From firewalls-owner  Fri Jan 31 23:55:45 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id VAA14922 for firewalls-outgoing; Fri, 31 Jan 1997 21:45:17 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id UAA06392 for <firewalls@GreatCircle.COM>; Fri, 31 Jan 1997 20:59:40 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-961106)
	id KAA08336; Fri, 31 Jan 1997 10:46:28 -0800
Received: from lestat.mc2-csr.com(204.107.238.150) by mycroft via smap (V1.3mjr)
	id sma008320; Fri Jan 31 10:45:56 1997
Received: from merlin.mc2-csr.com (merlin.mc2-csr.com [204.107.238.176]) by lestat.mc2-csr.com (8.7.3/8.7.3) with SMTP id NAA11814; Fri, 31 Jan 1997 13:31:23 -0500 (EST)
Message-Id: <3.0.32.19970131133122.007c2760@mc2-csr.com>
X-Sender: lglaze@mc2-csr.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Fri, 31 Jan 1997 13:31:25 -0500
To: Dave Schnardthorst <ds3721@strydr.com>, firewalls@GreatCircle.COM
From: Larry Glaze <lglaze@mc2-csr.com>
Subject: Re: Rewriting User Names
Mime-Version: 1.0
Content-Type: text/enriched; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 10:00 AM 1/31/97 -0600, Dave Schnardthorst wrote:

>I am currently running Sendmail-8.8.5 and would like to be able to rewrite

>user names when sending out e-mail.  

>

>Example:

>

>  Incoming mail to myself could be aliased to daves@stryder.com.  When

>  I send outgoing mail my return address currently shows ds3721@stryder.com.

>  The outgoing mail should show daves@stryder.com.

>

>Can somebody give me some examples as to how this might be accomplished.


Check out http://www.mc2-csr.com/~lglaze and follow the virtual hosting

link. The page you want is the first sendmail link. The second one goes

into a different aspect of sendmail and virtual hosts, but it may also

be useful to you.


If you have any questions then just let me know (I wrote the pages and

am currently using both configurations successfully).




---------------------------------------------------------------------------

|<color><param>0000,0000,8080</param>Larry Glaze                      
</color>|<color><param>0000,0000,8080</param>    "...Life's a bummer..." 
         </color>|

|<color><param>0000,0000,8080</param>System/Network Administrator     
</color>|<color><param>0000,0000,8080</param>            --Smashing
Pumpkins       </color>|

|<color><param>0000,0000,8080</param>MC<smaller>2</smaller> Cyberspace,
Ltd               </color>|<color><param>0000,0000,8080</param>          
                           </color>|

|<color><param>0000,0000,8080</param>http://www.mc2-csr.com/~lglaze   
</color>|<color><param>0000,0000,8080</param>           
lglaze@mc2-csr.com        </color>|

---------------------------------------------------------------------------

|               <color><param>ffff,0000,0000</param>All opinions are my
own, as they should be!               </color>|

---------------------------------------------------------------------------

From firewalls-owner  Sat Feb  1 00:10:32 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id VAA14128 for firewalls-outgoing; Fri, 31 Jan 1997 21:37:06 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id VAA06588 for <firewalls@GreatCircle.COM>; Fri, 31 Jan 1997 21:00:12 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-961106)
	id KAA08698; Fri, 31 Jan 1997 10:53:08 -0800
Received: from gatekeep.us.landisgyr.com(206.175.68.122) by mycroft via smap (V1.3mjr)
	id sma008606; Fri Jan 31 10:52:50 1997
Received: by gatekeep.us.landisgyr.com; id NAA22977; Fri, 31 Jan 1997 13:51:44 -0500 (EST)
Received: from mailrelay.us.landisgyr.com(204.207.1.11) by gatekeep.us.landisgyr.com via smap (3.2)
	id xma022919; Fri, 31 Jan 97 13:51:19 -0500
Received: from mailrelay.us.landisgyr.com by pfmsv4.us.landisgyr.com
 (PMDF V5.0-6 #10101) id <01IEV3927WKW008S3K@pfmsv4.us.landisgyr.com> for
 firewalls@greatcircle.com; Fri, 31 Jan 1997 12:45:19 -0600 (CST)
Received: with PMDF-MR; Fri, 31 Jan 1997 12:48:55 -0600 (CST)
MR-Received: by mta PFMSV1.MUAS; Relayed; Fri, 31 Jan 1997 12:48:55 -0600
MR-Received: by mta PFMSV1; Relayed; Fri, 31 Jan 1997 12:48:55 -0600
MR-Received: by mta PFMSV4; Relayed; Fri, 31 Jan 1997 12:45:12 -0600
Disclose-recipients: prohibited
Date: Fri, 31 Jan 1997 12:48:55 -0600 (CST)
From: Joav Kohn <joav.kohn@us.landisstaefa.com>
Subject: Re: Rewriting User Names
In-reply-to: <199701311600.QAA04428@gollum.strydr.com>
To: firewalls <firewalls@GreatCircle.COM>
Message-id: <4055481231011997/A03557/PFMSV1/11B1FB303600*@MHS>
Autoforwarded: false
MIME-version: 1.0
Content-type: TEXT/PLAIN; CHARSET=US-ASCII
Content-transfer-encoding: 7BIT
Importance: normal
Sensitivity: Company-Confidential
UA-content-id: 11B1FB303600
X400-MTS-identifier: [;4055481231011997/A03557/PFMSV1]
Hop-count: 2
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>   Incoming mail to myself could be aliased to daves@stryder.com.  When
>   I send outgoing mail my return address currently shows ds3721@stryder.com.
>   The outgoing mail should show daves@stryder.com.
> 
> Can somebody give me some examples as to how this might be accomplished.
> 

What you want to do is not so hard, just copy the following steps. It may look
a little harder than it is if you don't know sendmail that well.

First, create a list of address translations, like this:

ds3721		daves
real_name	alias_name

making sure that the lefthand column is unique.

Then run 'makemap btree name_of_database < address_translation_list'.

In your /etc/sendmail.cf file, add the following

Kout btree /location_of_database/name_of_database

Moutbound_mailer,	P=[TCP], F=mDFMuX, S=12, R=22, A=IPC $h, E=\r\n

S12
# rewrite outbound (sender's) addresses to proper format
R$+<@$+>$*			$1@$2$3				remove
canocalization, then
R$+@stryder.com			$:$>31 $1@stryder.com		rewrite if in
groups
R$+@$*stryder.com		$@$1<@$2stryder.com>		make canocical

S31
R$+@stryder.com	$:$(out $1 $)
R$+		$:$1@stryder.com

(for all you sendmail experts, it may be a little rought around the edges, but
its from
off the top of my head).

Hope it helps,
-joav


From firewalls-owner  Sat Feb  1 00:19:07 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id VAA13811 for firewalls-outgoing; Fri, 31 Jan 1997 21:34:28 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id UAA05782 for <firewalls@GreatCircle.COM>; Fri, 31 Jan 1997 20:58:10 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-961106)
	id LAA09152; Fri, 31 Jan 1997 11:02:47 -0800
Received: from igate2.pabs.com(38.246.96.3) by mycroft via smap (V1.3mjr)
	id sma009104; Fri Jan 31 11:01:44 1997
Received: from igate2.pabs.com (daemon@localhost) by igate2.pabs.com (8.7.2/8.7.2) with ESMTP id OAA03652 for <firewalls@GreatCircle.COM>; Fri, 31 Jan 1997 14:06:43 -0500 (EST)
Received: from richey.pabs.com (richey.pabs.com [157.154.1.136]) by igate2.pabs.com (8.7.2/8.7.2) with ESMTP id OAA03646 for <firewalls@GreatCircle.COM>; Fri, 31 Jan 1997 14:06:42 -0500 (EST)
Received: from richey (richey@richey.pabs.com [157.154.1.136])
          by richey.pabs.com (8.8.5/8.8.4) with SMTP
	  id OAA21062; Fri, 31 Jan 1997 14:06:27 -0500
Message-ID: <32F242B2.27243F03@highmark.com>
Date: Fri, 31 Jan 1997 14:06:26 -0500
From: Jim Richey <jrichey@highmark.com>
X-Mailer: Mozilla 3.01Gold (X11; I; Linux 2.0.25 i586)
MIME-Version: 1.0
To: Dave Schnardthorst <ds3721@strydr.com>
CC: firewalls@GreatCircle.COM
Subject: Re: Rewriting User Names
References: <199701311600.QAA04428@gollum.strydr.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Read the section in the documentation about using the genericstable.


Dave Schnardthorst wrote:
> 
> I am currently running Sendmail-8.8.5 and would like to be able to rewrite
> user names when sending out e-mail.
> 
> Example:
> 
>   Incoming mail to myself could be aliased to daves@stryder.com.  When
>   I send outgoing mail my return address currently shows ds3721@stryder.com.
>   The outgoing mail should show daves@stryder.com.
> 
> Can somebody give me some examples as to how this might be accomplished.
> 
> Thanks
> 
> --
> ============================================================================
> David Schnardthorst, Systems/Network Eng. *  Phone: (314)838-6839
> Stryder Communications, Inc.              *    Fax: (314)838-8527
> 869 St. Francois                          * E-Mail: ds3721@strydr.com
> Florissant, MO  63031                     *    URL: http://www.strydr.com
> ============================================================================

-- 
Jim Richey
jrichey@highmark.com
HighMark Inc.
http://www.highmark.com

From firewalls-owner  Sat Feb  1 00:25:23 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id VAA13122 for firewalls-outgoing; Fri, 31 Jan 1997 21:26:28 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id UAA05156 for <Firewalls@GreatCircle.COM>; Fri, 31 Jan 1997 20:56:42 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-961106)
	id KAA07853; Fri, 31 Jan 1997 10:38:19 -0800
Received: from tanis.tiac.net(204.215.141.78) by mycroft via smap (V1.3mjr)
	id sma007791; Fri Jan 31 10:37:16 1997
Received: by cptech.com (5.x/SMI-SVR4)
	id AA01423; Fri, 31 Jan 1997 13:38:02 -0500
Date: Fri, 31 Jan 1997 13:38:02 -0500
From: dcosio@tanis.cptech.com (Dave Cosio)
Message-Id: <9701311838.AA01423@cptech.com>
To: Firewalls@GreatCircle.COM
Subject: Dave From McGraw Hill
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

	

Dave 

I lost your email,

could you call me or email me I want to send the 
info you need.

-Dave


From firewalls-owner  Sat Feb  1 00:37:48 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id VAA17327 for firewalls-outgoing; Fri, 31 Jan 1997 21:56:57 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id VAA16575 for <firewalls@GreatCircle.COM>; Fri, 31 Jan 1997 21:54:46 -0800 (PST)
From: harley@icrf.icnet.uk
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-961106)
	id MAA12560; Fri, 31 Jan 1997 12:07:21 -0800
Message-Id: <199701312007.MAA12560@mycroft.GreatCircle.COM>
Received: from unknown(143.65.100.4) by mycroft via smap (V1.3mjr)
	id sma012318; Fri Jan 31 12:02:59 1997
Received: by europa.lif.icnet.uk; Fri, 31 Jan 1997 20:03:01 GMT
Subject: RE: [NTSEC] ActiveX, MSIE and Quicken 
To: firewalls@GreatCircle.COM
Date: Fri, 31 Jan 1997 20:03:01 +0000 (GMT)
X-Mailer: ELM [version 2.4 PL23]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


> ActiveX components have the same characteristics of a virus. They are code
> which is delivered from the outside, frequently without knowledge, which can
> affect the long-term characteristics of the host system or other systems
> and/or pass information back which may be considered proprietary or
> sensitive. 

<pedant> Actually, none of these are defining characteristics of a
virus. All a virus has to do to -be- a virus is replicate. </pedant>

-- 
David Harley                     \   |   /                 alt.comp.virus FAQ
D.Harley@icrf.icnet.uk            \  |  /               & Anti-Virus Web Page
Support & Security Analyst         \ | /         Folk London On-Line gig-list
Imperial Cancer Research Fund   ____\|/____   http://webworlds.co.uk/dharley/

From firewalls-owner  Sat Feb  1 00:40:31 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id WAA04765 for firewalls-outgoing; Fri, 31 Jan 1997 22:53:18 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id WAA03635 for <Firewalls@GreatCircle.COM>; Fri, 31 Jan 1997 22:50:32 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-961106)
	id WAA21608; Fri, 31 Jan 1997 22:10:41 -0800
Received: from diablo.cisco.com(171.68.223.106) by mycroft via smap (V1.3mjr)
	id sma021590; Fri Jan 31 22:10:10 1997
Received: from clonvick-pc.cisco.com (sj-dial-3-12.cisco.com [171.68.179.13]) by diablo.cisco.com (8.8.4/CISCO.SERVER.1.2) with SMTP id WAA01416; Fri, 31 Jan 1997 22:11:22 -0800 (PST)
Message-Id: <2.2.32.19970201060829.00fded58@diablo.cisco.com>
X-Sender: clonvick@diablo.cisco.com
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Sat, 01 Feb 1997 00:08:29 -0600
To: Mark Thompson <thommd@CETUS.MNGT.ULETH.CA>, Firewalls@GreatCircle.COM
From: Chris Lonvick <clonvick@cisco.com>
Subject: Re: ICMP Class 9; Code 0 in FW-1 Logs??
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi Mark,

Slap a sniffer on the wire and see if it's ICMP Type 9 Code 0.
This is described in RFC-1256 as the ICMP Router Discovery Message.
If so, then you have a router out there sending IRDP advertisements.
It was intended to provide hosts with the IP addresses of their
neighboring routers.  This is a good idea for dropping a host into
a network and getting it to work right away.  

This is a bad idea for a firewall - which is why yours is ignoring it.

Hope this helps,

Chris Lonvick
Cisco Systems
Consulting Engineering
Houston, TX, USA
+1-713-778-5663

At 07:31 PM 1/31/97 -0700, Mark Thompson wrote:
>We're getting some logging that we can't explain in our FW-1 2.1 (solaris)
>logs which I was hoping somebody out there might be able to help us
>with:
>
>ICMP class 9 rejected; 
>ICMP code 0 rejected
>
>Does anybody have any idea what these classes and codes mean.  Are
>these FW-1'isms, or are they actually part of the ICMP spec?  We had an
>idea that they might be related to RIP traffic, but have (as of yet) been
>unable to find proof.
>
>Thanks much,
>
>Mark.
>
>Mark Thompson
>Manager of Network Services
>The University of Lethbridge
>Lethbridge, AB Canada
>
>thommd@cetus.mngt.uleth.ca
>(403) 329-2689
>
>


From firewalls-owner  Sat Feb  1 01:10:32 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id WAA28540 for firewalls-outgoing; Fri, 31 Jan 1997 22:27:07 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id VAA16902 for <firewalls@GreatCircle.COM>; Fri, 31 Jan 1997 21:55:40 -0800 (PST)
From: mcwilkin@twcable.com
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-961106)
	id MAA14124; Fri, 31 Jan 1997 12:37:16 -0800
Received: from unknown(205.138.118.193) by mycroft via smap (V1.3mjr)
	id sma014080; Fri Jan 31 12:35:36 1997
Received: from denmisf01.twcable.com (denmisf01.twcable.com [198.59.12.1]) by dencbis94.twcable.com (8.8.3/8.8.3) with ESMTP id NAA06994 for <firewalls@Greatcircle.com>; Fri, 31 Jan 1997 13:36:23 -0700 (MST)
Received: from dencbis56 (dencbis56 [198.59.12.201]) by denmisf01.twcable.com (8.8.3/8.8.3) with SMTP id NAA10433 for <firewalls@Greatcircle.com>; Fri, 31 Jan 1997 13:36:22 -0700 (MST)
Message-Id: <199701312036.NAA10433@denmisf01.twcable.com>
Comments: Authenticated sender is <mcwilkin@[198.59.12.1]>
To: firewalls@GreatCircle.COM
Date: Fri, 31 Jan 1997 13:42:44 +0000
Subject: Ident revisited
X-mailer: Pegasus Mail for Win32 (v2.42)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi all-

I have a question re: ident. We have a strange problem. We drop
all ident requests inbound silently at the firewall.

First, we are running Solstice Firewall-1 2.1 on a Sparc 10 with
Solaris 2.5

There is a site our users need to access but they can't. After we
watched the packets we saw ident come in and we block it. But,
instead of timing out and allowing us access, it closed our conn-
ection!

So,  I figured that they might have it configured to require some
sort of response.

Here is where I get lost.

I tried it from our internal name server and it timed out... But in-
stead of sending FIN to close the connection it let us in.

This is the only internal machine that can access that site. So, if
we are dropping ident on the floor and(if) they require it... Why
does this one work and all the others don't.

This internal machine doesn't even run ident or service port 113
but that doesn;t matter since ident doesn;t even reach it!

I really don't think they are requiring a response. 

It almost seems like the firewall is doing this.  I didn't configure
the firewall so I am not familiar with it...

But, if someone can give me a place to look or something to try
it would be appreciated.

Also, since we have an internal/external DNS setup we have a *
PTR on our external name server for reverse lookups.

Mike
Michael C. Wilkinson
Time Warner Cable-IS
mcwilkin@twcable.com

From firewalls-owner  Sat Feb  1 01:25:50 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id WAA29222 for firewalls-outgoing; Fri, 31 Jan 1997 22:32:43 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id VAA17539 for <firewalls@GreatCircle.COM>; Fri, 31 Jan 1997 21:57:30 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-961106)
	id LAA11844; Fri, 31 Jan 1997 11:53:44 -0800
Received: from pan.ch.intel.com(143.182.246.24) by mycroft via smap (V1.3mjr)
	id sma010511; Fri Jan 31 11:28:40 1997
Received: from argus.intel.com by pan.ch.intel.com (8.8.4/10.0i); Fri, 31 Jan 1997 19:29:18 GMT
Received: by argus.intel.com (8.8.4/10.0i); Fri, 31 Jan 1997 11:28:46 -0800
From: sedayao@argus.intel.com (Jeffrey C. Sedayao)
Message-Id: <199701311928.LAA18993@argus.intel.com>
Subject: Re: Firewall Consolidation
To: asetton@lightech.com.ar
Date: Fri, 31 Jan 97 11:28:46 PST
Cc: firewalls@GreatCircle.COM
In-Reply-To: <32F1C9B2.436E@lightech.com.ar> from "Adrian F. Setton" at Jan 31, 97 01:30:11 pm
X-Mailer: ELM [version 2.4dev PL66]
MIME-Version: 1.0
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Hello,
> I'm looking for opinions about using the same firewall machine in
> order to conect the same organization with multiple services.
> For example, a Bank could use the same firewall in order to protect
> the private network from the Web Servers that are in the DMZ, and in
> order to give access to the Internet to the employees.
> An argument is that perhaps we do not want to consolidate them for
> performance reasons (we want to be able to isolate one service from
> another, so the traffic from one does not affect the performance of
> the second one).
> Any idea about why this consolidation could be good or bad, will be
> appreciated.

I would keep them separate because:

1.  Performance - If you are putting the DMZ as a segment off the
firewall machine, as the firewall gets bogged down, performance for 
your internal users (to the Internet) and your external users of your 
web servers will suffer.

2.  Robustness - If the DMZ firewall machine goes down, both your
internal users will suffer as well as your external customers of your
web servers.  You want to minimize the number of angry phone calls at
the same time.

3.  Easier configuration - Rather than worry about both the web server
and your users on the same machine's configuration, you think of them
separately.  Simpler configurations will reduce the chance of you making
a mistake.

Then again, if you don't have have enough money for more than one
machine, well, you will have one machine.  I don't think that would be a
good idea.

In either case, I think you want to make sure that one group or person
is administering both machines.

> -- 
> Adrian F. Setton
> LighTech                        Voice:  (54-1) 373-1141
> Ayacucho 563. Piso 13 Dto "A"   FAX:    (54-1) 373-1215
> Buenos Aires                    e-mail: asetton@lightech.com.ar
> Argentina                       URL:    http://www.lightech.com.ar

-- 
Jeff Sedayao
Intel Corporation
sedayao@argus.intel.com

From firewalls-owner  Sat Feb  1 03:25:34 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id CAA07315 for firewalls-outgoing; Sat, 1 Feb 1997 02:53:53 -0800 (PST)
Received: from ravian.globalxs.nl (ravian.GlobalXS.nl [143.178.250.5]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id CAA07259 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 02:53:15 -0800 (PST)
Received: from ns.globalxs.nl (Borg.startrek.GlobalXS.nl [143.178.243.49]) by ravian.globalxs.nl (8.7.4/8.7.3) with SMTP id LAA16582 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 11:51:56 +0100
Message-Id: <3.0.32.19970201114932.00693214@globalxs.nl>
X-Sender: pnefkens@globalxs.nl
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Sat, 01 Feb 1997 11:50:52 +0100
To: firewalls@GreatCircle.COM
From: Patrick Nefkens <pnefkens@globalxs.nl>
Subject: Re: [Fwd: Re: MS Proxy as a firewall?]
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>> Luckly, an article
>> in Infoworld or Communication Week a few weeks ago reviewed msproxy server

>Is there anybody out there who has more information about this article ?
>Thanks in advance.
 
This article was published in Communications Week, January 20, 1997. It can
be found at http://www.techweb.com. There you will have to search on the
keyword "MS Proxy".


Patrick "Cloggie" Nefkens

Those who can, do.
Those who can't, write the instructions.

From firewalls-owner  Sat Feb  1 04:17:24 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id CAA05405 for firewalls-outgoing; Sat, 1 Feb 1997 02:21:06 -0800 (PST)
Received: from glacier.wise.edt.ericsson.se (glacier-ext.wise.edt.ericsson.se [193.180.251.38]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id CAA05389 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 02:20:31 -0800 (PST)
Received: from negrita.nmac.ericsson.se (negrita.nmac.ericsson.se [130.100.187.78]) by glacier.wise.edt.ericsson.se (8.7.5/8.7.3/glacier-0.9) with SMTP id LAA20399 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 11:19:15 +0100 (MET)
Received: by negrita.nmac.ericsson.se (SMI-8.6/SMI-SVR4)
	id LAA01562; Sat, 1 Feb 1997 11:18:44 +0100
Date: Sat, 1 Feb 1997 11:18:44 +0100
From: etxrosd@nmac.ericsson.se (Robert Stahlbrand)
Message-Id: <199702011018.LAA01562@negrita.nmac.ericsson.se>
To: firewalls@GreatCircle.COM
Subject: Re: Rewriting User Names
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-MD5: FrfX2PdBGzeQgK4fMDZ8Lg==
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi!

I have got a problem with makemap! When I run: makemap outnames.db < 
outnames.db.txt the following error-messege appears:
"makemap: Type btree not supported in this version"

The same happens if I use hash-option instead of btree. I know that I had some 
trouble when I compiled makemap (sendmail ver. 8.8.5) and it couldn't generate 
manpages but what the heck was my thought. I don't need manpages for makemap 
(maybe I need now). I run sendmail on solaris 2.5.
Is there someone else who are having the same problem?
Is there anyone who can share a copy of the makemap binary for Solaris 2.5?

###########################################################
#                 Robert Stahlbrand                       #
# Network and System Administrator OPLab and NMAC domains #
#                                                         #
#                 Ericsson Telecom AB                     #
#                      Box 333                            #
#                   43184 Molndal                         #
#                      Sweden                             #
#                  +46 31 7476162                         #
#                  +46 31 7472942 (fax)                   #
#                                                         #
#              robert@nmac.ericsson.se                    #
###########################################################


> >   Incoming mail to myself could be aliased to daves@stryder.com.  When
> >   I send outgoing mail my return address currently shows ds3721@stryder.com.
> >   The outgoing mail should show daves@stryder.com.
> > 
> > Can somebody give me some examples as to how this might be accomplished.
> > 
> 
> What you want to do is not so hard, just copy the following steps. It may look
> a little harder than it is if you don't know sendmail that well.
> 
> First, create a list of address translations, like this:
> 
> ds3721		daves
> real_name	alias_name
> 
> making sure that the lefthand column is unique.
> 
> Then run 'makemap btree name_of_database < address_translation_list'.
> 
> In your /etc/sendmail.cf file, add the following
> 
> Kout btree /location_of_database/name_of_database
> 
> Moutbound_mailer,	P=[TCP], F=mDFMuX, S=12, R=22, A=IPC $h, E=\r\n
> 
> S12
> # rewrite outbound (sender's) addresses to proper format
> R$+<@$+>$*			$1@$2$3				remove
> canocalization, then
> R$+@stryder.com			$:$>31 $1@stryder.com		rewrite 
if in
> groups
> R$+@$*stryder.com		$@$1<@$2stryder.com>		make canocical
> 
> S31
> R$+@stryder.com	$:$(out $1 $)
> R$+		$:$1@stryder.com
> 
> (for all you sendmail experts, it may be a little rought around the edges, but
> its from
> off the top of my head).
> 
> Hope it helps,
> -joav
> 

From firewalls-owner  Sat Feb  1 10:28:58 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id KAA22754 for firewalls-outgoing; Sat, 1 Feb 1997 10:12:05 -0800 (PST)
Received: from amdext.amd.com (amdext.amd.com [139.95.251.1]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id KAA22745 for <Firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 10:11:49 -0800 (PST)
Received: from amdint.amd.com (amdint.amd.com [139.95.250.1])
          by amdext.amd.com (8.8.4/8.8.4/AMD) with ESMTP
	  id KAA19117; Sat, 1 Feb 1997 10:09:55 -0800 (PST)
Received: from brahms.amd.com (brahms.amd.com [193.5.6.1])
          by amdint.amd.com (8.8.4/8.8.4/AMD) with SMTP
	  id KAA26862; Sat, 1 Feb 1997 10:09:54 -0800 (PST)
Received: from zappa.amd.com by brahms.amd.com (4.1/AMDSN-1.18)
	id AA22065; Sat, 1 Feb 97 10:09:54 PST
Received: from procyon.amd.com (kathryn) by zappa.amd.com (4.1/AMDC-1.20)
	id AA28003; Sat, 1 Feb 97 10:09:53 PST
Message-Id: <3.0.32.19970201091209.006e15fc@brahms>
X-Sender: chris@brahms
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Sat, 01 Feb 1997 09:12:21 -0800
To: gvc@ocsystems.com (G. Vincent Castellano), Firewalls@GreatCircle.COM
From: Chris Martin <chris.martin@amd.com>
Subject: Re: Protecting local news from Suck
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 06:45 PM 1/30/97 -0500, G. Vincent Castellano wrote:
> ...
>I have heard that there is a tool called 'suck' which is
>designed to do just this.  Is there such a tool?  If so,
>how can I be sure I'm safe from it?

One approach would be to use a set of news servers internally for
newsreading and distinct set of news servers externally exclusively for
news relay.  The internal news servers simply wouldn't feed internal groups
out to the relay servers.  This is generally considered to be better from a
performance perspective as well -- especially if you have a number of
external news peers.


From firewalls-owner  Sat Feb  1 11:10:37 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id KAA25272 for firewalls-outgoing; Sat, 1 Feb 1997 10:52:30 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id KAA24590 for <Firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 10:50:44 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-961106)
	id IAA25666; Sat, 1 Feb 1997 08:58:32 -0800
Received: from unknown(206.161.161.2) by mycroft via smap (V1.3mjr)
	id sma025662; Sat Feb  1 08:58:12 1997
Received: from 206.161.161.3 by northern-va.com
 with SMTP (Apple Internet Mail Server 1.1.1); Sat, 1 Feb 1997 13:04:06 +0000
Message-ID: <3110E43E.11E9@northern-va.com>
Date: Thu, 01 Feb 1996 12:03:10 -0400
From: Ronald Ogle <oglerr@northern-va.com>
Reply-To: oglerr@northern-va.com
Organization: RTO Consulting
X-Mailer: Mozilla 3.0 (Macintosh; I; PPC)
MIME-Version: 1.0
To: Firewalls@GreatCircle.COM
Subject: Firewall-1 to Sunscreen SPF-100 VPN
References: <199702010925.BAA28232@miles.greatcircle.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I've got some information from SUN on how to make a Virtual Private
Network connection between a Firewall-1 2.1 machine and a Sunscreen
SPF-100 machine.  My question is does anyone else have a working VPN
between these same two machines?  Secondly, would you be willing to
share the procedure on how you set it up?

Thanks!
-- 
Ronald R. Ogle
RTO Consulting
15210 Crescent St.
Dale City, VA 22193-1623
(703) 730-0451
oglerr@northern-va.com

From firewalls-owner  Sat Feb  1 11:49:00 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id LAA00563 for firewalls-outgoing; Sat, 1 Feb 1997 11:32:00 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id KAA25988 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 10:55:00 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-961106)
	id IAA24844; Sat, 1 Feb 1997 08:09:07 -0800
Message-Id: <199702011609.IAA24844@mycroft.GreatCircle.COM>
Received: from unknown(130.184.252.196) by mycroft via smap (V1.3mjr)
	id sma024839; Sat Feb  1 08:08:27 1997
Received: from UAFSYSB.UARK.EDU by UAFSYSB.UARK.EDU (IBM VM SMTP V2R3)
   with BSMTP id 2255; Sat, 01 Feb 97 10:07:46 CST
Received: from UAFSYSB.UARK.EDU (NJE origin SAMARAK@UAFSYSB) by UAFSYSB.UARK.EDU (LMail V1.2a/1.8a) with BSMTP id 2786; Sat, 1 Feb 1997 10:07:46 -0600
Date:         Sat, 01 Feb 97 10:04:20 CST
From: Steve Marak <SAMARAK@UAFSYSB.UARK.EDU>
Subject:      Blocking modems
To: Firewalls mailing list <firewalls@GreatCircle.COM>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


>Random thought: would it be possible to insert a (hardware) filter
>on incoming lines to block modem signalling frequencies? This would
>not disturb voice traffic but might be an effective solution. Modern
>modems

This occurred to me about 6 years ago and I've been trying ever since to
find a product/service/vendor who could implement it for me, with no
luck. I've asked a lot of people at conferences and such, too. Usually
their answer was that it seemed quite logical and surely someone *ought*
to provide something, but they didn't know specifically of anything.

Some of our AT&T contingent assured me that the newer high-end switches
could be configured to do this, but so far none of the technical people
seem to know how.

If someone out here does know of something along this line, please include
me in the reply if you don't post to the list.

Apologies to the list at large for continuing this (at best tangential)
topic - it's been a thorn in my side for a long time.

Steve


-- Steve Marak
-- SAMARAK@UAFSYSB.UARK.EDU

From firewalls-owner  Sat Feb  1 12:25:33 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id MAA04535 for firewalls-outgoing; Sat, 1 Feb 1997 12:12:33 -0800 (PST)
Received: from introtv01.intro.ch (introtv01.intro.ch [194.158.232.66]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id MAA04468 for <Firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 12:12:09 -0800 (PST)
Received: by introtv01.intro.ch with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63)
	id <01BC1084.70DC1410@introtv01.intro.ch>; Sat, 1 Feb 1997 21:11:07 +0100
Message-ID: <c=CH%a=_%p=SASSOGROUP%l=SASVR001-970201201054Z-2@introtv01.intro.ch>
From: Krummenacher Kurt <Kurt.Krummenacher@sasso.intro.ch>
To: "'Firewalls@GreatCircle.COM'" <Firewalls@GreatCircle.COM>
Subject: Put me off
Date: Sat, 1 Feb 1997 21:10:54 +0100
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

please put out this list

K.Krummenacher@spectraweb.ch

From firewalls-owner  Sat Feb  1 12:44:47 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id MAA05879 for firewalls-outgoing; Sat, 1 Feb 1997 12:26:58 -0800 (PST)
Received: from psihost.memberville.com (memberville.com [38.234.19.2]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id MAA05842 for <firewalls@greatcircle.com>; Sat, 1 Feb 1997 12:26:38 -0800 (PST)
Received: from x.memberville.com ([38.234.19.100])
          by psihost.memberville.com (Netscape Mail Server v2.0) with SMTP
          id AAA7428 for <firewalls@greatcircle.com>;
          Sat, 1 Feb 1997 15:22:05 -0500
Message-ID: <32F3A57F.D10@paragonfcu.org>
Date: Sat, 01 Feb 1997 15:20:15 -0500
From: davew@memberville.com (Dave Weinstein)
Reply-To: davew@paragonfcu.org
Organization: Paragon Federal Credit Union
X-Mailer: Mozilla 3.0 (Win95; I)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: Technologic's Interceptor
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

We are presently evaluating different firewall solutions, one of which
is Technologic's Interceptor.

Is it a good product?

Can anyone please provide a little insight.

Thanks in advance, 
David Weinstein
VP of Information Systems and Technology

From firewalls-owner  Sat Feb  1 12:55:44 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id MAA06465 for firewalls-outgoing; Sat, 1 Feb 1997 12:33:15 -0800 (PST)
Received: from firewall.harker.com (firewall.harker.com [192.102.231.125]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id MAA06455 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 12:33:01 -0800 (PST)
Received: from harker.harker.com (harker.harker.com [192.102.231.1]) by firewall.harker.com (8.6.9/8.6.12) with ESMTP id FAA21415; Sat, 1 Feb 1997 05:27:51 GMT
Received: (from harker@localhost) by harker.harker.com (8.8.4/8.8.3) id MAA28549; Sat, 1 Feb 1997 12:34:07 -0800 (PST)
Date: Sat, 1 Feb 1997 12:34:07 -0800 (PST)
From: Robert Harker <harker@harker.com>
Message-Id: <199702012034.MAA28549@harker.harker.com>
To: etxrosd@nmac.ericsson.se
Subject: Re: Rewriting User Names
Cc: firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

The version of makemap you compiled seems not to support the new Berkeley "db"
Library.  Either get the library from:
	ftp://ftp.cs.berkeley.edu/ucb/4bsd/db.1.85.tar.gz
Or you can use your existing makemap which probabily supports the vendors
default "ndbm" database.  Try:
	makemap dbm outnames < outnames
This will create the ndbm database files: outnames.pag and outnames.dir
(the two names can be the same)

Word of warning, if your makemap command has been compiled with db
support, then you will get db files even if you specify dbm as the database
type.  To build a ndbm file you must use the makedbm command.

Hope this helps

RLH

   > For info about our "Managing Internet Mail, Setting Up and Trouble <
   > Shooting sendmail and DNS" and a schedule of dates and locations,  <
   > please send email to info@harker.com, or visit www.harker.com      <

Robert Harker						Harker Systems
Sendmail and TCP/IP Network Training			1180 Hester Ave
Network and Sysadmin Consulting				San Jose, CA 95126
harker@harker.com					408-295-9432


From firewalls-owner  Sat Feb  1 15:27:11 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id PAA18976 for firewalls-outgoing; Sat, 1 Feb 1997 15:13:38 -0800 (PST)
Received: from unix1.sysnet.net (unix1.sysnet.net [206.142.32.2]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id PAA18969 for <firewalls@greatcircle.com>; Sat, 1 Feb 1997 15:13:25 -0800 (PST)
Received: from [206.142.16.32] (appp13.sysnet.net [206.142.16.32]) by unix1.sysnet.net (8.8.4/8.6.12) with SMTP id TAA25825; Sat, 1 Feb 1997 19:49:02 -0500 (EST)
Message-Id: <199702020049.TAA25825@unix1.sysnet.net>
Subject: Re: Lower Prices and More NSA Testing
Date: Sat, 1 Feb 97 18:12:53 -0400
x-sender: patton@mail.sysnet.net
x-mailer: Claris Emailer 1.1
From: Matthew Patton <patton@sysnet.net>
To: "BeachCruiser" <pelicans@mindspring.com>
cc: <firewalls@greatcircle.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>release of more test results as the X31 crew expands their commercial
>firewall product evaluations.  Gauntlet and Sidewinder just happened to be
>the first two on the bench.  Others are already in the queue.

But has anybody read them?  I just finished the TIS one and I'm VERY 
nonplussed.  What's the value added of the X31's efforts?  There's no new 
insight, and it was hardly what I'd consider rigorous.  Indeed their 
testing basically boiled down to confirming that the firewall obeyed 
protocol conventions.  So what?  The trade rags do similar testing.  
There are an incredible number of TIS sites out there and if the features 
didn't work as advertised we've have known a LONG time ago.  I'll read 
the sidewinder one next and I'm prepared to be yet again disappointed at 
the coverage.

From firewalls-owner  Sat Feb  1 16:40:58 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id QAA24288 for firewalls-outgoing; Sat, 1 Feb 1997 16:35:49 -0800 (PST)
Received: from mailhost.netrunner.net (mailhost.netrunner.net [204.137.145.201]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id QAA24281 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 16:35:37 -0800 (PST)
Received: from jim.davocom.com ([205.164.226.41]) by mailhost.netrunner.net (8.7.5/8.7.5) with ESMTP id TAA17673; Sat, 1 Feb 1997 19:13:31 -0500 (EST)
Message-ID: <32F3DA42.27E9@davocom.com>
Date: Sat, 01 Feb 1997 19:05:23 -0500
From: Jim Canfield <jcanfiel@davocom.com>
X-Sender: Jim Canfield <jcanfiel@davocom.com>
X-Mailer: Mozilla 4.0b1 (Win95; I)
MIME-Version: 1.0
To: "K.M." <goertzek@wangfed.com>
CC: firewalls@GreatCircle.COM
Subject: Re: Sidewinder vs. Cyberguard
X-Priority: Normal
References: <9701311502.AA10288@uc0009.wangfed.com>
Content-Type: multipart/alternative; boundary="----------592E56445F600"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


------------592E56445F600
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=us-ascii

I am a relative novice in the arena of firewalls but am attempting to
learn as much as I can. Monitoring this forum on basic fw issues to the
most esoteric  is exceptionally enlightening. I have been implementing
L/WAN's for about 9 years and consider myself relatively well qualified
in certain areas.

Coming at the issue of firewalls as a small system integration house we
researched what a firewall is and what is important. What is important
as I see it is to keep the unwanted out while inconveniencing those who
need access as little as possible..

First: How is security rated A1, B3, B2, B1, C2, C1 in the US, other
similar grading scales in England/Germany and probably countless others
worldwide. Then to find out what was the best achievable security rating
for a product that is usable.
The most secure, usable, firewall we have found to date is the
Cyberguard

As mentioned the products are B1 compliant (awaiting certification)....
They are relatively easy to setup , nice GUI and it has built in the
ablity for most "standard "(excuse the word) proxies and allows creation
of probably anything you might need.  It is priced competitively with
Sidewinder, Raptor and the other high-end hardened O/S FW's available
but as far as I know it is the only one that is B compliant.

If you need to purchase a firewall,  I do not see how anyone ever
chooses anything other than the Cyberguard.

Thanks for your time.

Jim Canfield

------------592E56445F600
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset=us-ascii

<HTML><BODY>

<DT>I am a relative novice in the arena of firewalls but am attempting
to learn as much as I can. Monitoring this forum on basic fw issues to
the most esoteric&nbsp; is exceptionally enlightening.&nbsp;I have been
implementing L/WAN's for about 9 years and consider myself relatively well
qualified in certain areas.&nbsp;&nbsp;</DT>

<DT>&nbsp;</DT>

<DT>Coming at the issue of firewalls as a small system integration house
we researched what a firewall is and what is important. What is important
as I see it is to keep the unwanted out while inconveniencing those who
need access as little as possible..&nbsp;</DT>

<DT>&nbsp;</DT>

<DT>First: How is security rated A1, B3, B2, B1, C2, C1 in the US, other
similar grading scales in England/Germany and probably countless others
worldwide. Then to find out what was the best achievable security rating
for a product that is usable.</DT>

<DT>The most secure, usable, firewall we have found to date is the Cyberguard</DT>

<DT>&nbsp;</DT>

<DT>As mentioned the products are B1 compliant (awaiting certification)....&nbsp;
They are relatively easy to setup , nice GUI and it has built in the ablity
for most &quot;standard &quot;(excuse the word) proxies and allows creation
of probably anything you might need.&nbsp; It is priced competitively with
Sidewinder, Raptor and the other high-end hardened O/S FW's available but
as far as I know it is the only one that is B compliant.</DT>

<DT>&nbsp;</DT>

<DT>If you need to purchase a firewall,&nbsp; I do not see how anyone ever
chooses anything other than the Cyberguard.</DT>

<DT>&nbsp;</DT>

<DT>Thanks for your time.</DT>

<DT>&nbsp;</DT>

<DT>Jim Canfield</DT>

</BODY>
</HTML>
------------592E56445F600--


From firewalls-owner  Sat Feb  1 18:29:14 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id SAA02436 for firewalls-outgoing; Sat, 1 Feb 1997 18:13:06 -0800 (PST)
Received: from homeport.org (lighthouse.homeport.org [205.136.65.198]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id SAA02426 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 18:12:56 -0800 (PST)
Received: (adam@localhost) by homeport.org (8.6.9/8.6.9) id VAA02207; Sat, 1 Feb 1997 21:09:11 -0500
From: Adam Shostack <adam@homeport.org>
Message-Id: <199702020209.VAA02207@homeport.org>
Subject: Re: [NTSEC] ActiveX, MSIE and Quicken
In-Reply-To: <41FDA823FC5AD011A0970000E8D5C667029335@mail.rc.on.ca> from Russ at "Jan 31, 97 07:04:44 am"
To: Russ.Cooper@RC.on.ca (Russ)
Date: Sat, 1 Feb 1997 21:09:11 -0500 (EST)
Cc: firewalls@GreatCircle.COM, lists@reflections.mindspring.com
X-Mailer: ELM [version 2.4ME+ PL27 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Russ wrote:
| 1. If the default IE implementation existed on the exploited machine,
| they were informed of the company name who signed the certificate, and
| were asked to confirm acceptance of the object. In which case, they
| chose to trust an untrustworthy company, why is that the fault of
| Activex?
| 
| 2. If they previously had told IE to accept all signed certificates,
| then they chose to leave their machine wide open, again, why is that
| ActiveX's fault?

	Lets say that the user is in class one, and makes a mistake.
	They've could have just accepted a malicious applet that
changes their IE config into class two.  Or perhaps it adds a trusted
CA.  (Or perhaps the attack is two pronged; the malicious code that
changes the config file is a word virus.)  There are subtle attacks.
ActiveX is bad technology because it does not offer mechanisms for an
organizations security officer to control what is happening in any
way other than turning it off.

Adam


-- 
Pet peeve of the day: Security companies whose protocols dare not
speak their name. Guilty company of the day is Security Dynamics.



From firewalls-owner  Sat Feb  1 18:41:03 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id SAA03429 for firewalls-outgoing; Sat, 1 Feb 1997 18:30:44 -0800 (PST)
Received: from reflections.mindspring.com (reflections.mindspring.com [204.180.142.192]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id SAA03227 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 18:29:59 -0800 (PST)
Received: from localhost (lists@localhost) by reflections.mindspring.com (8.7.6/8.7.3) with SMTP id VAA01895; Sat, 1 Feb 1997 21:28:51 -0500
Date: Sat, 1 Feb 1997 21:28:51 -0500 (EST)
From: Todd Graham Lewis <lists@reflections.mindspring.com>
To: Adam Shostack <adam@homeport.org>
cc: Russ <Russ.Cooper@RC.on.ca>, firewalls@GreatCircle.COM
Subject: Re: [NTSEC] ActiveX, MSIE and Quicken
In-Reply-To: <199702020209.VAA02207@homeport.org>
Message-ID: <Pine.LNX.3.95.970201212545.306A-100000@reflections.mindspring.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Sat, 1 Feb 1997, Adam Shostack wrote:

> Russ wrote:
>
> | 2. If they previously had told IE to accept all signed certificates,
> | then they chose to leave their machine wide open, again, why is that
> | ActiveX's fault?
> 
> 	Lets say that the user is in class one, and makes a mistake.
> 	They've could have just accepted a malicious applet that
> changes their IE config into class two.  Or perhaps it adds a trusted
> CA.

Or maybe it fires up Frontpage and slaps the same thing on an internal web
page.  Etc., ad nauseum.

Russ, when you continue to argue that "ActiveX/OLE has always been an
insecure, crappy technology; the only difference is that it's now on the
web", I really fail to see your point.  Maybe you could fill me in. 

__
Todd Graham Lewis          Mindspring Enterprises      tlewis@mindspring.com


From firewalls-owner  Sat Feb  1 19:09:22 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id SAA03617 for firewalls-outgoing; Sat, 1 Feb 1997 18:37:27 -0800 (PST)
Received: from homeport.org (lighthouse.homeport.org [205.136.65.198]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id SAA03607 for <Firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 18:37:10 -0800 (PST)
Received: (adam@localhost) by homeport.org (8.6.9/8.6.9) id VAA02356; Sat, 1 Feb 1997 21:33:14 -0500
From: Adam Shostack <adam@homeport.org>
Message-Id: <199702020233.VAA02356@homeport.org>
Subject: Re: Secure Telneting into a internal network
In-Reply-To: <Pine.GSO.3.95.970130140106.20876O-100000@raleigh> from Derrick 'Red 5' Cole at "Jan 30, 97 02:14:41 pm"
To: derrick.cole@ssds.com
Date: Sat, 1 Feb 1997 21:33:14 -0500 (EST)
Cc: aharpham@cnweb.com, Firewalls@GreatCircle.COM
X-Mailer: ELM [version 2.4ME+ PL27 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Derrick 'Red 5' Cole wrote:
| On Thu, 30 Jan 1997, Allen D. Harpham wrote:
| > 
| > They use a windows based telnet package that they would like to use to
| > access their hosts on the internal network over the internet.
| 
| This is the behaviour purported by this "shim" idea.  It situates itself
| in the midst of the winsock stack, and "knows" (most likely via routes to
| destinations using pseudo interfaces - as with swIPe) when to encrypt a
| session and when not to.

	There are a couple of shims that sit above winsock now, rather
than mucking with it.  V-One makes one, theres another called VTCP.
You point your network program to 127.0.0.1 on some port, and it wraps
the connection in an 'secure pipe' to the firewall.  V-One offers the
nice ability to control where users connect to once they connect over
this pipe.

	On the down side, you find yourself saying 'the V-One client
server protocol' or 'the V-One online registration protocol' an awful
lot, and they're both mouthfuls.

Adam

-- 
Pet peeve of the day: Security companies whose protocols dare not
speak their name, because they don't have one.  Guilty company of the
day is now V-One.



From firewalls-owner  Sat Feb  1 19:11:02 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id SAA03473 for firewalls-outgoing; Sat, 1 Feb 1997 18:31:53 -0800 (PST)
Received: from unix1.sysnet.net (unix1.sysnet.net [206.142.32.2]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id SAA03466 for <firewalls@greatcircle.com>; Sat, 1 Feb 1997 18:31:40 -0800 (PST)
Received: from [206.142.16.36] (bppp2.sysnet.net [206.142.16.36]) by unix1.sysnet.net (8.8.4/8.6.12) with SMTP id XAA27088; Sat, 1 Feb 1997 23:07:18 -0500 (EST)
Message-Id: <199702020407.XAA27088@unix1.sysnet.net>
Subject: Re: Sidewinder vs. Cyberguard
Date: Sat, 1 Feb 97 21:31:07 -0400
x-sender: patton@mail.sysnet.net
x-mailer: Claris Emailer 1.1
From: Matthew Patton <patton@sysnet.net>
To: "Jim Canfield" <jcanfiel@davocom.com>
cc: <firewalls@greatcircle.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Jim Canfield wrote:
>The most secure, usable, firewall we have found to date is the
>Cyberguard

On what basis do you make this assertion?  "secure" can mean a lot of 
things and a rubber stamp from NSA or it's equivalent doesn't mean a 
whole lot if buggy software can be trivially exploited.  We could go on 
about "usable" but I'll let that one slide.  In particular is the 
firewall configuration an EXACT match with the 
"certified/tested/evaluated" machine?  NT has a C2 rating but it's not 
worth a damn.  When was the last time you ran an NT box with no LAN, no 
floppy, and with a modified BIOS?  Not exactly a useful product.  Then 
again, assuming you duplicate this setup, place said machine nearish to a 
window.  Electronic eavesdropping (for about $3000 and change) or outside 
observation does tend to degrade the usefulness of said rating does it 
not?

>As mentioned the products are B1 compliant (awaiting certification)....
whatever, see above.

>They are relatively easy to setup , nice GUI and it has built in the
Ah, the GUI.  Remote manageable too I think I recall.  What to say when 
the X11 session gets hijacked?  You sure the box isn't running a 
braindamaged X11 server?  Can you attack the logging facility thru DOS?  
What happens when you bog the machine down with hundreds of connections?  
Does it run out of VM and spontaneously reboot?  How about the logs 
filling up the disk?  What happens when this occurs and an exploit is 
then launched?  Do you still have an audit trail?

>ablity for most "standard "(excuse the word) proxies and allows creation
>of probably anything you might need.
So they know how to check off all of the feature boxes on the report 
card.  Anybody can and everybody does that.

IMO ratings, be they NSA/NCSA or whatever aren't worth much and 
deffinately not a price premium.  I take far more comfort in people 
banging away at the available stuff and fixing the problems.  
Additionally, you really believe the vendor (or reviewer for that matter) 
went thru every single line of code specifically looking for possible 
exploits?  Get real.  All the ratings do is study the protection scheme 
and bless it as logical and OK at least in theory.  Then with various 
degrees of persistance they try to prove you can't get around said 
protection.  Holes and stack smashes by way of poorly written C and 
resolver libraries and DOS via SYN etc. aren't addressed.  If they were 
we wouldn't be plagued with some of the problems we have now.

From firewalls-owner  Sat Feb  1 20:25:39 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id UAA13424 for firewalls-outgoing; Sat, 1 Feb 1997 20:19:41 -0800 (PST)
Received: from mcfeely.bsfs.org (mcfeely.bsfs.org [204.91.13.34]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id UAA13416 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 20:19:28 -0800 (PST)
Received: (from wombat@localhost) by mcfeely.bsfs.org (8.6.12/8.6.12) id WAA23134; Sat, 1 Feb 1997 22:06:36 -0500
Date: Sat, 1 Feb 1997 22:06:30 -0500 (EST)
From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: "Starkweather, Mike" <mike.starkweather@anheuser-busch.com>
cc: "'firewalls@GreatCircle.COM'" <firewalls@GreatCircle.COM>
Subject: Re: Highly available Internet connection
In-Reply-To: <c=US%a=attmail%p=BUSCH%l=STLABCEXG010-970129224027Z-19370@stlabcexg001.anheuser-busch.com>
Message-ID: <Pine.BSF.3.91.970201220224.23106A-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Without two circuits, a local loop failure will take you down. You are 
much better off running two circuits, to two different ISPs, from two of 
your sites. Make sure you don't use two different ISPs that are both 
heavily dependant on the same MAE or NAP, or have heavily interdependant 
peering arangements, such that failure of a core router can still take out 
both.

-r.w.


On Wed, 29 Jan 1997, Starkweather, Mike wrote:

> My company wants to move toward Electronic Commerce on the Internet. 
>  One of the requirements would be a highly available, secure 
> connection.  One of the ideas I have considered is two firewalls going 
> out over two routers to two wide area links to two ISPs.  This is a 
> pretty brute force approach.
> 
> Does anyone have any ideas to share on how we might build an Internet 
> connection that would approach 100 percent availability?
> 
> Thanks for all your help.
> 
> Mike Starkweather
> Anheuser-Busch
> 

From firewalls-owner  Sat Feb  1 20:57:31 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id UAA14180 for firewalls-outgoing; Sat, 1 Feb 1997 20:42:38 -0800 (PST)
Received: from news.rc.on.ca ([207.176.151.6]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id UAA14164 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 20:42:24 -0800 (PST)
Received: by mail.rc.on.ca with Internet Mail Service (5.0.1389.3)
	id <01BC1099.5A732EB0@mail.rc.on.ca>; Sat, 1 Feb 1997 23:40:49 -0500
Message-ID: <41FDA823FC5AD011A0970000E8D5C667029390@mail.rc.on.ca>
From: Russ <Russ.Cooper@RC.on.ca>
To: Adam Shostack <adam@homeport.org>,
        "'Todd Graham Lewis'"
	 <lists@reflections.mindspring.com>
Cc: firewalls@GreatCircle.COM
Subject: RE: [NTSEC] ActiveX, MSIE and Quicken
Date: Sat, 1 Feb 1997 23:40:48 -0500
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1389.3)
Content-Type: text/plain;
	charset="iso-8859-1"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

To try and keep this on a Firewalls vein. The tunneling of anything over
HTTP is, in my opinion, the crappy technology. That goes for Java
applets or certificate authentication for that matter. I don't like the
idea of combining diverse tasks within a single channel if its possible
to avoid it, and it is possible, so the only reason its not being done
is to USURP FIREWALLS.

ActiveX as an Internet web surfing technology (i.e. interaction between
non-cooperating trust environments), despite the ability for vendors to
incorporate their bar codes on their packages, is just another
implementation of that same crappy technology.

BUT...

The issue is whether or not there is to be a future technology that
isn't crappy. I don't see how Firewall administrators can honestly say
that they trust Java applets any more than you can say you trust ActiveX
objects, when their coming from an untrusted source (even if that source
has signed the applet with a trustable digital certificate). Now don't
respond with the Java applets are more secure than ActiveX objects
thing, please. Neither can be completely trusted to the extent necessary
for a Firewall administrator to honestly say its OK to let it in.
ActiveX has no security, and Java applets have lots of security, but
neither provide sufficient control or reporting for a Firewall
administrator to really know what's happening where, and the sandbox
can't be trusted enough to say you don't need to care what a Java applet
it doing, IMO.

So neither technology are THE answer. Both technologies are
demonstrations of future technology which will become AN answer. Whether
either survive, or some hybrid or completely different technology
emerges as THE answer is still to be seen.

I argue that its been possible for applications to be installed on an
OLE machine and do what these malicious ActiveX objects (or hypothetical
objects) can do. It was required for them to be retrieved (in whatever
fashion), installed (in a variety of fashions including Trojans), and
invoked (again, covertly was not out of the question). So in the case of
an ActiveX object from a web page, you are asked if you want to retrieve
the object, whether or not it should be installed, and whether or not it
should be invoked. The issue seems to be how easy that has become, but
Windows 95 and NT 4.0 both implement a model that make that easy and
somewhat hidden (a shortcut accessed across a network share could easily
install itself without any notification whatsoever).

ActiveX is a big word, it covers a whole spate of technologies, of which
only one is its ability to be downloaded/installed/invoked from a web
page. Disparaging ActiveX as a technology because of one aspect of it is
like saying that Java applets are useless because they allow a reverse
connection back to their originating machine. Its one part of the
technology that needs to be replaced/improved.

Since Windows HAS BECOME an ActiveX environment, from top to bottom,
what's needed now is more emphasis on the environments security. Windows
NT 4.0 represents, somewhat, the environment that all OLE-based
platforms have to become. An environment where distributed computing is
possible, but can also be implemented securely. But this discussion
digresses into issues that shouldn't be debated here.

Bottom line is that with so little interest by Firewall administrators
in desktop security, their minds concreted in the idea that everything
is going to be controlled at the company gates by the GateKeeper, its
obvious that the Tunnellers will win and the GateKeepers will lose. With
that goes the legacy systems that put bottlenecks on technology and
innovation in favour of time-tested and proven security models. Fine,
it'll work great for lots of implementations, but while those walls
crumble and the GateKeeper continues to be assailed from his/her own
charges, at some point the realization will hit them that desktop
security and an integrated administration/security platform is the only
model that can move forward with the technology.

They say that a month on the web is the equivalent of a year for
anything else. So if a new Internet product is in public beta for 5
months, that's supposed to be the equivalent of 5 years. Obviously from
a security perspective this analogy doesn't work, since people aren't
testing products 12 times faster than they used to...;-] But if IS
decisions are being done at or near the pace of the Internet, clearly
something has to give somewhere. The only way that can happen is to
expand the scope of the GateKeeper from beyond the Firewall to include
the desktop. If these new technologies are implemented with this in
mind, it would be possible for a Firewall admin to probe, control, and
enforce a security policy at the desktop through a server cooperating
with the Firewall. ActiveX does make this possible, but the tools don't
exist yet (or aren't widely known) so it seems impossible.

So again I say it, block ActiveX objects if you can at your Firewall.
But get your head out of the sand and realize that this very same
technology could be put to valuable use in your environment to enhance
your ability to implement and enforce your security policy, and it all
could be done in total cooperation with your Firewall. All we have to do
is force the vendors to deliver the products that could do this. This
doesn't translate to a call for NT Firewalls (although light 'em if you
have 'em).

But if you think you can say that ActiveX is bad so take it way, you'll
have to tell them to take away all your MS desktops as well. I'm sure
many of you have been saying that for a while now, but the facts are in
front of the majority of you and can be seen just by looking around your
office.

> Cheers,
> Russ
> R.C. Consulting, Inc. - NT/Internet Security Consulting
> "Why does Plug-n-Play so often turn into Unplug-n-Pay?"

From firewalls-owner  Sat Feb  1 21:33:18 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id VAA15971 for firewalls-outgoing; Sat, 1 Feb 1997 21:08:59 -0800 (PST)
Received: from mcfeely.bsfs.org (mcfeely.bsfs.org [204.91.13.34]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id VAA15919 for <Firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 21:08:41 -0800 (PST)
Received: (from wombat@localhost) by mcfeely.bsfs.org (8.6.12/8.6.12) id WAA23257; Sat, 1 Feb 1997 22:55:57 -0500
Date: Sat, 1 Feb 1997 22:55:52 -0500 (EST)
From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: Matthew Archibald <matt@plato.West.Sun.COM>
cc: pyb@cadrus.fr, Firewalls@GreatCircle.COM
Subject: Re: Internal modems ?
In-Reply-To: <199701292016.MAA16951@plato.West.Sun.COM>
Message-ID: <Pine.BSF.3.91.970201225411.23106C-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



On Wed, 29 Jan 1997, Matthew Archibald wrote:

> 
> 
> 
> Two methods will work here...
> 
> 
> 	1) Get a dialer like 'toneloc' or other wardialer 
> 	   and run random checks against all known internal
> 	   phone numbers.
> 		- If a modem answers you have a hit
> 		- If it goes to voice or someone answers
> 		  they know you are checking, but hey,
> 		  that's what you want anyway
> 

Actually, they *might* know *somebody* is checking; be interesting to 
find out if anyone reports what they hear ... my guess is that nobody 
will even mention it to the IS team.

-r.w.

From firewalls-owner  Sat Feb  1 21:40:49 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id VAA16550 for firewalls-outgoing; Sat, 1 Feb 1997 21:13:59 -0800 (PST)
Received: from mail.primary.net (mail.primary.net [205.242.92.3]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id VAA16492 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 21:13:35 -0800 (PST)
Received: from desktop (pn7-ppp-106.primary.net [205.242.93.106]) by mail.primary.net (8.8.5/+primary) with SMTP id XAA09705 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 23:16:19 -0600 (CST)
Message-ID: <32F421E1.2F0C@primary.net>
Date: Sat, 01 Feb 1997 23:10:57 -0600
From: "Paul A. Murphy" <pamurphy@primary.net>
X-Mailer: Mozilla 3.0 (Win95; U)
MIME-Version: 1.0
To: firewalls@GreatCircle.COM
Subject: NT Firewalls
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello!

My company is looking into firewalls to protect our network that is
connected with a T-1.

Our company is migrating to NT as a standard and I am concerned that the
NT Firewalls are generally less secure than the UNIX firewalls and am
looking for material to make my case that the firewall be UNIX.

I would appreciate any comments related to the UNIX vs NT debate.

Thanks

Paul Murphy
St. Louis

From firewalls-owner  Sat Feb  1 21:55:27 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id VAA19188 for firewalls-outgoing; Sat, 1 Feb 1997 21:39:00 -0800 (PST)
Received: from mcfeely.bsfs.org (mcfeely.bsfs.org [204.91.13.34]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id VAA19135 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 21:38:43 -0800 (PST)
Received: (from wombat@localhost) by mcfeely.bsfs.org (8.6.12/8.6.12) id XAA23327; Sat, 1 Feb 1997 23:25:48 -0500
Date: Sat, 1 Feb 1997 23:25:43 -0500 (EST)
From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: Dave Cosio <dcosio@tanis.cptech.com>
cc: firewalls@GreatCircle.COM
Subject: Re: Dave at McGraw Hill
In-Reply-To: <32F22D67.4A41@tanis.cptech.com>
Message-ID: <Pine.BSF.3.91.970201232519.23106G-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Dave's not here, man.  ;)

On Fri, 31 Jan 1997, Dave Cosio wrote:

> Dave,
> 
> I had problem with my mail and lost your address.
> could you resend it.
> 
> thanks
> 
> -Dave Cosio
> 

From firewalls-owner  Sat Feb  1 22:08:04 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id VAA16933 for firewalls-outgoing; Sat, 1 Feb 1997 21:19:26 -0800 (PST)
Received: from mcfeely.bsfs.org (mcfeely.bsfs.org [204.91.13.34]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id VAA16902 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 21:19:13 -0800 (PST)
Received: (from wombat@localhost) by mcfeely.bsfs.org (8.6.12/8.6.12) id XAA23271; Sat, 1 Feb 1997 23:06:19 -0500
Date: Sat, 1 Feb 1997 23:06:14 -0500 (EST)
From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: Laura_Bohde@prenhall.com
cc: "'firewalls@GreatCircle.COM'" <firewalls@GreatCircle.COM>,
        "Starkweather; Mike" <mike.starkweather@anheuser-busch.com>
Subject: Re: Highly available Internet connection
In-Reply-To: <2F023040.@prenhall.com>
Message-ID: <Pine.BSF.3.91.970201230533.23106D-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Not very resistant to back-hoe fade ...

On Wed, 29 Jan 1997 Laura_Bohde@prenhall.com wrote:

>         
>         We have two routers connected to the Internet configured 
>         identically, as well as two hubs, two firewalls, and two 
>         hubs on the other side.  Then we installed Black Box 
>         power on/off switches (one on each router, and one on 
>         each hub at the other end).  This way we can leave one 
>         network up and the other powered off.  If any device in 
>         the "primary" network fails, with a simple phone call 
>         (our help desk can even do this), one network can be 
>         powered off and the other powered up.  (this way all 
>         equipment can actually have the same IP addresses too.)
>         
>         Hope this helps -
>         
>         Laura
> 

From firewalls-owner  Sat Feb  1 23:13:32 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id WAA27794 for firewalls-outgoing; Sat, 1 Feb 1997 22:58:15 -0800 (PST)
Received: from xyzzy.plugh.edmonton.ab.ca (xyzzy.plugh.edmonton.ab.ca [198.161.22.2]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id WAA27787 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 22:58:04 -0800 (PST)
Received: (from uucp@localhost) by xyzzy.plugh.edmonton.ab.ca (8.6.12/8.6.9) id XAA21095; Sat, 1 Feb 1997 23:56:29 -0700
Received: from snouts-gw.obtuse.com(192.168.30.61), claiming to be "snouts.obtuse.com"
 via SMTP by mailhost.plugh.edmonton.ab.ca, id smtpd21092aaa; Sat Feb  1 23:56:21 1997
Received: (from beck@localhost) by snouts.obtuse.com (8.7.5/8.7.3) id XAA01520; Sat, 1 Feb 1997 23:56:17 -0700
From: Bob Beck <beck@obtuse.com>
Message-Id: <199702020656.XAA01520@snouts.obtuse.com>
Subject: Re: [NTSEC] ActiveX, MSIE and Quicken
To: Russ.Cooper@RC.on.ca (Russ)
Date: Sat, 1 Feb 1997 23:56:15 -0700 (MST)
Cc: adam@homeport.org, lists@reflections.mindspring.com,
        firewalls@GreatCircle.COM
In-Reply-To: <41FDA823FC5AD011A0970000E8D5C667029390@mail.rc.on.ca> from "Russ" at Feb 1, 97 11:40:48 pm
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> To try and keep this on a Firewalls vein. The tunneling of anything over
> HTTP is, in my opinion, the crappy technology. That goes for Java
> applets or certificate authentication for that matter. I don't like the
> idea of combining diverse tasks within a single channel if its possible
> to avoid it, and it is possible, so the only reason its not being done
> is to USURP FIREWALLS.

	Perhaps if you're using only a packet filter yes, but
hopefully on a real firewall you're proxying your http, and there's
nothing at all to "USURP". You recognize it, and deal with it in the
proxy.
	
	Notwithstanding that, doing embedded "stuff" like this is
normal, and doing evil with it is a lot older than http:

----------------------
oldvax%mail bigluser@sucker.org
Subject: Hey Dude, Try this neat new script out..
#!/bin/sh
[ insert hack here - trojan .login to mail me their password next time]
[ etc. etc. ]  

From firewalls-owner  Sun Feb  2 00:55:26 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id AAA04631 for firewalls-outgoing; Sun, 2 Feb 1997 00:37:17 -0800 (PST)
Received: from hamlin.cc.boun.edu.tr (hamlin.cc.boun.edu.tr [193.140.192.9]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id AAA04613 for <Firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 00:36:59 -0800 (PST)
Received: from ReAlbi.cc.boun.edu.tr by hamlin.cc.boun.edu.tr (AIX 4.1/UCB 5.64/4.03)
          id AA61498; Sun, 2 Feb 1997 10:31:15 +0300
Message-Id: <32F4513E.3BA1440E@boun.edu.tr>
Date: Sun, 02 Feb 1997 10:33:02 +0200
From: Can Baysal <baysalc@boun.edu.tr>
Organization: BUCC
X-Mailer: Mozilla 3.01Gold (X11; I; Linux 1.3.20 i586)
Mime-Version: 1.0
To: "'Firewalls@GreatCircle.COM'" <Firewalls@GreatCircle.COM>
Subject: Re: SATAN user group?
References: <c=US%a=_%p=NASA%l=KSCMBS30-970129232003Z-3746@kscgws00.ksc.nasa.gov>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Ferrell-1, Ema wrote:
> 
> Hi all,
> 
.....................
> P.S.  For those who don't know SATAN stands for Security Administrator's
> Tool for Analyzing Networks.

	Hey, thanks for the information, I was trying to find out why they do
not call that as SANTA. I wonder, what they do if Venema and Farmer
heard this. Maybe they will write something like repent.


> 
> Thanks in advance,
> 
> Ema Ferrell
> Subsystems Engineering Branch
> Shuttle Data Center/DE-CLC-A
> 407-861-7275 (phone #)
> 407-861-7470 (fax #)

From firewalls-owner  Sun Feb  2 02:41:18 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id BAA07905 for firewalls-outgoing; Sun, 2 Feb 1997 01:46:12 -0800 (PST)
Received: from polaris.pacificnet.net (polaris.pacificnet.net [207.171.0.250]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id BAA07889 for <Firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 01:45:54 -0800 (PST)
From: osiris@pacificnet.net
Received: from lwash (pm3a-16.pacificnet.net [207.171.18.17]) by polaris.pacificnet.net (8.6.11/8.6.11) with SMTP id BAA25173; Sun, 2 Feb 1997 01:43:38 -0800
Message-ID: <32F462D3.38E3@pacificnet.net>
Date: Sun, 02 Feb 1997 01:48:03 -0800
Organization: -
X-Mailer: Mozilla 3.01Gold (Win95; I)
MIME-Version: 1.0
To: Can Baysal <baysalc@boun.edu.tr>
CC: "'Firewalls@GreatCircle.COM'" <Firewalls@GreatCircle.COM>
Subject: Re: SATAN user group?
References: <c=US%a=_%p=NASA%l=KSCMBS30-970129232003Z-3746@kscgws00.ksc.nasa.gov> <32F4513E.3BA1440E@boun.edu.tr>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Can Baysal wrote:
> 
> Ferrell-1, Ema wrote:
> >
> > Hi all,
> >
> .....................
> > P.S.  For those who don't know SATAN stands for Security Administrator's
> > Tool for Analyzing Networks.
> 
>         Hey, thanks for the information, I was trying to find out why they do
> not call that as SANTA. I wonder, what they do if Venema and Farmer
> heard this. Maybe they will write something like repent.

You are either joking or have landed on the most unlikely coincidence!
Contained within the SATAN distribution is a script called "repent" that
will change all references of "SATAN" to "SANTA." In any event..

Has anyone on this list tried "Merlin?" I am wondering whether anyone
has attempted to make a siilar interface to manage firewall
admnistration and auditing. (Merln is a tool from CIAC. It integrates
Tripwire, COPS, TIGER, Crack and reportedly, SPI, which is unavailable
to us regular folk. The interface is exclusively PERL/HTML for use in
X.)

From firewalls-owner  Sun Feb  2 03:04:29 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id CAA09423 for firewalls-outgoing; Sun, 2 Feb 1997 02:14:27 -0800 (PST)
Received: from hamlin.cc.boun.edu.tr (hamlin.cc.boun.edu.tr [193.140.192.9]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id CAA09415 for <Firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 02:14:00 -0800 (PST)
Received: from ReAlbi.cc.boun.edu.tr by hamlin.cc.boun.edu.tr (AIX 4.1/UCB 5.64/4.03)
          id AA28350; Sun, 2 Feb 1997 12:07:50 +0300
Message-Id: <32F467E1.7E1C0F55@boun.edu.tr>
Date: Sun, 02 Feb 1997 12:09:37 +0200
From: Can Baysal <baysalc@boun.edu.tr>
Organization: BUCC
X-Mailer: Mozilla 3.01Gold (X11; I; Linux 1.3.20 i586)
Mime-Version: 1.0
To: "'Firewalls@GreatCircle.COM'" <Firewalls@GreatCircle.COM>
Subject: Re: SATAN user group?
References: <c=US%a=_%p=NASA%l=KSCMBS30-970129232003Z-3746@kscgws00.ksc.nasa.gov> <32F4513E.3BA1440E@boun.edu.tr> <32F462D3.38E3@pacificnet.net>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

osiris@pacificnet.net wrote:
> 
> >         Hey, thanks for the information, I was trying to find out why they do
> > not call that as SANTA. I wonder, what they do if Venema and Farmer
> > heard this. Maybe they will write something like repent.
> 
> You are either joking or have landed on the most unlikely coincidence!

	:)

> Contained within the SATAN distribution is a script called "repent" that
> will change all references of "SATAN" to "SANTA." In any event..
> 
> Has anyone on this list tried "Merlin?" I am wondering whether anyone
> has attempted to make a siilar interface to manage firewall
> admnistration and auditing. (Merln is a tool from CIAC. It integrates
> Tripwire, COPS, TIGER, Crack and reportedly, SPI, which is unavailable

	You know it is the way of our days, you can reach parts but not the
whole. 

> to us regular folk. The interface is exclusively PERL/HTML for use in
> X.)

From firewalls-owner  Sun Feb  2 04:55:28 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id EAA16076 for firewalls-outgoing; Sun, 2 Feb 1997 04:43:16 -0800 (PST)
Received: from gargoyle.clark.net (pa1dsp11.dcwt.infi.net [208.136.65.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id EAA16068 for <firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 04:42:52 -0800 (PST)
Received: (qmail 21874 invoked by uid 500); 2 Feb 1997 12:42:42 -0000
Date: Sun, 2 Feb 1997 07:42:42 -0500 (EST)
From: "Paul D. Robertson" <proberts@clark.net>
X-Sender: proberts@gargoyle
To: Russ <Russ.Cooper@RC.on.ca>
cc: Adam Shostack <adam@homeport.org>,
        "'Todd Graham Lewis'" <lists@reflections.mindspring.com>,
        firewalls@GreatCircle.COM
Subject: RE: [NTSEC] ActiveX, MSIE and Quicken
In-Reply-To: <41FDA823FC5AD011A0970000E8D5C667029390@mail.rc.on.ca>
Message-ID: <Pine.LNX.3.91.970202071714.18864S-100000@gargoyle>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Sat, 1 Feb 1997, Russ wrote:

> To try and keep this on a Firewalls vein. The tunneling of anything over
> HTTP is, in my opinion, the crappy technology. That goes for Java
> applets or certificate authentication for that matter. I don't like the
> idea of combining diverse tasks within a single channel if its possible
> to avoid it, and it is possible, so the only reason its not being done
> is to USURP FIREWALLS.

Right, this is my whole problem with SSL.  SHTTP was better, though I'd 
prefer that the firewall be able to man-in-the-middle the crypto stuff in 
either case, so as to pass it through an application layer gateway.  
 
> administrator to really know what's happening where, and the sandbox
> can't be trusted enough to say you don't need to care what a Java applet
> it doing, IMO.

This is an issue with the implementation of the JVM though, which is 
certainly a better thing that straight object code.  It's more a 'lesser 
of two evils' situation.  I *could* see the JVM actually evolving into a 
trusted environment, or more properly, into a well-bounded untrusted 
one.  I can't see OLE ever doing the same, so I'd rather try to back the 
horse that I'd like to see win.

> So neither technology are THE answer. Both technologies are
> demonstrations of future technology which will become AN answer. Whether
> either survive, or some hybrid or completely different technology
> emerges as THE answer is still to be seen.

Which makes this the right time to be pressing for improvements in both,
which blocking by enough people will get addressed.  Certainly, the fact that
ActiveX was holding us back from authorizing IE as an approved browser 
got at least a preliminary answer from MS.  It's too bad they won't 
follow up on specific implementation deficiencies as quickly.

> Windows 95 and NT 4.0 both implement a model that make that easy and
> somewhat hidden (a shortcut accessed across a network share could easily
> install itself without any notification whatsoever).

This is true, and I think a number of companies are falling back to the
old military compartmentalization model, I know we certainly are.  The 
first order of business is to tighten down the interaction between the
'internal to the company' and the 'external to the company' zones, then 
the internal ones get the next set of restrictions.

> what's needed now is more emphasis on the environments security. Windows
> NT 4.0 represents, somewhat, the environment that all OLE-based
> platforms have to become. An environment where distributed computing is
> possible, but can also be implemented securely. But this discussion
> digresses into issues that shouldn't be debated here.

NT 4.0 is a start, but it certainly isn't the culmination of that evolution.

> Bottom line is that with so little interest by Firewall administrators
> in desktop security, their minds concreted in the idea that everything
> is going to be controlled at the company gates by the GateKeeper, its
> obvious that the Tunnellers will win and the GateKeepers will lose. With
> that goes the legacy systems that put bottlenecks on technology and
> innovation in favour of time-tested and proven security models. Fine,
> it'll work great for lots of implementations, but while those walls
> crumble and the GateKeeper continues to be assailed from his/her own
> charges, at some point the realization will hit them that desktop
> security and an integrated administration/security platform is the only
> model that can move forward with the technology.

The only way you can be proactive with desktop security is to control 
what runs on the desktop.  That's why it's important to get the 
developers listening now, and not to accept blind tunneling.

> is force the vendors to deliver the products that could do this. This
> doesn't translate to a call for NT Firewalls (although light 'em if you
> have 'em).

It certainly *shouldn't* translate to a call for NT firewalls, that's too 
much like in-band control of the phone switch.

> But if you think you can say that ActiveX is bad so take it way, you'll
> have to tell them to take away all your MS desktops as well. I'm sure
> many of you have been saying that for a while now, but the facts are in
> front of the majority of you and can be seen just by looking around your
> office.

$300 NCs would make that a viable alternative.  Too bad that's not a 
fiscal reality.  The fact is that most desktop users in a corporate 
environment don't *need* OLE, or most of the other bloat that comes with 
a desktop OS.  Most of them don't *need* the Internet either.  But I'm 
still not at a point where I'm ready to pack up my toys and go home.

With the right JVM, or with a JVM on the right hardware, Java can be 
well-bounded enough to be trustworthy.  There's a couple of years worth 
of work there, but it is possible.  I just don't see how you can do it, 
even with twice as long with OLE.  

Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
proberts@clark.net      which may have no basis whatsoever in fact."
                                                                     PSB#9280


From firewalls-owner  Sun Feb  2 07:28:20 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id HAA20065 for firewalls-outgoing; Sun, 2 Feb 1997 07:10:38 -0800 (PST)
Received: from internic.uob.bh ([193.188.12.10]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id HAA20012 for <firewalls@greatcircle.com>; Sun, 2 Feb 1997 07:10:15 -0800 (PST)
Received: from netmgr.uob.bh ([193.188.12.65]) by internic.uob.bh
          (Netscape Mail Server v2.0) with SMTP id AAA7058
          for <firewalls@greatcircle.com>; Sat, 1 Feb 1997 08:45:59 +0300
Message-ID: <32F2D77E.6B7C@admin.uob.bh>
Date: Sat, 01 Feb 1997 08:41:18 +0300
From: "Hisham Abdullatif Al-Rumaihi" <rumaihi@admin.uob.bh>
Reply-To: rumaihi@admin.uob.bh
Organization: University of Bahrain
X-Mailer: Mozilla 3.0 (Win95; I)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: DHCP
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

We are using DHCP server runing on windows NT 4.0, is it possible to
view/print the DHCP database?.

Can you suggust any mailing list that is relatd to (networks).

Thank you.

From firewalls-owner  Sun Feb  2 11:25:37 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id LAA28196 for firewalls-outgoing; Sun, 2 Feb 1997 11:08:54 -0800 (PST)
Received: from smtp2.erols.com (smtp2.erols.com [205.252.116.102]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id LAA28159 for <firewalls-digest@greatcircle.com>; Sun, 2 Feb 1997 11:08:41 -0800 (PST)
Received: from chris ([208.199.94.198])
	by smtp2.erols.com (8.8.5/8.8.5) with SMTP id OAA10765
	for <firewalls-digest@greatcircle.com>; Sun, 2 Feb 1997 14:07:23 -0500 (EST)
Message-ID: <32F4E5E9.1504@tidalwave.net>
Date: Sun, 02 Feb 1997 14:07:21 -0500
From: Chris Pressley <chrisp@tidalwave.net>
Reply-To: chrisp@sitescape.com
X-Mailer: Mozilla 3.0 (Win95; U)
MIME-Version: 1.0
To: firewalls-digest@greatcircle.com
Subject: Optimal Throughput for NAT
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

NAT is a small part of my overall security plan. I'm looking for the
best way to implement NAT, primarily from a cost and performance
standpoint. Currently, I know of three ways to do NAT:
  1) Install and configure a firewall
  2) Dedicate a host, using software such as IPRoute    
(http://www.mischler.com/iproute/)
  3) Configure a router (e.g. Cisco with IOS 11.2 and "IP Options")

I'm looking for feedback on the following:
  1) What is my best dollar/cost solution?
  2) Are there other ways to implement NAT that I'm not aware of?

Thanks in advance for any feedback.

Chris


From firewalls-owner  Sun Feb  2 11:45:29 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id LAA28625 for firewalls-outgoing; Sun, 2 Feb 1997 11:25:17 -0800 (PST)
Received: from mail.baileynm.com (fw.baileynm.com [206.109.159.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id LAA28617 for <firewalls@GreatCircle.com>; Sun, 2 Feb 1997 11:25:06 -0800 (PST)
Received: (qmail 10479 invoked from smtpd); 2 Feb 1997 19:23:53 -0000
Received: from web.nmti.com (root@198.178.0.201)
  by fw.nmti.com with SMTP; 2 Feb 1997 19:23:53 -0000
Received: from sonic.nmti.com (peter@sonic.nmti.com [198.178.0.2]) by web.nmti.com (8.6.12/8.6.9) with SMTP id NAA06030; Sun, 2 Feb 1997 13:23:52 -0600
Received: by sonic.nmti.com; id AA10062; Sun, 2 Feb 1997 13:18:18 -0600
From: peter@baileynm.com (Peter da Silva)
Message-Id: <9702021918.AA10062@sonic.nmti.com.nmti.com>
Subject: Re: [NTSEC] ActiveX, MSIE and Quicken
To: Russ.Cooper@RC.on.ca (Russ)
Date: Sun, 2 Feb 1997 13:18:17 -0600 (CST)
Cc: firewalls@GreatCircle.com
In-Reply-To: <41FDA823FC5AD011A0970000E8D5C667029390@mail.rc.on.ca> from "Russ" at Feb 1, 97 11:40:48 pm
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Since Windows HAS BECOME an ActiveX environment, from top to bottom,
> what's needed now is more emphasis on the environments security. Windows
> NT 4.0 represents, somewhat, the environment that all OLE-based
> platforms have to become. An environment where distributed computing is
> possible, but can also be implemented securely. But this discussion
> digresses into issues that shouldn't be debated here.

We've already had this discussion, Russ, so I'll just say that NT at this
time is nowhere *near* an environment where you could even *think* of
running untrusted applications. A Java sandbox, or a chrooted secured
sandbox on certain UNIX implementations, is getting there. The Safe Tcl
sandbox is closer.

I think that you could probably build an extremely useful sandbox using the
NT kernel as a start, though it wouldn't include the Win32 subsystem... or
if it did that subsystem would be so crippled that it wouldn't run any
applications that currently exist out there. I've said before that the
underlying NT security model, while overly complex, has a lot of potential...
but it's never going to acheive that potential in Microsoft's hands, and if
you think otherwise you're fooling yourself.

The UNIX model is less fine-grained, but it's also a lot *simpler*, and there
are ways to shed the parts of a UNIX implementation that don't use that model
without breaking the UNIX API, because it's so much higher level than the
NT one. Just as it's possible to shed the dangerous parts of Tcl without
breaking the ability to do useful things in Tcl... simply because it's such
a high level and simple model.

> Bottom line is that with so little interest by Firewall administrators
> in desktop security, their minds concreted in the idea that everything
> is going to be controlled at the company gates by the GateKeeper,

That's because it's the only place we have any control. We can't control the
desktop, because our users have undeniable business reasons to support the
inherently insecure Windows API. So long as that's true, all we can do is block
the tunnelers. Because the Internet is not near as important as the desktop,
so we can get away with telling people they can't use this or that new internet
toy.

> innovation in favour of time-tested and proven security models. Fine,
> it'll work great for lots of implementations, but while those walls
> crumble and the GateKeeper continues to be assailed from his/her own
> charges, at some point the realization will hit them that desktop
> security and an integrated administration/security platform is the only
> model that can move forward with the technology.

I would dearly like to see that, but I don't believe it will happen. The
desktop is firmly in the hands of a man who can spell security but has no
idea of what it means.

> But if you think you can say that ActiveX is bad so take it way, you'll
> have to tell them to take away all your MS desktops as well.

Love to, but that won't happen. That's like trying to fireproof your
office by banning paper.

> I'm sure
> many of you have been saying that for a while now, but the facts are in
> front of the majority of you and can be seen just by looking around your
> office.

Yep. And those facts say that the desktop will be completely unable to
provide any useful security for the forseeable future.

From firewalls-owner  Sun Feb  2 12:10:29 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id LAA00228 for firewalls-outgoing; Sun, 2 Feb 1997 11:54:21 -0800 (PST)
Received: from neon.ingenia.ca (neon.ingenia.com [205.207.220.57]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id LAA00208 for <firewalls@greatcircle.com>; Sun, 2 Feb 1997 11:54:05 -0800 (PST)
Received: (from shaver@localhost) by neon.ingenia.ca (8.8.5/8.7.3) id OAA23121; Sun, 2 Feb 1997 14:52:31 -0500
From: Mike Shaver <shaver@neon.ingenia.ca>
Message-Id: <199702021952.OAA23121@neon.ingenia.ca>
Subject: Re: [NTSEC] ActiveX, MSIE and Quicken
In-Reply-To: <Pine.LNX.3.95.970131093619.355F-100000@reflections.mindspring.com> from Todd Graham Lewis at "Jan 31, 97 09:42:57 am"
To: lists@reflections.mindspring.com (Todd Graham Lewis)
Date: Sun, 2 Feb 1997 14:52:29 -0500 (EST)
Cc: firewalls@greatcircle.com
X-Mailer: ELM [version 2.4ME+ PL28 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Thus spake Todd Graham Lewis:
> On Fri, 31 Jan 1997, Russ wrote:
> 
> > So yes, plug it up today, that's what I recommend anyway, but What we
> > really need are new/improved desktop security products, not more filters
> > for Firewalls.
> 
> Not to be contentious or anything, but what we _need_ are designers who
> put different technologies on different port numbers rather than cramming
> everything under the sun down port 80.

Pardon the arrogance, but what we _need_ are firewall
designers/implementors/administrators/advocates who have outgrown the
bogus `port = protocol' bit.  Ports have meaning only for connection
management.  The use of `well-known-ports' is a convenience (snicker)
at best, designed to allow people to synchronize their /etc/services
files in lieu of a decent service-location directory or whatever.

Assuming that port 80 means HTTP is only marginally more clueful than
assuming that ports below 1024 are from root and so it's all Really OK
To Trust Them.

(Similarly for assuming that HTTP means HTML and images.)

If you want to filter an application protocol, you need a
application-protocol-level filter.

> Geez, at age 21 I really am too young to get an ulcer.

Not by a fair shot, gramps. =)

Mike

--
#> Mike Shaver (shaver@ingenia.com) Ingenia Communications Corporation 
#>                   Welcome to the technocracy.
#>                                                                     
#> "Nobody ever went broke underestimating the public's intelligence."
#>                    - cbird@chat.carleton.ca

From firewalls-owner  Sun Feb  2 15:38:00 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id OAA13761 for firewalls-outgoing; Sun, 2 Feb 1997 14:50:49 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id OAA13587 for <firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 14:50:07 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-961106)
	id OAA00888; Sun, 2 Feb 1997 14:16:43 -0800
Received: from squirrel.com(192.135.191.159) by mycroft via smap (V1.3mjr)
	id sma000879; Sun Feb  2 14:16:33 1997
Received: (from mch@localhost) by squirrel.com (8.6.12/SQUIRREL-1.0) id OAA15113; Sun, 2 Feb 1997 14:17:57 -0800
Message-ID: <Mutt.19970202141757.mch@ratatosk.squirrel.com>
Date: Sun, 2 Feb 1997 14:17:57 -0800
From: mch@squirrel.com (Mark Henderson)
To: chrisp@sitescape.com
Cc: firewalls@GreatCircle.COM
Subject: Re: Optimal Throughput for NAT
References: <32F4E5E9.1504@tidalwave.net>
X-Mailer: Mutt 0.58.1
Mime-Version: 1.0
Content-Type: multipart/signed; protocol="application/pgp-signature";
	micalg=pgp-md5; boundary=BcSYHtfZcVUIIZwe
In-Reply-To: <32F4E5E9.1504@tidalwave.net>; from Chris Pressley on Feb 2, 1997 14:07:21 -0500
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


--BcSYHtfZcVUIIZwe

Chris Pressley writes:
> NAT is a small part of my overall security plan. I'm looking for the
> best way to implement NAT, primarily from a cost and performance
> standpoint. Currently, I know of three ways to do NAT:
>   1) Install and configure a firewall
>   2) Dedicate a host, using software such as IPRoute    
> (http://www.mischler.com/iproute/)
>   3) Configure a router (e.g. Cisco with IOS 11.2 and "IP Options")
> 
> I'm looking for feedback on the following:
>   1) What is my best dollar/cost solution?
>   2) Are there other ways to implement NAT that I'm not aware of?

I'm not going to attempt to answer the larger question, but you might 
also take a look at IP filter. It provides packet filtering, NAT 
functionality, and support for transparent proxies. It can also keep
some connection state information. 

http://coombs.anu.edu.au/~avalon/ip-filter.html

N.B. Although I like the feature set of this package, it is very much 
still a work in progress. If you aren't comfortable hacking a little 
C or generally playing around with your kernel, you should probably 
stay away from this. 


--BcSYHtfZcVUIIZwe
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a

iQCVAwUBMvUSi6WYCYyyZn7/AQE5igP/WF7pCucj7LBONTbYQ7y6ZASEV2qLQ4qC
Y+Hm/dVWpuwG258kIFen5WnJqEGiluoGicl3crF4cL0tr/AEQHSoSABDuZfuw9Y1
RPhWdljpOmDn2FaxjWr3CSVPEG1BQxAVhGvEj+RSq1pu10JWoGK13C1vbt7gNwqo
yGw18AuW584=
=m8cD
-----END PGP SIGNATURE-----

--BcSYHtfZcVUIIZwe--

From firewalls-owner  Sun Feb  2 15:39:53 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id OAA10394 for firewalls-outgoing; Sun, 2 Feb 1997 14:00:44 -0800 (PST)
Received: from xyzzy.plugh.edmonton.ab.ca (xyzzy.plugh.edmonton.ab.ca [198.161.22.2]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id OAA10330 for <firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 14:00:22 -0800 (PST)
Received: (from uucp@localhost) by xyzzy.plugh.edmonton.ab.ca (8.6.12/8.6.9) id OAA23227; Sun, 2 Feb 1997 14:59:07 -0700
Received: from snouts-gw.obtuse.com(192.168.30.61), claiming to be "snouts.obtuse.com"
 via SMTP by mailhost.plugh.edmonton.ab.ca, id smtpd23225aaa; Sun Feb  2 14:58:56 1997
Received: (from beck@localhost) by snouts.obtuse.com (8.7.5/8.7.3) id OAA02338; Sun, 2 Feb 1997 14:58:54 -0700
From: Bob Beck <beck@obtuse.com>
Message-Id: <199702022158.OAA02338@snouts.obtuse.com>
Subject: Re: [NTSEC] ActiveX, MSIE and Quicken
To: peter@baileynm.com (Peter da Silva)
Date: Sun, 2 Feb 1997 14:58:52 -0700 (MST)
Cc: Russ.Cooper@RC.on.ca, firewalls@GreatCircle.COM
In-Reply-To: <9702021918.AA10062@sonic.nmti.com.nmti.com> from "Peter da Silva" at Feb 2, 97 01:18:17 pm
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


	Banning ActiveX at the firewall is hardly taking away the MS
desktops. It's still viable inside the firewall as long as you're
talking about a relatively trusted environment. If you aren't talking
about a relatively trusted environment inside you probably shouldn't
be running an MS desktop anyway.

> > But if you think you can say that ActiveX is bad so take it way, you'll
> > have to tell them to take away all your MS desktops as well.
> 
> Love to, but that won't happen. That's like trying to fireproof your
> office by banning paper.
> 
	Not all that inconcievable.  There are perfectly viable
alternatives to an MS desktop for anyone who feels like using
them. It's also possible to put them on another net by themselves with
a seperate firewall and security policy. You can even run them fairly
open, with the security policy that sensitive stuff doesn't go on the
open net. I.E. network A is the low security network where the users
are allowed to sysadmin their own desktops. Network B is the high
security network where that isn't allowed, and the permitted OS's are
mandated. Network B doesn't trust network A any more than it trusts
the internet. Not foolproof in the slightest, but draws a better
boundary for the users as to what is important.

	
> > I'm sure
> > many of you have been saying that for a while now, but the facts are in
> > front of the majority of you and can be seen just by looking around your
> > office.
> 
> Yep. And those facts say that the desktop will be completely unable to
> provide any useful security for the forseeable future.
> 

	Microsoft's desktop will always be completely unable to
provide any useful security for the exact same reasons as we've seen
for years and years with Sendmail. It's big, bloated and constantly
afflicted with creeping featuritism. It's not *designed* to provide
useful security, it's designed to work well as a desktop environment
that can sell. period, Just as Sendmail is a MTA first and security
somewhere not first. (This isn't always a bad thing if your first and
formost requirement is a powerful MTA) Security can be addressed for
99% of it's users by a few glossies with the words "Hacker" "Internet"
and "C2" jumbled in the the rest of the marketing hype, since the odds
are they'll never get seriously hit even if they ran a fully unsecured
box.

	-Bob
--
Bob Beck					 Obtuse Systems Corporation
beck@obtuse.com					 http://www.obtuse.com/	
True Evil hides its real intentions in its street address. Search and you
shall find it, and the truth shall set you free.




From firewalls-owner  Sun Feb  2 16:28:33 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id NAA08292 for firewalls-outgoing; Sun, 2 Feb 1997 13:31:34 -0800 (PST)
Received: from smtp1.erols.com (smtp1.erols.com [205.252.116.101]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id NAA08238 for <firewalls@greatcircle.com>; Sun, 2 Feb 1997 13:31:07 -0800 (PST)
Received: from chris ([208.199.94.119])
	by smtp1.erols.com (8.8.5/8.8.5) with SMTP id QAA17222
	for <firewalls@greatcircle.com>; Sun, 2 Feb 1997 16:30:42 -0500
Message-ID: <32F4FE72.7344@tidalwave.net>
Date: Sun, 02 Feb 1997 15:52:02 -0500
From: Chris Pressley <chrisp@tidalwave.net>
Reply-To: chrisp@sitescape.com
X-Mailer: Mozilla 3.0 (Win95; U)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: Optimal Throughput for NAT
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

NAT is a small part of my overall security plan. I'm looking for the
best way to implement NAT, primarily from a cost and performance
standpoint. Currently, I know of three ways to do NAT:
  1) Install and configure a firewall
  2) Dedicate a host, using software such as IPRoute    
     (http://www.mischler.com/iproute/)
  3) Configure a router (e.g. Cisco with IOS 11.2 and "IP Options")

I'm looking for feedback on the following:
  1) What is my best dollar/cost solution?
  2) Are there other ways to implement NAT that I'm not aware of?

Thanks in advance for any feedback.
 
Chris


From firewalls-owner  Sun Feb  2 16:46:45 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id PAA19969 for firewalls-outgoing; Sun, 2 Feb 1997 15:55:03 -0800 (PST)
Received: (mcb@localhost) by miles.greatcircle.com (8.7.4/Miles-960830-1) id PAA19959 for firewalls@greatcircle.com; Sun, 2 Feb 1997 15:54:58 -0800 (PST)
Received: from news.rc.on.ca ([207.176.151.6]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id NAA14337 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 13:38:02 -0800 (PST)
Received: by mail.rc.on.ca with Internet Mail Service (5.0.1389.3)
	id <01BC105E.11DA9840@mail.rc.on.ca>; Sat, 1 Feb 1997 16:36:27 -0500
Message-ID: <41FDA823FC5AD011A0970000E8D5C667029384@mail.rc.on.ca>
From: Russ <Russ.Cooper@RC.on.ca>
To: "'Firewalls Mailing List'" <firewalls@GreatCircle.COM>
Subject: NTBugTraq now available
Date: Sat, 1 Feb 1997 16:36:26 -0500
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1389.3)
Content-Type: text/plain;
	charset="iso-8859-1"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Windows NT BugTraq Mailing List

In the tradition of Aleph One's BugTraq mailing list, this list
has been created to invite the free and open discussion of
Windows NT Security Exploits/Bugs or *SEBs* as I call them. This
list is not intended to be a forum to discuss "how to" issues, but
instead should be used to report reproducible SEBs which you have
personally encountered with Windows NT or its related BackOffice
products.

Q:What is a SEB?
A:Anything that can be done to a Windows NT installation via a
  remote connection (network or RAS) or through the local
  installation of commercial software which causes Windows NT to
  react in anything but an expected fashion. So telnet to TCP port
  135 and typing 15 characters thereby causing the Windows NT CPU
  to go to 100% utilization would be an acceptable topic. Sitting
  at a console logged in as Administrator and removing the
  Administrator's file permissions on the %systemroot%\system32
  would not be considered an acceptable topic.

Do's:
- Discuss SEB resolution or workaround.
- Discuss SEBs in third-party Windows NT products, providing that
  the product is designed for BackOffice.
- Discuss Macintosh, Netware, or Samba/Unix-related SEBs assuming
  that the SEB is related to Windows NT involvement.

Don'ts:
- Discuss Windows '95, unless, and only if, the Windows NT SEB
  can only be reproduced with a Windows '95 client.
- Discuss Windows for Workgroups or Windows 3.x, for any reason.
- Discuss products to enhance security, unless they have been
  proven to resolve an outstanding SEB.
- Discuss Unix SEBs, these should be addressed to
  BUGTRAQ@NETSPACE.ORG (subscribe through LISTSERV@NETSPACE.ORG)
- Discuss general Windows NT Security, how to, what to, why to,
  type questions. The NTSecurity@ISS.net list (subscribe through
  MAJORDOMO@ISS.NET) would be a better forum to discuss these
  issues.

Vendor involvement in the list is not discouraged, but I would
ask that you not use this forum as a method of advertising the
value of your products. If a SEB shows a weakness in Windows NT
design, and your product can resolve that weakness, a short note
indicating TECHNICALLY how your product addresses the issue would
be consider appropriate. If you don't address the issue in a
technical fashion your subscription will be revoked.

Now after reading all of this you'll probably wonder why I'm
being so restrictive. For one, I want to keep the volume low, as
low as possible. I want to keep the content as pertinent as I
possibly can so that the list becomes a useful tool for everyone
using Windows NT. If the list can remain on topic, people will
post SEBs here first, and we will all have an opportunity to
address the issues in a way best suited to our environments.

I would also make a couple of recommendations to you prior to you
posting a security exploit/bug.

1. Don't post SEBs unless you have been able to reproduce it. If
   the subscriber base grows as I expect it will, posting such
   messages may cause many people to waste valuable time trying
   to reproduce something which is not there.

2. When posting a SEB, make sure you include enough relevant
   information about your configuration to make it possible to
   reproduce your scenario. Versions of the relevant software,
   service pack levels of your system, platform, and any
   configuration information which might affect the issue. By
   doing this you will prevent a lot of messages asking you the
   basic questions and make resolution or workaround that much
   quicker.

3. When posting a resolution or workaround, if you have received
   a Microsoft Knowledgebase Article number (a Q#####), please
   post it with your message so everyone can read it if they want.

4. Remember your Non-Disclosure Agreements. Issues pertaining to
   products covered under NDA should not be discussed here, use
   the appropriate Microsoft Newsgroup for these issues.
   Typically, once a product has been released to public beta
   testing your NDA changes to one limiting you from discussing
   performance characteristics of the product. Please check with
   your Microsoft representative or Beta Administration if you
   are at all unsure of your NDA status prior to posting.

This list operates on a confirmation basis. Your subscription,
and every message you post to this list will generate a
confirmation message from LISTSERV@RC.ON.CA. This is there for
your protection to ensure that subscription requests really are
from the actual individual email address. It is also there to let
you think about your message prior to it being posted. This is
not a configurable option.

I hope that the list proves useful to you and your organization.
With the REview option turned off, I hope that it will attract
individuals in organizations who have the ability to address the
issues which get raised on this list. I know from personal
experience that having to pay Microsoft US$195 in order to report
a bug (despite the fact you get a refund 3 or 4 days later) can
often mean the difference between reporting a bug and not. This
list should provide an alternative to that process, and at the
same time, should allow the rest of the Windows NT community the
opportunity both to take up the issue with their own Microsoft
representatives, and protect themselves from the possible
exploits which a SEB might expose them to.

The objective is to get SEB resolution done faster, better, and
with less risk to the Windows NT customer than currently exists.

To subscribe to this Listserv, send a message to
Listserv@rc.on.ca with

SUB NTBUGTRAQ Your Name
SUB NTBUGTRAQ Russ Cooper (for example)

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security Consulting



From firewalls-owner  Sun Feb  2 16:52:31 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id NAA08048 for firewalls-outgoing; Sun, 2 Feb 1997 13:26:58 -0800 (PST)
Received: from postbox.acs.ohio-state.edu (postbox.acs.ohio-state.edu [128.146.214.20]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id NAA07941 for <Firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 13:26:04 -0800 (PST)
Received: from scanner (scanner.oar.net [199.18.97.164])
          by postbox.acs.ohio-state.edu (8.8.5/8.8.4) with SMTP
	  id QAA27595 for <Firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 16:24:31 -0500 (EST)
Message-ID: <32F505D4.369C@osu.edu>
Date: Sun, 02 Feb 1997 16:23:32 -0500
From: Andrew Smith <smith.1431@osu.edu>
Reply-To: smith.1431@osu.edu
X-Mailer: Mozilla 3.01 (WinNT; I)
MIME-Version: 1.0
To: Firewalls@GreatCircle.COM
Subject: (no subject)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Please remove my name from the list.

From firewalls-owner  Sun Feb  2 17:20:30 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id QAA26183 for firewalls-outgoing; Sun, 2 Feb 1997 16:43:13 -0800 (PST)
Received: from mail.baileynm.com (fw.baileynm.com [206.109.159.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id QAA26149 for <firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 16:42:56 -0800 (PST)
Received: (qmail 11075 invoked from smtpd); 3 Feb 1997 00:41:40 -0000
Received: from web.nmti.com (root@198.178.0.201)
  by fw.nmti.com with SMTP; 3 Feb 1997 00:41:40 -0000
Received: from sonic.nmti.com (peter@sonic.nmti.com [198.178.0.2]) by web.nmti.com (8.6.12/8.6.9) with SMTP id SAA22435; Sun, 2 Feb 1997 18:41:12 -0600
Received: by sonic.nmti.com; id AA16657; Sun, 2 Feb 1997 18:35:38 -0600
From: peter@baileynm.com (Peter da Silva)
Message-Id: <9702030035.AA16657@sonic.nmti.com.nmti.com>
Subject: Re: [NTSEC] ActiveX, MSIE and Quicken
To: beck@obtuse.com (Bob Beck)
Date: Sun, 2 Feb 1997 18:35:37 -0600 (CST)
Cc: peter@baileynm.com, Russ.Cooper@RC.on.ca, firewalls@GreatCircle.COM
In-Reply-To: <199702022158.OAA02338@snouts.obtuse.com> from "Bob Beck" at Feb 2, 97 02:58:52 pm
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 	Banning ActiveX at the firewall is hardly taking away the MS
> desktops. It's still viable inside the firewall as long as you're
> talking about a relatively trusted environment. If you aren't talking
> about a relatively trusted environment inside you probably shouldn't
> be running an MS desktop anyway.

Oh, definitely. Russ's comment about it not being the whole OLE environment
but rather the web-enabled part of it being the poroblem is right on. The
terminology war, however, is lost... the phrase "ActiveX" is going to be
forever associated with applets, because that's the obvious technology
difference between OLE and ActiveX.

> 	Not all that inconcievable.  There are perfectly viable
> alternatives to an MS desktop for anyone who feels like using
> them.

Unfortunately, no. Not if you want to be able to effectively do business
in America today. Microsoft's file formats are everywhere, and they work very
hard at making sure that nothing but their products can use them effectively.

> 	Microsoft's desktop will always be completely unable to
> provide any useful security for the exact same reasons as we've seen
> for years and years with Sendmail.

It's worse than sendmail. Eric Allman isn't trying to make Sendmail do
everything (there's no http and nntp in there, for example), and Eric
*is* concerned about security. It's not at the top of the list, but at
least it's *on* the list.

From firewalls-owner  Sun Feb  2 17:36:44 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id NAA07607 for firewalls-outgoing; Sun, 2 Feb 1997 13:18:10 -0800 (PST)
Received: from gw.research.megasoft.com (gw.research.megasoft.com [206.230.35.93]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id NAA07596 for <firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 13:17:54 -0800 (PST)
Received: (from uucp@localhost) by gw.research.megasoft.com (8.7.5/8.7.3-cmcurtin) id QAA15204; Sun, 2 Feb 1997 16:15:26 -0500 (EST)
Received: from goffette.research.megasoft.com(192.168.1.2) by gw.research.megasoft.com via smap (V1.3)
	id sma015202; Sun Feb  2 16:15:20 1997
Received: by goffette.research.megasoft.com (940816.SGI.8.6.9/940406.SGI)
	 id QAA12393; Sun, 2 Feb 1997 16:06:47 -0500
Date: Sun, 2 Feb 1997 16:06:47 -0500
Message-Id: <199702022106.QAA12393@goffette.research.megasoft.com>
From: C Matthew Curtin <cmcurtin@research.megasoft.com>
To: harley@icrf.icnet.uk
Cc: firewalls@GreatCircle.COM
Subject: What is a virus? (was: RE: [NTSEC] ActiveX, MSIE and Quicken )
In-Reply-To: <199701312007.MAA12560@mycroft.GreatCircle.COM>
References: <199701312007.MAA12560@mycroft.GreatCircle.COM>
X-Face: "&>g(&eGr?u^F:nFihL%BsyS1[tCqG7}I2rGk4{aKJ5I_5A\*6RYn4"N.`1pPF9LO!Fa<(gj:12)?=uP2l01e10Gij"7j&-)torL^iBrNf\s7PDLm=rf[PjxtSbZ{J(@@j"q2/iV9^Mx<e%nT[:7s7.-#u*}GAH,bEfbfh-NDqSG`+s
Reply-To: cmcurtin@research.megasoft.com
X-Attribution: mattC
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>>>>> "David" == harley  <harley@icrf.icnet.uk> writes:

David> <pedant> Actually, none of these are defining characteristics
David> of a virus. All a virus has to do to -be- a virus is
David> replicate. </pedant>

Uh, not quite.

A "virus" is so named because of its resemblance to its biological
namesake: it attaches itself to something that's already there.  A
worm also replicates itself, but it does not attach itself to
something that's already there: it is, itself, a standalone program.

The mainstream media has completely blurred the distinction between
the two.  Let's not allow "their" confusion to cause misunderstandings
among "us," eh?

-- 
Matt Curtin  Chief Scientist  Megasoft, Inc.  cmcurtin@research.megasoft.com
http://www.research.megasoft.com/people/cmcurtin/    I speak only for myself
Hacker Security Firewall Crypto PGP Privacy Unix Perl Java Internet Intranet

From firewalls-owner  Sun Feb  2 17:46:46 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id NAA06697 for firewalls-outgoing; Sun, 2 Feb 1997 13:06:02 -0800 (PST)
Received: (mcb@localhost) by miles.greatcircle.com (8.7.4/Miles-960830-1) id NAA06683 for firewalls@greatcircle.com; Sun, 2 Feb 1997 13:05:49 -0800 (PST)
Received: from relay6.UU.NET (relay6.UU.NET [192.48.96.16]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id HAA29127 for <firewalls@greatcircle.com>; Fri, 31 Jan 1997 07:45:58 -0800 (PST)
Received: from cwiz.com by relay6.UU.NET with SMTP 
	(peer crosschecked as: www.cwiz.com [208.210.163.10])
	id QQcawt09367; Fri, 31 Jan 1997 10:45:14 -0500 (EST)
Received: by cwiz.com (SMI-8.6/SMI-SVR4)
	id JAA18433; Fri, 31 Jan 1997 09:50:56 -0600
Date: Fri, 31 Jan 1997 09:50:56 -0600
From: mdb@dosmanos.cwiz.com (Martin D. Baldenegro)
Message-Id: <199701311550.JAA18433@cwiz.com>
To: solid@mozcom.com
Subject: Re: Question on MAC Address
Cc: firewalls@greatcircle.com
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


	Jet,

  You did not state on what type of machine you are running this,
  nor did you state what OS.
  I do know that with Sun's and with SunOS and Solaris, all of the
  ethernet cards will have the same MAC address as the ethernet that
  is onboard. You can change the MAC address with the "ifconfig"
  command (ifconfig qe0 ether 0:0:20:75:a0:23) and specify a MAC
  address.

  Regards,

	/mdb


=======================
Martin D. Baldenegro  |
The Cwiz Group        |
email - mdb@cwiz.com  |
=======================

----- Begin Included Message -----

>From solid@mozcom.com Fri Jan 31 07:18:15 1997
Date: Fri, 31 Jan 1997 19:53:09 +0800
From: "Jet B. Bagadion" <solid@mozcom.com>
Mime-Version: 1.0
To: firewalls@greatcircle.com
Subject: Question on MAC Address
Content-Transfer-Encoding: 7bit

Hi,

I'm using Firewall-1 v2.0 and I'm using a SBus Quad ethernet
controller.  I noticed that when I use the command ifconfig -a ,  le0
and the ethernet ports of the Quad controller have the same ethernet MAC
addresses. Should it be really like that? How will I know the right MAC
address of the ethernet ports?

Thanks.

-- 
Jet B. Bagadion


----- End Included Message -----




From firewalls-owner  Sun Feb  2 18:08:01 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id NAA06566 for firewalls-outgoing; Sun, 2 Feb 1997 13:03:43 -0800 (PST)
Received: (mcb@localhost) by miles.greatcircle.com (8.7.4/Miles-960830-1) id NAA06557 for firewalls@greatcircle.com; Sun, 2 Feb 1997 13:03:29 -0800 (PST)
Received: from mbagate2.mba.com ([206.235.208.3]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id OAA18026 for <Firewalls@GreatCircle.COM>; Thu, 30 Jan 1997 14:28:01 -0800 (PST)
Received: (from mail@localhost) by mbagate2.mba.com (8.6.9/8.6.9) id PAA05329 for <Firewalls@GreatCircle.COM>; Thu, 30 Jan 1997 15:22:43 -0700
Received: from cxh-austin.mba.com(38.228.202.1) by mbagate2.mba.com via smap (V1.3)
	id sma005326; Thu Jan 30 15:22:22 1997
Message-Id: <1.5.4.32.19970130222909.0030742c@mbagate2.mba.com>
X-Sender: cxh@mbagate2.mba.com
X-Mailer: Windows Eudora Light Version 1.5.4 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Thu, 30 Jan 1997 16:29:09 -0600
To: Firewalls@GreatCircle.COM
From: Cynthia He <cxh@mba.com>
Subject: HELP NEEDED: one time password with chroot ftp?
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi, all,

I am trying to set up a chroot ftp area for our clients. We also have a
requirement that users have to use one time passwords to login. I am using
TIS fwtk.

What I have in netperm-table is something like this:

  netacl-ftpd: permit-hosts * -chroot /ftp/others/ -exec /usr/bin/ftpd -d

When a user tries to login, he gets the following error:

  530 Cannot connect to auth server
  ftp: Login failed.
  Remote system type is UNIX.      

It seems that the chroot happens before the user gets authenticated and
hence has no access to the authsrv database. Is there a way to get around this?

Thanks for any help.

Cynthia



From firewalls-owner  Sun Feb  2 18:17:51 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id RAA29850 for firewalls-outgoing; Sun, 2 Feb 1997 17:18:00 -0800 (PST)
Received: from lotus.lotus.com (lotus.com [192.233.136.1]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id RAA29732 for <firewalls@greatcircle.com>; Sun, 2 Feb 1997 17:17:26 -0800 (PST)
From: Martin_Khoo/SIN/Lotus@lotus.com
Received: from internet2.lotus.com by lotus.lotus.com (SMI-8.6/SMI-SVR4)
	id UAA22629; Sun, 2 Feb 1997 20:12:41 -0500
Received: from MTA2.lotus.com by internet2.lotus.com (5.x/SMI-SVR4)
	id AC03920; Sun, 2 Feb 1997 20:09:13 -0500
Received: by mta2.lotus.com(Lotus SMTP MTA v1.05 (305.4 1-15-1997))  id 85256433.00070EA4 ; Sun, 2 Feb 1997 20:17:05 -0400
X-Lotus-Fromdomain: LOTUSINT@LOTUS@MTA
To: chrisp@sitescape.com
Cc: firewalls@greatcircle.com
Message-Id: <48256433.00059512.00@mta2.lotus.com>
Date: Mon, 3 Feb 1997 09:14:29 +0900
Subject: Re: Optimal Throughput for NAT
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk





Hi,

IMHO, NAT is an important component of any security plan. It may be a small
or large part of the overall plan but it varies with the site's policy.

The 3 possible implemenetation of NAT that you mentioned will all work for
you, but I feel that from a cost benefit point of view, the use of a
firewall would make more sense. The firewall does more then NAT and I
believe you would need a firewall as part of your security infrastructure.

Having a dedicated box running a NAT application is kind of wastefull but
then again you may have your reasons for doing so.

Using the router to do NAT seems to make alot of sense for some people but
I feel that you should let the router do what is primarily its main
function : i.e providing routing . Well , many people may disagree with me
on this but NO FLAMES PLEASE.

Cheers!
martin




chrisp@tidalwave.net on 02/03/97 03:07:21 AM

Please respond to chrisp@sitescape.com

To:   firewalls-digest@GreatCircle.COM
cc:    (bcc: Martin Khoo/SIN/Lotus)
Subject:  Optimal Throughput for NAT




NAT is a small part of my overall security plan. I'm looking for the
best way to implement NAT, primarily from a cost and performance
standpoint. Currently, I know of three ways to do NAT:
  1) Install and configure a firewall
  2) Dedicate a host, using software such as IPRoute
(http://www.mischler.com/iproute/)
  3) Configure a router (e.g. Cisco with IOS 11.2 and "IP Options")

I'm looking for feedback on the following:
  1) What is my best dollar/cost solution?
  2) Are there other ways to implement NAT that I'm not aware of?

Thanks in advance for any feedback.

Chris








From firewalls-owner  Sun Feb  2 18:20:08 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id NAA06565 for firewalls-outgoing; Sun, 2 Feb 1997 13:03:36 -0800 (PST)
Received: (mcb@localhost) by miles.greatcircle.com (8.7.4/Miles-960830-1) id NAA06545 for firewalls@greatcircle.com; Sun, 2 Feb 1997 13:03:23 -0800 (PST)
Received: from dns.byelex.nl (dns.byelex.nl [194.229.247.131]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id MAA01790 for <firewalls@GreatCircle.COM>; Thu, 30 Jan 1997 12:01:24 -0800 (PST)
Received: (from cowboy@localhost)
	by dns.byelex.nl (8.8.5/8.8.5) id VAA07482;
	Thu, 30 Jan 1997 21:00:36 +0100
Date: Thu, 30 Jan 1997 21:00:35 +0100 (MET)
From: Kevin McPeake <cowboy@dns.byelex.nl>
X-Sender: cowboy@dns.byelex.nl
To: firewalls <firewalls@GreatCircle.COM>
Subject: Re: checkpoint firewall-1 logs
In-Reply-To: <19970130140437038.AAA208@garyw.citelecom.net>
Message-ID: <Pine.LNX.3.91.970130205812.7417B-100000@dns.byelex.nl>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


I don't know what the policy is on this list for people that continue to 
post msg's like this, but I sent him my copy of the sub-info doc that 
tells him how to unsub himself.

If he continues to post like this...all I can say is he was told how now.

Kev

On Thu, 30 Jan 1997, Gary Williams wrote:

> immediately remove my name from your list!
> 
> ----------
> > From: John Chen/New York/ACMC <John_Chen@ACML.COM>
> > To: firewalls <firewalls@greatcircle.com>
> > Subject: checkpoint firewall-1 logs
> > Date: Wednesday, January 29, 1997 10:41 AM
> > 


         BYELEX BV     Kevin McPeake
  Hulstkamp Gebouw     Internet Consultant
      Maaskade 119     kmpeake@byelex.nl
 3071 NK Rotterdam     kevin@mcpeake.org

"Winner of the Lotus Euro Beacon Award '96"
           http://www.byelex.nl/

I never give them hell.  I just tell the truth and they think it's hell.

- H. Truman                           



From firewalls-owner  Sun Feb  2 19:17:00 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id TAA18733 for firewalls-outgoing; Sun, 2 Feb 1997 19:07:56 -0800 (PST)
Received: from lotus.lotus.com (lotus.com [192.233.136.1]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id TAA18726 for <firewalls@greatcircle.com>; Sun, 2 Feb 1997 19:07:48 -0800 (PST)
From: Martin_Khoo/SIN/Lotus@lotus.com
Received: from internet2.lotus.com by lotus.lotus.com (SMI-8.6/SMI-SVR4)
	id WAA25959; Sun, 2 Feb 1997 22:03:04 -0500
Received: from MTA2.lotus.com by internet2.lotus.com (5.x/SMI-SVR4)
	id AC04771; Sun, 2 Feb 1997 21:59:38 -0500
Received: by mta2.lotus.com(Lotus SMTP MTA v1.05 (305.4 1-15-1997))  id 85256433.001127E7 ; Sun, 2 Feb 1997 22:07:23 -0400
X-Lotus-Fromdomain: LOTUSINT@LOTUS@MTA
To: chrisp@sitescape.com
Cc: firewalls@greatcircle.com
Message-Id: <48256433.00059512.00@mta2.lotus.com>
Date: Mon, 3 Feb 1997 11:00:28 +0900
Subject: Re: Optimal Throughput for NAT
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk





Hi,

IMHO, NAT is an important component of any security plan. It may be a small
or large part of the overall plan but it varies with the site's policy.

The 3 possible implemenetation of NAT that you mentioned will all work for
you, but I feel that from a cost benefit point of view, the use of a
firewall would make more sense. The firewall does more then NAT and I
believe you would need a firewall as part of your security infrastructure.

Having a dedicated box running a NAT application is kind of wastefull but
then again you may have your reasons for doing so.

Using the router to do NAT seems to make alot of sense for some people but
I feel that you should let the router do what is primarily its main
function : i.e providing routing . Well , many people may disagree with me
on this but NO FLAMES PLEASE.

Cheers!
martin




chrisp@tidalwave.net on 02/03/97 03:07:21 AM

Please respond to chrisp@sitescape.com

To:   firewalls-digest@GreatCircle.COM
cc:    (bcc: Martin Khoo/SIN/Lotus)
Subject:  Optimal Throughput for NAT




NAT is a small part of my overall security plan. I'm looking for the
best way to implement NAT, primarily from a cost and performance
standpoint. Currently, I know of three ways to do NAT:
  1) Install and configure a firewall
  2) Dedicate a host, using software such as IPRoute
(http://www.mischler.com/iproute/)
  3) Configure a router (e.g. Cisco with IOS 11.2 and "IP Options")

I'm looking for feedback on the following:
  1) What is my best dollar/cost solution?
  2) Are there other ways to implement NAT that I'm not aware of?

Thanks in advance for any feedback.

Chris








From firewalls-owner  Sun Feb  2 19:36:25 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id TAA18575 for firewalls-outgoing; Sun, 2 Feb 1997 19:05:26 -0800 (PST)
Received: from europa.lif.icnet.uk (europa.lif.icnet.uk [143.65.100.4]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id TAA18557 for <firewalls@greatcircle.com>; Sun, 2 Feb 1997 19:05:17 -0800 (PST)
From: harley@icrf.icnet.uk
Message-Id: <199702030305.TAA18557@miles.greatcircle.com>
Received: by europa.lif.icnet.uk; Mon, 3 Feb 1997 03:03:58 GMT
Subject: Re: What is a virus? (long & off-topic)
To: cmcurtin@research.megasoft.com
Date: Mon, 3 Feb 1997 03:03:58 +0000 (GMT)
Cc: firewalls@GreatCircle.COM
In-Reply-To: <199702022106.QAA12393@goffette.research.megasoft.com> from "C Matthew Curtin" at Feb 2, 97 04:06:47 pm
X-Mailer: ELM [version 2.4 PL23]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> David> <pedant> Actually, none of these are defining characteristics
> David> of a virus. All a virus has to do to -be- a virus is
> David> replicate. </pedant>
> 
> Uh, not quite.

This discussion seems to be getting somewhat metaphysical and 
off-topic. Perhaps follow-ups would be more appropriate via
e-mail. 
> 
> A "virus" is so named because of its resemblance to its biological
> namesake: it attaches itself to something that's already there.

I have to quibble with this, at least in the absence of a definition
of 'attach', since it appears to exclude some boot sector viruses 
(notably those which don't preserve a copy of the original boot sector).
and viruses which -replace- an existing file rather than append, prepend,
or overwrite -part- of the target file.

An adequate definition of attach would also have to cover spawning
viruses, and viruses which modify the FAT rather than the target file.

> A worm also replicates itself, but it does not attach itself to
> something that's already there: it is, itself, a standalone program.
> 
That's a different debate. I'd probably accept your definition, 
personally, but the argument is not as cut and dried as you imply. 
Fred Cohen, for instance, has stated that a worm is a special case
of a virus. ["A short course in computer viruses" - Wiley]
Either way, I don't see its relevance to the original
posting or my follow-up. I didn't state that replication was
a defining characteristic -only- of viruses.

> The mainstream media has completely blurred the distinction between
> the two.  Let's not allow "their" confusion to cause misunderstandings
> among "us," eh?
> 
I didn't think anyone had mentioned worms up to now. My point was 
actually that the original post implied that the secondary 
characteristics of -some- viruses, e.g. covert operation, were
primary characteristics, without mentioning replication at all.
I think you'd find it difficult to find a competent virus 
specialist who was prepared to risk a definition of the term
virus which didn't incorporate the concept of replication.

I resent your implying that I derived my assertion from the 
mainstream media. What knowledge and opinions I may have 
are derived from much more rigorous sources. B-) 

I enclose the following extract from the alt.comp.virus not
as support for my own stance (that would be inappropriate,
since I wrote it, apart from the quotation from Fridrik Skulason),
but because if you're going to attack my stance, you might as
well know what it is. I haven't cut it, since part of it relates
to the original post as well as the squelch to which I'm replying.

----------------------include-------------------------

(3) What is a virus (and what are Trojans and Worms)?
=====================================================

A (computer) virus is a program (a block of executable code) which
attaches itself to, overwrites or otherwise replaces another program
in order to reproduce itself without the knowledge of the PC user.

Most viruses are comparatively harmless, and may be present for
years with no noticeable effect: some, however, may cause random
damage to data files (sometimes insidiously, over a long period)
or attempt to destroy files and disks. Others cause unintended
damage. Even benign viruses (apparently non-destructive viruses)
cause significant damage by occupying disk space and/or main
memory, by using up CPU processing time, and by the time and expense
wasted in detecting and removing them.

A Trojan Horse is a program intended to perform some covert
and usually malicious act which the victim did not expect or want.
It differs from a destructive virus in that it doesn't reproduce,
(though this distinction is by no means universally accepted).

A dropper is a program which installs a virus or Trojan, often
covertly.

A worm is a program which spreads (usually) over network
connections. Unlike a virus, it does not attach itself to a
host program. In practice, worms are not normally associated
with personal computer systems. There is an excellent
and considerably longer definition in the Mk. 2 version of the
Virus-L FAQ.

(The following is a slightly academic diversion)

A lot of bandwidth is spent on precise definitions of some of
the terms above. I have Fridrik Skulason's permission to include
the following definition of a virus, which I like because it
demonstrates most of the relevant issues.

"    #1 A virus is a program that is able to replicate - that is, create
        (possibly modified) copies of itself.

     #2 The replication is intentional, not just a side-effect.

     #3 At least some of the replicants are also viruses, by this
        definition.

     #4 A virus has to attach itself to a host, in the sense that execution
        of the host implies execution of the virus.

  --

  #1 is the main definition, which distinguishes between viruses and Trojans
  and other non-replicating malware.

  #2 is necessary to exclude for example a disk-copying program copying a
  disk, which contains a copy of itself.

  #3 is necessary to exclude "intended" not-quite-viruses.

  #4 is necessary to exclude "worms", but at the same time it has to be broad
  enough to include companion viruses and .DOC viruses. "

---------------------------outclude-------------------------------------

-- 
David Harley                     \   |   /                 alt.comp.virus FAQ
D.Harley@icrf.icnet.uk            \  |  /               & Anti-Virus Web Page
Support & Security Analyst         \ | /         Folk London On-Line gig-list
Imperial Cancer Research Fund   ____\|/____   http://webworlds.co.uk/dharley/

From firewalls-owner  Sun Feb  2 19:40:40 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id TAA20618 for firewalls-outgoing; Sun, 2 Feb 1997 19:32:29 -0800 (PST)
Received: from cat.bbsr.edu (cat.bbsr.edu [198.116.91.161]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id TAA20590 for <firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 19:32:17 -0800 (PST)
Message-Id: <199702030332.TAA20590@miles.greatcircle.com>
Received: from [198.168.1.203] by cat.bbsr.edu
  (SMTPD32-3.00) id AB759BC00C8; Sun Feb 02 23:28:53 1997
From: "Jamie Thain" <jthain@cat.bbsr.edu>
To: "Paul A. Murphy" <pamurphy@primary.net>, <firewalls@GreatCircle.COM>
Subject: Re: NT Firewalls
Date: Sun, 2 Feb 1997 23:35:04 -0500
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1155
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Paul,

This NT vs UNIX firewall issue has been debated several times on this list.
I would suggest that both OS's are able to be secure. And that local
experience in making one or the other secure would help. I would also
suggest that you not consider a firewall a single machine, but a
configuration of several machines to defend against security threats to
your computing environment. 

In the later statement I would suggest that you have at least two different
OS types and two different Firewall vendor protections. For example. 


Firwall/Plus       DMZ                    Firewall-1
 NT             ---    Proxy stuff   ----      UNIX      ---  Internal Lan.

Likewise the security policy you are trying to implement will have a vast
effect on the firewall configuration that you choose.

regards:jamie



----------
> From: Paul A. Murphy <pamurphy@primary.net>
> To: firewalls@GreatCircle.COM
> Subject: NT Firewalls
> Date: Sunday, February 02, 1997 12:10 AM
> 
> Hello!
> 
> My company is looking into firewalls to protect our network that is
> connected with a T-1.
> 
> Our company is migrating to NT as a standard and I am concerned that the
> NT Firewalls are generally less secure than the UNIX firewalls and am
> looking for material to make my case that the firewall be UNIX.
> 
> I would appreciate any comments related to the UNIX vs NT debate.
> 
> Thanks
> 
> Paul Murphy
> St. Louis


From firewalls-owner  Sun Feb  2 23:25:38 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id XAA09987 for firewalls-outgoing; Sun, 2 Feb 1997 23:11:42 -0800 (PST)
Received: from squirrel.com (squirrel.com [192.135.191.159]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id XAA09979 for <firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 23:11:31 -0800 (PST)
Received: (from mch@localhost) by squirrel.com (8.6.12/SQUIRREL-1.0) id XAA16015; Sun, 2 Feb 1997 23:09:39 -0800
Message-ID: <Mutt.19970202230938.mch@ratatosk.squirrel.com>
Date: Sun, 2 Feb 1997 23:09:38 -0800
From: mch@squirrel.com (Mark Henderson)
To: jonesmd@unifiedtech.com (Mike Jones)
Cc: firewalls@GreatCircle.COM, solid@mozcom.com
Subject: Re: Question on MAC Address
References: <199701311328.IAA06926@bass.unifiedtech.com>
X-Mailer: Mutt 0.58.1
Mime-Version: 1.0
Content-Type: multipart/signed; protocol="application/pgp-signature";
	micalg=pgp-md5; boundary=MycPikHgYmatd1I+
In-Reply-To: <199701311328.IAA06926@bass.unifiedtech.com>; from Mike Jones on Jan 31, 1997 08:28:09 -0500
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


--MycPikHgYmatd1I+

Mike Jones writes:
> Yes, it should be like that. It's just the way Suns work. They change
> the MAC address of all Ethernet interfaces to be the same as the 
> "primary" interface (typically le0). It's OK, because MAC addresses only
> really have to be unique on a per-segment basis for things to work, and
> it keeps a 1-to-1 relationship between machines and MAC addresses.
> 
> 	Mike Jones
> 	Sr. Network Computing Advisor
> 	UNIFIED Technologies

On most modern Sun workstations and servers that MAC address is 
stored in NVRAM (SGS-Thomson M48T02, M48T08, M48T59Y depending upon 
the model of Sun). This is the same NVRAM that stores things like 
boot device, nvramrc, input-device, etc. - although the methods for 
modifying this ethernet address in NVRAM are not documented, at least 
by Sun ;-) 

The SS1000 and SC2000 are different in that, the MAC address is 
stored in a flash eeprom. 

In any case, this MAC address in NVRAM is the default MAC address for 
all ethernet and fast ethernet interfaces. You can override this
default for any particular interface with ifconfig. 

Typically this is only an issue when one wants to put two interfaces 
on the same segment. 


--MycPikHgYmatd1I+
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a

iQCVAwUBMvWPLKWYCYyyZn7/AQHO7wP/duAYfPaVNY/ko5vFSYCd0goFr8Fg/xLo
JyrxXBzczT+H3NAVuCKhlNKUHdKqiZifh1GFYpJ6E5duFGCyF9eRQmss+LtyfbPR
WpH0KbzKDUK1LStoeYeSHe7x2vMG9TWQ24YGXnQXrl7XN0ARabd6EB/sO8pHcqtN
QQAEHpBojBs=
=QOo8
-----END PGP SIGNATURE-----

--MycPikHgYmatd1I+--

From firewalls-owner  Mon Feb  3 01:55:50 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id BAA22424 for firewalls-outgoing; Mon, 3 Feb 1997 01:43:48 -0800 (PST)
Received: from loach.cichlid.com (loach.cichlid.com [165.227.20.2]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id BAA22397 for <firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 01:43:26 -0800 (PST)
Received: (from news@localhost) by loach.cichlid.com (8.7.4/8.7.3) id BAA09518; Mon, 3 Feb 1997 01:39:00 -0800
To: firewalls@GreatCircle.COM
Path: cichlid
From: "david.d.b.bolger@ .x400.entropy.ie"@entropy.entropy.ie
Newsgroups: mail.firewalls
Subject: None
Date: 3 Feb 1997 01:38:54 -0800
Lines: 82
Message-ID: <5d4bne$8mf@cichlid.cichlid.com>
NNTP-Posting-Host: cichlid.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Message-ID: <ecdc49d6534dab8a@deliver.cichlid.com>
Lines:  72
Xdeliver: processed on Mon Feb  3 01:38:49 PST 1997
Xdeliver: SENDER fw-1-mailinglist-owner@us.checkpoint.com
Xdeliver: to 
Xdeliver: cc 
Xdeliver: apparent_to 
Xdeliver: from "david.d.b.bolger@ .x400.entropy.ie"@entropy.entropy.ie

X400-Received: by mta EntropyMHS in /PRMD=Entropy/ADMD=ENT/C=ie; Relayed; 03 Feb 97 09:30:09 +0000
X400-Received: by /PRMD=Entropy/ADMD=ENT/C=ie; Relayed; 03 Feb 97 09:30:09 +0000
Date: 03 Feb 97 09:30:20 +0000
Delivery-Date: 03 Feb 97 09:30:20 +0000
Message-Type: Multiple Part
X400-Originator: "david.d.b.bolger@ .x400.entropy.ie"
X400-MTS-Identifier: [/PRMD=Entropy/ADMD=ENT/C=ie;ISOCOR-32eca775-entropymhs]
X400-Recipients: owner-fw-1-mailinglist@us.checkpoint.com
X400-Recipients: ToddK@competitive.com
X400-Recipients: fw-1-mailinglist@us.checkpoint.com
Original-Encoded-Information-Types: IA5-Text
X400-Content-Type: P2-1984
Message-ID: <ISOPRO::DH-EF::63C6::32F61E82*/G=david/I=db/S=bolger/CN=david/O=entropy/OU= /PRMD=entropy/ADMD=ent/C=ie@MHS>
Importance: normal
Subject: RE(2): [FW1] FW logswitch on Windows NT 
Autoforwarded: FALSE
To: owner-fw-1-mailinglist@us.checkpoint.com (Non Receipt Notification Requested)
To: ToddK@competitive.com (Non Receipt Notification Requested)
CC: fw-1-mailinglist@us.checkpoint.com (Non Receipt Notification Requested)
In-Reply-To: <0131084029-Re: FW1 FW logswitch on Windows NT * @MHS>
Conversion: Allowed
Conversion-With-Loss: Allowed
Alternate-Recipient: Prohibited
Content-Identifier: RE(2): ?FW1? FW
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7Bit
Sender: owner-fw-1-mailinglist@us.checkpoint.com

If you disable IP forwarding in NT, then if you wish to use it as a firewall, the packets destined for the other side will not even try to get to the firewall level.
You need to have IP forwarding on, and then let FW-1 control it or not.

===============================
David Bolger - Technical Engineer

Entropy Ltd.
Unit 25 
Sandyford Office Park
Dublin 18
Ireland

Tel: 	++353-1-2940199
Fax: 	++353-1-2940121
email:	David.Bolger@entropy.ie
===============================

---- owner-fw-1-mailinglist(a)us.checkpoint.com's Message ----



 
> The default for Firewall-1 is to 'control IP forwarding' which means
> that although the NT IP forwarding is enbaled packets WILL NOT be
> forwarded unless Firewall-1 permits.  I beleive this is true even when
> the Firewall-1 service is stopped due to the device driver changes to
> the IP stack made by Checkpoint.
> 
> Can anyone confirm this last point for me?
> 

The last point is true. However, it is better to disable ip forwarding 
capablity of NT (I'm quite dark in NT) so that the host would not be
able to forward ip even when FW-1 was unloaded from system.

Nobuhiko Yoshimoto
Nihon Keizai Shimbun Inc.
yoshi@nikkei.co.jp
phone:813-5690-0256
fax:813-5690-0250





From firewalls-owner  Mon Feb  3 02:11:08 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id BAA23499 for firewalls-outgoing; Mon, 3 Feb 1997 01:55:56 -0800 (PST)
Received: from server21.digital.fr (server21.digital.fr [193.56.15.21]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id BAA23415 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 01:55:35 -0800 (PST)
Received: from mail.vbo.dec.com (mail.vbo.dec.com [16.36.208.34]) by server21.digital.fr (8.7.5/8.7) with ESMTP id KAA25596 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 10:58:37 +0100 (MET)
Received: from vbormc.vbo.dec.com (vbormc.vbo.dec.com [16.36.208.94]) by mail.vbo.dec.com (8.7.3/8.7) with ESMTP id KAA05336 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 10:56:07 +0100 (MET)
Received: from becomm.ebo.dec.com (becomm.ebo.dec.com [16.184.208.35]) by vbormc.vbo.dec.com (8.7.3/8.7) with SMTP id KAA17332 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 10:51:09 +0100
Received: from beux1.ebo.dec.com by becomm.ebo.dec.com; (5.65v3.2/1.1.8.2/07Mar96-0234PM)
	id AA04977; Mon, 3 Feb 1997 10:53:44 +0100
Received: by beux1.ebo.dec.com; (5.65v3.2/1.1.8.2/11Feb96-0242PM)
	id AA21150; Mon, 3 Feb 1997 10:53:35 +0100
Subject: NT port numbers needed
To: Firewalls@GreatCircle.COM
X-Mailer: MAILworks 1.7-A
From: Arjo Mukherjee 4663 <mukherje@ebo.dec.com>
Date: Mon, 3 Feb 97 10:53:35 +0100
Message-Id: <970203105335.20842@beux1.ebo.dec.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

Anyone know what are the relevant IP port numbers for NT?  

I read somewhere that NT uses ports 512/tcp and 721-731/tcp for 
print services.

What are the IP ports for File Sharing and other applicable NT
services?

Thanks,
Arjo

From firewalls-owner  Mon Feb  3 02:25:47 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id BAA22373 for firewalls-outgoing; Mon, 3 Feb 1997 01:42:23 -0800 (PST)
Received: from gate.dataquest.com (gate.dataquest.com [206.79.141.1]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id BAA22345 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 01:42:11 -0800 (PST)
Received: from cc.dataquest.com (cc.dataquest.com [206.79.111.244]) by gate.dataquest.com (8.8.3/8.8.0) with SMTP id BAA25438 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 01:41:21 -0800 (PST)
Received: from ccMail by cc.dataquest.com (SMTPLINK V2.11.01)
	id AA854962845; Mon, 03 Feb 97 01:36:38 PST
Date: Mon, 03 Feb 97 01:36:38 PST
From: "Administrator" <Administrator_at_~BarneyPO@dataquest.com>
Message-Id: <9701038549.AA854962845@cc.dataquest.com>
To: Firewalls@GreatCircle.COM
Subject: Message not deliverable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Firewalls-Digest       Monday, February 3 1997       Volume 06 : Number 044



In this issue:

        Re: NT Firewalls
        Re: Question on MAC Address

See the end of the digest for information on subscribing to the Firewalls
or Firewalls-Digest mailing lists and on how to retrieve back issues.

----------------------------------------------------------------------

Date: Sun, 2 Feb 1997 23:35:04 -0500
From: "Jamie Thain" <jthain@cat.bbsr.edu>
Subject: Re: NT Firewalls

Paul,

This NT vs UNIX firewall issue has been debated several times on this list.
I would suggest that both OS's are able to be secure. And that local
experience in making one or the other secure would help. I would also
suggest that you not consider a firewall a single machine, but a
configuration of several machines to defend against security threats to
your computing environment. 

In the later statement I would suggest that you have at least two different
OS types and two different Firewall vendor protections. For example. 


Firwall/Plus       DMZ                    Firewall-1
 NT             ---    Proxy stuff   ----      UNIX      ---  Internal Lan.

Likewise the security policy you are trying to implement will have a vast
effect on the firewall configuration that you choose.

regards:jamie



- ----------
> From: Paul A. Murphy <pamurphy@primary.net>
> To: firewalls@GreatCircle.COM
> Subject: NT Firewalls
> Date: Sunday, February 02, 1997 12:10 AM
> 
> Hello!
> 
> My company is looking into firewalls to protect our network that is
> connected with a T-1.
> 
> Our company is migrating to NT as a standard and I am concerned that the
> NT Firewalls are generally less secure than the UNIX firewalls and am
> looking for material to make my case that the firewall be UNIX.
> 
> I would appreciate any comments related to the UNIX vs NT debate.
> 
> Thanks
> 
> Paul Murphy
> St. Louis

------------------------------

Date: Sun, 2 Feb 1997 23:09:38 -0800
From: mch@squirrel.com (Mark Henderson)
Subject: Re: Question on MAC Address

- --MycPikHgYmatd1I+

Mike Jones writes:
> Yes, it should be like that. It's just the way Suns work. They change
> the MAC address of all Ethernet interfaces to be the same as the 
> "primary" interface (typically le0). It's OK, because MAC addresses only
> really have to be unique on a per-segment basis for things to work, and
> it keeps a 1-to-1 relationship between machines and MAC addresses.
> 
>  Mike Jones
>  Sr. Network Computing Advisor
>  UNIFIED Technologies

On most modern Sun workstations and servers that MAC address is 
stored in NVRAM (SGS-Thomson M48T02, M48T08, M48T59Y depending upon 
the model of Sun). This is the same NVRAM that stores things like 
boot device, nvramrc, input-device, etc. - although the methods for 
modifying this ethernet address in NVRAM are not documented, at least 
by Sun ;-) 

The SS1000 and SC2000 are different in that, the MAC address is 
stored in a flash eeprom. 

In any case, this MAC address in NVRAM is the default MAC address for 
all ethernet and fast ethernet interfaces. You can override this
default for any particular interface with ifconfig. 

Typically this is only an issue when one wants to put two interfaces 
on the same segment. 


- --MycPikHgYmatd1I+
Content-Type: application/pgp-signature

- -----BEGIN PGP SIGNATURE-----
Version: 2.6.3a

iQCVAwUBMvWPLKWYCYyyZn7/AQHO7wP/duAYfPaVNY/ko5vFSYCd0goFr8Fg/xLo
JyrxXBzczT+H3NAVuCKhlNKUHdKqiZifh1GFYpJ6E5duFGCyF9eRQmss+LtyfbPR
WpH0KbzKDUK1LStoeYeSHe7x2vMG9TWQ24YGXnQXrl7XN0ARabd6EB/sO8pHcqtN
QQAEHpBojBs=
=QOo8
- -----END PGP SIGNATURE-----

- --MycPikHgYmatd1I+--

------------------------------

End of Firewalls-Digest V6 #44
******************************

To unsubscribe from Firewalls-Digest, send the following command
in the body of a message to "Majordomo@GreatCircle.COM":

unsubscribe firewalls-digest

If you want to subscribe or unsubscribe an address other than the
account the mail is coming from, such as a local redistribution list,
then append that address to the command; for example, to subscribe
"local-firewalls":

subscribe firewalls-digest local-firewalls@your.domain.net

A non-digest (direct mail) version of this list is also available; to
subscribe to that instead, replace all instances of "firewalls-digest"
in the commands above with "firewalls".

Compressed back issues are available for anonymous FTP from
FTP.GreatCircle.COM, in pub/firewalls/digest/vNN.nMMM.Z (where "NN"
is the volume number, and "MMM" is the issue number).


From firewalls-owner  Mon Feb  3 02:40:29 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id CAA24909 for firewalls-outgoing; Mon, 3 Feb 1997 02:15:30 -0800 (PST)
Received: from relay.cryptonet.it (relay.cryptonet.it [194.185.79.195]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id CAA24871 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 02:15:01 -0800 (PST)
Message-Id: <199702031025.LAA07956@relay.cryptonet.it>
Received: from enigma.cryptonet.it(192.168.1.1) by relay.cryptonet.it via smap (V1.3)
	id sma007954; Mon Feb  3 11:24:48 1997
From: David Vincenzetti <vince@cryptonet.it>
Subject: to source or not to source? (was: [NTSEC] ActiveX, MSIE and Quicken)
To: Firewalls@GreatCircle.COM
Date: Mon, 3 Feb 1997 11:17:58 +0100 (MET)
X-Pgp: vince@cryptonet.it 1024/A4D8B5CD 8CE2406F5CFBF9B9 D70DABF5912F66E8
X-Mjr: You can have Cheap, Easy, or Secure.  Pick two
X-Dijkstra: Testing can reveal the presence of bugs, but not their absence
X-Mailer: ELM [version 2.4 PL24 PGP5a]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Oh, definitely. Russ's comment about it not being the whole OLE environment
> but rather the web-enabled part of it being the poroblem is right on. The
> terminology war, however, is lost... the phrase "ActiveX" is going to be
> forever associated with applets, because that's the obvious technology
> difference between OLE and ActiveX.
> 
> > 	Not all that inconcievable.  There are perfectly viable
> > alternatives to an MS desktop for anyone who feels like using
> > them.
> 
> Unfortunately, no. Not if you want to be able to effectively do business
> in America today. Microsoft's file formats are everywhere, and they work very
> hard at making sure that nothing but their products can use them effectively.
> 
> > 	Microsoft's desktop will always be completely unable to
> > provide any useful security for the exact same reasons as we've seen
> > for years and years with Sendmail.
> 
> It's worse than sendmail. Eric Allman isn't trying to make Sendmail do
> everything (there's no http and nntp in there, for example), and Eric
> *is* concerned about security. It's not at the top of the list, but at
> least it's *on* the list.

Just to play Devils Advocate (I am a openness/source_included
enthusiast!), the main difference between Sendmail and ActiveX
is that the former provides full source while the latter
does not provide any sources. 

Sendmail full sources are available, they can be studied
and examined by everyone, and they can be studied by malicious
hackers too.  ActiveX sources are not available, and it is
harder, for a malicious hacker, to spot new bugs.
Sendmail is a crystal box while ActiveX is a black box
(remember the old Security Thru Obscurity model?:-).

As a matter of fact, a much larger number of bugs are
found for systems whose sources are available.  Installing
patches is an EXPENSIVE activity, so most companies will NOT
install all the patches as they are released by CERTs and
vendors.  Not installing new CERT patches is a bad habit, but
companies usually do not have the knowledge/skills/manpower
for keeping their software up to date.

So, is source availability a real advantage for commercial
companies?

--vince

From firewalls-owner  Mon Feb  3 04:41:25 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id EAA05114 for firewalls-outgoing; Mon, 3 Feb 1997 04:23:27 -0800 (PST)
Received: from mercury.Sun.COM (mercury.Sun.COM [192.9.25.1]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id EAA05106 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 04:23:17 -0800 (PST)
Received: from PRC.Sun.COM ([129.158.112.5]) by mercury.Sun.COM (SMI-8.6/mail.byaddr) with SMTP id EAA01046; Mon, 3 Feb 1997 04:22:00 -0800
Received: from lingshan.PRC.Sun.COM by PRC.Sun.COM (SMI-8.6/SMI-5.3)
	id UAA01596; Mon, 3 Feb 1997 20:32:04 +0800
Received: by lingshan.PRC.Sun.COM (SMI-8.6/SMI-SVR4)
	id UAA00706; Mon, 3 Feb 1997 20:18:37 +0800
Date: Mon, 3 Feb 1997 20:18:37 +0800
From: Carl.Ma@PRC.Sun.COM (Carl Ma - SE Trainee)
Message-Id: <199702031218.UAA00706@lingshan.PRC.Sun.COM>
To: Martin_Khoo/SIN/Lotus@lotus.com
Subject: About NAT
Cc: firewalls@greatcircle.com
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,
  I have heard the product  of Sun microsystem,Sunscreen, which 
can hide its IP address , does it use the some function of the
NAT, where can I find more material of NAT?
Thanks in advance!
Carl.ma

From firewalls-owner  Mon Feb  3 05:25:48 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id FAA08812 for firewalls-outgoing; Mon, 3 Feb 1997 05:18:42 -0800 (PST)
Received: from csnnetra1 ([200.255.165.102]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id FAA08735 for <firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 05:18:20 -0800 (PST)
Received: from mg65 by csnnetra1 (SMI-8.6/SMI-SVR4)
	id LAA25672; Mon, 3 Feb 1997 11:15:56 -0200
Message-Id: <199702031315.LAA25672@csnnetra1>
Comments: Authenticated sender is <cs84088@pop1.csn.com.br>
From: "Alessandro Jannuzzi" <jannuzzi@csn.com.br>
To: firewalls@GreatCircle.COM
Date: Mon, 3 Feb 1997 11:15:23 +0000
MIME-Version: 1.0
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Subject: Re: Virus Scan on the FW
X-mailer: Pegasus Mail for Win32 (v2.42a)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

Is there a solution similary WebShild that I can run on a non-Intel 
plataform ?
On Solaris 2.5 for instance. . .

Thanks,

Alessandro Jannuzzi
jannuzzi@csn.com.br

From firewalls-owner  Mon Feb  3 05:55:43 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id FAA10613 for firewalls-outgoing; Mon, 3 Feb 1997 05:42:37 -0800 (PST)
Received: from internet2.sbi.com (rutherford2.SBI.COM [192.195.121.10]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id FAA10559 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 05:42:19 -0800 (PST)
Received: from internet.sbi.com (rutherford.SBI.COM [192.195.121.6]) by internet2.sbi.com (8.6.12/8.6.12) with SMTP id IAA25635 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 08:41:05 -0500
Received: from confucious.sbi.com (security) by internet.sbi.com (4.1/SMI-4.1)
	id AA14875; Mon, 3 Feb 97 08:41:06 EST
Received: from paranoid.sbi.com by confucious.sbi.com (SMI-8.6/SMI-SVR4)
	id IAA06883; Mon, 3 Feb 1997 08:41:04 -0500
Received: by paranoid.sbi.com (SMI-8.6/SMI-SVR4)
	id IAA00690; Mon, 3 Feb 1997 08:41:38 -0500
Date: Mon, 3 Feb 1997 08:41:38 -0500
From: jerrys@confucious.sbi.com (Jerry Simonowits)
Message-Id: <199702031341.IAA00690@paranoid.sbi.com>
To: Firewalls@GreatCircle.COM
Subject: Firewall-1 bug
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I'm using Firewall-1 version 2.1 and seem to have run accross a bug. I've
added more hosts to my database than can be displayed on the screen and
I get an error message:

	XView warning: Menu too large for screen (Command Menu package)

And, nothing is displayed on the screen.

It's been confirmed to me that this is a bug, but I haven't received any
fixes....

Any suggestions ???

Jerry

From firewalls-owner  Mon Feb  3 06:10:37 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id FAA11072 for firewalls-outgoing; Mon, 3 Feb 1997 05:47:22 -0800 (PST)
Received: from internet2.sbi.com (rutherford2.SBI.COM [192.195.121.10]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id FAA11053 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 05:47:13 -0800 (PST)
Received: from internet.sbi.com (rutherford.SBI.COM [192.195.121.6]) by internet2.sbi.com (8.6.12/8.6.12) with SMTP id IAA25959 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 08:46:00 -0500
Received: from confucious.sbi.com (security) by internet.sbi.com (4.1/SMI-4.1)
	id AA15301; Mon, 3 Feb 97 08:45:59 EST
Received: from paranoid.sbi.com by confucious.sbi.com (SMI-8.6/SMI-SVR4)
	id IAA06915; Mon, 3 Feb 1997 08:45:58 -0500
Received: by paranoid.sbi.com (SMI-8.6/SMI-SVR4)
	id IAA00692; Mon, 3 Feb 1997 08:46:35 -0500
Date: Mon, 3 Feb 1997 08:46:35 -0500
From: jerrys@confucious.sbi.com (Jerry Simonowits)
Message-Id: <199702031346.IAA00692@paranoid.sbi.com>
To: Firewalls@GreatCircle.COM
Subject: Re: Optimal Throughput for NAT
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Martin wrote:

[stuff cut]

Using the router to do NAT seems to make alot of sense for some people but
I feel that you should let the router do what is primarily its main
function : i.e providing routing . Well , many people may disagree with me
on this but NO FLAMES PLEASE.

===========================================================================

Not a flame, just a difference of opinion...I've spent the last 9 years or so
involved with routers, and I would have agreed with you completely, oh, until
about the last 2 years or so. Router hardware has taken a major leap, and the
processing power available to most routers these days is way way more then
most "edge" routers require to accomplish their routing tasks. That being
the task, why not use all that leftover power to do NAT and other useful
things ?

I would think that a good approach would be to define what needs doing and
then find the appropriate system to accomplish that. In this case "system"
may include a multiplicity of devices.

Jerry

From firewalls-owner  Mon Feb  3 06:39:33 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id FAA11117 for firewalls-outgoing; Mon, 3 Feb 1997 05:48:14 -0800 (PST)
Received: from MetGwy02.metlife.com ([204.146.159.1]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id FAA11097 for <Firewalls@Greatcircle.Com>; Mon, 3 Feb 1997 05:47:55 -0800 (PST)
Received: by MetGwy02.metlife.com(Lotus SMTP MTA v1.01.02 (238.7 10-8-1996))  id 85256433.004B55FE ; Mon, 3 Feb 1997 08:42:52 -0400
X-Lotus-FromDomain: METLIFE @ METLIFENET
From: "Mike Stoico"<mstoico@metlife.com>
To: david@mony.com
cc: Cihans@Garanti.Com.Tr, Firewalls@Greatcircle.Com
Message-ID: <85256433:004B4BA9.00@MetGwy02.metlife.com>
Date: Mon, 3 Feb 1997 08:44:31 -0400
Subject: Re: Virus Scan....
Mime-Version: 1.0
Content-type: multipart/mixed; 
	Boundary="0__=htt0AwaJJWdvCCNgIjUMvBGNVEF5GZifKxBgZ1WQJc2Bjir909QQtPX8"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


--0__=htt0AwaJJWdvCCNgIjUMvBGNVEF5GZifKxBgZ1WQJc2Bjir909QQtPX8
Content-type: text/plain; charset=us-ascii



Have you seen any performance hits on your traffic with this installed?
We're looking at using it, and I have a concern about placing another hub
between inside and outside. Also, is there any configuration that the user
needs to do?
Mike Stoico
MetLife
The views expressed here are probabvly not those of my employer


                                                                            
           (Embedded                                                        
           image moved   david @ mony.com                                   
           to file:      01/31/97 10:59 AM                                  
           PIC13806.PCX)                                                    
                                                                            



          To:   CihanS @ garanti.com.tr
          cc:   firewalls @ GreatCircle.COM
          Subject:  Re: Virus Scan....




          Cihan Subasi said:
          >
          >      And how WebShield will work? In the documents it is said that
          the
> product is "Completely Transparent and cannot be bypassed by users"
anybody > has any idea about those issues?

What happens is that WebShield sits between your firewall (or exterior
router) and your internal network. It has two network cards, but instead of
routing it acts as a bridge. It does seem to be essentially invisible.

However: We've run into some issues regarding it's use with FTP, and we're
trying to find someone at McAfee who can give us some answers. Test it
thoroughly and decide if you want to use it.

And yes, there are all kinds of email attachments that it can't decode to
detect virii. Our client wants us to implement it anyway, and hopefully
they understand that this will _assist_ in preventing virus infections, not
provide 100% protection.
          --
          David Kozinn                   dkozinn@csc.com
          Computer Sciences Corporation
          Technology Management Group    +1-201-907-6990



--0__=htt0AwaJJWdvCCNgIjUMvBGNVEF5GZifKxBgZ1WQJc2Bjir909QQtPX8
Content-type: application/octet-stream; 
	name="PIC13806.PCX"
Content-transfer-encoding: base64

CgUBCAAAAABoACwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAABaQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAD1E9sTzRPHE8MTwhP1E9sTzRPHE8MTwhP1E9sTzRPHE8MTwhP1E9sTzRPH
E8MTwhP1E9sTzRPHE8MTwhP1E9sTzRPHE8MTwhP1E9sTzRPHE8MTwhP1E9sTzRPHE8MTwhP1E9sT
zRPHE8MTwhPwEwzIBgzYE8wTxhPDE8IT7hPOBtcTzBPGE8MTE+wTwgbCBwbCEgbCEgbCEsUG1hPL
E8YTwxMT6hMMwgYHwgLCAwISwgfEEsMCwwbVE8sTxRPDExPpE8MGAwcCBwMCwhLDB8ISwgISwgLD
BtUTyhPFE8MTE+gTwgIHA8ICEw4DDgLDE8USwwLCEMIG1BPKE8UTwxMT5xMCAwcDAg4TDgITwgIS
D8ISD8ISBRICEcICwwbUE8oTxRPCExPmEwYCBwMCDgIOwgLDExITEhPCEg8GxgLDBtMMDAfJE8QT
whMT5hMGwwITBgMCDhLFEw8SE8ISBgIDwhIDEsMGB9MDxwwHxRPDExPlEwYHAhESAg8CwhMPwhMP
xBMPxRIQwgIDAgMCBtMDxwPEDAfDE8IT4RMHwwzCBgLCEhMCDxLIE8MSD8MSwwIQAwIDBgfSDMkD
wgPCDAfCExPbEwfGDMIDDAIHERITEhMSwxMPwxMPwxPDEgIDAgMCwwMCBgzREwfHDMYDDMITE9YT
B8UMyAMGB8ICBhLDAsYTEhMSExIPwhIHAgcCAwUQAgYRBgfSE8UTB8QMwgMMwhMT0hMHxAzLA8IM
BsISDxESExITAw4DxBMSExITwxICBwPCAsMDDMIGB9ITyRMHwwzCExPPEwfDDMkDxQwHwhMGBxIT
AhECEwMOAg7DExITDxMPwxIDAgMCBwMCDAYRBgfSE8kTwhPCDMITE8wTB8MMxwPEDMIHxxMGxBLD
Ag4DDgIGwg/IEgIDwgIDAgwCEMIGB9ITyRMHDAcMwhMTyhMHwgzGA8MMwgfMEwYHwhLCEAIOAg4C
DhDDAhIPxhIFAgXDAgUCEQYH0hPHEwfCDAcPDMITE8gTB8IMxQPDDAfQEwbDEhDEAhAOEA4QwgLG
EgcSBhIGBcMCBcIGB9ATB8UMEwfCDA8HDwwHwhMTxhMHwgzEA8MMB9MTBgfCEhADEMICDhAOEMIC
EQIDxxIGBwbCAgUCEQYHyxMHxAwHwhMHEwzCEwcPBw8MB8MTE8UTBwzEA8IMB9YTBsQSEAMCA8UC
EQIDAgPDEgcSBgfCBgUQAhDCBgfGEwfEDAfGE8INEwzCEw8HwgwHwxPCE8QTBwzDA8IMB9gTBgfE
EhACEMYCEQIDAsQSBhLDBsICEALCBgfCEwfDDAfKEwfCDRMHwhPCDAfEE8ITE8MTBwzCA8IMB9oT
DBIHwxLDDBEDxQIDAgPDEgYSBgfCBgIQAhAGDAfCEwzDE8MHyRMHwhPCBxMHxRPDExPDEwzCAwwH
3RMGxxICEQPDAgMCA8MSBhIGBwYMBhACEAIGDMMTDBPCB8YTwwfHEwfGE8MTwhPDEwwDDAfeEwYH
xxICEQPDAgMCwhIGEgYHBgwGEAIQAsIGB8MTDMYTwwfKEwzGE8MTwhPDE8IMB98TDBLCB8USAgMR
xAISB8ISBgcGDAYQBhAGEAYMB8MMB8kTwwfHEwzGE8MTwhPDEwwPwgzfEwYSB8ISB8ISAhECAwID
EgcSBwYHBgwGEAYQxgzDD8IHxRPDB8kTBwzGE8MTwhPDEwzDD8QM3BPCBhIGwxIGAhECAwIHBgcG
yAzJDxMHzRMHwwwHxxPDE8ITwxMHDMYPxwwH1BMGEgYSBhLLDM4PwwwTDMcTwgfEDAfJE8QTwhMT
xBMHwgzLD9sM0w/GDAfDEwzDEwfEDAfLE8YTwxMTxhMHxAztD8gMBgfIE8QMB84TxxPDE8ITyhMH
xwzbD8sMEAUMBcIMwgYH1RPKE8UTwxMT0RMH2wwGEAYQBhACBQwFDAUMBgwHBgfWE8sTxRPDExPu
EwYMBhAGEAIGDAYMwwYH1xPLE8YTwxMT8BPKBgfYE8wTxhPDExP1E9sTzRPHE8MTwhP1E9sTzRPH
E8MTwhMMAAAAgAAAAIAAgIAAAACAgACAAICAwMDAwNzApsrw//vwoKCkgICA/wAAAP8A//8AAAD/
/wD/AP//////AAAAgAAAAIAAgIAAAACAgACAAICAwMDAwNzApsrw//vwoKCkgICA/wAAAP8A//8A
AAD//wD/AP//////AAAAgAAAAIAAgIAAAACAgACAAICAwMDAwNzApsrw//vwoKCkgICA/wAAAP8A
//8AAAD//wD/AP//////AAAAgAAAAIAAgIAAAACAgACAAICAwMDAwNzApsrw//vwoKCkgICA/wAA
AP8A//8AAAD//wD/AP//////AAAAgAAAAIAAgIAAAACAgACAAICAwMDAwNzApsrw//vwoKCkgICA
/wAAAP8A//8AAAD//wD/AP//////AAAAgAAAAIAAgIAAAACAgACAAICAwMDAwNzApsrw//vwoKCk
gICA/wAAAP8A//8AAAD//wD/AP//////AAAAgAAAAIAAgIAAAACAgACAAICAwMDAwNzApsrw//vw
oKCkgICA/wAAAP8A//8AAAD//wD/AP//////AAAAgAAAAIAAgIAAAACAgACAAICAwMDAwNzApsrw
//vwoKCkgICA/wAAAP8A//8AAAD//wD/AP//////AAAAgAAAAIAAgIAAAACAgACAAICAwMDAwNzA
psrw//vwoKCkgICA/wAAAP8A//8AAAD//wD/AP//////AAAAgAAAAIAAgIAAAACAgACAAICAwMDA
wNzApsrw//vwoKCkgICA/wAAAP8A//8AAAD//wD/AP//////AAAAgAAAAIAAgIAAAACAgACAAICA
wMDAwNzApsrw//vwoKCkgICA/wAAAP8A//8AAAD//wD/AP//////AAAAgAAAAIAAgIAAAACAgACA
AICAwMDAwNzApsrw//vwoKCkgICA/wAAAP8A//8AAAD//wD/AP//////AAAAgAAAAIAAgIAAAACA
gACA//vwoKCkgICA/wAAAP8A//8AAAD//wD/AP//////

--0__=htt0AwaJJWdvCCNgIjUMvBGNVEF5GZifKxBgZ1WQJc2Bjir909QQtPX8--


From firewalls-owner  Mon Feb  3 08:49:58 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id HAA19570 for firewalls-outgoing; Mon, 3 Feb 1997 07:20:17 -0800 (PST)
Received: from poss.com (camel.poss.com [198.70.184.130]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id HAA19550 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 07:20:04 -0800 (PST)
Received: from sunfire ([207.113.179.166])
          by poss.com (8.8.4/8.8.4) with ESMTP
	  id KAA06480; Mon, 3 Feb 1997 10:16:39 -0500 (EST)
Received: from localhost (wilcox@localhost) by sunfire (8.6.12/8.6.9) with ESMTP id KAA00693; Mon, 3 Feb 1997 10:19:41 -0500
Message-Id: <199702031519.KAA00693@sunfire>
X-Mailer: exmh version 2.0beta 12/23/96
To: jerrys@confucious.sbi.com (Jerry Simonowits)
cc: Firewalls@GreatCircle.COM
Subject: Re: Firewall-1 bug 
In-reply-to: Message  <199702031341.IAA00690@paranoid.sbi.com> 
   from "Mon, 03 Feb 1997 08:41:38 EST."
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Mon, 03 Feb 1997 10:19:40 -0500
From: Ken Wilcox <wilcox@poss.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

jerrys@confucious.sbi.com (Jerry Simonowits) writes:
> I'm using Firewall-1 version 2.1 and seem to have run accross a bug. I've
> added more hosts to my database than can be displayed on the screen and
> I get an error message:
> 
> 	XView warning: Menu too large for screen (Command Menu package)
> 
> And, nothing is displayed on the screen.
> 
> It's been confirmed to me that this is a bug, but I haven't received any
> fixes....
> 
> Any suggestions ???
> 
> Jerry
> 

This is what Sunsolve has to say about this. I hope it helps.

Document ID: 1890

SYNOPSIS: Error message: "Xview warning: Menu too large for screen" 

DETAIL DESCRIPTION:

I create 250 hosts, but when I want to install a new rule I am not able
to see the windows with all objects created.  I receive the message
"Xview warning: Menu too large for screen".  What does this mean?


SOLUTION SUMMARY:

This is a known limitiation.  Future releases of Firewall-1 will
probably include a scroll-bar menu instead of this pop-up menu.  However
in the meantime here are several workarounds:

1. Edit the files manually.

 Instead of using the firewall GUI, you can modify the object file
 (objects.C) and the rule file (<rule_name>.W) under /etc/fw/conf with
 the command line interface.  The format of the file is self-explanatory. 
 Once you've done that you can type "fw load <rule_name>.W
<hosts>".  If
 you are using more than 250 objects it is probably faster to edit the
 rules and object list using the command line than the GUI anyway. 

2. Group the objects and only display those needed.

 It is likely that, even if you are dealing with 250+ objects you do not
 want to create rules for every one of them.  Usually you want to put
 your objects into groups and apply the filter rules only to those
 groups.  If this is the case, you can create groups using the network
 object manager under the GUI and for each host you put in a group, in
 the host properties, un-select the check-box "Show in Menus". 

3.  Use networks whenever possible.  

 Sometimes you do not really need that many hosts. See if you can
 group the hosts into network objects. 

4.  Share the load among several Firewalls.  

 This is not very attractive because, after all, one reason of getting a
 firewall is that you want to manage your entire security policy from a
 central point.  But if you really need hundreds of hosts and hundreds of
 rules to manage them, then you may consider splitting the security
 checking between several firewalls.  This will also lower the risk of
 experiencing performance problems (specially if you are also using VPN
 and NAT). 





DATE APPROVED: 08/31/96



KEYWORDS:     firewall xview warning objects file

OS RELEASE:   Solaris/SunOS 2.5/5.5
-- 
Ken Wilcox					Perfect Order Inc.
Account Representative				Authorized Sun Reseller
2212 Eagles Nest Lane
Monroeville PA 15146
Phone: +1 412 373 1528				Email: wilcox@poss.com
Fax:   +1 412 373 1722



From firewalls-owner  Mon Feb  3 08:51:28 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id HAA20024 for firewalls-outgoing; Mon, 3 Feb 1997 07:23:38 -0800 (PST)
Received: from NS1.Content.Net (NS1.Content.Net [206.253.232.1]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id HAA19883 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 07:22:50 -0800 (PST)
Received: from localhost (jims@localhost) by NS1.Content.Net (8.8.2/8.8.2) with SMTP id KAA05461; Mon, 3 Feb 1997 10:22:40 -0500 (EST)
Date: Mon, 3 Feb 1997 10:22:40 -0500 (EST)
From: Jim Serven <jims@GLIX.Net>
X-Sender: jims@NS1.Content.Net
To: Jerry Simonowits <jerrys@confucious.sbi.com>
cc: Firewalls@GreatCircle.COM
Subject: Re: Firewall-1 bug
In-Reply-To: <199702031341.IAA00690@paranoid.sbi.com>
Message-ID: <Pine.SGI.3.95.970203101826.3188D-100000@NS1.Content.Net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


> It's been confirmed to me that this is a bug, but I haven't received any
> fixes....
> Any suggestions ???

Yes,

Go into the Object Manager.
and edit any objects which do NOT need to be on the menu.
on the (editing) window for each object when you open it (along the
bottom (in X)) is a "[ ] Show in Menu" - the default is for it to be
checked.  UN check it.  and do this for as many hosts as necessary until
you are able to view you objects in the expandable menu.

Usually, we only "show" objects in the menu while we are adding them to a
rule, and then we "unshow" them so that we can leave the menu space
available for more important hosts(or whatever) or until we need it later.
That way valuable X real estate is saved, and FW1(X) doesn't complain.

If you have any questions, feel free to holler.

Cheers!

-Jim

Certified Checkpoint Security Engineer CCSE
-------------------------------------------
Jim Serven <jims@glix.net> The GLIX Network
President                G-4010 W. Court St
http://www.glix.net         Flint, Mi 48532
    (v) 810.898.4483 (f) 810.695.8403
-------------------------------------------
Firewalls, webSmiths, and bandwidth. oh my!


From firewalls-owner  Mon Feb  3 08:53:43 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id HAA22457 for firewalls-outgoing; Mon, 3 Feb 1997 07:49:53 -0800 (PST)
Received: from tuna.wang.com (TUNA.wang.com [150.124.136.4]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id HAA22413 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 07:49:26 -0800 (PST)
Received: from mars.wangfed.com (mars.Wangfed.COM [159.94.10.1])
    by tuna.wang.com (8.6.12/8.6.12tf1) with SMTP id KAA12949;
    Mon, 3 Feb 1997 10:47:58 -0500
Received: from uc0009.wangfed.com (uc0009 [159.94.10.15])
	by mars.wangfed.com (8.8.4/3.8) with SMTP
	id KAA29366; Mon, 3 Feb 1997 10:54:03 -0500 (EST)
Received: from [159.94.14.48] by uc0009.wangfed.com (BULL 5.61++/B.O.S 02.01)
	id AA20974; Mon, 3 Feb 97 10:38:51 -0500
Date: Mon, 3 Feb 97 10:38:51 -0500
Message-Id: <9702031538.AA20974@uc0009.wangfed.com>
From: "K.M."  <goertzek@wangfed.com>
Reply-To: "K.M."  <goertzek@wangfed.com>
To: jcanfiel@davocom.com, firewalls@greatcircle.com
Subject: Re: Sidewinder vs. Cyberguard
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

In message <32F3DA42.27E9@davocom.com> Jim Canfield writes:

> First: How is security rated A1, B3, B2, B1, C2, C1 in the US, other
> similar grading scales in England/Germany and probably countless others
> worldwide. 

TCSEC (US)    =     ITSEC (EU)
----------          ----------
A1            =     E6 / F6 (or F-A1)
B3            =     E5 / F5 (or F-B3)
B2            =     E4 / F4 (or F-B2)
B1            =     E3 / F3 (or F-B1)
C2            =     E2 / F2 (or F-C2)
C1            =     E1 / F1 (or F-C1)

There is no concept, in TCSEC, for separate assurance and functionality 
evaluations.  Each rating assumes a combination of functionality and assurance 
at a certain level.

The Common Criteria (if they ever happen) will look a lot more like the ITSEC 
scheme.

The TCSEC also does not evaluate *applications* (though it does evaluate the 
TCBs of relational database management systems).  Thus, there are no TCSEC 
evaluations of *firewalls*, because these are applications.

The ITSEC *does* evaluate applications - including firewalls.  This is why 
CyberGuard was evaluated, as an application, in Europe, while the CyberGuard 
platform (Harris "Nighthawk") was all that was evaluated in the U.S. 
("NightHawk" also got an E3/F3 rating in Europe).  CyberGuard got an "E3" 
assurance rating at a UK CLEF.


Then to find out what was the best achievable security rating
> for a product that is usable.


The highest rating any firewall has got is the ITSEC "E3" given to CyberGuard.  
Even this is possibly "underkill", for while the MACs provided at the E3 (B1) 
level may be used to protect the firewall, E3 does *not* provide a covert 
channel analysis, so there may be huge covert channels in a E3 (B1) operating 
system or application that can be exploited by a clever malfeasant.

ON the other hand, none of the firewall applications (except Sidewinder) running
on B1/E3 platforms actually use the MACs to reinforce separation between the 
networks connected to the firewall.  Both CyberGuard and the Norman Firewall 
(which runs on Compartmented Mode Workstations with MACs) run at a single level 
in the MAC scheme of the operating system.  There is no trusted process in these
firewalls that would allow the "inside" to run at a higher classification level 
than the "outside", thus using the MACs and TCB effectively to separate the 
protected network from the unprotected one.  Only Sidewinder does this, using 
type enforcement, and even with type enforcement, there is no sense of the 
inside being more protected than the outside (though the combination of non-TCB 
related firewall configuration - e.g., which proxies are two-way, which are only
outbound ,etc. - and type enforcement can achieve something resembling this).
However, I have heard that Sidewinder is very difficult to configure, unless 
they have managed to greatly improve their interface in new release.  
Cyberguard, on the other hand, is supposed to be as easy to configure as 
Firewall-One, and is more trustworthy.

> The most secure, usable, firewall we have found to date is the
> Cyberguard
> 
> As mentioned the products are B1 compliant (awaiting certification)....

The OS is already evaluted, and the E3 rating of the firewall application should
be completed any day now.


KM

=====

K.M. Goertzel
Manager, Business Development
Secure Systems & Services Operation
WANG FEDERAL, Inc.
7900 Westpark Drive - MS 700
McLean, VA  22102-4299  USA
tel (703)827 3914
fax (703)827 3161 
email goertzek@wangfed.com


From firewalls-owner  Mon Feb  3 09:12:36 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id IAA25633 for firewalls-outgoing; Mon, 3 Feb 1997 08:28:28 -0800 (PST)
Received: from mail1.phoenix.net (mail1.phoenix.net [204.120.233.12]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id IAA25626 for <firewalls-digest@GreatCircle.COM>; Mon, 3 Feb 1997 08:28:21 -0800 (PST)
Received: from ottog.net1.net (ppp082.Net1.Net [204.254.232.82]) by mail1.phoenix.net (8.7.5/8.6.12) with ESMTP id KAA08871 for <firewalls-digest@GreatCircle.COM>; Mon, 3 Feb 1997 10:27:09 -0600 (CST)
Message-Id: <199702031627.KAA08871@mail1.phoenix.net>
From: "Greg Otto" <gdo@newf.com>
To: <firewalls-digest@GreatCircle.COM>
Subject: Secure Kernel's versus Unix or NT
Date: Mon, 3 Feb 1997 10:27:50 -0600
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1155
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I am looking for some information which compares the problems and issues
of running Firewall systems on a real-time kernel versus on an existing
operating system such as Unix or NT.

I would like to get a better understanding of where the problems exist and
what issues may arise.  I understand that most OS based systems will
"harden" up the OS, but I still wonder how many loop-holes are left out
there.

Thanks,
Greg
============================================================================

Gregory Otto                       e-mail  gdo@newf.com
New Frontier Consulting            WWW     http://www.newf.com
Houston, Texas                     Voice   (713) 718-1358
============================================================================



From firewalls-owner  Mon Feb  3 09:22:05 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id IAA23397 for firewalls-outgoing; Mon, 3 Feb 1997 08:02:44 -0800 (PST)
Received: from intkx001.usair.com (intkx001.usair.com [199.72.38.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id IAA23372 for <firewalls@GreatCircle.com>; Mon, 3 Feb 1997 08:02:27 -0800 (PST)
Received: from intad116.usair.com by intkx001.usair.com (AIX 4.1/UCB 5.64/4.03)
          id AA74194; Mon, 3 Feb 1997 10:56:56 -0500
Message-Id: <32F60B04.4E0B@usair.com>
Date: Mon, 03 Feb 1997 10:57:57 -0500
From: Mark Smith <msmith@usair.com>
Reply-To: msmith@usair.com
X-Mailer: Mozilla 3.01 (Win95; I)
Mime-Version: 1.0
To: firewalls@GreatCircle.com
Subject: Filtering outbound packets
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

What is the general practice for readers of this list on filtering
outbound packets at the router between the ISP and the DMZ ?  

The original intent was to limit the chances of mounting
attacks/FSP/general bad stuff using our site as base camp.  Now,
however, we have a mail application which appears to drive the router at
max CPU, allegedly due to the filtering in place.   That outbound
filtering allows only the "good" protocols to their known ports.

From firewalls-owner  Mon Feb  3 09:27:42 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id IAA24890 for firewalls-outgoing; Mon, 3 Feb 1997 08:20:57 -0800 (PST)
Received: from mail.baileynm.com (fw.baileynm.com [206.109.159.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id IAA24850 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 08:20:44 -0800 (PST)
Received: (qmail 13505 invoked from smtpd); 3 Feb 1997 16:19:28 -0000
Received: from web.nmti.com (root@198.178.0.201)
  by fw.nmti.com with SMTP; 3 Feb 1997 16:19:28 -0000
Received: from sonic.nmti.com (peter@sonic.nmti.com [198.178.0.2]) by web.nmti.com (8.6.12/8.6.9) with SMTP id KAA14133; Mon, 3 Feb 1997 10:19:28 -0600
Received: by sonic.nmti.com; id AA07546; Mon, 3 Feb 1997 10:13:53 -0600
From: peter@baileynm.com (Peter da Silva)
Message-Id: <9702031613.AA07546@sonic.nmti.com.nmti.com>
Subject: Re: to source or not to source? (was: [NTSEC] ActiveX, MSIE and Quicken)
To: vince@cryptonet.it (David Vincenzetti)
Date: Mon, 3 Feb 1997 10:13:53 -0600 (CST)
Cc: Firewalls@GreatCircle.COM
In-Reply-To: <199702031025.LAA07956@relay.cryptonet.it> from "David Vincenzetti" at Feb 3, 97 11:17:58 am
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Sendmail full sources are available, they can be studied
> and examined by everyone, and they can be studied by malicious
> hackers too.  ActiveX sources are not available, and it is
> harder, for a malicious hacker, to spot new bugs.

I don't think you're thinking this through. You don't *need* source to
break security on ActiveX, because there is none. All you need to do is
spoof Authenticode or steal an Authenticode private key... and since
there is no mechanism to revoke an Authenticode key as soon as *one*
person has done it the game's over.

Regardless of the utility crystal box vs. black box argument, it's got
nothing to do with ActiveX.

From firewalls-owner  Mon Feb  3 09:41:11 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id JAA00772 for firewalls-outgoing; Mon, 3 Feb 1997 09:19:54 -0800 (PST)
Received: from panix3.panix.com (panix3.panix.com [198.7.0.4]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id JAA00753 for <firewalls@GreatCircle.com>; Mon, 3 Feb 1997 09:19:40 -0800 (PST)
Received: from localhost (fangyou2@localhost) by panix3.panix.com (8.8.5/8.7/PanixU1.3) with SMTP id MAA15163 for <firewalls@GreatCircle.com>; Mon, 3 Feb 1997 12:18:09 -0500 (EST)
Date: Mon, 3 Feb 1997 12:18:08 -0500 (EST)
From: FaNgYoU2 <fangyou2@panix.com>
To: firewalls@GreatCircle.com
Subject: NT network and system management
Message-ID: <Pine.SUN.3.94.970203120818.14366A-100000@panix3.panix.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Apologies because this is not strictly a firewall question.  However,
there are quite a few NT experts on the list who can help.

I need to monitor the following items across about 80 Windows NT servers:
DOS Devices : Paging File : Percent usage Peak
Physical Disk : Percent disk time
Physical Disk : Average disk sec/read  (reads per second)
Physical Disk : Disk read bytes/sec    (read bytes per second)
Physical Disk : Queue length
Processor : Percent processor time
Memory : pages/second
Server : bytes total/second

For each network user connected to server:
NIC card address/MAC address
Computer name (if any)
IP address (if any)
User name.

Is there a group of NET commands which will give me this?
Is there a commercial product that can be customized to give me this?
Finally, which mailing list does this question really belong on?

                                         FaNgYoU2, Cyberspace^^Vampyre

^^       Touch it, touch it, touch me ... creatures of the Night       ^^


From firewalls-owner  Mon Feb  3 09:47:49 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id HAA20026 for firewalls-outgoing; Mon, 3 Feb 1997 07:23:39 -0800 (PST)
Received: from gk-blue.unicc.org (gk-red.unicc.org [192.91.247.2]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id HAA19870 for <firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 07:22:46 -0800 (PST)
Received: by gk-blue.unicc.org; (5.65v3.2/1.3/10May95) id AA17758; Mon, 3 Feb 1997 16:23:58 +0100
Received: from gh.unicc.org (localhost [127.0.0.1]) by gh.unicc.org (8.7.5/8.7.3) with SMTP id QAA07405; Mon, 3 Feb 1997 16:23:54 +0100 (MET)
Message-Id: <32F60309.41C6@unicc.org>
Date: Mon, 03 Feb 1997 16:23:53 +0100
From: Lilia Miltcheva <miltcheva@unicc.org>
Organization: United Nations International Computing Centre
X-Mailer: Mozilla 2.0 (X11; I; OSF1 V3.2 alpha)
Mime-Version: 1.0
To: altavista-product@digital.com
Cc: admin@unicc.org, firewalls@GreatCircle.COM
Subject: Duplicated network addresses
X-Url: http://altavista.software.digital.com/help/tunnelfaq4/index.htm
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Dear Guru,

I'm keen on using the AltaVista Tunnel and have already a lot of
requests for providing the service. I have a question :

We are currently using Alta Vista FW for Unix and behind it we have
class C addresses that we once got by EUnet. Than we changed the ISP and
renumbered our "red" (external) network, but on the internal ("blue")
WAN we kept the old IPs as there are anyhow not accessible from the
Internet.

What is going to happen if a remote client, using AVT connects to our
AVT server, gets the numbers of the private networks (for example
193.72.45.0) and starts tunneling, but at the same time there is a
server somewhere on the Internet that has address let's say 193.72.45.20
(same class C). How this clash could possibly be menaged?


I'm aware that many people use inside their FW "any" IP addresses (just
unique on the LAN), so that will be a problem with all those guys if
some coincedence occurs.

Is there something I'm missing?

Thanks a lot in advance. I'll greately appriciate any help....

Lili

From firewalls-owner  Mon Feb  3 09:56:31 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id JAA01900 for firewalls-outgoing; Mon, 3 Feb 1997 09:35:04 -0800 (PST)
Received: from mercury.Sun.COM (mercury.Sun.COM [192.9.25.1]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id JAA01837 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 09:34:33 -0800 (PST)
Received: from West.Sun.COM ([129.153.100.31]) by mercury.Sun.COM (SMI-8.6/mail.byaddr) with SMTP id JAA11027; Mon, 3 Feb 1997 09:32:47 -0800
Received: from topsun.West.Sun.COM by West.Sun.COM (SMI-8.6/SMI-5.3)
	id JAA05376; Mon, 3 Feb 1997 09:32:07 -0800
Received: from plato.West.Sun.COM by topsun.West.Sun.COM (SMI-8.6/SMI-SVR4)
	id JAA13336; Mon, 3 Feb 1997 09:32:07 -0800
Received: by plato.West.Sun.COM (SMI-8.6/SMI-SVR4)
	id JAA05126; Mon, 3 Feb 1997 09:16:58 -0800
Date: Mon, 3 Feb 1997 09:16:58 -0800
From: matt@plato.West.Sun.COM (Matthew Archibald)
Message-Id: <199702031716.JAA05126@plato.West.Sun.COM>
To: firewalls@greatcircle.com, bsterling@hotmail.com
Subject: Re: Securing Web Servers
Cc: smith@sctc.com
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


On Friday 31 Jan 1997 - Brad Sterling wrote:


> Memco SeOS, on the other hand, is capable of achieving the same results as
> SideWinder, but requires no alteration of the OS, other than being installed so
> that it can intercept system calls which are security oriented (very clever
> stuff which is up for patents).  Since Memco SeOS can achieve this with
> standard vendor releases of any Unix system (Solaris, HP/UX, AIX, etc.), and
> combined with FireWall-1 far outperforms any application level firewall, I
> don't see a reasonable comparison.


In fact Memco SeOS changes the kernel of the system via loadable
kernel modules.

What this does is to force every open, exec, write etc... call to
be checked against an ACL prior to the action taking place and
writes a log entry for each.  Now, while this is pretty strong
stuff there are no host-to-host authentication services, at least
not in the 1.x releases.  Also, try running this on a large Oracle,
Sybase or other SQL server and watch your performance go down the
drain.

Patenting of a loadable kernel module might not be very easy since
Memco is not the first, or last to do this sort of thing.
I even have an example of a module in a 'Writing Device Drivers'
course for SunOS,v4.X.x (c 1991/2) to capture just this type of info.
(First release that let you load a module at boot time)

Regardless, most SysV UNIX variants released in the past
6-18 months and/or next 6-18 months will/have inlcuded file
ACL's which if maintainted reasonably well offer similar
protection with less overhead sine they are native to the OS
in use.

I know, the famous 'we obivate the need for root' statement
is flashy to mainframe centric minded folks but really, no
matter how you do it the system always has one priveledged
user id or another regardless if the name is 'root', 'seosadmin'
or 'barney'...

For standalone systems SeOS is very cool. For network trust
unfortunately it seems to be lacking strong controls. A mixture
of SeOS with network based audit and access control services
offers the best of both worlds.

Of course with the release of version 2.x things might be
better.

		My 2cents worth,
				Matthew Archibald

From firewalls-owner  Mon Feb  3 10:12:48 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id KAA04387 for firewalls-outgoing; Mon, 3 Feb 1997 10:03:53 -0800 (PST)
Received: from relay5.UU.NET (relay5.UU.NET [192.48.96.15]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id KAA04366 for <firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 10:03:34 -0800 (PST)
Received: from txau.tx.mt.np.els-gms.att.net by relay5.UU.NET with SMTP 
	(peer crosschecked as: txau.tx.mt.np.els-gms.att.net [199.191.144.201])
	id QQcbie24564; Mon, 3 Feb 1997 13:01:30 -0500 (EST)
Date: Mon, 03 Feb 1997 11:02:20 -0500
From: mcoss@attmail.com (Michael J Coss)
Received: from mcoss by attmail; Mon Feb  3 17:48:26 GMT 1997
Subject: Re: Sidewinder vs. Cyberguard
In-Reply-To: your message <199702020407.XAA27088@unix1.sysnet.net> of Sat Feb  1 21:31:07 -0400 1997
To: firewalls@GreatCircle.COM
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <winATT-3.0-mcoss-25>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Matthew Patton wrote:

>On what basis do you make this assertion?  "secure" can mean a lot of 
>things and a rubber stamp from NSA or it's equivalent doesn't mean a 
>whole lot if buggy software can be trivially exploited.  We could go on 
>about "usable" but I'll let that one slide.  In particular is the 
>firewall configuration an EXACT match with the 
>"certified/tested/evaluated" machine?  NT has a C2 rating but it's not 
>worth a damn.  When was the last time you ran an NT box with no LAN, no 
>floppy, and with a modified BIOS?  Not exactly a useful product.  Then 
>again, assuming you duplicate this setup, place said machine nearish to a 
>window.  Electronic eavesdropping (for about $3000 and change) or outside 
>observation does tend to degrade the usefulness of said rating does it 
>not?

Your correct, "secure" is a nebulous term, but obviously you have not been 
involved with a evaluation of an operating system if you believe that its a 
rubber stamp.  I worked on the NCSC evaluation of a UNIX operating system and 
it took too long (several years) and was not a rubber stamp.  Your point about 
what the configuration is is quite true but Cyberguard has gone the extra mile 
of getting a Network evaluation to provide a better security solution that 
does include a network component.  And you can buy the NightHawk in a TEMPEST 
cabinet if your concerned about that.
 
>Ah, the GUI.  Remote manageable too I think I recall.  What to say when 
>the X11 session gets hijacked?  You sure the box isn't running a 
>braindamaged X11 server?  Can you attack the logging facility thru DOS?  
>What happens when you bog the machine down with hundreds of connections?  
>Does it run out of VM and spontaneously reboot?  How about the logs 
>filling up the disk?  What happens when this occurs and an exploit is 
>then launched?  Do you still have an audit trail?

First, I know of no system that is completely immune to a concerted denial of 
service attack.  You can attempt to minimize the impact but with a general 
purpose operating system, it may be virtually impossible to eliminate.  
Second, unless your willing to expend the money to create a tamperproof box, 
the granting of access to the machine is taboo. 

>So they know how to check off all of the feature boxes on the report 
>card.  Anybody can and everybody does that.
Do you KNOW that the features are not provided?  What feature do you believe 
they are lying about?

>IMO ratings, be they NSA/NCSA or whatever aren't worth much and 
>deffinately not a price premium.  I take far more comfort in people 
>banging away at the available stuff and fixing the problems.  
And what pray tell do you believe that the evaluations/testings are trying to 
do?  The purpose of these are to provide a degree of comfort that someone 
other than the vendor has looked is varying degrees of detail at the 
implementation of the software/hardware combination.

>Additionally, you really believe the vendor (or reviewer for that matter) 
>went thru every single line of code specifically looking for possible 
>exploits?  Get real.
Have you been involved in the evaluation process?  I have.  No, we didn't go 
thru every single line of code but we tried to get complete coverage and did a 
analysis of the data flow and looked at the access control mechanisms in 
great detail and looked at privileged processes to verify there correct 
operation and in those programs we did indeed look at every line and reviewed 
the libraries.  That some people attempt to slide thru an evaluation, I have 
no doubt but I'd like to believe that that is the exception rather than the 
rule. 

>All the ratings do is study the protection scheme and bless it as logical 
>and OK at least in theory.  Then with various degrees of persistance they
>try to prove you can't get around said protection.  Holes and stack smashes
>by way of poorly written C and resolver libraries and DOS via SYN etc.
>aren't addressed.

While the NCSC did not require denial of service attacks, nor penetration 
testing (for a B1 system), we as part of our own Q&A did do these things based 
on knowledge gathered from various sources and our own experience.

>If they were we wouldn't be plagued with some of the problems we have now.
No product is completely immune no matter how much money or resources are 
thrown at it.  What you want is a system that provides a degree of security, 
and some assurance that the vendor has made a best effort at 1) implementation 
of a security mechanism, and 2) discovery/correction of known bugs.

Finally, there is the issue of do you need a secure operating system.  While I 
believe that a properly implemented firewall does not require a trusted base 
to run on.  A secure OS will help if the firewall code is compromised.  It may 
not be sufficient to protect the network but it may minimize the damage.

I'm not recommending either choice but I do believe that there is benefits 
derived from having the system evaluated by an outside source.  Is it worth 
the money? The market has shown to date that they want security but don't want 
to pay for the extensive review/testing/etc. required to develop and maintain 
it.  The expectation is that it should come for free..."Of course your 
software is safe...right?"

---Michael J Coss
Lucent Technologies - Bell Laboratories		mjcoss@lucent.com

From firewalls-owner  Mon Feb  3 10:17:21 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id GAA15043 for firewalls-outgoing; Mon, 3 Feb 1997 06:39:27 -0800 (PST)
Received: from bastion.s-1.com (BASTION.FIVEPACES.COM [204.130.55.230]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id GAA15034 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 06:39:17 -0800 (PST)
Received: from UNKNOWN [10.1.1.10] by bastion.s-1.com
	for <watt>
	id JAA29721; Mon Feb  3 09:37:57 1997
Received: from mordred.s-1.com by wine.s-1.com with SMTP
	(1.39.111.2/16.2) id AA204210569; Mon, 3 Feb 1997 09:36:09 -0500
Received: by mordred.s-1.com (5.65/2.1) id AA22362; Mon, 3 Feb 97 09:37:35 -0500
Message-Id: <9702031437.AA22362@mordred.s-1.com>
Subject: RE: Technologic's Interceptor
Date: Mon, 3 Feb 1997 09:37:30 -0500 (EST)
X-Mailer: ELM [version 2.4 PL21]
Content-Type: text
To: Firewalls@GreatCircle.COM
From: Charles Watt <watt@s-1.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

-----BEGIN PRIVACY-ENHANCED MESSAGE-----
Proc-Type: 4,MIC-CLEAR
Content-Domain: RFC822
Originator-Certificate:
 MIIBvzCCAWkCEFmOln6ip0w49CuyWr9vDVUwDQYJKoZIhvcNAQECBQAwWTELMAkG
 A1UEBhMCVVMxGDAWBgNVBAoTD1NlY3VyZVdhcmUgSW5jLjEXMBUGA1UECxMOU2Vj
 dXJlV2FyZSBQQ0ExFzAVBgNVBAsTDkVuZ2luZWVyaW5nIENBMB4XDTk1MDUwODIw
 MjMzNVoXDTk3MDUwNzIwMjMzNVowcDELMAkGA1UEBhMCVVMxGDAWBgNVBAoTD1Nl
 Y3VyZVdhcmUgSW5jLjEXMBUGA1UECxMOU2VjdXJlV2FyZSBQQ0ExFzAVBgNVBAsT
 DkVuZ2luZWVyaW5nIENBMRUwEwYDVQQDEwxDaGFybGVzIFdhdHQwWTAKBgRVCAEB
 AgICBANLADBIAkEM2ZSp7b6eqDqK5RbPFpd6DGSLjbpHOZU07pUcdgJXiduj9Ytf
 1rsmf/adaplQr+X5FeoIdT/bVSv2MUi3gY0eFwIDAQABMA0GCSqGSIb3DQEBAgUA
 A0EApEjzeBjiSnGImJXgeY1K8HWSufpJ2DpLBF7DYqqIVAX9H7gmfOJhfeGEYVjK
 aTxjgASxqHhzkx7PkOnL4JrN+Q==
MIC-Info: RSA-MD5,RSA,
 CjW81uLLaNxmHKEFGvLlRPVknGKeyMsMAGbyaXYA/6puqyPsHKbPrYb3seEbNK7i
 X0h3M7XKAjv7iTEPk411pPo=

We use the Interceptor to protect Security First Network Bank.  It
installs easily, is very easy to administer, provides excellent logging
and alarming, all with good throughput.  In the past we have used or
evaluated several other products (Checkpoint, Raptor, Gauntlet) before
deciding on the Interceptor.

Charles Watt
Security First Technologies

> We are presently evaluating different firewall solutions, one of which
> is Technologic's Interceptor.
> 
> Is it a good product?
> 
> Can anyone please provide a little insight.
> 
> Thanks in advance,
> David Weinstein
> VP of Information Systems and Technology
> 
-----END PRIVACY-ENHANCED MESSAGE-----

From firewalls-owner  Mon Feb  3 11:04:57 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id KAA09613 for firewalls-outgoing; Mon, 3 Feb 1997 10:54:43 -0800 (PST)
Received: from emf.emf.net (emf.emf.net [205.149.0.20]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id KAA09565 for <firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 10:54:13 -0800 (PST)
Received: from d4bdonapc01 (dhcp-17-005.srv.ptss.com [155.241.17.5]) by emf.emf.net (EMF-K/K) with ESMTP id KAA28196; Mon, 3 Feb 1997 10:49:00 -0800
Message-Id: <199702031849.KAA28196@emf.emf.net>
From: "David B. Donahue" <ddonahue@emf.net>
To: <Laura_Bohde@prenhall.com>, <firewalls@GreatCircle.COM>,
        <mike.starkweather@anheuser-busch.com>,
        "Francis Yeung" <fyeung@fyeung8.netific.com>
Cc: <www@qualix.com>
Subject: Re: Re[2]: Highly available Internet connection
Date: Mon, 3 Feb 1997 10:52:50 -0800
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1155
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I used to be a reseller (not anymore) for a product called Qualix
"Secure-watch" it was a high availability solution, it worked very well for
me in some complex configurations.

It automatically backed up the firewall and/or web server hardware and
software using  automatic hot cutover/monitoring software and Shared SCSI
disks.

Tech support wasn't great, but it was OK if you were a Sr. Unix sys admin.

According to the sales info on thier home page at:
http://www.qualix.com/sysman/product/securewatch.htmld/

"Qualix has combined the core technology of the leading high-availability
software, QualixHA(tm) (including Qualix HA-Environment(tm)and VERITAS
FirstWatch(r)), with the security of the leading firewall, FireWall-1.
These two products, along with special Qualix HA-Modules(tm) software,
provide a packaged solution for highly available secure Internet
connectivity."

"In order to guarantee access to the Internet, SecureWatch uses two
workstations. A primary workstation operates as the Internet firewall, and
a "hot standby"
workstation operates as the back-up."

I'd bet that a solution like this would solve your problems, they have
several competitors you can do a Hotbot search for "high availability
firewall" and turn some of those up.

-David B. Donahue

P.S. I have no affiliation with them anymore, i just liked thier product,
even if i had problems with thier T/S group.

----------
> From: Laura_Bohde@prenhall.com
> To: firewalls@GreatCircle.COM; mike.starkweather@anheuser-busch.com;
Francis Yeung <fyeung@fyeung8.netific.com>
> Subject: Re[2]: Highly available Internet connection
> Date: Thursday, January 30, 1997 8:24 PM
> 
>         
>         The firewall is not powered off - what is powered off is 
>         the router on one side of it, and the hub on the other 
>         side.  I never want to use a power switch on a Unix box 
>         for fear of corrupting the File Systems/disks.  Also - 
>         leaving the firewall live enables us to ensure the backup 
>         doesn't have any hardware problems.
>         
>         We haven't automated the synching yet.  Static routes are 
>         defined in a startup file - the same on both systems.  
>         Doesn't change very often, and is easy to change on both 
>         systems, should a new route need to be added.  All I 
>         actually need to do is copy the firewall config files (I 
>         use tape right now, can't ftp because the backup isn't on 
>         a live network) over to the backup system after I make a 
>         configuration change.  Only takes a few minutes -
>         
>         We also thought about the second disk idea, where you 
>         could boot off of another disk that housed the 
>         configuration, but we didn't want to worry about the 
>         experience of the person performing the switch-over.
>         
>         - Laura
> 
> 
> ______________________________ Reply Separator
_________________________________
> Subject: Re: Highly available Internet connection
> Author:  fyeung@fyeung8.netific.com (Francis Yeung) at INTERNET-PUB
> Date:    1/30/97 10:43 AM
> 
> 
> Laura,
>         
>         What happens to the data - firewall rules, static routes etc,
>  ? How you do keep them in sync if one unit is powered off ?
>         
>         Thanks.
>         
>         Francis
>         
> > From root@fyeung25.netific.com Thu Jan 30 03:32 PST 1997 
> > From: Laura_Bohde@prenhall.com
> > Date: Wed, 29 Jan 1997 23:20:46 -0500
> > Subject: Re: Highly available Internet connection
> > To: "'firewalls@GreatCircle.COM'" <firewalls@GreatCircle.COM>,
> >         "Starkweather; Mike" <mike.starkweather@anheuser-busch.com> 
> > 
> >         
> >         We have two routers connected to the Internet configured 
> >         identically, as well as two hubs, two firewalls, and two 
> >         hubs on the other side.  Then we installed Black Box 
> >         power on/off switches (one on each router, and one on 
> >         each hub at the other end).  This way we can leave one 
> >         network up and the other powered off.  If any device in 
> >         the "primary" network fails, with a simple phone call 
> >         (our help desk can even do this), one network can be 
> >         powered off and the other powered up.  (this way all 
> >         equipment can actually have the same IP addresses too.) 
> >         
> >         Hope this helps -
> >         
> >         Laura
> > 
> > 
> > ______________________________ Reply Separator 
> _________________________________
> > Subject: Highly available Internet connection
> > Author:  "Starkweather; Mike" <mike.starkweather@anheuser-busch.com> at

> > INTERNET-PUB
> > Date:    1/29/97 4:40 PM
> > 
> > 
> > My company wants to move toward Electronic Commerce on the Internet. 
> >  One of the requirements would be a highly available, secure 
> > connection.  One of the ideas I have considered is two firewalls going 
> > out over two routers to two wide area links to two ISPs.  This is a 
> > pretty brute force approach.
> >         
> > Does anyone have any ideas to share on how we might build an Internet 
> > connection that would approach 100 percent availability?
> >         
> > Thanks for all your help.
> >         
> > Mike Starkweather
> > Anheuser-Busch
> > 
> > 
> > 

From firewalls-owner  Mon Feb  3 11:15:40 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id KAA09926 for firewalls-outgoing; Mon, 3 Feb 1997 10:57:45 -0800 (PST)
Received: from mailhost.netrunner.net (mailhost.netrunner.net [204.137.145.201]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id KAA09826 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 10:57:05 -0800 (PST)
Received: from brian ([207.100.192.100]) by mailhost.netrunner.net (8.7.5/8.7.5) with SMTP id OAA20494 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 14:05:27 -0500 (EST)
Date: Mon, 3 Feb 1997 14:05:27 -0500 (EST)
Message-Id: <1.5.4.16.19970203135653.1aef92d6@mailhost.netrunner.net>
X-Sender: brianp@mailhost.netrunner.net
X-Mailer: Windows Eudora Light Version 1.5.4 (16)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: Firewalls@GreatCircle.COM
From: Brian Podolak <brianp@netrunner.net>
Subject: Re: Sidewinder vs. Cyberguard
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 09:31 PM 2/1/97 -0400, you wrote:
>Jim Canfield wrote:
>>The most secure, usable, firewall we have found to date is the
>>Cyberguard
>
>On what basis do you make this assertion?  "secure" can mean a lot of 
>things and a rubber stamp from NSA or it's equivalent doesn't mean a 
>whole lot if buggy software can be trivially exploited.  We could go on 
>about "usable" but I'll let that one slide.  In particular is the 
>firewall configuration an EXACT match with the 
>"certified/tested/evaluated" machine?  NT has a C2 rating but it's not 
>worth a damn.  When was the last time you ran an NT box with no LAN, no 
>floppy, and with a modified BIOS?  Not exactly a useful product.  Then 
>again, assuming you duplicate this setup, place said machine nearish to a 
>window.  Electronic eavesdropping (for about $3000 and change) or outside 
>observation does tend to degrade the usefulness of said rating does it 
>not?

Firest Mistake. NT is not C2 complient. Anyone knowing anything about LAN
security would know this. Do a little more research before replying to
someone. Besides, do you even know the differnet levels of security, or are
you just "anti-nt".(which is not a bad thing)



>
>>As mentioned the products are B1 compliant (awaiting certification)....
>whatever, see above.
>
>>They are relatively easy to setup , nice GUI and it has built in the
>Ah, the GUI.  Remote manageable too I think I recall.  What to say when 
>the X11 session gets hijacked?  You sure the box isn't running a 
>braindamaged X11 server?  Can you attack the logging facility thru DOS?  
>What happens when you bog the machine down with hundreds of connections?  
>Does it run out of VM and spontaneously reboot?  How about the logs 
>filling up the disk?  What happens when this occurs and an exploit is 
>then launched?  Do you still have an audit trail?
>
Have you even used the Cyberguard product ? You would know this if you have.
Pick up a phone and call !!


>>ablity for most "standard "(excuse the word) proxies and allows creation
>>of probably anything you might need.
>So they know how to check off all of the feature boxes on the report 
>card.  Anybody can and everybody does that.
>
>IMO ratings, be they NSA/NCSA or whatever aren't worth much and 
>deffinately not a price premium.  I take far more comfort in people 
>banging away at the available stuff and fixing the problems.  
>Additionally, you really believe the vendor (or reviewer for that matter) 
>went thru every single line of code specifically looking for possible 
>exploits?  Get real.  All the ratings do is study the protection scheme 
>and bless it as logical and OK at least in theory.  Then with various 
>degrees of persistance they try to prove you can't get around said 
>protection.  Holes and stack smashes by way of poorly written C and 
>resolver libraries and DOS via SYN etc. aren't addressed.  If they were 
>we wouldn't be plagued with some of the problems we have now.
>
SO..... Which firewall do you prefer? A filter in a router.

Sorry about the late response, I took off this weekend for once. I believe
if you do prefer one FW to another, that is fine. But don't say one box is
"better" then another or one is not "good". How do we rate these today? As
all LAN and WAN hardware desicions, personal tastes still are a factor. If I
like Cyberguard and you like Guantlet, who is to say I am wrong or you are.
Each application has it own requirements. Don't ask questions that pertain
to firewalls in general. 

 


>
============================================================================
= Brian Podolak, 							====
= E-Mail brianp@netrunner.net						====
============================================================================


From firewalls-owner  Mon Feb  3 12:11:25 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id LAA16660 for firewalls-outgoing; Mon, 3 Feb 1997 11:59:08 -0800 (PST)
Received: from beach.sctc.com (beach.sctc.com [192.55.214.50]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id LAA16642 for <firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 11:58:51 -0800 (PST)
Received: from mfil.terminal (mfil@localhost) by beach.sctc.com (8.7.5/8.7.3) with SMTP id NAA23552; Mon, 3 Feb 1997 13:20:43 -0600 (CST)
Received: from sphinx.sctc.com (sphinx.sctc.com [172.17.192.3]) by beach.sctc.com (8.7.5/8.7.3) with ESMTP id NAA23544; Mon, 3 Feb 1997 13:20:36 -0600 (CST)
Received: from cressida.sctc.com (cressida.sctc.com [172.17.192.62]) by sphinx.sctc.com (8.8.5/8.7.3) with ESMTP id NAA20517; Mon, 3 Feb 1997 13:23:04 -0600 (CST)
Received: from localhost (willis@localhost)
          by cressida.sctc.com (8.8.5/8.8.4) with SMTP
	  id NAA01821; Mon, 3 Feb 1997 13:23:01 -0600 (CST)
Date: Mon, 3 Feb 1997 13:23:01 -0600 (CST)
From: Matt Willis <willis@sctc.com>
To: "K.M." <goertzek@wangfed.com>
cc: firewalls@GreatCircle.COM
Subject: Re: Sidewinder vs. Cyberguard
In-Reply-To: <9702031538.AA20974@uc0009.wangfed.com>
Message-ID: <Pine.GSO.3.95.970203131751.1690F-100000@cressida.sctc.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Mon, 3 Feb 1997, K.M. wrote:

> However, I have heard that Sidewinder is very difficult to configure, unless 
> they have managed to greatly improve their interface in new release.  

Sidewinder now offers a *real* GUI and a command line interface, for those
of us that like it old-school.  Not that I count as unbiased, but it's a
night-and-day comparison to the old version...

We've also done away with the notion of internal and external to allow for
multiple network interfaces...

The mail-filter is pretty hip, as well... drag-and-drop and such.

Matt Willis
Computer Scientist
Secure Computing Corporation


From firewalls-owner  Mon Feb  3 12:41:36 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id MAA18364 for firewalls-outgoing; Mon, 3 Feb 1997 12:13:55 -0800 (PST)
Received: from mailhost.netrunner.net (mailhost.netrunner.net [204.137.145.201]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id MAA18299 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 12:13:25 -0800 (PST)
Received: from brian ([207.100.192.100]) by mailhost.netrunner.net (8.7.5/8.7.5) with SMTP id PAA26673 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 15:21:40 -0500 (EST)
Date: Mon, 3 Feb 1997 15:21:40 -0500 (EST)
Message-Id: <1.5.4.16.19970203151305.19a7696a@mailhost.netrunner.net>
X-Sender: brianp@mailhost.netrunner.net
X-Mailer: Windows Eudora Light Version 1.5.4 (16)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: Firewalls@GreatCircle.COM
From: Brian Podolak <brianp@netrunner.net>
Subject: Re: Sidewinder vs. Cyberguard
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 09:31 PM 2/1/97 -0400, you wrote:
>Jim Canfield wrote:
>>The most secure, usable, firewall we have found to date is the
>>Cyberguard
>
>On what basis do you make this assertion?  "secure" can mean a lot of 
>things and a rubber stamp from NSA or it's equivalent doesn't mean a 
>whole lot if buggy software can be trivially exploited.  We could go on 
>about "usable" but I'll let that one slide.  In particular is the 
>firewall configuration an EXACT match with the 
>"certified/tested/evaluated" machine?  NT has a C2 rating but it's not 
>worth a damn.  When was the last time you ran an NT box with no LAN, no 
>floppy, and with a modified BIOS?  Not exactly a useful product.  Then 
>again, assuming you duplicate this setup, place said machine nearish to a 
>window.  Electronic eavesdropping (for about $3000 and change) or outside 
>observation does tend to degrade the usefulness of said rating does it 
>not?

Firest Mistake. NT is not C2 complient. Anyone knowing anything about LAN
security would know this. Do a little more research before replying to
someone. Besides, do you even know the differnet levels of security, or are
you just "anti-nt".(which is not a bad thing)



>
>>As mentioned the products are B1 compliant (awaiting certification)....
>whatever, see above.
>
>>They are relatively easy to setup , nice GUI and it has built in the
>Ah, the GUI.  Remote manageable too I think I recall.  What to say when 
>the X11 session gets hijacked?  You sure the box isn't running a 
>braindamaged X11 server?  Can you attack the logging facility thru DOS?  
>What happens when you bog the machine down with hundreds of connections?  
>Does it run out of VM and spontaneously reboot?  How about the logs 
>filling up the disk?  What happens when this occurs and an exploit is 
>then launched?  Do you still have an audit trail?
>
Have you even used the Cyberguard product ? You would know this if you have.
Pick up a phone and call !!


>>ablity for most "standard "(excuse the word) proxies and allows creation
>>of probably anything you might need.
>So they know how to check off all of the feature boxes on the report 
>card.  Anybody can and everybody does that.
>
>IMO ratings, be they NSA/NCSA or whatever aren't worth much and 
>deffinately not a price premium.  I take far more comfort in people 
>banging away at the available stuff and fixing the problems.  
>Additionally, you really believe the vendor (or reviewer for that matter) 
>went thru every single line of code specifically looking for possible 
>exploits?  Get real.  All the ratings do is study the protection scheme 
>and bless it as logical and OK at least in theory.  Then with various 
>degrees of persistance they try to prove you can't get around said 
>protection.  Holes and stack smashes by way of poorly written C and 
>resolver libraries and DOS via SYN etc. aren't addressed.  If they were 
>we wouldn't be plagued with some of the problems we have now.
>
SO..... Which firewall do you prefer? A filter in a router.

Sorry about the late response, I took off this weekend for once. I believe
if you do prefer one FW to another, that is fine. But don't say one box is
"better" then another or one is not "good". How do we rate these today? As
all LAN and WAN hardware desicions, personal tastes still are a factor. If I
like Cyberguard and you like Guantlet, who is to say I am wrong or you are.
Each application has it own requirements. Don't ask questions that pertain
to firewalls in general. 

 


>
============================================================================
= Brian Podolak, 							====
= E-Mail brianp@netrunner.net						====
============================================================================


From firewalls-owner  Mon Feb  3 14:27:58 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id MAA21279 for firewalls-outgoing; Mon, 3 Feb 1997 12:35:49 -0800 (PST)
Received: from cypress.nwnet.net (cypress.nwnet.net [192.80.13.56]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id MAA21213 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 12:35:26 -0800 (PST)
Received: from localhost (larry@localhost)
	by cypress.nwnet.net (970108885) with SMTP id MAA23416
	for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 12:34:05 -0800 (PST)
Date: Mon, 3 Feb 1997 12:34:05 -0800 (PST)
From: "Larry J. Hughes Jr." <larry@nwnet.net>
Reply-To: "Larry J. Hughes Jr." <larry@nwnet.net>
To: firewalls@greatcircle.com
Subject: FW's on NT server vs. workstation
Message-ID: <Pine.GSO.3.95.970203123111.6845H-100000@cypress.nwnet.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

(I'm resending this due to the apparent problems with distribution of
issue #44 this past weekend.) 

For those of you running firewalls on NT platforms: is NT server a must,
or does NT workstation suffice?  Any variables I should be aware of? 

---
Larry J. Hughes Jr.    larry@nwnet.net     http://www.nwnet.net/~larry/



From firewalls-owner  Mon Feb  3 14:53:18 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id NAA26914 for firewalls-outgoing; Mon, 3 Feb 1997 13:14:32 -0800 (PST)
Received: from f15.hotmail.com (F15.hotmail.com [207.82.250.26]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id NAA26868 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 13:14:16 -0800 (PST)
Received: (from root@localhost) by f15.hotmail.com (8.7.5/8.7.3) id NAA05684; Mon, 3 Feb 1997 13:12:56 -0800 (PST)
Date: Mon, 3 Feb 1997 13:12:56 -0800 (PST)
Message-Id: <199702032112.NAA05684@f15.hotmail.com>
Received: from 193.1.182.55 by www.hotmail.com with HTTP;
	Mon, 03 Feb 1997 13:12:56 PST
From: "John Cashman" <whizzy1@hotmail.com>
To: Firewalls@GreatCircle.COM
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

please remove my name from the list

---------------------------------------------------------
Get Your *Web-Based* Free Email at http://www.hotmail.com
---------------------------------------------------------


From firewalls-owner  Mon Feb  3 15:14:16 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id OAA07939 for firewalls-outgoing; Mon, 3 Feb 1997 14:33:37 -0800 (PST)
Received: from thor.inlink.com (ultra.inlink.com [206.196.96.100]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id OAA07858 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 14:32:37 -0800 (PST)
Received: from mail.global-sol.com (global-sol.com [206.196.126.221]) by thor.inlink.com (8.8.5/V8) with ESMTP id QAA11469 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 16:30:49 -0600 (CST)
Received: from thor.inlink.com ([206.196.126.220]) by mail.global-sol.com (8.7.5/8.7.3) with SMTP id SAA02126 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 18:11:43 GMT
Message-Id: <199702031811.SAA02126@mail.global-sol.com>
Comments: Authenticated sender is <tlayton@[206.196.126.221]>
From: "Timothy P. Layton, Sr." <tlayton@global-sol.com>
Organization: Global Solutions Corporation
To: firewalls@greatcircle.com
Date: Mon, 3 Feb 1997 16:28:38 +0000
Subject: MS Proxy server ??
Reply-to: tlayton@global-sol.com
X-mailer: Pegasus Mail for Win32 (v2.42)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Has anyone installed and played with the MS Proxy server yet ??

I am researching a firewall solution that will need to include proxy
and N.A.T.

Thanks for any input.


From firewalls-owner  Mon Feb  3 15:42:53 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id OAA07462 for firewalls-outgoing; Mon, 3 Feb 1997 14:28:36 -0800 (PST)
Received: from mail.ptw.com (mail.ptw.com [207.104.240.5]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id OAA07344 for <firewalls@greatCircle.COM>; Mon, 3 Feb 1997 14:28:04 -0800 (PST)
Received: from localhost.com (qh-1-16.ptw.com [207.212.177.48]) by mail.ptw.com (8.8.3/8.6.9) with SMTP id OAA00279 for <firewalls@greatCircle.COM>; Mon, 3 Feb 1997 14:22:43 -0800
Message-Id: <199702032222.OAA00279@mail.ptw.com>
Comments: Authenticated sender is <bextreme@mail.ptw.com>
From: "Jesse" <Jesse.Brown@POBox.com>
To: firewalls@greatCircle.COM
Date: Sun, 2 Feb 1997 14:27:26 +0000
MIME-Version: 1.0
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Subject: Rainbow Book Series?
Reply-to: bextreme@POBox.com
X-mailer: Pegasus Mail for Win32 (v2.42a)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello, does anyone know where I can get the entire Rainbow Book 
Series?

   Thanks!!
-J
===================================================
Finger bextreme@pobox.com for PGP Public Key Block.
E-mail to jesse.brown@pobox.com
phone: (805) 942-1391   pager: (805) 267-9511
---------------------------------------------------
 Member of the HTML Writers Guild (http://hwg.org)
===================================================

From firewalls-owner  Mon Feb  3 16:02:10 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id OAA07769 for firewalls-outgoing; Mon, 3 Feb 1997 14:31:41 -0800 (PST)
Received: from thor.inlink.com (ultra.inlink.com [206.196.96.100]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id OAA07645 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 14:30:39 -0800 (PST)
Received: from mail.global-sol.com (global-sol.com [206.196.126.221]) by thor.inlink.com (8.8.5/V8) with ESMTP id QAA11098 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 16:29:04 -0600 (CST)
Received: from thor.inlink.com ([206.196.126.220]) by mail.global-sol.com (8.7.5/8.7.3) with SMTP id SAA02110 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 18:09:58 GMT
Message-Id: <199702031809.SAA02110@mail.global-sol.com>
Comments: Authenticated sender is <tlayton@[206.196.126.221]>
From: "Timothy P. Layton, Sr." <tlayton@global-sol.com>
Organization: Global Solutions Corporation
To: firewalls@greatcircle.com
Date: Mon, 3 Feb 1997 16:26:54 +0000
Subject: NAT on Cisco PIX vs. ??
Reply-to: tlayton@global-sol.com
X-mailer: Pegasus Mail for Win32 (v2.42)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I am familiar with NAT on the PIX and was wondering what 
operating systems that any one has had experience with in dealing
with NAT. Does any one feel that there is a trade off with the
PIX being a hardware solution vs. a software based solution ?

Thanks for any input.



From firewalls-owner  Mon Feb  3 16:06:48 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id PAA12171 for firewalls-outgoing; Mon, 3 Feb 1997 15:06:43 -0800 (PST)
Received: from relay7.UU.NET (relay7.UU.NET [192.48.96.17]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id PAA12116 for <firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 15:06:18 -0800 (PST)
Received: from txau.tx.mt.np.els-gms.att.net by relay7.UU.NET with SMTP 
	(peer crosschecked as: txau.tx.mt.np.els-gms.att.net [199.191.144.201])
	id QQcbiy12497; Mon, 3 Feb 1997 18:04:51 -0500 (EST)
Date: Mon, 03 Feb 1997 17:08:55 -0500
From: mcoss@attmail.com (Michael J Coss)
Received: from mcoss by attmail; Mon Feb  3 23:02:12 GMT 1997
Subject: Re: Sidewinder vs. Cyberguard
To: firewalls@GreatCircle.COM
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <winATT-3.0-mcoss-26>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Matthew Patton wrote:

>On what basis do you make this assertion?  "secure" can mean a lot of 
>things and a rubber stamp from NSA or it's equivalent doesn't mean a 
>whole lot if buggy software can be trivially exploited.  We could go on 
>about "usable" but I'll let that one slide.  In particular is the 
>firewall configuration an EXACT match with the 
>"certified/tested/evaluated" machine?  NT has a C2 rating but it's not 
>worth a damn.  When was the last time you ran an NT box with no LAN, no 
>floppy, and with a modified BIOS?  Not exactly a useful product.  Then 
>again, assuming you duplicate this setup, place said machine nearish to a 
>window.  Electronic eavesdropping (for about $3000 and change) or outside 
>observation does tend to degrade the usefulness of said rating does it 
>not?

Your correct, "secure" is a nebulous term, but obviously you have not been 
involved with a evaluation of an operating system if you believe that its a 
rubber stamp.  I worked on the NCSC evaluation of a UNIX operating system and 
it took too long (several years) and was not a rubber stamp.  Your point about 
what the configuration is is quite true but Cyberguard has gone the extra mile 
of getting a Network evaluation to provide a better security solution that 
does include a network component.  And you can buy the NightHawk in a TEMPEST 
cabinet if your concerned about that.
 
>Ah, the GUI.  Remote manageable too I think I recall.  What to say when 
>the X11 session gets hijacked?  You sure the box isn't running a 
>braindamaged X11 server?  Can you attack the logging facility thru DOS?  
>What happens when you bog the machine down with hundreds of connections?  
>Does it run out of VM and spontaneously reboot?  How about the logs 
>filling up the disk?  What happens when this occurs and an exploit is 
>then launched?  Do you still have an audit trail?

First, I know of no system that is completely immune to a concerted denial of 
service attack.  You can attempt to minimize the impact but with a general 
purpose operating system, it may be virtually impossible to eliminate.  
Second, unless your willing to expend the money to create a tamperproof box, 
the granting of access to the machine is taboo. 

>So they know how to check off all of the feature boxes on the report 
>card.  Anybody can and everybody does that.
Do you KNOW that the features are not provided?  What feature do you believe 
they are lying about?

>IMO ratings, be they NSA/NCSA or whatever aren't worth much and 
>deffinately not a price premium.  I take far more comfort in people 
>banging away at the available stuff and fixing the problems.  
And what pray tell do you believe that the evaluations/testings are trying to 
do?  The purpose of these are to provide a degree of comfort that someone 
other than the vendor has looked is varying degrees of detail at the 
implementation of the software/hardware combination.

>Additionally, you really believe the vendor (or reviewer for that matter) 
>went thru every single line of code specifically looking for possible 
>exploits?  Get real.
Have you been involved in the evaluation process?  I have.  No, we didn't go 
thru every single line of code but we tried to get complete coverage and did a 
analysis of the data flow and looked at the access control mechanisms in 
great detail and looked at privileged processes to verify there correct 
operation and in those programs we did indeed look at every line and reviewed 
the libraries.  That some people attempt to slide thru an evaluation, I have 
no doubt but I'd like to believe that that is the exception rather than the 
rule. 

>All the ratings do is study the protection scheme and bless it as logical 
>and OK at least in theory.  Then with various degrees of persistance they
>try to prove you can't get around said protection.  Holes and stack smashes
>by way of poorly written C and resolver libraries and DOS via SYN etc.
>aren't addressed.

While the NCSC did not require denial of service attacks, nor penetration 
testing (for a B1 system), we as part of our own Q&A did do these things based 
on knowledge gathered from various sources and our own experience.

>If they were we wouldn't be plagued with some of the problems we have now.
No product is completely immune no matter how much money or resources are 
thrown at it.  What you want is a system that provides a degree of security, 
and some assurance that the vendor has made a best effort at 1) implementation 
of a security mechanism, and 2) discovery/correction of known bugs.

Finally, there is the issue of do you need a secure operating system.  While I 
believe that a properly implemented firewall does not require a trusted base 
to run on.  A secure OS will help if the firewall code is compromised.  It may 
not be sufficient to protect the network but it may minimize the damage.

I'm not recommending either choice but I do believe that there is benefits 
derived from having the system evaluated by an outside source.  Is it worth 
the money? The market has shown to date that they want security but don't want 
to pay for the extensive review/testing/etc. required to develop and maintain 
it.  The expectation is that it should come for free..."Of course your 
software is safe...right?"

---Michael J Coss
Lucent Technologies - Bell Laboratories		mjcoss@lucent.com

From firewalls-owner  Mon Feb  3 16:26:28 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id PAA18897 for firewalls-outgoing; Mon, 3 Feb 1997 15:50:41 -0800 (PST)
Received: from si-nic.hrz.uni-siegen.de (si-nic.hrz.uni-siegen.de [141.99.128.16]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id PAA18731 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 15:49:46 -0800 (PST)
Received: from vespa.unix-ag.uni-siegen.de <Firewalls@GreatCircle.COM>
	by si-nic.hrz.uni-siegen.de with SMTP (5.67b/UniSiegen 1.1)
        id AA11184; Tue, 4 Feb 1997 00:48:13 +0100
Received: from privatehost (sfx@isdn92.hrz.uni-siegen.de [141.99.174.92]) by vespa.unix-ag.uni-siegen.de (Mailhost) with ESMTP id AAA23776 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 00:47:20 +0100 (MET)
To: "Firewalls" <Firewalls@GreatCircle.COM>
In-Reply-To: <32F462D3.38E3@pacificnet.net>
From: "Lars Eilebrecht" <sfx@unix-ag.uni-siegen.de>
Date: Tue, 04 Feb 1997 00:45:04 +0200
X-Mailer: IntuiNews 1.4 (28.6.96)
Subject: Re: SATAN user group?
Message-Id: <43790619.sfx@shadowbase.unix-ag.org>
Organization: Unix workgroup at the University of Siegen
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

osiris wrote:

> Has anyone on this list tried "Merlin?" I am wondering whether anyone has
> attempted to make a siilar interface to manage firewall admnistration and
> auditing. (Merln is a tool from CIAC. It integrates Tripwire, COPS, TIGER,
> Crack and reportedly, SPI, which is unavailable to us regular folk. The
                        ^^^
SPI?


ciao...
        Lars
-- 
     _____ ____ __
    /\___// __// /    __              sfx@cyberspace.org
    \ \  / /_\  /    /\_\      http://www.cyberspace.org/~sfx/
  ___\ \/ __//  \    \/_/
 /____\/_/  /_/\ \           - I don't know, I don't care,
                \_\         - and it doesn't make any difference.


From firewalls-owner  Mon Feb  3 16:29:01 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id PAA17618 for firewalls-outgoing; Mon, 3 Feb 1997 15:42:28 -0800 (PST)
Received: from loki.atcon.com (loki.atcon.com [199.166.213.6]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id PAA17579 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 15:42:11 -0800 (PST)
Received: from stealth.icondata.com (stealth.icondata.com [198.167.251.19]) by loki.atcon.com (8.8.3/8.7.3) with SMTP id TAA27191 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 19:40:41 -0400 (AST)
Received: by stealth.icondata.com with Microsoft Mail
	id <01BC120A.4F787AC0@stealth.icondata.com>; Mon, 3 Feb 1997 19:41:55 -0400
Message-ID: <01BC120A.4F787AC0@stealth.icondata.com>
From: Jeff Simms <jsimms@auracom.com>
To: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: RE: NT network and system management
Date: Mon, 3 Feb 1997 19:41:53 -0400
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

One product you may look into is MS SMS (System Management Server) =
Server.  I have only briefly looked at the product, but it does most, if =
not all and more, of the things you require.

Jeff Simms
Network Services Manager
auracom Internet Services

-----Original Message-----
From:	FaNgYoU2 [SMTP:fangyou2@panix.com]
Sent:	Monday, February 03, 1997 1:18 PM
To:	firewalls@GreatCircle.COM
Subject:	NT network and system management

Apologies because this is not strictly a firewall question.  However,
there are quite a few NT experts on the list who can help.

I need to monitor the following items across about 80 Windows NT =
servers:
DOS Devices : Paging File : Percent usage Peak
Physical Disk : Percent disk time
Physical Disk : Average disk sec/read  (reads per second)
Physical Disk : Disk read bytes/sec    (read bytes per second)
Physical Disk : Queue length
Processor : Percent processor time
Memory : pages/second
Server : bytes total/second

For each network user connected to server:
NIC card address/MAC address
Computer name (if any)
IP address (if any)
User name.

Is there a group of NET commands which will give me this?
Is there a commercial product that can be customized to give me this?
Finally, which mailing list does this question really belong on?

                                         FaNgYoU2, Cyberspace^^Vampyre

^^       Touch it, touch it, touch me ... creatures of the Night       =
^^



From firewalls-owner  Mon Feb  3 16:32:00 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id PAA15568 for firewalls-outgoing; Mon, 3 Feb 1997 15:29:05 -0800 (PST)
Received: from terisa-bh.terisa.com (terisa-bh.terisa.COM [205.226.38.66]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id PAA15548 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 15:28:55 -0800 (PST)
Received: (from uucp@localhost) by terisa-bh.terisa.com (8.6.12/8.6.11) id PAA13228; Mon, 3 Feb 1997 15:28:59 -0800
Received: from itech.terisa.com by terisa-bh.terisa.com via smap (V1.3)
	id sma013225; Mon Feb  3 15:28:44 1997
Received: from kmac.terisa.COM (kmac.terisa.COM [205.226.39.35]) by itech.terisa.com (8.6.12/8.6.4) with SMTP id PAA13699; Mon, 3 Feb 1997 15:25:09 -0800
Message-Id: <199702032325.PAA13699@itech.terisa.com>
X-Authentication-Warning: itech.terisa.com: Host kmac.terisa.COM didn't use HELO protocol
To: Brian Podolak <brianp@netrunner.net>
cc: Firewalls@GreatCircle.COM
Subject: Re: Sidewinder vs. Cyberguard 
In-reply-to: Your message of "Mon, 03 Feb 1997 14:05:27 EST."
             <1.5.4.16.19970203135653.1aef92d6@mailhost.netrunner.net> 
Date: Mon, 03 Feb 1997 15:29:08 -0800
From: EKR <ekr@terisa.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> At 09:31 PM 2/1/97 -0400, you wrote:
> >Jim Canfield wrote:
> >>The most secure, usable, firewall we have found to date is the
> >>Cyberguard
> >
> >On what basis do you make this assertion?  "secure" can mean a lot of 
> >things and a rubber stamp from NSA or it's equivalent doesn't mean a 
> >whole lot if buggy software can be trivially exploited.  We could go on 
> >about "usable" but I'll let that one slide.  In particular is the 
> >firewall configuration an EXACT match with the 
> >"certified/tested/evaluated" machine?  NT has a C2 rating but it's not 
> >worth a damn.  When was the last time you ran an NT box with no LAN, no 
> >floppy, and with a modified BIOS?  Not exactly a useful product.  Then 
> >again, assuming you duplicate this setup, place said machine nearish to a 
> >window.  Electronic eavesdropping (for about $3000 and change) or outside 
> >observation does tend to degrade the usefulness of said rating does it 
> >not?
> 
> Firest Mistake. NT is not C2 complient. Anyone knowing anything about LAN
> security would know this. Do a little more research before replying to
> someone. Besides, do you even know the differnet levels of security, or are
> you just "anti-nt".(which is not a bad thing)
Actually, you're quite wrong. NT has been evaluated at C2 in
a standalone configuration, which appears to be precisely what
the gentleman was referring to. Please see:

http://www.radium.ncsc.mil/tpep/epl/entries/CSC-EPL-95-003.html

-Ekr



From firewalls-owner  Mon Feb  3 16:36:23 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id PAA17994 for firewalls-outgoing; Mon, 3 Feb 1997 15:44:10 -0800 (PST)
Received: from gatekeeper.Bridge.COM (gatekeeper.bridge.com [167.76.159.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id PAA17713 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 15:42:57 -0800 (PST)
Received: (from mailproxy@localhost) by gatekeeper.Bridge.COM (8.6.12/8.6.9) id RAA26513 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 17:40:18 -0600
Received: from dns1srv.bridge.com(167.76.36.6) by gatekeeper.Bridge.COM via smap (V1.3)
	id sma026498; Mon Feb  3 17:40:09 1997
Received: from binki.bridge.com (binki.bridge.com [167.76.24.243]) by dns1srv.bridge.com (8.7.6/8.7.3) with ESMTP id RAA17246 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 17:41:36 -0600 (CST)
Received: (from ken@localhost) by binki.bridge.com (8.7/8.7) id RAA07664 for firewalls@greatcircle.com; Mon, 3 Feb 1997 17:41:38 -0600 (CST)
Date: Mon, 3 Feb 1997 17:41:38 -0600 (CST)
From: Ken Hardy <ken@mailhost.bridge.com>
Message-Id: <199702032341.RAA07664@binki.bridge.com>
To: firewalls@greatcircle.com
Subject: Solved: Odd probes at port 7777
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I wrote:

>Every couple of days we get an attempted connection to port 7777 from
>scripps.edu, so I put a byte sucker on that port to log any received
>data.  It seems to be a 4 digit and a 2 digit number separated by a
>comma, followed by a carriage return.

Further investigation made it apparent that the connection to my port
7777 was occuring whenever a connection was made to the remote system's
SMTP port.  The data I captured, two comma-separated decimal numbers
followed by a <CR><LF>, is identical to an IDENT query.  The second number
was always 25.  The lightbulb lights!

I relayed this information to the site's admin.  He reports that they
had recently installed a new version of sendmail which does IDENT
queries, but why to port 7777?  The admin's latest message to me:

>You were on the right track with your comment about services..
>We are a heavy user of NIS and ident is not a standard Solaris
>/etc/services daemon.  I found that the NIS file contained
>an ident entry with an alias of auth..  There was an auth entry
>in the NIS file at port 7777..  I converted it to only use
>a local copy of the services file..  Hopefully, this will cause
>the probing you were seeing to go away..  If it doesn't please
>let me know..  THANKS for the heads-up on the problem!

I don't see this on any of my Solaris systems (not using NIS).  I'd
guess that someone had put an "auth" entry in at 7777 to refer to TIS'
authsrv, which uses that port.
^^^^

--
KH

From firewalls-owner  Mon Feb  3 18:10:57 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id SAA12537 for firewalls-outgoing; Mon, 3 Feb 1997 18:07:48 -0800 (PST)
Received: from polaris.pacificnet.net (polaris.pacificnet.net [207.171.0.250]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id SAA12518 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 18:07:37 -0800 (PST)
From: osiris@pacificnet.net
Received: from lwash (pm3e-31.pacificnet.net [207.171.18.224]) by polaris.pacificnet.net (8.6.11/8.6.11) with SMTP id SAA27015; Mon, 3 Feb 1997 18:05:29 -0800
Message-ID: <32F69A74.A8B@pacificnet.net>
Date: Mon, 03 Feb 1997 18:09:56 -0800
Organization: -
X-Mailer: Mozilla 3.01Gold (Win95; I)
MIME-Version: 1.0
To: Lars Eilebrecht <sfx@unix-ag.uni-siegen.de>
CC: Firewalls <Firewalls@GreatCircle.COM>
Subject: Re: SATAN user group?
References: <43790619.sfx@shadowbase.unix-ag.org>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Lars Eilebrecht wrote:
> 
> osiris wrote:
> 
> > Has anyone on this list tried "Merlin?" I am wondering whether anyone has
> > attempted to make a siilar interface to manage firewall admnistration and
> > auditing. (Merln is a tool from CIAC. It integrates Tripwire, COPS, TIGER,
> > Crack and reportedly, SPI, which is unavailable to us regular folk. The
>                         ^^^
> SPI?
> 
> ciao...
>         Lars

Yeah...strange little ditty. SPI = Security Profile Inspector. It's a
very powerful tool for examination of UNIX networks. Problem is, it's
only available to the US Department of Energy and Department of Defense.
(Or, qualified contractors.) You can check out at least their preview at
http://ciac.llnl.gov/cstc/spi/spinet.html. About the closest I've been
able to get to understanding this tool is to aqcuire the manuals (which
apparently aren't restricted) and are here:
ftp://ciac.llnl.gov/pub/spi/spi.rm.ps.Z.

From firewalls-owner  Mon Feb  3 18:56:32 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id SAA16874 for firewalls-outgoing; Mon, 3 Feb 1997 18:44:13 -0800 (PST)
Received: from csc.com (explorer.csc.com [20.1.10.27]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id SAA16829 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 18:44:00 -0800 (PST)
Received: from sdfpc2.gsfc.nasa.gov by csc.com with smtp
	(Smail3.1.29.1 #1) id m0vrapU-001AdNC; Mon, 3 Feb 97 21:41 EST
Message-ID: <32F6CCFC.6E6A@csc.com>
Date: Mon, 03 Feb 1997 21:45:32 -0800
From: Adam Safier <asafier@csc.com>
Reply-To: asafier@csc.com
Organization: Computer Sciences Corp.
X-Mailer: Mozilla 3.0 (Win16; U)
MIME-Version: 1.0
To: firewalls@greatcircle.com
CC: watchman@molhub.mol.net.my, MMedwid@symantec.com
Subject: Multicast through Firewall-1
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Can anyone provide pointers to an MOSPF implementation for Solaris 2.5
(without full OSPF if possible - I plan static routs)  or  better yet, a
multicast proxy or Firewall-1 rule that will pass multicast correctly?

An alternative would be a proxy/rule for joining an external group and
then doing NAT to unicast to selected host(s) internally.  Anyone got
one they can share?

Background:

By running _Mrouted_ on the firewall I can multicast between LAN's on
either side of Firewall-1 on a SUN with Solaris 2.5 (I know... UDP,
multicast <> security, but we have to have it.) Alas, the backbone
(external) router will be running MOSPF.  MOSPF and DVMRP supposedly do
not talk to each other on Bay Networks routers (over which I have no
control.)

>From what I can tell from some searches, as of June '96 gated did not
support MOSPF.  It will someday but it doesn't look like it will be in
time to help me.

Knowledge sharing and misinformation:

Multicast uses the Class D IP addresses to transmit a single packet that
can be seen by a group of hosts.  An IGMP (protocol 2, not ICMP) "join"
(or "drop") message is sent to multicast capable routers by hosts that
wish to join a multicast group. The router uses either MOSPF or DVMRP to
tell other routers it has group memebers for that group.  When a
multicast UDP packet is sent by one host the routers unicast it between
routers that have group memebers for that packet. When a router has an
attached LAN with memebers in the group it sends that packet out with a
multicast IP address (Ex: 224.1.2.3) on the LAN's multicast MAC
address.  (Ethernet actually ends up mapping 4 multicast IP addresses to
each ethernet multicast address.)  

The need to write to a multicast MAC address is why I think regular NAT
will not work well with multicast. We could try to work out something by
overloading IP addresses on each interface and forcing a multicast MAC
address on each multicast IP address in the ARP table but with a bunch
of multicast addresses this is a painfully tedious process, if it even
works!

Mrouted takes care of all of that but then the firewall is acting as a
router running DVMRP, which is incompatible with MOSPF (multicast
extensions to OSPF!)  I tried running an AltaVista search on +MOSPF +sun
+multicast and got limited results and no pointers to MOSPF code



-- 
Adam Safier                  asafier@csc.com		http://www.csc.com
CSC-SED-Infosec              (301) 794-1349		(301) 552-3272 (fax)

Curious Cat Question:  
How does DIX Ethernet know the packet length?
802.3 Ethernet has a length field but DIX has a type and no length
field.

Technology Abuse: 1) Netscape Frames on a 14" screen.
                  2) Netscape 3.0 on a 386-33 w/ 8 Meg RAM.

The above are my own opinions.
I'm proud to live in a country where I'm free to express them!


From firewalls-owner  Mon Feb  3 19:25:53 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id TAA21106 for firewalls-outgoing; Mon, 3 Feb 1997 19:19:57 -0800 (PST)
Received: from mesbne01.medeserv.com.au (mesbne01.medeserv.com.au [203.9.184.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id TAA21076 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 19:19:47 -0800 (PST)
Received: (from mail@localhost) by mesbne01.medeserv.com.au (8.7.4/8.7.3) id NAA07310 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 13:18:23 +1000 (EST)
Received: from tooh199.medeserv.com.au(203.9.187.199) by mesbne01 via smap (V1.3)
	id /mail/incoming/sma007295; Tue Feb  4 13:18:21 1997
Message-ID: <32F6ACD0.2F25@medeserv.com.au>
Date: Tue, 04 Feb 1997 13:28:16 +1000
From: Steven Herod <sherod@medeserv.com.au>
Reply-To: sherod@medeserv.com.au
Organization: Med-E-Serv Connect
X-Mailer: Mozilla 3.0C-MESC  (WinNT; I)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: Encryption Software mailing list
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Is anybody familiar with an Encyrption Software mailing list
or something along those lines?

Best Regards
Steven Herod

From firewalls-owner  Mon Feb  3 19:45:03 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id TAA21607 for firewalls-outgoing; Mon, 3 Feb 1997 19:25:52 -0800 (PST)
Received: from homeport.org (lighthouse.homeport.org [205.136.65.198]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id TAA21584 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 19:25:42 -0800 (PST)
Received: (adam@localhost) by homeport.org (8.8.5/8.6.9) id WAA12795; Mon, 3 Feb 1997 22:22:00 -0500 (EST)
From: Adam Shostack <adam@homeport.org>
Message-Id: <199702040322.WAA12795@homeport.org>
Subject: Re: to source or not to source? (was: [NTSEC] ActiveX, MSIE and Quicken)
In-Reply-To: <199702031025.LAA07956@relay.cryptonet.it> from David Vincenzetti at "Feb 3, 97 11:17:58 am"
To: vince@cryptonet.it (David Vincenzetti)
Date: Mon, 3 Feb 1997 22:21:59 -0500 (EST)
Cc: Firewalls@GreatCircle.COM
X-Mailer: ELM [version 2.4ME+ PL27 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

	Malicious hackers have a lot more time on their hands than
good guys.

	They do not, however, tend to publish bugs.  So, what you see
in public is that the many good guys who look at systems with source
available announce problems, while the bad guys, who look at both
source and binaries, do not announce problems.  This is what
statisticians refer to as the self-selection problem.

	Drawing inferences from bad data will probably lead you to bad
inferences.

Adam


David Vincenzetti wrote:
| Sendmail full sources are available, they can be studied
| and examined by everyone, and they can be studied by malicious
| hackers too.  ActiveX sources are not available, and it is
| harder, for a malicious hacker, to spot new bugs.
| Sendmail is a crystal box while ActiveX is a black box
| (remember the old Security Thru Obscurity model?:-).

-- 
Pet peeve of the day: Security companies whose protocols dare not
speak their name, because they don't have one. Guilty company of the
day is now V-One.




From firewalls-owner  Mon Feb  3 20:32:53 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id UAA28444 for firewalls-outgoing; Mon, 3 Feb 1997 20:15:59 -0800 (PST)
Received: from www.fordnet.com ([204.57.142.93]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id UAA28437 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 20:15:53 -0800 (PST)
Received: from autobahn.wolfenet.com (sea-ts1-p71.wolfenet.com [204.157.98.18]) by www.fordnet.com (8.7.3 Version 1.1 Build 565/8.7.3) with SMTP id VAA00016 for <Firewalls@GreatCircle.COM>; Mon, 03 Feb 1997 21:08:46 -0800 (Pacific Standard Time)
Message-Id: <3.0.1.32.19970203201644.0068c418@fordnet.com>
X-Sender: Jeremy@fordnet.com
X-Mailer: Windows Eudora Light Version 3.0.1 beta 12 (32)
Date: Mon, 03 Feb 1997 20:16:44 -0800
To: Firewalls@GreatCircle.COM
From: Jeremy Johnson <Jeremy@fordnet.com>
Subject: NT Firewall
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Just curious as to what all of you thought would be the best firewall to
implement on a NT4.x server? we are a rapidly growing company and we need
to establish our network security firmly before we take on many more  clients.
any thoughts?

thanx
Jeremy Johnson
System Administrator
Internet Autobahn, Inc.

From firewalls-owner  Mon Feb  3 20:41:06 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id UAA28970 for firewalls-outgoing; Mon, 3 Feb 1997 20:20:21 -0800 (PST)
Received: from diablo.cisco.com (diablo.cisco.com [171.68.223.106]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id UAA28930 for <firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 20:20:08 -0800 (PST)
Received: from clonvick-pc.cisco.com (sj-dial-4-26.cisco.com [171.68.179.91]) by diablo.cisco.com (8.8.4/CISCO.SERVER.1.2) with SMTP id UAA04488; Mon, 3 Feb 1997 20:18:22 -0800 (PST)
Message-Id: <2.2.32.19970204041522.006bf3ac@diablo.cisco.com>
X-Sender: clonvick@diablo.cisco.com
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Mon, 03 Feb 1997 22:15:22 -0600
To: CCCRE.CCULL@capital.ge.com,
        "firewalls(a)greatcircle.com" <firewalls@GreatCircle.COM>
From: Chris Lonvick <clonvick@cisco.com>
Subject: Re: Highly available Internet connection
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi again,

I just need to correct something I wrote about HSRP.  The Great Powers That 
Be have told me that the interfaces configured with HSRP, disable ICMP 
redirects.  This is so the workstations never get confused.  

If a Primary were to send out a redirect, the workstation that received it
would send packets to it.  If that router were to fail, then there would be
no backup for it.  Therefore, the developers reasoned, it is good to not send
ICMP redirects to workstations.  The workstations should always be able to
reach a router on the LAN which is participating in HSRP.

Sorry for the misinformation,
Chris 

At 11:10 PM 1/31/97 -0600, Chris Lonvick wrote:
>Hi folks,
>
>The details of HSRP (Hot Standby Router Protocol) can be found at:
>  http://www.cisco.com/warp/public/417/27.html
>
>I wouldn't say that there is any "load sharing" between the two (or more)
>routers participating in HSRP.  In essence, a Virtual MAC (VMAC) address is
>passed back in response to an ARP from the Priamry HSRP router.  The Primary
>HSRP router will accept packets destined to that VMAC.  If it dies, then the
>Secondary will accept packets destined to the VMAC after the funeral (...
>uhh, I mean to say, after the Secondary doesn't see any HSRP-Hello's within
>a timeout period - usually 10 seconds, but it's configurable.)  
>
>While these devices maintain a VMAC between them, each does have their own
>unique MAC, and IP addresses and each maintains its' own routing tables.
>So, if the primary fails, it should either have a real route to all known
>destinations, or should have a default route.  If both are on the same
>internal LAN segment as well as external LAN segment (DMZ) then they will
>both have the same routing table.
>
>As far as load sharing or balancing goes, if the routers have different
>routing paths (one router has a connection to ISP-A and another has a
>connection to ISP-B rather than being on the same DMZ LAN), they will
>maintain different routing tables.  So, if you configure a workstation with
>a default gateway (the Primary HSRP router), and it sends packets towards
>it, then the Primary HSRP router may respond with an ICMP-redirect which
>points to one of the backup HSRP routers.  In this way, some sessions may go
>across the HSRP backup router.
>
>Getting back to the original question, I'd opt for diversity throughout your
>enterprise if it's _that_ important to you.   Most of the systems I've seen
>have dealt with:
>o  what if my firewall dies?
>o  what if my link to my ISP dies?
>o  what if my ISP dies?
>Which have the same single point of failure: your central site.
>
>Living in Houston, as elsewhere along the Gulf Coast, we worry about: what
>if all communications to the city becomes unavailable?  (Not to press our
>luck, but I think that we're statistically overdue for a really big
>hurricane.)  So, to line this out with an example, if your Transaction
>Processing machines (redundant, of course) are in Wichita and Des Moines,
>then you should have ISP links in each of those cities which both of your TP
>machines could access if 
>o  the primary link were to fail
>o  the other TP machine were to fail
>o  that really big hurricane was to get to one city or the other.
>
>+++ Some commercialism follows +++  stop reading here if this offends you.
>(hey, I gotta' make a living!)
>
>The Cisco PIX does have a failover feature.  
>  http://www.cisco.com/warp/public/146/Intrafirewall.html
>which does address the issue of "what if my firewall dies?"
>
>It is usually deployed on the same internal LAN and same DMZ-LAN.  However,
>just thinking about it, it should be possible to deploy them both on an
>internal LAN, but on different external LANs with routers going to different
>ISPs.  Since the PIX is session stateful (the routers are, by default, not
>stateful), sessions would be broken if the primary fails but general
>connectivity would be maintained.  
>
>Hope this helps,
>
>Chris Lonvick
>Cisco Systems
>Consulting Engineering
>Houston, TX, USA
>+1-713-778-5663
>
>
>
>
>At 10:38 AM 1/31/97 -0500, CCCRE.CCULL@capital.ge.com wrote:
>>     >>Are they one on the same box or is it two different router that
>>     >>automatically drop to a redundancy ? Thanks.
>>
>>     >>-- Joel
>>
>>     i didn't get your e-mail address joel,  so i'm having to repond
>>     here...
>>
>>     they are 2 physically seperate boxes (referring to cisco's hot standby
>>     protocol).  i'm not sure if they do anything like load balancing,  or
>>     if the split between the 2 is more static.  however,  i do know that
>>     when one fails,  the other one picks up it's load.  i'm working from 4
>>     month old memory here,  so this stuff is a little foggy....  but it
>>     seems like the 2 routers are seen (ip-wise) as 1 virtual router.  i
>>     guess each router knows the other's routing table,  but just ignores
>>     that portion as long as the other router is functional. if they DIDN'T
>>     know each others table,  and 1 of the routers failed,  there'd be a
>>     lag while it updated,  and i remember no perceptible lag when we
>>     tested these....
>>
>>     chris cull
>>     cccre.ccull@capital.ge.com
>>
>>
>
>
>


From firewalls-owner  Mon Feb  3 21:10:37 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id UAA01400 for firewalls-outgoing; Mon, 3 Feb 1997 20:44:32 -0800 (PST)
Received: from pp (pp.ksc.nasa.gov [128.159.174.102]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id UAA01388 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 20:44:19 -0800 (PST)
Received: from kscgws00.ksc.nasa.gov by pp with SMTP (PP);
          Mon, 3 Feb 1997 23:44:21 -0500
Received: by kscgws00.ksc.nasa.gov 
          with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63) 
          id <01BC122C.4539FB20@kscgws00.ksc.nasa.gov>;
          Mon, 3 Feb 1997 23:45:00 -0500
Message-ID: <c=US%a=_%p=NASA%l=KSCMBS30-970204044449Z-6984@kscgws00.ksc.nasa.gov>
From: "Ferrell-1, Ema" <Eman.Ferrell-1@kmail.ksc.nasa.gov>
To: "'Lars Eilebrecht'" <sfx@unix-ag.uni-siegen.de>,
        "'osiris@pacificnet.net'" <osiris@pacificnet.net>
Cc: "'Firewalls'" <Firewalls@GreatCircle.COM>
Subject: RE: SATAN user group?
Date: Mon, 3 Feb 1997 23:44:49 -0500
X-Mailer: Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Where can I get Merlin?  Does it stand for something?  I would like to
check it out.  Thanks!

>----------
>From: 	osiris@pacificnet.net[SMTP:osiris@pacificnet.net]
>Sent: 	Monday, February 03, 1997 9:09 PM
>To: 	Lars Eilebrecht
>Cc: 	Firewalls
>Subject: 	Re: SATAN user group?
>
>Lars Eilebrecht wrote:
>> 
>> osiris wrote:
>> 
>> > Has anyone on this list tried "Merlin?" I am wondering whether anyone has
>> > attempted to make a siilar interface to manage firewall admnistration and
>> > auditing. (Merln is a tool from CIAC. It integrates Tripwire, COPS,
>>TIGER,
>> > Crack and reportedly, SPI, which is unavailable to us regular folk. The
>>                         ^^^
>> SPI?
>> 
>> ciao...
>>         Lars
>
>Yeah...strange little ditty. SPI = Security Profile Inspector. It's a
>very powerful tool for examination of UNIX networks. Problem is, it's
>only available to the US Department of Energy and Department of Defense.
>(Or, qualified contractors.) You can check out at least their preview at
>http://ciac.llnl.gov/cstc/spi/spinet.html. About the closest I've been
>able to get to understanding this tool is to aqcuire the manuals (which
>apparently aren't restricted) and are here:
>ftp://ciac.llnl.gov/pub/spi/spi.rm.ps.Z.
>

From firewalls-owner  Mon Feb  3 21:40:57 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id VAA05292 for firewalls-outgoing; Mon, 3 Feb 1997 21:19:09 -0800 (PST)
Received: from polaris.pacificnet.net (polaris.pacificnet.net [207.171.0.250]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id VAA05276 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 21:18:57 -0800 (PST)
Received: from localhost (osiris@localhost) by polaris.pacificnet.net (8.6.11/8.6.11) with SMTP id VAA24972; Mon, 3 Feb 1997 21:16:45 -0800
Date: Mon, 3 Feb 1997 21:16:43 -0800 (PST)
From: Osiris <osiris@polaris.pacificnet.net>
To: "Ferrell-1, Ema" <Eman.Ferrell-1@pp.ksc.nasa.gov>
cc: "'Lars Eilebrecht'" <sfx@unix-ag.uni-siegen.de>,
        "'Firewalls'" <Firewalls@GreatCircle.COM>
Subject: RE: SATAN user group?
In-Reply-To: <c=US%a=_%p=NASA%l=KSCMBS30-970204044449Z-6984@kscgws00.ksc.nasa.gov>
Message-ID: <Pine.GSO.3.95.970203211000.24108A-100000@polaris.pacificnet.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



On Mon, 3 Feb 1997, Ferrell-1, Ema wrote:

> Where can I get Merlin?  Does it stand for something?  I would like to
> check it out.  Thanks!

Get Merlin here: http://ciac.llnl.gov in the "Tools" section. 


From firewalls-owner  Mon Feb  3 22:25:49 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id WAA13508 for firewalls-outgoing; Mon, 3 Feb 1997 22:17:37 -0800 (PST)
Received: from mail-gw.pacbell.net (mail-gw.pacbell.net [206.13.28.25]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id WAA13501 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 22:17:29 -0800 (PST)
Received: from camdenave.xo.com.camdenave.xo.com ([205.158.161.107]) by mail-gw.pacbell.net (8.8.5/8.7.1) with ESMTP id WAA09724; Mon, 3 Feb 1997 22:16:05 -0800 (PST)
Message-Id: <199702040616.WAA09724@mail-gw.pacbell.net>
From: "Stan Wolf" <swolf@pacbell.net>
To: <asetton@lightech.com.ar>
Cc: "Firewall Newsgroup" <firewalls@greatcircle.com>, <jrjones@comsource.net>
Subject: MS Proxy Server
Date: Mon, 3 Feb 1997 22:16:04 -0800
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1155
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I think you will find what you are looking for at the following site:
	http://www.techweb.com/search/search.html
In the first search field, enter "proxy server", and follow the first link
you see presented to go to the article.  It's not all that negative, but
points out that more security may be required.  

I plan to use PSINet' managed and monitored "RouteWaller" packet filtering
firewall router in front of MS Proxy Server running by itself on NT Server
4.0.  Any thoughts on this arrangement, Jim?

Microsoft has some interesting testimonials on their Proxy Server area. 
One of the sources is a newspaper group right here in my town.  I spoke to
him, and he is very pleased; using PS ONLY! 
  _____    
   S|an  \/\/olf
swolf@pacbell.net

From firewalls-owner  Mon Feb  3 22:55:54 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id WAA16327 for firewalls-outgoing; Mon, 3 Feb 1997 22:42:33 -0800 (PST)
Received: from socrates.berkeley.edu (socrates.Berkeley.EDU [128.32.25.13]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id WAA16310 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 22:42:25 -0800 (PST)
Received: from garnet.berkeley.edu (garnet.Berkeley.EDU [128.32.136.6]) by socrates.berkeley.edu (8.8.4/8.8.0) with ESMTP id WAA04707; Mon, 3 Feb 1997 22:41:03 -0800 (PST)
Received: from pine by garnet.berkeley.edu (8.7.5/1.33-960227)
	id WAA22341; Mon, 3 Feb 1997 22:40:53 -0800
Message-Id: <2.2.32.19970204064107.006df0bc@garnet.berkeley.edu>
X-Sender: mendes@garnet.berkeley.edu
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Mon, 03 Feb 1997 22:41:07 -0800
To: Jeremy Johnson <Jeremy@fordnet.com>
From: Jerry Mendes <mendes@garnet.berkeley.edu>
Subject: Re: NT Firewall
Cc: Firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I just read an interesting review of about 8 NT Firewall products on the
Network World website:
        http://www.nwfusion.com/

You'll have to identify yourself and create an account....pretty much
painless.  After logging in, you'll land on a page that asks you for a 4
digit number identifying the article you want to see.  The one on the NT
Firewall products is:  0402

Maybe this is what you want.

Jerry Mendes, Principal Consultant
DataComm Insights
150 Seminary Drive
Mill Valley, California  94941

Voice:  (415) 381-5500
FAX:    (415) 381-5502
Email:  mendes@garnet.berkeley.edu



At 08:16 PM 2/3/97 -0800, Jeremy Johnson wrote:
>Just curious as to what all of you thought would be the best firewall to
>implement on a NT4.x server? we are a rapidly growing company and we need
>to establish our network security firmly before we take on many more  clients.
>any thoughts?
 


From firewalls-owner  Tue Feb  4 00:10:41 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id XAA22741 for firewalls-outgoing; Mon, 3 Feb 1997 23:54:03 -0800 (PST)
Received: from mule0.mindspring.com (mule0.mindspring.com [204.180.128.166]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id XAA22734 for <firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 23:53:53 -0800 (PST)
Received: from [207.69.170.17] (user-37kbagh.dialup.mindspring.com [207.69.170.17])
          by mule0.mindspring.com (8.8.4/8.8.4) with SMTP
	  id CAA32360; Tue, 4 Feb 1997 02:51:55 -0500
Date: Tue, 4 Feb 1997 02:51:55 -0500
X-Sender: pelicans@pop.mindspring.com
Message-Id: <v01540b01af1c28d63a8a@[207.69.170.53]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: Matthew Patton <patton@sysnet.net>
From: pelicans@mindspring.com (BeachCruiser)
Subject: Poor NSA...Hells freezin' over again.
Cc: firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 6:12 PM 2/1/97, Matthew Patton wrote:
>>release of more test results as the X31 crew expands their commercial
>>firewall product evaluations.  Gauntlet and Sidewinder just happened to be
>>the first two on the bench.  Others are already in the queue.
>
>But has anybody read them?  I just finished the TIS one and I'm VERY
>nonplussed.  What's the value added of the X31's efforts?  There's no new
>insight, and it was hardly what I'd consider rigorous.  Indeed their
>testing basically boiled down to confirming that the firewall obeyed
>protocol conventions.  So what?  The trade rags do similar testing.

Well then why don't you give Jim Harper a call.  He's runs CSC's INFOSEC
lab facility in Hanover, MD.  Tell him you weren't happy with the limp
wristed job that was done under the X31 network security products eval
tasking, and you want the full up bed-of-nails protocol on your firewalls
of choice...gate crashing and penetration vulnerability, covert channel
analysis...the whole nine yards.  Be aware that they do most of the INFOSEC
T&E's for NSA, and that lab runs hot constantly, so, you'll probably have
to wait a couple of months for a slot.

BTW you might want to have your boss talk to some investment bankers about
a second round public offering because what that job is gonna cost you
exceeds most companies net worth.  Otherwise the TPEP catalog would be 80
pages long instead of eight.

>There are an incredible number of TIS sites out there and if the features
>didn't work as advertised we've have known a LONG time ago.

Well, sure lets just forget about this testing business altogether and let
a defacto standard emerge based on the vendor with the largest installed
base.  Ok, TIS wins, we'll proclaim Fred Avolio the Bill Gates of
Firewalls, those who survive can call him for a license, and the rest of
you can find another other line of work. :)

>I'll read the sidewinder one next and I'm prepared to be yet again
>disappointed >at the coverage.

It might also be helpful if some folks on this forum understood that the
National Security Agency exists to serve the national intelligence and
information systems security communities, at the pleasure of the Secretary
of Defense, Director of Central Intelligence and the National Security
Advisor.  It is NOT in the business of validating or benchmarking the
systems and products of commercial companies, or trying to please their
systems administrators or corporate shareholders.

"The Fort" hasn't taken this kind of beating since the '70's and '80's when
we had a flock of commercial companies trying to build TEMPEST* approved
equipment.  It's very interesting to watch this come around again.  There
was the same noise over testing, certifications and endorsements then as
there is now.  Only, firewalls are the bullwhips of the '90's coming across
NSA's hide.

The clamoring from the user community is that they all want the "most
secure" firewall.  Of course they don't know, can't figure out, or agree on
what "secure" even means now any more than they did back then.  And the
vendors don't know what benchmarks to build to.  So, just like they did
back in the TEMPEST days, some simply solve that problem by claiming that
their product's trust level holds some relevance to Orange Book, or some
other rating levels established by the security gods.  Whether they
actually did or not was just as much an open question then as it is now.

And of course then, as is the case today, the "suits" downtown started
feeling the political heat because the media was making hay about Russian's
pointing pigtail antennas at or bouncing lasers off of windows and
capturing the returns to intercept keystroke emissions or room
conversations.  Now the rage is about the hackers pillaging the national
information infrastructure...and it all finally gets to the point were
20755 says, "ok, bring 'em on in here, wire 'em up, lets see what these
things do and we'll publish the results.

Well now something else is wrong...it seems that somebody's whinin' because
the test is not rigorous enough, or the reports are no good, or, the soup's
cold...

I'm not hear to defend the NSA, but you could well imagine that some of
those folks over there might be muttering, "screw this...I'm moving to the
beach and be a plumber".

Along comes the NCSA to try and bring some rationale to the process, in
concert with nearly every developer in the business, by establishing a lab
and hacking up some benchmarks .  But, now some are saying that's not
credible either because they're takin' money for it.  Apparently somewhere
along the line those folks were never told that the development and
marketing of commercial security systems and products was a business.
While still others don't seem to have any problem at all when an industry
rag, owned by a publishing house for godsake, that doesn't know a covert
channel from the English Channel, puts out a review and within an hour the
Madison Avenue machine is in overdrive to tell you who won.

Well, this aformentioned stupidity has brought me to realize that perhaps
indeed Marcus was right...as long as you've got source code who needs X31,
NCSA or Firewalls Home Journal to tell you about your gui frosted filter
stack or app gateway of choice.  If you've got the souce, everything is
crystal clear...right?

To you folks up in X31...hang in there...only six more weeks of winter.
Ocean City and Dewey awaits you.

uh...more tea anyone?

___________________________
Bob McKisson
Cypress Systems Corporation
P. O. Box 809
Virginia Beach, VA 23451
(757) 425-4195  Voice
(757) 425-4196  FAX
(757) 442-0888  STU-III
pelicans@mindspring.com

I don't give them hell...I just give them the truth, and they think it's hell.

                                                - Harry Truman


ps:  Wonder if there is anyone else out there who knows or remembers what
TEMPEST actually stands for?  And yes it IS an acronym, and it DOES mean
something.









From firewalls-owner  Tue Feb  4 00:41:57 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id AAA24409 for firewalls-outgoing; Tue, 4 Feb 1997 00:34:20 -0800 (PST)
Received: from glacier.wise.edt.ericsson.se (glacier-ext.wise.edt.ericsson.se [193.180.251.38]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id AAA24380 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 00:34:01 -0800 (PST)
Received: from negrita.nmac.ericsson.se (negrita.nmac.ericsson.se [130.100.187.78]) by glacier.wise.edt.ericsson.se (8.7.5/8.7.3/glacier-0.9) with SMTP id JAA20132 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 09:32:49 +0100 (MET)
Received: by negrita.nmac.ericsson.se (SMI-8.6/SMI-SVR4)
	id JAA03683; Tue, 4 Feb 1997 09:32:16 +0100
Date: Tue, 4 Feb 1997 09:32:16 +0100
From: etxrosd@nmac.ericsson.se (Robert Stahlbrand)
Message-Id: <199702040832.JAA03683@negrita.nmac.ericsson.se>
To: firewalls@greatcircle.com
Subject: throughput on Ciscos contra NT, Solaris
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-MD5: dMKrDw75qYnSGO6ZPTMWgQ==
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi!

Is there anyone who knows about the difference in throughput on Cisco-routers 
contra using an NT-server (lets say HP, 166 MHz) running NT4.0 or an SUN Ultra1 
running Solaris 2.5(.X) as the router. We are planning on using 100 Mbit/s 
ethernet cards and it seems like a solution with a Cisco in the 7000-serie with 
three 100 Mbit/s overrides our budget for this year. Is there a great loss of 
performance?
Is it at all possible to install an inspection module on NT4.0-gw using 
Checkpoints Firewall-1 ver.2.1 if we use NT4.0 on the FW Manager host?

Is it more unsecure to use nt or Solars on the router?

This is what our configuration will look like:


                |      100 Mbit/s in every direction
                | Internet
            ____|____
Inspection |         | DMZ
Module     | Router  |____________
Installed  |_________|            |
                |            _____|_____
                |           |           |
                |           |    WWW    |
                |           |___________|
                |
           _____|_____________________ Intranet
                     |
                     |
                 ____|____
                |         |
                |   FW    | FW Manager host
                |_________|
                
                
                
###########################################################
#                 Robert Stahlbrand                       #
# Network and System Administrator OPLab and NMAC domains #
#                                                         #
#                 Ericsson Telecom AB                     #
#                      Box 333                            #
#                   43184 Molndal                         #
#                      Sweden                             #
#                  +46 31 7476162                         #
#                  +46 31 7472942 (fax)                   #
#                                                         #
#              robert@nmac.ericsson.se                    #
###########################################################

From firewalls-owner  Tue Feb  4 03:40:48 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id DAA06645 for firewalls-outgoing; Tue, 4 Feb 1997 03:26:25 -0800 (PST)
Received: from server21.digital.fr (server21.digital.fr [193.56.15.21]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id DAA06607 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 03:25:44 -0800 (PST)
Received: from mail.vbo.dec.com (mail.vbo.dec.com [16.36.208.34]) by server21.digital.fr (8.7.5/8.7) with ESMTP id MAA16828 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 12:28:51 +0100 (MET)
Received: from vbormc.vbo.dec.com (vbormc.vbo.dec.com [16.36.208.94]) by mail.vbo.dec.com (8.7.3/8.7) with ESMTP id MAA24570 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 12:26:14 +0100 (MET)
Received: from becomm.ebo.dec.com (becomm.ebo.dec.com [16.184.208.35]) by vbormc.vbo.dec.com (8.7.3/8.7) with SMTP id MAA03953 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 12:21:23 +0100
Received: from beux1.ebo.dec.com by becomm.ebo.dec.com; (5.65v3.2/1.1.8.2/07Mar96-0234PM)
	id AA06285; Tue, 4 Feb 1997 12:23:36 +0100
Received: by beux1.ebo.dec.com; (5.65v3.2/1.1.8.2/11Feb96-0242PM)
	id AA04693; Tue, 4 Feb 1997 12:23:27 +0100
Subject: Duplicated network addresses and VPN (AVT as requested)
To: Firewalls@GreatCircle.COM
X-Mailer: MAILworks 1.7-A
From: Arjo Mukherjee 4663 <mukherje@ebo.dec.com>
Date: Tue, 4 Feb 97 12:23:27 +0100
Message-Id: <970204122327.3603@beux1.ebo.dec.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


 Lilia Miltcheva <miltcheva@unicc.org> asked "

"I'm keen on using the AltaVista Tunnel and have already a lot of
requests for providing the service. I have a question :

We are currently using Alta Vista FW for Unix and behind it we have
class C addresses that we once got by EUnet. Than we changed the ISP and
renumbered our "red" (external) network, but on the internal ("blue")
WAN we kept the old IPs as there are anyhow not accessible from the
Internet.

What is going to happen if a remote client, using AVT connects to our
AVT server, gets the numbers of the private networks (for example
193.72.45.0) and starts tunneling, but at the same time there is a
server somewhere on the Internet that has address let's say 193.72.45.20
(same class C). How this clash could possibly be menaged?"
- -------------
Before I continue I would like to state that I am not an expert on the
Alta Vista Tunnel.  I have only installed it a couple of times and
write the following based on that.  Maybe it will help.
 
I don't believe that there is anything to worry about
as far as a clash is concerned.  This is because while you set up the
VPN (Virtual Privat Network) you need to define the IPs of the
applicable FW's.  In essence, the target address is encapsulated and
passed through the firewalls.  The destination firewall will pass the
data to the Tunnel Server where it will be handled as needed.

Therefore, as long as there is no clash with Firewall addresses, there
should not be a problem.  

Another point, it is also possible to load the AVT on the FW machine,
but I think most prefer to load it onto a seperate machine behind the
destination firewall.

Ciao,
Arjo

From firewalls-owner  Tue Feb  4 03:55:55 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id DAA07499 for firewalls-outgoing; Tue, 4 Feb 1997 03:38:40 -0800 (PST)
Received: from SWBELL.net (mail1.rcsntx.swbell.net [151.164.1.2]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id DAA07491 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 03:38:22 -0800 (PST)
Received: from bbenton.swbell.net (ppp-151-164-42-49.eulstx.swbell.net [151.164.42.49]) by SWBELL.net (8.7.5/8.7.1) with SMTP id FAA22561; Tue, 4 Feb 1997 05:37:13 -0600 (CST)
Date: Tue, 4 Feb 1997 05:37:13 -0600 (CST)
From: Bob Benton <bbenton@swbell.net>
Subject: RE: NT port numbers needed
To: Firewalls <Firewalls@GreatCircle.COM>,
        Arjo Mukherjee <mukherje@ebo.dec.com>
Message-ID: <855063337@home486nt>
X-Mailer: FPRetail Version 5.51.009
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

MS's 4.0 Resource kit has a good starting list.  
lpd uses udp, 721-731 on 3.51. 
lpd uses tcp on anything from 512-1023 on 4.0
Not sure about file sharing.  Get the kit.

Bob

> Hi,
> 
> Anyone know what are the relevant IP port numbers for NT?  
> 
> I read somewhere that NT uses ports 512/tcp and 721-731/tcp for 
> print services.
> 
> What are the IP ports for File Sharing and other applicable NT
> services?
> 
> Thanks,
> Arjo
> 
> 
> 



From firewalls-owner  Tue Feb  4 04:56:02 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id EAA12898 for firewalls-outgoing; Tue, 4 Feb 1997 04:48:04 -0800 (PST)
Received: from homeport.org (lighthouse.homeport.org [205.136.65.198]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id EAA12884 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 04:47:54 -0800 (PST)
Received: (adam@localhost) by homeport.org (8.8.5/8.6.9) id HAA15489; Tue, 4 Feb 1997 07:43:03 -0500 (EST)
From: Adam Shostack <adam@homeport.org>
Message-Id: <199702041243.HAA15489@homeport.org>
Subject: Re: NT Firewall
In-Reply-To: <2.2.32.19970204064107.006df0bc@garnet.berkeley.edu> from Jerry Mendes at "Feb 3, 97 10:41:07 pm"
To: mendes@garnet.berkeley.edu (Jerry Mendes)
Date: Tue, 4 Feb 1997 07:43:02 -0500 (EST)
Cc: Jeremy@fordnet.com, Firewalls@GreatCircle.COM
X-Mailer: ELM [version 2.4ME+ PL27 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

http://www.nwfusion.com/cgi-bin/gate2?|wwV7tddI://PPP.GP81XZ9G.59b/i958ZGi7e/wVwWe7O.tdbEwqwFGP81XZ9GVWV6xvhuUMph,5oIt7eI1GDX,xvhu4Mvvzg,5oIt7eI1GDX

Login as cypherpunks, password cypherpunks (this works most places
that request a sign in, for those of you who don't know.)

	Firewalls relevance?  That URL above gets you in as someone
else.  They're not using strong access controls, and are thus easily
bypassed.

Adam


Jerry Mendes wrote:
| You'll have to identify yourself and create an account....pretty much
| painless.  After logging in, you'll land on a page that asks you for a 4
| digit number identifying the article you want to see.  The one on the NT
| Firewall products is:  0402


-- 
Pet peeve of the day: Security companies whose protocols dare not
speak their name, because they don't have one. Guilty company of the
day is now V-One.




From firewalls-owner  Tue Feb  4 05:40:43 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id FAA15673 for firewalls-outgoing; Tue, 4 Feb 1997 05:25:56 -0800 (PST)
Received: from portal2.ameritech.com (portal2.ameritech.com [198.186.232.49]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id FAA15561 for <firewalls@greatCircle.COM>; Tue, 4 Feb 1997 05:25:23 -0800 (PST)
From: MARK.ELIAS@x400gw.ameritech.com
Received: by portal2.ameritech.com id AA08272
  (InterLock SMTP Gateway 3.0 for firewalls@greatCircle.COM);
  Tue, 4 Feb 1997 08:23:59 -0500
Received: by portal2.ameritech.com (Internal Mail Agent-2);
  Tue, 4 Feb 1997 08:23:59 -0500
Received: by portal2.ameritech.com (Internal Mail Agent-1);
  Tue, 4 Feb 1997 08:23:59 -0500
Date: 4 Feb 97 08:22:13 -0500
To: firewalls@greatCircle.COM,
        /DDV=Jesse.Brown#064#POBox.com/DDT=RFC-822/S=Jesse.Brown/P=AMRTCH4/A=MCI/C=US/@x400gw.ameritech.com
Subject: RE: Rainbow Book Series?
In-Reply-To: <199702032222.OAA00279@mail.ptw.com>
Message-Id: <H000035c05c57cf2*/PN=Mark.Elias/OU=AIT5/PRMD=AMRTCH4/ADMD=MCI/C=US/@MHS>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Hello, does anyone know where I can get the entire Rainbow Book 
> Series?
> 

Try  http://csrc.ncsl.nist.gov/secpubs/rainbow

(csrc = Computer Security Resource Clearinghouse /
 nist = National Institute of Standards and Technology)

There are order forms there as well as the actual documents. 


From firewalls-owner  Tue Feb  4 06:10:56 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id GAA17773 for firewalls-outgoing; Tue, 4 Feb 1997 06:06:03 -0800 (PST)
Received: from WKST194.SLD.GORDON.ARMY.MIL (wkst194.sld.gordon.army.mil [147.51.218.194]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id GAA17766 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 06:05:55 -0800 (PST)
Date: Tue,  4 Feb 97 09:08:00 EST
Message-Id: <9702040908.AA13332@WKST194.SLD.GORDON.ARMY.MIL>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
From: "Inez M. Crawford" <crawfori@SLD1.GORDON.ARMY.MIL>
Reply-To: <crawfori@SLD1.GORDON.ARMY.MIL>
X-Sender: <crawfori@WKST194.SLD.GORDON.ARMY.MIL>
To: Jesse.Brown@POBox.com
CC: firewalls@greatcircle.com
Subject: Re: Rainbow Book Series?
X-Mailer: <WS_GMAIL v2.50>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Try this site - 

http://www.fas.org/irp/nsa/rainbow.htm

It seems to have a very good collection of downloadable "books"

IM Crawford


From firewalls-owner  Tue Feb  4 06:26:35 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id GAA18728 for firewalls-outgoing; Tue, 4 Feb 1997 06:22:51 -0800 (PST)
Received: from server21.digital.fr (server21.digital.fr [193.56.15.21]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id GAA18710 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 06:22:35 -0800 (PST)
Received: from mail.vbo.dec.com (mail.vbo.dec.com [16.36.208.34]) by server21.digital.fr (8.7.5/8.7) with ESMTP id PAA04962 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 15:25:18 +0100 (MET)
Received: from vbormc.vbo.dec.com (vbormc.vbo.dec.com [16.36.208.94]) by mail.vbo.dec.com (8.7.3/8.7) with ESMTP id PAA22407 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 15:22:48 +0100 (MET)
Received: from becomm.ebo.dec.com (becomm.ebo.dec.com [16.184.208.35]) by vbormc.vbo.dec.com (8.7.3/8.7) with SMTP id PAA13161 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 15:17:51 +0100
Received: from beux1.ebo.dec.com by becomm.ebo.dec.com; (5.65v3.2/1.1.8.2/07Mar96-0234PM)
	id AA06205; Tue, 4 Feb 1997 15:20:14 +0100
Received: by beux1.ebo.dec.com; (5.65v3.2/1.1.8.2/11Feb96-0242PM)
	id AA13994; Tue, 4 Feb 1997 15:20:11 +0100
Subject:  RE: AVT configurations
To: Firewalls@GreatCircle.COM
X-Mailer: MAILworks 1.7-A
From: Arjo Mukherjee 4663 <mukherje@ebo.dec.com>
Date: Tue, 4 Feb 97 15:20:10 +0100
Message-Id: <970204152010.3603@beux1.ebo.dec.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



----- Forwarded message follows -----
Delivery-Date: Tue, 4 Feb 97 14:58:27 +0100
To: Lilia Miltcheva <Miltcheva@unicc.org>
Subject: RE: AVT configurations
In-Reply-To: <c=CH%a=400net%p=unicc%l=NEW-EXCHANGE-970204131239Z-3793@new-exchange.unicc.org>
References: <c=CH%a=400net%p=unicc%l=NEW-EXCHANGE-970204131239Z-3793@new-exchange.unicc.org>
X-Mailer: MAILworks 1.7-A
From: Arjo Mukherjee 4663 <mukherje>
Date: Tue, 4 Feb 97 15:15:40 +0100
Message-ID: <970204151540.3603@beux1.ebo.dec.com>

I have the feeling that every session that wants to use the AVT, has to
be defined on the local clients.  In other words, if you want to telnet
using the VPN, then you have to set up a defined session with the link
pointer to the local Tunnel.  Otherwise, the routing will default wise
direct the path to the firewall and out int the internet.

I guess the question you have is how to set up the applicatiions on the
local client to let it know when to use the Tuneel and when not to use
it.

>From the sparse docs that I could read, it appears as if on the local
clients, ie. PC,s etc, one copies a couple of files, which the tunnel
admin provides.  These have the definitions for the tunnel path.

It appears that if the user wants to use the tunnel, he needs to click
on the application to activate the link to the tunnel components, and
then he can use the VPN.

Otherwise, it defaults to the firewall and out into the internet.

Seems like the user has to activate the tunnel link if he wants to use
it.

Arjo   

                   >  > Hi, Arjo!
> 
> Thanks to have answered my mail.
> 
> I do not worry about the routing. The question is if we have a duplicate
> IP on the private network and on the Internet, which way the connection
> is going to be decided - to go through the tunnel or through the regular
> (ISP) way?
> During the initial handshake the AVT server gives the IP numbers of the
> private networks to the tunnel client. Logically than, any IP belonging
> to one of those networks will be routed through the tunnel. This means
> that if there is another host on the Internet with the same IP, it will
> never be reached as far as the tunnel is up... 
> 
> Thanks, Lili
> 
> 
> >----------
> >From: 	Arjo Mukherjee 4663[SMTP:mukherje@ebo.dec.com]
> >Sent: 	Tuesday, February 04, 1997 3:26AM
> >To: 	miltcheva@unicc.org
> >Subject: 	AVT configurations
> >
> >Howdy,
> >
> >don't think there are address conflicts as the routing takes place
> >through firewalls.  in other words, the destination address is handled
> >only after it reaches the target VPN Server (Tunnel Server).
> >
> >The firewall is set up to handle the tunnel addresses via relay.
> >
> >Arjo
> >
> >
----- End of forwarded message -----

From firewalls-owner  Tue Feb  4 07:16:01 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id GAA23786 for firewalls-outgoing; Tue, 4 Feb 1997 06:56:29 -0800 (PST)
Received: from wachusett.altavista-software.com ([205.181.164.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id GAA23767 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 06:56:08 -0800 (PST)
Received: by wachusett.altavista-software.com; (5.65v3.2/1.3/10May95) id AA00880; Tue, 4 Feb 1997 09:54:58 -0500
Date: Tue, 4 Feb 1997 09:54:41 -0500 (EST)
From: Jeff Needle <needle@altavista.digital.com>
X-Sender: needle@plugh.hq.altav.com
Reply-To: jeff.needle@altavista-software.com
To: Lilia Miltcheva <miltcheva@unicc.org>
Cc: altavista-product@digital.com, admin@unicc.org, firewalls@GreatCircle.COM
Subject: Re: Duplicated network addresses
In-Reply-To: <32F60309.41C6@unicc.org>
Message-Id: <Pine.OSF.3.95.970204095058.22446C-100000@plugh.hq.altav.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

When you use the AltaVista Tunnel, any network packets that travel the
internet will have a source address of your physical adapter and a target
address of your firewall's external interface (tunnel server in the case
where you have no firewall).  The tunnel server, upon receipt of a tunnel
packet, will strip the tunnel header and decrypt the packet, restoring the
original destination address.  Therefore the only place your private
network addresses will be seen are within your private network, between
your tunnel server and the final internal destination.

Hope this helps.  If you have any further questions about AltaVista
Tunnel, don't hesitate to contact me.

Jeff Needle, AltaVista engineering



On Mon, 3 Feb 1997, Lilia Miltcheva wrote:

> Date: Mon, 03 Feb 1997 16:23:53 +0100
> From: Lilia Miltcheva <miltcheva@unicc.org>
> To: altavista-product@digital.com
> Cc: admin@unicc.org, firewalls@GreatCircle.COM
> Subject: Duplicated network addresses
> 
> Dear Guru,
> 
> I'm keen on using the AltaVista Tunnel and have already a lot of
> requests for providing the service. I have a question :
> 
> We are currently using Alta Vista FW for Unix and behind it we have
> class C addresses that we once got by EUnet. Than we changed the ISP and
> renumbered our "red" (external) network, but on the internal ("blue")
> WAN we kept the old IPs as there are anyhow not accessible from the
> Internet.
> 
> What is going to happen if a remote client, using AVT connects to our
> AVT server, gets the numbers of the private networks (for example
> 193.72.45.0) and starts tunneling, but at the same time there is a
> server somewhere on the Internet that has address let's say 193.72.45.20
> (same class C). How this clash could possibly be menaged?
> 
> 
> I'm aware that many people use inside their FW "any" IP addresses (just
> unique on the LAN), so that will be a problem with all those guys if
> some coincedence occurs.
> 
> Is there something I'm missing?
> 
> Thanks a lot in advance.. I'll greately appriciate any help....
> 
> Lili
> 



From firewalls-owner  Tue Feb  4 07:49:12 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id HAA27998 for firewalls-outgoing; Tue, 4 Feb 1997 07:36:44 -0800 (PST)
Received: from wachusett.altavista-software.com ([205.181.164.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id HAA27976 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 07:36:33 -0800 (PST)
Received: by wachusett.altavista-software.com; (5.65v3.2/1.3/10May95) id AA04094; Tue, 4 Feb 1997 10:35:22 -0500
Date: Tue, 4 Feb 1997 10:34:59 -0500 (EST)
From: Jeff Needle <needle@altavista.digital.com>
X-Sender: needle@plugh.hq.altav.com
To: Lilia Miltcheva <Miltcheva@unicc.org>
Cc: "'admin@unicc.org'" <admin@unicc.org>,
        "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: RE: Duplicated network addresses
In-Reply-To: <c=CH%a=400net%p=unicc%l=NEW-EXCHANGE-970204153200Z-3805@new-exchange.unicc.org>
Message-Id: <Pine.OSF.3.95.970204103100.22446O-100000@plugh.hq.altav.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

It won't matter if you assign an address that is equivalent to an external
address.  The only place those tunnel "pseudo addresses" will be seen is
on the private network, beyond the tunnel server.  They never travel on
the internet.  Any tunnel packets traveling on the internet will be
encrypted and encapsulated in an IP packet with a source address of the
client's real address and a destination address of your firewall, both of
which would be legal address.

The typical tunnel configuration seems to use RFC 1918 addresses for the
tunnel clients.

Jeff

On Tue, 4 Feb 1997, Lilia Miltcheva wrote:

> Date: Tue, 4 Feb 1997 16:32:00 +0100
> From: Lilia Miltcheva <Miltcheva@unicc.org>
> To: "'jeff.needle@altavista-software.com'"
     <jeff.needle@altavista-software.com>
> Cc: "'altavista-product@digital.com'" <altavista-product@digital.com>,
>     "'admin@unicc.org'" <admin@unicc.org>,
>     "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
> Subject: RE: Duplicated network addresses
> 
> Jeff,
> 
> What you say is correct and I do not have any problem with that. My
> question is rather what will happen if I address host.unicc.org that has
> the same IP as www.microsoft.com, for example? 
> As the tunnel comes up, the tunnel server tells the client which
> networks a to be tunneled, so logically in this case for
> www.microsoft.com = host.unicc.org I will go through the tunnel and
> therefore I will never be able to reach www.microsoft.com while the
> tunnel is up....
> 
> Thanks a lot for your support,
> Lili


From firewalls-owner  Tue Feb  4 08:27:00 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id HAA29210 for firewalls-outgoing; Tue, 4 Feb 1997 07:50:02 -0800 (PST)
Received: from tuna.wang.com (TUNA.wang.com [150.124.136.4]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id HAA29161 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 07:49:37 -0800 (PST)
Received: from mars.wangfed.com (mars.Wangfed.COM [159.94.10.1])
    by tuna.wang.com (8.6.12/8.6.12tf1) with SMTP id KAA22492;
    Tue, 4 Feb 1997 10:48:25 -0500
Received: from uc0009.wangfed.com (uc0009 [159.94.10.15])
	by mars.wangfed.com (8.8.4/3.8) with SMTP
	id KAA14495; Tue, 4 Feb 1997 10:54:31 -0500 (EST)
Received: from [159.94.14.48] by uc0009.wangfed.com (BULL 5.61++/B.O.S 02.01)
	id AA26148; Tue, 4 Feb 97 10:39:17 -0500
Date: Tue, 4 Feb 97 10:39:17 -0500
Message-Id: <9702041539.AA26148@uc0009.wangfed.com>
From: "K.M."  <goertzek@wangfed.com>
Reply-To: "K.M."  <goertzek@wangfed.com>
To: pelicans@mindspring.com, firewalls@GreatCircle.COM
Subject: Re: Poor NSA...Hells freezin' over again.
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

TEMPEST = Transient ElectroMagnetic Pulse Emanation STandard
          ^         ^      ^        ^     ^         ^^    



KM     

=====

K.M. Goertzel
Manager, Business Development
Secure Systems & Services Operation
WANG FEDERAL, Inc.
7900 Westpark Drive - MS 700
McLean, VA  22102-4299  USA
tel (703)827 3914
fax (703)827 3161 
email goertzek@wangfed.com


From firewalls-owner  Tue Feb  4 08:42:35 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id HAA27431 for firewalls-outgoing; Tue, 4 Feb 1997 07:29:26 -0800 (PST)
Received: from gk-blue.unicc.org (gk-red.unicc.org [192.91.247.2]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id HAA27413 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 07:29:07 -0800 (PST)
Received: by gk-blue.unicc.org; (5.65v3.2/1.3/10May95) id AA06978; Tue, 4 Feb 1997 16:30:26 +0100
Received: by gh-old.unicc.org (5.65/jsb-190694);
	id AA00396; Tue, 4 Feb 1997 16:30:27 +0100
Received: by new-exchange.unicc.org with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5)
	id <01BC12B8.F37AE050@new-exchange.unicc.org>; Tue, 4 Feb 1997 16:32:02 +0100
Message-Id: <c=CH%a=400net%p=unicc%l=NEW-EXCHANGE-970204153200Z-3805@new-exchange.unicc.org>
From: Lilia Miltcheva <Miltcheva@unicc.org>
To: "'jeff.needle@altavista-software.com'" <jeff.needle@altavista-software.com>
Cc: "'altavista-product@digital.com'" <altavista-product@digital.com>,
        "'admin@unicc.org'" <admin@unicc.org>,
        "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: RE: Duplicated network addresses
Date: Tue, 4 Feb 1997 16:32:00 +0100
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Jeff,

What you say is correct and I do not have any problem with that. My
question is rather what will happen if I address host.unicc.org that has
the same IP as www.microsoft.com, for example? 
As the tunnel comes up, the tunnel server tells the client which
networks a to be tunneled, so logically in this case for
www.microsoft.com = host.unicc.org I will go through the tunnel and
therefore I will never be able to reach www.microsoft.com while the
tunnel is up....

Thanks a lot for your support,
Lili




>----------
>From: 	Jeff Needle[SMTP:needle@altavista.digital.com]
>Sent: 	Tuesday, February 04, 1997 12:54AM
>To: 	Lilia Miltcheva
>Cc: 	altavista-product@digital.com; admin@unicc.org;
>firewalls@greatcircle.com
>Subject: 	Re: Duplicated network addresses
>
>When you use the AltaVista Tunnel, any network packets that travel the
>internet will have a source address of your physical adapter and a target
>address of your firewall's external interface (tunnel server in the case
>where you have no firewall).  The tunnel server, upon receipt of a tunnel
>packet, will strip the tunnel header and decrypt the packet, restoring the
>original destination address.  Therefore the only place your private
>network addresses will be seen are within your private network, between
>your tunnel server and the final internal destination.
>
>Hope this helps.  If you have any further questions about AltaVista
>Tunnel, don't hesitate to contact me.
>
>Jeff Needle, AltaVista engineering
>
>
>
>On Mon, 3 Feb 1997, Lilia Miltcheva wrote:
>
>> Date: Mon, 03 Feb 1997 16:23:53 +0100
>> From: Lilia Miltcheva <miltcheva@unicc.org>
>> To: altavista-product@digital.com
>> Cc: admin@unicc.org, firewalls@GreatCircle.COM
>> Subject: Duplicated network addresses
>> 
>> Dear Guru,
>> 
>> I'm keen on using the AltaVista Tunnel and have already a lot of
>> requests for providing the service. I have a question :
>> 
>> We are currently using Alta Vista FW for Unix and behind it we have
>> class C addresses that we once got by EUnet. Than we changed the ISP and
>> renumbered our "red" (external) network, but on the internal ("blue")
>> WAN we kept the old IPs as there are anyhow not accessible from the
>> Internet.
>> 
>> What is going to happen if a remote client, using AVT connects to our
>> AVT server, gets the numbers of the private networks (for example
>> 193.72.45.0) and starts tunneling, but at the same time there is a
>> server somewhere on the Internet that has address let's say 193.72.45.20
>> (same class C). How this clash could possibly be menaged?
>> 
>> 
>> I'm aware that many people use inside their FW "any" IP addresses (just
>> unique on the LAN), so that will be a problem with all those guys if
>> some coincedence occurs.
>> 
>> Is there something I'm missing?
>> 
>> Thanks a lot in advance.. I'll greately appriciate any help....
>> 
>> Lili
>> 
>
>
>
>

From firewalls-owner  Tue Feb  4 08:49:28 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id HAA29012 for firewalls-outgoing; Tue, 4 Feb 1997 07:48:36 -0800 (PST)
Received: from gk-blue.unicc.org (gk-red.unicc.org [192.91.247.2]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id HAA28988 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 07:48:25 -0800 (PST)
Received: by gk-blue.unicc.org; (5.65v3.2/1.3/10May95) id AA28606; Tue, 4 Feb 1997 16:49:36 +0100
Received: by gh-old.unicc.org (5.65/jsb-190694);
	id AA02025; Tue, 4 Feb 1997 16:49:38 +0100
Received: by new-exchange.unicc.org with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5)
	id <01BC12BB.A2C958A0@new-exchange.unicc.org>; Tue, 4 Feb 1997 16:51:15 +0100
Message-Id: <c=CH%a=400net%p=unicc%l=NEW-EXCHANGE-970204155113Z-3811@new-exchange.unicc.org>
From: Lilia Miltcheva <Miltcheva@unicc.org>
To: "'Lilia Miltcheva'" <miltcheva@unicc.org>,
        "'Jeff Needle'"
	 <needle@altavista.digital.com>
Cc: "'admin@unicc.org'" <admin@unicc.org>,
        "'firewalls@greatcircle.com'"
	 <firewalls@greatcircle.com>
Subject: RE: Duplicated network addresses
Date: Tue, 4 Feb 1997 16:51:13 +0100
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Jeff,

Probably I cannot explain very well. What you say for me means that
while I have the tunnel client up I will never see the host on the
Internet (www.microsoft.com in my example)?! I will always go through
the tunnel, because the tunnel client will think that this is a private
address....

Thanks, Lili

>----------
>From: 	Jeff Needle[SMTP:needle@altavista.digital.com]
>Sent: 	Tuesday, February 04, 1997 1:34AM
>To: 	Lilia Miltcheva
>Cc: 	'admin@unicc.org'; 'firewalls@greatcircle.com'
>Subject: 	RE: Duplicated network addresses
>
>It won't matter if you assign an address that is equivalent to an external
>address.  The only place those tunnel "pseudo addresses" will be seen is
>on the private network, beyond the tunnel server.  They never travel on
>the internet.  Any tunnel packets traveling on the internet will be
>encrypted and encapsulated in an IP packet with a source address of the
>client's real address and a destination address of your firewall, both of
>which would be legal address.
>
>The typical tunnel configuration seems to use RFC 1918 addresses for the
>tunnel clients.
>
>Jeff
>
>On Tue, 4 Feb 1997, Lilia Miltcheva wrote:
>
>> Date: Tue, 4 Feb 1997 16:32:00 +0100
>> From: Lilia Miltcheva <Miltcheva@unicc.org>
>> To: "'jeff.needle@altavista-software.com'"
>     <jeff.needle@altavista-software.com>
>> Cc: "'altavista-product@digital.com'" <altavista-product@digital.com>,
>>     "'admin@unicc.org'" <admin@unicc.org>,
>>     "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
>> Subject: RE: Duplicated network addresses
>> 
>> Jeff,
>> 
>> What you say is correct and I do not have any problem with that. My
>> question is rather what will happen if I address host.unicc.org that has
>> the same IP as www.microsoft.com, for example? 
>> As the tunnel comes up, the tunnel server tells the client which
>> networks a to be tunneled, so logically in this case for
>> www.microsoft.com = host.unicc.org I will go through the tunnel and
>> therefore I will never be able to reach www.microsoft.com while the
>> tunnel is up....
>> 
>> Thanks a lot for your support,
>> Lili
>
>
>

From firewalls-owner  Tue Feb  4 08:55:50 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id IAA04894 for firewalls-outgoing; Tue, 4 Feb 1997 08:37:12 -0800 (PST)
Received: from strat.enernet.com (strat.enernet.com [206.116.106.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id IAA04871 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 08:37:01 -0800 (PST)
Received: from strat (strat.enernet.com [206.116.106.11]) by strat.enernet.com (8.7.5/8.7.3) with SMTP id JAA51050 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 09:38:24 -0700
Message-ID: <32F76600.446B@enernet.com>
Date: Tue, 04 Feb 1997 09:38:24 -0700
From: Chad David <davidc@enernet.com>
Organization: Enernet Technologies Inc.
X-Mailer: Mozilla 3.0 (X11; I; AIX 1)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: Re: NAT on Cisco PIX vs. ??
References: <199702031809.SAA02110@mail.global-sol.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Timothy P. Layton, Sr. wrote:
> 
> I am familiar with NAT on the PIX and was wondering what
> operating systems that any one has had experience with in dealing
> with NAT. Does any one feel that there is a trade off with the
> PIX being a hardware solution vs. a software based solution ?
> 
> Thanks for any input.

I have never used the PIX, but have been told by venders that
NAT is slow, and that there have been problems due to memory 
and cpu constrains... compared to a unix (maybe NT) based 
firewall that is.

Can anyone comment on this?

-- 
Chad David
Network Admin
Enernet Technologies Inc.
davidc@enernet.com

From firewalls-owner  Tue Feb  4 09:11:10 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id IAA06882 for firewalls-outgoing; Tue, 4 Feb 1997 08:55:04 -0800 (PST)
Received: from gw.garrison.com (gw.garrison.com [205.241.58.147]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id IAA06871 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 08:54:55 -0800 (PST)
Received: from gw.garrison.com (root@localhost) by gw.garrison.com (8.7.5/8.7.3) with ESMTP id TAA19236 for <firewalls@GreatCircle.COM>; Fri, 18 Dec 1987 19:33:36 -0600 (CST)
Received: from garrison.com. ([10.0.0.2]) by gw.garrison.com (8.7.5/8.7.3) with SMTP id TAA19230 for <firewalls@GreatCircle.COM>; Fri, 18 Dec 1987 19:33:36 -0600 (CST)
Received: by garrison.com. (4.1/Surrogate Sendmail hack)
	id AA16482; Tue, 4 Feb 97 10:48:30 CST
Date: Tue, 4 Feb 97 10:48:30 CST
From: jeromie@garrison.com (Jeromie Jackson)
Message-Id: <9702041648.AA16482@garrison.com.>
To: goertzek@wangfed.com, willis@sctc.com
Subject: Re: Sidewinder vs. Cyberguard
Cc: firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> On Mon, 3 Feb 1997, K.M. wrote:
> 
> > However, I have heard that Sidewinder is very difficult to configure, unless 
> > they have managed to greatly improve their interface in new release.  

	Matt Willis wrote:
> 
> Sidewinder now offers a *real* GUI and a command line interface, for those
> of us that like it old-school.  Not that I count as unbiased, but it's a
> night-and-day comparison to the old version...
> 
> We've also done away with the notion of internal and external to allow for
> multiple network interfaces...
> 
> The mail-filter is pretty hip, as well... drag-and-drop and such.
> 

	I would definitely have to agree.  The interface for 3.01 of 
Sidewinder is quite nice (although I still prefer the cf lines for most
admin. tasks).  It is quite easy to open up ports and such, quite a lot
easier than many other firewalls I've seen.

	I would agree, the Mail filtering capabilities are quite cool.. The
drag-and-drop approach, and the configuration of the filtering/auditing is
quite spiff.

Jeromie Jackson
Garrison Technologies
jeromie@garrison.com 

From firewalls-owner  Tue Feb  4 09:22:06 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id IAA03311 for firewalls-outgoing; Tue, 4 Feb 1997 08:22:33 -0800 (PST)
Received: from wachusett.altavista-software.com ([205.181.164.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id IAA03301 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 08:22:19 -0800 (PST)
Received: by wachusett.altavista-software.com; (5.65v3.2/1.3/10May95) id AA18495; Tue, 4 Feb 1997 11:21:02 -0500
Date: Tue, 4 Feb 1997 11:20:43 -0500 (EST)
From: Jeff Needle <needle@altavista.digital.com>
X-Sender: needle@plugh.hq.altav.com
To: Lilia Miltcheva <Miltcheva@unicc.org>
Cc: "'admin@unicc.org'" <admin@unicc.org>,
        "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: RE: Duplicated network addresses
In-Reply-To: <c=CH%a=400net%p=unicc%l=NEW-EXCHANGE-970204155113Z-3811@new-exchange.unicc.org>
Message-Id: <Pine.OSF.3.95.970204111424.22446R-100000@plugh.hq.altav.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Well, now you've lost me a bit.  But what I'm saying is that with the
tunnel up, you'll have a route to the private network.  Any traffic
destined for that private network will be encrypted, sent over the
internet with a destination address of the remote firewall and a source
address of your physical network (typically, your ISP-assigned address).
The only place that your private address will be seen is on the private
network, after your tunnel server has decrypted the packet.

If what you're saying is that you've picked addresses in your private
network that overlap real outside addresses instead of using RFC 1918
addresses, then you'll certainly have some confusion!  If one time you
want traffic going to 207.68.156.61 to go to www.microsoft.com, and the
next time, you want traffic going to 207.68.156.61 to go to a machine
which you've got in your private network called host.unicc.org, then
indeed you'll have to craft some routes that will cause this host to be
reachable through the tunnel and you'll have to disconnect the tunnel
before you can access that real address on the internet.

Jeff

On Tue, 4 Feb 1997, Lilia Miltcheva wrote:

> Date: Tue, 4 Feb 1997 16:51:13 +0100
> From: Lilia Miltcheva <Miltcheva@unicc.org>
> To: 'Lilia Miltcheva' <miltcheva@unicc.org>,
>     'Jeff Needle' <needle@altavista.digital.com>
> Cc: "'admin@unicc.org'" <admin@unicc.org>,
>     "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
> Subject: RE: Duplicated network addresses
> 
> Jeff,
> 
> Probably I cannot explain very well. What you say for me means that
> while I have the tunnel client up I will never see the host on the
> Internet (www.microsoft.com in my example)?! I will always go through
> the tunnel, because the tunnel client will think that this is a private
> address....
> 
> Thanks, Lili


From firewalls-owner  Tue Feb  4 09:37:55 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id HAA27312 for firewalls-outgoing; Tue, 4 Feb 1997 07:27:48 -0800 (PST)
Received: from wachusett.altavista-software.com ([205.181.164.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id HAA27280 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 07:27:26 -0800 (PST)
Received: by wachusett.altavista-software.com; (5.65v3.2/1.3/10May95) id AA24058; Tue, 4 Feb 1997 10:26:15 -0500
Date: Tue, 4 Feb 1997 10:26:02 -0500 (EST)
From: Jeff Needle <needle@altavista.digital.com>
X-Sender: needle@plugh.hq.altav.com
To: Arjo Mukherjee 4663 <mukherje@ebo.dec.com>
Cc: Firewalls@GreatCircle.COM
Subject: RE: AVT configurations
In-Reply-To: <970204152010.3603@beux1.ebo.dec.com>
Message-Id: <Pine.OSF.3.95.970204102143.22446K-100000@plugh.hq.altav.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

When the tunnel connection is established, the first thing that's done is
that an address is downloaded and bound to the tunnel pseudo adapter.  The
next thing that happens is a routing packet is downloaded, and those
routes are associated with the tunnel pseudo adapter.  After that,
anything destined for the private network (as defined by the routes
downloaded to the client by the server) will "magically" be encrypted and
routed to the tunnel server. 

Jeff Needle, AltaVista engineering

On Tue, 4 Feb 1997, Arjo Mukherjee 4663 wrote:

> Date: Tue, 4 Feb 97 15:20:10 +0100
> From: Arjo Mukherjee 4663 <mukherje@ebo.dec.com>
> To: Firewalls@GreatCircle.COM
> Subject: RE: AVT configurations
> 
> 
> 
> ----- Forwarded message follows -----
> Delivery-Date: Tue, 4 Feb 97 14:58:27 +0100
> To: Lilia Miltcheva <Miltcheva@unicc.org>
> Subject: RE: AVT configurations
> In-Reply-To: <c=CH%a=400net%p=unicc%l=NEW-EXCHANGE-970204131239Z-3793@new-exchange.unicc.org>
> References: <c=CH%a=400net%p=unicc%l=NEW-EXCHANGE-970204131239Z-3793@new-exchange.unicc.org>
> X-Mailer: MAILworks 1.7-A
> From: Arjo Mukherjee 4663 <mukherje>
> Date: Tue, 4 Feb 97 15:15:40 +0100
> Message-ID: <970204151540.3603@beux1.ebo.dec.com>
> 
> I have the feeling that every session that wants to use the AVT, has to
> be defined on the local clients.  In other words, if you want to telnet
> using the VPN, then you have to set up a defined session with the link
> pointer to the local Tunnel.  Otherwise, the routing will default wise
> direct the path to the firewall and out int the internet.
> 
> I guess the question you have is how to set up the applicatiions on the
> local client to let it know when to use the Tuneel and when not to use
> it.
> 
> >From the sparse docs that I could read, it appears as if on the local
> clients, ie. PC,s etc, one copies a couple of files, which the tunnel
> admin provides.  These have the definitions for the tunnel path.
> 
> It appears that if the user wants to use the tunnel, he needs to click
> on the application to activate the link to the tunnel components, and
> then he can use the VPN.
> 
> Otherwise, it defaults to the firewall and out into the internet.
> 
> Seems like the user has to activate the tunnel link if he wants to use
> it.
> 
> Arjo   
> 
>                    >  > Hi, Arjo!
> > 
> > Thanks to have answered my mail.
> > 
> > I do not worry about the routing. The question is if we have a duplicate
> > IP on the private network and on the Internet, which way the connection
> > is going to be decided - to go through the tunnel or through the regular
> > (ISP) way?
> > During the initial handshake the AVT server gives the IP numbers of the
> > private networks to the tunnel client. Logically than, any IP belonging
> > to one of those networks will be routed through the tunnel. This means
> > that if there is another host on the Internet with the same IP, it will
> > never be reached as far as the tunnel is up... 
> > 
> > Thanks, Lili
> > 
> > 
> > >----------
> > >From: 	Arjo Mukherjee 4663[SMTP:mukherje@ebo.dec.com]
> > >Sent: 	Tuesday, February 04, 1997 3:26AM
> > >To: 	miltcheva@unicc.org
> > >Subject: 	AVT configurations
> > >
> > >Howdy,
> > >
> > >don't think there are address conflicts as the routing takes place
> > >through firewalls.  in other words, the destination address is handled
> > >only after it reaches the target VPN Server (Tunnel Server).
> > >
> > >The firewall is set up to handle the tunnel addresses via relay.
> > >
> > >Arjo
> > >
> > >
> ----- End of forwarded message -----
> 



From firewalls-owner  Tue Feb  4 10:04:48 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id JAA14130 for firewalls-outgoing; Tue, 4 Feb 1997 09:50:10 -0800 (PST)
Received: from main.geminisecure.com (main.geminisecure.com [205.179.16.1]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id JAA14098 for <Firewalls@GreatCircle.com>; Tue, 4 Feb 1997 09:49:59 -0800 (PST)
Received: (from leonard@localhost) by main.geminisecure.com (8.6.9/8.6.9) id JAA19690; Tue, 4 Feb 1997 09:46:37 -0800
Date: Tue, 4 Feb 1997 09:46:37 -0800 (PST)
From: Leonard Miyata <leonard@geminisecure.com>
To: Firewalls@GreatCircle.com
Subject: Red Book vs Orange Book 
In-Reply-To: <199702032325.PAA13699@itech.terisa.com>
Message-ID: <Pine.BSD/.3.91.970204093211.19649A-100000@main.geminisecure.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


There seems to be a general misunderstanding on the C2 rating of
Windows NT Server. Windows NT has a 'Orange Book' C2 rating. Their
resource book for NT 4.0 Server states that NT was designed for
'Red Book' C2, but since they are not claiming this yet, they must
not have acheived this.

Orange Book rates the security of a isolated computer host. It does
not rate the components of a host (e.g. A B2 rated floppy drive or
SCSI controller) but if the components with the O.S. are assembled
in such a fashion, the overall rating of a host is at this level as 
far as MAC, DAC, I&A, Audit, etc are concerned.

Red Book (TNI) is an official supplement to the Orange Book, extending
the Orange Book definitions to a networked environment. Red Book rates
the overall rating of the NETWORK. Individual components of the network
may have a lower rating then the network in general (e.g. workstations,
routers) if other components in the Network can inforce MAC, DAC, I&A
etc. As an example with NT Server, their Domain Authentication Server
is an attempt to meet the DAC requirement. PPTP may be used for trusted
path for I&A, etc. Another example is NetWare, which for a restricted
IPX network, has been rated for Red Book C2

I hope this has been useful

Personal Opinions provided by
Leonard Miyata
aka leonard@geminisecure.com
GEMINI COMPUTERS INC.



On Mon, 3 Feb 1997, EKR wrote:

> > Firest Mistake. NT is not C2 complient. Anyone knowing anything about LAN
> > security would know this. Do a little more research before replying to
> > someone. Besides, do you even know the differnet levels of security, or are
> > you just "anti-nt".(which is not a bad thing)
> Actually, you're quite wrong. NT has been evaluated at C2 in
> a standalone configuration, which appears to be precisely what
> the gentleman was referring to. Please see:
> 
> http://www.radium.ncsc.mil/tpep/epl/entries/CSC-EPL-95-003.html
> 
> -Ekr
> 
> 
> 

From firewalls-owner  Tue Feb  4 10:17:31 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id JAA11075 for firewalls-outgoing; Tue, 4 Feb 1997 09:31:34 -0800 (PST)
Received: from mail.eskimo.com (mail.eskimo.com [204.122.16.4]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id JAA11026 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 09:31:16 -0800 (PST)
Received: from blackrhino (joelm@tia1.eskimo.com [204.122.16.40]) by mail.eskimo.com (8.7.6/8.6.12) with SMTP id JAA11081; Tue, 4 Feb 1997 09:29:51 -0800 (PST)
Message-Id: <3.0.32.19970204092911.006a9454@mail.eskimo.com>
X-Sender: joelm@mail.eskimo.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Tue, 04 Feb 1997 09:29:23 -0800
To: firewalls@GreatCircle.COM
From: Joel McNamara <joelm@eskimo.com>
Subject: Re: Poor NSA...Hells freezin' over again.
Cc: pelicans@mindspring.com (BeachCruiser)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>ps:  Wonder if there is anyone else out there who knows or remembers what
>TEMPEST actually stands for?  And yes it IS an acronym, and it DOES mean
>something.

Not really firewall related, but according to the Feds, TEMPEST is a
codeword, and not an acronym that means anything.

See the Complete, Unofficial TEMPEST Information Page at:

http://www.eskimo.com/~joelm/tempest.html

for loads of open source info on the topic...

Joel


From firewalls-owner  Tue Feb  4 10:25:19 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id JAA10764 for firewalls-outgoing; Tue, 4 Feb 1997 09:28:33 -0800 (PST)
Received: from lancomp-gate.LANcomp.COM (lancomp-gate.lancomp.com [199.170.17.253]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id JAA10684 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 09:28:10 -0800 (PST)
Received: from devils.LANcomp.COM ([192.168.1.102]) by lancomp-gate.LANcomp.COM
          via smtpd (for miles.greatcircle.com [198.102.244.34]) with SMTP; 4 Feb 1997 17:26:53 UT
Received: by LANcomp.COM (5.x/SMI-SVR4)
	id AA01368; Tue, 4 Feb 1997 12:26:49 -0500
Date: Tue, 4 Feb 1997 12:26:49 -0500 (EST)
From: Lee Whitty <lwhitty@LANcomp.COM>
X-Sender: lwhitty@devils
To: firewall <firewalls@greatcircle.com>
Subject: FW1 Address translation installation on multiple inspection module hosts
Message-Id: <Pine.SOL.3.91.970204121550.1256A-100000@devils>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I'm working with a customer running FW1 V2.1 on 2 firewalls. One firewall 
is licensed to run only the inspection module and authentication server. 
The other has the internet security center license. I need to be able to 
install the same rule set on both machines, but load a different address 
translation filter on each. When installing a new rule set, the 
Management firewall installs the local ruleset and translation table onto 
itself, then pushes the same to the second firewall. Even if I create a 
seperate ruleset for the second firewall, it will still install the same 
fwxl.conf on both firewalls. Is there any way to have seperate 
translation tables and a common ruleset, and install them in one step?
Any assistance would be appreciated.

--------------------------------------------------------------------------------
Lee Whitty 
LANcomp                                         Email: lwhitty@lancomp.com
242 Old New Brunswick Road, Suite 200           Voice: 908-981-1991
Piscataway, NJ 08855                            Fax  : 908-981-1858
--------------------------------------------------------------------------------


From firewalls-owner  Tue Feb  4 10:53:17 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id KAA18245 for firewalls-outgoing; Tue, 4 Feb 1997 10:19:26 -0800 (PST)
Received: from lexicon.ins.com (lexicon.ins.com [199.0.193.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id KAA18226 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 10:19:08 -0800 (PST)
Received: from martin_d.ins.com (dmartin.ins.com [199.0.194.34]) by lexicon.ins.com (8.7.5/8.7.3) with SMTP id KAA24351 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 10:17:44 -0800 (PST)
Message-Id: <3.0.32.19970204131543.006ccfd8@lexicon.ins.com>
X-Sender: martin_d@lexicon.ins.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Tue, 04 Feb 1997 13:15:46 -0500
To: firewalls@greatcircle.com
From: "Darwin L. Martinez" <darwin_martinez@INS.COM>
Subject: CyberGuard & NAT
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

ALL:

Can someone tell me if CyberGuard 3.0 (or 2.2) can provide NAT similar to
FireWall-1?

Thanks.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Darwin L. Martinez                 Voice:  404-843-5954
Network Systems Engineer           Pager:  888-346-1320
International Network Services     Vmail:  770-641-4004
Atlanta Office                     Email:  <mailto:darwin_martinez@ins.com>

http://www.ins.com

"Happiness is a belt-fed weapon."
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

From firewalls-owner  Tue Feb  4 11:16:27 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id KAA17332 for firewalls-outgoing; Tue, 4 Feb 1997 10:11:26 -0800 (PST)
Received: from bitsy.hollyfeld.org (bitsy.hollyfeld.org [38.240.235.1]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id KAA17260 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 10:11:01 -0800 (PST)
Received: from bitsy.hollyfeld.org (bitsy.hollyfeld.org [38.240.235.1]) by bitsy.hollyfeld.org (8.7.4/8.7.3) with SMTP id NAA26547; Tue, 4 Feb 1997 13:07:57 -0500
Date: Tue, 4 Feb 1997 13:07:55 -0500 (EST)
From: Daniel Garcia <kender@hollyfeld.org>
To: Lilia Miltcheva <Miltcheva@unicc.org>
cc: "'jeff.needle@altavista-software.com'" <jeff.needle@altavista-software.com>,
        "'altavista-product@digital.com'" <altavista-product@digital.com>,
        "'admin@unicc.org'" <admin@unicc.org>,
        "'firewalls@greatcircle.com'" <firewalls@GreatCircle.COM>
Subject: RE: Duplicated network addresses
In-Reply-To: <c=CH%a=400net%p=unicc%l=NEW-EXCHANGE-970204153200Z-3805@new-exchange.unicc.org>
Message-ID: <Pine.LNX.3.95.970204123811.22357P-100000@bitsy.hollyfeld.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Tue, 4 Feb 1997, Lilia Miltcheva wrote:
> Jeff,
> What you say is correct and I do not have any problem with that. My
> question is rather what will happen if I address host.unicc.org that has
> the same IP as www.microsoft.com, for example? 
> As the tunnel comes up, the tunnel server tells the client which
> networks a to be tunneled, so logically in this case for
> www.microsoft.com = host.unicc.org I will go through the tunnel and
> therefore I will never be able to reach www.microsoft.com while the
> tunnel is up....

There is a set of IP numbers that is reseved precisely for this situation -
they are reserved for private networks, i.e. networks that will never be
directly addressable by the internet, and are garunteed by IANA (among
others I believe) to never be allocated on the internet. According to
rfc1918 (available at http://ftp.isi.edu/in-notes/rfc1918.txt ) the
following address spaces are available:

   The Internet Assigned Numbers Authority (IANA) has reserved the
      following three blocks of the IP address space for private internets:
      
           10.0.0.0        -   10.255.255.255  (10/8 prefix)
	        172.16.0.0      -   172.31.255.255  (172.16/12 prefix)
		     192.168.0.0     -   192.168.255.255 (192.168/16 prefix)

Cheers,

--Dg


From firewalls-owner  Tue Feb  4 11:40:08 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA25851 for firewalls-outgoing; Tue, 4 Feb 1997 11:13:11 -0800 (PST)
Received: from wolfe.net (mail1.wolfe.net [204.157.98.11]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id LAA25802 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 11:12:57 -0800 (PST)
Received: from sea-ts3-p01.wolfenet.com (sea-ts3-p01.wolfenet.com [204.157.98.183]) by wolfe.net (8.8.0/8.8.0) with SMTP id LAA10904 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 11:13:38 -0800 (PST)
Received: by sea-ts3-p01.wolfenet.com with Microsoft Mail
	id <01BC128C.2AC360A0@sea-ts3-p01.wolfenet.com>; Tue, 4 Feb 1997 11:11:28 -0800
Message-ID: <01BC128C.2AC360A0@sea-ts3-p01.wolfenet.com>
From: MANGO <mango@wafirm.com>
To: "'Firewalls@GreatCircle.COM'" <Firewalls@GreatCircle.COM>
Subject: Security Network Specialist Employment Opportunity
Date: Tue, 4 Feb 1997 10:48:34 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

AT&T Wireless Services is selecting talent 
for our Logical / Cross Technology Security team.
We are expanding our 'tiger team'.

AT&T Wireless Services is using leading edge
proprietary technology.  Our team is responsible for
securing our computing and cellular networks at
our corporate headquarters located in Seattle, WA.

Network Security Specialist
RESPONSIBILITIES
Establish and implement network
	security requirements.
Lead network security training effort 
	for Sys Admins throughout AT&T.
Monitor 'hacker' community and CERTs.
Establish security compliance center.
Conduct penetration tests on AWS 
network to ensure security compliance.

REQUIREMENTS
Eight or more years in Information Systems. 
Detailed understanding of UNIX security
	and TCP/IP networking.
Experience with security tools and 
demonstrated network security success.

For more information or to apply:
Send your resume or questions
via fax 206/284.8844 or 
e-mail mango@wafirm.com

The Washington Firm, Ltd. provides outsourced recruiting services for AT&T Wireless Services' headquarters.


From firewalls-owner  Tue Feb  4 11:45:38 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA26668 for firewalls-outgoing; Tue, 4 Feb 1997 11:20:32 -0800 (PST)
Received: from alpha.comsource.net (mail.comsource.net [205.243.40.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id LAA26645 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 11:20:19 -0800 (PST)
Received: from localhost by alpha.comsource.net; (5.65v3.2/1.1.8.2/17May96-0857AM)
	id AA15539; Tue, 4 Feb 1997 13:13:44 -0600
Date: Tue, 4 Feb 1997 13:13:43 -0600 (CST)
From: Jim Jones <jrjones@comsource.net>
To: Stan Wolf <swolf@pacbell.net>
Cc: asetton@lightech.com.ar, Firewall Newsgroup <firewalls@greatcircle.com>
Subject: Re: MS Proxy Server
In-Reply-To: <199702040616.WAA09724@mail-gw.pacbell.net>
Message-Id: <Pine.OSF.3.95.970204130759.26645A-100000@alpha.comsource.net>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Mon, 3 Feb 1997, Stan Wolf wrote:

[...snip...]
> 
> I plan to use PSINet' managed and monitored "RouteWaller" packet filtering
> firewall router in front of MS Proxy Server running by itself on NT Server
> 4.0.  Any thoughts on this arrangement, Jim?

Stan,

I am have never read or dealt with the RouteWaller.  So I do not know how
good a product you are getting.  The big thing about a Firewall IMHO is
the ability to log activity and the ability to hide your internal network.

jim jones
jrjones@comsource.net



From firewalls-owner  Tue Feb  4 13:07:25 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id MAA06366 for firewalls-outgoing; Tue, 4 Feb 1997 12:23:24 -0800 (PST)
Received: from news.ptes.com ([138.112.199.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id MAA06339 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 12:23:13 -0800 (PST)
Received: from [138.112.190.103] (mike.ptes.com [138.112.190.103])
	by news.ptes.com (8.8.5/8.8.5) with SMTP id MAA10718;
	Tue, 4 Feb 1997 12:19:26 -0800 (PST)
X-Sender: mike@moonlight
Message-Id: <v0213051baf1d57cf8528@[138.112.190.103]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Tue, 4 Feb 1997 12:22:56 -0900
To: Dave Schnardthorst <ds3721@strydr.com>, firewalls@GreatCircle.COM
From: mike@ptes.com (Mike Bernhardt)
Subject: Re: Rewriting User Names
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>At 10:00 AM 1/31/97 -0600, Dave Schnardthorst wrote:
>>I am currently running Sendmail-8.8.5 and would like to be able to rewrite
>>user names when sending out e-mail.
>>
>>Example:
>>
>>  Incoming mail to myself could be aliased to daves@stryder.com.  When
>>  I send outgoing mail my return address currently shows ds3721@stryder.com.
>>  The outgoing mail should show daves@stryder.com.
>>
>>Can somebody give me some examples as to how this might be accomplished.
>
>Check out http://www.mc2-csr.com/~lglaze and follow the virtual hosting
>link. The page you want is the first sendmail link. The second one goes
>into a different aspect of sendmail and virtual hosts, but it may also
>be useful to you.
>
>If you have any questions then just let me know (I wrote the pages and
>am currently using both configurations successfully).

It seems like people are making this issue harder than it needs to be. Here
is what I did (in the m4 file). Host name is "Moonlight."

divert(0)dnl
VERSIONID(`@(#)moonlight.mc 8.3 (Berkeley) 3/23/96')
OSTYPE(solaris2.ml)dnl
DOMAIN(generic)dnl
MASQUERADE_AS(ptes.com)dnl
MASQUERADE_DOMAIN(Moonlight)
MAILER(local)dnl
MAILER(smtp)dnl

This way all users on the host "Moonlight" are masked as "ptes.com."




From firewalls-owner  Tue Feb  4 13:07:58 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id MAA09428 for firewalls-outgoing; Tue, 4 Feb 1997 12:46:18 -0800 (PST)
Received: from CETUS.MNGT.ULETH.CA (cetus.mngt.uleth.ca [142.66.25.26]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id MAA09399 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 12:46:03 -0800 (PST)
Received: from MNGT-Message_Server by CETUS.MNGT.ULETH.CA
	with Novell_GroupWise; Tue, 04 Feb 1997 13:43:42 -0700
Message-Id: <s2f73d0e.003@CETUS.MNGT.ULETH.CA>
X-Mailer: Novell GroupWise 4.1
Date: Tue, 04 Feb 1997 13:30:45 -0700
From: Mark Thompson <thommd@CETUS.MNGT.ULETH.CA>
To: firewalls@greatcircle.com
Subject: FW-1 config questions - can anyone help?
Mime-Version: 1.0
Content-Type: text/plain
Content-Disposition: inline
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

G'Day All, 

I am in the process of setting up Firewall-1 on a Sun Ultra 1,  running
Solaris 2.5.1.  Being a newbie in the area of firewalls,  routers, and
gateways, I have been doing quite a lot af reading. One thing that I
cannot find in the setup for the firewall, is  how to set up my
multi-homed host as a gateway.  I need this so that my *ix boxes on the
inside of my network (or any that accept RIP packets) will recieve a
correct RIP packet from my  gateway (firewall). 
  
I am in the process of getting a separate, very small, class C  address
toconnect my firewall/gateway to the router supplied by  our ISP. 
  
Here is a simple diagram of what we have now and what we will have 
after the firewall goes in. 
 -----------                 ------                       ---------------  
|  my.net   |------------|router|---------------|  internet     |  
-----------                  ------                      --------------- 
Here, my side of the router has an address of x.y.1.1, but this  is inside
my domain space.  I have a class B domain so my subnet  mask is
255.255.0.0 and my default gateway is x.y.1.1.  Now, the majority of my
network is made up of PC's and MAC's, so I need  the gateway
to stay the same internally (x.y.1.1). 
  
After I put in the firewall,  I will have 
 ----------             ----------          ------           ----------  
|  my.net  |---------| firewall |-------|router|-------| internet |   
----------             ----------           ------           ---------- 
Here, I am going to move the x.y.1.1 to the inside of my firewall,  and get
another small address space (4 addresses) to go between my 
firewall and the router.  For simplicity sake, say that these  addresses
are 200.200.1.1 and 200.200.1.2 on the outside of the  firewall and
my side of the router, respectively.  Thus, I will have  200.200.1.1 on le0
and x.y.1.1 on qe0. 
  
The questions that I need answered are: 
  
1. I am assuming that if firewall-1 is turned off, that my firewall/gateway
machine will  need to act as a gateway that   passes all on the router. 
Is this in fact the case? 
  
2. As far as routes go, from what I have read, using static routes
seems to be the way  that I need to proceed.  So, I have made a
/etc/gateways file that reads: 
  
            norip le0    
            net 0.0.0.0 gateway 200.200.1.1 metric 0 passive    
            noripin qe0    
            net x.y.0.0 gateway x.y.1.1 metric 0 passive 
  
    I have also thought that I might need to add a route to the router as
follows: 
  
            host 200.200.1.2 gateway 200.200.1.1 metric 0 passive 
  
    Is this the best way to define my gateway so that my internal
machines that respond  to RIPs will get the correct info? 
  
3. From my reading, it seems to me that I only need to run interior routing
and no  exterior routing.  Thus I will  only need to run routed and not
gated (with EGP),  while the exterior routing will be taken care of by my
ISP.  Is this true? 

Thanks for any help,

Mark.

Mark Thompson
Manager of Network Services
Computing Services
The University of Lethbridge
Lethbridge, AB, Canada

(403) 329-2689
thommd@hg.uleth.ca
http://home.uleth.ca/~thommd

From firewalls-owner  Tue Feb  4 13:21:28 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id MAA03355 for firewalls-outgoing; Tue, 4 Feb 1997 12:03:37 -0800 (PST)
Received: from relay2.UU.NET (relay2.UU.NET [192.48.96.7]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id MAA03163 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 12:02:41 -0800 (PST)
Received: from cwiz.com by relay2.UU.NET with SMTP 
	(peer crosschecked as: www.cwiz.com [208.210.163.10])
	id QQcbme02601; Tue, 4 Feb 1997 15:01:19 -0500 (EST)
Received: by cwiz.com (SMI-8.6/SMI-SVR4)
	id OAA08060; Tue, 4 Feb 1997 14:06:58 -0600
Date: Tue, 4 Feb 1997 14:06:58 -0600
From: mdb@dosmanos.cwiz.com (Martin D. Baldenegro)
Message-Id: <199702042006.OAA08060@cwiz.com>
To: firewalls@GreatCircle.COM
Subject: class1 -vs- class 2
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



  IHAC who asked me to explain the difference between using
  a class 1 vs a class 2 type routing system for his firewall.

  I'm a little bit confussed, as I am not sure what he means
  by this. Either I am way out of it, or just never had this
  question come up.

  Are there any pointers that would explain this to me.

  Thanks,


=======================
Martin D. Baldenegro  |
The Cwiz Group        |
email - mdb@cwiz.com  |
=======================


From firewalls-owner  Tue Feb  4 13:55:02 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id MAA03396 for firewalls-outgoing; Tue, 4 Feb 1997 12:03:49 -0800 (PST)
Received: from news.ptes.com ([138.112.199.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id MAA03221 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 12:02:56 -0800 (PST)
Received: from [138.112.190.103] (mike.ptes.com [138.112.190.103])
	by news.ptes.com (8.8.5/8.8.5) with SMTP id LAA10400;
	Tue, 4 Feb 1997 11:59:53 -0800 (PST)
X-Sender: mike@moonlight
Message-Id: <v0213051aaf1d53b58de1@[138.112.190.103]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Tue, 4 Feb 1997 12:03:24 -0900
To: msmith@usair.com, firewalls@GreatCircle.COM
From: mike@ptes.com (Mike Bernhardt)
Subject: Re: Filtering outbound packets
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Outbound, we only filter for source addresses that are not from our net
i.e. possibly spoofed addresses, or least bad ones. I don't care what
protocols go out, as long as they leave here with legitimate addresses.

At 6:57 AM 2/3/97, Mark Smith wrote:
>What is the general practice for readers of this list on filtering
>outbound packets at the router between the ISP and the DMZ ?
>
>The original intent was to limit the chances of mounting
>attacks/FSP/general bad stuff using our site as base camp.  Now,
>however, we have a mail application which appears to drive the router at
>max CPU, allegedly due to the filtering in place.   That outbound
>filtering allows only the "good" protocols to their known ports.



From firewalls-owner  Tue Feb  4 14:32:55 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA18514 for firewalls-outgoing; Tue, 4 Feb 1997 14:10:16 -0800 (PST)
Received: from tetsuo.communique.net (Tetsuo.Communique.Net [204.27.65.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id OAA18457 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 14:09:58 -0800 (PST)
Received: from dguill.communique.net (005.msy4.Communique.Net [204.27.127.5]) by tetsuo.communique.net (8.6.12/8.6.12) with SMTP id QAA67143; Tue, 4 Feb 1997 16:08:27 -0600
Message-ID: <32F6F8BB.5D68@communique.net>
Date: Tue, 04 Feb 1997 02:52:12 -0600
From: "Donald R. Guillot" <dguill@communique.net>
Organization: Guillot Systems
X-Mailer: Mozilla 3.01Gold (Win95; I)
MIME-Version: 1.0
To: Cynthia He <cxh@mba.com>
CC: Firewalls@GreatCircle.COM
Subject: Re: HELP NEEDED: one time password with chroot ftp?
References: <1.5.4.32.19970130222909.0030742c@mbagate2.mba.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Cynthia He wrote:
> 
> Hi, all,
> 
> I am trying to set up a chroot ftp area for our clients. We also have a
> requirement that users have to use one time passwords to login. I am using
> TIS fwtk.
> 
> What I have in netperm-table is something like this:
> 
>   netacl-ftpd: permit-hosts * -chroot /ftp/others/ -exec /usr/bin/ftpd -d
> 
> When a user tries to login, he gets the following error:
> 
>   530 Cannot connect to auth server
>   ftp: Login failed.
>   Remote system type is UNIX.
> 
> It seems that the chroot happens before the user gets authenticated and
> hence has no access to the authsrv database. Is there a way to get around this?
> 
> Thanks for any help.
> 
> Cynthia

Cynthia,

It looks like you are just not connecting the authsrv module....
Make sure their is a definition for the location of the database
eg. authsrv:        database        /usr/local/etc/authdb

This should solve your problem..

Happy authing. (:}}

Donald R. Guillot

From firewalls-owner  Tue Feb  4 14:34:14 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA19098 for firewalls-outgoing; Tue, 4 Feb 1997 14:15:22 -0800 (PST)
Received: from tetsuo.communique.net (Tetsuo.Communique.Net [204.27.65.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id OAA19004 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 14:14:47 -0800 (PST)
Received: from dguill.communique.net (005.msy4.Communique.Net [204.27.127.5]) by tetsuo.communique.net (8.6.12/8.6.12) with SMTP id QAA13881; Tue, 4 Feb 1997 16:13:28 -0600
Message-ID: <32F6F9EB.247C@communique.net>
Date: Tue, 04 Feb 1997 02:57:15 -0600
From: "Donald R. Guillot" <dguill@communique.net>
Organization: Guillot Systems
X-Mailer: Mozilla 3.01Gold (Win95; I)
MIME-Version: 1.0
To: Ken Hardy <ken@mailhost.bridge.com>
CC: firewalls@GreatCircle.COM
Subject: Re: Solved: Odd probes at port 7777
References: <199702032341.RAA07664@binki.bridge.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Ken Hardy wrote:
> 
> I wrote:
> 
> >Every couple of days we get an attempted connection to port 7777 from
> >scripps.edu, so I put a byte sucker on that port to log any received
> >data.  It seems to be a 4 digit and a 2 digit number separated by a
> >comma, followed by a carriage return.
> 
> Further investigation made it apparent that the connection to my port
> 7777 was occuring whenever a connection was made to the remote system's
> SMTP port.  The data I captured, two comma-separated decimal numbers
> followed by a <CR><LF>, is identical to an IDENT query.  The second number
> was always 25.  The lightbulb lights!
> 
> I relayed this information to the site's admin.  He reports that they
> had recently installed a new version of sendmail which does IDENT
> queries, but why to port 7777?  The admin's latest message to me:
> 
> >You were on the right track with your comment about services..
> >We are a heavy user of NIS and ident is not a standard Solaris
> >/etc/services daemon.  I found that the NIS file contained
> >an ident entry with an alias of auth..  There was an auth entry
> >in the NIS file at port 7777..  I converted it to only use
> >a local copy of the services file..  Hopefully, this will cause
> >the probing you were seeing to go away..  If it doesn't please
> >let me know..  THANKS for the heads-up on the problem!
> 
> I don't see this on any of my Solaris systems (not using NIS).  I'd
> guess that someone had put an "auth" entry in at 7777 to refer to TIS'
> authsrv, which uses that port.
> ^^^^
> 
> --
> KH

It looks like TIS default authserver database set-up.....

Donald R. Guillot

From firewalls-owner  Tue Feb  4 16:06:49 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id PAA01229 for firewalls-outgoing; Tue, 4 Feb 1997 15:35:11 -0800 (PST)
Received: from owl.jmu.edu (owl.jmu.edu [134.126.10.50]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id PAA01137 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 15:34:43 -0800 (PST)
Received: from sys14.cs.jmu.edu (sys14.cs.jmu.edu [134.126.20.234]) by owl.jmu.edu (8.7.5/8.7.3) with SMTP id SAA17183; Tue, 4 Feb 1997 18:32:51 -0500 (EST)
Date: Tue, 4 Feb 1997 18:33:24 -0500 (EST)
From: john r cordani <cordanjr@cs.jmu.edu>
To: bextreme@pobox.com
cc: firewalls@greatcircle.com
Subject: Re: Rainbow Book Series?
In-Reply-To: <199702032222.OAA00279@mail.ptw.com>
Message-ID: <Pine.SOL.3.91.970204183114.27294A-100000@sys14.cs.jmu.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


The entire series can be had in hard copy from
director, national security agency
infosec awareness
attention: s322
9800 savage road
fort george g meade, md 20755-600

On Sun, 2 Feb 1997, Jesse 
wrote:

> Hello, does anyone know where I can get the entire Rainbow Book 
> Series?
> 
>    Thanks!!
> -J
> ===================================================
> Finger bextreme@pobox.com for PGP Public Key Block.
> E-mail to jesse.brown@pobox.com
> phone: (805) 942-1391   pager: (805) 267-9511
> ---------------------------------------------------
>  Member of the HTML Writers Guild (http://hwg.org)
> ===================================================

From firewalls-owner  Tue Feb  4 16:09:40 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA23812 for firewalls-outgoing; Tue, 4 Feb 1997 14:49:52 -0800 (PST)
Received: from lint.cisco.com (lint.cisco.com [171.68.223.44]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id OAA23783 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 14:49:35 -0800 (PST)
Received: from big-dogs.cisco.com ([171.68.53.75]) by lint.cisco.com (8.8.4/CISCO.SERVER.1.2) with SMTP id OAA02492; Tue, 4 Feb 1997 14:47:52 -0800 (PST)
Message-Id: <3.0.32.19970204174749.006b62b4@lint.cisco.com>
X-Sender: pferguso@lint.cisco.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Tue, 04 Feb 1997 17:47:52 -0500
To: mike@ptes.com (Mike Bernhardt)
From: Paul Ferguson <pferguso@cisco.com>
Subject: Re: Filtering outbound packets
Cc: msmith@usair.com, firewalls@GreatCircle.COM
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 12:03 PM 2/4/97 -0900, Mike Bernhardt wrote:

>Outbound, we only filter for source addresses that are not from our net
>i.e. possibly spoofed addresses, or least bad ones. I don't care what
>protocols go out, as long as they leave here with legitimate addresses.
>

This is, of course, the responsible thing to do.  :-)

- paul


--
Paul Ferguson                                           ||        ||
Consulting Engineering                                  ||        ||
Herndon, Virginia   USA                                ||||      ||||
tel: +1.703.397.5938                               ..:||||||:..:||||||:..
e-mail: pferguso@cisco.com                         c i s c o S y s t e m s

From firewalls-owner  Tue Feb  4 16:15:08 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id PAA02563 for firewalls-outgoing; Tue, 4 Feb 1997 15:57:03 -0800 (PST)
Received: from panix3.panix.com (panix3.panix.com [198.7.0.4]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id PAA02432 for <firewalls@GreatCircle.com>; Tue, 4 Feb 1997 15:56:27 -0800 (PST)
Received: from localhost (fangyou2@localhost) by panix3.panix.com (8.8.5/8.7/PanixU1.3) with SMTP id SAA02667; Tue, 4 Feb 1997 18:55:16 -0500 (EST)
Date: Tue, 4 Feb 1997 18:55:15 -0500 (EST)
From: FaNgYoU2 <fangyou2@panix.com>
To: firewalls@GreatCircle.com
cc: patton@sysnet.net
Subject: Re: NT network and system management
In-Reply-To: <199702040448.XAA02909@unix1.sysnet.net>
Message-ID: <Pine.SUN.3.94.970204184833.2399A-100000@panix3.panix.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Mon, 3 Feb 1997, Matthew Patton wrote:
> That's a whole lot of data ...
> ... What is your ultimate goal?  Asset management?

Our ultimate goals are:
  1) to see which servers are taking a hit on CPU, RAM or disk,
     (may have to provide better server or split the load);
  2) to see which servers are clobbering the LAN;
  3) to see which users are clobbering which servers;
  4) to detect/watch any intruders that get in.

and
  5) seek and destroy Homer Simpson if he ever connects to the LAN.

                                              FaNgYou2  ^^


From firewalls-owner  Tue Feb  4 16:19:30 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id PAA25767 for firewalls-outgoing; Tue, 4 Feb 1997 15:02:47 -0800 (PST)
Received: from sigg.com (NS.SIGG.COM [192.225.9.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id PAA25706 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 15:02:29 -0800 (PST)
Received: by firewall.sigg.com id <19643>; Tue, 4 Feb 1997 16:57:49 -0600
Illegal-Object: Syntax error in Return-path: address found on firewall.sigg.com:
	Return-path:	<>
			 ^-expected word
Message-Id: <97Feb4.165749cst.19643@firewall.sigg.com>
X-Mailer: Novell GroupWise 4.1
Date: Tue, 4 Feb 1997 17:06:45 -0600
From: Gary Fitzgerald <gfitzger@sigg.com>
To: Firewalls@GreatCircle.COM
Subject: Firewalls-Digest V6 #46 -Reply
Mime-Version: 1.0
Content-Type: text/plain
Content-Disposition: inline
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I am out of town at a training conference.  I will return and answer your mail on February 10th.  

Thanks.

From firewalls-owner  Tue Feb  4 18:34:00 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id SAA21141 for firewalls-outgoing; Tue, 4 Feb 1997 18:22:04 -0800 (PST)
Received: from mailhost.lanl.gov (mailhost.lanl.gov [128.165.3.12]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id SAA21124 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 18:21:57 -0800 (PST)
Received: from cic-mail.lanl.gov (cic-mail.lanl.gov [128.165.3.68]) by mailhost.lanl.gov (8.8.5/8.8.3) with ESMTP id TAA03546; Tue, 4 Feb 1997 19:20:48 -0700 (MST)
Received: from localhost (u802454@localhost) by cic-mail.lanl.gov (8.8.5/8.8.3) with SMTP id TAA06680; Tue, 4 Feb 1997 19:20:46 -0700 (MST)
X-Authentication-Warning: cic-mail.lanl.gov: u802454 owned process doing -bs
Date: Tue, 4 Feb 1997 19:20:46 -0700 (MST)
From: Poole Stephen <u802454@lanl.gov>
X-Sender: u802454@cic-mail
To: john r cordani <cordanjr@cs.jmu.edu>
cc: bextreme@pobox.com, firewalls@GreatCircle.COM
Subject: Re: Rainbow Book Series?
In-Reply-To: <Pine.SOL.3.91.970204183114.27294A-100000@sys14.cs.jmu.edu>
Message-ID: <Pine.SOL.3.95.970204192023.6641A-100000@cic-mail>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

You can actually call them and ask them to send you the books. :-)

Steve...

On Tue, 4 Feb 1997, john r cordani wrote:

> 
> The entire series can be had in hard copy from
> director, national security agency
> infosec awareness
> attention: s322
> 9800 savage road
> fort george g meade, md 20755-600
> 
> On Sun, 2 Feb 1997, Jesse 
> wrote:
> 
> > Hello, does anyone know where I can get the entire Rainbow Book 
> > Series?
> > 
> >    Thanks!!
> > -J
> > ===================================================
> > Finger bextreme@pobox.com for PGP Public Key Block.
> > E-mail to jesse.brown@pobox.com
> > phone: (805) 942-1391   pager: (805) 267-9511
> > ---------------------------------------------------
> >  Member of the HTML Writers Guild (http://hwg.org)
> > ===================================================
> 


From firewalls-owner  Tue Feb  4 18:48:52 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id SAA21736 for firewalls-outgoing; Tue, 4 Feb 1997 18:39:43 -0800 (PST)
Received: from unix1.sysnet.net (unix1.sysnet.net [206.142.32.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id SAA21729 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 18:39:36 -0800 (PST)
Received: from [206.142.16.40] (bppp6.sysnet.net [206.142.16.40]) by unix1.sysnet.net (8.8.4/8.6.12) with SMTP id XAA28125 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 23:15:51 -0500 (EST)
Message-Id: <199702050415.XAA28125@unix1.sysnet.net>
Subject: RE: Rainbow Book Series?
Date: Tue, 4 Feb 97 21:38:46 -0400
x-sender: patton@mail.sysnet.net
x-mailer: Claris Emailer 1.1
From: Matthew Patton <patton@sysnet.net>
To: <firewalls@greatcircle.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

or http://hightop.nrl.navy.mil/rainbow.html unless my bookmarks are all 
wrong.

From firewalls-owner  Tue Feb  4 19:04:11 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id SAA21754 for firewalls-outgoing; Tue, 4 Feb 1997 18:40:02 -0800 (PST)
Received: from unix1.sysnet.net (unix1.sysnet.net [206.142.32.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id SAA21738 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 18:39:48 -0800 (PST)
Received: from [206.142.16.40] (bppp6.sysnet.net [206.142.16.40]) by unix1.sysnet.net (8.8.4/8.6.12) with SMTP id XAA28137 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 23:16:02 -0500 (EST)
Message-Id: <199702050416.XAA28137@unix1.sysnet.net>
Subject: Re: Poor NSA...Hells freezin' over again.
Date: Tue, 4 Feb 97 21:38:56 -0400
x-sender: patton@mail.sysnet.net
x-mailer: Claris Emailer 1.1
From: Matthew Patton <patton@sysnet.net>
To: <firewalls@greatcircle.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Having firmly inserted my lower appendage into a certain orifice, let's 
see how good it tastes when I masticate...

BeachCruiser, pelicans@mindspring.com recently wrote:
>It (the NSA) is NOT in the business of validating or benchmarking the
>systems and products of commercial companies, or trying to please their
>systems administrators or corporate shareholders.

I understand.  So can somebody then explain why I hear repeatedly that 
"we choose this product cause NSA blessed it" or that the rags make such 
a big deal out of it?  It really grates on my nerves when I hear such 
lines as the sole justification from those who've never admined a box in 
their life or don't understand the variables involved.  Maybe we're all 
guilty of saddling NSA with stuff it isn't equipped to deal with (not 
necessarily technically but financially or time wise).

>The clamoring from the user community is that they all want the "most
>secure" firewall.  Of course they don't know, can't figure out, or agree on
>what "secure" even means now any more than they did back then.  And the
>vendors don't know what benchmarks to build to.  So, just like they did
>back in the TEMPEST days, some simply solve that problem by claiming that
>their product's trust level holds some relevance to Orange Book, or some
>other rating levels established by the security gods.  Whether they
>actually did or not was just as much an open question then as it is now.

So which one of us is going to raise our hand and yell "reality check!!  
Will the produce manager come to register 3 to render assistance?"

>Well, sure lets just forget about this testing business altogether and let
>a defacto standard emerge based on the vendor with the largest installed
>base.
No I didn't mean to imply any of the kind.  My thrust was that given the 
delay involved in the release of their report, if there had been 
problems, the market would have found out long before that.  Either 
through the rags doing their varying degrees of 'testing' or in 
customers' use of the product.  TIS was mentioned simply because that was 
the report case in question.  It could have easily been Raptor, or FW1.

>Well now something else is wrong...it seems that somebody's whinin' because
>the test is not rigorous enough, or the reports are no good, or, the soup's
>cold...
Come to think of it, Turkey and vegetable soup is not very tasty served 
cold...

Ok, maybe I'm whining and perhaps the NSA did the reviews just to get 
"us" off their backs.  The "beef" in my case is, if they were going to 
conduct the tests, let's see something a little more than the ordinary, 
something you CAN'T get from the private sector, something to make joe 
admin faint in awe at the mighty power and insight of the NSA (no, I'm 
not being sarcastic... well ok, just a little), something to justify 
their invenstment in both time and money (at taxpayer expense no less).  
Essentially,  the value added.  That or stand up and say "Screw you, 
we're not in this business to eval firewalls," and let the media and 
public know it.  Did they do a poor or incomplete job on the stuff they 
DID test?  No.

Just went and reread the NCSA certification rules and they're not half 
bad.  Perhaps I should look into this a little more.  Personally I don't 
mind that NCSA charges for their services.  I can understand it costs a 
pretty penny to provide the facilities and the time and people to conduct 
the tests even if they might be simple.  In any event we and the industry 
need a watchdog of some sort to establish a baseline.  Mabye NCSA is the 
best forum for the time being.  I'm not so sure I'd be willing to let the 
rags be our conscience.  Could the NCSA rating be improved qualitatively 
with a wider collection of tools?  The NID or SPI products perhaps?  
Running challenge sites (a SCC favorite) for each product?  With periodic 
reports on how they handled new attacks?

The problem with the firewalls issue is that it's only part of the 
problem.  There are a further million and one variables/cases in securing 
the wholistic network, which is what we're driving toward.  The case of 
little applets slipping through the FW into a client which can then do 
all kinds of mischief really isn't a firewall issue per say.  Or an 
inexperienced web server setup letting someone waltz right on thru to the 
inside.

>While still others don't seem to have any problem at all when an industry
>rag, owned by a publishing house for godsake, that doesn't know a covert
>channel from the English Channel, puts out a review and within an hour the
>Madison Avenue machine is in overdrive to tell you who won.
these guys really get to me too.  A couple pointers at Network World's 
review is in order I think.

>If you've got the souce, everything is
>crystal clear...right?
to those who can understand it.  Can any one person understand it?  
Probably not.  But given how many good minds there are I think a pretty 
good effort can be made.

I like your humor.  Something I need to work on...Maybe I should get in 
touch with my "inner child."  An associate worked for NSA for 10+ years, 
if anything I ought to be singing it's praises.

>uh...more tea anyone?
Thanks, just make it a sweet tea with lemon.

PS. Tempest = storm, maelstrom, serious atmospheric disturbance.  But I'm 
sure that definition was NOT the one you wanted.

From firewalls-owner  Tue Feb  4 20:19:50 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id UAA00545 for firewalls-outgoing; Tue, 4 Feb 1997 20:07:05 -0800 (PST)
Received: from su1.in.net (su1.in.net [199.0.62.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id UAA00530 for <firewalls@GreatCircle.com>; Tue, 4 Feb 1997 20:06:51 -0800 (PST)
Received: from pm4-28.in.net by su1.in.net with SMTP (5.65/1.2-eef)
	id AA20224; Tue, 4 Feb 97 22:58:16 -0500
Date: Tue, 4 Feb 97 22:58:16 -0500
Message-Id: <9702050358.AA20224@su1.in.net>
X-Sender: frankw@in.net (Unverified)
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: <winspace@geko.net.au>
From: Frank Willoughby <frankw@in.net>
Subject: Re: SATAN user group?
Cc: firewalls@GreatCircle.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 04:51 AM 2/1/97 +1000, you wrote:

>In reply to the honourable 'frankw@in.net' who said:
>
>> The SATAN tool (or SANTA as I prefer to call it - after running the 
>> REPENT program) is vastly over-hyped & over-rated.  BTW, I hope you 
>
>
>sorry but some of us beg to differ, FWIW its a great tool and im sure many
of us 
>recognise its worth. putting it down the way you did does the auther DF a
great 
>disservice. its just another tool in the sysadmin's suite of tools or
should be seen 
>as such, and it performs, what is normally a repetitive and standard set of 
>diagnostics that one should be running on ones _own_ network, extremely well.


I maintain my stance that the SATAN/SANTA tool is over-hyped and over-rated.
Just before it was released, it made a lot of Information Security Officers
(including me) very nervous.  At the time I was a Company (nationwide)
Information Security Operations officer for a major US hi-tech company overseas 
(@3K systems and 6K employees, but I digress).  After putting the tool on the 
bench and seeing what it really does, we breathed a lot easier.  
 
Here are a few reasons why:

o The software was/is out-dated (even when it was released).  If you are 
   keeping your software current, then it is highly likely that your system 
   will contain patches for vulnerabilities that the SANTA tool would detect.

o An Operating System (O/S) contains 5 major components - Accounts, Auditing, 
   File System, Network, & System areas (root files, system binaries, etc. 
   In performing its testing, the SANTA tool relies on the network component 
   (only) of the Operating System to tell you about the security of the 
   *entire* O/S (as seen by the network).  While this is a noble goal, it 
   falls far short.  Non-networking components of the O/S are not evaluated.  
   IOW, if your networking component is secure, but your system is wide open 
   because of problems in other areas, your system is vulnerable to being
   taken over - in spite of a report from SANTA that your system is OK.
   Use the right tool for the right job.  SANTA tests (primarily) the
   networking component, and it doesn't do that very well, IMHO.

o The SANTA tool performs a very small portion of the tests that ISS 
   and other vendors' products perform.  If it doesn't test for attacks
   such as SYN-flooding or the "Ping-of-death", then it can't tell you
   if these will be a problem for you or not.

o A "clean bill of health" from the SANTA tool give the sysadmin a false 
   sense of security about the security of his/her systems.

o At best, the SANTA tool will tell the beginner sysadmin if they 
   have overlooked something basic, but beyond that, it is useless.

o Another nit is the choice of the name that was chosen.  In one stroke, 
   DF & WV managed to alienate those who are offended by the name "SATAN".  
   The name SATAN signifies the epitome of evil.  If the tool was intended
   to be used for good rather than evil purposes, the choice of the name 
   was the worst one possible.  I don't know the agenda behind the name,
   but I am curious why they chose that particular name than any of a
   multitude of other suitable names.

o It is my understanding that a trojan horse was planted (by a hacker)
  in version 1.1 of the tool.  If you really insist on using the tool,
  run the latest version possible (or v1.1.1 as a minimum).

o It is probably worth checking the 'net for free & commercial versions
   of tools similar to the SANTA tool.  You will probably find other
   tools which provide better coverage than the SANTA tool.

o Use the right tool for the right job.  A network security tool is only 
   one of many tools which a skilled Information Security Officer uses 
   to keep their environment secure.

Santa does have two redeeming graces <double-pun intended>, but they 
don't outweigh the disadvantages, IMHO.  The few advantages are:

o The source code is available, so it can be modified to run on custom
   platforms.

o Further, since the source code is available, any sysadmin can add 
   custom modules to the tool (OTOH, so can the hackers).

Last, but not least, if one of our customers has heard of the tool and 
is curious what it looks like, we will show it them.  Then we will 
show them that our typical network security analysis services (such as 
Firewall Penetration Tests, etc.) discover far more potential probem 
areas than the SANTA tool ever could.  FWIW, the contrast between the 
"much-feared" SANTA tool and the far more extensive tests that we run 
makes *quite* a favorable impression on our customers.

Best Regards,


Frank
=======================================================================
| Fortified Networks, Inc.  -  Expert Information Security Consulting |
| Web:  http://www.fortified.com                                      |
| Phone: (317) 573-0800                                               |
| Fax:   (317) 573-0817                                                 |
=======================================================================


From firewalls-owner  Tue Feb  4 21:08:29 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id VAA03514 for firewalls-outgoing; Tue, 4 Feb 1997 21:01:08 -0800 (PST)
Received: from ns1.ntshop.com ([207.91.166.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id VAA03475 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 21:00:47 -0800 (PST)
Received: from boulder.ntshop.net ([207.91.166.17]) by ns1.ntshop.com
          (post.office MTA v2.0 0813 ID# 153-13296) with SMTP id AAA230;
          Tue, 4 Feb 1997 22:58:24 -0600
Received: by boulder.ntshop.net with Microsoft Mail
	id <01BC12EF.12A4B880@boulder.ntshop.net>; Tue, 4 Feb 1997 22:59:27 -0600
Message-ID: <01BC12EF.12A4B880@boulder.ntshop.net>
From: Mark Joseph Edwards <mark@ntshop.net>
To: "'jesse.brown@pobox.com'" <jesse.brown@pobox.com>
Cc: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: RE: Rainbow Book Series? RIGHT HERE ONLINE
Date: Tue, 4 Feb 1997 22:59:22 -0600
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


There are pointers to most of the Rainbow books (online versions) on =
this Web page, click "NT  Security Risks", then go down to "Other =
Resources".  http://www.ntshop.net/security

mark

-----Original Message-----
From:	john r cordani [SMTP:cordanjr@cs.jmu.edu]
Sent:	Tuesday, February 04, 1997 5:33 PM
To:	bextreme@pobox.com
Cc:	firewalls@greatcircle.com
Subject:	Re: Rainbow Book Series?


The entire series can be had in hard copy from
director, national security agency
infosec awareness
attention: s322
9800 savage road
fort george g meade, md 20755-600

On Sun, 2 Feb 1997, Jesse=20
wrote:

> Hello, does anyone know where I can get the entire Rainbow Book=20
> Series?
>=20
>    Thanks!!
> -J
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D
> Finger bextreme@pobox.com for PGP Public Key Block.
> E-mail to jesse.brown@pobox.com
> phone: (805) 942-1391   pager: (805) 267-9511
> ---------------------------------------------------
>  Member of the HTML Writers Guild (http://hwg.org)
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D

From firewalls-owner  Wed Feb  5 01:34:01 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id BAA20396 for firewalls-outgoing; Wed, 5 Feb 1997 01:27:52 -0800 (PST)
Received: from sigg.com (NS.SIGG.COM [192.225.9.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id BAA20387 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 01:27:42 -0800 (PST)
Received: by firewall.sigg.com id <19643>; Wed, 5 Feb 1997 03:23:04 -0600
Illegal-Object: Syntax error in Return-path: address found on firewall.sigg.com:
	Return-path:	<>
			 ^-expected word
Message-Id: <97Feb5.032304cst.19643@firewall.sigg.com>
X-Mailer: Novell GroupWise 4.1
Date: Wed, 5 Feb 1997 03:31:55 -0600
From: Gary Fitzgerald <gfitzger@sigg.com>
To: Firewalls@GreatCircle.COM
Subject: Firewalls-Digest V6 #47 -Reply
Mime-Version: 1.0
Content-Type: text/plain
Content-Disposition: inline
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I am out of town at a training conference.  I will return and answer your mail on February 10th.  

Thanks.

From firewalls-owner  Wed Feb  5 07:30:52 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA04936 for firewalls-outgoing; Wed, 5 Feb 1997 06:49:16 -0800 (PST)
Received: from dante.sapient.com (dante.sapient.com [207.121.0.5]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA04892 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 06:48:57 -0800 (PST)
Received: (from mail@localhost) by dante.sapient.com (8.6.11/8.6.11) id JAA01321 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 09:47:35 -0500
Received: from smtpgate.sapient.com(172.16.1.7) by dante.sapient.com via smap (V1.3)
	id smaa01315; Wed Feb  5 09:47:07 1997
Received: by galaxy.sapient.com with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63)
	id <01BC1349.676F77B0@galaxy.sapient.com>; Wed, 5 Feb 1997 09:46:04 -0500
Message-ID: <c=US%a=_%p=sapient%l=SAPIENT/SMTPGATE/000909F3@galaxy.sapient.com>
From: Timothy Tu <ltu@sapient.com>
To: "'Firewalls@GreatCircle.COM'" <Firewalls@GreatCircle.COM>
Subject: proxy and newsgroups
Date: Wed, 5 Feb 1997 09:45:04 -0500
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

I need some help.  Is there a way to access my ISP's newsgroups through
my work's connection that has a proxy server on a NT or 95?  If so, do
you know which news reader program support it?  Thanks.

Timothy Tu
lt10@cornell.edu

From firewalls-owner  Wed Feb  5 07:37:47 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA05168 for firewalls-outgoing; Wed, 5 Feb 1997 06:56:34 -0800 (PST)
Received: from gargoyle.clark.net (gargoyle.clark.net [168.143.0.250]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA05142 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 06:56:16 -0800 (PST)
Received: (qmail 26767 invoked by uid 500); 5 Feb 1997 05:57:06 -0000
Date: Wed, 5 Feb 1997 00:57:06 -0500 (EST)
From: "Paul D. Robertson" <proberts@clark.net>
X-Sender: proberts@gargoyle
To: Frank Willoughby <frankw@in.net>
cc: winspace@geko.net.au, firewalls@GreatCircle.COM
Subject: Re: SATAN user group?
In-Reply-To: <9702050358.AA20224@su1.in.net>
Message-ID: <Pine.LNX.3.91.970205004148.25908E-100000@gargoyle>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Tue, 4 Feb 1997, Frank Willoughby wrote:

> o The software was/is out-dated (even when it was released).  If you are 
>    keeping your software current, then it is highly likely that your system 
>    will contain patches for vulnerabilities that the SANTA tool would detect.

>From what I've heard, the 3rd pre-release was very agressive, and like 
all tools, it needs to remain current.  

>    because of problems in other areas, your system is vulnerable to being
>    taken over - in spite of a report from SANTA that your system is OK.
>    Use the right tool for the right job.  SANTA tests (primarily) the
>    networking component, and it doesn't do that very well, IMHO.

It's quite specifically targeted for networks.

> 
> o The SANTA tool performs a very small portion of the tests that ISS 
>    and other vendors' products perform.  If it doesn't test for attacks
>    such as SYN-flooding or the "Ping-of-death", then it can't tell you
>    if these will be a problem for you or not.

It's very difficult to run a denial-of-service attack without denying 
service, don't you think?   Most of us who claim it doesn't do enough are 
the same ones who would claim it did too much for the bad guys if it were 
released with a more agressive suite of tests.

> o A "clean bill of health" from the SANTA tool give the sysadmin a false 
>    sense of security about the security of his/her systems.

If they don't know what it does, and doesn't do.  This is true of *every* 
analysis tool. 

> o At best, the SANTA tool will tell the beginner sysadmin if they 
>    have overlooked something basic, but beyond that, it is useless.

It's extensible, and that's one of it's main features, if you don't grow 
it, then yes, it's not much more than a rubber stamp for a limited set of 
vulnerabilities, that's true of any analysis tool in a dynamic environment.

> o Another nit is the choice of the name that was chosen.  In one stroke, 
>    DF & WV managed to alienate those who are offended by the name "SATAN".  
>    The name SATAN signifies the epitome of evil.  If the tool was intended
>    to be used for good rather than evil purposes, the choice of the name 
>    was the worst one possible.  I don't know the agenda behind the name,
>    but I am curious why they chose that particular name than any of a
>    multitude of other suitable names.

If the name of a program is that bad to someone, then I'd respectfully
suggest that they're in the wrong line of work.  Given, if I recall 
correctly, Dan's naming of a program Fuck!, SATAN could even be 
considered a step up. :) 

> o Further, since the source code is available, any sysadmin can add 
>    custom modules to the tool (OTOH, so can the hackers).

With a C compiler, any sysadmin can write nice helpful programs.  On the 
other hand, evil hackers can write mean and nasty programs.  ?

Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
proberts@clark.net      which may have no basis whatsoever in fact."
                                                                     PSB#9280


From firewalls-owner  Wed Feb  5 07:58:42 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA06672 for firewalls-outgoing; Wed, 5 Feb 1997 07:24:40 -0800 (PST)
Received: from tuna.wang.com (TUNA.wang.com [150.124.136.4]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id HAA06654 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 07:24:28 -0800 (PST)
Received: from mars.wangfed.com (mars.Wangfed.COM [159.94.10.1])
    by tuna.wang.com (8.6.12/8.6.12tf1) with SMTP id KAA11781;
    Wed, 5 Feb 1997 10:23:18 -0500
Received: from uc0009.wangfed.com (uc0009 [159.94.10.15])
	by mars.wangfed.com (8.8.4/3.8) with SMTP
	id KAA29114; Wed, 5 Feb 1997 10:29:22 -0500 (EST)
Received: from [159.94.14.48] by uc0009.wangfed.com (BULL 5.61++/B.O.S 02.01)
	id AA00388; Wed, 5 Feb 97 10:14:08 -0500
Date: Wed, 5 Feb 97 10:14:08 -0500
Message-Id: <9702051514.AA00388@uc0009.wangfed.com>
From: "K.M."  <goertzek@wangfed.com>
Reply-To: "K.M."  <goertzek@wangfed.com>
To: patton@sysnet.net, firewalls@GreatCircle.COM
Subject: Re: Rainbow Book Series?
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

In message <199702050415.XAA28125@unix1.sysnet.net> Matthew Patton writes:
> or http://hightop.nrl.navy.mil/rainbow.html unless my bookmarks are all 
> wrong.


NRL has closed its web site to all domain names except those ending in .gov or 
.org.


Karen Goertzel

=====

K.M. Goertzel
Manager, Business Development
Secure Systems & Services Operation
WANG FEDERAL, Inc.
7900 Westpark Drive - MS 700
McLean, VA  22102-4299  USA
tel (703)827 3914
fax (703)827 3161 
email goertzek@wangfed.com


From firewalls-owner  Wed Feb  5 08:46:23 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA08313 for firewalls-outgoing; Wed, 5 Feb 1997 07:50:46 -0800 (PST)
Received: from mail.baileynm.com (fw.baileynm.com [206.109.159.11]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id HAA08305 for <firewalls@GreatCircle.com>; Wed, 5 Feb 1997 07:50:30 -0800 (PST)
Received: (qmail 2923 invoked from smtpd); 5 Feb 1997 15:49:21 -0000
Received: from web.nmti.com (root@198.178.0.201)
  by fw.nmti.com with SMTP; 5 Feb 1997 15:49:21 -0000
Received: from sonic.nmti.com (peter@sonic.nmti.com [198.178.0.2]) by web.nmti.com (8.6.12/8.6.9) with SMTP id JAA03997; Wed, 5 Feb 1997 09:49:21 -0600
Received: by sonic.nmti.com; id AA08998; Wed, 5 Feb 1997 09:43:46 -0600
From: peter@baileynm.com (Peter da Silva)
Message-Id: <9702051543.AA08998@sonic.nmti.com.nmti.com>
Subject: Re: SATAN user group?
To: frankw@in.net (Frank Willoughby)
Date: Wed, 5 Feb 1997 09:43:45 -0600 (CST)
Cc: winspace@geko.net.au, firewalls@GreatCircle.com
In-Reply-To: <9702050358.AA20224@su1.in.net> from "Frank Willoughby" at Feb 4, 97 10:58:16 pm
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> o Another nit is the choice of the name that was chosen.  In one stroke, 
>    DF & WV managed to alienate those who are offended by the name "SATAN".  
>    The name SATAN signifies the epitome of evil.  If the tool was intended
>    to be used for good rather than evil purposes, the choice of the name 
>    was the worst one possible.  I don't know the agenda behind the name,
>    but I am curious why they chose that particular name than any of a
>    multitude of other suitable names.

What, you mean like maybe "the Farmer Universal Cracking Kit"? <g>


From firewalls-owner  Wed Feb  5 09:01:23 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA10595 for firewalls-outgoing; Wed, 5 Feb 1997 08:20:01 -0800 (PST)
Received: from arden.iss.net (arden.iss.net [204.241.60.8]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id IAA10554 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 08:19:42 -0800 (PST)
Received: from localhost (davem@localhost) by arden.iss.net (8.8.5/8.7.3) with SMTP id LAA16282; Wed, 5 Feb 1997 11:17:23 -0500
X-Authentication-Warning: arden.iss.net: davem owned process doing -bs
Date: Wed, 5 Feb 1997 11:17:23 -0500 (EST)
From: "David J. Meltzer" <davem@iss.net>
To: "Paul D. Robertson" <proberts@clark.net>
cc: Frank Willoughby <frankw@in.net>, winspace@geko.net.au,
        firewalls@GreatCircle.COM
Subject: Re: SATAN user group?
In-Reply-To: <Pine.LNX.3.91.970205004148.25908E-100000@gargoyle>
Message-ID: <Pine.LNX.3.95.970205110403.15762A-100000@arden.iss.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> It's very difficult to run a denial-of-service attack without denying 
> service, don't you think?   Most of us who claim it doesn't do enough are 
> the same ones who would claim it did too much for the bad guys if it were 
> released with a more agressive suite of tests.

  This is a very subtle point.  There are some denial of service attacks
that are nearly impossible to test for under certain conditions without
going ahead and actually performing the attack.  Something like the ping
of death or a UDP bomb can very likely fall into this category for a
network based check.  (Another method of testing, logging into each
machine and discovering the specific operating system and kernel revision,
is a way to avoid performing the denial of service attack, but brings with
it its own set of problems and disadvantages).
  A test for a syn flood attack is possible to check for remotely in such
a way that it has a very minimal impact on the service that you are
attempting to flood.  The syn flood denial of service test that is a part
of ISS does perform an actual denial of service, but it only shuts down
the service for a split second before reversing the impact of the attack
and opening the service back up.  That might fall into a very small
acceptable DoS attack you could test against a production system. 
  I think we can all agree though that it is far better for a system or 
security administrator to test for vulnerabilities to these problems under
controlled timing and conditions than it is to figure out what machines
are vulnerable to attack when a hacker starts performing it 4am on a
sunday morning.

-Dave

--------------------------------+---------------------
       David J. Meltzer         | Email: davem@iss.net 
       Systems Engineer         |   Web:   www.iss.net 
Internet Security Systems, Inc. |   Fax: (770)395-1972


From firewalls-owner  Wed Feb  5 09:32:22 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA09719 for firewalls-outgoing; Wed, 5 Feb 1997 08:05:07 -0800 (PST)
Received: from ITSFW.internal.cits.com (itsfw.cits.com [57.192.1.9]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id IAA09488 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 08:04:04 -0800 (PST)
Received: by ITSFW.internal.cits.com (AIX 4.1/UCB 5.64/4.03)
          id AA11202; Wed, 5 Feb 1997 17:07:22 +0100
Received: from itsgtw.internal.cits.com(124.10.10.10) by ITSFW via smap (V1.3)
	id sma012732; Wed Feb  5 17:06:40 1997
Received: from sscherrer.internal.cits.com by ITSGTW.internal.cits.com (AIX 3.2/UCB 5.64/4.03)
          id AA10889; Wed, 5 Feb 1997 16:47:22 +0100
Message-Id: <32F8AFCA.246D@cits.com>
Date: Wed, 05 Feb 1997 17:05:32 +0100
From: Stephane Scherrer <sscherrer@cits.com>
X-Sender: Stephane Scherrer <sscherrer@cits.com> (Unverified)
X-Mailer: Mozilla 4.0b1 (Win95; I)
Mime-Version: 1.0
To: Firewalls@GreatCircle.COM
Subject: Source port filtering rules...
X-Priority: Normal
References: <199702040443.UAA01246@miles.greatcircle.com>
Content-Type: multipart/mixed; boundary="----------5B574DC5BC10"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

This is a multi-part message in MIME format.
------------5B574DC5BC10
Content-Type: multipart/alternative; boundary="----------6AEC73B4325F1"


------------6AEC73B4325F1
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=us-ascii

Hi everybody,

I'm currently having a slight problem with a remote site and would
appreciate any help on this.
Here is where it lies :
I'm currently running the TIS Firewall Toolkit with a screening router,
between it and the Internet...

         -----            -------------------               ---------
        | TIS  |------ | Screening Router |---------| Internet |
         -----            -------------------               ---------

The screening router is configured with defined filter rules, and one of
these rules is causing us lots of troubles :

        allow X (Port>=1024)   ---------> FW (Port=25)
or in "Cisco Langage" :
       access-list 130 permit tcp any gt 1023 FWIPaddress FWnetmask eq
25

It didn't sound wrong for me...except when a remote site contacted me
saying that they couldn't send us any Mail...
Furether investigation showed that their Mail packets in destination of
our Mail server had a source port below 1024... I reported the problem
to them and they investigate on their side...

Here lies the problem :
They were said by Checkpoint software (who installed their firewall
including a NAT) that we shouldn't filter incoming packets on the source
port !!!!

If anybody could answer these two questions, it would greatly help me :
    - Is there any real security problems if you don't filter source
port on incoming packets ?
    - Should these kind of packets (source port <1024 to destination
port =25) be allowed to pass through ?

Thanks very much for any help on this one.

Stephane Scherrer
MIS Project Manager
ITS EUMA
Email : sscherrer@cits.com
Voice : (33)-1-41 16 23 58
Fax : (33)-1-41 16 22 17


------------6AEC73B4325F1
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset=us-ascii

<HTML><BODY>

<DT>Hi everybody,</DT>

<DT>&nbsp;</DT>

<DT>I'm currently having a slight problem with a remote site and would
appreciate any help on this.&nbsp;</DT>

<DT>Here is where it lies :</DT>

<DT>I'm currently running the TIS Firewall Toolkit with a screening router,
between it and the Internet...</DT>

<DT>&nbsp;</DT>

<DT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -----&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-------------------&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
---------</DT>

<DT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; | TIS&nbsp; |------ | Screening
Router |---------| Internet |</DT>

<DT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -----&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-------------------&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
---------</DT>

<DT>&nbsp;</DT>

<DT>The screening router is configured with defined filter rules, and one
of these rules is causing us lots of troubles :</DT>

<DT>&nbsp;</DT>

<DT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; allow X (Port&gt;=1024)&nbsp;&nbsp;
---------&gt; FW (Port=25)</DT>

<DT>or in &quot;Cisco Langage&quot; :</DT>

<DT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; access-list 130 permit tcp any
gt 1023 FWIPaddress FWnetmask eq 25&nbsp;</DT>

<DT>&nbsp;</DT>

<DT>It didn't sound wrong for me...except when a remote site contacted
me saying that they couldn't send us any Mail...</DT>

<DT>Furether investigation showed that their Mail packets in destination
of our Mail server had a source port below 1024...&nbsp;I reported the
problem to them and they investigate on their side...</DT>

<DT>&nbsp;</DT>

<DT>Here lies the problem :</DT>

<DT>They were said by Checkpoint software (who installed their firewall
including a NAT) that we shouldn't filter incoming packets on the source
port !!!!&nbsp;</DT>

<DT>&nbsp;</DT>

<DT>If anybody could answer these two questions, it would greatly help
me :</DT>

<DT>&nbsp;&nbsp;&nbsp; - Is there any real security problems if you don't
filter source port on incoming packets ?</DT>

<DT>&nbsp;&nbsp;&nbsp; - Should these kind of packets (source port &lt;1024
to destination port =25) be allowed to pass through ?</DT>

<DT>&nbsp;</DT>

<DT>Thanks very much for any help on this one.</DT>

<DT>&nbsp;</DT>

<DT>Stephane Scherrer</DT>

<DT>MIS&nbsp;Project Manager</DT>

<DT>ITS&nbsp;EUMA</DT>

<DT>Email : sscherrer@cits.com</DT>

<DT>Voice : (33)-1-41 16 23 58</DT>

<DT>Fax : (33)-1-41 16 22 17</DT>

<DT>&nbsp;</DT>

</BODY>
</HTML>
------------6AEC73B4325F1--

------------5B574DC5BC10
Content-Transfer-Encoding: 7bit
Content-Description: Address Book Card for Stephane Scherrer
Content-Disposition: inline; filename="nsmail76.TMP"
Content-Type: text/x-vCard; charset=us-ascii; name="nsmail76.TMP"

BEGIN:VCARD
FN:Stephane Scherrer
N:Scherrer;Stephane
ORG:ITS
ADR:;;124, Bd de Verdun;Courbevoie;Courbevoie;92400
EMAIL;INTERNET:sscherrer@cits.com
TITLE:Mis Project Specialist
TEL;WORK:(33) 01 41 16 23 58
TEL;FAX:(33) 01 41 16 22 37
X-NAV-HTML:T
END:VCARD


------------5B574DC5BC10--


From firewalls-owner  Wed Feb  5 10:00:37 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA11564 for firewalls-outgoing; Wed, 5 Feb 1997 08:30:32 -0800 (PST)
Received: from ait.nrl.navy.mil (ait.nrl.navy.mil [132.250.128.5]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id IAA11514 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 08:30:15 -0800 (PST)
Received: from enterprise (rtaylor@enterprise [132.250.128.5]) by ait.nrl.navy.mil (8.8.3/8.8.3) with ESMTP id LAA11822; Wed, 5 Feb 1997 11:28:23 -0500 (EST)
Message-Id: <199702051628.LAA11822@ait.nrl.navy.mil>
To: "K.M." <goertzek@wangfed.com>
cc: patton@sysnet.net, webmaster@hightop.nrl.navy.mil,
        firewalls@greatcircle.com
Subject: Re: Rainbow Book Series? 
In-reply-to: Your message of Wed, 05 Feb 1997 10:14:08 EST.
             <9702051514.AA00388@uc0009.wangfed.com> 
Date: Wed, 05 Feb 1997 11:28:22 -0500
From: Randy Taylor <rtaylor@ait.nrl.navy.mil>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


> In message <199702050415.XAA28125@unix1.sysnet.net> Matthew Patton writes:
> > or http://hightop.nrl.navy.mil/rainbow.html unless my bookmarks are all 
> > wrong.
> 
> 
> NRL has closed its web site to all domain names except those ending in .gov o
r 
> .org.

Incorrect. The NRL Information Systems Security Branch, which is part
of the Naval Research Laboratory, has closed its web site to all
but the .mil and .gov network domains. Other divisions and branches
of the Naval Research Laboratory choose their own access policies -
most are in fact, open to public browsing.

Just wanted to clear up that bit of misinformation from Ms. Goertzel.


Randy Taylor             
Supporting Code 1221.3,
Information Systems Security Branch
Naval Research Laboratory
Washington, D.C.
email: rtaylor@hightop.nrl.navy.mil
       webmaster@hightop.nrl.navy.mil

From firewalls-owner  Wed Feb  5 10:30:52 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA15400 for firewalls-outgoing; Wed, 5 Feb 1997 09:01:47 -0800 (PST)
Received: from mitchell.cap.af.mil (mitchell.cap.af.mil [132.60.58.11]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id JAA15354 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 09:01:14 -0800 (PST)
Received: from localhost (cmilam@localhost) by mitchell.cap.af.mil (8.7.6/8.7.3-961117-BC) with SMTP id KAA17085; Wed, 5 Feb 1997 10:52:04 -0600
Date: Wed, 5 Feb 1997 10:52:04 -0600 (CST)
From: "Milam, Charles R. 1LT CAP" <cmilam@cap.af.mil>
To: "K.M." <goertzek@wangfed.com>
cc: patton@sysnet.net, firewalls@GreatCircle.COM
Subject: Re: Rainbow Book Series?
In-Reply-To: <9702051514.AA00388@uc0009.wangfed.com>
Message-ID: <Pine.LNX.3.94.970205105109.16926B-100000@mitchell.cap.af.mil>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


On Wed, 5 Feb 1997, K.M. wrote:

> NRL has closed its web site to all domain names except those ending in .gov or 
> .org.

Actually, it's closed to .gov and .mil.  Don't feel bad, all I get is a
"Server is refusing connections now. Sorry." message, anyway.

----------------------------------------------------------------------
1LT Chuck Milam, CAP				cmilam@cap.af.mil
United States Air Force Auxiliary		http://www.cap.af.mil/
Civil Air Patrol National Headquarters		Comm:	(334) 953-4271
Maxwell Air Force Base, AL			DSN:	493-4271


From firewalls-owner  Wed Feb  5 10:41:14 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA20531 for firewalls-outgoing; Wed, 5 Feb 1997 09:59:28 -0800 (PST)
Received: from bgc.bostongas.com (bgc.bostongas.com [208.202.16.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id JAA20494 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 09:59:09 -0800 (PST)
Received: by bgc.bostongas.com; id MAA23191; Wed, 5 Feb 1997 12:56:02 -0500 (EST)
Received: from unknown(10.129.1.4) by bgc.bostongas.com via smap (V3.1)
	id xma023185; Wed, 5 Feb 97 12:55:58 -0500
Received: from NetWare MHS (SMF70) by smtp.bostongas.com
	via Connect2-SMTP 4.20B.3; Wed, 5 Feb 1997 12:52:22 -0500
Message-ID: <4A30323C013C41D9@smtp.bostongas.com>
Date: Wed, 5 Feb 1997 12:37:24 -0500
From: "Kolenko, Marc" <mmk@bostongas.com>
Organization: BOSTON GAS COMPANY
To: firewalls@greatcircle.com
Subject: Sandbox?
MIME-Version: 1.0
Content-type: text/plain; charset="US-ASCII"
Content-disposition: inline
Content-transfer-encoding: 7bit
X-Mailer: Connect2-SMTP 4.20B.3 MHS/SMF to SMTP Gateway
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Friends

can some one give me the 2 minute drill on the architectural definition 
of "SANDBOX"?

Does it relate to typical DMZ configurations usually alluded to in 
Firewall placement discussions?

thanks in advance

Marc
*******************************************
Marc M. Kolenko, Boston Gas Co.
Strategic IT Planning
mkolenko@bostongas.com
     -or-
kolenko@tiac.net
617.723.5512; x-2669
*******************************************

--------------------------------------------------------------------------
---------
"The opinions expressed here are my own and 
do not represent the views or opinions of Boston Gas Co."
--------------------------------------------------------------------------
---------


From firewalls-owner  Wed Feb  5 11:39:23 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id KAA26142 for firewalls-outgoing; Wed, 5 Feb 1997 10:55:41 -0800 (PST)
Received: from ibmmail.COM (ibmmail.com [199.171.26.3]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id KAA26130 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 10:55:29 -0800 (PST)
From: uskanbye@ibmmail.com
Message-Id: <199702051855.KAA26130@miles.greatcircle.com>
Received: from ibmmail by ibmmail.COM (IBM VM SMTP V2R3) with BSMTP id 9360;
   Wed, 05 Feb 97 13:54:22 EST
Date: Wed, 05 Feb 1997 13:53:24 EST
To: firewalls@GreatCircle.COM
X-Sender-Info: Mitchell Ummel CSP CCP, KDHE Network Manager
               Office of Information Systems, Tech Services Section
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Subject: DLSw (Data Link Switching) through a firewall
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Question is how (or if) DLSw can be passed through a firewall (without
opening up the entire network). Our WAN includes remotes sites that are
running SNA encapsulated within IP (DLSw) via CISCO routers. We're
hoping to NOT have to move them to pure IP before firewall
implementation. Is anybody aware of implementation (or have done this)?
Any/all advice appreciated.

By the way, Eagle Raptor NT is the selected firewall...




     --------KANSAS DEPARTMENT OF HEALTH & ENVIRONMENT---------
     -----------------WWW.INK.ORG\PUBLIC\KDHE------------------
     ----------Mills Bldg Suite 501 Topeka, KS 66612-----------
     ---------Phone (913) 296-5643 FAX (913) 296-8943----------

From firewalls-owner  Wed Feb  5 11:50:45 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id KAA20890 for firewalls-outgoing; Wed, 5 Feb 1997 10:01:34 -0800 (PST)
Received: from zonk.geko.net.au (zonk.geko.net.au [203.2.239.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id KAA20790 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 10:00:52 -0800 (PST)
Received: from mozart.void.hell.net (dialup2057.geko.net.au [203.25.225.57]) by zonk.geko.net.au (8.7.5/8.6.12) with ESMTP id EAA02167; Thu, 6 Feb 1997 04:59:54 +1100 (EST)
Received: from beethoven ([192.168.0.2]) by mozart.void.hell.net
	 with smtp id m0vsBjj-000Jn4C
	(Debian Smail-3.2 1996-Jul-4 #2); Thu, 6 Feb 1997 05:06:23 +1100 (EST)
Message-Id: <m0vsBjj-000Jn4C@mozart.void.hell.net>
Date: Thu, 6 Feb 1997 04:59:54 +1000
From: <winspace@void.hell.net> (Norman Widders)
To: <firewalls@GreatCircle.COM>
Subject: Re: SATAN user group?
Reply-To: <winspace@geko.net.au>
Organisation: W.C.E. Consulting
X-Mailer: Mailbase for NT v1.2.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7BIT
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

In reply to the honourable 'frankw@in.net' who said:

> o The software was/is out-dated (even when it was released).  If you are 

This assumption is incorrect. The software was designed to perform basic diagnostics 
and port/services evaluation.

OTOH, all software is out-dated by the time its released, its only while its still 
fresh in the mind of the developer that its new. This is especially true for patches 
also. Take the latest set of sendmail patches from 8.7.x to 8.8.5 for example.

> o The SANTA tool performs a very small portion of the tests that ISS 

I said satan is one component, another tool in the IS suite. I also recommend 
tripwire, courtney, tcpdump, cops, tiger, hobgoblin, ISS, fwtk, crack and numerous 
others to provide a well rounded toolbox. One should never rely solely on one 
specific tool.

For further penetration testing write your own utilities, download the current 
black-hat rootkits, and examine thoroughly the actual system being tested.

> o A "clean bill of health" from the SANTA tool give the sysadmin a false 
>    sense of security about the security of his/her systems.

Any person that feels secure in their setup is at risk. A clean bill of health is 
only given by a Security consultant based on sound security practices and 
techniques. Using tools merely assists one here, but keep a healthy paranoia at all 
times.
 
> o At best, the SANTA tool will tell the beginner sysadmin if they 
>    have overlooked something basic, but beyond that, it is useless.

What is a beginner sysadmin doing in charge of security ? Security is for those with 
the required expertise.
 
> o Another nit is the choice of the name that was chosen.  In one stroke, 

This is a pointless argument that has been repeated over and over, acronyms are 
acronyms and usually goes into /dev/null.

> o It is my understanding that a trojan horse was planted (by a hacker)

If you run checksums on the binaries and only download from the original trusted 
site, then it is not an issue.


> You will probably find other tools which provide better coverage than the SANTA > 
tool. 

Complete coverage is not provided by any tool or tools, it is only through the IS 
personnels' knowledge and diligence that one attains 'complete coverage'. Which 
again relies partly on having a diverse range of tools to assist one in automating 
basic tasks.


> o Use the right tool for the right job.  A network security tool is only 
>    one of many tools which a skilled Information Security Officer uses 
>    to keep their environment secure.

This is what i have been saying all along. 


> show them that our typical network security analysis services (such as 
> Firewall Penetration Tests, etc.) discover far more potential probem 
> areas than the SANTA tool ever could.  

Assessing the risks and trouble spots in ones network/firewall is a multistep 
process, rearrange as per your preferences.
1. install and run the standard tools, check versions, holes etc.
2. write and run _your_ own specific scripts and programs.
3. investigate the known problem areas
4. manually go through ones own acquired checklist of problems.

Step 1 is where one hopefully makes use of tools like satan.

Are you advising people not to make use of an available tool ? or do we continue to 
reinvent the wheel.

> "much-feared" SANTA tool and the far more extensive tests that we run 
> makes *quite* a favorable impression on our customers.

Impressing customers is far less important than knowing the end result will be 
effective.

cheers

+------------------------------------------------------------+
|                                                            |
|   _/_/         _/_/     _/_/_/_/_/_/      _/_/_/_/_/_/     |
|   _/_/        _/_/     _/_/_/            _/_/              |
|    _/_/ _/_/ _/_/      _/_/              _/_/_/            |
|     _/_/_/_/_/_/       _/_/_/            _/_/              |
|      _/_/  _/_/         _/_/_/_/_/_/      _/_/_/_/_/_/     |
|                                                            |
| winspace@geko.net.au - Software Engineering in SQL and C++ |
+------------------------------------------------------------+



From firewalls-owner  Wed Feb  5 12:21:05 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA27559 for firewalls-outgoing; Wed, 5 Feb 1997 11:07:51 -0800 (PST)
Received: from darkstar.sysinfo.com (darkstar.sysinfo.com [204.246.65.62]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id LAA27550 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 11:07:38 -0800 (PST)
Received: from parka.winternet.com (dufresne@parka.winternet.com [198.174.169.9]) by darkstar.sysinfo.com (8.8.2/8.8.2) with SMTP id NAA15228; Wed, 5 Feb 1997 13:08:25 -0600
Date: Wed, 5 Feb 1997 12:58:31 -0600 (CST)
From: Ron DuFresne <dufresne@parka.winternet.com>
To: "Kolenko, Marc" <mmk@bostongas.com>
cc: firewalls@GreatCircle.COM
Subject: Re: Sandbox?
In-Reply-To: <4A30323C013C41D9@smtp.bostongas.com>
Message-ID: <Pine.GSO.3.95q.970205125722.29324A-100000@parka.winternet.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Wed, 5 Feb 1997, Kolenko, Marc wrote:

> Friends
> 
> can some one give me the 2 minute drill on the architectural definition 
> of "SANDBOX"?
> 
> Does it relate to typical DMZ configurations usually alluded to in 
> Firewall placement discussions?

If I'm recalling things correctly, the sandbox mentioned and refered to is
in reguards to chrooted systems.

Later,

Ron DuFresne
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
	***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D.  Just don't touch anything.


From firewalls-owner  Wed Feb  5 12:28:16 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA01204 for firewalls-outgoing; Wed, 5 Feb 1997 11:32:02 -0800 (PST)
Received: from andromeda.tectel.com.mx ([200.23.62.194]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id LAA01108 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 11:31:36 -0800 (PST)
Received: from port3.tectel.com.mx ([200.23.62.131])
          by andromeda.tectel.com.mx (Netscape Mail Server v2.0) with SMTP
          id AAA2232; Wed, 5 Feb 1997 13:20:38 -0600
Received: by port3.tectel.com.mx with Microsoft Mail
	id <01BC1369.07930260@port3.tectel.com.mx>; Wed, 5 Feb 1997 13:32:27 -0600
Message-ID: <01BC1369.07930260@port3.tectel.com.mx>
From: Colegio de Contadores <contanet@andromeda.tectel.com.mx>
To: "'Firewalls@GreatCircle.COM'" <Firewalls@GreatCircle.COM>
Cc: "'support@access1.sun.com'" <support@access1.sun.com>,
        "'support@sunsoft.com'" <support@sunsoft.com>
Subject: hardware requeriment.
Date: Wed, 5 Feb 1997 13:32:15 -0600
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



Hello . Im new in the list , and i=B4d like to talk about=20
Solaris Firewall .


	Wich is the recommended hardware for install this firewall
	over x86 plataform ?

	Procesor  ??

	Memory ?

	CPU clock ?

	Mi link is going to be a 128 kbps .

	Im thinking to use a vectra VE 486/66 of HP.


	Thanks for your comments.



Israel Zavalza Bahena
Contanet.

	

From firewalls-owner  Wed Feb  5 12:59:55 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA03985 for firewalls-outgoing; Wed, 5 Feb 1997 11:57:12 -0800 (PST)
Received: from firewall.uprc.com (sentry.uprc.com [144.94.230.3]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id LAA03978 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 11:57:01 -0800 (PST)
Received: by firewall.uprc.com; id AA05745; Wed, 5 Feb 97 13:55:11 CST
Received: from clavin.uprc.com(144.94.68.3) by firewall.uprc.com via smap (V3.1)
	id xma005740; Wed, 5 Feb 97 13:55:04 -0600
Received: from kafka.uprc.com by clavin (4.1/3.2.012693-Union Pacific Resources Company);
        id AA04784 for Firewalls@GreatCircle.COM; Wed, 5 Feb 97 13:54:30 CST
Received: by kafka.uprc.com (SMI-8.6/SMI-SVR4)
	id NAA17384; Wed, 5 Feb 1997 13:54:30 -0600
Date: Wed, 5 Feb 1997 13:54:30 -0600
From: z76399@uprc.com (Prahl V. E. (Von))
Message-Id: <199702051954.NAA17384@kafka.uprc.com>
To: Firewalls@GreatCircle.COM
Subject: http proxy problems / gauntlet
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

greetings,


we occasionally get the following errors from our netscape v 3.0 browser:

"The requested item could not be loaded by the proxy.

A ntework error occurred: unable to connect ot server (TCP Error:32) The server may be
down or unreachable.  Try connecting again later.

Proxy server at hostname.xxx.com on port 8080."

hostname.xxx.com is our webserver which is inside the firewall.  in the fireall messages i
get a security alert on unserved port 8080.  i am running gauntlet 3.1 on a sparc20
SunOS 4.1.4 and have http configed by the boot.  i have http pointing to port 80, which is the 
default. we actually are proxying http through the internal web machine.  i have no idea what is 
going on here.  any help on this one would be apprieciated.

thanks,


von prahl

From firewalls-owner  Wed Feb  5 13:09:34 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA02432 for firewalls-outgoing; Wed, 5 Feb 1997 11:44:09 -0800 (PST)
Received: from mail.Germany.EU.net (mail.germany.eu.net [192.76.144.65]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id LAA02403 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 11:43:47 -0800 (PST)
Received: by mail.Germany.EU.net with ESMTP (5.59+:34/EUnetD-2.6.1.h) via EUnet
	id UAA02095; Wed, 5 Feb 1997 20:42:36 +0100
Received: (from smap@localhost) by prosecco. (fw-afx-1) id UAA37708 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 20:43:05 +0100
Received: from cerberus.ak.munich.ibm.com(9.23.4.12) by prosecco.munich.ibm.de via smap (V1.3)
	id sma031560; Wed Feb  5 20:42:51 1997
Received: from barolo.ak.munich.ibm.com (barolo.ak.munich.ibm.com [9.23.4.120]) by cerberus (8.8.3/8.7afx1) with ESMTP id UAA15602 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 20:42:19 +0100
Received: (from afx@localhost) by barolo (8.8.5/8.7afx2) id UAA17998; Wed, 5 Feb 1997 20:42:17 +0100
Message-ID: <19970205204217.OK44797@barolo.ak.munich.ibm.com>
Date: Wed, 5 Feb 1997 20:42:17 +0100
From: afx@ibm.de (Andreas Siegert)
To: firewalls@greatcircle.com (Firewall mailing list)
Subject: [sscherrer@cits.com: Source port filtering rules...]
X-Mailer: Mutt 0.59.1
Mime-Version: 1.0
X-Organisation: EMEA AIX Security CoC / AIX ATG IBM Germany
X-Address: Anzinger Strasse 29, 81671 Muenchen, Germany
X-Phone: 498945044509 (internal 9454509), Fax 4223
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Sorry, but that sounds bogus to me.
Of course one filters on both source and destination port!
The guys who send you mail probably set up the bogus sendmail low port option.
Not reccomended...
afx

-----Forwarded message from sscherrer@cits.com (Stephane Scherrer)-----

       access-list 130 permit tcp any gt 1023 FWIPaddress FWnetmask eq 25

It didn't sound wrong for me...except when a remote site contacted me
saying that they couldn't send us any Mail...
Furether investigation showed that their Mail packets in destination of
our Mail server had a source port below 1024... I reported the problem
to them and they investigate on their side...

Here lies the problem :
They were said by Checkpoint software (who installed their firewall
including a NAT) that we shouldn't filter incoming packets on the source
port !!!!

-----End of forwarded message-----

-- 
Andreas Siegert       afx@ibm.de / afx@barolo.ak.munich.ibm.com / AFX at IPNET
Every time we've moved ahead in IBM, it was because someone was willing to take
a chance, put his head on the block, and try something new - Thomas Watson, Jr.

From firewalls-owner  Wed Feb  5 13:20:37 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id MAA05038 for firewalls-outgoing; Wed, 5 Feb 1997 12:05:09 -0800 (PST)
Received: from gw.iai.com (gw.iai.com [206.64.157.62]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id MAA04926 for <firewalls@GreatCircle.com>; Wed, 5 Feb 1997 12:04:28 -0800 (PST)
Received: by gw.iai.com; id PAA12630; Wed, 5 Feb 1997 15:03:09 -0500 (EST)
Received: from milford.ma.iai.com(10.1.1.2) by gw.iai.com via smap (3.2)
	id xma012627; Wed, 5 Feb 97 15:02:47 -0500
Received: by milford.iai.com (AIX 4.1/UCB 5.64/4.03)
          id AA21770; Wed, 5 Feb 1997 15:03:13 -0500
From: jegan@iai.com (James Egan)
Message-Id: <9702052003.AA21770@milford.iai.com>
Subject: Re: SATAN user group?
To: firewalls@GreatCircle.com
Date: Wed, 5 Feb 1997 15:03:13 -0500 (EST)
In-Reply-To: <9702051543.AA08998@sonic.nmti.com.nmti.com> from "Peter da Silva" at Feb 5, 97 09:43:45 am
Reply-To: Jim.Egan@iai.com
Organization: Integrated Architectures, Inc.
Pgp-Fingerprint: 64 47 DC 51 D9 11 1D FF  31 43 9C 4C E2 A1 FC 04
Pgp-Public-Key: public-key-server@martigny.ai.mit.edu (subject: GET jegan) 
X-Mailer: ELM [version 2.4 PL24 ME5a]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Peter da Silva recently wrote:
> 
> > o Another nit is the choice of the name that was chosen.  In one stroke, 
> >    DF & WV managed to alienate those who are offended by the name "SATAN".  
> >    The name SATAN signifies the epitome of evil.  If the tool was intended
> >    to be used for good rather than evil purposes, the choice of the name 
> >    was the worst one possible.  I don't know the agenda behind the name,
> >    but I am curious why they chose that particular name than any of a
> >    multitude of other suitable names.
> 
> What, you mean like maybe "the Farmer Universal Cracking Kit"? <g>
> 
> 

Actually, the docs I saw a while back said if you didn't like SATAN then call
it SANTA.

/Jim/
--
James P. Egan                   | Jim.Egan@iai.com 
Integrated Architectures, Inc.  | http://www.iai.com 
300 East Main Street, Suite 207 | Tel: 508-634-3200 x209
Milford, MA  01757              | Fax: 508-634-8381
Use PGP for more secure email

From firewalls-owner  Wed Feb  5 13:34:28 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA29149 for firewalls-outgoing; Wed, 5 Feb 1997 11:20:12 -0800 (PST)
Received: from ALABAMA.CF.CS.YALE.EDU (RT-GW.CS.YALE.EDU [128.36.0.13]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id LAA29133 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 11:19:59 -0800 (PST)
From: long-morrow@CS.YALE.EDU
Received: from SPARKY.CF.CS.YALE.EDU by ALABAMA.CF.CS.YALE.EDU (8.7.1/res.host.cf-4.0)
	with ESMTP id OAA22917; Wed, 5 Feb 1997 14:18:33 -0500 (EST) sender long-morrow@CS.YALE.EDU for 
Received: by SPARKY.CF.CS.YALE.EDU (Sendmail-8.7.1/res.client.cf-4.0)
	id OAA27745; Wed, 5 Feb 1997 14:18:30 -0500 (EST)
Date: Wed, 5 Feb 1997 14:18:30 -0500 (EST)
Message-Id: <199702051918.OAA27745@SPARKY.CF.CS.YALE.EDU>
To: firewalls@greatcircle.com, mmk@bostongas.com
Subject: Re:  Sandbox?
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


From: "Kolenko, Marc" <mmk@bostongas.com>
>can some one give me the 2 minute drill on the architectural definition 
>of "SANDBOX"?

Though you speak of firewall DMZ configurations I've usually seen this
term (sandbox) used to refer to the rubber-walled "jail" environments
set up for software to run inside on a computer.

The computer may be a server in the example of a Web server process
running 'chroot()d' on a Unix machine -- and where even the CGI programs
spawned by http server run inside the 'defanged/neutered' chroot()
'sandbox' environment.

'sandbox' is also used to refer to the 'safe' mode the Java Virtual
Machine turns on when Java applets are run inside a Web browser
(ie. Netscape Navigator or MS IE) -- where local file I/O and most
network I/O is disabled.

- Morrow


From firewalls-owner  Wed Feb  5 16:33:39 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id PAA27419 for firewalls-outgoing; Wed, 5 Feb 1997 15:23:42 -0800 (PST)
Received: from travelers.mail.cornell.edu (TRAVELERS.MAIL.CORNELL.EDU [132.236.56.13]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id PAA27410 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 15:23:33 -0800 (PST)
From: nvs2@cornell.edu
Received: from travelers.mail.cornell.edu (travelers.mail.cornell.edu [132.236.56.13]) by travelers.mail.cornell.edu (8.7.5/8.7.3) with SMTP id SAA06190 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 18:22:07 -0500 (EST)
Date: Wed, 5 Feb 1997 18:22:06 -0500 (EST)
X-Sender: nvs2@travelers.mail.cornell.edu
To: firewalls@greatcircle.com
Subject: Packet Filter rules...
Message-ID: <Pine.SOL.3.91.970205181527.3915B-100000@travelers.mail.cornell.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,
I am implementing a firewall as a Master's project and I need to decide 
on rules for packet filtering. I have two questions to ask you folks:

(1) Can anyone suggest research papers/books/web documents on packet 
filtering?

(2) I was told that a packet filter should check for various combinations 
of :
Source Address, Destn Address, protocol, Source port, destn port

 and then decide if a packet should be let thro.
Also, this decision making has to be real fast so as not to introduce a 
considerable amount of overhead while routing the packet.
Does any one have any suggestions on how this can be done?

Thanks in advance

Nik.
----

From firewalls-owner  Wed Feb  5 16:34:18 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id PAA26934 for firewalls-outgoing; Wed, 5 Feb 1997 15:14:54 -0800 (PST)
Received: from tango.lightech.com.ar ([200.0.253.151]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id PAA26916 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 15:14:38 -0800 (PST)
Received: from salsa (router1-p14.pccp.com.ar [200.0.253.30]) by tango.lightech.com.ar (8.6.8.1/SCA-6.6)  with SMTP
	id XAA12867; Wed, 5 Feb 1997 23:03:29 GMT
Message-ID: <32F8BDB6.1630@lightech.com.ar>
Date: Wed, 05 Feb 1997 20:04:54 +0300
From: "Adrian F. Setton" <asetton@lightech.com.ar>
Reply-To: asetton@lightech.com.ar
Organization: LighTech
X-Mailer: Mozilla 3.0 (Win95; I)
MIME-Version: 1.0
To: Andreas Siegert <afx@ibm.de>
CC: Firewall mailing list <firewalls@greatcircle.com>
Subject: Re: [sscherrer@cits.com: Source port filtering rules...]
References: <19970205204217.OK44797@barolo.ak.munich.ibm.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Andreas Siegert wrote:
> Sorry, but that sounds bogus to me.
> Of course one filters on both source and destination port!
> The guys who send you mail probably set up the bogus sendmail low port option.
> Not reccomended...

Andreas,
I don't agree in this point.
Let me quote Firewalls & Internet Securiy from Bill Cheswick & Steve
Bellovin,
page 24, assuming that they will allow this little quote from this great
book
(marketing add., in order to avoid their lawyers)

"Most versions of TCP and UDP for UNIX systems enforce the rule that
only the superuser (root) can create a port numbered less than 1024.
These are privileged ports. The intent is that remote systems can trust
the authenticity of information written to such ports. The restriction
is a convention only, and is <i> not </i> required by the protocol
specification. Conforming implementations need not honor this."

Altough it is usual to put filtering rules using non-privileged ports as
the
only valid client ports, this is wrong and we should not blame the
remote user,
but change the filtering rules to allow this valid connections.
Regards ...
--
Adrian F. Setton
LighTech                        Voice:  (54-1) 373-1141
Ayacucho 563. Piso 13 Of. "A"   FAX:    (54-1) 373-1215
Buenos Aires                    e-mail: asetton@lightech.com.ar
Argentina                       URL:    http://www.lightech.com.ar

From firewalls-owner  Wed Feb  5 16:34:13 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA13663 for firewalls-outgoing; Wed, 5 Feb 1997 13:16:06 -0800 (PST)
Received: from fti.framatech.com ([160.84.80.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id NAA13629 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 13:15:49 -0800 (PST)
From: Thutchens@framatech.com
Received: by fti.framatech.com; id QAA25594; Wed, 5 Feb 1997 16:37:50 -0500
Received: from ftimail.framatech.com(160.84.100.246) by fti.framatech.com via smap (3.2)
	id xma025560; Wed, 5 Feb 97 16:37:40 -0500
Received: from ccmail.framatech.com (ccmail.framatech.com [160.84.100.247]) by ftimail.framatech.com (8.6.11/8.6.9) with SMTP id QAA04046; Wed, 5 Feb 1997 16:17:13 -0500
Received: from ccMail by ccmail.framatech.com (SMTPLINK V2.11.01)
	id AA855188085; Wed, 05 Feb 97 15:34:09 EST
Date: Wed, 05 Feb 97 15:34:09 EST
Message-Id: <9701058551.AA855188085@ccmail.framatech.com>
To: firewalls@GreatCircle.COM, "Kolenko, Marc" <mmk@bostongas.com>
Subject: Re: Sandbox?
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

     You're exactly right!


______________________________ Reply Separator _________________________________
Subject: Sandbox?
Author:  "Kolenko, Marc" <mmk@bostongas.com> at INTERNET
Date:    2/5/97 2:31 PM


Friends
     
can some one give me the 2 minute drill on the architectural definition 
of "SANDBOX"?
     
Does it relate to typical DMZ configurations usually alluded to in 
Firewall placement discussions?
     
thanks in advance
     
Marc
******************************************* 
Marc M. Kolenko, Boston Gas Co.
Strategic IT Planning
mkolenko@bostongas.com
     -or-
kolenko@tiac.net
617.723.5512; x-2669
*******************************************
     
-------------------------------------------------------------------------- 
---------
"The opinions expressed here are my own and 
do not represent the views or opinions of Boston Gas Co." 
-------------------------------------------------------------------------- 
---------
     


From firewalls-owner  Wed Feb  5 17:14:20 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA17121 for firewalls-outgoing; Wed, 5 Feb 1997 13:46:57 -0800 (PST)
Received: from reflections.mindspring.com (reflections.mindspring.com [204.180.142.192]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id NAA17097 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 13:46:39 -0800 (PST)
Received: from localhost (lists@localhost) by reflections.mindspring.com (8.7.6/8.7.3) with SMTP id QAA15733; Wed, 5 Feb 1997 16:45:17 -0500
Date: Wed, 5 Feb 1997 16:45:17 -0500 (EST)
From: Todd Graham Lewis <lists@reflections.mindspring.com>
To: Ron DuFresne <dufresne@parka.winternet.com>
cc: "Kolenko, Marc" <mmk@bostongas.com>, firewalls@GreatCircle.COM
Subject: Re: Sandbox?
In-Reply-To: <Pine.GSO.3.95q.970205125722.29324A-100000@parka.winternet.com>
Message-ID: <Pine.LNX.3.95.970205164159.13253C-100000@reflections.mindspring.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Wed, 5 Feb 1997, Ron DuFresne wrote:

> If I'm recalling things correctly, the sandbox mentioned and refered to is
> in reguards to chrooted systems.

Mostly, it refers to environments such as SafeTCL and Netscape's Java
implementation, wherein applets/tasks/processes run in a restricted
run-time environment (the Sandbox) where they have restricted access to
such facilities as network access, local file access, etc.  chroot()++, so
to speak.  This stops rogue Java applets from reading your password file
and sending it back to the server, etc.

See also, antonym, ActiveX.

__
Todd Graham Lewis          Mindspring Enterprises      tlewis@mindspring.com


From firewalls-owner  Wed Feb  5 17:16:17 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA17297 for firewalls-outgoing; Wed, 5 Feb 1997 13:47:51 -0800 (PST)
Received: from hermes.zynet.net (hermes.zynet.net [194.154.160.251]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id NAA17119 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 13:46:55 -0800 (PST)
Received: from Fred.zynet.co.uk (ex1-p5.zynet.co.uk [194.154.163.6]) by hermes.zynet.net (8.8.0/8.6.12) with SMTP id VAA07338 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 21:45:41 GMT
Message-ID: <32F8FF16.32BE@mail.zynet.co.uk>
Date: Wed, 05 Feb 1997 21:43:51 +0000
From: Kevin Townsend <kev-rhea@mail.zynet.co.uk>
Reply-To: kev-rhea@mail.zynet.co.uk
X-Mailer: Mozilla 3.0Gold (Win95; I)
MIME-Version: 1.0
To: firewalls@GreatCircle.COM
Subject: Re: [Fwd: Internal modems ?]
References: <32EFC6B0.41C67EA6@iphase.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Pierre-Yves Bonnetain wrote:
> >
> >    Hello you experts,
> >
> >    Maybe this subject has been dealt with to the point of sickness, but...
> >    One of my customers is looking for a _systematic_ way (well, as near as
> > possible, as usual) to detect if any internal user, on his network, may have
> > some modem attached to his computer (W95, OS/2 or Unix). I just told him that
> > this seemed dubious at most, but customers are customers.
> >    So, what is your opinion ?
> >    Tia,
> > --
> > -+-+ Pierre-Yves BONNETAIN (aka Pyb)


In April, Rhea Group will be launching a new Win 95 security product.
One of its features might possibly help. It doesn't detect modems - but
it can be used to prevent their use on all or specified workstations on
the network.

If you'd like any more info on this, mail me and I'll see to it.

Rgds

Kev


From firewalls-owner  Wed Feb  5 17:27:55 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA23464 for firewalls-outgoing; Wed, 5 Feb 1997 14:32:51 -0800 (PST)
Received: from mule0.mindspring.com (mule0.mindspring.com [204.180.128.166]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id OAA23417 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 14:32:35 -0800 (PST)
Received: from [207.69.170.17] (user-37kbahm.dialup.mindspring.com [207.69.170.54])
          by mule0.mindspring.com (8.8.4/8.8.4) with SMTP
	  id RAA05982 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 17:31:20 -0500
Date: Wed, 5 Feb 1997 17:31:20 -0500
X-Sender: pelicans@pop.mindspring.com
Message-Id: <v01540b0daf1e745e44a5@[207.69.170.17]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: Firewalls@GreatCircle.COM
From: pelicans@mindspring.com (BeachCruiser)
Subject: TEMPEST
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Joel wrote:

>Not really firewall related, but according to the Feds, TEMPEST is a
>codeword, and not an acronym that means anything.

You're right on the relevance.

However, some "Feds" nothwithstanding...

...as set forth in the classified SECRET NSA publication, "National
Communication Security Implementation Memorandum" (NACSIM 5100A)...

K.M. Goertzel and Jody Patilla have it exactly correct.


TEMPEST = Transient Electro-Magnetic Pulse Emanation STandard
          ^         ^       ^        ^     ^         ^^

//rmck







From firewalls-owner  Wed Feb  5 17:59:28 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA25476 for firewalls-outgoing; Wed, 5 Feb 1997 14:51:30 -0800 (PST)
Received: from mule0.mindspring.com (mule0.mindspring.com [204.180.128.166]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id OAA25467 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 14:51:10 -0800 (PST)
Received: from [207.69.170.17] (user-37kbahm.dialup.mindspring.com [207.69.170.54])
          by mule0.mindspring.com (8.8.4/8.8.4) with SMTP
	  id RAA45890 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 17:49:55 -0500
Date: Wed, 5 Feb 1997 17:49:55 -0500
X-Sender: pelicans@pop.mindspring.com
Message-Id: <v01540b0eaf1e7a91b99c@[207.69.170.17]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: Firewalls@GreatCircle.COM
From: pelicans@mindspring.com (BeachCruiser)
Subject: TEMPEST
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


K.M. Goertzel and Jody Patilla have it exactly correct.


TEMPEST = Transient Electro-Magnetic Pulse Emanation STandard
          ^         ^       ^        ^     ^         ^^

Sorry...so did Brett Lymn



Thread Dead.







From firewalls-owner  Wed Feb  5 18:03:19 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id QAA03452 for firewalls-outgoing; Wed, 5 Feb 1997 16:23:02 -0800 (PST)
Received: from csam.com.my (csam.csam.com.my [202.184.8.8]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id QAA03383 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 16:22:34 -0800 (PST)
Received: by csam.com.my (SMI-8.6/SMI-SVR4)
	id IAA25874; Thu, 6 Feb 1997 08:20:15 +0800
Date: Thu, 6 Feb 1997 08:20:14 +0800 (SGT)
From: Ng Yiu Cho - CSD SUNSSD <ycng@csam.com.my>
To: Colegio de Contadores <contanet@andromeda.tectel.com.mx>
cc: Firewalls@GreatCircle.COM
Subject: Re: hardware requeriment.
In-Reply-To: <01BC1369.07930260@port3.tectel.com.mx>
Message-ID: <Pine.SOL.3.91.970206081536.25707A-100000@csam>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Content-Transfer-Encoding: QUOTED-PRINTABLE
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi

There recommended hardware requirement that I would=20
suggest will be=20

CPU - Get a Pentium Processor 166 or better
Memory -  > 64MB Ram
Hard Disk - > 2.1 GB
Running using Solaris x86 2.5.1


....joey

On Wed, 5 Feb 1997, Colegio de Contadores wrote:

>=20
>=20
> Hello . Im new in the list , and i=B4d like to talk about=20
> Solaris Firewall .
>=20
>=20
> =09Wich is the recommended hardware for install this firewall
> =09over x86 plataform ?
>=20
> =09Procesor  ??
>=20
> =09Memory ?
>=20
> =09CPU clock ?
>=20
> =09Mi link is going to be a 128 kbps .
>=20
> =09Im thinking to use a vectra VE 486/66 of HP.
>=20
>=20
> =09Thanks for your comments.
>=20
>=20
>=20
> Israel Zavalza Bahena
> Contanet.
>=20
> =09
>=20

From firewalls-owner  Wed Feb  5 18:32:17 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA25369 for firewalls-outgoing; Wed, 5 Feb 1997 14:50:39 -0800 (PST)
Received: (mcb@localhost) by miles.greatcircle.com (8.8.5/Miles-960830-1) id OAA25303 for firewalls@greatcircle.com; Wed, 5 Feb 1997 14:50:16 -0800 (PST)
Received: from abyss.techsoft.com (abyss.techsoft.com [205.160.68.2]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id FAA16715 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 05:41:00 -0800 (PST)
Received: from cc:Mail (PU Serial #1520)
  by abyss.techsoft.com (PostalUnion/SMTP(tm) v2.1.9e for Windows NT(tm))
  id AA-1997Feb04.073438.1520.7012; Tue, 04 Feb 1997 07:35:41 -0600
From: kabernard@techsoft.com (KABERNARD)
Cc: firewalls@GreatCircle.COM (firewalls)
Message-ID: <1997Feb04.073438.1520.7012@abyss.techsoft.com>
X-Conversion-ID: <cc:Mail/#87732/TECHSOFT>
X-Mailer: cc:Mail via PostalUnion/SMTP for Windows NT
Mime-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable
Organization: Technical Software Services, Inc.
Date: Tue, 04 Feb 1997 07:35:41 -0600
Subject: Re: Poor NSA...Hells freezin' over again.
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

 If someone is unhappy with the level of testing that someone else has =
 performed on some firewall, then they must know something that was not =
 tested (or tested correctly).  If they want or need to know the =
 results of the correctly executed test(s), they should perform the =
 test. Then, they should post the results here, since that is supposed =
 to be the purpose of this list.  Unless of course the person who is =
 unhappy with someone else's work is unwilling to share his own =
 work.....
 =
 y/p kurt
 =
 =



From firewalls-owner  Wed Feb  5 18:52:24 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id QAA01744 for firewalls-outgoing; Wed, 5 Feb 1997 16:04:52 -0800 (PST)
Received: from pbm01.pacblue.com (pbm01.pacblue.com [199.182.109.200]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id QAA01706 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 16:04:35 -0800 (PST)
Received: by pbm01.pacblue.com with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63)
	id <01BC1379.A11CEFD0@pbm01.pacblue.com>; Wed, 5 Feb 1997 15:31:17 -0800
Message-ID: <c=US%a=_%p=Pacific_Blue_Mic%l=PBM01-970205233115Z-690@pbm01.pacblue.com>
From: Paul Osterwald <posterwald@pacblue.com>
To: "'Paul D. Robertson'" <proberts@clark.net>,
        "'Frank Willoughby'"
	 <frankw@in.net>
Cc: "'winspace@geko.net.au'" <winspace@geko.net.au>,
        "'firewalls@GreatCircle.COM'" <firewalls@GreatCircle.COM>
Subject: RE: SATAN user group?
Date: Wed, 5 Feb 1997 15:31:15 -0800
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

SATAN - Security Administrator's Tool for Analyzing Networks

>-----Original Message-----
>From:	Paul D. Robertson [SMTP:proberts@clark.net]
>Sent:	Tuesday, February 04, 1997 9:57 PM
>To:	Frank Willoughby
>Cc:	winspace@geko.net.au; firewalls@GreatCircle.COM
>Subject:	Re: SATAN user group?
>
>On Tue, 4 Feb 1997, Frank Willoughby wrote:
>
>> o The software was/is out-dated (even when it was released).  If you are 
>>    keeping your software current, then it is highly likely that your system
>>    will contain patches for vulnerabilities that the SANTA tool would
>>detect.
>
>From what I've heard, the 3rd pre-release was very agressive, and like 
>all tools, it needs to remain current.  
>
>>    because of problems in other areas, your system is vulnerable to being
>>    taken over - in spite of a report from SANTA that your system is OK.
>>    Use the right tool for the right job.  SANTA tests (primarily) the
>>    networking component, and it doesn't do that very well, IMHO.
>
>It's quite specifically targeted for networks.
>
>> 
>> o The SANTA tool performs a very small portion of the tests that ISS 
>>    and other vendors' products perform.  If it doesn't test for attacks
>>    such as SYN-flooding or the "Ping-of-death", then it can't tell you
>>    if these will be a problem for you or not.
>
>It's very difficult to run a denial-of-service attack without denying 
>service, don't you think?   Most of us who claim it doesn't do enough are 
>the same ones who would claim it did too much for the bad guys if it were 
>released with a more agressive suite of tests.
>
>> o A "clean bill of health" from the SANTA tool give the sysadmin a false 
>>    sense of security about the security of his/her systems.
>
>If they don't know what it does, and doesn't do.  This is true of *every* 
>analysis tool. 
>
>> o At best, the SANTA tool will tell the beginner sysadmin if they 
>>    have overlooked something basic, but beyond that, it is useless.
>
>It's extensible, and that's one of it's main features, if you don't grow 
>it, then yes, it's not much more than a rubber stamp for a limited set of 
>vulnerabilities, that's true of any analysis tool in a dynamic environment.
>
>> o Another nit is the choice of the name that was chosen.  In one stroke, 
>>    DF & WV managed to alienate those who are offended by the name "SATAN".
>>    The name SATAN signifies the epitome of evil.  If the tool was intended
>>    to be used for good rather than evil purposes, the choice of the name 
>>    was the worst one possible.  I don't know the agenda behind the name,
>>    but I am curious why they chose that particular name than any of a
>>    multitude of other suitable names.
>
>If the name of a program is that bad to someone, then I'd respectfully
>suggest that they're in the wrong line of work.  Given, if I recall 
>correctly, Dan's naming of a program Fuck!, SATAN could even be 
>considered a step up. :) 
>
>> o Further, since the source code is available, any sysadmin can add 
>>    custom modules to the tool (OTOH, so can the hackers).
>
>With a C compiler, any sysadmin can write nice helpful programs.  On the 
>other hand, evil hackers can write mean and nasty programs.  ?
>
>Paul
>-----------------------------------------------------------------------------
>Paul D. Robertson      "My statements in this message are personal opinions
>proberts@clark.net      which may have no basis whatsoever in fact."
>                                                                     PSB#9280
>

From firewalls-owner  Wed Feb  5 20:22:39 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id RAA06982 for firewalls-outgoing; Wed, 5 Feb 1997 17:01:09 -0800 (PST)
Received: from relay.hq.tis.com (relay.hq.tis.com [192.94.214.100]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id RAA06921 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 17:00:46 -0800 (PST)
Received: by relay.hq.tis.com; id UAA06099; Wed, 5 Feb 1997 20:00:30 -0500 (EST)
Received: from clipper.hq.tis.com(10.33.1.2) by relay.hq.tis.com via smap (3.2)
	id xma006088; Wed, 5 Feb 97 20:00:13 -0500
Received: from jupiter.hq.tis.com (jupiter.hq.tis.com [10.33.112.189]) by clipper.hq.tis.com (8.7.5/8.7.3) with SMTP id TAA00547; Wed, 5 Feb 1997 19:56:35 -0500 (EST)
From: Jody C Patilla <jcp@tis.com>
Message-Id: <199702060056.TAA00547@clipper.hq.tis.com>
Subject: Re: Packet Filter rules...
To: nvs2@cornell.edu
Date: Wed, 5 Feb 1997 19:56:38 -0500 (EST)
Cc: firewalls@greatcircle.com
In-Reply-To: <Pine.SOL.3.91.970205181527.3915B-100000@travelers.mail.cornell.edu> from "nvs2@cornell.edu" at Feb 5, 97 06:22:06 pm
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> Hi,
> I am implementing a firewall as a Master's project and I need to decide 
> on rules for packet filtering. I have two questions to ask you folks:
> 
> (1) Can anyone suggest research papers/books/web documents on packet 
> filtering?
> 

Chapter 6 of _Building Internet Firewalls_ from O'Reilly, by Chapman and
Zwicky, is the single best discussion of packet filtering that I have read
anywhere. I highly recommend it to all my customers. Brent and ELizabeth ought 
to be giving me a commission for the sales I've generated for them. :-)

- jcp

-- 
=========================================================================
Jody C. Patilla						jcp@tis.com
Trusted Information Systems				Glenwood, Md.


From firewalls-owner  Wed Feb  5 20:23:45 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id RAA07521 for firewalls-outgoing; Wed, 5 Feb 1997 17:04:16 -0800 (PST)
Received: from extra.infocable.cl (extra.infocable.cl [200.29.55.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id RAA07330 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 17:03:21 -0800 (PST)
Received: by extra.infocable.cl (951211.SGI.8.6.12.PATCH1042/951211.SGI.AUTO)
	for <firewalls@greatcircle.com> id WAA20501; Wed, 6 Nov 1996 22:06:13 -0800
Received: from intranet(192.10.1.2) by extra via smap (3.1)
	id xma020498; Wed, 6 Nov 96 22:06:12 -0800
Message-ID: <32817C54.41C6@infocable.cl>
Date: Wed, 06 Nov 1996 22:06:12 -0800
From: "Eduardo Romero U." <edo@intranet.infocable.cl>
Organization: Infocable Chile.
X-Mailer: Mozilla 3.0C-SGI (X11; I; IRIX 6.2 IP22)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: Re: http proxy problems / gauntlet
References: <199702051954.NAA17384@kafka.uprc.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Prahl V. E. (Von) wrote:
> 
> greetings,
> 
> we occasionally get the following errors from our netscape v 3.0 browser:
> 
> "The requested item could not be loaded by the proxy.
> [ common message of refused proxy ] 
> hostname.xxx.com is our webserver which is inside the firewall.  in the fireall messages i
> get a security alert on unserved port 8080.  i am running gauntlet 3.1 on a sparc20

few mounths ago have the same problem with gauntlet 3.1 [ sgi 5.3 - 6.2]
and the problem was in howto to determinate de metric value of gated
configuration, so the refused occurs when a make a first connection,
the same happens with telnet, ftp , any tcp-application , but when u try
to reconect , this was succesfull. The default metric is 0 , but i have
to reconfigurate the router of firewall's out network with a this metric
value in theirs routes with the local network.
 

> SunOS 4.1.4 and have http configed by the boot.  i have http pointing to port 80, which is the
> default. we actually are proxying http through the internal web machine.  i have no idea what is
> going on here.  any help on this one would be apprieciated.
> 
so hints : gated metric , router tables and ipfilter permissions.

> thanks,
> 
> von prahl

Edo.

From firewalls-owner  Wed Feb  5 20:34:19 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id TAA27703 for firewalls-outgoing; Wed, 5 Feb 1997 19:45:25 -0800 (PST)
Received: from fire.epa.nsw.gov.au (fire.EPA.NSW.GOV.AU [141.243.34.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id TAA27693 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 19:45:13 -0800 (PST)
Received: from airmoon.epa.nsw.gov.au by fire.epa.nsw.gov.au
 (PMDF V4.3-7 #6932) id <01IF3IRQOTAO003PR6@fire.epa.nsw.gov.au>; Thu,
 6 Feb 1997 13:35:48 +10:00
Received: from neptune.epa.nsw.gov.au (neptune [141.243.6.5])
 by airmoon.epa.nsw.gov.au (8.6.12/8.6.12) with SMTP id OAA20170 for
 <Firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 14:19:30 +1100
Date: Thu, 06 Feb 1997 13:45:15 +1100 (EST)
From: Mitko Stoyanov <mstoyan@airmoon.epa.nsw.gov.au>
Subject: Dynamic (per user) dial-in PPP IP filtering
In-reply-to: <c=US%a=_%p=sapient%l=SAPIENT/SMTPGATE/000909F3@galaxy.sapient.com>
X-Sender: mstoyan@neptune.epa.nsw.gov.au
To: Firewalls@GreatCircle.COM
Message-id: <Pine.LNX.3.95.970206132757.3870A-100000@neptune.epa.nsw.gov.au>
MIME-version: 1.0
Content-type: TEXT/PLAIN; charset=US-ASCII
Content-transfer-encoding: 7BIT
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Hi,

I am after any links or information which would help me to achieve the
above. The filter rules has to be dynamically inserted when the relevant
user logs in, and removed, when he/she logs out. There will be no more
than 4 - 8 groups of filter rules. There are multiple dial-in ports with
static IP addresses, and when the user logs out, only the rules regarding
the used port/IP address should be removed.I did it already with Linux
2.0.28, modified pppd and perl scripts, but was wondering if any other
solution exist already.

Anyone to share experience? Will summarize if the interest is enough.

Thanks in advance. 


From firewalls-owner  Wed Feb  5 20:52:31 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id TAA27278 for firewalls-outgoing; Wed, 5 Feb 1997 19:35:28 -0800 (PST)
Received: from mule0.mindspring.com (mule0.mindspring.com [204.180.128.166]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id TAA27271 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 19:35:19 -0800 (PST)
Received: from [207.69.170.17] (user-37kbah1.dialup.mindspring.com [207.69.170.33])
          by mule0.mindspring.com (8.8.4/8.8.4) with SMTP
	  id WAA69792; Wed, 5 Feb 1997 22:34:02 -0500
Date: Wed, 5 Feb 1997 22:34:02 -0500
X-Sender: pelicans@pop.mindspring.com
Message-Id: <v01540b1aaf1eb9697d60@[207.69.170.17]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: kabernard@techsoft.com (KABERNARD)
From: pelicans@mindspring.com (BeachCruiser)
Subject: Re: Poor NSA...Hells freezin' over again.
Cc: Firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> If someone is unhappy with the level of testing that someone else has
>performed on some firewall, then they must know something that was not
>tested (or tested correctly).  If they want or need to know the  results
>of the correctly executed test(s), they should perform the  test. Then,
>they should post the results here, since that is supposed  to be the
>purpose of this list.  Unless of course the person who is  unhappy with
>someone else's work is unwilling to share his own  work.....
>  y/p kurt

Yeah, understand your point...but I'm not sure that's really what was being
conveyed in the earlier gripe.

I've heard from alot of folks backchannel on this and my reading of the
"tea leaves" is it's not really unhappiness with the testing that's at
issue, but rather the depth and comprehensiveness of the evaluations beyond
what to many regard as rather academic findings and marketing bla-bla-bla.

Let's see where it goes from here.

//rmck









From firewalls-owner  Wed Feb  5 21:04:35 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id UAA00481 for firewalls-outgoing; Wed, 5 Feb 1997 20:32:42 -0800 (PST)
Received: from diablo.cisco.com (diablo.cisco.com [171.68.223.106]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id UAA00463 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 20:32:25 -0800 (PST)
Received: from clonvick-pc.cisco.com (sj-dial-3-28.cisco.com [171.68.179.29]) by diablo.cisco.com (8.8.5/CISCO.SERVER.1.2) with SMTP id UAA28974; Wed, 5 Feb 1997 20:31:15 -0800 (PST)
Message-Id: <2.2.32.19970206042809.006fb13c@diablo.cisco.com>
X-Sender: clonvick@diablo.cisco.com
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Wed, 05 Feb 1997 22:28:09 -0600
To: uskanbye@ibmmail.com, firewalls@GreatCircle.COM
From: Chris Lonvick <clonvick@cisco.com>
Subject: Re: DLSw (Data Link Switching) through a firewall
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello Mitchell,

>From RFC-1795:

---snip---
Wells & Bartky                                   [...at the end of Page 5]

RFC 1795                  Data Link Switching                 April 1995

   The default parameters associated with the TCP connections between
   Data Link Switches are as follows:

   Socket Family     AF_INET        (Internet protocols)
   Socket Type       SOCK_STREAM    (stream socket)
   Read Port Number  2065
   Write Port Number 2067
---/snip---

If you're just doing normal DLSw with TCP encapsulation, then you'll need 
to open these ports through your firewall.  If you're prioritizing this 
data by using the "priority" keyword in the DLSw remote peer statement, 
then the router will additionally open TCP ports 1981, 1982, and 1983.  

If your firewall is performing NAT, then this should still work (if you're not 
using any of the additional features of DLSw+), since none of the payload 
fields are dependent upon any of the TCP or IP fields.  However, I've been
told that Boarder Peers (part of DLSw+ from Cisco) won't work across a
NATificator since the payload of some of the packets contains the IP address 
of the dynamic peers.  This just means that you'll have to setup actual
peer statements.  

Beyond this, however, I'd examine the traffic you expect to send through your
firewall very carefully before committing to this.  Historically, SNA stuff is
pretty vital to an organization and all efforts should be made to keep this
from prying eyes.  You might want to encrypt this over a Virtual Private Network
between your firewalls.  NetBIOS/NetBEUI (the other reason for DLSw) is the 
encapsulation of a data stream into an evil, and non-routable protocol and 
should be eradicated.  (In my humble and personal opinion, of course ;-)  

Hope this helps,

Chris Lonvick
Cisco Systems
Consulting Engineering
Houston, TX, USA
+1-713-778-5663


At 01:53 PM 2/5/97 EST, uskanbye@ibmmail.com wrote:
>
>Question is how (or if) DLSw can be passed through a firewall (without
>opening up the entire network). Our WAN includes remotes sites that are
>running SNA encapsulated within IP (DLSw) via CISCO routers. We're
>hoping to NOT have to move them to pure IP before firewall
>implementation. Is anybody aware of implementation (or have done this)?
>Any/all advice appreciated.
>
>By the way, Eagle Raptor NT is the selected firewall...
>
>
>
>
>     --------KANSAS DEPARTMENT OF HEALTH & ENVIRONMENT---------
>     -----------------WWW.INK.ORG\PUBLIC\KDHE------------------
>     ----------Mills Bldg Suite 501 Topeka, KS 66612-----------
>     ---------Phone (913) 296-5643 FAX (913) 296-8943----------
>
>


From firewalls-owner  Wed Feb  5 21:18:55 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id SAA16586 for firewalls-outgoing; Wed, 5 Feb 1997 18:10:51 -0800 (PST)
Received: from snet ([202.190.59.4]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id SAA16541 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 18:10:27 -0800 (PST)
Received: from sos.dataprep.com.my by snet (SMI-8.6/SMI-SVR4)
	id KAA09431; Thu, 6 Feb 1997 10:17:48 -0800
Received: by sos.dataprep.com.my with Microsoft Mail
	id <01BC1416.3D1A48A0@sos.dataprep.com.my>; Thu, 6 Feb 1997 10:12:20 +-800
Message-ID: <01BC1416.3D1A48A0@sos.dataprep.com.my>
From: KENNETH PHANG <kent@dataprep.com.my>
To: "'Firewall digest'" <firewalls@greatcircle.com>
Subject: Security Design Issue 
Date: Thu, 6 Feb 1997 10:12:18 +-800
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi everybody,

	Recently i'm looking into some of the network security design issue =
which i need second opinion from you guys. One of my customer has a =
network that runs on the FR cloud with about 13 remote sites link up to =
their enterprise router in the HQ. Each of the link are running a T1 and =
share a sigle E1 link into the HQ with partially  mesh environment with =
OSPF. Probably you can look at the diagram below for better =
understanding:-

=09
		R1	R2	R3	R4	R.. Remote sites
		 |	 |	 |	 |	 |
		 |	 |	 |	 |	 | T1 link
		  \	 |	 |	 |	/
		    \	 |	 |	 |        /
		=09
			 (  Frame Relay	) _____________Internet

				 |    E1 link
				 R0			 R0 - HQ router
				 |			 R1 - Remote router site 1
				HQ			 R2 - Remote router site 2
				 |
				 |	LAN
		---------------------------------------------------

The FR provider already built their PVCs from all the remote sites to =
the HQ and another PVC from the HQ to the=20
Internet. The HQ enterprise router can support multiple IP address =
configuration onto the same physical SYNC and Ethernet interface. I've =
been ask what is the best way to protect the network environment with =
FW-1. Sensitive information flow from the remote sites to the HQ must be =
protected so as the treat from Internet. By the way the FW-1 is also =
required to provide NAT to the remote sites and the HQ LAN. The customer =
to utilise the E1 link both for the remote links so as the Internet =
link. I understand that this is not a very good idea especially for =
security point of view. Hope to hear from you'll soon. All your comments =
are highly appreciated.=20

Many thanz

Cheers
kent
				

From firewalls-owner  Wed Feb  5 21:20:01 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id TAA24736 for firewalls-outgoing; Wed, 5 Feb 1997 19:14:36 -0800 (PST)
Received: from ginger.vnet.net (ginger.vnet.net [166.82.1.69]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id TAA24705 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 19:14:19 -0800 (PST)
Received: from galip.hon.com (galip.vnet.net [166.82.174.200]) by ginger.vnet.net (8.8.4/8.8.2) with SMTP id WAA08736 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 22:13:46 -0500 (EST)
Received: from galip.hon.com (galip.hon.com [166.82.174.200]) by galip.hon.com (NTMail 3.02.10) with ESMTP id ia000216 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 22:09:00 -0500
Message-ID: <32F949B5.21FC@hon.com>
Date: Wed, 05 Feb 1997 22:02:13 -0500
From: Steve Gallipeau <Steve@hon.com>
Reply-To: Steve@hon.com
Organization: SDG Consulting
X-Mailer: Mozilla 3.0Gold (WinNT; I)
MIME-Version: 1.0
To: Firewalls@GreatCircle.COM
Subject: Email Crashed Mail Server!
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Info: Evaluation version at galip.hon.com
X-Info: Errors to Postmaster@hon.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

I received the following email (had to dig it out of my logs) that
crashed my Mail Server.  I would really appreciate anyone taking a look
at the headers and maybe be able to advise me why this crashed my server
and if it could have been intentional.  The 'To:' line in particular
looks very unusual.

Thanks,

Steve
SDG Consulting

----------------------------------------------------------------------
Received: from cliffy.lfwc.lockheed.com (cliffy.lfwc.lockheed.com
[143.114.72.1]) by galip.hon.com (NTMail 3.02.10) with ESMTP id Steve
for <STEVE@HON.COM>; Wed, 5 Feb 1997 21:46:32 -0500
Received: from mailhub by cliffy.lmtas.lmco.com (SMI-8.6/SMI-SVR4)
	id UAA25797; Wed, 5 Feb 1997 20:49:17 -0600
Received: from smtpgate.lmtas.lmco.com by mailhub (SMI-8.6/SMI-SVR4)
	id UAA13466; Wed, 5 Feb 1997 20:42:43 -0600
Received: by smtpgate.lmtas.lmco.com (AlisaMail V05.1-000d) 
    id Megw.4950221 ; Wed, 5 Feb 1997 20:47:36 -0600
Message-ID: <Megw.4950221@smtpgate.lmtas.lmco.com>
Date: Wed, 05 Feb 1997 19:33:00 -0600
From: "Hammons, Steven W" <HMMNSW@SMTPGATE.lmtas.lmco.com>
Subject: test 1
To: STEVE@HON.COM,
       
"27#e##034#Steve_Hammons#034##c##c#26#e##034#STEVE_HAMMONS#034##c##c#25#e#SMTP"@SMTPGATE.lmtas.lmco.com,
        HMMNSW@SMTPGATE.lmtas.lmco.com
X-Info: Evaluation version at galip.hon.com
X-Info: Errors to Postmaster@hon.com


Date      :  5-FEB-1997 19:33:00.00
Posted on :  5-FEB-1997 19:33:00.00
this is to 
"26=("Steve Hammons"
HMMNSWAB@smtpgate.lmtas.lmco.com)::25=smtp"@smtpgate



----------
Received: from mailhub.lmtas.lmco.com by smtpgate.lmtas.lmco.com
        with SMTP (AlisaMail M05.1-000) 
        id SINN.1737164@smtpgate.lmtas.lmco.com ; Wed, 5 Feb 1997
20:12:17 -0600
Received: from smtpgate.lmtas.lmco.com by mailhub (SMI-8.6/SMI-SVR4)
        id UAA13290; Wed, 5 Feb 1997 20:07:03 -0600
Received: by smtpgate.lmtas.lmco.com (AlisaMail V05.1-000d) 
    id Megw.4949841 ; Wed, 5 Feb 1997 20:07:48 -0600
Message-ID: <Megw.4949841@smtpgate.lmtas.lmco.com>
Date: Wed, 05 Feb 1997 19:33:00 -0600
From: "Hammons, Steven W" <HMMNSWAB@SMTPGATE.lmtas.lmco.com>
Subject: test 1
To: "Steve Hammons"HMMNSWAB@smtpgate.lmtas.lmco.com


From firewalls-owner  Wed Feb  5 21:52:49 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id QAA05537 for firewalls-outgoing; Wed, 5 Feb 1997 16:49:03 -0800 (PST)
Received: (mcb@localhost) by miles.greatcircle.com (8.8.5/Miles-960830-1) id QAA05525 for firewalls@greatcircle.com; Wed, 5 Feb 1997 16:48:53 -0800 (PST)
Received: from darkstar.sysinfo.com (darkstar.sysinfo.com [204.246.65.62]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id KAA21006 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 10:02:55 -0800 (PST)
Received: from localhost (dufresne@localhost [127.0.0.1]) by darkstar.sysinfo.com (8.8.2/8.8.2) with SMTP id MAA15107; Wed, 5 Feb 1997 12:03:23 -0600
Date: Wed, 5 Feb 1997 12:03:23 -0600 (CST)
From: "R. DuFresne" <dufresne@darkstar.sysinfo.com>
To: linux-security@redhat.com
cc: BUGTRAQ@NETSPACE.ORG, Firewalls@GreatCircle.COM
Subject: Re: [linux-security] Re: Re: Linux virus
In-Reply-To: <199702051433.OAA02123@snowcrash.cymru.net>
Message-ID: <Pine.LNX.3.95.970205115852.14711B-100000@darkstar.sysinfo.com>
Organization: Minn. Information Systems
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Wed, 5 Feb 1997, Alan Cox wrote:

> > 	In any event -- McAfee may be able to add this to 
> > 	their existing uvscan product.  uvscan scan Linux
> > 	filesystems for DOS and Windows (including Word Macro)
> > 	viruses.   It may be possible for the AV team to 
> > 	simply add bliss' signature to the next release -- and
> > 	it may even be possible for them to create a remover.
> 
> I've had a look at the algorithms used for this "Bliss" toy. Its quite
> interesting as its a completely portable technique. It works for NT
> DLL's it works for all Unixen.
> 
> Tripwire pretty much immediately spots such tampering.
> 


I find this aspect of 'portability' interesting.  One of the security
weinies where I'm presently contracted <folks here make great use of NT>
made a claim in a class he was teaching, that it's far to costly to write
viri for 32bit OS'.  Since the class wasn't about viri, and this side
issue was brought up for just a short note, I chose not at the time to
challenge the issue.  Anyone willing to share some clues with folks like
me here?

thanks, my best to all,

Ron Dufresne
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
	admin & senior consultant:  darkstar.sysinfo.com
		  http://darkstar.sysinfo.com
"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
	***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D.  Just don't touch anything.



From firewalls-owner  Wed Feb  5 22:53:18 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id WAA21247 for firewalls-outgoing; Wed, 5 Feb 1997 22:47:16 -0800 (PST)
Received: from glacier.wise.edt.ericsson.se (glacier-ext.wise.edt.ericsson.se [193.180.251.38]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id WAA21186 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 22:47:01 -0800 (PST)
Received: from curtis.nmac.ericsson.se (curtis.nmac.ericsson.se [130.100.187.66]) by glacier.wise.edt.ericsson.se (8.7.5/8.7.3/glacier-0.9) with SMTP id HAA10890 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 07:45:52 +0100 (MET)
Received: by curtis.nmac.ericsson.se (SMI-8.6/SMI-SVR4)
	id HAA13071; Thu, 6 Feb 1997 07:43:28 +0100
Date: Thu, 6 Feb 1997 07:43:28 +0100
From: etxrosd@nmac.ericsson.se (Robert Stahlbrand)
Message-Id: <199702060643.HAA13071@curtis.nmac.ericsson.se>
To: firewalls@greatcircle.com
Subject: Configuring SecureID in FW-1
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-MD5: JvNWURNsNKqUy4vORm/n2g==
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi everyone!

I'm trying to configure secureID for users who uses my telnet proxy in 
Checkpoints FW-1 ver.2.1 but it doesn't seem to work. What I'm trying to 
configure is this.....

We have a modempool outside our firewall and if the users need access to our 
intranet I thought that secureID would be an easy way for the users to login. It 
seems to be pretty safe and pretty easy for the users. I use the telnet (ftp, 
http as well) proxy function so the users must pass through the proxy to enter 
the internal network. I have configured a number of users and it's no problem 
with UNIX passwords, Internal passwords or S/Key but I don't get the 
secureID-function to work!!! And how should it work??? I got a card but I don't 
see where I should put in the serial-number for the card in the firewall!!! How 
will the firewall be able to understand which card the user have got? I 
understand that the FW must be time synchronized because the secureID card 
changes the displayed number every 10 seconds. When I choose secureID in the 
user setup I am prompted for nothing else???

My FW-1 handbook says nothing about secureID (almost nothing). Do you have to 
buy an extra license or something???

###########################################################
#                 Robert Stahlbrand                       #
# Network and System Administrator OPLab and NMAC domains #
#                                                         #
#                 Ericsson Telecom AB                     #
#                      Box 333                            #
#                   43184 Molndal                         #
#                      Sweden                             #
#                  +46 31 7476162                         #
#                  +46 31 7472942 (fax)                   #
#                                                         #
#              robert@nmac.ericsson.se                    #
###########################################################

From firewalls-owner  Thu Feb  6 01:19:08 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id BAA29874 for firewalls-outgoing; Thu, 6 Feb 1997 01:04:09 -0800 (PST)
Received: from didahp1.deis.unibo.it (didahp1.deis.unibo.it [137.204.56.18]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id AAA29578 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 00:59:43 -0800 (PST)
Message-Id: <199702060859.AAA29578@miles.greatcircle.com>
Received: by didahp1.deis.unibo.it
	(1.37.109.4/16.2) id AA14101; Thu, 6 Feb 97 10:58:08 +0100
From: Rebecca Montanari - tesista Corradi <rebecca@didahp1.deis.unibo.it>
Subject: problem with TIS on Solaris2.5
To: firewalls@greatcircle.com
Date: Thu, 6 Feb 97 10:58:08 MET
Mailer: Elm [revision: 70.85]
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I'm installing TIS toolkit on Solaris2.5 and
I'm having lots of problems in compiling it
and making it work.
Has anyone compiled TIS toolkit on the same OS
and can I have suggestions on what I have to do?
Thanks in advance
Rebecca

From firewalls-owner  Thu Feb  6 01:49:25 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id BAA02971 for firewalls-outgoing; Thu, 6 Feb 1997 01:36:35 -0800 (PST)
Received: from gk-blue.unicc.org (gk-red.unicc.org [192.91.247.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id BAA02953 for <Firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 01:36:25 -0800 (PST)
From: admin@unicc.org
Received: by gk-blue.unicc.org; (5.65v3.2/1.3/10May95) id AA15958; Thu, 6 Feb 1997 10:37:38 +0100
Received: by gh-old.unicc.org (5.65/jsb-190694);
	id AA07401; Thu, 6 Feb 1997 10:37:42 +0100
Message-Id: <9702060937.AA07401@gh-old.unicc.org>
To: Firewalls@GreatCircle.COM
Subject: PPTP and Firewalls 
Date: Thu, 06 Feb 97 10:37:36 +0100
X-Mts: smtp
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Does anybody knows how I can use PPTP to a RAS server that is behind a firewall?

I can install a generic relay, but I do not know on with port. I have godd Unix 
knowledge, but wiht Windows NT I feel a bit lost ....



Thanks, Lili

From firewalls-owner  Thu Feb  6 03:19:15 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id DAA10370 for firewalls-outgoing; Thu, 6 Feb 1997 03:16:03 -0800 (PST)
Received: from ibmmail.COM (ibmmail.com [199.171.26.3]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id DAA10357 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 03:15:56 -0800 (PST)
From: gblolmxb@ibmmail.com
Message-Id: <199702061115.DAA10357@miles.greatcircle.com>
Received: from ibmmail by ibmmail.COM (IBM VM SMTP V2R3) with BSMTP id 1568;
   Thu, 06 Feb 97 06:14:50 EST
Date: Thu, 06 Feb 1997 06:13:52 EST
To: firewalls@greatcircle.com
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Subject: Firewall 1 & Bay Routers
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


     I understand that Bay are planning to incorporate checkpoint's
     firewall-1 within their router's s/w. My gut reaction is that this is
     not a Good Idea - any comments?

     Mark.

From firewalls-owner  Thu Feb  6 04:19:24 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id EAA13509 for firewalls-outgoing; Thu, 6 Feb 1997 04:05:12 -0800 (PST)
Received: from relay-7.mail.demon.net (relay-7.mail.demon.net [194.217.242.9]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id EAA13489 for <Firewalls@greatcircle.com>; Thu, 6 Feb 1997 04:04:56 -0800 (PST)
Received: from scio.demon.co.uk ([158.152.150.17]) by relay-5.mail.demon.net
           id aa529371; 6 Feb 97 10:13 GMT
From: Mike Blaser <Mike@scio.demon.co.uk>
To: Firewalls@greatcircle.com
Subject: Charge-Back
Date: Thu, 06 Feb 1997 10:12:59 GMT
Organization: Vertex Data Systems Ltd.
Reply-To: mike@scio.demon.co.uk
Message-ID: <32f98158.13483437@post.demon.co.uk>
X-Mailer: Forte Agent .99g/32.326
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

A question for all you corporate types out there.

Does anyone use the reporting capabilities of their firewall to allocate
costs to individual depratments/users so as to enable a charge-back
structure for internet usage?  Do most firewalls allow reporting on this
sort of basis or would a seperate package have to be used, in which case
which ones are out there and what do people recommend?

Cheers

Mike
--
Mike Blaser  -  IT Security Analyst                 mike@scio.demon.co.uk
Vertex Data Science Ltd                               +44 (0) 1925 236831
TA29, Dawson House                 Comments and opinions are those of the
Great Sankey, Warrington, UK    author and not of Vertex Data Science Ltd

From firewalls-owner  Thu Feb  6 04:34:28 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id EAA14344 for firewalls-outgoing; Thu, 6 Feb 1997 04:23:43 -0800 (PST)
Received: from gfw.siemens.co.za ([196.27.60.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id EAA14334 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 04:23:15 -0800 (PST)
Received: by gfw.siemens.co.za; id OAA09709; Thu, 6 Feb 1997 14:19:13 +0200
Received: from unknown(150.207.254.15) by gfw.siemens.co.za via smap (V3.1.1)
	id xmaa09703; Thu, 6 Feb 97 14:19:10 +0200
Received: by sparkex.siemens.co.za with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63)
	id <01BC1439.1F1962A0@sparkex.siemens.co.za>; Thu, 6 Feb 1997 14:22:02 +0200
Message-ID: <c=ZA%a=TELKOM400%p=SCN%l=SPARKEX-970206122200Z-22789@sparkex.siemens.co.za>
From: "Sizer, Kevin" <KevinS@Siemens.co.za>
To: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: Gauntlet ver 3.12
Date: Thu, 6 Feb 1997 14:22:00 +0200
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Any ideas on how to crack this number? All in the cause of a better
system.
KevinS

From firewalls-owner  Thu Feb  6 05:05:04 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id EAA14918 for firewalls-outgoing; Thu, 6 Feb 1997 04:34:57 -0800 (PST)
Received: from castle.us-state.gov (castle.us-state.gov [198.76.102.19]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id EAA14896 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 04:34:33 -0800 (PST)
From: crumrig@us-state.gov
Received: by castle.us-state.gov; id AA15140; Thu, 6 Feb 97 07:33:05 EST
Received: from pubhost.us-state.gov(198.76.102.34) by castle.us-state.gov via smap (V1.3mjr)
	id sma015125; Thu Feb  6 07:32:16 1997
Received: by pubhost.us-state.gov; id AA14976; Thu, 6 Feb 97 07:32:07 EST
Date: Thu,  6 Feb 97 07:21:06 PST
Subject: RE: Packet Filter rules... 
To: firewalls@greatcircle.com, nvs2@cornell.edu
X-Mailer: Chameleon ENGP1, TCP/IP for Windows, NetManage Inc.
Message-Id: <Chameleon.970206073120.gary@crumrig.fadpc.im,us-state.gov>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Try going to the mountain and speaking with GOD.  Markus Ranum has his security white papers located at www.v-one.com.  I assume you know who Markus Ranum is, if not then you should take up some other major, like basket weaving or such.  Actually, I am just kidding.  As you probably know, Markus wrote FW Toolkit.  He is now working at v-one and all of his stuff is there for reading.  I also would suggest hitting the NCSA's website and getting ahold of some of the books they have for sale..  Lastly, a packet filter router, is a very good tool, and should be a part of any system that is being implimented.  And, it possibly could manage to work for small to medium operations, but they are not a Firewall in hte truest sense of the word.  Now there are some nice features that CISCO will try and sell you, but when it comes to proxy services, and configurability AND reporting, then true dual homed proxy firewalls are the only way to go Period!  Packet filters are good as tools as p!
art of a bigger system, but that i
s all.  Besides the lack of reporting on a router, I could kill your router with traffic and have free reign on your system while the router is rebooting itself.  As far as speed goes, don't worry about it.  Unless of sourse you have 2ooo node lan, all using http and sending a million messages an hour.
---------------Original Message---------------
Hi,
I am implementing a firewall as a Master's project and I need to decide 
on rules for packet filtering. I have two questions to ask you folks:

(1) Can anyone suggest research papers/books/web documents on packet 
filtering?

(2) I was told that a packet filter should check for various combinations 
of :
Source Address, Destn Address, protocol, Source port, destn port

 and then decide if a packet should be let thro.
Also, this decision making has to be real fast so as not to introduce a 
considerable amount of overhead while routing the packet.
Does any one have any suggestions on how this can be done?

Thanks in advance

Nik.
----


----------End of Original Message----------



From firewalls-owner  Thu Feb  6 05:19:46 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id FAA17799 for firewalls-outgoing; Thu, 6 Feb 1997 05:00:07 -0800 (PST)
Received: from mailsrv1.pcy.mci.net (mailsrv1.pcy.mci.net [204.71.0.43]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id EAA17751 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 04:59:48 -0800 (PST)
Received: from mikeep01.wachovia.com (usr16-dialup40.Atlanta.mci.net)
 by MAIL-CLUSTER.PCY.MCI.NET (PMDF V5.0-7 #10044)
 id <01IF36ZMAOFK8WWBWS@MAIL-CLUSTER.PCY.MCI.NET>; Thu,
 06 Feb 1997 07:58:46 -0500 (EST)
Received: from mikeep01.wachovia.com (usr16-dialup40.Atlanta.mci.net)
 by MAIL-CLUSTER.PCY.MCI.NET (PMDF V5.0-7 #10045)
 id <01IF36YY39QQ8Y58AJ@MAIL-CLUSTER.PCY.MCI.NET>; Thu,
 06 Feb 1997 07:58:02 -0500 (EST)
Date: Thu, 06 Feb 1997 07:54:34 +0000
From: Mike Parsons <109j9jph6ig4@mail04.internetMCI.com>
Subject: Re: Firewall 1 & Bay Routers
To: firewalls@greatcircle.com, gblolmxb@ibmmail.com
Reply-to: mike.parsons@internetmci.com
Message-id: <01IF36YYF3GK8Y58AJ@MAIL-CLUSTER.PCY.MCI.NET>
MIME-version: 1.0
X-Mailer: Pegasus Mail for Win32 (v2.42a)
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Comments: Authenticated sender is <109j9jph6ig4@mail04.internetMCI.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

It can have its advantages.  The Checkpoint 1 software can offer 
significant improvement to the packet filtering capabilities of a 
router that is serving the role of a screening router on the 
perimeter.

At the risk of causing undue discussion, though, I still feel obliged 
to point out that this should be in conjunction with a real proxy 
host.  I have my inate paranoia to protect 8^).

From firewalls-owner  Thu Feb  6 05:40:54 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id FAA20358 for firewalls-outgoing; Thu, 6 Feb 1997 05:23:40 -0800 (PST)
Received: from anaf04.amsterdam.nl ([145.222.17.29]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id FAA20292 for <FireWalls@GreatCircle.com>; Thu, 6 Feb 1997 05:23:14 -0800 (PST)
Received: from anaf01.amsterdam.nl ([145.222.33.39]) by anaf04.amsterdam.nl (8.6.12/8.6.9) with SMTP id OAA22775 for <FireWalls@GreatCircle.com>; Thu, 6 Feb 1997 14:03:31 +0100
Received: from AMSTERDAM-Message_Server by anaf01.amsterdam.nl
	with Novell_GroupWise; Thu, 06 Feb 1997 14:23:54 +0100
Message-Id: <s2f9e97a.075@anaf01.amsterdam.nl>
X-Mailer: Novell GroupWise 4.1
Date: Thu, 06 Feb 1997 14:21:41 +0100
From: Ewout Meij <BSD02.EMEIJ@anaf01.amsterdam.nl>
Reply-To: BSD02.EMEIJ@anaf01.amsterdam.nl
To: FireWalls@GreatCircle.com
Subject: Other protocols
Mime-Version: 1.0
Content-Type: text/plain
Content-Disposition: inline
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Great think-tank:

Is there anybody outthere who does this:

   |----- LAN 1 -----| with: IPX/SPX-TCP/IP-DEC-IBM
        |
       FW
        |
     |----- LAN 2 -----| with: TCP/IP only
                   |
                  FW
                   |
   |----- LAN 3 -----| with: IPX/SPX-TCP/IP-DEC-IBM

And yes there needs to be comm. between the LAN1 & LAN3 on all the 
mentioned protocols... is there any FW's on the marked thar are
'especaily' good at this? Am I in fact looking for a bunch of proxies?

As I am claiming your time anyway here is the next: what about this
config:

   |---net1---|TCP/IP only
        |
       FW
        |
   |---net2---| SPX/IPX only
        |
       FW
        |
   |---net3---|TCP/IP only

Does this sounds like anything you've come across? and what about it?

Ewout Meij

Contrary to popular belief, Unix is user friendly. 
It just happens to be very selective about who it decides to make friends with.

From firewalls-owner  Thu Feb  6 05:59:56 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id FAA22168 for firewalls-outgoing; Thu, 6 Feb 1997 05:42:56 -0800 (PST)
Received: from pdx1.world.net (pdx1.world.net [192.243.32.18]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id FAA22153 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 05:42:44 -0800 (PST)
From: proff@suburbia.net
Received: from suburbia.net (suburbia.net [203.4.184.1]) by pdx1.world.net (8.7.5/8.7.3) with SMTP id FAA09342 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 05:43:01 -0800 (PST)
Received: (qmail 1429 invoked by uid 110); 6 Feb 1997 13:41:13 -0000
Message-ID: <19970206134113.1427.qmail@suburbia.net>
Subject: Re: Packet Filter rules...
In-Reply-To: <Chameleon.970206073120.gary@crumrig.fadpc.im,us-state.gov> from "crumrig@us-state.gov" at "Feb 6, 97 07:21:06 am"
To: crumrig@us-state.gov
Date: Fri, 7 Feb 1997 00:41:13 +1100 (EST)
Cc: firewalls@greatcircle.com
X-Mailer: ELM [version 2.4ME+ PL28 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Try going to the mountain and speaking with GOD.  Markus Ranum has

As much as one may respect MJR, God doesn't write buffer over-runs in
firewalls.

--
Prof. Julian Assange  |If you want to build a ship, don't drum up people
		      |together to collect wood and don't assign them tasks
proff@iq.org          |and work, but rather teach them to long for the endless
proff@gnu.ai.mit.edu  |immensity of the sea. -- Antoine de Saint Exupery

From firewalls-owner  Thu Feb  6 06:35:42 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA25041 for firewalls-outgoing; Thu, 6 Feb 1997 06:10:12 -0800 (PST)
Received: from deere-bh.dx.deere.com (deere-bh.dx.deere.com [207.122.201.66]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA25031 for <Firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 06:10:03 -0800 (PST)
Received: (from uucp@localhost) by deere-bh.dx.deere.com (8.6.12/8.6.11) id IAA03423; Thu, 6 Feb 1997 08:10:07 -0600
Received: from 192.43.1.3 by deere-bh.dx.deere.com via smap (V1.3)
	id sma003149; Thu Feb  6 08:09:42 1997
Received: from 90.deere.com (dts.90.deere.com) by deere.dx.deere.com (4.1/SMI-4.0)
	id AA28511; Thu, 6 Feb 97 08:08:22 CST
Received: from t47up.90.deere.com by 90.deere.com (SMI-8.6/SMI-SVR4)
	id IAA17023; Thu, 6 Feb 1997 08:05:51 -0600
Message-Id: <32F9E5C6.287C@90.deere.com>
Date: Thu, 06 Feb 1997 08:08:06 -0600
From: Bertrum Carroll <bc17684@90.deere.com>
Organization: Deere & Company
X-Sender: Bertrum Carroll <bc17684@90.deere.com>
X-Mailer: Mozilla 4.0b1 (Win95; I)
Mime-Version: 1.0
To: admin@unicc.org
Cc: Firewalls@GreatCircle.COM
Subject: Re: PPTP and Firewalls
X-Priority: Normal
References: <9702060937.AA07401@gh-old.unicc.org>
Content-Type: multipart/mixed; boundary="----------511E25927B301"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

This is a multi-part message in MIME format.
------------511E25927B301
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=us-ascii

Does anyone know how to do PPTP with out the 255  or 254 concurrent 
user limit in RAS ?
------------511E25927B301
Content-Transfer-Encoding: 7bit
Content-Description: Address Book Card for Bertrum Carroll
Content-Disposition: inline; filename="nsmailCE.TMP"
Content-Type: text/x-vCard; charset=us-ascii; name="nsmailCE.TMP"

BEGIN:VCARD
FN:Bertrum Carroll
N:Carroll;Bertrum
EMAIL;INTERNET:bc17684@90.deere.com
NOTE:Deere & Company Computer Security
X-NAV-HTML:T
END:VCARD


------------511E25927B301--


From firewalls-owner  Thu Feb  6 07:06:35 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA26217 for firewalls-outgoing; Thu, 6 Feb 1997 06:16:42 -0800 (PST)
Received: from callisto.lif.icnet.uk (callisto.lif.icnet.uk [143.65.100.5]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA26135 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 06:16:12 -0800 (PST)
Received: from localhost
           by callisto.lif.icnet.uk with SMTP(5.65v3.0/6.2); Thu, 6 Feb 1997 14:12:26 GMT
Date: Thu, 6 Feb 1997 14:12:26 +0000 (GMT)
From: John Hopkins <hopkins@icrf.icnet.uk>
X-Sender: hopkins@callisto.lif.icnet.uk
To: proff@suburbia.net
Cc: crumrig@us-state.gov, firewalls@greatcircle.com
Subject: Re: Packet Filter rules...
In-Reply-To: <19970206134113.1427.qmail@suburbia.net>
Message-Id: <Pine.OSF.3.93.970206141143.8018B-100000@callisto.lif.icnet.uk>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hmm.
	I don't know of a firewall package that God has written. 

John Hopkins


On Fri, 7 Feb 1997 proff@suburbia.net wrote:

> > Try going to the mountain and speaking with GOD.  Markus Ranum has
> 
> As much as one may respect MJR, God doesn't write buffer over-runs in
> firewalls.
> 
> --
> Prof. Julian Assange  |If you want to build a ship, don't drum up people
> 		      |together to collect wood and don't assign them tasks
> proff@iq.org          |and work, but rather teach them to long for the endless
> proff@gnu.ai.mit.edu  |immensity of the sea. -- Antoine de Saint Exupery
> 


From firewalls-owner  Thu Feb  6 07:25:53 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA03304 for firewalls-outgoing; Thu, 6 Feb 1997 07:14:35 -0800 (PST)
Received: from ultra1.dreamscape.com (ultra1.dreamscape.com [206.64.128.7]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id HAA03295 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 07:14:27 -0800 (PST)
Received: from bertha (sa2.dreamscape.com [206.114.183.131])
          by ultra1.dreamscape.com (8.8.5/8.8.4) with ESMTP
	  id KAA29422 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 10:14:24 -0500 (EST)
Message-ID: <32F9F533.64D2@dreamscape.com>
Date: Thu, 06 Feb 1997 10:13:55 -0500
From: "Steven E. Matkoski" <matkoski@dreamscape.com>
Organization: Blue Cross Blue Shield of CNY
X-Sender: "Steven E. Matkoski" <matkoski@dreamscape.com>
X-Mailer: Mozilla 4.0b1 (WinNT; I)
MIME-Version: 1.0
To: Firewall mailing list <firewalls@greatcircle.com>
Subject: Guantlet on Solaris: Installation question.
X-Priority: Normal
Content-Type: multipart/alternative; boundary="----------34855444F6A2"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


------------34855444F6A2
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=us-ascii

Hi,

I am about to start installing Guantlet on Solaris 2.5.1 and wondered if
there was anything
I should do to harden the OS before installation?

--
Thanks!
-steve.
matkoski@dreamscape.com


------------34855444F6A2
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset=us-ascii

<HTML><BODY>

<DT>Hi,</DT>

<DT>&nbsp;</DT>

<DT>I am about to start installing Guantlet on Solaris 2.5.1 and wondered
if there was anything</DT>

<DT>I should do to harden the OS before installation?</DT>

<DT><BR>
--&nbsp;<BR>
Thanks!<BR>
-steve.<BR>
matkoski@dreamscape.com<BR>
&nbsp;</DT>

</BODY>
</HTML>
------------34855444F6A2--


From firewalls-owner  Thu Feb  6 07:43:12 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA29047 for firewalls-outgoing; Thu, 6 Feb 1997 06:37:58 -0800 (PST)
Received: from homeport.org (lighthouse.homeport.org [205.136.65.198]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id GAA29003 for <firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 06:37:33 -0800 (PST)
Received: (adam@localhost) by homeport.org (8.8.5/8.6.9) id JAA26381; Thu, 6 Feb 1997 09:33:01 -0500 (EST)
From: Adam Shostack <adam@homeport.org>
Message-Id: <199702061433.JAA26381@homeport.org>
Subject: Re: Packet Filter rules...
In-Reply-To: <19970206134113.1427.qmail@suburbia.net> from "proff@suburbia.net" at "Feb 7, 97 00:41:13 am"
To: proff@suburbia.net
Date: Thu, 6 Feb 1997 09:33:00 -0500 (EST)
Cc: crumrig@us-state.gov, firewalls@GreatCircle.COM
X-Mailer: ELM [version 2.4ME+ PL27 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

proff@suburbia.net wrote:
| > Try going to the mountain and speaking with GOD.  Markus Ranum has
| 
| As much as one may respect MJR, God doesn't write buffer over-runs in
| firewalls.

	God doesn't write firewalls.  Anyone who can create a world in
7 days can clearly secure every app on their entire network.  He just
uses a couple of packet filters to cause endless philisophical
arguments about 'can god create a network so large that he can't
secure it?'

Adam
-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume



From firewalls-owner  Thu Feb  6 07:59:26 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA07789 for firewalls-outgoing; Thu, 6 Feb 1997 07:39:15 -0800 (PST)
Received: from cptech.com (tanis.tiac.net [204.215.141.78]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id HAA07773 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 07:39:06 -0800 (PST)
Received: by cptech.com (5.x/SMI-SVR4)
	id AA04434; Thu, 6 Feb 1997 10:37:40 -0500
Date: Thu, 6 Feb 1997 10:37:40 -0500
From: dcosio@tanis.cptech.com (Dave Cosio)
Message-Id: <9702061537.AA04434@cptech.com>
To: firewalls@greatcircle.com
Subject: Re: Firewall 1 & Bay Routers
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



If you think about it. A firewall is nothing more
than a secure router. With varing levels of security.
Why would you want to waste hardware resource on a 
full-blown O.S (UNIX or Nt) on a router. I think this
is a great idea. I suspect you will get good-great security
with excellent performance. 


-------------------------------------------------------------------------------

Dave Cosio					Corporate Technologies Inc.
Systems Consultant				Tel 508.459.2420 x20
Network Security and Systems Integrators        100 foot of John Street
http://www.cptech.com				Lowell Massachusetts

"Make mine a Smutty"  -Smuttynose Brewing Co slogan.
                                        



From firewalls-owner  Thu Feb  6 08:30:55 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA07623 for firewalls-outgoing; Thu, 6 Feb 1997 07:37:43 -0800 (PST)
Received: from europa.lif.icnet.uk (europa.lif.icnet.uk [143.65.100.4]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id HAA07420 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 07:36:55 -0800 (PST)
From: harley@icrf.icnet.uk
Message-Id: <199702061536.HAA07420@miles.greatcircle.com>
Received: by europa.lif.icnet.uk; Thu, 6 Feb 1997 15:35:50 GMT
Subject: Re: Packet Filter rules...
To: hopkins@icrf.icnet.uk (John Hopkins)
Date: Thu, 6 Feb 1997 15:35:50 +0000 (GMT)
Cc: firewalls@greatcircle.com
In-Reply-To: <Pine.OSF.3.93.970206141143.8018B-100000@callisto.lif.icnet.uk> from "John Hopkins" at Feb 6, 97 02:12:26 pm
X-Mailer: ELM [version 2.4 PL23]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> Hmm.
> 	I don't know of a firewall package that God has written. 
> 
> John Hopkins
> 

Why should SATAN have all the best tunes? B-)

-- 
David Harley                     \   |   /                 alt.comp.virus FAQ
D.Harley@icrf.icnet.uk            \  |  /               & Anti-Virus Web Page
Support & Security Analyst         \ | /         Folk London On-Line gig-list
Imperial Cancer Research Fund   ____\|/____   http://webworlds.co.uk/dharley/


From firewalls-owner  Thu Feb  6 08:31:05 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA04990 for firewalls-outgoing; Thu, 6 Feb 1997 07:25:03 -0800 (PST)
Received: from andromeda.tectel.com.mx (andromeda.tectel.com.mx [200.23.62.194]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id HAA04920 for <Firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 07:24:44 -0800 (PST)
Received: from port10.tectel.com.mx ([200.23.62.138])
          by andromeda.tectel.com.mx (Netscape Mail Server v2.0) with SMTP
          id AAA7178; Thu, 6 Feb 1997 09:14:22 -0600
Received: by port10.tectel.com.mx with Microsoft Mail
	id <01BC140F.CFE09C40@port10.tectel.com.mx>; Thu, 6 Feb 1997 09:26:20 -0600
Message-ID: <01BC140F.CFE09C40@port10.tectel.com.mx>
From: Colegio de Contadores <contanet@andromeda.tectel.com.mx>
To: "'Ng Yiu Cho - CSD SUNSSD'" <ycng@csam.com.my>
Cc: "Firewalls@GreatCircle.COM" <Firewalls@GreatCircle.COM>
Subject: RE: hardware requeriment.
Date: Thu, 6 Feb 1997 09:07:04 -0600
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



----------
De:     	Ng Yiu Cho - CSD SUNSSD[SMTP:ycng@csam.com.my]
Enviado: 	jueves 6 de febrero de 1997 2:20
Para:   	Colegio de Contadores
Cc: 	Firewalls@GreatCircle.COM
Asunto:     	Re: hardware requeriment.

Hi

There recommended hardware requirement that I would 
suggest will be 

CPU - Get a Pentium Processor 166 or better
Memory -  > 64MB Ram
Hard Disk - > 2.1 GB


****************************************************************************************


Why that amount of Hard Disk ?


	is it not enough 450 M for O.S. and the firewall itself ?


	Thanks for your answer .....



	oooppp.... pardon .. How can I suscribe to the list ?

	




From firewalls-owner  Thu Feb  6 08:32:34 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA28203 for firewalls-outgoing; Thu, 6 Feb 1997 06:29:42 -0800 (PST)
Received: from lint.cisco.com (lint.cisco.com [171.68.223.44]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id GAA28124 for <FireWalls@GreatCircle.COM>; Thu, 6 Feb 1997 06:29:19 -0800 (PST)
Received: from big-dogs.cisco.com ([171.68.53.75]) by lint.cisco.com (8.8.5/CISCO.SERVER.1.2) with SMTP id GAA22877; Thu, 6 Feb 1997 06:27:52 -0800 (PST)
Message-Id: <3.0.32.19970206092745.006bf1ac@lint.cisco.com>
X-Sender: pferguso@lint.cisco.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Thu, 06 Feb 1997 09:27:52 -0500
To: BSD02.EMEIJ@anaf01.amsterdam.nl
From: Paul Ferguson <pferguso@cisco.com>
Subject: Re: Other protocols
Cc: FireWalls@GreatCircle.COM
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 02:21 PM 2/6/97 +0100, Ewout Meij wrote:

>Great think-tank:
>
>Is there anybody outthere who does this:
>
>   |----- LAN 1 -----| with: IPX/SPX-TCP/IP-DEC-IBM
>        |
>       FW
>        |
>     |----- LAN 2 -----| with: TCP/IP only
>                   |
>                  FW
>                   |
>   |----- LAN 3 -----| with: IPX/SPX-TCP/IP-DEC-IBM
>
>And yes there needs to be comm. between the LAN1 & LAN3 on all the 
>mentioned protocols... is there any FW's on the marked thar are
>'especaily' good at this? Am I in fact looking for a bunch of proxies?
>

Sounds like a practical job for a good multiprotocol router with
filtering capabilities, but that's just my opinion.

- paul



--
Paul Ferguson                                           ||        ||
Consulting Engineering                                  ||        ||
Herndon, Virginia   USA                                ||||      ||||
tel: +1.703.397.5938                               ..:||||||:..:||||||:..
e-mail: pferguso@cisco.com                         c i s c o S y s t e m s

From firewalls-owner  Thu Feb  6 09:27:47 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA28343 for firewalls-outgoing; Thu, 6 Feb 1997 06:31:33 -0800 (PST)
Received: from sage.Cypher-Sage.COM ([206.41.182.5]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA28328 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 06:31:18 -0800 (PST)
From: bkatzung@Cypher-Sage.COM
Received: by sage.Cypher-Sage.COM
	(?/BK-2.3.1) id IAA09755; Thu, 6 Feb 1997 08:28:48 -0600
Date: Thu, 6 Feb 1997 08:28:48 -0600
Message-Id: <199702061428.IAA09755@sage.Cypher-Sage.COM>
To: lwhitty@LANcomp.COM
Subject: Re: FW1 Address translation installation on multiple inspection module hosts
Cc: firewalls@greatcircle.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>Date: Tue, 4 Feb 1997 12:26:49 -0500 (EST)
>From: Lee Whitty <lwhitty@LANcomp.COM>
>
>I'm working with a customer running FW1 V2.1 on 2 firewalls. [...]
>I need to be able to install the same rule set on both machines, but
>load a different address translation filter on each. [...] Is there
>any way to have seperate translation tables and a common ruleset,
>and install them in one step?

The translation is performed by INSPECT segment register 15, which can be
loaded independently for any host and interface combination.  The code
for the general case looks something like this:

// Firewall "a" and it's standby clone
fwa_hosts=hosts{
	fwa, fwa_stdby
};

// A's external interface
fwa_ext_ifs=interfaces{
	le0
};

// A's external interface translation(s)
fwa_ext_trans={
	<... HIDE ...>,
	<... SRC_STATIC ...>
};

<> fwa_ext_ifs@fwa_hosts
	set sr15 fwa_ext_trans;

// A's DMZ interface(s)
fwa_dmz_ifs=interfaces{
	qe0, qe1
};

// A's DMZ translation(s)
fwa_dmz_trans={
	<... DST_STATIC ...>
};

<> fwa_dmz_ifs@fwa_hosts
	set sr15 fwa_dmz_trans;

// Firewall "b"
fwb_hosts=host{
	fwb
};

// [Continue by defining fwb_..._ifs and fwb_..._trans, etc. and install
// them based on the interfaces and hosts as above.]


  -- Brian Katzung  bkatzung@Cypher-Sage.COM

From firewalls-owner  Thu Feb  6 09:36:26 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA00422 for firewalls-outgoing; Thu, 6 Feb 1997 06:47:44 -0800 (PST)
Received: from portal.west.saic.com (portal.west.saic.com [198.151.12.15]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA00332 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 06:47:16 -0800 (PST)
Received: from escort.sigtech.saic.com ([139.121.146.51]) by portal.west.saic.com
          via smtpd (for miles.greatcircle.com [198.102.244.34]) with SMTP; 6 Feb 1997 14:46:10 UT
Received: from falcon.cist.saic.com by escort (4.1/SMI-4.1)
	id AA07616; Thu, 6 Feb 97 09:45:09 EST
Message-Id: <9702061445.AA07616@escort>
From: "Chris Kostick" <christopher.t.kostick@cpmx.saic.com>
To: <firewalls@greatcircle.com>
Subject: Re: Packet Filter rules...
Date: Thu, 6 Feb 1997 09:43:49 -0500
X-Msmail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1155
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> > Try going to the mountain and speaking with GOD.  Markus Ranum has
> 
> As much as one may respect MJR, God doesn't write buffer over-runs in
> firewalls.

BTW, Marcus spells his name with a C.
--
Chris


From firewalls-owner  Thu Feb  6 10:09:34 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA26801 for firewalls-outgoing; Thu, 6 Feb 1997 06:19:54 -0800 (PST)
Received: from bicc00.bi.ehu.es (bicc00.bi.ehu.es [158.227.65.40]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA26728 for <firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 06:19:29 -0800 (PST)
Received: from bipt71.bi.ehu.es by bicc00.bi.ehu.es (AIX 3.2/UCB 5.64/4.03)
          id AA29398; Thu, 6 Feb 1997 15:22:16 GMT
Message-Id: <3.0.1.32.19970206151811.0069c320@bicc00.bi.ehu.es>
X-Sender: jtpjatae@bicc00.bi.ehu.es
X-Mailer: Windows Eudora Light Version 3.0.1 beta 12 (32)
Date: Thu, 06 Feb 1997 15:18:11 +0100
To: firewalls@GreatCircle.COM
From: Eduardo Jacob <jtpjatae@bicc00.bi.ehu.es>
Subject: NEC Socks V5
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Has anybody had experiences with the above?. I have beeen impressed by the
way both security (encripted link) and user authentication is got (at least
in domestic version, domestic there...).

I was thinking about securing access from mobile PC that get each time a
different IP address and name (due to the ISP to use). So I must relay on
user authentication with ID cards, OPIE or SKEY, instead of IP address or
DNS names. 

I would also get an encrypted tunnel for all access to the server so I
could use directly unsecured applications.

Sadly it seems this is restricted to the USA only version.

Does anybody know of any implementation for Linux that has this
capabilities? Or at least a version with the authentication and encription
facilities not removed. Or a Bones version?

	Best regards.

	Eduardo




-------------------------------------------------------
Eduardo Jacob - Area de Ingenier'ia Telem'atica
Departamento de Electr'onica y Telecomunicaciones
ETSII y de IT               Tel: +34-(9)4-427 8055
UPV / EHU                   Fax: +34-(9)4-441 4041
Alda Urquijo s/n         E-mail: jtpjatae@bi.ehu.es
E-48013 - Bilbao (Spain)       : 100021,2212 Compuserve
Ham: EA2BAJ          VHF PACKET: EA2BAJ @ EA2URV



From firewalls-owner  Thu Feb  6 10:11:22 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA12537 for firewalls-outgoing; Thu, 6 Feb 1997 08:23:06 -0800 (PST)
Received: from stortek.stortek.com (stortek.com [129.80.22.249]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id IAA12528 for <firewalls@GreatCircle.Com>; Thu, 6 Feb 1997 08:22:59 -0800 (PST)
Received: from coltano.stortek.com (coltano.stortek.com [129.80.40.2]) by stortek.stortek.com (8.8.4/8.7.3) with ESMTP id JAA04232 for <firewalls@GreatCircle.Com>; Thu, 6 Feb 1997 09:21:44 -0700 (MST)
Received: (from jim@localhost)
	by coltano.stortek.com (8.8.5/8.8.5) id JAA05056;
	Thu, 6 Feb 1997 09:21:43 -0700 (MST)
Date: Thu, 6 Feb 1997 09:21:43 -0700 (MST)
From: Jim Wamsley 303-673-8163 <jim@coltano.stortek.com>
Message-Id: <199702061621.JAA05056@coltano.stortek.com>
To: firewalls@GreatCircle.Com
Subject: Re: TEMPEST
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

You're all wrong 

NCSC Pub 1 defines tempest as a short title for the study of unintentional, 
possibly compromising, spurious emanations.  

take it as gospel folks - they originated it.  according to folklore, when
it was discovered that EMI could be captured and analyzed, the resulting
furor and panic was likened to a tempest in a teapot.  hence the short title.


 > From firewalls-owner@GreatCircle.COM Wed Feb  5 19:25 MST 1997
 > Date: Wed, 5 Feb 1997 17:49:55 -0500
 > X-Sender: pelicans@pop.mindspring.com
 > Mime-Version: 1.0
 > To: Firewalls@GreatCircle.COM
 > From: pelicans@mindspring.com (BeachCruiser)
 > Subject: TEMPEST
 > 
 > 
 > K.M. Goertzel and Jody Patilla have it exactly correct.
 > 
 > 
 > TEMPEST = Transient Electro-Magnetic Pulse Emanation STandard
 >           ^         ^       ^        ^     ^         ^^
 > 
 > Sorry...so did Brett Lymn
 > 
 > 
 > 
 > Thread Dead.
 > 


From firewalls-owner  Thu Feb  6 10:52:35 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA00602 for firewalls-outgoing; Thu, 6 Feb 1997 06:49:22 -0800 (PST)
Received: from sage.Cypher-Sage.COM ([206.41.182.5]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA00520 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 06:48:55 -0800 (PST)
From: bkatzung@Cypher-Sage.COM
Received: by sage.Cypher-Sage.COM
	(?/BK-2.3.1) id IAA09778; Thu, 6 Feb 1997 08:44:52 -0600
Date: Thu, 6 Feb 1997 08:44:52 -0600
Message-Id: <199702061444.IAA09778@sage.Cypher-Sage.COM>
To: etxrosd@nmac.ericsson.se
Subject: Re: Configuring SecureID in FW-1
Cc: firewalls@greatcircle.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>Date: Thu, 6 Feb 1997 07:43:28 +0100
>From: etxrosd@nmac.ericsson.se (Robert Stahlbrand)
>
>I'm trying to configure secureID for users who uses my telnet proxy in 
>Checkpoints FW-1 ver.2.1 but it doesn't seem to work. [...]
>I have configured a number of users and it's no problem with UNIX
>passwords, Internal passwords or S/Key but I don't get the
>secureID-function to work!!! [...] I got a card but I don't see where
>I should put in the serial-number for the card in the firewall!!! How
>will the firewall be able to understand which card the user have got? I
>understand that the FW must be time synchronized because the secureID card
>changes the displayed number every 10 seconds. When I choose secureID in the
>user setup I am prompted for nothing else???
>
>My FW-1 handbook says nothing about secureID (almost nothing). Do you have
>to buy an extra license or something???

You need to install the SecurID client (from SecurID) for the operating
system you are using (eg, SunOS, NT) on the FW-1 machine.  FW-1 will see
the client's configuration files and call the client libraries.  It will
pass the FW-1 user name to the ACE server, so just authorize that user (or
a group containing that user) for the FW-1 host (client) in the ACE
configuration.

The token assignment and time synchronization all gets handled by the
ACE server software "black box".  FW-1 doesn't know or care about it.

  -- Brian Katzung  bkatzung@Cypher-Sage.COM

From firewalls-owner  Thu Feb  6 10:53:04 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA10450 for firewalls-outgoing; Thu, 6 Feb 1997 08:03:56 -0800 (PST)
Received: from brimstone.rnb.com (brimstone.rnb.com [204.178.80.14]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id IAA10435 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 08:03:48 -0800 (PST)
Received: by brimstone.rnb.com; id LAA14398; Thu, 6 Feb 1997 11:02:38 -0500 (EST)
Received: from relay.rnb.com(199.99.101.2) by brimstone.rnb.com via smap (3.2)
	id xma014377; Thu, 6 Feb 97 11:02:33 -0500
Received: from monarch.rnb.com (monarch [150.1.33.146])
          by relay.rnb.com (8.8.4/8.8.4) with SMTP
	  id LAA18382 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 11:02:32 -0500 (EST)
Comments: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Comments: Internet Message: Sender identity is not verified.
Comments: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Date: Thu, 6 Feb 1997 11:01:00 -0500 (EST)
From: Ken Kempster <kempster@monarch.rnb.com>
To: Firewalls <firewalls@greatcircle.com>
Subject: Gauntlet 3.2 on Solaris 2.5.1 server
Message-ID: <Pine.SOL.3.95.970206105652.2705A-100000@monarch.rnb.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Has anyone had success installing Gauntlet 3.2
on Solaris 2.5.1 server?

After doing the pkgadd, everything seems to be broken.
here are some of the highlights:
1)can't communicate with anything off my local segment
2)openwindows hangs.
3)none of the proxies work;  all hang.
etc.

My hardware config. is a Sparc ultra with Solaris 2.5.1 server.

Does anyone know of any issues with 2.5.1 and Gauntlet 3.2?

any help would be great

thanx.

|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|  Ken Kempster                 kempster@monarch.rnb.com  |
|  Network Systems Engineer          _\|/_                |
|  Republic National Bank            (o o)                |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~oOO-(_)-OOo~~~~~~~~~~~~~~


From firewalls-owner  Thu Feb  6 11:02:37 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA15073 for firewalls-outgoing; Thu, 6 Feb 1997 08:38:56 -0800 (PST)
Received: from xyzzy.plugh.edmonton.ab.ca (xyzzy.plugh.edmonton.ab.ca [198.161.22.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id IAA15009 for <firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 08:38:26 -0800 (PST)
Received: (from uucp@localhost) by xyzzy.plugh.edmonton.ab.ca (8.6.12/8.6.9) id JAA04556; Thu, 6 Feb 1997 09:37:06 -0700
Received: from snouts-gw.obtuse.com(192.168.30.61), claiming to be "snouts.obtuse.com"
 via SMTP by mailhost.plugh.edmonton.ab.ca, id smtpd04547aaa; Thu Feb  6 09:36:55 1997
Received: (from beck@localhost) by snouts.obtuse.com (8.7.5/8.7.3) id JAA02220; Thu, 6 Feb 1997 09:36:58 -0700
From: Bob Beck <beck@obtuse.com>
Message-Id: <199702061636.JAA02220@snouts.obtuse.com>
Subject: Re: Packet Filter rules...
To: adam@homeport.org (Adam Shostack)
Date: Thu, 6 Feb 1997 09:36:57 -0700 (MST)
Cc: proff@suburbia.net, crumrig@us-state.gov, firewalls@GreatCircle.COM
In-Reply-To: <199702061433.JAA26381@homeport.org> from "Adam Shostack" at Feb 6, 97 09:33:00 am
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> 	God doesn't write firewalls.  Anyone who can create a world in
> 7 days can clearly secure every app on their entire network.  He just
> uses a couple of packet filters to cause endless philisophical
> arguments about 'can god create a network so large that he can't
> secure it?'
>

	According to scripture God trusted the users too much and
didn't have every app secured. He ended up having to expel users from
the system after they violated the conditions of use.

> 
> Adam
  ^^^^-- Anyone with that name oughta know that ;-)

	-Bob

--
Bob Beck					 Obtuse Systems Corporation
beck@obtuse.com					 http://www.obtuse.com/	
True Evil hides its real intentions in its street address. Search and you
shall find it, and the truth shall set you free.
	

From firewalls-owner  Thu Feb  6 11:34:32 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA29972 for firewalls-outgoing; Thu, 6 Feb 1997 06:45:33 -0800 (PST)
Received: from chronos.synopsys.com (chronos.synopsys.com [146.225.8.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA29964 for <Firewalls@greatcircle.com>; Thu, 6 Feb 1997 06:45:25 -0800 (PST)
Received: from atropos.synopsys.com by chronos.synopsys.com with SMTP id AA29874
  (5.65c/IDA-1.4.4 for <Firewalls@greatcircle.com>); Thu, 6 Feb 1997 06:44:19 -0800
Received: from flying.synopsys.com (flying.synopsys.com [146.225.72.11])
  by atropos.synopsys.com (8.6.9/8.6.9) with ESMTP id GAA16876; Thu, 6 Feb 1997 06:44:18 -0800
From: Habeeb Qadri <habeeb@Synopsys.COM>
Received: by flying.synopsys.com (SMI-8.6/SNPS-Sol2)
	id GAA05591; Thu, 6 Feb 1997 06:44:37 -0800
Date: Thu, 6 Feb 1997 06:44:37 -0800
Message-Id: <199702061444.GAA05591@flying.synopsys.com>
To: Firewalls@greatcircle.com, mike@scio.demon.co.uk
Subject: Re: Charge-Back
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Mike:

I know that the next version of CheckPoint's Firewall-1 (3.0) has:

"Network Usage Accounting: Provides data on session lengths and bytes transmitted"

This data could then be input into a charge-back program.

Habeeb Qadri
Security Admin
Synopsys, Inc
Mountain View, CA, USA
	
> From postmaster@synopsys.com  Thu Feb  6 04:41:37 1997
> From: Mike Blaser <Mike@scio.demon.co.uk>
> To: Firewalls@greatcircle.com
> Subject: Charge-Back
> Date: Thu, 06 Feb 1997 10:12:59 GMT
> Mime-Version: 1.0
> Content-Transfer-Encoding: quoted-printable
> 
> A question for all you corporate types out there.
> 
> Does anyone use the reporting capabilities of their firewall to allocate
> costs to individual depratments/users so as to enable a charge-back
> structure for internet usage?  Do most firewalls allow reporting on this
> sort of basis or would a seperate package have to be used, in which case
> which ones are out there and what do people recommend?
> 
> Cheers
> 
> Mike
> --
> Mike Blaser  -  IT Security Analyst                 mike@scio.demon.co.uk
> Vertex Data Science Ltd                               +44 (0) 1925 236831
> TA29, Dawson House                 Comments and opinions are those of the
> Great Sankey, Warrington, UK    author and not of Vertex Data Science Ltd

From firewalls-owner  Thu Feb  6 11:56:02 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA11004 for firewalls-outgoing; Thu, 6 Feb 1997 08:09:04 -0800 (PST)
Received: from ALABAMA.CF.CS.YALE.EDU (RT-GW.CS.YALE.EDU [128.36.0.13]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id IAA10995 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 08:08:51 -0800 (PST)
From: long-morrow@CS.YALE.EDU
Received: from SPARKY.CF.CS.YALE.EDU by ALABAMA.CF.CS.YALE.EDU (8.7.1/res.host.cf-4.0)
	with ESMTP id LAA10236; Thu, 6 Feb 1997 11:06:45 -0500 (EST) sender long-morrow@CS.YALE.EDU for 
Received: by SPARKY.CF.CS.YALE.EDU (Sendmail-8.7.1/res.client.cf-4.0)
	id LAA00909; Thu, 6 Feb 1997 11:06:43 -0500 (EST)
Date: Thu, 6 Feb 1997 11:06:43 -0500 (EST)
Message-Id: <199702061606.LAA00909@SPARKY.CF.CS.YALE.EDU>
To: firewalls@greatcircle.com, hopkins@icrf.icnet.uk, proff@suburbia.net
Subject: Re: Packet Filter rules...
Cc: crumrig@us-state.gov
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


So sayeth John Hopkins:
>	I don't know of a firewall package that God has written. 

You mean you never heard of the 'RedSea(TM)' firewall system?  One of
the most effective ever created for keeping nasty intruders out :-)

Or the Jericho(TM) firewall penetration suite and the Noah'/Lot(R) (as
in "know a lot" 'bout many different virii :-) anti-virus product :-?
Noah'/Lot(R) is the ultimate solution for disinfecting systems known to
be hopelessly infected...

Of course, everyone knows by now that archangels SATAN and Gabriel have
gotten into the business, both releasing complementary network security
products under their own names.  It won't be long before mere angelic
creatures (Cherubim and Seraphim) begin breaking off on their own to
form consultancies to license, distribute and install these and other
commercial firewall products (FW-1, FWTK, Gauntlet, NEC PNG, etc.).

Even some of the disciples have also gotten into the act, Paul (famous
author of many books in the "Letter to the ..." series) is purportedly
working on a book for IDG Communications ("Firewalls for Dummies") and
Matthew, Mark, Luke and John are working on a "virtual-DMZ-in-a-box"
solution called "Purgatory(TM)".

- Morrow (Totally tongue-in-cheek :-)


From firewalls-owner  Thu Feb  6 11:58:57 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA15832 for firewalls-outgoing; Thu, 6 Feb 1997 08:47:05 -0800 (PST)
Received: from Walden.MO.NET (walden.mo.net [199.250.196.5]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id IAA15775 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 08:46:26 -0800 (PST)
Received: from gate.hussmann.com (gate.hussmann.com [205.139.246.2]) by Walden.MO.NET (8.8.3/8.6.10) with ESMTP id KAA03422; Thu, 6 Feb 1997 10:44:19 -0600 (CST)
Received: (from nobody@localhost) by gate.hussmann.com (8.7.1/8.7.3) id KAA24017; Thu, 6 Feb 1997 10:44:25 -0600
Message-Id: <199702061644.KAA24017@gate.hussmann.com>
Received: from mail-gate.hussmann.com(129.1.5.4) by gate.hussmann.com via smap (V1.3)
	id tmp024010; Thu Feb  6 10:43:55 1997
Date: Thu, 6 Feb 1997 10:42:00 -0600
From: "Hicks, Rick" <RHicks@hussmann.com>
Subject: RE: Security Design Issue
To: "'Firewalls List'" <firewalls@greatcircle.com>
Cc: "'kent@dataprep.com.my'" <kent@dataprep.com.my>
X-Mailer: Worldtalk (NetConnex V4.00a)/MIME
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


>The FR provider already built their PVCs from all the remote sites to =
>the HQ and another PVC from the HQ to the=20
>Internet. The HQ enterprise router can support multiple IP address =
>configuration onto the same physical SYNC and Ethernet interface. I've =
>been ask what is the best way to protect the network environment with =
>FW-1. Sensitive information flow from the remote sites to the HQ must be   
=
>protected so as the treat from Internet. By the way the FW-1 is also =
>required to provide NAT to the remote sites and the HQ LAN. The customer   
=
>to utilise the E1 link both for the remote links so as the Internet =
>link. I understand that this is not a very good idea especially for =
>security point of view. Hope to hear from you'll soon. All your comments   
=
>are highly appreciated.

Disclaimer:  I am not very familiar with FW-1.

You will need to apply access-lists, both input and output, on the   
Internet PVC's sub-interface.  This input list should, as always, deny   
incoming packets with a source IP address that is internal to your   
network; deny IP spoofing.  You also need to make sure that all incoming   
packets have a destination for FW-1 ONLY, all other packets should be   
denied.

*very* simple example:

access-list 101 deny ip <internal network> <wildcard mask> any
access-list 101 permit ip any host <FW-1 address>
<implicit deny>

The output list should make sure that outgoing traffic is only allowed   
from FW-1.  This should also be taken care of by making sure you use a   
static route to the ISP on the Internet PVC and the default route on the   
router, if you need one, points to FW-1, NOT the PVC sub-interface   
(otherwise packets are routed around FW-1, instead of through it).  This   
gets a little tricky however, because FW-1 needs to have the *real*   
default route to the Internet link. < If anyone has done this please   
speak up; I haven't, and don't know for sure how to do it >.  Just make   
sure that only FW-1 knows the *true* route, and everyone else must go   
through it to get out.

access-list 102 permit ip host <FW-1 address> any
<implicit deny>

You could further protect the other sites, and the HQ network, by   
applying output filters on all other interfaces that only allow packets   
from FW-1 and the other internal networks.

The only problem I see is with the default route issue.  Does anyone have   
any suggestions??


Good Luck,

Rick

____________________________________________
Rick Hicks
Network Specialist
Hussmann Corporation
RHicks@Hussmann.com
http://www.hussmann.com

From firewalls-owner  Thu Feb  6 12:37:23 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA19825 for firewalls-outgoing; Thu, 6 Feb 1997 09:19:15 -0800 (PST)
Received: from info.census.gov (info.census.gov [148.129.129.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id JAA19630 for <firewalls@GreatCircle.com>; Thu, 6 Feb 1997 09:18:30 -0800 (PST)
Received: from gate.census.gov (gate.census.gov [148.129.129.2]) by info.census.gov (8.8.5/8.8.3) with SMTP id MAA02456 for <firewalls@GreatCircle.com>; Thu, 6 Feb 1997 12:17:23 -0500 (EST)
Received: from it-relay1.census.gov by gate.census.gov with SMTP id AA27993
  (InterLock SMTP Gateway 3.0 for <firewalls@GreatCircle.com>);
  Thu, 6 Feb 1997 12:17:22 -0500
Received: from rulan001.census.gov ([148.129.79.162]) by it-relay1.census.gov (8.8.4/8.7.3/v1.9) with SMTP id MAA29327 for <firewalls@GreatCircle.com>; Thu, 6 Feb 1997 12:17:21 -0500 (EST)
Date: Thu, 6 Feb 1997 12:17:21 -0500 (EST)
Message-Id: <199702061717.MAA29327@it-relay1.census.gov>
X-Sender: truland@internet.census.gov
X-Mailer: Windows Eudora Light Version 1.5.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: firewalls@GreatCircle.com
From: "Timothy P. Ruland" <truland@Census.GOV>
Subject: Packet vs. Proxy Firewalls
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

We are currently using an ANS Interlock firewall to protect our internal 
network.  For a variety of reasons we are beginning to re-evaluate the way we 
have established our basic Internet capabilities.

One question that has been floated around is the benefit of a packet-based
firewall 
solution as opposed to the application gateway system like the Interlock
machine.

I have been a silent participant on this list for quite awhile and decided
to solicate 
some professional opinions on the matter.  Does anyone have a preference as
to which 
firewall solution is better?  Of prime concern to our users is performance.

I would appreciate any suggestions. You can send any replies to me direct at:

        truland@census.gov


Thanks in advance for the assistance. --- ktf

    
****************************************************************************
"It's astounding...time is fleeting...madness takes its toll"	Tim Ruland
  "but listen closely...not for very much longer..."		US Census Bureau
     "I'VE GOT TO TAKE CONTROL!!!!!!"				ADP Security Office


From firewalls-owner  Thu Feb  6 12:41:03 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA28497 for firewalls-outgoing; Thu, 6 Feb 1997 06:33:26 -0800 (PST)
Received: from chronos.synopsys.com (chronos.synopsys.com [146.225.8.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA28480 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 06:33:11 -0800 (PST)
Received: from atropos.synopsys.com by chronos.synopsys.com with SMTP id AA29555
  (5.65c/IDA-1.4.4 for <firewalls@greatcircle.com>); Thu, 6 Feb 1997 06:32:01 -0800
Received: from flying.synopsys.com (flying.synopsys.com [146.225.72.11])
  by atropos.synopsys.com (8.6.9/8.6.9) with ESMTP id GAA16445; Thu, 6 Feb 1997 06:32:00 -0800
From: Habeeb Qadri <habeeb@Synopsys.COM>
Received: by flying.synopsys.com (SMI-8.6/SNPS-Sol2)
	id GAA05585; Thu, 6 Feb 1997 06:32:19 -0800
Date: Thu, 6 Feb 1997 06:32:19 -0800
Message-Id: <199702061432.GAA05585@flying.synopsys.com>
To: firewalls@greatcircle.com, etxrosd@nmac.ericsson.se
Subject: Re: Configuring SecureID in FW-1
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Robert:

to get your Firewall-1 to work with SecurID:

1) ensure that your SecurID environment is working properly.
	Setup your ACE server.
	from your message it appears that you have done this correctly.

2) When defining your firewall host as a network object:
	click on "Auth Schemes" button
	"Host Auth Schemes" icon pops up
	click on "SecurID" button (second from top)
	click "apply"

3) Setup your Firewall-1 host as n ACE client
	
4) reboot your Firewall-1 system

hope this helps,

Habeeb Qadri
Security Admin
Synopsys, Inc
Mountain View, CA, USA


	
> From postmaster@synopsys.com  Wed Feb  5 23:09:21 1997
> Date: Thu, 6 Feb 1997 07:43:28 +0100
> From: etxrosd@nmac.ericsson.se (Robert Stahlbrand)
> To: firewalls@greatcircle.com
> Subject: Configuring SecureID in FW-1
> Mime-Version: 1.0
> Content-Transfer-Encoding: 7bit
> Content-Md5: JvNWURNsNKqUy4vORm/n2g==
> 
> Hi everyone!
> 
> I'm trying to configure secureID for users who uses my telnet proxy in 
> Checkpoints FW-1 ver.2.1 but it doesn't seem to work. What I'm trying to 
> configure is this.....
> 
> We have a modempool outside our firewall and if the users need access to our 
> intranet I thought that secureID would be an easy way for the users to login. It 
> seems to be pretty safe and pretty easy for the users. I use the telnet (ftp, 
> http as well) proxy function so the users must pass through the proxy to enter 
> the internal network. I have configured a number of users and it's no problem 
> with UNIX passwords, Internal passwords or S/Key but I don't get the 
> secureID-function to work!!! And how should it work??? I got a card but I don't 
> see where I should put in the serial-number for the card in the firewall!!! How 
> will the firewall be able to understand which card the user have got? I 
> understand that the FW must be time synchronized because the secureID card 
> changes the displayed number every 10 seconds. When I choose secureID in the 
> user setup I am prompted for nothing else???
> 
> My FW-1 handbook says nothing about secureID (almost nothing). Do you have to 
> buy an extra license or something???
> 
> ###########################################################
> #                 Robert Stahlbrand                       #
> # Network and System Administrator OPLab and NMAC domains #
> #                                                         #
> #                 Ericsson Telecom AB                     #
> #                      Box 333                            #
> #                   43184 Molndal                         #
> #                      Sweden                             #
> #                  +46 31 7476162                         #
> #                  +46 31 7472942 (fax)                   #
> #                                                         #
> #              robert@nmac.ericsson.se                    #
> ###########################################################
> 

From firewalls-owner  Thu Feb  6 12:53:22 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id KAA28293 for firewalls-outgoing; Thu, 6 Feb 1997 10:11:32 -0800 (PST)
Received: from mail-gw.pacbell.net (mail-gw.pacbell.net [206.13.28.25]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id KAA28243 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 10:11:12 -0800 (PST)
Received: from p133 (ppp-206-170-30-16.hywr01.pacbell.net [206.170.30.16]) by mail-gw.pacbell.net (8.8.5/8.7.1) with SMTP id KAA26283 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 10:10:03 -0800 (PST)
Message-ID: <32FA1E77.2801@pacbell.net>
Date: Thu, 06 Feb 1997 10:09:59 -0800
From: Dave Sroelov <dsroelov@pacbell.net>
X-Mailer: Mozilla 3.01Gold (WinNT; I)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: installation problem
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

i'm new with firewall-1, actually this is my first install, and i am
having a slight problem.  any information would be greatly appreciated.

i install the firewall on nt 3.51 and everything goes ok.  i then
install the gui software and everything still goes ok.  when i try to
get the gui software to connect to the firewall software i get 'no
response from server' messages.

the software is firewall-1 version 2.1c and everything is running on the
same machine, although it doesn't connect from a remote machine either. 
i have tried nt 3.51 and 4.0 and neither one works.

help!!!

	dave sroelov
	dsroelov@pacbell.net

From firewalls-owner  Thu Feb  6 13:01:13 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id KAA29655 for firewalls-outgoing; Thu, 6 Feb 1997 10:20:44 -0800 (PST)
Received: from parijs.tip.nl (parijs.tip.nl [143.177.1.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id KAA29437 for <Firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 10:19:29 -0800 (PST)
Received: from memo.home.nl by parijs.tip.nl with smtp
	(Smail3.1.29.1 #16) id m0vsYPf-000DnGC; Thu, 6 Feb 97 19:19 MET
Message-Id: <m0vsYPf-000DnGC@parijs.tip.nl>
From: "Rodney van den Oever" <Rodney.van.den.Oever@tip.nl>
To: <Firewalls@GreatCircle.COM>
Subject: Re: Firewalls-Digest V6 #49
Date: Thu, 6 Feb 1997 19:18:27 +0100
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1155
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Date: Thu, 06 Feb 1997 13:45:15 +1100 (EST)
> From: Mitko Stoyanov <mstoyan@airmoon.epa.nsw.gov.au>
> Subject: Dynamic (per user) dial-in PPP IP filtering
> 
> I am after any links or information which would help me to achieve the
> above. The filter rules has to be dynamically inserted when the relevant
> user logs in, and removed, when he/she logs out. There will be no more
> than 4 - 8 groups of filter rules. There are multiple dial-in ports with
> static IP addresses, and when the user logs out, only the rules regarding
> the used port/IP address should be removed.I did it already with Linux
> 2.0.28, modified pppd and perl scripts, but was wondering if any other
> solution exist already.

Use tacacs+ from cisco or radius



From firewalls-owner  Thu Feb  6 13:15:10 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA26009 for firewalls-outgoing; Thu, 6 Feb 1997 09:58:16 -0800 (PST)
Received: from inetgate.scitexdpi.com (firewall.sdp.scitex.com [149.115.248.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id JAA25994 for <Firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 09:58:07 -0800 (PST)
Received: by inetgate.scitexdpi.com; id AA09526; Thu, 6 Feb 97 12:56:53 EST
Received: from mailhub.scitexdpi.com(172.16.9.23) by inetgate.scitexdpi.com via smap (3.2)
	id xma009522; Thu, 6 Feb 97 12:56:27 -0500
Received: from mailhub.scitexdpi.com by mailhub with SMTP id AA01069
  (5.67b/IDA-1.5 for <Firewalls@GreatCircle.COM>); Thu, 6 Feb 1997 12:56:24 -0500
Received: from sdphq-Message_Server by mailhub.scitexdpi.com
	with Novell_GroupWise; Thu, 06 Feb 1997 12:56:21 -0500
Message-Id: <s2f9d4f4.017@mailhub.scitexdpi.com>
X-Mailer: Novell GroupWise 4.1
Date: Thu, 06 Feb 1997 12:55:54 -0500
From: Bob Allison <ballison@scitexdpi.com>
To: Firewalls@GreatCircle.COM, z76399@uprc.com
Subject:  http proxy problems / gauntlet -Reply
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

If your setup is like mine, my internal web server tries to go through
the firewall on port 8080, for which there is no proxy.

The solution is to have the internal web server use the firewall:80 as
a web proxy for everything, rather than using Gauntlet's transparency.

>>> Prahl V. E. Von <z76399@uprc.com> 02/05/97 02:54pm >>>
greetings,


we occasionally get the following errors from our netscape v 3.0 browser:

"The requested item could not be loaded by the proxy.

A ntework error occurred: unable to connect ot server (TCP Error:32) The server
may be down or unreachable.  Try connecting again later.

Proxy server at hostname.xxx.com on port 8080."

hostname.xxx.com is our webserver which is inside the firewall.  in the fireall
messages i get a security alert on unserved port 8080.  i am running gauntlet
3.1 on a sparc20
SunOS 4.1.4 and have http configed by the boot.  i have http pointing to port
80, which is the  default. we actually are proxying http through the internal
web machine.  i have no idea what is  going on here.  any help on this one would
be apprieciated.

thanks,


von prahl



From firewalls-owner  Thu Feb  6 13:30:15 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA23632 for firewalls-outgoing; Thu, 6 Feb 1997 09:38:07 -0800 (PST)
Received: from brimstone.rnb.com (brimstone.rnb.com [204.178.80.14]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id JAA23551 for <firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 09:37:34 -0800 (PST)
Received: by brimstone.rnb.com; id MAA14947; Thu, 6 Feb 1997 12:36:23 -0500 (EST)
Received: from relay.rnb.com(199.99.101.2) by brimstone.rnb.com via smap (3.2)
	id xma014880; Thu, 6 Feb 97 12:36:16 -0500
Received: from monarch.rnb.com (monarch [150.1.33.146])
          by relay.rnb.com (8.8.4/8.8.4) with SMTP
	  id MAA19646; Thu, 6 Feb 1997 12:36:14 -0500 (EST)
Comments: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Comments: Internet Message: Sender identity is not verified.
Comments: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Date: Thu, 6 Feb 1997 12:34:43 -0500 (EST)
From: Ken Kempster <kempster@monarch.rnb.com>
To: "Steven E. Matkoski" <matkoski@dreamscape.com>
cc: Firewall mailing list <firewalls@GreatCircle.COM>
Subject: Re: Guantlet on Solaris: Installation question.
In-Reply-To: <32F9F533.64D2@dreamscape.com>
Message-ID: <Pine.SOL.3.95.970206123156.2705B-100000@monarch.rnb.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Thu, 6 Feb 1997, Steven E. Matkoski wrote:

> Hi,
> 
> I am about to start installing Guantlet on Solaris 2.5.1 and wondered if
> there was anything
> I should do to harden the OS before installation?

I am having nothing but pain with installing Gauntlet 3.2 on Solaris 2.5.1
TIS suggests installing the sun suggested patches; which I did before the 
Gauntlet install.  But after install nothing seems to work right.

I have tried the install three times with the same results.
I am falling back to Solaris 2.5 to see if it's a 2.5.1 problem.

I'll let you know how I make out.

> 
> --
> Thanks!
> -steve.
> matkoski@dreamscape.com
> 
> 

|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|  Ken Kempster                 kempster@monarch.rnb.com  |
|  Network Systems Engineer          _\|/_                |
|  Republic National Bank            (o o)                |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~oOO-(_)-OOo~~~~~~~~~~~~~~


From firewalls-owner  Thu Feb  6 13:35:13 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id KAA00359 for firewalls-outgoing; Thu, 6 Feb 1997 10:24:21 -0800 (PST)
Received: from hcat.epcorp.com (typhoon.epcorp.com [198.30.14.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id KAA00276 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 10:23:45 -0800 (PST)
Received: from homepcmcw.eapi.com by hcat.epcorp.com id aa19432;
          6 Feb 97 13:11 EST
Message-Id: <3.0.32.19970206131148.006a19b4@hellcat.epcorp.com>
X-Sender: martinw@hellcat.epcorp.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Thu, 06 Feb 1997 13:11:50 -0500
To: contanet@andromeda.tectel.com.mx, firewalls@greatcircle.com
From: "Martin C. Walker" <martinw@epcorp.com>
Subject: hardware requeriment.
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

my recommendation, based on experience running fw-1 from sun on
solariz x86 is NOT TO USE SOLARIS x86 !!!

This is not necessarilly because there is anything wrong with x86,
but because there are few people in sunservice, or it appears in checkpoint
who know anything about x86.  As soon as you mention you're running x86
you get the standard reply "Oh!  well I don't really know anything about
x86 but...".  It also raises add'l questions from the tech suppt people that
can obscure the real issue because their lack of familiarity with it make
them question things (or ignore things) they shouldn't.  Further, if you run
into a problem which they need to duplicate they (sunservice) don't have
x86 platforms in the lab, and must do it with sparc.  What they really means
is that in order to duplicate the problem they use your production systems
as a lab.

I'd just recommend you stay away from it, things are much simpler with
sparc platforms.

>Hello . Im new in the list , and i=B4d like to talk about=20
>Solaris Firewall .
>
>
>	Wich is the recommended hardware for install this firewall
>	over x86 plataform ?
>
>	Procesor  ??
>
>	Memory ?
>
>	CPU clock ?
>
>	Mi link is going to be a 128 kbps .
>
>	Im thinking to use a vectra VE 486/66 of HP.
>
>
>	Thanks for your comments.
>
>
>
>Israel Zavalza Bahena
>Contanet.
>
>
 --------------------------------------------------------------------------
 Martin C. Walker     |  martinw@epcorp.com  |      PP-ASEL,IFR AA5-A 9908U
 Project Lead         |       (513)629-2517  | Blue Belt Okinawan Shuri-Ryu
 Eagle-Picher Inc.    |  Fax: (513)629-2449  |                Porsche 911SC
 580 Walnut St,       |                      |
 Cincinnati, OH 45202 |                      |


From firewalls-owner  Thu Feb  6 14:18:59 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA24020 for firewalls-outgoing; Thu, 6 Feb 1997 09:41:23 -0800 (PST)
Received: from chronos.synopsys.com (chronos.synopsys.com [146.225.8.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id JAA24000 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 09:41:02 -0800 (PST)
Received: from atropos.synopsys.com by chronos.synopsys.com with SMTP id AA07729
  (5.65c/IDA-1.4.4 for <firewalls@greatcircle.com>); Thu, 6 Feb 1997 09:39:52 -0800
Received: from flying.synopsys.com (flying.synopsys.com [146.225.72.11])
  by atropos.synopsys.com (8.6.9/8.6.9) with ESMTP id JAA00144; Thu, 6 Feb 1997 09:39:50 -0800
From: Habeeb Qadri <habeeb@Synopsys.COM>
Received: by flying