims Broadband 'Safe' · · Score: 1

    If I may be so bold as to bash the company for which I am employed. Frontier was purchased by GlobalCrossing awhile back.

    Check out this page as it is on Frontier's add for DSL. I thought that it was pretty funny.

    http://www.frontierlightninglink.com/fun/fun.sht ml#secure

    "Secure

    Cable modems leave your computer vulnerable to others accessing your private files.

    Not so with Frontier LightningLink. Your connection to the internet is dedicated and secure. You can leave your computer on all day with no worries about whether someone is looking at the private files on your personal computer."

    Yea!

  22. Re:Delete your account! on Handling Spam from Large Commercial Entities? · · Score: 1

    I will agree with this one.

    And, if it is easier to delete your account with a company than it is to get off of their spam lists then do it.

    Big company spammers on my list;

    excite.com -- when they first opened they spammed all over. They also spammed you if you simply used their search engine. They grabbed it from your browser. I remember them because I did not know how to filter my mail at that time.

    techies.com -- a slashdot add sponsor! You cannot remove yourself from their mailing lists unless you remember your account number. Whoops. Forgetful me. I give their domain the /dev/null treatment.

    I have the pleasure of not remembering others because I have long since filtered them.

  23. Investigators on Sony/Transmeta Video Laptop · · Score: 1


    This device is very cool. Very specialized electronics for specific uses. Expect to see more of it in the future.

    People who would be very interested in this item are investigators and insurance adjusters -- onsite/accident investigators. The applications in their fields of work matches perfectly.

  24. The headliner is right on Sony's Latest VAIO Looks Like Barf · · Score: 1

    Damn. You are right. They do look like barf! Why change the style? I want very much to buy one of those new Crusoe based units. This is just a really dumb move.

  25. Get the ISP to give up stats on On Counting Website Traffic · · Score: 1


    Get bandwidth statistics from their ISPs if you can.

    The ISP that I work for generates stats on almost every interface on our network, save a few odd pieces of hardware that do not support it or are not worth supporting it. You cannot count the hits, but you can count the proverbial p0rn that they are pushing... or pulling.