From firewalls-owner  Fri Jan 31 23:55:45 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id VAA14922 for firewalls-outgoing; Fri, 31 Jan 1997 21:45:17 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id UAA06392 for <firewalls@GreatCircle.COM>; Fri, 31 Jan 1997 20:59:40 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-961106)
	id KAA08336; Fri, 31 Jan 1997 10:46:28 -0800
Received: from lestat.mc2-csr.com(204.107.238.150) by mycroft via smap (V1.3mjr)
	id sma008320; Fri Jan 31 10:45:56 1997
Received: from merlin.mc2-csr.com (merlin.mc2-csr.com [204.107.238.176]) by lestat.mc2-csr.com (8.7.3/8.7.3) with SMTP id NAA11814; Fri, 31 Jan 1997 13:31:23 -0500 (EST)
Message-Id: <3.0.32.19970131133122.007c2760@mc2-csr.com>
X-Sender: lglaze@mc2-csr.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Fri, 31 Jan 1997 13:31:25 -0500
To: Dave Schnardthorst <ds3721@strydr.com>, firewalls@GreatCircle.COM
From: Larry Glaze <lglaze@mc2-csr.com>
Subject: Re: Rewriting User Names
Mime-Version: 1.0
Content-Type: text/enriched; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 10:00 AM 1/31/97 -0600, Dave Schnardthorst wrote:

>I am currently running Sendmail-8.8.5 and would like to be able to rewrite

>user names when sending out e-mail.  

>

>Example:

>

>  Incoming mail to myself could be aliased to daves@stryder.com.  When

>  I send outgoing mail my return address currently shows ds3721@stryder.com.

>  The outgoing mail should show daves@stryder.com.

>

>Can somebody give me some examples as to how this might be accomplished.


Check out http://www.mc2-csr.com/~lglaze and follow the virtual hosting

link. The page you want is the first sendmail link. The second one goes

into a different aspect of sendmail and virtual hosts, but it may also

be useful to you.


If you have any questions then just let me know (I wrote the pages and

am currently using both configurations successfully).




---------------------------------------------------------------------------

|<color><param>0000,0000,8080</param>Larry Glaze                      
</color>|<color><param>0000,0000,8080</param>    "...Life's a bummer..." 
         </color>|

|<color><param>0000,0000,8080</param>System/Network Administrator     
</color>|<color><param>0000,0000,8080</param>            --Smashing
Pumpkins       </color>|

|<color><param>0000,0000,8080</param>MC<smaller>2</smaller> Cyberspace,
Ltd               </color>|<color><param>0000,0000,8080</param>          
                           </color>|

|<color><param>0000,0000,8080</param>http://www.mc2-csr.com/~lglaze   
</color>|<color><param>0000,0000,8080</param>           
lglaze@mc2-csr.com        </color>|

---------------------------------------------------------------------------

|               <color><param>ffff,0000,0000</param>All opinions are my
own, as they should be!               </color>|

---------------------------------------------------------------------------

From firewalls-owner  Sat Feb  1 00:10:32 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id VAA14128 for firewalls-outgoing; Fri, 31 Jan 1997 21:37:06 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id VAA06588 for <firewalls@GreatCircle.COM>; Fri, 31 Jan 1997 21:00:12 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-961106)
	id KAA08698; Fri, 31 Jan 1997 10:53:08 -0800
Received: from gatekeep.us.landisgyr.com(206.175.68.122) by mycroft via smap (V1.3mjr)
	id sma008606; Fri Jan 31 10:52:50 1997
Received: by gatekeep.us.landisgyr.com; id NAA22977; Fri, 31 Jan 1997 13:51:44 -0500 (EST)
Received: from mailrelay.us.landisgyr.com(204.207.1.11) by gatekeep.us.landisgyr.com via smap (3.2)
	id xma022919; Fri, 31 Jan 97 13:51:19 -0500
Received: from mailrelay.us.landisgyr.com by pfmsv4.us.landisgyr.com
 (PMDF V5.0-6 #10101) id <01IEV3927WKW008S3K@pfmsv4.us.landisgyr.com> for
 firewalls@greatcircle.com; Fri, 31 Jan 1997 12:45:19 -0600 (CST)
Received: with PMDF-MR; Fri, 31 Jan 1997 12:48:55 -0600 (CST)
MR-Received: by mta PFMSV1.MUAS; Relayed; Fri, 31 Jan 1997 12:48:55 -0600
MR-Received: by mta PFMSV1; Relayed; Fri, 31 Jan 1997 12:48:55 -0600
MR-Received: by mta PFMSV4; Relayed; Fri, 31 Jan 1997 12:45:12 -0600
Disclose-recipients: prohibited
Date: Fri, 31 Jan 1997 12:48:55 -0600 (CST)
From: Joav Kohn <joav.kohn@us.landisstaefa.com>
Subject: Re: Rewriting User Names
In-reply-to: <199701311600.QAA04428@gollum.strydr.com>
To: firewalls <firewalls@GreatCircle.COM>
Message-id: <4055481231011997/A03557/PFMSV1/11B1FB303600*@MHS>
Autoforwarded: false
MIME-version: 1.0
Content-type: TEXT/PLAIN; CHARSET=US-ASCII
Content-transfer-encoding: 7BIT
Importance: normal
Sensitivity: Company-Confidential
UA-content-id: 11B1FB303600
X400-MTS-identifier: [;4055481231011997/A03557/PFMSV1]
Hop-count: 2
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>   Incoming mail to myself could be aliased to daves@stryder.com.  When
>   I send outgoing mail my return address currently shows ds3721@stryder.com.
>   The outgoing mail should show daves@stryder.com.
> 
> Can somebody give me some examples as to how this might be accomplished.
> 

What you want to do is not so hard, just copy the following steps. It may look
a little harder than it is if you don't know sendmail that well.

First, create a list of address translations, like this:

ds3721		daves
real_name	alias_name

making sure that the lefthand column is unique.

Then run 'makemap btree name_of_database < address_translation_list'.

In your /etc/sendmail.cf file, add the following

Kout btree /location_of_database/name_of_database

Moutbound_mailer,	P=[TCP], F=mDFMuX, S=12, R=22, A=IPC $h, E=\r\n

S12
# rewrite outbound (sender's) addresses to proper format
R$+<@$+>$*			$1@$2$3				remove
canocalization, then
R$+@stryder.com			$:$>31 $1@stryder.com		rewrite if in
groups
R$+@$*stryder.com		$@$1<@$2stryder.com>		make canocical

S31
R$+@stryder.com	$:$(out $1 $)
R$+		$:$1@stryder.com

(for all you sendmail experts, it may be a little rought around the edges, but
its from
off the top of my head).

Hope it helps,
-joav


From firewalls-owner  Sat Feb  1 00:19:07 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id VAA13811 for firewalls-outgoing; Fri, 31 Jan 1997 21:34:28 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id UAA05782 for <firewalls@GreatCircle.COM>; Fri, 31 Jan 1997 20:58:10 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-961106)
	id LAA09152; Fri, 31 Jan 1997 11:02:47 -0800
Received: from igate2.pabs.com(38.246.96.3) by mycroft via smap (V1.3mjr)
	id sma009104; Fri Jan 31 11:01:44 1997
Received: from igate2.pabs.com (daemon@localhost) by igate2.pabs.com (8.7.2/8.7.2) with ESMTP id OAA03652 for <firewalls@GreatCircle.COM>; Fri, 31 Jan 1997 14:06:43 -0500 (EST)
Received: from richey.pabs.com (richey.pabs.com [157.154.1.136]) by igate2.pabs.com (8.7.2/8.7.2) with ESMTP id OAA03646 for <firewalls@GreatCircle.COM>; Fri, 31 Jan 1997 14:06:42 -0500 (EST)
Received: from richey (richey@richey.pabs.com [157.154.1.136])
          by richey.pabs.com (8.8.5/8.8.4) with SMTP
	  id OAA21062; Fri, 31 Jan 1997 14:06:27 -0500
Message-ID: <32F242B2.27243F03@highmark.com>
Date: Fri, 31 Jan 1997 14:06:26 -0500
From: Jim Richey <jrichey@highmark.com>
X-Mailer: Mozilla 3.01Gold (X11; I; Linux 2.0.25 i586)
MIME-Version: 1.0
To: Dave Schnardthorst <ds3721@strydr.com>
CC: firewalls@GreatCircle.COM
Subject: Re: Rewriting User Names
References: <199701311600.QAA04428@gollum.strydr.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Read the section in the documentation about using the genericstable.


Dave Schnardthorst wrote:
> 
> I am currently running Sendmail-8.8.5 and would like to be able to rewrite
> user names when sending out e-mail.
> 
> Example:
> 
>   Incoming mail to myself could be aliased to daves@stryder.com.  When
>   I send outgoing mail my return address currently shows ds3721@stryder.com.
>   The outgoing mail should show daves@stryder.com.
> 
> Can somebody give me some examples as to how this might be accomplished.
> 
> Thanks
> 
> --
> ============================================================================
> David Schnardthorst, Systems/Network Eng. *  Phone: (314)838-6839
> Stryder Communications, Inc.              *    Fax: (314)838-8527
> 869 St. Francois                          * E-Mail: ds3721@strydr.com
> Florissant, MO  63031                     *    URL: http://www.strydr.com
> ============================================================================

-- 
Jim Richey
jrichey@highmark.com
HighMark Inc.
http://www.highmark.com

From firewalls-owner  Sat Feb  1 00:25:23 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id VAA13122 for firewalls-outgoing; Fri, 31 Jan 1997 21:26:28 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id UAA05156 for <Firewalls@GreatCircle.COM>; Fri, 31 Jan 1997 20:56:42 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-961106)
	id KAA07853; Fri, 31 Jan 1997 10:38:19 -0800
Received: from tanis.tiac.net(204.215.141.78) by mycroft via smap (V1.3mjr)
	id sma007791; Fri Jan 31 10:37:16 1997
Received: by cptech.com (5.x/SMI-SVR4)
	id AA01423; Fri, 31 Jan 1997 13:38:02 -0500
Date: Fri, 31 Jan 1997 13:38:02 -0500
From: dcosio@tanis.cptech.com (Dave Cosio)
Message-Id: <9701311838.AA01423@cptech.com>
To: Firewalls@GreatCircle.COM
Subject: Dave From McGraw Hill
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

	

Dave 

I lost your email,

could you call me or email me I want to send the 
info you need.

-Dave


From firewalls-owner  Sat Feb  1 00:37:48 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id VAA17327 for firewalls-outgoing; Fri, 31 Jan 1997 21:56:57 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id VAA16575 for <firewalls@GreatCircle.COM>; Fri, 31 Jan 1997 21:54:46 -0800 (PST)
From: harley@icrf.icnet.uk
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-961106)
	id MAA12560; Fri, 31 Jan 1997 12:07:21 -0800
Message-Id: <199701312007.MAA12560@mycroft.GreatCircle.COM>
Received: from unknown(143.65.100.4) by mycroft via smap (V1.3mjr)
	id sma012318; Fri Jan 31 12:02:59 1997
Received: by europa.lif.icnet.uk; Fri, 31 Jan 1997 20:03:01 GMT
Subject: RE: [NTSEC] ActiveX, MSIE and Quicken 
To: firewalls@GreatCircle.COM
Date: Fri, 31 Jan 1997 20:03:01 +0000 (GMT)
X-Mailer: ELM [version 2.4 PL23]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


> ActiveX components have the same characteristics of a virus. They are code
> which is delivered from the outside, frequently without knowledge, which can
> affect the long-term characteristics of the host system or other systems
> and/or pass information back which may be considered proprietary or
> sensitive. 

<pedant> Actually, none of these are defining characteristics of a
virus. All a virus has to do to -be- a virus is replicate. </pedant>

-- 
David Harley                     \   |   /                 alt.comp.virus FAQ
D.Harley@icrf.icnet.uk            \  |  /               & Anti-Virus Web Page
Support & Security Analyst         \ | /         Folk London On-Line gig-list
Imperial Cancer Research Fund   ____\|/____   http://webworlds.co.uk/dharley/

From firewalls-owner  Sat Feb  1 00:40:31 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id WAA04765 for firewalls-outgoing; Fri, 31 Jan 1997 22:53:18 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id WAA03635 for <Firewalls@GreatCircle.COM>; Fri, 31 Jan 1997 22:50:32 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-961106)
	id WAA21608; Fri, 31 Jan 1997 22:10:41 -0800
Received: from diablo.cisco.com(171.68.223.106) by mycroft via smap (V1.3mjr)
	id sma021590; Fri Jan 31 22:10:10 1997
Received: from clonvick-pc.cisco.com (sj-dial-3-12.cisco.com [171.68.179.13]) by diablo.cisco.com (8.8.4/CISCO.SERVER.1.2) with SMTP id WAA01416; Fri, 31 Jan 1997 22:11:22 -0800 (PST)
Message-Id: <2.2.32.19970201060829.00fded58@diablo.cisco.com>
X-Sender: clonvick@diablo.cisco.com
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Sat, 01 Feb 1997 00:08:29 -0600
To: Mark Thompson <thommd@CETUS.MNGT.ULETH.CA>, Firewalls@GreatCircle.COM
From: Chris Lonvick <clonvick@cisco.com>
Subject: Re: ICMP Class 9; Code 0 in FW-1 Logs??
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi Mark,

Slap a sniffer on the wire and see if it's ICMP Type 9 Code 0.
This is described in RFC-1256 as the ICMP Router Discovery Message.
If so, then you have a router out there sending IRDP advertisements.
It was intended to provide hosts with the IP addresses of their
neighboring routers.  This is a good idea for dropping a host into
a network and getting it to work right away.  

This is a bad idea for a firewall - which is why yours is ignoring it.

Hope this helps,

Chris Lonvick
Cisco Systems
Consulting Engineering
Houston, TX, USA
+1-713-778-5663

At 07:31 PM 1/31/97 -0700, Mark Thompson wrote:
>We're getting some logging that we can't explain in our FW-1 2.1 (solaris)
>logs which I was hoping somebody out there might be able to help us
>with:
>
>ICMP class 9 rejected; 
>ICMP code 0 rejected
>
>Does anybody have any idea what these classes and codes mean.  Are
>these FW-1'isms, or are they actually part of the ICMP spec?  We had an
>idea that they might be related to RIP traffic, but have (as of yet) been
>unable to find proof.
>
>Thanks much,
>
>Mark.
>
>Mark Thompson
>Manager of Network Services
>The University of Lethbridge
>Lethbridge, AB Canada
>
>thommd@cetus.mngt.uleth.ca
>(403) 329-2689
>
>


From firewalls-owner  Sat Feb  1 01:10:32 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id WAA28540 for firewalls-outgoing; Fri, 31 Jan 1997 22:27:07 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id VAA16902 for <firewalls@GreatCircle.COM>; Fri, 31 Jan 1997 21:55:40 -0800 (PST)
From: mcwilkin@twcable.com
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-961106)
	id MAA14124; Fri, 31 Jan 1997 12:37:16 -0800
Received: from unknown(205.138.118.193) by mycroft via smap (V1.3mjr)
	id sma014080; Fri Jan 31 12:35:36 1997
Received: from denmisf01.twcable.com (denmisf01.twcable.com [198.59.12.1]) by dencbis94.twcable.com (8.8.3/8.8.3) with ESMTP id NAA06994 for <firewalls@Greatcircle.com>; Fri, 31 Jan 1997 13:36:23 -0700 (MST)
Received: from dencbis56 (dencbis56 [198.59.12.201]) by denmisf01.twcable.com (8.8.3/8.8.3) with SMTP id NAA10433 for <firewalls@Greatcircle.com>; Fri, 31 Jan 1997 13:36:22 -0700 (MST)
Message-Id: <199701312036.NAA10433@denmisf01.twcable.com>
Comments: Authenticated sender is <mcwilkin@[198.59.12.1]>
To: firewalls@GreatCircle.COM
Date: Fri, 31 Jan 1997 13:42:44 +0000
Subject: Ident revisited
X-mailer: Pegasus Mail for Win32 (v2.42)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi all-

I have a question re: ident. We have a strange problem. We drop
all ident requests inbound silently at the firewall.

First, we are running Solstice Firewall-1 2.1 on a Sparc 10 with
Solaris 2.5

There is a site our users need to access but they can't. After we
watched the packets we saw ident come in and we block it. But,
instead of timing out and allowing us access, it closed our conn-
ection!

So,  I figured that they might have it configured to require some
sort of response.

Here is where I get lost.

I tried it from our internal name server and it timed out... But in-
stead of sending FIN to close the connection it let us in.

This is the only internal machine that can access that site. So, if
we are dropping ident on the floor and(if) they require it... Why
does this one work and all the others don't.

This internal machine doesn't even run ident or service port 113
but that doesn;t matter since ident doesn;t even reach it!

I really don't think they are requiring a response. 

It almost seems like the firewall is doing this.  I didn't configure
the firewall so I am not familiar with it...

But, if someone can give me a place to look or something to try
it would be appreciated.

Also, since we have an internal/external DNS setup we have a *
PTR on our external name server for reverse lookups.

Mike
Michael C. Wilkinson
Time Warner Cable-IS
mcwilkin@twcable.com

From firewalls-owner  Sat Feb  1 01:25:50 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id WAA29222 for firewalls-outgoing; Fri, 31 Jan 1997 22:32:43 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id VAA17539 for <firewalls@GreatCircle.COM>; Fri, 31 Jan 1997 21:57:30 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-961106)
	id LAA11844; Fri, 31 Jan 1997 11:53:44 -0800
Received: from pan.ch.intel.com(143.182.246.24) by mycroft via smap (V1.3mjr)
	id sma010511; Fri Jan 31 11:28:40 1997
Received: from argus.intel.com by pan.ch.intel.com (8.8.4/10.0i); Fri, 31 Jan 1997 19:29:18 GMT
Received: by argus.intel.com (8.8.4/10.0i); Fri, 31 Jan 1997 11:28:46 -0800
From: sedayao@argus.intel.com (Jeffrey C. Sedayao)
Message-Id: <199701311928.LAA18993@argus.intel.com>
Subject: Re: Firewall Consolidation
To: asetton@lightech.com.ar
Date: Fri, 31 Jan 97 11:28:46 PST
Cc: firewalls@GreatCircle.COM
In-Reply-To: <32F1C9B2.436E@lightech.com.ar> from "Adrian F. Setton" at Jan 31, 97 01:30:11 pm
X-Mailer: ELM [version 2.4dev PL66]
MIME-Version: 1.0
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Hello,
> I'm looking for opinions about using the same firewall machine in
> order to conect the same organization with multiple services.
> For example, a Bank could use the same firewall in order to protect
> the private network from the Web Servers that are in the DMZ, and in
> order to give access to the Internet to the employees.
> An argument is that perhaps we do not want to consolidate them for
> performance reasons (we want to be able to isolate one service from
> another, so the traffic from one does not affect the performance of
> the second one).
> Any idea about why this consolidation could be good or bad, will be
> appreciated.

I would keep them separate because:

1.  Performance - If you are putting the DMZ as a segment off the
firewall machine, as the firewall gets bogged down, performance for 
your internal users (to the Internet) and your external users of your 
web servers will suffer.

2.  Robustness - If the DMZ firewall machine goes down, both your
internal users will suffer as well as your external customers of your
web servers.  You want to minimize the number of angry phone calls at
the same time.

3.  Easier configuration - Rather than worry about both the web server
and your users on the same machine's configuration, you think of them
separately.  Simpler configurations will reduce the chance of you making
a mistake.

Then again, if you don't have have enough money for more than one
machine, well, you will have one machine.  I don't think that would be a
good idea.

In either case, I think you want to make sure that one group or person
is administering both machines.

> -- 
> Adrian F. Setton
> LighTech                        Voice:  (54-1) 373-1141
> Ayacucho 563. Piso 13 Dto "A"   FAX:    (54-1) 373-1215
> Buenos Aires                    e-mail: asetton@lightech.com.ar
> Argentina                       URL:    http://www.lightech.com.ar

-- 
Jeff Sedayao
Intel Corporation
sedayao@argus.intel.com

From firewalls-owner  Sat Feb  1 03:25:34 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id CAA07315 for firewalls-outgoing; Sat, 1 Feb 1997 02:53:53 -0800 (PST)
Received: from ravian.globalxs.nl (ravian.GlobalXS.nl [143.178.250.5]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id CAA07259 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 02:53:15 -0800 (PST)
Received: from ns.globalxs.nl (Borg.startrek.GlobalXS.nl [143.178.243.49]) by ravian.globalxs.nl (8.7.4/8.7.3) with SMTP id LAA16582 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 11:51:56 +0100
Message-Id: <3.0.32.19970201114932.00693214@globalxs.nl>
X-Sender: pnefkens@globalxs.nl
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Sat, 01 Feb 1997 11:50:52 +0100
To: firewalls@GreatCircle.COM
From: Patrick Nefkens <pnefkens@globalxs.nl>
Subject: Re: [Fwd: Re: MS Proxy as a firewall?]
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>> Luckly, an article
>> in Infoworld or Communication Week a few weeks ago reviewed msproxy server

>Is there anybody out there who has more information about this article ?
>Thanks in advance.
 
This article was published in Communications Week, January 20, 1997. It can
be found at http://www.techweb.com. There you will have to search on the
keyword "MS Proxy".


Patrick "Cloggie" Nefkens

Those who can, do.
Those who can't, write the instructions.

From firewalls-owner  Sat Feb  1 04:17:24 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id CAA05405 for firewalls-outgoing; Sat, 1 Feb 1997 02:21:06 -0800 (PST)
Received: from glacier.wise.edt.ericsson.se (glacier-ext.wise.edt.ericsson.se [193.180.251.38]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id CAA05389 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 02:20:31 -0800 (PST)
Received: from negrita.nmac.ericsson.se (negrita.nmac.ericsson.se [130.100.187.78]) by glacier.wise.edt.ericsson.se (8.7.5/8.7.3/glacier-0.9) with SMTP id LAA20399 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 11:19:15 +0100 (MET)
Received: by negrita.nmac.ericsson.se (SMI-8.6/SMI-SVR4)
	id LAA01562; Sat, 1 Feb 1997 11:18:44 +0100
Date: Sat, 1 Feb 1997 11:18:44 +0100
From: etxrosd@nmac.ericsson.se (Robert Stahlbrand)
Message-Id: <199702011018.LAA01562@negrita.nmac.ericsson.se>
To: firewalls@GreatCircle.COM
Subject: Re: Rewriting User Names
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-MD5: FrfX2PdBGzeQgK4fMDZ8Lg==
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi!

I have got a problem with makemap! When I run: makemap outnames.db < 
outnames.db.txt the following error-messege appears:
"makemap: Type btree not supported in this version"

The same happens if I use hash-option instead of btree. I know that I had some 
trouble when I compiled makemap (sendmail ver. 8.8.5) and it couldn't generate 
manpages but what the heck was my thought. I don't need manpages for makemap 
(maybe I need now). I run sendmail on solaris 2.5.
Is there someone else who are having the same problem?
Is there anyone who can share a copy of the makemap binary for Solaris 2.5?

###########################################################
#                 Robert Stahlbrand                       #
# Network and System Administrator OPLab and NMAC domains #
#                                                         #
#                 Ericsson Telecom AB                     #
#                      Box 333                            #
#                   43184 Molndal                         #
#                      Sweden                             #
#                  +46 31 7476162                         #
#                  +46 31 7472942 (fax)                   #
#                                                         #
#              robert@nmac.ericsson.se                    #
###########################################################


> >   Incoming mail to myself could be aliased to daves@stryder.com.  When
> >   I send outgoing mail my return address currently shows ds3721@stryder.com.
> >   The outgoing mail should show daves@stryder.com.
> > 
> > Can somebody give me some examples as to how this might be accomplished.
> > 
> 
> What you want to do is not so hard, just copy the following steps. It may look
> a little harder than it is if you don't know sendmail that well.
> 
> First, create a list of address translations, like this:
> 
> ds3721		daves
> real_name	alias_name
> 
> making sure that the lefthand column is unique.
> 
> Then run 'makemap btree name_of_database < address_translation_list'.
> 
> In your /etc/sendmail.cf file, add the following
> 
> Kout btree /location_of_database/name_of_database
> 
> Moutbound_mailer,	P=[TCP], F=mDFMuX, S=12, R=22, A=IPC $h, E=\r\n
> 
> S12
> # rewrite outbound (sender's) addresses to proper format
> R$+<@$+>$*			$1@$2$3				remove
> canocalization, then
> R$+@stryder.com			$:$>31 $1@stryder.com		rewrite 
if in
> groups
> R$+@$*stryder.com		$@$1<@$2stryder.com>		make canocical
> 
> S31
> R$+@stryder.com	$:$(out $1 $)
> R$+		$:$1@stryder.com
> 
> (for all you sendmail experts, it may be a little rought around the edges, but
> its from
> off the top of my head).
> 
> Hope it helps,
> -joav
> 

From firewalls-owner  Sat Feb  1 10:28:58 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id KAA22754 for firewalls-outgoing; Sat, 1 Feb 1997 10:12:05 -0800 (PST)
Received: from amdext.amd.com (amdext.amd.com [139.95.251.1]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id KAA22745 for <Firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 10:11:49 -0800 (PST)
Received: from amdint.amd.com (amdint.amd.com [139.95.250.1])
          by amdext.amd.com (8.8.4/8.8.4/AMD) with ESMTP
	  id KAA19117; Sat, 1 Feb 1997 10:09:55 -0800 (PST)
Received: from brahms.amd.com (brahms.amd.com [193.5.6.1])
          by amdint.amd.com (8.8.4/8.8.4/AMD) with SMTP
	  id KAA26862; Sat, 1 Feb 1997 10:09:54 -0800 (PST)
Received: from zappa.amd.com by brahms.amd.com (4.1/AMDSN-1.18)
	id AA22065; Sat, 1 Feb 97 10:09:54 PST
Received: from procyon.amd.com (kathryn) by zappa.amd.com (4.1/AMDC-1.20)
	id AA28003; Sat, 1 Feb 97 10:09:53 PST
Message-Id: <3.0.32.19970201091209.006e15fc@brahms>
X-Sender: chris@brahms
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Sat, 01 Feb 1997 09:12:21 -0800
To: gvc@ocsystems.com (G. Vincent Castellano), Firewalls@GreatCircle.COM
From: Chris Martin <chris.martin@amd.com>
Subject: Re: Protecting local news from Suck
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 06:45 PM 1/30/97 -0500, G. Vincent Castellano wrote:
> ...
>I have heard that there is a tool called 'suck' which is
>designed to do just this.  Is there such a tool?  If so,
>how can I be sure I'm safe from it?

One approach would be to use a set of news servers internally for
newsreading and distinct set of news servers externally exclusively for
news relay.  The internal news servers simply wouldn't feed internal groups
out to the relay servers.  This is generally considered to be better from a
performance perspective as well -- especially if you have a number of
external news peers.


From firewalls-owner  Sat Feb  1 11:10:37 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id KAA25272 for firewalls-outgoing; Sat, 1 Feb 1997 10:52:30 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id KAA24590 for <Firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 10:50:44 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-961106)
	id IAA25666; Sat, 1 Feb 1997 08:58:32 -0800
Received: from unknown(206.161.161.2) by mycroft via smap (V1.3mjr)
	id sma025662; Sat Feb  1 08:58:12 1997
Received: from 206.161.161.3 by northern-va.com
 with SMTP (Apple Internet Mail Server 1.1.1); Sat, 1 Feb 1997 13:04:06 +0000
Message-ID: <3110E43E.11E9@northern-va.com>
Date: Thu, 01 Feb 1996 12:03:10 -0400
From: Ronald Ogle <oglerr@northern-va.com>
Reply-To: oglerr@northern-va.com
Organization: RTO Consulting
X-Mailer: Mozilla 3.0 (Macintosh; I; PPC)
MIME-Version: 1.0
To: Firewalls@GreatCircle.COM
Subject: Firewall-1 to Sunscreen SPF-100 VPN
References: <199702010925.BAA28232@miles.greatcircle.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I've got some information from SUN on how to make a Virtual Private
Network connection between a Firewall-1 2.1 machine and a Sunscreen
SPF-100 machine.  My question is does anyone else have a working VPN
between these same two machines?  Secondly, would you be willing to
share the procedure on how you set it up?

Thanks!
-- 
Ronald R. Ogle
RTO Consulting
15210 Crescent St.
Dale City, VA 22193-1623
(703) 730-0451
oglerr@northern-va.com

From firewalls-owner  Sat Feb  1 11:49:00 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id LAA00563 for firewalls-outgoing; Sat, 1 Feb 1997 11:32:00 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id KAA25988 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 10:55:00 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-961106)
	id IAA24844; Sat, 1 Feb 1997 08:09:07 -0800
Message-Id: <199702011609.IAA24844@mycroft.GreatCircle.COM>
Received: from unknown(130.184.252.196) by mycroft via smap (V1.3mjr)
	id sma024839; Sat Feb  1 08:08:27 1997
Received: from UAFSYSB.UARK.EDU by UAFSYSB.UARK.EDU (IBM VM SMTP V2R3)
   with BSMTP id 2255; Sat, 01 Feb 97 10:07:46 CST
Received: from UAFSYSB.UARK.EDU (NJE origin SAMARAK@UAFSYSB) by UAFSYSB.UARK.EDU (LMail V1.2a/1.8a) with BSMTP id 2786; Sat, 1 Feb 1997 10:07:46 -0600
Date:         Sat, 01 Feb 97 10:04:20 CST
From: Steve Marak <SAMARAK@UAFSYSB.UARK.EDU>
Subject:      Blocking modems
To: Firewalls mailing list <firewalls@GreatCircle.COM>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


>Random thought: would it be possible to insert a (hardware) filter
>on incoming lines to block modem signalling frequencies? This would
>not disturb voice traffic but might be an effective solution. Modern
>modems

This occurred to me about 6 years ago and I've been trying ever since to
find a product/service/vendor who could implement it for me, with no
luck. I've asked a lot of people at conferences and such, too. Usually
their answer was that it seemed quite logical and surely someone *ought*
to provide something, but they didn't know specifically of anything.

Some of our AT&T contingent assured me that the newer high-end switches
could be configured to do this, but so far none of the technical people
seem to know how.

If someone out here does know of something along this line, please include
me in the reply if you don't post to the list.

Apologies to the list at large for continuing this (at best tangential)
topic - it's been a thorn in my side for a long time.

Steve


-- Steve Marak
-- SAMARAK@UAFSYSB.UARK.EDU

From firewalls-owner  Sat Feb  1 12:25:33 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id MAA04535 for firewalls-outgoing; Sat, 1 Feb 1997 12:12:33 -0800 (PST)
Received: from introtv01.intro.ch (introtv01.intro.ch [194.158.232.66]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id MAA04468 for <Firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 12:12:09 -0800 (PST)
Received: by introtv01.intro.ch with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63)
	id <01BC1084.70DC1410@introtv01.intro.ch>; Sat, 1 Feb 1997 21:11:07 +0100
Message-ID: <c=CH%a=_%p=SASSOGROUP%l=SASVR001-970201201054Z-2@introtv01.intro.ch>
From: Krummenacher Kurt <Kurt.Krummenacher@sasso.intro.ch>
To: "'Firewalls@GreatCircle.COM'" <Firewalls@GreatCircle.COM>
Subject: Put me off
Date: Sat, 1 Feb 1997 21:10:54 +0100
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

please put out this list

K.Krummenacher@spectraweb.ch

From firewalls-owner  Sat Feb  1 12:44:47 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id MAA05879 for firewalls-outgoing; Sat, 1 Feb 1997 12:26:58 -0800 (PST)
Received: from psihost.memberville.com (memberville.com [38.234.19.2]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id MAA05842 for <firewalls@greatcircle.com>; Sat, 1 Feb 1997 12:26:38 -0800 (PST)
Received: from x.memberville.com ([38.234.19.100])
          by psihost.memberville.com (Netscape Mail Server v2.0) with SMTP
          id AAA7428 for <firewalls@greatcircle.com>;
          Sat, 1 Feb 1997 15:22:05 -0500
Message-ID: <32F3A57F.D10@paragonfcu.org>
Date: Sat, 01 Feb 1997 15:20:15 -0500
From: davew@memberville.com (Dave Weinstein)
Reply-To: davew@paragonfcu.org
Organization: Paragon Federal Credit Union
X-Mailer: Mozilla 3.0 (Win95; I)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: Technologic's Interceptor
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

We are presently evaluating different firewall solutions, one of which
is Technologic's Interceptor.

Is it a good product?

Can anyone please provide a little insight.

Thanks in advance, 
David Weinstein
VP of Information Systems and Technology

From firewalls-owner  Sat Feb  1 12:55:44 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id MAA06465 for firewalls-outgoing; Sat, 1 Feb 1997 12:33:15 -0800 (PST)
Received: from firewall.harker.com (firewall.harker.com [192.102.231.125]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id MAA06455 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 12:33:01 -0800 (PST)
Received: from harker.harker.com (harker.harker.com [192.102.231.1]) by firewall.harker.com (8.6.9/8.6.12) with ESMTP id FAA21415; Sat, 1 Feb 1997 05:27:51 GMT
Received: (from harker@localhost) by harker.harker.com (8.8.4/8.8.3) id MAA28549; Sat, 1 Feb 1997 12:34:07 -0800 (PST)
Date: Sat, 1 Feb 1997 12:34:07 -0800 (PST)
From: Robert Harker <harker@harker.com>
Message-Id: <199702012034.MAA28549@harker.harker.com>
To: etxrosd@nmac.ericsson.se
Subject: Re: Rewriting User Names
Cc: firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

The version of makemap you compiled seems not to support the new Berkeley "db"
Library.  Either get the library from:
	ftp://ftp.cs.berkeley.edu/ucb/4bsd/db.1.85.tar.gz
Or you can use your existing makemap which probabily supports the vendors
default "ndbm" database.  Try:
	makemap dbm outnames < outnames
This will create the ndbm database files: outnames.pag and outnames.dir
(the two names can be the same)

Word of warning, if your makemap command has been compiled with db
support, then you will get db files even if you specify dbm as the database
type.  To build a ndbm file you must use the makedbm command.

Hope this helps

RLH

   > For info about our "Managing Internet Mail, Setting Up and Trouble <
   > Shooting sendmail and DNS" and a schedule of dates and locations,  <
   > please send email to info@harker.com, or visit www.harker.com      <

Robert Harker						Harker Systems
Sendmail and TCP/IP Network Training			1180 Hester Ave
Network and Sysadmin Consulting				San Jose, CA 95126
harker@harker.com					408-295-9432


From firewalls-owner  Sat Feb  1 15:27:11 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id PAA18976 for firewalls-outgoing; Sat, 1 Feb 1997 15:13:38 -0800 (PST)
Received: from unix1.sysnet.net (unix1.sysnet.net [206.142.32.2]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id PAA18969 for <firewalls@greatcircle.com>; Sat, 1 Feb 1997 15:13:25 -0800 (PST)
Received: from [206.142.16.32] (appp13.sysnet.net [206.142.16.32]) by unix1.sysnet.net (8.8.4/8.6.12) with SMTP id TAA25825; Sat, 1 Feb 1997 19:49:02 -0500 (EST)
Message-Id: <199702020049.TAA25825@unix1.sysnet.net>
Subject: Re: Lower Prices and More NSA Testing
Date: Sat, 1 Feb 97 18:12:53 -0400
x-sender: patton@mail.sysnet.net
x-mailer: Claris Emailer 1.1
From: Matthew Patton <patton@sysnet.net>
To: "BeachCruiser" <pelicans@mindspring.com>
cc: <firewalls@greatcircle.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>release of more test results as the X31 crew expands their commercial
>firewall product evaluations.  Gauntlet and Sidewinder just happened to be
>the first two on the bench.  Others are already in the queue.

But has anybody read them?  I just finished the TIS one and I'm VERY 
nonplussed.  What's the value added of the X31's efforts?  There's no new 
insight, and it was hardly what I'd consider rigorous.  Indeed their 
testing basically boiled down to confirming that the firewall obeyed 
protocol conventions.  So what?  The trade rags do similar testing.  
There are an incredible number of TIS sites out there and if the features 
didn't work as advertised we've have known a LONG time ago.  I'll read 
the sidewinder one next and I'm prepared to be yet again disappointed at 
the coverage.

From firewalls-owner  Sat Feb  1 16:40:58 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id QAA24288 for firewalls-outgoing; Sat, 1 Feb 1997 16:35:49 -0800 (PST)
Received: from mailhost.netrunner.net (mailhost.netrunner.net [204.137.145.201]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id QAA24281 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 16:35:37 -0800 (PST)
Received: from jim.davocom.com ([205.164.226.41]) by mailhost.netrunner.net (8.7.5/8.7.5) with ESMTP id TAA17673; Sat, 1 Feb 1997 19:13:31 -0500 (EST)
Message-ID: <32F3DA42.27E9@davocom.com>
Date: Sat, 01 Feb 1997 19:05:23 -0500
From: Jim Canfield <jcanfiel@davocom.com>
X-Sender: Jim Canfield <jcanfiel@davocom.com>
X-Mailer: Mozilla 4.0b1 (Win95; I)
MIME-Version: 1.0
To: "K.M." <goertzek@wangfed.com>
CC: firewalls@GreatCircle.COM
Subject: Re: Sidewinder vs. Cyberguard
X-Priority: Normal
References: <9701311502.AA10288@uc0009.wangfed.com>
Content-Type: multipart/alternative; boundary="----------592E56445F600"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


------------592E56445F600
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=us-ascii

I am a relative novice in the arena of firewalls but am attempting to
learn as much as I can. Monitoring this forum on basic fw issues to the
most esoteric  is exceptionally enlightening. I have been implementing
L/WAN's for about 9 years and consider myself relatively well qualified
in certain areas.

Coming at the issue of firewalls as a small system integration house we
researched what a firewall is and what is important. What is important
as I see it is to keep the unwanted out while inconveniencing those who
need access as little as possible..

First: How is security rated A1, B3, B2, B1, C2, C1 in the US, other
similar grading scales in England/Germany and probably countless others
worldwide. Then to find out what was the best achievable security rating
for a product that is usable.
The most secure, usable, firewall we have found to date is the
Cyberguard

As mentioned the products are B1 compliant (awaiting certification)....
They are relatively easy to setup , nice GUI and it has built in the
ablity for most "standard "(excuse the word) proxies and allows creation
of probably anything you might need.  It is priced competitively with
Sidewinder, Raptor and the other high-end hardened O/S FW's available
but as far as I know it is the only one that is B compliant.

If you need to purchase a firewall,  I do not see how anyone ever
chooses anything other than the Cyberguard.

Thanks for your time.

Jim Canfield

------------592E56445F600
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset=us-ascii

<HTML><BODY>

<DT>I am a relative novice in the arena of firewalls but am attempting
to learn as much as I can. Monitoring this forum on basic fw issues to
the most esoteric&nbsp; is exceptionally enlightening.&nbsp;I have been
implementing L/WAN's for about 9 years and consider myself relatively well
qualified in certain areas.&nbsp;&nbsp;</DT>

<DT>&nbsp;</DT>

<DT>Coming at the issue of firewalls as a small system integration house
we researched what a firewall is and what is important. What is important
as I see it is to keep the unwanted out while inconveniencing those who
need access as little as possible..&nbsp;</DT>

<DT>&nbsp;</DT>

<DT>First: How is security rated A1, B3, B2, B1, C2, C1 in the US, other
similar grading scales in England/Germany and probably countless others
worldwide. Then to find out what was the best achievable security rating
for a product that is usable.</DT>

<DT>The most secure, usable, firewall we have found to date is the Cyberguard</DT>

<DT>&nbsp;</DT>

<DT>As mentioned the products are B1 compliant (awaiting certification)....&nbsp;
They are relatively easy to setup , nice GUI and it has built in the ablity
for most &quot;standard &quot;(excuse the word) proxies and allows creation
of probably anything you might need.&nbsp; It is priced competitively with
Sidewinder, Raptor and the other high-end hardened O/S FW's available but
as far as I know it is the only one that is B compliant.</DT>

<DT>&nbsp;</DT>

<DT>If you need to purchase a firewall,&nbsp; I do not see how anyone ever
chooses anything other than the Cyberguard.</DT>

<DT>&nbsp;</DT>

<DT>Thanks for your time.</DT>

<DT>&nbsp;</DT>

<DT>Jim Canfield</DT>

</BODY>
</HTML>
------------592E56445F600--


From firewalls-owner  Sat Feb  1 18:29:14 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id SAA02436 for firewalls-outgoing; Sat, 1 Feb 1997 18:13:06 -0800 (PST)
Received: from homeport.org (lighthouse.homeport.org [205.136.65.198]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id SAA02426 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 18:12:56 -0800 (PST)
Received: (adam@localhost) by homeport.org (8.6.9/8.6.9) id VAA02207; Sat, 1 Feb 1997 21:09:11 -0500
From: Adam Shostack <adam@homeport.org>
Message-Id: <199702020209.VAA02207@homeport.org>
Subject: Re: [NTSEC] ActiveX, MSIE and Quicken
In-Reply-To: <41FDA823FC5AD011A0970000E8D5C667029335@mail.rc.on.ca> from Russ at "Jan 31, 97 07:04:44 am"
To: Russ.Cooper@RC.on.ca (Russ)
Date: Sat, 1 Feb 1997 21:09:11 -0500 (EST)
Cc: firewalls@GreatCircle.COM, lists@reflections.mindspring.com
X-Mailer: ELM [version 2.4ME+ PL27 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Russ wrote:
| 1. If the default IE implementation existed on the exploited machine,
| they were informed of the company name who signed the certificate, and
| were asked to confirm acceptance of the object. In which case, they
| chose to trust an untrustworthy company, why is that the fault of
| Activex?
| 
| 2. If they previously had told IE to accept all signed certificates,
| then they chose to leave their machine wide open, again, why is that
| ActiveX's fault?

	Lets say that the user is in class one, and makes a mistake.
	They've could have just accepted a malicious applet that
changes their IE config into class two.  Or perhaps it adds a trusted
CA.  (Or perhaps the attack is two pronged; the malicious code that
changes the config file is a word virus.)  There are subtle attacks.
ActiveX is bad technology because it does not offer mechanisms for an
organizations security officer to control what is happening in any
way other than turning it off.

Adam


-- 
Pet peeve of the day: Security companies whose protocols dare not
speak their name. Guilty company of the day is Security Dynamics.



From firewalls-owner  Sat Feb  1 18:41:03 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id SAA03429 for firewalls-outgoing; Sat, 1 Feb 1997 18:30:44 -0800 (PST)
Received: from reflections.mindspring.com (reflections.mindspring.com [204.180.142.192]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id SAA03227 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 18:29:59 -0800 (PST)
Received: from localhost (lists@localhost) by reflections.mindspring.com (8.7.6/8.7.3) with SMTP id VAA01895; Sat, 1 Feb 1997 21:28:51 -0500
Date: Sat, 1 Feb 1997 21:28:51 -0500 (EST)
From: Todd Graham Lewis <lists@reflections.mindspring.com>
To: Adam Shostack <adam@homeport.org>
cc: Russ <Russ.Cooper@RC.on.ca>, firewalls@GreatCircle.COM
Subject: Re: [NTSEC] ActiveX, MSIE and Quicken
In-Reply-To: <199702020209.VAA02207@homeport.org>
Message-ID: <Pine.LNX.3.95.970201212545.306A-100000@reflections.mindspring.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Sat, 1 Feb 1997, Adam Shostack wrote:

> Russ wrote:
>
> | 2. If they previously had told IE to accept all signed certificates,
> | then they chose to leave their machine wide open, again, why is that
> | ActiveX's fault?
> 
> 	Lets say that the user is in class one, and makes a mistake.
> 	They've could have just accepted a malicious applet that
> changes their IE config into class two.  Or perhaps it adds a trusted
> CA.

Or maybe it fires up Frontpage and slaps the same thing on an internal web
page.  Etc., ad nauseum.

Russ, when you continue to argue that "ActiveX/OLE has always been an
insecure, crappy technology; the only difference is that it's now on the
web", I really fail to see your point.  Maybe you could fill me in. 

__
Todd Graham Lewis          Mindspring Enterprises      tlewis@mindspring.com


From firewalls-owner  Sat Feb  1 19:09:22 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id SAA03617 for firewalls-outgoing; Sat, 1 Feb 1997 18:37:27 -0800 (PST)
Received: from homeport.org (lighthouse.homeport.org [205.136.65.198]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id SAA03607 for <Firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 18:37:10 -0800 (PST)
Received: (adam@localhost) by homeport.org (8.6.9/8.6.9) id VAA02356; Sat, 1 Feb 1997 21:33:14 -0500
From: Adam Shostack <adam@homeport.org>
Message-Id: <199702020233.VAA02356@homeport.org>
Subject: Re: Secure Telneting into a internal network
In-Reply-To: <Pine.GSO.3.95.970130140106.20876O-100000@raleigh> from Derrick 'Red 5' Cole at "Jan 30, 97 02:14:41 pm"
To: derrick.cole@ssds.com
Date: Sat, 1 Feb 1997 21:33:14 -0500 (EST)
Cc: aharpham@cnweb.com, Firewalls@GreatCircle.COM
X-Mailer: ELM [version 2.4ME+ PL27 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Derrick 'Red 5' Cole wrote:
| On Thu, 30 Jan 1997, Allen D. Harpham wrote:
| > 
| > They use a windows based telnet package that they would like to use to
| > access their hosts on the internal network over the internet.
| 
| This is the behaviour purported by this "shim" idea.  It situates itself
| in the midst of the winsock stack, and "knows" (most likely via routes to
| destinations using pseudo interfaces - as with swIPe) when to encrypt a
| session and when not to.

	There are a couple of shims that sit above winsock now, rather
than mucking with it.  V-One makes one, theres another called VTCP.
You point your network program to 127.0.0.1 on some port, and it wraps
the connection in an 'secure pipe' to the firewall.  V-One offers the
nice ability to control where users connect to once they connect over
this pipe.

	On the down side, you find yourself saying 'the V-One client
server protocol' or 'the V-One online registration protocol' an awful
lot, and they're both mouthfuls.

Adam

-- 
Pet peeve of the day: Security companies whose protocols dare not
speak their name, because they don't have one.  Guilty company of the
day is now V-One.



From firewalls-owner  Sat Feb  1 19:11:02 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id SAA03473 for firewalls-outgoing; Sat, 1 Feb 1997 18:31:53 -0800 (PST)
Received: from unix1.sysnet.net (unix1.sysnet.net [206.142.32.2]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id SAA03466 for <firewalls@greatcircle.com>; Sat, 1 Feb 1997 18:31:40 -0800 (PST)
Received: from [206.142.16.36] (bppp2.sysnet.net [206.142.16.36]) by unix1.sysnet.net (8.8.4/8.6.12) with SMTP id XAA27088; Sat, 1 Feb 1997 23:07:18 -0500 (EST)
Message-Id: <199702020407.XAA27088@unix1.sysnet.net>
Subject: Re: Sidewinder vs. Cyberguard
Date: Sat, 1 Feb 97 21:31:07 -0400
x-sender: patton@mail.sysnet.net
x-mailer: Claris Emailer 1.1
From: Matthew Patton <patton@sysnet.net>
To: "Jim Canfield" <jcanfiel@davocom.com>
cc: <firewalls@greatcircle.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Jim Canfield wrote:
>The most secure, usable, firewall we have found to date is the
>Cyberguard

On what basis do you make this assertion?  "secure" can mean a lot of 
things and a rubber stamp from NSA or it's equivalent doesn't mean a 
whole lot if buggy software can be trivially exploited.  We could go on 
about "usable" but I'll let that one slide.  In particular is the 
firewall configuration an EXACT match with the 
"certified/tested/evaluated" machine?  NT has a C2 rating but it's not 
worth a damn.  When was the last time you ran an NT box with no LAN, no 
floppy, and with a modified BIOS?  Not exactly a useful product.  Then 
again, assuming you duplicate this setup, place said machine nearish to a 
window.  Electronic eavesdropping (for about $3000 and change) or outside 
observation does tend to degrade the usefulness of said rating does it 
not?

>As mentioned the products are B1 compliant (awaiting certification)....
whatever, see above.

>They are relatively easy to setup , nice GUI and it has built in the
Ah, the GUI.  Remote manageable too I think I recall.  What to say when 
the X11 session gets hijacked?  You sure the box isn't running a 
braindamaged X11 server?  Can you attack the logging facility thru DOS?  
What happens when you bog the machine down with hundreds of connections?  
Does it run out of VM and spontaneously reboot?  How about the logs 
filling up the disk?  What happens when this occurs and an exploit is 
then launched?  Do you still have an audit trail?

>ablity for most "standard "(excuse the word) proxies and allows creation
>of probably anything you might need.
So they know how to check off all of the feature boxes on the report 
card.  Anybody can and everybody does that.

IMO ratings, be they NSA/NCSA or whatever aren't worth much and 
deffinately not a price premium.  I take far more comfort in people 
banging away at the available stuff and fixing the problems.  
Additionally, you really believe the vendor (or reviewer for that matter) 
went thru every single line of code specifically looking for possible 
exploits?  Get real.  All the ratings do is study the protection scheme 
and bless it as logical and OK at least in theory.  Then with various 
degrees of persistance they try to prove you can't get around said 
protection.  Holes and stack smashes by way of poorly written C and 
resolver libraries and DOS via SYN etc. aren't addressed.  If they were 
we wouldn't be plagued with some of the problems we have now.

From firewalls-owner  Sat Feb  1 20:25:39 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id UAA13424 for firewalls-outgoing; Sat, 1 Feb 1997 20:19:41 -0800 (PST)
Received: from mcfeely.bsfs.org (mcfeely.bsfs.org [204.91.13.34]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id UAA13416 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 20:19:28 -0800 (PST)
Received: (from wombat@localhost) by mcfeely.bsfs.org (8.6.12/8.6.12) id WAA23134; Sat, 1 Feb 1997 22:06:36 -0500
Date: Sat, 1 Feb 1997 22:06:30 -0500 (EST)
From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: "Starkweather, Mike" <mike.starkweather@anheuser-busch.com>
cc: "'firewalls@GreatCircle.COM'" <firewalls@GreatCircle.COM>
Subject: Re: Highly available Internet connection
In-Reply-To: <c=US%a=attmail%p=BUSCH%l=STLABCEXG010-970129224027Z-19370@stlabcexg001.anheuser-busch.com>
Message-ID: <Pine.BSF.3.91.970201220224.23106A-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Without two circuits, a local loop failure will take you down. You are 
much better off running two circuits, to two different ISPs, from two of 
your sites. Make sure you don't use two different ISPs that are both 
heavily dependant on the same MAE or NAP, or have heavily interdependant 
peering arangements, such that failure of a core router can still take out 
both.

-r.w.


On Wed, 29 Jan 1997, Starkweather, Mike wrote:

> My company wants to move toward Electronic Commerce on the Internet. 
>  One of the requirements would be a highly available, secure 
> connection.  One of the ideas I have considered is two firewalls going 
> out over two routers to two wide area links to two ISPs.  This is a 
> pretty brute force approach.
> 
> Does anyone have any ideas to share on how we might build an Internet 
> connection that would approach 100 percent availability?
> 
> Thanks for all your help.
> 
> Mike Starkweather
> Anheuser-Busch
> 

From firewalls-owner  Sat Feb  1 20:57:31 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id UAA14180 for firewalls-outgoing; Sat, 1 Feb 1997 20:42:38 -0800 (PST)
Received: from news.rc.on.ca ([207.176.151.6]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id UAA14164 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 20:42:24 -0800 (PST)
Received: by mail.rc.on.ca with Internet Mail Service (5.0.1389.3)
	id <01BC1099.5A732EB0@mail.rc.on.ca>; Sat, 1 Feb 1997 23:40:49 -0500
Message-ID: <41FDA823FC5AD011A0970000E8D5C667029390@mail.rc.on.ca>
From: Russ <Russ.Cooper@RC.on.ca>
To: Adam Shostack <adam@homeport.org>,
        "'Todd Graham Lewis'"
	 <lists@reflections.mindspring.com>
Cc: firewalls@GreatCircle.COM
Subject: RE: [NTSEC] ActiveX, MSIE and Quicken
Date: Sat, 1 Feb 1997 23:40:48 -0500
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1389.3)
Content-Type: text/plain;
	charset="iso-8859-1"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

To try and keep this on a Firewalls vein. The tunneling of anything over
HTTP is, in my opinion, the crappy technology. That goes for Java
applets or certificate authentication for that matter. I don't like the
idea of combining diverse tasks within a single channel if its possible
to avoid it, and it is possible, so the only reason its not being done
is to USURP FIREWALLS.

ActiveX as an Internet web surfing technology (i.e. interaction between
non-cooperating trust environments), despite the ability for vendors to
incorporate their bar codes on their packages, is just another
implementation of that same crappy technology.

BUT...

The issue is whether or not there is to be a future technology that
isn't crappy. I don't see how Firewall administrators can honestly say
that they trust Java applets any more than you can say you trust ActiveX
objects, when their coming from an untrusted source (even if that source
has signed the applet with a trustable digital certificate). Now don't
respond with the Java applets are more secure than ActiveX objects
thing, please. Neither can be completely trusted to the extent necessary
for a Firewall administrator to honestly say its OK to let it in.
ActiveX has no security, and Java applets have lots of security, but
neither provide sufficient control or reporting for a Firewall
administrator to really know what's happening where, and the sandbox
can't be trusted enough to say you don't need to care what a Java applet
it doing, IMO.

So neither technology are THE answer. Both technologies are
demonstrations of future technology which will become AN answer. Whether
either survive, or some hybrid or completely different technology
emerges as THE answer is still to be seen.

I argue that its been possible for applications to be installed on an
OLE machine and do what these malicious ActiveX objects (or hypothetical
objects) can do. It was required for them to be retrieved (in whatever
fashion), installed (in a variety of fashions including Trojans), and
invoked (again, covertly was not out of the question). So in the case of
an ActiveX object from a web page, you are asked if you want to retrieve
the object, whether or not it should be installed, and whether or not it
should be invoked. The issue seems to be how easy that has become, but
Windows 95 and NT 4.0 both implement a model that make that easy and
somewhat hidden (a shortcut accessed across a network share could easily
install itself without any notification whatsoever).

ActiveX is a big word, it covers a whole spate of technologies, of which
only one is its ability to be downloaded/installed/invoked from a web
page. Disparaging ActiveX as a technology because of one aspect of it is
like saying that Java applets are useless because they allow a reverse
connection back to their originating machine. Its one part of the
technology that needs to be replaced/improved.

Since Windows HAS BECOME an ActiveX environment, from top to bottom,
what's needed now is more emphasis on the environments security. Windows
NT 4.0 represents, somewhat, the environment that all OLE-based
platforms have to become. An environment where distributed computing is
possible, but can also be implemented securely. But this discussion
digresses into issues that shouldn't be debated here.

Bottom line is that with so little interest by Firewall administrators
in desktop security, their minds concreted in the idea that everything
is going to be controlled at the company gates by the GateKeeper, its
obvious that the Tunnellers will win and the GateKeepers will lose. With
that goes the legacy systems that put bottlenecks on technology and
innovation in favour of time-tested and proven security models. Fine,
it'll work great for lots of implementations, but while those walls
crumble and the GateKeeper continues to be assailed from his/her own
charges, at some point the realization will hit them that desktop
security and an integrated administration/security platform is the only
model that can move forward with the technology.

They say that a month on the web is the equivalent of a year for
anything else. So if a new Internet product is in public beta for 5
months, that's supposed to be the equivalent of 5 years. Obviously from
a security perspective this analogy doesn't work, since people aren't
testing products 12 times faster than they used to...;-] But if IS
decisions are being done at or near the pace of the Internet, clearly
something has to give somewhere. The only way that can happen is to
expand the scope of the GateKeeper from beyond the Firewall to include
the desktop. If these new technologies are implemented with this in
mind, it would be possible for a Firewall admin to probe, control, and
enforce a security policy at the desktop through a server cooperating
with the Firewall. ActiveX does make this possible, but the tools don't
exist yet (or aren't widely known) so it seems impossible.

So again I say it, block ActiveX objects if you can at your Firewall.
But get your head out of the sand and realize that this very same
technology could be put to valuable use in your environment to enhance
your ability to implement and enforce your security policy, and it all
could be done in total cooperation with your Firewall. All we have to do
is force the vendors to deliver the products that could do this. This
doesn't translate to a call for NT Firewalls (although light 'em if you
have 'em).

But if you think you can say that ActiveX is bad so take it way, you'll
have to tell them to take away all your MS desktops as well. I'm sure
many of you have been saying that for a while now, but the facts are in
front of the majority of you and can be seen just by looking around your
office.

> Cheers,
> Russ
> R.C. Consulting, Inc. - NT/Internet Security Consulting
> "Why does Plug-n-Play so often turn into Unplug-n-Pay?"

From firewalls-owner  Sat Feb  1 21:33:18 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id VAA15971 for firewalls-outgoing; Sat, 1 Feb 1997 21:08:59 -0800 (PST)
Received: from mcfeely.bsfs.org (mcfeely.bsfs.org [204.91.13.34]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id VAA15919 for <Firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 21:08:41 -0800 (PST)
Received: (from wombat@localhost) by mcfeely.bsfs.org (8.6.12/8.6.12) id WAA23257; Sat, 1 Feb 1997 22:55:57 -0500
Date: Sat, 1 Feb 1997 22:55:52 -0500 (EST)
From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: Matthew Archibald <matt@plato.West.Sun.COM>
cc: pyb@cadrus.fr, Firewalls@GreatCircle.COM
Subject: Re: Internal modems ?
In-Reply-To: <199701292016.MAA16951@plato.West.Sun.COM>
Message-ID: <Pine.BSF.3.91.970201225411.23106C-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



On Wed, 29 Jan 1997, Matthew Archibald wrote:

> 
> 
> 
> Two methods will work here...
> 
> 
> 	1) Get a dialer like 'toneloc' or other wardialer 
> 	   and run random checks against all known internal
> 	   phone numbers.
> 		- If a modem answers you have a hit
> 		- If it goes to voice or someone answers
> 		  they know you are checking, but hey,
> 		  that's what you want anyway
> 

Actually, they *might* know *somebody* is checking; be interesting to 
find out if anyone reports what they hear ... my guess is that nobody 
will even mention it to the IS team.

-r.w.

From firewalls-owner  Sat Feb  1 21:40:49 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id VAA16550 for firewalls-outgoing; Sat, 1 Feb 1997 21:13:59 -0800 (PST)
Received: from mail.primary.net (mail.primary.net [205.242.92.3]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id VAA16492 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 21:13:35 -0800 (PST)
Received: from desktop (pn7-ppp-106.primary.net [205.242.93.106]) by mail.primary.net (8.8.5/+primary) with SMTP id XAA09705 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 23:16:19 -0600 (CST)
Message-ID: <32F421E1.2F0C@primary.net>
Date: Sat, 01 Feb 1997 23:10:57 -0600
From: "Paul A. Murphy" <pamurphy@primary.net>
X-Mailer: Mozilla 3.0 (Win95; U)
MIME-Version: 1.0
To: firewalls@GreatCircle.COM
Subject: NT Firewalls
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello!

My company is looking into firewalls to protect our network that is
connected with a T-1.

Our company is migrating to NT as a standard and I am concerned that the
NT Firewalls are generally less secure than the UNIX firewalls and am
looking for material to make my case that the firewall be UNIX.

I would appreciate any comments related to the UNIX vs NT debate.

Thanks

Paul Murphy
St. Louis

From firewalls-owner  Sat Feb  1 21:55:27 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id VAA19188 for firewalls-outgoing; Sat, 1 Feb 1997 21:39:00 -0800 (PST)
Received: from mcfeely.bsfs.org (mcfeely.bsfs.org [204.91.13.34]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id VAA19135 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 21:38:43 -0800 (PST)
Received: (from wombat@localhost) by mcfeely.bsfs.org (8.6.12/8.6.12) id XAA23327; Sat, 1 Feb 1997 23:25:48 -0500
Date: Sat, 1 Feb 1997 23:25:43 -0500 (EST)
From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: Dave Cosio <dcosio@tanis.cptech.com>
cc: firewalls@GreatCircle.COM
Subject: Re: Dave at McGraw Hill
In-Reply-To: <32F22D67.4A41@tanis.cptech.com>
Message-ID: <Pine.BSF.3.91.970201232519.23106G-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Dave's not here, man.  ;)

On Fri, 31 Jan 1997, Dave Cosio wrote:

> Dave,
> 
> I had problem with my mail and lost your address.
> could you resend it.
> 
> thanks
> 
> -Dave Cosio
> 

From firewalls-owner  Sat Feb  1 22:08:04 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id VAA16933 for firewalls-outgoing; Sat, 1 Feb 1997 21:19:26 -0800 (PST)
Received: from mcfeely.bsfs.org (mcfeely.bsfs.org [204.91.13.34]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id VAA16902 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 21:19:13 -0800 (PST)
Received: (from wombat@localhost) by mcfeely.bsfs.org (8.6.12/8.6.12) id XAA23271; Sat, 1 Feb 1997 23:06:19 -0500
Date: Sat, 1 Feb 1997 23:06:14 -0500 (EST)
From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: Laura_Bohde@prenhall.com
cc: "'firewalls@GreatCircle.COM'" <firewalls@GreatCircle.COM>,
        "Starkweather; Mike" <mike.starkweather@anheuser-busch.com>
Subject: Re: Highly available Internet connection
In-Reply-To: <2F023040.@prenhall.com>
Message-ID: <Pine.BSF.3.91.970201230533.23106D-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Not very resistant to back-hoe fade ...

On Wed, 29 Jan 1997 Laura_Bohde@prenhall.com wrote:

>         
>         We have two routers connected to the Internet configured 
>         identically, as well as two hubs, two firewalls, and two 
>         hubs on the other side.  Then we installed Black Box 
>         power on/off switches (one on each router, and one on 
>         each hub at the other end).  This way we can leave one 
>         network up and the other powered off.  If any device in 
>         the "primary" network fails, with a simple phone call 
>         (our help desk can even do this), one network can be 
>         powered off and the other powered up.  (this way all 
>         equipment can actually have the same IP addresses too.)
>         
>         Hope this helps -
>         
>         Laura
> 

From firewalls-owner  Sat Feb  1 23:13:32 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id WAA27794 for firewalls-outgoing; Sat, 1 Feb 1997 22:58:15 -0800 (PST)
Received: from xyzzy.plugh.edmonton.ab.ca (xyzzy.plugh.edmonton.ab.ca [198.161.22.2]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id WAA27787 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 22:58:04 -0800 (PST)
Received: (from uucp@localhost) by xyzzy.plugh.edmonton.ab.ca (8.6.12/8.6.9) id XAA21095; Sat, 1 Feb 1997 23:56:29 -0700
Received: from snouts-gw.obtuse.com(192.168.30.61), claiming to be "snouts.obtuse.com"
 via SMTP by mailhost.plugh.edmonton.ab.ca, id smtpd21092aaa; Sat Feb  1 23:56:21 1997
Received: (from beck@localhost) by snouts.obtuse.com (8.7.5/8.7.3) id XAA01520; Sat, 1 Feb 1997 23:56:17 -0700
From: Bob Beck <beck@obtuse.com>
Message-Id: <199702020656.XAA01520@snouts.obtuse.com>
Subject: Re: [NTSEC] ActiveX, MSIE and Quicken
To: Russ.Cooper@RC.on.ca (Russ)
Date: Sat, 1 Feb 1997 23:56:15 -0700 (MST)
Cc: adam@homeport.org, lists@reflections.mindspring.com,
        firewalls@GreatCircle.COM
In-Reply-To: <41FDA823FC5AD011A0970000E8D5C667029390@mail.rc.on.ca> from "Russ" at Feb 1, 97 11:40:48 pm
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> To try and keep this on a Firewalls vein. The tunneling of anything over
> HTTP is, in my opinion, the crappy technology. That goes for Java
> applets or certificate authentication for that matter. I don't like the
> idea of combining diverse tasks within a single channel if its possible
> to avoid it, and it is possible, so the only reason its not being done
> is to USURP FIREWALLS.

	Perhaps if you're using only a packet filter yes, but
hopefully on a real firewall you're proxying your http, and there's
nothing at all to "USURP". You recognize it, and deal with it in the
proxy.
	
	Notwithstanding that, doing embedded "stuff" like this is
normal, and doing evil with it is a lot older than http:

----------------------
oldvax%mail bigluser@sucker.org
Subject: Hey Dude, Try this neat new script out..
#!/bin/sh
[ insert hack here - trojan .login to mail me their password next time]
[ etc. etc. ]  

From firewalls-owner  Sun Feb  2 00:55:26 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id AAA04631 for firewalls-outgoing; Sun, 2 Feb 1997 00:37:17 -0800 (PST)
Received: from hamlin.cc.boun.edu.tr (hamlin.cc.boun.edu.tr [193.140.192.9]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id AAA04613 for <Firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 00:36:59 -0800 (PST)
Received: from ReAlbi.cc.boun.edu.tr by hamlin.cc.boun.edu.tr (AIX 4.1/UCB 5.64/4.03)
          id AA61498; Sun, 2 Feb 1997 10:31:15 +0300
Message-Id: <32F4513E.3BA1440E@boun.edu.tr>
Date: Sun, 02 Feb 1997 10:33:02 +0200
From: Can Baysal <baysalc@boun.edu.tr>
Organization: BUCC
X-Mailer: Mozilla 3.01Gold (X11; I; Linux 1.3.20 i586)
Mime-Version: 1.0
To: "'Firewalls@GreatCircle.COM'" <Firewalls@GreatCircle.COM>
Subject: Re: SATAN user group?
References: <c=US%a=_%p=NASA%l=KSCMBS30-970129232003Z-3746@kscgws00.ksc.nasa.gov>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Ferrell-1, Ema wrote:
> 
> Hi all,
> 
.....................
> P.S.  For those who don't know SATAN stands for Security Administrator's
> Tool for Analyzing Networks.

	Hey, thanks for the information, I was trying to find out why they do
not call that as SANTA. I wonder, what they do if Venema and Farmer
heard this. Maybe they will write something like repent.


> 
> Thanks in advance,
> 
> Ema Ferrell
> Subsystems Engineering Branch
> Shuttle Data Center/DE-CLC-A
> 407-861-7275 (phone #)
> 407-861-7470 (fax #)

From firewalls-owner  Sun Feb  2 02:41:18 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id BAA07905 for firewalls-outgoing; Sun, 2 Feb 1997 01:46:12 -0800 (PST)
Received: from polaris.pacificnet.net (polaris.pacificnet.net [207.171.0.250]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id BAA07889 for <Firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 01:45:54 -0800 (PST)
From: osiris@pacificnet.net
Received: from lwash (pm3a-16.pacificnet.net [207.171.18.17]) by polaris.pacificnet.net (8.6.11/8.6.11) with SMTP id BAA25173; Sun, 2 Feb 1997 01:43:38 -0800
Message-ID: <32F462D3.38E3@pacificnet.net>
Date: Sun, 02 Feb 1997 01:48:03 -0800
Organization: -
X-Mailer: Mozilla 3.01Gold (Win95; I)
MIME-Version: 1.0
To: Can Baysal <baysalc@boun.edu.tr>
CC: "'Firewalls@GreatCircle.COM'" <Firewalls@GreatCircle.COM>
Subject: Re: SATAN user group?
References: <c=US%a=_%p=NASA%l=KSCMBS30-970129232003Z-3746@kscgws00.ksc.nasa.gov> <32F4513E.3BA1440E@boun.edu.tr>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Can Baysal wrote:
> 
> Ferrell-1, Ema wrote:
> >
> > Hi all,
> >
> .....................
> > P.S.  For those who don't know SATAN stands for Security Administrator's
> > Tool for Analyzing Networks.
> 
>         Hey, thanks for the information, I was trying to find out why they do
> not call that as SANTA. I wonder, what they do if Venema and Farmer
> heard this. Maybe they will write something like repent.

You are either joking or have landed on the most unlikely coincidence!
Contained within the SATAN distribution is a script called "repent" that
will change all references of "SATAN" to "SANTA." In any event..

Has anyone on this list tried "Merlin?" I am wondering whether anyone
has attempted to make a siilar interface to manage firewall
admnistration and auditing. (Merln is a tool from CIAC. It integrates
Tripwire, COPS, TIGER, Crack and reportedly, SPI, which is unavailable
to us regular folk. The interface is exclusively PERL/HTML for use in
X.)

From firewalls-owner  Sun Feb  2 03:04:29 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id CAA09423 for firewalls-outgoing; Sun, 2 Feb 1997 02:14:27 -0800 (PST)
Received: from hamlin.cc.boun.edu.tr (hamlin.cc.boun.edu.tr [193.140.192.9]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id CAA09415 for <Firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 02:14:00 -0800 (PST)
Received: from ReAlbi.cc.boun.edu.tr by hamlin.cc.boun.edu.tr (AIX 4.1/UCB 5.64/4.03)
          id AA28350; Sun, 2 Feb 1997 12:07:50 +0300
Message-Id: <32F467E1.7E1C0F55@boun.edu.tr>
Date: Sun, 02 Feb 1997 12:09:37 +0200
From: Can Baysal <baysalc@boun.edu.tr>
Organization: BUCC
X-Mailer: Mozilla 3.01Gold (X11; I; Linux 1.3.20 i586)
Mime-Version: 1.0
To: "'Firewalls@GreatCircle.COM'" <Firewalls@GreatCircle.COM>
Subject: Re: SATAN user group?
References: <c=US%a=_%p=NASA%l=KSCMBS30-970129232003Z-3746@kscgws00.ksc.nasa.gov> <32F4513E.3BA1440E@boun.edu.tr> <32F462D3.38E3@pacificnet.net>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

osiris@pacificnet.net wrote:
> 
> >         Hey, thanks for the information, I was trying to find out why they do
> > not call that as SANTA. I wonder, what they do if Venema and Farmer
> > heard this. Maybe they will write something like repent.
> 
> You are either joking or have landed on the most unlikely coincidence!

	:)

> Contained within the SATAN distribution is a script called "repent" that
> will change all references of "SATAN" to "SANTA." In any event..
> 
> Has anyone on this list tried "Merlin?" I am wondering whether anyone
> has attempted to make a siilar interface to manage firewall
> admnistration and auditing. (Merln is a tool from CIAC. It integrates
> Tripwire, COPS, TIGER, Crack and reportedly, SPI, which is unavailable

	You know it is the way of our days, you can reach parts but not the
whole. 

> to us regular folk. The interface is exclusively PERL/HTML for use in
> X.)

From firewalls-owner  Sun Feb  2 04:55:28 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id EAA16076 for firewalls-outgoing; Sun, 2 Feb 1997 04:43:16 -0800 (PST)
Received: from gargoyle.clark.net (pa1dsp11.dcwt.infi.net [208.136.65.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id EAA16068 for <firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 04:42:52 -0800 (PST)
Received: (qmail 21874 invoked by uid 500); 2 Feb 1997 12:42:42 -0000
Date: Sun, 2 Feb 1997 07:42:42 -0500 (EST)
From: "Paul D. Robertson" <proberts@clark.net>
X-Sender: proberts@gargoyle
To: Russ <Russ.Cooper@RC.on.ca>
cc: Adam Shostack <adam@homeport.org>,
        "'Todd Graham Lewis'" <lists@reflections.mindspring.com>,
        firewalls@GreatCircle.COM
Subject: RE: [NTSEC] ActiveX, MSIE and Quicken
In-Reply-To: <41FDA823FC5AD011A0970000E8D5C667029390@mail.rc.on.ca>
Message-ID: <Pine.LNX.3.91.970202071714.18864S-100000@gargoyle>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Sat, 1 Feb 1997, Russ wrote:

> To try and keep this on a Firewalls vein. The tunneling of anything over
> HTTP is, in my opinion, the crappy technology. That goes for Java
> applets or certificate authentication for that matter. I don't like the
> idea of combining diverse tasks within a single channel if its possible
> to avoid it, and it is possible, so the only reason its not being done
> is to USURP FIREWALLS.

Right, this is my whole problem with SSL.  SHTTP was better, though I'd 
prefer that the firewall be able to man-in-the-middle the crypto stuff in 
either case, so as to pass it through an application layer gateway.  
 
> administrator to really know what's happening where, and the sandbox
> can't be trusted enough to say you don't need to care what a Java applet
> it doing, IMO.

This is an issue with the implementation of the JVM though, which is 
certainly a better thing that straight object code.  It's more a 'lesser 
of two evils' situation.  I *could* see the JVM actually evolving into a 
trusted environment, or more properly, into a well-bounded untrusted 
one.  I can't see OLE ever doing the same, so I'd rather try to back the 
horse that I'd like to see win.

> So neither technology are THE answer. Both technologies are
> demonstrations of future technology which will become AN answer. Whether
> either survive, or some hybrid or completely different technology
> emerges as THE answer is still to be seen.

Which makes this the right time to be pressing for improvements in both,
which blocking by enough people will get addressed.  Certainly, the fact that
ActiveX was holding us back from authorizing IE as an approved browser 
got at least a preliminary answer from MS.  It's too bad they won't 
follow up on specific implementation deficiencies as quickly.

> Windows 95 and NT 4.0 both implement a model that make that easy and
> somewhat hidden (a shortcut accessed across a network share could easily
> install itself without any notification whatsoever).

This is true, and I think a number of companies are falling back to the
old military compartmentalization model, I know we certainly are.  The 
first order of business is to tighten down the interaction between the
'internal to the company' and the 'external to the company' zones, then 
the internal ones get the next set of restrictions.

> what's needed now is more emphasis on the environments security. Windows
> NT 4.0 represents, somewhat, the environment that all OLE-based
> platforms have to become. An environment where distributed computing is
> possible, but can also be implemented securely. But this discussion
> digresses into issues that shouldn't be debated here.

NT 4.0 is a start, but it certainly isn't the culmination of that evolution.

> Bottom line is that with so little interest by Firewall administrators
> in desktop security, their minds concreted in the idea that everything
> is going to be controlled at the company gates by the GateKeeper, its
> obvious that the Tunnellers will win and the GateKeepers will lose. With
> that goes the legacy systems that put bottlenecks on technology and
> innovation in favour of time-tested and proven security models. Fine,
> it'll work great for lots of implementations, but while those walls
> crumble and the GateKeeper continues to be assailed from his/her own
> charges, at some point the realization will hit them that desktop
> security and an integrated administration/security platform is the only
> model that can move forward with the technology.

The only way you can be proactive with desktop security is to control 
what runs on the desktop.  That's why it's important to get the 
developers listening now, and not to accept blind tunneling.

> is force the vendors to deliver the products that could do this. This
> doesn't translate to a call for NT Firewalls (although light 'em if you
> have 'em).

It certainly *shouldn't* translate to a call for NT firewalls, that's too 
much like in-band control of the phone switch.

> But if you think you can say that ActiveX is bad so take it way, you'll
> have to tell them to take away all your MS desktops as well. I'm sure
> many of you have been saying that for a while now, but the facts are in
> front of the majority of you and can be seen just by looking around your
> office.

$300 NCs would make that a viable alternative.  Too bad that's not a 
fiscal reality.  The fact is that most desktop users in a corporate 
environment don't *need* OLE, or most of the other bloat that comes with 
a desktop OS.  Most of them don't *need* the Internet either.  But I'm 
still not at a point where I'm ready to pack up my toys and go home.

With the right JVM, or with a JVM on the right hardware, Java can be 
well-bounded enough to be trustworthy.  There's a couple of years worth 
of work there, but it is possible.  I just don't see how you can do it, 
even with twice as long with OLE.  

Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
proberts@clark.net      which may have no basis whatsoever in fact."
                                                                     PSB#9280


From firewalls-owner  Sun Feb  2 07:28:20 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id HAA20065 for firewalls-outgoing; Sun, 2 Feb 1997 07:10:38 -0800 (PST)
Received: from internic.uob.bh ([193.188.12.10]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id HAA20012 for <firewalls@greatcircle.com>; Sun, 2 Feb 1997 07:10:15 -0800 (PST)
Received: from netmgr.uob.bh ([193.188.12.65]) by internic.uob.bh
          (Netscape Mail Server v2.0) with SMTP id AAA7058
          for <firewalls@greatcircle.com>; Sat, 1 Feb 1997 08:45:59 +0300
Message-ID: <32F2D77E.6B7C@admin.uob.bh>
Date: Sat, 01 Feb 1997 08:41:18 +0300
From: "Hisham Abdullatif Al-Rumaihi" <rumaihi@admin.uob.bh>
Reply-To: rumaihi@admin.uob.bh
Organization: University of Bahrain
X-Mailer: Mozilla 3.0 (Win95; I)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: DHCP
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

We are using DHCP server runing on windows NT 4.0, is it possible to
view/print the DHCP database?.

Can you suggust any mailing list that is relatd to (networks).

Thank you.

From firewalls-owner  Sun Feb  2 11:25:37 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id LAA28196 for firewalls-outgoing; Sun, 2 Feb 1997 11:08:54 -0800 (PST)
Received: from smtp2.erols.com (smtp2.erols.com [205.252.116.102]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id LAA28159 for <firewalls-digest@greatcircle.com>; Sun, 2 Feb 1997 11:08:41 -0800 (PST)
Received: from chris ([208.199.94.198])
	by smtp2.erols.com (8.8.5/8.8.5) with SMTP id OAA10765
	for <firewalls-digest@greatcircle.com>; Sun, 2 Feb 1997 14:07:23 -0500 (EST)
Message-ID: <32F4E5E9.1504@tidalwave.net>
Date: Sun, 02 Feb 1997 14:07:21 -0500
From: Chris Pressley <chrisp@tidalwave.net>
Reply-To: chrisp@sitescape.com
X-Mailer: Mozilla 3.0 (Win95; U)
MIME-Version: 1.0
To: firewalls-digest@greatcircle.com
Subject: Optimal Throughput for NAT
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

NAT is a small part of my overall security plan. I'm looking for the
best way to implement NAT, primarily from a cost and performance
standpoint. Currently, I know of three ways to do NAT:
  1) Install and configure a firewall
  2) Dedicate a host, using software such as IPRoute    
(http://www.mischler.com/iproute/)
  3) Configure a router (e.g. Cisco with IOS 11.2 and "IP Options")

I'm looking for feedback on the following:
  1) What is my best dollar/cost solution?
  2) Are there other ways to implement NAT that I'm not aware of?

Thanks in advance for any feedback.

Chris


From firewalls-owner  Sun Feb  2 11:45:29 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id LAA28625 for firewalls-outgoing; Sun, 2 Feb 1997 11:25:17 -0800 (PST)
Received: from mail.baileynm.com (fw.baileynm.com [206.109.159.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id LAA28617 for <firewalls@GreatCircle.com>; Sun, 2 Feb 1997 11:25:06 -0800 (PST)
Received: (qmail 10479 invoked from smtpd); 2 Feb 1997 19:23:53 -0000
Received: from web.nmti.com (root@198.178.0.201)
  by fw.nmti.com with SMTP; 2 Feb 1997 19:23:53 -0000
Received: from sonic.nmti.com (peter@sonic.nmti.com [198.178.0.2]) by web.nmti.com (8.6.12/8.6.9) with SMTP id NAA06030; Sun, 2 Feb 1997 13:23:52 -0600
Received: by sonic.nmti.com; id AA10062; Sun, 2 Feb 1997 13:18:18 -0600
From: peter@baileynm.com (Peter da Silva)
Message-Id: <9702021918.AA10062@sonic.nmti.com.nmti.com>
Subject: Re: [NTSEC] ActiveX, MSIE and Quicken
To: Russ.Cooper@RC.on.ca (Russ)
Date: Sun, 2 Feb 1997 13:18:17 -0600 (CST)
Cc: firewalls@GreatCircle.com
In-Reply-To: <41FDA823FC5AD011A0970000E8D5C667029390@mail.rc.on.ca> from "Russ" at Feb 1, 97 11:40:48 pm
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Since Windows HAS BECOME an ActiveX environment, from top to bottom,
> what's needed now is more emphasis on the environments security. Windows
> NT 4.0 represents, somewhat, the environment that all OLE-based
> platforms have to become. An environment where distributed computing is
> possible, but can also be implemented securely. But this discussion
> digresses into issues that shouldn't be debated here.

We've already had this discussion, Russ, so I'll just say that NT at this
time is nowhere *near* an environment where you could even *think* of
running untrusted applications. A Java sandbox, or a chrooted secured
sandbox on certain UNIX implementations, is getting there. The Safe Tcl
sandbox is closer.

I think that you could probably build an extremely useful sandbox using the
NT kernel as a start, though it wouldn't include the Win32 subsystem... or
if it did that subsystem would be so crippled that it wouldn't run any
applications that currently exist out there. I've said before that the
underlying NT security model, while overly complex, has a lot of potential...
but it's never going to acheive that potential in Microsoft's hands, and if
you think otherwise you're fooling yourself.

The UNIX model is less fine-grained, but it's also a lot *simpler*, and there
are ways to shed the parts of a UNIX implementation that don't use that model
without breaking the UNIX API, because it's so much higher level than the
NT one. Just as it's possible to shed the dangerous parts of Tcl without
breaking the ability to do useful things in Tcl... simply because it's such
a high level and simple model.

> Bottom line is that with so little interest by Firewall administrators
> in desktop security, their minds concreted in the idea that everything
> is going to be controlled at the company gates by the GateKeeper,

That's because it's the only place we have any control. We can't control the
desktop, because our users have undeniable business reasons to support the
inherently insecure Windows API. So long as that's true, all we can do is block
the tunnelers. Because the Internet is not near as important as the desktop,
so we can get away with telling people they can't use this or that new internet
toy.

> innovation in favour of time-tested and proven security models. Fine,
> it'll work great for lots of implementations, but while those walls
> crumble and the GateKeeper continues to be assailed from his/her own
> charges, at some point the realization will hit them that desktop
> security and an integrated administration/security platform is the only
> model that can move forward with the technology.

I would dearly like to see that, but I don't believe it will happen. The
desktop is firmly in the hands of a man who can spell security but has no
idea of what it means.

> But if you think you can say that ActiveX is bad so take it way, you'll
> have to tell them to take away all your MS desktops as well.

Love to, but that won't happen. That's like trying to fireproof your
office by banning paper.

> I'm sure
> many of you have been saying that for a while now, but the facts are in
> front of the majority of you and can be seen just by looking around your
> office.

Yep. And those facts say that the desktop will be completely unable to
provide any useful security for the forseeable future.

From firewalls-owner  Sun Feb  2 12:10:29 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id LAA00228 for firewalls-outgoing; Sun, 2 Feb 1997 11:54:21 -0800 (PST)
Received: from neon.ingenia.ca (neon.ingenia.com [205.207.220.57]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id LAA00208 for <firewalls@greatcircle.com>; Sun, 2 Feb 1997 11:54:05 -0800 (PST)
Received: (from shaver@localhost) by neon.ingenia.ca (8.8.5/8.7.3) id OAA23121; Sun, 2 Feb 1997 14:52:31 -0500
From: Mike Shaver <shaver@neon.ingenia.ca>
Message-Id: <199702021952.OAA23121@neon.ingenia.ca>
Subject: Re: [NTSEC] ActiveX, MSIE and Quicken
In-Reply-To: <Pine.LNX.3.95.970131093619.355F-100000@reflections.mindspring.com> from Todd Graham Lewis at "Jan 31, 97 09:42:57 am"
To: lists@reflections.mindspring.com (Todd Graham Lewis)
Date: Sun, 2 Feb 1997 14:52:29 -0500 (EST)
Cc: firewalls@greatcircle.com
X-Mailer: ELM [version 2.4ME+ PL28 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Thus spake Todd Graham Lewis:
> On Fri, 31 Jan 1997, Russ wrote:
> 
> > So yes, plug it up today, that's what I recommend anyway, but What we
> > really need are new/improved desktop security products, not more filters
> > for Firewalls.
> 
> Not to be contentious or anything, but what we _need_ are designers who
> put different technologies on different port numbers rather than cramming
> everything under the sun down port 80.

Pardon the arrogance, but what we _need_ are firewall
designers/implementors/administrators/advocates who have outgrown the
bogus `port = protocol' bit.  Ports have meaning only for connection
management.  The use of `well-known-ports' is a convenience (snicker)
at best, designed to allow people to synchronize their /etc/services
files in lieu of a decent service-location directory or whatever.

Assuming that port 80 means HTTP is only marginally more clueful than
assuming that ports below 1024 are from root and so it's all Really OK
To Trust Them.

(Similarly for assuming that HTTP means HTML and images.)

If you want to filter an application protocol, you need a
application-protocol-level filter.

> Geez, at age 21 I really am too young to get an ulcer.

Not by a fair shot, gramps. =)

Mike

--
#> Mike Shaver (shaver@ingenia.com) Ingenia Communications Corporation 
#>                   Welcome to the technocracy.
#>                                                                     
#> "Nobody ever went broke underestimating the public's intelligence."
#>                    - cbird@chat.carleton.ca

From firewalls-owner  Sun Feb  2 15:38:00 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id OAA13761 for firewalls-outgoing; Sun, 2 Feb 1997 14:50:49 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id OAA13587 for <firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 14:50:07 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.6.10/SMI-4.1/Brent-961106)
	id OAA00888; Sun, 2 Feb 1997 14:16:43 -0800
Received: from squirrel.com(192.135.191.159) by mycroft via smap (V1.3mjr)
	id sma000879; Sun Feb  2 14:16:33 1997
Received: (from mch@localhost) by squirrel.com (8.6.12/SQUIRREL-1.0) id OAA15113; Sun, 2 Feb 1997 14:17:57 -0800
Message-ID: <Mutt.19970202141757.mch@ratatosk.squirrel.com>
Date: Sun, 2 Feb 1997 14:17:57 -0800
From: mch@squirrel.com (Mark Henderson)
To: chrisp@sitescape.com
Cc: firewalls@GreatCircle.COM
Subject: Re: Optimal Throughput for NAT
References: <32F4E5E9.1504@tidalwave.net>
X-Mailer: Mutt 0.58.1
Mime-Version: 1.0
Content-Type: multipart/signed; protocol="application/pgp-signature";
	micalg=pgp-md5; boundary=BcSYHtfZcVUIIZwe
In-Reply-To: <32F4E5E9.1504@tidalwave.net>; from Chris Pressley on Feb 2, 1997 14:07:21 -0500
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


--BcSYHtfZcVUIIZwe

Chris Pressley writes:
> NAT is a small part of my overall security plan. I'm looking for the
> best way to implement NAT, primarily from a cost and performance
> standpoint. Currently, I know of three ways to do NAT:
>   1) Install and configure a firewall
>   2) Dedicate a host, using software such as IPRoute    
> (http://www.mischler.com/iproute/)
>   3) Configure a router (e.g. Cisco with IOS 11.2 and "IP Options")
> 
> I'm looking for feedback on the following:
>   1) What is my best dollar/cost solution?
>   2) Are there other ways to implement NAT that I'm not aware of?

I'm not going to attempt to answer the larger question, but you might 
also take a look at IP filter. It provides packet filtering, NAT 
functionality, and support for transparent proxies. It can also keep
some connection state information. 

http://coombs.anu.edu.au/~avalon/ip-filter.html

N.B. Although I like the feature set of this package, it is very much 
still a work in progress. If you aren't comfortable hacking a little 
C or generally playing around with your kernel, you should probably 
stay away from this. 


--BcSYHtfZcVUIIZwe
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a

iQCVAwUBMvUSi6WYCYyyZn7/AQE5igP/WF7pCucj7LBONTbYQ7y6ZASEV2qLQ4qC
Y+Hm/dVWpuwG258kIFen5WnJqEGiluoGicl3crF4cL0tr/AEQHSoSABDuZfuw9Y1
RPhWdljpOmDn2FaxjWr3CSVPEG1BQxAVhGvEj+RSq1pu10JWoGK13C1vbt7gNwqo
yGw18AuW584=
=m8cD
-----END PGP SIGNATURE-----

--BcSYHtfZcVUIIZwe--

From firewalls-owner  Sun Feb  2 15:39:53 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id OAA10394 for firewalls-outgoing; Sun, 2 Feb 1997 14:00:44 -0800 (PST)
Received: from xyzzy.plugh.edmonton.ab.ca (xyzzy.plugh.edmonton.ab.ca [198.161.22.2]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id OAA10330 for <firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 14:00:22 -0800 (PST)
Received: (from uucp@localhost) by xyzzy.plugh.edmonton.ab.ca (8.6.12/8.6.9) id OAA23227; Sun, 2 Feb 1997 14:59:07 -0700
Received: from snouts-gw.obtuse.com(192.168.30.61), claiming to be "snouts.obtuse.com"
 via SMTP by mailhost.plugh.edmonton.ab.ca, id smtpd23225aaa; Sun Feb  2 14:58:56 1997
Received: (from beck@localhost) by snouts.obtuse.com (8.7.5/8.7.3) id OAA02338; Sun, 2 Feb 1997 14:58:54 -0700
From: Bob Beck <beck@obtuse.com>
Message-Id: <199702022158.OAA02338@snouts.obtuse.com>
Subject: Re: [NTSEC] ActiveX, MSIE and Quicken
To: peter@baileynm.com (Peter da Silva)
Date: Sun, 2 Feb 1997 14:58:52 -0700 (MST)
Cc: Russ.Cooper@RC.on.ca, firewalls@GreatCircle.COM
In-Reply-To: <9702021918.AA10062@sonic.nmti.com.nmti.com> from "Peter da Silva" at Feb 2, 97 01:18:17 pm
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


	Banning ActiveX at the firewall is hardly taking away the MS
desktops. It's still viable inside the firewall as long as you're
talking about a relatively trusted environment. If you aren't talking
about a relatively trusted environment inside you probably shouldn't
be running an MS desktop anyway.

> > But if you think you can say that ActiveX is bad so take it way, you'll
> > have to tell them to take away all your MS desktops as well.
> 
> Love to, but that won't happen. That's like trying to fireproof your
> office by banning paper.
> 
	Not all that inconcievable.  There are perfectly viable
alternatives to an MS desktop for anyone who feels like using
them. It's also possible to put them on another net by themselves with
a seperate firewall and security policy. You can even run them fairly
open, with the security policy that sensitive stuff doesn't go on the
open net. I.E. network A is the low security network where the users
are allowed to sysadmin their own desktops. Network B is the high
security network where that isn't allowed, and the permitted OS's are
mandated. Network B doesn't trust network A any more than it trusts
the internet. Not foolproof in the slightest, but draws a better
boundary for the users as to what is important.

	
> > I'm sure
> > many of you have been saying that for a while now, but the facts are in
> > front of the majority of you and can be seen just by looking around your
> > office.
> 
> Yep. And those facts say that the desktop will be completely unable to
> provide any useful security for the forseeable future.
> 

	Microsoft's desktop will always be completely unable to
provide any useful security for the exact same reasons as we've seen
for years and years with Sendmail. It's big, bloated and constantly
afflicted with creeping featuritism. It's not *designed* to provide
useful security, it's designed to work well as a desktop environment
that can sell. period, Just as Sendmail is a MTA first and security
somewhere not first. (This isn't always a bad thing if your first and
formost requirement is a powerful MTA) Security can be addressed for
99% of it's users by a few glossies with the words "Hacker" "Internet"
and "C2" jumbled in the the rest of the marketing hype, since the odds
are they'll never get seriously hit even if they ran a fully unsecured
box.

	-Bob
--
Bob Beck					 Obtuse Systems Corporation
beck@obtuse.com					 http://www.obtuse.com/	
True Evil hides its real intentions in its street address. Search and you
shall find it, and the truth shall set you free.




From firewalls-owner  Sun Feb  2 16:28:33 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id NAA08292 for firewalls-outgoing; Sun, 2 Feb 1997 13:31:34 -0800 (PST)
Received: from smtp1.erols.com (smtp1.erols.com [205.252.116.101]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id NAA08238 for <firewalls@greatcircle.com>; Sun, 2 Feb 1997 13:31:07 -0800 (PST)
Received: from chris ([208.199.94.119])
	by smtp1.erols.com (8.8.5/8.8.5) with SMTP id QAA17222
	for <firewalls@greatcircle.com>; Sun, 2 Feb 1997 16:30:42 -0500
Message-ID: <32F4FE72.7344@tidalwave.net>
Date: Sun, 02 Feb 1997 15:52:02 -0500
From: Chris Pressley <chrisp@tidalwave.net>
Reply-To: chrisp@sitescape.com
X-Mailer: Mozilla 3.0 (Win95; U)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: Optimal Throughput for NAT
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

NAT is a small part of my overall security plan. I'm looking for the
best way to implement NAT, primarily from a cost and performance
standpoint. Currently, I know of three ways to do NAT:
  1) Install and configure a firewall
  2) Dedicate a host, using software such as IPRoute    
     (http://www.mischler.com/iproute/)
  3) Configure a router (e.g. Cisco with IOS 11.2 and "IP Options")

I'm looking for feedback on the following:
  1) What is my best dollar/cost solution?
  2) Are there other ways to implement NAT that I'm not aware of?

Thanks in advance for any feedback.
 
Chris


From firewalls-owner  Sun Feb  2 16:46:45 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id PAA19969 for firewalls-outgoing; Sun, 2 Feb 1997 15:55:03 -0800 (PST)
Received: (mcb@localhost) by miles.greatcircle.com (8.7.4/Miles-960830-1) id PAA19959 for firewalls@greatcircle.com; Sun, 2 Feb 1997 15:54:58 -0800 (PST)
Received: from news.rc.on.ca ([207.176.151.6]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id NAA14337 for <firewalls@GreatCircle.COM>; Sat, 1 Feb 1997 13:38:02 -0800 (PST)
Received: by mail.rc.on.ca with Internet Mail Service (5.0.1389.3)
	id <01BC105E.11DA9840@mail.rc.on.ca>; Sat, 1 Feb 1997 16:36:27 -0500
Message-ID: <41FDA823FC5AD011A0970000E8D5C667029384@mail.rc.on.ca>
From: Russ <Russ.Cooper@RC.on.ca>
To: "'Firewalls Mailing List'" <firewalls@GreatCircle.COM>
Subject: NTBugTraq now available
Date: Sat, 1 Feb 1997 16:36:26 -0500
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1389.3)
Content-Type: text/plain;
	charset="iso-8859-1"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Windows NT BugTraq Mailing List

In the tradition of Aleph One's BugTraq mailing list, this list
has been created to invite the free and open discussion of
Windows NT Security Exploits/Bugs or *SEBs* as I call them. This
list is not intended to be a forum to discuss "how to" issues, but
instead should be used to report reproducible SEBs which you have
personally encountered with Windows NT or its related BackOffice
products.

Q:What is a SEB?
A:Anything that can be done to a Windows NT installation via a
  remote connection (network or RAS) or through the local
  installation of commercial software which causes Windows NT to
  react in anything but an expected fashion. So telnet to TCP port
  135 and typing 15 characters thereby causing the Windows NT CPU
  to go to 100% utilization would be an acceptable topic. Sitting
  at a console logged in as Administrator and removing the
  Administrator's file permissions on the %systemroot%\system32
  would not be considered an acceptable topic.

Do's:
- Discuss SEB resolution or workaround.
- Discuss SEBs in third-party Windows NT products, providing that
  the product is designed for BackOffice.
- Discuss Macintosh, Netware, or Samba/Unix-related SEBs assuming
  that the SEB is related to Windows NT involvement.

Don'ts:
- Discuss Windows '95, unless, and only if, the Windows NT SEB
  can only be reproduced with a Windows '95 client.
- Discuss Windows for Workgroups or Windows 3.x, for any reason.
- Discuss products to enhance security, unless they have been
  proven to resolve an outstanding SEB.
- Discuss Unix SEBs, these should be addressed to
  BUGTRAQ@NETSPACE.ORG (subscribe through LISTSERV@NETSPACE.ORG)
- Discuss general Windows NT Security, how to, what to, why to,
  type questions. The NTSecurity@ISS.net list (subscribe through
  MAJORDOMO@ISS.NET) would be a better forum to discuss these
  issues.

Vendor involvement in the list is not discouraged, but I would
ask that you not use this forum as a method of advertising the
value of your products. If a SEB shows a weakness in Windows NT
design, and your product can resolve that weakness, a short note
indicating TECHNICALLY how your product addresses the issue would
be consider appropriate. If you don't address the issue in a
technical fashion your subscription will be revoked.

Now after reading all of this you'll probably wonder why I'm
being so restrictive. For one, I want to keep the volume low, as
low as possible. I want to keep the content as pertinent as I
possibly can so that the list becomes a useful tool for everyone
using Windows NT. If the list can remain on topic, people will
post SEBs here first, and we will all have an opportunity to
address the issues in a way best suited to our environments.

I would also make a couple of recommendations to you prior to you
posting a security exploit/bug.

1. Don't post SEBs unless you have been able to reproduce it. If
   the subscriber base grows as I expect it will, posting such
   messages may cause many people to waste valuable time trying
   to reproduce something which is not there.

2. When posting a SEB, make sure you include enough relevant
   information about your configuration to make it possible to
   reproduce your scenario. Versions of the relevant software,
   service pack levels of your system, platform, and any
   configuration information which might affect the issue. By
   doing this you will prevent a lot of messages asking you the
   basic questions and make resolution or workaround that much
   quicker.

3. When posting a resolution or workaround, if you have received
   a Microsoft Knowledgebase Article number (a Q#####), please
   post it with your message so everyone can read it if they want.

4. Remember your Non-Disclosure Agreements. Issues pertaining to
   products covered under NDA should not be discussed here, use
   the appropriate Microsoft Newsgroup for these issues.
   Typically, once a product has been released to public beta
   testing your NDA changes to one limiting you from discussing
   performance characteristics of the product. Please check with
   your Microsoft representative or Beta Administration if you
   are at all unsure of your NDA status prior to posting.

This list operates on a confirmation basis. Your subscription,
and every message you post to this list will generate a
confirmation message from LISTSERV@RC.ON.CA. This is there for
your protection to ensure that subscription requests really are
from the actual individual email address. It is also there to let
you think about your message prior to it being posted. This is
not a configurable option.

I hope that the list proves useful to you and your organization.
With the REview option turned off, I hope that it will attract
individuals in organizations who have the ability to address the
issues which get raised on this list. I know from personal
experience that having to pay Microsoft US$195 in order to report
a bug (despite the fact you get a refund 3 or 4 days later) can
often mean the difference between reporting a bug and not. This
list should provide an alternative to that process, and at the
same time, should allow the rest of the Windows NT community the
opportunity both to take up the issue with their own Microsoft
representatives, and protect themselves from the possible
exploits which a SEB might expose them to.

The objective is to get SEB resolution done faster, better, and
with less risk to the Windows NT customer than currently exists.

To subscribe to this Listserv, send a message to
Listserv@rc.on.ca with

SUB NTBUGTRAQ Your Name
SUB NTBUGTRAQ Russ Cooper (for example)

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security Consulting



From firewalls-owner  Sun Feb  2 16:52:31 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id NAA08048 for firewalls-outgoing; Sun, 2 Feb 1997 13:26:58 -0800 (PST)
Received: from postbox.acs.ohio-state.edu (postbox.acs.ohio-state.edu [128.146.214.20]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id NAA07941 for <Firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 13:26:04 -0800 (PST)
Received: from scanner (scanner.oar.net [199.18.97.164])
          by postbox.acs.ohio-state.edu (8.8.5/8.8.4) with SMTP
	  id QAA27595 for <Firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 16:24:31 -0500 (EST)
Message-ID: <32F505D4.369C@osu.edu>
Date: Sun, 02 Feb 1997 16:23:32 -0500
From: Andrew Smith <smith.1431@osu.edu>
Reply-To: smith.1431@osu.edu
X-Mailer: Mozilla 3.01 (WinNT; I)
MIME-Version: 1.0
To: Firewalls@GreatCircle.COM
Subject: (no subject)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Please remove my name from the list.

From firewalls-owner  Sun Feb  2 17:20:30 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id QAA26183 for firewalls-outgoing; Sun, 2 Feb 1997 16:43:13 -0800 (PST)
Received: from mail.baileynm.com (fw.baileynm.com [206.109.159.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id QAA26149 for <firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 16:42:56 -0800 (PST)
Received: (qmail 11075 invoked from smtpd); 3 Feb 1997 00:41:40 -0000
Received: from web.nmti.com (root@198.178.0.201)
  by fw.nmti.com with SMTP; 3 Feb 1997 00:41:40 -0000
Received: from sonic.nmti.com (peter@sonic.nmti.com [198.178.0.2]) by web.nmti.com (8.6.12/8.6.9) with SMTP id SAA22435; Sun, 2 Feb 1997 18:41:12 -0600
Received: by sonic.nmti.com; id AA16657; Sun, 2 Feb 1997 18:35:38 -0600
From: peter@baileynm.com (Peter da Silva)
Message-Id: <9702030035.AA16657@sonic.nmti.com.nmti.com>
Subject: Re: [NTSEC] ActiveX, MSIE and Quicken
To: beck@obtuse.com (Bob Beck)
Date: Sun, 2 Feb 1997 18:35:37 -0600 (CST)
Cc: peter@baileynm.com, Russ.Cooper@RC.on.ca, firewalls@GreatCircle.COM
In-Reply-To: <199702022158.OAA02338@snouts.obtuse.com> from "Bob Beck" at Feb 2, 97 02:58:52 pm
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 	Banning ActiveX at the firewall is hardly taking away the MS
> desktops. It's still viable inside the firewall as long as you're
> talking about a relatively trusted environment. If you aren't talking
> about a relatively trusted environment inside you probably shouldn't
> be running an MS desktop anyway.

Oh, definitely. Russ's comment about it not being the whole OLE environment
but rather the web-enabled part of it being the poroblem is right on. The
terminology war, however, is lost... the phrase "ActiveX" is going to be
forever associated with applets, because that's the obvious technology
difference between OLE and ActiveX.

> 	Not all that inconcievable.  There are perfectly viable
> alternatives to an MS desktop for anyone who feels like using
> them.

Unfortunately, no. Not if you want to be able to effectively do business
in America today. Microsoft's file formats are everywhere, and they work very
hard at making sure that nothing but their products can use them effectively.

> 	Microsoft's desktop will always be completely unable to
> provide any useful security for the exact same reasons as we've seen
> for years and years with Sendmail.

It's worse than sendmail. Eric Allman isn't trying to make Sendmail do
everything (there's no http and nntp in there, for example), and Eric
*is* concerned about security. It's not at the top of the list, but at
least it's *on* the list.

From firewalls-owner  Sun Feb  2 17:36:44 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id NAA07607 for firewalls-outgoing; Sun, 2 Feb 1997 13:18:10 -0800 (PST)
Received: from gw.research.megasoft.com (gw.research.megasoft.com [206.230.35.93]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id NAA07596 for <firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 13:17:54 -0800 (PST)
Received: (from uucp@localhost) by gw.research.megasoft.com (8.7.5/8.7.3-cmcurtin) id QAA15204; Sun, 2 Feb 1997 16:15:26 -0500 (EST)
Received: from goffette.research.megasoft.com(192.168.1.2) by gw.research.megasoft.com via smap (V1.3)
	id sma015202; Sun Feb  2 16:15:20 1997
Received: by goffette.research.megasoft.com (940816.SGI.8.6.9/940406.SGI)
	 id QAA12393; Sun, 2 Feb 1997 16:06:47 -0500
Date: Sun, 2 Feb 1997 16:06:47 -0500
Message-Id: <199702022106.QAA12393@goffette.research.megasoft.com>
From: C Matthew Curtin <cmcurtin@research.megasoft.com>
To: harley@icrf.icnet.uk
Cc: firewalls@GreatCircle.COM
Subject: What is a virus? (was: RE: [NTSEC] ActiveX, MSIE and Quicken )
In-Reply-To: <199701312007.MAA12560@mycroft.GreatCircle.COM>
References: <199701312007.MAA12560@mycroft.GreatCircle.COM>
X-Face: "&>g(&eGr?u^F:nFihL%BsyS1[tCqG7}I2rGk4{aKJ5I_5A\*6RYn4"N.`1pPF9LO!Fa<(gj:12)?=uP2l01e10Gij"7j&-)torL^iBrNf\s7PDLm=rf[PjxtSbZ{J(@@j"q2/iV9^Mx<e%nT[:7s7.-#u*}GAH,bEfbfh-NDqSG`+s
Reply-To: cmcurtin@research.megasoft.com
X-Attribution: mattC
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>>>>> "David" == harley  <harley@icrf.icnet.uk> writes:

David> <pedant> Actually, none of these are defining characteristics
David> of a virus. All a virus has to do to -be- a virus is
David> replicate. </pedant>

Uh, not quite.

A "virus" is so named because of its resemblance to its biological
namesake: it attaches itself to something that's already there.  A
worm also replicates itself, but it does not attach itself to
something that's already there: it is, itself, a standalone program.

The mainstream media has completely blurred the distinction between
the two.  Let's not allow "their" confusion to cause misunderstandings
among "us," eh?

-- 
Matt Curtin  Chief Scientist  Megasoft, Inc.  cmcurtin@research.megasoft.com
http://www.research.megasoft.com/people/cmcurtin/    I speak only for myself
Hacker Security Firewall Crypto PGP Privacy Unix Perl Java Internet Intranet

From firewalls-owner  Sun Feb  2 17:46:46 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id NAA06697 for firewalls-outgoing; Sun, 2 Feb 1997 13:06:02 -0800 (PST)
Received: (mcb@localhost) by miles.greatcircle.com (8.7.4/Miles-960830-1) id NAA06683 for firewalls@greatcircle.com; Sun, 2 Feb 1997 13:05:49 -0800 (PST)
Received: from relay6.UU.NET (relay6.UU.NET [192.48.96.16]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id HAA29127 for <firewalls@greatcircle.com>; Fri, 31 Jan 1997 07:45:58 -0800 (PST)
Received: from cwiz.com by relay6.UU.NET with SMTP 
	(peer crosschecked as: www.cwiz.com [208.210.163.10])
	id QQcawt09367; Fri, 31 Jan 1997 10:45:14 -0500 (EST)
Received: by cwiz.com (SMI-8.6/SMI-SVR4)
	id JAA18433; Fri, 31 Jan 1997 09:50:56 -0600
Date: Fri, 31 Jan 1997 09:50:56 -0600
From: mdb@dosmanos.cwiz.com (Martin D. Baldenegro)
Message-Id: <199701311550.JAA18433@cwiz.com>
To: solid@mozcom.com
Subject: Re: Question on MAC Address
Cc: firewalls@greatcircle.com
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


	Jet,

  You did not state on what type of machine you are running this,
  nor did you state what OS.
  I do know that with Sun's and with SunOS and Solaris, all of the
  ethernet cards will have the same MAC address as the ethernet that
  is onboard. You can change the MAC address with the "ifconfig"
  command (ifconfig qe0 ether 0:0:20:75:a0:23) and specify a MAC
  address.

  Regards,

	/mdb


=======================
Martin D. Baldenegro  |
The Cwiz Group        |
email - mdb@cwiz.com  |
=======================

----- Begin Included Message -----

>From solid@mozcom.com Fri Jan 31 07:18:15 1997
Date: Fri, 31 Jan 1997 19:53:09 +0800
From: "Jet B. Bagadion" <solid@mozcom.com>
Mime-Version: 1.0
To: firewalls@greatcircle.com
Subject: Question on MAC Address
Content-Transfer-Encoding: 7bit

Hi,

I'm using Firewall-1 v2.0 and I'm using a SBus Quad ethernet
controller.  I noticed that when I use the command ifconfig -a ,  le0
and the ethernet ports of the Quad controller have the same ethernet MAC
addresses. Should it be really like that? How will I know the right MAC
address of the ethernet ports?

Thanks.

-- 
Jet B. Bagadion


----- End Included Message -----




From firewalls-owner  Sun Feb  2 18:08:01 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id NAA06566 for firewalls-outgoing; Sun, 2 Feb 1997 13:03:43 -0800 (PST)
Received: (mcb@localhost) by miles.greatcircle.com (8.7.4/Miles-960830-1) id NAA06557 for firewalls@greatcircle.com; Sun, 2 Feb 1997 13:03:29 -0800 (PST)
Received: from mbagate2.mba.com ([206.235.208.3]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id OAA18026 for <Firewalls@GreatCircle.COM>; Thu, 30 Jan 1997 14:28:01 -0800 (PST)
Received: (from mail@localhost) by mbagate2.mba.com (8.6.9/8.6.9) id PAA05329 for <Firewalls@GreatCircle.COM>; Thu, 30 Jan 1997 15:22:43 -0700
Received: from cxh-austin.mba.com(38.228.202.1) by mbagate2.mba.com via smap (V1.3)
	id sma005326; Thu Jan 30 15:22:22 1997
Message-Id: <1.5.4.32.19970130222909.0030742c@mbagate2.mba.com>
X-Sender: cxh@mbagate2.mba.com
X-Mailer: Windows Eudora Light Version 1.5.4 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Thu, 30 Jan 1997 16:29:09 -0600
To: Firewalls@GreatCircle.COM
From: Cynthia He <cxh@mba.com>
Subject: HELP NEEDED: one time password with chroot ftp?
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi, all,

I am trying to set up a chroot ftp area for our clients. We also have a
requirement that users have to use one time passwords to login. I am using
TIS fwtk.

What I have in netperm-table is something like this:

  netacl-ftpd: permit-hosts * -chroot /ftp/others/ -exec /usr/bin/ftpd -d

When a user tries to login, he gets the following error:

  530 Cannot connect to auth server
  ftp: Login failed.
  Remote system type is UNIX.      

It seems that the chroot happens before the user gets authenticated and
hence has no access to the authsrv database. Is there a way to get around this?

Thanks for any help.

Cynthia



From firewalls-owner  Sun Feb  2 18:17:51 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id RAA29850 for firewalls-outgoing; Sun, 2 Feb 1997 17:18:00 -0800 (PST)
Received: from lotus.lotus.com (lotus.com [192.233.136.1]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id RAA29732 for <firewalls@greatcircle.com>; Sun, 2 Feb 1997 17:17:26 -0800 (PST)
From: Martin_Khoo/SIN/Lotus@lotus.com
Received: from internet2.lotus.com by lotus.lotus.com (SMI-8.6/SMI-SVR4)
	id UAA22629; Sun, 2 Feb 1997 20:12:41 -0500
Received: from MTA2.lotus.com by internet2.lotus.com (5.x/SMI-SVR4)
	id AC03920; Sun, 2 Feb 1997 20:09:13 -0500
Received: by mta2.lotus.com(Lotus SMTP MTA v1.05 (305.4 1-15-1997))  id 85256433.00070EA4 ; Sun, 2 Feb 1997 20:17:05 -0400
X-Lotus-Fromdomain: LOTUSINT@LOTUS@MTA
To: chrisp@sitescape.com
Cc: firewalls@greatcircle.com
Message-Id: <48256433.00059512.00@mta2.lotus.com>
Date: Mon, 3 Feb 1997 09:14:29 +0900
Subject: Re: Optimal Throughput for NAT
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk





Hi,

IMHO, NAT is an important component of any security plan. It may be a small
or large part of the overall plan but it varies with the site's policy.

The 3 possible implemenetation of NAT that you mentioned will all work for
you, but I feel that from a cost benefit point of view, the use of a
firewall would make more sense. The firewall does more then NAT and I
believe you would need a firewall as part of your security infrastructure.

Having a dedicated box running a NAT application is kind of wastefull but
then again you may have your reasons for doing so.

Using the router to do NAT seems to make alot of sense for some people but
I feel that you should let the router do what is primarily its main
function : i.e providing routing . Well , many people may disagree with me
on this but NO FLAMES PLEASE.

Cheers!
martin




chrisp@tidalwave.net on 02/03/97 03:07:21 AM

Please respond to chrisp@sitescape.com

To:   firewalls-digest@GreatCircle.COM
cc:    (bcc: Martin Khoo/SIN/Lotus)
Subject:  Optimal Throughput for NAT




NAT is a small part of my overall security plan. I'm looking for the
best way to implement NAT, primarily from a cost and performance
standpoint. Currently, I know of three ways to do NAT:
  1) Install and configure a firewall
  2) Dedicate a host, using software such as IPRoute
(http://www.mischler.com/iproute/)
  3) Configure a router (e.g. Cisco with IOS 11.2 and "IP Options")

I'm looking for feedback on the following:
  1) What is my best dollar/cost solution?
  2) Are there other ways to implement NAT that I'm not aware of?

Thanks in advance for any feedback.

Chris








From firewalls-owner  Sun Feb  2 18:20:08 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id NAA06565 for firewalls-outgoing; Sun, 2 Feb 1997 13:03:36 -0800 (PST)
Received: (mcb@localhost) by miles.greatcircle.com (8.7.4/Miles-960830-1) id NAA06545 for firewalls@greatcircle.com; Sun, 2 Feb 1997 13:03:23 -0800 (PST)
Received: from dns.byelex.nl (dns.byelex.nl [194.229.247.131]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id MAA01790 for <firewalls@GreatCircle.COM>; Thu, 30 Jan 1997 12:01:24 -0800 (PST)
Received: (from cowboy@localhost)
	by dns.byelex.nl (8.8.5/8.8.5) id VAA07482;
	Thu, 30 Jan 1997 21:00:36 +0100
Date: Thu, 30 Jan 1997 21:00:35 +0100 (MET)
From: Kevin McPeake <cowboy@dns.byelex.nl>
X-Sender: cowboy@dns.byelex.nl
To: firewalls <firewalls@GreatCircle.COM>
Subject: Re: checkpoint firewall-1 logs
In-Reply-To: <19970130140437038.AAA208@garyw.citelecom.net>
Message-ID: <Pine.LNX.3.91.970130205812.7417B-100000@dns.byelex.nl>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


I don't know what the policy is on this list for people that continue to 
post msg's like this, but I sent him my copy of the sub-info doc that 
tells him how to unsub himself.

If he continues to post like this...all I can say is he was told how now.

Kev

On Thu, 30 Jan 1997, Gary Williams wrote:

> immediately remove my name from your list!
> 
> ----------
> > From: John Chen/New York/ACMC <John_Chen@ACML.COM>
> > To: firewalls <firewalls@greatcircle.com>
> > Subject: checkpoint firewall-1 logs
> > Date: Wednesday, January 29, 1997 10:41 AM
> > 


         BYELEX BV     Kevin McPeake
  Hulstkamp Gebouw     Internet Consultant
      Maaskade 119     kmpeake@byelex.nl
 3071 NK Rotterdam     kevin@mcpeake.org

"Winner of the Lotus Euro Beacon Award '96"
           http://www.byelex.nl/

I never give them hell.  I just tell the truth and they think it's hell.

- H. Truman                           



From firewalls-owner  Sun Feb  2 19:17:00 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id TAA18733 for firewalls-outgoing; Sun, 2 Feb 1997 19:07:56 -0800 (PST)
Received: from lotus.lotus.com (lotus.com [192.233.136.1]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id TAA18726 for <firewalls@greatcircle.com>; Sun, 2 Feb 1997 19:07:48 -0800 (PST)
From: Martin_Khoo/SIN/Lotus@lotus.com
Received: from internet2.lotus.com by lotus.lotus.com (SMI-8.6/SMI-SVR4)
	id WAA25959; Sun, 2 Feb 1997 22:03:04 -0500
Received: from MTA2.lotus.com by internet2.lotus.com (5.x/SMI-SVR4)
	id AC04771; Sun, 2 Feb 1997 21:59:38 -0500
Received: by mta2.lotus.com(Lotus SMTP MTA v1.05 (305.4 1-15-1997))  id 85256433.001127E7 ; Sun, 2 Feb 1997 22:07:23 -0400
X-Lotus-Fromdomain: LOTUSINT@LOTUS@MTA
To: chrisp@sitescape.com
Cc: firewalls@greatcircle.com
Message-Id: <48256433.00059512.00@mta2.lotus.com>
Date: Mon, 3 Feb 1997 11:00:28 +0900
Subject: Re: Optimal Throughput for NAT
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk





Hi,

IMHO, NAT is an important component of any security plan. It may be a small
or large part of the overall plan but it varies with the site's policy.

The 3 possible implemenetation of NAT that you mentioned will all work for
you, but I feel that from a cost benefit point of view, the use of a
firewall would make more sense. The firewall does more then NAT and I
believe you would need a firewall as part of your security infrastructure.

Having a dedicated box running a NAT application is kind of wastefull but
then again you may have your reasons for doing so.

Using the router to do NAT seems to make alot of sense for some people but
I feel that you should let the router do what is primarily its main
function : i.e providing routing . Well , many people may disagree with me
on this but NO FLAMES PLEASE.

Cheers!
martin




chrisp@tidalwave.net on 02/03/97 03:07:21 AM

Please respond to chrisp@sitescape.com

To:   firewalls-digest@GreatCircle.COM
cc:    (bcc: Martin Khoo/SIN/Lotus)
Subject:  Optimal Throughput for NAT




NAT is a small part of my overall security plan. I'm looking for the
best way to implement NAT, primarily from a cost and performance
standpoint. Currently, I know of three ways to do NAT:
  1) Install and configure a firewall
  2) Dedicate a host, using software such as IPRoute
(http://www.mischler.com/iproute/)
  3) Configure a router (e.g. Cisco with IOS 11.2 and "IP Options")

I'm looking for feedback on the following:
  1) What is my best dollar/cost solution?
  2) Are there other ways to implement NAT that I'm not aware of?

Thanks in advance for any feedback.

Chris








From firewalls-owner  Sun Feb  2 19:36:25 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id TAA18575 for firewalls-outgoing; Sun, 2 Feb 1997 19:05:26 -0800 (PST)
Received: from europa.lif.icnet.uk (europa.lif.icnet.uk [143.65.100.4]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id TAA18557 for <firewalls@greatcircle.com>; Sun, 2 Feb 1997 19:05:17 -0800 (PST)
From: harley@icrf.icnet.uk
Message-Id: <199702030305.TAA18557@miles.greatcircle.com>
Received: by europa.lif.icnet.uk; Mon, 3 Feb 1997 03:03:58 GMT
Subject: Re: What is a virus? (long & off-topic)
To: cmcurtin@research.megasoft.com
Date: Mon, 3 Feb 1997 03:03:58 +0000 (GMT)
Cc: firewalls@GreatCircle.COM
In-Reply-To: <199702022106.QAA12393@goffette.research.megasoft.com> from "C Matthew Curtin" at Feb 2, 97 04:06:47 pm
X-Mailer: ELM [version 2.4 PL23]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> David> <pedant> Actually, none of these are defining characteristics
> David> of a virus. All a virus has to do to -be- a virus is
> David> replicate. </pedant>
> 
> Uh, not quite.

This discussion seems to be getting somewhat metaphysical and 
off-topic. Perhaps follow-ups would be more appropriate via
e-mail. 
> 
> A "virus" is so named because of its resemblance to its biological
> namesake: it attaches itself to something that's already there.

I have to quibble with this, at least in the absence of a definition
of 'attach', since it appears to exclude some boot sector viruses 
(notably those which don't preserve a copy of the original boot sector).
and viruses which -replace- an existing file rather than append, prepend,
or overwrite -part- of the target file.

An adequate definition of attach would also have to cover spawning
viruses, and viruses which modify the FAT rather than the target file.

> A worm also replicates itself, but it does not attach itself to
> something that's already there: it is, itself, a standalone program.
> 
That's a different debate. I'd probably accept your definition, 
personally, but the argument is not as cut and dried as you imply. 
Fred Cohen, for instance, has stated that a worm is a special case
of a virus. ["A short course in computer viruses" - Wiley]
Either way, I don't see its relevance to the original
posting or my follow-up. I didn't state that replication was
a defining characteristic -only- of viruses.

> The mainstream media has completely blurred the distinction between
> the two.  Let's not allow "their" confusion to cause misunderstandings
> among "us," eh?
> 
I didn't think anyone had mentioned worms up to now. My point was 
actually that the original post implied that the secondary 
characteristics of -some- viruses, e.g. covert operation, were
primary characteristics, without mentioning replication at all.
I think you'd find it difficult to find a competent virus 
specialist who was prepared to risk a definition of the term
virus which didn't incorporate the concept of replication.

I resent your implying that I derived my assertion from the 
mainstream media. What knowledge and opinions I may have 
are derived from much more rigorous sources. B-) 

I enclose the following extract from the alt.comp.virus not
as support for my own stance (that would be inappropriate,
since I wrote it, apart from the quotation from Fridrik Skulason),
but because if you're going to attack my stance, you might as
well know what it is. I haven't cut it, since part of it relates
to the original post as well as the squelch to which I'm replying.

----------------------include-------------------------

(3) What is a virus (and what are Trojans and Worms)?
=====================================================

A (computer) virus is a program (a block of executable code) which
attaches itself to, overwrites or otherwise replaces another program
in order to reproduce itself without the knowledge of the PC user.

Most viruses are comparatively harmless, and may be present for
years with no noticeable effect: some, however, may cause random
damage to data files (sometimes insidiously, over a long period)
or attempt to destroy files and disks. Others cause unintended
damage. Even benign viruses (apparently non-destructive viruses)
cause significant damage by occupying disk space and/or main
memory, by using up CPU processing time, and by the time and expense
wasted in detecting and removing them.

A Trojan Horse is a program intended to perform some covert
and usually malicious act which the victim did not expect or want.
It differs from a destructive virus in that it doesn't reproduce,
(though this distinction is by no means universally accepted).

A dropper is a program which installs a virus or Trojan, often
covertly.

A worm is a program which spreads (usually) over network
connections. Unlike a virus, it does not attach itself to a
host program. In practice, worms are not normally associated
with personal computer systems. There is an excellent
and considerably longer definition in the Mk. 2 version of the
Virus-L FAQ.

(The following is a slightly academic diversion)

A lot of bandwidth is spent on precise definitions of some of
the terms above. I have Fridrik Skulason's permission to include
the following definition of a virus, which I like because it
demonstrates most of the relevant issues.

"    #1 A virus is a program that is able to replicate - that is, create
        (possibly modified) copies of itself.

     #2 The replication is intentional, not just a side-effect.

     #3 At least some of the replicants are also viruses, by this
        definition.

     #4 A virus has to attach itself to a host, in the sense that execution
        of the host implies execution of the virus.

  --

  #1 is the main definition, which distinguishes between viruses and Trojans
  and other non-replicating malware.

  #2 is necessary to exclude for example a disk-copying program copying a
  disk, which contains a copy of itself.

  #3 is necessary to exclude "intended" not-quite-viruses.

  #4 is necessary to exclude "worms", but at the same time it has to be broad
  enough to include companion viruses and .DOC viruses. "

---------------------------outclude-------------------------------------

-- 
David Harley                     \   |   /                 alt.comp.virus FAQ
D.Harley@icrf.icnet.uk            \  |  /               & Anti-Virus Web Page
Support & Security Analyst         \ | /         Folk London On-Line gig-list
Imperial Cancer Research Fund   ____\|/____   http://webworlds.co.uk/dharley/

From firewalls-owner  Sun Feb  2 19:40:40 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id TAA20618 for firewalls-outgoing; Sun, 2 Feb 1997 19:32:29 -0800 (PST)
Received: from cat.bbsr.edu (cat.bbsr.edu [198.116.91.161]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id TAA20590 for <firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 19:32:17 -0800 (PST)
Message-Id: <199702030332.TAA20590@miles.greatcircle.com>
Received: from [198.168.1.203] by cat.bbsr.edu
  (SMTPD32-3.00) id AB759BC00C8; Sun Feb 02 23:28:53 1997
From: "Jamie Thain" <jthain@cat.bbsr.edu>
To: "Paul A. Murphy" <pamurphy@primary.net>, <firewalls@GreatCircle.COM>
Subject: Re: NT Firewalls
Date: Sun, 2 Feb 1997 23:35:04 -0500
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1155
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Paul,

This NT vs UNIX firewall issue has been debated several times on this list.
I would suggest that both OS's are able to be secure. And that local
experience in making one or the other secure would help. I would also
suggest that you not consider a firewall a single machine, but a
configuration of several machines to defend against security threats to
your computing environment. 

In the later statement I would suggest that you have at least two different
OS types and two different Firewall vendor protections. For example. 


Firwall/Plus       DMZ                    Firewall-1
 NT             ---    Proxy stuff   ----      UNIX      ---  Internal Lan.

Likewise the security policy you are trying to implement will have a vast
effect on the firewall configuration that you choose.

regards:jamie



----------
> From: Paul A. Murphy <pamurphy@primary.net>
> To: firewalls@GreatCircle.COM
> Subject: NT Firewalls
> Date: Sunday, February 02, 1997 12:10 AM
> 
> Hello!
> 
> My company is looking into firewalls to protect our network that is
> connected with a T-1.
> 
> Our company is migrating to NT as a standard and I am concerned that the
> NT Firewalls are generally less secure than the UNIX firewalls and am
> looking for material to make my case that the firewall be UNIX.
> 
> I would appreciate any comments related to the UNIX vs NT debate.
> 
> Thanks
> 
> Paul Murphy
> St. Louis


From firewalls-owner  Sun Feb  2 23:25:38 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id XAA09987 for firewalls-outgoing; Sun, 2 Feb 1997 23:11:42 -0800 (PST)
Received: from squirrel.com (squirrel.com [192.135.191.159]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id XAA09979 for <firewalls@GreatCircle.COM>; Sun, 2 Feb 1997 23:11:31 -0800 (PST)
Received: (from mch@localhost) by squirrel.com (8.6.12/SQUIRREL-1.0) id XAA16015; Sun, 2 Feb 1997 23:09:39 -0800
Message-ID: <Mutt.19970202230938.mch@ratatosk.squirrel.com>
Date: Sun, 2 Feb 1997 23:09:38 -0800
From: mch@squirrel.com (Mark Henderson)
To: jonesmd@unifiedtech.com (Mike Jones)
Cc: firewalls@GreatCircle.COM, solid@mozcom.com
Subject: Re: Question on MAC Address
References: <199701311328.IAA06926@bass.unifiedtech.com>
X-Mailer: Mutt 0.58.1
Mime-Version: 1.0
Content-Type: multipart/signed; protocol="application/pgp-signature";
	micalg=pgp-md5; boundary=MycPikHgYmatd1I+
In-Reply-To: <199701311328.IAA06926@bass.unifiedtech.com>; from Mike Jones on Jan 31, 1997 08:28:09 -0500
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


--MycPikHgYmatd1I+

Mike Jones writes:
> Yes, it should be like that. It's just the way Suns work. They change
> the MAC address of all Ethernet interfaces to be the same as the 
> "primary" interface (typically le0). It's OK, because MAC addresses only
> really have to be unique on a per-segment basis for things to work, and
> it keeps a 1-to-1 relationship between machines and MAC addresses.
> 
> 	Mike Jones
> 	Sr. Network Computing Advisor
> 	UNIFIED Technologies

On most modern Sun workstations and servers that MAC address is 
stored in NVRAM (SGS-Thomson M48T02, M48T08, M48T59Y depending upon 
the model of Sun). This is the same NVRAM that stores things like 
boot device, nvramrc, input-device, etc. - although the methods for 
modifying this ethernet address in NVRAM are not documented, at least 
by Sun ;-) 

The SS1000 and SC2000 are different in that, the MAC address is 
stored in a flash eeprom. 

In any case, this MAC address in NVRAM is the default MAC address for 
all ethernet and fast ethernet interfaces. You can override this
default for any particular interface with ifconfig. 

Typically this is only an issue when one wants to put two interfaces 
on the same segment. 


--MycPikHgYmatd1I+
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a

iQCVAwUBMvWPLKWYCYyyZn7/AQHO7wP/duAYfPaVNY/ko5vFSYCd0goFr8Fg/xLo
JyrxXBzczT+H3NAVuCKhlNKUHdKqiZifh1GFYpJ6E5duFGCyF9eRQmss+LtyfbPR
WpH0KbzKDUK1LStoeYeSHe7x2vMG9TWQ24YGXnQXrl7XN0ARabd6EB/sO8pHcqtN
QQAEHpBojBs=
=QOo8
-----END PGP SIGNATURE-----

--MycPikHgYmatd1I+--

From firewalls-owner  Mon Feb  3 01:55:50 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id BAA22424 for firewalls-outgoing; Mon, 3 Feb 1997 01:43:48 -0800 (PST)
Received: from loach.cichlid.com (loach.cichlid.com [165.227.20.2]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id BAA22397 for <firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 01:43:26 -0800 (PST)
Received: (from news@localhost) by loach.cichlid.com (8.7.4/8.7.3) id BAA09518; Mon, 3 Feb 1997 01:39:00 -0800
To: firewalls@GreatCircle.COM
Path: cichlid
From: "david.d.b.bolger@ .x400.entropy.ie"@entropy.entropy.ie
Newsgroups: mail.firewalls
Subject: None
Date: 3 Feb 1997 01:38:54 -0800
Lines: 82
Message-ID: <5d4bne$8mf@cichlid.cichlid.com>
NNTP-Posting-Host: cichlid.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Message-ID: <ecdc49d6534dab8a@deliver.cichlid.com>
Lines:  72
Xdeliver: processed on Mon Feb  3 01:38:49 PST 1997
Xdeliver: SENDER fw-1-mailinglist-owner@us.checkpoint.com
Xdeliver: to 
Xdeliver: cc 
Xdeliver: apparent_to 
Xdeliver: from "david.d.b.bolger@ .x400.entropy.ie"@entropy.entropy.ie

X400-Received: by mta EntropyMHS in /PRMD=Entropy/ADMD=ENT/C=ie; Relayed; 03 Feb 97 09:30:09 +0000
X400-Received: by /PRMD=Entropy/ADMD=ENT/C=ie; Relayed; 03 Feb 97 09:30:09 +0000
Date: 03 Feb 97 09:30:20 +0000
Delivery-Date: 03 Feb 97 09:30:20 +0000
Message-Type: Multiple Part
X400-Originator: "david.d.b.bolger@ .x400.entropy.ie"
X400-MTS-Identifier: [/PRMD=Entropy/ADMD=ENT/C=ie;ISOCOR-32eca775-entropymhs]
X400-Recipients: owner-fw-1-mailinglist@us.checkpoint.com
X400-Recipients: ToddK@competitive.com
X400-Recipients: fw-1-mailinglist@us.checkpoint.com
Original-Encoded-Information-Types: IA5-Text
X400-Content-Type: P2-1984
Message-ID: <ISOPRO::DH-EF::63C6::32F61E82*/G=david/I=db/S=bolger/CN=david/O=entropy/OU= /PRMD=entropy/ADMD=ent/C=ie@MHS>
Importance: normal
Subject: RE(2): [FW1] FW logswitch on Windows NT 
Autoforwarded: FALSE
To: owner-fw-1-mailinglist@us.checkpoint.com (Non Receipt Notification Requested)
To: ToddK@competitive.com (Non Receipt Notification Requested)
CC: fw-1-mailinglist@us.checkpoint.com (Non Receipt Notification Requested)
In-Reply-To: <0131084029-Re: FW1 FW logswitch on Windows NT * @MHS>
Conversion: Allowed
Conversion-With-Loss: Allowed
Alternate-Recipient: Prohibited
Content-Identifier: RE(2): ?FW1? FW
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7Bit
Sender: owner-fw-1-mailinglist@us.checkpoint.com

If you disable IP forwarding in NT, then if you wish to use it as a firewall, the packets destined for the other side will not even try to get to the firewall level.
You need to have IP forwarding on, and then let FW-1 control it or not.

===============================
David Bolger - Technical Engineer

Entropy Ltd.
Unit 25 
Sandyford Office Park
Dublin 18
Ireland

Tel: 	++353-1-2940199
Fax: 	++353-1-2940121
email:	David.Bolger@entropy.ie
===============================

---- owner-fw-1-mailinglist(a)us.checkpoint.com's Message ----



 
> The default for Firewall-1 is to 'control IP forwarding' which means
> that although the NT IP forwarding is enbaled packets WILL NOT be
> forwarded unless Firewall-1 permits.  I beleive this is true even when
> the Firewall-1 service is stopped due to the device driver changes to
> the IP stack made by Checkpoint.
> 
> Can anyone confirm this last point for me?
> 

The last point is true. However, it is better to disable ip forwarding 
capablity of NT (I'm quite dark in NT) so that the host would not be
able to forward ip even when FW-1 was unloaded from system.

Nobuhiko Yoshimoto
Nihon Keizai Shimbun Inc.
yoshi@nikkei.co.jp
phone:813-5690-0256
fax:813-5690-0250





From firewalls-owner  Mon Feb  3 02:11:08 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id BAA23499 for firewalls-outgoing; Mon, 3 Feb 1997 01:55:56 -0800 (PST)
Received: from server21.digital.fr (server21.digital.fr [193.56.15.21]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id BAA23415 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 01:55:35 -0800 (PST)
Received: from mail.vbo.dec.com (mail.vbo.dec.com [16.36.208.34]) by server21.digital.fr (8.7.5/8.7) with ESMTP id KAA25596 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 10:58:37 +0100 (MET)
Received: from vbormc.vbo.dec.com (vbormc.vbo.dec.com [16.36.208.94]) by mail.vbo.dec.com (8.7.3/8.7) with ESMTP id KAA05336 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 10:56:07 +0100 (MET)
Received: from becomm.ebo.dec.com (becomm.ebo.dec.com [16.184.208.35]) by vbormc.vbo.dec.com (8.7.3/8.7) with SMTP id KAA17332 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 10:51:09 +0100
Received: from beux1.ebo.dec.com by becomm.ebo.dec.com; (5.65v3.2/1.1.8.2/07Mar96-0234PM)
	id AA04977; Mon, 3 Feb 1997 10:53:44 +0100
Received: by beux1.ebo.dec.com; (5.65v3.2/1.1.8.2/11Feb96-0242PM)
	id AA21150; Mon, 3 Feb 1997 10:53:35 +0100
Subject: NT port numbers needed
To: Firewalls@GreatCircle.COM
X-Mailer: MAILworks 1.7-A
From: Arjo Mukherjee 4663 <mukherje@ebo.dec.com>
Date: Mon, 3 Feb 97 10:53:35 +0100
Message-Id: <970203105335.20842@beux1.ebo.dec.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

Anyone know what are the relevant IP port numbers for NT?  

I read somewhere that NT uses ports 512/tcp and 721-731/tcp for 
print services.

What are the IP ports for File Sharing and other applicable NT
services?

Thanks,
Arjo

From firewalls-owner  Mon Feb  3 02:25:47 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id BAA22373 for firewalls-outgoing; Mon, 3 Feb 1997 01:42:23 -0800 (PST)
Received: from gate.dataquest.com (gate.dataquest.com [206.79.141.1]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id BAA22345 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 01:42:11 -0800 (PST)
Received: from cc.dataquest.com (cc.dataquest.com [206.79.111.244]) by gate.dataquest.com (8.8.3/8.8.0) with SMTP id BAA25438 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 01:41:21 -0800 (PST)
Received: from ccMail by cc.dataquest.com (SMTPLINK V2.11.01)
	id AA854962845; Mon, 03 Feb 97 01:36:38 PST
Date: Mon, 03 Feb 97 01:36:38 PST
From: "Administrator" <Administrator_at_~BarneyPO@dataquest.com>
Message-Id: <9701038549.AA854962845@cc.dataquest.com>
To: Firewalls@GreatCircle.COM
Subject: Message not deliverable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Firewalls-Digest       Monday, February 3 1997       Volume 06 : Number 044



In this issue:

        Re: NT Firewalls
        Re: Question on MAC Address

See the end of the digest for information on subscribing to the Firewalls
or Firewalls-Digest mailing lists and on how to retrieve back issues.

----------------------------------------------------------------------

Date: Sun, 2 Feb 1997 23:35:04 -0500
From: "Jamie Thain" <jthain@cat.bbsr.edu>
Subject: Re: NT Firewalls

Paul,

This NT vs UNIX firewall issue has been debated several times on this list.
I would suggest that both OS's are able to be secure. And that local
experience in making one or the other secure would help. I would also
suggest that you not consider a firewall a single machine, but a
configuration of several machines to defend against security threats to
your computing environment. 

In the later statement I would suggest that you have at least two different
OS types and two different Firewall vendor protections. For example. 


Firwall/Plus       DMZ                    Firewall-1
 NT             ---    Proxy stuff   ----      UNIX      ---  Internal Lan.

Likewise the security policy you are trying to implement will have a vast
effect on the firewall configuration that you choose.

regards:jamie



- ----------
> From: Paul A. Murphy <pamurphy@primary.net>
> To: firewalls@GreatCircle.COM
> Subject: NT Firewalls
> Date: Sunday, February 02, 1997 12:10 AM
> 
> Hello!
> 
> My company is looking into firewalls to protect our network that is
> connected with a T-1.
> 
> Our company is migrating to NT as a standard and I am concerned that the
> NT Firewalls are generally less secure than the UNIX firewalls and am
> looking for material to make my case that the firewall be UNIX.
> 
> I would appreciate any comments related to the UNIX vs NT debate.
> 
> Thanks
> 
> Paul Murphy
> St. Louis

------------------------------

Date: Sun, 2 Feb 1997 23:09:38 -0800
From: mch@squirrel.com (Mark Henderson)
Subject: Re: Question on MAC Address

- --MycPikHgYmatd1I+

Mike Jones writes:
> Yes, it should be like that. It's just the way Suns work. They change
> the MAC address of all Ethernet interfaces to be the same as the 
> "primary" interface (typically le0). It's OK, because MAC addresses only
> really have to be unique on a per-segment basis for things to work, and
> it keeps a 1-to-1 relationship between machines and MAC addresses.
> 
>  Mike Jones
>  Sr. Network Computing Advisor
>  UNIFIED Technologies

On most modern Sun workstations and servers that MAC address is 
stored in NVRAM (SGS-Thomson M48T02, M48T08, M48T59Y depending upon 
the model of Sun). This is the same NVRAM that stores things like 
boot device, nvramrc, input-device, etc. - although the methods for 
modifying this ethernet address in NVRAM are not documented, at least 
by Sun ;-) 

The SS1000 and SC2000 are different in that, the MAC address is 
stored in a flash eeprom. 

In any case, this MAC address in NVRAM is the default MAC address for 
all ethernet and fast ethernet interfaces. You can override this
default for any particular interface with ifconfig. 

Typically this is only an issue when one wants to put two interfaces 
on the same segment. 


- --MycPikHgYmatd1I+
Content-Type: application/pgp-signature

- -----BEGIN PGP SIGNATURE-----
Version: 2.6.3a

iQCVAwUBMvWPLKWYCYyyZn7/AQHO7wP/duAYfPaVNY/ko5vFSYCd0goFr8Fg/xLo
JyrxXBzczT+H3NAVuCKhlNKUHdKqiZifh1GFYpJ6E5duFGCyF9eRQmss+LtyfbPR
WpH0KbzKDUK1LStoeYeSHe7x2vMG9TWQ24YGXnQXrl7XN0ARabd6EB/sO8pHcqtN
QQAEHpBojBs=
=QOo8
- -----END PGP SIGNATURE-----

- --MycPikHgYmatd1I+--

------------------------------

End of Firewalls-Digest V6 #44
******************************

To unsubscribe from Firewalls-Digest, send the following command
in the body of a message to "Majordomo@GreatCircle.COM":

unsubscribe firewalls-digest

If you want to subscribe or unsubscribe an address other than the
account the mail is coming from, such as a local redistribution list,
then append that address to the command; for example, to subscribe
"local-firewalls":

subscribe firewalls-digest local-firewalls@your.domain.net

A non-digest (direct mail) version of this list is also available; to
subscribe to that instead, replace all instances of "firewalls-digest"
in the commands above with "firewalls".

Compressed back issues are available for anonymous FTP from
FTP.GreatCircle.COM, in pub/firewalls/digest/vNN.nMMM.Z (where "NN"
is the volume number, and "MMM" is the issue number).


From firewalls-owner  Mon Feb  3 02:40:29 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id CAA24909 for firewalls-outgoing; Mon, 3 Feb 1997 02:15:30 -0800 (PST)
Received: from relay.cryptonet.it (relay.cryptonet.it [194.185.79.195]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id CAA24871 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 02:15:01 -0800 (PST)
Message-Id: <199702031025.LAA07956@relay.cryptonet.it>
Received: from enigma.cryptonet.it(192.168.1.1) by relay.cryptonet.it via smap (V1.3)
	id sma007954; Mon Feb  3 11:24:48 1997
From: David Vincenzetti <vince@cryptonet.it>
Subject: to source or not to source? (was: [NTSEC] ActiveX, MSIE and Quicken)
To: Firewalls@GreatCircle.COM
Date: Mon, 3 Feb 1997 11:17:58 +0100 (MET)
X-Pgp: vince@cryptonet.it 1024/A4D8B5CD 8CE2406F5CFBF9B9 D70DABF5912F66E8
X-Mjr: You can have Cheap, Easy, or Secure.  Pick two
X-Dijkstra: Testing can reveal the presence of bugs, but not their absence
X-Mailer: ELM [version 2.4 PL24 PGP5a]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Oh, definitely. Russ's comment about it not being the whole OLE environment
> but rather the web-enabled part of it being the poroblem is right on. The
> terminology war, however, is lost... the phrase "ActiveX" is going to be
> forever associated with applets, because that's the obvious technology
> difference between OLE and ActiveX.
> 
> > 	Not all that inconcievable.  There are perfectly viable
> > alternatives to an MS desktop for anyone who feels like using
> > them.
> 
> Unfortunately, no. Not if you want to be able to effectively do business
> in America today. Microsoft's file formats are everywhere, and they work very
> hard at making sure that nothing but their products can use them effectively.
> 
> > 	Microsoft's desktop will always be completely unable to
> > provide any useful security for the exact same reasons as we've seen
> > for years and years with Sendmail.
> 
> It's worse than sendmail. Eric Allman isn't trying to make Sendmail do
> everything (there's no http and nntp in there, for example), and Eric
> *is* concerned about security. It's not at the top of the list, but at
> least it's *on* the list.

Just to play Devils Advocate (I am a openness/source_included
enthusiast!), the main difference between Sendmail and ActiveX
is that the former provides full source while the latter
does not provide any sources. 

Sendmail full sources are available, they can be studied
and examined by everyone, and they can be studied by malicious
hackers too.  ActiveX sources are not available, and it is
harder, for a malicious hacker, to spot new bugs.
Sendmail is a crystal box while ActiveX is a black box
(remember the old Security Thru Obscurity model?:-).

As a matter of fact, a much larger number of bugs are
found for systems whose sources are available.  Installing
patches is an EXPENSIVE activity, so most companies will NOT
install all the patches as they are released by CERTs and
vendors.  Not installing new CERT patches is a bad habit, but
companies usually do not have the knowledge/skills/manpower
for keeping their software up to date.

So, is source availability a real advantage for commercial
companies?

--vince

From firewalls-owner  Mon Feb  3 04:41:25 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id EAA05114 for firewalls-outgoing; Mon, 3 Feb 1997 04:23:27 -0800 (PST)
Received: from mercury.Sun.COM (mercury.Sun.COM [192.9.25.1]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id EAA05106 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 04:23:17 -0800 (PST)
Received: from PRC.Sun.COM ([129.158.112.5]) by mercury.Sun.COM (SMI-8.6/mail.byaddr) with SMTP id EAA01046; Mon, 3 Feb 1997 04:22:00 -0800
Received: from lingshan.PRC.Sun.COM by PRC.Sun.COM (SMI-8.6/SMI-5.3)
	id UAA01596; Mon, 3 Feb 1997 20:32:04 +0800
Received: by lingshan.PRC.Sun.COM (SMI-8.6/SMI-SVR4)
	id UAA00706; Mon, 3 Feb 1997 20:18:37 +0800
Date: Mon, 3 Feb 1997 20:18:37 +0800
From: Carl.Ma@PRC.Sun.COM (Carl Ma - SE Trainee)
Message-Id: <199702031218.UAA00706@lingshan.PRC.Sun.COM>
To: Martin_Khoo/SIN/Lotus@lotus.com
Subject: About NAT
Cc: firewalls@greatcircle.com
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,
  I have heard the product  of Sun microsystem,Sunscreen, which 
can hide its IP address , does it use the some function of the
NAT, where can I find more material of NAT?
Thanks in advance!
Carl.ma

From firewalls-owner  Mon Feb  3 05:25:48 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id FAA08812 for firewalls-outgoing; Mon, 3 Feb 1997 05:18:42 -0800 (PST)
Received: from csnnetra1 ([200.255.165.102]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id FAA08735 for <firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 05:18:20 -0800 (PST)
Received: from mg65 by csnnetra1 (SMI-8.6/SMI-SVR4)
	id LAA25672; Mon, 3 Feb 1997 11:15:56 -0200
Message-Id: <199702031315.LAA25672@csnnetra1>
Comments: Authenticated sender is <cs84088@pop1.csn.com.br>
From: "Alessandro Jannuzzi" <jannuzzi@csn.com.br>
To: firewalls@GreatCircle.COM
Date: Mon, 3 Feb 1997 11:15:23 +0000
MIME-Version: 1.0
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Subject: Re: Virus Scan on the FW
X-mailer: Pegasus Mail for Win32 (v2.42a)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

Is there a solution similary WebShild that I can run on a non-Intel 
plataform ?
On Solaris 2.5 for instance. . .

Thanks,

Alessandro Jannuzzi
jannuzzi@csn.com.br

From firewalls-owner  Mon Feb  3 05:55:43 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id FAA10613 for firewalls-outgoing; Mon, 3 Feb 1997 05:42:37 -0800 (PST)
Received: from internet2.sbi.com (rutherford2.SBI.COM [192.195.121.10]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id FAA10559 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 05:42:19 -0800 (PST)
Received: from internet.sbi.com (rutherford.SBI.COM [192.195.121.6]) by internet2.sbi.com (8.6.12/8.6.12) with SMTP id IAA25635 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 08:41:05 -0500
Received: from confucious.sbi.com (security) by internet.sbi.com (4.1/SMI-4.1)
	id AA14875; Mon, 3 Feb 97 08:41:06 EST
Received: from paranoid.sbi.com by confucious.sbi.com (SMI-8.6/SMI-SVR4)
	id IAA06883; Mon, 3 Feb 1997 08:41:04 -0500
Received: by paranoid.sbi.com (SMI-8.6/SMI-SVR4)
	id IAA00690; Mon, 3 Feb 1997 08:41:38 -0500
Date: Mon, 3 Feb 1997 08:41:38 -0500
From: jerrys@confucious.sbi.com (Jerry Simonowits)
Message-Id: <199702031341.IAA00690@paranoid.sbi.com>
To: Firewalls@GreatCircle.COM
Subject: Firewall-1 bug
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I'm using Firewall-1 version 2.1 and seem to have run accross a bug. I've
added more hosts to my database than can be displayed on the screen and
I get an error message:

	XView warning: Menu too large for screen (Command Menu package)

And, nothing is displayed on the screen.

It's been confirmed to me that this is a bug, but I haven't received any
fixes....

Any suggestions ???

Jerry

From firewalls-owner  Mon Feb  3 06:10:37 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id FAA11072 for firewalls-outgoing; Mon, 3 Feb 1997 05:47:22 -0800 (PST)
Received: from internet2.sbi.com (rutherford2.SBI.COM [192.195.121.10]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id FAA11053 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 05:47:13 -0800 (PST)
Received: from internet.sbi.com (rutherford.SBI.COM [192.195.121.6]) by internet2.sbi.com (8.6.12/8.6.12) with SMTP id IAA25959 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 08:46:00 -0500
Received: from confucious.sbi.com (security) by internet.sbi.com (4.1/SMI-4.1)
	id AA15301; Mon, 3 Feb 97 08:45:59 EST
Received: from paranoid.sbi.com by confucious.sbi.com (SMI-8.6/SMI-SVR4)
	id IAA06915; Mon, 3 Feb 1997 08:45:58 -0500
Received: by paranoid.sbi.com (SMI-8.6/SMI-SVR4)
	id IAA00692; Mon, 3 Feb 1997 08:46:35 -0500
Date: Mon, 3 Feb 1997 08:46:35 -0500
From: jerrys@confucious.sbi.com (Jerry Simonowits)
Message-Id: <199702031346.IAA00692@paranoid.sbi.com>
To: Firewalls@GreatCircle.COM
Subject: Re: Optimal Throughput for NAT
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Martin wrote:

[stuff cut]

Using the router to do NAT seems to make alot of sense for some people but
I feel that you should let the router do what is primarily its main
function : i.e providing routing . Well , many people may disagree with me
on this but NO FLAMES PLEASE.

===========================================================================

Not a flame, just a difference of opinion...I've spent the last 9 years or so
involved with routers, and I would have agreed with you completely, oh, until
about the last 2 years or so. Router hardware has taken a major leap, and the
processing power available to most routers these days is way way more then
most "edge" routers require to accomplish their routing tasks. That being
the task, why not use all that leftover power to do NAT and other useful
things ?

I would think that a good approach would be to define what needs doing and
then find the appropriate system to accomplish that. In this case "system"
may include a multiplicity of devices.

Jerry

From firewalls-owner  Mon Feb  3 06:39:33 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id FAA11117 for firewalls-outgoing; Mon, 3 Feb 1997 05:48:14 -0800 (PST)
Received: from MetGwy02.metlife.com ([204.146.159.1]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id FAA11097 for <Firewalls@Greatcircle.Com>; Mon, 3 Feb 1997 05:47:55 -0800 (PST)
Received: by MetGwy02.metlife.com(Lotus SMTP MTA v1.01.02 (238.7 10-8-1996))  id 85256433.004B55FE ; Mon, 3 Feb 1997 08:42:52 -0400
X-Lotus-FromDomain: METLIFE @ METLIFENET
From: "Mike Stoico"<mstoico@metlife.com>
To: david@mony.com
cc: Cihans@Garanti.Com.Tr, Firewalls@Greatcircle.Com
Message-ID: <85256433:004B4BA9.00@MetGwy02.metlife.com>
Date: Mon, 3 Feb 1997 08:44:31 -0400
Subject: Re: Virus Scan....
Mime-Version: 1.0
Content-type: multipart/mixed; 
	Boundary="0__=htt0AwaJJWdvCCNgIjUMvBGNVEF5GZifKxBgZ1WQJc2Bjir909QQtPX8"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


--0__=htt0AwaJJWdvCCNgIjUMvBGNVEF5GZifKxBgZ1WQJc2Bjir909QQtPX8
Content-type: text/plain; charset=us-ascii



Have you seen any performance hits on your traffic with this installed?
We're looking at using it, and I have a concern about placing another hub
between inside and outside. Also, is there any configuration that the user
needs to do?
Mike Stoico
MetLife
The views expressed here are probabvly not those of my employer


                                                                            
           (Embedded                                                        
           image moved   david @ mony.com                                   
           to file:      01/31/97 10:59 AM                                  
           PIC13806.PCX)                                                    
                                                                            



          To:   CihanS @ garanti.com.tr
          cc:   firewalls @ GreatCircle.COM
          Subject:  Re: Virus Scan....




          Cihan Subasi said:
          >
          >      And how WebShield will work? In the documents it is said that
          the
> product is "Completely Transparent and cannot be bypassed by users"
anybody > has any idea about those issues?

What happens is that WebShield sits between your firewall (or exterior
router) and your internal network. It has two network cards, but instead of
routing it acts as a bridge. It does seem to be essentially invisible.

However: We've run into some issues regarding it's use with FTP, and we're
trying to find someone at McAfee who can give us some answers. Test it
thoroughly and decide if you want to use it.

And yes, there are all kinds of email attachments that it can't decode to
detect virii. Our client wants us to implement it anyway, and hopefully
they understand that this will _assist_ in preventing virus infections, not
provide 100% protection.
          --
          David Kozinn                   dkozinn@csc.com
          Computer Sciences Corporation
          Technology Management Group    +1-201-907-6990



--0__=htt0AwaJJWdvCCNgIjUMvBGNVEF5GZifKxBgZ1WQJc2Bjir909QQtPX8
Content-type: application/octet-stream; 
	name="PIC13806.PCX"
Content-transfer-encoding: base64

CgUBCAAAAABoACwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAABaQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAD1E9sTzRPHE8MTwhP1E9sTzRPHE8MTwhP1E9sTzRPHE8MTwhP1E9sTzRPH
E8MTwhP1E9sTzRPHE8MTwhP1E9sTzRPHE8MTwhP1E9sTzRPHE8MTwhP1E9sTzRPHE8MTwhP1E9sT
zRPHE8MTwhPwEwzIBgzYE8wTxhPDE8IT7hPOBtcTzBPGE8MTE+wTwgbCBwbCEgbCEgbCEsUG1hPL
E8YTwxMT6hMMwgYHwgLCAwISwgfEEsMCwwbVE8sTxRPDExPpE8MGAwcCBwMCwhLDB8ISwgISwgLD
BtUTyhPFE8MTE+gTwgIHA8ICEw4DDgLDE8USwwLCEMIG1BPKE8UTwxMT5xMCAwcDAg4TDgITwgIS
D8ISD8ISBRICEcICwwbUE8oTxRPCExPmEwYCBwMCDgIOwgLDExITEhPCEg8GxgLDBtMMDAfJE8QT
whMT5hMGwwITBgMCDhLFEw8SE8ISBgIDwhIDEsMGB9MDxwwHxRPDExPlEwYHAhESAg8CwhMPwhMP
xBMPxRIQwgIDAgMCBtMDxwPEDAfDE8IT4RMHwwzCBgLCEhMCDxLIE8MSD8MSwwIQAwIDBgfSDMkD
wgPCDAfCExPbEwfGDMIDDAIHERITEhMSwxMPwxMPwxPDEgIDAgMCwwMCBgzREwfHDMYDDMITE9YT
B8UMyAMGB8ICBhLDAsYTEhMSExIPwhIHAgcCAwUQAgYRBgfSE8UTB8QMwgMMwhMT0hMHxAzLA8IM
BsISDxESExITAw4DxBMSExITwxICBwPCAsMDDMIGB9ITyRMHwwzCExPPEwfDDMkDxQwHwhMGBxIT
AhECEwMOAg7DExITDxMPwxIDAgMCBwMCDAYRBgfSE8kTwhPCDMITE8wTB8MMxwPEDMIHxxMGxBLD
Ag4DDgIGwg/IEgIDwgIDAgwCEMIGB9ITyRMHDAcMwhMTyhMHwgzGA8MMwgfMEwYHwhLCEAIOAg4C
DhDDAhIPxhIFAgXDAgUCEQYH0hPHEwfCDAcPDMITE8gTB8IMxQPDDAfQEwbDEhDEAhAOEA4QwgLG
EgcSBhIGBcMCBcIGB9ATB8UMEwfCDA8HDwwHwhMTxhMHwgzEA8MMB9MTBgfCEhADEMICDhAOEMIC
EQIDxxIGBwbCAgUCEQYHyxMHxAwHwhMHEwzCEwcPBw8MB8MTE8UTBwzEA8IMB9YTBsQSEAMCA8UC
EQIDAgPDEgcSBgfCBgUQAhDCBgfGEwfEDAfGE8INEwzCEw8HwgwHwxPCE8QTBwzDA8IMB9gTBgfE
EhACEMYCEQIDAsQSBhLDBsICEALCBgfCEwfDDAfKEwfCDRMHwhPCDAfEE8ITE8MTBwzCA8IMB9oT
DBIHwxLDDBEDxQIDAgPDEgYSBgfCBgIQAhAGDAfCEwzDE8MHyRMHwhPCBxMHxRPDExPDEwzCAwwH
3RMGxxICEQPDAgMCA8MSBhIGBwYMBhACEAIGDMMTDBPCB8YTwwfHEwfGE8MTwhPDEwwDDAfeEwYH
xxICEQPDAgMCwhIGEgYHBgwGEAIQAsIGB8MTDMYTwwfKEwzGE8MTwhPDE8IMB98TDBLCB8USAgMR
xAISB8ISBgcGDAYQBhAGEAYMB8MMB8kTwwfHEwzGE8MTwhPDEwwPwgzfEwYSB8ISB8ISAhECAwID
EgcSBwYHBgwGEAYQxgzDD8IHxRPDB8kTBwzGE8MTwhPDEwzDD8QM3BPCBhIGwxIGAhECAwIHBgcG
yAzJDxMHzRMHwwwHxxPDE8ITwxMHDMYPxwwH1BMGEgYSBhLLDM4PwwwTDMcTwgfEDAfJE8QTwhMT
xBMHwgzLD9sM0w/GDAfDEwzDEwfEDAfLE8YTwxMTxhMHxAztD8gMBgfIE8QMB84TxxPDE8ITyhMH
xwzbD8sMEAUMBcIMwgYH1RPKE8UTwxMT0RMH2wwGEAYQBhACBQwFDAUMBgwHBgfWE8sTxRPDExPu
EwYMBhAGEAIGDAYMwwYH1xPLE8YTwxMT8BPKBgfYE8wTxhPDExP1E9sTzRPHE8MTwhP1E9sTzRPH
E8MTwhMMAAAAgAAAAIAAgIAAAACAgACAAICAwMDAwNzApsrw//vwoKCkgICA/wAAAP8A//8AAAD/
/wD/AP//////AAAAgAAAAIAAgIAAAACAgACAAICAwMDAwNzApsrw//vwoKCkgICA/wAAAP8A//8A
AAD//wD/AP//////AAAAgAAAAIAAgIAAAACAgACAAICAwMDAwNzApsrw//vwoKCkgICA/wAAAP8A
//8AAAD//wD/AP//////AAAAgAAAAIAAgIAAAACAgACAAICAwMDAwNzApsrw//vwoKCkgICA/wAA
AP8A//8AAAD//wD/AP//////AAAAgAAAAIAAgIAAAACAgACAAICAwMDAwNzApsrw//vwoKCkgICA
/wAAAP8A//8AAAD//wD/AP//////AAAAgAAAAIAAgIAAAACAgACAAICAwMDAwNzApsrw//vwoKCk
gICA/wAAAP8A//8AAAD//wD/AP//////AAAAgAAAAIAAgIAAAACAgACAAICAwMDAwNzApsrw//vw
oKCkgICA/wAAAP8A//8AAAD//wD/AP//////AAAAgAAAAIAAgIAAAACAgACAAICAwMDAwNzApsrw
//vwoKCkgICA/wAAAP8A//8AAAD//wD/AP//////AAAAgAAAAIAAgIAAAACAgACAAICAwMDAwNzA
psrw//vwoKCkgICA/wAAAP8A//8AAAD//wD/AP//////AAAAgAAAAIAAgIAAAACAgACAAICAwMDA
wNzApsrw//vwoKCkgICA/wAAAP8A//8AAAD//wD/AP//////AAAAgAAAAIAAgIAAAACAgACAAICA
wMDAwNzApsrw//vwoKCkgICA/wAAAP8A//8AAAD//wD/AP//////AAAAgAAAAIAAgIAAAACAgACA
AICAwMDAwNzApsrw//vwoKCkgICA/wAAAP8A//8AAAD//wD/AP//////AAAAgAAAAIAAgIAAAACA
gACA//vwoKCkgICA/wAAAP8A//8AAAD//wD/AP//////

--0__=htt0AwaJJWdvCCNgIjUMvBGNVEF5GZifKxBgZ1WQJc2Bjir909QQtPX8--


From firewalls-owner  Mon Feb  3 08:49:58 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id HAA19570 for firewalls-outgoing; Mon, 3 Feb 1997 07:20:17 -0800 (PST)
Received: from poss.com (camel.poss.com [198.70.184.130]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id HAA19550 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 07:20:04 -0800 (PST)
Received: from sunfire ([207.113.179.166])
          by poss.com (8.8.4/8.8.4) with ESMTP
	  id KAA06480; Mon, 3 Feb 1997 10:16:39 -0500 (EST)
Received: from localhost (wilcox@localhost) by sunfire (8.6.12/8.6.9) with ESMTP id KAA00693; Mon, 3 Feb 1997 10:19:41 -0500
Message-Id: <199702031519.KAA00693@sunfire>
X-Mailer: exmh version 2.0beta 12/23/96
To: jerrys@confucious.sbi.com (Jerry Simonowits)
cc: Firewalls@GreatCircle.COM
Subject: Re: Firewall-1 bug 
In-reply-to: Message  <199702031341.IAA00690@paranoid.sbi.com> 
   from "Mon, 03 Feb 1997 08:41:38 EST."
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Mon, 03 Feb 1997 10:19:40 -0500
From: Ken Wilcox <wilcox@poss.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

jerrys@confucious.sbi.com (Jerry Simonowits) writes:
> I'm using Firewall-1 version 2.1 and seem to have run accross a bug. I've
> added more hosts to my database than can be displayed on the screen and
> I get an error message:
> 
> 	XView warning: Menu too large for screen (Command Menu package)
> 
> And, nothing is displayed on the screen.
> 
> It's been confirmed to me that this is a bug, but I haven't received any
> fixes....
> 
> Any suggestions ???
> 
> Jerry
> 

This is what Sunsolve has to say about this. I hope it helps.

Document ID: 1890

SYNOPSIS: Error message: "Xview warning: Menu too large for screen" 

DETAIL DESCRIPTION:

I create 250 hosts, but when I want to install a new rule I am not able
to see the windows with all objects created.  I receive the message
"Xview warning: Menu too large for screen".  What does this mean?


SOLUTION SUMMARY:

This is a known limitiation.  Future releases of Firewall-1 will
probably include a scroll-bar menu instead of this pop-up menu.  However
in the meantime here are several workarounds:

1. Edit the files manually.

 Instead of using the firewall GUI, you can modify the object file
 (objects.C) and the rule file (<rule_name>.W) under /etc/fw/conf with
 the command line interface.  The format of the file is self-explanatory. 
 Once you've done that you can type "fw load <rule_name>.W
<hosts>".  If
 you are using more than 250 objects it is probably faster to edit the
 rules and object list using the command line than the GUI anyway. 

2. Group the objects and only display those needed.

 It is likely that, even if you are dealing with 250+ objects you do not
 want to create rules for every one of them.  Usually you want to put
 your objects into groups and apply the filter rules only to those
 groups.  If this is the case, you can create groups using the network
 object manager under the GUI and for each host you put in a group, in
 the host properties, un-select the check-box "Show in Menus". 

3.  Use networks whenever possible.  

 Sometimes you do not really need that many hosts. See if you can
 group the hosts into network objects. 

4.  Share the load among several Firewalls.  

 This is not very attractive because, after all, one reason of getting a
 firewall is that you want to manage your entire security policy from a
 central point.  But if you really need hundreds of hosts and hundreds of
 rules to manage them, then you may consider splitting the security
 checking between several firewalls.  This will also lower the risk of
 experiencing performance problems (specially if you are also using VPN
 and NAT). 





DATE APPROVED: 08/31/96



KEYWORDS:     firewall xview warning objects file

OS RELEASE:   Solaris/SunOS 2.5/5.5
-- 
Ken Wilcox					Perfect Order Inc.
Account Representative				Authorized Sun Reseller
2212 Eagles Nest Lane
Monroeville PA 15146
Phone: +1 412 373 1528				Email: wilcox@poss.com
Fax:   +1 412 373 1722



From firewalls-owner  Mon Feb  3 08:51:28 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id HAA20024 for firewalls-outgoing; Mon, 3 Feb 1997 07:23:38 -0800 (PST)
Received: from NS1.Content.Net (NS1.Content.Net [206.253.232.1]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id HAA19883 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 07:22:50 -0800 (PST)
Received: from localhost (jims@localhost) by NS1.Content.Net (8.8.2/8.8.2) with SMTP id KAA05461; Mon, 3 Feb 1997 10:22:40 -0500 (EST)
Date: Mon, 3 Feb 1997 10:22:40 -0500 (EST)
From: Jim Serven <jims@GLIX.Net>
X-Sender: jims@NS1.Content.Net
To: Jerry Simonowits <jerrys@confucious.sbi.com>
cc: Firewalls@GreatCircle.COM
Subject: Re: Firewall-1 bug
In-Reply-To: <199702031341.IAA00690@paranoid.sbi.com>
Message-ID: <Pine.SGI.3.95.970203101826.3188D-100000@NS1.Content.Net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


> It's been confirmed to me that this is a bug, but I haven't received any
> fixes....
> Any suggestions ???

Yes,

Go into the Object Manager.
and edit any objects which do NOT need to be on the menu.
on the (editing) window for each object when you open it (along the
bottom (in X)) is a "[ ] Show in Menu" - the default is for it to be
checked.  UN check it.  and do this for as many hosts as necessary until
you are able to view you objects in the expandable menu.

Usually, we only "show" objects in the menu while we are adding them to a
rule, and then we "unshow" them so that we can leave the menu space
available for more important hosts(or whatever) or until we need it later.
That way valuable X real estate is saved, and FW1(X) doesn't complain.

If you have any questions, feel free to holler.

Cheers!

-Jim

Certified Checkpoint Security Engineer CCSE
-------------------------------------------
Jim Serven <jims@glix.net> The GLIX Network
President                G-4010 W. Court St
http://www.glix.net         Flint, Mi 48532
    (v) 810.898.4483 (f) 810.695.8403
-------------------------------------------
Firewalls, webSmiths, and bandwidth. oh my!


From firewalls-owner  Mon Feb  3 08:53:43 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id HAA22457 for firewalls-outgoing; Mon, 3 Feb 1997 07:49:53 -0800 (PST)
Received: from tuna.wang.com (TUNA.wang.com [150.124.136.4]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id HAA22413 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 07:49:26 -0800 (PST)
Received: from mars.wangfed.com (mars.Wangfed.COM [159.94.10.1])
    by tuna.wang.com (8.6.12/8.6.12tf1) with SMTP id KAA12949;
    Mon, 3 Feb 1997 10:47:58 -0500
Received: from uc0009.wangfed.com (uc0009 [159.94.10.15])
	by mars.wangfed.com (8.8.4/3.8) with SMTP
	id KAA29366; Mon, 3 Feb 1997 10:54:03 -0500 (EST)
Received: from [159.94.14.48] by uc0009.wangfed.com (BULL 5.61++/B.O.S 02.01)
	id AA20974; Mon, 3 Feb 97 10:38:51 -0500
Date: Mon, 3 Feb 97 10:38:51 -0500
Message-Id: <9702031538.AA20974@uc0009.wangfed.com>
From: "K.M."  <goertzek@wangfed.com>
Reply-To: "K.M."  <goertzek@wangfed.com>
To: jcanfiel@davocom.com, firewalls@greatcircle.com
Subject: Re: Sidewinder vs. Cyberguard
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

In message <32F3DA42.27E9@davocom.com> Jim Canfield writes:

> First: How is security rated A1, B3, B2, B1, C2, C1 in the US, other
> similar grading scales in England/Germany and probably countless others
> worldwide. 

TCSEC (US)    =     ITSEC (EU)
----------          ----------
A1            =     E6 / F6 (or F-A1)
B3            =     E5 / F5 (or F-B3)
B2            =     E4 / F4 (or F-B2)
B1            =     E3 / F3 (or F-B1)
C2            =     E2 / F2 (or F-C2)
C1            =     E1 / F1 (or F-C1)

There is no concept, in TCSEC, for separate assurance and functionality 
evaluations.  Each rating assumes a combination of functionality and assurance 
at a certain level.

The Common Criteria (if they ever happen) will look a lot more like the ITSEC 
scheme.

The TCSEC also does not evaluate *applications* (though it does evaluate the 
TCBs of relational database management systems).  Thus, there are no TCSEC 
evaluations of *firewalls*, because these are applications.

The ITSEC *does* evaluate applications - including firewalls.  This is why 
CyberGuard was evaluated, as an application, in Europe, while the CyberGuard 
platform (Harris "Nighthawk") was all that was evaluated in the U.S. 
("NightHawk" also got an E3/F3 rating in Europe).  CyberGuard got an "E3" 
assurance rating at a UK CLEF.


Then to find out what was the best achievable security rating
> for a product that is usable.


The highest rating any firewall has got is the ITSEC "E3" given to CyberGuard.  
Even this is possibly "underkill", for while the MACs provided at the E3 (B1) 
level may be used to protect the firewall, E3 does *not* provide a covert 
channel analysis, so there may be huge covert channels in a E3 (B1) operating 
system or application that can be exploited by a clever malfeasant.

ON the other hand, none of the firewall applications (except Sidewinder) running
on B1/E3 platforms actually use the MACs to reinforce separation between the 
networks connected to the firewall.  Both CyberGuard and the Norman Firewall 
(which runs on Compartmented Mode Workstations with MACs) run at a single level 
in the MAC scheme of the operating system.  There is no trusted process in these
firewalls that would allow the "inside" to run at a higher classification level 
than the "outside", thus using the MACs and TCB effectively to separate the 
protected network from the unprotected one.  Only Sidewinder does this, using 
type enforcement, and even with type enforcement, there is no sense of the 
inside being more protected than the outside (though the combination of non-TCB 
related firewall configuration - e.g., which proxies are two-way, which are only
outbound ,etc. - and type enforcement can achieve something resembling this).
However, I have heard that Sidewinder is very difficult to configure, unless 
they have managed to greatly improve their interface in new release.  
Cyberguard, on the other hand, is supposed to be as easy to configure as 
Firewall-One, and is more trustworthy.

> The most secure, usable, firewall we have found to date is the
> Cyberguard
> 
> As mentioned the products are B1 compliant (awaiting certification)....

The OS is already evaluted, and the E3 rating of the firewall application should
be completed any day now.


KM

=====

K.M. Goertzel
Manager, Business Development
Secure Systems & Services Operation
WANG FEDERAL, Inc.
7900 Westpark Drive - MS 700
McLean, VA  22102-4299  USA
tel (703)827 3914
fax (703)827 3161 
email goertzek@wangfed.com


From firewalls-owner  Mon Feb  3 09:12:36 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id IAA25633 for firewalls-outgoing; Mon, 3 Feb 1997 08:28:28 -0800 (PST)
Received: from mail1.phoenix.net (mail1.phoenix.net [204.120.233.12]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id IAA25626 for <firewalls-digest@GreatCircle.COM>; Mon, 3 Feb 1997 08:28:21 -0800 (PST)
Received: from ottog.net1.net (ppp082.Net1.Net [204.254.232.82]) by mail1.phoenix.net (8.7.5/8.6.12) with ESMTP id KAA08871 for <firewalls-digest@GreatCircle.COM>; Mon, 3 Feb 1997 10:27:09 -0600 (CST)
Message-Id: <199702031627.KAA08871@mail1.phoenix.net>
From: "Greg Otto" <gdo@newf.com>
To: <firewalls-digest@GreatCircle.COM>
Subject: Secure Kernel's versus Unix or NT
Date: Mon, 3 Feb 1997 10:27:50 -0600
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1155
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I am looking for some information which compares the problems and issues
of running Firewall systems on a real-time kernel versus on an existing
operating system such as Unix or NT.

I would like to get a better understanding of where the problems exist and
what issues may arise.  I understand that most OS based systems will
"harden" up the OS, but I still wonder how many loop-holes are left out
there.

Thanks,
Greg
============================================================================

Gregory Otto                       e-mail  gdo@newf.com
New Frontier Consulting            WWW     http://www.newf.com
Houston, Texas                     Voice   (713) 718-1358
============================================================================



From firewalls-owner  Mon Feb  3 09:22:05 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id IAA23397 for firewalls-outgoing; Mon, 3 Feb 1997 08:02:44 -0800 (PST)
Received: from intkx001.usair.com (intkx001.usair.com [199.72.38.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id IAA23372 for <firewalls@GreatCircle.com>; Mon, 3 Feb 1997 08:02:27 -0800 (PST)
Received: from intad116.usair.com by intkx001.usair.com (AIX 4.1/UCB 5.64/4.03)
          id AA74194; Mon, 3 Feb 1997 10:56:56 -0500
Message-Id: <32F60B04.4E0B@usair.com>
Date: Mon, 03 Feb 1997 10:57:57 -0500
From: Mark Smith <msmith@usair.com>
Reply-To: msmith@usair.com
X-Mailer: Mozilla 3.01 (Win95; I)
Mime-Version: 1.0
To: firewalls@GreatCircle.com
Subject: Filtering outbound packets
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

What is the general practice for readers of this list on filtering
outbound packets at the router between the ISP and the DMZ ?  

The original intent was to limit the chances of mounting
attacks/FSP/general bad stuff using our site as base camp.  Now,
however, we have a mail application which appears to drive the router at
max CPU, allegedly due to the filtering in place.   That outbound
filtering allows only the "good" protocols to their known ports.

From firewalls-owner  Mon Feb  3 09:27:42 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id IAA24890 for firewalls-outgoing; Mon, 3 Feb 1997 08:20:57 -0800 (PST)
Received: from mail.baileynm.com (fw.baileynm.com [206.109.159.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id IAA24850 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 08:20:44 -0800 (PST)
Received: (qmail 13505 invoked from smtpd); 3 Feb 1997 16:19:28 -0000
Received: from web.nmti.com (root@198.178.0.201)
  by fw.nmti.com with SMTP; 3 Feb 1997 16:19:28 -0000
Received: from sonic.nmti.com (peter@sonic.nmti.com [198.178.0.2]) by web.nmti.com (8.6.12/8.6.9) with SMTP id KAA14133; Mon, 3 Feb 1997 10:19:28 -0600
Received: by sonic.nmti.com; id AA07546; Mon, 3 Feb 1997 10:13:53 -0600
From: peter@baileynm.com (Peter da Silva)
Message-Id: <9702031613.AA07546@sonic.nmti.com.nmti.com>
Subject: Re: to source or not to source? (was: [NTSEC] ActiveX, MSIE and Quicken)
To: vince@cryptonet.it (David Vincenzetti)
Date: Mon, 3 Feb 1997 10:13:53 -0600 (CST)
Cc: Firewalls@GreatCircle.COM
In-Reply-To: <199702031025.LAA07956@relay.cryptonet.it> from "David Vincenzetti" at Feb 3, 97 11:17:58 am
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Sendmail full sources are available, they can be studied
> and examined by everyone, and they can be studied by malicious
> hackers too.  ActiveX sources are not available, and it is
> harder, for a malicious hacker, to spot new bugs.

I don't think you're thinking this through. You don't *need* source to
break security on ActiveX, because there is none. All you need to do is
spoof Authenticode or steal an Authenticode private key... and since
there is no mechanism to revoke an Authenticode key as soon as *one*
person has done it the game's over.

Regardless of the utility crystal box vs. black box argument, it's got
nothing to do with ActiveX.

From firewalls-owner  Mon Feb  3 09:41:11 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id JAA00772 for firewalls-outgoing; Mon, 3 Feb 1997 09:19:54 -0800 (PST)
Received: from panix3.panix.com (panix3.panix.com [198.7.0.4]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id JAA00753 for <firewalls@GreatCircle.com>; Mon, 3 Feb 1997 09:19:40 -0800 (PST)
Received: from localhost (fangyou2@localhost) by panix3.panix.com (8.8.5/8.7/PanixU1.3) with SMTP id MAA15163 for <firewalls@GreatCircle.com>; Mon, 3 Feb 1997 12:18:09 -0500 (EST)
Date: Mon, 3 Feb 1997 12:18:08 -0500 (EST)
From: FaNgYoU2 <fangyou2@panix.com>
To: firewalls@GreatCircle.com
Subject: NT network and system management
Message-ID: <Pine.SUN.3.94.970203120818.14366A-100000@panix3.panix.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Apologies because this is not strictly a firewall question.  However,
there are quite a few NT experts on the list who can help.

I need to monitor the following items across about 80 Windows NT servers:
DOS Devices : Paging File : Percent usage Peak
Physical Disk : Percent disk time
Physical Disk : Average disk sec/read  (reads per second)
Physical Disk : Disk read bytes/sec    (read bytes per second)
Physical Disk : Queue length
Processor : Percent processor time
Memory : pages/second
Server : bytes total/second

For each network user connected to server:
NIC card address/MAC address
Computer name (if any)
IP address (if any)
User name.

Is there a group of NET commands which will give me this?
Is there a commercial product that can be customized to give me this?
Finally, which mailing list does this question really belong on?

                                         FaNgYoU2, Cyberspace^^Vampyre

^^       Touch it, touch it, touch me ... creatures of the Night       ^^


From firewalls-owner  Mon Feb  3 09:47:49 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id HAA20026 for firewalls-outgoing; Mon, 3 Feb 1997 07:23:39 -0800 (PST)
Received: from gk-blue.unicc.org (gk-red.unicc.org [192.91.247.2]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id HAA19870 for <firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 07:22:46 -0800 (PST)
Received: by gk-blue.unicc.org; (5.65v3.2/1.3/10May95) id AA17758; Mon, 3 Feb 1997 16:23:58 +0100
Received: from gh.unicc.org (localhost [127.0.0.1]) by gh.unicc.org (8.7.5/8.7.3) with SMTP id QAA07405; Mon, 3 Feb 1997 16:23:54 +0100 (MET)
Message-Id: <32F60309.41C6@unicc.org>
Date: Mon, 03 Feb 1997 16:23:53 +0100
From: Lilia Miltcheva <miltcheva@unicc.org>
Organization: United Nations International Computing Centre
X-Mailer: Mozilla 2.0 (X11; I; OSF1 V3.2 alpha)
Mime-Version: 1.0
To: altavista-product@digital.com
Cc: admin@unicc.org, firewalls@GreatCircle.COM
Subject: Duplicated network addresses
X-Url: http://altavista.software.digital.com/help/tunnelfaq4/index.htm
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Dear Guru,

I'm keen on using the AltaVista Tunnel and have already a lot of
requests for providing the service. I have a question :

We are currently using Alta Vista FW for Unix and behind it we have
class C addresses that we once got by EUnet. Than we changed the ISP and
renumbered our "red" (external) network, but on the internal ("blue")
WAN we kept the old IPs as there are anyhow not accessible from the
Internet.

What is going to happen if a remote client, using AVT connects to our
AVT server, gets the numbers of the private networks (for example
193.72.45.0) and starts tunneling, but at the same time there is a
server somewhere on the Internet that has address let's say 193.72.45.20
(same class C). How this clash could possibly be menaged?


I'm aware that many people use inside their FW "any" IP addresses (just
unique on the LAN), so that will be a problem with all those guys if
some coincedence occurs.

Is there something I'm missing?

Thanks a lot in advance. I'll greately appriciate any help....

Lili

From firewalls-owner  Mon Feb  3 09:56:31 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id JAA01900 for firewalls-outgoing; Mon, 3 Feb 1997 09:35:04 -0800 (PST)
Received: from mercury.Sun.COM (mercury.Sun.COM [192.9.25.1]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id JAA01837 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 09:34:33 -0800 (PST)
Received: from West.Sun.COM ([129.153.100.31]) by mercury.Sun.COM (SMI-8.6/mail.byaddr) with SMTP id JAA11027; Mon, 3 Feb 1997 09:32:47 -0800
Received: from topsun.West.Sun.COM by West.Sun.COM (SMI-8.6/SMI-5.3)
	id JAA05376; Mon, 3 Feb 1997 09:32:07 -0800
Received: from plato.West.Sun.COM by topsun.West.Sun.COM (SMI-8.6/SMI-SVR4)
	id JAA13336; Mon, 3 Feb 1997 09:32:07 -0800
Received: by plato.West.Sun.COM (SMI-8.6/SMI-SVR4)
	id JAA05126; Mon, 3 Feb 1997 09:16:58 -0800
Date: Mon, 3 Feb 1997 09:16:58 -0800
From: matt@plato.West.Sun.COM (Matthew Archibald)
Message-Id: <199702031716.JAA05126@plato.West.Sun.COM>
To: firewalls@greatcircle.com, bsterling@hotmail.com
Subject: Re: Securing Web Servers
Cc: smith@sctc.com
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


On Friday 31 Jan 1997 - Brad Sterling wrote:


> Memco SeOS, on the other hand, is capable of achieving the same results as
> SideWinder, but requires no alteration of the OS, other than being installed so
> that it can intercept system calls which are security oriented (very clever
> stuff which is up for patents).  Since Memco SeOS can achieve this with
> standard vendor releases of any Unix system (Solaris, HP/UX, AIX, etc.), and
> combined with FireWall-1 far outperforms any application level firewall, I
> don't see a reasonable comparison.


In fact Memco SeOS changes the kernel of the system via loadable
kernel modules.

What this does is to force every open, exec, write etc... call to
be checked against an ACL prior to the action taking place and
writes a log entry for each.  Now, while this is pretty strong
stuff there are no host-to-host authentication services, at least
not in the 1.x releases.  Also, try running this on a large Oracle,
Sybase or other SQL server and watch your performance go down the
drain.

Patenting of a loadable kernel module might not be very easy since
Memco is not the first, or last to do this sort of thing.
I even have an example of a module in a 'Writing Device Drivers'
course for SunOS,v4.X.x (c 1991/2) to capture just this type of info.
(First release that let you load a module at boot time)

Regardless, most SysV UNIX variants released in the past
6-18 months and/or next 6-18 months will/have inlcuded file
ACL's which if maintainted reasonably well offer similar
protection with less overhead sine they are native to the OS
in use.

I know, the famous 'we obivate the need for root' statement
is flashy to mainframe centric minded folks but really, no
matter how you do it the system always has one priveledged
user id or another regardless if the name is 'root', 'seosadmin'
or 'barney'...

For standalone systems SeOS is very cool. For network trust
unfortunately it seems to be lacking strong controls. A mixture
of SeOS with network based audit and access control services
offers the best of both worlds.

Of course with the release of version 2.x things might be
better.

		My 2cents worth,
				Matthew Archibald

From firewalls-owner  Mon Feb  3 10:12:48 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id KAA04387 for firewalls-outgoing; Mon, 3 Feb 1997 10:03:53 -0800 (PST)
Received: from relay5.UU.NET (relay5.UU.NET [192.48.96.15]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id KAA04366 for <firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 10:03:34 -0800 (PST)
Received: from txau.tx.mt.np.els-gms.att.net by relay5.UU.NET with SMTP 
	(peer crosschecked as: txau.tx.mt.np.els-gms.att.net [199.191.144.201])
	id QQcbie24564; Mon, 3 Feb 1997 13:01:30 -0500 (EST)
Date: Mon, 03 Feb 1997 11:02:20 -0500
From: mcoss@attmail.com (Michael J Coss)
Received: from mcoss by attmail; Mon Feb  3 17:48:26 GMT 1997
Subject: Re: Sidewinder vs. Cyberguard
In-Reply-To: your message <199702020407.XAA27088@unix1.sysnet.net> of Sat Feb  1 21:31:07 -0400 1997
To: firewalls@GreatCircle.COM
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <winATT-3.0-mcoss-25>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Matthew Patton wrote:

>On what basis do you make this assertion?  "secure" can mean a lot of 
>things and a rubber stamp from NSA or it's equivalent doesn't mean a 
>whole lot if buggy software can be trivially exploited.  We could go on 
>about "usable" but I'll let that one slide.  In particular is the 
>firewall configuration an EXACT match with the 
>"certified/tested/evaluated" machine?  NT has a C2 rating but it's not 
>worth a damn.  When was the last time you ran an NT box with no LAN, no 
>floppy, and with a modified BIOS?  Not exactly a useful product.  Then 
>again, assuming you duplicate this setup, place said machine nearish to a 
>window.  Electronic eavesdropping (for about $3000 and change) or outside 
>observation does tend to degrade the usefulness of said rating does it 
>not?

Your correct, "secure" is a nebulous term, but obviously you have not been 
involved with a evaluation of an operating system if you believe that its a 
rubber stamp.  I worked on the NCSC evaluation of a UNIX operating system and 
it took too long (several years) and was not a rubber stamp.  Your point about 
what the configuration is is quite true but Cyberguard has gone the extra mile 
of getting a Network evaluation to provide a better security solution that 
does include a network component.  And you can buy the NightHawk in a TEMPEST 
cabinet if your concerned about that.
 
>Ah, the GUI.  Remote manageable too I think I recall.  What to say when 
>the X11 session gets hijacked?  You sure the box isn't running a 
>braindamaged X11 server?  Can you attack the logging facility thru DOS?  
>What happens when you bog the machine down with hundreds of connections?  
>Does it run out of VM and spontaneously reboot?  How about the logs 
>filling up the disk?  What happens when this occurs and an exploit is 
>then launched?  Do you still have an audit trail?

First, I know of no system that is completely immune to a concerted denial of 
service attack.  You can attempt to minimize the impact but with a general 
purpose operating system, it may be virtually impossible to eliminate.  
Second, unless your willing to expend the money to create a tamperproof box, 
the granting of access to the machine is taboo. 

>So they know how to check off all of the feature boxes on the report 
>card.  Anybody can and everybody does that.
Do you KNOW that the features are not provided?  What feature do you believe 
they are lying about?

>IMO ratings, be they NSA/NCSA or whatever aren't worth much and 
>deffinately not a price premium.  I take far more comfort in people 
>banging away at the available stuff and fixing the problems.  
And what pray tell do you believe that the evaluations/testings are trying to 
do?  The purpose of these are to provide a degree of comfort that someone 
other than the vendor has looked is varying degrees of detail at the 
implementation of the software/hardware combination.

>Additionally, you really believe the vendor (or reviewer for that matter) 
>went thru every single line of code specifically looking for possible 
>exploits?  Get real.
Have you been involved in the evaluation process?  I have.  No, we didn't go 
thru every single line of code but we tried to get complete coverage and did a 
analysis of the data flow and looked at the access control mechanisms in 
great detail and looked at privileged processes to verify there correct 
operation and in those programs we did indeed look at every line and reviewed 
the libraries.  That some people attempt to slide thru an evaluation, I have 
no doubt but I'd like to believe that that is the exception rather than the 
rule. 

>All the ratings do is study the protection scheme and bless it as logical 
>and OK at least in theory.  Then with various degrees of persistance they
>try to prove you can't get around said protection.  Holes and stack smashes
>by way of poorly written C and resolver libraries and DOS via SYN etc.
>aren't addressed.

While the NCSC did not require denial of service attacks, nor penetration 
testing (for a B1 system), we as part of our own Q&A did do these things based 
on knowledge gathered from various sources and our own experience.

>If they were we wouldn't be plagued with some of the problems we have now.
No product is completely immune no matter how much money or resources are 
thrown at it.  What you want is a system that provides a degree of security, 
and some assurance that the vendor has made a best effort at 1) implementation 
of a security mechanism, and 2) discovery/correction of known bugs.

Finally, there is the issue of do you need a secure operating system.  While I 
believe that a properly implemented firewall does not require a trusted base 
to run on.  A secure OS will help if the firewall code is compromised.  It may 
not be sufficient to protect the network but it may minimize the damage.

I'm not recommending either choice but I do believe that there is benefits 
derived from having the system evaluated by an outside source.  Is it worth 
the money? The market has shown to date that they want security but don't want 
to pay for the extensive review/testing/etc. required to develop and maintain 
it.  The expectation is that it should come for free..."Of course your 
software is safe...right?"

---Michael J Coss
Lucent Technologies - Bell Laboratories		mjcoss@lucent.com

From firewalls-owner  Mon Feb  3 10:17:21 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id GAA15043 for firewalls-outgoing; Mon, 3 Feb 1997 06:39:27 -0800 (PST)
Received: from bastion.s-1.com (BASTION.FIVEPACES.COM [204.130.55.230]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id GAA15034 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 06:39:17 -0800 (PST)
Received: from UNKNOWN [10.1.1.10] by bastion.s-1.com
	for <watt>
	id JAA29721; Mon Feb  3 09:37:57 1997
Received: from mordred.s-1.com by wine.s-1.com with SMTP
	(1.39.111.2/16.2) id AA204210569; Mon, 3 Feb 1997 09:36:09 -0500
Received: by mordred.s-1.com (5.65/2.1) id AA22362; Mon, 3 Feb 97 09:37:35 -0500
Message-Id: <9702031437.AA22362@mordred.s-1.com>
Subject: RE: Technologic's Interceptor
Date: Mon, 3 Feb 1997 09:37:30 -0500 (EST)
X-Mailer: ELM [version 2.4 PL21]
Content-Type: text
To: Firewalls@GreatCircle.COM
From: Charles Watt <watt@s-1.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

-----BEGIN PRIVACY-ENHANCED MESSAGE-----
Proc-Type: 4,MIC-CLEAR
Content-Domain: RFC822
Originator-Certificate:
 MIIBvzCCAWkCEFmOln6ip0w49CuyWr9vDVUwDQYJKoZIhvcNAQECBQAwWTELMAkG
 A1UEBhMCVVMxGDAWBgNVBAoTD1NlY3VyZVdhcmUgSW5jLjEXMBUGA1UECxMOU2Vj
 dXJlV2FyZSBQQ0ExFzAVBgNVBAsTDkVuZ2luZWVyaW5nIENBMB4XDTk1MDUwODIw
 MjMzNVoXDTk3MDUwNzIwMjMzNVowcDELMAkGA1UEBhMCVVMxGDAWBgNVBAoTD1Nl
 Y3VyZVdhcmUgSW5jLjEXMBUGA1UECxMOU2VjdXJlV2FyZSBQQ0ExFzAVBgNVBAsT
 DkVuZ2luZWVyaW5nIENBMRUwEwYDVQQDEwxDaGFybGVzIFdhdHQwWTAKBgRVCAEB
 AgICBANLADBIAkEM2ZSp7b6eqDqK5RbPFpd6DGSLjbpHOZU07pUcdgJXiduj9Ytf
 1rsmf/adaplQr+X5FeoIdT/bVSv2MUi3gY0eFwIDAQABMA0GCSqGSIb3DQEBAgUA
 A0EApEjzeBjiSnGImJXgeY1K8HWSufpJ2DpLBF7DYqqIVAX9H7gmfOJhfeGEYVjK
 aTxjgASxqHhzkx7PkOnL4JrN+Q==
MIC-Info: RSA-MD5,RSA,
 CjW81uLLaNxmHKEFGvLlRPVknGKeyMsMAGbyaXYA/6puqyPsHKbPrYb3seEbNK7i
 X0h3M7XKAjv7iTEPk411pPo=

We use the Interceptor to protect Security First Network Bank.  It
installs easily, is very easy to administer, provides excellent logging
and alarming, all with good throughput.  In the past we have used or
evaluated several other products (Checkpoint, Raptor, Gauntlet) before
deciding on the Interceptor.

Charles Watt
Security First Technologies

> We are presently evaluating different firewall solutions, one of which
> is Technologic's Interceptor.
> 
> Is it a good product?
> 
> Can anyone please provide a little insight.
> 
> Thanks in advance,
> David Weinstein
> VP of Information Systems and Technology
> 
-----END PRIVACY-ENHANCED MESSAGE-----

From firewalls-owner  Mon Feb  3 11:04:57 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id KAA09613 for firewalls-outgoing; Mon, 3 Feb 1997 10:54:43 -0800 (PST)
Received: from emf.emf.net (emf.emf.net [205.149.0.20]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id KAA09565 for <firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 10:54:13 -0800 (PST)
Received: from d4bdonapc01 (dhcp-17-005.srv.ptss.com [155.241.17.5]) by emf.emf.net (EMF-K/K) with ESMTP id KAA28196; Mon, 3 Feb 1997 10:49:00 -0800
Message-Id: <199702031849.KAA28196@emf.emf.net>
From: "David B. Donahue" <ddonahue@emf.net>
To: <Laura_Bohde@prenhall.com>, <firewalls@GreatCircle.COM>,
        <mike.starkweather@anheuser-busch.com>,
        "Francis Yeung" <fyeung@fyeung8.netific.com>
Cc: <www@qualix.com>
Subject: Re: Re[2]: Highly available Internet connection
Date: Mon, 3 Feb 1997 10:52:50 -0800
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1155
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I used to be a reseller (not anymore) for a product called Qualix
"Secure-watch" it was a high availability solution, it worked very well for
me in some complex configurations.

It automatically backed up the firewall and/or web server hardware and
software using  automatic hot cutover/monitoring software and Shared SCSI
disks.

Tech support wasn't great, but it was OK if you were a Sr. Unix sys admin.

According to the sales info on thier home page at:
http://www.qualix.com/sysman/product/securewatch.htmld/

"Qualix has combined the core technology of the leading high-availability
software, QualixHA(tm) (including Qualix HA-Environment(tm)and VERITAS
FirstWatch(r)), with the security of the leading firewall, FireWall-1.
These two products, along with special Qualix HA-Modules(tm) software,
provide a packaged solution for highly available secure Internet
connectivity."

"In order to guarantee access to the Internet, SecureWatch uses two
workstations. A primary workstation operates as the Internet firewall, and
a "hot standby"
workstation operates as the back-up."

I'd bet that a solution like this would solve your problems, they have
several competitors you can do a Hotbot search for "high availability
firewall" and turn some of those up.

-David B. Donahue

P.S. I have no affiliation with them anymore, i just liked thier product,
even if i had problems with thier T/S group.

----------
> From: Laura_Bohde@prenhall.com
> To: firewalls@GreatCircle.COM; mike.starkweather@anheuser-busch.com;
Francis Yeung <fyeung@fyeung8.netific.com>
> Subject: Re[2]: Highly available Internet connection
> Date: Thursday, January 30, 1997 8:24 PM
> 
>         
>         The firewall is not powered off - what is powered off is 
>         the router on one side of it, and the hub on the other 
>         side.  I never want to use a power switch on a Unix box 
>         for fear of corrupting the File Systems/disks.  Also - 
>         leaving the firewall live enables us to ensure the backup 
>         doesn't have any hardware problems.
>         
>         We haven't automated the synching yet.  Static routes are 
>         defined in a startup file - the same on both systems.  
>         Doesn't change very often, and is easy to change on both 
>         systems, should a new route need to be added.  All I 
>         actually need to do is copy the firewall config files (I 
>         use tape right now, can't ftp because the backup isn't on 
>         a live network) over to the backup system after I make a 
>         configuration change.  Only takes a few minutes -
>         
>         We also thought about the second disk idea, where you 
>         could boot off of another disk that housed the 
>         configuration, but we didn't want to worry about the 
>         experience of the person performing the switch-over.
>         
>         - Laura
> 
> 
> ______________________________ Reply Separator
_________________________________
> Subject: Re: Highly available Internet connection
> Author:  fyeung@fyeung8.netific.com (Francis Yeung) at INTERNET-PUB
> Date:    1/30/97 10:43 AM
> 
> 
> Laura,
>         
>         What happens to the data - firewall rules, static routes etc,
>  ? How you do keep them in sync if one unit is powered off ?
>         
>         Thanks.
>         
>         Francis
>         
> > From root@fyeung25.netific.com Thu Jan 30 03:32 PST 1997 
> > From: Laura_Bohde@prenhall.com
> > Date: Wed, 29 Jan 1997 23:20:46 -0500
> > Subject: Re: Highly available Internet connection
> > To: "'firewalls@GreatCircle.COM'" <firewalls@GreatCircle.COM>,
> >         "Starkweather; Mike" <mike.starkweather@anheuser-busch.com> 
> > 
> >         
> >         We have two routers connected to the Internet configured 
> >         identically, as well as two hubs, two firewalls, and two 
> >         hubs on the other side.  Then we installed Black Box 
> >         power on/off switches (one on each router, and one on 
> >         each hub at the other end).  This way we can leave one 
> >         network up and the other powered off.  If any device in 
> >         the "primary" network fails, with a simple phone call 
> >         (our help desk can even do this), one network can be 
> >         powered off and the other powered up.  (this way all 
> >         equipment can actually have the same IP addresses too.) 
> >         
> >         Hope this helps -
> >         
> >         Laura
> > 
> > 
> > ______________________________ Reply Separator 
> _________________________________
> > Subject: Highly available Internet connection
> > Author:  "Starkweather; Mike" <mike.starkweather@anheuser-busch.com> at

> > INTERNET-PUB
> > Date:    1/29/97 4:40 PM
> > 
> > 
> > My company wants to move toward Electronic Commerce on the Internet. 
> >  One of the requirements would be a highly available, secure 
> > connection.  One of the ideas I have considered is two firewalls going 
> > out over two routers to two wide area links to two ISPs.  This is a 
> > pretty brute force approach.
> >         
> > Does anyone have any ideas to share on how we might build an Internet 
> > connection that would approach 100 percent availability?
> >         
> > Thanks for all your help.
> >         
> > Mike Starkweather
> > Anheuser-Busch
> > 
> > 
> > 

From firewalls-owner  Mon Feb  3 11:15:40 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id KAA09926 for firewalls-outgoing; Mon, 3 Feb 1997 10:57:45 -0800 (PST)
Received: from mailhost.netrunner.net (mailhost.netrunner.net [204.137.145.201]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id KAA09826 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 10:57:05 -0800 (PST)
Received: from brian ([207.100.192.100]) by mailhost.netrunner.net (8.7.5/8.7.5) with SMTP id OAA20494 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 14:05:27 -0500 (EST)
Date: Mon, 3 Feb 1997 14:05:27 -0500 (EST)
Message-Id: <1.5.4.16.19970203135653.1aef92d6@mailhost.netrunner.net>
X-Sender: brianp@mailhost.netrunner.net
X-Mailer: Windows Eudora Light Version 1.5.4 (16)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: Firewalls@GreatCircle.COM
From: Brian Podolak <brianp@netrunner.net>
Subject: Re: Sidewinder vs. Cyberguard
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 09:31 PM 2/1/97 -0400, you wrote:
>Jim Canfield wrote:
>>The most secure, usable, firewall we have found to date is the
>>Cyberguard
>
>On what basis do you make this assertion?  "secure" can mean a lot of 
>things and a rubber stamp from NSA or it's equivalent doesn't mean a 
>whole lot if buggy software can be trivially exploited.  We could go on 
>about "usable" but I'll let that one slide.  In particular is the 
>firewall configuration an EXACT match with the 
>"certified/tested/evaluated" machine?  NT has a C2 rating but it's not 
>worth a damn.  When was the last time you ran an NT box with no LAN, no 
>floppy, and with a modified BIOS?  Not exactly a useful product.  Then 
>again, assuming you duplicate this setup, place said machine nearish to a 
>window.  Electronic eavesdropping (for about $3000 and change) or outside 
>observation does tend to degrade the usefulness of said rating does it 
>not?

Firest Mistake. NT is not C2 complient. Anyone knowing anything about LAN
security would know this. Do a little more research before replying to
someone. Besides, do you even know the differnet levels of security, or are
you just "anti-nt".(which is not a bad thing)



>
>>As mentioned the products are B1 compliant (awaiting certification)....
>whatever, see above.
>
>>They are relatively easy to setup , nice GUI and it has built in the
>Ah, the GUI.  Remote manageable too I think I recall.  What to say when 
>the X11 session gets hijacked?  You sure the box isn't running a 
>braindamaged X11 server?  Can you attack the logging facility thru DOS?  
>What happens when you bog the machine down with hundreds of connections?  
>Does it run out of VM and spontaneously reboot?  How about the logs 
>filling up the disk?  What happens when this occurs and an exploit is 
>then launched?  Do you still have an audit trail?
>
Have you even used the Cyberguard product ? You would know this if you have.
Pick up a phone and call !!


>>ablity for most "standard "(excuse the word) proxies and allows creation
>>of probably anything you might need.
>So they know how to check off all of the feature boxes on the report 
>card.  Anybody can and everybody does that.
>
>IMO ratings, be they NSA/NCSA or whatever aren't worth much and 
>deffinately not a price premium.  I take far more comfort in people 
>banging away at the available stuff and fixing the problems.  
>Additionally, you really believe the vendor (or reviewer for that matter) 
>went thru every single line of code specifically looking for possible 
>exploits?  Get real.  All the ratings do is study the protection scheme 
>and bless it as logical and OK at least in theory.  Then with various 
>degrees of persistance they try to prove you can't get around said 
>protection.  Holes and stack smashes by way of poorly written C and 
>resolver libraries and DOS via SYN etc. aren't addressed.  If they were 
>we wouldn't be plagued with some of the problems we have now.
>
SO..... Which firewall do you prefer? A filter in a router.

Sorry about the late response, I took off this weekend for once. I believe
if you do prefer one FW to another, that is fine. But don't say one box is
"better" then another or one is not "good". How do we rate these today? As
all LAN and WAN hardware desicions, personal tastes still are a factor. If I
like Cyberguard and you like Guantlet, who is to say I am wrong or you are.
Each application has it own requirements. Don't ask questions that pertain
to firewalls in general. 

 


>
============================================================================
= Brian Podolak, 							====
= E-Mail brianp@netrunner.net						====
============================================================================


From firewalls-owner  Mon Feb  3 12:11:25 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id LAA16660 for firewalls-outgoing; Mon, 3 Feb 1997 11:59:08 -0800 (PST)
Received: from beach.sctc.com (beach.sctc.com [192.55.214.50]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id LAA16642 for <firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 11:58:51 -0800 (PST)
Received: from mfil.terminal (mfil@localhost) by beach.sctc.com (8.7.5/8.7.3) with SMTP id NAA23552; Mon, 3 Feb 1997 13:20:43 -0600 (CST)
Received: from sphinx.sctc.com (sphinx.sctc.com [172.17.192.3]) by beach.sctc.com (8.7.5/8.7.3) with ESMTP id NAA23544; Mon, 3 Feb 1997 13:20:36 -0600 (CST)
Received: from cressida.sctc.com (cressida.sctc.com [172.17.192.62]) by sphinx.sctc.com (8.8.5/8.7.3) with ESMTP id NAA20517; Mon, 3 Feb 1997 13:23:04 -0600 (CST)
Received: from localhost (willis@localhost)
          by cressida.sctc.com (8.8.5/8.8.4) with SMTP
	  id NAA01821; Mon, 3 Feb 1997 13:23:01 -0600 (CST)
Date: Mon, 3 Feb 1997 13:23:01 -0600 (CST)
From: Matt Willis <willis@sctc.com>
To: "K.M." <goertzek@wangfed.com>
cc: firewalls@GreatCircle.COM
Subject: Re: Sidewinder vs. Cyberguard
In-Reply-To: <9702031538.AA20974@uc0009.wangfed.com>
Message-ID: <Pine.GSO.3.95.970203131751.1690F-100000@cressida.sctc.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Mon, 3 Feb 1997, K.M. wrote:

> However, I have heard that Sidewinder is very difficult to configure, unless 
> they have managed to greatly improve their interface in new release.  

Sidewinder now offers a *real* GUI and a command line interface, for those
of us that like it old-school.  Not that I count as unbiased, but it's a
night-and-day comparison to the old version...

We've also done away with the notion of internal and external to allow for
multiple network interfaces...

The mail-filter is pretty hip, as well... drag-and-drop and such.

Matt Willis
Computer Scientist
Secure Computing Corporation


From firewalls-owner  Mon Feb  3 12:41:36 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id MAA18364 for firewalls-outgoing; Mon, 3 Feb 1997 12:13:55 -0800 (PST)
Received: from mailhost.netrunner.net (mailhost.netrunner.net [204.137.145.201]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id MAA18299 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 12:13:25 -0800 (PST)
Received: from brian ([207.100.192.100]) by mailhost.netrunner.net (8.7.5/8.7.5) with SMTP id PAA26673 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 15:21:40 -0500 (EST)
Date: Mon, 3 Feb 1997 15:21:40 -0500 (EST)
Message-Id: <1.5.4.16.19970203151305.19a7696a@mailhost.netrunner.net>
X-Sender: brianp@mailhost.netrunner.net
X-Mailer: Windows Eudora Light Version 1.5.4 (16)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: Firewalls@GreatCircle.COM
From: Brian Podolak <brianp@netrunner.net>
Subject: Re: Sidewinder vs. Cyberguard
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 09:31 PM 2/1/97 -0400, you wrote:
>Jim Canfield wrote:
>>The most secure, usable, firewall we have found to date is the
>>Cyberguard
>
>On what basis do you make this assertion?  "secure" can mean a lot of 
>things and a rubber stamp from NSA or it's equivalent doesn't mean a 
>whole lot if buggy software can be trivially exploited.  We could go on 
>about "usable" but I'll let that one slide.  In particular is the 
>firewall configuration an EXACT match with the 
>"certified/tested/evaluated" machine?  NT has a C2 rating but it's not 
>worth a damn.  When was the last time you ran an NT box with no LAN, no 
>floppy, and with a modified BIOS?  Not exactly a useful product.  Then 
>again, assuming you duplicate this setup, place said machine nearish to a 
>window.  Electronic eavesdropping (for about $3000 and change) or outside 
>observation does tend to degrade the usefulness of said rating does it 
>not?

Firest Mistake. NT is not C2 complient. Anyone knowing anything about LAN
security would know this. Do a little more research before replying to
someone. Besides, do you even know the differnet levels of security, or are
you just "anti-nt".(which is not a bad thing)



>
>>As mentioned the products are B1 compliant (awaiting certification)....
>whatever, see above.
>
>>They are relatively easy to setup , nice GUI and it has built in the
>Ah, the GUI.  Remote manageable too I think I recall.  What to say when 
>the X11 session gets hijacked?  You sure the box isn't running a 
>braindamaged X11 server?  Can you attack the logging facility thru DOS?  
>What happens when you bog the machine down with hundreds of connections?  
>Does it run out of VM and spontaneously reboot?  How about the logs 
>filling up the disk?  What happens when this occurs and an exploit is 
>then launched?  Do you still have an audit trail?
>
Have you even used the Cyberguard product ? You would know this if you have.
Pick up a phone and call !!


>>ablity for most "standard "(excuse the word) proxies and allows creation
>>of probably anything you might need.
>So they know how to check off all of the feature boxes on the report 
>card.  Anybody can and everybody does that.
>
>IMO ratings, be they NSA/NCSA or whatever aren't worth much and 
>deffinately not a price premium.  I take far more comfort in people 
>banging away at the available stuff and fixing the problems.  
>Additionally, you really believe the vendor (or reviewer for that matter) 
>went thru every single line of code specifically looking for possible 
>exploits?  Get real.  All the ratings do is study the protection scheme 
>and bless it as logical and OK at least in theory.  Then with various 
>degrees of persistance they try to prove you can't get around said 
>protection.  Holes and stack smashes by way of poorly written C and 
>resolver libraries and DOS via SYN etc. aren't addressed.  If they were 
>we wouldn't be plagued with some of the problems we have now.
>
SO..... Which firewall do you prefer? A filter in a router.

Sorry about the late response, I took off this weekend for once. I believe
if you do prefer one FW to another, that is fine. But don't say one box is
"better" then another or one is not "good". How do we rate these today? As
all LAN and WAN hardware desicions, personal tastes still are a factor. If I
like Cyberguard and you like Guantlet, who is to say I am wrong or you are.
Each application has it own requirements. Don't ask questions that pertain
to firewalls in general. 

 


>
============================================================================
= Brian Podolak, 							====
= E-Mail brianp@netrunner.net						====
============================================================================


From firewalls-owner  Mon Feb  3 14:27:58 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id MAA21279 for firewalls-outgoing; Mon, 3 Feb 1997 12:35:49 -0800 (PST)
Received: from cypress.nwnet.net (cypress.nwnet.net [192.80.13.56]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id MAA21213 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 12:35:26 -0800 (PST)
Received: from localhost (larry@localhost)
	by cypress.nwnet.net (970108885) with SMTP id MAA23416
	for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 12:34:05 -0800 (PST)
Date: Mon, 3 Feb 1997 12:34:05 -0800 (PST)
From: "Larry J. Hughes Jr." <larry@nwnet.net>
Reply-To: "Larry J. Hughes Jr." <larry@nwnet.net>
To: firewalls@greatcircle.com
Subject: FW's on NT server vs. workstation
Message-ID: <Pine.GSO.3.95.970203123111.6845H-100000@cypress.nwnet.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

(I'm resending this due to the apparent problems with distribution of
issue #44 this past weekend.) 

For those of you running firewalls on NT platforms: is NT server a must,
or does NT workstation suffice?  Any variables I should be aware of? 

---
Larry J. Hughes Jr.    larry@nwnet.net     http://www.nwnet.net/~larry/



From firewalls-owner  Mon Feb  3 14:53:18 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id NAA26914 for firewalls-outgoing; Mon, 3 Feb 1997 13:14:32 -0800 (PST)
Received: from f15.hotmail.com (F15.hotmail.com [207.82.250.26]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id NAA26868 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 13:14:16 -0800 (PST)
Received: (from root@localhost) by f15.hotmail.com (8.7.5/8.7.3) id NAA05684; Mon, 3 Feb 1997 13:12:56 -0800 (PST)
Date: Mon, 3 Feb 1997 13:12:56 -0800 (PST)
Message-Id: <199702032112.NAA05684@f15.hotmail.com>
Received: from 193.1.182.55 by www.hotmail.com with HTTP;
	Mon, 03 Feb 1997 13:12:56 PST
From: "John Cashman" <whizzy1@hotmail.com>
To: Firewalls@GreatCircle.COM
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

please remove my name from the list

---------------------------------------------------------
Get Your *Web-Based* Free Email at http://www.hotmail.com
---------------------------------------------------------


From firewalls-owner  Mon Feb  3 15:14:16 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id OAA07939 for firewalls-outgoing; Mon, 3 Feb 1997 14:33:37 -0800 (PST)
Received: from thor.inlink.com (ultra.inlink.com [206.196.96.100]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id OAA07858 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 14:32:37 -0800 (PST)
Received: from mail.global-sol.com (global-sol.com [206.196.126.221]) by thor.inlink.com (8.8.5/V8) with ESMTP id QAA11469 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 16:30:49 -0600 (CST)
Received: from thor.inlink.com ([206.196.126.220]) by mail.global-sol.com (8.7.5/8.7.3) with SMTP id SAA02126 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 18:11:43 GMT
Message-Id: <199702031811.SAA02126@mail.global-sol.com>
Comments: Authenticated sender is <tlayton@[206.196.126.221]>
From: "Timothy P. Layton, Sr." <tlayton@global-sol.com>
Organization: Global Solutions Corporation
To: firewalls@greatcircle.com
Date: Mon, 3 Feb 1997 16:28:38 +0000
Subject: MS Proxy server ??
Reply-to: tlayton@global-sol.com
X-mailer: Pegasus Mail for Win32 (v2.42)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Has anyone installed and played with the MS Proxy server yet ??

I am researching a firewall solution that will need to include proxy
and N.A.T.

Thanks for any input.


From firewalls-owner  Mon Feb  3 15:42:53 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id OAA07462 for firewalls-outgoing; Mon, 3 Feb 1997 14:28:36 -0800 (PST)
Received: from mail.ptw.com (mail.ptw.com [207.104.240.5]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id OAA07344 for <firewalls@greatCircle.COM>; Mon, 3 Feb 1997 14:28:04 -0800 (PST)
Received: from localhost.com (qh-1-16.ptw.com [207.212.177.48]) by mail.ptw.com (8.8.3/8.6.9) with SMTP id OAA00279 for <firewalls@greatCircle.COM>; Mon, 3 Feb 1997 14:22:43 -0800
Message-Id: <199702032222.OAA00279@mail.ptw.com>
Comments: Authenticated sender is <bextreme@mail.ptw.com>
From: "Jesse" <Jesse.Brown@POBox.com>
To: firewalls@greatCircle.COM
Date: Sun, 2 Feb 1997 14:27:26 +0000
MIME-Version: 1.0
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Subject: Rainbow Book Series?
Reply-to: bextreme@POBox.com
X-mailer: Pegasus Mail for Win32 (v2.42a)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello, does anyone know where I can get the entire Rainbow Book 
Series?

   Thanks!!
-J
===================================================
Finger bextreme@pobox.com for PGP Public Key Block.
E-mail to jesse.brown@pobox.com
phone: (805) 942-1391   pager: (805) 267-9511
---------------------------------------------------
 Member of the HTML Writers Guild (http://hwg.org)
===================================================

From firewalls-owner  Mon Feb  3 16:02:10 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id OAA07769 for firewalls-outgoing; Mon, 3 Feb 1997 14:31:41 -0800 (PST)
Received: from thor.inlink.com (ultra.inlink.com [206.196.96.100]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id OAA07645 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 14:30:39 -0800 (PST)
Received: from mail.global-sol.com (global-sol.com [206.196.126.221]) by thor.inlink.com (8.8.5/V8) with ESMTP id QAA11098 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 16:29:04 -0600 (CST)
Received: from thor.inlink.com ([206.196.126.220]) by mail.global-sol.com (8.7.5/8.7.3) with SMTP id SAA02110 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 18:09:58 GMT
Message-Id: <199702031809.SAA02110@mail.global-sol.com>
Comments: Authenticated sender is <tlayton@[206.196.126.221]>
From: "Timothy P. Layton, Sr." <tlayton@global-sol.com>
Organization: Global Solutions Corporation
To: firewalls@greatcircle.com
Date: Mon, 3 Feb 1997 16:26:54 +0000
Subject: NAT on Cisco PIX vs. ??
Reply-to: tlayton@global-sol.com
X-mailer: Pegasus Mail for Win32 (v2.42)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I am familiar with NAT on the PIX and was wondering what 
operating systems that any one has had experience with in dealing
with NAT. Does any one feel that there is a trade off with the
PIX being a hardware solution vs. a software based solution ?

Thanks for any input.



From firewalls-owner  Mon Feb  3 16:06:48 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id PAA12171 for firewalls-outgoing; Mon, 3 Feb 1997 15:06:43 -0800 (PST)
Received: from relay7.UU.NET (relay7.UU.NET [192.48.96.17]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id PAA12116 for <firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 15:06:18 -0800 (PST)
Received: from txau.tx.mt.np.els-gms.att.net by relay7.UU.NET with SMTP 
	(peer crosschecked as: txau.tx.mt.np.els-gms.att.net [199.191.144.201])
	id QQcbiy12497; Mon, 3 Feb 1997 18:04:51 -0500 (EST)
Date: Mon, 03 Feb 1997 17:08:55 -0500
From: mcoss@attmail.com (Michael J Coss)
Received: from mcoss by attmail; Mon Feb  3 23:02:12 GMT 1997
Subject: Re: Sidewinder vs. Cyberguard
To: firewalls@GreatCircle.COM
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <winATT-3.0-mcoss-26>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Matthew Patton wrote:

>On what basis do you make this assertion?  "secure" can mean a lot of 
>things and a rubber stamp from NSA or it's equivalent doesn't mean a 
>whole lot if buggy software can be trivially exploited.  We could go on 
>about "usable" but I'll let that one slide.  In particular is the 
>firewall configuration an EXACT match with the 
>"certified/tested/evaluated" machine?  NT has a C2 rating but it's not 
>worth a damn.  When was the last time you ran an NT box with no LAN, no 
>floppy, and with a modified BIOS?  Not exactly a useful product.  Then 
>again, assuming you duplicate this setup, place said machine nearish to a 
>window.  Electronic eavesdropping (for about $3000 and change) or outside 
>observation does tend to degrade the usefulness of said rating does it 
>not?

Your correct, "secure" is a nebulous term, but obviously you have not been 
involved with a evaluation of an operating system if you believe that its a 
rubber stamp.  I worked on the NCSC evaluation of a UNIX operating system and 
it took too long (several years) and was not a rubber stamp.  Your point about 
what the configuration is is quite true but Cyberguard has gone the extra mile 
of getting a Network evaluation to provide a better security solution that 
does include a network component.  And you can buy the NightHawk in a TEMPEST 
cabinet if your concerned about that.
 
>Ah, the GUI.  Remote manageable too I think I recall.  What to say when 
>the X11 session gets hijacked?  You sure the box isn't running a 
>braindamaged X11 server?  Can you attack the logging facility thru DOS?  
>What happens when you bog the machine down with hundreds of connections?  
>Does it run out of VM and spontaneously reboot?  How about the logs 
>filling up the disk?  What happens when this occurs and an exploit is 
>then launched?  Do you still have an audit trail?

First, I know of no system that is completely immune to a concerted denial of 
service attack.  You can attempt to minimize the impact but with a general 
purpose operating system, it may be virtually impossible to eliminate.  
Second, unless your willing to expend the money to create a tamperproof box, 
the granting of access to the machine is taboo. 

>So they know how to check off all of the feature boxes on the report 
>card.  Anybody can and everybody does that.
Do you KNOW that the features are not provided?  What feature do you believe 
they are lying about?

>IMO ratings, be they NSA/NCSA or whatever aren't worth much and 
>deffinately not a price premium.  I take far more comfort in people 
>banging away at the available stuff and fixing the problems.  
And what pray tell do you believe that the evaluations/testings are trying to 
do?  The purpose of these are to provide a degree of comfort that someone 
other than the vendor has looked is varying degrees of detail at the 
implementation of the software/hardware combination.

>Additionally, you really believe the vendor (or reviewer for that matter) 
>went thru every single line of code specifically looking for possible 
>exploits?  Get real.
Have you been involved in the evaluation process?  I have.  No, we didn't go 
thru every single line of code but we tried to get complete coverage and did a 
analysis of the data flow and looked at the access control mechanisms in 
great detail and looked at privileged processes to verify there correct 
operation and in those programs we did indeed look at every line and reviewed 
the libraries.  That some people attempt to slide thru an evaluation, I have 
no doubt but I'd like to believe that that is the exception rather than the 
rule. 

>All the ratings do is study the protection scheme and bless it as logical 
>and OK at least in theory.  Then with various degrees of persistance they
>try to prove you can't get around said protection.  Holes and stack smashes
>by way of poorly written C and resolver libraries and DOS via SYN etc.
>aren't addressed.

While the NCSC did not require denial of service attacks, nor penetration 
testing (for a B1 system), we as part of our own Q&A did do these things based 
on knowledge gathered from various sources and our own experience.

>If they were we wouldn't be plagued with some of the problems we have now.
No product is completely immune no matter how much money or resources are 
thrown at it.  What you want is a system that provides a degree of security, 
and some assurance that the vendor has made a best effort at 1) implementation 
of a security mechanism, and 2) discovery/correction of known bugs.

Finally, there is the issue of do you need a secure operating system.  While I 
believe that a properly implemented firewall does not require a trusted base 
to run on.  A secure OS will help if the firewall code is compromised.  It may 
not be sufficient to protect the network but it may minimize the damage.

I'm not recommending either choice but I do believe that there is benefits 
derived from having the system evaluated by an outside source.  Is it worth 
the money? The market has shown to date that they want security but don't want 
to pay for the extensive review/testing/etc. required to develop and maintain 
it.  The expectation is that it should come for free..."Of course your 
software is safe...right?"

---Michael J Coss
Lucent Technologies - Bell Laboratories		mjcoss@lucent.com

From firewalls-owner  Mon Feb  3 16:26:28 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id PAA18897 for firewalls-outgoing; Mon, 3 Feb 1997 15:50:41 -0800 (PST)
Received: from si-nic.hrz.uni-siegen.de (si-nic.hrz.uni-siegen.de [141.99.128.16]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id PAA18731 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 15:49:46 -0800 (PST)
Received: from vespa.unix-ag.uni-siegen.de <Firewalls@GreatCircle.COM>
	by si-nic.hrz.uni-siegen.de with SMTP (5.67b/UniSiegen 1.1)
        id AA11184; Tue, 4 Feb 1997 00:48:13 +0100
Received: from privatehost (sfx@isdn92.hrz.uni-siegen.de [141.99.174.92]) by vespa.unix-ag.uni-siegen.de (Mailhost) with ESMTP id AAA23776 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 00:47:20 +0100 (MET)
To: "Firewalls" <Firewalls@GreatCircle.COM>
In-Reply-To: <32F462D3.38E3@pacificnet.net>
From: "Lars Eilebrecht" <sfx@unix-ag.uni-siegen.de>
Date: Tue, 04 Feb 1997 00:45:04 +0200
X-Mailer: IntuiNews 1.4 (28.6.96)
Subject: Re: SATAN user group?
Message-Id: <43790619.sfx@shadowbase.unix-ag.org>
Organization: Unix workgroup at the University of Siegen
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

osiris wrote:

> Has anyone on this list tried "Merlin?" I am wondering whether anyone has
> attempted to make a siilar interface to manage firewall admnistration and
> auditing. (Merln is a tool from CIAC. It integrates Tripwire, COPS, TIGER,
> Crack and reportedly, SPI, which is unavailable to us regular folk. The
                        ^^^
SPI?


ciao...
        Lars
-- 
     _____ ____ __
    /\___// __// /    __              sfx@cyberspace.org
    \ \  / /_\  /    /\_\      http://www.cyberspace.org/~sfx/
  ___\ \/ __//  \    \/_/
 /____\/_/  /_/\ \           - I don't know, I don't care,
                \_\         - and it doesn't make any difference.


From firewalls-owner  Mon Feb  3 16:29:01 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id PAA17618 for firewalls-outgoing; Mon, 3 Feb 1997 15:42:28 -0800 (PST)
Received: from loki.atcon.com (loki.atcon.com [199.166.213.6]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id PAA17579 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 15:42:11 -0800 (PST)
Received: from stealth.icondata.com (stealth.icondata.com [198.167.251.19]) by loki.atcon.com (8.8.3/8.7.3) with SMTP id TAA27191 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 19:40:41 -0400 (AST)
Received: by stealth.icondata.com with Microsoft Mail
	id <01BC120A.4F787AC0@stealth.icondata.com>; Mon, 3 Feb 1997 19:41:55 -0400
Message-ID: <01BC120A.4F787AC0@stealth.icondata.com>
From: Jeff Simms <jsimms@auracom.com>
To: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: RE: NT network and system management
Date: Mon, 3 Feb 1997 19:41:53 -0400
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

One product you may look into is MS SMS (System Management Server) =
Server.  I have only briefly looked at the product, but it does most, if =
not all and more, of the things you require.

Jeff Simms
Network Services Manager
auracom Internet Services

-----Original Message-----
From:	FaNgYoU2 [SMTP:fangyou2@panix.com]
Sent:	Monday, February 03, 1997 1:18 PM
To:	firewalls@GreatCircle.COM
Subject:	NT network and system management

Apologies because this is not strictly a firewall question.  However,
there are quite a few NT experts on the list who can help.

I need to monitor the following items across about 80 Windows NT =
servers:
DOS Devices : Paging File : Percent usage Peak
Physical Disk : Percent disk time
Physical Disk : Average disk sec/read  (reads per second)
Physical Disk : Disk read bytes/sec    (read bytes per second)
Physical Disk : Queue length
Processor : Percent processor time
Memory : pages/second
Server : bytes total/second

For each network user connected to server:
NIC card address/MAC address
Computer name (if any)
IP address (if any)
User name.

Is there a group of NET commands which will give me this?
Is there a commercial product that can be customized to give me this?
Finally, which mailing list does this question really belong on?

                                         FaNgYoU2, Cyberspace^^Vampyre

^^       Touch it, touch it, touch me ... creatures of the Night       =
^^



From firewalls-owner  Mon Feb  3 16:32:00 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id PAA15568 for firewalls-outgoing; Mon, 3 Feb 1997 15:29:05 -0800 (PST)
Received: from terisa-bh.terisa.com (terisa-bh.terisa.COM [205.226.38.66]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id PAA15548 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 15:28:55 -0800 (PST)
Received: (from uucp@localhost) by terisa-bh.terisa.com (8.6.12/8.6.11) id PAA13228; Mon, 3 Feb 1997 15:28:59 -0800
Received: from itech.terisa.com by terisa-bh.terisa.com via smap (V1.3)
	id sma013225; Mon Feb  3 15:28:44 1997
Received: from kmac.terisa.COM (kmac.terisa.COM [205.226.39.35]) by itech.terisa.com (8.6.12/8.6.4) with SMTP id PAA13699; Mon, 3 Feb 1997 15:25:09 -0800
Message-Id: <199702032325.PAA13699@itech.terisa.com>
X-Authentication-Warning: itech.terisa.com: Host kmac.terisa.COM didn't use HELO protocol
To: Brian Podolak <brianp@netrunner.net>
cc: Firewalls@GreatCircle.COM
Subject: Re: Sidewinder vs. Cyberguard 
In-reply-to: Your message of "Mon, 03 Feb 1997 14:05:27 EST."
             <1.5.4.16.19970203135653.1aef92d6@mailhost.netrunner.net> 
Date: Mon, 03 Feb 1997 15:29:08 -0800
From: EKR <ekr@terisa.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> At 09:31 PM 2/1/97 -0400, you wrote:
> >Jim Canfield wrote:
> >>The most secure, usable, firewall we have found to date is the
> >>Cyberguard
> >
> >On what basis do you make this assertion?  "secure" can mean a lot of 
> >things and a rubber stamp from NSA or it's equivalent doesn't mean a 
> >whole lot if buggy software can be trivially exploited.  We could go on 
> >about "usable" but I'll let that one slide.  In particular is the 
> >firewall configuration an EXACT match with the 
> >"certified/tested/evaluated" machine?  NT has a C2 rating but it's not 
> >worth a damn.  When was the last time you ran an NT box with no LAN, no 
> >floppy, and with a modified BIOS?  Not exactly a useful product.  Then 
> >again, assuming you duplicate this setup, place said machine nearish to a 
> >window.  Electronic eavesdropping (for about $3000 and change) or outside 
> >observation does tend to degrade the usefulness of said rating does it 
> >not?
> 
> Firest Mistake. NT is not C2 complient. Anyone knowing anything about LAN
> security would know this. Do a little more research before replying to
> someone. Besides, do you even know the differnet levels of security, or are
> you just "anti-nt".(which is not a bad thing)
Actually, you're quite wrong. NT has been evaluated at C2 in
a standalone configuration, which appears to be precisely what
the gentleman was referring to. Please see:

http://www.radium.ncsc.mil/tpep/epl/entries/CSC-EPL-95-003.html

-Ekr



From firewalls-owner  Mon Feb  3 16:36:23 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id PAA17994 for firewalls-outgoing; Mon, 3 Feb 1997 15:44:10 -0800 (PST)
Received: from gatekeeper.Bridge.COM (gatekeeper.bridge.com [167.76.159.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id PAA17713 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 15:42:57 -0800 (PST)
Received: (from mailproxy@localhost) by gatekeeper.Bridge.COM (8.6.12/8.6.9) id RAA26513 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 17:40:18 -0600
Received: from dns1srv.bridge.com(167.76.36.6) by gatekeeper.Bridge.COM via smap (V1.3)
	id sma026498; Mon Feb  3 17:40:09 1997
Received: from binki.bridge.com (binki.bridge.com [167.76.24.243]) by dns1srv.bridge.com (8.7.6/8.7.3) with ESMTP id RAA17246 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 17:41:36 -0600 (CST)
Received: (from ken@localhost) by binki.bridge.com (8.7/8.7) id RAA07664 for firewalls@greatcircle.com; Mon, 3 Feb 1997 17:41:38 -0600 (CST)
Date: Mon, 3 Feb 1997 17:41:38 -0600 (CST)
From: Ken Hardy <ken@mailhost.bridge.com>
Message-Id: <199702032341.RAA07664@binki.bridge.com>
To: firewalls@greatcircle.com
Subject: Solved: Odd probes at port 7777
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I wrote:

>Every couple of days we get an attempted connection to port 7777 from
>scripps.edu, so I put a byte sucker on that port to log any received
>data.  It seems to be a 4 digit and a 2 digit number separated by a
>comma, followed by a carriage return.

Further investigation made it apparent that the connection to my port
7777 was occuring whenever a connection was made to the remote system's
SMTP port.  The data I captured, two comma-separated decimal numbers
followed by a <CR><LF>, is identical to an IDENT query.  The second number
was always 25.  The lightbulb lights!

I relayed this information to the site's admin.  He reports that they
had recently installed a new version of sendmail which does IDENT
queries, but why to port 7777?  The admin's latest message to me:

>You were on the right track with your comment about services..
>We are a heavy user of NIS and ident is not a standard Solaris
>/etc/services daemon.  I found that the NIS file contained
>an ident entry with an alias of auth..  There was an auth entry
>in the NIS file at port 7777..  I converted it to only use
>a local copy of the services file..  Hopefully, this will cause
>the probing you were seeing to go away..  If it doesn't please
>let me know..  THANKS for the heads-up on the problem!

I don't see this on any of my Solaris systems (not using NIS).  I'd
guess that someone had put an "auth" entry in at 7777 to refer to TIS'
authsrv, which uses that port.
^^^^

--
KH

From firewalls-owner  Mon Feb  3 18:10:57 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id SAA12537 for firewalls-outgoing; Mon, 3 Feb 1997 18:07:48 -0800 (PST)
Received: from polaris.pacificnet.net (polaris.pacificnet.net [207.171.0.250]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id SAA12518 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 18:07:37 -0800 (PST)
From: osiris@pacificnet.net
Received: from lwash (pm3e-31.pacificnet.net [207.171.18.224]) by polaris.pacificnet.net (8.6.11/8.6.11) with SMTP id SAA27015; Mon, 3 Feb 1997 18:05:29 -0800
Message-ID: <32F69A74.A8B@pacificnet.net>
Date: Mon, 03 Feb 1997 18:09:56 -0800
Organization: -
X-Mailer: Mozilla 3.01Gold (Win95; I)
MIME-Version: 1.0
To: Lars Eilebrecht <sfx@unix-ag.uni-siegen.de>
CC: Firewalls <Firewalls@GreatCircle.COM>
Subject: Re: SATAN user group?
References: <43790619.sfx@shadowbase.unix-ag.org>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Lars Eilebrecht wrote:
> 
> osiris wrote:
> 
> > Has anyone on this list tried "Merlin?" I am wondering whether anyone has
> > attempted to make a siilar interface to manage firewall admnistration and
> > auditing. (Merln is a tool from CIAC. It integrates Tripwire, COPS, TIGER,
> > Crack and reportedly, SPI, which is unavailable to us regular folk. The
>                         ^^^
> SPI?
> 
> ciao...
>         Lars

Yeah...strange little ditty. SPI = Security Profile Inspector. It's a
very powerful tool for examination of UNIX networks. Problem is, it's
only available to the US Department of Energy and Department of Defense.
(Or, qualified contractors.) You can check out at least their preview at
http://ciac.llnl.gov/cstc/spi/spinet.html. About the closest I've been
able to get to understanding this tool is to aqcuire the manuals (which
apparently aren't restricted) and are here:
ftp://ciac.llnl.gov/pub/spi/spi.rm.ps.Z.

From firewalls-owner  Mon Feb  3 18:56:32 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id SAA16874 for firewalls-outgoing; Mon, 3 Feb 1997 18:44:13 -0800 (PST)
Received: from csc.com (explorer.csc.com [20.1.10.27]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id SAA16829 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 18:44:00 -0800 (PST)
Received: from sdfpc2.gsfc.nasa.gov by csc.com with smtp
	(Smail3.1.29.1 #1) id m0vrapU-001AdNC; Mon, 3 Feb 97 21:41 EST
Message-ID: <32F6CCFC.6E6A@csc.com>
Date: Mon, 03 Feb 1997 21:45:32 -0800
From: Adam Safier <asafier@csc.com>
Reply-To: asafier@csc.com
Organization: Computer Sciences Corp.
X-Mailer: Mozilla 3.0 (Win16; U)
MIME-Version: 1.0
To: firewalls@greatcircle.com
CC: watchman@molhub.mol.net.my, MMedwid@symantec.com
Subject: Multicast through Firewall-1
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Can anyone provide pointers to an MOSPF implementation for Solaris 2.5
(without full OSPF if possible - I plan static routs)  or  better yet, a
multicast proxy or Firewall-1 rule that will pass multicast correctly?

An alternative would be a proxy/rule for joining an external group and
then doing NAT to unicast to selected host(s) internally.  Anyone got
one they can share?

Background:

By running _Mrouted_ on the firewall I can multicast between LAN's on
either side of Firewall-1 on a SUN with Solaris 2.5 (I know... UDP,
multicast <> security, but we have to have it.) Alas, the backbone
(external) router will be running MOSPF.  MOSPF and DVMRP supposedly do
not talk to each other on Bay Networks routers (over which I have no
control.)

>From what I can tell from some searches, as of June '96 gated did not
support MOSPF.  It will someday but it doesn't look like it will be in
time to help me.

Knowledge sharing and misinformation:

Multicast uses the Class D IP addresses to transmit a single packet that
can be seen by a group of hosts.  An IGMP (protocol 2, not ICMP) "join"
(or "drop") message is sent to multicast capable routers by hosts that
wish to join a multicast group. The router uses either MOSPF or DVMRP to
tell other routers it has group memebers for that group.  When a
multicast UDP packet is sent by one host the routers unicast it between
routers that have group memebers for that packet. When a router has an
attached LAN with memebers in the group it sends that packet out with a
multicast IP address (Ex: 224.1.2.3) on the LAN's multicast MAC
address.  (Ethernet actually ends up mapping 4 multicast IP addresses to
each ethernet multicast address.)  

The need to write to a multicast MAC address is why I think regular NAT
will not work well with multicast. We could try to work out something by
overloading IP addresses on each interface and forcing a multicast MAC
address on each multicast IP address in the ARP table but with a bunch
of multicast addresses this is a painfully tedious process, if it even
works!

Mrouted takes care of all of that but then the firewall is acting as a
router running DVMRP, which is incompatible with MOSPF (multicast
extensions to OSPF!)  I tried running an AltaVista search on +MOSPF +sun
+multicast and got limited results and no pointers to MOSPF code



-- 
Adam Safier                  asafier@csc.com		http://www.csc.com
CSC-SED-Infosec              (301) 794-1349		(301) 552-3272 (fax)

Curious Cat Question:  
How does DIX Ethernet know the packet length?
802.3 Ethernet has a length field but DIX has a type and no length
field.

Technology Abuse: 1) Netscape Frames on a 14" screen.
                  2) Netscape 3.0 on a 386-33 w/ 8 Meg RAM.

The above are my own opinions.
I'm proud to live in a country where I'm free to express them!


From firewalls-owner  Mon Feb  3 19:25:53 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id TAA21106 for firewalls-outgoing; Mon, 3 Feb 1997 19:19:57 -0800 (PST)
Received: from mesbne01.medeserv.com.au (mesbne01.medeserv.com.au [203.9.184.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id TAA21076 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 19:19:47 -0800 (PST)
Received: (from mail@localhost) by mesbne01.medeserv.com.au (8.7.4/8.7.3) id NAA07310 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 13:18:23 +1000 (EST)
Received: from tooh199.medeserv.com.au(203.9.187.199) by mesbne01 via smap (V1.3)
	id /mail/incoming/sma007295; Tue Feb  4 13:18:21 1997
Message-ID: <32F6ACD0.2F25@medeserv.com.au>
Date: Tue, 04 Feb 1997 13:28:16 +1000
From: Steven Herod <sherod@medeserv.com.au>
Reply-To: sherod@medeserv.com.au
Organization: Med-E-Serv Connect
X-Mailer: Mozilla 3.0C-MESC  (WinNT; I)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: Encryption Software mailing list
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Is anybody familiar with an Encyrption Software mailing list
or something along those lines?

Best Regards
Steven Herod

From firewalls-owner  Mon Feb  3 19:45:03 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id TAA21607 for firewalls-outgoing; Mon, 3 Feb 1997 19:25:52 -0800 (PST)
Received: from homeport.org (lighthouse.homeport.org [205.136.65.198]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id TAA21584 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 19:25:42 -0800 (PST)
Received: (adam@localhost) by homeport.org (8.8.5/8.6.9) id WAA12795; Mon, 3 Feb 1997 22:22:00 -0500 (EST)
From: Adam Shostack <adam@homeport.org>
Message-Id: <199702040322.WAA12795@homeport.org>
Subject: Re: to source or not to source? (was: [NTSEC] ActiveX, MSIE and Quicken)
In-Reply-To: <199702031025.LAA07956@relay.cryptonet.it> from David Vincenzetti at "Feb 3, 97 11:17:58 am"
To: vince@cryptonet.it (David Vincenzetti)
Date: Mon, 3 Feb 1997 22:21:59 -0500 (EST)
Cc: Firewalls@GreatCircle.COM
X-Mailer: ELM [version 2.4ME+ PL27 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

	Malicious hackers have a lot more time on their hands than
good guys.

	They do not, however, tend to publish bugs.  So, what you see
in public is that the many good guys who look at systems with source
available announce problems, while the bad guys, who look at both
source and binaries, do not announce problems.  This is what
statisticians refer to as the self-selection problem.

	Drawing inferences from bad data will probably lead you to bad
inferences.

Adam


David Vincenzetti wrote:
| Sendmail full sources are available, they can be studied
| and examined by everyone, and they can be studied by malicious
| hackers too.  ActiveX sources are not available, and it is
| harder, for a malicious hacker, to spot new bugs.
| Sendmail is a crystal box while ActiveX is a black box
| (remember the old Security Thru Obscurity model?:-).

-- 
Pet peeve of the day: Security companies whose protocols dare not
speak their name, because they don't have one. Guilty company of the
day is now V-One.




From firewalls-owner  Mon Feb  3 20:32:53 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id UAA28444 for firewalls-outgoing; Mon, 3 Feb 1997 20:15:59 -0800 (PST)
Received: from www.fordnet.com ([204.57.142.93]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id UAA28437 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 20:15:53 -0800 (PST)
Received: from autobahn.wolfenet.com (sea-ts1-p71.wolfenet.com [204.157.98.18]) by www.fordnet.com (8.7.3 Version 1.1 Build 565/8.7.3) with SMTP id VAA00016 for <Firewalls@GreatCircle.COM>; Mon, 03 Feb 1997 21:08:46 -0800 (Pacific Standard Time)
Message-Id: <3.0.1.32.19970203201644.0068c418@fordnet.com>
X-Sender: Jeremy@fordnet.com
X-Mailer: Windows Eudora Light Version 3.0.1 beta 12 (32)
Date: Mon, 03 Feb 1997 20:16:44 -0800
To: Firewalls@GreatCircle.COM
From: Jeremy Johnson <Jeremy@fordnet.com>
Subject: NT Firewall
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Just curious as to what all of you thought would be the best firewall to
implement on a NT4.x server? we are a rapidly growing company and we need
to establish our network security firmly before we take on many more  clients.
any thoughts?

thanx
Jeremy Johnson
System Administrator
Internet Autobahn, Inc.

From firewalls-owner  Mon Feb  3 20:41:06 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id UAA28970 for firewalls-outgoing; Mon, 3 Feb 1997 20:20:21 -0800 (PST)
Received: from diablo.cisco.com (diablo.cisco.com [171.68.223.106]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id UAA28930 for <firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 20:20:08 -0800 (PST)
Received: from clonvick-pc.cisco.com (sj-dial-4-26.cisco.com [171.68.179.91]) by diablo.cisco.com (8.8.4/CISCO.SERVER.1.2) with SMTP id UAA04488; Mon, 3 Feb 1997 20:18:22 -0800 (PST)
Message-Id: <2.2.32.19970204041522.006bf3ac@diablo.cisco.com>
X-Sender: clonvick@diablo.cisco.com
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Mon, 03 Feb 1997 22:15:22 -0600
To: CCCRE.CCULL@capital.ge.com,
        "firewalls(a)greatcircle.com" <firewalls@GreatCircle.COM>
From: Chris Lonvick <clonvick@cisco.com>
Subject: Re: Highly available Internet connection
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi again,

I just need to correct something I wrote about HSRP.  The Great Powers That 
Be have told me that the interfaces configured with HSRP, disable ICMP 
redirects.  This is so the workstations never get confused.  

If a Primary were to send out a redirect, the workstation that received it
would send packets to it.  If that router were to fail, then there would be
no backup for it.  Therefore, the developers reasoned, it is good to not send
ICMP redirects to workstations.  The workstations should always be able to
reach a router on the LAN which is participating in HSRP.

Sorry for the misinformation,
Chris 

At 11:10 PM 1/31/97 -0600, Chris Lonvick wrote:
>Hi folks,
>
>The details of HSRP (Hot Standby Router Protocol) can be found at:
>  http://www.cisco.com/warp/public/417/27.html
>
>I wouldn't say that there is any "load sharing" between the two (or more)
>routers participating in HSRP.  In essence, a Virtual MAC (VMAC) address is
>passed back in response to an ARP from the Priamry HSRP router.  The Primary
>HSRP router will accept packets destined to that VMAC.  If it dies, then the
>Secondary will accept packets destined to the VMAC after the funeral (...
>uhh, I mean to say, after the Secondary doesn't see any HSRP-Hello's within
>a timeout period - usually 10 seconds, but it's configurable.)  
>
>While these devices maintain a VMAC between them, each does have their own
>unique MAC, and IP addresses and each maintains its' own routing tables.
>So, if the primary fails, it should either have a real route to all known
>destinations, or should have a default route.  If both are on the same
>internal LAN segment as well as external LAN segment (DMZ) then they will
>both have the same routing table.
>
>As far as load sharing or balancing goes, if the routers have different
>routing paths (one router has a connection to ISP-A and another has a
>connection to ISP-B rather than being on the same DMZ LAN), they will
>maintain different routing tables.  So, if you configure a workstation with
>a default gateway (the Primary HSRP router), and it sends packets towards
>it, then the Primary HSRP router may respond with an ICMP-redirect which
>points to one of the backup HSRP routers.  In this way, some sessions may go
>across the HSRP backup router.
>
>Getting back to the original question, I'd opt for diversity throughout your
>enterprise if it's _that_ important to you.   Most of the systems I've seen
>have dealt with:
>o  what if my firewall dies?
>o  what if my link to my ISP dies?
>o  what if my ISP dies?
>Which have the same single point of failure: your central site.
>
>Living in Houston, as elsewhere along the Gulf Coast, we worry about: what
>if all communications to the city becomes unavailable?  (Not to press our
>luck, but I think that we're statistically overdue for a really big
>hurricane.)  So, to line this out with an example, if your Transaction
>Processing machines (redundant, of course) are in Wichita and Des Moines,
>then you should have ISP links in each of those cities which both of your TP
>machines could access if 
>o  the primary link were to fail
>o  the other TP machine were to fail
>o  that really big hurricane was to get to one city or the other.
>
>+++ Some commercialism follows +++  stop reading here if this offends you.
>(hey, I gotta' make a living!)
>
>The Cisco PIX does have a failover feature.  
>  http://www.cisco.com/warp/public/146/Intrafirewall.html
>which does address the issue of "what if my firewall dies?"
>
>It is usually deployed on the same internal LAN and same DMZ-LAN.  However,
>just thinking about it, it should be possible to deploy them both on an
>internal LAN, but on different external LANs with routers going to different
>ISPs.  Since the PIX is session stateful (the routers are, by default, not
>stateful), sessions would be broken if the primary fails but general
>connectivity would be maintained.  
>
>Hope this helps,
>
>Chris Lonvick
>Cisco Systems
>Consulting Engineering
>Houston, TX, USA
>+1-713-778-5663
>
>
>
>
>At 10:38 AM 1/31/97 -0500, CCCRE.CCULL@capital.ge.com wrote:
>>     >>Are they one on the same box or is it two different router that
>>     >>automatically drop to a redundancy ? Thanks.
>>
>>     >>-- Joel
>>
>>     i didn't get your e-mail address joel,  so i'm having to repond
>>     here...
>>
>>     they are 2 physically seperate boxes (referring to cisco's hot standby
>>     protocol).  i'm not sure if they do anything like load balancing,  or
>>     if the split between the 2 is more static.  however,  i do know that
>>     when one fails,  the other one picks up it's load.  i'm working from 4
>>     month old memory here,  so this stuff is a little foggy....  but it
>>     seems like the 2 routers are seen (ip-wise) as 1 virtual router.  i
>>     guess each router knows the other's routing table,  but just ignores
>>     that portion as long as the other router is functional. if they DIDN'T
>>     know each others table,  and 1 of the routers failed,  there'd be a
>>     lag while it updated,  and i remember no perceptible lag when we
>>     tested these....
>>
>>     chris cull
>>     cccre.ccull@capital.ge.com
>>
>>
>
>
>


From firewalls-owner  Mon Feb  3 21:10:37 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id UAA01400 for firewalls-outgoing; Mon, 3 Feb 1997 20:44:32 -0800 (PST)
Received: from pp (pp.ksc.nasa.gov [128.159.174.102]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id UAA01388 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 20:44:19 -0800 (PST)
Received: from kscgws00.ksc.nasa.gov by pp with SMTP (PP);
          Mon, 3 Feb 1997 23:44:21 -0500
Received: by kscgws00.ksc.nasa.gov 
          with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63) 
          id <01BC122C.4539FB20@kscgws00.ksc.nasa.gov>;
          Mon, 3 Feb 1997 23:45:00 -0500
Message-ID: <c=US%a=_%p=NASA%l=KSCMBS30-970204044449Z-6984@kscgws00.ksc.nasa.gov>
From: "Ferrell-1, Ema" <Eman.Ferrell-1@kmail.ksc.nasa.gov>
To: "'Lars Eilebrecht'" <sfx@unix-ag.uni-siegen.de>,
        "'osiris@pacificnet.net'" <osiris@pacificnet.net>
Cc: "'Firewalls'" <Firewalls@GreatCircle.COM>
Subject: RE: SATAN user group?
Date: Mon, 3 Feb 1997 23:44:49 -0500
X-Mailer: Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Where can I get Merlin?  Does it stand for something?  I would like to
check it out.  Thanks!

>----------
>From: 	osiris@pacificnet.net[SMTP:osiris@pacificnet.net]
>Sent: 	Monday, February 03, 1997 9:09 PM
>To: 	Lars Eilebrecht
>Cc: 	Firewalls
>Subject: 	Re: SATAN user group?
>
>Lars Eilebrecht wrote:
>> 
>> osiris wrote:
>> 
>> > Has anyone on this list tried "Merlin?" I am wondering whether anyone has
>> > attempted to make a siilar interface to manage firewall admnistration and
>> > auditing. (Merln is a tool from CIAC. It integrates Tripwire, COPS,
>>TIGER,
>> > Crack and reportedly, SPI, which is unavailable to us regular folk. The
>>                         ^^^
>> SPI?
>> 
>> ciao...
>>         Lars
>
>Yeah...strange little ditty. SPI = Security Profile Inspector. It's a
>very powerful tool for examination of UNIX networks. Problem is, it's
>only available to the US Department of Energy and Department of Defense.
>(Or, qualified contractors.) You can check out at least their preview at
>http://ciac.llnl.gov/cstc/spi/spinet.html. About the closest I've been
>able to get to understanding this tool is to aqcuire the manuals (which
>apparently aren't restricted) and are here:
>ftp://ciac.llnl.gov/pub/spi/spi.rm.ps.Z.
>

From firewalls-owner  Mon Feb  3 21:40:57 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id VAA05292 for firewalls-outgoing; Mon, 3 Feb 1997 21:19:09 -0800 (PST)
Received: from polaris.pacificnet.net (polaris.pacificnet.net [207.171.0.250]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id VAA05276 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 21:18:57 -0800 (PST)
Received: from localhost (osiris@localhost) by polaris.pacificnet.net (8.6.11/8.6.11) with SMTP id VAA24972; Mon, 3 Feb 1997 21:16:45 -0800
Date: Mon, 3 Feb 1997 21:16:43 -0800 (PST)
From: Osiris <osiris@polaris.pacificnet.net>
To: "Ferrell-1, Ema" <Eman.Ferrell-1@pp.ksc.nasa.gov>
cc: "'Lars Eilebrecht'" <sfx@unix-ag.uni-siegen.de>,
        "'Firewalls'" <Firewalls@GreatCircle.COM>
Subject: RE: SATAN user group?
In-Reply-To: <c=US%a=_%p=NASA%l=KSCMBS30-970204044449Z-6984@kscgws00.ksc.nasa.gov>
Message-ID: <Pine.GSO.3.95.970203211000.24108A-100000@polaris.pacificnet.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



On Mon, 3 Feb 1997, Ferrell-1, Ema wrote:

> Where can I get Merlin?  Does it stand for something?  I would like to
> check it out.  Thanks!

Get Merlin here: http://ciac.llnl.gov in the "Tools" section. 


From firewalls-owner  Mon Feb  3 22:25:49 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id WAA13508 for firewalls-outgoing; Mon, 3 Feb 1997 22:17:37 -0800 (PST)
Received: from mail-gw.pacbell.net (mail-gw.pacbell.net [206.13.28.25]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id WAA13501 for <firewalls@greatcircle.com>; Mon, 3 Feb 1997 22:17:29 -0800 (PST)
Received: from camdenave.xo.com.camdenave.xo.com ([205.158.161.107]) by mail-gw.pacbell.net (8.8.5/8.7.1) with ESMTP id WAA09724; Mon, 3 Feb 1997 22:16:05 -0800 (PST)
Message-Id: <199702040616.WAA09724@mail-gw.pacbell.net>
From: "Stan Wolf" <swolf@pacbell.net>
To: <asetton@lightech.com.ar>
Cc: "Firewall Newsgroup" <firewalls@greatcircle.com>, <jrjones@comsource.net>
Subject: MS Proxy Server
Date: Mon, 3 Feb 1997 22:16:04 -0800
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1155
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I think you will find what you are looking for at the following site:
	http://www.techweb.com/search/search.html
In the first search field, enter "proxy server", and follow the first link
you see presented to go to the article.  It's not all that negative, but
points out that more security may be required.  

I plan to use PSINet' managed and monitored "RouteWaller" packet filtering
firewall router in front of MS Proxy Server running by itself on NT Server
4.0.  Any thoughts on this arrangement, Jim?

Microsoft has some interesting testimonials on their Proxy Server area. 
One of the sources is a newspaper group right here in my town.  I spoke to
him, and he is very pleased; using PS ONLY! 
  _____    
   S|an  \/\/olf
swolf@pacbell.net

From firewalls-owner  Mon Feb  3 22:55:54 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id WAA16327 for firewalls-outgoing; Mon, 3 Feb 1997 22:42:33 -0800 (PST)
Received: from socrates.berkeley.edu (socrates.Berkeley.EDU [128.32.25.13]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id WAA16310 for <Firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 22:42:25 -0800 (PST)
Received: from garnet.berkeley.edu (garnet.Berkeley.EDU [128.32.136.6]) by socrates.berkeley.edu (8.8.4/8.8.0) with ESMTP id WAA04707; Mon, 3 Feb 1997 22:41:03 -0800 (PST)
Received: from pine by garnet.berkeley.edu (8.7.5/1.33-960227)
	id WAA22341; Mon, 3 Feb 1997 22:40:53 -0800
Message-Id: <2.2.32.19970204064107.006df0bc@garnet.berkeley.edu>
X-Sender: mendes@garnet.berkeley.edu
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Mon, 03 Feb 1997 22:41:07 -0800
To: Jeremy Johnson <Jeremy@fordnet.com>
From: Jerry Mendes <mendes@garnet.berkeley.edu>
Subject: Re: NT Firewall
Cc: Firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I just read an interesting review of about 8 NT Firewall products on the
Network World website:
        http://www.nwfusion.com/

You'll have to identify yourself and create an account....pretty much
painless.  After logging in, you'll land on a page that asks you for a 4
digit number identifying the article you want to see.  The one on the NT
Firewall products is:  0402

Maybe this is what you want.

Jerry Mendes, Principal Consultant
DataComm Insights
150 Seminary Drive
Mill Valley, California  94941

Voice:  (415) 381-5500
FAX:    (415) 381-5502
Email:  mendes@garnet.berkeley.edu



At 08:16 PM 2/3/97 -0800, Jeremy Johnson wrote:
>Just curious as to what all of you thought would be the best firewall to
>implement on a NT4.x server? we are a rapidly growing company and we need
>to establish our network security firmly before we take on many more  clients.
>any thoughts?
 


From firewalls-owner  Tue Feb  4 00:10:41 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id XAA22741 for firewalls-outgoing; Mon, 3 Feb 1997 23:54:03 -0800 (PST)
Received: from mule0.mindspring.com (mule0.mindspring.com [204.180.128.166]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id XAA22734 for <firewalls@GreatCircle.COM>; Mon, 3 Feb 1997 23:53:53 -0800 (PST)
Received: from [207.69.170.17] (user-37kbagh.dialup.mindspring.com [207.69.170.17])
          by mule0.mindspring.com (8.8.4/8.8.4) with SMTP
	  id CAA32360; Tue, 4 Feb 1997 02:51:55 -0500
Date: Tue, 4 Feb 1997 02:51:55 -0500
X-Sender: pelicans@pop.mindspring.com
Message-Id: <v01540b01af1c28d63a8a@[207.69.170.53]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: Matthew Patton <patton@sysnet.net>
From: pelicans@mindspring.com (BeachCruiser)
Subject: Poor NSA...Hells freezin' over again.
Cc: firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 6:12 PM 2/1/97, Matthew Patton wrote:
>>release of more test results as the X31 crew expands their commercial
>>firewall product evaluations.  Gauntlet and Sidewinder just happened to be
>>the first two on the bench.  Others are already in the queue.
>
>But has anybody read them?  I just finished the TIS one and I'm VERY
>nonplussed.  What's the value added of the X31's efforts?  There's no new
>insight, and it was hardly what I'd consider rigorous.  Indeed their
>testing basically boiled down to confirming that the firewall obeyed
>protocol conventions.  So what?  The trade rags do similar testing.

Well then why don't you give Jim Harper a call.  He's runs CSC's INFOSEC
lab facility in Hanover, MD.  Tell him you weren't happy with the limp
wristed job that was done under the X31 network security products eval
tasking, and you want the full up bed-of-nails protocol on your firewalls
of choice...gate crashing and penetration vulnerability, covert channel
analysis...the whole nine yards.  Be aware that they do most of the INFOSEC
T&E's for NSA, and that lab runs hot constantly, so, you'll probably have
to wait a couple of months for a slot.

BTW you might want to have your boss talk to some investment bankers about
a second round public offering because what that job is gonna cost you
exceeds most companies net worth.  Otherwise the TPEP catalog would be 80
pages long instead of eight.

>There are an incredible number of TIS sites out there and if the features
>didn't work as advertised we've have known a LONG time ago.

Well, sure lets just forget about this testing business altogether and let
a defacto standard emerge based on the vendor with the largest installed
base.  Ok, TIS wins, we'll proclaim Fred Avolio the Bill Gates of
Firewalls, those who survive can call him for a license, and the rest of
you can find another other line of work. :)

>I'll read the sidewinder one next and I'm prepared to be yet again
>disappointed >at the coverage.

It might also be helpful if some folks on this forum understood that the
National Security Agency exists to serve the national intelligence and
information systems security communities, at the pleasure of the Secretary
of Defense, Director of Central Intelligence and the National Security
Advisor.  It is NOT in the business of validating or benchmarking the
systems and products of commercial companies, or trying to please their
systems administrators or corporate shareholders.

"The Fort" hasn't taken this kind of beating since the '70's and '80's when
we had a flock of commercial companies trying to build TEMPEST* approved
equipment.  It's very interesting to watch this come around again.  There
was the same noise over testing, certifications and endorsements then as
there is now.  Only, firewalls are the bullwhips of the '90's coming across
NSA's hide.

The clamoring from the user community is that they all want the "most
secure" firewall.  Of course they don't know, can't figure out, or agree on
what "secure" even means now any more than they did back then.  And the
vendors don't know what benchmarks to build to.  So, just like they did
back in the TEMPEST days, some simply solve that problem by claiming that
their product's trust level holds some relevance to Orange Book, or some
other rating levels established by the security gods.  Whether they
actually did or not was just as much an open question then as it is now.

And of course then, as is the case today, the "suits" downtown started
feeling the political heat because the media was making hay about Russian's
pointing pigtail antennas at or bouncing lasers off of windows and
capturing the returns to intercept keystroke emissions or room
conversations.  Now the rage is about the hackers pillaging the national
information infrastructure...and it all finally gets to the point were
20755 says, "ok, bring 'em on in here, wire 'em up, lets see what these
things do and we'll publish the results.

Well now something else is wrong...it seems that somebody's whinin' because
the test is not rigorous enough, or the reports are no good, or, the soup's
cold...

I'm not hear to defend the NSA, but you could well imagine that some of
those folks over there might be muttering, "screw this...I'm moving to the
beach and be a plumber".

Along comes the NCSA to try and bring some rationale to the process, in
concert with nearly every developer in the business, by establishing a lab
and hacking up some benchmarks .  But, now some are saying that's not
credible either because they're takin' money for it.  Apparently somewhere
along the line those folks were never told that the development and
marketing of commercial security systems and products was a business.
While still others don't seem to have any problem at all when an industry
rag, owned by a publishing house for godsake, that doesn't know a covert
channel from the English Channel, puts out a review and within an hour the
Madison Avenue machine is in overdrive to tell you who won.

Well, this aformentioned stupidity has brought me to realize that perhaps
indeed Marcus was right...as long as you've got source code who needs X31,
NCSA or Firewalls Home Journal to tell you about your gui frosted filter
stack or app gateway of choice.  If you've got the souce, everything is
crystal clear...right?

To you folks up in X31...hang in there...only six more weeks of winter.
Ocean City and Dewey awaits you.

uh...more tea anyone?

___________________________
Bob McKisson
Cypress Systems Corporation
P. O. Box 809
Virginia Beach, VA 23451
(757) 425-4195  Voice
(757) 425-4196  FAX
(757) 442-0888  STU-III
pelicans@mindspring.com

I don't give them hell...I just give them the truth, and they think it's hell.

                                                - Harry Truman


ps:  Wonder if there is anyone else out there who knows or remembers what
TEMPEST actually stands for?  And yes it IS an acronym, and it DOES mean
something.









From firewalls-owner  Tue Feb  4 00:41:57 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id AAA24409 for firewalls-outgoing; Tue, 4 Feb 1997 00:34:20 -0800 (PST)
Received: from glacier.wise.edt.ericsson.se (glacier-ext.wise.edt.ericsson.se [193.180.251.38]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id AAA24380 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 00:34:01 -0800 (PST)
Received: from negrita.nmac.ericsson.se (negrita.nmac.ericsson.se [130.100.187.78]) by glacier.wise.edt.ericsson.se (8.7.5/8.7.3/glacier-0.9) with SMTP id JAA20132 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 09:32:49 +0100 (MET)
Received: by negrita.nmac.ericsson.se (SMI-8.6/SMI-SVR4)
	id JAA03683; Tue, 4 Feb 1997 09:32:16 +0100
Date: Tue, 4 Feb 1997 09:32:16 +0100
From: etxrosd@nmac.ericsson.se (Robert Stahlbrand)
Message-Id: <199702040832.JAA03683@negrita.nmac.ericsson.se>
To: firewalls@greatcircle.com
Subject: throughput on Ciscos contra NT, Solaris
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-MD5: dMKrDw75qYnSGO6ZPTMWgQ==
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi!

Is there anyone who knows about the difference in throughput on Cisco-routers 
contra using an NT-server (lets say HP, 166 MHz) running NT4.0 or an SUN Ultra1 
running Solaris 2.5(.X) as the router. We are planning on using 100 Mbit/s 
ethernet cards and it seems like a solution with a Cisco in the 7000-serie with 
three 100 Mbit/s overrides our budget for this year. Is there a great loss of 
performance?
Is it at all possible to install an inspection module on NT4.0-gw using 
Checkpoints Firewall-1 ver.2.1 if we use NT4.0 on the FW Manager host?

Is it more unsecure to use nt or Solars on the router?

This is what our configuration will look like:


                |      100 Mbit/s in every direction
                | Internet
            ____|____
Inspection |         | DMZ
Module     | Router  |____________
Installed  |_________|            |
                |            _____|_____
                |           |           |
                |           |    WWW    |
                |           |___________|
                |
           _____|_____________________ Intranet
                     |
                     |
                 ____|____
                |         |
                |   FW    | FW Manager host
                |_________|
                
                
                
###########################################################
#                 Robert Stahlbrand                       #
# Network and System Administrator OPLab and NMAC domains #
#                                                         #
#                 Ericsson Telecom AB                     #
#                      Box 333                            #
#                   43184 Molndal                         #
#                      Sweden                             #
#                  +46 31 7476162                         #
#                  +46 31 7472942 (fax)                   #
#                                                         #
#              robert@nmac.ericsson.se                    #
###########################################################

From firewalls-owner  Tue Feb  4 03:40:48 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id DAA06645 for firewalls-outgoing; Tue, 4 Feb 1997 03:26:25 -0800 (PST)
Received: from server21.digital.fr (server21.digital.fr [193.56.15.21]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id DAA06607 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 03:25:44 -0800 (PST)
Received: from mail.vbo.dec.com (mail.vbo.dec.com [16.36.208.34]) by server21.digital.fr (8.7.5/8.7) with ESMTP id MAA16828 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 12:28:51 +0100 (MET)
Received: from vbormc.vbo.dec.com (vbormc.vbo.dec.com [16.36.208.94]) by mail.vbo.dec.com (8.7.3/8.7) with ESMTP id MAA24570 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 12:26:14 +0100 (MET)
Received: from becomm.ebo.dec.com (becomm.ebo.dec.com [16.184.208.35]) by vbormc.vbo.dec.com (8.7.3/8.7) with SMTP id MAA03953 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 12:21:23 +0100
Received: from beux1.ebo.dec.com by becomm.ebo.dec.com; (5.65v3.2/1.1.8.2/07Mar96-0234PM)
	id AA06285; Tue, 4 Feb 1997 12:23:36 +0100
Received: by beux1.ebo.dec.com; (5.65v3.2/1.1.8.2/11Feb96-0242PM)
	id AA04693; Tue, 4 Feb 1997 12:23:27 +0100
Subject: Duplicated network addresses and VPN (AVT as requested)
To: Firewalls@GreatCircle.COM
X-Mailer: MAILworks 1.7-A
From: Arjo Mukherjee 4663 <mukherje@ebo.dec.com>
Date: Tue, 4 Feb 97 12:23:27 +0100
Message-Id: <970204122327.3603@beux1.ebo.dec.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


 Lilia Miltcheva <miltcheva@unicc.org> asked "

"I'm keen on using the AltaVista Tunnel and have already a lot of
requests for providing the service. I have a question :

We are currently using Alta Vista FW for Unix and behind it we have
class C addresses that we once got by EUnet. Than we changed the ISP and
renumbered our "red" (external) network, but on the internal ("blue")
WAN we kept the old IPs as there are anyhow not accessible from the
Internet.

What is going to happen if a remote client, using AVT connects to our
AVT server, gets the numbers of the private networks (for example
193.72.45.0) and starts tunneling, but at the same time there is a
server somewhere on the Internet that has address let's say 193.72.45.20
(same class C). How this clash could possibly be menaged?"
- -------------
Before I continue I would like to state that I am not an expert on the
Alta Vista Tunnel.  I have only installed it a couple of times and
write the following based on that.  Maybe it will help.
 
I don't believe that there is anything to worry about
as far as a clash is concerned.  This is because while you set up the
VPN (Virtual Privat Network) you need to define the IPs of the
applicable FW's.  In essence, the target address is encapsulated and
passed through the firewalls.  The destination firewall will pass the
data to the Tunnel Server where it will be handled as needed.

Therefore, as long as there is no clash with Firewall addresses, there
should not be a problem.  

Another point, it is also possible to load the AVT on the FW machine,
but I think most prefer to load it onto a seperate machine behind the
destination firewall.

Ciao,
Arjo

From firewalls-owner  Tue Feb  4 03:55:55 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id DAA07499 for firewalls-outgoing; Tue, 4 Feb 1997 03:38:40 -0800 (PST)
Received: from SWBELL.net (mail1.rcsntx.swbell.net [151.164.1.2]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id DAA07491 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 03:38:22 -0800 (PST)
Received: from bbenton.swbell.net (ppp-151-164-42-49.eulstx.swbell.net [151.164.42.49]) by SWBELL.net (8.7.5/8.7.1) with SMTP id FAA22561; Tue, 4 Feb 1997 05:37:13 -0600 (CST)
Date: Tue, 4 Feb 1997 05:37:13 -0600 (CST)
From: Bob Benton <bbenton@swbell.net>
Subject: RE: NT port numbers needed
To: Firewalls <Firewalls@GreatCircle.COM>,
        Arjo Mukherjee <mukherje@ebo.dec.com>
Message-ID: <855063337@home486nt>
X-Mailer: FPRetail Version 5.51.009
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

MS's 4.0 Resource kit has a good starting list.  
lpd uses udp, 721-731 on 3.51. 
lpd uses tcp on anything from 512-1023 on 4.0
Not sure about file sharing.  Get the kit.

Bob

> Hi,
> 
> Anyone know what are the relevant IP port numbers for NT?  
> 
> I read somewhere that NT uses ports 512/tcp and 721-731/tcp for 
> print services.
> 
> What are the IP ports for File Sharing and other applicable NT
> services?
> 
> Thanks,
> Arjo
> 
> 
> 



From firewalls-owner  Tue Feb  4 04:56:02 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id EAA12898 for firewalls-outgoing; Tue, 4 Feb 1997 04:48:04 -0800 (PST)
Received: from homeport.org (lighthouse.homeport.org [205.136.65.198]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id EAA12884 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 04:47:54 -0800 (PST)
Received: (adam@localhost) by homeport.org (8.8.5/8.6.9) id HAA15489; Tue, 4 Feb 1997 07:43:03 -0500 (EST)
From: Adam Shostack <adam@homeport.org>
Message-Id: <199702041243.HAA15489@homeport.org>
Subject: Re: NT Firewall
In-Reply-To: <2.2.32.19970204064107.006df0bc@garnet.berkeley.edu> from Jerry Mendes at "Feb 3, 97 10:41:07 pm"
To: mendes@garnet.berkeley.edu (Jerry Mendes)
Date: Tue, 4 Feb 1997 07:43:02 -0500 (EST)
Cc: Jeremy@fordnet.com, Firewalls@GreatCircle.COM
X-Mailer: ELM [version 2.4ME+ PL27 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

http://www.nwfusion.com/cgi-bin/gate2?|wwV7tddI://PPP.GP81XZ9G.59b/i958ZGi7e/wVwWe7O.tdbEwqwFGP81XZ9GVWV6xvhuUMph,5oIt7eI1GDX,xvhu4Mvvzg,5oIt7eI1GDX

Login as cypherpunks, password cypherpunks (this works most places
that request a sign in, for those of you who don't know.)

	Firewalls relevance?  That URL above gets you in as someone
else.  They're not using strong access controls, and are thus easily
bypassed.

Adam


Jerry Mendes wrote:
| You'll have to identify yourself and create an account....pretty much
| painless.  After logging in, you'll land on a page that asks you for a 4
| digit number identifying the article you want to see.  The one on the NT
| Firewall products is:  0402


-- 
Pet peeve of the day: Security companies whose protocols dare not
speak their name, because they don't have one. Guilty company of the
day is now V-One.




From firewalls-owner  Tue Feb  4 05:40:43 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id FAA15673 for firewalls-outgoing; Tue, 4 Feb 1997 05:25:56 -0800 (PST)
Received: from portal2.ameritech.com (portal2.ameritech.com [198.186.232.49]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id FAA15561 for <firewalls@greatCircle.COM>; Tue, 4 Feb 1997 05:25:23 -0800 (PST)
From: MARK.ELIAS@x400gw.ameritech.com
Received: by portal2.ameritech.com id AA08272
  (InterLock SMTP Gateway 3.0 for firewalls@greatCircle.COM);
  Tue, 4 Feb 1997 08:23:59 -0500
Received: by portal2.ameritech.com (Internal Mail Agent-2);
  Tue, 4 Feb 1997 08:23:59 -0500
Received: by portal2.ameritech.com (Internal Mail Agent-1);
  Tue, 4 Feb 1997 08:23:59 -0500
Date: 4 Feb 97 08:22:13 -0500
To: firewalls@greatCircle.COM,
        /DDV=Jesse.Brown#064#POBox.com/DDT=RFC-822/S=Jesse.Brown/P=AMRTCH4/A=MCI/C=US/@x400gw.ameritech.com
Subject: RE: Rainbow Book Series?
In-Reply-To: <199702032222.OAA00279@mail.ptw.com>
Message-Id: <H000035c05c57cf2*/PN=Mark.Elias/OU=AIT5/PRMD=AMRTCH4/ADMD=MCI/C=US/@MHS>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Hello, does anyone know where I can get the entire Rainbow Book 
> Series?
> 

Try  http://csrc.ncsl.nist.gov/secpubs/rainbow

(csrc = Computer Security Resource Clearinghouse /
 nist = National Institute of Standards and Technology)

There are order forms there as well as the actual documents. 


From firewalls-owner  Tue Feb  4 06:10:56 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id GAA17773 for firewalls-outgoing; Tue, 4 Feb 1997 06:06:03 -0800 (PST)
Received: from WKST194.SLD.GORDON.ARMY.MIL (wkst194.sld.gordon.army.mil [147.51.218.194]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id GAA17766 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 06:05:55 -0800 (PST)
Date: Tue,  4 Feb 97 09:08:00 EST
Message-Id: <9702040908.AA13332@WKST194.SLD.GORDON.ARMY.MIL>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
From: "Inez M. Crawford" <crawfori@SLD1.GORDON.ARMY.MIL>
Reply-To: <crawfori@SLD1.GORDON.ARMY.MIL>
X-Sender: <crawfori@WKST194.SLD.GORDON.ARMY.MIL>
To: Jesse.Brown@POBox.com
CC: firewalls@greatcircle.com
Subject: Re: Rainbow Book Series?
X-Mailer: <WS_GMAIL v2.50>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Try this site - 

http://www.fas.org/irp/nsa/rainbow.htm

It seems to have a very good collection of downloadable "books"

IM Crawford


From firewalls-owner  Tue Feb  4 06:26:35 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id GAA18728 for firewalls-outgoing; Tue, 4 Feb 1997 06:22:51 -0800 (PST)
Received: from server21.digital.fr (server21.digital.fr [193.56.15.21]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id GAA18710 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 06:22:35 -0800 (PST)
Received: from mail.vbo.dec.com (mail.vbo.dec.com [16.36.208.34]) by server21.digital.fr (8.7.5/8.7) with ESMTP id PAA04962 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 15:25:18 +0100 (MET)
Received: from vbormc.vbo.dec.com (vbormc.vbo.dec.com [16.36.208.94]) by mail.vbo.dec.com (8.7.3/8.7) with ESMTP id PAA22407 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 15:22:48 +0100 (MET)
Received: from becomm.ebo.dec.com (becomm.ebo.dec.com [16.184.208.35]) by vbormc.vbo.dec.com (8.7.3/8.7) with SMTP id PAA13161 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 15:17:51 +0100
Received: from beux1.ebo.dec.com by becomm.ebo.dec.com; (5.65v3.2/1.1.8.2/07Mar96-0234PM)
	id AA06205; Tue, 4 Feb 1997 15:20:14 +0100
Received: by beux1.ebo.dec.com; (5.65v3.2/1.1.8.2/11Feb96-0242PM)
	id AA13994; Tue, 4 Feb 1997 15:20:11 +0100
Subject:  RE: AVT configurations
To: Firewalls@GreatCircle.COM
X-Mailer: MAILworks 1.7-A
From: Arjo Mukherjee 4663 <mukherje@ebo.dec.com>
Date: Tue, 4 Feb 97 15:20:10 +0100
Message-Id: <970204152010.3603@beux1.ebo.dec.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



----- Forwarded message follows -----
Delivery-Date: Tue, 4 Feb 97 14:58:27 +0100
To: Lilia Miltcheva <Miltcheva@unicc.org>
Subject: RE: AVT configurations
In-Reply-To: <c=CH%a=400net%p=unicc%l=NEW-EXCHANGE-970204131239Z-3793@new-exchange.unicc.org>
References: <c=CH%a=400net%p=unicc%l=NEW-EXCHANGE-970204131239Z-3793@new-exchange.unicc.org>
X-Mailer: MAILworks 1.7-A
From: Arjo Mukherjee 4663 <mukherje>
Date: Tue, 4 Feb 97 15:15:40 +0100
Message-ID: <970204151540.3603@beux1.ebo.dec.com>

I have the feeling that every session that wants to use the AVT, has to
be defined on the local clients.  In other words, if you want to telnet
using the VPN, then you have to set up a defined session with the link
pointer to the local Tunnel.  Otherwise, the routing will default wise
direct the path to the firewall and out int the internet.

I guess the question you have is how to set up the applicatiions on the
local client to let it know when to use the Tuneel and when not to use
it.

>From the sparse docs that I could read, it appears as if on the local
clients, ie. PC,s etc, one copies a couple of files, which the tunnel
admin provides.  These have the definitions for the tunnel path.

It appears that if the user wants to use the tunnel, he needs to click
on the application to activate the link to the tunnel components, and
then he can use the VPN.

Otherwise, it defaults to the firewall and out into the internet.

Seems like the user has to activate the tunnel link if he wants to use
it.

Arjo   

                   >  > Hi, Arjo!
> 
> Thanks to have answered my mail.
> 
> I do not worry about the routing. The question is if we have a duplicate
> IP on the private network and on the Internet, which way the connection
> is going to be decided - to go through the tunnel or through the regular
> (ISP) way?
> During the initial handshake the AVT server gives the IP numbers of the
> private networks to the tunnel client. Logically than, any IP belonging
> to one of those networks will be routed through the tunnel. This means
> that if there is another host on the Internet with the same IP, it will
> never be reached as far as the tunnel is up... 
> 
> Thanks, Lili
> 
> 
> >----------
> >From: 	Arjo Mukherjee 4663[SMTP:mukherje@ebo.dec.com]
> >Sent: 	Tuesday, February 04, 1997 3:26AM
> >To: 	miltcheva@unicc.org
> >Subject: 	AVT configurations
> >
> >Howdy,
> >
> >don't think there are address conflicts as the routing takes place
> >through firewalls.  in other words, the destination address is handled
> >only after it reaches the target VPN Server (Tunnel Server).
> >
> >The firewall is set up to handle the tunnel addresses via relay.
> >
> >Arjo
> >
> >
----- End of forwarded message -----

From firewalls-owner  Tue Feb  4 07:16:01 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id GAA23786 for firewalls-outgoing; Tue, 4 Feb 1997 06:56:29 -0800 (PST)
Received: from wachusett.altavista-software.com ([205.181.164.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id GAA23767 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 06:56:08 -0800 (PST)
Received: by wachusett.altavista-software.com; (5.65v3.2/1.3/10May95) id AA00880; Tue, 4 Feb 1997 09:54:58 -0500
Date: Tue, 4 Feb 1997 09:54:41 -0500 (EST)
From: Jeff Needle <needle@altavista.digital.com>
X-Sender: needle@plugh.hq.altav.com
Reply-To: jeff.needle@altavista-software.com
To: Lilia Miltcheva <miltcheva@unicc.org>
Cc: altavista-product@digital.com, admin@unicc.org, firewalls@GreatCircle.COM
Subject: Re: Duplicated network addresses
In-Reply-To: <32F60309.41C6@unicc.org>
Message-Id: <Pine.OSF.3.95.970204095058.22446C-100000@plugh.hq.altav.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

When you use the AltaVista Tunnel, any network packets that travel the
internet will have a source address of your physical adapter and a target
address of your firewall's external interface (tunnel server in the case
where you have no firewall).  The tunnel server, upon receipt of a tunnel
packet, will strip the tunnel header and decrypt the packet, restoring the
original destination address.  Therefore the only place your private
network addresses will be seen are within your private network, between
your tunnel server and the final internal destination.

Hope this helps.  If you have any further questions about AltaVista
Tunnel, don't hesitate to contact me.

Jeff Needle, AltaVista engineering



On Mon, 3 Feb 1997, Lilia Miltcheva wrote:

> Date: Mon, 03 Feb 1997 16:23:53 +0100
> From: Lilia Miltcheva <miltcheva@unicc.org>
> To: altavista-product@digital.com
> Cc: admin@unicc.org, firewalls@GreatCircle.COM
> Subject: Duplicated network addresses
> 
> Dear Guru,
> 
> I'm keen on using the AltaVista Tunnel and have already a lot of
> requests for providing the service. I have a question :
> 
> We are currently using Alta Vista FW for Unix and behind it we have
> class C addresses that we once got by EUnet. Than we changed the ISP and
> renumbered our "red" (external) network, but on the internal ("blue")
> WAN we kept the old IPs as there are anyhow not accessible from the
> Internet.
> 
> What is going to happen if a remote client, using AVT connects to our
> AVT server, gets the numbers of the private networks (for example
> 193.72.45.0) and starts tunneling, but at the same time there is a
> server somewhere on the Internet that has address let's say 193.72.45.20
> (same class C). How this clash could possibly be menaged?
> 
> 
> I'm aware that many people use inside their FW "any" IP addresses (just
> unique on the LAN), so that will be a problem with all those guys if
> some coincedence occurs.
> 
> Is there something I'm missing?
> 
> Thanks a lot in advance.. I'll greately appriciate any help....
> 
> Lili
> 



From firewalls-owner  Tue Feb  4 07:49:12 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id HAA27998 for firewalls-outgoing; Tue, 4 Feb 1997 07:36:44 -0800 (PST)
Received: from wachusett.altavista-software.com ([205.181.164.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id HAA27976 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 07:36:33 -0800 (PST)
Received: by wachusett.altavista-software.com; (5.65v3.2/1.3/10May95) id AA04094; Tue, 4 Feb 1997 10:35:22 -0500
Date: Tue, 4 Feb 1997 10:34:59 -0500 (EST)
From: Jeff Needle <needle@altavista.digital.com>
X-Sender: needle@plugh.hq.altav.com
To: Lilia Miltcheva <Miltcheva@unicc.org>
Cc: "'admin@unicc.org'" <admin@unicc.org>,
        "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: RE: Duplicated network addresses
In-Reply-To: <c=CH%a=400net%p=unicc%l=NEW-EXCHANGE-970204153200Z-3805@new-exchange.unicc.org>
Message-Id: <Pine.OSF.3.95.970204103100.22446O-100000@plugh.hq.altav.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

It won't matter if you assign an address that is equivalent to an external
address.  The only place those tunnel "pseudo addresses" will be seen is
on the private network, beyond the tunnel server.  They never travel on
the internet.  Any tunnel packets traveling on the internet will be
encrypted and encapsulated in an IP packet with a source address of the
client's real address and a destination address of your firewall, both of
which would be legal address.

The typical tunnel configuration seems to use RFC 1918 addresses for the
tunnel clients.

Jeff

On Tue, 4 Feb 1997, Lilia Miltcheva wrote:

> Date: Tue, 4 Feb 1997 16:32:00 +0100
> From: Lilia Miltcheva <Miltcheva@unicc.org>
> To: "'jeff.needle@altavista-software.com'"
     <jeff.needle@altavista-software.com>
> Cc: "'altavista-product@digital.com'" <altavista-product@digital.com>,
>     "'admin@unicc.org'" <admin@unicc.org>,
>     "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
> Subject: RE: Duplicated network addresses
> 
> Jeff,
> 
> What you say is correct and I do not have any problem with that. My
> question is rather what will happen if I address host.unicc.org that has
> the same IP as www.microsoft.com, for example? 
> As the tunnel comes up, the tunnel server tells the client which
> networks a to be tunneled, so logically in this case for
> www.microsoft.com = host.unicc.org I will go through the tunnel and
> therefore I will never be able to reach www.microsoft.com while the
> tunnel is up....
> 
> Thanks a lot for your support,
> Lili


From firewalls-owner  Tue Feb  4 08:27:00 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id HAA29210 for firewalls-outgoing; Tue, 4 Feb 1997 07:50:02 -0800 (PST)
Received: from tuna.wang.com (TUNA.wang.com [150.124.136.4]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id HAA29161 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 07:49:37 -0800 (PST)
Received: from mars.wangfed.com (mars.Wangfed.COM [159.94.10.1])
    by tuna.wang.com (8.6.12/8.6.12tf1) with SMTP id KAA22492;
    Tue, 4 Feb 1997 10:48:25 -0500
Received: from uc0009.wangfed.com (uc0009 [159.94.10.15])
	by mars.wangfed.com (8.8.4/3.8) with SMTP
	id KAA14495; Tue, 4 Feb 1997 10:54:31 -0500 (EST)
Received: from [159.94.14.48] by uc0009.wangfed.com (BULL 5.61++/B.O.S 02.01)
	id AA26148; Tue, 4 Feb 97 10:39:17 -0500
Date: Tue, 4 Feb 97 10:39:17 -0500
Message-Id: <9702041539.AA26148@uc0009.wangfed.com>
From: "K.M."  <goertzek@wangfed.com>
Reply-To: "K.M."  <goertzek@wangfed.com>
To: pelicans@mindspring.com, firewalls@GreatCircle.COM
Subject: Re: Poor NSA...Hells freezin' over again.
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

TEMPEST = Transient ElectroMagnetic Pulse Emanation STandard
          ^         ^      ^        ^     ^         ^^    



KM     

=====

K.M. Goertzel
Manager, Business Development
Secure Systems & Services Operation
WANG FEDERAL, Inc.
7900 Westpark Drive - MS 700
McLean, VA  22102-4299  USA
tel (703)827 3914
fax (703)827 3161 
email goertzek@wangfed.com


From firewalls-owner  Tue Feb  4 08:42:35 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id HAA27431 for firewalls-outgoing; Tue, 4 Feb 1997 07:29:26 -0800 (PST)
Received: from gk-blue.unicc.org (gk-red.unicc.org [192.91.247.2]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id HAA27413 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 07:29:07 -0800 (PST)
Received: by gk-blue.unicc.org; (5.65v3.2/1.3/10May95) id AA06978; Tue, 4 Feb 1997 16:30:26 +0100
Received: by gh-old.unicc.org (5.65/jsb-190694);
	id AA00396; Tue, 4 Feb 1997 16:30:27 +0100
Received: by new-exchange.unicc.org with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5)
	id <01BC12B8.F37AE050@new-exchange.unicc.org>; Tue, 4 Feb 1997 16:32:02 +0100
Message-Id: <c=CH%a=400net%p=unicc%l=NEW-EXCHANGE-970204153200Z-3805@new-exchange.unicc.org>
From: Lilia Miltcheva <Miltcheva@unicc.org>
To: "'jeff.needle@altavista-software.com'" <jeff.needle@altavista-software.com>
Cc: "'altavista-product@digital.com'" <altavista-product@digital.com>,
        "'admin@unicc.org'" <admin@unicc.org>,
        "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: RE: Duplicated network addresses
Date: Tue, 4 Feb 1997 16:32:00 +0100
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Jeff,

What you say is correct and I do not have any problem with that. My
question is rather what will happen if I address host.unicc.org that has
the same IP as www.microsoft.com, for example? 
As the tunnel comes up, the tunnel server tells the client which
networks a to be tunneled, so logically in this case for
www.microsoft.com = host.unicc.org I will go through the tunnel and
therefore I will never be able to reach www.microsoft.com while the
tunnel is up....

Thanks a lot for your support,
Lili




>----------
>From: 	Jeff Needle[SMTP:needle@altavista.digital.com]
>Sent: 	Tuesday, February 04, 1997 12:54AM
>To: 	Lilia Miltcheva
>Cc: 	altavista-product@digital.com; admin@unicc.org;
>firewalls@greatcircle.com
>Subject: 	Re: Duplicated network addresses
>
>When you use the AltaVista Tunnel, any network packets that travel the
>internet will have a source address of your physical adapter and a target
>address of your firewall's external interface (tunnel server in the case
>where you have no firewall).  The tunnel server, upon receipt of a tunnel
>packet, will strip the tunnel header and decrypt the packet, restoring the
>original destination address.  Therefore the only place your private
>network addresses will be seen are within your private network, between
>your tunnel server and the final internal destination.
>
>Hope this helps.  If you have any further questions about AltaVista
>Tunnel, don't hesitate to contact me.
>
>Jeff Needle, AltaVista engineering
>
>
>
>On Mon, 3 Feb 1997, Lilia Miltcheva wrote:
>
>> Date: Mon, 03 Feb 1997 16:23:53 +0100
>> From: Lilia Miltcheva <miltcheva@unicc.org>
>> To: altavista-product@digital.com
>> Cc: admin@unicc.org, firewalls@GreatCircle.COM
>> Subject: Duplicated network addresses
>> 
>> Dear Guru,
>> 
>> I'm keen on using the AltaVista Tunnel and have already a lot of
>> requests for providing the service. I have a question :
>> 
>> We are currently using Alta Vista FW for Unix and behind it we have
>> class C addresses that we once got by EUnet. Than we changed the ISP and
>> renumbered our "red" (external) network, but on the internal ("blue")
>> WAN we kept the old IPs as there are anyhow not accessible from the
>> Internet.
>> 
>> What is going to happen if a remote client, using AVT connects to our
>> AVT server, gets the numbers of the private networks (for example
>> 193.72.45.0) and starts tunneling, but at the same time there is a
>> server somewhere on the Internet that has address let's say 193.72.45.20
>> (same class C). How this clash could possibly be menaged?
>> 
>> 
>> I'm aware that many people use inside their FW "any" IP addresses (just
>> unique on the LAN), so that will be a problem with all those guys if
>> some coincedence occurs.
>> 
>> Is there something I'm missing?
>> 
>> Thanks a lot in advance.. I'll greately appriciate any help....
>> 
>> Lili
>> 
>
>
>
>

From firewalls-owner  Tue Feb  4 08:49:28 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id HAA29012 for firewalls-outgoing; Tue, 4 Feb 1997 07:48:36 -0800 (PST)
Received: from gk-blue.unicc.org (gk-red.unicc.org [192.91.247.2]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id HAA28988 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 07:48:25 -0800 (PST)
Received: by gk-blue.unicc.org; (5.65v3.2/1.3/10May95) id AA28606; Tue, 4 Feb 1997 16:49:36 +0100
Received: by gh-old.unicc.org (5.65/jsb-190694);
	id AA02025; Tue, 4 Feb 1997 16:49:38 +0100
Received: by new-exchange.unicc.org with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5)
	id <01BC12BB.A2C958A0@new-exchange.unicc.org>; Tue, 4 Feb 1997 16:51:15 +0100
Message-Id: <c=CH%a=400net%p=unicc%l=NEW-EXCHANGE-970204155113Z-3811@new-exchange.unicc.org>
From: Lilia Miltcheva <Miltcheva@unicc.org>
To: "'Lilia Miltcheva'" <miltcheva@unicc.org>,
        "'Jeff Needle'"
	 <needle@altavista.digital.com>
Cc: "'admin@unicc.org'" <admin@unicc.org>,
        "'firewalls@greatcircle.com'"
	 <firewalls@greatcircle.com>
Subject: RE: Duplicated network addresses
Date: Tue, 4 Feb 1997 16:51:13 +0100
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Jeff,

Probably I cannot explain very well. What you say for me means that
while I have the tunnel client up I will never see the host on the
Internet (www.microsoft.com in my example)?! I will always go through
the tunnel, because the tunnel client will think that this is a private
address....

Thanks, Lili

>----------
>From: 	Jeff Needle[SMTP:needle@altavista.digital.com]
>Sent: 	Tuesday, February 04, 1997 1:34AM
>To: 	Lilia Miltcheva
>Cc: 	'admin@unicc.org'; 'firewalls@greatcircle.com'
>Subject: 	RE: Duplicated network addresses
>
>It won't matter if you assign an address that is equivalent to an external
>address.  The only place those tunnel "pseudo addresses" will be seen is
>on the private network, beyond the tunnel server.  They never travel on
>the internet.  Any tunnel packets traveling on the internet will be
>encrypted and encapsulated in an IP packet with a source address of the
>client's real address and a destination address of your firewall, both of
>which would be legal address.
>
>The typical tunnel configuration seems to use RFC 1918 addresses for the
>tunnel clients.
>
>Jeff
>
>On Tue, 4 Feb 1997, Lilia Miltcheva wrote:
>
>> Date: Tue, 4 Feb 1997 16:32:00 +0100
>> From: Lilia Miltcheva <Miltcheva@unicc.org>
>> To: "'jeff.needle@altavista-software.com'"
>     <jeff.needle@altavista-software.com>
>> Cc: "'altavista-product@digital.com'" <altavista-product@digital.com>,
>>     "'admin@unicc.org'" <admin@unicc.org>,
>>     "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
>> Subject: RE: Duplicated network addresses
>> 
>> Jeff,
>> 
>> What you say is correct and I do not have any problem with that. My
>> question is rather what will happen if I address host.unicc.org that has
>> the same IP as www.microsoft.com, for example? 
>> As the tunnel comes up, the tunnel server tells the client which
>> networks a to be tunneled, so logically in this case for
>> www.microsoft.com = host.unicc.org I will go through the tunnel and
>> therefore I will never be able to reach www.microsoft.com while the
>> tunnel is up....
>> 
>> Thanks a lot for your support,
>> Lili
>
>
>

From firewalls-owner  Tue Feb  4 08:55:50 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id IAA04894 for firewalls-outgoing; Tue, 4 Feb 1997 08:37:12 -0800 (PST)
Received: from strat.enernet.com (strat.enernet.com [206.116.106.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id IAA04871 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 08:37:01 -0800 (PST)
Received: from strat (strat.enernet.com [206.116.106.11]) by strat.enernet.com (8.7.5/8.7.3) with SMTP id JAA51050 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 09:38:24 -0700
Message-ID: <32F76600.446B@enernet.com>
Date: Tue, 04 Feb 1997 09:38:24 -0700
From: Chad David <davidc@enernet.com>
Organization: Enernet Technologies Inc.
X-Mailer: Mozilla 3.0 (X11; I; AIX 1)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: Re: NAT on Cisco PIX vs. ??
References: <199702031809.SAA02110@mail.global-sol.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Timothy P. Layton, Sr. wrote:
> 
> I am familiar with NAT on the PIX and was wondering what
> operating systems that any one has had experience with in dealing
> with NAT. Does any one feel that there is a trade off with the
> PIX being a hardware solution vs. a software based solution ?
> 
> Thanks for any input.

I have never used the PIX, but have been told by venders that
NAT is slow, and that there have been problems due to memory 
and cpu constrains... compared to a unix (maybe NT) based 
firewall that is.

Can anyone comment on this?

-- 
Chad David
Network Admin
Enernet Technologies Inc.
davidc@enernet.com

From firewalls-owner  Tue Feb  4 09:11:10 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id IAA06882 for firewalls-outgoing; Tue, 4 Feb 1997 08:55:04 -0800 (PST)
Received: from gw.garrison.com (gw.garrison.com [205.241.58.147]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id IAA06871 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 08:54:55 -0800 (PST)
Received: from gw.garrison.com (root@localhost) by gw.garrison.com (8.7.5/8.7.3) with ESMTP id TAA19236 for <firewalls@GreatCircle.COM>; Fri, 18 Dec 1987 19:33:36 -0600 (CST)
Received: from garrison.com. ([10.0.0.2]) by gw.garrison.com (8.7.5/8.7.3) with SMTP id TAA19230 for <firewalls@GreatCircle.COM>; Fri, 18 Dec 1987 19:33:36 -0600 (CST)
Received: by garrison.com. (4.1/Surrogate Sendmail hack)
	id AA16482; Tue, 4 Feb 97 10:48:30 CST
Date: Tue, 4 Feb 97 10:48:30 CST
From: jeromie@garrison.com (Jeromie Jackson)
Message-Id: <9702041648.AA16482@garrison.com.>
To: goertzek@wangfed.com, willis@sctc.com
Subject: Re: Sidewinder vs. Cyberguard
Cc: firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> On Mon, 3 Feb 1997, K.M. wrote:
> 
> > However, I have heard that Sidewinder is very difficult to configure, unless 
> > they have managed to greatly improve their interface in new release.  

	Matt Willis wrote:
> 
> Sidewinder now offers a *real* GUI and a command line interface, for those
> of us that like it old-school.  Not that I count as unbiased, but it's a
> night-and-day comparison to the old version...
> 
> We've also done away with the notion of internal and external to allow for
> multiple network interfaces...
> 
> The mail-filter is pretty hip, as well... drag-and-drop and such.
> 

	I would definitely have to agree.  The interface for 3.01 of 
Sidewinder is quite nice (although I still prefer the cf lines for most
admin. tasks).  It is quite easy to open up ports and such, quite a lot
easier than many other firewalls I've seen.

	I would agree, the Mail filtering capabilities are quite cool.. The
drag-and-drop approach, and the configuration of the filtering/auditing is
quite spiff.

Jeromie Jackson
Garrison Technologies
jeromie@garrison.com 

From firewalls-owner  Tue Feb  4 09:22:06 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id IAA03311 for firewalls-outgoing; Tue, 4 Feb 1997 08:22:33 -0800 (PST)
Received: from wachusett.altavista-software.com ([205.181.164.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id IAA03301 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 08:22:19 -0800 (PST)
Received: by wachusett.altavista-software.com; (5.65v3.2/1.3/10May95) id AA18495; Tue, 4 Feb 1997 11:21:02 -0500
Date: Tue, 4 Feb 1997 11:20:43 -0500 (EST)
From: Jeff Needle <needle@altavista.digital.com>
X-Sender: needle@plugh.hq.altav.com
To: Lilia Miltcheva <Miltcheva@unicc.org>
Cc: "'admin@unicc.org'" <admin@unicc.org>,
        "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: RE: Duplicated network addresses
In-Reply-To: <c=CH%a=400net%p=unicc%l=NEW-EXCHANGE-970204155113Z-3811@new-exchange.unicc.org>
Message-Id: <Pine.OSF.3.95.970204111424.22446R-100000@plugh.hq.altav.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Well, now you've lost me a bit.  But what I'm saying is that with the
tunnel up, you'll have a route to the private network.  Any traffic
destined for that private network will be encrypted, sent over the
internet with a destination address of the remote firewall and a source
address of your physical network (typically, your ISP-assigned address).
The only place that your private address will be seen is on the private
network, after your tunnel server has decrypted the packet.

If what you're saying is that you've picked addresses in your private
network that overlap real outside addresses instead of using RFC 1918
addresses, then you'll certainly have some confusion!  If one time you
want traffic going to 207.68.156.61 to go to www.microsoft.com, and the
next time, you want traffic going to 207.68.156.61 to go to a machine
which you've got in your private network called host.unicc.org, then
indeed you'll have to craft some routes that will cause this host to be
reachable through the tunnel and you'll have to disconnect the tunnel
before you can access that real address on the internet.

Jeff

On Tue, 4 Feb 1997, Lilia Miltcheva wrote:

> Date: Tue, 4 Feb 1997 16:51:13 +0100
> From: Lilia Miltcheva <Miltcheva@unicc.org>
> To: 'Lilia Miltcheva' <miltcheva@unicc.org>,
>     'Jeff Needle' <needle@altavista.digital.com>
> Cc: "'admin@unicc.org'" <admin@unicc.org>,
>     "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
> Subject: RE: Duplicated network addresses
> 
> Jeff,
> 
> Probably I cannot explain very well. What you say for me means that
> while I have the tunnel client up I will never see the host on the
> Internet (www.microsoft.com in my example)?! I will always go through
> the tunnel, because the tunnel client will think that this is a private
> address....
> 
> Thanks, Lili


From firewalls-owner  Tue Feb  4 09:37:55 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id HAA27312 for firewalls-outgoing; Tue, 4 Feb 1997 07:27:48 -0800 (PST)
Received: from wachusett.altavista-software.com ([205.181.164.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id HAA27280 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 07:27:26 -0800 (PST)
Received: by wachusett.altavista-software.com; (5.65v3.2/1.3/10May95) id AA24058; Tue, 4 Feb 1997 10:26:15 -0500
Date: Tue, 4 Feb 1997 10:26:02 -0500 (EST)
From: Jeff Needle <needle@altavista.digital.com>
X-Sender: needle@plugh.hq.altav.com
To: Arjo Mukherjee 4663 <mukherje@ebo.dec.com>
Cc: Firewalls@GreatCircle.COM
Subject: RE: AVT configurations
In-Reply-To: <970204152010.3603@beux1.ebo.dec.com>
Message-Id: <Pine.OSF.3.95.970204102143.22446K-100000@plugh.hq.altav.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

When the tunnel connection is established, the first thing that's done is
that an address is downloaded and bound to the tunnel pseudo adapter.  The
next thing that happens is a routing packet is downloaded, and those
routes are associated with the tunnel pseudo adapter.  After that,
anything destined for the private network (as defined by the routes
downloaded to the client by the server) will "magically" be encrypted and
routed to the tunnel server. 

Jeff Needle, AltaVista engineering

On Tue, 4 Feb 1997, Arjo Mukherjee 4663 wrote:

> Date: Tue, 4 Feb 97 15:20:10 +0100
> From: Arjo Mukherjee 4663 <mukherje@ebo.dec.com>
> To: Firewalls@GreatCircle.COM
> Subject: RE: AVT configurations
> 
> 
> 
> ----- Forwarded message follows -----
> Delivery-Date: Tue, 4 Feb 97 14:58:27 +0100
> To: Lilia Miltcheva <Miltcheva@unicc.org>
> Subject: RE: AVT configurations
> In-Reply-To: <c=CH%a=400net%p=unicc%l=NEW-EXCHANGE-970204131239Z-3793@new-exchange.unicc.org>
> References: <c=CH%a=400net%p=unicc%l=NEW-EXCHANGE-970204131239Z-3793@new-exchange.unicc.org>
> X-Mailer: MAILworks 1.7-A
> From: Arjo Mukherjee 4663 <mukherje>
> Date: Tue, 4 Feb 97 15:15:40 +0100
> Message-ID: <970204151540.3603@beux1.ebo.dec.com>
> 
> I have the feeling that every session that wants to use the AVT, has to
> be defined on the local clients.  In other words, if you want to telnet
> using the VPN, then you have to set up a defined session with the link
> pointer to the local Tunnel.  Otherwise, the routing will default wise
> direct the path to the firewall and out int the internet.
> 
> I guess the question you have is how to set up the applicatiions on the
> local client to let it know when to use the Tuneel and when not to use
> it.
> 
> >From the sparse docs that I could read, it appears as if on the local
> clients, ie. PC,s etc, one copies a couple of files, which the tunnel
> admin provides.  These have the definitions for the tunnel path.
> 
> It appears that if the user wants to use the tunnel, he needs to click
> on the application to activate the link to the tunnel components, and
> then he can use the VPN.
> 
> Otherwise, it defaults to the firewall and out into the internet.
> 
> Seems like the user has to activate the tunnel link if he wants to use
> it.
> 
> Arjo   
> 
>                    >  > Hi, Arjo!
> > 
> > Thanks to have answered my mail.
> > 
> > I do not worry about the routing. The question is if we have a duplicate
> > IP on the private network and on the Internet, which way the connection
> > is going to be decided - to go through the tunnel or through the regular
> > (ISP) way?
> > During the initial handshake the AVT server gives the IP numbers of the
> > private networks to the tunnel client. Logically than, any IP belonging
> > to one of those networks will be routed through the tunnel. This means
> > that if there is another host on the Internet with the same IP, it will
> > never be reached as far as the tunnel is up... 
> > 
> > Thanks, Lili
> > 
> > 
> > >----------
> > >From: 	Arjo Mukherjee 4663[SMTP:mukherje@ebo.dec.com]
> > >Sent: 	Tuesday, February 04, 1997 3:26AM
> > >To: 	miltcheva@unicc.org
> > >Subject: 	AVT configurations
> > >
> > >Howdy,
> > >
> > >don't think there are address conflicts as the routing takes place
> > >through firewalls.  in other words, the destination address is handled
> > >only after it reaches the target VPN Server (Tunnel Server).
> > >
> > >The firewall is set up to handle the tunnel addresses via relay.
> > >
> > >Arjo
> > >
> > >
> ----- End of forwarded message -----
> 



From firewalls-owner  Tue Feb  4 10:04:48 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id JAA14130 for firewalls-outgoing; Tue, 4 Feb 1997 09:50:10 -0800 (PST)
Received: from main.geminisecure.com (main.geminisecure.com [205.179.16.1]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id JAA14098 for <Firewalls@GreatCircle.com>; Tue, 4 Feb 1997 09:49:59 -0800 (PST)
Received: (from leonard@localhost) by main.geminisecure.com (8.6.9/8.6.9) id JAA19690; Tue, 4 Feb 1997 09:46:37 -0800
Date: Tue, 4 Feb 1997 09:46:37 -0800 (PST)
From: Leonard Miyata <leonard@geminisecure.com>
To: Firewalls@GreatCircle.com
Subject: Red Book vs Orange Book 
In-Reply-To: <199702032325.PAA13699@itech.terisa.com>
Message-ID: <Pine.BSD/.3.91.970204093211.19649A-100000@main.geminisecure.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


There seems to be a general misunderstanding on the C2 rating of
Windows NT Server. Windows NT has a 'Orange Book' C2 rating. Their
resource book for NT 4.0 Server states that NT was designed for
'Red Book' C2, but since they are not claiming this yet, they must
not have acheived this.

Orange Book rates the security of a isolated computer host. It does
not rate the components of a host (e.g. A B2 rated floppy drive or
SCSI controller) but if the components with the O.S. are assembled
in such a fashion, the overall rating of a host is at this level as 
far as MAC, DAC, I&A, Audit, etc are concerned.

Red Book (TNI) is an official supplement to the Orange Book, extending
the Orange Book definitions to a networked environment. Red Book rates
the overall rating of the NETWORK. Individual components of the network
may have a lower rating then the network in general (e.g. workstations,
routers) if other components in the Network can inforce MAC, DAC, I&A
etc. As an example with NT Server, their Domain Authentication Server
is an attempt to meet the DAC requirement. PPTP may be used for trusted
path for I&A, etc. Another example is NetWare, which for a restricted
IPX network, has been rated for Red Book C2

I hope this has been useful

Personal Opinions provided by
Leonard Miyata
aka leonard@geminisecure.com
GEMINI COMPUTERS INC.



On Mon, 3 Feb 1997, EKR wrote:

> > Firest Mistake. NT is not C2 complient. Anyone knowing anything about LAN
> > security would know this. Do a little more research before replying to
> > someone. Besides, do you even know the differnet levels of security, or are
> > you just "anti-nt".(which is not a bad thing)
> Actually, you're quite wrong. NT has been evaluated at C2 in
> a standalone configuration, which appears to be precisely what
> the gentleman was referring to. Please see:
> 
> http://www.radium.ncsc.mil/tpep/epl/entries/CSC-EPL-95-003.html
> 
> -Ekr
> 
> 
> 

From firewalls-owner  Tue Feb  4 10:17:31 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id JAA11075 for firewalls-outgoing; Tue, 4 Feb 1997 09:31:34 -0800 (PST)
Received: from mail.eskimo.com (mail.eskimo.com [204.122.16.4]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id JAA11026 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 09:31:16 -0800 (PST)
Received: from blackrhino (joelm@tia1.eskimo.com [204.122.16.40]) by mail.eskimo.com (8.7.6/8.6.12) with SMTP id JAA11081; Tue, 4 Feb 1997 09:29:51 -0800 (PST)
Message-Id: <3.0.32.19970204092911.006a9454@mail.eskimo.com>
X-Sender: joelm@mail.eskimo.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Tue, 04 Feb 1997 09:29:23 -0800
To: firewalls@GreatCircle.COM
From: Joel McNamara <joelm@eskimo.com>
Subject: Re: Poor NSA...Hells freezin' over again.
Cc: pelicans@mindspring.com (BeachCruiser)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>ps:  Wonder if there is anyone else out there who knows or remembers what
>TEMPEST actually stands for?  And yes it IS an acronym, and it DOES mean
>something.

Not really firewall related, but according to the Feds, TEMPEST is a
codeword, and not an acronym that means anything.

See the Complete, Unofficial TEMPEST Information Page at:

http://www.eskimo.com/~joelm/tempest.html

for loads of open source info on the topic...

Joel


From firewalls-owner  Tue Feb  4 10:25:19 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id JAA10764 for firewalls-outgoing; Tue, 4 Feb 1997 09:28:33 -0800 (PST)
Received: from lancomp-gate.LANcomp.COM (lancomp-gate.lancomp.com [199.170.17.253]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id JAA10684 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 09:28:10 -0800 (PST)
Received: from devils.LANcomp.COM ([192.168.1.102]) by lancomp-gate.LANcomp.COM
          via smtpd (for miles.greatcircle.com [198.102.244.34]) with SMTP; 4 Feb 1997 17:26:53 UT
Received: by LANcomp.COM (5.x/SMI-SVR4)
	id AA01368; Tue, 4 Feb 1997 12:26:49 -0500
Date: Tue, 4 Feb 1997 12:26:49 -0500 (EST)
From: Lee Whitty <lwhitty@LANcomp.COM>
X-Sender: lwhitty@devils
To: firewall <firewalls@greatcircle.com>
Subject: FW1 Address translation installation on multiple inspection module hosts
Message-Id: <Pine.SOL.3.91.970204121550.1256A-100000@devils>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I'm working with a customer running FW1 V2.1 on 2 firewalls. One firewall 
is licensed to run only the inspection module and authentication server. 
The other has the internet security center license. I need to be able to 
install the same rule set on both machines, but load a different address 
translation filter on each. When installing a new rule set, the 
Management firewall installs the local ruleset and translation table onto 
itself, then pushes the same to the second firewall. Even if I create a 
seperate ruleset for the second firewall, it will still install the same 
fwxl.conf on both firewalls. Is there any way to have seperate 
translation tables and a common ruleset, and install them in one step?
Any assistance would be appreciated.

--------------------------------------------------------------------------------
Lee Whitty 
LANcomp                                         Email: lwhitty@lancomp.com
242 Old New Brunswick Road, Suite 200           Voice: 908-981-1991
Piscataway, NJ 08855                            Fax  : 908-981-1858
--------------------------------------------------------------------------------


From firewalls-owner  Tue Feb  4 10:53:17 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id KAA18245 for firewalls-outgoing; Tue, 4 Feb 1997 10:19:26 -0800 (PST)
Received: from lexicon.ins.com (lexicon.ins.com [199.0.193.11]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id KAA18226 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 10:19:08 -0800 (PST)
Received: from martin_d.ins.com (dmartin.ins.com [199.0.194.34]) by lexicon.ins.com (8.7.5/8.7.3) with SMTP id KAA24351 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 10:17:44 -0800 (PST)
Message-Id: <3.0.32.19970204131543.006ccfd8@lexicon.ins.com>
X-Sender: martin_d@lexicon.ins.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Tue, 04 Feb 1997 13:15:46 -0500
To: firewalls@greatcircle.com
From: "Darwin L. Martinez" <darwin_martinez@INS.COM>
Subject: CyberGuard & NAT
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

ALL:

Can someone tell me if CyberGuard 3.0 (or 2.2) can provide NAT similar to
FireWall-1?

Thanks.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Darwin L. Martinez                 Voice:  404-843-5954
Network Systems Engineer           Pager:  888-346-1320
International Network Services     Vmail:  770-641-4004
Atlanta Office                     Email:  <mailto:darwin_martinez@ins.com>

http://www.ins.com

"Happiness is a belt-fed weapon."
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

From firewalls-owner  Tue Feb  4 11:16:27 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.7.1-lists/Lists-960417-1) id KAA17332 for firewalls-outgoing; Tue, 4 Feb 1997 10:11:26 -0800 (PST)
Received: from bitsy.hollyfeld.org (bitsy.hollyfeld.org [38.240.235.1]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with ESMTP id KAA17260 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 10:11:01 -0800 (PST)
Received: from bitsy.hollyfeld.org (bitsy.hollyfeld.org [38.240.235.1]) by bitsy.hollyfeld.org (8.7.4/8.7.3) with SMTP id NAA26547; Tue, 4 Feb 1997 13:07:57 -0500
Date: Tue, 4 Feb 1997 13:07:55 -0500 (EST)
From: Daniel Garcia <kender@hollyfeld.org>
To: Lilia Miltcheva <Miltcheva@unicc.org>
cc: "'jeff.needle@altavista-software.com'" <jeff.needle@altavista-software.com>,
        "'altavista-product@digital.com'" <altavista-product@digital.com>,
        "'admin@unicc.org'" <admin@unicc.org>,
        "'firewalls@greatcircle.com'" <firewalls@GreatCircle.COM>
Subject: RE: Duplicated network addresses
In-Reply-To: <c=CH%a=400net%p=unicc%l=NEW-EXCHANGE-970204153200Z-3805@new-exchange.unicc.org>
Message-ID: <Pine.LNX.3.95.970204123811.22357P-100000@bitsy.hollyfeld.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Tue, 4 Feb 1997, Lilia Miltcheva wrote:
> Jeff,
> What you say is correct and I do not have any problem with that. My
> question is rather what will happen if I address host.unicc.org that has
> the same IP as www.microsoft.com, for example? 
> As the tunnel comes up, the tunnel server tells the client which
> networks a to be tunneled, so logically in this case for
> www.microsoft.com = host.unicc.org I will go through the tunnel and
> therefore I will never be able to reach www.microsoft.com while the
> tunnel is up....

There is a set of IP numbers that is reseved precisely for this situation -
they are reserved for private networks, i.e. networks that will never be
directly addressable by the internet, and are garunteed by IANA (among
others I believe) to never be allocated on the internet. According to
rfc1918 (available at http://ftp.isi.edu/in-notes/rfc1918.txt ) the
following address spaces are available:

   The Internet Assigned Numbers Authority (IANA) has reserved the
      following three blocks of the IP address space for private internets:
      
           10.0.0.0        -   10.255.255.255  (10/8 prefix)
	        172.16.0.0      -   172.31.255.255  (172.16/12 prefix)
		     192.168.0.0     -   192.168.255.255 (192.168/16 prefix)

Cheers,

--Dg


From firewalls-owner  Tue Feb  4 11:40:08 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA25851 for firewalls-outgoing; Tue, 4 Feb 1997 11:13:11 -0800 (PST)
Received: from wolfe.net (mail1.wolfe.net [204.157.98.11]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id LAA25802 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 11:12:57 -0800 (PST)
Received: from sea-ts3-p01.wolfenet.com (sea-ts3-p01.wolfenet.com [204.157.98.183]) by wolfe.net (8.8.0/8.8.0) with SMTP id LAA10904 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 11:13:38 -0800 (PST)
Received: by sea-ts3-p01.wolfenet.com with Microsoft Mail
	id <01BC128C.2AC360A0@sea-ts3-p01.wolfenet.com>; Tue, 4 Feb 1997 11:11:28 -0800
Message-ID: <01BC128C.2AC360A0@sea-ts3-p01.wolfenet.com>
From: MANGO <mango@wafirm.com>
To: "'Firewalls@GreatCircle.COM'" <Firewalls@GreatCircle.COM>
Subject: Security Network Specialist Employment Opportunity
Date: Tue, 4 Feb 1997 10:48:34 -0800
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

AT&T Wireless Services is selecting talent 
for our Logical / Cross Technology Security team.
We are expanding our 'tiger team'.

AT&T Wireless Services is using leading edge
proprietary technology.  Our team is responsible for
securing our computing and cellular networks at
our corporate headquarters located in Seattle, WA.

Network Security Specialist
RESPONSIBILITIES
Establish and implement network
	security requirements.
Lead network security training effort 
	for Sys Admins throughout AT&T.
Monitor 'hacker' community and CERTs.
Establish security compliance center.
Conduct penetration tests on AWS 
network to ensure security compliance.

REQUIREMENTS
Eight or more years in Information Systems. 
Detailed understanding of UNIX security
	and TCP/IP networking.
Experience with security tools and 
demonstrated network security success.

For more information or to apply:
Send your resume or questions
via fax 206/284.8844 or 
e-mail mango@wafirm.com

The Washington Firm, Ltd. provides outsourced recruiting services for AT&T Wireless Services' headquarters.


From firewalls-owner  Tue Feb  4 11:45:38 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA26668 for firewalls-outgoing; Tue, 4 Feb 1997 11:20:32 -0800 (PST)
Received: from alpha.comsource.net (mail.comsource.net [205.243.40.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id LAA26645 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 11:20:19 -0800 (PST)
Received: from localhost by alpha.comsource.net; (5.65v3.2/1.1.8.2/17May96-0857AM)
	id AA15539; Tue, 4 Feb 1997 13:13:44 -0600
Date: Tue, 4 Feb 1997 13:13:43 -0600 (CST)
From: Jim Jones <jrjones@comsource.net>
To: Stan Wolf <swolf@pacbell.net>
Cc: asetton@lightech.com.ar, Firewall Newsgroup <firewalls@greatcircle.com>
Subject: Re: MS Proxy Server
In-Reply-To: <199702040616.WAA09724@mail-gw.pacbell.net>
Message-Id: <Pine.OSF.3.95.970204130759.26645A-100000@alpha.comsource.net>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Mon, 3 Feb 1997, Stan Wolf wrote:

[...snip...]
> 
> I plan to use PSINet' managed and monitored "RouteWaller" packet filtering
> firewall router in front of MS Proxy Server running by itself on NT Server
> 4.0.  Any thoughts on this arrangement, Jim?

Stan,

I am have never read or dealt with the RouteWaller.  So I do not know how
good a product you are getting.  The big thing about a Firewall IMHO is
the ability to log activity and the ability to hide your internal network.

jim jones
jrjones@comsource.net



From firewalls-owner  Tue Feb  4 13:07:25 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id MAA06366 for firewalls-outgoing; Tue, 4 Feb 1997 12:23:24 -0800 (PST)
Received: from news.ptes.com ([138.112.199.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id MAA06339 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 12:23:13 -0800 (PST)
Received: from [138.112.190.103] (mike.ptes.com [138.112.190.103])
	by news.ptes.com (8.8.5/8.8.5) with SMTP id MAA10718;
	Tue, 4 Feb 1997 12:19:26 -0800 (PST)
X-Sender: mike@moonlight
Message-Id: <v0213051baf1d57cf8528@[138.112.190.103]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Tue, 4 Feb 1997 12:22:56 -0900
To: Dave Schnardthorst <ds3721@strydr.com>, firewalls@GreatCircle.COM
From: mike@ptes.com (Mike Bernhardt)
Subject: Re: Rewriting User Names
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>At 10:00 AM 1/31/97 -0600, Dave Schnardthorst wrote:
>>I am currently running Sendmail-8.8.5 and would like to be able to rewrite
>>user names when sending out e-mail.
>>
>>Example:
>>
>>  Incoming mail to myself could be aliased to daves@stryder.com.  When
>>  I send outgoing mail my return address currently shows ds3721@stryder.com.
>>  The outgoing mail should show daves@stryder.com.
>>
>>Can somebody give me some examples as to how this might be accomplished.
>
>Check out http://www.mc2-csr.com/~lglaze and follow the virtual hosting
>link. The page you want is the first sendmail link. The second one goes
>into a different aspect of sendmail and virtual hosts, but it may also
>be useful to you.
>
>If you have any questions then just let me know (I wrote the pages and
>am currently using both configurations successfully).

It seems like people are making this issue harder than it needs to be. Here
is what I did (in the m4 file). Host name is "Moonlight."

divert(0)dnl
VERSIONID(`@(#)moonlight.mc 8.3 (Berkeley) 3/23/96')
OSTYPE(solaris2.ml)dnl
DOMAIN(generic)dnl
MASQUERADE_AS(ptes.com)dnl
MASQUERADE_DOMAIN(Moonlight)
MAILER(local)dnl
MAILER(smtp)dnl

This way all users on the host "Moonlight" are masked as "ptes.com."




From firewalls-owner  Tue Feb  4 13:07:58 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id MAA09428 for firewalls-outgoing; Tue, 4 Feb 1997 12:46:18 -0800 (PST)
Received: from CETUS.MNGT.ULETH.CA (cetus.mngt.uleth.ca [142.66.25.26]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id MAA09399 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 12:46:03 -0800 (PST)
Received: from MNGT-Message_Server by CETUS.MNGT.ULETH.CA
	with Novell_GroupWise; Tue, 04 Feb 1997 13:43:42 -0700
Message-Id: <s2f73d0e.003@CETUS.MNGT.ULETH.CA>
X-Mailer: Novell GroupWise 4.1
Date: Tue, 04 Feb 1997 13:30:45 -0700
From: Mark Thompson <thommd@CETUS.MNGT.ULETH.CA>
To: firewalls@greatcircle.com
Subject: FW-1 config questions - can anyone help?
Mime-Version: 1.0
Content-Type: text/plain
Content-Disposition: inline
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

G'Day All, 

I am in the process of setting up Firewall-1 on a Sun Ultra 1,  running
Solaris 2.5.1.  Being a newbie in the area of firewalls,  routers, and
gateways, I have been doing quite a lot af reading. One thing that I
cannot find in the setup for the firewall, is  how to set up my
multi-homed host as a gateway.  I need this so that my *ix boxes on the
inside of my network (or any that accept RIP packets) will recieve a
correct RIP packet from my  gateway (firewall). 
  
I am in the process of getting a separate, very small, class C  address
toconnect my firewall/gateway to the router supplied by  our ISP. 
  
Here is a simple diagram of what we have now and what we will have 
after the firewall goes in. 
 -----------                 ------                       ---------------  
|  my.net   |------------|router|---------------|  internet     |  
-----------                  ------                      --------------- 
Here, my side of the router has an address of x.y.1.1, but this  is inside
my domain space.  I have a class B domain so my subnet  mask is
255.255.0.0 and my default gateway is x.y.1.1.  Now, the majority of my
network is made up of PC's and MAC's, so I need  the gateway
to stay the same internally (x.y.1.1). 
  
After I put in the firewall,  I will have 
 ----------             ----------          ------           ----------  
|  my.net  |---------| firewall |-------|router|-------| internet |   
----------             ----------           ------           ---------- 
Here, I am going to move the x.y.1.1 to the inside of my firewall,  and get
another small address space (4 addresses) to go between my 
firewall and the router.  For simplicity sake, say that these  addresses
are 200.200.1.1 and 200.200.1.2 on the outside of the  firewall and
my side of the router, respectively.  Thus, I will have  200.200.1.1 on le0
and x.y.1.1 on qe0. 
  
The questions that I need answered are: 
  
1. I am assuming that if firewall-1 is turned off, that my firewall/gateway
machine will  need to act as a gateway that   passes all on the router. 
Is this in fact the case? 
  
2. As far as routes go, from what I have read, using static routes
seems to be the way  that I need to proceed.  So, I have made a
/etc/gateways file that reads: 
  
            norip le0    
            net 0.0.0.0 gateway 200.200.1.1 metric 0 passive    
            noripin qe0    
            net x.y.0.0 gateway x.y.1.1 metric 0 passive 
  
    I have also thought that I might need to add a route to the router as
follows: 
  
            host 200.200.1.2 gateway 200.200.1.1 metric 0 passive 
  
    Is this the best way to define my gateway so that my internal
machines that respond  to RIPs will get the correct info? 
  
3. From my reading, it seems to me that I only need to run interior routing
and no  exterior routing.  Thus I will  only need to run routed and not
gated (with EGP),  while the exterior routing will be taken care of by my
ISP.  Is this true? 

Thanks for any help,

Mark.

Mark Thompson
Manager of Network Services
Computing Services
The University of Lethbridge
Lethbridge, AB, Canada

(403) 329-2689
thommd@hg.uleth.ca
http://home.uleth.ca/~thommd

From firewalls-owner  Tue Feb  4 13:21:28 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id MAA03355 for firewalls-outgoing; Tue, 4 Feb 1997 12:03:37 -0800 (PST)
Received: from relay2.UU.NET (relay2.UU.NET [192.48.96.7]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id MAA03163 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 12:02:41 -0800 (PST)
Received: from cwiz.com by relay2.UU.NET with SMTP 
	(peer crosschecked as: www.cwiz.com [208.210.163.10])
	id QQcbme02601; Tue, 4 Feb 1997 15:01:19 -0500 (EST)
Received: by cwiz.com (SMI-8.6/SMI-SVR4)
	id OAA08060; Tue, 4 Feb 1997 14:06:58 -0600
Date: Tue, 4 Feb 1997 14:06:58 -0600
From: mdb@dosmanos.cwiz.com (Martin D. Baldenegro)
Message-Id: <199702042006.OAA08060@cwiz.com>
To: firewalls@GreatCircle.COM
Subject: class1 -vs- class 2
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



  IHAC who asked me to explain the difference between using
  a class 1 vs a class 2 type routing system for his firewall.

  I'm a little bit confussed, as I am not sure what he means
  by this. Either I am way out of it, or just never had this
  question come up.

  Are there any pointers that would explain this to me.

  Thanks,


=======================
Martin D. Baldenegro  |
The Cwiz Group        |
email - mdb@cwiz.com  |
=======================


From firewalls-owner  Tue Feb  4 13:55:02 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id MAA03396 for firewalls-outgoing; Tue, 4 Feb 1997 12:03:49 -0800 (PST)
Received: from news.ptes.com ([138.112.199.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id MAA03221 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 12:02:56 -0800 (PST)
Received: from [138.112.190.103] (mike.ptes.com [138.112.190.103])
	by news.ptes.com (8.8.5/8.8.5) with SMTP id LAA10400;
	Tue, 4 Feb 1997 11:59:53 -0800 (PST)
X-Sender: mike@moonlight
Message-Id: <v0213051aaf1d53b58de1@[138.112.190.103]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Tue, 4 Feb 1997 12:03:24 -0900
To: msmith@usair.com, firewalls@GreatCircle.COM
From: mike@ptes.com (Mike Bernhardt)
Subject: Re: Filtering outbound packets
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Outbound, we only filter for source addresses that are not from our net
i.e. possibly spoofed addresses, or least bad ones. I don't care what
protocols go out, as long as they leave here with legitimate addresses.

At 6:57 AM 2/3/97, Mark Smith wrote:
>What is the general practice for readers of this list on filtering
>outbound packets at the router between the ISP and the DMZ ?
>
>The original intent was to limit the chances of mounting
>attacks/FSP/general bad stuff using our site as base camp.  Now,
>however, we have a mail application which appears to drive the router at
>max CPU, allegedly due to the filtering in place.   That outbound
>filtering allows only the "good" protocols to their known ports.



From firewalls-owner  Tue Feb  4 14:32:55 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA18514 for firewalls-outgoing; Tue, 4 Feb 1997 14:10:16 -0800 (PST)
Received: from tetsuo.communique.net (Tetsuo.Communique.Net [204.27.65.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id OAA18457 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 14:09:58 -0800 (PST)
Received: from dguill.communique.net (005.msy4.Communique.Net [204.27.127.5]) by tetsuo.communique.net (8.6.12/8.6.12) with SMTP id QAA67143; Tue, 4 Feb 1997 16:08:27 -0600
Message-ID: <32F6F8BB.5D68@communique.net>
Date: Tue, 04 Feb 1997 02:52:12 -0600
From: "Donald R. Guillot" <dguill@communique.net>
Organization: Guillot Systems
X-Mailer: Mozilla 3.01Gold (Win95; I)
MIME-Version: 1.0
To: Cynthia He <cxh@mba.com>
CC: Firewalls@GreatCircle.COM
Subject: Re: HELP NEEDED: one time password with chroot ftp?
References: <1.5.4.32.19970130222909.0030742c@mbagate2.mba.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Cynthia He wrote:
> 
> Hi, all,
> 
> I am trying to set up a chroot ftp area for our clients. We also have a
> requirement that users have to use one time passwords to login. I am using
> TIS fwtk.
> 
> What I have in netperm-table is something like this:
> 
>   netacl-ftpd: permit-hosts * -chroot /ftp/others/ -exec /usr/bin/ftpd -d
> 
> When a user tries to login, he gets the following error:
> 
>   530 Cannot connect to auth server
>   ftp: Login failed.
>   Remote system type is UNIX.
> 
> It seems that the chroot happens before the user gets authenticated and
> hence has no access to the authsrv database. Is there a way to get around this?
> 
> Thanks for any help.
> 
> Cynthia

Cynthia,

It looks like you are just not connecting the authsrv module....
Make sure their is a definition for the location of the database
eg. authsrv:        database        /usr/local/etc/authdb

This should solve your problem..

Happy authing. (:}}

Donald R. Guillot

From firewalls-owner  Tue Feb  4 14:34:14 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA19098 for firewalls-outgoing; Tue, 4 Feb 1997 14:15:22 -0800 (PST)
Received: from tetsuo.communique.net (Tetsuo.Communique.Net [204.27.65.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id OAA19004 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 14:14:47 -0800 (PST)
Received: from dguill.communique.net (005.msy4.Communique.Net [204.27.127.5]) by tetsuo.communique.net (8.6.12/8.6.12) with SMTP id QAA13881; Tue, 4 Feb 1997 16:13:28 -0600
Message-ID: <32F6F9EB.247C@communique.net>
Date: Tue, 04 Feb 1997 02:57:15 -0600
From: "Donald R. Guillot" <dguill@communique.net>
Organization: Guillot Systems
X-Mailer: Mozilla 3.01Gold (Win95; I)
MIME-Version: 1.0
To: Ken Hardy <ken@mailhost.bridge.com>
CC: firewalls@GreatCircle.COM
Subject: Re: Solved: Odd probes at port 7777
References: <199702032341.RAA07664@binki.bridge.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Ken Hardy wrote:
> 
> I wrote:
> 
> >Every couple of days we get an attempted connection to port 7777 from
> >scripps.edu, so I put a byte sucker on that port to log any received
> >data.  It seems to be a 4 digit and a 2 digit number separated by a
> >comma, followed by a carriage return.
> 
> Further investigation made it apparent that the connection to my port
> 7777 was occuring whenever a connection was made to the remote system's
> SMTP port.  The data I captured, two comma-separated decimal numbers
> followed by a <CR><LF>, is identical to an IDENT query.  The second number
> was always 25.  The lightbulb lights!
> 
> I relayed this information to the site's admin.  He reports that they
> had recently installed a new version of sendmail which does IDENT
> queries, but why to port 7777?  The admin's latest message to me:
> 
> >You were on the right track with your comment about services..
> >We are a heavy user of NIS and ident is not a standard Solaris
> >/etc/services daemon.  I found that the NIS file contained
> >an ident entry with an alias of auth..  There was an auth entry
> >in the NIS file at port 7777..  I converted it to only use
> >a local copy of the services file..  Hopefully, this will cause
> >the probing you were seeing to go away..  If it doesn't please
> >let me know..  THANKS for the heads-up on the problem!
> 
> I don't see this on any of my Solaris systems (not using NIS).  I'd
> guess that someone had put an "auth" entry in at 7777 to refer to TIS'
> authsrv, which uses that port.
> ^^^^
> 
> --
> KH

It looks like TIS default authserver database set-up.....

Donald R. Guillot

From firewalls-owner  Tue Feb  4 16:06:49 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id PAA01229 for firewalls-outgoing; Tue, 4 Feb 1997 15:35:11 -0800 (PST)
Received: from owl.jmu.edu (owl.jmu.edu [134.126.10.50]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id PAA01137 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 15:34:43 -0800 (PST)
Received: from sys14.cs.jmu.edu (sys14.cs.jmu.edu [134.126.20.234]) by owl.jmu.edu (8.7.5/8.7.3) with SMTP id SAA17183; Tue, 4 Feb 1997 18:32:51 -0500 (EST)
Date: Tue, 4 Feb 1997 18:33:24 -0500 (EST)
From: john r cordani <cordanjr@cs.jmu.edu>
To: bextreme@pobox.com
cc: firewalls@greatcircle.com
Subject: Re: Rainbow Book Series?
In-Reply-To: <199702032222.OAA00279@mail.ptw.com>
Message-ID: <Pine.SOL.3.91.970204183114.27294A-100000@sys14.cs.jmu.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


The entire series can be had in hard copy from
director, national security agency
infosec awareness
attention: s322
9800 savage road
fort george g meade, md 20755-600

On Sun, 2 Feb 1997, Jesse 
wrote:

> Hello, does anyone know where I can get the entire Rainbow Book 
> Series?
> 
>    Thanks!!
> -J
> ===================================================
> Finger bextreme@pobox.com for PGP Public Key Block.
> E-mail to jesse.brown@pobox.com
> phone: (805) 942-1391   pager: (805) 267-9511
> ---------------------------------------------------
>  Member of the HTML Writers Guild (http://hwg.org)
> ===================================================

From firewalls-owner  Tue Feb  4 16:09:40 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA23812 for firewalls-outgoing; Tue, 4 Feb 1997 14:49:52 -0800 (PST)
Received: from lint.cisco.com (lint.cisco.com [171.68.223.44]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id OAA23783 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 14:49:35 -0800 (PST)
Received: from big-dogs.cisco.com ([171.68.53.75]) by lint.cisco.com (8.8.4/CISCO.SERVER.1.2) with SMTP id OAA02492; Tue, 4 Feb 1997 14:47:52 -0800 (PST)
Message-Id: <3.0.32.19970204174749.006b62b4@lint.cisco.com>
X-Sender: pferguso@lint.cisco.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Tue, 04 Feb 1997 17:47:52 -0500
To: mike@ptes.com (Mike Bernhardt)
From: Paul Ferguson <pferguso@cisco.com>
Subject: Re: Filtering outbound packets
Cc: msmith@usair.com, firewalls@GreatCircle.COM
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 12:03 PM 2/4/97 -0900, Mike Bernhardt wrote:

>Outbound, we only filter for source addresses that are not from our net
>i.e. possibly spoofed addresses, or least bad ones. I don't care what
>protocols go out, as long as they leave here with legitimate addresses.
>

This is, of course, the responsible thing to do.  :-)

- paul


--
Paul Ferguson                                           ||        ||
Consulting Engineering                                  ||        ||
Herndon, Virginia   USA                                ||||      ||||
tel: +1.703.397.5938                               ..:||||||:..:||||||:..
e-mail: pferguso@cisco.com                         c i s c o S y s t e m s

From firewalls-owner  Tue Feb  4 16:15:08 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id PAA02563 for firewalls-outgoing; Tue, 4 Feb 1997 15:57:03 -0800 (PST)
Received: from panix3.panix.com (panix3.panix.com [198.7.0.4]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id PAA02432 for <firewalls@GreatCircle.com>; Tue, 4 Feb 1997 15:56:27 -0800 (PST)
Received: from localhost (fangyou2@localhost) by panix3.panix.com (8.8.5/8.7/PanixU1.3) with SMTP id SAA02667; Tue, 4 Feb 1997 18:55:16 -0500 (EST)
Date: Tue, 4 Feb 1997 18:55:15 -0500 (EST)
From: FaNgYoU2 <fangyou2@panix.com>
To: firewalls@GreatCircle.com
cc: patton@sysnet.net
Subject: Re: NT network and system management
In-Reply-To: <199702040448.XAA02909@unix1.sysnet.net>
Message-ID: <Pine.SUN.3.94.970204184833.2399A-100000@panix3.panix.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Mon, 3 Feb 1997, Matthew Patton wrote:
> That's a whole lot of data ...
> ... What is your ultimate goal?  Asset management?

Our ultimate goals are:
  1) to see which servers are taking a hit on CPU, RAM or disk,
     (may have to provide better server or split the load);
  2) to see which servers are clobbering the LAN;
  3) to see which users are clobbering which servers;
  4) to detect/watch any intruders that get in.

and
  5) seek and destroy Homer Simpson if he ever connects to the LAN.

                                              FaNgYou2  ^^


From firewalls-owner  Tue Feb  4 16:19:30 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id PAA25767 for firewalls-outgoing; Tue, 4 Feb 1997 15:02:47 -0800 (PST)
Received: from sigg.com (NS.SIGG.COM [192.225.9.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id PAA25706 for <Firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 15:02:29 -0800 (PST)
Received: by firewall.sigg.com id <19643>; Tue, 4 Feb 1997 16:57:49 -0600
Illegal-Object: Syntax error in Return-path: address found on firewall.sigg.com:
	Return-path:	<>
			 ^-expected word
Message-Id: <97Feb4.165749cst.19643@firewall.sigg.com>
X-Mailer: Novell GroupWise 4.1
Date: Tue, 4 Feb 1997 17:06:45 -0600
From: Gary Fitzgerald <gfitzger@sigg.com>
To: Firewalls@GreatCircle.COM
Subject: Firewalls-Digest V6 #46 -Reply
Mime-Version: 1.0
Content-Type: text/plain
Content-Disposition: inline
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I am out of town at a training conference.  I will return and answer your mail on February 10th.  

Thanks.

From firewalls-owner  Tue Feb  4 18:34:00 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id SAA21141 for firewalls-outgoing; Tue, 4 Feb 1997 18:22:04 -0800 (PST)
Received: from mailhost.lanl.gov (mailhost.lanl.gov [128.165.3.12]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id SAA21124 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 18:21:57 -0800 (PST)
Received: from cic-mail.lanl.gov (cic-mail.lanl.gov [128.165.3.68]) by mailhost.lanl.gov (8.8.5/8.8.3) with ESMTP id TAA03546; Tue, 4 Feb 1997 19:20:48 -0700 (MST)
Received: from localhost (u802454@localhost) by cic-mail.lanl.gov (8.8.5/8.8.3) with SMTP id TAA06680; Tue, 4 Feb 1997 19:20:46 -0700 (MST)
X-Authentication-Warning: cic-mail.lanl.gov: u802454 owned process doing -bs
Date: Tue, 4 Feb 1997 19:20:46 -0700 (MST)
From: Poole Stephen <u802454@lanl.gov>
X-Sender: u802454@cic-mail
To: john r cordani <cordanjr@cs.jmu.edu>
cc: bextreme@pobox.com, firewalls@GreatCircle.COM
Subject: Re: Rainbow Book Series?
In-Reply-To: <Pine.SOL.3.91.970204183114.27294A-100000@sys14.cs.jmu.edu>
Message-ID: <Pine.SOL.3.95.970204192023.6641A-100000@cic-mail>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

You can actually call them and ask them to send you the books. :-)

Steve...

On Tue, 4 Feb 1997, john r cordani wrote:

> 
> The entire series can be had in hard copy from
> director, national security agency
> infosec awareness
> attention: s322
> 9800 savage road
> fort george g meade, md 20755-600
> 
> On Sun, 2 Feb 1997, Jesse 
> wrote:
> 
> > Hello, does anyone know where I can get the entire Rainbow Book 
> > Series?
> > 
> >    Thanks!!
> > -J
> > ===================================================
> > Finger bextreme@pobox.com for PGP Public Key Block.
> > E-mail to jesse.brown@pobox.com
> > phone: (805) 942-1391   pager: (805) 267-9511
> > ---------------------------------------------------
> >  Member of the HTML Writers Guild (http://hwg.org)
> > ===================================================
> 


From firewalls-owner  Tue Feb  4 18:48:52 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id SAA21736 for firewalls-outgoing; Tue, 4 Feb 1997 18:39:43 -0800 (PST)
Received: from unix1.sysnet.net (unix1.sysnet.net [206.142.32.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id SAA21729 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 18:39:36 -0800 (PST)
Received: from [206.142.16.40] (bppp6.sysnet.net [206.142.16.40]) by unix1.sysnet.net (8.8.4/8.6.12) with SMTP id XAA28125 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 23:15:51 -0500 (EST)
Message-Id: <199702050415.XAA28125@unix1.sysnet.net>
Subject: RE: Rainbow Book Series?
Date: Tue, 4 Feb 97 21:38:46 -0400
x-sender: patton@mail.sysnet.net
x-mailer: Claris Emailer 1.1
From: Matthew Patton <patton@sysnet.net>
To: <firewalls@greatcircle.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

or http://hightop.nrl.navy.mil/rainbow.html unless my bookmarks are all 
wrong.

From firewalls-owner  Tue Feb  4 19:04:11 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id SAA21754 for firewalls-outgoing; Tue, 4 Feb 1997 18:40:02 -0800 (PST)
Received: from unix1.sysnet.net (unix1.sysnet.net [206.142.32.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id SAA21738 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 18:39:48 -0800 (PST)
Received: from [206.142.16.40] (bppp6.sysnet.net [206.142.16.40]) by unix1.sysnet.net (8.8.4/8.6.12) with SMTP id XAA28137 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 23:16:02 -0500 (EST)
Message-Id: <199702050416.XAA28137@unix1.sysnet.net>
Subject: Re: Poor NSA...Hells freezin' over again.
Date: Tue, 4 Feb 97 21:38:56 -0400
x-sender: patton@mail.sysnet.net
x-mailer: Claris Emailer 1.1
From: Matthew Patton <patton@sysnet.net>
To: <firewalls@greatcircle.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Having firmly inserted my lower appendage into a certain orifice, let's 
see how good it tastes when I masticate...

BeachCruiser, pelicans@mindspring.com recently wrote:
>It (the NSA) is NOT in the business of validating or benchmarking the
>systems and products of commercial companies, or trying to please their
>systems administrators or corporate shareholders.

I understand.  So can somebody then explain why I hear repeatedly that 
"we choose this product cause NSA blessed it" or that the rags make such 
a big deal out of it?  It really grates on my nerves when I hear such 
lines as the sole justification from those who've never admined a box in 
their life or don't understand the variables involved.  Maybe we're all 
guilty of saddling NSA with stuff it isn't equipped to deal with (not 
necessarily technically but financially or time wise).

>The clamoring from the user community is that they all want the "most
>secure" firewall.  Of course they don't know, can't figure out, or agree on
>what "secure" even means now any more than they did back then.  And the
>vendors don't know what benchmarks to build to.  So, just like they did
>back in the TEMPEST days, some simply solve that problem by claiming that
>their product's trust level holds some relevance to Orange Book, or some
>other rating levels established by the security gods.  Whether they
>actually did or not was just as much an open question then as it is now.

So which one of us is going to raise our hand and yell "reality check!!  
Will the produce manager come to register 3 to render assistance?"

>Well, sure lets just forget about this testing business altogether and let
>a defacto standard emerge based on the vendor with the largest installed
>base.
No I didn't mean to imply any of the kind.  My thrust was that given the 
delay involved in the release of their report, if there had been 
problems, the market would have found out long before that.  Either 
through the rags doing their varying degrees of 'testing' or in 
customers' use of the product.  TIS was mentioned simply because that was 
the report case in question.  It could have easily been Raptor, or FW1.

>Well now something else is wrong...it seems that somebody's whinin' because
>the test is not rigorous enough, or the reports are no good, or, the soup's
>cold...
Come to think of it, Turkey and vegetable soup is not very tasty served 
cold...

Ok, maybe I'm whining and perhaps the NSA did the reviews just to get 
"us" off their backs.  The "beef" in my case is, if they were going to 
conduct the tests, let's see something a little more than the ordinary, 
something you CAN'T get from the private sector, something to make joe 
admin faint in awe at the mighty power and insight of the NSA (no, I'm 
not being sarcastic... well ok, just a little), something to justify 
their invenstment in both time and money (at taxpayer expense no less).  
Essentially,  the value added.  That or stand up and say "Screw you, 
we're not in this business to eval firewalls," and let the media and 
public know it.  Did they do a poor or incomplete job on the stuff they 
DID test?  No.

Just went and reread the NCSA certification rules and they're not half 
bad.  Perhaps I should look into this a little more.  Personally I don't 
mind that NCSA charges for their services.  I can understand it costs a 
pretty penny to provide the facilities and the time and people to conduct 
the tests even if they might be simple.  In any event we and the industry 
need a watchdog of some sort to establish a baseline.  Mabye NCSA is the 
best forum for the time being.  I'm not so sure I'd be willing to let the 
rags be our conscience.  Could the NCSA rating be improved qualitatively 
with a wider collection of tools?  The NID or SPI products perhaps?  
Running challenge sites (a SCC favorite) for each product?  With periodic 
reports on how they handled new attacks?

The problem with the firewalls issue is that it's only part of the 
problem.  There are a further million and one variables/cases in securing 
the wholistic network, which is what we're driving toward.  The case of 
little applets slipping through the FW into a client which can then do 
all kinds of mischief really isn't a firewall issue per say.  Or an 
inexperienced web server setup letting someone waltz right on thru to the 
inside.

>While still others don't seem to have any problem at all when an industry
>rag, owned by a publishing house for godsake, that doesn't know a covert
>channel from the English Channel, puts out a review and within an hour the
>Madison Avenue machine is in overdrive to tell you who won.
these guys really get to me too.  A couple pointers at Network World's 
review is in order I think.

>If you've got the souce, everything is
>crystal clear...right?
to those who can understand it.  Can any one person understand it?  
Probably not.  But given how many good minds there are I think a pretty 
good effort can be made.

I like your humor.  Something I need to work on...Maybe I should get in 
touch with my "inner child."  An associate worked for NSA for 10+ years, 
if anything I ought to be singing it's praises.

>uh...more tea anyone?
Thanks, just make it a sweet tea with lemon.

PS. Tempest = storm, maelstrom, serious atmospheric disturbance.  But I'm 
sure that definition was NOT the one you wanted.

From firewalls-owner  Tue Feb  4 20:19:50 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id UAA00545 for firewalls-outgoing; Tue, 4 Feb 1997 20:07:05 -0800 (PST)
Received: from su1.in.net (su1.in.net [199.0.62.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id UAA00530 for <firewalls@GreatCircle.com>; Tue, 4 Feb 1997 20:06:51 -0800 (PST)
Received: from pm4-28.in.net by su1.in.net with SMTP (5.65/1.2-eef)
	id AA20224; Tue, 4 Feb 97 22:58:16 -0500
Date: Tue, 4 Feb 97 22:58:16 -0500
Message-Id: <9702050358.AA20224@su1.in.net>
X-Sender: frankw@in.net (Unverified)
X-Mailer: Windows Eudora Pro Version 2.1.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: <winspace@geko.net.au>
From: Frank Willoughby <frankw@in.net>
Subject: Re: SATAN user group?
Cc: firewalls@GreatCircle.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 04:51 AM 2/1/97 +1000, you wrote:

>In reply to the honourable 'frankw@in.net' who said:
>
>> The SATAN tool (or SANTA as I prefer to call it - after running the 
>> REPENT program) is vastly over-hyped & over-rated.  BTW, I hope you 
>
>
>sorry but some of us beg to differ, FWIW its a great tool and im sure many
of us 
>recognise its worth. putting it down the way you did does the auther DF a
great 
>disservice. its just another tool in the sysadmin's suite of tools or
should be seen 
>as such, and it performs, what is normally a repetitive and standard set of 
>diagnostics that one should be running on ones _own_ network, extremely well.


I maintain my stance that the SATAN/SANTA tool is over-hyped and over-rated.
Just before it was released, it made a lot of Information Security Officers
(including me) very nervous.  At the time I was a Company (nationwide)
Information Security Operations officer for a major US hi-tech company overseas 
(@3K systems and 6K employees, but I digress).  After putting the tool on the 
bench and seeing what it really does, we breathed a lot easier.  
 
Here are a few reasons why:

o The software was/is out-dated (even when it was released).  If you are 
   keeping your software current, then it is highly likely that your system 
   will contain patches for vulnerabilities that the SANTA tool would detect.

o An Operating System (O/S) contains 5 major components - Accounts, Auditing, 
   File System, Network, & System areas (root files, system binaries, etc. 
   In performing its testing, the SANTA tool relies on the network component 
   (only) of the Operating System to tell you about the security of the 
   *entire* O/S (as seen by the network).  While this is a noble goal, it 
   falls far short.  Non-networking components of the O/S are not evaluated.  
   IOW, if your networking component is secure, but your system is wide open 
   because of problems in other areas, your system is vulnerable to being
   taken over - in spite of a report from SANTA that your system is OK.
   Use the right tool for the right job.  SANTA tests (primarily) the
   networking component, and it doesn't do that very well, IMHO.

o The SANTA tool performs a very small portion of the tests that ISS 
   and other vendors' products perform.  If it doesn't test for attacks
   such as SYN-flooding or the "Ping-of-death", then it can't tell you
   if these will be a problem for you or not.

o A "clean bill of health" from the SANTA tool give the sysadmin a false 
   sense of security about the security of his/her systems.

o At best, the SANTA tool will tell the beginner sysadmin if they 
   have overlooked something basic, but beyond that, it is useless.

o Another nit is the choice of the name that was chosen.  In one stroke, 
   DF & WV managed to alienate those who are offended by the name "SATAN".  
   The name SATAN signifies the epitome of evil.  If the tool was intended
   to be used for good rather than evil purposes, the choice of the name 
   was the worst one possible.  I don't know the agenda behind the name,
   but I am curious why they chose that particular name than any of a
   multitude of other suitable names.

o It is my understanding that a trojan horse was planted (by a hacker)
  in version 1.1 of the tool.  If you really insist on using the tool,
  run the latest version possible (or v1.1.1 as a minimum).

o It is probably worth checking the 'net for free & commercial versions
   of tools similar to the SANTA tool.  You will probably find other
   tools which provide better coverage than the SANTA tool.

o Use the right tool for the right job.  A network security tool is only 
   one of many tools which a skilled Information Security Officer uses 
   to keep their environment secure.

Santa does have two redeeming graces <double-pun intended>, but they 
don't outweigh the disadvantages, IMHO.  The few advantages are:

o The source code is available, so it can be modified to run on custom
   platforms.

o Further, since the source code is available, any sysadmin can add 
   custom modules to the tool (OTOH, so can the hackers).

Last, but not least, if one of our customers has heard of the tool and 
is curious what it looks like, we will show it them.  Then we will 
show them that our typical network security analysis services (such as 
Firewall Penetration Tests, etc.) discover far more potential probem 
areas than the SANTA tool ever could.  FWIW, the contrast between the 
"much-feared" SANTA tool and the far more extensive tests that we run 
makes *quite* a favorable impression on our customers.

Best Regards,


Frank
=======================================================================
| Fortified Networks, Inc.  -  Expert Information Security Consulting |
| Web:  http://www.fortified.com                                      |
| Phone: (317) 573-0800                                               |
| Fax:   (317) 573-0817                                                 |
=======================================================================


From firewalls-owner  Tue Feb  4 21:08:29 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id VAA03514 for firewalls-outgoing; Tue, 4 Feb 1997 21:01:08 -0800 (PST)
Received: from ns1.ntshop.com ([207.91.166.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id VAA03475 for <firewalls@greatcircle.com>; Tue, 4 Feb 1997 21:00:47 -0800 (PST)
Received: from boulder.ntshop.net ([207.91.166.17]) by ns1.ntshop.com
          (post.office MTA v2.0 0813 ID# 153-13296) with SMTP id AAA230;
          Tue, 4 Feb 1997 22:58:24 -0600
Received: by boulder.ntshop.net with Microsoft Mail
	id <01BC12EF.12A4B880@boulder.ntshop.net>; Tue, 4 Feb 1997 22:59:27 -0600
Message-ID: <01BC12EF.12A4B880@boulder.ntshop.net>
From: Mark Joseph Edwards <mark@ntshop.net>
To: "'jesse.brown@pobox.com'" <jesse.brown@pobox.com>
Cc: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: RE: Rainbow Book Series? RIGHT HERE ONLINE
Date: Tue, 4 Feb 1997 22:59:22 -0600
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


There are pointers to most of the Rainbow books (online versions) on =
this Web page, click "NT  Security Risks", then go down to "Other =
Resources".  http://www.ntshop.net/security

mark

-----Original Message-----
From:	john r cordani [SMTP:cordanjr@cs.jmu.edu]
Sent:	Tuesday, February 04, 1997 5:33 PM
To:	bextreme@pobox.com
Cc:	firewalls@greatcircle.com
Subject:	Re: Rainbow Book Series?


The entire series can be had in hard copy from
director, national security agency
infosec awareness
attention: s322
9800 savage road
fort george g meade, md 20755-600

On Sun, 2 Feb 1997, Jesse=20
wrote:

> Hello, does anyone know where I can get the entire Rainbow Book=20
> Series?
>=20
>    Thanks!!
> -J
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D
> Finger bextreme@pobox.com for PGP Public Key Block.
> E-mail to jesse.brown@pobox.com
> phone: (805) 942-1391   pager: (805) 267-9511
> ---------------------------------------------------
>  Member of the HTML Writers Guild (http://hwg.org)
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D

From firewalls-owner  Wed Feb  5 01:34:01 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id BAA20396 for firewalls-outgoing; Wed, 5 Feb 1997 01:27:52 -0800 (PST)
Received: from sigg.com (NS.SIGG.COM [192.225.9.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id BAA20387 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 01:27:42 -0800 (PST)
Received: by firewall.sigg.com id <19643>; Wed, 5 Feb 1997 03:23:04 -0600
Illegal-Object: Syntax error in Return-path: address found on firewall.sigg.com:
	Return-path:	<>
			 ^-expected word
Message-Id: <97Feb5.032304cst.19643@firewall.sigg.com>
X-Mailer: Novell GroupWise 4.1
Date: Wed, 5 Feb 1997 03:31:55 -0600
From: Gary Fitzgerald <gfitzger@sigg.com>
To: Firewalls@GreatCircle.COM
Subject: Firewalls-Digest V6 #47 -Reply
Mime-Version: 1.0
Content-Type: text/plain
Content-Disposition: inline
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I am out of town at a training conference.  I will return and answer your mail on February 10th.  

Thanks.

From firewalls-owner  Wed Feb  5 07:30:52 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA04936 for firewalls-outgoing; Wed, 5 Feb 1997 06:49:16 -0800 (PST)
Received: from dante.sapient.com (dante.sapient.com [207.121.0.5]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA04892 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 06:48:57 -0800 (PST)
Received: (from mail@localhost) by dante.sapient.com (8.6.11/8.6.11) id JAA01321 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 09:47:35 -0500
Received: from smtpgate.sapient.com(172.16.1.7) by dante.sapient.com via smap (V1.3)
	id smaa01315; Wed Feb  5 09:47:07 1997
Received: by galaxy.sapient.com with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63)
	id <01BC1349.676F77B0@galaxy.sapient.com>; Wed, 5 Feb 1997 09:46:04 -0500
Message-ID: <c=US%a=_%p=sapient%l=SAPIENT/SMTPGATE/000909F3@galaxy.sapient.com>
From: Timothy Tu <ltu@sapient.com>
To: "'Firewalls@GreatCircle.COM'" <Firewalls@GreatCircle.COM>
Subject: proxy and newsgroups
Date: Wed, 5 Feb 1997 09:45:04 -0500
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

I need some help.  Is there a way to access my ISP's newsgroups through
my work's connection that has a proxy server on a NT or 95?  If so, do
you know which news reader program support it?  Thanks.

Timothy Tu
lt10@cornell.edu

From firewalls-owner  Wed Feb  5 07:37:47 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA05168 for firewalls-outgoing; Wed, 5 Feb 1997 06:56:34 -0800 (PST)
Received: from gargoyle.clark.net (gargoyle.clark.net [168.143.0.250]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA05142 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 06:56:16 -0800 (PST)
Received: (qmail 26767 invoked by uid 500); 5 Feb 1997 05:57:06 -0000
Date: Wed, 5 Feb 1997 00:57:06 -0500 (EST)
From: "Paul D. Robertson" <proberts@clark.net>
X-Sender: proberts@gargoyle
To: Frank Willoughby <frankw@in.net>
cc: winspace@geko.net.au, firewalls@GreatCircle.COM
Subject: Re: SATAN user group?
In-Reply-To: <9702050358.AA20224@su1.in.net>
Message-ID: <Pine.LNX.3.91.970205004148.25908E-100000@gargoyle>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Tue, 4 Feb 1997, Frank Willoughby wrote:

> o The software was/is out-dated (even when it was released).  If you are 
>    keeping your software current, then it is highly likely that your system 
>    will contain patches for vulnerabilities that the SANTA tool would detect.

>From what I've heard, the 3rd pre-release was very agressive, and like 
all tools, it needs to remain current.  

>    because of problems in other areas, your system is vulnerable to being
>    taken over - in spite of a report from SANTA that your system is OK.
>    Use the right tool for the right job.  SANTA tests (primarily) the
>    networking component, and it doesn't do that very well, IMHO.

It's quite specifically targeted for networks.

> 
> o The SANTA tool performs a very small portion of the tests that ISS 
>    and other vendors' products perform.  If it doesn't test for attacks
>    such as SYN-flooding or the "Ping-of-death", then it can't tell you
>    if these will be a problem for you or not.

It's very difficult to run a denial-of-service attack without denying 
service, don't you think?   Most of us who claim it doesn't do enough are 
the same ones who would claim it did too much for the bad guys if it were 
released with a more agressive suite of tests.

> o A "clean bill of health" from the SANTA tool give the sysadmin a false 
>    sense of security about the security of his/her systems.

If they don't know what it does, and doesn't do.  This is true of *every* 
analysis tool. 

> o At best, the SANTA tool will tell the beginner sysadmin if they 
>    have overlooked something basic, but beyond that, it is useless.

It's extensible, and that's one of it's main features, if you don't grow 
it, then yes, it's not much more than a rubber stamp for a limited set of 
vulnerabilities, that's true of any analysis tool in a dynamic environment.

> o Another nit is the choice of the name that was chosen.  In one stroke, 
>    DF & WV managed to alienate those who are offended by the name "SATAN".  
>    The name SATAN signifies the epitome of evil.  If the tool was intended
>    to be used for good rather than evil purposes, the choice of the name 
>    was the worst one possible.  I don't know the agenda behind the name,
>    but I am curious why they chose that particular name than any of a
>    multitude of other suitable names.

If the name of a program is that bad to someone, then I'd respectfully
suggest that they're in the wrong line of work.  Given, if I recall 
correctly, Dan's naming of a program Fuck!, SATAN could even be 
considered a step up. :) 

> o Further, since the source code is available, any sysadmin can add 
>    custom modules to the tool (OTOH, so can the hackers).

With a C compiler, any sysadmin can write nice helpful programs.  On the 
other hand, evil hackers can write mean and nasty programs.  ?

Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
proberts@clark.net      which may have no basis whatsoever in fact."
                                                                     PSB#9280


From firewalls-owner  Wed Feb  5 07:58:42 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA06672 for firewalls-outgoing; Wed, 5 Feb 1997 07:24:40 -0800 (PST)
Received: from tuna.wang.com (TUNA.wang.com [150.124.136.4]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id HAA06654 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 07:24:28 -0800 (PST)
Received: from mars.wangfed.com (mars.Wangfed.COM [159.94.10.1])
    by tuna.wang.com (8.6.12/8.6.12tf1) with SMTP id KAA11781;
    Wed, 5 Feb 1997 10:23:18 -0500
Received: from uc0009.wangfed.com (uc0009 [159.94.10.15])
	by mars.wangfed.com (8.8.4/3.8) with SMTP
	id KAA29114; Wed, 5 Feb 1997 10:29:22 -0500 (EST)
Received: from [159.94.14.48] by uc0009.wangfed.com (BULL 5.61++/B.O.S 02.01)
	id AA00388; Wed, 5 Feb 97 10:14:08 -0500
Date: Wed, 5 Feb 97 10:14:08 -0500
Message-Id: <9702051514.AA00388@uc0009.wangfed.com>
From: "K.M."  <goertzek@wangfed.com>
Reply-To: "K.M."  <goertzek@wangfed.com>
To: patton@sysnet.net, firewalls@GreatCircle.COM
Subject: Re: Rainbow Book Series?
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

In message <199702050415.XAA28125@unix1.sysnet.net> Matthew Patton writes:
> or http://hightop.nrl.navy.mil/rainbow.html unless my bookmarks are all 
> wrong.


NRL has closed its web site to all domain names except those ending in .gov or 
.org.


Karen Goertzel

=====

K.M. Goertzel
Manager, Business Development
Secure Systems & Services Operation
WANG FEDERAL, Inc.
7900 Westpark Drive - MS 700
McLean, VA  22102-4299  USA
tel (703)827 3914
fax (703)827 3161 
email goertzek@wangfed.com


From firewalls-owner  Wed Feb  5 08:46:23 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA08313 for firewalls-outgoing; Wed, 5 Feb 1997 07:50:46 -0800 (PST)
Received: from mail.baileynm.com (fw.baileynm.com [206.109.159.11]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id HAA08305 for <firewalls@GreatCircle.com>; Wed, 5 Feb 1997 07:50:30 -0800 (PST)
Received: (qmail 2923 invoked from smtpd); 5 Feb 1997 15:49:21 -0000
Received: from web.nmti.com (root@198.178.0.201)
  by fw.nmti.com with SMTP; 5 Feb 1997 15:49:21 -0000
Received: from sonic.nmti.com (peter@sonic.nmti.com [198.178.0.2]) by web.nmti.com (8.6.12/8.6.9) with SMTP id JAA03997; Wed, 5 Feb 1997 09:49:21 -0600
Received: by sonic.nmti.com; id AA08998; Wed, 5 Feb 1997 09:43:46 -0600
From: peter@baileynm.com (Peter da Silva)
Message-Id: <9702051543.AA08998@sonic.nmti.com.nmti.com>
Subject: Re: SATAN user group?
To: frankw@in.net (Frank Willoughby)
Date: Wed, 5 Feb 1997 09:43:45 -0600 (CST)
Cc: winspace@geko.net.au, firewalls@GreatCircle.com
In-Reply-To: <9702050358.AA20224@su1.in.net> from "Frank Willoughby" at Feb 4, 97 10:58:16 pm
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> o Another nit is the choice of the name that was chosen.  In one stroke, 
>    DF & WV managed to alienate those who are offended by the name "SATAN".  
>    The name SATAN signifies the epitome of evil.  If the tool was intended
>    to be used for good rather than evil purposes, the choice of the name 
>    was the worst one possible.  I don't know the agenda behind the name,
>    but I am curious why they chose that particular name than any of a
>    multitude of other suitable names.

What, you mean like maybe "the Farmer Universal Cracking Kit"? <g>


From firewalls-owner  Wed Feb  5 09:01:23 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA10595 for firewalls-outgoing; Wed, 5 Feb 1997 08:20:01 -0800 (PST)
Received: from arden.iss.net (arden.iss.net [204.241.60.8]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id IAA10554 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 08:19:42 -0800 (PST)
Received: from localhost (davem@localhost) by arden.iss.net (8.8.5/8.7.3) with SMTP id LAA16282; Wed, 5 Feb 1997 11:17:23 -0500
X-Authentication-Warning: arden.iss.net: davem owned process doing -bs
Date: Wed, 5 Feb 1997 11:17:23 -0500 (EST)
From: "David J. Meltzer" <davem@iss.net>
To: "Paul D. Robertson" <proberts@clark.net>
cc: Frank Willoughby <frankw@in.net>, winspace@geko.net.au,
        firewalls@GreatCircle.COM
Subject: Re: SATAN user group?
In-Reply-To: <Pine.LNX.3.91.970205004148.25908E-100000@gargoyle>
Message-ID: <Pine.LNX.3.95.970205110403.15762A-100000@arden.iss.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> It's very difficult to run a denial-of-service attack without denying 
> service, don't you think?   Most of us who claim it doesn't do enough are 
> the same ones who would claim it did too much for the bad guys if it were 
> released with a more agressive suite of tests.

  This is a very subtle point.  There are some denial of service attacks
that are nearly impossible to test for under certain conditions without
going ahead and actually performing the attack.  Something like the ping
of death or a UDP bomb can very likely fall into this category for a
network based check.  (Another method of testing, logging into each
machine and discovering the specific operating system and kernel revision,
is a way to avoid performing the denial of service attack, but brings with
it its own set of problems and disadvantages).
  A test for a syn flood attack is possible to check for remotely in such
a way that it has a very minimal impact on the service that you are
attempting to flood.  The syn flood denial of service test that is a part
of ISS does perform an actual denial of service, but it only shuts down
the service for a split second before reversing the impact of the attack
and opening the service back up.  That might fall into a very small
acceptable DoS attack you could test against a production system. 
  I think we can all agree though that it is far better for a system or 
security administrator to test for vulnerabilities to these problems under
controlled timing and conditions than it is to figure out what machines
are vulnerable to attack when a hacker starts performing it 4am on a
sunday morning.

-Dave

--------------------------------+---------------------
       David J. Meltzer         | Email: davem@iss.net 
       Systems Engineer         |   Web:   www.iss.net 
Internet Security Systems, Inc. |   Fax: (770)395-1972


From firewalls-owner  Wed Feb  5 09:32:22 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA09719 for firewalls-outgoing; Wed, 5 Feb 1997 08:05:07 -0800 (PST)
Received: from ITSFW.internal.cits.com (itsfw.cits.com [57.192.1.9]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id IAA09488 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 08:04:04 -0800 (PST)
Received: by ITSFW.internal.cits.com (AIX 4.1/UCB 5.64/4.03)
          id AA11202; Wed, 5 Feb 1997 17:07:22 +0100
Received: from itsgtw.internal.cits.com(124.10.10.10) by ITSFW via smap (V1.3)
	id sma012732; Wed Feb  5 17:06:40 1997
Received: from sscherrer.internal.cits.com by ITSGTW.internal.cits.com (AIX 3.2/UCB 5.64/4.03)
          id AA10889; Wed, 5 Feb 1997 16:47:22 +0100
Message-Id: <32F8AFCA.246D@cits.com>
Date: Wed, 05 Feb 1997 17:05:32 +0100
From: Stephane Scherrer <sscherrer@cits.com>
X-Sender: Stephane Scherrer <sscherrer@cits.com> (Unverified)
X-Mailer: Mozilla 4.0b1 (Win95; I)
Mime-Version: 1.0
To: Firewalls@GreatCircle.COM
Subject: Source port filtering rules...
X-Priority: Normal
References: <199702040443.UAA01246@miles.greatcircle.com>
Content-Type: multipart/mixed; boundary="----------5B574DC5BC10"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

This is a multi-part message in MIME format.
------------5B574DC5BC10
Content-Type: multipart/alternative; boundary="----------6AEC73B4325F1"


------------6AEC73B4325F1
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=us-ascii

Hi everybody,

I'm currently having a slight problem with a remote site and would
appreciate any help on this.
Here is where it lies :
I'm currently running the TIS Firewall Toolkit with a screening router,
between it and the Internet...

         -----            -------------------               ---------
        | TIS  |------ | Screening Router |---------| Internet |
         -----            -------------------               ---------

The screening router is configured with defined filter rules, and one of
these rules is causing us lots of troubles :

        allow X (Port>=1024)   ---------> FW (Port=25)
or in "Cisco Langage" :
       access-list 130 permit tcp any gt 1023 FWIPaddress FWnetmask eq
25

It didn't sound wrong for me...except when a remote site contacted me
saying that they couldn't send us any Mail...
Furether investigation showed that their Mail packets in destination of
our Mail server had a source port below 1024... I reported the problem
to them and they investigate on their side...

Here lies the problem :
They were said by Checkpoint software (who installed their firewall
including a NAT) that we shouldn't filter incoming packets on the source
port !!!!

If anybody could answer these two questions, it would greatly help me :
    - Is there any real security problems if you don't filter source
port on incoming packets ?
    - Should these kind of packets (source port <1024 to destination
port =25) be allowed to pass through ?

Thanks very much for any help on this one.

Stephane Scherrer
MIS Project Manager
ITS EUMA
Email : sscherrer@cits.com
Voice : (33)-1-41 16 23 58
Fax : (33)-1-41 16 22 17


------------6AEC73B4325F1
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset=us-ascii

<HTML><BODY>

<DT>Hi everybody,</DT>

<DT>&nbsp;</DT>

<DT>I'm currently having a slight problem with a remote site and would
appreciate any help on this.&nbsp;</DT>

<DT>Here is where it lies :</DT>

<DT>I'm currently running the TIS Firewall Toolkit with a screening router,
between it and the Internet...</DT>

<DT>&nbsp;</DT>

<DT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -----&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-------------------&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
---------</DT>

<DT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; | TIS&nbsp; |------ | Screening
Router |---------| Internet |</DT>

<DT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; -----&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
-------------------&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
---------</DT>

<DT>&nbsp;</DT>

<DT>The screening router is configured with defined filter rules, and one
of these rules is causing us lots of troubles :</DT>

<DT>&nbsp;</DT>

<DT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; allow X (Port&gt;=1024)&nbsp;&nbsp;
---------&gt; FW (Port=25)</DT>

<DT>or in &quot;Cisco Langage&quot; :</DT>

<DT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; access-list 130 permit tcp any
gt 1023 FWIPaddress FWnetmask eq 25&nbsp;</DT>

<DT>&nbsp;</DT>

<DT>It didn't sound wrong for me...except when a remote site contacted
me saying that they couldn't send us any Mail...</DT>

<DT>Furether investigation showed that their Mail packets in destination
of our Mail server had a source port below 1024...&nbsp;I reported the
problem to them and they investigate on their side...</DT>

<DT>&nbsp;</DT>

<DT>Here lies the problem :</DT>

<DT>They were said by Checkpoint software (who installed their firewall
including a NAT) that we shouldn't filter incoming packets on the source
port !!!!&nbsp;</DT>

<DT>&nbsp;</DT>

<DT>If anybody could answer these two questions, it would greatly help
me :</DT>

<DT>&nbsp;&nbsp;&nbsp; - Is there any real security problems if you don't
filter source port on incoming packets ?</DT>

<DT>&nbsp;&nbsp;&nbsp; - Should these kind of packets (source port &lt;1024
to destination port =25) be allowed to pass through ?</DT>

<DT>&nbsp;</DT>

<DT>Thanks very much for any help on this one.</DT>

<DT>&nbsp;</DT>

<DT>Stephane Scherrer</DT>

<DT>MIS&nbsp;Project Manager</DT>

<DT>ITS&nbsp;EUMA</DT>

<DT>Email : sscherrer@cits.com</DT>

<DT>Voice : (33)-1-41 16 23 58</DT>

<DT>Fax : (33)-1-41 16 22 17</DT>

<DT>&nbsp;</DT>

</BODY>
</HTML>
------------6AEC73B4325F1--

------------5B574DC5BC10
Content-Transfer-Encoding: 7bit
Content-Description: Address Book Card for Stephane Scherrer
Content-Disposition: inline; filename="nsmail76.TMP"
Content-Type: text/x-vCard; charset=us-ascii; name="nsmail76.TMP"

BEGIN:VCARD
FN:Stephane Scherrer
N:Scherrer;Stephane
ORG:ITS
ADR:;;124, Bd de Verdun;Courbevoie;Courbevoie;92400
EMAIL;INTERNET:sscherrer@cits.com
TITLE:Mis Project Specialist
TEL;WORK:(33) 01 41 16 23 58
TEL;FAX:(33) 01 41 16 22 37
X-NAV-HTML:T
END:VCARD


------------5B574DC5BC10--


From firewalls-owner  Wed Feb  5 10:00:37 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA11564 for firewalls-outgoing; Wed, 5 Feb 1997 08:30:32 -0800 (PST)
Received: from ait.nrl.navy.mil (ait.nrl.navy.mil [132.250.128.5]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id IAA11514 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 08:30:15 -0800 (PST)
Received: from enterprise (rtaylor@enterprise [132.250.128.5]) by ait.nrl.navy.mil (8.8.3/8.8.3) with ESMTP id LAA11822; Wed, 5 Feb 1997 11:28:23 -0500 (EST)
Message-Id: <199702051628.LAA11822@ait.nrl.navy.mil>
To: "K.M." <goertzek@wangfed.com>
cc: patton@sysnet.net, webmaster@hightop.nrl.navy.mil,
        firewalls@greatcircle.com
Subject: Re: Rainbow Book Series? 
In-reply-to: Your message of Wed, 05 Feb 1997 10:14:08 EST.
             <9702051514.AA00388@uc0009.wangfed.com> 
Date: Wed, 05 Feb 1997 11:28:22 -0500
From: Randy Taylor <rtaylor@ait.nrl.navy.mil>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


> In message <199702050415.XAA28125@unix1.sysnet.net> Matthew Patton writes:
> > or http://hightop.nrl.navy.mil/rainbow.html unless my bookmarks are all 
> > wrong.
> 
> 
> NRL has closed its web site to all domain names except those ending in .gov o
r 
> .org.

Incorrect. The NRL Information Systems Security Branch, which is part
of the Naval Research Laboratory, has closed its web site to all
but the .mil and .gov network domains. Other divisions and branches
of the Naval Research Laboratory choose their own access policies -
most are in fact, open to public browsing.

Just wanted to clear up that bit of misinformation from Ms. Goertzel.


Randy Taylor             
Supporting Code 1221.3,
Information Systems Security Branch
Naval Research Laboratory
Washington, D.C.
email: rtaylor@hightop.nrl.navy.mil
       webmaster@hightop.nrl.navy.mil

From firewalls-owner  Wed Feb  5 10:30:52 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA15400 for firewalls-outgoing; Wed, 5 Feb 1997 09:01:47 -0800 (PST)
Received: from mitchell.cap.af.mil (mitchell.cap.af.mil [132.60.58.11]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id JAA15354 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 09:01:14 -0800 (PST)
Received: from localhost (cmilam@localhost) by mitchell.cap.af.mil (8.7.6/8.7.3-961117-BC) with SMTP id KAA17085; Wed, 5 Feb 1997 10:52:04 -0600
Date: Wed, 5 Feb 1997 10:52:04 -0600 (CST)
From: "Milam, Charles R. 1LT CAP" <cmilam@cap.af.mil>
To: "K.M." <goertzek@wangfed.com>
cc: patton@sysnet.net, firewalls@GreatCircle.COM
Subject: Re: Rainbow Book Series?
In-Reply-To: <9702051514.AA00388@uc0009.wangfed.com>
Message-ID: <Pine.LNX.3.94.970205105109.16926B-100000@mitchell.cap.af.mil>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


On Wed, 5 Feb 1997, K.M. wrote:

> NRL has closed its web site to all domain names except those ending in .gov or 
> .org.

Actually, it's closed to .gov and .mil.  Don't feel bad, all I get is a
"Server is refusing connections now. Sorry." message, anyway.

----------------------------------------------------------------------
1LT Chuck Milam, CAP				cmilam@cap.af.mil
United States Air Force Auxiliary		http://www.cap.af.mil/
Civil Air Patrol National Headquarters		Comm:	(334) 953-4271
Maxwell Air Force Base, AL			DSN:	493-4271


From firewalls-owner  Wed Feb  5 10:41:14 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA20531 for firewalls-outgoing; Wed, 5 Feb 1997 09:59:28 -0800 (PST)
Received: from bgc.bostongas.com (bgc.bostongas.com [208.202.16.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id JAA20494 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 09:59:09 -0800 (PST)
Received: by bgc.bostongas.com; id MAA23191; Wed, 5 Feb 1997 12:56:02 -0500 (EST)
Received: from unknown(10.129.1.4) by bgc.bostongas.com via smap (V3.1)
	id xma023185; Wed, 5 Feb 97 12:55:58 -0500
Received: from NetWare MHS (SMF70) by smtp.bostongas.com
	via Connect2-SMTP 4.20B.3; Wed, 5 Feb 1997 12:52:22 -0500
Message-ID: <4A30323C013C41D9@smtp.bostongas.com>
Date: Wed, 5 Feb 1997 12:37:24 -0500
From: "Kolenko, Marc" <mmk@bostongas.com>
Organization: BOSTON GAS COMPANY
To: firewalls@greatcircle.com
Subject: Sandbox?
MIME-Version: 1.0
Content-type: text/plain; charset="US-ASCII"
Content-disposition: inline
Content-transfer-encoding: 7bit
X-Mailer: Connect2-SMTP 4.20B.3 MHS/SMF to SMTP Gateway
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Friends

can some one give me the 2 minute drill on the architectural definition 
of "SANDBOX"?

Does it relate to typical DMZ configurations usually alluded to in 
Firewall placement discussions?

thanks in advance

Marc
*******************************************
Marc M. Kolenko, Boston Gas Co.
Strategic IT Planning
mkolenko@bostongas.com
     -or-
kolenko@tiac.net
617.723.5512; x-2669
*******************************************

--------------------------------------------------------------------------
---------
"The opinions expressed here are my own and 
do not represent the views or opinions of Boston Gas Co."
--------------------------------------------------------------------------
---------


From firewalls-owner  Wed Feb  5 11:39:23 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id KAA26142 for firewalls-outgoing; Wed, 5 Feb 1997 10:55:41 -0800 (PST)
Received: from ibmmail.COM (ibmmail.com [199.171.26.3]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id KAA26130 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 10:55:29 -0800 (PST)
From: uskanbye@ibmmail.com
Message-Id: <199702051855.KAA26130@miles.greatcircle.com>
Received: from ibmmail by ibmmail.COM (IBM VM SMTP V2R3) with BSMTP id 9360;
   Wed, 05 Feb 97 13:54:22 EST
Date: Wed, 05 Feb 1997 13:53:24 EST
To: firewalls@GreatCircle.COM
X-Sender-Info: Mitchell Ummel CSP CCP, KDHE Network Manager
               Office of Information Systems, Tech Services Section
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Subject: DLSw (Data Link Switching) through a firewall
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Question is how (or if) DLSw can be passed through a firewall (without
opening up the entire network). Our WAN includes remotes sites that are
running SNA encapsulated within IP (DLSw) via CISCO routers. We're
hoping to NOT have to move them to pure IP before firewall
implementation. Is anybody aware of implementation (or have done this)?
Any/all advice appreciated.

By the way, Eagle Raptor NT is the selected firewall...




     --------KANSAS DEPARTMENT OF HEALTH & ENVIRONMENT---------
     -----------------WWW.INK.ORG\PUBLIC\KDHE------------------
     ----------Mills Bldg Suite 501 Topeka, KS 66612-----------
     ---------Phone (913) 296-5643 FAX (913) 296-8943----------

From firewalls-owner  Wed Feb  5 11:50:45 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id KAA20890 for firewalls-outgoing; Wed, 5 Feb 1997 10:01:34 -0800 (PST)
Received: from zonk.geko.net.au (zonk.geko.net.au [203.2.239.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id KAA20790 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 10:00:52 -0800 (PST)
Received: from mozart.void.hell.net (dialup2057.geko.net.au [203.25.225.57]) by zonk.geko.net.au (8.7.5/8.6.12) with ESMTP id EAA02167; Thu, 6 Feb 1997 04:59:54 +1100 (EST)
Received: from beethoven ([192.168.0.2]) by mozart.void.hell.net
	 with smtp id m0vsBjj-000Jn4C
	(Debian Smail-3.2 1996-Jul-4 #2); Thu, 6 Feb 1997 05:06:23 +1100 (EST)
Message-Id: <m0vsBjj-000Jn4C@mozart.void.hell.net>
Date: Thu, 6 Feb 1997 04:59:54 +1000
From: <winspace@void.hell.net> (Norman Widders)
To: <firewalls@GreatCircle.COM>
Subject: Re: SATAN user group?
Reply-To: <winspace@geko.net.au>
Organisation: W.C.E. Consulting
X-Mailer: Mailbase for NT v1.2.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7BIT
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

In reply to the honourable 'frankw@in.net' who said:

> o The software was/is out-dated (even when it was released).  If you are 

This assumption is incorrect. The software was designed to perform basic diagnostics 
and port/services evaluation.

OTOH, all software is out-dated by the time its released, its only while its still 
fresh in the mind of the developer that its new. This is especially true for patches 
also. Take the latest set of sendmail patches from 8.7.x to 8.8.5 for example.

> o The SANTA tool performs a very small portion of the tests that ISS 

I said satan is one component, another tool in the IS suite. I also recommend 
tripwire, courtney, tcpdump, cops, tiger, hobgoblin, ISS, fwtk, crack and numerous 
others to provide a well rounded toolbox. One should never rely solely on one 
specific tool.

For further penetration testing write your own utilities, download the current 
black-hat rootkits, and examine thoroughly the actual system being tested.

> o A "clean bill of health" from the SANTA tool give the sysadmin a false 
>    sense of security about the security of his/her systems.

Any person that feels secure in their setup is at risk. A clean bill of health is 
only given by a Security consultant based on sound security practices and 
techniques. Using tools merely assists one here, but keep a healthy paranoia at all 
times.
 
> o At best, the SANTA tool will tell the beginner sysadmin if they 
>    have overlooked something basic, but beyond that, it is useless.

What is a beginner sysadmin doing in charge of security ? Security is for those with 
the required expertise.
 
> o Another nit is the choice of the name that was chosen.  In one stroke, 

This is a pointless argument that has been repeated over and over, acronyms are 
acronyms and usually goes into /dev/null.

> o It is my understanding that a trojan horse was planted (by a hacker)

If you run checksums on the binaries and only download from the original trusted 
site, then it is not an issue.


> You will probably find other tools which provide better coverage than the SANTA > 
tool. 

Complete coverage is not provided by any tool or tools, it is only through the IS 
personnels' knowledge and diligence that one attains 'complete coverage'. Which 
again relies partly on having a diverse range of tools to assist one in automating 
basic tasks.


> o Use the right tool for the right job.  A network security tool is only 
>    one of many tools which a skilled Information Security Officer uses 
>    to keep their environment secure.

This is what i have been saying all along. 


> show them that our typical network security analysis services (such as 
> Firewall Penetration Tests, etc.) discover far more potential probem 
> areas than the SANTA tool ever could.  

Assessing the risks and trouble spots in ones network/firewall is a multistep 
process, rearrange as per your preferences.
1. install and run the standard tools, check versions, holes etc.
2. write and run _your_ own specific scripts and programs.
3. investigate the known problem areas
4. manually go through ones own acquired checklist of problems.

Step 1 is where one hopefully makes use of tools like satan.

Are you advising people not to make use of an available tool ? or do we continue to 
reinvent the wheel.

> "much-feared" SANTA tool and the far more extensive tests that we run 
> makes *quite* a favorable impression on our customers.

Impressing customers is far less important than knowing the end result will be 
effective.

cheers

+------------------------------------------------------------+
|                                                            |
|   _/_/         _/_/     _/_/_/_/_/_/      _/_/_/_/_/_/     |
|   _/_/        _/_/     _/_/_/            _/_/              |
|    _/_/ _/_/ _/_/      _/_/              _/_/_/            |
|     _/_/_/_/_/_/       _/_/_/            _/_/              |
|      _/_/  _/_/         _/_/_/_/_/_/      _/_/_/_/_/_/     |
|                                                            |
| winspace@geko.net.au - Software Engineering in SQL and C++ |
+------------------------------------------------------------+



From firewalls-owner  Wed Feb  5 12:21:05 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA27559 for firewalls-outgoing; Wed, 5 Feb 1997 11:07:51 -0800 (PST)
Received: from darkstar.sysinfo.com (darkstar.sysinfo.com [204.246.65.62]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id LAA27550 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 11:07:38 -0800 (PST)
Received: from parka.winternet.com (dufresne@parka.winternet.com [198.174.169.9]) by darkstar.sysinfo.com (8.8.2/8.8.2) with SMTP id NAA15228; Wed, 5 Feb 1997 13:08:25 -0600
Date: Wed, 5 Feb 1997 12:58:31 -0600 (CST)
From: Ron DuFresne <dufresne@parka.winternet.com>
To: "Kolenko, Marc" <mmk@bostongas.com>
cc: firewalls@GreatCircle.COM
Subject: Re: Sandbox?
In-Reply-To: <4A30323C013C41D9@smtp.bostongas.com>
Message-ID: <Pine.GSO.3.95q.970205125722.29324A-100000@parka.winternet.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Wed, 5 Feb 1997, Kolenko, Marc wrote:

> Friends
> 
> can some one give me the 2 minute drill on the architectural definition 
> of "SANDBOX"?
> 
> Does it relate to typical DMZ configurations usually alluded to in 
> Firewall placement discussions?

If I'm recalling things correctly, the sandbox mentioned and refered to is
in reguards to chrooted systems.

Later,

Ron DuFresne
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
	***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D.  Just don't touch anything.


From firewalls-owner  Wed Feb  5 12:28:16 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA01204 for firewalls-outgoing; Wed, 5 Feb 1997 11:32:02 -0800 (PST)
Received: from andromeda.tectel.com.mx ([200.23.62.194]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id LAA01108 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 11:31:36 -0800 (PST)
Received: from port3.tectel.com.mx ([200.23.62.131])
          by andromeda.tectel.com.mx (Netscape Mail Server v2.0) with SMTP
          id AAA2232; Wed, 5 Feb 1997 13:20:38 -0600
Received: by port3.tectel.com.mx with Microsoft Mail
	id <01BC1369.07930260@port3.tectel.com.mx>; Wed, 5 Feb 1997 13:32:27 -0600
Message-ID: <01BC1369.07930260@port3.tectel.com.mx>
From: Colegio de Contadores <contanet@andromeda.tectel.com.mx>
To: "'Firewalls@GreatCircle.COM'" <Firewalls@GreatCircle.COM>
Cc: "'support@access1.sun.com'" <support@access1.sun.com>,
        "'support@sunsoft.com'" <support@sunsoft.com>
Subject: hardware requeriment.
Date: Wed, 5 Feb 1997 13:32:15 -0600
MIME-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



Hello . Im new in the list , and i=B4d like to talk about=20
Solaris Firewall .


	Wich is the recommended hardware for install this firewall
	over x86 plataform ?

	Procesor  ??

	Memory ?

	CPU clock ?

	Mi link is going to be a 128 kbps .

	Im thinking to use a vectra VE 486/66 of HP.


	Thanks for your comments.



Israel Zavalza Bahena
Contanet.

	

From firewalls-owner  Wed Feb  5 12:59:55 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA03985 for firewalls-outgoing; Wed, 5 Feb 1997 11:57:12 -0800 (PST)
Received: from firewall.uprc.com (sentry.uprc.com [144.94.230.3]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id LAA03978 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 11:57:01 -0800 (PST)
Received: by firewall.uprc.com; id AA05745; Wed, 5 Feb 97 13:55:11 CST
Received: from clavin.uprc.com(144.94.68.3) by firewall.uprc.com via smap (V3.1)
	id xma005740; Wed, 5 Feb 97 13:55:04 -0600
Received: from kafka.uprc.com by clavin (4.1/3.2.012693-Union Pacific Resources Company);
        id AA04784 for Firewalls@GreatCircle.COM; Wed, 5 Feb 97 13:54:30 CST
Received: by kafka.uprc.com (SMI-8.6/SMI-SVR4)
	id NAA17384; Wed, 5 Feb 1997 13:54:30 -0600
Date: Wed, 5 Feb 1997 13:54:30 -0600
From: z76399@uprc.com (Prahl V. E. (Von))
Message-Id: <199702051954.NAA17384@kafka.uprc.com>
To: Firewalls@GreatCircle.COM
Subject: http proxy problems / gauntlet
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

greetings,


we occasionally get the following errors from our netscape v 3.0 browser:

"The requested item could not be loaded by the proxy.

A ntework error occurred: unable to connect ot server (TCP Error:32) The server may be
down or unreachable.  Try connecting again later.

Proxy server at hostname.xxx.com on port 8080."

hostname.xxx.com is our webserver which is inside the firewall.  in the fireall messages i
get a security alert on unserved port 8080.  i am running gauntlet 3.1 on a sparc20
SunOS 4.1.4 and have http configed by the boot.  i have http pointing to port 80, which is the 
default. we actually are proxying http through the internal web machine.  i have no idea what is 
going on here.  any help on this one would be apprieciated.

thanks,


von prahl

From firewalls-owner  Wed Feb  5 13:09:34 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA02432 for firewalls-outgoing; Wed, 5 Feb 1997 11:44:09 -0800 (PST)
Received: from mail.Germany.EU.net (mail.germany.eu.net [192.76.144.65]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id LAA02403 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 11:43:47 -0800 (PST)
Received: by mail.Germany.EU.net with ESMTP (5.59+:34/EUnetD-2.6.1.h) via EUnet
	id UAA02095; Wed, 5 Feb 1997 20:42:36 +0100
Received: (from smap@localhost) by prosecco. (fw-afx-1) id UAA37708 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 20:43:05 +0100
Received: from cerberus.ak.munich.ibm.com(9.23.4.12) by prosecco.munich.ibm.de via smap (V1.3)
	id sma031560; Wed Feb  5 20:42:51 1997
Received: from barolo.ak.munich.ibm.com (barolo.ak.munich.ibm.com [9.23.4.120]) by cerberus (8.8.3/8.7afx1) with ESMTP id UAA15602 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 20:42:19 +0100
Received: (from afx@localhost) by barolo (8.8.5/8.7afx2) id UAA17998; Wed, 5 Feb 1997 20:42:17 +0100
Message-ID: <19970205204217.OK44797@barolo.ak.munich.ibm.com>
Date: Wed, 5 Feb 1997 20:42:17 +0100
From: afx@ibm.de (Andreas Siegert)
To: firewalls@greatcircle.com (Firewall mailing list)
Subject: [sscherrer@cits.com: Source port filtering rules...]
X-Mailer: Mutt 0.59.1
Mime-Version: 1.0
X-Organisation: EMEA AIX Security CoC / AIX ATG IBM Germany
X-Address: Anzinger Strasse 29, 81671 Muenchen, Germany
X-Phone: 498945044509 (internal 9454509), Fax 4223
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Sorry, but that sounds bogus to me.
Of course one filters on both source and destination port!
The guys who send you mail probably set up the bogus sendmail low port option.
Not reccomended...
afx

-----Forwarded message from sscherrer@cits.com (Stephane Scherrer)-----

       access-list 130 permit tcp any gt 1023 FWIPaddress FWnetmask eq 25

It didn't sound wrong for me...except when a remote site contacted me
saying that they couldn't send us any Mail...
Furether investigation showed that their Mail packets in destination of
our Mail server had a source port below 1024... I reported the problem
to them and they investigate on their side...

Here lies the problem :
They were said by Checkpoint software (who installed their firewall
including a NAT) that we shouldn't filter incoming packets on the source
port !!!!

-----End of forwarded message-----

-- 
Andreas Siegert       afx@ibm.de / afx@barolo.ak.munich.ibm.com / AFX at IPNET
Every time we've moved ahead in IBM, it was because someone was willing to take
a chance, put his head on the block, and try something new - Thomas Watson, Jr.

From firewalls-owner  Wed Feb  5 13:20:37 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id MAA05038 for firewalls-outgoing; Wed, 5 Feb 1997 12:05:09 -0800 (PST)
Received: from gw.iai.com (gw.iai.com [206.64.157.62]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id MAA04926 for <firewalls@GreatCircle.com>; Wed, 5 Feb 1997 12:04:28 -0800 (PST)
Received: by gw.iai.com; id PAA12630; Wed, 5 Feb 1997 15:03:09 -0500 (EST)
Received: from milford.ma.iai.com(10.1.1.2) by gw.iai.com via smap (3.2)
	id xma012627; Wed, 5 Feb 97 15:02:47 -0500
Received: by milford.iai.com (AIX 4.1/UCB 5.64/4.03)
          id AA21770; Wed, 5 Feb 1997 15:03:13 -0500
From: jegan@iai.com (James Egan)
Message-Id: <9702052003.AA21770@milford.iai.com>
Subject: Re: SATAN user group?
To: firewalls@GreatCircle.com
Date: Wed, 5 Feb 1997 15:03:13 -0500 (EST)
In-Reply-To: <9702051543.AA08998@sonic.nmti.com.nmti.com> from "Peter da Silva" at Feb 5, 97 09:43:45 am
Reply-To: Jim.Egan@iai.com
Organization: Integrated Architectures, Inc.
Pgp-Fingerprint: 64 47 DC 51 D9 11 1D FF  31 43 9C 4C E2 A1 FC 04
Pgp-Public-Key: public-key-server@martigny.ai.mit.edu (subject: GET jegan) 
X-Mailer: ELM [version 2.4 PL24 ME5a]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Peter da Silva recently wrote:
> 
> > o Another nit is the choice of the name that was chosen.  In one stroke, 
> >    DF & WV managed to alienate those who are offended by the name "SATAN".  
> >    The name SATAN signifies the epitome of evil.  If the tool was intended
> >    to be used for good rather than evil purposes, the choice of the name 
> >    was the worst one possible.  I don't know the agenda behind the name,
> >    but I am curious why they chose that particular name than any of a
> >    multitude of other suitable names.
> 
> What, you mean like maybe "the Farmer Universal Cracking Kit"? <g>
> 
> 

Actually, the docs I saw a while back said if you didn't like SATAN then call
it SANTA.

/Jim/
--
James P. Egan                   | Jim.Egan@iai.com 
Integrated Architectures, Inc.  | http://www.iai.com 
300 East Main Street, Suite 207 | Tel: 508-634-3200 x209
Milford, MA  01757              | Fax: 508-634-8381
Use PGP for more secure email

From firewalls-owner  Wed Feb  5 13:34:28 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA29149 for firewalls-outgoing; Wed, 5 Feb 1997 11:20:12 -0800 (PST)
Received: from ALABAMA.CF.CS.YALE.EDU (RT-GW.CS.YALE.EDU [128.36.0.13]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id LAA29133 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 11:19:59 -0800 (PST)
From: long-morrow@CS.YALE.EDU
Received: from SPARKY.CF.CS.YALE.EDU by ALABAMA.CF.CS.YALE.EDU (8.7.1/res.host.cf-4.0)
	with ESMTP id OAA22917; Wed, 5 Feb 1997 14:18:33 -0500 (EST) sender long-morrow@CS.YALE.EDU for 
Received: by SPARKY.CF.CS.YALE.EDU (Sendmail-8.7.1/res.client.cf-4.0)
	id OAA27745; Wed, 5 Feb 1997 14:18:30 -0500 (EST)
Date: Wed, 5 Feb 1997 14:18:30 -0500 (EST)
Message-Id: <199702051918.OAA27745@SPARKY.CF.CS.YALE.EDU>
To: firewalls@greatcircle.com, mmk@bostongas.com
Subject: Re:  Sandbox?
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


From: "Kolenko, Marc" <mmk@bostongas.com>
>can some one give me the 2 minute drill on the architectural definition 
>of "SANDBOX"?

Though you speak of firewall DMZ configurations I've usually seen this
term (sandbox) used to refer to the rubber-walled "jail" environments
set up for software to run inside on a computer.

The computer may be a server in the example of a Web server process
running 'chroot()d' on a Unix machine -- and where even the CGI programs
spawned by http server run inside the 'defanged/neutered' chroot()
'sandbox' environment.

'sandbox' is also used to refer to the 'safe' mode the Java Virtual
Machine turns on when Java applets are run inside a Web browser
(ie. Netscape Navigator or MS IE) -- where local file I/O and most
network I/O is disabled.

- Morrow


From firewalls-owner  Wed Feb  5 16:33:39 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id PAA27419 for firewalls-outgoing; Wed, 5 Feb 1997 15:23:42 -0800 (PST)
Received: from travelers.mail.cornell.edu (TRAVELERS.MAIL.CORNELL.EDU [132.236.56.13]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id PAA27410 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 15:23:33 -0800 (PST)
From: nvs2@cornell.edu
Received: from travelers.mail.cornell.edu (travelers.mail.cornell.edu [132.236.56.13]) by travelers.mail.cornell.edu (8.7.5/8.7.3) with SMTP id SAA06190 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 18:22:07 -0500 (EST)
Date: Wed, 5 Feb 1997 18:22:06 -0500 (EST)
X-Sender: nvs2@travelers.mail.cornell.edu
To: firewalls@greatcircle.com
Subject: Packet Filter rules...
Message-ID: <Pine.SOL.3.91.970205181527.3915B-100000@travelers.mail.cornell.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,
I am implementing a firewall as a Master's project and I need to decide 
on rules for packet filtering. I have two questions to ask you folks:

(1) Can anyone suggest research papers/books/web documents on packet 
filtering?

(2) I was told that a packet filter should check for various combinations 
of :
Source Address, Destn Address, protocol, Source port, destn port

 and then decide if a packet should be let thro.
Also, this decision making has to be real fast so as not to introduce a 
considerable amount of overhead while routing the packet.
Does any one have any suggestions on how this can be done?

Thanks in advance

Nik.
----

From firewalls-owner  Wed Feb  5 16:34:18 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id PAA26934 for firewalls-outgoing; Wed, 5 Feb 1997 15:14:54 -0800 (PST)
Received: from tango.lightech.com.ar ([200.0.253.151]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id PAA26916 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 15:14:38 -0800 (PST)
Received: from salsa (router1-p14.pccp.com.ar [200.0.253.30]) by tango.lightech.com.ar (8.6.8.1/SCA-6.6)  with SMTP
	id XAA12867; Wed, 5 Feb 1997 23:03:29 GMT
Message-ID: <32F8BDB6.1630@lightech.com.ar>
Date: Wed, 05 Feb 1997 20:04:54 +0300
From: "Adrian F. Setton" <asetton@lightech.com.ar>
Reply-To: asetton@lightech.com.ar
Organization: LighTech
X-Mailer: Mozilla 3.0 (Win95; I)
MIME-Version: 1.0
To: Andreas Siegert <afx@ibm.de>
CC: Firewall mailing list <firewalls@greatcircle.com>
Subject: Re: [sscherrer@cits.com: Source port filtering rules...]
References: <19970205204217.OK44797@barolo.ak.munich.ibm.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Andreas Siegert wrote:
> Sorry, but that sounds bogus to me.
> Of course one filters on both source and destination port!
> The guys who send you mail probably set up the bogus sendmail low port option.
> Not reccomended...

Andreas,
I don't agree in this point.
Let me quote Firewalls & Internet Securiy from Bill Cheswick & Steve
Bellovin,
page 24, assuming that they will allow this little quote from this great
book
(marketing add., in order to avoid their lawyers)

"Most versions of TCP and UDP for UNIX systems enforce the rule that
only the superuser (root) can create a port numbered less than 1024.
These are privileged ports. The intent is that remote systems can trust
the authenticity of information written to such ports. The restriction
is a convention only, and is <i> not </i> required by the protocol
specification. Conforming implementations need not honor this."

Altough it is usual to put filtering rules using non-privileged ports as
the
only valid client ports, this is wrong and we should not blame the
remote user,
but change the filtering rules to allow this valid connections.
Regards ...
--
Adrian F. Setton
LighTech                        Voice:  (54-1) 373-1141
Ayacucho 563. Piso 13 Of. "A"   FAX:    (54-1) 373-1215
Buenos Aires                    e-mail: asetton@lightech.com.ar
Argentina                       URL:    http://www.lightech.com.ar

From firewalls-owner  Wed Feb  5 16:34:13 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA13663 for firewalls-outgoing; Wed, 5 Feb 1997 13:16:06 -0800 (PST)
Received: from fti.framatech.com ([160.84.80.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id NAA13629 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 13:15:49 -0800 (PST)
From: Thutchens@framatech.com
Received: by fti.framatech.com; id QAA25594; Wed, 5 Feb 1997 16:37:50 -0500
Received: from ftimail.framatech.com(160.84.100.246) by fti.framatech.com via smap (3.2)
	id xma025560; Wed, 5 Feb 97 16:37:40 -0500
Received: from ccmail.framatech.com (ccmail.framatech.com [160.84.100.247]) by ftimail.framatech.com (8.6.11/8.6.9) with SMTP id QAA04046; Wed, 5 Feb 1997 16:17:13 -0500
Received: from ccMail by ccmail.framatech.com (SMTPLINK V2.11.01)
	id AA855188085; Wed, 05 Feb 97 15:34:09 EST
Date: Wed, 05 Feb 97 15:34:09 EST
Message-Id: <9701058551.AA855188085@ccmail.framatech.com>
To: firewalls@GreatCircle.COM, "Kolenko, Marc" <mmk@bostongas.com>
Subject: Re: Sandbox?
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

     You're exactly right!


______________________________ Reply Separator _________________________________
Subject: Sandbox?
Author:  "Kolenko, Marc" <mmk@bostongas.com> at INTERNET
Date:    2/5/97 2:31 PM


Friends
     
can some one give me the 2 minute drill on the architectural definition 
of "SANDBOX"?
     
Does it relate to typical DMZ configurations usually alluded to in 
Firewall placement discussions?
     
thanks in advance
     
Marc
******************************************* 
Marc M. Kolenko, Boston Gas Co.
Strategic IT Planning
mkolenko@bostongas.com
     -or-
kolenko@tiac.net
617.723.5512; x-2669
*******************************************
     
-------------------------------------------------------------------------- 
---------
"The opinions expressed here are my own and 
do not represent the views or opinions of Boston Gas Co." 
-------------------------------------------------------------------------- 
---------
     


From firewalls-owner  Wed Feb  5 17:14:20 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA17121 for firewalls-outgoing; Wed, 5 Feb 1997 13:46:57 -0800 (PST)
Received: from reflections.mindspring.com (reflections.mindspring.com [204.180.142.192]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id NAA17097 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 13:46:39 -0800 (PST)
Received: from localhost (lists@localhost) by reflections.mindspring.com (8.7.6/8.7.3) with SMTP id QAA15733; Wed, 5 Feb 1997 16:45:17 -0500
Date: Wed, 5 Feb 1997 16:45:17 -0500 (EST)
From: Todd Graham Lewis <lists@reflections.mindspring.com>
To: Ron DuFresne <dufresne@parka.winternet.com>
cc: "Kolenko, Marc" <mmk@bostongas.com>, firewalls@GreatCircle.COM
Subject: Re: Sandbox?
In-Reply-To: <Pine.GSO.3.95q.970205125722.29324A-100000@parka.winternet.com>
Message-ID: <Pine.LNX.3.95.970205164159.13253C-100000@reflections.mindspring.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Wed, 5 Feb 1997, Ron DuFresne wrote:

> If I'm recalling things correctly, the sandbox mentioned and refered to is
> in reguards to chrooted systems.

Mostly, it refers to environments such as SafeTCL and Netscape's Java
implementation, wherein applets/tasks/processes run in a restricted
run-time environment (the Sandbox) where they have restricted access to
such facilities as network access, local file access, etc.  chroot()++, so
to speak.  This stops rogue Java applets from reading your password file
and sending it back to the server, etc.

See also, antonym, ActiveX.

__
Todd Graham Lewis          Mindspring Enterprises      tlewis@mindspring.com


From firewalls-owner  Wed Feb  5 17:16:17 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA17297 for firewalls-outgoing; Wed, 5 Feb 1997 13:47:51 -0800 (PST)
Received: from hermes.zynet.net (hermes.zynet.net [194.154.160.251]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id NAA17119 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 13:46:55 -0800 (PST)
Received: from Fred.zynet.co.uk (ex1-p5.zynet.co.uk [194.154.163.6]) by hermes.zynet.net (8.8.0/8.6.12) with SMTP id VAA07338 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 21:45:41 GMT
Message-ID: <32F8FF16.32BE@mail.zynet.co.uk>
Date: Wed, 05 Feb 1997 21:43:51 +0000
From: Kevin Townsend <kev-rhea@mail.zynet.co.uk>
Reply-To: kev-rhea@mail.zynet.co.uk
X-Mailer: Mozilla 3.0Gold (Win95; I)
MIME-Version: 1.0
To: firewalls@GreatCircle.COM
Subject: Re: [Fwd: Internal modems ?]
References: <32EFC6B0.41C67EA6@iphase.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Pierre-Yves Bonnetain wrote:
> >
> >    Hello you experts,
> >
> >    Maybe this subject has been dealt with to the point of sickness, but...
> >    One of my customers is looking for a _systematic_ way (well, as near as
> > possible, as usual) to detect if any internal user, on his network, may have
> > some modem attached to his computer (W95, OS/2 or Unix). I just told him that
> > this seemed dubious at most, but customers are customers.
> >    So, what is your opinion ?
> >    Tia,
> > --
> > -+-+ Pierre-Yves BONNETAIN (aka Pyb)


In April, Rhea Group will be launching a new Win 95 security product.
One of its features might possibly help. It doesn't detect modems - but
it can be used to prevent their use on all or specified workstations on
the network.

If you'd like any more info on this, mail me and I'll see to it.

Rgds

Kev


From firewalls-owner  Wed Feb  5 17:27:55 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA23464 for firewalls-outgoing; Wed, 5 Feb 1997 14:32:51 -0800 (PST)
Received: from mule0.mindspring.com (mule0.mindspring.com [204.180.128.166]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id OAA23417 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 14:32:35 -0800 (PST)
Received: from [207.69.170.17] (user-37kbahm.dialup.mindspring.com [207.69.170.54])
          by mule0.mindspring.com (8.8.4/8.8.4) with SMTP
	  id RAA05982 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 17:31:20 -0500
Date: Wed, 5 Feb 1997 17:31:20 -0500
X-Sender: pelicans@pop.mindspring.com
Message-Id: <v01540b0daf1e745e44a5@[207.69.170.17]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: Firewalls@GreatCircle.COM
From: pelicans@mindspring.com (BeachCruiser)
Subject: TEMPEST
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Joel wrote:

>Not really firewall related, but according to the Feds, TEMPEST is a
>codeword, and not an acronym that means anything.

You're right on the relevance.

However, some "Feds" nothwithstanding...

...as set forth in the classified SECRET NSA publication, "National
Communication Security Implementation Memorandum" (NACSIM 5100A)...

K.M. Goertzel and Jody Patilla have it exactly correct.


TEMPEST = Transient Electro-Magnetic Pulse Emanation STandard
          ^         ^       ^        ^     ^         ^^

//rmck







From firewalls-owner  Wed Feb  5 17:59:28 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA25476 for firewalls-outgoing; Wed, 5 Feb 1997 14:51:30 -0800 (PST)
Received: from mule0.mindspring.com (mule0.mindspring.com [204.180.128.166]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id OAA25467 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 14:51:10 -0800 (PST)
Received: from [207.69.170.17] (user-37kbahm.dialup.mindspring.com [207.69.170.54])
          by mule0.mindspring.com (8.8.4/8.8.4) with SMTP
	  id RAA45890 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 17:49:55 -0500
Date: Wed, 5 Feb 1997 17:49:55 -0500
X-Sender: pelicans@pop.mindspring.com
Message-Id: <v01540b0eaf1e7a91b99c@[207.69.170.17]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: Firewalls@GreatCircle.COM
From: pelicans@mindspring.com (BeachCruiser)
Subject: TEMPEST
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


K.M. Goertzel and Jody Patilla have it exactly correct.


TEMPEST = Transient Electro-Magnetic Pulse Emanation STandard
          ^         ^       ^        ^     ^         ^^

Sorry...so did Brett Lymn



Thread Dead.







From firewalls-owner  Wed Feb  5 18:03:19 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id QAA03452 for firewalls-outgoing; Wed, 5 Feb 1997 16:23:02 -0800 (PST)
Received: from csam.com.my (csam.csam.com.my [202.184.8.8]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id QAA03383 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 16:22:34 -0800 (PST)
Received: by csam.com.my (SMI-8.6/SMI-SVR4)
	id IAA25874; Thu, 6 Feb 1997 08:20:15 +0800
Date: Thu, 6 Feb 1997 08:20:14 +0800 (SGT)
From: Ng Yiu Cho - CSD SUNSSD <ycng@csam.com.my>
To: Colegio de Contadores <contanet@andromeda.tectel.com.mx>
cc: Firewalls@GreatCircle.COM
Subject: Re: hardware requeriment.
In-Reply-To: <01BC1369.07930260@port3.tectel.com.mx>
Message-ID: <Pine.SOL.3.91.970206081536.25707A-100000@csam>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Content-Transfer-Encoding: QUOTED-PRINTABLE
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi

There recommended hardware requirement that I would=20
suggest will be=20

CPU - Get a Pentium Processor 166 or better
Memory -  > 64MB Ram
Hard Disk - > 2.1 GB
Running using Solaris x86 2.5.1


....joey

On Wed, 5 Feb 1997, Colegio de Contadores wrote:

>=20
>=20
> Hello . Im new in the list , and i=B4d like to talk about=20
> Solaris Firewall .
>=20
>=20
> =09Wich is the recommended hardware for install this firewall
> =09over x86 plataform ?
>=20
> =09Procesor  ??
>=20
> =09Memory ?
>=20
> =09CPU clock ?
>=20
> =09Mi link is going to be a 128 kbps .
>=20
> =09Im thinking to use a vectra VE 486/66 of HP.
>=20
>=20
> =09Thanks for your comments.
>=20
>=20
>=20
> Israel Zavalza Bahena
> Contanet.
>=20
> =09
>=20

From firewalls-owner  Wed Feb  5 18:32:17 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA25369 for firewalls-outgoing; Wed, 5 Feb 1997 14:50:39 -0800 (PST)
Received: (mcb@localhost) by miles.greatcircle.com (8.8.5/Miles-960830-1) id OAA25303 for firewalls@greatcircle.com; Wed, 5 Feb 1997 14:50:16 -0800 (PST)
Received: from abyss.techsoft.com (abyss.techsoft.com [205.160.68.2]) by miles.greatcircle.com (8.7.4/Miles-960830-1) with SMTP id FAA16715 for <firewalls@GreatCircle.COM>; Tue, 4 Feb 1997 05:41:00 -0800 (PST)
Received: from cc:Mail (PU Serial #1520)
  by abyss.techsoft.com (PostalUnion/SMTP(tm) v2.1.9e for Windows NT(tm))
  id AA-1997Feb04.073438.1520.7012; Tue, 04 Feb 1997 07:35:41 -0600
From: kabernard@techsoft.com (KABERNARD)
Cc: firewalls@GreatCircle.COM (firewalls)
Message-ID: <1997Feb04.073438.1520.7012@abyss.techsoft.com>
X-Conversion-ID: <cc:Mail/#87732/TECHSOFT>
X-Mailer: cc:Mail via PostalUnion/SMTP for Windows NT
Mime-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable
Organization: Technical Software Services, Inc.
Date: Tue, 04 Feb 1997 07:35:41 -0600
Subject: Re: Poor NSA...Hells freezin' over again.
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

 If someone is unhappy with the level of testing that someone else has =
 performed on some firewall, then they must know something that was not =
 tested (or tested correctly).  If they want or need to know the =
 results of the correctly executed test(s), they should perform the =
 test. Then, they should post the results here, since that is supposed =
 to be the purpose of this list.  Unless of course the person who is =
 unhappy with someone else's work is unwilling to share his own =
 work.....
 =
 y/p kurt
 =
 =



From firewalls-owner  Wed Feb  5 18:52:24 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id QAA01744 for firewalls-outgoing; Wed, 5 Feb 1997 16:04:52 -0800 (PST)
Received: from pbm01.pacblue.com (pbm01.pacblue.com [199.182.109.200]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id QAA01706 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 16:04:35 -0800 (PST)
Received: by pbm01.pacblue.com with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63)
	id <01BC1379.A11CEFD0@pbm01.pacblue.com>; Wed, 5 Feb 1997 15:31:17 -0800
Message-ID: <c=US%a=_%p=Pacific_Blue_Mic%l=PBM01-970205233115Z-690@pbm01.pacblue.com>
From: Paul Osterwald <posterwald@pacblue.com>
To: "'Paul D. Robertson'" <proberts@clark.net>,
        "'Frank Willoughby'"
	 <frankw@in.net>
Cc: "'winspace@geko.net.au'" <winspace@geko.net.au>,
        "'firewalls@GreatCircle.COM'" <firewalls@GreatCircle.COM>
Subject: RE: SATAN user group?
Date: Wed, 5 Feb 1997 15:31:15 -0800
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

SATAN - Security Administrator's Tool for Analyzing Networks

>-----Original Message-----
>From:	Paul D. Robertson [SMTP:proberts@clark.net]
>Sent:	Tuesday, February 04, 1997 9:57 PM
>To:	Frank Willoughby
>Cc:	winspace@geko.net.au; firewalls@GreatCircle.COM
>Subject:	Re: SATAN user group?
>
>On Tue, 4 Feb 1997, Frank Willoughby wrote:
>
>> o The software was/is out-dated (even when it was released).  If you are 
>>    keeping your software current, then it is highly likely that your system
>>    will contain patches for vulnerabilities that the SANTA tool would
>>detect.
>
>From what I've heard, the 3rd pre-release was very agressive, and like 
>all tools, it needs to remain current.  
>
>>    because of problems in other areas, your system is vulnerable to being
>>    taken over - in spite of a report from SANTA that your system is OK.
>>    Use the right tool for the right job.  SANTA tests (primarily) the
>>    networking component, and it doesn't do that very well, IMHO.
>
>It's quite specifically targeted for networks.
>
>> 
>> o The SANTA tool performs a very small portion of the tests that ISS 
>>    and other vendors' products perform.  If it doesn't test for attacks
>>    such as SYN-flooding or the "Ping-of-death", then it can't tell you
>>    if these will be a problem for you or not.
>
>It's very difficult to run a denial-of-service attack without denying 
>service, don't you think?   Most of us who claim it doesn't do enough are 
>the same ones who would claim it did too much for the bad guys if it were 
>released with a more agressive suite of tests.
>
>> o A "clean bill of health" from the SANTA tool give the sysadmin a false 
>>    sense of security about the security of his/her systems.
>
>If they don't know what it does, and doesn't do.  This is true of *every* 
>analysis tool. 
>
>> o At best, the SANTA tool will tell the beginner sysadmin if they 
>>    have overlooked something basic, but beyond that, it is useless.
>
>It's extensible, and that's one of it's main features, if you don't grow 
>it, then yes, it's not much more than a rubber stamp for a limited set of 
>vulnerabilities, that's true of any analysis tool in a dynamic environment.
>
>> o Another nit is the choice of the name that was chosen.  In one stroke, 
>>    DF & WV managed to alienate those who are offended by the name "SATAN".
>>    The name SATAN signifies the epitome of evil.  If the tool was intended
>>    to be used for good rather than evil purposes, the choice of the name 
>>    was the worst one possible.  I don't know the agenda behind the name,
>>    but I am curious why they chose that particular name than any of a
>>    multitude of other suitable names.
>
>If the name of a program is that bad to someone, then I'd respectfully
>suggest that they're in the wrong line of work.  Given, if I recall 
>correctly, Dan's naming of a program Fuck!, SATAN could even be 
>considered a step up. :) 
>
>> o Further, since the source code is available, any sysadmin can add 
>>    custom modules to the tool (OTOH, so can the hackers).
>
>With a C compiler, any sysadmin can write nice helpful programs.  On the 
>other hand, evil hackers can write mean and nasty programs.  ?
>
>Paul
>-----------------------------------------------------------------------------
>Paul D. Robertson      "My statements in this message are personal opinions
>proberts@clark.net      which may have no basis whatsoever in fact."
>                                                                     PSB#9280
>

From firewalls-owner  Wed Feb  5 20:22:39 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id RAA06982 for firewalls-outgoing; Wed, 5 Feb 1997 17:01:09 -0800 (PST)
Received: from relay.hq.tis.com (relay.hq.tis.com [192.94.214.100]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id RAA06921 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 17:00:46 -0800 (PST)
Received: by relay.hq.tis.com; id UAA06099; Wed, 5 Feb 1997 20:00:30 -0500 (EST)
Received: from clipper.hq.tis.com(10.33.1.2) by relay.hq.tis.com via smap (3.2)
	id xma006088; Wed, 5 Feb 97 20:00:13 -0500
Received: from jupiter.hq.tis.com (jupiter.hq.tis.com [10.33.112.189]) by clipper.hq.tis.com (8.7.5/8.7.3) with SMTP id TAA00547; Wed, 5 Feb 1997 19:56:35 -0500 (EST)
From: Jody C Patilla <jcp@tis.com>
Message-Id: <199702060056.TAA00547@clipper.hq.tis.com>
Subject: Re: Packet Filter rules...
To: nvs2@cornell.edu
Date: Wed, 5 Feb 1997 19:56:38 -0500 (EST)
Cc: firewalls@greatcircle.com
In-Reply-To: <Pine.SOL.3.91.970205181527.3915B-100000@travelers.mail.cornell.edu> from "nvs2@cornell.edu" at Feb 5, 97 06:22:06 pm
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> Hi,
> I am implementing a firewall as a Master's project and I need to decide 
> on rules for packet filtering. I have two questions to ask you folks:
> 
> (1) Can anyone suggest research papers/books/web documents on packet 
> filtering?
> 

Chapter 6 of _Building Internet Firewalls_ from O'Reilly, by Chapman and
Zwicky, is the single best discussion of packet filtering that I have read
anywhere. I highly recommend it to all my customers. Brent and ELizabeth ought 
to be giving me a commission for the sales I've generated for them. :-)

- jcp

-- 
=========================================================================
Jody C. Patilla						jcp@tis.com
Trusted Information Systems				Glenwood, Md.


From firewalls-owner  Wed Feb  5 20:23:45 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id RAA07521 for firewalls-outgoing; Wed, 5 Feb 1997 17:04:16 -0800 (PST)
Received: from extra.infocable.cl (extra.infocable.cl [200.29.55.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id RAA07330 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 17:03:21 -0800 (PST)
Received: by extra.infocable.cl (951211.SGI.8.6.12.PATCH1042/951211.SGI.AUTO)
	for <firewalls@greatcircle.com> id WAA20501; Wed, 6 Nov 1996 22:06:13 -0800
Received: from intranet(192.10.1.2) by extra via smap (3.1)
	id xma020498; Wed, 6 Nov 96 22:06:12 -0800
Message-ID: <32817C54.41C6@infocable.cl>
Date: Wed, 06 Nov 1996 22:06:12 -0800
From: "Eduardo Romero U." <edo@intranet.infocable.cl>
Organization: Infocable Chile.
X-Mailer: Mozilla 3.0C-SGI (X11; I; IRIX 6.2 IP22)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: Re: http proxy problems / gauntlet
References: <199702051954.NAA17384@kafka.uprc.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Prahl V. E. (Von) wrote:
> 
> greetings,
> 
> we occasionally get the following errors from our netscape v 3.0 browser:
> 
> "The requested item could not be loaded by the proxy.
> [ common message of refused proxy ] 
> hostname.xxx.com is our webserver which is inside the firewall.  in the fireall messages i
> get a security alert on unserved port 8080.  i am running gauntlet 3.1 on a sparc20

few mounths ago have the same problem with gauntlet 3.1 [ sgi 5.3 - 6.2]
and the problem was in howto to determinate de metric value of gated
configuration, so the refused occurs when a make a first connection,
the same happens with telnet, ftp , any tcp-application , but when u try
to reconect , this was succesfull. The default metric is 0 , but i have
to reconfigurate the router of firewall's out network with a this metric
value in theirs routes with the local network.
 

> SunOS 4.1.4 and have http configed by the boot.  i have http pointing to port 80, which is the
> default. we actually are proxying http through the internal web machine.  i have no idea what is
> going on here.  any help on this one would be apprieciated.
> 
so hints : gated metric , router tables and ipfilter permissions.

> thanks,
> 
> von prahl

Edo.

From firewalls-owner  Wed Feb  5 20:34:19 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id TAA27703 for firewalls-outgoing; Wed, 5 Feb 1997 19:45:25 -0800 (PST)
Received: from fire.epa.nsw.gov.au (fire.EPA.NSW.GOV.AU [141.243.34.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id TAA27693 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 19:45:13 -0800 (PST)
Received: from airmoon.epa.nsw.gov.au by fire.epa.nsw.gov.au
 (PMDF V4.3-7 #6932) id <01IF3IRQOTAO003PR6@fire.epa.nsw.gov.au>; Thu,
 6 Feb 1997 13:35:48 +10:00
Received: from neptune.epa.nsw.gov.au (neptune [141.243.6.5])
 by airmoon.epa.nsw.gov.au (8.6.12/8.6.12) with SMTP id OAA20170 for
 <Firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 14:19:30 +1100
Date: Thu, 06 Feb 1997 13:45:15 +1100 (EST)
From: Mitko Stoyanov <mstoyan@airmoon.epa.nsw.gov.au>
Subject: Dynamic (per user) dial-in PPP IP filtering
In-reply-to: <c=US%a=_%p=sapient%l=SAPIENT/SMTPGATE/000909F3@galaxy.sapient.com>
X-Sender: mstoyan@neptune.epa.nsw.gov.au
To: Firewalls@GreatCircle.COM
Message-id: <Pine.LNX.3.95.970206132757.3870A-100000@neptune.epa.nsw.gov.au>
MIME-version: 1.0
Content-type: TEXT/PLAIN; charset=US-ASCII
Content-transfer-encoding: 7BIT
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Hi,

I am after any links or information which would help me to achieve the
above. The filter rules has to be dynamically inserted when the relevant
user logs in, and removed, when he/she logs out. There will be no more
than 4 - 8 groups of filter rules. There are multiple dial-in ports with
static IP addresses, and when the user logs out, only the rules regarding
the used port/IP address should be removed.I did it already with Linux
2.0.28, modified pppd and perl scripts, but was wondering if any other
solution exist already.

Anyone to share experience? Will summarize if the interest is enough.

Thanks in advance. 


From firewalls-owner  Wed Feb  5 20:52:31 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id TAA27278 for firewalls-outgoing; Wed, 5 Feb 1997 19:35:28 -0800 (PST)
Received: from mule0.mindspring.com (mule0.mindspring.com [204.180.128.166]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id TAA27271 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 19:35:19 -0800 (PST)
Received: from [207.69.170.17] (user-37kbah1.dialup.mindspring.com [207.69.170.33])
          by mule0.mindspring.com (8.8.4/8.8.4) with SMTP
	  id WAA69792; Wed, 5 Feb 1997 22:34:02 -0500
Date: Wed, 5 Feb 1997 22:34:02 -0500
X-Sender: pelicans@pop.mindspring.com
Message-Id: <v01540b1aaf1eb9697d60@[207.69.170.17]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: kabernard@techsoft.com (KABERNARD)
From: pelicans@mindspring.com (BeachCruiser)
Subject: Re: Poor NSA...Hells freezin' over again.
Cc: Firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> If someone is unhappy with the level of testing that someone else has
>performed on some firewall, then they must know something that was not
>tested (or tested correctly).  If they want or need to know the  results
>of the correctly executed test(s), they should perform the  test. Then,
>they should post the results here, since that is supposed  to be the
>purpose of this list.  Unless of course the person who is  unhappy with
>someone else's work is unwilling to share his own  work.....
>  y/p kurt

Yeah, understand your point...but I'm not sure that's really what was being
conveyed in the earlier gripe.

I've heard from alot of folks backchannel on this and my reading of the
"tea leaves" is it's not really unhappiness with the testing that's at
issue, but rather the depth and comprehensiveness of the evaluations beyond
what to many regard as rather academic findings and marketing bla-bla-bla.

Let's see where it goes from here.

//rmck









From firewalls-owner  Wed Feb  5 21:04:35 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id UAA00481 for firewalls-outgoing; Wed, 5 Feb 1997 20:32:42 -0800 (PST)
Received: from diablo.cisco.com (diablo.cisco.com [171.68.223.106]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id UAA00463 for <firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 20:32:25 -0800 (PST)
Received: from clonvick-pc.cisco.com (sj-dial-3-28.cisco.com [171.68.179.29]) by diablo.cisco.com (8.8.5/CISCO.SERVER.1.2) with SMTP id UAA28974; Wed, 5 Feb 1997 20:31:15 -0800 (PST)
Message-Id: <2.2.32.19970206042809.006fb13c@diablo.cisco.com>
X-Sender: clonvick@diablo.cisco.com
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Wed, 05 Feb 1997 22:28:09 -0600
To: uskanbye@ibmmail.com, firewalls@GreatCircle.COM
From: Chris Lonvick <clonvick@cisco.com>
Subject: Re: DLSw (Data Link Switching) through a firewall
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello Mitchell,

>From RFC-1795:

---snip---
Wells & Bartky                                   [...at the end of Page 5]

RFC 1795                  Data Link Switching                 April 1995

   The default parameters associated with the TCP connections between
   Data Link Switches are as follows:

   Socket Family     AF_INET        (Internet protocols)
   Socket Type       SOCK_STREAM    (stream socket)
   Read Port Number  2065
   Write Port Number 2067
---/snip---

If you're just doing normal DLSw with TCP encapsulation, then you'll need 
to open these ports through your firewall.  If you're prioritizing this 
data by using the "priority" keyword in the DLSw remote peer statement, 
then the router will additionally open TCP ports 1981, 1982, and 1983.  

If your firewall is performing NAT, then this should still work (if you're not 
using any of the additional features of DLSw+), since none of the payload 
fields are dependent upon any of the TCP or IP fields.  However, I've been
told that Boarder Peers (part of DLSw+ from Cisco) won't work across a
NATificator since the payload of some of the packets contains the IP address 
of the dynamic peers.  This just means that you'll have to setup actual
peer statements.  

Beyond this, however, I'd examine the traffic you expect to send through your
firewall very carefully before committing to this.  Historically, SNA stuff is
pretty vital to an organization and all efforts should be made to keep this
from prying eyes.  You might want to encrypt this over a Virtual Private Network
between your firewalls.  NetBIOS/NetBEUI (the other reason for DLSw) is the 
encapsulation of a data stream into an evil, and non-routable protocol and 
should be eradicated.  (In my humble and personal opinion, of course ;-)  

Hope this helps,

Chris Lonvick
Cisco Systems
Consulting Engineering
Houston, TX, USA
+1-713-778-5663


At 01:53 PM 2/5/97 EST, uskanbye@ibmmail.com wrote:
>
>Question is how (or if) DLSw can be passed through a firewall (without
>opening up the entire network). Our WAN includes remotes sites that are
>running SNA encapsulated within IP (DLSw) via CISCO routers. We're
>hoping to NOT have to move them to pure IP before firewall
>implementation. Is anybody aware of implementation (or have done this)?
>Any/all advice appreciated.
>
>By the way, Eagle Raptor NT is the selected firewall...
>
>
>
>
>     --------KANSAS DEPARTMENT OF HEALTH & ENVIRONMENT---------
>     -----------------WWW.INK.ORG\PUBLIC\KDHE------------------
>     ----------Mills Bldg Suite 501 Topeka, KS 66612-----------
>     ---------Phone (913) 296-5643 FAX (913) 296-8943----------
>
>


From firewalls-owner  Wed Feb  5 21:18:55 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id SAA16586 for firewalls-outgoing; Wed, 5 Feb 1997 18:10:51 -0800 (PST)
Received: from snet ([202.190.59.4]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id SAA16541 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 18:10:27 -0800 (PST)
Received: from sos.dataprep.com.my by snet (SMI-8.6/SMI-SVR4)
	id KAA09431; Thu, 6 Feb 1997 10:17:48 -0800
Received: by sos.dataprep.com.my with Microsoft Mail
	id <01BC1416.3D1A48A0@sos.dataprep.com.my>; Thu, 6 Feb 1997 10:12:20 +-800
Message-ID: <01BC1416.3D1A48A0@sos.dataprep.com.my>
From: KENNETH PHANG <kent@dataprep.com.my>
To: "'Firewall digest'" <firewalls@greatcircle.com>
Subject: Security Design Issue 
Date: Thu, 6 Feb 1997 10:12:18 +-800
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi everybody,

	Recently i'm looking into some of the network security design issue =
which i need second opinion from you guys. One of my customer has a =
network that runs on the FR cloud with about 13 remote sites link up to =
their enterprise router in the HQ. Each of the link are running a T1 and =
share a sigle E1 link into the HQ with partially  mesh environment with =
OSPF. Probably you can look at the diagram below for better =
understanding:-

=09
		R1	R2	R3	R4	R.. Remote sites
		 |	 |	 |	 |	 |
		 |	 |	 |	 |	 | T1 link
		  \	 |	 |	 |	/
		    \	 |	 |	 |        /
		=09
			 (  Frame Relay	) _____________Internet

				 |    E1 link
				 R0			 R0 - HQ router
				 |			 R1 - Remote router site 1
				HQ			 R2 - Remote router site 2
				 |
				 |	LAN
		---------------------------------------------------

The FR provider already built their PVCs from all the remote sites to =
the HQ and another PVC from the HQ to the=20
Internet. The HQ enterprise router can support multiple IP address =
configuration onto the same physical SYNC and Ethernet interface. I've =
been ask what is the best way to protect the network environment with =
FW-1. Sensitive information flow from the remote sites to the HQ must be =
protected so as the treat from Internet. By the way the FW-1 is also =
required to provide NAT to the remote sites and the HQ LAN. The customer =
to utilise the E1 link both for the remote links so as the Internet =
link. I understand that this is not a very good idea especially for =
security point of view. Hope to hear from you'll soon. All your comments =
are highly appreciated.=20

Many thanz

Cheers
kent
				

From firewalls-owner  Wed Feb  5 21:20:01 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id TAA24736 for firewalls-outgoing; Wed, 5 Feb 1997 19:14:36 -0800 (PST)
Received: from ginger.vnet.net (ginger.vnet.net [166.82.1.69]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id TAA24705 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 19:14:19 -0800 (PST)
Received: from galip.hon.com (galip.vnet.net [166.82.174.200]) by ginger.vnet.net (8.8.4/8.8.2) with SMTP id WAA08736 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 22:13:46 -0500 (EST)
Received: from galip.hon.com (galip.hon.com [166.82.174.200]) by galip.hon.com (NTMail 3.02.10) with ESMTP id ia000216 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 22:09:00 -0500
Message-ID: <32F949B5.21FC@hon.com>
Date: Wed, 05 Feb 1997 22:02:13 -0500
From: Steve Gallipeau <Steve@hon.com>
Reply-To: Steve@hon.com
Organization: SDG Consulting
X-Mailer: Mozilla 3.0Gold (WinNT; I)
MIME-Version: 1.0
To: Firewalls@GreatCircle.COM
Subject: Email Crashed Mail Server!
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Info: Evaluation version at galip.hon.com
X-Info: Errors to Postmaster@hon.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

I received the following email (had to dig it out of my logs) that
crashed my Mail Server.  I would really appreciate anyone taking a look
at the headers and maybe be able to advise me why this crashed my server
and if it could have been intentional.  The 'To:' line in particular
looks very unusual.

Thanks,

Steve
SDG Consulting

----------------------------------------------------------------------
Received: from cliffy.lfwc.lockheed.com (cliffy.lfwc.lockheed.com
[143.114.72.1]) by galip.hon.com (NTMail 3.02.10) with ESMTP id Steve
for <STEVE@HON.COM>; Wed, 5 Feb 1997 21:46:32 -0500
Received: from mailhub by cliffy.lmtas.lmco.com (SMI-8.6/SMI-SVR4)
	id UAA25797; Wed, 5 Feb 1997 20:49:17 -0600
Received: from smtpgate.lmtas.lmco.com by mailhub (SMI-8.6/SMI-SVR4)
	id UAA13466; Wed, 5 Feb 1997 20:42:43 -0600
Received: by smtpgate.lmtas.lmco.com (AlisaMail V05.1-000d) 
    id Megw.4950221 ; Wed, 5 Feb 1997 20:47:36 -0600
Message-ID: <Megw.4950221@smtpgate.lmtas.lmco.com>
Date: Wed, 05 Feb 1997 19:33:00 -0600
From: "Hammons, Steven W" <HMMNSW@SMTPGATE.lmtas.lmco.com>
Subject: test 1
To: STEVE@HON.COM,
       
"27#e##034#Steve_Hammons#034##c##c#26#e##034#STEVE_HAMMONS#034##c##c#25#e#SMTP"@SMTPGATE.lmtas.lmco.com,
        HMMNSW@SMTPGATE.lmtas.lmco.com
X-Info: Evaluation version at galip.hon.com
X-Info: Errors to Postmaster@hon.com


Date      :  5-FEB-1997 19:33:00.00
Posted on :  5-FEB-1997 19:33:00.00
this is to 
"26=("Steve Hammons"
HMMNSWAB@smtpgate.lmtas.lmco.com)::25=smtp"@smtpgate



----------
Received: from mailhub.lmtas.lmco.com by smtpgate.lmtas.lmco.com
        with SMTP (AlisaMail M05.1-000) 
        id SINN.1737164@smtpgate.lmtas.lmco.com ; Wed, 5 Feb 1997
20:12:17 -0600
Received: from smtpgate.lmtas.lmco.com by mailhub (SMI-8.6/SMI-SVR4)
        id UAA13290; Wed, 5 Feb 1997 20:07:03 -0600
Received: by smtpgate.lmtas.lmco.com (AlisaMail V05.1-000d) 
    id Megw.4949841 ; Wed, 5 Feb 1997 20:07:48 -0600
Message-ID: <Megw.4949841@smtpgate.lmtas.lmco.com>
Date: Wed, 05 Feb 1997 19:33:00 -0600
From: "Hammons, Steven W" <HMMNSWAB@SMTPGATE.lmtas.lmco.com>
Subject: test 1
To: "Steve Hammons"HMMNSWAB@smtpgate.lmtas.lmco.com


From firewalls-owner  Wed Feb  5 21:52:49 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id QAA05537 for firewalls-outgoing; Wed, 5 Feb 1997 16:49:03 -0800 (PST)
Received: (mcb@localhost) by miles.greatcircle.com (8.8.5/Miles-960830-1) id QAA05525 for firewalls@greatcircle.com; Wed, 5 Feb 1997 16:48:53 -0800 (PST)
Received: from darkstar.sysinfo.com (darkstar.sysinfo.com [204.246.65.62]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id KAA21006 for <Firewalls@GreatCircle.COM>; Wed, 5 Feb 1997 10:02:55 -0800 (PST)
Received: from localhost (dufresne@localhost [127.0.0.1]) by darkstar.sysinfo.com (8.8.2/8.8.2) with SMTP id MAA15107; Wed, 5 Feb 1997 12:03:23 -0600
Date: Wed, 5 Feb 1997 12:03:23 -0600 (CST)
From: "R. DuFresne" <dufresne@darkstar.sysinfo.com>
To: linux-security@redhat.com
cc: BUGTRAQ@NETSPACE.ORG, Firewalls@GreatCircle.COM
Subject: Re: [linux-security] Re: Re: Linux virus
In-Reply-To: <199702051433.OAA02123@snowcrash.cymru.net>
Message-ID: <Pine.LNX.3.95.970205115852.14711B-100000@darkstar.sysinfo.com>
Organization: Minn. Information Systems
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Wed, 5 Feb 1997, Alan Cox wrote:

> > 	In any event -- McAfee may be able to add this to 
> > 	their existing uvscan product.  uvscan scan Linux
> > 	filesystems for DOS and Windows (including Word Macro)
> > 	viruses.   It may be possible for the AV team to 
> > 	simply add bliss' signature to the next release -- and
> > 	it may even be possible for them to create a remover.
> 
> I've had a look at the algorithms used for this "Bliss" toy. Its quite
> interesting as its a completely portable technique. It works for NT
> DLL's it works for all Unixen.
> 
> Tripwire pretty much immediately spots such tampering.
> 


I find this aspect of 'portability' interesting.  One of the security
weinies where I'm presently contracted <folks here make great use of NT>
made a claim in a class he was teaching, that it's far to costly to write
viri for 32bit OS'.  Since the class wasn't about viri, and this side
issue was brought up for just a short note, I chose not at the time to
challenge the issue.  Anyone willing to share some clues with folks like
me here?

thanks, my best to all,

Ron Dufresne
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
	admin & senior consultant:  darkstar.sysinfo.com
		  http://darkstar.sysinfo.com
"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
	***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D.  Just don't touch anything.



From firewalls-owner  Wed Feb  5 22:53:18 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id WAA21247 for firewalls-outgoing; Wed, 5 Feb 1997 22:47:16 -0800 (PST)
Received: from glacier.wise.edt.ericsson.se (glacier-ext.wise.edt.ericsson.se [193.180.251.38]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id WAA21186 for <firewalls@greatcircle.com>; Wed, 5 Feb 1997 22:47:01 -0800 (PST)
Received: from curtis.nmac.ericsson.se (curtis.nmac.ericsson.se [130.100.187.66]) by glacier.wise.edt.ericsson.se (8.7.5/8.7.3/glacier-0.9) with SMTP id HAA10890 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 07:45:52 +0100 (MET)
Received: by curtis.nmac.ericsson.se (SMI-8.6/SMI-SVR4)
	id HAA13071; Thu, 6 Feb 1997 07:43:28 +0100
Date: Thu, 6 Feb 1997 07:43:28 +0100
From: etxrosd@nmac.ericsson.se (Robert Stahlbrand)
Message-Id: <199702060643.HAA13071@curtis.nmac.ericsson.se>
To: firewalls@greatcircle.com
Subject: Configuring SecureID in FW-1
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-MD5: JvNWURNsNKqUy4vORm/n2g==
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi everyone!

I'm trying to configure secureID for users who uses my telnet proxy in 
Checkpoints FW-1 ver.2.1 but it doesn't seem to work. What I'm trying to 
configure is this.....

We have a modempool outside our firewall and if the users need access to our 
intranet I thought that secureID would be an easy way for the users to login. It 
seems to be pretty safe and pretty easy for the users. I use the telnet (ftp, 
http as well) proxy function so the users must pass through the proxy to enter 
the internal network. I have configured a number of users and it's no problem 
with UNIX passwords, Internal passwords or S/Key but I don't get the 
secureID-function to work!!! And how should it work??? I got a card but I don't 
see where I should put in the serial-number for the card in the firewall!!! How 
will the firewall be able to understand which card the user have got? I 
understand that the FW must be time synchronized because the secureID card 
changes the displayed number every 10 seconds. When I choose secureID in the 
user setup I am prompted for nothing else???

My FW-1 handbook says nothing about secureID (almost nothing). Do you have to 
buy an extra license or something???

###########################################################
#                 Robert Stahlbrand                       #
# Network and System Administrator OPLab and NMAC domains #
#                                                         #
#                 Ericsson Telecom AB                     #
#                      Box 333                            #
#                   43184 Molndal                         #
#                      Sweden                             #
#                  +46 31 7476162                         #
#                  +46 31 7472942 (fax)                   #
#                                                         #
#              robert@nmac.ericsson.se                    #
###########################################################

From firewalls-owner  Thu Feb  6 01:19:08 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id BAA29874 for firewalls-outgoing; Thu, 6 Feb 1997 01:04:09 -0800 (PST)
Received: from didahp1.deis.unibo.it (didahp1.deis.unibo.it [137.204.56.18]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id AAA29578 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 00:59:43 -0800 (PST)
Message-Id: <199702060859.AAA29578@miles.greatcircle.com>
Received: by didahp1.deis.unibo.it
	(1.37.109.4/16.2) id AA14101; Thu, 6 Feb 97 10:58:08 +0100
From: Rebecca Montanari - tesista Corradi <rebecca@didahp1.deis.unibo.it>
Subject: problem with TIS on Solaris2.5
To: firewalls@greatcircle.com
Date: Thu, 6 Feb 97 10:58:08 MET
Mailer: Elm [revision: 70.85]
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I'm installing TIS toolkit on Solaris2.5 and
I'm having lots of problems in compiling it
and making it work.
Has anyone compiled TIS toolkit on the same OS
and can I have suggestions on what I have to do?
Thanks in advance
Rebecca

From firewalls-owner  Thu Feb  6 01:49:25 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id BAA02971 for firewalls-outgoing; Thu, 6 Feb 1997 01:36:35 -0800 (PST)
Received: from gk-blue.unicc.org (gk-red.unicc.org [192.91.247.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id BAA02953 for <Firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 01:36:25 -0800 (PST)
From: admin@unicc.org
Received: by gk-blue.unicc.org; (5.65v3.2/1.3/10May95) id AA15958; Thu, 6 Feb 1997 10:37:38 +0100
Received: by gh-old.unicc.org (5.65/jsb-190694);
	id AA07401; Thu, 6 Feb 1997 10:37:42 +0100
Message-Id: <9702060937.AA07401@gh-old.unicc.org>
To: Firewalls@GreatCircle.COM
Subject: PPTP and Firewalls 
Date: Thu, 06 Feb 97 10:37:36 +0100
X-Mts: smtp
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Does anybody knows how I can use PPTP to a RAS server that is behind a firewall?

I can install a generic relay, but I do not know on with port. I have godd Unix 
knowledge, but wiht Windows NT I feel a bit lost ....



Thanks, Lili

From firewalls-owner  Thu Feb  6 03:19:15 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id DAA10370 for firewalls-outgoing; Thu, 6 Feb 1997 03:16:03 -0800 (PST)
Received: from ibmmail.COM (ibmmail.com [199.171.26.3]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id DAA10357 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 03:15:56 -0800 (PST)
From: gblolmxb@ibmmail.com
Message-Id: <199702061115.DAA10357@miles.greatcircle.com>
Received: from ibmmail by ibmmail.COM (IBM VM SMTP V2R3) with BSMTP id 1568;
   Thu, 06 Feb 97 06:14:50 EST
Date: Thu, 06 Feb 1997 06:13:52 EST
To: firewalls@greatcircle.com
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Subject: Firewall 1 & Bay Routers
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


     I understand that Bay are planning to incorporate checkpoint's
     firewall-1 within their router's s/w. My gut reaction is that this is
     not a Good Idea - any comments?

     Mark.

From firewalls-owner  Thu Feb  6 04:19:24 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id EAA13509 for firewalls-outgoing; Thu, 6 Feb 1997 04:05:12 -0800 (PST)
Received: from relay-7.mail.demon.net (relay-7.mail.demon.net [194.217.242.9]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id EAA13489 for <Firewalls@greatcircle.com>; Thu, 6 Feb 1997 04:04:56 -0800 (PST)
Received: from scio.demon.co.uk ([158.152.150.17]) by relay-5.mail.demon.net
           id aa529371; 6 Feb 97 10:13 GMT
From: Mike Blaser <Mike@scio.demon.co.uk>
To: Firewalls@greatcircle.com
Subject: Charge-Back
Date: Thu, 06 Feb 1997 10:12:59 GMT
Organization: Vertex Data Systems Ltd.
Reply-To: mike@scio.demon.co.uk
Message-ID: <32f98158.13483437@post.demon.co.uk>
X-Mailer: Forte Agent .99g/32.326
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

A question for all you corporate types out there.

Does anyone use the reporting capabilities of their firewall to allocate
costs to individual depratments/users so as to enable a charge-back
structure for internet usage?  Do most firewalls allow reporting on this
sort of basis or would a seperate package have to be used, in which case
which ones are out there and what do people recommend?

Cheers

Mike
--
Mike Blaser  -  IT Security Analyst                 mike@scio.demon.co.uk
Vertex Data Science Ltd                               +44 (0) 1925 236831
TA29, Dawson House                 Comments and opinions are those of the
Great Sankey, Warrington, UK    author and not of Vertex Data Science Ltd

From firewalls-owner  Thu Feb  6 04:34:28 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id EAA14344 for firewalls-outgoing; Thu, 6 Feb 1997 04:23:43 -0800 (PST)
Received: from gfw.siemens.co.za ([196.27.60.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id EAA14334 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 04:23:15 -0800 (PST)
Received: by gfw.siemens.co.za; id OAA09709; Thu, 6 Feb 1997 14:19:13 +0200
Received: from unknown(150.207.254.15) by gfw.siemens.co.za via smap (V3.1.1)
	id xmaa09703; Thu, 6 Feb 97 14:19:10 +0200
Received: by sparkex.siemens.co.za with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63)
	id <01BC1439.1F1962A0@sparkex.siemens.co.za>; Thu, 6 Feb 1997 14:22:02 +0200
Message-ID: <c=ZA%a=TELKOM400%p=SCN%l=SPARKEX-970206122200Z-22789@sparkex.siemens.co.za>
From: "Sizer, Kevin" <KevinS@Siemens.co.za>
To: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: Gauntlet ver 3.12
Date: Thu, 6 Feb 1997 14:22:00 +0200
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Any ideas on how to crack this number? All in the cause of a better
system.
KevinS

From firewalls-owner  Thu Feb  6 05:05:04 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id EAA14918 for firewalls-outgoing; Thu, 6 Feb 1997 04:34:57 -0800 (PST)
Received: from castle.us-state.gov (castle.us-state.gov [198.76.102.19]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id EAA14896 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 04:34:33 -0800 (PST)
From: crumrig@us-state.gov
Received: by castle.us-state.gov; id AA15140; Thu, 6 Feb 97 07:33:05 EST
Received: from pubhost.us-state.gov(198.76.102.34) by castle.us-state.gov via smap (V1.3mjr)
	id sma015125; Thu Feb  6 07:32:16 1997
Received: by pubhost.us-state.gov; id AA14976; Thu, 6 Feb 97 07:32:07 EST
Date: Thu,  6 Feb 97 07:21:06 PST
Subject: RE: Packet Filter rules... 
To: firewalls@greatcircle.com, nvs2@cornell.edu
X-Mailer: Chameleon ENGP1, TCP/IP for Windows, NetManage Inc.
Message-Id: <Chameleon.970206073120.gary@crumrig.fadpc.im,us-state.gov>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Try going to the mountain and speaking with GOD.  Markus Ranum has his security white papers located at www.v-one.com.  I assume you know who Markus Ranum is, if not then you should take up some other major, like basket weaving or such.  Actually, I am just kidding.  As you probably know, Markus wrote FW Toolkit.  He is now working at v-one and all of his stuff is there for reading.  I also would suggest hitting the NCSA's website and getting ahold of some of the books they have for sale..  Lastly, a packet filter router, is a very good tool, and should be a part of any system that is being implimented.  And, it possibly could manage to work for small to medium operations, but they are not a Firewall in hte truest sense of the word.  Now there are some nice features that CISCO will try and sell you, but when it comes to proxy services, and configurability AND reporting, then true dual homed proxy firewalls are the only way to go Period!  Packet filters are good as tools as p!
art of a bigger system, but that i
s all.  Besides the lack of reporting on a router, I could kill your router with traffic and have free reign on your system while the router is rebooting itself.  As far as speed goes, don't worry about it.  Unless of sourse you have 2ooo node lan, all using http and sending a million messages an hour.
---------------Original Message---------------
Hi,
I am implementing a firewall as a Master's project and I need to decide 
on rules for packet filtering. I have two questions to ask you folks:

(1) Can anyone suggest research papers/books/web documents on packet 
filtering?

(2) I was told that a packet filter should check for various combinations 
of :
Source Address, Destn Address, protocol, Source port, destn port

 and then decide if a packet should be let thro.
Also, this decision making has to be real fast so as not to introduce a 
considerable amount of overhead while routing the packet.
Does any one have any suggestions on how this can be done?

Thanks in advance

Nik.
----


----------End of Original Message----------



From firewalls-owner  Thu Feb  6 05:19:46 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id FAA17799 for firewalls-outgoing; Thu, 6 Feb 1997 05:00:07 -0800 (PST)
Received: from mailsrv1.pcy.mci.net (mailsrv1.pcy.mci.net [204.71.0.43]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id EAA17751 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 04:59:48 -0800 (PST)
Received: from mikeep01.wachovia.com (usr16-dialup40.Atlanta.mci.net)
 by MAIL-CLUSTER.PCY.MCI.NET (PMDF V5.0-7 #10044)
 id <01IF36ZMAOFK8WWBWS@MAIL-CLUSTER.PCY.MCI.NET>; Thu,
 06 Feb 1997 07:58:46 -0500 (EST)
Received: from mikeep01.wachovia.com (usr16-dialup40.Atlanta.mci.net)
 by MAIL-CLUSTER.PCY.MCI.NET (PMDF V5.0-7 #10045)
 id <01IF36YY39QQ8Y58AJ@MAIL-CLUSTER.PCY.MCI.NET>; Thu,
 06 Feb 1997 07:58:02 -0500 (EST)
Date: Thu, 06 Feb 1997 07:54:34 +0000
From: Mike Parsons <109j9jph6ig4@mail04.internetMCI.com>
Subject: Re: Firewall 1 & Bay Routers
To: firewalls@greatcircle.com, gblolmxb@ibmmail.com
Reply-to: mike.parsons@internetmci.com
Message-id: <01IF36YYF3GK8Y58AJ@MAIL-CLUSTER.PCY.MCI.NET>
MIME-version: 1.0
X-Mailer: Pegasus Mail for Win32 (v2.42a)
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Comments: Authenticated sender is <109j9jph6ig4@mail04.internetMCI.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

It can have its advantages.  The Checkpoint 1 software can offer 
significant improvement to the packet filtering capabilities of a 
router that is serving the role of a screening router on the 
perimeter.

At the risk of causing undue discussion, though, I still feel obliged 
to point out that this should be in conjunction with a real proxy 
host.  I have my inate paranoia to protect 8^).

From firewalls-owner  Thu Feb  6 05:40:54 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id FAA20358 for firewalls-outgoing; Thu, 6 Feb 1997 05:23:40 -0800 (PST)
Received: from anaf04.amsterdam.nl ([145.222.17.29]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id FAA20292 for <FireWalls@GreatCircle.com>; Thu, 6 Feb 1997 05:23:14 -0800 (PST)
Received: from anaf01.amsterdam.nl ([145.222.33.39]) by anaf04.amsterdam.nl (8.6.12/8.6.9) with SMTP id OAA22775 for <FireWalls@GreatCircle.com>; Thu, 6 Feb 1997 14:03:31 +0100
Received: from AMSTERDAM-Message_Server by anaf01.amsterdam.nl
	with Novell_GroupWise; Thu, 06 Feb 1997 14:23:54 +0100
Message-Id: <s2f9e97a.075@anaf01.amsterdam.nl>
X-Mailer: Novell GroupWise 4.1
Date: Thu, 06 Feb 1997 14:21:41 +0100
From: Ewout Meij <BSD02.EMEIJ@anaf01.amsterdam.nl>
Reply-To: BSD02.EMEIJ@anaf01.amsterdam.nl
To: FireWalls@GreatCircle.com
Subject: Other protocols
Mime-Version: 1.0
Content-Type: text/plain
Content-Disposition: inline
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Great think-tank:

Is there anybody outthere who does this:

   |----- LAN 1 -----| with: IPX/SPX-TCP/IP-DEC-IBM
        |
       FW
        |
     |----- LAN 2 -----| with: TCP/IP only
                   |
                  FW
                   |
   |----- LAN 3 -----| with: IPX/SPX-TCP/IP-DEC-IBM

And yes there needs to be comm. between the LAN1 & LAN3 on all the 
mentioned protocols... is there any FW's on the marked thar are
'especaily' good at this? Am I in fact looking for a bunch of proxies?

As I am claiming your time anyway here is the next: what about this
config:

   |---net1---|TCP/IP only
        |
       FW
        |
   |---net2---| SPX/IPX only
        |
       FW
        |
   |---net3---|TCP/IP only

Does this sounds like anything you've come across? and what about it?

Ewout Meij

Contrary to popular belief, Unix is user friendly. 
It just happens to be very selective about who it decides to make friends with.

From firewalls-owner  Thu Feb  6 05:59:56 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id FAA22168 for firewalls-outgoing; Thu, 6 Feb 1997 05:42:56 -0800 (PST)
Received: from pdx1.world.net (pdx1.world.net [192.243.32.18]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id FAA22153 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 05:42:44 -0800 (PST)
From: proff@suburbia.net
Received: from suburbia.net (suburbia.net [203.4.184.1]) by pdx1.world.net (8.7.5/8.7.3) with SMTP id FAA09342 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 05:43:01 -0800 (PST)
Received: (qmail 1429 invoked by uid 110); 6 Feb 1997 13:41:13 -0000
Message-ID: <19970206134113.1427.qmail@suburbia.net>
Subject: Re: Packet Filter rules...
In-Reply-To: <Chameleon.970206073120.gary@crumrig.fadpc.im,us-state.gov> from "crumrig@us-state.gov" at "Feb 6, 97 07:21:06 am"
To: crumrig@us-state.gov
Date: Fri, 7 Feb 1997 00:41:13 +1100 (EST)
Cc: firewalls@greatcircle.com
X-Mailer: ELM [version 2.4ME+ PL28 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Try going to the mountain and speaking with GOD.  Markus Ranum has

As much as one may respect MJR, God doesn't write buffer over-runs in
firewalls.

--
Prof. Julian Assange  |If you want to build a ship, don't drum up people
		      |together to collect wood and don't assign them tasks
proff@iq.org          |and work, but rather teach them to long for the endless
proff@gnu.ai.mit.edu  |immensity of the sea. -- Antoine de Saint Exupery

From firewalls-owner  Thu Feb  6 06:35:42 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA25041 for firewalls-outgoing; Thu, 6 Feb 1997 06:10:12 -0800 (PST)
Received: from deere-bh.dx.deere.com (deere-bh.dx.deere.com [207.122.201.66]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA25031 for <Firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 06:10:03 -0800 (PST)
Received: (from uucp@localhost) by deere-bh.dx.deere.com (8.6.12/8.6.11) id IAA03423; Thu, 6 Feb 1997 08:10:07 -0600
Received: from 192.43.1.3 by deere-bh.dx.deere.com via smap (V1.3)
	id sma003149; Thu Feb  6 08:09:42 1997
Received: from 90.deere.com (dts.90.deere.com) by deere.dx.deere.com (4.1/SMI-4.0)
	id AA28511; Thu, 6 Feb 97 08:08:22 CST
Received: from t47up.90.deere.com by 90.deere.com (SMI-8.6/SMI-SVR4)
	id IAA17023; Thu, 6 Feb 1997 08:05:51 -0600
Message-Id: <32F9E5C6.287C@90.deere.com>
Date: Thu, 06 Feb 1997 08:08:06 -0600
From: Bertrum Carroll <bc17684@90.deere.com>
Organization: Deere & Company
X-Sender: Bertrum Carroll <bc17684@90.deere.com>
X-Mailer: Mozilla 4.0b1 (Win95; I)
Mime-Version: 1.0
To: admin@unicc.org
Cc: Firewalls@GreatCircle.COM
Subject: Re: PPTP and Firewalls
X-Priority: Normal
References: <9702060937.AA07401@gh-old.unicc.org>
Content-Type: multipart/mixed; boundary="----------511E25927B301"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

This is a multi-part message in MIME format.
------------511E25927B301
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=us-ascii

Does anyone know how to do PPTP with out the 255  or 254 concurrent 
user limit in RAS ?
------------511E25927B301
Content-Transfer-Encoding: 7bit
Content-Description: Address Book Card for Bertrum Carroll
Content-Disposition: inline; filename="nsmailCE.TMP"
Content-Type: text/x-vCard; charset=us-ascii; name="nsmailCE.TMP"

BEGIN:VCARD
FN:Bertrum Carroll
N:Carroll;Bertrum
EMAIL;INTERNET:bc17684@90.deere.com
NOTE:Deere & Company Computer Security
X-NAV-HTML:T
END:VCARD


------------511E25927B301--


From firewalls-owner  Thu Feb  6 07:06:35 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA26217 for firewalls-outgoing; Thu, 6 Feb 1997 06:16:42 -0800 (PST)
Received: from callisto.lif.icnet.uk (callisto.lif.icnet.uk [143.65.100.5]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA26135 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 06:16:12 -0800 (PST)
Received: from localhost
           by callisto.lif.icnet.uk with SMTP(5.65v3.0/6.2); Thu, 6 Feb 1997 14:12:26 GMT
Date: Thu, 6 Feb 1997 14:12:26 +0000 (GMT)
From: John Hopkins <hopkins@icrf.icnet.uk>
X-Sender: hopkins@callisto.lif.icnet.uk
To: proff@suburbia.net
Cc: crumrig@us-state.gov, firewalls@greatcircle.com
Subject: Re: Packet Filter rules...
In-Reply-To: <19970206134113.1427.qmail@suburbia.net>
Message-Id: <Pine.OSF.3.93.970206141143.8018B-100000@callisto.lif.icnet.uk>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hmm.
	I don't know of a firewall package that God has written. 

John Hopkins


On Fri, 7 Feb 1997 proff@suburbia.net wrote:

> > Try going to the mountain and speaking with GOD.  Markus Ranum has
> 
> As much as one may respect MJR, God doesn't write buffer over-runs in
> firewalls.
> 
> --
> Prof. Julian Assange  |If you want to build a ship, don't drum up people
> 		      |together to collect wood and don't assign them tasks
> proff@iq.org          |and work, but rather teach them to long for the endless
> proff@gnu.ai.mit.edu  |immensity of the sea. -- Antoine de Saint Exupery
> 


From firewalls-owner  Thu Feb  6 07:25:53 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA03304 for firewalls-outgoing; Thu, 6 Feb 1997 07:14:35 -0800 (PST)
Received: from ultra1.dreamscape.com (ultra1.dreamscape.com [206.64.128.7]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id HAA03295 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 07:14:27 -0800 (PST)
Received: from bertha (sa2.dreamscape.com [206.114.183.131])
          by ultra1.dreamscape.com (8.8.5/8.8.4) with ESMTP
	  id KAA29422 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 10:14:24 -0500 (EST)
Message-ID: <32F9F533.64D2@dreamscape.com>
Date: Thu, 06 Feb 1997 10:13:55 -0500
From: "Steven E. Matkoski" <matkoski@dreamscape.com>
Organization: Blue Cross Blue Shield of CNY
X-Sender: "Steven E. Matkoski" <matkoski@dreamscape.com>
X-Mailer: Mozilla 4.0b1 (WinNT; I)
MIME-Version: 1.0
To: Firewall mailing list <firewalls@greatcircle.com>
Subject: Guantlet on Solaris: Installation question.
X-Priority: Normal
Content-Type: multipart/alternative; boundary="----------34855444F6A2"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


------------34855444F6A2
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=us-ascii

Hi,

I am about to start installing Guantlet on Solaris 2.5.1 and wondered if
there was anything
I should do to harden the OS before installation?

--
Thanks!
-steve.
matkoski@dreamscape.com


------------34855444F6A2
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset=us-ascii

<HTML><BODY>

<DT>Hi,</DT>

<DT>&nbsp;</DT>

<DT>I am about to start installing Guantlet on Solaris 2.5.1 and wondered
if there was anything</DT>

<DT>I should do to harden the OS before installation?</DT>

<DT><BR>
--&nbsp;<BR>
Thanks!<BR>
-steve.<BR>
matkoski@dreamscape.com<BR>
&nbsp;</DT>

</BODY>
</HTML>
------------34855444F6A2--


From firewalls-owner  Thu Feb  6 07:43:12 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA29047 for firewalls-outgoing; Thu, 6 Feb 1997 06:37:58 -0800 (PST)
Received: from homeport.org (lighthouse.homeport.org [205.136.65.198]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id GAA29003 for <firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 06:37:33 -0800 (PST)
Received: (adam@localhost) by homeport.org (8.8.5/8.6.9) id JAA26381; Thu, 6 Feb 1997 09:33:01 -0500 (EST)
From: Adam Shostack <adam@homeport.org>
Message-Id: <199702061433.JAA26381@homeport.org>
Subject: Re: Packet Filter rules...
In-Reply-To: <19970206134113.1427.qmail@suburbia.net> from "proff@suburbia.net" at "Feb 7, 97 00:41:13 am"
To: proff@suburbia.net
Date: Thu, 6 Feb 1997 09:33:00 -0500 (EST)
Cc: crumrig@us-state.gov, firewalls@GreatCircle.COM
X-Mailer: ELM [version 2.4ME+ PL27 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

proff@suburbia.net wrote:
| > Try going to the mountain and speaking with GOD.  Markus Ranum has
| 
| As much as one may respect MJR, God doesn't write buffer over-runs in
| firewalls.

	God doesn't write firewalls.  Anyone who can create a world in
7 days can clearly secure every app on their entire network.  He just
uses a couple of packet filters to cause endless philisophical
arguments about 'can god create a network so large that he can't
secure it?'

Adam
-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume



From firewalls-owner  Thu Feb  6 07:59:26 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA07789 for firewalls-outgoing; Thu, 6 Feb 1997 07:39:15 -0800 (PST)
Received: from cptech.com (tanis.tiac.net [204.215.141.78]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id HAA07773 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 07:39:06 -0800 (PST)
Received: by cptech.com (5.x/SMI-SVR4)
	id AA04434; Thu, 6 Feb 1997 10:37:40 -0500
Date: Thu, 6 Feb 1997 10:37:40 -0500
From: dcosio@tanis.cptech.com (Dave Cosio)
Message-Id: <9702061537.AA04434@cptech.com>
To: firewalls@greatcircle.com
Subject: Re: Firewall 1 & Bay Routers
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



If you think about it. A firewall is nothing more
than a secure router. With varing levels of security.
Why would you want to waste hardware resource on a 
full-blown O.S (UNIX or Nt) on a router. I think this
is a great idea. I suspect you will get good-great security
with excellent performance. 


-------------------------------------------------------------------------------

Dave Cosio					Corporate Technologies Inc.
Systems Consultant				Tel 508.459.2420 x20
Network Security and Systems Integrators        100 foot of John Street
http://www.cptech.com				Lowell Massachusetts

"Make mine a Smutty"  -Smuttynose Brewing Co slogan.
                                        



From firewalls-owner  Thu Feb  6 08:30:55 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA07623 for firewalls-outgoing; Thu, 6 Feb 1997 07:37:43 -0800 (PST)
Received: from europa.lif.icnet.uk (europa.lif.icnet.uk [143.65.100.4]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id HAA07420 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 07:36:55 -0800 (PST)
From: harley@icrf.icnet.uk
Message-Id: <199702061536.HAA07420@miles.greatcircle.com>
Received: by europa.lif.icnet.uk; Thu, 6 Feb 1997 15:35:50 GMT
Subject: Re: Packet Filter rules...
To: hopkins@icrf.icnet.uk (John Hopkins)
Date: Thu, 6 Feb 1997 15:35:50 +0000 (GMT)
Cc: firewalls@greatcircle.com
In-Reply-To: <Pine.OSF.3.93.970206141143.8018B-100000@callisto.lif.icnet.uk> from "John Hopkins" at Feb 6, 97 02:12:26 pm
X-Mailer: ELM [version 2.4 PL23]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> Hmm.
> 	I don't know of a firewall package that God has written. 
> 
> John Hopkins
> 

Why should SATAN have all the best tunes? B-)

-- 
David Harley                     \   |   /                 alt.comp.virus FAQ
D.Harley@icrf.icnet.uk            \  |  /               & Anti-Virus Web Page
Support & Security Analyst         \ | /         Folk London On-Line gig-list
Imperial Cancer Research Fund   ____\|/____   http://webworlds.co.uk/dharley/


From firewalls-owner  Thu Feb  6 08:31:05 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA04990 for firewalls-outgoing; Thu, 6 Feb 1997 07:25:03 -0800 (PST)
Received: from andromeda.tectel.com.mx (andromeda.tectel.com.mx [200.23.62.194]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id HAA04920 for <Firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 07:24:44 -0800 (PST)
Received: from port10.tectel.com.mx ([200.23.62.138])
          by andromeda.tectel.com.mx (Netscape Mail Server v2.0) with SMTP
          id AAA7178; Thu, 6 Feb 1997 09:14:22 -0600
Received: by port10.tectel.com.mx with Microsoft Mail
	id <01BC140F.CFE09C40@port10.tectel.com.mx>; Thu, 6 Feb 1997 09:26:20 -0600
Message-ID: <01BC140F.CFE09C40@port10.tectel.com.mx>
From: Colegio de Contadores <contanet@andromeda.tectel.com.mx>
To: "'Ng Yiu Cho - CSD SUNSSD'" <ycng@csam.com.my>
Cc: "Firewalls@GreatCircle.COM" <Firewalls@GreatCircle.COM>
Subject: RE: hardware requeriment.
Date: Thu, 6 Feb 1997 09:07:04 -0600
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



----------
De:     	Ng Yiu Cho - CSD SUNSSD[SMTP:ycng@csam.com.my]
Enviado: 	jueves 6 de febrero de 1997 2:20
Para:   	Colegio de Contadores
Cc: 	Firewalls@GreatCircle.COM
Asunto:     	Re: hardware requeriment.

Hi

There recommended hardware requirement that I would 
suggest will be 

CPU - Get a Pentium Processor 166 or better
Memory -  > 64MB Ram
Hard Disk - > 2.1 GB


****************************************************************************************


Why that amount of Hard Disk ?


	is it not enough 450 M for O.S. and the firewall itself ?


	Thanks for your answer .....



	oooppp.... pardon .. How can I suscribe to the list ?

	




From firewalls-owner  Thu Feb  6 08:32:34 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA28203 for firewalls-outgoing; Thu, 6 Feb 1997 06:29:42 -0800 (PST)
Received: from lint.cisco.com (lint.cisco.com [171.68.223.44]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id GAA28124 for <FireWalls@GreatCircle.COM>; Thu, 6 Feb 1997 06:29:19 -0800 (PST)
Received: from big-dogs.cisco.com ([171.68.53.75]) by lint.cisco.com (8.8.5/CISCO.SERVER.1.2) with SMTP id GAA22877; Thu, 6 Feb 1997 06:27:52 -0800 (PST)
Message-Id: <3.0.32.19970206092745.006bf1ac@lint.cisco.com>
X-Sender: pferguso@lint.cisco.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Thu, 06 Feb 1997 09:27:52 -0500
To: BSD02.EMEIJ@anaf01.amsterdam.nl
From: Paul Ferguson <pferguso@cisco.com>
Subject: Re: Other protocols
Cc: FireWalls@GreatCircle.COM
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 02:21 PM 2/6/97 +0100, Ewout Meij wrote:

>Great think-tank:
>
>Is there anybody outthere who does this:
>
>   |----- LAN 1 -----| with: IPX/SPX-TCP/IP-DEC-IBM
>        |
>       FW
>        |
>     |----- LAN 2 -----| with: TCP/IP only
>                   |
>                  FW
>                   |
>   |----- LAN 3 -----| with: IPX/SPX-TCP/IP-DEC-IBM
>
>And yes there needs to be comm. between the LAN1 & LAN3 on all the 
>mentioned protocols... is there any FW's on the marked thar are
>'especaily' good at this? Am I in fact looking for a bunch of proxies?
>

Sounds like a practical job for a good multiprotocol router with
filtering capabilities, but that's just my opinion.

- paul



--
Paul Ferguson                                           ||        ||
Consulting Engineering                                  ||        ||
Herndon, Virginia   USA                                ||||      ||||
tel: +1.703.397.5938                               ..:||||||:..:||||||:..
e-mail: pferguso@cisco.com                         c i s c o S y s t e m s

From firewalls-owner  Thu Feb  6 09:27:47 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA28343 for firewalls-outgoing; Thu, 6 Feb 1997 06:31:33 -0800 (PST)
Received: from sage.Cypher-Sage.COM ([206.41.182.5]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA28328 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 06:31:18 -0800 (PST)
From: bkatzung@Cypher-Sage.COM
Received: by sage.Cypher-Sage.COM
	(?/BK-2.3.1) id IAA09755; Thu, 6 Feb 1997 08:28:48 -0600
Date: Thu, 6 Feb 1997 08:28:48 -0600
Message-Id: <199702061428.IAA09755@sage.Cypher-Sage.COM>
To: lwhitty@LANcomp.COM
Subject: Re: FW1 Address translation installation on multiple inspection module hosts
Cc: firewalls@greatcircle.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>Date: Tue, 4 Feb 1997 12:26:49 -0500 (EST)
>From: Lee Whitty <lwhitty@LANcomp.COM>
>
>I'm working with a customer running FW1 V2.1 on 2 firewalls. [...]
>I need to be able to install the same rule set on both machines, but
>load a different address translation filter on each. [...] Is there
>any way to have seperate translation tables and a common ruleset,
>and install them in one step?

The translation is performed by INSPECT segment register 15, which can be
loaded independently for any host and interface combination.  The code
for the general case looks something like this:

// Firewall "a" and it's standby clone
fwa_hosts=hosts{
	fwa, fwa_stdby
};

// A's external interface
fwa_ext_ifs=interfaces{
	le0
};

// A's external interface translation(s)
fwa_ext_trans={
	<... HIDE ...>,
	<... SRC_STATIC ...>
};

<> fwa_ext_ifs@fwa_hosts
	set sr15 fwa_ext_trans;

// A's DMZ interface(s)
fwa_dmz_ifs=interfaces{
	qe0, qe1
};

// A's DMZ translation(s)
fwa_dmz_trans={
	<... DST_STATIC ...>
};

<> fwa_dmz_ifs@fwa_hosts
	set sr15 fwa_dmz_trans;

// Firewall "b"
fwb_hosts=host{
	fwb
};

// [Continue by defining fwb_..._ifs and fwb_..._trans, etc. and install
// them based on the interfaces and hosts as above.]


  -- Brian Katzung  bkatzung@Cypher-Sage.COM

From firewalls-owner  Thu Feb  6 09:36:26 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA00422 for firewalls-outgoing; Thu, 6 Feb 1997 06:47:44 -0800 (PST)
Received: from portal.west.saic.com (portal.west.saic.com [198.151.12.15]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA00332 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 06:47:16 -0800 (PST)
Received: from escort.sigtech.saic.com ([139.121.146.51]) by portal.west.saic.com
          via smtpd (for miles.greatcircle.com [198.102.244.34]) with SMTP; 6 Feb 1997 14:46:10 UT
Received: from falcon.cist.saic.com by escort (4.1/SMI-4.1)
	id AA07616; Thu, 6 Feb 97 09:45:09 EST
Message-Id: <9702061445.AA07616@escort>
From: "Chris Kostick" <christopher.t.kostick@cpmx.saic.com>
To: <firewalls@greatcircle.com>
Subject: Re: Packet Filter rules...
Date: Thu, 6 Feb 1997 09:43:49 -0500
X-Msmail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1155
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> > Try going to the mountain and speaking with GOD.  Markus Ranum has
> 
> As much as one may respect MJR, God doesn't write buffer over-runs in
> firewalls.

BTW, Marcus spells his name with a C.
--
Chris


From firewalls-owner  Thu Feb  6 10:09:34 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA26801 for firewalls-outgoing; Thu, 6 Feb 1997 06:19:54 -0800 (PST)
Received: from bicc00.bi.ehu.es (bicc00.bi.ehu.es [158.227.65.40]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA26728 for <firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 06:19:29 -0800 (PST)
Received: from bipt71.bi.ehu.es by bicc00.bi.ehu.es (AIX 3.2/UCB 5.64/4.03)
          id AA29398; Thu, 6 Feb 1997 15:22:16 GMT
Message-Id: <3.0.1.32.19970206151811.0069c320@bicc00.bi.ehu.es>
X-Sender: jtpjatae@bicc00.bi.ehu.es
X-Mailer: Windows Eudora Light Version 3.0.1 beta 12 (32)
Date: Thu, 06 Feb 1997 15:18:11 +0100
To: firewalls@GreatCircle.COM
From: Eduardo Jacob <jtpjatae@bicc00.bi.ehu.es>
Subject: NEC Socks V5
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Has anybody had experiences with the above?. I have beeen impressed by the
way both security (encripted link) and user authentication is got (at least
in domestic version, domestic there...).

I was thinking about securing access from mobile PC that get each time a
different IP address and name (due to the ISP to use). So I must relay on
user authentication with ID cards, OPIE or SKEY, instead of IP address or
DNS names. 

I would also get an encrypted tunnel for all access to the server so I
could use directly unsecured applications.

Sadly it seems this is restricted to the USA only version.

Does anybody know of any implementation for Linux that has this
capabilities? Or at least a version with the authentication and encription
facilities not removed. Or a Bones version?

	Best regards.

	Eduardo




-------------------------------------------------------
Eduardo Jacob - Area de Ingenier'ia Telem'atica
Departamento de Electr'onica y Telecomunicaciones
ETSII y de IT               Tel: +34-(9)4-427 8055
UPV / EHU                   Fax: +34-(9)4-441 4041
Alda Urquijo s/n         E-mail: jtpjatae@bi.ehu.es
E-48013 - Bilbao (Spain)       : 100021,2212 Compuserve
Ham: EA2BAJ          VHF PACKET: EA2BAJ @ EA2URV



From firewalls-owner  Thu Feb  6 10:11:22 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA12537 for firewalls-outgoing; Thu, 6 Feb 1997 08:23:06 -0800 (PST)
Received: from stortek.stortek.com (stortek.com [129.80.22.249]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id IAA12528 for <firewalls@GreatCircle.Com>; Thu, 6 Feb 1997 08:22:59 -0800 (PST)
Received: from coltano.stortek.com (coltano.stortek.com [129.80.40.2]) by stortek.stortek.com (8.8.4/8.7.3) with ESMTP id JAA04232 for <firewalls@GreatCircle.Com>; Thu, 6 Feb 1997 09:21:44 -0700 (MST)
Received: (from jim@localhost)
	by coltano.stortek.com (8.8.5/8.8.5) id JAA05056;
	Thu, 6 Feb 1997 09:21:43 -0700 (MST)
Date: Thu, 6 Feb 1997 09:21:43 -0700 (MST)
From: Jim Wamsley 303-673-8163 <jim@coltano.stortek.com>
Message-Id: <199702061621.JAA05056@coltano.stortek.com>
To: firewalls@GreatCircle.Com
Subject: Re: TEMPEST
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

You're all wrong 

NCSC Pub 1 defines tempest as a short title for the study of unintentional, 
possibly compromising, spurious emanations.  

take it as gospel folks - they originated it.  according to folklore, when
it was discovered that EMI could be captured and analyzed, the resulting
furor and panic was likened to a tempest in a teapot.  hence the short title.


 > From firewalls-owner@GreatCircle.COM Wed Feb  5 19:25 MST 1997
 > Date: Wed, 5 Feb 1997 17:49:55 -0500
 > X-Sender: pelicans@pop.mindspring.com
 > Mime-Version: 1.0
 > To: Firewalls@GreatCircle.COM
 > From: pelicans@mindspring.com (BeachCruiser)
 > Subject: TEMPEST
 > 
 > 
 > K.M. Goertzel and Jody Patilla have it exactly correct.
 > 
 > 
 > TEMPEST = Transient Electro-Magnetic Pulse Emanation STandard
 >           ^         ^       ^        ^     ^         ^^
 > 
 > Sorry...so did Brett Lymn
 > 
 > 
 > 
 > Thread Dead.
 > 


From firewalls-owner  Thu Feb  6 10:52:35 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA00602 for firewalls-outgoing; Thu, 6 Feb 1997 06:49:22 -0800 (PST)
Received: from sage.Cypher-Sage.COM ([206.41.182.5]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA00520 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 06:48:55 -0800 (PST)
From: bkatzung@Cypher-Sage.COM
Received: by sage.Cypher-Sage.COM
	(?/BK-2.3.1) id IAA09778; Thu, 6 Feb 1997 08:44:52 -0600
Date: Thu, 6 Feb 1997 08:44:52 -0600
Message-Id: <199702061444.IAA09778@sage.Cypher-Sage.COM>
To: etxrosd@nmac.ericsson.se
Subject: Re: Configuring SecureID in FW-1
Cc: firewalls@greatcircle.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>Date: Thu, 6 Feb 1997 07:43:28 +0100
>From: etxrosd@nmac.ericsson.se (Robert Stahlbrand)
>
>I'm trying to configure secureID for users who uses my telnet proxy in 
>Checkpoints FW-1 ver.2.1 but it doesn't seem to work. [...]
>I have configured a number of users and it's no problem with UNIX
>passwords, Internal passwords or S/Key but I don't get the
>secureID-function to work!!! [...] I got a card but I don't see where
>I should put in the serial-number for the card in the firewall!!! How
>will the firewall be able to understand which card the user have got? I
>understand that the FW must be time synchronized because the secureID card
>changes the displayed number every 10 seconds. When I choose secureID in the
>user setup I am prompted for nothing else???
>
>My FW-1 handbook says nothing about secureID (almost nothing). Do you have
>to buy an extra license or something???

You need to install the SecurID client (from SecurID) for the operating
system you are using (eg, SunOS, NT) on the FW-1 machine.  FW-1 will see
the client's configuration files and call the client libraries.  It will
pass the FW-1 user name to the ACE server, so just authorize that user (or
a group containing that user) for the FW-1 host (client) in the ACE
configuration.

The token assignment and time synchronization all gets handled by the
ACE server software "black box".  FW-1 doesn't know or care about it.

  -- Brian Katzung  bkatzung@Cypher-Sage.COM

From firewalls-owner  Thu Feb  6 10:53:04 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA10450 for firewalls-outgoing; Thu, 6 Feb 1997 08:03:56 -0800 (PST)
Received: from brimstone.rnb.com (brimstone.rnb.com [204.178.80.14]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id IAA10435 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 08:03:48 -0800 (PST)
Received: by brimstone.rnb.com; id LAA14398; Thu, 6 Feb 1997 11:02:38 -0500 (EST)
Received: from relay.rnb.com(199.99.101.2) by brimstone.rnb.com via smap (3.2)
	id xma014377; Thu, 6 Feb 97 11:02:33 -0500
Received: from monarch.rnb.com (monarch [150.1.33.146])
          by relay.rnb.com (8.8.4/8.8.4) with SMTP
	  id LAA18382 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 11:02:32 -0500 (EST)
Comments: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Comments: Internet Message: Sender identity is not verified.
Comments: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Date: Thu, 6 Feb 1997 11:01:00 -0500 (EST)
From: Ken Kempster <kempster@monarch.rnb.com>
To: Firewalls <firewalls@greatcircle.com>
Subject: Gauntlet 3.2 on Solaris 2.5.1 server
Message-ID: <Pine.SOL.3.95.970206105652.2705A-100000@monarch.rnb.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Has anyone had success installing Gauntlet 3.2
on Solaris 2.5.1 server?

After doing the pkgadd, everything seems to be broken.
here are some of the highlights:
1)can't communicate with anything off my local segment
2)openwindows hangs.
3)none of the proxies work;  all hang.
etc.

My hardware config. is a Sparc ultra with Solaris 2.5.1 server.

Does anyone know of any issues with 2.5.1 and Gauntlet 3.2?

any help would be great

thanx.

|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|  Ken Kempster                 kempster@monarch.rnb.com  |
|  Network Systems Engineer          _\|/_                |
|  Republic National Bank            (o o)                |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~oOO-(_)-OOo~~~~~~~~~~~~~~


From firewalls-owner  Thu Feb  6 11:02:37 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA15073 for firewalls-outgoing; Thu, 6 Feb 1997 08:38:56 -0800 (PST)
Received: from xyzzy.plugh.edmonton.ab.ca (xyzzy.plugh.edmonton.ab.ca [198.161.22.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id IAA15009 for <firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 08:38:26 -0800 (PST)
Received: (from uucp@localhost) by xyzzy.plugh.edmonton.ab.ca (8.6.12/8.6.9) id JAA04556; Thu, 6 Feb 1997 09:37:06 -0700
Received: from snouts-gw.obtuse.com(192.168.30.61), claiming to be "snouts.obtuse.com"
 via SMTP by mailhost.plugh.edmonton.ab.ca, id smtpd04547aaa; Thu Feb  6 09:36:55 1997
Received: (from beck@localhost) by snouts.obtuse.com (8.7.5/8.7.3) id JAA02220; Thu, 6 Feb 1997 09:36:58 -0700
From: Bob Beck <beck@obtuse.com>
Message-Id: <199702061636.JAA02220@snouts.obtuse.com>
Subject: Re: Packet Filter rules...
To: adam@homeport.org (Adam Shostack)
Date: Thu, 6 Feb 1997 09:36:57 -0700 (MST)
Cc: proff@suburbia.net, crumrig@us-state.gov, firewalls@GreatCircle.COM
In-Reply-To: <199702061433.JAA26381@homeport.org> from "Adam Shostack" at Feb 6, 97 09:33:00 am
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> 	God doesn't write firewalls.  Anyone who can create a world in
> 7 days can clearly secure every app on their entire network.  He just
> uses a couple of packet filters to cause endless philisophical
> arguments about 'can god create a network so large that he can't
> secure it?'
>

	According to scripture God trusted the users too much and
didn't have every app secured. He ended up having to expel users from
the system after they violated the conditions of use.

> 
> Adam
  ^^^^-- Anyone with that name oughta know that ;-)

	-Bob

--
Bob Beck					 Obtuse Systems Corporation
beck@obtuse.com					 http://www.obtuse.com/	
True Evil hides its real intentions in its street address. Search and you
shall find it, and the truth shall set you free.
	

From firewalls-owner  Thu Feb  6 11:34:32 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA29972 for firewalls-outgoing; Thu, 6 Feb 1997 06:45:33 -0800 (PST)
Received: from chronos.synopsys.com (chronos.synopsys.com [146.225.8.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA29964 for <Firewalls@greatcircle.com>; Thu, 6 Feb 1997 06:45:25 -0800 (PST)
Received: from atropos.synopsys.com by chronos.synopsys.com with SMTP id AA29874
  (5.65c/IDA-1.4.4 for <Firewalls@greatcircle.com>); Thu, 6 Feb 1997 06:44:19 -0800
Received: from flying.synopsys.com (flying.synopsys.com [146.225.72.11])
  by atropos.synopsys.com (8.6.9/8.6.9) with ESMTP id GAA16876; Thu, 6 Feb 1997 06:44:18 -0800
From: Habeeb Qadri <habeeb@Synopsys.COM>
Received: by flying.synopsys.com (SMI-8.6/SNPS-Sol2)
	id GAA05591; Thu, 6 Feb 1997 06:44:37 -0800
Date: Thu, 6 Feb 1997 06:44:37 -0800
Message-Id: <199702061444.GAA05591@flying.synopsys.com>
To: Firewalls@greatcircle.com, mike@scio.demon.co.uk
Subject: Re: Charge-Back
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Mike:

I know that the next version of CheckPoint's Firewall-1 (3.0) has:

"Network Usage Accounting: Provides data on session lengths and bytes transmitted"

This data could then be input into a charge-back program.

Habeeb Qadri
Security Admin
Synopsys, Inc
Mountain View, CA, USA
	
> From postmaster@synopsys.com  Thu Feb  6 04:41:37 1997
> From: Mike Blaser <Mike@scio.demon.co.uk>
> To: Firewalls@greatcircle.com
> Subject: Charge-Back
> Date: Thu, 06 Feb 1997 10:12:59 GMT
> Mime-Version: 1.0
> Content-Transfer-Encoding: quoted-printable
> 
> A question for all you corporate types out there.
> 
> Does anyone use the reporting capabilities of their firewall to allocate
> costs to individual depratments/users so as to enable a charge-back
> structure for internet usage?  Do most firewalls allow reporting on this
> sort of basis or would a seperate package have to be used, in which case
> which ones are out there and what do people recommend?
> 
> Cheers
> 
> Mike
> --
> Mike Blaser  -  IT Security Analyst                 mike@scio.demon.co.uk
> Vertex Data Science Ltd                               +44 (0) 1925 236831
> TA29, Dawson House                 Comments and opinions are those of the
> Great Sankey, Warrington, UK    author and not of Vertex Data Science Ltd

From firewalls-owner  Thu Feb  6 11:56:02 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA11004 for firewalls-outgoing; Thu, 6 Feb 1997 08:09:04 -0800 (PST)
Received: from ALABAMA.CF.CS.YALE.EDU (RT-GW.CS.YALE.EDU [128.36.0.13]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id IAA10995 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 08:08:51 -0800 (PST)
From: long-morrow@CS.YALE.EDU
Received: from SPARKY.CF.CS.YALE.EDU by ALABAMA.CF.CS.YALE.EDU (8.7.1/res.host.cf-4.0)
	with ESMTP id LAA10236; Thu, 6 Feb 1997 11:06:45 -0500 (EST) sender long-morrow@CS.YALE.EDU for 
Received: by SPARKY.CF.CS.YALE.EDU (Sendmail-8.7.1/res.client.cf-4.0)
	id LAA00909; Thu, 6 Feb 1997 11:06:43 -0500 (EST)
Date: Thu, 6 Feb 1997 11:06:43 -0500 (EST)
Message-Id: <199702061606.LAA00909@SPARKY.CF.CS.YALE.EDU>
To: firewalls@greatcircle.com, hopkins@icrf.icnet.uk, proff@suburbia.net
Subject: Re: Packet Filter rules...
Cc: crumrig@us-state.gov
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


So sayeth John Hopkins:
>	I don't know of a firewall package that God has written. 

You mean you never heard of the 'RedSea(TM)' firewall system?  One of
the most effective ever created for keeping nasty intruders out :-)

Or the Jericho(TM) firewall penetration suite and the Noah'/Lot(R) (as
in "know a lot" 'bout many different virii :-) anti-virus product :-?
Noah'/Lot(R) is the ultimate solution for disinfecting systems known to
be hopelessly infected...

Of course, everyone knows by now that archangels SATAN and Gabriel have
gotten into the business, both releasing complementary network security
products under their own names.  It won't be long before mere angelic
creatures (Cherubim and Seraphim) begin breaking off on their own to
form consultancies to license, distribute and install these and other
commercial firewall products (FW-1, FWTK, Gauntlet, NEC PNG, etc.).

Even some of the disciples have also gotten into the act, Paul (famous
author of many books in the "Letter to the ..." series) is purportedly
working on a book for IDG Communications ("Firewalls for Dummies") and
Matthew, Mark, Luke and John are working on a "virtual-DMZ-in-a-box"
solution called "Purgatory(TM)".

- Morrow (Totally tongue-in-cheek :-)


From firewalls-owner  Thu Feb  6 11:58:57 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA15832 for firewalls-outgoing; Thu, 6 Feb 1997 08:47:05 -0800 (PST)
Received: from Walden.MO.NET (walden.mo.net [199.250.196.5]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id IAA15775 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 08:46:26 -0800 (PST)
Received: from gate.hussmann.com (gate.hussmann.com [205.139.246.2]) by Walden.MO.NET (8.8.3/8.6.10) with ESMTP id KAA03422; Thu, 6 Feb 1997 10:44:19 -0600 (CST)
Received: (from nobody@localhost) by gate.hussmann.com (8.7.1/8.7.3) id KAA24017; Thu, 6 Feb 1997 10:44:25 -0600
Message-Id: <199702061644.KAA24017@gate.hussmann.com>
Received: from mail-gate.hussmann.com(129.1.5.4) by gate.hussmann.com via smap (V1.3)
	id tmp024010; Thu Feb  6 10:43:55 1997
Date: Thu, 6 Feb 1997 10:42:00 -0600
From: "Hicks, Rick" <RHicks@hussmann.com>
Subject: RE: Security Design Issue
To: "'Firewalls List'" <firewalls@greatcircle.com>
Cc: "'kent@dataprep.com.my'" <kent@dataprep.com.my>
X-Mailer: Worldtalk (NetConnex V4.00a)/MIME
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


>The FR provider already built their PVCs from all the remote sites to =
>the HQ and another PVC from the HQ to the=20
>Internet. The HQ enterprise router can support multiple IP address =
>configuration onto the same physical SYNC and Ethernet interface. I've =
>been ask what is the best way to protect the network environment with =
>FW-1. Sensitive information flow from the remote sites to the HQ must be   
=
>protected so as the treat from Internet. By the way the FW-1 is also =
>required to provide NAT to the remote sites and the HQ LAN. The customer   
=
>to utilise the E1 link both for the remote links so as the Internet =
>link. I understand that this is not a very good idea especially for =
>security point of view. Hope to hear from you'll soon. All your comments   
=
>are highly appreciated.

Disclaimer:  I am not very familiar with FW-1.

You will need to apply access-lists, both input and output, on the   
Internet PVC's sub-interface.  This input list should, as always, deny   
incoming packets with a source IP address that is internal to your   
network; deny IP spoofing.  You also need to make sure that all incoming   
packets have a destination for FW-1 ONLY, all other packets should be   
denied.

*very* simple example:

access-list 101 deny ip <internal network> <wildcard mask> any
access-list 101 permit ip any host <FW-1 address>
<implicit deny>

The output list should make sure that outgoing traffic is only allowed   
from FW-1.  This should also be taken care of by making sure you use a   
static route to the ISP on the Internet PVC and the default route on the   
router, if you need one, points to FW-1, NOT the PVC sub-interface   
(otherwise packets are routed around FW-1, instead of through it).  This   
gets a little tricky however, because FW-1 needs to have the *real*   
default route to the Internet link. < If anyone has done this please   
speak up; I haven't, and don't know for sure how to do it >.  Just make   
sure that only FW-1 knows the *true* route, and everyone else must go   
through it to get out.

access-list 102 permit ip host <FW-1 address> any
<implicit deny>

You could further protect the other sites, and the HQ network, by   
applying output filters on all other interfaces that only allow packets   
from FW-1 and the other internal networks.

The only problem I see is with the default route issue.  Does anyone have   
any suggestions??


Good Luck,

Rick

____________________________________________
Rick Hicks
Network Specialist
Hussmann Corporation
RHicks@Hussmann.com
http://www.hussmann.com

From firewalls-owner  Thu Feb  6 12:37:23 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA19825 for firewalls-outgoing; Thu, 6 Feb 1997 09:19:15 -0800 (PST)
Received: from info.census.gov (info.census.gov [148.129.129.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id JAA19630 for <firewalls@GreatCircle.com>; Thu, 6 Feb 1997 09:18:30 -0800 (PST)
Received: from gate.census.gov (gate.census.gov [148.129.129.2]) by info.census.gov (8.8.5/8.8.3) with SMTP id MAA02456 for <firewalls@GreatCircle.com>; Thu, 6 Feb 1997 12:17:23 -0500 (EST)
Received: from it-relay1.census.gov by gate.census.gov with SMTP id AA27993
  (InterLock SMTP Gateway 3.0 for <firewalls@GreatCircle.com>);
  Thu, 6 Feb 1997 12:17:22 -0500
Received: from rulan001.census.gov ([148.129.79.162]) by it-relay1.census.gov (8.8.4/8.7.3/v1.9) with SMTP id MAA29327 for <firewalls@GreatCircle.com>; Thu, 6 Feb 1997 12:17:21 -0500 (EST)
Date: Thu, 6 Feb 1997 12:17:21 -0500 (EST)
Message-Id: <199702061717.MAA29327@it-relay1.census.gov>
X-Sender: truland@internet.census.gov
X-Mailer: Windows Eudora Light Version 1.5.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: firewalls@GreatCircle.com
From: "Timothy P. Ruland" <truland@Census.GOV>
Subject: Packet vs. Proxy Firewalls
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

We are currently using an ANS Interlock firewall to protect our internal 
network.  For a variety of reasons we are beginning to re-evaluate the way we 
have established our basic Internet capabilities.

One question that has been floated around is the benefit of a packet-based
firewall 
solution as opposed to the application gateway system like the Interlock
machine.

I have been a silent participant on this list for quite awhile and decided
to solicate 
some professional opinions on the matter.  Does anyone have a preference as
to which 
firewall solution is better?  Of prime concern to our users is performance.

I would appreciate any suggestions. You can send any replies to me direct at:

        truland@census.gov


Thanks in advance for the assistance. --- ktf

    
****************************************************************************
"It's astounding...time is fleeting...madness takes its toll"	Tim Ruland
  "but listen closely...not for very much longer..."		US Census Bureau
     "I'VE GOT TO TAKE CONTROL!!!!!!"				ADP Security Office


From firewalls-owner  Thu Feb  6 12:41:03 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA28497 for firewalls-outgoing; Thu, 6 Feb 1997 06:33:26 -0800 (PST)
Received: from chronos.synopsys.com (chronos.synopsys.com [146.225.8.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA28480 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 06:33:11 -0800 (PST)
Received: from atropos.synopsys.com by chronos.synopsys.com with SMTP id AA29555
  (5.65c/IDA-1.4.4 for <firewalls@greatcircle.com>); Thu, 6 Feb 1997 06:32:01 -0800
Received: from flying.synopsys.com (flying.synopsys.com [146.225.72.11])
  by atropos.synopsys.com (8.6.9/8.6.9) with ESMTP id GAA16445; Thu, 6 Feb 1997 06:32:00 -0800
From: Habeeb Qadri <habeeb@Synopsys.COM>
Received: by flying.synopsys.com (SMI-8.6/SNPS-Sol2)
	id GAA05585; Thu, 6 Feb 1997 06:32:19 -0800
Date: Thu, 6 Feb 1997 06:32:19 -0800
Message-Id: <199702061432.GAA05585@flying.synopsys.com>
To: firewalls@greatcircle.com, etxrosd@nmac.ericsson.se
Subject: Re: Configuring SecureID in FW-1
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Robert:

to get your Firewall-1 to work with SecurID:

1) ensure that your SecurID environment is working properly.
	Setup your ACE server.
	from your message it appears that you have done this correctly.

2) When defining your firewall host as a network object:
	click on "Auth Schemes" button
	"Host Auth Schemes" icon pops up
	click on "SecurID" button (second from top)
	click "apply"

3) Setup your Firewall-1 host as n ACE client
	
4) reboot your Firewall-1 system

hope this helps,

Habeeb Qadri
Security Admin
Synopsys, Inc
Mountain View, CA, USA


	
> From postmaster@synopsys.com  Wed Feb  5 23:09:21 1997
> Date: Thu, 6 Feb 1997 07:43:28 +0100
> From: etxrosd@nmac.ericsson.se (Robert Stahlbrand)
> To: firewalls@greatcircle.com
> Subject: Configuring SecureID in FW-1
> Mime-Version: 1.0
> Content-Transfer-Encoding: 7bit
> Content-Md5: JvNWURNsNKqUy4vORm/n2g==
> 
> Hi everyone!
> 
> I'm trying to configure secureID for users who uses my telnet proxy in 
> Checkpoints FW-1 ver.2.1 but it doesn't seem to work. What I'm trying to 
> configure is this.....
> 
> We have a modempool outside our firewall and if the users need access to our 
> intranet I thought that secureID would be an easy way for the users to login. It 
> seems to be pretty safe and pretty easy for the users. I use the telnet (ftp, 
> http as well) proxy function so the users must pass through the proxy to enter 
> the internal network. I have configured a number of users and it's no problem 
> with UNIX passwords, Internal passwords or S/Key but I don't get the 
> secureID-function to work!!! And how should it work??? I got a card but I don't 
> see where I should put in the serial-number for the card in the firewall!!! How 
> will the firewall be able to understand which card the user have got? I 
> understand that the FW must be time synchronized because the secureID card 
> changes the displayed number every 10 seconds. When I choose secureID in the 
> user setup I am prompted for nothing else???
> 
> My FW-1 handbook says nothing about secureID (almost nothing). Do you have to 
> buy an extra license or something???
> 
> ###########################################################
> #                 Robert Stahlbrand                       #
> # Network and System Administrator OPLab and NMAC domains #
> #                                                         #
> #                 Ericsson Telecom AB                     #
> #                      Box 333                            #
> #                   43184 Molndal                         #
> #                      Sweden                             #
> #                  +46 31 7476162                         #
> #                  +46 31 7472942 (fax)                   #
> #                                                         #
> #              robert@nmac.ericsson.se                    #
> ###########################################################
> 

From firewalls-owner  Thu Feb  6 12:53:22 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id KAA28293 for firewalls-outgoing; Thu, 6 Feb 1997 10:11:32 -0800 (PST)
Received: from mail-gw.pacbell.net (mail-gw.pacbell.net [206.13.28.25]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id KAA28243 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 10:11:12 -0800 (PST)
Received: from p133 (ppp-206-170-30-16.hywr01.pacbell.net [206.170.30.16]) by mail-gw.pacbell.net (8.8.5/8.7.1) with SMTP id KAA26283 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 10:10:03 -0800 (PST)
Message-ID: <32FA1E77.2801@pacbell.net>
Date: Thu, 06 Feb 1997 10:09:59 -0800
From: Dave Sroelov <dsroelov@pacbell.net>
X-Mailer: Mozilla 3.01Gold (WinNT; I)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: installation problem
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

i'm new with firewall-1, actually this is my first install, and i am
having a slight problem.  any information would be greatly appreciated.

i install the firewall on nt 3.51 and everything goes ok.  i then
install the gui software and everything still goes ok.  when i try to
get the gui software to connect to the firewall software i get 'no
response from server' messages.

the software is firewall-1 version 2.1c and everything is running on the
same machine, although it doesn't connect from a remote machine either. 
i have tried nt 3.51 and 4.0 and neither one works.

help!!!

	dave sroelov
	dsroelov@pacbell.net

From firewalls-owner  Thu Feb  6 13:01:13 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id KAA29655 for firewalls-outgoing; Thu, 6 Feb 1997 10:20:44 -0800 (PST)
Received: from parijs.tip.nl (parijs.tip.nl [143.177.1.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id KAA29437 for <Firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 10:19:29 -0800 (PST)
Received: from memo.home.nl by parijs.tip.nl with smtp
	(Smail3.1.29.1 #16) id m0vsYPf-000DnGC; Thu, 6 Feb 97 19:19 MET
Message-Id: <m0vsYPf-000DnGC@parijs.tip.nl>
From: "Rodney van den Oever" <Rodney.van.den.Oever@tip.nl>
To: <Firewalls@GreatCircle.COM>
Subject: Re: Firewalls-Digest V6 #49
Date: Thu, 6 Feb 1997 19:18:27 +0100
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1155
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Date: Thu, 06 Feb 1997 13:45:15 +1100 (EST)
> From: Mitko Stoyanov <mstoyan@airmoon.epa.nsw.gov.au>
> Subject: Dynamic (per user) dial-in PPP IP filtering
> 
> I am after any links or information which would help me to achieve the
> above. The filter rules has to be dynamically inserted when the relevant
> user logs in, and removed, when he/she logs out. There will be no more
> than 4 - 8 groups of filter rules. There are multiple dial-in ports with
> static IP addresses, and when the user logs out, only the rules regarding
> the used port/IP address should be removed.I did it already with Linux
> 2.0.28, modified pppd and perl scripts, but was wondering if any other
> solution exist already.

Use tacacs+ from cisco or radius



From firewalls-owner  Thu Feb  6 13:15:10 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA26009 for firewalls-outgoing; Thu, 6 Feb 1997 09:58:16 -0800 (PST)
Received: from inetgate.scitexdpi.com (firewall.sdp.scitex.com [149.115.248.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id JAA25994 for <Firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 09:58:07 -0800 (PST)
Received: by inetgate.scitexdpi.com; id AA09526; Thu, 6 Feb 97 12:56:53 EST
Received: from mailhub.scitexdpi.com(172.16.9.23) by inetgate.scitexdpi.com via smap (3.2)
	id xma009522; Thu, 6 Feb 97 12:56:27 -0500
Received: from mailhub.scitexdpi.com by mailhub with SMTP id AA01069
  (5.67b/IDA-1.5 for <Firewalls@GreatCircle.COM>); Thu, 6 Feb 1997 12:56:24 -0500
Received: from sdphq-Message_Server by mailhub.scitexdpi.com
	with Novell_GroupWise; Thu, 06 Feb 1997 12:56:21 -0500
Message-Id: <s2f9d4f4.017@mailhub.scitexdpi.com>
X-Mailer: Novell GroupWise 4.1
Date: Thu, 06 Feb 1997 12:55:54 -0500
From: Bob Allison <ballison@scitexdpi.com>
To: Firewalls@GreatCircle.COM, z76399@uprc.com
Subject:  http proxy problems / gauntlet -Reply
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

If your setup is like mine, my internal web server tries to go through
the firewall on port 8080, for which there is no proxy.

The solution is to have the internal web server use the firewall:80 as
a web proxy for everything, rather than using Gauntlet's transparency.

>>> Prahl V. E. Von <z76399@uprc.com> 02/05/97 02:54pm >>>
greetings,


we occasionally get the following errors from our netscape v 3.0 browser:

"The requested item could not be loaded by the proxy.

A ntework error occurred: unable to connect ot server (TCP Error:32) The server
may be down or unreachable.  Try connecting again later.

Proxy server at hostname.xxx.com on port 8080."

hostname.xxx.com is our webserver which is inside the firewall.  in the fireall
messages i get a security alert on unserved port 8080.  i am running gauntlet
3.1 on a sparc20
SunOS 4.1.4 and have http configed by the boot.  i have http pointing to port
80, which is the  default. we actually are proxying http through the internal
web machine.  i have no idea what is  going on here.  any help on this one would
be apprieciated.

thanks,


von prahl



From firewalls-owner  Thu Feb  6 13:30:15 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA23632 for firewalls-outgoing; Thu, 6 Feb 1997 09:38:07 -0800 (PST)
Received: from brimstone.rnb.com (brimstone.rnb.com [204.178.80.14]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id JAA23551 for <firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 09:37:34 -0800 (PST)
Received: by brimstone.rnb.com; id MAA14947; Thu, 6 Feb 1997 12:36:23 -0500 (EST)
Received: from relay.rnb.com(199.99.101.2) by brimstone.rnb.com via smap (3.2)
	id xma014880; Thu, 6 Feb 97 12:36:16 -0500
Received: from monarch.rnb.com (monarch [150.1.33.146])
          by relay.rnb.com (8.8.4/8.8.4) with SMTP
	  id MAA19646; Thu, 6 Feb 1997 12:36:14 -0500 (EST)
Comments: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Comments: Internet Message: Sender identity is not verified.
Comments: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Date: Thu, 6 Feb 1997 12:34:43 -0500 (EST)
From: Ken Kempster <kempster@monarch.rnb.com>
To: "Steven E. Matkoski" <matkoski@dreamscape.com>
cc: Firewall mailing list <firewalls@GreatCircle.COM>
Subject: Re: Guantlet on Solaris: Installation question.
In-Reply-To: <32F9F533.64D2@dreamscape.com>
Message-ID: <Pine.SOL.3.95.970206123156.2705B-100000@monarch.rnb.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Thu, 6 Feb 1997, Steven E. Matkoski wrote:

> Hi,
> 
> I am about to start installing Guantlet on Solaris 2.5.1 and wondered if
> there was anything
> I should do to harden the OS before installation?

I am having nothing but pain with installing Gauntlet 3.2 on Solaris 2.5.1
TIS suggests installing the sun suggested patches; which I did before the 
Gauntlet install.  But after install nothing seems to work right.

I have tried the install three times with the same results.
I am falling back to Solaris 2.5 to see if it's a 2.5.1 problem.

I'll let you know how I make out.

> 
> --
> Thanks!
> -steve.
> matkoski@dreamscape.com
> 
> 

|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|  Ken Kempster                 kempster@monarch.rnb.com  |
|  Network Systems Engineer          _\|/_                |
|  Republic National Bank            (o o)                |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~oOO-(_)-OOo~~~~~~~~~~~~~~


From firewalls-owner  Thu Feb  6 13:35:13 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id KAA00359 for firewalls-outgoing; Thu, 6 Feb 1997 10:24:21 -0800 (PST)
Received: from hcat.epcorp.com (typhoon.epcorp.com [198.30.14.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id KAA00276 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 10:23:45 -0800 (PST)
Received: from homepcmcw.eapi.com by hcat.epcorp.com id aa19432;
          6 Feb 97 13:11 EST
Message-Id: <3.0.32.19970206131148.006a19b4@hellcat.epcorp.com>
X-Sender: martinw@hellcat.epcorp.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Thu, 06 Feb 1997 13:11:50 -0500
To: contanet@andromeda.tectel.com.mx, firewalls@greatcircle.com
From: "Martin C. Walker" <martinw@epcorp.com>
Subject: hardware requeriment.
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

my recommendation, based on experience running fw-1 from sun on
solariz x86 is NOT TO USE SOLARIS x86 !!!

This is not necessarilly because there is anything wrong with x86,
but because there are few people in sunservice, or it appears in checkpoint
who know anything about x86.  As soon as you mention you're running x86
you get the standard reply "Oh!  well I don't really know anything about
x86 but...".  It also raises add'l questions from the tech suppt people that
can obscure the real issue because their lack of familiarity with it make
them question things (or ignore things) they shouldn't.  Further, if you run
into a problem which they need to duplicate they (sunservice) don't have
x86 platforms in the lab, and must do it with sparc.  What they really means
is that in order to duplicate the problem they use your production systems
as a lab.

I'd just recommend you stay away from it, things are much simpler with
sparc platforms.

>Hello . Im new in the list , and i=B4d like to talk about=20
>Solaris Firewall .
>
>
>	Wich is the recommended hardware for install this firewall
>	over x86 plataform ?
>
>	Procesor  ??
>
>	Memory ?
>
>	CPU clock ?
>
>	Mi link is going to be a 128 kbps .
>
>	Im thinking to use a vectra VE 486/66 of HP.
>
>
>	Thanks for your comments.
>
>
>
>Israel Zavalza Bahena
>Contanet.
>
>
 --------------------------------------------------------------------------
 Martin C. Walker     |  martinw@epcorp.com  |      PP-ASEL,IFR AA5-A 9908U
 Project Lead         |       (513)629-2517  | Blue Belt Okinawan Shuri-Ryu
 Eagle-Picher Inc.    |  Fax: (513)629-2449  |                Porsche 911SC
 580 Walnut St,       |                      |
 Cincinnati, OH 45202 |                      |


From firewalls-owner  Thu Feb  6 14:18:59 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA24020 for firewalls-outgoing; Thu, 6 Feb 1997 09:41:23 -0800 (PST)
Received: from chronos.synopsys.com (chronos.synopsys.com [146.225.8.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id JAA24000 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 09:41:02 -0800 (PST)
Received: from atropos.synopsys.com by chronos.synopsys.com with SMTP id AA07729
  (5.65c/IDA-1.4.4 for <firewalls@greatcircle.com>); Thu, 6 Feb 1997 09:39:52 -0800
Received: from flying.synopsys.com (flying.synopsys.com [146.225.72.11])
  by atropos.synopsys.com (8.6.9/8.6.9) with ESMTP id JAA00144; Thu, 6 Feb 1997 09:39:50 -0800
From: Habeeb Qadri <habeeb@Synopsys.COM>
Received: by flying.synopsys.com (SMI-8.6/SNPS-Sol2)
	id JAA05639; Thu, 6 Feb 1997 09:40:07 -0800
Date: Thu, 6 Feb 1997 09:40:07 -0800
Message-Id: <199702061740.JAA05639@flying.synopsys.com>
To: firewalls@greatcircle.com, matkoski@dreamscape.com
Subject: Re: Guantlet on Solaris: Installation question.
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Steve:

according to Systems Engineering manager at TIS,
when you install Gauntlet on Solaris 2.5.1, they
have routines that do all the "hardening" for you, without
user intervention.

However, if you have a Sun software contract, you should consider
installing the following security recommended patches from Sun:

===================================================================


103558 admintool fixes for security and missing swmtool options

103582 telnet ftp single user tcp NDD tcp_bind web

103594 security sendmail V8 core HP openmail mail BIND 4.9.3 libresolv.so.2

103612 security libc memory su getdate NIS+ libnsl nis_cachemgr rpc.nisd NIS+

103630 ip, ifconfig and arp patch

103640 kernel patch

103663 security DNS libresolv.so.2 CERT BIND 4.9.3 in.named named-xfer
 
103680 nscd nscd_nischeck BIND 4.9.3 libresolv.so.2 security

103683 nss_dns.so.1 BIND 4.9.3 libresolv.so.2 security

103686 rpc.nisd_resolv BIND 4.9.3 libresolv.so.2 security

103696 single user su C2 TZ security

103743 XFN BIND libresolv.so.2 DNS security
 
103817 rdist buffer overflow lookup sprintf security
 
103866 BCP syslog core security getservbyname nsswitch.conf
 
103879 security kcms kcms_calibrate
 
103900 security XView binary compatibility
 
104010 security vold filemgr action_filemgr.so.1 action_filemgr.so.1
 
104516 security PPP IP address dial-in
 
==========================================================================

I am not sure if Gauntlet already does the above mentioned patches.
You should check with them.

Sun also a script on their WEB page, unders Solaris security, that 
modifies the permissions on certain directories and files, that tightens
up the access to system resources.

hope this helps,

Habeeb Qadri
Security Admin
Synopsys Inc
Mountain View, CA, USA


From firewalls-owner  Thu Feb  6 14:20:24 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA24311 for firewalls-outgoing; Thu, 6 Feb 1997 09:43:29 -0800 (PST)
Received: from csc.com (explorer.csc.com [20.1.10.27]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id JAA24157; Thu, 6 Feb 1997 09:42:31 -0800 (PST)
Received: from sdfpc2.gsfc.nasa.gov by csc.com with smtp
	(Smail3.1.29.1 #1) id m0vsXoq-001AjPC; Thu, 6 Feb 97 12:41 EST
Message-ID: <32FA3C76.3321@csc.com>
Date: Thu, 06 Feb 1997 12:17:58 -0800
From: Adam Safier <asafier@csc.com>
Reply-To: asafier@csc.com
Organization: Computer Sciences Corp.
X-Mailer: Mozilla 3.0 (Win16; U)
MIME-Version: 1.0
To: Firewalls@GreatCircle.COM
CC: firewalls-digest@GreatCircle.COM
Subject: Re: Security Design Issue
References: <199702060900.BAA29725@miles.greatcircle.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

- Use the FW-1 enterprise package.
- Put a dual homed Firewall-1 module (M) with DES or better encryption
at each site.
- Put the Firewall-1 management workstation (S) on an internal LAN in a
physically secure location.
- Encrypt all links between modules.  Your traffic from the Management
workstation to the modules is also encrypted. 

A while back a co-worker who once designed Frame Relay switches for a
major carrier told me the words security and Frame Relay were
oxymorons.  If the data is valuable and sensetive you will need
encryption devices at all sites.

> Date: Thu, 6 Feb 1997 10:12:18 +-800
> From: KENNETH PHANG <kent@dataprep.com.my>
> Subject: Security Design Issue
> 
                   M       M       M       M       M
                   |       |       |       |       |
>                 R1      R2      R3      R4       R.. Remote sites
>                  |       |       |       |       |
>                  |       |       |       |       | T1 link
>                   \      |       |       |      /
>                     \    |       |       |     /
>                          (  Frame Relay ) _____________Internet
>                                  |
>                                  |    E1 link
>                                  R0                      R0 - HQ router
                                   |          S - FW-1 Management
workstation
                                   M          M - FW-1 module
>                                  |                       R1 - Remote router site 1
>                                 HQ                       R2 - Remote router site 2
>                                  |
>                                  |      LAN
>                 -----------S----------------------------------------
> 
> .... I've =
> been ask what is the best way to protect the network environment with =
> FW-1. Sensitive information flow from the remote sites to the HQ must be =
> protected so as the treat from Internet. By the way the FW-1 is also =
> required to provide NAT to the remote sites and the HQ LAN. The customer =
> to utilise the E1 link both for the remote links so as the Internet =
> link. I understand that this is not a very good idea especially for =
> security point of view. Hope to hear from you'll soon. All your comments =
> are highly appreciated.=20


-- 
Adam Safier                  asafier@csc.com		http://www.csc.com
CSC-SED-Infosec              (301) 794-1349		(301) 552-3272 (fax)

Curious Cat Question:  
How does DIX Ethernet know the packet length?
802.3 Ethernet has a length field but DIX has a type and no length
field.

Technology Abuse: 1) Netscape Frames on a 14" screen.
                  2) Netscape 3.0 on a 386-33 w/ 8 Meg RAM.

The above are my own opinions.
I'm proud to live in a country where I'm free to express them!



From firewalls-owner  Thu Feb  6 14:28:04 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA05439 for firewalls-outgoing; Thu, 6 Feb 1997 11:02:22 -0800 (PST)
Received: from boris.umds.ac.uk (boris.umds.ac.uk [159.92.18.16]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id LAA05389 for <firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 11:02:01 -0800 (PST)
Received: (from crr@localhost) by boris.umds.ac.uk (8.7.5/8.7.3) id TAA28341 for firewalls@GreatCircle.COM; Thu, 6 Feb 1997 19:00:40 GMT
Date: Thu, 6 Feb 1997 19:00:40 GMT
Message-Id: <199702061900.TAA28341@boris.umds.ac.uk>
From: crr@ipg.umds.ac.uk
To: firewalls@GreatCircle.COM
Subject: ftp deamons
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

-----BEGIN PGP SIGNED MESSAGE-----


Hi,
	We have been using wu-ftpd on a Sun at our site to provide an 
anonymous ftp service. The other day I was fiddling around with
the configeration of it to allow someone to upload some files. 
I went home, had a few days off with flu and came back to
find it full of warez beccause I had trashed the configeration
without realising it. So last week I had about one person every 30
seconds wanting to download DieHard or somesuch.

This prompted Charlie, a colleague of mine, to get aftpd by Marcus Ranum, 
originaly from tis.com. The idea was that we would check over the code
maybe hack it a little to do what we want and install it in place of 
the bloated wu-ftpd. 

Unfortunatley Charlie has gone into full hacker mode and though claiming to
be simplifying and minimalising the code -  he says there are bits he doesn't 
like, the parser for instance, the whole thing does more that we need 
anyway and it really ought to be  ansi C nowadays - I am sure we will end 
up with something marvelously baroque. What's more he is supposed to be 
finishing his PhD.

Obviously there is a lot to be said for using small deamons with 
easily verifiable code in this situation, and so I was wondering if
anyone knew of any other small PD sources of ftp we could have 
a look at. Then I can stop Charlie from re-inventing the wheel and avoid the
ire of his PhD supervisor - who is also my manager.

with thanks

Colin
+----------------------------------------------------------------------------+
| email: C.Renshaw@ipg.umds.ac.uk     |                  .                   |
| URL http://www-ipg.umds.ac.uk/~crr/ |                                      |
+----------------------------------------------------------------------------+
|  PGP KeyID: 0x9E6610DD                                                     |
|  PGP Key fingerprint:  AA 12 CF 24 07 8E 19 83  01 EF 25 86 68 4C A0 84    |
+----------------------------------------------------------------------------+

-----BEGIN PGP SIGNATURE-----
Version: 2.6

iQCVAgUBMvoqT0vWYGmeZhDdAQEDdQP/UaNNY9XodKQukv0ek4whmBR6n/NlaDUb
6GfHris7aqnhedvNs1yiMEIgjZSwWb61pjhRIA8zYl1etPZkhlTTrh2zcRfjj5Kc
RwHDLQjULqxVEMIzvuB7/gpRSm/InmQzPeQxJvuozxxm/DzD5goWymaUFdivtOIx
3DCpYVHcG/c=
=OQZt
-----END PGP SIGNATURE-----

From firewalls-owner  Thu Feb  6 15:19:19 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA26438 for firewalls-outgoing; Thu, 6 Feb 1997 13:20:48 -0800 (PST)
Received: from seraph.uunet.ca (uunet.ca [142.77.1.254]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id NAA26412 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 13:20:35 -0800 (PST)
Received: from maxon by seraph.uunet.ca with UUCP id <656713-19576>; Thu, 6 Feb 1997 16:19:19 -0500
Received: from ntsvr1.maxon by maxon.ca (5.x/SMI-SVR4)
	id AA01167; Thu, 6 Feb 1997 15:53:46 -0500
Received: by ntsvr1.maxon with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5)
	id <01BC1446.15F427C0@ntsvr1.maxon>; Thu, 6 Feb 1997 15:54:50 -0500
Message-Id: <c=US%a=_%p=MAXON%l=NTSVR1-970206205420Z-5@ntsvr1.maxon>
From: Patrick Roch <PatrickR@maxon.ca>
To: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: FW: Configuring SecureID in FW-1
Date: Thu, 6 Feb 1997 15:54:20 -0500
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


_______________________________________________
Patrick Roch
proch@maxon.ca

Les Service MAXON inc.
8550 Marie-Victorin, Brossard, Quebec, J4X 1A1
(514) 466-2423,243   fax: (515) 466-2113


-----Original Message-----
From:	Patrick Roch
Sent:	February 6, 1997 11:22 AM
To:	'etxrosd@nmac.ericsson.se'
Subject:	RE: Configuring SecureID in FW-1

You need a ACE/Server to handle the identification and authentification, 
The option in FW-1 is only has a client. Also, if you are using FW-1 on NT, 
you have to select S/key for activating SecurID, FW-1 inverse S/key and 
Securid in their menu. In the UNIX version they did it correctly.

If you need more information on ACE/server  please reply.

_______________________________________________
Patrick Roch
proch@maxon.ca

Les Service MAXON inc.
8550 Marie-Victorin, Brossard, Quebec, J4X 1A1
(514) 466-2423,243   fax: (515) 466-2113


-----Original Message-----
From:	etxrosd@nmac.ericsson.se [SMTP:etxrosd@nmac.ericsson.se]
Sent:	February 6, 1997 1:43 AM
To:	firewalls@greatcircle.com
Subject:	Configuring SecureID in FW-1

Hi everyone!

I'm trying to configure secureID for users who uses my telnet proxy in
Checkpoints FW-1 ver.2.1 but it doesn't seem to work. What I'm trying to
configure is this.....

We have a modempool outside our firewall and if the users need access to 
our
intranet I thought that secureID would be an easy way for the users to 
login. It
seems to be pretty safe and pretty easy for the users. I use the telnet 
(ftp,
http as well) proxy function so the users must pass through the proxy to 
enter
the internal network. I have configured a number of users and it's no 
problem
with UNIX passwords, Internal passwords or S/Key but I don't get the
secureID-function to work!!! And how should it work??? I got a card but I 
don't
see where I should put in the serial-number for the card in the firewall!!! 
How
will the firewall be able to understand which card the user have got? I
understand that the FW must be time synchronized because the secureID card 
changes the displayed number every 10 seconds. When I choose secureID in 
the
user setup I am prompted for nothing else???

My FW-1 handbook says nothing about secureID (almost nothing). Do you have 
to
buy an extra license or something???

###########################################################
#                 Robert Stahlbrand                       #
# Network and System Administrator OPLab and NMAC domains #
#                                                         #
#                 Ericsson Telecom AB                     #
#                      Box 333                            #
#                   43184 Molndal                         #
#                      Sweden                             #
#                  +46 31 7476162                         #
#                  +46 31 7472942 (fax)                   #
#                                                         #
#              robert@nmac.ericsson.se                    #
###########################################################



From firewalls-owner  Thu Feb  6 17:10:03 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA01440 for firewalls-outgoing; Thu, 6 Feb 1997 13:50:02 -0800 (PST)
Received: from news.ptes.com ([138.112.199.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id NAA01353 for <Firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 13:49:28 -0800 (PST)
Received: from [138.112.190.103] (mike.ptes.com [138.112.190.103])
	by news.ptes.com (8.8.5/8.8.5) with SMTP id NAA15727;
	Thu, 6 Feb 1997 13:46:16 -0800 (PST)
X-Sender: mike@moonlight
Message-Id: <v02130530af2010316fa4@[138.112.190.103]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Thu, 6 Feb 1997 13:49:52 -0900
To: Mitko Stoyanov <mstoyan@airmoon.epa.nsw.gov.au>, Firewalls@GreatCircle.COM
From: mike@ptes.com (Mike Bernhardt)
Subject: Re: Dynamic (per user) dial-in PPP IP filtering
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Radius works great, and it's free. You can get a copy from ftp.ascend.com
(Ascend's version has extra definitions specific to Ascend equipment).

At 5:45 PM 2/5/97, Mitko Stoyanov wrote:
>Hi,
>
>I am after any links or information which would help me to achieve the
>above. The filter rules has to be dynamically inserted when the relevant
>user logs in, and removed, when he/she logs out. There will be no more
>than 4 - 8 groups of filter rules. There are multiple dial-in ports with
>static IP addresses, and when the user logs out, only the rules regarding
>the used port/IP address should be removed.I did it already with Linux
>2.0.28, modified pppd and perl scripts, but was wondering if any other
>solution exist already.
>
>Anyone to share experience? Will summarize if the interest is enough.
>
>Thanks in advance.



From firewalls-owner  Thu Feb  6 17:18:44 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA01130 for firewalls-outgoing; Thu, 6 Feb 1997 13:47:59 -0800 (PST)
Received: from news.ptes.com ([138.112.199.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id NAA00968 for <firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 13:47:18 -0800 (PST)
Received: from [138.112.190.103] (mike.ptes.com [138.112.190.103])
	by news.ptes.com (8.8.5/8.8.5) with SMTP id NAA15626;
	Thu, 6 Feb 1997 13:40:49 -0800 (PST)
X-Sender: mike@moonlight
Message-Id: <v0213052faf1ff83dcc77@[138.112.190.103]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Thu, 6 Feb 1997 13:44:24 -0900
To: Ken Kempster <kempster@monarch.rnb.com>,
        Firewalls <firewalls@GreatCircle.COM>
From: mike@ptes.com (Mike Bernhardt)
Subject: Re: Gauntlet 3.2 on Solaris 2.5.1 server
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I have Gauntlet on a "Netra" server, which I believe is a SPARC20. It has
two Ethernet interfaces. I fixed the stuck-on-my-local-segment problem-
Gauntlet did not alter the /etc/netmasks file, so I had to open the subnet
mask that Solaris originally put in there. The proxies I've tested (ftp and
telnet) seem to work fine. However, my OpenWindows hangs too, and the http
admin page always says that the daemon "is no longer running." So, I 'd
like some answers too.

At 7:01 AM 2/6/97, Ken Kempster wrote:
>Has anyone had success installing Gauntlet 3.2
>on Solaris 2.5.1 server?
>
>After doing the pkgadd, everything seems to be broken.
>here are some of the highlights:
>1)can't communicate with anything off my local segment
>2)openwindows hangs.
>3)none of the proxies work;  all hang.
>etc.
>
>My hardware config. is a Sparc ultra with Solaris 2.5.1 server.
>
>Does anyone know of any issues with 2.5.1 and Gauntlet 3.2?
>
>any help would be great
>
>thanx.
>
>|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
>|  Ken Kempster                 kempster@monarch.rnb.com  |
>|  Network Systems Engineer          _\|/_                |
>|  Republic National Bank            (o o)                |
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~oOO-(_)-OOo~~~~~~~~~~~~~~



From firewalls-owner  Thu Feb  6 17:19:59 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA08231 for firewalls-outgoing; Thu, 6 Feb 1997 14:34:11 -0800 (PST)
Received: from igate1.hac.com (igate1.HAC.COM [192.48.33.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id OAA08161 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 14:33:36 -0800 (PST)
From: rlcopperman@CCGATE.HAC.COM
Received: from ises01.ES.HAC.COM ([147.16.5.2])
          by igate1.hac.com (8.8.4/8.8.4) with SMTP
	  id OAA07524 for <firewalls@greatcircle.com>; Thu, 6 Feb 1997 14:32:18 -0800 (PST)
Received: by ises01.ES.HAC.COM; id AA04108; Thu, 6 Feb 1997 14:32:22 -0800
Received: from cc:Mail by CCGATE.HAC.COM
	id AA855268514; Thu, 06 Feb 97 15:24:40 PST8
Date: Thu, 06 Feb 97 15:24:40 PST8
Message-Id: <9701068552.AA855268514@CCGATE.HAC.COM>
To: firewalls@greatcircle.com
Subject: Mial List
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

     Please
     REMOVE 
        me from this list


From firewalls-owner  Thu Feb  6 17:45:22 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id QAA21923 for firewalls-outgoing; Thu, 6 Feb 1997 16:07:40 -0800 (PST)
Received: from inet03.citec.qld.gov.au (inet03.citec.qld.gov.au [203.5.10.130]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id QAA21895 for <firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 16:07:28 -0800 (PST)
Received: by inet03.citec.qld.gov.au; id KAA11406; Fri, 7 Feb 1997 10:03:31 +1000
Received: from guru.citec.qld.gov.au(147.132.20.47) by inet03.citec.qld.gov.au via smap (3.2)
	id xma011404; Fri, 7 Feb 97 10:03:03 +1000
Received: (from sgcccdc@localhost) by guru.citec.qld.gov.au (8.6.12/8.6.12) id KAA24931; Fri, 7 Feb 1997 10:07:07 +1000
From: Colin Campbell <sgcccdc@citec.qld.gov.au>
Message-Id: <199702070007.KAA24931@guru.citec.qld.gov.au>
Subject: Re: Packet Filter rules...
To: beck@obtuse.com (Bob Beck)
Date: Fri, 7 Feb 1997 10:07:06 +1000 (EST)
Cc: firewalls@GreatCircle.COM
In-Reply-To: <199702061636.JAA02220@snouts.obtuse.com> from "Bob Beck" at Feb 6, 97 09:36:57 am
X-Mailer: ELM [version 2.4 PL24]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

My mailer thinks Bob Beck said:
> 
> > 
	[stuff]
> 	According to scripture God trusted the users too much and
> didn't have every app secured. He ended up having to expel users from
> the system after they violated the conditions of use.
> 
Of course he would, they tried to use an apple!

Colin :-)

Thank god I'm an athiest.

From firewalls-owner  Thu Feb  6 17:58:45 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA06107 for firewalls-outgoing; Thu, 6 Feb 1997 14:18:30 -0800 (PST)
Received: from maddie.atlantic.com (maddie.atlantic.com [198.252.200.3]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id OAA06082 for <firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 14:18:17 -0800 (PST)
Received: (from pokey@localhost) by maddie.atlantic.com (8.7.6/8.7.3) id SAA23861; Thu, 6 Feb 1997 18:14:14 -0500
From: Rick Romkey <pokey@maddie.atlantic.com>
Message-Id: <199702062314.SAA23861@maddie.atlantic.com>
Subject: Re: hardware requeriment.
To: martinw@epcorp.com (Martin C. Walker)
Date: Thu, 6 Feb 1997 18:14:13 -0500 (EST)
Cc: contanet@andromeda.tectel.com.mx, firewalls@GreatCircle.COM
In-Reply-To: <3.0.32.19970206131148.006a19b4@hellcat.epcorp.com> from "Martin C. Walker" at Feb 6, 97 01:11:50 pm
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


> 
> my recommendation, based on experience running fw-1 from sun on
> solariz x86 is NOT TO USE SOLARIS x86 !!!
> 
> This is not necessarilly because there is anything wrong with x86,
> but because there are few people in sunservice, or it appears in checkpoint
> who know anything about x86.  As soon as you mention you're running x86
> you get the standard reply "Oh!  well I don't really know anything about
> x86 but...".  It also raises add'l questions from the tech suppt people that
> can obscure the real issue because their lack of familiarity with it make
> them question things (or ignore things) they shouldn't.  Further, if you run
> into a problem which they need to duplicate they (sunservice) don't have
> x86 platforms in the lab, and must do it with sparc.  What they really means
> is that in order to duplicate the problem they use your production systems
> as a lab.

I disagree completely.  FW-1 for Solaris x86 works great, and support should
be coming directly from your reseller for the product.  I can't imagine
why you'd get blank "stares" from people about it...it works great here.
I think last time I checked, ours had been running for 92 days or so.

Too bad it doesn't run under Linux.

-Rick

----------------------------------------------------------------------------
 Rick E Romkey     |          A T L A N T I C           |     Internet
pokey@atlantic.com |  Computing Technology Corporation  |   Specialists
 (860) 667-9596    |     http://www.atlantic.com/       |    
-----------------------------------------------------------------------------


From firewalls-owner  Thu Feb  6 18:12:19 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA06317 for firewalls-outgoing; Thu, 6 Feb 1997 14:19:43 -0800 (PST)
Received: from xyzzy.plugh.edmonton.ab.ca (xyzzy.plugh.edmonton.ab.ca [198.161.22.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id NAA02397 for <Firewalls@GreatCircle.COM>; Thu, 6 Feb 1997 13:56:49 -0800 (PST)
Received: (from uucp@localhost) by xyzzy.plugh.edmonton.ab.ca (8.6.12/8.6.9) id OAA06009; Thu, 6 Feb 1997 14:54:32 -0700
Received: from snouts-gw.obtuse.com(192.168.30.61), claiming to be "snouts.obtuse.com"
 via SMTP by mailhost.plugh.edmonton.ab.ca, id smtpd06007aaa; Thu Feb  6 14:54:28 1997
Received: (from beck@localhost) by snouts.obtuse.com (8.7.5/8.7.3) id OAA02597; Thu, 6 Feb 1997 14:54:32 -0700
From: Bob Beck <beck@obtuse.com>
Message-Id: <199702062154.OAA02597@snouts.obtuse.com>
Subject: Re: Charge-Back
To: habeeb@Synopsys.COM (Habeeb Qadri)
Date: Thu, 6 Feb 1997 14:54:31 -0700 (MST)
Cc: Firewalls@GreatCircle.COM, mike@scio.demon.co.uk
In-Reply-To: <199702061444.GAA05591@flying.synopsys.com> from "Habeeb Qadri" at Feb 6, 97 06:44:37 am
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



	Most proxy based systems that I've seen have this, Ours
does (http://www.obtuse.com/juniper).

	-Bob


> 
> 
> Mike:
> 
> I know that the next version of CheckPoint's Firewall-1 (3.0) has:
> 
> "Network Usage Accounting: Provides data on session lengths and bytes transmitted"
> 
> This data could then be input into a charge-back program.
> 
> Habeeb Qadri
> Security Admin
> Synopsys, Inc
> Mountain View, CA, USA
> 	
> > From postmaster@synopsys.com  Thu Feb  6 04:41:37 1997
> > From: Mike Blaser <Mike@scio.demon.co.uk>
> > To: Firewalls@greatcircle.com
> > Subject: Charge-Back
> > Date: Thu, 06 Feb 1997 10:12:59 GMT
> > Mime-Version: 1.0
> > Content-Transfer-Encoding: quoted-printable
> > 
> > A question for all you corporate types out there.
> > 
> > Does anyone use the reporting capabilities of their firewall to allocate
> > costs to individual depratments/users so as to enable a charge-back
> > structure for internet usage?  Do most firewalls allow reportFrom firewalls-owner  Fri Feb  7 02:35:08 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id CAA03382 for firewalls-outgoing; Fri, 7 Feb 1997 02:06:07 -0800 (PST)
Received: from ns.mad.servicom.es (peterpan.mad.servicom.es [194.106.6.133]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id CAA03323 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 02:05:34 -0800 (PST)
From: jcgomez@mad.servicom.es
Received: from Servicom.mad.servicom.es by ns.mad.servicom.es (8.6.12/FI-3.3) Fri, 7 Feb 1997 11:09:00 +0100
Message-Id: <3.0.32.19970207110314.00730ea4@pop.mad.servicom.es>
X-Sender: jcgomez@pop.mad.servicom.es
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Fri, 07 Feb 1997 11:03:18 +0000
To: firewalls@GreatCircle.COM
Subject: TIS: plug-to UDP
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello,

Has anybody know how to pass UDP packets through a TIS firewall? 
With plug-to (this only permit TCP connections)?

Thanks in advance.

Juan Carlos.

From firewalls-owner  Fri Feb  7 05:04:33 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id EAA13796 for firewalls-outgoing; Fri, 7 Feb 1997 04:34:45 -0800 (PST)
Received: from precisionair.com (stmp.precisionair.com [38.248.203.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id EAA13723 for <firewalls@greatcircle.com>; Fri, 7 Feb 1997 04:34:12 -0800 (PST)
From: tjo@precisionair.com
Received: from r2d2 (r2d2.precisionair.com [38.248.203.5]) by precisionair.com (8.6.9/8.6.9) with SMTP id IAA14230; Fri, 7 Feb 1997 08:00:37 -0500
Message-Id: <2.2.32.19970207123348.0092be20@precisionair.com>
X-Sender: tjo@precisionair.com
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Fri, 07 Feb 1997 07:33:48 -0500
To: jcgomez@mad.servicom.es
Subject: Re: TIS: plug-to UDP
Cc: firewalls@greatcircle.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Juan,

The plug-gw proxy on the TIS gauntlet can only handle the TCP protocol.
However with IPFS (Read the fine man pages.) you can open up a filter into
you internal network to allow UDP in.  One of the problems being... 
Your external router (or, any specific host that you wish to use this
filter) will need to know a route into the internal network.

timothy j otis

At 11:03 AM 2/7/97 +0000, you wrote:
>Hello,
>
>Has anybody know how to pass UDP packets through a TIS firewall? 
>With plug-to (this only permit TCP connections)?
>
>Thanks in advance.
>
>Juan Carlos.
>
>


From firewalls-owner  Fri Feb  7 05:19:53 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id EAA14234 for firewalls-outgoing; Fri, 7 Feb 1997 04:43:38 -0800 (PST)
Received: from tuna.wang.com (TUNA.wang.com [150.124.136.4]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id EAA14224 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 04:43:15 -0800 (PST)
Received: from mars.wangfed.com (mars.Wangfed.COM [159.94.10.1])
    by tuna.wang.com (8.6.12/8.6.12tf1) with SMTP id HAA22380;
    Fri, 7 Feb 1997 07:42:09 -0500
Received: from uc0009.wangfed.com (uc0009 [159.94.10.15])
	by mars.wangfed.com (8.8.4/3.8) with SMTP
	id HAA25335; Fri, 7 Feb 1997 07:48:15 -0500 (EST)
Received: from [159.94.14.48] by uc0009.wangfed.com (BULL 5.61++/B.O.S 02.01)
	id AA08883; Fri, 7 Feb 97 07:32:51 -0500
Date: Fri, 7 Feb 97 07:32:51 -0500
Message-Id: <9702071232.AA08883@uc0009.wangfed.com>
From: "K.M."  <goertzek@wangfed.com>
Reply-To: "K.M."  <goertzek@wangfed.com>
To: jim@coltano.stortek.com, firewalls@GreatCircle.COM
Subject: Re: TEMPEST
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

In message <199702061621.JAA05056@coltano.stortek.com> Jim Wamsley 303-673-8163 
writes:
> You're all wrong 
> 
> NCSC Pub 1 defines tempest as a short title for the study of unintentional, 
> possibly compromising, spurious emanations.  
> 
> take it as gospel folks - they originated it.  according to folklore, when
> it was discovered that EMI could be captured and analyzed, the resulting
> furor and panic was likened to a tempest in a teapot.  hence the short title.


What you write does not prove that any of us are wrong.  We were expanding the 
TEMPEST acronym.  You defined what you believe TEMPEST is.  These two are not in
conflict, and your definition does nothing to disprove or negate the *CORRECT* 
expansion of the acronym.

KM



=====

K.M. Goertzel
Manager, Business Development
Secure Systems & Services Operation
WANG FEDERAL, Inc.
7900 Westpark Drive - MS 700
McLean, VA  22102-4299  USA
tel (703)827 3914
fax (703)827 3161 
email goertzek@wangfed.com


From firewalls-owner  Fri Feb  7 05:49:45 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id FAA17999 for firewalls-outgoing; Fri, 7 Feb 1997 05:40:37 -0800 (PST)
Received: from reflections.mindspring.com (reflections.mindspring.com [204.180.142.192]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id FAA17944 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 05:40:12 -0800 (PST)
Received: from localhost (lists@localhost) by reflections.mindspring.com (8.7.6/8.7.3) with SMTP id IAA27435; Fri, 7 Feb 1997 08:38:44 -0500
Date: Fri, 7 Feb 1997 08:38:44 -0500 (EST)
From: Todd Graham Lewis <lists@reflections.mindspring.com>
To: jcgomez@mad.servicom.es
cc: firewalls@GreatCircle.COM
Subject: Re: TIS: plug-to UDP
In-Reply-To: <3.0.32.19970207110314.00730ea4@pop.mad.servicom.es>
Message-ID: <Pine.LNX.3.95.970207083750.13253G-100000@reflections.mindspring.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Fri, 7 Feb 1997 jcgomez@mad.servicom.es wrote:

> Hello,

Hi.

> Has anybody know how to pass UDP packets through a TIS firewall? 

Use udprelay; cf. www.altavista.digital.com

> With plug-to (this only permit TCP connections)?

Plug-gw is, to my understanding, tcp only.

__
Todd Graham Lewis          Mindspring Enterprises      tlewis@mindspring.com


From firewalls-owner  Fri Feb  7 06:13:01 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id FAA18766 for firewalls-outgoing; Fri, 7 Feb 1997 05:49:00 -0800 (PST)
Received: from tuna.wang.com (TUNA.wang.com [150.124.136.4]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id EAA14527 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 04:47:20 -0800 (PST)
Received: from mars.wangfed.com (mars.Wangfed.COM [159.94.10.1])
    by tuna.wang.com (8.6.12/8.6.12tf1) with SMTP id HAA22453;
    Fri, 7 Feb 1997 07:45:57 -0500
Received: from uc0009.wangfed.com (uc0009 [159.94.10.15])
	by mars.wangfed.com (8.8.4/3.8) with SMTP
	id HAA25368; Fri, 7 Feb 1997 07:52:03 -0500 (EST)
Received: from [159.94.14.48] by uc0009.wangfed.com (BULL 5.61++/B.O.S 02.01)
	id AA08905; Fri, 7 Feb 97 07:36:40 -0500
Date: Fri, 7 Feb 97 07:36:40 -0500
Message-Id: <9702071236.AA08905@uc0009.wangfed.com>
From: "K.M."  <goertzek@wangfed.com>
Reply-To: "K.M."  <goertzek@wangfed.com>
To: rlcopperman@ccgate.hac.com, firewalls@GreatCircle.COM
Subject: Re: Mial List
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

In message <9701068552.AA855268514@CCGATE.HAC.COM>  writes:
>      Please
>      REMOVE 
>         me from this list


THe way to do this is to send an email to

majordomo@greatcircle.com

Leave the subject line blank.

In the text, type:  unsubscribe firewalls

Send the message.

Wasn't that simple?

=====

K.M. Goertzel
Manager, Business Development
Secure Systems & Services Operation
WANG FEDERAL, Inc.
7900 Westpark Drive - MS 700
McLean, VA  22102-4299  USA
tel (703)827 3914
fax (703)827 3161 
email goertzek@wangfed.com


From firewalls-owner  Fri Feb  7 06:25:38 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA20522 for firewalls-outgoing; Fri, 7 Feb 1997 06:03:23 -0800 (PST)
Received: from mail.Germany.EU.net (mail.germany.eu.net [192.76.144.65]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA20508 for <firewalls@greatcircle.com>; Fri, 7 Feb 1997 06:03:11 -0800 (PST)
Received: by mail.Germany.EU.net with ESMTP (5.59+:34/EUnetD-2.6.1.h) via EUnet
	id PAA17050; Fri, 7 Feb 1997 15:01:52 +0100
Received: (from smap@localhost) by prosecco. (fw-afx-1) id PAA37684 for <firewalls@greatcircle.com>; Fri, 7 Feb 1997 15:02:20 +0100
Received: from cerberus.ak.munich.ibm.com(9.23.4.12) by prosecco.munich.ibm.de via smap (V1.3)
	id sma025904; Fri Feb  7 15:01:54 1997
Received: from barolo.ak.munich.ibm.com (barolo.ak.munich.ibm.com [9.23.4.120]) by cerberus (8.8.3/8.7afx1) with ESMTP id PAA08326 for <firewalls@greatcircle.com>; Fri, 7 Feb 1997 15:01:22 +0100
Received: (from afx@localhost) by barolo (8.8.5/8.7afx2) id PAA19842; Fri, 7 Feb 1997 15:01:21 +0100
Message-ID: <19970207150121.OB10073@barolo.ak.munich.ibm.com>
Date: Fri, 7 Feb 1997 15:01:21 +0100
From: afx@ibm.de (Andreas Siegert)
To: firewalls@greatcircle.com (Firewall mailing list)
Subject: Obtuse smtpd and AIX name resolution
X-Mailer: Mutt 0.59.1
Mime-Version: 1.0
X-Organisation: EMEA AIX Security CoC / AIX ATG IBM Germany
X-Address: Anzinger Strasse 29, 81671 Muenchen, Germany
X-Phone: 498945044509 (internal 9454509), Fax 4223
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,
I am experimenting with the obtuse smtpd and so far I can not get it to
resolve names at all.
The jail has the resolver files. I tried static linking as well as copying
libc.a over.
No difference.
It accpets mail but it always claims it can not reverse resolve names (of
course they are resolvable in normal operation).
any ideas?
(AIX 4.1.4)
thx
afx
-- 
Andreas Siegert       afx@ibm.de / afx@barolo.ak.munich.ibm.com / AFX at IPNET
Every time we've moved ahead in IBM, it was because someone was willing to take
a chance, put his head on the block, and try something new - Thomas Watson, Jr.

From firewalls-owner  Fri Feb  7 07:17:38 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA26452 for firewalls-outgoing; Fri, 7 Feb 1997 06:52:36 -0800 (PST)
Received: from polaris.pacificnet.net (polaris.pacificnet.net [207.171.0.250]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA26442 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 06:52:28 -0800 (PST)
Received: from default (pm3a-1.pacificnet.net [207.171.18.2]) by polaris.pacificnet.net (8.6.11/8.6.11) with SMTP id GAA12946; Fri, 7 Feb 1997 06:47:10 -0800
Message-ID: <32FB4182.5B47@pacificnet.net>
Date: Fri, 07 Feb 1997 06:51:46 -0800
From: Osiris <osiris@pacificnet.net>
Reply-To: osiris@pacificnet.net
X-Mailer: Mozilla 3.01 (Win95; I)
MIME-Version: 1.0
To: "K.M." <goertzek@wangfed.com>
CC: firewalls@GreatCircle.COM
Subject: Re: TEMPEST
References: <9702071232.AA08883@uc0009.wangfed.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

K.M. wrote:

> K.M. Goertzel
> Manager, Business Development
> Secure Systems & Services Operation
> WANG FEDERAL, Inc.
  ^^^^^^^^^^^^^^^^^^

Hmmm. Now, THAT'S a secure operating system vendor...XTS-300 STOP 4.1.
Trusted path protection, (SAK,) SCS...spook material. Let me ask this:
isn't it true that with minor system alterations, an XTS-300 system
could be an extremely effective firewall? 
As a side note: Wang has integrated ActiveX technology into one of their
products, which is an imaging application. Are there any plans to
integrate ActiveX technology into other Wang products?

From firewalls-owner  Fri Feb  7 07:22:12 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA25204 for firewalls-outgoing; Fri, 7 Feb 1997 06:38:58 -0800 (PST)
Received: from CMSSOFT.STATE.IL.US (mvstcpa.state.il.us [163.191.193.129]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA25130 for <Firewalls@GREATCIRCLE.COM>; Fri, 7 Feb 1997 06:38:30 -0800 (PST)
Received: from INS084R1.STATE.IL.US by CMSSOFT.STATE.IL.US
        (Soft*Switch Central V4L40P1A) id 814635080097038FINS084R1;
        07 Feb 1997 08:35:08 GMT
Message-Id: <INS084R1.DSUITS.814635080097038FINS084R1@STATE.IL.US>
Date: 07 Feb 1997 08:35:08 GMT
From: "Duston Suits" <DSUITS@INS084R1.STATE.IL.US>
Subject: LanOptics OS/2
To: Firewalls@GREATCIRCLE.COM
Comment: MEMO 02/07/97 08:33:00
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

     Ok, don't laugh.  We're currently an OS/2 shop, and I noticed that
     LanOptics has an OS/2 firewall offering.  I'm seriously considering
     either Altavista or FireWall-1 on NT for our firewall, but I am far
     more familiar with OS/2 than NT (I have zero experience with Unix, so
     Unix is not an option).
     I also have concerns about NT performance.  I can get a character
     based shell for OS/2 which makes it really scream.  So, now the
     questions:

     1) How does the LanOptics product stand up to the other two?
     2) Since my skills are OS/2 and not-so-much NT, is it worth
     considering?
     3) Are my reservations about NT performance justified?

     TIA
     Duston Suits
     Webmaster, State of Illinois, Department of Insurance
     http://www.state.il.us/ins

From firewalls-owner  Fri Feb  7 07:38:58 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA24895 for firewalls-outgoing; Fri, 7 Feb 1997 06:35:49 -0800 (PST)
Received: from sierra.corsof.com (sierra.corsof.com [198.22.44.240]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA24836 for <Firewalls@greatcircle.com>; Fri, 7 Feb 1997 06:35:26 -0800 (PST)
Received: from dana.corsof.com by sierra.corsof.com with SMTP
	(8.6.12/16.2) id JAA00465; Fri, 7 Feb 1997 09:33:52 -0500
Message-Id: <3.0.32.19970207093510.006aebe0@pop.corsof.com>
X-Sender: dana@pop.corsof.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Fri, 07 Feb 1997 09:35:24 -0500
To: Firewalls@greatcircle.com
From: Dana Nowell <DanaNowell@corsof.com>
Subject: Re: Packet Filter rules...
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

It is hard to tell.  Fortunately for the vendors, GOD does not write
firewalls at all. Programming with omnipotence and omniscience might narrow
the market a wee bit :-).

>> Try going to the mountain and speaking with GOD.  Markus Ranum has
>
>As much as one may respect MJR, God doesn't write buffer over-runs in
>firewalls.
>
>- --
>Prof. Julian Assange  |If you want to build a ship, don't drum up people
>		      |together to collect wood and don't assign them tasks
>proff@iq.org          |and work, but rather teach them to long for the
endless
>proff@gnu.ai.mit.edu  |immensity of the sea. -- Antoine de Saint Exupery
>
>


Dana Nowell                               Voice (603) 595-7480 EXT 28
Cornerstone Software Inc.                 FAX   (603) 882-7313
Work: DanaNowell@corsof.com               Home: dana@nowell.mv.com
MIME attachments preferred, BINHEX and uuencoded acceptable.
As usual, I speak only for myself.
  

From firewalls-owner  Fri Feb  7 07:51:30 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA01160 for firewalls-outgoing; Fri, 7 Feb 1997 07:29:17 -0800 (PST)
Received: from mail.swip.net (mn4.swip.net [192.71.180.65]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id HAA01138 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 07:29:06 -0800 (PST)
Received: from wintermute.marievik.findata.se by mail.swip.net (8.6.8/3.01)
	id QAA16384; Fri, 7 Feb 1997 16:28:01 +0100
Received: from wintermute.marievik.findata.se (ckn@wintermute.marievik.findata.se [192.71.39.5]) by wintermute.marievik.findata.se (8.6.4/8.6.4) with SMTP id QAA17443; Fri, 7 Feb 1997 16:27:48 +0100
Date: Fri, 7 Feb 1997 16:27:47 +0100 (MET)
From: Carl Karlsson <ckn@findata.se>
X-Sender: ckn@wintermute.marievik.findata.se
To: Andreas Siegert <afx@ibm.de>
cc: Firewall mailing list <firewalls@GreatCircle.COM>
Subject: Re: Obtuse smtpd and AIX name resolution
In-Reply-To: <19970207150121.OB10073@barolo.ak.munich.ibm.com>
Message-ID: <Pine.SUN.3.93.970207162525.17304B-100000@wintermute.marievik.findata.se>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


On Fri, 7 Feb 1997, Andreas Siegert wrote:

> I am experimenting with the obtuse smtpd and so far I can not get it to
> resolve names at all.
> The jail has the resolver files. I tried static linking as well as copying

I thought I had all the files too until I did an strace. I was missing my
/etc/hosts file (wasn't using a nameserver).


  Calle


From firewalls-owner  Fri Feb  7 07:53:36 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA25611 for firewalls-outgoing; Fri, 7 Feb 1997 06:42:01 -0800 (PST)
Received: from reflections.mindspring.com (reflections.mindspring.com [204.180.142.192]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id GAA25603 for <firewalls@greatcircle.com>; Fri, 7 Feb 1997 06:41:51 -0800 (PST)
Received: from localhost (lists@localhost) by reflections.mindspring.com (8.7.6/8.7.3) with SMTP id JAA27722 for <firewalls@greatcircle.com>; Fri, 7 Feb 1997 09:40:47 -0500
Date: Fri, 7 Feb 1997 09:40:47 -0500 (EST)
From: Todd Graham Lewis <lists@reflections.mindspring.com>
To: Firewalls Mailing List <firewalls@greatcircle.com>
Subject: Re: TEMPEST
In-Reply-To: <9702071232.AA08883@uc0009.wangfed.com>
Message-ID: <Pine.LNX.3.95.970207093939.27505C-100000@reflections.mindspring.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Oh, I'm sorry.  I thought that this was the firewalls mailing list.  I
guess the title misled me.

__
Todd Graham Lewis          Mindspring Enterprises      tlewis@mindspring.com



On Fri, 7 Feb 1997, K.M. wrote:

> In message <199702061621.JAA05056@coltano.stortek.com> Jim Wamsley 
> 303-673-8163 writes:
>
> > You're all wrong 
> > 
> > NCSC Pub 1 defines tempest as a short title for the study of unintentional, 
> > possibly compromising, spurious emanations.  
> > 
> > take it as gospel folks - they originated it.  according to folklore, when
> > it was discovered that EMI could be captured and analyzed, the resulting
> > furor and panic was likened to a tempest in a teapot.  hence the short title.
> 
> 
> What you write does not prove that any of us are wrong.  We were expanding the 
> TEMPEST acronym.  You defined what you believe TEMPEST is.  These two are not in
> conflict, and your definition does nothing to disprove or negate the *CORRECT* 
> expansion of the acronym.


From firewalls-owner  Fri Feb  7 07:57:09 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA24651 for firewalls-outgoing; Fri, 7 Feb 1997 06:34:25 -0800 (PST)
Received: from relay.rv.tis.com (relay.rv.tis.com [204.254.155.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id GAA24643 for <firewalls@greatcircle.com>; Fri, 7 Feb 1997 06:34:18 -0800 (PST)
Received: by relay.rv.tis.com; id JAA25430; Fri, 7 Feb 1997 09:39:48 -0500 (EST)
Received: from dira.rv.tis.com(10.0.1.43) by relay.rv.tis.com via smap (3.2)
	id xma025407; Fri, 7 Feb 97 09:39:36 -0500
Received: from unit65.rv.tis.com (dyn097.hq.tis.com [10.33.10.97]) by dira.rv.tis.com (8.7.4/8.7.3) with SMTP id JAA02458; Fri, 7 Feb 1997 09:25:25 -0500 (EST)
Message-Id: <3.0.32.19970207093237.006e6044@pop.rv.tis.com>
X-Sender: avolio@pop.rv.tis.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Fri, 07 Feb 1997 09:32:38 -0500
To: tjo@precisionair.com, jcgomez@mad.servicom.es
From: Frederick M Avolio <avolio@tis.com>
Subject: Re: TIS: plug-to UDP
Cc: firewalls@greatcircle.com
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

This is, of course, frightening.  Why buy a proxy-based firewall if you are
going to then allow UDP services through it via a packet filter?

If this is the FWTK, you ought to float this by the people on that list. If
this is the Gauntlet Internet Firewall, you ought to discuss it with
technical support at the company from which you bought it.

Fred


At 07:33 AM 2/7/97 -0500, tjo@precisionair.com wrote:
>Juan,
>
>The plug-gw proxy on the TIS gauntlet can only handle the TCP protocol.
>However with IPFS (Read the fine man pages.) you can open up a filter into
>you internal network to allow UDP in.  One of the problems being... 
>Your external router (or, any specific host that you wish to use this
>filter) will need to know a route into the internal network.
>
>timothy j otis
>
>At 11:03 AM 2/7/97 +0000, you wrote:
>>Hello,
>>
>>Has anybody know how to pass UDP packets through a TIS firewall? 
>>With plug-to (this only permit TCP connections)?
>>
>>Thanks in advance.
>>
>>Juan Carlos.
>>
>>
>
>

From firewalls-owner  Fri Feb  7 08:09:19 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA01559 for firewalls-outgoing; Fri, 7 Feb 1997 07:32:01 -0800 (PST)
Received: from ACML.COM ([207.140.173.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id HAA01525 for <firewalls@greatcircle.com>; Fri, 7 Feb 1997 07:31:47 -0800 (PST)
Received: from smtpngw.acml.com by ACML.COM (SMI-8.6/SMI-SVR4)
	id KAA18610; Fri, 7 Feb 1997 10:30:33 -0500
Received: by smtpngw.acml.com (IBM OS/2 SENDMAIL VERSION 1.3.17/2.12um) id AA0119; Fri, 07 Feb 97 10:27:59 -0500
Message-Id: <9702071527.AA0119@smtpngw.acml.com>
Received: from ALLIANCE with "Lotus Notes Mail Gateway for SMTP" id
  58751B3D5E34A91385256437004C58E0; Fri,  7 Feb 97 10:27:59 
To: firewalls <firewalls@greatcircle.com>
From: John Chen/New York/ACMC
  <John_Chen@ACML.COM>
Date:  7 Feb 97  9:03:20 
Subject: FW-1 license
Mime-Version: 1.0
Content-Type: Text/Plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi all

I have a question of FW-1 license, does FW-1 2.1 of Solaris version only 
license by hostid?

I'd like to build up a standby machine as backup of the production FW-1, if the 
license is hostid based, means I have to buy a second license.  If license is 
IP address based, I can have it setup and ready to go.  In case of the 
production machine is down, just simply tuen it on and plug into the network.

Any recommendation?

Thanks.

From firewalls-owner  Fri Feb  7 08:20:21 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA27894 for firewalls-outgoing; Fri, 7 Feb 1997 07:05:16 -0800 (PST)
Received: from dns.eng.auburn.edu (dns.eng.auburn.edu [131.204.10.13]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id HAA27884 for <firewalls@greatcircle.com>; Fri, 7 Feb 1997 07:05:08 -0800 (PST)
Received: from netman.eng.auburn.edu (netman.eng.auburn.edu [131.204.12.24]) by dns.eng.auburn.edu (8.7.6/8.6.4) with ESMTP id JAA01970; Fri, 7 Feb 1997 09:04:03 -0600 (CST)
From: Doug Hughes <Doug.Hughes@Eng.Auburn.EDU>
Received: (doug@localhost) by netman.eng.auburn.edu (SMI-8.6/8.6.4) id JAA23488; Fri, 7 Feb 1997 09:04:03 -0600
Date: Fri, 7 Feb 1997 09:04:03 -0600
Subject: Re: ftp deamons 
To: crr@boris.umds.ac.uk
Cc: firewalls@greatcircle.com
Message-Id: <doug-970207090402.A0C21696@netman.eng.auburn.edu>
X-Mailer: TkMail 4.0beta8
In-Reply-To: <199702061900.TAA28341@boris.umds.ac.uk> 
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



>-----BEGIN PGP SIGNED MESSAGE-----
>
>
>Hi,
>	We have been using wu-ftpd on a Sun at our site to provide an 
>anonymous ftp service. The other day I was fiddling around with
>the configeration of it to allow someone to upload some files. 
>I went home, had a few days off with flu and came back to
>find it full of warez beccause I had trashed the configeration
>without realising it. So last week I had about one person every 30
>seconds wanting to download DieHard or somesuch.
>
>This prompted Charlie, a colleague of mine, to get aftpd by Marcus Ranum, 
>originaly from tis.com. The idea was that we would check over the code
>maybe hack it a little to do what we want and install it in place of 
>the bloated wu-ftpd. 
>
>Unfortunatley Charlie has gone into full hacker mode and though claiming to
>be simplifying and minimalising the code -  he says there are bits he doesn't 
>like, the parser for instance, the whole thing does more that we need 
>anyway and it really ought to be  ansi C nowadays - I am sure we will end 
>up with something marvelously baroque. What's more he is supposed to be 
>finishing his PhD.
>
>Obviously there is a lot to be said for using small deamons with 
>easily verifiable code in this situation, and so I was wondering if
>anyone knew of any other small PD sources of ftp we could have 
>a look at. Then I can stop Charlie from re-inventing the wheel and avoid the
>ire of his PhD supervisor - who is also my manager.
>

I very much like the ftpd included with logdaemon for this
purpose. It is very small and verifiable. Nothing fancy.
It will do S/Key if you want it to. I've added ident support
to my version of it. It works great. Only one security hole
ever that I'm aware of. It was a signals one that also affected
just about every ftpd. Fixed within hours.

--
____________________________________________________________________________
Doug Hughes					Engineering Network Services
System/Net Admin  				Auburn University
			doug@eng.auburn.edu



From firewalls-owner  Fri Feb  7 08:36:10 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA07918 for firewalls-outgoing; Fri, 7 Feb 1997 08:27:50 -0800 (PST)
Received: from glacier.wise.edt.ericsson.se (glacier-ext.wise.edt.ericsson.se [193.180.251.38]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id IAA07887 for <firewalls@greatcircle.com>; Fri, 7 Feb 1997 08:27:37 -0800 (PST)
Received: from gilbeys.nmac.ericsson.se (gilbeys.nmac.ericsson.se [130.100.187.67]) by glacier.wise.edt.ericsson.se (8.7.5/8.7.3/glacier-0.9) with SMTP id RAA10898 for <firewalls@greatcircle.com>; Fri, 7 Feb 1997 17:26:28 +0100 (MET)
Received: by gilbeys.nmac.ericsson.se (SMI-8.6/SMI-SVR4)
	id RAA09386; Fri, 7 Feb 1997 17:29:02 +0100
Date: Fri, 7 Feb 1997 17:29:02 +0100
From: etxrosd@nmac.ericsson.se (Robert Stahlbrand)
Message-Id: <199702071629.RAA09386@gilbeys.nmac.ericsson.se>
To: firewalls@greatcircle.com
Subject: Tune Linux to route faster?
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-MD5: ueoUD6sFlCbJqlr4h30RXg==
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi!

We are planning on using TIS on a Linux bastion-host as the firewall.=20
Is there anyone who knows if it's possible to tune the Linux-kernel to =
give the=20
routing-process higher priority to speed up the routing?

Speed up the routing? Not really, but there are delays before the =
machine=20
actually begins to route and that is what we are trying to minimize!
Why not using a screening-router? Or idea' is to build a firewall which =
is=20
really cheap but as good as any commercial firewall.

/Robert St=E5hlbrand, Ericsson Telecom AB

From firewalls-owner  Fri Feb  7 09:20:58 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA12348 for firewalls-outgoing; Fri, 7 Feb 1997 09:13:16 -0800 (PST)
Received: from gatekeeper.premenos.com (mail.premenos.com [150.105.250.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id JAA12341 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 09:13:09 -0800 (PST)
Received: from localhost (smap@localhost) by gatekeeper.premenos.com (8.6.5/8.6.5) id JAA24584 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 09:14:55 -0800
Received: from coyote.premenos.com(150.105.104.245) by mail.premenos.com via smap (V1.3mjr)
	id sma024558; Fri Feb  7 09:13:56 1997
Received: by coyote.premenos.com (SMI-8.6/SMI-SVR4)
	id JAA01881; Fri, 7 Feb 1997 09:12:32 -0800
From: jmizzi@utu.premenos.com (John Mizzi)
Message-Id: <199702071712.JAA01881@coyote.premenos.com>
Subject: Altavista Tunnel
To: firewalls@GreatCircle.COM
Date: Fri, 7 Feb 1997 09:12:31 -0800 (PST)
X-Mailer: ELM [version 2.4 PL24]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Has anyone used the Altavista Tunnel ?


If so what are your opinions ?


Are there any similiar products which provide the same functionality as the
Altavista Tunnel ??


John


From firewalls-owner  Fri Feb  7 09:35:09 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA10489 for firewalls-outgoing; Fri, 7 Feb 1997 08:55:47 -0800 (PST)
Received: from portal2.ameritech.com (portal2.ameritech.com [198.186.232.49]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id IAA10468 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 08:55:21 -0800 (PST)
From: MARK.ELIAS@x400gw.ameritech.com
Received: by portal2.ameritech.com id AA02658
  (InterLock SMTP Gateway 3.0 for firewalls@GreatCircle.COM);
  Fri, 7 Feb 1997 11:53:52 -0500
Received: by portal2.ameritech.com (Internal Mail Agent-2);
  Fri, 7 Feb 1997 11:53:52 -0500
Received: by portal2.ameritech.com (Internal Mail Agent-1);
  Fri, 7 Feb 1997 11:53:52 -0500
Date: 7 Feb 97 11:51:19 -0500
To: firewalls@GreatCircle.COM,
        /DDV=jcgomez#064#mad.servicom.es/DDT=RFC-822/S=jcgomez/P=AMRTCH4/A=MCI/C=US/@x400gw.ameritech.com
Subject: RE: TIS: plug-to UDP
In-Reply-To: <3.0.32.19970207110314.00730ea4@pop.mad.servicom.es>
Message-Id: <H000035c05c82542*/PN=Mark.Elias/OU=AIT5/PRMD=AMRTCH4/ADMD=MCI/C=US/@MHS>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Has anybody know how to pass UDP packets through a TIS firewall? 
> With plug-to (this only permit TCP connections)?
> 
> Thanks in advance.
> 
> Juan Carlos.

Check out UDP relay.

It's at ftp://coast.cs.purdue.edu/pub/tools/unix/udprelay-0.2.tar.gz

Be aware that TIS does not actively support passing UDP traffic.


From firewalls-owner  Fri Feb  7 09:49:47 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA13683 for firewalls-outgoing; Fri, 7 Feb 1997 09:33:18 -0800 (PST)
Received: from Aptech.com (joshua.aptech.com [199.29.185.34]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id JAA13585 for <firewalls@greatcircle.com>; Fri, 7 Feb 1997 09:32:37 -0800 (PST)
Received: by Aptech.com (SMI-8.6/SMI-SVR4)
	id JAA00229; Fri, 7 Feb 1997 09:07:50 -0800
Received: from UNKNOWN(199.29.185.132), claiming to be "naomi.Aptech.com"
 via SMTP by joshua, id smtpdAAAa0003P; Fri Feb  7 09:04:46 1997
Received: from amos.Aptech.com by naomi.Aptech.com (SMI-8.6/SMI-SVR4)
	id IAA22214; Fri, 7 Feb 1997 08:47:51 -0800
Received: by amos.Aptech.com (SMI-8.6/SMI-SVR4)
	id IAA27009; Fri, 7 Feb 1997 08:47:51 -0800
Date: Fri, 7 Feb 1997 08:47:51 -0800
From: sjones@Aptech.com (Samuel D. Jones)
Message-Id: <199702071647.IAA27009@amos.Aptech.com>
To: firewalls@greatcircle.com
Subject: tripwire file change report
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

Tripwire detected this file on my Solaris mailhost called 
/var/uucp/.Admin/command which used to 
have 0 bytes and now has 75 bytes as follows:

daemon (2/5-12:45:08) uux - -r -aMailer-Daemon@elijah frbkc!rmail (alshen)

Any ideas what this is about?


-------------------------------
| Samuel D. Jones             |
|                             |
| Phone:   (206) 432-7855     |
| FAX:     (206) 432-7832     |
| E-mail:  sjones@Aptech.com  |
-------------------------------

From firewalls-owner  Fri Feb  7 10:04:50 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA11549 for firewalls-outgoing; Fri, 7 Feb 1997 09:05:03 -0800 (PST)
Received: from suntan.tandem.com (suntan.tandem.com [192.216.221.8]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id JAA11512 for <firewalls@greatcircle.com>; Fri, 7 Feb 1997 09:04:48 -0800 (PST)
Received: from adm.loc201.tandem.com by suntan.tandem.com (8.6.12/suntan5.961027) 
	id JAA18393; Fri, 7 Feb 1997 09:02:39 -0800
Received: from vern.loc201.tandem.com by adm.loc201.tandem.com (4.1/6main.940209)
	id AA27756; Fri, 7 Feb 97 09:02:36 PST
Received: by vern.loc201.tandem.com (5.x/6nospool.940209)
	id AA03502; Fri, 7 Feb 1997 09:01:32 -0800
Date: Fri, 7 Feb 1997 09:01:32 -0800
Message-Id: <9702071701.AA03502@vern.loc201.tandem.com>
To: firewalls@greatcircle.com, fw-1-mailinglist@us.checkpoint.co
Subject: FW-1 license
Cc: John_Chen@acml.com
From: pat@tandem.com
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

All my systems (Solaris and SunOS) are licensed by IP address.

                            -pat

----- Begin Included Message -----

From postmaster@tandem.com Fri Feb  7 08:58:36 1997
To: firewalls <firewalls@greatcircle.com>
From: John Chen/New York/ACMC
  <John_Chen@acml.com>
Date:  7 Feb 97  9:03:20 
Subject: FW-1 license
Mime-Version: 1.0
Sender: firewalls-owner@greatcircle.com

Hi all

I have a question of FW-1 license, does FW-1 2.1 of Solaris version only 
license by hostid?

I'd like to build up a standby machine as backup of the production FW-1, if the 
license is hostid based, means I have to buy a second license.  If license is 
IP address based, I can have it setup and ready to go.  In case of the 
production machine is down, just simply tuen it on and plug into the network.

Any recommendation?

Thanks.


----- End Included Message -----


From firewalls-owner  Fri Feb  7 10:35:09 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id KAA18799 for firewalls-outgoing; Fri, 7 Feb 1997 10:20:42 -0800 (PST)
Received: from reflections.mindspring.com (reflections.mindspring.com [204.180.142.192]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id KAA18745 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 10:20:26 -0800 (PST)
Received: from localhost (lists@localhost) by reflections.mindspring.com (8.7.6/8.7.3) with SMTP id NAA28912; Fri, 7 Feb 1997 13:19:04 -0500
Date: Fri, 7 Feb 1997 13:19:04 -0500 (EST)
From: Todd Graham Lewis <lists@reflections.mindspring.com>
To: Robert Stahlbrand <etxrosd@nmac.ericsson.se>
cc: firewalls@GreatCircle.COM
Subject: Re: Tune Linux to route faster?
In-Reply-To: <199702071629.RAA09386@gilbeys.nmac.ericsson.se>
Message-ID: <Pine.LNX.3.95.970207131419.27855A-100000@reflections.mindspring.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Fri, 7 Feb 1997, Robert Stahlbrand wrote:

> Hi!

Hello.

> We are planning on using TIS on a Linux bastion-host as the firewall. 
> Is there anyone who knows if it's possible to tune the Linux-kernel to give the 
> routing-process higher priority to speed up the routing?

I'm confused.  Do you mean the FWTK?  If so, then Linux is doing no
"routing" in that capacity.

> Speed up the routing? Not really, but there are delays before the machine 
> actually begins to route and that is what we are trying to minimize!
> Why not using a screening-router? Or idea' is to build a firewall which is 
> really cheap but as good as any commercial firewall.

There's no question that that is possible; I like to think I've done it
myself, and using Linux too.  If you're using ipfwadm &c to do packet
filtering, then there is nothing you can do to speed it up other than
write your ruleset to minimize the average time the kernel spends walking
your rule list.  If you're running the FWTK, which are mostly inetd-based
tools, then you might want to look into daemonizing them.  We did that to
plug-gw, and it really helped a lot.

Best of luck; mail if problems.

__
Todd Graham Lewis          Mindspring Enterprises      tlewis@mindspring.com


From firewalls-owner  Fri Feb  7 11:05:20 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id KAA24679 for firewalls-outgoing; Fri, 7 Feb 1997 10:59:40 -0800 (PST)
Received: from mx.ProNetC.com (ns.ProNetC.com [38.225.60.66]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id KAA24668 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 10:59:33 -0800 (PST)
Received: from mailhub.ProNetC.com (solaris.ProNetC.com [38.225.60.130]) by mx.ProNetC.com id KAA00778 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 10:59:42 -0800 (PST)
Received: by a host running sendmail id LAA01310 for firewalls@GreatCircle.COM; Fri, 7 Feb 1997 11:01:49 -0800 (PST)
From: Tom Lojewski <thl@ProNetC.com>
Message-Id: <199702071901.LAA01310@mailhub.ProNetC.com>
Subject: SUN's Stealth Product
To: firewalls@GreatCircle.COM
Date: Fri, 7 Feb 1997 11:01:48 -0800 (PST)
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Firewallers,

I've heard murmurings of SUN's Stealth product but have never heard it
mentioned on this list.  Does anyone know anything about it?

--Mel

From firewalls-owner  Fri Feb  7 11:20:06 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA26740 for firewalls-outgoing; Fri, 7 Feb 1997 11:15:47 -0800 (PST)
Received: from halon.sybase.com (halon.sybase.com [192.138.151.33]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id LAA26712 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 11:15:34 -0800 (PST)
Received: from smtp1.sybase.com (sybgate.sybase.com [130.214.220.35])
          by halon.sybase.com (8.8.4/8.8.4) with SMTP
	  id LAA03499 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 11:17:01 -0800 (PST)
Received: from notesgw2.sybase.com by smtp1.sybase.com (4.1/SMI-4.1/SybH3.5-030896)
	id AA04400; Fri, 7 Feb 97 11:14:37 PST
Received: by notesgw2.sybase.com (5.x/SMI-4.1/SybEGW3.3)
	id AA11104; Fri, 7 Feb 1997 11:14:11 -0800
Message-Id: <9702071914.AA11104@notesgw2.sybase.com>
Received: by SybaseNotes (Lotus Notes Mail Gateway for SMTP V1.1) id
  E1CA2BCFB6995D8D882564370069F495; Fri,  7 Feb 97 11:14:09 EDT
To: pat <pat@tandem.com>
Cc: firewalls <firewalls@GreatCircle.COM>,
        fw-1-mailinglist
 <fw-1-mailinglist@us.checkpoint.co>,
        John_Chen <John_Chen@acml.com>
From: Ryan Russell/SYBASE
  <Ryan.Russell@sybase.com>
Date:  7 Feb 97 11:17:40 EDT
Subject: Re: FW-1 license
X-Lotus-Type: Reply All
Mime-Version: 1.0
Content-Type: Text/Plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Funny...mine are licensed my IP Address AND Hostid.

     Ryan

---------- Previous Message ----------
To: firewalls, fw-1-mailinglist
cc: John_Chen
From: pat @ tandem.com @ smtp
Date: 02/07/97 09:01:32 AM
Subject: FW-1 license

All my systems (Solaris and SunOS) are licensed by IP address.

                            -pat

----- Begin Included Message -----

From postmaster@tandem.com Fri Feb  7 08:58:36 1997
To: firewalls <firewalls@greatcircle.com>
From: John Chen/New York/ACMC
  <John_Chen@acml.com>
Date:  7 Feb 97  9:03:20 
Subject: FW-1 license
Mime-Version: 1.0
Sender: firewalls-owner@greatcircle.com

Hi all

I have a question of FW-1 license, does FW-1 2.1 of Solaris version only 
license by hostid?

I'd like to build up a standby machine as backup of the production FW-1, if the 
license is hostid based, means I have to buy a second license.  If license is 
IP address based, I can have it setup and ready to go.  In case of the 
production machine is down, just simply tuen it on and plug into the network.

Any recommendation?

Thanks.


----- End Included Message -----





From firewalls-owner  Fri Feb  7 11:37:59 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA27643 for firewalls-outgoing; Fri, 7 Feb 1997 11:23:51 -0800 (PST)
Received: from netcom22.netcom.com (netcom22.netcom.com [192.100.81.136]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id LAA27558 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 11:23:25 -0800 (PST)
Received: (from mwallace@localhost) by netcom22.netcom.com (8.6.13/Netcom)
	id LAA09527; Fri, 7 Feb 1997 11:22:12 -0800
Date: Fri, 7 Feb 1997 11:22:12 -0800 (PST)
From: Matt Wallace <mwallace@netcom.com>
Subject: RE: Help Raptor-EagleNT306 Domain Entity
To: Frank Schuurman <SchuurmF@msgw.rijnhaave.nl>
cc: "'firewalls@GreatCircle.COM'" <firewalls@GreatCircle.COM>
In-Reply-To: <c=NL%a=_%p=Rijnhaave%l=RIJNHAAVE/ROA/00012B5D@imail.syntegra.nl>
Message-ID: <Pine.3.89.9702071126.A8439-0100000@netcom22>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


It is not in the 4.0 version that is on Solaris, and I understand the NT 
will be functionally equivalent. Of course, setting up security based on
domains is a bad idea. Subnets are IP based, and therefore 'safer'. Even 
those should not be trusted. Domain names, because of the open nature of DNS,
should never be relied upon for determining access. 

Use a secure method to restrict access.

-Matt

On Fri, 7 Feb 1997, Frank Schuurman wrote:

> Hi,
> 
> For what I heard it will be in the NT 4.0 version.
> 
> Gr. Frank
> 
> ----------
> From:  Bob Gammage[SMTP:rlgammag@use.usit.net]
> Sent:  Thursday, February 06, 1997 1:08 PM
> To:  raptor-list@raptor.com; firewalls@GreatCircle.COM
> Subject:  Help Raptor-EagleNT306 Domain Entity
> 
> I've installed EagleNT-3.06 for a customer and their
> security policy requires authorizations based upon
> domains rather than hosts or subnets.
> Unfortunately, I've not been able to get these to work.
> All I ever get is a cannot lookup <domain name> failure
> in the Eagel Log.
> (1) Will not accept "*.microsoft.com"
> (2) fails on "microsoft.com" and ".microsoft.com" and
> 	both of these with trailing dots.
> 
> TIAFAA
> Bob Gammage
> 

From firewalls-owner  Fri Feb  7 12:05:30 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA02135 for firewalls-outgoing; Fri, 7 Feb 1997 11:56:57 -0800 (PST)
Received: from andromeda.raksnet.com.tr (andromeda.raksnet.com.tr [194.54.48.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id LAA02110 for <firewalls@greatcircle.com>; Fri, 7 Feb 1997 11:56:47 -0800 (PST)
Received: from sir ([194.54.50.77]) by andromeda.raksnet.com.tr
          (Netscape Mail Server v2.0) with SMTP id AAA17714
          for <firewalls@greatcircle.com>; Fri, 7 Feb 1997 21:58:11 +0300
Message-ID: <32FB88D4.527E864B@raksnet.com.tr>
Date: Fri, 07 Feb 1997 21:56:04 +0200
From: Baris Cenberci <Baris.Cenberci@raksnet.com.tr>
Organization: RAKSNet Iletisim Teknoloji ve Tic. AS
X-Mailer: Mozilla 3.01Gold (X11; I; Linux 2.0.28 i586)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: Re: Tune Linux to route faster?
References: <199702071629.RAA09386@gilbeys.nmac.ericsson.se>
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Robert Stahlbrand wrote:
> 
> Hi!
> 
> We are planning on using TIS on a Linux bastion-host as the firewall.
> Is there anyone who knows if it's possible to tune the Linux-kernel to give the
> routing-process higher priority to speed up the routing?
> 
> Speed up the routing? Not really, but there are delays before the machine
> actually begins to route and that is what we are trying to minimize!
> Why not using a screening-router? Or idea' is to build a firewall which is
> really cheap but as good as any commercial firewall.
> 
> /Robert Ståhlbrand, Ericsson Telecom AB

If you are planning to build up a bastion host, you must turn the
routing OFF, not speed up it. The logic behind the bastion host is to
block the packets, not to forward them. 

You may be able to compile the kernel with the option 'optimize as
router' with a little configuration work, which minimizes the host
facilities of the Linux box, get rid of the unused services, and give a
'nicer' values to the TIS proxies which will speed up the Bastion host.

-- 
B.C.
=={:{)*
e-mail=Baris.Cenberci@raksnet.com.tr

From firewalls-owner  Fri Feb  7 13:49:50 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA13149 for firewalls-outgoing; Fri, 7 Feb 1997 13:41:50 -0800 (PST)
Received: from xyzzy.plugh.edmonton.ab.ca (xyzzy.plugh.edmonton.ab.ca [198.161.22.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id NAA13141 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 13:41:37 -0800 (PST)
Received: (from uucp@localhost) by xyzzy.plugh.edmonton.ab.ca (8.6.12/8.6.9) id OAA12507; Fri, 7 Feb 1997 14:40:24 -0700
Received: from snouts-gw.obtuse.com(192.168.30.61), claiming to be "snouts.obtuse.com"
 via SMTP by mailhost.plugh.edmonton.ab.ca, id smtpd12505aaa; Fri Feb  7 14:40:19 1997
Received: (from beck@localhost) by snouts.obtuse.com (8.7.5/8.7.3) id OAA03908; Fri, 7 Feb 1997 14:40:28 -0700
From: Bob Beck <beck@obtuse.com>
Message-Id: <199702072140.OAA03908@snouts.obtuse.com>
Subject: Re: Tune Linux to route faster?
To: Baris.Cenberci@raksnet.com.tr (Baris Cenberci)
Date: Fri, 7 Feb 1997 14:40:26 -0700 (MST)
Cc: firewalls@GreatCircle.COM
In-Reply-To: <32FB88D4.527E864B@raksnet.com.tr> from "Baris Cenberci" at Feb 7, 97 09:56:04 pm
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



> If you are planning to build up a bastion host, you must turn the
> routing OFF, not speed up it. The logic behind the bastion host is to
> block the packets, not to forward them.=20
> 
> You may be able to compile the kernel with the option 'optimize as
> router' with a little configuration work, which minimizes the host
> facilities of the Linux box, get rid of the unused services, and give a
> 'nicer' values to the TIS proxies which will speed up the Bastion host.
> 

	In the traditional dual homed bastion host setup, yes this is
what you do. However there is also nothing preventing someone from
running a dual homed bastion with forwarding on and a restrictive set
of filters running to prevent most stuff passing. It's probably not my
idea of a good time, but you can certainly do it. You could even
concievably have multiple interfaces on the machine with a third card
for a pseudo-dmz containing say, a web server with access controlled
by the packet filters on the machine, which allow traffic routed into
the dmz but not out from the inside, etc. 

	Nevertheless normally if you're routing on a machine you're
runing FWTK on you need to ask yourself very carefully if that is 
really what you want and if there isn't a better way.

	-Bob



From firewalls-owner  Fri Feb  7 14:28:54 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA14108 for firewalls-outgoing; Fri, 7 Feb 1997 13:58:07 -0800 (PST)
Received: from hcat.epcorp.com (typhoon.epcorp.com [198.30.14.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id NAA14099 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 13:57:55 -0800 (PST)
Received: from [198.30.12.230] by hcat.epcorp.com id aa05181; 7 Feb 97 16:45 EST
Message-Id: <3.0.32.19970207162534.0068fbcc@hellcat.epcorp.com>
X-Sender: martinw@hellcat.epcorp.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Fri, 07 Feb 1997 16:53:11 -0500
To: Rick Romkey <pokey@maddie.atlantic.com>
From: "Martin C. Walker" <martinw@epcorp.com>
Subject: Re: hardware requeriment.
Cc: contanet@andromeda.tectel.com.mx, firewalls@GreatCircle.COM
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I didn't say the PRODUCT didn't work great (though I'd certainly
argue that too!) but that support was problematic because the
lack of familiarity with x86 at sunservice and checkpoint tends
to cause various problems like obscuring the real problem, making
folks go down paths they normally wouldn't with diags, or not aving
the exact equipment to duplicate a problem.

sun is my reseller

At 06:14 PM 2/6/97 -0500, Rick Romkey wrote:
>
>> 
>> my recommendation, based on experience running fw-1 from sun on
>> solariz x86 is NOT TO USE SOLARIS x86 !!!
>> 
>> This is not necessarilly because there is anything wrong with x86,
>> but because there are few people in sunservice, or it appears in checkpoint
>> who know anything about x86.  As soon as you mention you're running x86
>> you get the standard reply "Oh!  well I don't really know anything about
>> x86 but...".  It also raises add'l questions from the tech suppt people
that
>> can obscure the real issue because their lack of familiarity with it make
>> them question things (or ignore things) they shouldn't.  Further, if you
run
>> into a problem which they need to duplicate they (sunservice) don't have
>> x86 platforms in the lab, and must do it with sparc.  What they really
means
>> is that in order to duplicate the problem they use your production systems
>> as a lab.
>
>I disagree completely.  FW-1 for Solaris x86 works great, and support should
>be coming directly from your reseller for the product.  I can't imagine
>why you'd get blank "stares" from people about it...it works great here.
>I think last time I checked, ours had been running for 92 days or so.
>
>Too bad it doesn't run under Linux.
>
>-Rick
>
>----------------------------------------------------------------------------
> Rick E Romkey     |          A T L A N T I C           |     Internet
>pokey@atlantic.com |  Computing Technology Corporation  |   Specialists
> (860) 667-9596    |     http://www.atlantic.com/       |    
>-----------------------------------------------------------------------------
>
>
--------------------------------------------------------------------------
Martin C. Walker     |  martinw@epcorp.com  |      PP-ASEL,IFR AA5-A 9908U
Project Lead         |       (513)629-2517  | Blue Belt Okinawan Shuri-Ryu
Eagle-Picher Inc.    |  Fax: (513)629-2449  |                Porsche 911SC
580 Walnut St,       |                      |
Cincinnati, OH 45202 |                      |

From firewalls-owner  Fri Feb  7 14:49:55 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA16336 for firewalls-outgoing; Fri, 7 Feb 1997 14:25:03 -0800 (PST)
Received: from gatekeeper.premenos.com (mail.premenos.com [150.105.250.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id OAA16322 for <firewalls@greatcircle.com>; Fri, 7 Feb 1997 14:24:52 -0800 (PST)
Received: from localhost (smap@localhost) by gatekeeper.premenos.com (8.6.5/8.6.5) id OAA06019 for <firewalls@greatcircle.com>; Fri, 7 Feb 1997 14:26:37 -0800
Received: from coyote.premenos.com(150.105.104.245) by mail.premenos.com via smap (V1.3mjr)
	id sma006008; Fri Feb  7 14:26:08 1997
Received: by coyote.premenos.com (SMI-8.6/SMI-SVR4)
	id OAA02863; Fri, 7 Feb 1997 14:24:42 -0800
From: jmizzi@utu.premenos.com (John Mizzi)
Message-Id: <199702072224.OAA02863@coyote.premenos.com>
Subject: Altavista Tunnel
To: firewalls@greatcircle.com
Date: Fri, 7 Feb 1997 14:24:41 -0800 (PST)
X-Mailer: ELM [version 2.4 PL24]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Has anyone used the Altavista Tunnel ?
 
 
If so what are your opinions ?
 
 
Are there any similiar products which provide the same functionality as the
Altavista Tunnel ??
 
 
John


From firewalls-owner  Fri Feb  7 15:21:55 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA18418 for firewalls-outgoing; Fri, 7 Feb 1997 14:44:30 -0800 (PST)
Received: from ACML.COM ([207.140.173.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id OAA18399 for <Firewalls@Greatcircle.Com>; Fri, 7 Feb 1997 14:44:13 -0800 (PST)
Received: from smtpngw.acml.com by ACML.COM (SMI-8.6/SMI-SVR4)
	id RAA21288; Fri, 7 Feb 1997 17:42:53 -0500
Received: by smtpngw.acml.com (IBM OS/2 SENDMAIL VERSION 1.3.17/2.12um) id AA1371; Fri, 07 Feb 97 17:40:18 -0500
Message-Id: <9702072240.AA1371@smtpngw.acml.com>
Received: from ALLIANCE with "Lotus Notes Mail Gateway for SMTP" id
  1C1B113F550FF6B185256437007C0C49; Fri,  7 Feb 97 17:40:15 
To: pat <pat@tandem.com>
Cc: Firewalls <Firewalls@Greatcircle.Com>,
        Fw-1-Mailinglist
 <Fw-1-Mailinglist@Us.Checkpoint.Co>,
        John_Chen <John_Chen@ACML.COM>
From: John Chen/New York/ACMC
  <John_Chen@ACML.COM>
Date:  7 Feb 97 17:36:32 
Subject: Re: FW-1 license
Mime-Version: 1.0
Content-Type: Text/Plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Thanks for your info.  I got confirm from Checkpoint with positive answer.  It 
is great.
Have a nice weekend.
John



	pat @ tandem.com 
07/02/97 09:01
To: firewalls @ greatcircle.com @ internet, fw-1-mailinglist @ us.checkpoint.co 
@ internet
cc: John_Chen @ ACML.COM @ internet 
Subject: FW-1 license

All my systems (Solaris and SunOS) are licensed by IP address.

                            -pat

----- Begin Included Message -----

From postmaster@tandem.com Fri Feb  7 08:58:36 1997
To: firewalls <firewalls@greatcircle.com>
From: John Chen/New York/ACMC
  <John_Chen@acml.com>
Date:  7 Feb 97  9:03:20 
Subject: FW-1 license
Mime-Version: 1.0
Sender: firewalls-owner@greatcircle.com

Hi all

I have a question of FW-1 license, does FW-1 2.1 of Solaris version only 
license by hostid?

I'd like to build up a standby machine as backup of the production FW-1, if the 
license is hostid based, means I have to buy a second license.  If license is 
IP address based, I can have it setup and ready to go.  In case of the 
production machine is down, just simply tuen it on and plug into the network.

Any recommendation?

Thanks.


----- End Included Message -----





From firewalls-owner  Fri Feb  7 15:25:23 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA19671 for firewalls-outgoing; Fri, 7 Feb 1997 14:55:35 -0800 (PST)
Received: from cpmx.mail.saic.com (cpmx.mail.saic.com [139.121.95.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id OAA19603 for <Firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 14:55:12 -0800 (PST)
From: David_Sulser@tssdc.saic.com
Received: from tssdc.saic.com by cpmx.mail.saic.com; Fri, 7 Feb 97 14:41:12 -0800
Received: by tssdc.saic.com(Lotus SMTP MTA v1.05b4 (287.3 12-16-1996))  id 88256438.00095492 ; Fri, 7 Feb 1997 17:41:54 -0700
X-Lotus-FromDomain: SAIC
To: Firewalls@GreatCircle.COM
Message-ID: <85256437.007BB1D7.00@tssdc.saic.com>
Date: Fri, 7 Feb 1997 17:42:45 -0400
Subject: Re: FW-1 license
Mime-Version: 1.0
Content-type: text/plain; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk






David Sulser
02-07-97 02:42 PM

I just installed Solstice FW-1 ver 2.1, licensed by hostid. After
installation, I decided to change the IP addresses of both interfaces. I
did not change the license. No problems.
Apologies for my mailer...


                                                                 
                                                                 
                                                                 



To:   pat @ tandem.com
cc:   firewalls @ GreatCircle.com, fw-1-mailinglist @ us.checkpoint.co,
      John_Chen @ ACML.COM (bcc: David Sulser/SAIC)
Subject:  Re: FW-1 license




Funny...mine are licensed my IP Address AND Hostid.

     Ryan

---------- Previous Message ----------
To: firewalls, fw-1-mailinglist
cc: John_Chen
From: pat @ tandem.com @ smtp
Date: 02/07/97 09:01:32 AM
Subject: FW-1 license


All my systems (Solaris and SunOS) are licensed by IP address.

                            -pat

----- Begin Included Message -----

From postmaster@tandem.com Fri Feb  7 08:58:36 1997
To: firewalls <firewalls@greatcircle.com>
From: John Chen/New York/ACMC
  <John_Chen@acml.com>
Date:  7 Feb 97  9:03:20
Subject: FW-1 license
Mime-Version: 1.0
Sender: firewalls-owner@greatcircle.com

Hi all

I have a question of FW-1 license, does FW-1 2.1 of Solaris version only
license by hostid?

I'd like to build up a standby machine as backup of the production FW-1, if
the license is hostid based, means I have to buy a second license.  If
license is IP address based, I can have it setup and ready to go.  In case
of the production machine is down, just simply tuen it on and plug into the
network.

Any recommendation?

Thanks.


----- End Included Message -----









From firewalls-owner  Fri Feb  7 16:06:17 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id PAA25026 for firewalls-outgoing; Fri, 7 Feb 1997 15:40:18 -0800 (PST)
Received: from Arco.COM (inetg1.Arco.COM [130.201.119.253]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id PAA25012 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 15:40:09 -0800 (PST)
Received: from ricambi.rrt.arco.com ([130.201.30.26]) by Arco.COM (4.1/SMI-4.1)
	id AA08661; Fri, 7 Feb 97 17:38:57 CST
Message-Id: <3.0.32.19970207173734.00697a48@users.arco.com>
X-Sender: gwhite@users.arco.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Fri, 07 Feb 1997 17:37:36 -0600
To: firewalls@GreatCircle.COM
From: Gary White <white@Arco.COM>
Subject: vendor access ??
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi-
Does anybody have any general suggestions about the problem of allowing
a software vendor access to a server machine running their special software,
which is typically in the center of a company's network... so they can 
perform maintenance/fixes?  In such a case I typically would not have 
a problem when they come on site to sit with them and let them work
away, but often the requirement is to do it remotely somehow.

Seems a careful setup would imply a special restricted route from whatever
modem or inbound connection is involved, to a machine quarantined from 
the rest of one's network... with the "quarantine" meaning open 
access into the machine, but very restricted outbound...

Any comments?
Thanks
-Gary

__________________________________________________________________
Gary White               ARCO Exploration & Production Technology
gwhite@arco.com          2300 W Plano Parkway
(214) 509-6554           Plano, Texas 75075


From firewalls-owner  Fri Feb  7 17:20:21 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id RAA04773 for firewalls-outgoing; Fri, 7 Feb 1997 17:14:12 -0800 (PST)
Received: from geocities.com ([204.7.246.133]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id RAA04764 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 17:14:02 -0800 (PST)
Received: from 193.230.255.2.flex.ro (vdehelean@dial05.flex.ro [193.230.255.105]) by geocities.com (8.7.5/8.7.3) with ESMTP id RAA03737 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 17:07:38 -0800 (PST)
Message-Id: <199702080107.RAA03737@geocities.com>
From: "Gabriel Dura" <dura@geocities.com>
To: <firewalls@GreatCircle.COM>
Subject: I need the latest version of Linux
Date: Sat, 8 Feb 1997 03:15:35 +0200
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1155
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Hello everybody!

I need the latest version of Linux for a local Internet Provider. They
already have Red Hat Linux 3.0 but they are looking for a new version of
Linux. 
Can anyone tell me where I can find it?
Is there any ftp site available for download? Is there anyone who can sell
it?
A place in Romania would be desirable...

Thank you for your help...
Gabriel Dura
dura@geocities.com


From firewalls-owner  Fri Feb  7 17:34:53 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id RAA05504 for firewalls-outgoing; Fri, 7 Feb 1997 17:19:16 -0800 (PST)
Received: from haleakala.aloha.net (haleakala.aloha.net [204.94.112.33]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id RAA05442 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 17:19:00 -0800 (PST)
Received: from localhost (samc@localhost) by haleakala.aloha.net (8.7.5/8.6.9) with SMTP id PAA29079 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 15:17:52 -1000 (HST)
Date: Fri, 7 Feb 1997 15:17:47 -1000 (HST)
From: Sam Chepkevich <samc@aloha.net>
To: firewalls@GreatCircle.COM
Subject: Convoy Technology Products
In-Reply-To: <199702071712.JAA01881@coyote.premenos.com>
Message-ID: <Pine.GSO.3.94.970207150941.29127W-100000@haleakala.aloha.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

-----BEGIN PGP SIGNED MESSAGE-----

I have been monitoring the list for about two months now.  I have a fair
understanding of firewall vendors etc.  I have been approached by a
vendor whose name I haven't seen any mention of in this list.

The Product line is from Network Engineering Technologies and includes the
products: Telaxian Shield Firewall and Zero Exposure transaction
server.  No I am not a reseller of these technologies.  

Any of you guys out there holding out or is this a new company??
Feedback?  Thanks!  I will look on the Web for more info but was wondering
if anyone knows about these.  

                         ----------------------------------
                           Sam Chepkevich samc@aloha.net
                        Manager Systems Engineering (Hawaii)
                            Hawaii OnLine/GST Internet
                         ----------------------------------

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQB1AwUBMvvUPx+al3jzqk0xAQFGgAL/fOjyfzJD5UIGgj291pUXDzaBXMJTD+6U
5jyiCR8noz32wVx7km80zKXobu6A1wCo2oqEKSyNuQNQkgTP8ptLS4XQSSy+8GKE
BnnjWtgBSOBcUxUx7W+is/M2tOaaypub
=jI4V
-----END PGP SIGNATURE-----


From firewalls-owner  Fri Feb  7 17:49:45 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id RAA07463 for firewalls-outgoing; Fri, 7 Feb 1997 17:33:15 -0800 (PST)
Received: from mail.rc.on.ca ([207.176.151.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id RAA07427 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 17:33:00 -0800 (PST)
Received: by mail.rc.on.ca with Internet Mail Service (5.0.1389.3)
	id <01BC1535.F0E71FA0@mail.rc.on.ca>; Fri, 7 Feb 1997 20:31:47 -0500
Message-ID: <B1A2E88F5F7FD011A0B40000E8D5C6670114C4@mail.rc.on.ca>
From: Russ <Russ.Cooper@RC.on.ca>
To: "firewalls@greatcircle.com" <firewalls@GreatCircle.COM>,
        "'jmizzi@utu.premenos.com'" <jmizzi@utu.premenos.com>
Subject: RE: Altavista Tunnel
Date: Fri, 7 Feb 1997 20:31:46 -0500
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1389.3)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Microsoft's PPTP can provide similar functionality to an Altavista
Tunnel, as can Devon Software's Kyberpass product
(http://www.magi.com/~devon/newweb/index.html). I believe that V-One's
SmartGate can also do similar functionality.

Their viability and fitness to task obviously depend greatly on what you
are trying to achieve.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
NTBugTraq: Send SUBSCRIBE NTBUGTRAQ Your Name to LISTSERV@RC.ON.CA


From firewalls-owner  Fri Feb  7 18:21:48 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id SAA11580 for firewalls-outgoing; Fri, 7 Feb 1997 18:08:32 -0800 (PST)
Received: from tcs_gateway1.treas.gov (tcs_gateway1.treas.gov [204.151.245.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id SAA11506 for <firewalls@greatcircle.com>; Fri, 7 Feb 1997 18:07:55 -0800 (PST)
Received: by tcs_gateway1.treas.gov id 
  (InterLock SMTP Gateway 3.0 for firewalls@greatcircle.com);
  Fri, 7 Feb 1997 21:06:42 -0500
Received: by tcs_gateway1.treas.gov (Internal Mail Agent-2);
  Fri, 7 Feb 1997 21:06:42 -0500
Received: by tcs_gateway1.treas.gov (Internal Mail Agent-1);
  Fri, 7 Feb 1997 21:06:42 -0500
Received: by tcs_gateway1.treas.gov (Internal Mail Agent-0);
  Fri, 7 Feb 1997 21:06:42 -0500
Message-Id: <B0000030733@ausc-nt1.aus.swr.irs.gov>
From: "Earl Meck" <earme@ausc-nt1.aus.swr.irs.gov>
To: <tlayton@global-sol.com>, <firewalls@greatcircle.com>
Subject: Re: MS Proxy server ??
Date: Tue, 4 Feb 1997 07:24:21 -0000
X-Msmail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1155
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I have been running the Netscape proxy server on NT for about a month and
have been pretty satisfied with it.  There are a few things that are not
real intuitive about their configuration screens, but it makes
administration allot easier.  We have been using CERN for a couple of years
now and I have been looking at Netscape and Apache as possible
replacements.  I have been tasked with applying quite a few restrictions on
users prior to going out of our firewall and Netscape seems to handle this
better than the others.  I will be done testing by the end of this week and
will let you know in more detail what I came up with if you want.

Later

----------
> From: Timothy P. Layton, Sr. <tlayton@global-sol.com>
> To: firewalls@greatcircle.com
> Subject: MS Proxy server ??
> Date: Monday, February 03, 1997 4:28 PM
> 
> 
> Has anyone installed and played with the MS Proxy server yet ??
> 
> I am researching a firewall solution that will need to include proxy
> and N.A.T.
> 
> Thanks for any input.

From firewalls-owner  Fri Feb  7 18:47:22 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id SAA15157 for firewalls-outgoing; Fri, 7 Feb 1997 18:32:15 -0800 (PST)
Received: from xyzzy.plugh.edmonton.ab.ca (xyzzy.plugh.edmonton.ab.ca [198.161.22.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id SAA15112 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 18:32:01 -0800 (PST)
Received: (from uucp@localhost) by xyzzy.plugh.edmonton.ab.ca (8.6.12/8.6.9) id TAA13128; Fri, 7 Feb 1997 19:30:50 -0700
Received: from snouts-gw.obtuse.com(192.168.30.61), claiming to be "snouts.obtuse.com"
 via SMTP by mailhost.plugh.edmonton.ab.ca, id smtpd13126aaa; Fri Feb  7 19:30:41 1997
Received: (from beck@localhost) by snouts.obtuse.com (8.7.5/8.7.3) id TAA04364; Fri, 7 Feb 1997 19:30:50 -0700
From: Bob Beck <beck@obtuse.com>
Message-Id: <199702080230.TAA04364@snouts.obtuse.com>
Subject: Re: vendor access ??
To: white@Arco.COM (Gary White)
Date: Fri, 7 Feb 1997 19:30:48 -0700 (MST)
Cc: firewalls@GreatCircle.COM
In-Reply-To: <3.0.32.19970207173734.00697a48@users.arco.com> from "Gary White" at Feb 7, 97 05:37:36 pm
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> Hi-
> Does anybody have any general suggestions about the problem of allowing
> a software vendor access to a server machine running their special software,
> which is typically in the center of a company's network... so they can 
> perform maintenance/fixes?  In such a case I typically would not have 
> a problem when they come on site to sit with them and let them work
> away, but often the requirement is to do it remotely somehow.
> 
> Seems a careful setup would imply a special restricted route from whatever
> modem or inbound connection is involved, to a machine quarantined from 
> the rest of one's network... with the "quarantine" meaning open 
> access into the machine, but very restricted outbound...
> 

	First I'd make sure the legal department knew
the score so that your bottom feeders and their bottom feeders
have some sort of arrangement about what their responsabilities
are when they're on your system, and what yours are. 

	Considering they are probably going to need high level access to 
play with their software on your server there may only be
so much you can do. It depends on what your concerns are. 

	If I could get away with I'd run their whole package chrooted
into it's own little hole, along with their remote access
mechanism. That way they come in and fiddle, but don't mess with stuff
outside. Give them some kind of remote access device such as a
SecureNet Keycard so you can be relatively sure it's them, and a means
to come in with it, either through the firewall in an appropriate
manner, or from a modem on the box.

	Of course, you might not be able to do that, in which case I'd
settle for the card, and keeping a good eye on them. If they need
unrestricted high level access to one of your servers it's almost
certain they'll be able to screw you good if they either wanted to or
had a tragic episode of brain-finger disconnect. You are going to have
to trust them to some extent. If you can't do that convince the boss
they have to come on site.

	-Bob

--
Bob Beck					 Obtuse Systems Corporation
beck@obtuse.com					 http://www.obtuse.com/	
True Evil hides its real intentions in its street address. Search and you
shall find it, and the truth shall set you free.

From firewalls-owner  Fri Feb  7 20:07:47 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id TAA26167 for firewalls-outgoing; Fri, 7 Feb 1997 19:54:10 -0800 (PST)
Received: from mule1.mindspring.com (mule1.mindspring.com [204.180.128.167]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id TAA26158 for <Firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 19:54:03 -0800 (PST)
Received: from [207.69.170.14] (user-37kbagb.dialup.mindspring.com [207.69.170.11])
          by mule1.mindspring.com (8.8.4/8.8.4) with SMTP
	  id WAA97062; Fri, 7 Feb 1997 22:52:19 -0500
Date: Fri, 7 Feb 1997 22:52:19 -0500
X-Sender: pelicans@pop.mindspring.com
Message-Id: <v01540b02af2153d03de6@[207.69.170.14]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: Frederick M Avolio <avolio@tis.com>
From: pelicans@mindspring.com (BeachCruiser)
Subject: Re: TIS: plug-to UDP
Cc: Firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>This is, of course, frightening.  Why buy a proxy-based firewall if you are
>going to then allow UDP services through it via a packet filter?

Huh.  You have obviously been working the booth at the show downtown and
haven't been tuning in lately.  About a month on this list and you wonder,
"whydahell do some of these folks even bother to spend the time and
corporate resources to buy and install a firewall...to do some of the
dumbassed things they do with them.

A weeks pay says someone in the legal department is really behind some of
these questions.

Whatacountry :)


//rmck







From firewalls-owner  Fri Feb  7 20:19:53 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id UAA27461 for firewalls-outgoing; Fri, 7 Feb 1997 20:07:19 -0800 (PST)
Received: from solarnum.itd.uts.edu.au (solarnum.itd.uts.edu.au [138.25.16.3]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id UAA27403 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 20:07:04 -0800 (PST)
Received: (from matt@localhost)
	by solarnum.itd.uts.edu.au (8.8.5/8.8.5/1.3) id PAA08923;
	Sat, 8 Feb 1997 15:03:14 +1100 (EADT)
From: Jas (Matthew K) <matt@uts.edu.au>
Message-Id: <199702080403.PAA08923@solarnum.itd.uts.edu.au>
Subject: Re: NT 4.0 Bug FIX
To: Ryan.Russell@sybase.com (Ryan Russell/SYBASE)
Date: Sat, 8 Feb 1997 15:03:14 +1100 (EADT)
Cc: Russ.Cooper@RC.on.ca, firewalls@GreatCircle.COM
In-Reply-To: <199701240029.QAA27362@notesgw2.sybase.com> from "Ryan Russell/SYBASE" at Jan 23, 97 04:20:06 pm
X-Mailer: ELM [version 2.4 PL25]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Ryan Russell/SYBASE wrote this...

> My server has the symptom...

> But, I dunno... after all that discussion about trojan
> DLL's...should I trust you? :)

the origional was a trojan :)

		Matt







From firewalls-owner  Fri Feb  7 21:22:35 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id VAA04365 for firewalls-outgoing; Fri, 7 Feb 1997 21:13:17 -0800 (PST)
Received: from loki.atcon.com (loki.atcon.com [199.166.213.6]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id VAA04348 for <firewalls@GreatCircle.COM>; Fri, 7 Feb 1997 21:13:03 -0800 (PST)
Received: from stealth.icondata.com (hemlok@stealth.icondata.com [198.167.251.19]) by loki.atcon.com (8.8.3/8.7.3) with SMTP id BAA10892 for <firewalls@GreatCircle.COM>; Sat, 8 Feb 1997 01:11:51 -0400 (AST)
Received: by stealth.icondata.com with Microsoft Mail
	id <01BC155D.3A7ACF00@stealth.icondata.com>; Sat, 8 Feb 1997 01:13:01 -0400
Message-ID: <01BC155D.3A7ACF00@stealth.icondata.com>
From: Jeff Simms <jsimms@auracom.com>
To: "firewalls@GreatCircle.COM" <firewalls@GreatCircle.COM>
Subject: RE: I need the latest version of Linux
Date: Sat, 8 Feb 1997 01:12:59 -0400
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

In case you havent been following this list, its for firewalls ... LINux =
is available all over the world, use the web and stop wasting those of =
us who are here for firewall discussions' time.

Jeff Simms
Network Services Manager
auracom Internet Services

-----Original Message-----
From:	Gabriel Dura [SMTP:dura@geocities.com]
Sent:	Friday, February 07, 1997 9:16 PM
To:	firewalls@GreatCircle.COM
Subject:	I need the latest version of Linux


Hello everybody!

I need the latest version of Linux for a local Internet Provider. They
already have Red Hat Linux 3.0 but they are looking for a new version of
Linux.=20
Can anyone tell me where I can find it?
Is there any ftp site available for download? Is there anyone who can =
sell
it?
A place in Romania would be desirable...

Thank you for your help...
Gabriel Dura
dura@geocities.com



From firewalls-owner  Sat Feb  8 03:19:43 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id DAA25705 for firewalls-outgoing; Sat, 8 Feb 1997 03:07:08 -0800 (PST)
Received: from socrates.berkeley.edu (socrates.Berkeley.EDU [128.32.25.13]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id DAA25677 for <firewalls@GreatCircle.COM>; Sat, 8 Feb 1997 03:06:41 -0800 (PST)
Received: from garnet.berkeley.edu (garnet.Berkeley.EDU [128.32.155.6]) by socrates.berkeley.edu (8.8.4/8.8.0) with ESMTP id DAA20608; Sat, 8 Feb 1997 03:05:37 -0800 (PST)
Received: from pine by garnet.berkeley.edu (8.7.5/1.33-960227)
	id DAA22927; Sat, 8 Feb 1997 03:05:34 -0800
Message-Id: <2.2.32.19970208110514.00716ad8@garnet.berkeley.edu>
X-Sender: mendes@garnet.berkeley.edu
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Sat, 08 Feb 1997 03:05:14 -0800
To: Russ <Russ.Cooper@RC.on.ca>
From: Jerry Mendes <mendes@garnet.berkeley.edu>
Subject: RE: [NTSEC] ActiveX, MSIE and Quicken
Cc: firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Presumably, one answer is for the firewall companies to write additional
application layer filters for port 80, looking for ActiveX or Java
downloads.  This would make configuration of the firewall a bit more
complex.  Don't know if any of 'em are considering this yet.  Anyone have
any scoop on this?

Jerry Mendes, Principal Consultant
DataComm Insights
150 Seminary Drive
Mill Valley, California  94941

Voice:  415-381-5500
FAX:    415-381-5502
Email:  mendes@garnet.berkeley.edu

At 11:40 PM 2/1/97 -0500, Russ wrote:
>To try and keep this on a Firewalls vein. The tunneling of anything over
>HTTP is, in my opinion, the crappy technology. That goes for Java
>applets or certificate authentication for that matter. I don't like the
>idea of combining diverse tasks within a single channel if its possible
>to avoid it, and it is possible, so the only reason its not being done
>is to USURP FIREWALLS.
____________________________________________________________________________
_______
Jerry Mendes, Principal Consultant              Voice:   (415) 381-5500
DataComm Insights                               FAX:     (415) 381-5502
150 Seminary Drive                              Email:
mendes@garnet.berkeley.edu
Mill Valley, California  94941


From firewalls-owner  Sat Feb  8 04:25:01 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id DAA25944 for firewalls-outgoing; Sat, 8 Feb 1997 03:14:22 -0800 (PST)
Received: from socrates.berkeley.edu (socrates.Berkeley.EDU [128.32.25.13]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id DAA25937 for <firewalls@GreatCircle.COM>; Sat, 8 Feb 1997 03:13:47 -0800 (PST)
Received: from garnet.berkeley.edu (garnet.Berkeley.EDU [128.32.155.6]) by socrates.berkeley.edu (8.8.4/8.8.0) with ESMTP id DAA20642; Sat, 8 Feb 1997 03:12:44 -0800 (PST)
Received: from pine by garnet.berkeley.edu (8.7.5/1.33-960227)
	id DAA23200; Sat, 8 Feb 1997 03:12:38 -0800
Message-Id: <2.2.32.19970208111220.00716268@garnet.berkeley.edu>
X-Sender: mendes@garnet.berkeley.edu
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Sat, 08 Feb 1997 03:12:20 -0800
To: Daniel Garcia <kender@hollyfeld.org>
From: Jerry Mendes <mendes@garnet.berkeley.edu>
Subject: RE: Duplicated network addresses
Cc: firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Yes, but if she's already used some *other* block of IP addresses that are
actually assigned to someone else, then she really does have this problem.
And she can't easily fix it without renumbering her internal network.

At 01:07 PM 2/4/97 -0500, Daniel Garcia wrote:

>There is a set of IP numbers that is reseved precisely for this situation -
>they are reserved for private networks, i.e. networks that will never be
>directly addressable by the internet, and are garunteed by IANA (among
>others I believe) to never be allocated on the internet. According to
>rfc1918 (available at http://ftp.isi.edu/in-notes/rfc1918.txt ) the
>following address spaces are available:
>
>   The Internet Assigned Numbers Authority (IANA) has reserved the
>      following three blocks of the IP address space for private internets:
>      
>           10.0.0.0        -   10.255.255.255  (10/8 prefix)
>	        172.16.0.0      -   172.31.255.255  (172.16/12 prefix)
>		     192.168.0.0     -   192.168.255.255 (192.168/16 prefix)
>
>Cheers,
>
>--Dg
>
>
>
____________________________________________________________________________
_______
Jerry Mendes, Principal Consultant              Voice:   (415) 381-5500
DataComm Insights                               FAX:     (415) 381-5502
150 Seminary Drive                              Email:
mendes@garnet.berkeley.edu
Mill Valley, California  94941


From firewalls-owner  Sat Feb  8 04:55:30 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id DAA25706 for firewalls-outgoing; Sat, 8 Feb 1997 03:07:17 -0800 (PST)
Received: from socrates.berkeley.edu (socrates.Berkeley.EDU [128.32.25.13]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id DAA25698 for <firewalls@greatcircle.com>; Sat, 8 Feb 1997 03:06:49 -0800 (PST)
Received: from garnet.berkeley.edu (garnet.Berkeley.EDU [128.32.155.6]) by socrates.berkeley.edu (8.8.4/8.8.0) with ESMTP id DAA20620; Sat, 8 Feb 1997 03:05:46 -0800 (PST)
Received: from pine by garnet.berkeley.edu (8.7.5/1.33-960227)
	id DAA22941; Sat, 8 Feb 1997 03:05:44 -0800
Message-Id: <2.2.32.19970208110523.0070c80c@garnet.berkeley.edu>
X-Sender: mendes@garnet.berkeley.edu
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Sat, 08 Feb 1997 03:05:23 -0800
To: jmizzi@utu.premenos.com (John Mizzi)
From: Jerry Mendes <mendes@garnet.berkeley.edu>
Subject: Re: Altavista Tunnel
Cc: firewalls@greatcircle.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 02:24 PM 2/7/97 -0800, John Mizzi wrote:
>Has anyone used the Altavista Tunnel ?

I teach the installation and use of AltaVista Tunnel products for Global
Knowledge Networks, Inc......assuming you're in the U.S., we offer the class
at a number of sites around the U.S.  Call (800) 332-5656 and ask about the
course Internet Security: Installing and Configuring AltaVista Firewall and
Tunnel.

It's a 4 day class....of which 1/3 covers generic security issues, and 2/3
is devoted to the installation and configuration of both the Firewall and
Tunnel products.


 
>If so what are your opinions ?

I think the product is pretty darn good, but then I'm a bit biased.  :-)

>Are there any similiar products which provide the same functionality as the
>Altavista Tunnel ??

Yes there are.  A number of the firewall companies offer other secure
solutions, either as part of the firewall or as a separate product.  Also,
Microsoft has developed an encrypted tunnel technology, as well....goes
under the name PPTP (I believe it translates as Point to Point Tunneling
Protocol).

Best of luck.  Look forward to seeing you in one of my classes soon.

____________________________________________________________________________
______
Jerry Mendes, Principal Consultant              Voice:   (415) 381-5500
DataComm Insights                               FAX:     (415) 381-5502
150 Seminary Drive                              Email:
mendes@garnet.berkeley.edu

____________________________________________________________________________
_______
Jerry Mendes, Principal Consultant              Voice:   (415) 381-5500
DataComm Insights                               FAX:     (415) 381-5502
150 Seminary Drive                              Email:
mendes@garnet.berkeley.edu
Mill Valley, California  94941


From firewalls-owner  Sat Feb  8 06:04:57 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id FAA08552 for firewalls-outgoing; Sat, 8 Feb 1997 05:54:34 -0800 (PST)
Received: from mail.rc.on.ca ([207.176.151.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id FAA08544 for <firewalls@GreatCircle.COM>; Sat, 8 Feb 1997 05:54:27 -0800 (PST)
Received: by mail.rc.on.ca with Internet Mail Service (5.0.1389.3)
	id <01BC159D.888704D0@mail.rc.on.ca>; Sat, 8 Feb 1997 08:53:20 -0500
Message-ID: <B1A2E88F5F7FD011A0B40000E8D5C6670114CE@mail.rc.on.ca>
From: Russ <Russ.Cooper@RC.on.ca>
To: "'Jerry Mendes'" <mendes@garnet.berkeley.edu>
Cc: "firewalls@greatcircle.com" <firewalls@GreatCircle.COM>
Subject: RE: Altavista Tunnel
Date: Sat, 8 Feb 1997 08:53:19 -0500
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1389.3)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

If I installed Altavista Tunnel at my location, behind my Firewall, to
act as a means for outside users to access resources within my network,
how would I limit their access to those internal resources?

Let's take the example of a previous poster who asked about securing a
box running a third-party proprietary package that needed to be accessed
by the vendor of that package. With VPN technology working at the
Firewall, I could ensure that their connection would be encrypted from
the Vendor's desktop to my Firewall, and then I could use the Firewall
to ensure that the Vendor could only do a limited number of network
services (say, telnet and ftp for example), and then also ensure that
they could do those services with a single box within my network. I
could use discretionary rules that might allow some clients full access
while limiting others.

In the case of an Altavista Tunnel arrangement, its my understanding
that I could only ensure that the Vendor's desktop was encrypted to the
Tunnel server, and that after that I would have no ability to control
what network services that desktop could employ once they had been
authenticated at the Tunnel server.

It means that I might have to set up an arrangement like Untrusted Net
-- Firewall -- Tunnel Server -- Firewall -- Trusted Net.

Am I missing something in the abilities of Altavista Tunnel? Or am I
truly left giving full access to my entire Trusted Net to anyone who has
been authenticated at the Tunnel Server?

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
NTBugTraq: Send SUBSCRIBE NTBUGTRAQ Your Name to LISTSERV@RC.ON.CA


From firewalls-owner  Sat Feb  8 08:19:39 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA12991 for firewalls-outgoing; Sat, 8 Feb 1997 08:04:47 -0800 (PST)
Received: from emout18.mail.aol.com (emout18.mx.aol.com [198.81.11.44]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id IAA12984 for <firewalls@greatcircle.com>; Sat, 8 Feb 1997 08:04:40 -0800 (PST)
From: AspenMH@aol.com
Received: (from root@localhost)
	  by emout18.mail.aol.com (8.7.6/8.7.3/AOL-2.0.0)
	  id LAA06556;
	  Sat, 8 Feb 1997 11:03:34 -0500 (EST)
Date: Sat, 8 Feb 1997 11:03:34 -0500 (EST)
Message-ID: <970208110332_541100851@emout18.mail.aol.com>
To: rlcopperman@ccgate.hac.com, firewalls@greatcircle.com
Subject: Re: Mial List
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Please 
 REMOVE 
     me from this list


From firewalls-owner  Sat Feb  8 10:20:23 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id KAA19637 for firewalls-outgoing; Sat, 8 Feb 1997 10:02:50 -0800 (PST)
Received: from gw.research.megasoft.com (gw.research.megasoft.com [206.230.35.93]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id KAA19630 for <Firewalls@GreatCircle.COM>; Sat, 8 Feb 1997 10:02:39 -0800 (PST)
Received: (from uucp@localhost) by gw.research.megasoft.com (8.7.5/8.7.3-cmcurtin) id NAA06767; Sat, 8 Feb 1997 13:01:03 -0500 (EST)
Received: from goffette.research.megasoft.com(192.168.1.2) by gw.research.megasoft.com via smap (V1.3)
	id sma006754; Sat Feb  8 13:00:56 1997
Received: by goffette.research.megasoft.com (940816.SGI.8.6.9/940406.SGI)
	 id MAA16502; Sat, 8 Feb 1997 12:52:59 -0500
Date: Sat, 8 Feb 1997 12:52:59 -0500
Message-Id: <199702081752.MAA16502@goffette.research.megasoft.com>
From: C Matthew Curtin <cmcurtin@research.megasoft.com>
To: Timothy Tu <ltu@sapient.com>
Cc: "'Firewalls@GreatCircle.COM'" <Firewalls@GreatCircle.COM>
Subject: Re: proxy and newsgroups
In-Reply-To: <c=US%a=_%p=sapient%l=SAPIENT/SMTPGATE/000909F3@galaxy.sapient.com>
References: <c=US%a=_%p=sapient%l=SAPIENT/SMTPGATE/000909F3@galaxy.sapient.com>
X-Face: "&>g(&eGr?u^F:nFihL%BsyS1[tCqG7}I2rGk4{aKJ5I_5A\*6RYn4"N.`1pPF9LO!Fa<(gj:12)?=uP2l01e10Gij"7j&-)torL^iBrNf\s7PDLm=rf[PjxtSbZ{J(@@j"q2/iV9^Mx<e%nT[:7s7.-#u*}GAH,bEfbfh-NDqSG`+s
Reply-To: cmcurtin@research.megasoft.com
X-Attribution: mattC
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Timothy" == Timothy Tu <ltu@sapient.com> writes:

Timothy> Is there a way to access my ISP's
Timothy> newsgroups through my work's connection that has a proxy
Timothy> server on a NT or 95?  If so, do you know which news reader
Timothy> program support it?

This sort of thing has historically been accomplished by putting a
tunnel through the firewall, such that by connecting to the NNTP port
of the internal interface of your bastion host, you carry on a
conversation with the NNTP server on the ISP's news host.

On the client side, then, you specify your proxy host's internal
interface as your news server.

I know of no free (or commercial, for that matter) solutions for this
for Windoze of any flavor.  As usual, though, with Unix, your options
are many, and the software is typically completely free.

- -- 
Matt Curtin  Chief Scientist  Megasoft, Inc.  cmcurtin@research.megasoft.com
http://www.research.megasoft.com/people/cmcurtin/    I speak only for myself
Hacker Security Firewall Crypto PGP Privacy Unix Perl Java Internet Intranet

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Have you encrypted your data today?

iQEVAwUBMvy9dn6R34u/f3zNAQELVAf9HhpaiwOvus6OcgmGtooFk/eyFpiQ+dU5
4tKtI7G29S+5d9fxvJh5on6y9XMLaywwK4Zox78BeGmtY0KI2DdQQvIdoUT1K5QW
T1hcTwMZLeiUDEZ9c+Ucrq4Pv0Q6wFoDsbjB8QI73UQ+melEqS+QBzHnBhq7BDlT
EDCQKF6v28A7Tr3GgDotidoATABw5XsUeNf2GB98IUu7Izt4pn8Ph9ummK4q9oii
zG3YrTxAd+D91N1eW1DwWz5MHrJdk5UIOcwKS49+sK3jwLjIGBcZ5BZl0vIQnZ9a
e0ngm6zmihI6+Yb+FnBrZhX+6p7UBlhOPPpkFShnEJn5RaAowZbf1Q==
=99Dv
-----END PGP SIGNATURE-----

From firewalls-owner  Sat Feb  8 10:27:18 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id KAA19800 for firewalls-outgoing; Sat, 8 Feb 1997 10:07:04 -0800 (PST)
Received: from gw.research.megasoft.com (gw.research.megasoft.com [206.230.35.93]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id KAA19793 for <Firewalls@GreatCircle.COM>; Sat, 8 Feb 1997 10:06:49 -0800 (PST)
Received: (from uucp@localhost) by gw.research.megasoft.com (8.7.5/8.7.3-cmcurtin) id NAA06808; Sat, 8 Feb 1997 13:05:03 -0500 (EST)
Received: from goffette.research.megasoft.com(192.168.1.2) by gw.research.megasoft.com via smap (V1.3)
	id sma006806; Sat Feb  8 13:05:02 1997
Received: by goffette.research.megasoft.com (940816.SGI.8.6.9/940406.SGI)
	 id MAA16516; Sat, 8 Feb 1997 12:57:05 -0500
Date: Sat, 8 Feb 1997 12:57:05 -0500
Message-Id: <199702081757.MAA16516@goffette.research.megasoft.com>
From: C Matthew Curtin <cmcurtin@research.megasoft.com>
To: Steve@hon.com
Cc: Firewalls@GreatCircle.COM
Subject: Re: Email Crashed Mail Server!
In-Reply-To: <32F949B5.21FC@hon.com>
References: <32F949B5.21FC@hon.com>
X-Face: "&>g(&eGr?u^F:nFihL%BsyS1[tCqG7}I2rGk4{aKJ5I_5A\*6RYn4"N.`1pPF9LO!Fa<(gj:12)?=uP2l01e10Gij"7j&-)torL^iBrNf\s7PDLm=rf[PjxtSbZ{J(@@j"q2/iV9^Mx<e%nT[:7s7.-#u*}GAH,bEfbfh-NDqSG`+s
Reply-To: cmcurtin@research.megasoft.com
X-Attribution: mattC
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Steve" == Steve Gallipeau <Steve@hon.com> writes:

Steve> I received the following email (had to dig it out of my
Steve> logs) that crashed my Mail Server.  I would really appreciate
Steve> anyone taking a look at the headers and maybe be able to advise
Steve> me why this crashed my server and if it could have been
Steve> intentional.  The 'To:' line in particular looks very unusual.

Looks to me like you're using the wrong mail server.  Linux|FreeBSD
and qmail|smail|smtpd+sendmail are your friends.  At least you haven't
paid for it.  (And if you *did* pay for it, you should get your money
back.) 

There's nothing in any of those headers that is illegal.

- -- 
Matt Curtin  Chief Scientist  Megasoft, Inc.  cmcurtin@research.megasoft.com
http://www.research.megasoft.com/people/cmcurtin/    I speak only for myself
Hacker Security Firewall Crypto PGP Privacy Unix Perl Java Internet Intranet

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Have you encrypted your data today?

iQEVAwUBMvy+XH6R34u/f3zNAQGSkwf9GoWhkZ3PFBbG+dqdnedxMB+pa/Fnq6uM
kiTQE51aB18RGQ0BRjVpltEkJUgtaXy/gFxv+XsLxsmZiMekDj/8f4dbb25KutnS
+c5haDphocv1BT89i/8MmvW7Hzs4L8tYe+ur12S07cu5KV1qeexT10JZkgDHWRD2
lufrwRWBXod6qIVkOjApg8o4Ss2duLLZkhW8PRxZmKoXuU4Ao39dAvt/HM/POYJm
1arZGAA80ssq614cxW+cwy/7UZ0suq69hAQoi1S05JZjQkB63VS0CjWAyp10QTWu
O0DVv3Ij+L1gPlyKWwvxBN+hniHi4uJA0X05+0pgWyA/PhpnyHAIdg==
=7omY
-----END PGP SIGNATURE-----

From firewalls-owner  Sat Feb  8 10:35:15 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA19296 for firewalls-outgoing; Sat, 8 Feb 1997 09:57:18 -0800 (PST)
Received: from gw.research.megasoft.com (gw.research.megasoft.com [206.230.35.93]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id JAA19289 for <firewalls@GreatCircle.COM>; Sat, 8 Feb 1997 09:57:08 -0800 (PST)
Received: (from uucp@localhost) by gw.research.megasoft.com (8.7.5/8.7.3-cmcurtin) id MAA06693; Sat, 8 Feb 1997 12:55:32 -0500 (EST)
Received: from goffette.research.megasoft.com(192.168.1.2) by gw.research.megasoft.com via smap (V1.3)
	id sma006691; Sat Feb  8 12:55:11 1997
Received: by goffette.research.megasoft.com (940816.SGI.8.6.9/940406.SGI)
	 id MAA16483; Sat, 8 Feb 1997 12:47:12 -0500
Date: Sat, 8 Feb 1997 12:47:12 -0500
Message-Id: <199702081747.MAA16483@goffette.research.megasoft.com>
From: C Matthew Curtin <cmcurtin@research.megasoft.com>
To: sherod@medeserv.com.au
Cc: firewalls@GreatCircle.COM
Subject: Re: Encryption Software mailing list
In-Reply-To: <32F6ACD0.2F25@medeserv.com.au>
References: <32F6ACD0.2F25@medeserv.com.au>
X-Face: "&>g(&eGr?u^F:nFihL%BsyS1[tCqG7}I2rGk4{aKJ5I_5A\*6RYn4"N.`1pPF9LO!Fa<(gj:12)?=uP2l01e10Gij"7j&-)torL^iBrNf\s7PDLm=rf[PjxtSbZ{J(@@j"q2/iV9^Mx<e%nT[:7s7.-#u*}GAH,bEfbfh-NDqSG`+s
Reply-To: cmcurtin@research.megasoft.com
X-Attribution: mattC
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Steven" == Steven Herod <sherod@medeserv.com.au> writes:

Steven> Is anybody familiar with an Encyrption Software mailing list
Steven> or something along those lines?

I haven't seen anything that's oriented toward what products are good,
but there are some good mailing lists and newsgroups that talk about
cryptography, typically implementation thereof.

Information that you'll pick up from there will give you some ideas
about what algorithms and such are generally trusted, which are not,
and that sort of thing.  But it'll still be up to you to ask questions
of the vendors and choose something that makes sense.

Also, my "Snake Oil FAQ" is a good start to getting a quick
understanding of the kinds of things to generally be aware of when
thinking about getting a crypto solution.

http://www.research.megasoft.com/people/cmcurtin/snake-oil-faq.html
http://www.research.megasoft.com/people/cmcurtin/snake-oil-faq.ps

* Coderpunks
  mailto:majordomo@toad.com
    subscribe coderpunks

* Cryptography
  mailto:majordomo@c2.net
    subscribe cryptography

* sci.crypt
  news:sci.crypt  

- -- 
Matt Curtin  Chief Scientist  Megasoft, Inc.  cmcurtin@research.megasoft.com
http://www.research.megasoft.com/people/cmcurtin/    I speak only for myself
Hacker Security Firewall Crypto PGP Privacy Unix Perl Java Internet Intranet

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: Have you encrypted your data today?

iQEVAwUBMvy8EX6R34u/f3zNAQFXQwf+KeDapmjhzZjMqdrkgQcJKC60X5Kkx6F1
GKJPMJrq6ryMnbjF/G8jw82ASWfqyC1H1BIs4t53VcmA9mDcVCir3vDdpYTr9FbB
xHGP5bcs5LdcvWdiN/Ls7SpE3JuLkwv0t6DUcitgdYyV62lZnD8Fq6Z7I0bnsysY
b2bo7GThYq3Io2W7Ivpsf9EOgOCGTpix177Xv25u2unFvDc6PlfRAE8P9fQW59ud
LCheuWygpbCsj3lt+7n8noFS3Fl2355beSb8z8f7BhBFkbD5YO/pri0f1nXAasw+
g9sWOfdH2hVggBBzoxDMSI8I0j2nyD4vVBP5BtCQoF666Y2ia9NUCA==
=rPkb
-----END PGP SIGNATURE-----

From firewalls-owner  Sat Feb  8 11:30:47 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA26951 for firewalls-outgoing; Sat, 8 Feb 1997 11:07:29 -0800 (PST)
Received: from mailhost.onramp.net (mailhost.onramp.net [199.1.11.3]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id LAA26894 for <Firewalls@GreatCircle.COM>; Sat, 8 Feb 1997 11:07:15 -0800 (PST)
Received: from sage1 (sage1.doogie.com [206.50.2.2]) by mailhost.onramp.net (8.8.5/8.6.5) with ESMTP id NAA22831; Sat, 8 Feb 1997 13:04:51 -0600 (CST)
Message-Id: <199702081904.NAA22831@mailhost.onramp.net>
From: "Jerry Mckane" <jerrym@Onramp.NET>
To: <cmcurtin@research.megasoft.com>, <Steve@hon.com>
Cc: <Firewalls@GreatCircle.COM>
Subject: Re: Email Crashed Mail Server!
Date: Sat, 8 Feb 1997 13:07:07 -0600
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1155
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

a while back my pc clock got sent to 2097 instead of 1997 and everyone at
work using netscape mail system crashed 
whoops :)

----------
> From: C Matthew Curtin <cmcurtin@research.megasoft.com>
> To: Steve@hon.com
> Cc: Firewalls@GreatCircle.COM
> Subject: Re: Email Crashed Mail Server!
> Date: Saturday, February 08, 1997 11:57 AM
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> 
> >>>>> "Steve" == Steve Gallipeau <Steve@hon.com> writes:
> 
> Steve> I received the following email (had to dig it out of my
> Steve> logs) that crashed my Mail Server.  I would really appreciate
> Steve> anyone taking a look at the headers and maybe be able to advise
> Steve> me why this crashed my server and if it could have been
> Steve> intentional.  The 'To:' line in particular looks very unusual.
> 
> Looks to me like you're using the wrong mail server.  Linux|FreeBSD
> and qmail|smail|smtpd+sendmail are your friends.  At least you haven't
> paid for it.  (And if you *did* pay for it, you should get your money
> back.) 
> 
> There's nothing in any of those headers that is illegal.
> 
> - -- 
> Matt Curtin  Chief Scientist  Megasoft, Inc. 
cmcurtin@research.megasoft.com
> http://www.research.megasoft.com/people/cmcurtin/    I speak only for
myself
> Hacker Security Firewall Crypto PGP Privacy Unix Perl Java Internet
Intranet
> 
> -----BEGIN PGP SIGNATURE-----
> Version: 2.6.2
> Comment: Have you encrypted your data today?
> 
> iQEVAwUBMvy+XH6R34u/f3zNAQGSkwf9GoWhkZ3PFBbG+dqdnedxMB+pa/Fnq6uM
> kiTQE51aB18RGQ0BRjVpltEkJUgtaXy/gFxv+XsLxsmZiMekDj/8f4dbb25KutnS
> +c5haDphocv1BT89i/8MmvW7Hzs4L8tYe+ur12S07cu5KV1qeexT10JZkgDHWRD2
> lufrwRWBXod6qIVkOjApg8o4Ss2duLLZkhW8PRxZmKoXuU4Ao39dAvt/HM/POYJm
> 1arZGAA80ssq614cxW+cwy/7UZ0suq69hAQoi1S05JZjQkB63VS0CjWAyp10QTWu
> O0DVv3Ij+L1gPlyKWwvxBN+hniHi4uJA0X05+0pgWyA/PhpnyHAIdg==
> =7omY
> -----END PGP SIGNATURE-----

From firewalls-owner  Sat Feb  8 13:11:43 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA05289 for firewalls-outgoing; Sat, 8 Feb 1997 13:03:06 -0800 (PST)
Received: from squirrel.com (squirrel.com [192.135.191.159]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id NAA05274 for <firewalls@greatcircle.com>; Sat, 8 Feb 1997 13:02:53 -0800 (PST)
Received: (from mch@localhost) by squirrel.com (8.6.12/SQUIRREL-1.0) id NAA05617; Sat, 8 Feb 1997 13:02:19 -0800
Message-ID: <Mutt.19970208130218.mch@ratatosk.squirrel.com>
Date: Sat, 8 Feb 1997 13:02:18 -0800
From: mch@squirrel.com (Mark Henderson)
To: John_Chen@acml.com (John Chen/New York/ACMC)
Cc: firewalls@greatcircle.com (firewalls)
Subject: Re: FW-1 license
X-Mailer: Mutt 0.58.1
Mime-Version: 1.0
In-Reply-To: <no.id>; from John Chen/New York/ACMC on Feb 7, 1997 16:58:36 +0000
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

John Chen/New York/ACMC writes:
> Hi all
> 
> I have a question of FW-1 license, does FW-1 2.1 of Solaris version only
> license by hostid?
> 
> I'd like to build up a standby machine as backup of the production FW-1, if
> the license is hostid based, means I have to buy a second license.  If
> license is IP address based, I can have it setup and ready to go.  In case
> of the production machine is down, just simply tuen it on and plug into the
> network.

If the licence is hostid based you might consider using change-sun-hostid.

ftp://ftp.netcom.com/pub/he/henderso/change-sun-hostid.tar.gz
http://www.squirrel.com/squirrel/sun-stuff/change-sun-hostid.tar.gz

But, I'd be careful with the legal issues. 

When I wrote it I intended it for short-term emergency use of hostid 
locked software (e.g. when a server dies and the vendor isn't answering
their phones to give out new keys - weekends, etc.) 


From firewalls-owner  Sat Feb  8 15:35:24 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id PAA12964 for firewalls-outgoing; Sat, 8 Feb 1997 15:27:44 -0800 (PST)
Received: from thor.inlink.com (ultra.inlink.com [206.196.96.100]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id PAA12946 for <firewalls@greatcircle.com>; Sat, 8 Feb 1997 15:27:35 -0800 (PST)
Received: from mail.global-sol.com (global-sol.com [206.196.126.221]) by thor.inlink.com (8.8.0/V8) with ESMTP id RAA12681 for <firewalls@greatcircle.com>; Sat, 8 Feb 1997 17:26:28 -0600 (CST)
Received: from thor.inlink.com ([206.196.126.220]) by mail.global-sol.com (8.7.5/8.7.3) with SMTP id TAA19064 for <firewalls@greatcircle.com>; Sat, 8 Feb 1997 19:09:54 GMT
Message-Id: <199702081909.TAA19064@mail.global-sol.com>
Comments: Authenticated sender is <tlayton@[206.196.126.221]>
From: "Timothy P. Layton, Sr." <tlayton@global-sol.com>
Organization: Global Solutions Corporation
To: firewalls@greatcircle.com
Date: Sat, 8 Feb 1997 17:24:46 +0000
Subject: fellow PIX users ?
Reply-to: tlayton@global-sol.com
X-mailer: Pegasus Mail for Win32 (v2.42)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi, is anyone out there using a cisco PIX firewall ??

I installed the PIX a few months ago and am using the 10.0 internal
network.  Everything is wroking really good.  I need to start 
implementing security rules.  My boss wants me to only allow
a few select users ftp, telnet, etc type of applications.  

I understand normal cisco router access lists and was wondering
if when you implement an access list on the PIX that it also
denys everything from that point on unless you explicitly
permit it ???

Thanks for any help that you may be able to provide.

If you could cut and paste any example I would appreciate it.

PS-
I have looked at cisco's web site and found a few sytax examples but
were not overly helpful to me.

Thanks
Tim-

From firewalls-owner  Sun Feb  9 03:49:53 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id DAA14634 for firewalls-outgoing; Sun, 9 Feb 1997 03:42:08 -0800 (PST)
Received: from ns.medcom.se (ns.medcom.se [194.213.80.20]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id DAA14627 for <Firewalls@GreatCircle.COM>; Sun, 9 Feb 1997 03:41:55 -0800 (PST)
Received: by ns.medcom.se; id MAA02372; Sun, 9 Feb 1997 12:43:35 +0100 (MET)
Received: from giscard.medcom.se(194.16.52.41) by ns.medcom.se via smap (3.2)
	id xma002370; Sun, 9 Feb 97 12:43:30 +0100
Received: from bob (giscard.medcom.se) by giscard.medcom.se with ESMTP
	(1.37.109.16/16.2) id AA016622035; Sun, 9 Feb 1997 12:40:35 GMT
Message-Id: <32FDB7C9.6C1B@medcom.se>
Date: Sun, 09 Feb 1997 12:40:57 +0100
From: Neil Costigan <neil@medcom.se>
Reply-To: neil@medcom.se
X-Sender: Neil Costigan <neil@medcom.se> (Unverified)
X-Mailer: Mozilla 4.0b1 (WinNT; I)
Mime-Version: 1.0
To: Russ.Cooper@RC.on.ca, Firewalls@GreatCircle.COM
Subject: VPN / alternative to alta vista's tunnel / security utils
X-Priority: Normal
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=us-ascii
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Russ,

check out medcom's ssl based VPN
its a cheap, SSL based, alternative VPN to alta vista's tunnel

http://www.medcom.se/ssrssl

as this is going to the firewall's list ..

medcom also have a 'new' S/key client for free down-load

http://www.medcom.se/skey

has normal md4/5 skey fuctionality
with handy auto cut / paste operation

Regards,
/neil costigan
http://www.medcom.se

From firewalls-owner  Sun Feb  9 06:04:55 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA20121 for firewalls-outgoing; Sun, 9 Feb 1997 06:01:26 -0800 (PST)
Received: from minotaur.labyrinth.net.au (minotaur.labyrinth.net.au [203.9.148.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id GAA20110 for <firewalls@greatcircle.com>; Sun, 9 Feb 1997 06:01:18 -0800 (PST)
Received: (from mail@localhost) by minotaur.labyrinth.net.au (8.7.2/8.7.2) id BAA27748 for <firewalls@greatcircle.com>; Mon, 10 Feb 1997 01:00:17 +1100 (EST)
X-Authentication-Warning: minotaur.labyrinth.net.au: mail set sender to <sjg@zen.quick.com.au> using -f
Received: from gate.quick.com.au(203.12.250.130) by minotaur.labyrinth.net.au via smap (V1.3)
	id sma027690; Mon Feb 10 00:59:51 1997
Received: (from sjg@localhost) by zen.quick.com.au (8.7.3/8.7.3) id AAA11179; Mon, 10 Feb 1997 00:59:23 +1100 (EST)
Date: Mon, 10 Feb 1997 00:59:23 +1100 (EST)
From: "Simon J. Gerraty" <sjg@zen.quick.com.au>
Message-Id: <199702091359.AAA11179@zen.quick.com.au>
To: firewalls@greatcircle.com
Subject: SLr* released.  rsh,rcp,rdist over SSL
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Sorry to all the folk that have waited so long and patiently for this,
but I have _finally_ cut a release of SSLrshd and friends.  

They can be downloaded from ftp://ftp.quick.com.au/sjg/ or 
http://www.quick.com.au/ftp/pub/sjg/

SSLrshd is the server for ssl_rcmd(), they work just like rshd and
rcmd() except that trust is placed in X.509 certificates and nothing
needs to be set-uid root.  If a host trusts my certificate, then it
does not care where I make requests from.  The functionality is the
same, but the security is vastly different.

See http://www.quick.com.au/ftp/pub/sjg/help/SSLrsh.html for more details.

I gave up on the idea of adding support for GNU, make, so you still
need to obtain bmake, my bmake.tar.gz  in the same directory uses GNU
configure so should build reasonably easily - it certainly does on
SunOS,Solaris,HP-UX and IRIX.  

See http://www.quick.com.au/ftp/pub/sjg/help/bmake.html for more details. 

SSLrsh-1.0.tar.gz contains

SSLrsh
SSLrshd
SSLrcp
and
SSLrdist

actually to build SSLrdist you must have the USC rdist distribution handy.

and of course libsslfd which makes adding SSL and other crypto hooks to
network daemons such as rshd, telnetd and even ftpd almost trivial.

Since libsslfd is a pre-requisit for my stelnet and SNFS, I hope to
get those packaged up and released soon.

--sjg


From firewalls-owner  Sun Feb  9 08:38:01 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA26919 for firewalls-outgoing; Sun, 9 Feb 1997 08:30:12 -0800 (PST)
Received: from ocsystems.com (ocsystems.com [192.246.117.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id IAA26905 for <Firewalls@GreatCircle.COM>; Sun, 9 Feb 1997 08:30:04 -0800 (PST)
Received: by ocsystems.com (AIX 3.2/UCB 5.64/4.03)
          id AA33081; Sun, 9 Feb 1997 11:32:37 -0500
From: gvc@ocsystems.com (G. Vincent Castellano)
Message-Id: <9702091632.AA33081@ocsystems.com>
Subject: O'Reilly:  Passive mode ftp filtering
To: Firewalls@GreatCircle.COM
Date: Sun, 9 Feb 1997 11:32:36 -0500 (EST)
X-Mailer: ELM [version 2.4 PL22]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I'm looking at the O'Reilly book (Building Internet
Firewalls, Nov 1995 edition)  and have a question about the
filtering rule ftp-15 on page 334 (filtering rules for
external router, screened subnet).

I think this rule could require the Ack bit set ('Yes' in the
Ack column) because it only needs to allow the server to
send packets on an already open connection.  This doesn't
open up much of a hole, but I want to verify that I
understand what's going on here.

So, would it harm anything to require Ack=yes on rule ftp-15?

 == G. Vincent Castellano :: X/Ada WWW => http://www.ocsystems.com/xada ==
 ==  "If virtual memory did not exist, it would have                    ==
 ==     become necessary for us to invent it."                          ==

From firewalls-owner  Sun Feb  9 10:06:38 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA02035 for firewalls-outgoing; Sun, 9 Feb 1997 09:53:20 -0800 (PST)
Received: from mail.swip.net (mn4.swip.net [192.71.180.65]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id JAA02004 for <firewalls@GreatCircle.COM>; Sun, 9 Feb 1997 09:53:05 -0800 (PST)
Received: from wintermute.marievik.findata.se by mail.swip.net (8.6.8/3.01)
	id SAA09793; Sun, 9 Feb 1997 18:52:03 +0100
Received: from wintermute.marievik.findata.se (ckn@wintermute.marievik.findata.se [192.71.39.5]) by wintermute.marievik.findata.se (8.6.4/8.6.4) with SMTP id SAA26438; Sun, 9 Feb 1997 18:51:54 +0100
Date: Sun, 9 Feb 1997 18:51:52 +0100 (MET)
From: Carl Karlsson <ckn@findata.se>
X-Sender: ckn@wintermute.marievik.findata.se
To: "Simon J. Gerraty" <sjg@zen.quick.com.au>
cc: firewalls@GreatCircle.COM
Subject: Re: SLr* released.  rsh,rcp,rdist over SSL
In-Reply-To: <199702091359.AAA11179@zen.quick.com.au>
Message-ID: <Pine.SUN.3.93.970209185027.26291A-100000@wintermute.marievik.findata.se>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


On Mon, 10 Feb 1997, Simon J. Gerraty wrote:

> Sorry to all the folk that have waited so long and patiently for this,
> but I have _finally_ cut a release of SSLrshd and friends.  

Sorry for a probably dumb question, but how does these relate to the SSH
package? Pro's and cons, etc.

TIA,
  Calle


From firewalls-owner  Sun Feb  9 10:37:47 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id KAA03592 for firewalls-outgoing; Sun, 9 Feb 1997 10:21:29 -0800 (PST)
Received: from dsm-usa.com ([204.90.102.5]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id KAA03574 for <firewalls@greatcircle.com>; Sun, 9 Feb 1997 10:21:21 -0800 (PST)
Received: from DSM#u#OFFICE-Message_Server by dsm-usa.com
	with Novell_GroupWise; Sun, 09 Feb 1997 13:11:25 -0500
Message-Id: <s2fdccfd.044@dsm-usa.com>
X-Mailer: Novell GroupWise 4.1
Date: Sun, 09 Feb 1997 13:20:18 -0500
From: Richard Brackett <rbrackett@dsm.net>
To: firewalls@greatcircle.com
Subject:  RE: I need the latest version of Linux -Reply
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Were you born such a putz, or do you just work at it real hard?  Send
them a private message explaining the purpose of this list and where
else they might inquire (if you know yourself).  Where has civility gone in
this society?

>>> Jeff Simms <jsimms@auracom.com> 02/08/97 12:12am >>>
In case you havent been following this list, its for firewalls ... LINux = is
available all over the world, use the web and stop wasting those of = us
who are here for firewall discussions' time.

Jeff Simms
Network Services Manager auracom Internet Services

-----Original Message-----
From:	Gabriel Dura [SMTP:dura@geocities.com]
Sent:	Friday, February 07, 1997 9:16 PM
To:	firewalls@GreatCircle.COM
Subject:	I need the latest version of Linux


Hello everybody!

I need the latest version of Linux for a local Internet Provider. They
already have Red Hat Linux 3.0 but they are looking for a new version of
Linux.=20
Can anyone tell me where I can find it?
Is there any ftp site available for download? Is there anyone who can =
sell it?
A place in Romania would be desirable...

Thank you for your help...
Gabriel Dura dura@geocities.com





From firewalls-owner  Sun Feb  9 11:04:58 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA07636 for firewalls-outgoing; Sun, 9 Feb 1997 11:00:55 -0800 (PST)
Received: from dsm-usa.com ([204.90.102.5]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id LAA07626 for <firewalls@greatcircle.com>; Sun, 9 Feb 1997 11:00:48 -0800 (PST)
Received: from DSM#u#OFFICE-Message_Server by dsm-usa.com
	with Novell_GroupWise; Sun, 09 Feb 1997 13:50:55 -0500
Message-Id: <s2fdd63f.045@dsm-usa.com>
X-Mailer: Novell GroupWise 4.1
Date: Sun, 09 Feb 1997 13:59:45 -0500
From: Richard Brackett <rbrackett@dsm.net>
To: firewalls@greatcircle.com
Subject:  RE: I need the latest version of Linux -Reply
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Were you born such a putz, or do you just work at it real hard?  Send
them a private message explaining the purpose of this list and where
else they might inquire (if you know yourself).  Where has civility gone in
this society?

>>> Jeff Simms <jsimms@auracom.com> 02/08/97 12:12am >>>
In case you havent been following this list, its for firewalls ... LINux = is
available all over the world, use the web and stop wasting those of = us
who are here for firewall discussions' time.

Jeff Simms
Network Services Manager auracom Internet Services

-----Original Message-----
From:	Gabriel Dura [SMTP:dura@geocities.com]
Sent:	Friday, February 07, 1997 9:16 PM
To:	firewalls@GreatCircle.COM
Subject:	I need the latest version of Linux


Hello everybody!

I need the latest version of Linux for a local Internet Provider. They
already have Red Hat Linux 3.0 but they are looking for a new version of
Linux.=20
Can anyone tell me where I can find it?
Is there any ftp site available for download? Is there anyone who can =
sell it?
A place in Romania would be desirable...

Thank you for your help...
Gabriel Dura dura@geocities.com





From firewalls-owner  Sun Feb  9 13:08:04 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id MAA16525 for firewalls-outgoing; Sun, 9 Feb 1997 12:58:50 -0800 (PST)
Received: from minotaur.labyrinth.net.au (minotaur.labyrinth.net.au [203.9.148.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id MAA16518 for <firewalls@greatcircle.com>; Sun, 9 Feb 1997 12:58:40 -0800 (PST)
Received: (from mail@localhost) by minotaur.labyrinth.net.au (8.7.2/8.7.2) id HAA09513; Mon, 10 Feb 1997 07:57:40 +1100 (EST)
Received: from gate.quick.com.au(203.12.250.130) by minotaur.labyrinth.net.au via smap (V1.3)
	id sma009511; Mon Feb 10 07:57:19 1997
Received: from localhost (localhost [127.0.0.1]) by zen.quick.com.au (8.7.3/8.7.3) with SMTP id HAA25370; Mon, 10 Feb 1997 07:56:53 +1100 (EST)
Message-Id: <199702092056.HAA25370@zen.quick.com.au>
X-Authentication-Warning: zen.quick.com.au: Host localhost [127.0.0.1] didn't use HELO protocol
To: Carl Karlsson <ckn@findata.se>
cc: firewalls@greatcircle.com
Subject: Re: SLr* released. rsh,rcp,rdist over SSL 
In-reply-to: Your message of "Sun, 09 Feb 97 18:51:52 BST."
             <Pine.SUN.3.93.970209185027.26291A-100000@wintermute.marievik.findata.se> 
Date: Mon, 10 Feb 1997 07:56:50 +1100
From: "Simon J. Gerraty" <sjg@zen.quick.com.au>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> > but I have _finally_ cut a release of SSLrshd and friends.  
> 
> Sorry for a probably dumb question, but how does these relate to the SSH
> package? Pro's and cons, etc.

Not a dumb question at all.  I've not used SSH myself, but know many
folk who have and are very happy with it.

As far as I know the main difference is in key management.  If you are
already issuing X.509 certs to your hosts for web servers, then using
SSLr*,SSLtelnet,SSLftp etc is simply a sensible way to make the most
use of that effort.

Otherwise, SSH is a tried and tested package, which as I understand it
can do more than my simple SSL based versions of standard tools.

--sjg

From firewalls-owner  Sun Feb  9 13:20:02 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA17583 for firewalls-outgoing; Sun, 9 Feb 1997 13:16:27 -0800 (PST)
Received: from imc.eyron.com (mail.eyron.com [192.116.223.180]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id NAA17576 for <firewalls@greatcircle.com>; Sun, 9 Feb 1997 13:16:19 -0800 (PST)
Received: by imc.eyron.com with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63)
	id <01BC16DF.31AE5D00@imc.eyron.com>; Sun, 9 Feb 1997 23:15:52 +0200
Message-ID: <c=US%a=_%p=EYRON%l=MASTER7-970209211512Z-274@imc.eyron.com>
From: Dov Sharon <DovS@EYRON.COM>
To: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: NT Ports
Date: Sun, 9 Feb 1997 23:15:12 +0200
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>Hi 
>
>from a check I did on my NT IIS server it seems that some of the ports it
>listens on are:
>
>Port# 1036 
>Port# 1037 
>Port# 1050 
>Port# 1030 
>Port# 1065 
>Port# 1054 
>
>Does someone know what this ports are used for and if they can be blocked ?
>
>Thanks
>Dov Sharon
>System Admin
>Eyron Ltd
>
>

From firewalls-owner  Sun Feb  9 13:34:57 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA17223 for firewalls-outgoing; Sun, 9 Feb 1997 13:10:58 -0800 (PST)
Received: from hubbub.cisco.com (hubbub.cisco.com [198.92.30.31]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id NAA17209 for <firewalls@GreatCircle.COM>; Sun, 9 Feb 1997 13:10:43 -0800 (PST)
Received: from mhoward-pc.cisco.com (mhoward-isdn1.cisco.com [171.68.19.2]) by hubbub.cisco.com (8.8.4-Cisco.1/CISCO.GATE.1.1) with SMTP id NAA10526; Sun, 9 Feb 1997 13:08:56 -0800 (PST)
Message-Id: <2.2.32.19970209211259.0075c748@diablo.cisco.com>
X-Sender: mhoward@diablo.cisco.com
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Sun, 09 Feb 1997 13:12:59 -0800
To: tlayton@global-sol.com, firewalls@GreatCircle.COM
From: Matthew Howard <mhoward@cisco.com>
Subject: Re: fellow PIX users ?
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

please contact you local Cisco account mgr or systems engineer.  There is a
PIX Firewall Design Guide that is very helpful.  

tks,

matt

At 05:24 PM 2/8/97 +0000, Timothy P. Layton, Sr. wrote:
>Hi, is anyone out there using a cisco PIX firewall ??
>
>I installed the PIX a few months ago and am using the 10.0 internal
>network.  Everything is wroking really good.  I need to start 
>implementing security rules.  My boss wants me to only allow
>a few select users ftp, telnet, etc type of applications.  
>
>I understand normal cisco router access lists and was wondering
>if when you implement an access list on the PIX that it also
>denys everything from that point on unless you explicitly
>permit it ???
>
>Thanks for any help that you may be able to provide.
>
>If you could cut and paste any example I would appreciate it.
>
>PS-
>I have looked at cisco's web site and found a few sytax examples but
>were not overly helpful to me.
>
>Thanks
>Tim-
>
>


   Matthew Howard   
   Sr. Product Line Manager           mhoward@cisco.com
   Internet Business Unit             408-526-4720 (voice)
   Cisco Systems Inc.		      408-527-8122 (fax)
   170 West Tasman Drive  
   Building VM2 (corner of First & Vista Montana)                             
   San Jose, CA 95134


From firewalls-owner  Sun Feb  9 13:50:32 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA19204 for firewalls-outgoing; Sun, 9 Feb 1997 13:32:58 -0800 (PST)
Received: from challenger.atc.fhda.edu (challenger.atc.fhda.edu [153.18.32.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id NAA19175 for <firewalls@GreatCircle.COM>; Sun, 9 Feb 1997 13:32:47 -0800 (PST)
Received: from localhost (manek@localhost) by challenger.atc.fhda.edu (8.8.0/8.7.3) with SMTP id NAA11397; Sun, 9 Feb 1997 13:29:51 -0800 (PST)
Date: Sun, 9 Feb 1997 13:29:51 -0800 (PST)
From: Sameer R Manek <manek@challenger.atc.fhda.edu>
To: "Simon J. Gerraty" <sjg@zen.quick.com.au>
cc: firewalls@GreatCircle.COM
Subject: Re: SLr* released.  rsh,rcp,rdist over SSL
In-Reply-To: <199702091359.AAA11179@zen.quick.com.au>
Message-ID: <Pine.SGI.3.95.970209132017.10700A-100000@challenger.atc.fhda.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Just out of curosity what advantage does the SSLr* package 
have over the SSH package?

The only ones i can think of are ssl doesn't have any setuid files
and ssl has an rdist type program. Though i suppose that ssh could
write a rdist type program. What about encryption advantages of
the two? Though i suppose cypher punks would probably be a better 
place to ask.

Also I suppose i should ask is does sslr* have an officially sanctioned
port number? and ofcourse does it have an rfc? I suspect this may be 
answered via the web, but netscape on a 80386i and a modem link isn't
exactly fun.

Thanks
--
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Sameer Manek                        manek@challenger.atc.fhda.edu
    "A mind once streched by a new idea 
                   never regains its original dimentions"
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
              MIT Magic Cookies, made with Xtc



From firewalls-owner  Sun Feb  9 14:05:27 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA21359 for firewalls-outgoing; Sun, 9 Feb 1997 13:49:39 -0800 (PST)
Received: from mx.ProNetC.com (ns.ProNetC.com [38.225.60.66]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id NAA21296 for <firewalls@GreatCircle.COM>; Sun, 9 Feb 1997 13:49:17 -0800 (PST)
Received: from mailhub.ProNetC.com (solaris.ProNetC.com [38.225.60.130]) by mx.ProNetC.com id NAA00317 for <firewalls@GreatCircle.COM>; Sun, 9 Feb 1997 13:49:20 -0800 (PST)
Received: by a host running sendmail id NAA00628 for firewalls@GreatCircle.COM; Sun, 9 Feb 1997 13:51:24 -0800 (PST)
Date: Sun, 9 Feb 1997 13:51:24 -0800 (PST)
From: Melvin Dippo <md@ProNetC.com>
Message-Id: <199702092151.NAA00628@mailhub.ProNetC.com>
To: firewalls@GreatCircle.COM
Subject: SSH and the TERM Variable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


FWers,

Speaking of SSH.  Does anyone know if the recent advisory WRT rlogin
also apply to SSH?  As I undestand it, SSH is more or less an
"encrypted" rlogin, isn't it?  Is SSH subject to the same $TERM
variable buffer overflow as rlogin?  I assume this is something that
happens after successful login so is probably not as much of a worry
with SSH?  Might there be any other potential issues?

...Mel



From firewalls-owner  Sun Feb  9 16:50:04 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id QAA05757 for firewalls-outgoing; Sun, 9 Feb 1997 16:46:51 -0800 (PST)
Received: from wmperry.in.aventail.com (wmperry.oz.net [207.13.185.53]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id QAA05748 for <Firewalls@GreatCircle.COM>; Sun, 9 Feb 1997 16:46:33 -0800 (PST)
Received: (from wmperry@localhost) by wmperry.in.aventail.com (8.7.6/8.7.3) id QAA01543; Sun, 9 Feb 1997 16:51:17 -0800
Date: Sun, 9 Feb 1997 16:51:17 -0800
Message-Id: <199702100051.QAA01543@wmperry.in.aventail.com>
From: "William M. Perry" <wmperry@aventail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
To: Firewalls@GreatCircle.COM
Subject: RE: [NTSEC] ActiveX, MSIE and Quicken
In-Reply-To: <199702090900.BAA08043@miles.greatcircle.com>
References: <199702090900.BAA08043@miles.greatcircle.com>
Reply-to: wmperry@aventail.com
X-Face: O~Rn;(l][/-o1sALg4A@xpE:9-"'IR[%;,,!m7</SYF`{vYQ(&RI1&EiH[FvT;J}@f!4kfz
 x_!Y#=y{Uuj9GvUi=cPuajQ(Z42R[wE@{G,sn$qGr5g/wnb*"*ktI+,CD}1Z'wxrM2ag-r0p5I6\nA
 [WJopW_J.WY;
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>Presumably, one answer is for the firewall companies to write additional
>application layer filters for port 80, looking for ActiveX or Java
>downloads.  This would make configuration of the firewall a bit more
>complex.  Don't know if any of 'em are considering this yet.  Anyone have
>any scoop on this?

  You can do this with the aventail socks server right now, with the HTTP
filter, you can specify a second-layer of filtering based on the
content-type of the document being retrieved.  For text/html, you can
specify tags and attributes that should be removed from the source.  Its
trivial to have this remove scripting and object embedding stuff.

  I plan on writing a plugin to filter Java/Active-X that will check
signatures, etc.  Just have to find the time.

  You can get more info on the http filter and/or aventail's products at
http://www.aventail.com/, or email me directly, as I wrote the filter.

-Bill P.

From firewalls-owner  Sun Feb  9 17:09:45 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id QAA05705 for firewalls-outgoing; Sun, 9 Feb 1997 16:45:21 -0800 (PST)
Received: from squirrel.com (squirrel.com [192.135.191.159]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id QAA05681 for <firewalls@GreatCircle.COM>; Sun, 9 Feb 1997 16:45:11 -0800 (PST)
Received: (from mch@localhost) by squirrel.com (8.6.12/SQUIRREL-1.0) id QAA09939; Sun, 9 Feb 1997 16:44:38 -0800
Message-ID: <Mutt.19970209164437.mch@ratatosk.squirrel.com>
Date: Sun, 9 Feb 1997 16:44:37 -0800
From: mch@squirrel.com (Mark Henderson)
To: manek@challenger.atc.fhda.edu (Sameer R Manek)
Cc: sjg@zen.quick.com.au (Simon J. Gerraty), firewalls@GreatCircle.COM
Subject: Re: SLr* released.  rsh,rcp,rdist over SSL
References: <199702091359.AAA11179@zen.quick.com.au> <Pine.SGI.3.95.970209132017.10700A-100000@challenger.atc.fhda.edu>
X-Mailer: Mutt 0.58.1
Mime-Version: 1.0
Content-Type: multipart/signed; protocol="application/pgp-signature";
	micalg=pgp-md5; boundary=bxvat6KnTRZkUdfL
In-Reply-To: <Pine.SGI.3.95.970209132017.10700A-100000@challenger.atc.fhda.edu>; from Sameer R Manek on Feb 9, 1997 13:29:51 -0800
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


--bxvat6KnTRZkUdfL

Sameer R Manek writes:
> Just out of curosity what advantage does the SSLr* package 
> have over the SSH package?
> 
> The only ones i can think of are ssl doesn't have any setuid files
> and ssl has an rdist type program. Though i suppose that ssh could
> write a rdist type program. What about encryption advantages of
> the two? Though i suppose cypher punks would probably be a better 
> place to ask.

With regard to ssh
 
1. You can run ssh non-setuid root. Works fine with user RSA authentication
   and password based authentication. 

2. rdist-6.1.3 works very nicely with ssh. You need one small patch
   if you are going to use password authentication, see the ssh faq
   at http://www.uni-karlsruhe.de/~ig25/ssh-faq/
 
Some clarification of the licence agreement might be in order.

> Finally, if you are planning to make money from your use of my code,
> and especially if my code represents a significant portion of or
> contribution to your product then you should obtain a commercial
> license for the code.

sample questions:

1. Can an ISP make SSLr* services available to their customers without
   paying a licence fee?

2. Can XYZ, Inc. use SSLr* to do backups, user logins, firewall 
   administration, etc. without paying a licence fee? 

3. Can XYZ, Inc. incorporate SSLr* into their spiffy new firewall product
   without paying a fee?

I think it is clear that 3 is out, but I'm unclear about 1 and 2.


--bxvat6KnTRZkUdfL
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a

iQCVAwUBMv5vbqWYCYyyZn7/AQHsnAP+Jyp3TY3MBdFmsyP2ovv3vki2PrTSlj+d
AgFVEYRXwjW2w/8FcNKRGA4jj+cHn6LW9nB981j7f0mkbOadN3HOb/H4kKw5Z6xv
ZHhS8xJicAblEpKoMbkYp+4dUt3Xwp29eEkHK1hPyzRuIk4EJCB9nKCTNm6Kmzek
IksiphPlBNc=
=eF62
-----END PGP SIGNATURE-----

--bxvat6KnTRZkUdfL--

From firewalls-owner  Sun Feb  9 19:04:54 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id TAA15659 for firewalls-outgoing; Sun, 9 Feb 1997 19:01:07 -0800 (PST)
Received: from homeport.org (lighthouse.homeport.org [205.136.65.198]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id TAA15650 for <firewalls@GreatCircle.COM>; Sun, 9 Feb 1997 19:00:59 -0800 (PST)
Received: (adam@localhost) by homeport.org (8.8.5/8.6.9) id VAA11979; Sun, 9 Feb 1997 21:56:27 -0500 (EST)
From: Adam Shostack <adam@homeport.org>
Message-Id: <199702100256.VAA11979@homeport.org>
Subject: Re: SLr* released.  rsh,rcp,rdist over SSL
In-Reply-To: <Pine.SGI.3.95.970209132017.10700A-100000@challenger.atc.fhda.edu> from Sameer R Manek at "Feb 9, 97 01:29:51 pm"
To: manek@challenger.atc.fhda.edu (Sameer R Manek)
Date: Sun, 9 Feb 1997 21:56:26 -0500 (EST)
Cc: sjg@zen.quick.com.au, firewalls@GreatCircle.COM
X-Mailer: ELM [version 2.4ME+ PL27 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Sameer R Manek wrote:
| Just out of curosity what advantage does the SSLr* package 
| have over the SSH package?

| The only ones i can think of are ssl doesn't have any setuid files
| and ssl has an rdist type program. Though i suppose that ssh could
| write a rdist type program. What about encryption advantages of
| the two? Though i suppose cypher punks would probably be a better 
| place to ask.

	SSH & Rdist integration is easy, and SSH allows you to specify
a command pretty tightly.  Recall that SSH does have a root listener
(by default /usr/local/sbin/sshd), so its not root-free code.

	SSH's key mechanism, where it generates a new temporary host
key from time to time is nice.  It also offers the cool port
forwarding and X display management features.  The code internals,
however, are not pretty.  (They're not that ugly either, they're just
not great.)

	I too, am curious as to what advantages SSLr* has.

Adam

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume



From firewalls-owner  Sun Feb  9 21:55:05 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id VAA24544 for firewalls-outgoing; Sun, 9 Feb 1997 21:40:37 -0800 (PST)
Received: from challenger.atc.fhda.edu (challenger.atc.fhda.edu [153.18.32.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id VAA24531 for <firewalls@GreatCircle.COM>; Sun, 9 Feb 1997 21:40:29 -0800 (PST)
Received: from localhost (manek@localhost) by challenger.atc.fhda.edu (8.8.0/8.7.3) with SMTP id VAA14200 for <firewalls@GreatCircle.COM>; Sun, 9 Feb 1997 21:39:29 -0800 (PST)
Date: Sun, 9 Feb 1997 21:39:29 -0800 (PST)
From: Sameer R Manek <manek@challenger.atc.fhda.edu>
To: firewalls@GreatCircle.COM
Subject: Re: SLr* released.  rsh,rcp,rdist over SSL
In-Reply-To: <199702100256.VAA11979@homeport.org>
Message-ID: <Pine.SGI.3.95.970209211248.12647C-100000@challenger.atc.fhda.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Sun, 9 Feb 1997, Adam Shostack wrote:

> Sameer R Manek wrote:
> | Just out of curosity what advantage does the SSLr* package 
> | have over the SSH package?
> 
> | The only ones i can think of are ssl doesn't have any setuid files
> | and ssl has an rdist type program. Though i suppose that ssh could
> | write a rdist type program. What about encryption advantages of
> | the two? Though i suppose cypher punks would probably be a better 
> | place to ask.
> 
> 	SSH & Rdist integration is easy, and SSH allows you to specify
> a command pretty tightly.  Recall that SSH does have a root listener
> (by default /usr/local/sbin/sshd), so its not root-free code.

Having never used rdist, i didn't know that ssh and rdist already worked
together (someone said that you need a patch) but anyways that is not
the point. SSHD does have to be root (unless every user is going to run
their own personal sshd) but we are talking setuid files.
/usr/local/bin/ssh is setuid, but does work w/o the setuid bit.

The use of setuid files is the only thing we can compare, because as
all login programs need root privs somewhere to setuid (). Each user
running their own SSHd or SSLr* is certainly not what I would consider
efficient use of system resources.

> 
> 	SSH's key mechanism, where it generates a new temporary host
> key from time to time is nice.  It also offers the cool port
> forwarding and X display management features.  The code internals,
> however, are not pretty.  (They're not that ugly either, they're just
> not great.)
> 

The only problem with ssh that I have is that it does not scale very
well. I wonder how well does SSLr* scale? I'd also make the argument
that competing encryption standards, especially when two aren't 
compatible with eachother may cause problems. ssh falls back to 
rsh if the remote site doesn't support ssh. Will SLrsh fall back
to either rsh or ssh? it would seem to me that a giant bloated 
r(sh, login, dist) that supports multiple standards is not the best.

Trying to explain to users that they can't connect to another machine
in some other department/company/school because the other department
supports a differnt encryption standard will cause people to shy away,
and complain of difficultly. Ultimately these users may do something 
that is least desireable, such as a cleartext telnet.

I couldn't agree more, a strong encyption is needed, but multiple venders
and groups issuing r* replacements that are incomplatible with 
each other does not seem to me the best solution. This idea of multiple 
replacements seems to against the system-admin ideal. Professional 
system admins are always telling me a good admin is one who can run 
a machine securely as possible, and still be as transparent as possible.
Incompatible and competeting standards seem to go directly against this
ideal.

Sameer
--
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Sameer Manek                        manek@challenger.atc.fhda.edu
    "A mind once streched by a new idea 
                   never regains its original dimentions"
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
              MIT Magic Cookies, made with Xtc



From firewalls-owner  Sun Feb  9 22:19:57 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id WAA27461 for firewalls-outgoing; Sun, 9 Feb 1997 22:14:54 -0800 (PST)
Received: from sunphil.sunphil.mozcom.com (sunphil.mozcom.com [206.151.138.34]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id WAA27363 for <firewalls@GreatCircle.COM>; Sun, 9 Feb 1997 22:13:49 -0800 (PST)
Received: by sunphil.sunphil.mozcom.com (SMI-8.6/SMI-SVR4)
	id OAA14629; Mon, 10 Feb 1997 14:10:45 -0800
Date: Mon, 10 Feb 1997 14:10:45 -0800
From: drexx@sunphil.mozcom.com (Dexter D. Laggui)
Message-Id: <199702102210.OAA14629@sunphil.sunphil.mozcom.com>
To: firewalls@GreatCircle.COM, fw-1-mailinglist@us.checkpoint.com
Subject: [FW-1] Configuration  and maintenance
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

						
Hello world,

It would be very much appreciated if anybody could be of help to my
Sun SparcStation + Solaris 2.5 + Firewall-1 box:

1] Are there any tools out there (preferably free) that can analyze
   core dump files, with particulars on FW-1?
   (I currently execute: "% strings core > core.txt; vi core.txt" )

2] What are the freely-available tools to counter-trace any attempts of
   security violations in our network ? How 'bout commercial ones?
   (We'd like to have one.) 

most humble newbie,
Drexx.

"It's a dirty job, but somebody's gotta do it." -- John Wayne
~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~
         ______
        /_____/\	DEXTER D. LAGGUI
       /_____\\ \	Systems Engineer, Systems Integration Group 
      /_____\ \\ /	PHILIPPINE SYSTEMS PRODUCTS INC.
     /_____/ \/ / /	Penthouse, Corporate Business Center
    /_____/ /   \//\	150 Paseo de Roxas Ave., Legaspi Village
    \_____\//\   / /	Makati City, Philippines
     \_____/ / /\ /          
      \_____/ \\ \	Phone: (++632) 813-6453 to 55 loc. 222
       \_____\ \\	Fax:   (++632) 813-3516
        \_____\/	Email: drexx@sunphil.mozcom.com

~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~


From firewalls-owner  Sun Feb  9 22:35:22 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id WAA28241 for firewalls-outgoing; Sun, 9 Feb 1997 22:20:37 -0800 (PST)
Received: from sunphil.sunphil.mozcom.com (sunphil.mozcom.com [206.151.138.34]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id WAA27756 for <firewalls@GreatCircle.COM>; Sun, 9 Feb 1997 22:16:57 -0800 (PST)
Received: by sunphil.sunphil.mozcom.com (SMI-8.6/SMI-SVR4)
	id OAA14926; Mon, 10 Feb 1997 14:13:00 -0800
Date: Mon, 10 Feb 1997 14:13:00 -0800
From: drexx@sunphil.mozcom.com (Dexter D. Laggui)
Message-Id: <199702102213.OAA14926@sunphil.sunphil.mozcom.com>
To: firewalls@GreatCircle.COM, fw-1-mailinglist@us.checkpoint.com
Subject: [FW-1] Configuration  and maintenance
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello world,

It would be very much appreciated if anybody could be of help to my
Sun SparcStation + Solaris 2.5 + Firewall-1 box:

1] Are there any tools out there (preferably free) that can analyze
   core dump files, with particulars on FW-1?
   (I currently execute: "% strings core > core.txt; vi core.txt" )

2] What are the freely-available tools to counter-trace any attempts of
   security violations in our network ? How 'bout commercial ones?
   (We'd like to have one.) 

most humble newbie,
Drexx.

"It's a dirty job, but somebody's gotta do it." -- John Wayne
~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~
         ______
        /_____/\	DEXTER D. LAGGUI
       /_____\\ \	Systems Engineer, Systems Integration Group 
      /_____\ \\ /	PHILIPPINE SYSTEMS PRODUCTS INC.
     /_____/ \/ / /	Penthouse, Corporate Business Center
    /_____/ /   \//\	150 Paseo de Roxas Ave., Legaspi Village
    \_____\//\   / /	Makati City, Philippines
     \_____/ / /\ /          
      \_____/ \\ \	Phone: (++632) 813-6453 to 55 loc. 222
       \_____\ \\	Fax:   (++632) 813-3516
        \_____\/	Email: drexx@sunphil.mozcom.com

~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~

From firewalls-owner  Sun Feb  9 22:50:14 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id WAA27401 for firewalls-outgoing; Sun, 9 Feb 1997 22:14:06 -0800 (PST)
Received: from sunphil.sunphil.mozcom.com (sunphil.mozcom.com [206.151.138.34]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id WAA27169 for <firewalls@GreatCircle.COM>; Sun, 9 Feb 1997 22:11:30 -0800 (PST)
Received: by sunphil.sunphil.mozcom.com (SMI-8.6/SMI-SVR4)
	id OAA14468; Mon, 10 Feb 1997 14:08:28 -0800
Date: Mon, 10 Feb 1997 14:08:28 -0800
From: drexx@sunphil.mozcom.com (Dexter D. Laggui)
Message-Id: <199702102208.OAA14468@sunphil.sunphil.mozcom.com>
To: firewalls@GreatCircle.COM, thl@ProNetC.com
Subject: Re: SUN's Stealth Product
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello Mel,

It's called the SunScreen SPF-100 and, IMHO, it is designed to work with
the Solstice Firewall-1 as part of a total security solution. Do check
out Sun's web site for more info. 

most humble newbie,
Drexx.

"It's a dirty job, but somebody's gotta do it." -- John Wayne
~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~
         ______
        /_____/\	DEXTER D. LAGGUI
       /_____\\ \	Systems Engineer, Systems Integration Group 
      /_____\ \\ /	PHILIPPINE SYSTEMS PRODUCTS INC.
     /_____/ \/ / /	Penthouse, Corporate Business Center
    /_____/ /   \//\	150 Paseo de Roxas Ave., Legaspi Village
    \_____\//\   / /	Makati City, Philippines
     \_____/ / /\ /          
      \_____/ \\ \	Phone: (++632) 813-6453 to 55 loc. 222
       \_____\ \\	Fax:   (++632) 813-3516
        \_____\/	Email: drexx@sunphil.mozcom.com

~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~

|| From firewalls-owner@GreatCircle.COM Sat Feb  8 03:46 GMT 1997
|| From: Tom Lojewski <thl@ProNetC.com>
|| Subject: SUN's Stealth Product
|| To: firewalls@GreatCircle.COM
|| Date: Fri, 7 Feb 1997 11:01:48 -0800 (PST)
|| X-Mailer: ELM [version 2.4 PL25]
|| MIME-Version: 1.0
|| Content-Transfer-Encoding: 7bit
|| Sender: firewalls-owner@GreatCircle.COM
|| 
|| 
|| Firewallers,
|| 
|| I've heard murmurings of SUN's Stealth product but have never heard it
|| mentioned on this list.  Does anyone know anything about it?
|| 
|| --Mel
|| 

From firewalls-owner  Sun Feb  9 23:02:06 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id WAA28484 for firewalls-outgoing; Sun, 9 Feb 1997 22:21:41 -0800 (PST)
Received: from sunphil.sunphil.mozcom.com (sunphil.mozcom.com [206.151.138.34]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id WAA28048 for <firewalls@GreatCircle.COM>; Sun, 9 Feb 1997 22:19:37 -0800 (PST)
Received: by sunphil.sunphil.mozcom.com (SMI-8.6/SMI-SVR4)
	id OAA15128; Mon, 10 Feb 1997 14:15:07 -0800
Date: Mon, 10 Feb 1997 14:15:07 -0800
From: drexx@sunphil.mozcom.com (Dexter D. Laggui)
Message-Id: <199702102215.OAA15128@sunphil.sunphil.mozcom.com>
To: firewalls@GreatCircle.COM, fw-1-mailinglist@us.checkpoint.com
Subject: packet from unknown router
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello world,

I keep getting this on my Firewall-1 2.0b VPN + Solaris 2.5 + Netra i +
Quad ethernet:

1] 

Date Time Hostname in.routed [pid]: packet from unknown router, hostIPaddr
   
2]
   NOTICE: zs3: ring buffer overflow

Searched database of Sunsolve and found Infodoc 11992. It says that a
patch for Solaris is still pending, that a patch is only available for
SunOS. To wit:

------------------
A: This occurs because your machine is receiving broadcast packets
from a router that is on a different subnet. Since broadcast packets
will not typically cross subnet boundaries, this usually means that
you have machines from two subnets on the same physical wire.

Often, this is a mistake  if you see this error and do not expect to
have multiple networks on the same wire, track down the
source machine (x.x.x.x) and fix its IP address.

However, there are cases where this setup might be intentional, as
outlined in RFC 1597. This would imply that you had several networks
all using the same physical wire. Unfortunately, this is not currently
supported correctly, as is described in Section 6.1.

If you are on a SunOS machine, just install patch 100283 and this
problem will go away. More information on this is contained in Section
5.1.

Under Solaris, a fix for this issue is still pending. If the errors
are too much, revert to using a default router, as
described in Section 3.1, until the problem is corrected.
------------------

I am hoping that somebody has a hack around this. Any help would be much
appreciated. Many TNX.

most humble newbie,
Drexx.


"It's a dirty job, but somebody's gotta do it." -- John Wayne
~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~
         ______
        /_____/\	DEXTER D. LAGGUI
       /_____\\ \	Systems Engineer, Systems Integration Group 
      /_____\ \\ /	PHILIPPINE SYSTEMS PRODUCTS INC.
     /_____/ \/ / /	Penthouse, Corporate Business Center
    /_____/ /   \//\	150 Paseo de Roxas Ave., Legaspi Village
    \_____\//\   / /	Makati City, Philippines
     \_____/ / /\ /          
      \_____/ \\ \	Phone: (++632) 813-6453 to 55 loc. 222
       \_____\ \\	Fax:   (++632) 813-3516
        \_____\/	Email: drexx@sunphil.mozcom.com

~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~


From firewalls-owner  Sun Feb  9 23:20:26 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id XAA05043 for firewalls-outgoing; Sun, 9 Feb 1997 23:04:31 -0800 (PST)
Received: from reflections.mindspring.com (reflections.mindspring.com [204.180.142.192]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id XAA04933 for <firewalls@GreatCircle.COM>; Sun, 9 Feb 1997 23:04:03 -0800 (PST)
Received: from localhost (lists@localhost) by reflections.mindspring.com (8.7.6/8.7.3) with SMTP id BAA15855; Mon, 10 Feb 1997 01:59:37 -0500
Date: Mon, 10 Feb 1997 01:59:37 -0500 (EST)
From: Todd Graham Lewis <lists@reflections.mindspring.com>
To: "Dexter D. Laggui" <drexx@sunphil.mozcom.com>
cc: firewalls@GreatCircle.COM, fw-1-mailinglist@us.checkpoint.com
Subject: Re: [FW-1] Configuration  and maintenance
In-Reply-To: <199702102210.OAA14629@sunphil.sunphil.mozcom.com>
Message-ID: <Pine.LNX.3.95.970210015743.10248F-100000@reflections.mindspring.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Mon, 10 Feb 1997, Dexter D. Laggui wrote:

> Hello world,

Hello.

> 1] Are there any tools out there (preferably free) that can analyze
>    core dump files, with particulars on FW-1?
>    (I currently execute: "% strings core > core.txt; vi core.txt" )

gdb springs to mind.  Of course, as is mentioned in the a.s.r FAQ, one of
the best ways to examine core files is to listen to them:

cat core > /dev/audio

Your mileage will vary depending on how the binary was compiled; you might
have to send it to the vendor, although between friends, they tend to
frown on this if you don't get permission first to send it to them.

> 2] What are the freely-available tools to counter-trace any attempts of
>    security violations in our network ? How 'bout commercial ones?
>    (We'd like to have one.) 

tcpdump?

__
Todd Graham Lewis          Mindspring Enterprises      tlewis@mindspring.com



From firewalls-owner  Mon Feb 10 00:26:59 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id AAA13750 for firewalls-outgoing; Mon, 10 Feb 1997 00:00:58 -0800 (PST)
Received: from silence.secnet.com ([199.185.231.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id AAA13703 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 00:00:40 -0800 (PST)
Received: from localhost (oliver@localhost) by silence.secnet.com (8.8.5/secnet) with SMTP id BAA06903; Mon, 10 Feb 1997 01:32:32 -0700 (MST)
Date: Mon, 10 Feb 1997 01:32:32 -0700 (MST)
From: Oliver Friedrichs <oliver@secnet.com>
To: Todd Graham Lewis <lists@reflections.mindspring.com>
cc: "Dexter D. Laggui" <drexx@sunphil.mozcom.com>, firewalls@GreatCircle.COM,
        fw-1-mailinglist@us.checkpoint.com
Subject: Re: [FW-1] Configuration  and maintenance
In-Reply-To: <Pine.LNX.3.95.970210015743.10248F-100000@reflections.mindspring.com>
Message-ID: <Pine.BSI.3.95.970210012254.6855A-100000@silence.secnet.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



On Mon, 10 Feb 1997, Todd Graham Lewis wrote:

> > 2] What are the freely-available tools to counter-trace any attempts of
> >    security violations in our network ? How 'bout commercial ones?
> >    (We'd like to have one.) 
> 
> tcpdump?

Just a note, but if you're relying on tcpdump for any security purposes
you should make sure that you are running the latest version (I think the
newest is about 2-3 months old?).  All versions prior to that release had
a serious problem whereby a malformed packet would cause tcpdump to dump
core.  All too easy for an attacker to kill tcpdump, and you have no logs.

- Oliver

 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
   Secure Networks Incorporated.  Calgary, Alberta, Canada, (403) 262-9211



From firewalls-owner  Mon Feb 10 02:05:31 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id BAA22489 for firewalls-outgoing; Mon, 10 Feb 1997 01:51:57 -0800 (PST)
Received: from mail.ruhrgebiet.individual.net ([141.39.224.38]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id BAA22463 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 01:51:38 -0800 (PST)
Received: (from admin@localhost)
	by mail.ruhrgebiet.individual.net (8.8.5/8.8.5) with UUCP id KAA14387;
	Mon, 10 Feb 1997 10:35:40 +0100 (MET)
Received: from hostname.devnull.ruhr.de (benedikt@hostname.devnull.ruhr.de [192.168.122.11]) by devnull.local.net (8.6.12/8.6.9) with ESMTP id AAA02992; Mon, 10 Feb 1997 00:59:09 +0100
Received: (from benedikt@localhost) by hostname.devnull.ruhr.de (8.7.5/8.7.3) id BAA00406; Mon, 10 Feb 1997 01:01:18 +0100
To: Sameer R Manek <manek@challenger.atc.fhda.edu>
Cc: "Simon J. Gerraty" <sjg@zen.quick.com.au>, firewalls@GreatCircle.COM
Subject: Re: SLr* released.  rsh,rcp,rdist over SSL
References: <Pine.SGI.3.95.970209132017.10700A-100000@challenger.atc.fhda.edu>
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
From: Benedikt Stockebrand <benedikt@devnull.ruhr.de>
Date: 10 Feb 1997 01:01:17 +0100
In-Reply-To: Sameer R Manek's message of Sun, 9 Feb 1997 13:29:51 -0800 (PST)
Message-ID: <87n2tdmsvm.fsf@devnull.ruhr.de>
Lines: 46
X-Mailer: Gnus v5.3/Emacs 19.34
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Sameer R Manek <manek@challenger.atc.fhda.edu> writes:

> Just out of curosity what advantage does the SSLr* package 
> have over the SSH package?

Various.  I don't know about the SSLr* stuff, but ssh has

  - transparent X11 forwarding
  - fairly smart key handling (ssh-agent, ssh-add, ssh-askpass)

On the other hand, you'll have to update your host key db's manually.
No big deal on a normal-sized LAN, but trouble with big networks.

But of course, that X11 forwarding and stuff in itself makes it bigger
and therefore more dangerous.  Having to deal with the host key db's
yourself keeps it smaller and makes it safer...

> Though i suppose that ssh could write a rdist type program.

If you replace rsh with ssh (as is *very* reasonable) plain old rdist
should work unless it uses its own, mostly obsolete, protocol.

> What about encryption advantages of the two? Though i suppose cypher
> punks would probably be a better place to ask.

Nope, ask the NSA :-) If you're living in the free part of the world
the major difference are an additional 88 bits of keylength.

By default it uses IDEA, a 64-bit block cipher with a key length of
128 bits, and RSA (with a configurable key length) of course.

> Also I suppose i should ask is does sslr* have an officially sanctioned
> port number? and ofcourse does it have an rfc?

It uses port 22, which is still unassigned to my last version of the
Assigned Numbers (RFC 1700, 1994/10).  Until now there's no RFC about
it, but the package comes with a draft.


    Ben

-- 
Ben(edikt)? Stockebrand    Runaway ping.de Admin---Never Ever Trust Old Friends
My name and email address are not to be added to any list used for advertising
purposes.  Any sender of unsolicited advertisement e-mail to this address im-
plicitly agrees to pay a DM 500 fee to the recipient for proofreading services.

From firewalls-owner  Mon Feb 10 02:49:54 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id CAA25674 for firewalls-outgoing; Mon, 10 Feb 1997 02:35:09 -0800 (PST)
Received: from ns.medcom.se (ns.medcom.se [194.213.80.20]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id CAA25629 for <Firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 02:34:52 -0800 (PST)
Received: by ns.medcom.se; id LAA06711; Mon, 10 Feb 1997 11:36:35 +0100 (MET)
Received: from giscard.medcom.se(194.16.52.41) by ns.medcom.se via smap (3.2)
	id xma006709; Mon, 10 Feb 97 11:36:31 +0100
Received: from larry (larry.medcom.se) by giscard.medcom.se with ESMTP
	(1.37.109.16/16.2) id AA075444370; Mon, 10 Feb 1997 11:32:50 GMT
Message-Id: <32FEF950.233@medcom.se>
Date: Mon, 10 Feb 1997 11:32:48 +0100
From: neil costigan <neil@medcom.se>
Reply-To: neil@medcom.se
X-Sender: neil costigan <neil@medcom.se> (Unverified)
X-Mailer: Mozilla 4.0b1 (WinNT; I)
Mime-Version: 1.0
To: Firewalls@GreatCircle.COM
Subject: Re: SLr* released. rsh,rcp,rdist over SSL
X-Priority: Normal
References: <199702100900.BAA18933@miles.greatcircle.com>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=us-ascii
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

| Just out of curosity what advantage does the SSLr* package 
| have over the SSH package?

<More info. Omitted for clarity>


>        SSH's key mechanism, where it generates a new temporary host
>key from time to time is nice.  It also offers the cool port
>forwarding


medcom's ssr (ssl) supplies 'port forwarding' fuctionality over SSL

http://www.medcom.se/ssrssl


Regards
/neil costigan


-- 
///////////////////////////////
neil costigan
   
mailto:neil@medcom.se    
http://www.medcom.se/neil
ph: +46.8.208585
//////////////////////////////

From firewalls-owner  Mon Feb 10 03:05:06 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id CAA27904 for firewalls-outgoing; Mon, 10 Feb 1997 02:57:10 -0800 (PST)
Received: from upshield.uniq.com.au (upstop.uniq.com.au [192.195.152.113]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id CAA27864 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 02:56:56 -0800 (PST)
Received: (from smtp@localhost) by upshield.uniq.com.au id VAA27448
  (8.8.5/IDA-1.6); Mon, 10 Feb 1997 21:55:05 +1100 (EST)
Received: from upshoo.uniq.com.au(192.195.152.130) by upshield via smap (V1.3)
	id ./smaAAAa006gp; Mon Feb 10 21:54:47 1997
Received: from basil.uniq.com.au (basil.uniq.com.au [192.168.3.1]) by upserv.uniq.com.au with ESMTP id VAA17120
  (8.8.5/IDA-1.6); Mon, 10 Feb 1997 21:50:06 +1100 (EST)
Received: (from pauline@localhost) by basil.uniq.com.au id VAA00571
  (8.8.5/IDA-1.6); Mon, 10 Feb 1997 21:52:54 +1100 (EST)
Date: Mon, 10 Feb 1997 21:52:54 +1100 (EST)
From: Pauline van Winsen - Uniq Professional Services <Pauline.van.Winsen@uniq.com.au>
Message-ID: <199702101052.VAA00571@basil.uniq.com.au>
To: firewalls@GreatCircle.COM, fw-1-mailinglist@us.checkpoint.com,
        drexx@sunphil.mozcom.com
Subject: Re: packet from unknown router
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-MD5: UATPfzU9KAkZ3732wwME/g==
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


hi dexter,

> I keep getting this on my Firewall-1 2.0b VPN + Solaris 2.5 + Netra i +
> Quad ethernet:
> 
> 1] 
> 
> Date Time Hostname in.routed [pid]: packet from unknown router, hostIPaddr

i'll think you'll find the pending patch was for 5.5.1 - it was released
a few weeks ago:

Patch-ID# 104236-01
Synopsis: SunOS 5.5.1: in.routed finds packet from unknown router
BugId's fixed with this patch: 1182386
Changes incorporated in this version:
Date: Jan/29/97

the same BugID is fixed in 5.5 by patch:

Patch-ID# 104234-01
Synopsis: SunOS 5.5: in.routed patch
BugId's fixed with this patch: 1182386
Changes incorporated in this version:
Date: Nov/06/96

which was released late last year. sun put out patch lists every two
weeks which are available from http://sunsolve1.sun.com - i suggest you
check there for more info or ask your sun support crew for more info & the
patch.

>    
> 2]
>    NOTICE: zs3: ring buffer overflow

this is a completely different error message - from the zs man page:

     zsn: ring buffer overflow.
          The driver's character  input  ring  buffer  overflowed
          before it could be serviced.

zs3 will most certainly be the mouse on your system, zs[01] are the
serial ports, zs2 is the keyboard.
i'd look for problems with the mouse or stop hitting the mouse buttons
so often. 8-) - though why you need a mouse on a firewall escapes me. 

there are also a number of lists to which you can direct solaris specific
questions like the ones you've posted to firewalls - i'd recommend the 
sun-managers list. info on the list can be found at:
ftp://ra.mcs.anl.gov/sun-managers/faq

hope this helps,
pauline

Pauline van Winsen                                   pauline@uniq.com.au
Uniq Professional Services Pty Ltd                       www.uniq.com.au
PO Box 70, Paddington, NSW 2021,                      (Sydney) Australia
Phone: +61-2-9380-6360      Fax: +61-2-9380-6416      Pager: 016 287 000
"It is not far fetched to say that a woman's cooking is often an 
expression of her love, and it's a wise woman who masters the art early. 
You can be sure he will expect you to cook as well as "Mum"."
	  Way to a Man's heart - Introduction, Woman's World, circa 1964.

From firewalls-owner  Mon Feb 10 03:20:03 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id CAA27070 for firewalls-outgoing; Mon, 10 Feb 1997 02:48:04 -0800 (PST)
Received: from artifex.de (aflinux1.artifex.de [193.141.148.181]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id CAA27056 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 02:47:55 -0800 (PST)
Received: from client_92.artifex.de (client-92.artifex.de [194.45.121.171]) by artifex.de (8.7.5/8.7.3) with SMTP id LAA10029 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 11:46:47 +0100
Message-Id: <2.2.32.19970210104646.0088cd58@artifex.de>
X-Sender: ralf@artifex.de
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Date: Mon, 10 Feb 1997 11:46:46 +0100
To: firewalls@GreatCircle.COM
From: Ralf Rudolph <ralf@artifex.de>
Subject: Strange change of file
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Please forgive me, as the following is not 100 Percent related to
"Firewalls". But it is related to security, and these two topics fit
together. And besides, I bet this audience is also interested in the=
 following.

I have some simple script that summarizes IP usage every 5 min and logs
these values. For that, i use the unix 'cut' command. This script worked
fine for several months without change. But this weekend, starting
somethimes at night, I got a crontab error mail every 5 minutes, because the
script did some error output. But it still worked fine!

After some research, I found out that the 'cut' command generated the error
message. It did so because it was altered! I made a DIFF to another machine
and found out that one bit had changed:

machinename:/usr/bin # hexdump cut>cut.txt      # this is from a safe place
machinename:/usr/bin # hexdump cut0>cut0.txt    # this is the altered one
machinename:/usr/bin # diff cut.txt cut0.txt
129c129
< 0000800 0000 e900 ff50 ffff 25ff 2e84 0800 5068
---
> 0000800 0000 e900 ff50 ffff 25ff 2ec4 0800 5068
machinename:/usr/bin # #             ^--- look here: 84 versus c4, that=B4s
one bit

There are two basic ways to explain what could have happened:
A) System failure (hardware, software or OS bug).=20
B) Some tampering attempt

Why do I bother you with this? Because the possibilty for A) is very low:
This machine has been very stable for several months. Changing Bits on the
harddisk should have been caught by the drive=B4s CRC. Errors on the scsi=
 bus
are protected by parity. If memory was unstable, the machine propably would
hang every now and then (instead, it is very reliable). And it was long ago
since I made the last write access to cut (during installation).

But on the other hand, who would be tampering with something like the 'cut'
command??? I mean, this is not inetd or passwd or something important.

So, what should I think of that?

The machine where this was happening is a rather closed system: No regular
users, and very few services. Basically, this machine handles some special
routing issues. It is running Linux 2.0.2x, a Nameserver, sendmail, a proxy
and does some routing. Besides root, there is only one other user on the
machine, and he=B4s trusted. Telnet has been restricted to some internal IP
addresses I consider to be safe.

Thanks for any Ideas! I hope to get some hints how to handle this. Please
e-mail if the response is very off-topic compared to the firewall topic,
because I don=B4t want to offend anyone!


--=20

| Ralf Rudolph
| Dipl.-Inf. (FH)=20
|
| Artifex Editorial Services GmbH
| Johanna-Melber-Weg 4
| D-60599 Frankfurt / Germany
|
| Phone: +49-69-962217-24
| Fax: +49-69-610351
| E-Mail: ralf@artifex.de
| CompuServe: 101234,53


From firewalls-owner  Mon Feb 10 06:50:10 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA10932 for firewalls-outgoing; Mon, 10 Feb 1997 06:25:05 -0800 (PST)
Received: from minotaur.labyrinth.net.au (minotaur.labyrinth.net.au [203.9.148.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id GAA10925 for <firewalls@greatcircle.com>; Mon, 10 Feb 1997 06:24:56 -0800 (PST)
Received: (from mail@localhost) by minotaur.labyrinth.net.au (8.7.2/8.7.2) id BAA04588; Tue, 11 Feb 1997 01:23:43 +1100 (EST)
X-Authentication-Warning: minotaur.labyrinth.net.au: mail set sender to <sjg@zen.quick.com.au> using -f
Received: from gate.quick.com.au(203.12.250.130) by minotaur.labyrinth.net.au via smap (V1.3)
	id sma004561; Tue Feb 11 01:23:10 1997
Received: (from sjg@localhost) by zen.quick.com.au (8.7.3/8.7.3) id BAA27485; Tue, 11 Feb 1997 01:22:53 +1100 (EST)
Date: Tue, 11 Feb 1997 01:22:53 +1100 (EST)
From: "Simon J. Gerraty" <sjg@zen.quick.com.au>
Message-Id: <199702101422.BAA27485@zen.quick.com.au>
To: firewalls@greatcircle.com
Cc: mch@squirrel.com, sjg@quick.com.au
Subject: Re: SLr* released. rsh,rcp,rdist over SSL
References: <199702091359.AAA11179@zen.quick.com.au> <Pine.SGI.3.95.970209132017.10700A-100000@challenger.atc.fhda.edu> <Mutt.19970209164437.mch@ratatosk.squirrel.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Gee I'm annoyed I missed that 1st S in the subject :-)

>Some clarification of the licence agreement might be in order.

>> Finally, if you are planning to make money from your use of my code,
>> and especially if my code represents a significant portion of or
>> contribution to your product then you should obtain a commercial
>> license for the code.

To put it simply, my intention is that any sysadmin on the net should
feel free to download install and use SSLr* regardless of the type of
organization she works for. so:

>1. Can an ISP make SSLr* services available to their customers without
>   paying a licence fee?

yes

>2. Can XYZ, Inc. use SSLr* to do backups, user logins, firewall 
>   administration, etc. without paying a licence fee? 

Absolutely. Though I use stelnet for logins :-)

>3. Can XYZ, Inc. incorporate SSLr* into their spiffy new firewall product
>   without paying a fee?

>I think it is clear that 3 is out, but I'm unclear about 1 and 2.

Yes, 3 should negotiate a commercial license.  

Sorry that the license is not bullet proof, and thanks for the
opportunity to clarify it.

BTW, our support policy
	http://www.quick.com.au/FreeWare/support.html
makes it clear that if your organization has a thing about only using
commercially licensed software that we are more than happy to take
your money :-)  But making money is not our main goal - it just helps
justify all the time spent at the computer...

--sjg
-- 
Simon J. Gerraty        <sjg@quick.com.au>

#include <disclaimer>   /* imagine something _very_ witty here */

From firewalls-owner  Mon Feb 10 07:05:11 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA11790 for firewalls-outgoing; Mon, 10 Feb 1997 06:47:55 -0800 (PST)
Received: from minotaur.labyrinth.net.au (minotaur.labyrinth.net.au [203.9.148.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id GAA11763 for <firewalls@greatcircle.com>; Mon, 10 Feb 1997 06:47:27 -0800 (PST)
Received: (from mail@localhost) by minotaur.labyrinth.net.au (8.7.2/8.7.2) id BAA05585; Tue, 11 Feb 1997 01:46:22 +1100 (EST)
X-Authentication-Warning: minotaur.labyrinth.net.au: mail set sender to <sjg@zen.quick.com.au> using -f
Received: from gate.quick.com.au(203.12.250.130) by minotaur.labyrinth.net.au via smap (V1.3)
	id sma005579; Tue Feb 11 01:46:06 1997
Received: (from sjg@localhost) by zen.quick.com.au (8.7.3/8.7.3) id BAA27764; Tue, 11 Feb 1997 01:46:02 +1100 (EST)
Date: Tue, 11 Feb 1997 01:46:02 +1100 (EST)
From: "Simon J. Gerraty" <sjg@zen.quick.com.au>
Message-Id: <199702101446.BAA27764@zen.quick.com.au>
To: firewalls@greatcircle.com
Cc: manek@challenger.atc.fhda.edu, sjg@quick.com.au
Subject: Re: SLr* released. rsh,rcp,rdist over SSL
References: <Pine.SGI.3.95.970209211248.12647C-100000@challenger.atc.fhda.edu>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>On Sun, 9 Feb 1997, Adam Shostack wrote:
>The only problem with ssh that I have is that it does not scale very
>well. I wonder how well does SSLr* scale? I'd also make the argument

This was the main reason I opted for SSLrsh rather than ssh.
SSH sounded great when I read about it, but the key management issue
worried me.

To use SSLr*, each host needs to be able to find the certificate
of the CA (certification authority) that issued the client's cert.  A
server cert is optional.  Each client must be issued with a
certificate (I have a simple CA setup here and at a couple of client
sites).

You can establish SSL encrypted connections without actually verifying
any certificate - but SSLr* is about authentication as much as encryption.

SSLrshd need only be able to satisfy itself that the offered
certificate was issued by a trusted CA.  This makes key management
much more scalable than needing to have a record of the public key of
every party you might want to talk to.

>rsh if the remote site doesn't support ssh. Will SLrsh fall back
>to either rsh or ssh? it would seem to me that a giant bloated 
>r(sh, login, dist) that supports multiple standards is not the best.

If SSLrshd cannot get an SSL connection with a cipher that it is happy
with, it drops the connection.  The SSL session can only be negotiated
if the client certificate is valid and can be verified.  Even once,
you have an SSL session established, if the client cert is not listed
in the auth file, or the resquested local user is not listed against
it the session is dropped.

The whole point is that SSLrshd will get a safe connection or none.

>Trying to explain to users that they can't connect to another machine
>in some other department/company/school because the other department
>supports a differnt encryption standard will cause people to shy away,
>and complain of difficultly. Ultimately these users may do something 
>that is least desireable, such as a cleartext telnet.

Not if the remote site does not support it :-)

>I couldn't agree more, a strong encyption is needed, but multiple venders
>and groups issuing r* replacements that are incomplatible with 
>each other does not seem to me the best solution. This idea of multiple 
>replacements seems to against the system-admin ideal. Professional 
>system admins are always telling me a good admin is one who can run 
>a machine securely as possible, and still be as transparent as possible.
>Incompatible and competeting standards seem to go directly against this
>ideal.

All valid points.  If r* were the only thing SSL were used for I'd
agree.  But since many sites are and will be investing in
infrastructure to obtain or issue X.509 certificates for use with
HTTPS, SSLr*,SSLtelnet,SSLftp and even sNFS (NFS over SSL :-) are
simply a sensible way of maximizing the return on that investment.

Though we may have to wait for the RSA patents to expire before use of
SSL in the U.S. really picks up.

--sjg
-- 
Simon J. Gerraty        <sjg@quick.com.au>

#include <disclaimer>   /* imagine something _very_ witty here */

From firewalls-owner  Mon Feb 10 08:06:22 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA18700 for firewalls-outgoing; Mon, 10 Feb 1997 08:02:07 -0800 (PST)
Received: from phoenix.iss.net (phoenix.iss.net [204.241.60.5]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id IAA18692 for <firewalls@greatcircle.com>; Mon, 10 Feb 1997 08:01:57 -0800 (PST)
Received: (from cklaus@localhost) by phoenix.iss.net (8.8.5/8.6.12) id LAA31014 for firewalls@greatcircle.com; Mon, 10 Feb 1997 11:00:51 -0500
From: Christopher Klaus <cklaus@iss.net>
Message-Id: <199702101600.LAA31014@phoenix.iss.net>
Subject: New Security Technology mailing list
To: firewalls@greatcircle.com
Date: Mon, 10 Feb 1997 11:00:51 -0500 (EST)
X-Mailer: ELM [version 2.4 PL24 PGP2]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



New Security Technology 

This mailing list is intended to keep people informed of the latest
network security technology advances.  

This mailing list is intended for public domain, shareware, and
commercial information regarding new security product announcements, new
security product upgrades (ie new features in the latest release of some
firewall), new security patches from vendors and any other new security
technology that is available.  This mailing list is open to everyone to
join and possibly contribute.  The technology is not limited to only
Unix or only NT, but any new technology designed to improve the security
of computers and networks.  This will provide an additional way for
security vendors to let administrators,  and security consultants become
aware of the latest tools to fight intruders.

This mailing list is not for repeated ads or repeated announcements.
This list is not a discussion mailing list.


To join the mailing list, send an email to majordomo@iss.net and within
the body of the message, type:

subscribe sectech

To join the digest version,  send an email to majordomo@iss.net and
within the body of the message, type:

subscribe sectech-digest


-- 
Christopher William Klaus	     Voice: (770)395-0150. Fax: (770)395-1972
Internet Security Systems, Inc.              "Internet Scanner SAFEsuite finds
Ste. 660,41 Perimeter Center East,Atlanta,GA 30346 your network security holes
Web: http://www.iss.net/  Email: cklaus@iss.net        before the hackers do."

From firewalls-owner  Mon Feb 10 08:42:40 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA20367 for firewalls-outgoing; Mon, 10 Feb 1997 08:30:51 -0800 (PST)
Received: from roble.com (ns.roble.com [207.5.40.50]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id IAA20349 for <Firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 08:30:42 -0800 (PST)
Received: (from marquis@localhost) by roble.com (8.8.4/8.7.3) id IAA05663; Mon, 10 Feb 1997 08:29:33 -0800 (PST)
Date: Mon, 10 Feb 1997 08:29:33 -0800 (PST)
From: Roger Marquis <marquis@roble.com>
To: Firewalls@GreatCircle.COM
Subject: Re: SLr* released.
In-Reply-To: <199702100900.BAA18933@miles.greatcircle.com>
Message-ID: <Pine.SUN.3.91.970210082425.5467E-100000@ns.roble.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

From: Adam Shostack <adam@homeport.org> wrote:
>Recall that SSH does have a root listener (by default 
>/usr/local/sbin/sshd), so its not root-free code. 

Sshd normally runs as root but it doesn't have to.  Any user can start the
daemon on a high port to access their own account.  In that case there 
would be nothing running as root.

Roger Marquis

From firewalls-owner  Mon Feb 10 08:53:19 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA18747 for firewalls-outgoing; Mon, 10 Feb 1997 08:03:21 -0800 (PST)
Received: from phoenix.iss.net (phoenix.iss.net [204.241.60.5]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id IAA18733 for <firewalls@greatcircle.com>; Mon, 10 Feb 1997 08:03:11 -0800 (PST)
Received: (from cklaus@localhost) by phoenix.iss.net (8.8.5/8.6.12) id LAA31027 for firewalls@greatcircle.com; Mon, 10 Feb 1997 11:02:08 -0500
From: Christopher Klaus <cklaus@iss.net>
Message-Id: <199702101602.LAA31027@phoenix.iss.net>
Subject: Security News mailing list
To: firewalls@greatcircle.com
Date: Mon, 10 Feb 1997 11:02:08 -0500 (EST)
X-Mailer: ELM [version 2.4 PL24 PGP2]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Security News Mailing List

This mailing list is for those people interested in receiving the latest
information on network security events and news announcements.  This
will include security press releases, and specific information and
announcements regarding security conferences and security industry
events.

This mailing list is open to everyone to join and possibly contribute.
This will provide an additional way for security vendors to keep
administrators and security consultants up to date on the latest
developments in the network security industry.

This list is not a discussion mailing list.

To join the mailing list, send an email to majordomo@iss.net and within
the body of the message, type:

subscribe secnews

To join the digest version,  send an email to majordomo@iss.net and
within the body of the message, type:

subscribe secnews-digest


-- 
Christopher William Klaus	     Voice: (770)395-0150. Fax: (770)395-1972
Internet Security Systems, Inc.              "Internet Scanner SAFEsuite finds
Ste. 660,41 Perimeter Center East,Atlanta,GA 30346 your network security holes
Web: http://www.iss.net/  Email: cklaus@iss.net        before the hackers do."

From firewalls-owner  Mon Feb 10 09:05:36 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA21130 for firewalls-outgoing; Mon, 10 Feb 1997 08:42:25 -0800 (PST)
Received: from servant (servant.mccaw-stg.com [205.172.10.40]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id IAA21100 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 08:42:12 -0800 (PST)
Received: from radiatore.mccaw-stg.com by servant (SMI-8.6/SMI-SVR4)
	id IAA02112; Mon, 10 Feb 1997 08:34:47 -0800
Received: by radiatore.mccaw-stg.com (SMI-8.6/SMI-SVR4)
	id IAA04174; Mon, 10 Feb 1997 08:34:47 -0800
Date: Mon, 10 Feb 1997 08:34:47 -0800
From: peter.gregory-unix@mccaw-stg.com (Peter Gregory)
Message-Id: <199702101634.IAA04174@radiatore.mccaw-stg.com>
To: firewalls@GreatCircle.COM, thl@ProNetC.com, drexx@sunphil.mozcom.com
Subject: Re: SUN's Stealth Product
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-MD5: Hm8MePhLAmcjIgtTN5vBRw==
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> It's called the SunScreen SPF-100 and, IMHO, it is designed to work with
> the Solstice Firewall-1 as part of a total security solution. Do check
> out Sun's web site for more info. 

No.  SunScreen is a standalone product, far superior to FW-1, and does not
need or use FW-1 in its solution.

For definitive information, check out:

http://www.sun.com/security/overview.html

...there you will find a description of SunScreen.  In all of the diagrams
you will not find FW-1.

-pg

--

Peter Gregory  [NICname PG11]  peter.gregory@attws.com
IT Manager, AT&T Wireless Services, Strategic Technologies Group

From firewalls-owner  Mon Feb 10 09:35:30 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA23651 for firewalls-outgoing; Mon, 10 Feb 1997 09:18:38 -0800 (PST)
Received: from mail.baileynm.com (fw.baileynm.com [206.109.159.11]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id JAA23622 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 09:18:16 -0800 (PST)
Received: (qmail 29916 invoked from smtpd); 10 Feb 1997 17:15:42 -0000
Received: from web.nmti.com (root@198.178.0.201)
  by fw.nmti.com with SMTP; 10 Feb 1997 17:15:42 -0000
Received: from sonic.nmti.com (peter@sonic.nmti.com [198.178.0.2]) by web.nmti.com (8.6.12/8.6.9) with SMTP id LAA23168; Mon, 10 Feb 1997 11:15:41 -0600
Received: by sonic.nmti.com; id AA02330; Mon, 10 Feb 1997 11:10:05 -0600
From: peter@baileynm.com (Peter da Silva)
Message-Id: <9702101710.AA02330@sonic.nmti.com.nmti.com>
Subject: Re: SLr* released.  rsh,rcp,rdist over SSL
To: benedikt@devnull.ruhr.de (Benedikt Stockebrand)
Date: Mon, 10 Feb 1997 11:10:04 -0600 (CST)
Cc: manek@challenger.atc.fhda.edu, sjg@zen.quick.com.au,
        firewalls@GreatCircle.COM
In-Reply-To: <87n2tdmsvm.fsf@devnull.ruhr.de> from "Benedikt Stockebrand" at Feb 10, 97 01:01:17 am
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> > Also I suppose i should ask is does sslr* have an officially sanctioned
> > port number? and ofcourse does it have an rfc?

> It uses port 22, which is still unassigned to my last version of the
> Assigned Numbers (RFC 1700, 1994/10).  Until now there's no RFC about
> it, but the package comes with a draft.

Not good. That's what ssh is using too.

My big question, is SSLr* proxyable? SSH isn't (you have to log in to the
proxy host, then run a separate ssh from there, which rules out SCP and
the like).

From firewalls-owner  Mon Feb 10 09:45:02 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA21260 for firewalls-outgoing; Mon, 10 Feb 1997 08:44:32 -0800 (PST)
Received: from eagle.anheuser-busch.com ([151.145.250.198]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id IAA21235 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 08:44:02 -0800 (PST)
Received: (from smap@localhost) by eagle.anheuser-busch.com (8.7.5/8.6.12) id KAA19440 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 10:34:45 -0600 (CST)
Received: from stlabcexg001.anheuser-busch.com(151.145.101.151) by eagle.anheuser-busch.com via smap (V1.3)
	id sma019428; Mon Feb 10 10:34:31 1997
Received: by stlabcexg001.anheuser-busch.com with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63)
	id <01BC173E.FB703FA0@stlabcexg001.anheuser-busch.com>; Mon, 10 Feb 1997 10:41:33 -0600
Message-ID: <c=US%a=attmail%p=BUSCH%l=STLABCEXG010-970210164133Z-35131@stlabcexg001.anheuser-busch.com>
From: "Starkweather, Mike" <mike.starkweather@anheuser-busch.com>
To: "firewalls@GreatCircle.COM" <firewalls@GreatCircle.COM>
Cc: "Starkweather, Mike" <mike.starkweather@anheuser-busch.com>
Subject: RE: [NTSEC] ActiveX, MSIE and Quicken
Date: Mon, 10 Feb 1997 10:41:33 -0600
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Using the firewall to filter ActiveX and Java is like throwing out the 
baby with the bath water.  This sounds more like a macro virus than a 
Internet exploit.  Wouldn't it be better to treat it at the desktop 
instead of the firewall?

Mike Starkweather

----------
From:  Jerry Mendes[SMTP:mendes@garnet.berkeley.edu]
Sent:  Saturday, February 08, 1997 5:05 AM
To:  Russ
Cc:  firewalls@GreatCircle.COM
Subject:  RE: [NTSEC] ActiveX, MSIE and Quicken

Presumably, one answer is for the firewall companies to write 
additional
application layer filters for port 80, looking for ActiveX or Java
downloads.  This would make configuration of the firewall a bit more
complex.  Don't know if any of 'em are considering this yet.  Anyone 
have
any scoop on this?

Jerry Mendes, Principal Consultant
DataComm Insights
150 Seminary Drive
Mill Valley, California  94941

Voice:  415-381-5500
FAX:    415-381-5502
Email:  mendes@garnet.berkeley.edu

At 11:40 PM 2/1/97 -0500, Russ wrote:
>To try and keep this on a Firewalls vein. The tunneling of anything 
over
>HTTP is, in my opinion, the crappy technology. That goes for Java
>applets or certificate authentication for that matter. I don't like 
the
>idea of combining diverse tasks within a single channel if its 
possible
>to avoid it, and it is possible, so the only reason its not being 
done
>is to USURP FIREWALLS.
_______________________________________________________________________  
_____
_______
Jerry Mendes, Principal Consultant              Voice:   (415) 
381-5500
DataComm Insights                               FAX:     (415) 
381-5502
150 Seminary Drive                              Email:
mendes@garnet.berkeley.edu
Mill Valley, California  94941



From firewalls-owner  Mon Feb 10 10:20:02 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA29099 for firewalls-outgoing; Mon, 10 Feb 1997 09:57:30 -0800 (PST)
Received: from mercury.Sun.COM (mercury.Sun.COM [192.9.25.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id JAA29070 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 09:57:18 -0800 (PST)
Received: from West.Sun.COM ([129.153.100.31]) by mercury.Sun.COM (SMI-8.6/mail.byaddr) with SMTP id JAA05841; Mon, 10 Feb 1997 09:52:04 -0800
Received: from topsun.West.Sun.COM by West.Sun.COM (SMI-8.6/SMI-5.3)
	id JAA21623; Mon, 10 Feb 1997 09:51:32 -0800
Received: from plato.West.Sun.COM by topsun.West.Sun.COM (SMI-8.6/SMI-SVR4)
	id JAA27644; Mon, 10 Feb 1997 09:51:33 -0800
Received: by plato.West.Sun.COM (SMI-8.6/SMI-SVR4)
	id JAA01120; Mon, 10 Feb 1997 09:55:20 -0800
Date: Mon, 10 Feb 1997 09:55:20 -0800
From: matt@plato.West.Sun.COM (Matthew Archibald)
Message-Id: <199702101755.JAA01120@plato.West.Sun.COM>
To: firewalls@GreatCircle.COM, thl@ProNetC.com, drexx@sunphil.mozcom.com,
        peter.gregory-unix@mccaw-stg.com
Subject: Re: SUN's Stealth Product
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk




http://www.incog.com

This is Sun's Internet Commerce Group page wherein all
SunScreen, SKIP and other related products, FAQ's etc
are found...

From firewalls-owner  Mon Feb 10 10:43:10 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA25031 for firewalls-outgoing; Mon, 10 Feb 1997 09:31:11 -0800 (PST)
Received: from lexicon.ins.com (lexicon.ins.com [199.0.193.11]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id JAA24999 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 09:30:55 -0800 (PST)
Received: from beethoven.ins.com (mask.osi.com [205.227.114.99]) by lexicon.ins.com (8.7.5/8.7.3) with SMTP id JAA09394; Mon, 10 Feb 1997 09:29:26 -0800 (PST)
Message-Id: <3.0.32.19970210112335.0075f190@lexicon.ins.com>
X-Sender: daughe_b@lexicon.ins.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Mon, 10 Feb 1997 11:27:11 -0800
To: firewalls@GreatCircle.COM
From: Brad Daugherty <bsd@pobox.com>
Subject: NWM: SNMP/Scripts/Freeware (off topic)
Cc: wizards@INS.COM
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello Everyone,

	I was recently requesting SNMP scripts for mass router password changes.  During my search I came across this great URL on SNMP with links to great shareware/scripts.  Just thought I would pass it along.

http://www.inforamp.net/~kjvallil/t/snmp.html

Thanks,
Brad

Providing The Power Of Operable Networks <http://www.ins.com>
Brad Daugherty - Associate Network Systems Engineer
PHONE:(630)467-8323 PAGER:(800)467-1467 FAX:(630)250-8748
Lifetime: <mailto:bsd@pobox.com> <http://www.pobox.com/~bsd>

From firewalls-owner  Mon Feb 10 10:52:31 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA25767 for firewalls-outgoing; Mon, 10 Feb 1997 09:37:51 -0800 (PST)
Received: from TGIEXCH.terraglyph.com ([206.138.89.35]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id JAA25707 for <firewalls@greatcircle.com>; Mon, 10 Feb 1997 09:37:23 -0800 (PST)
Received: by TGIEXCH.terraglyph.com with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5)
	id <01BC1746.F3D25A50@TGIEXCH.terraglyph.com>; Mon, 10 Feb 1997 11:38:36 -0600
Message-ID: <c=US%a=_%l=TGIEXCH-970210173834Z-280@TGIEXCH.terraglyph.com>
From: Mike Topalovich <TOPALOVICH@terraglyph.com>
To: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: RE: I need the latest version of Linux
Date: Mon, 10 Feb 1997 11:38:34 -0600
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


http://www.linux.org

>----------
>From: 	Gabriel Dura[SMTP:dura@geocities.com]
>Sent: 	Friday, February 7, 1997 7:15 PM
>To: 	firewalls@GreatCircle.COM
>Subject: 	I need the latest version of Linux
>
>
>Hello everybody!
>
>I need the latest version of Linux for a local Internet Provider. They
>already have Red Hat Linux 3.0 but they are looking for a new version of
>Linux. 
>Can anyone tell me where I can find it?
>Is there any ftp site available for download? Is there anyone who can sell
>it?
>A place in Romania would be desirable...
>
>Thank you for your help...
>Gabriel Dura
>dura@geocities.com
>
>

From firewalls-owner  Mon Feb 10 11:48:11 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id KAA02996 for firewalls-outgoing; Mon, 10 Feb 1997 10:19:25 -0800 (PST)
Received: from ocsystems.com (ocsystems.com [192.246.117.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id KAA02940 for <Firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 10:19:10 -0800 (PST)
Received: by ocsystems.com (AIX 3.2/UCB 5.64/4.03)
          id AA12289; Mon, 10 Feb 1997 13:21:40 -0500
From: gvc@ocsystems.com (G. Vincent Castellano)
Message-Id: <9702101821.AA12289@ocsystems.com>
Subject: Home-grown vs. Turn-Key Firewalls
To: Firewalls@GreatCircle.COM
Date: Mon, 10 Feb 1997 13:21:40 -0500 (EST)
X-Mailer: ELM [version 2.4 PL22]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I am trying to sell management on a Firewall solution made up of:
  - 2 routers with packet-filtering
  - 1 dual-homed bastion host between the routers
  - the TIS fwtk on the bastion host

I like this because it's low-cost:
  - all the software is freely-available 
  - we only need to buy 1 router (we already have 1)
  - the bastion host is a (currently spare) Unix box we're 
     already very familiar with administering
  
The boss says "find an off-the-shelf solution" because:
  - in-house solutions always are more expensive than you think after
     labour is taken into account
  - we've never done this before so we might misconfigure something
  - if we have to explain our security to a client they might not
     understand a piece-parts solution but would feel OK if we just
     named the commercial product we use

I respond (point-by-point)
  - a firewall product doesn't take much more work than 
      a custom configuration
  - a firewall product is also subject to configuration errors
  - a client savvy enough to ask about our security policy would
      be satisfied with a home-grown solution (assuming we could
      explain it clearly, and it was actually effective)

I can see his points, but I think I have the technical issues in hand.
I looked at one major vendor's software solution and found that for
$10K it would simply disable risky elements of the base operating system
and install some proxies I could get for free elsewhere.  It doesn't
seem like great value for the dollar.

Don't ask me to name OS or platform;  I'm sure this will
start a flame war even without arguing over vendor specifics.
(I look forward to an edifying flame war regardless.)

 == G. Vincent Castellano :: X/Ada WWW => http://www.ocsystems.com/xada ==
 ==  "If virtual memory did not exist, it would have                    ==
 ==     become necessary for us to invent it."                          ==

From firewalls-owner  Mon Feb 10 11:50:21 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA12530 for firewalls-outgoing; Mon, 10 Feb 1997 11:20:54 -0800 (PST)
Received: from crl.crl.com (crl.com [165.113.1.12]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id LAA12518 for <Firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 11:20:47 -0800 (PST)
Received: by crl.crl.com id AA10935
  (5.65c/IDA-1.5 for Firewalls@GreatCircle.COM); Mon, 10 Feb 1997 11:14:45 -0800
From: dZothMuellarg <zot@crl.com>
Message-Id: <199702101914.AA10935@crl.crl.com>
Subject: Window NT Challenge/Response through Firewall/Proxies?
To: Firewalls@GreatCircle.COM
Date: Mon, 10 Feb 1997 11:14:45 -0800 (PST)
X-Mailer: ELM [version 2.4 PL23]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I am investigating using IIS 3.0 and IE 3.0 as a system.

The thing I am looking at now is Windows NT Challene/Response.  I can
find little or no information on the web on it.  I am curious to know
how string is it?  and will a Proxy Pass it?  Also will services like
AOL and Compuserve passit?


I searched the digests and twice this question has come up, but I saw
no responses.  If there are any non-MS papers on this, I haven't
found it.  (I haven't found an MS papers for that matter, but I tend to
look for 3rd party verification).



-- 
Zot O'Connor                            zot@crl.com
Home Page:                              http://www.crl.com/~zot/
Improv Page:                            http://www.crl.com/~zot/improv.html
World Wide Web Calendar:                http://wwwcal.com

From firewalls-owner  Mon Feb 10 12:41:49 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id KAA06504 for firewalls-outgoing; Mon, 10 Feb 1997 10:41:51 -0800 (PST)
Received: from ALABAMA.CF.CS.YALE.EDU (RT-GW.CS.YALE.EDU [128.36.0.13]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id KAA06468 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 10:41:39 -0800 (PST)
From: long-morrow@CS.YALE.EDU
Received: from SPARKY.CF.CS.YALE.EDU by ALABAMA.CF.CS.YALE.EDU (8.7.1/res.host.cf-4.0)
	with ESMTP id NAA22775; Mon, 10 Feb 1997 13:40:22 -0500 (EST) sender long-morrow@CS.YALE.EDU for 
Received: by SPARKY.CF.CS.YALE.EDU (Sendmail-8.7.1/res.client.cf-4.0)
	id NAA05863; Mon, 10 Feb 1997 13:40:20 -0500 (EST)
Date: Mon, 10 Feb 1997 13:40:20 -0500 (EST)
Message-Id: <199702101840.NAA05863@SPARKY.CF.CS.YALE.EDU>
To: firewalls@GreatCircle.COM
Subject: RE: [NTSEC] ActiveX, MSIE and Quicken
Cc: mike.starkweather@anheuser-busch.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


"Starkweather, Mike" <mike.starkweather@anheuser-busch.com> wrote:
>Using the firewall to filter ActiveX and Java is like throwing out the 
>baby with the bath water.  This sounds more like a macro virus than a 
>Internet exploit.  Wouldn't it be better to treat it at the desktop 
>instead of the firewall?

While Java applets can be run in a crippled "sandbox" environment I
am not aware that any such "sandbox" exists for ActiveX apps. Are you?

ActiveX apps generally get complete access to your machine under Windows 95.

This is tempered a bit under Windows NT but ActiveX apps still get the
same level of privilege(s) as other processes running as your userid
are granted -- w.r.t. access to local files, network I/O, hardware, etc.

For more information there is an article on ActiveX as a virus in the
Feb 3rd Network World (available to members of the NWFusion Web site via
URL http://www.nwfusion.com/ and DocFinder: 0526):

	"ActiveX marks new virus spot" by Ellen Messmer 
		[and Carol Sliwa in one online version of the article]

- Morrow


From firewalls-owner  Mon Feb 10 12:59:58 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA17708 for firewalls-outgoing; Mon, 10 Feb 1997 11:53:16 -0800 (PST)
Received: from exch-bel1.attachmate.com (exch-bel1.attachmate.com [149.82.1.46]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id LAA17537 for <firewalls@greatcircle.com>; Mon, 10 Feb 1997 11:52:34 -0800 (PST)
Received: by exch-bel1.attachmate.com with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63)
	id <01BC1748.41BB0130@exch-bel1.attachmate.com>; Mon, 10 Feb 1997 11:47:56 -0800
Message-ID: <c=US%a=_%p=Attachmate%l=EXCH-CIN1-970210194928Z-12516@exch-bel1.attachmate.com>
From: Darren Cromer <DarrenCr@Attachmate.com>
To: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: now what?
Date: Mon, 10 Feb 1997 11:49:28 -0800
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

	
Hello,

This is proably a little off topic, but I'll give it a try anyway. 
 After reading about port 135 attacks on NT, I configured our firewall 
to report any attempts to open that port from the internet .
Lo and behold, I see a machine coming from an AT&T network (the isp) 
attempting to connect to this port.

While no harm was done, this does bother me.  On one hand Im guessing 
that this is proably
a semi-legimate attempt to connect as many people take laptops home 
and the dial into ISP's, occasionally I see them try to connect to our 
corporate resources. Usually though, its a recognizable port or 
recognizable source.  In this case though, this bug has been well 
advertised, and I don't know of any legitimate users of that port 
other than myself, and certainly not
in the part of the country where this is coming from.

I've left a message for the co-ordinator of the IP block, hoping he'll 
call me back.  Any other suggestions? What do you do typically do when 
you see suspicious activity coming from the internet?

thanks!
darren cromer
darrencr@attachmate.com






From firewalls-owner  Mon Feb 10 13:26:55 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id KAA01996 for firewalls-outgoing; Mon, 10 Feb 1997 10:13:11 -0800 (PST)
Received: from netcom22.netcom.com (netcom22.netcom.com [192.100.81.136]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id KAA01949 for <firewalls@greatcircle.com>; Mon, 10 Feb 1997 10:12:57 -0800 (PST)
Received: (from mwallace@localhost) by netcom22.netcom.com (8.6.13/Netcom)
	id KAA19561; Mon, 10 Feb 1997 10:11:29 -0800
Date: Mon, 10 Feb 1997 10:11:28 -0800 (PST)
From: Matt Wallace <mwallace@netcom.com>
Subject: Re: Altavista Tunnel
To: Jerry Mendes <mendes@garnet.berkeley.edu>
cc: John Mizzi <jmizzi@utu.premenos.com>, firewalls@greatcircle.com
In-Reply-To: <2.2.32.19970208110523.0070c80c@garnet.berkeley.edu>
Message-ID: <Pine.3.89.9702101040.A17420-0100000@netcom22>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



On Sat, 8 Feb 1997, Jerry Mendes wrote:

> At 02:24 PM 2/7/97 -0800, John Mizzi wrote:
> >Has anyone used the Altavista Tunnel ?
> 
[snip: class information]
>  
> >If so what are your opinions ?
> 
> I think the product is pretty darn good, but then I'm a bit biased.  :-)
> 
> >Are there any similiar products which provide the same functionality as the
> >Altavista Tunnel ??
> 
> Yes there are.  A number of the firewall companies offer other secure
> solutions, either as part of the firewall or as a separate product.  Also,
> Microsoft has developed an encrypted tunnel technology, as well....goes
> under the name PPTP (I believe it translates as Point to Point Tunneling
> Protocol).

Raptor's Eagle firewall has full VPN IP tunnelling capability, both from
firewall-to-firewall, and from a remote client to the firewall. 

VPNet, a company focused on VPN tunnelling, is working on products. I'd 
look into that yourself, as I'm hesitant to discuss any details for fear of
accidentally stepping on a NDA policy.

I've heard there is a hardware-to-hardware tunnelling solution like VPN's
from another companty, and the name escape's me... Red River? Red Creek?
Something like that.

Microsoft has an implementation of VPN tunnelling. They 'established' a 
-protocol-, called PPTP, which is point-to-point tunnelling protocol, and 
they also added an implementation to NT 4.0. However, you must be running
a RASS server to use theirs, as their PPTP server only comes as a subset of
that.

__
Matt Wallace
mwallace@netcom.com


From firewalls-owner  Mon Feb 10 13:55:21 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA17840 for firewalls-outgoing; Mon, 10 Feb 1997 11:54:13 -0800 (PST)
Received: from beach.sctc.com (beach.sctc.com [192.55.214.50]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id LAA17770 for <firewalls@greatcircle.com>; Mon, 10 Feb 1997 11:53:43 -0800 (PST)
Received: from mfil.terminal (mfil@localhost) by beach.sctc.com (8.7.5/8.7.3) with SMTP id NAA27163; Mon, 10 Feb 1997 13:47:00 -0600 (CST)
Received: from sphinx.sctc.com (sphinx.sctc.com [172.17.192.3]) by beach.sctc.com (8.7.5/8.7.3) with ESMTP id NAA27112; Mon, 10 Feb 1997 13:45:20 -0600 (CST)
Received: from shade.sctc.com (shade.sctc.com [172.17.192.48]) by sphinx.sctc.com (8.8.5/8.7.3) with SMTP id NAA16113; Mon, 10 Feb 1997 13:47:42 -0600 (CST)
Received: (from smith@localhost) by shade.sctc.com (8.6.12/8.6.9) id NAA24883; Mon, 10 Feb 1997 13:47:41 -0600
Date: Mon, 10 Feb 1997 13:47:41 -0600
From: Rick Smith <smith@sctc.com>
Message-Id: <199702101947.NAA24883@shade.sctc.com>
To: osiris@pacificnet.net (Osiris)
Cc: smith@sctc.com, firewalls@greatcircle.com
Subject: Re: TEMPEST
Newsgroups: security.firewalls
Organization: Secure Computing
X-Newsreader: TIN [version 1.2 PL2]
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

osiris@pacificnet.net (Osiris) asked about Wang Federal:

: Hmmm. Now, THAT'S a secure operating system vendor...XTS-300 STOP 4.1.
: Trusted path protection, (SAK,) SCS...spook material. Let me ask this:
: isn't it true that with minor system alterations, an XTS-300 system
: could be an extremely effective firewall? 

I'll let Karen answer specifically with respect to Wang's products,
but I'll take a stab at the general one -- is trusted OS technology
a good feature of an effective firewall?

Trusted OS technology, particularly mandatory access mechanisms, are
designed to control the behavior of malicious users. Conventional
systems are built with the same level of technology as typical locks
on desk drawers and file cabinets: they keep out the honest people.
Strong systems are designed to work in the face of a reasonably
determined attacker.

There are several vendors with products in this area: Sidewinder
(ours), Cyberguard, and (I think it's called) Cybershield. Perhaps
Karen can correct me if my info is out of date, but so far Wang hasn't
released a product in this area.

Rick.
smith@sctc.com        secure computing corporation

From firewalls-owner  Mon Feb 10 14:32:20 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA27975 for firewalls-outgoing; Mon, 10 Feb 1997 13:05:03 -0800 (PST)
Received: from gateway.superonline.net (gateway.superonline.net [194.242.73.254]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id NAA27872 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 13:04:30 -0800 (PST)
Received: by gateway.superonline.net; (5.65v3.2/1.3/10May95) id AA08100; Mon, 10 Feb 1997 23:02:29 +0300
Received: by postman.superonline.net with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5)
	id <01BC17A6.62B74840@postman.superonline.net>; Mon, 10 Feb 1997 23:01:44 +0200
Message-Id: <c=US%a=_%p=superonline%l=POSTMAN-970210210143Z-20385@postman.superonline.net>
From: =?iso-8859-1?Q?=22A=2E_=D6mer_K=F6ker=22?= <omer@superonline.net>
To: "'firewalls@GreatCircle.COM'" <firewalls@GreatCircle.COM>
Subject: RE: [NTSEC] ActiveX, MSIE and Quicken
Date: Mon, 10 Feb 1997 23:01:43 +0200
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


What about material coming in over email ?  Such as Netscape
In-Box-Direct and or even Pointcast and similiars?
Can you filter thousands of e-mail messages?  Privacy issues?=20

Regards,
A. Omer Koker.


>----------
>From: 	Jerry Mendes[SMTP:mendes@garnet.berkeley.edu]
>Sent: 	08 =DEubat 1997 Cumartesi 13:05
>To: 	Russ
>Cc: 	firewalls@GreatCircle.COM
>Subject: 	RE: [NTSEC] ActiveX, MSIE and Quicken
>
>Presumably, one answer is for the firewall companies to write =
additional
>application layer filters for port 80, looking for ActiveX or Java
>downloads.  This would make configuration of the firewall a bit more
>complex.  Don't know if any of 'em are considering this yet.  Anyone =
have
>any scoop on this?
>
>Jerry Mendes, Principal Consultant
>DataComm Insights
>150 Seminary Drive
>Mill Valley, California  94941
>
>Voice:  415-381-5500
>FAX:    415-381-5502
>Email:  mendes@garnet.berkeley.edu
>
>At 11:40 PM 2/1/97 -0500, Russ wrote:
>>To try and keep this on a Firewalls vein. The tunneling of anything =
over
>>HTTP is, in my opinion, the crappy technology. That goes for Java
>>applets or certificate authentication for that matter. I don't like =
the
>>idea of combining diverse tasks within a single channel if its =
possible
>>to avoid it, and it is possible, so the only reason its not being done
>>is to USURP FIREWALLS.
>________________________________________________________________________=
____
>_______
>Jerry Mendes, Principal Consultant              Voice:   (415) 381-5500
>DataComm Insights                               FAX:     (415) 381-5502
>150 Seminary Drive                              Email:
>mendes@garnet.berkeley.edu
>Mill Valley, California  94941
>
>

From firewalls-owner  Mon Feb 10 14:34:09 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA07607 for firewalls-outgoing; Mon, 10 Feb 1997 14:13:25 -0800 (PST)
Received: from zeus.tomco.net (zeus.tomco.net [205.218.239.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id OAA07567 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 14:12:39 -0800 (PST)
Received: from zeus.tomco.net (zeus.tomco.net [205.218.239.2]) by zeus.tomco.net (8.7.5/8.7.3) with SMTP id RAA14146; Mon, 10 Feb 1997 17:13:27 GMT
Date: Mon, 10 Feb 1997 17:13:25 +0000 ()
From: Security Administrator <security@tomco.net>
To: Christopher Klaus <cklaus@iss.net>
cc: firewalls@GreatCircle.COM
Subject: Re: New Security Technology mailing list
In-Reply-To: <199702101600.LAA31014@phoenix.iss.net>
Message-ID: <Pine.BSF.3.91.970210171312.11793C-100000@zeus.tomco.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



On Mon, 10 Feb 1997, Christopher Klaus wrote:

> 
> 
> New Security Technology 
> 
> This mailing list is intended to keep people informed of the latest
> network security technology advances.  
> 
> This mailing list is intended for public domain, shareware, and
> commercial information regarding new security product announcements, new
> security product upgrades (ie new features in the latest release of some
> firewall), new security patches from vendors and any other new security
> technology that is available.  This mailing list is open to everyone to
> join and possibly contribute.  The technology is not limited to only
> Unix or only NT, but any new technology designed to improve the security
> of computers and networks.  This will provide an additional way for
> security vendors to let administrators,  and security consultants become
> aware of the latest tools to fight intruders.
> 
> This mailing list is not for repeated ads or repeated announcements.
> This list is not a discussion mailing list.
> 
> 
> To join the mailing list, send an email to majordomo@iss.net and within
> the body of the message, type:
> 
> subscribe sectech
> 
> To join the digest version,  send an email to majordomo@iss.net and
> within the body of the message, type:
> 
> subscribe sectech-digest
> 
> 
> -- 
> Christopher William Klaus	     Voice: (770)395-0150. Fax: (770)395-1972
> Internet Security Systems, Inc.              "Internet Scanner SAFEsuite finds
> Ste. 660,41 Perimeter Center East,Atlanta,GA 30346 your network security holes
> Web: http://www.iss.net/  Email: cklaus@iss.net        before the hackers do."
> 

From firewalls-owner  Mon Feb 10 14:44:05 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA08448 for firewalls-outgoing; Mon, 10 Feb 1997 14:23:32 -0800 (PST)
Received: from alpha.comsource.net (mail.comsource.net [205.243.40.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id OAA08281 for <Firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 14:21:46 -0800 (PST)
Received: from localhost by alpha.comsource.net; (5.65v3.2/1.1.8.2/17May96-0857AM)
	id AA20620; Mon, 10 Feb 1997 16:16:18 -0600
Date: Mon, 10 Feb 1997 16:16:18 -0600 (CST)
From: Jim Jones <jrjones@comsource.net>
To: "G. Vincent Castellano" <gvc@ocsystems.com>
Cc: Firewalls@GreatCircle.COM
Subject: Re: Home-grown vs. Turn-Key Firewalls
In-Reply-To: <9702101821.AA12289@ocsystems.com>
Message-Id: <Pine.OSF.3.95.970210160242.31709B-100000@alpha.comsource.net>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


 On Mon, 10 Feb 1997, G. Vincent Castellano wrote:

>
> The boss says "find an off-the-shelf solution" because:
>   - if we have to explain our security to a client they might not
>      understand a piece-parts solution but would feel OK if we just
>      named the commercial product we use
>


Okay,

First off I do not know your business, but I have to side with your boss.
I have put TIS software before and it works great.  But, trying to explain
that to a client who is security aware or misaware can be a disaster.  I
have seen sales loss becuase of shareware solutions.  People just do not
understand, especially if they have led a sheltered life in the IBM or DEC
or some other vendor world.  It is easier to say my firewall is a Raptor
or Digital Altavista Firewall, or one supplied by IBM, etc.  The customer
tunes into it and says okay.  Their is no explanation, needed done deal.
However, if you say yea we use TIS and we built it our self, that can make
a misaware customer very nervous and additional explanations which sales
do not want to get into.

Bottom line it may cost more, but if it saves a sales or reduces
explanation to a customer it may be worth it.

Don't get me wrong I do not disagree with your approach, but less costly
solutions and shareware, freeware solutions are not always viewed
postively.  The last thing you want is a competitor saying hey we use such
and such and they use shareware or freeware.  

Well I said enough for my 2 cents.


jim jones
jrjones@comsource.net

 On Mon, 10 Feb 1997, G. Vincent Castellano wrote:

>   
> The boss says "find an off-the-shelf solution" because:
>   - if we have to explain our security to a client they might not
>      understand a piece-parts solution but would feel OK if we just
>      named the commercial product we use
> 


From firewalls-owner  Mon Feb 10 14:57:57 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id MAA19694 for firewalls-outgoing; Mon, 10 Feb 1997 12:07:47 -0800 (PST)
Received: from kcpgw2.kcp.com (kcpgw2.kcp.com [198.62.69.67]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id MAA19491 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 12:06:57 -0800 (PST)
From: dharris@kcp.com
Received: by kcpgw2.kcp.com id AA06463
  (InterLock SMTP Gateway 3.0 for firewalls@GreatCircle.COM);
  Mon, 10 Feb 1997 14:05:41 -0600
Message-Id: <199702102005.AA06463@kcpgw2.kcp.com>
Received: by kcpgw2.kcp.com (Protected-side Proxy Mail Agent-2);
  Mon, 10 Feb 1997 14:05:41 -0600
Received: by kcpgw2.kcp.com (Protected-side Proxy Mail Agent-1);
  Mon, 10 Feb 1997 14:05:41 -0600
Mime-Version: 1.0
Date: Mon, 10 Feb 1997 14:02:41 -0600
Subject: Re: vendor access ??
To: firewalls@GreatCircle.COM, Gary White <white@Arco.COM>
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Content-Description: cc:Mail note part
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

If you have the authority - say no.  If you know enough about the vendor's 
package to know that you have blocked all outbound access from that package then
the vendor ought to pay you to do your own work on that package ;-)

If they won't come on-site, for whatever reason, then partition the host system 
away from your internal network.  Set up to allow NO connectivity to your 
internal network.  Alternatively, put a firewall between the host system being 
worked on and ALL the other systems on your network.

Also, make sure your quarantine denies access to any other software you might 
have (stored or executing) on the host machine.


______________________________ Reply Separator _________________________________
Subject: vendor access ??
Author:  Gary White <white%Arco.COM@cerberus2.kcp.com> at INTERNET-MAIL
Date:    2/7/97 5:37 PM


Hi-
Does anybody have any general suggestions about the problem of allowing
a software vendor access to a server machine running their special software,
which is typically in the center of a company's network... so they can 
perform maintenance/fixes?  In such a case I typically would not have 
a problem when they come on site to sit with them and let them work
away, but often the requirement is to do it remotely somehow.

Seems a careful setup would imply a special restricted route from whatever
modem or inbound connection is involved, to a machine quarantined from 
the rest of one's network... with the "quarantine" meaning open 
access into the machine, but very restricted outbound...

Any comments?
Thanks
-Gary

__________________________________________________________________
Gary White               ARCO Exploration & Production Technology
gwhite@arco.com          2300 W Plano Parkway
(214) 509-6554           Plano, Texas 75075


From firewalls-owner  Mon Feb 10 14:59:10 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id MAA26776 for firewalls-outgoing; Mon, 10 Feb 1997 12:56:20 -0800 (PST)
Received: from borden.com ([207.6.126.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id MAA26697 for <firewalls@greatcircle.com>; Mon, 10 Feb 1997 12:55:58 -0800 (PST)
Received: from BE1-Message_Server by borden.com
	with Novell_GroupWise; Mon, 10 Feb 1997 16:00:41 -0500
Message-Id: <s2ff4629.049@borden.com>
X-Mailer: Novell GroupWise 4.1
Date: Mon, 10 Feb 1997 15:59:10 -0500
From: George Metropoulos <Gmetropo@borden.com>
To: firewalls@greatcircle.com
Subject: Firewall audit
Mime-Version: 1.0
Content-Type: text/plain
Content-Disposition: inline
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Can anybody recommend a certified Firewall-1 engineer or
consulting firm that will be available to do a firewall audit in the
Toronto area??

Thanks!

From firewalls-owner  Mon Feb 10 15:46:53 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA27673 for firewalls-outgoing; Mon, 10 Feb 1997 13:03:08 -0800 (PST)
Received: from mercury.Sun.COM (mercury.Sun.COM [192.9.25.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id NAA27653 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 13:02:51 -0800 (PST)
Received: from West.Sun.COM ([129.153.100.31]) by mercury.Sun.COM (SMI-8.6/mail.byaddr) with SMTP id MAA02599; Mon, 10 Feb 1997 12:58:00 -0800
Received: from topsun.West.Sun.COM by West.Sun.COM (SMI-8.6/SMI-5.3)
	id MAA06825; Mon, 10 Feb 1997 12:57:55 -0800
Received: from plato.West.Sun.COM by topsun.West.Sun.COM (SMI-8.6/SMI-SVR4)
	id MAA05849; Mon, 10 Feb 1997 12:57:54 -0800
Received: by plato.West.Sun.COM (SMI-8.6/SMI-SVR4)
	id NAA00860; Mon, 10 Feb 1997 13:01:44 -0800
Date: Mon, 10 Feb 1997 13:01:44 -0800
From: matt@plato.West.Sun.COM (Matthew Archibald)
Message-Id: <199702102101.NAA00860@plato.West.Sun.COM>
To: firewalls@GreatCircle.COM, thl@ProNetC.com, drexx@sunphil.mozcom.com,
        peter.gregory-unix@mccaw-stg.com, matt@plato.West.Sun.COM,
        omer@superonline.net
Subject: RE: SUN's Stealth Product
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk




Correction....

Been moved to: http://www.sun.com/security

From firewalls-owner  Mon Feb 10 16:01:56 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id PAA18006 for firewalls-outgoing; Mon, 10 Feb 1997 15:19:15 -0800 (PST)
Received: from minotaur.labyrinth.net.au (minotaur.labyrinth.net.au [203.9.148.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id PAA17526 for <firewalls@greatcircle.com>; Mon, 10 Feb 1997 15:17:31 -0800 (PST)
Received: (from mail@localhost) by minotaur.labyrinth.net.au (8.7.2/8.7.2) id KAA25535; Tue, 11 Feb 1997 10:16:27 +1100 (EST)
X-Authentication-Warning: minotaur.labyrinth.net.au: mail set sender to <sjg@zen.quick.com.au> using -f
Received: from gate.quick.com.au(203.12.250.130) by minotaur.labyrinth.net.au via smap (V1.3)
	id sma025520; Tue Feb 11 10:16:11 1997
Received: (from sjg@localhost) by zen.quick.com.au (8.7.3/8.7.3) id KAA13252; Tue, 11 Feb 1997 10:16:06 +1100 (EST)
Date: Tue, 11 Feb 1997 10:16:06 +1100 (EST)
From: "Simon J. Gerraty" <sjg@zen.quick.com.au>
Message-Id: <199702102316.KAA13252@zen.quick.com.au>
To: firewalls@greatcircle.com
Cc: peter@baileynm.com, sjg@quick.com.au
Subject: Re: SLr* released. rsh,rcp,rdist over SSL
References: <9702101710.AA02330@sonic.nmti.com.nmti.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>> > Also I suppose i should ask is does sslr* have an officially sanctioned
>> > port number? and ofcourse does it have an rfc?

No, though I guess it should - I run it on port 414
And it has been suggested that the service name should be shells not SSLshell.
The next release may address these and have a more clearly stated
license policy :-)

>> It uses port 22, which is still unassigned to my last version of the
>> Assigned Numbers (RFC 1700, 1994/10).  Until now there's no RFC about
>> it, but the package comes with a draft.

>Not good. That's what ssh is using too.

Actually the question was about SSLr*, but the guy was talking about
ssh.

>My big question, is SSLr* proxyable? SSH isn't (you have to log in to the
>proxy host, then run a separate ssh from there, which rules out SCP and
>the like).

Not really, SSLr* _is_ r* only the transport an authentication model
are changed.  Though you can override the port to be used, so you
could setup plug-gw's on various ports.  Not really what I'd call
proxying. 

If there is much demand for it, ssl_rcmd() could probably be modified
to handle HTTPS's CONNECT protocol, so you could possibly just use
your WEB proxy - I'll look into that.  Anyway you do it though, you
can forget your secondary error/signal channel...

For interactive sessions, you can proxy ssh btw.  At one site where I
work I have set up tn-gw to treat port 22 as a "raw" port, and the
guys who use ssh have hacked themeslves a simple proxy that negotiates
the connection via tn-gw, and then hands the socket to ssh - I think
that is how it works.

Oh, and SSLr* does not include rlogin - way too many system
dependencies and stelnet using X.509 certs provides for auto login
anyway. 

--sjg
-- 
Simon J. Gerraty        <sjg@quick.com.au>

#include <disclaimer>   /* imagine something _very_ witty here */

From firewalls-owner  Mon Feb 10 16:06:08 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id PAA23531 for firewalls-outgoing; Mon, 10 Feb 1997 15:52:53 -0800 (PST)
Received: from mail.ruhrgebiet.individual.net ([141.39.224.38]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id PAA23403 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 15:52:22 -0800 (PST)
Received: (from admin@localhost)
	by mail.ruhrgebiet.individual.net (8.8.5/8.8.5) with UUCP id XAA04729
	for firewalls@GreatCircle.COM; Mon, 10 Feb 1997 23:56:01 +0100 (MET)
Received: from hostname.devnull.ruhr.de (benedikt@hostname.devnull.ruhr.de [192.168.122.11]) by devnull.local.net (8.6.12/8.6.9) with ESMTP id TAA01483 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 19:53:26 +0100
Received: (from benedikt@localhost) by hostname.devnull.ruhr.de (8.7.5/8.7.3) id TAA00361; Mon, 10 Feb 1997 19:55:50 +0100
To: firewalls@GreatCircle.COM
Subject: Re: SLr* released.  rsh,rcp,rdist over SSL
References: <Pine.SGI.3.95.970209211248.12647C-100000@challenger.atc.fhda.edu>
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
From: Benedikt Stockebrand <benedikt@devnull.ruhr.de>
Date: 10 Feb 1997 19:55:49 +0100
In-Reply-To: Sameer R Manek's message of Sun, 9 Feb 1997 21:39:29 -0800 (PST)
Message-ID: <877mkgsd6y.fsf@devnull.ruhr.de>
Lines: 95
X-Mailer: Gnus v5.3/Emacs 19.34
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

peter@baileynm.com (Peter da Silva) writes:

> > > Also I suppose i should ask is does sslr* have an officially sanctioned
> > > port number? and ofcourse does it have an rfc?
> 
> > It uses port 22, which is still unassigned to my last version of the
> > Assigned Numbers (RFC 1700, 1994/10).  Until now there's no RFC about
> > it, but the package comes with a draft.
> 
> Not good. That's what ssh is using too.

Sorry, my fault --- I've misread Sameers question.  Yes, ssh uses port
22.  I don't know about sslr*.

> My big question, is SSLr* proxyable? SSH isn't (you have to log in to the
> proxy host, then run a separate ssh from there, which rules out SCP and
> the like).

Of course, protocols as secure as ssh or sslr* can be trusted straight
through your firewall :-)



Sameer R Manek <manek@challenger.atc.fhda.edu> writes:

> SSHD does have to be root (unless every user is going to run
> their own personal sshd)

Correct, but I don't really see a way to help this.

> but we are talking setuid files.
> /usr/local/bin/ssh is setuid, but does work w/o the setuid bit.

This is necessary if you want to allow host-to-host authentication and
use the ssh equivalents of /etc/hosts.equiv and ~/.rhosts.  If you
turn the setuid bit off you'll be limited to use user-to-user
authentication --- not a bad way to go, but one of the design goals of
ssh was to be a transparent replacement for rsh/rlogin/rcp.

> ssh falls back to 
> rsh if the remote site doesn't support ssh.

Correct, if you configure it to do so --- which most people are
paranoid enough not to.  After all, using insecure protocols as telnet
and r* should only be done on a trusted network.  As long as this
trusted network is controlled by a somewhat central authority a
remote site that doesn't support ssh shouldn't exist.

Of course, if you want to use ssh for Internet-wide authentication it
is probably the wrong way to go.  But so are ~/.rhosts files.


> Trying to explain to users that they can't connect to another machine
> in some other department/company/school because the other department
> supports a differnt encryption standard will cause people to shy away,

Let's all switch to Windows NT!
Sorry :-)

> and complain of difficultly. Ultimately these users may do something 
> that is least desireable, such as a cleartext telnet.

Then don't allow telnet or plain rsh access.  If you really have to
worry about this, run both sshd and sslrshd on your machines --- in
that case both will work.  However, if there's some sort of central
authority this could (and should) pick one for use.

> I couldn't agree more, a strong encyption is needed, but multiple venders
> and groups issuing r* replacements that are incomplatible with 
> each other does not seem to me the best solution. This idea of multiple 
> replacements seems to against the system-admin ideal.

I think in this case it's rather the ``should I use the hammer or the
soldering iron?'' question.  Both protocols have their advantage in
some areas, you just pick the one most appropriate for your needs.

> Professional 
> system admins are always telling me a good admin is one who can run 
> a machine securely as possible, and still be as transparent as possible.
> Incompatible and competeting standards seem to go directly against this
> ideal.

OTOH, if you stuff everything in one monolithic protocol you'll
eventually start writing application-level filters (see the recent
ActiveX thread).  And a complex protocol requires complex programs.
Complex programs don't improve security.


    Ben

-- 
Ben(edikt)? Stockebrand    Runaway ping.de Admin---Never Ever Trust Old Friends
My name and email address are not to be added to any list used for advertising
purposes.  Any sender of unsolicited advertisement e-mail to this address im-
plicitly agrees to pay a DM 500 fee to the recipient for proofreading services.

From firewalls-owner  Mon Feb 10 16:27:07 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA06427 for firewalls-outgoing; Mon, 10 Feb 1997 14:02:44 -0800 (PST)
Received: from lancomp-gate.LANcomp.COM (lancomp-gate.lancomp.com [199.170.17.253]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id OAA06349 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 14:02:24 -0800 (PST)
Received: from devils.LANcomp.COM ([192.168.1.102]) by lancomp-gate.LANcomp.COM
          via smtpd (for miles.greatcircle.com [198.102.244.34]) with SMTP; 10 Feb 1997 22:01:24 UT
Received: by LANcomp.COM (5.x/SMI-SVR4)
	id AA09513; Mon, 10 Feb 1997 17:00:39 -0500
Date: Mon, 10 Feb 1997 17:00:38 -0500 (EST)
From: Lee Whitty <lwhitty@LANcomp.COM>
X-Sender: lwhitty@devils
To: "Dexter D. Laggui" <drexx@sunphil.mozcom.com>
Cc: firewalls@GreatCircle.COM, fw-1-mailinglist@us.checkpoint.com
Subject: Re: [FW1] packet from unknown router
In-Reply-To: <199702102215.OAA15128@sunphil.sunphil.mozcom.com>
Message-Id: <Pine.SOL.3.91.970210165033.7329B-100000@devils>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Mon, 10 Feb 1997, Dexter D. Laggui wrote:

> Hello world,
> 
> I keep getting this on my Firewall-1 2.0b VPN + Solaris 2.5 + Netra i +
> Quad ethernet:
> 
> 1] 
> 
> Date Time Hostname in.routed [pid]: packet from unknown router, hostIPaddr
>    
> ------------------
> A: This occurs because your machine is receiving broadcast packets
> from a router that is on a different subnet. Since broadcast packets
> will not typically cross subnet boundaries, this usually means that
> you have machines from two subnets on the same physical wire.
> 
> Often, this is a mistake  if you see this error and do not expect to
> have multiple networks on the same wire, track down the
> source machine (x.x.x.x) and fix its IP address.
> 
> However, there are cases where this setup might be intentional, as
> outlined in RFC 1597. This would imply that you had several networks
> all using the same physical wire. Unfortunately, this is not currently
> supported correctly, as is described in Section 6.1.

This is correct. Multiple subnets on the same wire cause these errors. If 
this configuration is intentional, one way to get rid of the errors is to 
configure a secondary IP address on the interface reporting these errors. 
This address should also be added to the FW1 network object representing 
the firewall.

> I am hoping that somebody has a hack around this. Any help would be much
> appreciated. Many TNX.
> 
> most humble newbie,
> Drexx.
> 
> 
> "It's a dirty job, but somebody's gotta do it." -- John Wayne
> ~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~
>          ______
>         /_____/\	DEXTER D. LAGGUI
>        /_____\\ \	Systems Engineer, Systems Integration Group 
>       /_____\ \\ /	PHILIPPINE SYSTEMS PRODUCTS INC.
>      /_____/ \/ / /	Penthouse, Corporate Business Center
>     /_____/ /   \//\	150 Paseo de Roxas Ave., Legaspi Village
>     \_____\//\   / /	Makati City, Philippines
>      \_____/ / /\ /          
>       \_____/ \\ \	Phone: (++632) 813-6453 to 55 loc. 222
>        \_____\ \\	Fax:   (++632) 813-3516
>         \_____\/	Email: drexx@sunphil.mozcom.com
> 
> ~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~
> 
> 

--------------------------------------------------------------------------------
Lee Whitty 
LANcomp                                         Email: lwhitty@lancomp.com
242 Old New Brunswick Road, Suite 200           Voice: 908-981-1991
Piscataway, NJ 08855                            Fax  : 908-981-1858
--------------------------------------------------------------------------------


From firewalls-owner  Mon Feb 10 16:55:50 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA25294 for firewalls-outgoing; Mon, 10 Feb 1997 09:34:18 -0800 (PST)
Received: from TGIEXCH.terraglyph.com ([206.138.89.35]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id JAA25283 for <firewalls@greatcircle.com>; Mon, 10 Feb 1997 09:34:05 -0800 (PST)
Received: by TGIEXCH.terraglyph.com with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5)
	id <01BC1746.78DC14D0@TGIEXCH.terraglyph.com>; Mon, 10 Feb 1997 11:35:10 -0600
Message-ID: <c=US%a=_%l=TGIEXCH-970210173509Z-278@TGIEXCH.terraglyph.com>
From: Mike Topalovich <TOPALOVICH@terraglyph.com>
To: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: RE: DHCP
Date: Mon, 10 Feb 1997 11:35:09 -0600
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


I believe the log files are saved as .MDB database files, aren't they?
I should probably check before posting this, but I'm pretty sure you can
open the logs using Access or any other RDB with an Access filter.  If
it isn't in .MDB format, then I would imagine it's in some other
ODBC-accessable format.  Just open the logs in a RDB and print from
there.

>----------
>From: 	Hisham Abdullatif Al-Rumaihi[SMTP:rumaihi@admin.uob.bh]
>Sent: 	Friday, January 31, 1997 11:41 PM
>To: 	firewalls@greatcircle.com
>Subject: 	DHCP
>
>Hi,
>
>We are using DHCP server runing on windows NT 4.0, is it possible to
>view/print the DHCP database?.
>
>Can you suggust any mailing list that is relatd to (networks).
>
>Thank you.
>

From firewalls-owner  Mon Feb 10 16:54:19 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id PAA20520 for firewalls-outgoing; Mon, 10 Feb 1997 15:32:32 -0800 (PST)
Received: from homeport.org (lighthouse.homeport.org [205.136.65.198]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id PAA20497 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 15:32:20 -0800 (PST)
Received: (adam@localhost) by homeport.org (8.8.5/8.6.9) id SAA15684; Mon, 10 Feb 1997 18:28:59 -0500 (EST)
From: Adam Shostack <adam@homeport.org>
Message-Id: <199702102328.SAA15684@homeport.org>
Subject: Re: [NTSEC] ActiveX, MSIE and Quicken
In-Reply-To: <c=US%a=attmail%p=BUSCH%l=STLABCEXG010-970210164133Z-35131@stlabcexg001.anheuser-busch.com> from "Starkweather, Mike" at "Feb 10, 97 10:41:33 am"
To: mike.starkweather@anheuser-busch.com (Starkweather, Mike)
Date: Mon, 10 Feb 1997 18:28:58 -0500 (EST)
Cc: firewalls@GreatCircle.COM, mike.starkweather@anheuser-busch.com
X-Mailer: ELM [version 2.4ME+ PL27 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Can you enforce a policy at the desktop with the preponderance of
'Click here to download the latest...' links everywhere?  Not without
tools on the firewall to enforce policy.  What you really want is a
http proxy that sends a policy url/statement (like Netscape's autoproxy,
but for security policies) with each request, and a browser that
accepts and obeys policies from the firewall.

Adam

Starkweather, Mike wrote:
| Using the firewall to filter ActiveX and Java is like throwing out the 
| baby with the bath water.  This sounds more like a macro virus than a 
| Internet exploit.  Wouldn't it be better to treat it at the desktop 
| instead of the firewall?
| 
| Mike Starkweather
| 
| ----------
| From:  Jerry Mendes[SMTP:mendes@garnet.berkeley.edu]
| Sent:  Saturday, February 08, 1997 5:05 AM
| To:  Russ
| Cc:  firewalls@GreatCircle.COM
| Subject:  RE: [NTSEC] ActiveX, MSIE and Quicken
| 
| Presumably, one answer is for the firewall companies to write 
| additional
| application layer filters for port 80, looking for ActiveX or Java
| downloads.  This would make configuration of the firewall a bit more
| complex.  Don't know if any of 'em are considering this yet.  Anyone 
| have
| any scoop on this?
| 
| Jerry Mendes, Principal Consultant
| DataComm Insights
| 150 Seminary Drive
| Mill Valley, California  94941
| 
| Voice:  415-381-5500
| FAX:    415-381-5502
| Email:  mendes@garnet.berkeley.edu
| 
| At 11:40 PM 2/1/97 -0500, Russ wrote:
| >To try and keep this on a Firewalls vein. The tunneling of anything 
| over
| >HTTP is, in my opinion, the crappy technology. That goes for Java
| >applets or certificate authentication for that matter. I don't like 
| the
| >idea of combining diverse tasks within a single channel if its 
| possible
| >to avoid it, and it is possible, so the only reason its not being 
| done
| >is to USURP FIREWALLS.
| _______________________________________________________________________  
| _____
| _______
| Jerry Mendes, Principal Consultant              Voice:   (415) 
| 381-5500
| DataComm Insights                               FAX:     (415) 
| 381-5502
| 150 Seminary Drive                              Email:
| mendes@garnet.berkeley.edu
| Mill Valley, California  94941
| 
| 


-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume



From firewalls-owner  Mon Feb 10 16:54:51 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA07198 for firewalls-outgoing; Mon, 10 Feb 1997 14:08:54 -0800 (PST)
Received: from upshield.uniq.com.au (upstop.uniq.com.au [192.195.152.113]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id OAA07130 for <Firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 14:08:29 -0800 (PST)
Received: (from smtp@localhost) by upshield.uniq.com.au id JAA28841
  (8.8.5/IDA-1.6); Tue, 11 Feb 1997 09:06:22 +1100 (EST)
Received: from upshoo.uniq.com.au(192.195.152.130) by upshield via smap (V1.3)
	id ./smaAAAa0072a; Tue Feb 11 09:06:03 1997
Received: from basil.uniq.com.au (basil.uniq.com.au [192.168.3.1]) by upserv.uniq.com.au with ESMTP id JAA03801
  (8.8.5/IDA-1.6); Tue, 11 Feb 1997 09:01:25 +1100 (EST)
Received: (from pauline@localhost) by basil.uniq.com.au id JAA01224
  (8.8.5/IDA-1.6); Tue, 11 Feb 1997 09:04:15 +1100 (EST)
Date: Tue, 11 Feb 1997 09:04:15 +1100 (EST)
From: Pauline van Winsen - Uniq Professional Services <Pauline.van.Winsen@uniq.com.au>
Message-ID: <199702102204.JAA01224@basil.uniq.com.au>
To: gvc@ocsystems.com
Subject: Re: Home-grown vs. Turn-Key Firewalls
Cc: Firewalls@GreatCircle.COM
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-MD5: BLDYs35y9+3OkGzzbaqEZw==
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


hiya,

> 
> I am trying to sell management on a Firewall solution made up of:
>   - 2 routers with packet-filtering
>   - 1 dual-homed bastion host between the routers
>   - the TIS fwtk on the bastion host
> 
> I like this because it's low-cost:
>   - all the software is freely-available 
>   - we only need to buy 1 router (we already have 1)
>   - the bastion host is a (currently spare) Unix box we're 
>      already very familiar with administering
>   
> The boss says "find an off-the-shelf solution" because:
>   - in-house solutions always are more expensive than you think after
>      labour is taken into account
>   - we've never done this before so we might misconfigure something
>   - if we have to explain our security to a client they might not
>      understand a piece-parts solution but would feel OK if we just
>      named the commercial product we use
> 
> I respond (point-by-point)
>   - a firewall product doesn't take much more work than 
>       a custom configuration
>   - a firewall product is also subject to configuration errors
>   - a client savvy enough to ask about our security policy would
>       be satisfied with a home-grown solution (assuming we could
>       explain it clearly, and it was actually effective)
> 
> I can see his points, but I think I have the technical issues in hand.
> I looked at one major vendor's software solution and found that for
> $10K it would simply disable risky elements of the base operating system
> and install some proxies I could get for free elsewhere.  It doesn't
> seem like great value for the dollar.
> 
> Don't ask me to name OS or platform;  I'm sure this will
> start a flame war even without arguing over vendor specifics.
> (I look forward to an edifying flame war regardless.)

don't forget products with functionality you really need such as 
logsurfer & tripwire/tiger.
i think a physical read-only tripwire database is one of the best 
pieces of technology you can add to a system where security is a concern. 

there is a real myth that an off-the-shelf product save significant time 
& money.
firewall packages rarely address underlying operating system vulnerabilities
or vulnerabilities in protocol implementation. e.g. sendmail & bind.
if they do - you still need to keep up with the versions which roll like
a taxi meter. pick your poison - ftp, compile & configure yourself or wait
for a vendor fix & workaround the problem in the mean time.

just because you have brand-X firewall whether it be home-grown or
purchased doesn't mean you don't have to jump when new vulnerabilities
are exposed, install OS vendor patches or keep sendmail up to date etc etc etc.
whatever you decide to install you are going to have to commit resources
to administer it & keep it up to date.

#include <standard rant on security not being a technical problem - it's
procedures & policies> 8-)

hope this helps,
pauline

Pauline van Winsen                                   pauline@uniq.com.au
Uniq Professional Services Pty Ltd                       www.uniq.com.au
PO Box 70, Paddington, NSW 2021,                      (Sydney) Australia
Phone: +61-2-9380-6360      Fax: +61-2-9380-6416      Pager: 016 287 000
"Another matter which must be left to your escort in restaurant dining
is any communication with the waiter. If you want something that is
not on the table you never ask the waiter direct, but ask your escort
if he will ask the waiter for it."
	       Dining Out - Book 3, Woman's World, circa 1964.




From firewalls-owner  Mon Feb 10 16:55:58 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id MAA26123 for firewalls-outgoing; Mon, 10 Feb 1997 12:51:14 -0800 (PST)
Received: from gateway.superonline.net (gateway.superonline.net [194.242.73.254]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id MAA25981 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 12:50:43 -0800 (PST)
Received: by gateway.superonline.net; (5.65v3.2/1.3/10May95) id AA07551; Mon, 10 Feb 1997 22:48:33 +0300
Received: by postman.superonline.net with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5)
	id <01BC17A4.70BF9390@postman.superonline.net>; Mon, 10 Feb 1997 22:47:49 +0200
Message-Id: <c=US%a=_%p=superonline%l=POSTMAN-970210204747Z-20381@postman.superonline.net>
From: =?iso-8859-1?Q?=22A=2E_=D6mer_K=F6ker=22?= <omer@superonline.net>
To: "'firewalls@GreatCircle.COM'" <firewalls@GreatCircle.COM>,
        "'thl@ProNetC.com'" <thl@ProNetC.com>,
        "'drexx@sunphil.mozcom.com'" <drexx@sunphil.mozcom.com>,
        "'peter.gregory-unix@mccaw-stg.com'" <peter.gregory-unix@mccaw-stg.com>,
        "'matt@plato.West.Sun.COM'" <matt@plato.West.Sun.COM>
Subject: RE: SUN's Stealth Product
Date: Mon, 10 Feb 1997 22:47:47 +0200
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


the site is actually at  http://www.sun.com/security/

>----------
>From: 	matt@plato.West.Sun.COM[SMTP:matt@plato.West.Sun.COM]
>Sent: 	10 =DEubat 1997 Pazartesi 19:55
>To: 	firewalls@GreatCircle.COM; thl@ProNetC.com; =
drexx@sunphil.mozcom.com;
>peter.gregory-unix@mccaw-stg.com
>Subject: 	Re: SUN's Stealth Product
>
>
>
>
>http://www.incog.com
>
>This is Sun's Internet Commerce Group page wherein all
>SunScreen, SKIP and other related products, FAQ's etc
>are found...
>

From firewalls-owner  Mon Feb 10 17:27:46 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id MAA26664 for firewalls-outgoing; Mon, 10 Feb 1997 12:55:29 -0800 (PST)
Received: from beach.sctc.com (beach.sctc.com [192.55.214.50]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id MAA26655 for <firewalls@greatcircle.com>; Mon, 10 Feb 1997 12:55:16 -0800 (PST)
Received: from mfil.terminal (mfil@localhost) by beach.sctc.com (8.7.5/8.7.3) with SMTP id OAA00403; Mon, 10 Feb 1997 14:49:27 -0600 (CST)
Received: from sphinx.sctc.com (sphinx.sctc.com [172.17.192.3]) by beach.sctc.com (8.7.5/8.7.3) with ESMTP id OAA00309; Mon, 10 Feb 1997 14:46:48 -0600 (CST)
Received: from [172.17.1.61] (smith.sctc.com [172.17.1.61]) by sphinx.sctc.com (8.8.5/8.7.3) with SMTP id OAA19394; Mon, 10 Feb 1997 14:49:10 -0600 (CST)
X-Sender: smith@mailhost.sctc.com
Message-Id: <v01540b08af2532bff851@[172.17.1.61]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Mon, 10 Feb 1997 14:49:08 -0600
To: matt@plato.West.Sun.COM (Matthew Archibald), firewalls@greatcircle.com,
        bsterling@hotmail.com
From: smith@sctc.com (Rick Smith)
Subject: Re: Securing Web Servers
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Last Monday, Matthew Archibald wrote:

>I know, the famous 'we obivate the need for root' statement
>is flashy to mainframe centric minded folks but really, no
>matter how you do it the system always has one priveledged
>user id or another regardless if the name is 'root', 'seosadmin'
>or 'barney'...

Disagree.

There is probably no security concept more rooted in the mainframe world
than the notion that you must have a single, all powerful userid. It takes
a lot of work to make a particular userid all-powerful among a group of
distributed systems, unless you have low standards for acceptable security.
If mainframe-centric folks dislike the one all-powerful userid, then it's
because they have years of experience with its security drawbacks.

When OS/360 first came out, Conventional Wisdom was that users needed to be
able to write their own channel programs, essentially, custom writing
device drivers for individual application programs. This was eventually
recognized to be a Bad Idea from an architectural standpoint. I hope the
same future will hold true for "root." I recognize it will be a while
before OSes do this: it's already taking a long time for the kernel
mode/user mode distinction to work its way into desktop OSes.

Rick.
smith@sctc.com          secure computing corporation



From firewalls-owner  Mon Feb 10 17:34:21 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id MAA23500 for firewalls-outgoing; Mon, 10 Feb 1997 12:34:37 -0800 (PST)
Received: from fw.roguewave.com (roguewave.com [198.68.9.6]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id MAA23324 for <firewalls@greatcircle.com>; Mon, 10 Feb 1997 12:33:47 -0800 (PST)
Received: by fw.roguewave.com; id MAA00285; Mon, 10 Feb 1997 12:31:24 -0800 (PST)
Received: from unknown(10.68.9.1) by fw.roguewave.com via smap (3.2)
	id xma000269; Mon, 10 Feb 97 12:31:11 -0800
Received: from rw0328 ([10.68.2.128]) by cvo.roguewave.com (8.8.2/8.8.2) with SMTP id MAA12191 for <firewalls@greatcircle.com>; Mon, 10 Feb 1997 12:31:51 -0800 (PST)
Message-Id: <199702102031.MAA12191@cvo.roguewave.com>
Comments: Authenticated sender is <snyder@mail.cvo.roguewave.com>
From: "Ron Snyder" <snyder@roguewave.com>
Organization: Rogue Wave Software
To: firewalls@greatcircle.com
Date: Mon, 10 Feb 1997 12:30:13 -0800
Subject: netscape commerce server using javascript???
Reply-to: snyder@roguewave.com
X-mailer: Pegasus Mail for Win32 (v2.52)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Sorry if this is a FAQ, but I've been reading for a while and don't 
recall seeing this come up.

I was just informed by our webmaster that the netscape commerce 
server uses javascript for remote admin.  In order for him to 
administer the web server (which is outside the FW, of course), 
Netscape requires him to have javascript capability to the machine.  

I was just getting ready to disable javascript through the firewall 
when he told me this.  Here are my questions:

1) Is it _really_, _really_ dumb of Netscape to REQUIRE javascript to 
admin the server?

2) Is there any way that I can have my cake (disable java*) and eat 
it too (let him admin the server)?  These are the possibilities I can 
see:
   a) tell him to dial in to the web server
      (modem should be dial-out only, so this is a bad idea)
   b) Have him use ISDN to establish his admin sessions to the web 
      server.
      (What problems does the existence of his desktop ISDN 
       connection give me?)

What are some other options that I'm not seeing?

Thanks,
-ron
--
ron snyder   snyder@roguewave.com       |         This space
Rogue Wave Software, Inc                |         intentionally    
{news,unix} admin                       |         left blank
#include <std-dsclmr.h++>               |   

From firewalls-owner  Mon Feb 10 17:36:53 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id MAA21396 for firewalls-outgoing; Mon, 10 Feb 1997 12:20:08 -0800 (PST)
Received: from xyzzy.plugh.edmonton.ab.ca (xyzzy.plugh.edmonton.ab.ca [198.161.22.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id MAA21229 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 12:19:18 -0800 (PST)
Received: (from uucp@localhost) by xyzzy.plugh.edmonton.ab.ca (8.6.12/8.6.9) id NAA21387; Mon, 10 Feb 1997 13:17:59 -0700
Received: from snouts-gw.obtuse.com(192.168.30.61), claiming to be "snouts.obtuse.com"
 via SMTP by mailhost.plugh.edmonton.ab.ca, id smtpd21385aaa; Mon Feb 10 13:17:53 1997
Received: (from beck@localhost) by snouts.obtuse.com (8.7.5/8.7.3) id NAA06806; Mon, 10 Feb 1997 13:17:50 -0700
From: Bob Beck <beck@obtuse.com>
Message-Id: <199702102017.NAA06806@snouts.obtuse.com>
Subject: Re: [NTSEC] ActiveX, MSIE and Quicken
To: mike.starkweather@anheuser-busch.com (Starkweather Mike)
Date: Mon, 10 Feb 1997 13:17:48 -0700 (MST)
Cc: firewalls@GreatCircle.COM, mike.starkweather@anheuser-busch.com
In-Reply-To: <c=US%a=attmail%p=BUSCH%l=STLABCEXG010-970210164133Z-35131@stlabcexg001.anheuser-busch.com> from "Starkweather, Mike" at Feb 10, 97 10:41:33 am
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> Using the firewall to filter ActiveX and Java is like throwing out the 
> baby with the bath water.  This sounds more like a macro virus than a 
> Internet exploit.  Wouldn't it be better to treat it at the desktop 
> instead of the firewall?
> 
> Mike Starkweather


	Java maybe. When you filter java you're protecting yourself from
bogus sandbox implementations in the browser, So if you could make sure the
type of browser used on the desktop was enforced and that the browser's
sandbox for running a java applet was sane and free of bugs this is 
theoretically possible.

	For ActiveX in from the outside, well, no. ActiveX is just
insane, (unless you trust people outside to be able to run arbitrary
stuff on your internal machines unprotected). The operating systems
(or lack thereof) under which the browsers that support ActiveX run do
*not* have the sorts of controls necessary to even make a half-baked
attempt at securing a browser to run a potentially malicious
application as a subprocess.

	Notwithstanding either of the above, the usual point of the
firewall is to prevent such distributed security nightmares as the
above. You can do without a firewall completely if you secure all your
desktops. The problem is that that's usually a very difficult thing to
do.
 
	-Bob


From firewalls-owner  Mon Feb 10 17:39:18 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id MAA23014 for firewalls-outgoing; Mon, 10 Feb 1997 12:31:42 -0800 (PST)
Received: from gatekeeper2.mcimail.com (gatekeeper2.mcimail.com [192.147.45.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id MAA22857 for <firewalls@greatcircle.com>; Mon, 10 Feb 1997 12:31:04 -0800 (PST)
Received: from mailgate2.mcimail.com (mailgate2.mcimail.com [166.40.135.23]) by gatekeeper2.mcimail.com (8.6.12/8.6.10) with SMTP id UAA26490; Mon, 10 Feb 1997 20:34:17 GMT
Received: from mcimail.com by mailgate2.mcimail.com id ad28395;
          10 Feb 97 20:31 WET
Date: Mon, 10 Feb 97 15:30 EST
From: Peter Ngo <Peter_Ngo+aEPS4-Carr%EPS@mcimail.com>
To: Jerry Mendes <mendes@garnet.berkeley.edu>,
        Matt Wallace <mwallace@netcom.com>
Cc: John Mizzi <jmizzi@utu.premenos.com>,
        firewalls <firewalls@greatcircle.com>
Subject: Re[2]: Altavista Tunnel
Message-Id: <35970210203053/0007044148PJ2EM@MCIMAIL.COM>
X-MB-Info: Serial #: 191-30-2807  VERSION: 2.01H
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

     Matt,

     Does Raptor's Eagle firewall support the ICMP protocol? I thought it
     does! But I heard rumours that it does not?

     Thanks,

     Peter


______________________________ Reply Separator _________________________________
Subject: Re: Altavista Tunnel
Author:  Matt Wallace|INTERNET|mwallace@netcom.com  at MCIMAIL
Date:    2/10/97 3:13 AM


On Sat, 8 Feb 1997, Jerry Mendes wrote:

> At 02:24 PM 2/7/97 -0800, John Mizzi wrote:
> >Has anyone used the Altavista Tunnel ?
>
[snip: class information]
>
> >If so what are your opinions ?
>
> I think the product is pretty darn good, but then I'm a bit biased.  :-)
>
> >Are there any similiar products which provide the same functionality as the
> >Altavista Tunnel ??
>
> Yes there are.  A number of the firewall companies offer other secure
> solutions, either as part of the firewall or as a separate product.  Also,
> Microsoft has developed an encrypted tunnel technology, as well....goes
> under the name PPTP (I believe it translates as Point to Point Tunneling
> Protocol).

Raptor's Eagle firewall has full VPN IP tunnelling capability, both from
firewall-to-firewall, and from a remote client to the firewall.

VPNet, a company focused on VPN tunnelling, is working on products. I'd
look into that yourself, as I'm hesitant to discuss any details for fear of
accidentally stepping on a NDA policy.

I've heard there is a hardware-to-hardware tunnelling solution like VPN's
from another companty, and the name escape's me... Red River? Red Creek?
Something like that.

Microsoft has an implementation of VPN tunnelling. They 'established' a
-protocol-, called PPTP, which is point-to-point tunnelling protocol, and
they also added an implementation to NT 4.0. However, you must be running
a RASS server to use theirs, as their PPTP server only comes as a subset of
that.

__
Matt Wallace
mwallace@netcom.com



From firewalls-owner  Mon Feb 10 17:45:02 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id RAA07182 for firewalls-outgoing; Mon, 10 Feb 1997 17:26:34 -0800 (PST)
Received: from sprocket.nis.newscorp.com (sprocket.nis.newscorp.com [206.15.111.87]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id RAA07174 for <Firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 17:26:26 -0800 (PST)
Received: (from mtc@localhost) by sprocket.nis.newscorp.com (8.7.3/8.7.2) id UAA29549; Mon, 10 Feb 1997 20:23:02 -0500 (EST)
From: mtc@ie.nis.newscorp.com
Message-Id: <199702110123.UAA29549@sprocket.nis.newscorp.com>
Subject: Re: Home-grown vs. Turn-Key Firewalls
To: jrjones@comsource.net (Jim Jones)
Date: Mon, 10 Feb 1997 20:23:02 -0500 (EST)
Cc: gvc@ocsystems.com, Firewalls@GreatCircle.COM
In-Reply-To: <Pine.OSF.3.95.970210160242.31709B-100000@alpha.comsource.net> from "Jim Jones" at Feb 10, 97 04:16:18 pm
Reply-to: mtc@newscorp.com
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

jrjones@comsource.net wrote:

>Bottom line it may cost more, but if it saves a sales or reduces
>explanation to a customer it may be worth it.
>
>Don't get me wrong I do not disagree with your approach, but less costly
>solutions and shareware, freeware solutions are not always viewed
>postively.  The last thing you want is a competitor saying hey we use such
>and such and they use shareware or freeware.  
>
>Well I said enough for my 2 cents.

Indeed, but when done right, one knows the limitations of the
custom built firewall whereas with the other option, one has no real
idea.
It is a toss up, company policy usually prevails.
Good luck,
Matt

From firewalls-owner  Mon Feb 10 18:10:14 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id RAA04985 for firewalls-outgoing; Mon, 10 Feb 1997 17:12:10 -0800 (PST)
Received: from exp2.is.xpark.pmh.org (exphub.is.xpark.pmh.org [198.215.78.104]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id RAA04974 for <firewalls@greatcircle.com>; Mon, 10 Feb 1997 17:11:58 -0800 (PST)
Received: from localhost by exp2.is.xpark.pmh.org (AIX 3.2/UCB 5.64/4.03)
          id AA34603; Mon, 10 Feb 1997 19:10:12 -0600
Message-Id: <32FFC6F4.794B@exphub.pmh.org>
Date: Mon, 10 Feb 1997 19:10:12 -0600
From: "Cary Conover(IS) 13897" <cconov@exp2.is.xpark.pmh.org>
Organization: Parkland Memorial Hospital
X-Mailer: Mozilla 3.01Gold (X11; I; AIX 2)
Mime-Version: 1.0
To: "Simon J. Gerraty" <sjg@zen.quick.com.au>
Cc: firewalls@greatcircle.com
Subject: Re: SLr* released.  rsh,rcp,rdist over SSL
References: <199702091359.AAA11179@zen.quick.com.au>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Simon J. Gerraty wrote:
> 
> Sorry to all the folk that have waited so long and patiently for this,
> but I have _finally_ cut a release of SSLrshd and friends.
> 
> They can be downloaded from ftp://ftp.quick.com.au/sjg/ or
> http://www.quick.com.au/ftp/pub/sjg/
> 
> SSLrshd is the server for ssl_rcmd(), they work just like rshd and
> rcmd() except that trust is placed in X.509 certificates and nothing
> needs to be set-uid root.  If a host trusts my certificate, then it
> does not care where I make requests from.  The functionality is the
> same, but the security is vastly different.
> 
> See http://www.quick.com.au/ftp/pub/sjg/help/SSLrsh.html for more details.
What about AIX support for this product?  Is it going to happen?

Just wondering.

> 
> I gave up on the idea of adding support for GNU, make, so you still
> need to obtain bmake, my bmake.tar.gz  in the same directory uses GNU
> configure so should build reasonably easily - it certainly does on
> SunOS,Solaris,HP-UX and IRIX.
> 
> See http://www.quick.com.au/ftp/pub/sjg/help/bmake.html for more details.
> 
> SSLrsh-1.0.tar.gz contains
> 
> SSLrsh
> SSLrshd
> SSLrcp
> and
> SSLrdist
> 
> actually to build SSLrdist you must have the USC rdist distribution handy.
> 
> and of course libsslfd which makes adding SSL and other crypto hooks to
> network daemons such as rshd, telnetd and even ftpd almost trivial.
> 
> Since libsslfd is a pre-requisit for my stelnet and SNFS, I hope to
> get those packaged up and released soon.
> 
> --sjg

-- 
Cary D. Conover
AIX Systems Administrator		Senior Systems Analyst
Parkland Health and Hospital System 	Dallas, Texas
cconov@parknet.pmh.org (Work)		carydc@why.net (Home)
817-571-6694 Home Voice / Ans. Mach.	817-571-6793 Home Data/Fax
817-360-8572 Mobile/Voice Mail/Pager 	214-590-0244 Work Voice
214-786-0282 Pager			214-590-0202 Work Fax

The views I express are mine and do not represent my employer.

From firewalls-owner  Mon Feb 10 19:18:22 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id SAA13253 for firewalls-outgoing; Mon, 10 Feb 1997 18:43:01 -0800 (PST)
Received: from lehman.Lehman.COM (lehman.Lehman.COM [192.147.66.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id SAA13243 for <firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 18:42:47 -0800 (PST)
From: carson@lehman.com
Received: (from smap@localhost) by lehman.Lehman.COM (8.6.12/8.6.12) id VAA08136; Mon, 10 Feb 1997 21:40:55 -0500
Received: from relay.messaging-svcs2.lehman.com(146.127.39.20) by lehman via smap (V1.3)
	id tmp008134; Mon Feb 10 21:40:53 1997
Received: from kublai.lehman.com by relay.lehman.com (4.1/LB-0.6)
	id AA20579; Mon, 10 Feb 97 21:40:52 EST
Received: from dragon.lehman.com by kublai.lehman.com (4.1/Lehman Bros. V1.6)
	id AA27329; Mon, 10 Feb 97 21:40:51 EST
Received: by dragon.lehman.com (SMI-8.6/Lehman Bros. V1.5)
	id VAA29576; Mon, 10 Feb 1997 21:40:50 -0500
Date: Mon, 10 Feb 1997 21:40:50 -0500
Message-Id: <199702110240.VAA29576@dragon.lehman.com>
To: "Cary Conover(IS) 13897" <cconov@exp2.is.xpark.pmh.org>
Cc: "Simon J. Gerraty" <sjg@zen.quick.com.au>, firewalls@GreatCircle.COM
Subject: Re: SLr* released.  rsh,rcp,rdist over SSL
In-Reply-To: <32FFC6F4.794B@exphub.pmh.org>
References: <199702091359.AAA11179@zen.quick.com.au>
	<32FFC6F4.794B@exphub.pmh.org>
Reply-To: carson@lehman.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>>>>> "Simon" == "Simon J. Gerraty" <sjg@zen.quick.com.au> wrote:

>> SSLrsh SSLrshd SSLrcp and SSLrdist
>> 
>> actually to build SSLrdist you must have the USC rdist distribution
>> handy.

I'm confused - why would anyone with a current rdist want to modify the
code? Just add -P myrshreplacement to the commandline. Why wouldn't

rdist -P SSLrsh ...

work? Well, you might have to write a condom for it if you need extra
args...

--
Carson Gaspar -- carson@cs.columbia.edu carson@lehman.com
http://www.cs.columbia.edu/~carson/home.html
<This is the boring business .sig - no outre sayings here>

From firewalls-owner  Mon Feb 10 20:04:54 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id TAA19552 for firewalls-outgoing; Mon, 10 Feb 1997 19:21:24 -0800 (PST)
Received: from visapur.apg.more.net (visapur.apg.more.net [198.209.250.159]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id TAA19462 for <firewalls@greatcircle.com>; Mon, 10 Feb 1997 19:20:54 -0800 (PST)
Received: (from vivek@localhost) by visapur.apg.more.net (8.7.5/8.7.3) id VAA23779; Mon, 10 Feb 1997 21:21:06 GMT
Date: Mon, 10 Feb 1997 21:21:05 +0000 ()
From: Vivek Bhandari <vivek@visapur.apg.more.net>
To: firewalls@greatcircle.com
Subject: test
Message-ID: <Pine.BSF.3.91.970210212030.23753C-100000@visapur.apg.more.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Please ignore. thanx.


From firewalls-owner  Mon Feb 10 22:19:56 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id WAA15983 for firewalls-outgoing; Mon, 10 Feb 1997 22:08:59 -0800 (PST)
Received: from linux.silkroad.com (linux.silkroad.com [198.133.151.18]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id WAA15932 for <Firewalls@GreatCircle.COM>; Mon, 10 Feb 1997 22:08:44 -0800 (PST)
Received: (from walls@localhost) by linux.silkroad.com (8.7.3/8.6.9) id BAA03769; Tue, 11 Feb 1997 01:06:17 -0500
From: "Fir E. Walls" <walls@linux.silkroad.com>
Message-Id: <199702110606.BAA03769@linux.silkroad.com>
Subject: Re: Home-grown vs. Turn-Key Firewalls
To: Pauline.van.Winsen@uniq.com.au (Pauline van Winsen - Uniq Professional Services)
Date: Tue, 11 Feb 1997 01:06:16 -0500 (EST)
Cc: gvc@ocsystems.com, Firewalls@GreatCircle.COM
In-Reply-To: <199702102204.JAA01224@basil.uniq.com.au> from "Pauline van Winsen - Uniq Professional Services" at Feb 11, 97 09:04:15 am
X-Mailer: ELM [version 2.4 PL24 PGP2]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


After building many choke-gate firewalls over the past 9
years..... this comment.

It is easier and more effective, from a security view point,
to have a strong TCP/IP (read UNIX) person who understands socket level
protocols and TCP/IP very well to build choke-gate firewalls
with other tools, i.e. tripwire, socks, &c &c. that can be compiled
using, e.g. a cross platform compiler.

However, most firms (the vast majority) do not want to pay
the big bucks for this expertise, so they prefer a COTS
firewall product which is supported by a vendor for obvious
reasons (if you have been in the business for a long time
you begin to understand the futility of a quixotic approach to 
the mindless COTS vs. homegrown debate... what is smart and
works best is not what most customers want, they want what
is cheap, supportable, and sustainable, and works ok...
however they say 'works best' because vendors have convinced
'ad clueleseum' that if it is called 'SUPER-DUPER FIREWALL PLUS', it has
to be very, very secure).   

Plus, vendors give away nice coffee mugs, cdroms, and t-shirts .^)

Fir. E. Walls, esq.




From firewalls-owner  Mon Feb 10 23:05:01 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id WAA20189 for firewalls-outgoing; Mon, 10 Feb 1997 22:55:40 -0800 (PST)
Received: from minotaur.labyrinth.net.au (minotaur.labyrinth.net.au [203.9.148.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id WAA20110 for <firewalls@greatcircle.com>; Mon, 10 Feb 1997 22:55:04 -0800 (PST)
Received: (from mail@localhost) by minotaur.labyrinth.net.au (8.7.2/8.7.2) id RAA20129; Tue, 11 Feb 1997 17:52:45 +1100 (EST)
X-Authentication-Warning: minotaur.labyrinth.net.au: mail set sender to <sjg@zen.quick.com.au> using -f
Received: from gate.quick.com.au(203.12.250.130) by minotaur.labyrinth.net.au via smap (V1.3)
	id sma020123; Tue Feb 11 17:52:33 1997
Received: (from sjg@localhost) by zen.quick.com.au (8.7.3/8.7.3) id RAA25793; Tue, 11 Feb 1997 17:52:27 +1100 (EST)
Date: Tue, 11 Feb 1997 17:52:27 +1100 (EST)
From: "Simon J. Gerraty" <sjg@zen.quick.com.au>
Message-Id: <199702110652.RAA25793@zen.quick.com.au>
To: firewalls@greatcircle.com
Cc: carson@lehman.com, sjg@quick.com.au
Subject: Re: SLr* released. rsh,rcp,rdist over SSL
References: <199702091359.AAA11179@zen.quick.com.au>	<32FFC6F4.794B@exphub.pmh.org> <199702110240.VAA29576@dragon.lehman.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>I'm confused - why would anyone with a current rdist want to modify the
>code? Just add -P myrshreplacement to the commandline. Why wouldn't

>rdist -P SSLrsh ...

>work? Well, you might have to write a condom for it if you need extra
>args...

It _does_ work.  But if you are using a certificate that requires you to
enter a passwd, and your distfile is going to update 60 hosts, 4 at a time
you are going to be sitting there for a _long_ time typing in
your passwd.  By contrast, SSLrdist reads your passwd once only, and thanks to 
libsslfd the patches are trivial.

This is covered in http://www.quick.com.au/sjg/SSLrsh.html and the 
help/SSLrsh.html in the distribution.

--sjg

-- 
Simon J. Gerraty        <sjg@quick.com.au>

#include <disclaimer>   /* imagine something _very_ witty here */

From firewalls-owner  Tue Feb 11 02:50:34 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id CAA02619 for firewalls-outgoing; Tue, 11 Feb 1997 02:23:04 -0800 (PST)
Received: from socrates.berkeley.edu (socrates.Berkeley.EDU [128.32.25.13]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id CAA02581 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 02:22:09 -0800 (PST)
Received: from garnet.berkeley.edu (garnet.Berkeley.EDU [128.32.155.6]) by socrates.berkeley.edu (8.8.4/8.8.0) with ESMTP id CAA10493; Tue, 11 Feb 1997 02:21:10 -0800 (PST)
Received: from pine by garnet.berkeley.edu (8.7.5/1.33-960227)
	id CAA27489; Tue, 11 Feb 1997 02:21:07 -0800
Message-Id: <2.2.32.19970211102035.006e8830@garnet.berkeley.edu>
X-Sender: mendes@garnet.berkeley.edu
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Tue, 11 Feb 1997 02:20:35 -0800
To: nvs2@cornell.edu
From: Jerry Mendes <mendes@garnet.berkeley.edu>
Subject: Re: Packet Filter rules...
Cc: firewalls@greatcircle.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Gee folks, lots of email jokes, but not too much help for the poor grad
student.  I'll give you another tip on "academic" sort of work.  Check out
Steve Bellovin's ftp directory at Bell Labs anonymous ftp site.  Bellovin
and his partner Bill Cheswick started publishing security papers as early as
1988/89, and their team at the Labs have written some pretty clever software
(my impression only) to find and track intruders.

        ftp://ftp.research.att.com/dist/smb/

This *was* the correct URL.  However, it might be different since Bell Labs
is now part of the new Lucent Technologies Co.  And, I'm not sure where SMB
has gone with the new AT&T split up.

Also, you might want to find Cheswick & Bellovin's book on firewalls.  Can't
recall the title, but I'm sure you can find it with the authors names.




At 06:22 PM 2/5/97 -0500, nvs2@cornell.edu wrote:
>Hi,
>I am implementing a firewall as a Master's project and I need to decide 
>on rules for packet filtering. I have two questions to ask you folks:
>
>(1) Can anyone suggest research papers/books/web documents on packet 
>filtering?
>
>(2) I was told that a packet filter should check for various combinations 
>of :
>Source Address, Destn Address, protocol, Source port, destn port
>
> and then decide if a packet should be let thro.
>Also, this decision making has to be real fast so as not to introduce a 
>considerable amount of overhead while routing the packet.
>Does any one have any suggestions on how this can be done?
>
>Thanks in advance
>
>Nik.
>----
>
>
___________________________________________________________________________
Jerry Mendes, Principal Consultant          Voice: (415) 381-5500
DataComm Insights                           FAX:   (415) 381-5502
150 Seminary Drive                          Email: mendes@garnet.berkeley.edu
Mill Valley, California  94941


From firewalls-owner  Tue Feb 11 03:05:12 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id CAA02597 for firewalls-outgoing; Tue, 11 Feb 1997 02:22:24 -0800 (PST)
Received: from socrates.berkeley.edu (socrates.Berkeley.EDU [128.32.25.13]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id CAA02562 for <Firewalls@greatcircle.com>; Tue, 11 Feb 1997 02:21:29 -0800 (PST)
Received: from garnet.berkeley.edu (garnet.Berkeley.EDU [128.32.155.6]) by socrates.berkeley.edu (8.8.4/8.8.0) with ESMTP id CAA10436; Tue, 11 Feb 1997 02:20:30 -0800 (PST)
Received: from pine by garnet.berkeley.edu (8.7.5/1.33-960227)
	id CAA27380; Tue, 11 Feb 1997 02:20:26 -0800
Message-Id: <2.2.32.19970211101953.00704770@garnet.berkeley.edu>
X-Sender: mendes@garnet.berkeley.edu
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Tue, 11 Feb 1997 02:19:53 -0800
To: "Allen D. Harpham" <aharpham@cnweb.com>
From: Jerry Mendes <mendes@garnet.berkeley.edu>
Subject: RE: Secure Telneting into a internal network
Cc: Firewalls@greatcircle.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Let me get my 2 cents into this, too.  Secure Shell (ssh) is really a good
idea in most cases....it's more or less like telnet with encryption.  As you
suggest, however, with a non-standard OS on the internal network, it would
probably be tricky...you'd be doing it on your own with little or no support
except for a mailing list group.

If you want to learn more about ssh, go to the homepage at the Helsinki
Technical University:
        http://www.cs.hut.fi/ssh/
There's an FAQ section, and a majordomo email distribution list.

Since it seems impractical to consider ssh, then look at things you might do
with your firewall.

You don't say what kind it is.  If your major concern is authenticating the
users before they are allowed through the firewall, firewalls can generally
do that....requiring the users to log in.  You can require them to use
hand-held authenticators (SecureID, Crypto Card, etc) that automatically
give them a new, one-time password everytime they connect.   One of the
vendors (someone on the list will surely know who) now has a software
version of the HHA, so that you install a program on the laptop that
replicates the function of the physical HHA, without requiring each user to
carry a physical device.

The best coming technology....all of the crypto vendors are going to have
products like this within the year...is the SmartCard, which will have an
RSA private keys and public keys for all of the servers one needs to connect
with.  I saw some of these at the recent RSA conference in San Francisco.
Here's a short list of vendors I saw with products:

        Chrysalis ITS (Ottawa)                  chrysalis-its.com
        Entegrity Solutions (Sunnyvale)         entegrity.com
        VPNet (San Jose)                        vpnet.com

If you need more than just authentication (ie--you're looking for encryption
of telnet sessions), you can do that too.  You're looking for VPN
technology.  Some firewall vendors have it built it, some sell it as an add-on.

In this case, the users again authenticate themselves, using RSA public key
cryptography.  Once the authentication is done, all transmissions are
encrypted using a secret session key which is generated by the encryption
"server", and sent through the encrypted tunnel (the VPN) to the client
workstation.  Good practice requires that a new session key be generated on
a regular basis, so that someone capturing packets would have an almost
impossible job to break the key, and decode the traffic before the new key
is generated.

Public key cryptography, when used within the U.S. or Canada is very secure
(key lengths range from 128 to 1024 bits).  If your users are in locations
outside North America, and you buy from U.S. vendors, then you probably
realize that you will not be able to purchase technology with key lengths
over 40 bits.

If I've carried on a bit too much, I apologize.  It's the teacher in me.  :-)


At 12:12 PM 1/30/97 -0600, Allen D. Harpham wrote:

>I have gotten a lot of good leads to the solution of this problem.  i
>really appreciate the help on this list.
>
>In talking to the client further, one request has come up that might put a
>monkey wrench into the works.
>
>They use a windows based telnet package that they would like to use to
>access their hosts on the internal network over the internet.
>
>In that case, it appears that ssh wouldn't work.  Should I be looking at
>some kind of tcp wrapper in this case?
>
>
>BTW, the internal hosts are not running unix.  They are running a
>propriatary operation system that supports telnet.  So I assume the best
>thing would be to setup a telnet server behind the firewall and have them
>first telnet into the telnet server and then telnet to the internal host.
>Correct me if I am wrong.

I don't think setting up a "proxy" telnet server is the right solution.
That's pretty much what the firewall is already doing.
___________________________________________________________________________
Jerry Mendes, Principal Consultant          Voice: (415) 381-5500
DataComm Insights                           FAX:   (415) 381-5502
150 Seminary Drive                          Email: mendes@garnet.berkeley.edu
Mill Valley, California  94941


From firewalls-owner  Tue Feb 11 03:50:06 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id DAA07201 for firewalls-outgoing; Tue, 11 Feb 1997 03:31:26 -0800 (PST)
Received: from sghms.ac.uk (s1.sghms.ac.uk [192.153.12.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id DAA07082 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 03:30:41 -0800 (PST)
Received: from gillettpc.sghms.ac.uk by sghms.ac.uk (SGHMSV1.0) ID AA05574; Tue, 11 Feb 97 11:27:15 GMT
Date: Tue, 11 Feb 1997 11:28:24 PST
From: Mark Gillett <mgillett@sghms.ac.uk>
Subject: Fire-X Firewall
To: firewalls@greatcircle.com
Message-Id: <ECS9702111124A@sghms.ac.uk>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi all,

I've long been running a couple of TIS Gauntlet firewalls between 
ourselves and attached hospitals (obviously they need to 
protection)....

I've now been told that another site we are connecting to is 
implementing a Fire-X ? firewall and have heard nothing about this in 
any of my previous discussions on firewall technology ... or indeed in 
the last 3 months of discussion on this list.

Has anyone got any experience of this product and does anyone know its 
strengths and weakneses, in terms of configuration and implementation.

Many thanks

<Mark Gillett>


================================================================
Mark Gillett, Computer Unit, St. Georges Hospital Medical School
----------------------------------------------------------------
Contrary to popular belief, Unix is user friendly. It just 
happens to be very selective about who it decides to make 
friends with.
----------------------------------------------------------------
e-mail : mgillett@sghms.ac.uk
web :    http://www.sghms.ac.uk
================================================================



From firewalls-owner  Tue Feb 11 04:05:01 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id DAA06915 for firewalls-outgoing; Tue, 11 Feb 1997 03:28:38 -0800 (PST)
Received: from challenger.atc.fhda.edu (challenger.atc.fhda.edu [153.18.32.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id DAA06853 for <firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 03:28:10 -0800 (PST)
Received: from localhost (dszd0g@localhost) by challenger.atc.fhda.edu (8.8.0/8.7.3) with SMTP id DAA04608 for <firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 03:27:12 -0800 (PST)
Date: Tue, 11 Feb 1997 03:27:12 -0800 (PST)
From: Benjamin J Stassart <dszd0g@challenger.atc.fhda.edu>
Reply-To: Benjamin J Stassart <dszd0g@challenger.atc.fhda.edu>
To: firewalls@GreatCircle.COM
Subject: Re: netscape commerce server using javascript???
In-Reply-To: <199702102031.MAA12191@cvo.roguewave.com>
Message-ID: <Pine.SGI.3.95.970211031235.28429I-100000@challenger.atc.fhda.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Mon, 10 Feb 1997, Ron Snyder wrote:

> Date: Mon, 10 Feb 1997 12:30:13 -0800
> From: Ron Snyder <snyder@roguewave.com>
> To: firewalls@GreatCircle.COM
> Subject: netscape commerce server using javascript???
> 

> I was just getting ready to disable javascript through the firewall
> when he told me this.  Here are my questions:

> 1) Is it _really_, _really_ dumb of Netscape to REQUIRE javascript to 
> admin the server?

Well, I'm not sure that it is _required_ you can always hand edit the
config files and restart the server.  Personally though, the javascript
administration server is much more convenient and I've encountered some
quirks with the first method.

> 
> 2) Is there any way that I can have my cake (disable java*) and eat 
> it too (let him admin the server)?  These are the possibilities I can 
> see:
>    a) tell him to dial in to the web server
>       (modem should be dial-out only, so this is a bad idea)
>    b) Have him use ISDN to establish his admin sessions to the web 
>       server.
>       (What problems does the existence of his desktop ISDN 
>        connection give me?)

These would allow him to hand edit the configuration files but unless you
are going to run a ppp connection off the web server they still do not
allow him to use the admin server.

One alternative you can use if the web server is a UN*X box (There may be
some equivalent under NT but I'm a Un*x person) is to:

1) Install Netscape Navigator on the web server.

2) Allow ssh sessions from a secure workstation inside your network
running an X-server (Well as secure as you can get with X) to the
webserver.

3) ssh -f <webserver> <path to netscape binary>

Since ssh will forward the x over the ssh session you will have an
encrypted connection between your web server and your workstation.

4) Configure your administration server to only allow local connections
(The Netscape Navigator session will be running locally).

Anything I'm overlooking?

Benjamin
      -----------------------------------
Stress-n- The condition or confusion that arises when the brain
overrides the body's desire to choke the hell out of some
idiot who really needs it.



From firewalls-owner  Tue Feb 11 05:05:36 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id EAA14012 for firewalls-outgoing; Tue, 11 Feb 1997 04:43:59 -0800 (PST)
Received: from homeport.org (lighthouse.homeport.org [205.136.65.198]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id EAA13967 for <firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 04:43:24 -0800 (PST)
Received: (adam@localhost) by homeport.org (8.8.5/8.6.9) id HAA18032; Tue, 11 Feb 1997 07:39:20 -0500 (EST)
From: Adam Shostack <adam@homeport.org>
Message-Id: <199702111239.HAA18032@homeport.org>
Subject: Re: netscape commerce server using javascript???
In-Reply-To: <Pine.SGI.3.95.970211031235.28429I-100000@challenger.atc.fhda.edu> from Benjamin J Stassart at "Feb 11, 97 03:27:12 am"
To: dszd0g@challenger.atc.fhda.edu
Date: Tue, 11 Feb 1997 07:39:20 -0500 (EST)
Cc: firewalls@GreatCircle.COM
X-Mailer: ELM [version 2.4ME+ PL27 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Benjamin J Stassart wrote:

| > 2) Is there any way that I can have my cake (disable java*) and eat 
| > it too (let him admin the server)?  These are the possibilities I can 
| > see:

| One alternative you can use if the web server is a UN*X box (There may be
| some equivalent under NT but I'm a Un*x person) is to:

	(ssh solution deleted)

	Another possibility would be to buy 2 web servers, install one
in trusted land on your users desktop, allow him to admin that, and
take the changed files out to the web. (Perhaps via scp?)

	You can use this with many things dependant on interfaces you
don't want in the firewall.

Adam

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume



From firewalls-owner  Tue Feb 11 05:20:13 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id FAA15570 for firewalls-outgoing; Tue, 11 Feb 1997 05:13:04 -0800 (PST)
Received: from mnl.sequel.net (mnl.sequel.net [204.255.104.30]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id FAA15553 for <firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 05:12:52 -0800 (PST)
Received: from mnl by mnl.sequel.net (SMI-8.6/SMI-SVR4)
	id VAA28300; Tue, 11 Feb 1997 21:10:05 +0800
Date: Tue, 11 Feb 1997 21:10:05 +0800
Message-Id: <3.0.32.19970211210719.009d8ba0@pop.infocom.sequel.net>
X-Sender: succesor@pop.infocom.sequel.net
X-Mailer: Windows Eudora Pro Version 3.0 Demo (32)
To: Ashish Bisarya <ashish@syl.nj.nec.com>
From: Gaddy Gumbao <succesor@mnl.sequel.net>
Subject: Can NT3.5 see or mount 
Cc: Rajesh Joshi <rjoshi@wipinfo.soft.net>, socks@socks.nec.com,
        socks5@socks.nec.com, firewalls@GreatCircle.COM,
        ntsocks@syl.nj.nec.com
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Hi there all,
 
 Hope you can help me on this problem of mine.
even though it's off the topic.
 How can I see or mount a directory in the DEC ALPHA.
Using NT3.5 to DEC ALPHA or vice versa.

 Thanks ....




From firewalls-owner  Tue Feb 11 06:28:26 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA21444 for firewalls-outgoing; Tue, 11 Feb 1997 06:06:42 -0800 (PST)
Received: from mnl.sequel.net (mnl.sequel.net [204.255.104.30]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA20981 for <firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 06:00:51 -0800 (PST)
Received: from mnl by mnl.sequel.net (SMI-8.6/SMI-SVR4)
	id WAA01986; Tue, 11 Feb 1997 22:01:02 +0800
Date: Tue, 11 Feb 1997 22:01:02 +0800
Message-Id: <3.0.32.19970211215814.015ed220@pop.infocom.sequel.net>
X-Sender: succesor@pop.infocom.sequel.net
X-Mailer: Windows Eudora Pro Version 3.0 Demo (32)
To: Ashish Bisarya <ashish@syl.nj.nec.com>
From: Gaddy Gumbao <succesor@mnl.sequel.net>
Subject: Can NT3.5 see or mount 
Cc: firewalls@GreatCircle.COM
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Hi there all,
 
 Hope you can help me on this problem of mine.
even though it's off the topic.
 How can I see or mount a directory in the DEC ALPHA.
Using NT3.5 to DEC ALPHA or vice versa.

 Thanks ....




From firewalls-owner  Tue Feb 11 06:50:54 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA21135 for firewalls-outgoing; Tue, 11 Feb 1997 06:02:49 -0800 (PST)
Received: from mwunix.mitre.org (mwunix.mitre.org [128.29.154.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id GAA21085 for <Firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 06:02:29 -0800 (PST)
Received: from smiley.sit (smiley.mitre.org [128.29.166.123])
          by mwunix.mitre.org (8.8.5/8.8.4/mitre.0) with SMTP
	  id JAA01373 for <Firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 09:01:21 -0500 (EST)
Received: from [128.29.162.45] (wneugent-mac) by smiley.sit (4.1/SMI-4.1)
	id AA24971; Tue, 11 Feb 97 08:58:26 EST
X-Sender: wneugent@smiley.mitre.org
Message-Id: <v01510103af261a128094@[128.29.162.45]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Tue, 11 Feb 1997 09:06:12 -0400
To: Firewalls@GreatCircle.COM
From: wneugent@smiley.mitre.org (Bill Neugent)
Subject: Views on Merits of Beta Testing Solicited
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Folks,
Please pardon the off-topic posting. In the words of JFK, here's something
you can do for your country (or ours, if you're not US :-). I'm doing a
study for the Department of Defense, to advise on how much to invest in
beta testing commercial security-enabled products. Our customers for this
are senior pentagon planners (motto: we think up stuff for other people to
do).

Please send me a note telling me of your experience (pro or con) regarding
beta testing, especially of security-related stuff. If you're a vendor, I'd
like to know how your best beta testers have helped you and themselves and
maybe accelerated time-to-market of something they need. I'm especially
looking for views of beta testers who represent big commercial users rather
than developers. I'd also like to hear if you feel, frinstance, that beta
testing is really just a machismo thing having more to do with male
strutting than with corporate advantage.

Please send your comments to me, rather than further trouble this list. And
let me know if you're willing to be quoted by name to my senior customers
and possibly contacted for follow-up information. I'll post a summary.
Thanx!!

Bill



From firewalls-owner  Tue Feb 11 07:39:01 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA21597 for firewalls-outgoing; Tue, 11 Feb 1997 06:09:00 -0800 (PST)
Received: from lestat.mc2-csr.com (lestat.mc2-csr.com [204.107.238.150]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id GAA21578 for <firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 06:08:31 -0800 (PST)
Received: from merlin (merlin.mc2-csr.com [204.107.238.176]) by lestat.mc2-csr.com (8.7.3/8.7.3) with SMTP id JAA05018; Tue, 11 Feb 1997 09:01:18 -0500 (EST)
Message-Id: <3.0.32.19970211090117.00f786e0@mc2-csr.com>
X-Sender: lglaze@mc2-csr.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Tue, 11 Feb 1997 09:01:18 -0500
To: snyder@roguewave.com, firewalls@GreatCircle.COM
From: Larry Glaze <lglaze@mc2-csr.com>
Subject: Re: netscape commerce server using javascript???
Mime-Version: 1.0
Content-Type: text/enriched; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 12:30 PM 2/10/97 -0800, Ron Snyder wrote:

>2) Is there any way that I can have my cake (disable java*) and eat 

>it too (let him admin the server)?  These are the possibilities I can 

>see:

>   a) tell him to dial in to the web server

>      (modem should be dial-out only, so this is a bad idea)

>   b) Have him use ISDN to establish his admin sessions to the web 

>      server.

>      (What problems does the existence of his desktop ISDN 

>       connection give me?)

>

>What are some other options that I'm not seeing?


Have him become *really* familiar with the layout of the config files

and edit them by hand whenever he needs to make a change. It takes

longer than the nice gui, but it is just as effective. 


Larry

--

---------------------------------------------------------------------------

|<color><param>0000,0000,8080</param>Larry Glaze                      
</color>|<color><param>0000,0000,8080</param>    "...Life's a bummer..." 
         </color>|

|<color><param>0000,0000,8080</param>System/Network Administrator     
</color>|<color><param>0000,0000,8080</param>            --Smashing
Pumpkins       </color>|

|<color><param>0000,0000,8080</param>MC<smaller>2</smaller> Cyberspace,
Ltd               </color>|<color><param>0000,0000,8080</param>          
                           </color>|

|<color><param>0000,0000,8080</param>http://www.mc2-csr.com/~lglaze   
</color>|<color><param>0000,0000,8080</param>           
lglaze@mc2-csr.com        </color>|

---------------------------------------------------------------------------

|               <color><param>ffff,0000,0000</param>All opinions are my
own, as they should be!               </color>|

---------------------------------------------------------------------------

From firewalls-owner  Tue Feb 11 07:46:56 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id FAA19839 for firewalls-outgoing; Tue, 11 Feb 1997 05:52:59 -0800 (PST)
Received: from lox.sandelman.ottawa.on.ca (lox.sandelman.ottawa.on.ca [205.233.54.146]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id FAA19805 for <Firewalls@greatcircle.com>; Tue, 11 Feb 1997 05:52:45 -0800 (PST)
Received: from amaterasu.sandelman.ottawa.on.ca (amaterasu.sandelman.ottawa.on.ca [205.233.54.134]) by lox.sandelman.ottawa.on.ca (8.7.5/8.7.3) with ESMTP id IAA20874 for <Firewalls@greatcircle.com>; Tue, 11 Feb 1997 08:58:22 -0500 (EST)
Received: from amaterasu.sandelman.ocunix.on.ca (LOCALHOST [127.0.0.1]) by amaterasu.sandelman.ottawa.on.ca (8.7.5/8.6.12) with ESMTP id IAA13563 for <Firewalls@greatcircle.com>; Tue, 11 Feb 1997 08:50:56 -0500 (EST)
Message-Id: <199702111350.IAA13563@amaterasu.sandelman.ottawa.on.ca>
To: Firewalls@greatcircle.com
Subject: Re: SLr* released.  rsh,rcp,rdist over SSL
In-reply-to: Your message of "Mon, 10 Feb 1997 01:00:34 PST."
             <199702100900.BAA18933@miles.greatcircle.com> 
Date: Tue, 11 Feb 1997 08:50:51 -0500
From: Michael Richardson <mcr@sandelman.ottawa.on.ca>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

-----BEGIN PGP SIGNED MESSAGE-----


    Sameer> Date: Sun, 9 Feb 1997 13:29:51 -0800 (PST) From: Sameer R
    Sameer> Manek <manek@challenger.atc.fhda.edu> Subject: Re: SLr*
    Sameer> released.  rsh,rcp,rdist over SSL

    Sameer> Just out of curosity what advantage does the SSLr* package
    Sameer> have over the SSH package?

    Sameer> The only ones i can think of are ssl doesn't have any
    Sameer> setuid files and ssl has an rdist type program. Though 

  SSH only needs to be setuid root if you want rsh emulation. You can
just remove that bit, with no problem. There are some compile options
which tell ssh to call /usr/ucb/rsh directly instead.

    Sameer> suppose that ssh could write a rdist type program. What

  SSH + rsync = is a partial replacement for rdist. 

    Sameer> about encryption advantages of the two? Though i suppose
    Sameer> cypher punks would probably be a better place to ask.

  SSL uses X.509 certificates. I consider this to be a fault.
  SSL has lots of specs at netscape.

   :!mcr!:            |  Network security consulting and 
   Michael Richardson |      contract programming
 WWW: <A HREF="http://www.sandelman.ottawa.on.ca/People/Michael_Richardson/Bio.html">mcr@sandelman.ottawa.on.ca</A>. PGP key available.


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: latin1
Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface

iQBVAwUBMwB5NdTTll4efmtZAQEaIQH/QmmWNyOl5XMvRG5LDZNK2VwxJ5RVII+a
FS31cXoE06lDAtczbeJNeIjxC2Y8VlmEihvwC8nTGAY09Uy0Fopzqg==
=t8gW
-----END PGP SIGNATURE-----

From firewalls-owner  Tue Feb 11 08:12:08 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA21196 for firewalls-outgoing; Tue, 11 Feb 1997 06:04:00 -0800 (PST)
Received: from psyche.the-wire.com (psyche.the-wire.com [198.53.192.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA21187 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 06:03:44 -0800 (PST)
Received: from anton.the-wire.com (anton.the-wire.com [198.53.192.186]) by psyche.the-wire.com (8.6.10/8.6.12) with SMTP id JAA01566; Tue, 11 Feb 1997 09:00:10 -0500
Message-Id: <3.0.32.19970211090903.0096e40c@the-wire.com>
X-Sender: anton@the-wire.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Tue, 11 Feb 1997 09:12:32 -0500
To: Paul Flores <pflores@phoenix.net>, David Murray <dmurray@pdssoftware.com>
From: Anton J Aylward <anton@the-wire.com>
Subject: Re: Access Logfile Question
Cc: Anton J Aylward <anton@the-wire.com>, www-security@ns2.rutgers.edu,
        firewalls@greatcircle.com
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 03:40 PM 10/02/97 -0600, Paul Flores wrote:
>On Mon, 10 Feb 1997, David Murray wrote:
>
>> I can't remember where I saw it, but I recently read an 
>> interesting article about mis-uses of DNS.  Several backbone 
>> organizations put such detail into their host (and gateway and 
>> router) names, that using nslookup, it possible to physically map 
>> their network.  Not many companies are willing to publish such vital 
>> corporate information, yet this is a perfectly reasonable and 
>> accepted policy for DNS.  Personally, I don't feel the need to 
>> publish host names for every PC we have connected to the Internet.  
>> Is this wrong? I don't know.  Can I ftp to uunet?  No, but there are 
>> other mirrors with the same information.  While reverse lookup may be 
>> reasonable, its not common.
>> 
>
>What is wrong with setting the reverse DNS to = the IP address? No
information
>is given out then, and you still have access to everything.
>
>Paul
>
>        "Show me an Ethernet collision and I'll show you a network that 
>could do with one user fewer" --BOFH

Nothing.
But from a security point of view, you are disclosing that you have all
those PCs and other internal machines.    Any one of them may be poorly
configured or running vulnerable software.

A firewall with a plug-in interface presents just one IP address
to the Internet.   With suitable split DNS (see earlier posting and any
standard text on firewalls) you are not disclosing any information about
the internals of your network.




--------------------------------------------------------------------------
Anton J Aylward                  | Security is not something that comes in 
The Strahn & Strachan Group Inc  | a self-contained box. It is an attribute 
Information Security Consultants | of how you do business and as such 
Voice: (416) 494-8661            | needs to be managed carefully.
  Fax: (416) 494-8803            |      - Karen Goertzel, Wang Federal Inc.

From firewalls-owner  Tue Feb 11 08:25:42 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id FAA20539 for firewalls-outgoing; Tue, 11 Feb 1997 05:56:35 -0800 (PST)
Received: from psyche.the-wire.com (psyche.the-wire.com [198.53.192.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id FAA20236 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 05:55:11 -0800 (PST)
Received: from anton.the-wire.com (anton.the-wire.com [198.53.192.186]) by psyche.the-wire.com (8.6.10/8.6.12) with SMTP id IAA01305; Tue, 11 Feb 1997 08:51:35 -0500
Message-Id: <3.0.32.19970211090313.009640f4@the-wire.com>
X-Sender: anton@the-wire.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Tue, 11 Feb 1997 09:03:58 -0500
To: dmurray@pdssoftware.com, Anton J Aylward <anton@the-wire.com>
From: Anton J Aylward <anton@the-wire.com>
Subject: Re: Access Logfile Question
Cc: www-security@ns2.rutgers.edu, firewalls@greatcircle.com
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 11:28 AM 10/02/97 -0500, David Murray wrote:
## Reply Start ##
>> There are many services, UUNET's FTP server being just one of them, which
>> will perform
>> reverse DNS to validate requests.  If this fails you're out.  Tough -
>> that's there policy.
>> The code for this is simple.  Many other sites implement this policy.  I
>> think its perfectly
>> reasonable and recommend it.   If someone can't identify themselves they
>> MAY be a crook.
>> They may also be idiots who don't know what they're doing.
>> 
>
>I can't remember where I saw it, but I recently read an 
>interesting article about mis-uses of DNS.  Several backbone 
>organizations put such detail into their host (and gateway and 
>router) names, that using nslookup, it possible to physically map 
>their network.  Not many companies are willing to publish such vital 
>corporate information, yet this is a perfectly reasonable and 
>accepted policy for DNS.  Personally, I don't feel the need to 
>publish host names for every PC we have connected to the Internet.  
>Is this wrong? I don't know.  Can I ftp to uunet?  No, but there are 
>other mirrors with the same information.  While reverse lookup may be 
>reasonable, its not common.
>
>
>David N. Murray                       | PDS
>Sr. Software Analyst                  | 670 Sentry Parkway
>610/828-4294                          | Blue Bell, PA  19422
>dmurray@pdssoftware.com               |

Dave,

You're making an assumption here which I'm not.
Certainly as someone who installs firewalls as part of his job,
I would never set up - or at least never advise a client to set up
DNS so that it is in the situation you describe here.  
Your assumption is that the DNS you set up for internal use 
listing all your PC is the same that is visible from the Internet.
You are correct in saying that this need not be so.  Indeed, the 
set-up  of firewall based DNS should make it "not be so".

Archives of the firewall list as well as the major texts
on firewalls discuss split DNS (or split-brain DNS).  This involves
two servers, one dealing with the Internet sourced queries and giving out
only basic information, name to IP, possibly MX.  There is no reason why
this shouldn't also give out the reverse mapping at it is not a security risk.

The internal DNS server cannot be accessed from the outside world.   
(IPwrappers & the UDP equivalent can be used if you're paranoid)
Policy dictates how much information this contains.  It is usually driven by 
the needs of the internal staff, and may have such things as CNAMES or TXT 
fields giving the location of the machine, always useful to netadmin staff.
Note this is INTERNAL.

This is not new or revolutionary.  The setup manuals for all the firewalls
I deal with either recommend it or discuss using it.   Its not hard to do.
Many firewalls have the external DNS part built in, or your backbone ISP can 
supply the simple single forward and backward entry. 

I don't see how you can assert that reverse lookup is not common without 
supplying a source or other basis for this statement.  If you have such 
information I'd be glad to hear it.  I suspect also that firewall vendors
would be glad too, since their product would allow users to run with split
DNS and so access sites that either have no mirrors or sites of which the
users are unaware of mirrors.

## Reply End ##
--------------------------------------------------------------------------
Anton J Aylward                  | Security is not something that comes in 
The Strahn & Strachan Group Inc  | a self-contained box. It is an attribute 
Information Security Consultants | of how you do business and as such 
Voice: (416) 494-8661            | needs to be managed carefully.
  Fax: (416) 494-8803            |      - Karen Goertzel, Wang Federal Inc.

From firewalls-owner  Tue Feb 11 08:43:22 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA23156 for firewalls-outgoing; Tue, 11 Feb 1997 06:32:21 -0800 (PST)
Received: from calamari.Progressive-Systems.Com (calamari.Progressive-Systems.Com [206.236.37.16]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id GAA23138 for <Firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 06:32:03 -0800 (PST)
Received: (from ge@localhost) by calamari.Progressive-Systems.Com (8.7.5/8.7.3) id JAA15115 for Firewalls@GreatCircle.COM; Tue, 11 Feb 1997 09:31:04 -0500 (EST)
From: "Ge' Weijers" <ge@calamari.Progressive-Systems.Com>
Message-Id: <199702111431.JAA15115@calamari.Progressive-Systems.Com>
Subject: Re: SLr* released.
To: Firewalls@GreatCircle.COM
Date: Tue, 11 Feb 1997 09:31:04 -0500 (EST)
In-Reply-To: <199702102305.PAA15556@miles.greatcircle.com> from "Firewalls-Digest" at Feb 10, 97 03:05:08 pm
Reply-To: ge@progressive-systems.com (Ge' Weijers)
Organization: Progressive Systems, Inc.
X-Mailer: ELM [version 2.4 PL24]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Date: 10 Feb 1997 01:01:17 +0100
> From: Benedikt Stockebrand <benedikt@devnull.ruhr.de>
> Subject: Re: SLr* released.  rsh,rcp,rdist over SSL
> 

[....]

> 
> It uses port 22, which is still unassigned to my last version of the
> Assigned Numbers (RFC 1700, 1994/10).  Until now there's no RFC about
> it, but the package comes with a draft.

To quote from the latest 'port-numbers.txt' on the IANA FTP site:
(ftp://ftp.isi.edu/in-notes/iana/assignments/)

ssh              22/tcp    SSH Remote Login Protocol
ssh              22/udp    SSH Remote Login Protocol
#                          Tatu Ylonen <ylo@cs.hut.fi>

Looks like SSH was there first. RFC1700 clearly states where to get the
latest assign port number information.

Ge'

From firewalls-owner  Tue Feb 11 08:57:22 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA26174 for firewalls-outgoing; Tue, 11 Feb 1997 07:13:37 -0800 (PST)
Received: from snd-fw.med.navy.mil ([159.71.152.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id HAA26150 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 07:13:26 -0800 (PST)
Received: by snd-fw.med.navy.mil; id HAA13466; Tue, 11 Feb 1997 07:16:45 -0800 (PST)
Received: from unknown(192.108.14.10) by snd-fw.med.navy.mil via smap (3.2)
	id xma013440; Tue, 11 Feb 97 07:16:19 -0800
Received: from [159.71.39.242] by snd10.med.navy.mil with SMTP (5.65/1.2-eef)
	id AA04327; Tue, 11 Feb 97 06:49:31 -0800
Message-Id: <2.2.32.19970211150718.0072544c@192.108.14.10>
X-Sender: snd1trz@192.108.14.10
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Tue, 11 Feb 1997 07:07:18 -0800
To: firewalls@greatcircle.com
From: "Todd R. Zimmerman" <snd1trz@snd10.med.navy.mil>
Subject: Port 135
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Excuse my ignorance if this has already been covered.

I just read a message from another user on the mailing list in regards to
attacks on NT servers via port 135.  What are the vulnerabilities of Port
135, and how can I minimize the threats?  Where can I obtain more
information on this vulnerability?



 _/_/_/_/  _/_/_/_/  _/_/_/_/  Todd R. Zimmerman
   _/     _/    _/       _/    Network Manager / Computer Specialist
  _/     _/_/_/_/      _/      Naval Medical Center, San Diego
 _/     _/    _/     _/        (619)532-9314  Pager 979-2195
_/     _/     _/   _/_/_/_/    snd1trz@snd10.med.navy.mil

** Disclaimer: The views expressed here do not reflect the    **
** official policy or position of DoD or the U.S. Government. **


From firewalls-owner  Tue Feb 11 10:11:10 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA26888 for firewalls-outgoing; Tue, 11 Feb 1997 07:20:01 -0800 (PST)
Received: from ns.ge.com (ns.ge.com [192.35.39.24]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id HAA26828 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 07:19:45 -0800 (PST)
From: CCCRE.CCULL@capital.ge.com
Received: from thomas.ge.com (thomas.ge.com [3.47.28.21]) by ns.ge.com (8.8.4/8.7.3) with ESMTP id KAA04023 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 10:16:49 -0500 (EST)
Received: from LMSPROD.CAPITAL.GE.COM ([3.113.164.115]) by thomas.ge.com (8.8.4/8.7.5) with SMTP id KAA12027 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 10:19:37 -0500 (EST)
X400-Originator: CCCRE.CCULL@capital.ge.com
X400-Recipients: firewalls@greatcircle.com
X400-MTS-Identifier: [/PRMD=GECAPITAL/ADMD=MARK400/C=US/;0013800002514307000002]
X400-Content-Type: P2-1988 (22)
Message-ID: <0013800002514307000002*@MHS>
To: "firewalls(a)greatcircle.com" <firewalls@greatcircle.com>
Subject: Socks?
Date: Tue, 11 Feb 1997 10:33:25 -0500
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

     <don't flame the newbie>
     any opinions on "Socks"???  I'm setting up a web server and we don't
     have much money to spend on a firewall.  In fact,  i'm seriously
     thinking about not even using a firewall,  and just assuming i'll have
     to reload the thing from tape if someone torches it.  Is socks
     free???? is there such thing as a free firewall???  i'm a novell/nt
     type person (NO unix experience) and the idea of free software is
     foreign to me.  but if i can get the os for free (linux) and the
     firewall for free,  and i'm assuming my web server is compromised
     anyway,  this seems like a hell of a time to learn unix.....

From firewalls-owner  Tue Feb 11 10:54:36 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA01969 for firewalls-outgoing; Tue, 11 Feb 1997 08:00:33 -0800 (PST)
Received: from sig.bsh.com (ns2.bsh.com [206.33.103.14]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id IAA01953 for <Firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 08:00:24 -0800 (PST)
Received: from dev.sig.bsh.com (dev.sig.bsh.com [206.33.103.21]) by sig.bsh.com (8.7.5/8.7.3/http://www.LeftBank.com) with SMTP id KAA15006 for <Firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 10:58:47 -0500 (EST)
Date: Tue, 11 Feb 1997 10:57:57 -0500 (EST)
From: Jason Vagner <jlv@sig.bsh.com>
To: Firewalls@GreatCircle.COM
Subject: Re: Firewalls-Digest V6 #53
In-Reply-To: <199702110900.BAA28274@miles.greatcircle.com>
Message-ID: <Pine.SGI.3.95.970211104546.12721E-100000@dev.sig.bsh.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


   >Date: Mon, 10 Feb 1997 12:30:13 -0800
   >From: "Ron Snyder" <snyder@roguewave.com>
   > 
   >I was just informed by our webmaster that the netscape commerce
   >server uses javascript for remote admin.  In order for him to

Actually, this is probably just a technical distinction, but the
Commerce server proper does not: the Fast Track and Enterprise
servers do.

[--cut--]

   >I was just getting ready to disable javascript through the
   >firewall when he told me this.  Here are my questions: 
   >
   >1) Is it _really_, _really_ dumb of Netscape to REQUIRE
   >javascript to admin the server? 

People begged and pleaded for a nicer admin interface. They gave the
world one. Bites, eh?

   >2) Is there any way that I can have my cake (disable java*) and
   >eat it too (let him admin the server)?  These are the
   >possibilities I can
   >see: 
   >   a) tell him to dial in to the web server
   >      (modem should be dial-out only, so this is a bad idea) 
   >   b) Have him use ISDN to establish his admin sessions to the
   >      web server. 
   >      (What problems does the existence of his desktop ISDN
   >       connection give me?) 
   >
   >What are some other options that I'm not seeing? 

Some thoughts:

1) dialing in would be a terrible option, IMHO. Modems are slow,
they fail, they hang up, offer a direct line to the machine, etc.

2) If you are willing to punch a tiny hole in the firewall, you
could permit javascript to their (the admin's) desktop, or you could
permit the admin to connect to the web server and remotely launch a
Netscape app to the admin's screen. This could be managed through
SSH, which would tunnel/encrypt the X session and offer increased
authentication options.

3) You could grant the admin physical access to the web server.

4) The admin could learn to admin the .conf files by hand (not
recommended, though).

5) The admin could maintain a staging server inside the network,
configure it properly, manually change ip/hostname info and then
deliver them by some other mechanism.


From firewalls-owner  Tue Feb 11 11:07:58 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA22969 for firewalls-outgoing; Tue, 11 Feb 1997 06:29:24 -0800 (PST)
Received: from deere-bh.dx.deere.com (deere-bh.dx.deere.com [207.122.201.66]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA22935 for <firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 06:28:52 -0800 (PST)
Received: (from uucp@localhost) by deere-bh.dx.deere.com (8.6.12/8.6.11) id IAA06546; Tue, 11 Feb 1997 08:23:13 -0600
Received: from 192.43.1.3 by deere-bh.dx.deere.com via smap (V1.3)
	id sma005552; Tue Feb 11 08:21:45 1997
Received: from 90.deere.com (dts.90.deere.com) by deere.dx.deere.com (4.1/SMI-4.0)
	id AA17342; Tue, 11 Feb 97 08:20:10 CST
Received: from catbert.uu.deere.com by 90.deere.com (SMI-8.6/SMI-SVR4)
	id IAA11736; Tue, 11 Feb 1997 08:17:32 -0600
Message-Id: <33008017.53D2@90.deere.com>
Date: Tue, 11 Feb 1997 08:20:07 -0600
From: Bertrum Carroll <bc17684@90.deere.com>
Organization: Deere & Company
X-Sender: Bertrum Carroll <bc17684@90.deere.com>
X-Mailer: Mozilla 4.0b1 (Win95; I)
Mime-Version: 1.0
To: dharris@kcp.com
Cc: firewalls@GreatCircle.COM, Gary White <white@Arco.COM>
Subject: Re: vendor access ??
X-Priority: Normal
References: <199702102005.AA06463@kcpgw2.kcp.com>
Content-Type: multipart/mixed; boundary="----------191C65BB6052"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

This is a multi-part message in MIME format.
------------191C65BB6052
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=us-ascii

Why not just give the vendor the keys to your office?

It's one thing to have a modem ready but unplugged.  Then you know what 
the vendor is doing and when its being done.  The real question is do 
you trust everyone the vendor hires and trust that their network is 
safe.  

"Didn't I see this in an AIDS warning?"


<Insert standard legal disclaimers; not the view of my employer, don't 
sue me I don't have any money>
------------191C65BB6052
Content-Transfer-Encoding: 7bit
Content-Description: Address Book Card for Bertrum Carroll
Content-Disposition: inline; filename="nsmailRQ.TMP"
Content-Type: text/x-vCard; charset=us-ascii; name="nsmailRQ.TMP"

BEGIN:VCARD
FN:Bertrum Carroll
N:Carroll;Bertrum
EMAIL;INTERNET:bc17684@90.deere.com
NOTE:Deere & Company Computer Security
X-NAV-HTML:T
END:VCARD


------------191C65BB6052--


From firewalls-owner  Tue Feb 11 13:37:04 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA03363 for firewalls-outgoing; Tue, 11 Feb 1997 08:13:33 -0800 (PST)
Received: from imc.eyron.com (mail.eyron.com [192.116.223.180]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id IAA03328 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 08:13:13 -0800 (PST)
Received: by imc.eyron.com with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63)
	id <01BC1847.3A4694A0@imc.eyron.com>; Tue, 11 Feb 1997 18:13:05 +0200
Message-ID: <c=US%a=_%p=EYRON%l=MASTER7-970211160717Z-296@imc.eyron.com>
From: Dov Sharon <DovS@EYRON.COM>
To: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: mail trough filtering CISCO
Date: Tue, 11 Feb 1997 18:07:17 +0200
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi

I have programmed my CISCO router to let only tcp port 25 into  my
network
and any protocol out of the network including full access for tcp
established connections.

The result was that outgoing mails were stuck at the mail gateway.

Are there in other port, protocols I should permit in order for smtp to
oprate corectly ?

Thanks
Dov
System Admin
Eyron Ltd


From firewalls-owner  Tue Feb 11 13:45:45 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA24909 for firewalls-outgoing; Tue, 11 Feb 1997 06:59:10 -0800 (PST)
Received: from mail1 (mail1.ci.chi.il.us [199.177.48.3]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA24894 for <Firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 06:58:52 -0800 (PST)
Received: by mail1 (SMI-8.6/SMI-SVR4)
	id IAA13636; Tue, 11 Feb 1997 08:52:56 -0600
From: minaba@mail1.ci.chi.il.us (Mark Inaba)
Message-Id: <199702111452.IAA13636@mail1>
Subject: Re: simple fw1 question (really simple, ignore if you're rushed) :) (fwd)
To: Firewalls@GreatCircle.COM (fw)
Date: Tue, 11 Feb 1997 08:52:56 -0600 (CST)
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

oops, i sent this to the wrong address...resending to the
fw mailing list
> > 
> > 	i just got into the driver's seat of sun's firewall software
> > and I'd like to make a rule to allow tn3270 telnets from a bunch/group
> > of workstations to our ibm mainframe. Is there a way to limit
> > the time that the access is active? I don't really want to (and I'm
> > not even sure if I can) authenticate individual users who pass thru,
> > I just want to limit access of that type of access to mon-fri...
> > can do? how? :)
> > thanks!
> > 
> > -Mark
> > 
> > 
> 
> 


From firewalls-owner  Tue Feb 11 13:46:16 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA03367 for firewalls-outgoing; Tue, 11 Feb 1997 08:13:38 -0800 (PST)
Received: from imc.eyron.com (mail.eyron.com [192.116.223.180]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id IAA03332 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 08:13:18 -0800 (PST)
Received: by imc.eyron.com with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63)
	id <01BC1847.3A4694A0@imc.eyron.com>; Tue, 11 Feb 1997 18:13:05 +0200
Message-ID: <c=US%a=_%p=EYRON%l=MASTER7-970211160639Z-295@imc.eyron.com>
From: Dov Sharon <DovS@EYRON.COM>
To: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: mail trough filtering CISCO
Date: Tue, 11 Feb 1997 18:06:39 +0200
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi

I have programmed my CISCO router to let only tcp port 25 into  my
network
and any protocol out of the network including full access for tcp
established connections.

The result was that outgoing mails were stuck at the mail gateway.

Are there in other port, protocols I should permit in order for smtp to
oprate corectly ?

Thanks
Dov
System Admin
Eyron Ltd



From firewalls-owner  Tue Feb 11 13:47:33 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA25157 for firewalls-outgoing; Tue, 11 Feb 1997 07:01:47 -0800 (PST)
Received: from mail1 (mail1.ci.chi.il.us [199.177.48.3]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id HAA25139 for <Firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 07:01:29 -0800 (PST)
Received: by mail1 (SMI-8.6/SMI-SVR4)
	id IAA13647; Tue, 11 Feb 1997 08:55:29 -0600
From: minaba@mail1.ci.chi.il.us (Mark Inaba)
Message-Id: <199702111455.IAA13647@mail1>
Subject: Re: update on cisco password changers :) (fwd)
To: Firewalls@GreatCircle.COM (fw)
Date: Tue, 11 Feb 1997 08:55:28 -0600 (CST)
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

oops, i sent this to the wrong address...resending to the
fw mailing list
> > 
> > oh! the reason I'm late in sending out my scripts for the cisco
> > router password changers is that to make it work, I have to send
> > out some other stuff too since its not just a password changer,
> > it needs procs that build up datafiles for the routers which
> > need to have the passwords imbedded and be encrypted, the actual
> > password changing parts are really tiny compared to the rest..
> > plus I want to double check that it doesn't do anything catastrophic..
> > and even then, how can I ever be sure.. :)
> > -Mark
> >  
> > 
> 
> 
actually are there any brave souls out there who would like to test
this on a router of theirs before I send it out to more people..and
let me know what problems I need to fix or account for or incorporate?
I already found a sysv vs bsd specific part so, i'm assuming everyone 
can run this on a sysv machine (sigh)  and I can add it to me list
of things to add too
-Mark

From firewalls-owner  Tue Feb 11 14:19:31 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA24949 for firewalls-outgoing; Tue, 11 Feb 1997 06:59:44 -0800 (PST)
Received: from citadel.oms.co.za (gram.aztec.co.za [196.3.254.235]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA24908 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 06:59:02 -0800 (PST)
Received: (from nobody@localhost) by citadel.oms.co.za (8.6.12/8.6.9) id PAA04701; Tue, 11 Feb 1997 15:23:45 +0200
Received: by citadel via recvmail id 4677; Tue Feb 11 15:23:39 1997
Received: (from ian@localhost) by ian.oms.co.za (8.6.12/8.6.9) id PAA00782; Tue, 11 Feb 1997 15:23:21 +0200
From: Ian Cooper <ian@oms.co.za>
Message-Id: <199702111323.PAA00782@ian.oms.co.za>
Subject: Re: Fire-X Firewall
To: mgillett@sghms.ac.uk (Mark Gillett)
Date: Tue, 11 Feb 1997 15:23:20 +0200 (SAT)
Cc: firewalls@greatcircle.com
In-Reply-To: <ECS9702111124A@sghms.ac.uk> from "Mark Gillett" at Feb 11, 97 11:28:24 am
X-Mailer: ELM [version 2.4 PL24]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


The Fire-X firewall is the GFX firewall from Global Technology Associates.
It is rebranded as a FIre-X firewall and resold under that label in the UK.

In terms of how good it is, I've had practical experience, and it is a solid,
fast performing NCSA certified firewall.


> I've now been told that another site we are connecting to is 
> implementing a Fire-X ? firewall and have heard nothing about this in 
> any of my previous discussions on firewall technology ... or indeed in 
> the last 3 months of discussion on this list.
> 


-- 
Ian Cooper (ian@oms.co.za)                             Tel: +27 21 23-6065
Open Mind Solutions                                    Fax: +27 21 24-3656
Internet Firewalls                                     Unit 3, 46 Orange Street
http://www.oms.co.za                                   Cape Town, South Africa

From firewalls-owner  Tue Feb 11 14:54:50 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA24245 for firewalls-outgoing; Tue, 11 Feb 1997 06:50:24 -0800 (PST)
Received: from mail.baileynm.com (fw.baileynm.com [206.109.159.11]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA24186 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 06:50:07 -0800 (PST)
Received: (qmail 5348 invoked from smtpd); 11 Feb 1997 14:49:04 -0000
Received: from web.nmti.com (root@198.178.0.201)
  by fw.nmti.com with SMTP; 11 Feb 1997 14:49:04 -0000
Received: from sonic.nmti.com (peter@sonic.nmti.com [198.178.0.2]) by web.nmti.com (8.6.12/8.6.9) with SMTP id IAA13536; Tue, 11 Feb 1997 08:48:36 -0600
Received: by sonic.nmti.com; id AA25216; Tue, 11 Feb 1997 08:42:59 -0600
From: peter@baileynm.com (Peter da Silva)
Message-Id: <9702111442.AA25216@sonic.nmti.com.nmti.com>
Subject: Re: SLr* released. rsh,rcp,rdist over SSL
To: sjg@zen.quick.com.au (Simon J. Gerraty)
Date: Tue, 11 Feb 1997 08:42:59 -0600 (CST)
Cc: firewalls@greatcircle.com, peter@baileynm.com, sjg@quick.com.au
In-Reply-To: <199702102316.KAA13252@zen.quick.com.au> from "Simon J. Gerraty" at Feb 11, 97 10:16:06 am
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Actually the question was about SSLr*, but the guy was talking about
> ssh.

Ah.

> If there is much demand for it, ssl_rcmd() could probably be modified
> to handle HTTPS's CONNECT protocol, so you could possibly just use
> your WEB proxy - I'll look into that.  Anyway you do it though, you
> can forget your secondary error/signal channel...

I'm not interested in out-proxies. I can use socks for that if I want to.
I don't like HTTPS and I don't like socks, but they'll do...

What I'm talking about is separating the encryption and authentication,
so you can establish an encrypted channel to the firewall, look at the
authentication information there, then establish a new encrypted channel
to the destination based on that, like the way ftp-gw works. This doesn't
have to be totally transparent... you can do a login "user@dest" at the
firewall. Let it print a message, syslog, popup, whatever, saying
that it's going through a proxy, so you can be aware that a man-in-the-
middle attack might be going on.

This would make things a LOT easier for support people in the field, and
would reduce the complexity of the firewall.

> For interactive sessions, you can proxy ssh btw.  At one site where I
> work I have set up tn-gw to treat port 22 as a "raw" port, and the
> guys who use ssh have hacked themeslves a simple proxy that negotiates
> the connection via tn-gw, and then hands the socket to ssh - I think
> that is how it works.

I'd be interested in seeing that code.

From firewalls-owner  Tue Feb 11 14:59:34 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA24891 for firewalls-outgoing; Tue, 11 Feb 1997 06:58:41 -0800 (PST)
Received: from mail1 (mail1.ci.chi.il.us [199.177.48.3]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA24839 for <Firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 06:58:21 -0800 (PST)
Received: by mail1 (SMI-8.6/SMI-SVR4)
	id IAA13629; Tue, 11 Feb 1997 08:52:31 -0600
From: minaba@mail1.ci.chi.il.us (Mark Inaba)
Message-Id: <199702111452.IAA13629@mail1>
Subject: Re: simple fw1 question (really simple, ignore if you're rushed) :) (fwd)
To: Firewalls@GreatCircle.COM (fw)
Date: Tue, 11 Feb 1997 08:52:31 -0600 (CST)
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Forwarded message:
> From mcb@GreatCircle.COM Fri Feb  7 21:05 CST 1997
> Message-Id: <199702080311.TAA20281@miles.greatcircle.com>
> From: mcb@GreatCircle.COM (Michael C. Berch)
> Date: Fri, 7 Feb 1997 19:11:15 +0000
> In-Reply-To: <199702071717.LAA02022@mail1>
> X-Mailer: Mail User's Shell (7.2.5 10/14/92)
> To: minaba@mail1.ci.chi.il.us (Mark Inaba)
> Subject: Re: simple fw1 question (really simple, ignore if you're rushed) :)
> Content-Type: text
> Content-Length: 1700
> 
> This message appears to be intended for the Firewalls mailing list,
> however it was sent to Firewalls-Owner@GreatCircle.com, which is the
> mailbox of the list manager for the list.  If you would like to
> message to appear in the Firewalls list, you will need to re-send
> it to Firewalls@GreatCircle.COM (and perhaps correct your local mail
> alias, if any, or override the default reply field of your mail program).
> 
> --
> Michael C. Berch
> Postmaster and list manager, Great Circle Associates
> mcb@greatcircle.com
> 
> 
> 
> > From firewalls-owner Fri Feb  7 09:23:36 1997
> > Received: from mail1 (mail1.ci.chi.il.us [199.177.48.3]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id JAA12843 for <firewalls-owner@GreatCircle.COM>; Fri, 7 Feb 1997 09:23:32 -0800 (PST)
> > Received: by mail1 (SMI-8.6/SMI-SVR4)
> > 	id LAA02022; Fri, 7 Feb 1997 11:17:37 -0600
> > From: minaba@mail1.ci.chi.il.us (Mark Inaba)
> > Message-Id: <199702071717.LAA02022@mail1>
> > Subject: simple fw1 question (really simple, ignore if you're rushed) :)
> > To: firewalls-owner@GreatCircle.COM
> > Date: Fri, 7 Feb 1997 11:17:37 -0600 (CST)
> > X-Mailer: ELM [version 2.4 PL25]
> > MIME-Version: 1.0
> > Content-Type: text/plain; charset=US-ASCII
> > Content-Transfer-Encoding: 7bit
> > Status: O
> > 
> > 	i just got into the driver's seat of sun's firewall software
> > and I'd like to make a rule to allow tn3270 telnets from a bunch/group
> > of workstations to our ibm mainframe. Is there a way to limit
> > the time that the access is active? I don't really want to (and I'm
> > not even sure if I can) authenticate individual users who pass thru,
> > I just want to limit access of that type of access to mon-fri...
> > can do? how? :)
> > thanks!
> > 
> > -Mark
> > 
> > 
> 
> 


From firewalls-owner  Tue Feb 11 15:16:29 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA05746 for firewalls-outgoing; Tue, 11 Feb 1997 08:34:09 -0800 (PST)
Received: from nebula.is.rpslmc.edu (nebula.is.rpslmc.edu [144.74.19.111]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id IAA05718 for <Firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 08:33:53 -0800 (PST)
Received: (qmail 7728 invoked by uid 2001); 11 Feb 1997 16:36:32 -0000
Date: Tue, 11 Feb 1997 10:36:32 -0600 (CST)
From: "Daniel G. Drumm" <dgd@nebula.is.rpslmc.edu>
To: Firewalls@GreatCircle.COM
Subject: RFE
In-Reply-To: <v01510103af261a128094@[128.29.162.45]>
Message-ID: <Pine.GSO.3.95.970211103228.7725A-100000@nebula.is.rpslmc.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

A Request for Experiences:

Has anybody attempted to do the following:

Run a FW product (FW-1, TIS, etc) at Fast Ethernet speeds on a NT box?

Run a FW product at OC3 speeds using Sun or Fore ATM cards in a Ultra or
Intel NT box? Without IP addresses on the interfaces?

I have a myriad of questions related to this, but finding others doing the
same has been difficult. Thanks.

--
Daniel G. Drumm - ddrumm@rush.edu
Rush Presbyterian St. Luke's Medical Center - Chicago, IL
Network Division - Information Services


From firewalls-owner  Tue Feb 11 15:37:00 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id KAA22847 for firewalls-outgoing; Tue, 11 Feb 1997 10:38:48 -0800 (PST)
Received: from loach.cichlid.com (loach.cichlid.com [165.227.20.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id KAA22783 for <firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 10:38:28 -0800 (PST)
Received: (from news@localhost) by loach.cichlid.com (8.7.4/8.7.3) id KAA04178; Tue, 11 Feb 1997 10:34:07 -0800
To: firewalls@GreatCircle.COM
Path: cichlid
From: cccre.ccull@capital.ge.com
Newsgroups: mail.firewalls
Subject: None
Date: 11 Feb 1997 10:34:03 -0800
Lines: 32
Message-ID: <5dqe2r$p61@cichlid.cichlid.com>
NNTP-Posting-Host: cichlid.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Message-ID: <f873b4036a478075@deliver.cichlid.com>
Lines:  22
Xdeliver: processed on Tue Feb 11 10:33:53 PST 1997
Xdeliver: SENDER firewalls-owner@greatcircle.com
Xdeliver: to 
Xdeliver: cc 
Xdeliver: apparent_to 
Xdeliver: from cccre.ccull@capital.ge.com

X400-Originator: CCCRE.CCULL@capital.ge.com
X400-Recipients: firewalls@greatcircle.com
X400-MTS-Identifier: [/PRMD=GECAPITAL/ADMD=MARK400/C=US/;0013800002514307000002]
X400-Content-Type: P2-1988 (22)
Message-ID: <0013800002514307000002*@MHS>
To: "firewalls(a)greatcircle.com" <firewalls@greatcircle.com>
Subject: Socks?
Date: Tue, 11 Feb 1997 10:33:25 -0500
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

     <don't flame the newbie>
     any opinions on "Socks"???  I'm setting up a web server and we don't
     have much money to spend on a firewall.  In fact,  i'm seriously
     thinking about not even using a firewall,  and just assuming i'll have
     to reload the thing from tape if someone torches it.  Is socks
     free???? is there such thing as a free firewall???  i'm a novell/nt
     type person (NO unix experience) and the idea of free software is
     foreign to me.  but if i can get the os for free (linux) and the
     firewall for free,  and i'm assuming my web server is compromised
     anyway,  this seems like a hell of a time to learn unix.....


From firewalls-owner  Tue Feb 11 15:49:26 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA15043 for firewalls-outgoing; Tue, 11 Feb 1997 09:43:06 -0800 (PST)
Received: from shadow.cyberdesic.com (shadow.cyberdesic.com [206.68.129.9]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id JAA15026 for <Firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 09:42:53 -0800 (PST)
Received: (from tom@localhost) by shadow.cyberdesic.com (8.6.12/8.6.12) id LAA29111; Tue, 11 Feb 1997 11:41:34 -0600
Date: Tue, 11 Feb 1997 11:41:34 -0600
From: Tom Friday <tom@shadow.cyberdesic.com>
Message-Id: <199702111741.LAA29111@shadow.cyberdesic.com>
To: Firewalls@GreatCircle.COM
Subject: Re: Re: Home-grown vs. Turn-Key Firewalls
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



[discussion of home-grown versus off-the-shelf solutions]

>Bottom line it may cost more, but if it saves a sales or reduces
>explanation to a customer it may be worth it.
>
>Don't get me wrong I do not disagree with your approach, but less costly
>solutions and shareware, freeware solutions are not always viewed
>postively.  The last thing you want is a competitor saying hey we use such
>and such and they use shareware or freeware.  

This is a valid point, which is why it's good to have technical people
that can explain your firewalling setup in a comprehensible way to a
client.  Done properly, this should inspire confidence in the client of the
effectiveness of your solution.

If you're talking to a technically savvy client, this should be easy.
If you're not, they won't understand anything you say about security
anyway, so it won't matter.  



From firewalls-owner  Tue Feb 11 16:01:27 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA13584 for firewalls-outgoing; Tue, 11 Feb 1997 09:27:49 -0800 (PST)
Received: from hidata.com (hidata.com [205.158.61.34]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id JAA13556 for <firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 09:27:38 -0800 (PST)
Received: by hidata.com; id AA18692; Tue, 11 Feb 97 09:26:29 PST
Received: from oscntsrv.hidata.com(205.158.60.100) by hds-gw.hidata.com via smap (3.2)
	id xma018690; Tue, 11 Feb 97 09:26:03 -0800
Received: by oscntsrv.hidata.com with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63)
	id <01BC17FD.81DDE920@oscntsrv.hidata.com>; Tue, 11 Feb 1997 09:25:23 -0800
Message-Id: <c=US%a=_%p=Hitachi_Data_Sys%l=OSCNTSRV-970211172522Z-472@oscntsrv.hidata.com>
From: "Stout, Bill" <bill.stout@hidata.com>
To: "'Firewall List'" <firewalls@GreatCircle.COM>
Subject: FW: NT Security list
Date: Tue, 11 Feb 1997 09:25:22 -0800
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



>----------
>From: 	Stout, Bill
>Sent: 	Tuesday, February 11, 1997 9:24 AM
>To: 	'NT Security List'
>Cc: 	'David LeBlanc'
>Subject: 	NT Security list
>
>Due to some very short-sighted <!@#$> political politicial decisions and
><!@#$> Microsoft-can-do-no-wrong fans, the pages explaining and promoting the
>repair of security holes within NT at
>http://www.hidata.com/guest/ntexploits.htm will disappear. I will delay the
>disappearance so that others may copy the data.
>
>I have placed no copyright on the data within these pages which I compliled
>and created.  I encourage you to please copy these pages widely onto your
>webservers urgently.
>
>Can ISS please post the data from these pages in their vulnerability
>database?  The two bugs listed (Microsoft IIS Web publisher vulnerability,
>WindowsNT CD .. Bug) ain't cutting it.
>
>Bill Stout
>
>!@#$ - Insert many politically incorrect verbs here.
>

From firewalls-owner  Tue Feb 11 16:15:45 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA10583 for firewalls-outgoing; Tue, 11 Feb 1997 09:05:23 -0800 (PST)
Received: from holly.cc.uleth.ca (holly.cc.uleth.ca [142.66.7.100]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id JAA10456 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 09:04:42 -0800 (PST)
Received: from rose.cserve.uleth.ca (rose.cserve.uleth.ca [142.66.26.250]) by holly.cc.uleth.ca (8.6.10/8.6.10) with ESMTP id KAA19660; Tue, 11 Feb 1997 10:09:39 -0700
Message-ID: <3300A653.2AC3@hg.uleth.ca>
Date: Tue, 11 Feb 1997 10:03:16 -0700
From: "Jeffrey L. Oliver" <oliver@hg.uleth.ca>
Organization: University of Lethbridge
X-Sender: "Jeffrey L. Oliver" <oliver@hg.uleth.ca> (Unverified)
X-Mailer: Mozilla 4.0b1 (Win95; I)
MIME-Version: 1.0
To: "fw-1-mailinglist@us.checkpoint.com" <fw-1-mailinglist@us.checkpoint.com>,
        "firewalls@greatcircle.com" <firewalls@greatcircle.com>
Subject: rule set
X-Priority: Normal
Content-Type: multipart/mixed; boundary="----------10C514114CFA6"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

This is a multi-part message in MIME format.
------------10C514114CFA6
Content-Type: multipart/alternative; boundary="----------4BFF1710532F7"


------------4BFF1710532F7
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=us-ascii

G'Day,

Is there a prefered order for the rule set in FW-1?

regards,
Jeff


------------4BFF1710532F7
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset=us-ascii

<HTML><BODY>

<DT>G'Day,</DT>

<DT>&nbsp;</DT>

<DT>Is there a prefered order for the rule set in FW-1?</DT>

<DT>&nbsp;</DT>

<DT>regards,</DT>

<DT>Jeff</DT>

<DT>&nbsp;</DT>

</BODY>
</HTML>
------------4BFF1710532F7--

------------10C514114CFA6
Content-Transfer-Encoding: 7bit
Content-Description: Address Book Card for Jeffrey L. Oliver
Content-Disposition: inline; filename="nsmailFS.TMP"
Content-Type: text/x-vCard; charset=us-ascii; name="nsmailFS.TMP"

BEGIN:VCARD
FN:Jeffrey L. Oliver
N:Oliver;Jeffrey L.
ORG:University of Lethbridge
ADR:;;4401 University Drive;Lethbridge;Alberta;T1K 3M4
EMAIL;INTERNET:oliver@hg.uleth.ca
TITLE:System Support Specialist
TEL;WORK:(403) 329-5162
TEL;FAX:(403) 382-7108
X-NAV-HTML:T
END:VCARD


------------10C514114CFA6--


From firewalls-owner  Tue Feb 11 16:42:55 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA11518 for firewalls-outgoing; Tue, 11 Feb 1997 09:12:05 -0800 (PST)
Received: from mail.visi.net (london.visi.net [206.246.194.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id JAA11495 for <firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 09:11:40 -0800 (PST)
Received: from LOCALNAME (ppp-2-42.nn.visi.net [206.246.196.106]) by mail.visi.net (8.7.6/8.7.3) with SMTP id MAA18540; Tue, 11 Feb 1997 12:03:35 -0500 (EST)
Message-ID: <3300D179.1FF@visi.net>
Date: Tue, 11 Feb 1997 12:07:21 -0800
From: Rodney Meryweather <rodrcc@visi.net>
Reply-To: rodrcc@visi.net
X-Mailer: Mozilla 3.0Gold (Win16; I)
MIME-Version: 1.0
To: "K.M." <goertzek@wangfed.com>
CC: firewalls@GreatCircle.COM
Subject: Re: TEMPEST
References: <9702071232.AA08883@uc0009.wangfed.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

K.M. wrote:
> 
> In message <199702061621.JAA05056@coltano.stortek.com> Jim Wamsley 303-673-8163
> writes:
> > You're all wrong
> >
> > NCSC Pub 1 defines tempest as a short title for the study of unintentional,
> > possibly compromising, spurious emanations.
> >
> > take it as gospel folks - they originated it.  according to folklore, when
> > it was discovered that EMI could be captured and analyzed, the resulting
> > furor and panic was likened to a tempest in a teapot.  hence the short title.
> 
> What you write does not prove that any of us are wrong.  We were expanding the
> TEMPEST acronym.  You defined what you believe TEMPEST is.  These two are not in
> conflict, and your definition does nothing to disprove or negate the *CORRECT*
> expansion of the acronym.
> 
> KM
> 
> =====
> 
> K.M. Goertzel
> Manager, Business Development
> Secure Systems & Services Operation
> WANG FEDERAL, Inc.
> 7900 Westpark Drive - MS 700
> McLean, VA  22102-4299  USA
> tel (703)827 3914
> fax (703)827 3161
> email goertzek@wangfed.com
High 
	I do believe that you would find TEMPEST to be as defined in the
NSTISSI No. 4009, National Information Systems Security (INFOSEC)
Glossary, dated 5 June 1995. 
	As the Short Name referring to "investigation, study, and control of
compromising emanations from telecommunications and automated
information systems equipment."
	I'd say it's fairly broad to cover a large area of fundamentals and
advaced concepts.
				Rod Meryweather
				Information Systems Security Officer

From firewalls-owner  Tue Feb 11 16:51:07 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA11035 for firewalls-outgoing; Tue, 11 Feb 1997 09:08:23 -0800 (PST)
Received: from kcpgw2.kcp.com (kcpgw2.kcp.com [198.62.69.67]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id JAA10752 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 09:06:53 -0800 (PST)
From: dharris@kcp.com
Received: by kcpgw2.kcp.com id AA18861
  (InterLock SMTP Gateway 3.0 for firewalls@greatcircle.com);
  Tue, 11 Feb 1997 11:05:37 -0600
Message-Id: <199702111705.AA18861@kcpgw2.kcp.com>
Received: by kcpgw2.kcp.com (Protected-side Proxy Mail Agent-2);
  Tue, 11 Feb 1997 11:05:37 -0600
Received: by kcpgw2.kcp.com (Protected-side Proxy Mail Agent-1);
  Tue, 11 Feb 1997 11:05:37 -0600
Mime-Version: 1.0
Date: Tue, 11 Feb 1997 11:01:25 -0600
Subject: Re: netscape commerce server using javascript???
To: firewalls@greatcircle.com, Ron Snyder <snyder@roguewave.com>
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Content-Description: cc:Mail note part
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Reply to 2)b) If he stays on your internal network and uses ISDN to connect to 
outside provider then there is a potential hole into your internal network.  
Usability depends on services running on his box.  One possibility is to use his
box as a springboard to any internal systems for which his box has 'r' command 
privileges.

                                Delmer


______________________________ Reply Separator _________________________________
Subject: netscape commerce server using javascript???
Author:  "Ron Snyder" <snyder%roguewave.com@cerberus2.kcp.com> at INTERNET-MAIL
Date:    2/10/97 12:30 PM


Sorry if this is a FAQ, but I've been reading for a while and don't 
recall seeing this come up.

I was just informed by our webmaster that the netscape commerce 
server uses javascript for remote admin.  In order for him to 
administer the web server (which is outside the FW, of course), 
Netscape requires him to have javascript capability to the machine.  

I was just getting ready to disable javascript through the firewall 
when he told me this.  Here are my questions:

1) Is it _really_, _really_ dumb of Netscape to REQUIRE javascript to 
admin the server?

2) Is there any way that I can have my cake (disable java*) and eat 
it too (let him admin the server)?  These are the possibilities I can 
see:
   a) tell him to dial in to the web server
      (modem should be dial-out only, so this is a bad idea)
   b) Have him use ISDN to establish his admin sessions to the web 
      server.
      (What problems does the existence of his desktop ISDN 
       connection give me?)

What are some other options that I'm not seeing?

Thanks,
-ron
--
ron snyder   snyder@roguewave.com       |         This space
Rogue Wave Software, Inc                |         intentionally    
{news,unix} admin                       |         left blank
#include <std-dsclmr.h++>               |   

From firewalls-owner  Tue Feb 11 17:03:41 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA09731 for firewalls-outgoing; Tue, 11 Feb 1997 08:59:04 -0800 (PST)
Received: from holly.cc.uleth.ca (holly.cc.uleth.ca [142.66.7.100]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id IAA09659 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 08:58:40 -0800 (PST)
Received: from rose.cserve.uleth.ca (rose.cserve.uleth.ca [142.66.26.250]) by holly.cc.uleth.ca (8.6.10/8.6.10) with ESMTP id KAA19653 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 10:03:26 -0700
Message-ID: <3300A4E1.72FD@hg.uleth.ca>
Date: Tue, 11 Feb 1997 09:57:05 -0700
From: "Jeffrey L. Oliver" <oliver@hg.uleth.ca>
Organization: University of Lethbridge
X-Sender: "Jeffrey L. Oliver" <oliver@hg.uleth.ca> (Unverified)
X-Mailer: Mozilla 4.0b1 (Win95; I)
MIME-Version: 1.0
To: fw <firewalls@greatcircle.com>
Subject: RIP Problems
X-Priority: Normal
Content-Type: multipart/mixed; boundary="----------AE4EC0284D4"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

This is a multi-part message in MIME format.
------------AE4EC0284D4
Content-Type: multipart/alternative; boundary="----------1FD065D651C45"


------------1FD065D651C45
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=us-ascii

 Hi there,

I am having a problem with RIP packets.  Before I turn on my firewall,
the machine (Sparc 20, Solaris 2.5.1) is acting as a gateway and doing
all right.  When I turn on my firewall software (FW-1 form SUN), the RIP
info that   it is propagating to the INSIDE of my firewall is
incorrect.  That is, the *default*  entry seems to be missing, and my
internal machines loose thier default route.

Maybe I need to clarify myself better.  Right now my firewall is on a
test network, so this is something I need to get working before I drop
it in.

Currently my network is attached to the internet via a router (not mine)
that *does* send RIP info into my network, so any machine that listens
for RIP packets gets it's default route from it. I also have a lot of
PC's and Mac's that use this route.

When I drop in my firewall, it will be between the router and the
network, and I am going to steal the IP address from my side of the
router to be the inside of the firewall (I have a new partial class C
for between the two).  The firewall will be configured with static
routes to the router, etc. and NORIP on the outside, but I would like it
to send RIP info to the inside, so that it advertises itself as a
default route.

 Any Ideas?
Jeff

------------1FD065D651C45
Content-Transfer-Encoding: 7bit
Content-Type: text/html; charset=us-ascii

<HTML><BODY>

<DT>&nbsp;Hi there,</DT>

<DT>&nbsp;</DT>

<DT>I am having a problem with RIP packets.&nbsp; Before I turn on my firewall,
the machine (Sparc 20, Solaris 2.5.1) is acting as a gateway and doing
all right.&nbsp; When I turn on my firewall software (FW-1 form SUN), the
RIP info that&nbsp;&nbsp; it is propagating to the INSIDE of my firewall
is incorrect.&nbsp; That is, the *default*&nbsp; entry seems to be missing,
and my internal machines loose thier default route.&nbsp;&nbsp;&nbsp;</DT>

<DT>&nbsp;</DT>

<DT>Maybe I need to clarify myself better.&nbsp; Right now my firewall
is on a test network, so this is something I need to get working before
I drop it in.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</DT>

<DT>&nbsp;</DT>

<DT>Currently my network is attached to the internet via a router (not
mine) that *does* send RIP info into my network, so any machine that listens
for RIP packets gets it's default route from it. I also have a lot of PC's
and Mac's that use this route.</DT>

<DT>&nbsp;</DT>

<DT>When I drop in my firewall, it will be between the router and the network,
and I am going to steal the IP address from my side of the router to be
the inside of the firewall (I have a new partial class C for between the
two).&nbsp; The firewall will be configured with static routes to the router,
etc. and NORIP on the outside, but I would like it to send RIP info to
the inside, so that it advertises itself as a default route.</DT>

<DT>&nbsp;</DT>

<DT>&nbsp;Any Ideas?&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</DT>

<DT>Jeff&nbsp;&nbsp;&nbsp;</DT>

</BODY>
</HTML>
------------1FD065D651C45--

------------AE4EC0284D4
Content-Transfer-Encoding: 7bit
Content-Description: Address Book Card for Jeffrey L. Oliver
Content-Disposition: inline; filename="nsmailUK.TMP"
Content-Type: text/x-vCard; charset=us-ascii; name="nsmailUK.TMP"

BEGIN:VCARD
FN:Jeffrey L. Oliver
N:Oliver;Jeffrey L.
ORG:University of Lethbridge
ADR:;;4401 University Drive;Lethbridge;Alberta;T1K 3M4
EMAIL;INTERNET:oliver@hg.uleth.ca
TITLE:System Support Specialist
TEL;WORK:(403) 329-5162
TEL;FAX:(403) 382-7108
X-NAV-HTML:T
END:VCARD


------------AE4EC0284D4--


From firewalls-owner  Tue Feb 11 17:05:26 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id KAA24741 for firewalls-outgoing; Tue, 11 Feb 1997 10:54:26 -0800 (PST)
Received: from netcom22.netcom.com (netcom22.netcom.com [192.100.81.136]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id KAA24653 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 10:53:55 -0800 (PST)
Received: (from mwallace@localhost) by netcom22.netcom.com (8.6.13/Netcom)
	id KAA09838; Tue, 11 Feb 1997 10:51:09 -0800
Date: Tue, 11 Feb 1997 10:51:09 -0800 (PST)
From: Matt Wallace <mwallace@netcom.com>
Subject: Re: Re[2]: Altavista Tunnel
To: Peter Ngo <Peter_Ngo+aEPS4-Carr%EPS@mcimail.com>
cc: Jerry Mendes <mendes@garnet.berkeley.edu>,
        John Mizzi <jmizzi@utu.premenos.com>,
        firewalls <firewalls@greatcircle.com>
In-Reply-To: <35970210203053/0007044148PJ2EM@MCIMAIL.COM>
Message-ID: <Pine.3.89.9702111023.A9375-0100000@netcom22>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Raptor's VPN tunnelling supports ICMP, yes. It is a gateway application level
firewall, and so naturally does not just pass ICMP. If you are willing to
route your internal network, you can configure the firewall to let ICMP 
through, though. A nice thing about raptor's eagle is that its basic mode
is an ironclad application gateway, but it does have the ability to function
more as a packet filter if you need that.

-Matt

On Mon, 10 Feb 1997, Peter Ngo wrote:

>      Matt,
> 
>      Does Raptor's Eagle firewall support the ICMP protocol? I thought it
>      does! But I heard rumours that it does not?
> 
>      Thanks,
> 
>      Peter
> 
> 
> ______________________________ Reply Separator _________________________________
> Subject: Re: Altavista Tunnel
> Author:  Matt Wallace|INTERNET|mwallace@netcom.com  at MCIMAIL
> Date:    2/10/97 3:13 AM
> 
> 
> On Sat, 8 Feb 1997, Jerry Mendes wrote:
> 
> > At 02:24 PM 2/7/97 -0800, John Mizzi wrote:
> > >Has anyone used the Altavista Tunnel ?
> >
> [snip: class information]
> >
> > >If so what are your opinions ?
> >
> > I think the product is pretty darn good, but then I'm a bit biased.  :-)
> >
> > >Are there any similiar products which provide the same functionality as the
> > >Altavista Tunnel ??
> >
> > Yes there are.  A number of the firewall companies offer other secure
> > solutions, either as part of the firewall or as a separate product.  Also,
> > Microsoft has developed an encrypted tunnel technology, as well....goes
> > under the name PPTP (I believe it translates as Point to Point Tunneling
> > Protocol).
> 
> Raptor's Eagle firewall has full VPN IP tunnelling capability, both from
> firewall-to-firewall, and from a remote client to the firewall.
> 
> VPNet, a company focused on VPN tunnelling, is working on products. I'd
> look into that yourself, as I'm hesitant to discuss any details for fear of
> accidentally stepping on a NDA policy.
> 
> I've heard there is a hardware-to-hardware tunnelling solution like VPN's
> from another companty, and the name escape's me... Red River? Red Creek?
> Something like that.
> 
> Microsoft has an implementation of VPN tunnelling. They 'established' a
> -protocol-, called PPTP, which is point-to-point tunnelling protocol, and
> they also added an implementation to NT 4.0. However, you must be running
> a RASS server to use theirs, as their PPTP server only comes as a subset of
> that.
> 
> __
> Matt Wallace
> mwallace@netcom.com
> 
> 

From firewalls-owner  Tue Feb 11 17:20:26 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA01075 for firewalls-outgoing; Tue, 11 Feb 1997 11:46:45 -0800 (PST)
Received: from iquest3.iquest.net (iquest3.iquest.net [206.246.190.103]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id LAA01054 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 11:46:21 -0800 (PST)
Received: (qmail 6712 invoked from network); 11 Feb 1997 19:44:47 -0000
Received: from ind-0010-26.iquest.net (HELO LOCALNAME) (206.246.171.154)
  by iquest3.iquest.net with SMTP; 11 Feb 1997 19:44:47 -0000
Message-ID: <3300F661.5CC4@iquest.net>
Date: Tue, 11 Feb 1997 14:44:49 -0800
From: "Charles L. Johnson" <charlesj@iquest.net>
Organization: RCI, Resort Condominiums International
X-Mailer: Mozilla 2.01 (Win16; U)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: Virus named Penpal Greetings - Is this a hoax?
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Firewalls;

	I have read the message below several times and believe that this is a hoax.  But I must admit there 
is the possibility that some hacker has figured a way of exploiting vulnerabilities.  I want to confirm - a 
second opinion, that this is just a hoax.  Please see clip below;

If anyone receives mail entitled; PENPAL GREETINGS! please delete it > > WITHOUT reading it!!  This is a 
warning for all Internet users - there > > is a dangerous virus propagating across the Internet through an 
e-mail
>
> message entitled 'PENPAL GREETINGS!". DO NOT DOWNLOAD ANY MESSAGE > > ENTITLED "PENPAL GREETINGS"!!  This message appears to be a friendly > > letter asking you if you are interested in a penpal, but by the time you > 
> read this letter, it is too late. The "trojan horse" virus will have > > already infected the boot sector of your hard drive, destroying all of > > the data present. 

It is a self-replicating virus, and once the message > > is read, it will AUTOMATICALLY forward itself to 
anyone who's e-mail > > address is present in YOUR mailbox. > > > > This virus will DESTROY your hard drive, 
and holds the potential to > > DESTROY the hard drive of anyone whose mail is in your in box, and who's > > 
mail is in their in box and so on.  If this virus keeps getting passed, > > it has the potential to do a great 
deal of DAMAGE to computer networks > > worldwide. > > > > Brian, Please pass this information along to 
whomever you think needs to be alerted. > >

From firewalls-owner  Tue Feb 11 17:31:23 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id MAA05144 for firewalls-outgoing; Tue, 11 Feb 1997 12:35:38 -0800 (PST)
Received: from mailgate32 (mailgate32-hme0.a001.sprintmail.com [205.137.196.58]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id MAA05083 for <firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 12:35:03 -0800 (PST)
Received: by mailgate32 (SMI-8.6/SMI-SVR4)
	id MAA20073; Tue, 11 Feb 1997 12:33:49 -0800
Message-Id: <199702112033.MAA20073@mailgate32>
Received: from sdn-ts-027txfworp09.dialsprint.net(206.133.151.156) by mailfep4-hme1 via smap (KC5.24)
	id Q_10.1.1.10/Q_12771_1_3300d708; Tue Feb 11 12:31:04 1997
From: "Robert Davila" <studpuppy@cutey.com>
To: "Todd R. Zimmerman" <snd1trz@snd10.med.navy.mil>
Cc: <firewalls@GreatCircle.COM>
Subject: Re: Port 135
Date: Tue, 11 Feb 1997 14:32:33 -0600
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1160
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>From What i understand there is a patch availble already from microsoft
that fixes the problem. you might want to check there website


Robert Davila
System Administrator / Security Consultant / Programmer
Hensley and Associates

----------
From: Todd R. Zimmerman <snd1trz@snd10.med.navy.mil>
To: firewalls@GreatCircle.COM
Subject: Port 135
Date: Tuesday, February 11, 1997 9:07 AM

Excuse my ignorance if this has already been covered.

I just read a message from another user on the mailing list in regards to
attacks on NT servers via port 135.  What are the vulnerabilities of Port
135, and how can I minimize the threats?  Where can I obtain more
information on this vulnerability?



 _/_/_/_/  _/_/_/_/  _/_/_/_/  Todd R. Zimmerman
   _/     _/    _/       _/    Network Manager / Computer Specialist
  _/     _/_/_/_/      _/      Naval Medical Center, San Diego
 _/     _/    _/     _/        (619)532-9314  Pager 979-2195
_/     _/     _/   _/_/_/_/    snd1trz@snd10.med.navy.mil

** Disclaimer: The views expressed here do not reflect the    **
** official policy or position of DoD or the U.S. Government. **


From firewalls-owner  Tue Feb 11 17:35:26 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA08238 for firewalls-outgoing; Tue, 11 Feb 1997 13:16:50 -0800 (PST)
Received: from magneto.acquion.com (magneto.acquion.com [206.154.17.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id NAA08152 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 13:16:08 -0800 (PST)
Received: from blur.acquion.com ([206.154.17.75]) by magneto.acquion.com
          (post.office MTA v2.0 0813 ID# 0-11944) with SMTP id AAA76;
          Tue, 11 Feb 1997 16:19:46 -0500
Message-Id: <2.2.32.19970211211349.00695074@mail.acqic.org>
X-Sender: oolid@mail.acqic.org
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Tue, 11 Feb 1997 16:13:49 -0500
To: "Todd R. Zimmerman" <snd1trz@snd10.med.navy.mil>,
        firewalls@greatcircle.com
From: oolid@acqic.org (Joseph L. Moll)
Subject: Re: Port 135
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Access to all NBT ports (i.e. 135/tcp, 137/udp, 138/udp, 139/tcp) should be
blocked at your border.

135/tcp is the RPC port, currently being exploited as a DOS attack without
the hotfix to SP2, however it has been reported that other NT 4.0 services
are vunerable to this attack as well.  Seems that some really bad code ended
up in a number of NT 4.0 services.

Regards,
joe, oolid@acqic.org


From firewalls-owner  Tue Feb 11 17:39:46 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA08457 for firewalls-outgoing; Tue, 11 Feb 1997 13:19:38 -0800 (PST)
Received: from csc.com (explorer.csc.com [20.1.10.27]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id NAA08408 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 13:19:08 -0800 (PST)
Received: from relay.ashton.csc.com by csc.com with smtp
	(Smail3.1.29.1 #1) id m0vuPaE-001AjaC; Tue, 11 Feb 97 16:17 EST
Received: by relay.ashton.csc.com; id NAA00681; Tue, 11 Feb 1997 13:12:27 -0500
Received: from jkerr2.sed.csc.com(20.2.53.152) by relay.ashton.csc.com via smap (g3.0.1)
	id sma000679; Tue, 11 Feb 97 13:12:21 -0500
Message-ID: <3300B720.3A43@csc.com>
Date: Tue, 11 Feb 1997 13:14:56 -0500
From: John Kerr <jkerr2@csc.com>
Reply-To: jkerr2@csc.com
Organization: Computer Sciences Corporation
X-Mailer: Mozilla 3.0 (Win95; I)
MIME-Version: 1.0
To: "Jeffrey L. Oliver" <oliver@hg.uleth.ca>
CC: "fw-1-mailinglist@us.checkpoint.com" <fw-1-mailinglist@us.checkpoint.com>,
        "firewalls@greatcircle.com" <firewalls@greatcircle.com>
Subject: Re: [FW1] rule set
References: <3300A653.2AC3@hg.uleth.ca>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Jeffrey L. Oliver wrote:
> 
> G'Day,
> 
> Is there a prefered order for the rule set in FW-1?
> 
> regards,
> Jeff
> 
> 
>     ---------------------------------------------------------------
> BEGIN:VCARD
> FN:Jeffrey L. Oliver
> N:Oliver;Jeffrey L.
> ORG:University of Lethbridge
> ADR:;;4401 University Drive;Lethbridge;Alberta;T1K 3M4
> EMAIL;INTERNET:oliver@hg.uleth.ca
> TITLE:System Support Specialist
> TEL;WORK:(403) 329-5162
> TEL;FAX:(403) 382-7108
> X-NAV-HTML:T
> END:VCARD
The rule set will start at rule number one and work its way down to the
last rule or until a rule condition has been satisfied.
			John

From firewalls-owner  Tue Feb 11 17:50:26 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA13939 for firewalls-outgoing; Tue, 11 Feb 1997 14:04:55 -0800 (PST)
Received: from minotaur.labyrinth.net.au (minotaur.labyrinth.net.au [203.9.148.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id OAA13788 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 14:04:09 -0800 (PST)
Received: (from mail@localhost) by minotaur.labyrinth.net.au (8.7.2/8.7.2) id JAA00946; Wed, 12 Feb 1997 09:03:05 +1100 (EST)
Received: from gate.quick.com.au(203.12.250.130) by minotaur.labyrinth.net.au via smap (V1.3)
	id sma000935; Wed Feb 12 09:02:47 1997
Received: from localhost (localhost [127.0.0.1]) by zen.quick.com.au (8.7.3/8.7.3) with SMTP id JAA26027; Wed, 12 Feb 1997 09:02:38 +1100 (EST)
Message-Id: <199702112202.JAA26027@zen.quick.com.au>
X-Authentication-Warning: zen.quick.com.au: Host localhost [127.0.0.1] didn't use HELO protocol
To: peter@baileynm.com (Peter da Silva)
cc: firewalls@greatcircle.com, sjg@quick.com.au
Subject: Re: SLr* released. rsh,rcp,rdist over SSL 
In-reply-to: Your message of "Tue, 11 Feb 97 08:42:59 MDT."
             <9702111442.AA25216@sonic.nmti.com.nmti.com> 
Date: Wed, 12 Feb 1997 09:02:34 +1100
From: "Simon J. Gerraty" <sjg@zen.quick.com.au>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> What I'm talking about is separating the encryption and authentication,
> so you can establish an encrypted channel to the firewall, look at the
> authentication information there, then establish a new encrypted channel
> to the destination based on that, like the way ftp-gw works. This doesn't
> have to be totally transparent... you can do a login "user@dest" at the
> firewall. Let it print a message, syslog, popup, whatever, saying
> that it's going through a proxy, so you can be aware that a man-in-the-
> middle attack might be going on.

Sounds like you are talking about interactice logins?  SSLrsh does not
support rlogin. I use stelnet for that.

I use a modified tn-gw for in-bound connections configured
to only accept an SSL connection (forced not negotiated).  Like
stelnetd, tn-gw can be told to accept the X.509 cert as
authentication, otherwise it will extract the common name field from
the certificate and offer it up to the authsrv.  Once authenticated
you can connect to the internal host if the authsrv allows it.  That
connection is not currently SSL based as tn-gw would have to negotiate
it using its own certificate.

For out-bound secure connections I just use the normal tn-gw.

I just stelnet to the tn-gw, since it does not negotiate SSL the
session is unencrypted so far.  I then connect to gate.quick.com.au
which negotiates SSL and I get a verified end to end encrypted
session.

> > For interactive sessions, you can proxy ssh btw.  At one site where I
> > work I have set up tn-gw to treat port 22 as a "raw" port, and the
> > guys who use ssh have hacked themeslves a simple proxy that negotiates
> > the connection via tn-gw, and then hands the socket to ssh - I think
> > that is how it works.
> 
> I'd be interested in seeing that code.

I don't have it, sorry but I'm pretty sure some of the guys who do,
read this list.

--sjg

From firewalls-owner  Tue Feb 11 18:01:58 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA12886 for firewalls-outgoing; Tue, 11 Feb 1997 13:57:31 -0800 (PST)
Received: from medsnt.medsite (medsnt.brooks.af.mil [140.140.126.41]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id NAA12777 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 13:56:47 -0800 (PST)
Received: by medsnt.medsite with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63)
	id <01BC1834.74C3DB50@medsnt.medsite>; Tue, 11 Feb 1997 15:58:43 -0600
Message-ID: <c=US%a=_%p=Brooks_AFB%l=MEDSNT-970211215842Z-16@medsnt.medsite>
From: <bennett_r@medsite.brooks.af.mil>
To: <firewalls@greatcircle.com>
Subject: FIREWALL : The NetRanger by Wheel Group
Date: Tue, 11 Feb 1997 15:58:42 -0600
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi, I'm a sys admin for the Government (Brooks, AFB Texas, USA) and we
have a contract with the WHEEL GROUP to install a new firewall system
called the NET RANGER.. is anyone familiar with this firewall or know
anything about it?

I need to collect data on it, and ways we can check it's capabilites. 

Anyone got any good outlines, ways to check it? 

Russ Bennett


From firewalls-owner  Tue Feb 11 18:05:26 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA12468 for firewalls-outgoing; Tue, 11 Feb 1997 13:55:13 -0800 (PST)
Received: from cvrelay.cv.com (cvrelay.CV.COM [130.21.162.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id NAA12408 for <firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 13:54:41 -0800 (PST)
Received: from ausgate.cv.com (ausgate.CV.COM [129.122.92.10]) by cvrelay.cv.com (8.6.9/8.6.9) with ESMTP id RAA15884 for <firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 17:03:16 -0500
Received: from 486dx100.cv.com by ausgate.cv.com (SMI-8.6/SMI-SVR4)
	id IAA10894; Wed, 12 Feb 1997 08:49:29 +1100
Message-Id: <199702112149.IAA10894@ausgate.cv.com>
Comments: Authenticated sender is <bsl@ausgate.cv.com>
From: "Brad Larden" <bsl@ausgate.cv.com>
Organization: Computervision
To: firewalls@GreatCircle.COM
Date: Wed, 12 Feb 1997 08:54:42 +1000
MIME-Version: 1.0
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Subject: In search of password server
Reply-to: bsl@ausgate.cv.com
X-mailer: Pegasus Mail for Win32 (v2.42)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi All,

Firstly, I hope this mail is close enough in subject matter to be relevant 
here.

I am searching for something that will take the hassle out of users 
maintaining (and forgetting) a multitude of passwords for various systems we 
have.
I don't know if such a thing exists as I haven't been able to find anything on 
the web but what we would like to do is have our users connect/login to their 
windows 95 (YUK!) pc's and be able to connect to any of the unix machine, 
netware machines and other proprietry hardware around the place.
Whether this mystical device just synchronises the passwords for any/all the 
systems for each user or somehow provides the password for a given user, I 
don't care. The problem is that many people (including management) are 
complaining about the number of user id's and passwords they need to remember.
I don't agree with them, as I have to remember more than the average person 
here and don't have a problem but I have to provide some feedback to them, 
even if it's to say "it can't be done". 

My concern is that if someone hacks in and finds one user/password 
combination, they will have access to any machine that the user has access to.

Anyway, thanks for your time and I hope someone has some comments on this.

Regards,
Brad.

From firewalls-owner  Tue Feb 11 18:48:45 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id PAA01777 for firewalls-outgoing; Tue, 11 Feb 1997 15:47:37 -0800 (PST)
Received: from fw.roguewave.com (roguewave.com [198.68.9.6]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id PAA01613 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 15:46:53 -0800 (PST)
Received: by fw.roguewave.com; id PAA05139; Tue, 11 Feb 1997 15:44:31 -0800 (PST)
Received: from unknown(10.68.9.1) by fw.roguewave.com via smap (3.2)
	id xmag05103; Tue, 11 Feb 97 15:44:20 -0800
Received: from rw0328 ([10.68.2.128]) by cvo.roguewave.com (8.8.2/8.8.2) with SMTP id PAA20805 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 15:22:08 -0800 (PST)
Message-Id: <199702112322.PAA20805@cvo.roguewave.com>
Comments: Authenticated sender is <snyder@mail.cvo.roguewave.com>
From: "Ron Snyder" <snyder@roguewave.com>
Organization: Rogue Wave Software
To: firewalls@greatcircle.com
Date: Tue, 11 Feb 1997 15:20:25 -0800
Subject: netscape remote admin requiring javascript (THANKS everybody)
Reply-to: snyder@roguewave.com
X-mailer: Pegasus Mail for Win32 (v2.52)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Thank you for all your responses-- It turns out that it's not the 
commerce server, but rather the enterprise server.  The two solutions 
that fit the best for us are:

1) using a second web server (that's internal), make changes using 
javascript, then move the files down to the 'live' web server; 

2) force the webmaster to learn the format of all of those files and 
make him use a text editor to do it.

(I think that he'll probably go for #1).

There was another solution to have a direct serial line, but that 
won't work for us because the firewall is an a completely different 
state.  (It's a _looong_ way outside of the firewall)

Thanks again!
-ron
--
ron snyder   snyder@roguewave.com       |         This space
Rogue Wave Software, Inc                |         intentionally    
{news,unix} admin                       |         left blank
#include <std-dsclmr.h++>               |   

From firewalls-owner  Tue Feb 11 18:53:12 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id PAA01773 for firewalls-outgoing; Tue, 11 Feb 1997 15:47:33 -0800 (PST)
Received: from fw.roguewave.com (roguewave.com [198.68.9.6]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id PAA01618 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 15:46:54 -0800 (PST)
Received: by fw.roguewave.com; id PAA05145; Tue, 11 Feb 1997 15:44:31 -0800 (PST)
Received: from unknown(10.68.9.1) by fw.roguewave.com via smap (3.2)
	id xmab05105; Tue, 11 Feb 97 15:44:20 -0800
Received: from rw0328 ([10.68.2.128]) by cvo.roguewave.com (8.8.2/8.8.2) with SMTP id PAA22034 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 15:37:25 -0800 (PST)
Message-Id: <199702112337.PAA22034@cvo.roguewave.com>
Comments: Authenticated sender is <snyder@mail.cvo.roguewave.com>
From: "Ron Snyder" <snyder@roguewave.com>
Organization: Rogue Wave Software
To: firewalls@greatcircle.com
Date: Tue, 11 Feb 1997 15:35:42 -0800
Subject: TIS smap.c-- blocking incoming email by recipient?
Reply-to: snyder@roguewave.com
X-mailer: Pegasus Mail for Win32 (v2.52)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Has anybody with a TIS gauntlet FW hacked smap.c so that you can have 
a list of email recipients that are unable to receive email from the 
Internet?  If not, I might try it myself, but you know the 
saying--"Why re-invent the mouse trap and have the world beat a path 
to your door"  :)

We've got some users that have left the company, and managed to get 
themselves on a whole bunch of UCE lists (or maybe they subscribed 
themselves, I don't know).  Of course, smap accepts the email, tries 
to give it to our mailhub, and then has to bounce it.  It can't be 
bounced (in most cases), because junk mailers aren't usually kind 
enough to put their _real_ email address into the headers.

-ron
--
ron snyder   snyder@roguewave.com       |         This space
Rogue Wave Software, Inc                |         intentionally    
{news,unix} admin                       |         left blank
#include <std-dsclmr.h++>               |   

From firewalls-owner  Tue Feb 11 19:31:11 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id SAA21529 for firewalls-outgoing; Tue, 11 Feb 1997 18:46:51 -0800 (PST)
Received: from ptss.com (email.ptss.com [155.241.24.21]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id SAA21481 for <firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 18:46:36 -0800 (PST)
Received: from ptssmsgsrv01.srv.ptss.com by ptss.com (SMI-8.6/SMI-SVR4)
	id SAA17438; Tue, 11 Feb 1997 18:37:58 -0800
Received: by ptssmsgsrv01.srv.ptss.com with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63)
	id <01BC184B.E15773F0@ptssmsgsrv01.srv.ptss.com>; Tue, 11 Feb 1997 18:46:24 -0800
Message-ID: <c=US%a=_%p=Pacific_Telesis%l=PTSSMSGSRV01-970212024622Z-8765@ptssmsgsrv01.srv.ptss.com>
From: "DONAHUE, DAVID B (D4BDONA)" <d4bdona@msg.ptss.com>
To: "'NT Security List'" <ntsecurity@iss.net>,
        "'Stout, Bill'"
	 <bill.stout@hidata.com>
Cc: "'Firewall List'" <firewalls@GreatCircle.COM>
Subject: RE: [NTSEC] NT Security list
Date: Tue, 11 Feb 1997 18:46:22 -0800
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

on Tuesday, February 11, 1997, Bill Stout<bill.stout@hidata.com> said:
>>Thread dead.

Well one final comment, if anyone else wants to mirror/copy/use as
source/whatever the (single directory modified) files from Bill's NT
exploit site, I have zipped them for easy mirroring (it was annoying to
hand mirror them like I did).

The URL is:

http://www.emf.net/~ddonahue/NThacks/NThacks.zip

Just expand it in any http accessible directory and voi'la, a mirror is
done.
(UNIX folks get to hand mirror it, but if asked nicely, I might TAR it
for you)

-David Donahue

Quote of the day:
Hey Rocky, ever see me configure a secure NT server ?
But Bullwinkle, that trick never works...
Nothing up my sleeves, Presto !
(much growling from the users)
Now for something you'll really like...
>

From firewalls-owner  Tue Feb 11 20:52:43 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id SAA14079 for firewalls-outgoing; Tue, 11 Feb 1997 18:12:13 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id SAA13685 for <firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 18:10:35 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-961106)
	id SAA24274; Tue, 11 Feb 1997 18:07:52 -0800 (PST)
Received: from mercury.sun.com(192.9.25.1) by mycroft via smap (V1.3mjr)
	id sma024236; Tue Feb 11 18:07:10 1997
Received: from Ebay.Sun.COM ([129.150.111.20]) by mercury.Sun.COM (SMI-8.6/mail.byaddr) with SMTP id SAA11121; Tue, 11 Feb 1997 18:07:38 -0800
Received: from althea.Ebay.Sun.COM by Ebay.Sun.COM (SMI-8.6/SMI-5.3)
	id SAA15630; Tue, 11 Feb 1997 18:07:35 -0800
Received: by althea.Ebay.Sun.COM (SMI-8.6/SMI-SVR4)
	id SAA19599; Tue, 11 Feb 1997 18:05:10 -0800
Date: Tue, 11 Feb 1997 18:05:10 -0800
From: jerald.josephs@Ebay.Sun.COM (Jerald Josephs)
Message-Id: <199702120205.SAA19599@althea.Ebay.Sun.COM>
To: oliver@hg.uleth.ca, jkerr2@csc.com
Subject: Re: [FW1] rule set
Cc: fw-1-mailinglist@us.checkpoint.com, firewalls@GreatCircle.COM
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


> From fw-1-mailinglist-owner@us.checkpoint.com  Tue Feb 11 13:44:17 1997
> X-Authentication-Warning: loudecho.us.checkpoint.com: majordom set sender to owner-fw-1-mailinglist@us.checkpoint.com using -f
> Date: Tue, 11 Feb 1997 13:14:56 -0500
> From: John Kerr <jkerr2@csc.com>
> MIME-Version: 1.0
> To: "Jeffrey L. Oliver" <oliver@hg.uleth.ca>
> CC: "fw-1-mailinglist@us.checkpoint.com" <fw-1-mailinglist@us.checkpoint.com>,
>         "firewalls@greatcircle.com" <firewalls@greatcircle.com>
> Subject: Re: [FW1] rule set
> Content-Transfer-Encoding: 7bit
> 
> Jeffrey L. Oliver wrote:
> > 
> > G'Day,
> > 
> > Is there a prefered order for the rule set in FW-1?
> > 
> > regards,
> > Jeff
> > 
> > 
> >     ---------------------------------------------------------------
> > BEGIN:VCARD
> > FN:Jeffrey L. Oliver
> > N:Oliver;Jeffrey L.
> > ORG:University of Lethbridge
> > ADR:;;4401 University Drive;Lethbridge;Alberta;T1K 3M4
> > EMAIL;INTERNET:oliver@hg.uleth.ca
> > TITLE:System Support Specialist
> > TEL;WORK:(403) 329-5162
> > TEL;FAX:(403) 382-7108
> > X-NAV-HTML:T
> > END:VCARD
> The rule set will start at rule number one and work its way down to the
> last rule or until a rule condition has been satisfied.
> 			John
> 

John is correct and since FW-1 does that for each and every packet, you
can minimize the time spent finding the corresponding rule by:

1) Start with rules that accept packets, followed by rules that block packets.

	This is my preferred logic, since I terminate my policy with a block
	all and log rule.

2) Start with rules that handle the most frequent services, followed by rules
   that handle the least frequent services.

	This has to do with the top-to-bottom sequential search.

3) End with a rule that drops all and logs it.

	Sometimes it is more important to know what you are blocking instead
	of what you are accepting.

4) Consider unchecking all of the Properties, forcing the policy to handle
everything.  This enables you to
			a) WYSIWYG
			b) log everything

   Not necessary, but it is an option that you might want to have known about.



    /\  Jerald E. Josephs
   \\ \  Course Developer - Network Security
  \ \\ /  Sun Educational Services
 / \/ / / 
/ /   \//\ 
\//\   / / 
 / / /\ /
  / \\ \  Phone/VM: 408-276-0941
   \ \\  FAX: 408-276-1565
    \/  E-mail: jerald.josephs@EBay.Sun.COM       


From firewalls-owner  Tue Feb 11 21:45:13 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id TAA28724 for firewalls-outgoing; Tue, 11 Feb 1997 19:34:42 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id TAA28217 for <firewalls@GreatCircle.COM>; Tue, 11 Feb 1997 19:32:42 -0800 (PST)
From: daemond@world2u.com
Received: by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-961106)
	id RAA20927; Tue, 11 Feb 1997 17:12:33 -0800 (PST)
Received: from ants3.world2u.com(204.141.123.3) by mycroft via smap (V1.3mjr)
	id sma020837; Tue Feb 11 17:09:55 1997
Received: from LOCALNAME (I123.254.world2u.com [204.141.123.254]) by ants3.world2u.com (8.7.6/8.7.3) with SMTP id UAA02435 for <firewalls@greatcircle.com>; Tue, 11 Feb 1997 20:11:02 -0500 (EST)From firewalls-owner  Wed Feb 12 03:05:37 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id CAA04863 for firewalls-outgoing; Wed, 12 Feb 1997 02:43:20 -0800 (PST)
Received: from data.tops.net (data.tops.net [194.162.222.70]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id CAA04856 for <firewalls@GreatCircle.COM>; Wed, 12 Feb 1997 02:43:05 -0800 (PST)
Received: from data.tops.net (data.tops.net [194.162.222.70])
          by data.tops.net (8.8.5/8.8.4) with SMTP
	  id LAA17778; Wed, 12 Feb 1997 11:43:23 +0100
Date: Wed, 12 Feb 1997 11:43:23 +0100 (MET)
From: armin <armin@data.tops.net>
To: "Jeffrey L. Oliver" <oliver@hg.uleth.ca>
cc: fw <firewalls@GreatCircle.COM>
Subject: e-mail !!!!= HTML   \:-|
In-Reply-To: <3300A4E1.72FD@hg.uleth.ca>
Message-ID: <Pine.LNX.3.91.970212111420.17770A-100000@data.tops.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


please, please, please, PLEASE !!!!!!!!

stop posting in HTML !!!!!!!!

at least _some people in here use pine or other
good mail programms. 

HTML != email -----> HTML in email SUX 

please stop it !

regards,
armin

 ----------------------------------------------
|real_name: armin ollig  e_mail: armin@tops.net|
|                                              |
| To the systems programmer, users and         |
|  applications serve only to provide          |
|            a test load.                      |
 ----------------------------------------------

On Tue, 11 Feb 1997, Jeffrey L. Oliver wrote:

[ email in HTML ]

From firewalls-owner  Wed Feb 12 03:20:34 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id DAA05897 for firewalls-outgoing; Wed, 12 Feb 1997 03:13:47 -0800 (PST)
Received: from magrat.asd.co.za (magrat.asd.co.za [160.124.253.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id DAA05880 for <firewalls@greatcircle.com>; Wed, 12 Feb 1997 03:13:27 -0800 (PST)
Received: from charlie (charlie.asd.co.za [160.124.253.50]) by magrat.asd.co.za (8.6.11/8.6.9) with SMTP id RAA04976; Sun, 23 Feb 1997 17:37:05 +0200
Message-ID: <3301C322.1F8DC21C@magrat.asd.co.za>
Date: Wed, 12 Feb 1997 13:18:26 +0000
From: Rudi Opperman <rudi@magrat.asd.co.za>
X-Mailer: Mozilla 2.0 (X11; I; Linux 1.2.13 i486)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: re rule set
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

jeff <oliver@hg.uleth.ua> asked about the preferred order for the rule
set in fw-1 and someone answered that it starts at rule 1 and works its
way down until a condition is satisfied or the last rule is reached.

I hope i am not splitting hairs here but with solstice fw-1, things are
a little more complicated as there are control properties that form part
 of the rules.

I think the order works like this :
1. Control properties labeled FIRST are matched first.
2. Rule are matched according to the order in the rule base (except the
last rule)
3. Control properties labeled BEFORE LAST are then matched.
4. The last rule in the rule base is matched
5. Control properties labeled LAST are then matched.

To complicate mattters further there is an implicit LAST rule in the
 rule base that silently drops anything that hasn't been matched by any
of the above.

hope this helps
bye

rudi <rudi@magrat.asd.co.za>

From firewalls-owner  Wed Feb 12 04:20:32 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id EAA10086 for firewalls-outgoing; Wed, 12 Feb 1997 04:04:32 -0800 (PST)
Received: from lhr.aster.com.pk (lhr.aster.com.pk [203.128.6.8]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id EAA10058 for <firewalls@greatcircle.com>; Wed, 12 Feb 1997 04:04:12 -0800 (PST)
Received: by lhr.aster.com.pk (Smail3.1.28.1 #4)
	id m0vudQY-0004IIC; Wed, 12 Feb 97 17:04 GMT+0500
Date: Wed, 12 Feb 1997 17:04:41 +0500 (GMT+0500)
From: Rafeeq Ur Rehman <rehman@lhr.aster.com.pk>
To: firewalls@greatcircle.com
Subject: Problem in compiling FWTK
Message-ID: <Pine.LNX.3.91.970212170216.27259B-100000@lhr.aster.com.pk>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I was using fwtk on Linux 1.2.8 previously. Now I have upgraded my 
firewall system to Linux 2.0.0 9Slakware). I am unable to compile
fwtk on this system. The 'make' terminates with error messages. Anybody 
who can send me "Makefile" of fwtk for linux 2.0.0

Rafeeq Ur Rehman
rehman@lhr.aster.com.pk



From firewalls-owner  Wed Feb 12 05:50:44 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id FAA14052 for firewalls-outgoing; Wed, 12 Feb 1997 05:38:27 -0800 (PST)
Received: from arnet.arn.net (arnet.arn.net [204.177.232.11]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id FAA14033 for <firewalls@greatcircle.com>; Wed, 12 Feb 1997 05:38:12 -0800 (PST)
Received: from teddyr.arn.net (teddyr.arn.net [204.177.232.25]) by arnet.arn.net (8.7.5/8.7.3) with SMTP id HAA14400 for <firewalls@greatcircle.com>; Wed, 12 Feb 1997 07:35:53 -0600 (CST)
Message-Id: <199702121335.HAA14400@arnet.arn.net>
Comments: Authenticated sender is <syousif@mailbox.arn.net>
From: "Sami A. Yousif" <syousif@arn.net>
Organization: TeddyR Computers
To: firewalls@greatcircle.com
Date: Wed, 12 Feb 1997 07:35:49 -0600
MIME-Version: 1.0
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Subject: self updating Internet applications
Reply-to: syousif@arn.net
X-TeddyRComment: You must be either a sysadmin or bored to be reading headers.
X-URL: http://users.arn.net/~syousif
X-mailer: Pegasus Mail for Win32 (v2.52)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Has anyone (third party) tested the programs like backweb, pointcast 
and nortons liveupdate for how they do their updates?

 I do realize that it is easy to disable the autoupdate for most of 
these clients; the only issue I can see is that you just have to 
trust the companies that make these applications. 

BTW: it seems that now both pointcast and backweb can be set to use 
port 80 to "go through" firewalls....

----
--

Sami A. Yousif
WT Box 1246
Canyon, TX 79016

Mailto:syousif@arn.net
Mailto:syousif@cyberjunkie.com
Talk  :syousif@teddyr.arn.net
Talk  :syousif@mc119b.wtamu.edu
Web   :http://users.arn.net/~syousif

   Using the only viable internet provider in the 
   Amarillo, TX area [http://www.arn.net/]

Thought for the day:
   Always be one level more paranoid than they think you need to be.
      -- ?


From firewalls-owner  Wed Feb 12 06:35:00 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA15657 for firewalls-outgoing; Wed, 12 Feb 1997 06:18:28 -0800 (PST)
Received: from mail.baileynm.com (fw.baileynm.com [206.109.159.11]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA15650 for <firewalls@GreatCircle.COM>; Wed, 12 Feb 1997 06:18:07 -0800 (PST)
Received: (qmail 11607 invoked from smtpd); 12 Feb 1997 14:16:59 -0000
Received: from web.nmti.com (root@198.178.0.201)
  by fw.nmti.com with SMTP; 12 Feb 1997 14:16:59 -0000
Received: from sonic.nmti.com (peter@sonic.nmti.com [198.178.0.2]) by web.nmti.com (8.6.12/8.6.9) with SMTP id IAA18136; Wed, 12 Feb 1997 08:16:59 -0600
Received: by sonic.nmti.com; id AA26220; Wed, 12 Feb 1997 08:11:21 -0600
From: peter@baileynm.com (Peter da Silva)
Message-Id: <9702121411.AA26220@sonic.nmti.com.nmti.com>
Subject: Re: e-mail !!!!= HTML   \:-|
To: armin@data.tops.net (armin)
Date: Wed, 12 Feb 1997 08:11:21 -0600 (CST)
Cc: oliver@hg.uleth.ca, firewalls@GreatCircle.COM
In-Reply-To: <Pine.LNX.3.91.970212111420.17770A-100000@data.tops.net> from "armin" at Feb 12, 97 11:43:23 am
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> please, please, please, PLEASE !!!!!!!!

> stop posting in HTML !!!!!!!!

It's worse. It's *ILLEGAL* HTML!

Netscape 4 doesn't seem to have an option to turn it off.

It's easy enough to catch "multipart/alternative" and strip out the HTML
part, though. Would be a great thing to add to the next release of
Majordomo. Brent?


From firewalls-owner  Wed Feb 12 06:44:56 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA15792 for firewalls-outgoing; Wed, 12 Feb 1997 06:21:10 -0800 (PST)
Received: from europa.lif.icnet.uk (europa.lif.icnet.uk [143.65.100.4]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA15752 for <firewalls@greatcircle.com>; Wed, 12 Feb 1997 06:20:48 -0800 (PST)
From: harley@icrf.icnet.uk
Message-Id: <199702121420.GAA15752@miles.greatcircle.com>
Received: by europa.lif.icnet.uk; Wed, 12 Feb 1997 14:19:36 GMT
Subject: Virus named Penpal Greetings 
To: firewalls@greatcircle.com
Date: Wed, 12 Feb 1997 14:19:35 +0000 (GMT)
X-Mailer: ELM [version 2.4 PL23]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> I have read the message below several times and believe that 
> this is a hoax.  But I must admit there 
> is the possibility that some hacker has figured a way of exploiting 
> vulnerabilities.  I want to confirm - a 
> second opinion, that this is just a hoax.  Please see clip below;
> 

PENPAL GREETINGS is a hoax. Or, if you prefer, a meme virus. You might
like to take a look at 

	http://ciac.llnl.gov/ciac/CIACHoaxes.html

-- 
David Harley                     \   |   /                 alt.comp.virus FAQ
D.Harley@icrf.icnet.uk            \  |  /               & Anti-Virus Web Page
Support & Security Analyst         \ | /         Folk London On-Line gig-list
Imperial Cancer Research Fund   ____\|/____   http://webworlds.co.uk/dharley/

From firewalls-owner  Wed Feb 12 06:56:42 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA16937 for firewalls-outgoing; Wed, 12 Feb 1997 06:39:49 -0800 (PST)
Received: from user1.scranton.com (user1.scranton.com [204.186.119.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id GAA16920 for <Firewalls@GreatCircle.COM>; Wed, 12 Feb 1997 06:39:39 -0800 (PST)
Received: from localhost (moroni@localhost) by user1.scranton.com (8.7.5/8.7.3) with SMTP id JAA11072; Wed, 12 Feb 1997 09:38:40 -0500
Date: Wed, 12 Feb 1997 09:38:40 -0500 (EST)
From: Moroni <moroni@scranton.com>
To: Adam Shostack <adam@homeport.org>
cc: Bill Neugent <wneugent@smiley.mitre.org>, Firewalls@GreatCircle.COM
Subject: Re: Views on Merits of Beta Testing Solicited
In-Reply-To: <199702120430.XAA03962@homeport.org>
Message-ID: <Pine.LNX.3.93.970212093448.11040A-100000@user1.scranton.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

   I evaluate software myself and was talking to a company about beta
testing and they warned me about my system going down on a regular basis
when beta testing.It would be wise to have a seperate computer just for
beta testing. 
   The only person I know of who got paid real money for beta testing
software is the fictional character Angela Bennett in the movie the
Net.Most people just get software when the final product is retailed.




On Tue, 11 Feb 1997, Adam Shostack wrote:

> Date: Tue, 11 Feb 1997 23:30:58 -0500 (EST)
> From: Adam Shostack <adam@homeport.org>
> To: Bill Neugent <wneugent@smiley.mitre.org>
> Cc: Firewalls@GreatCircle.COM
> Subject: Re: Views on Merits of Beta Testing Solicited
> 
> Bill Neugent wrote:
> 
> | Please send me a note telling me of your experience (pro or con) regarding
> | beta testing, especially of security-related stuff. If you're a vendor, I'd
> 
> 	Actually, despite your request, I think that there may be
> value to discussing this here.  I speak as someone who has beta tested
> many security products for a number of companies, most recently for a
> FW at a financial company.
> 
> 	Beta testing today is often what would have been release .0
> three years ago.  This represents 'internet time' development, which
> may not be a good thing for security products.  Doing a security
> product requires engineering work.  Bugs may not be obvious.  Security
> bugs oft are not.  Most beta products I've worked with have enough
> reliability & production working problems that I haven't been able to
> look for security problems.
> 
> 	In addition, the many security vendors who are selling black
> boxes today make evaluating the product that much harder.  I say that
> as someone who has taken apart security code with a debugger (with
> some help).  Its much easier to find problems by looking at source
> than looking at binaries.
> 
> 	So the end result of this rambling?  Its more useful to get
> source than betas, and it would help everyone if Government purchasing
> dollars went towards source available products.
> 
> Adam
> 
> -- 
> "It is seldom that liberty of any kind is lost all at once."
> 					               -Hume
> 
> 
















       xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
       x   No success can compensate for failure in the home.  x
       x                                                       x
       xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx


From firewalls-owner  Wed Feb 12 07:21:31 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA18922 for firewalls-outgoing; Wed, 12 Feb 1997 06:58:05 -0800 (PST)
Received: from ACML.COM ([207.140.173.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id GAA18868 for <Firewalls@Greatcircle.Com>; Wed, 12 Feb 1997 06:57:44 -0800 (PST)
Received: from smtpngw.acml.com by ACML.COM (SMI-8.6/SMI-SVR4)
	id JAA02591; Wed, 12 Feb 1997 09:53:49 -0500
Received: by smtpngw.acml.com (IBM OS/2 SENDMAIL VERSION 1.3.18/2.12um) id AA3404; Wed, 12 Feb 97 09:54:03 -0500
Message-Id: <9702121454.AA3404@smtpngw.acml.com>
Received: from ALLIANCE with "Lotus Notes Mail Gateway for SMTP" id
  FB3FF94995DDA15D8525643C0051829A; Wed, 12 Feb 97 09:54:01 
To: bennett_r <bennett_r@medsite.brooks.af.mil>
Cc: Firewalls <Firewalls@Greatcircle.Com>
From: John Chen/New York/ACMC
  <John_Chen@ACML.COM>
Date: 12 Feb 97  9:52:41 
Subject: Re: FIREWALL : The NetRanger by Wheel Group
Mime-Version: 1.0
Content-Type: Text/Plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

An article on Forbe (01/02/97) title of Somebody is reading your E-mail has 
some of details about Wheel Group.

John 




	bennett_r @ medsite.brooks.af.mil 
11/02/97 15:58
To: firewalls @ greatcircle.com @ internet
cc:  
Subject: FIREWALL : The NetRanger by Wheel Group

Hi, I'm a sys admin for the Government (Brooks, AFB Texas, USA) and we
have a contract with the WHEEL GROUP to install a new firewall system
called the NET RANGER.. is anyone familiar with this firewall or know
anything about it?

I need to collect data on it, and ways we can check it's capabilites. 

Anyone got any good outlines, ways to check it? 

Russ Bennett





From firewalls-owner  Wed Feb 12 07:22:50 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA15852 for firewalls-outgoing; Wed, 12 Feb 1997 06:22:13 -0800 (PST)
Received: from nebula.online.ee (nebula.online.ee [194.106.96.11]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id GAA15828 for <Firewalls@GreatCircle.COM>; Wed, 12 Feb 1997 06:21:56 -0800 (PST)
Received: from localhost (jk@localhost) by nebula.online.ee (8.8.3/8.8.3) with SMTP id QAA26954 for <Firewalls@GreatCircle.COM>; Wed, 12 Feb 1997 16:20:37 +0200 (EET)
Date: Wed, 12 Feb 1997 16:20:35 +0200 (EET)
From: Jyri Kaljundi <jk@stallion.ee>
X-Sender: jk@nebula
To: Firewalls@GreatCircle.COM
Subject: Re: Secure Telneting into a internal network
In-Reply-To: <199702112341.PAA00516@miles.greatcircle.com>
Message-ID: <Pine.GSO.3.95.970212161756.26124A-100000@nebula>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

 
Jerry Mendes <mendes@garnet.berkeley.edu> wrote:

> Public key cryptography, when used within the U.S. or Canada is very
> secure (key lengths range from 128 to 1024 bits).  If your users are in
> locations outside North America, and you buy from U.S. vendors, then you
> probably realize that you will not be able to purchase technology with
> key lengths over 40 bits. 

Still F-Secure technology is available all over the world, and it uses
only strong cryptography, so there is no reason to use any US (or crippled
Israeli) products. F-Secure SSH and F-Secure VPN can achieve most of what
ordinary US products can do.

Juri Kaljundi
jk@stallion.ee
Stallion Ltd.


From firewalls-owner  Wed Feb 12 08:13:55 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA19545 for firewalls-outgoing; Wed, 12 Feb 1997 07:05:09 -0800 (PST)
Received: from phoenix.iss.net (phoenix.iss.net [204.241.60.5]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id HAA19495 for <firewalls@GreatCircle.COM>; Wed, 12 Feb 1997 07:04:47 -0800 (PST)
Received: (from cklaus@localhost) by phoenix.iss.net (8.8.5/8.6.12) id KAA16891; Wed, 12 Feb 1997 10:02:57 -0500
From: Christopher Klaus <cklaus@iss.net>
Message-Id: <199702121502.KAA16891@phoenix.iss.net>
Subject: Re: Port 135 [and other NT attacks]
To: firewalls@GreatCircle.COM
Date: Wed, 12 Feb 1997 10:02:57 -0500 (EST)
Cc: snd1trz@snd10.med.navy.mil
X-Mailer: ELM [version 2.4 PL24 PGP2]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



> Excuse my ignorance if this has already been covered.
> 
> I just read a message from another user on the mailing list in regards to
> attacks on NT servers via port 135.  What are the vulnerabilities of Port
> 135, and how can I minimize the threats?  Where can I obtain more
> information on this vulnerability?

Summary of recent attacks that have become more well known.

These attacks have been discussed on NT Security mailing list but the
knowledge about them has not spread widely outside of the security
mailing list circle.

NT CPU Port Attacks
NT DNS Denial Attack
NT Trojan Password DLL 


NT CPU Port Attacks

On NT 3.51 and NT 4.0, there are TCP ports that are open that when an
attacker connects to them, types in some random characters, and drops
the connection, the CPU on the machine goes to 100% usage.

For example, connect to TCP port 135 (RPC server), type in
"thiswilldoacpuattack" and disconnect.  Then check the CPU usage.  The
CPU will be at 100% usage and the machine will be noticeably slower.  It
is possible to kill and restart the rpcss process to stop the CPU usage.

DNS (TCP port 53 & 65589) is susceptible to this attack as well.  In
16-bits, port 65589 is port 53.  65589 = 0x10035. 53 = 0x35


Solution:

On NT 4.0, there is filter capability to block all TCP ports except
needed critical ones.  You may want to enable that.

There is a hotfix available on 
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP2/RPC-fix

There is a DNS beta that fixed the random character on the port attack.
It is available via ftp from rhino.microsoft.com, log on as DNSBeta with
a password of DNSBeta. In the /service_pack3/x86 directory there is a
file called DNS.EXE dated 1/26/97.


NT DNS Denial Attack

If an attacker spoofs a response that the DNS never requested, DNS will terminate.
There is an advisory on this available at http://www.iss.net/lists/general/0118.html

Solution:

Currently, Microsoft is working on a solution.



NT Trojan Password DLL 

On NT 4.0 and 3.51, there is some entries in the registry that point to
a DLL that does not exist, that lets an attacker to put their own DLL in
place.  There is one DLL that will capture all password changes into a
file, so an attacker can obtain any passwords that get changed pertaining to
passwords residing on that machine.  Ideally for an attacker, placing the DLL
on a domain controller machine where most password changes can take place may 
produce the greatest amount of password information.  

More information is available with source code for the password changer
DLL at: ftp://ftp.iss.net/pub/lists/ntsecurity-digest.archive/v02.n114
or Knowledge Base article http://www.microsoft.com/kb/articles/q151/0/82.htm 


Solution:

To defend against this type of Trojan attack is to protect
access to your registry fiercely. A routine part of your security
maintenance checks should be to take a close look at this registry key:

          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Lsa\Notification Packages 

Make sure that it does not contain any strange entries. NT 4.0 ships
with a single entry to this registry key:

          FPNWCLN 

If anything else in this registry entry, find out what it is and whether
or not it's needed. If not sure, remove the errant entry immediately.
Netware requires the DLL, so if you already have installed the Netware
DLL, then it should have be installed admin-writable only.  If you do
not have the Netware DLL installed, make sure the register entry is
blank.



Acknowledgments

Thanks to the posters of the NT Security Mailing list where almost all
of this information was derived.  To subscribe, send email to
majordomo@iss.net and within the body of the message, type: "subscribe
ntsecurity".  



-- 
Christopher William Klaus	     Voice: (770)395-0150. Fax: (770)395-1972
Internet Security Systems, Inc.              "Internet Scanner SAFEsuite finds
Ste. 660,41 Perimeter Center East,Atlanta,GA 30346 your network security holes
Web: http://www.iss.net/  Email: cklaus@iss.net        before the hackers do."

From firewalls-owner  Wed Feb 12 08:43:42 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA22697 for firewalls-outgoing; Wed, 12 Feb 1997 07:24:47 -0800 (PST)
Received: from anaf04.amsterdam.nl ([145.222.17.29]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id HAA22568 for <firewalls@GreatCircle.com>; Wed, 12 Feb 1997 07:23:51 -0800 (PST)
Received: from anaf01.amsterdam.nl ([145.222.33.39]) by anaf04.amsterdam.nl (8.6.12/8.6.9) with SMTP id QAA04169 for <firewalls@GreatCircle.com>; Wed, 12 Feb 1997 16:03:16 +0100
Received: from AMSTERDAM-Message_Server by anaf01.amsterdam.nl
	with Novell_GroupWise; Wed, 12 Feb 1997 16:22:39 +0100
Message-Id: <s301ee4f.076@anaf01.amsterdam.nl>
X-Mailer: Novell GroupWise 4.1
Date: Wed, 12 Feb 1997 16:19:58 +0100
From: Ewout Meij <BSD02.EMEIJ@anaf01.amsterdam.nl>
Reply-To: BSD02.EMEIJ@anaf01.amsterdam.nl
To: firewalls@GreatCircle.com
Subject: Virus named Penpal Greetings - antwoord
Mime-Version: 1.0
Content-Type: text/plain
Content-Disposition: inline
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

no NO NO NOOOOOOOO

not again, _please_

From firewalls-owner  Wed Feb 12 08:58:03 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA20341 for firewalls-outgoing; Wed, 12 Feb 1997 07:11:53 -0800 (PST)
Received: from noc.belwue.de (noc.BelWue.DE [129.143.2.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id HAA20333 for <firewalls@GreatCircle.COM>; Wed, 12 Feb 1997 07:11:44 -0800 (PST)
Received: from ruscdrom.rus.uni-stuttgart.de (ruscdrom.rus.uni-stuttgart.de [129.69.235.40])
          by noc.belwue.de (8.8.5/8.8.4) with SMTP
	  id QAA01819; Wed, 12 Feb 1997 16:10:42 +0100 (MET)
Received: by ruscdrom.rus.uni-stuttgart.de (AIX 3.2/UCB 5.64/4.03) id AA29134; Wed, 12 Feb 1997 16:10:00 +0100
Message-Id: <9702121510.AA29134@ruscdrom.rus.uni-stuttgart.de>
Subject: Re: e-mail !!!!= HTML   \:-|
To: peter@baileynm.com (Peter da Silva)
Date: Wed, 12 Feb 1997 16:10:00 +0100 (MEZ)
Cc: armin@data.tops.net, oliver@hg.uleth.ca, firewalls@GreatCircle.COM
In-Reply-To: <9702121411.AA26220@sonic.nmti.com.nmti.com> from "Peter da Silva" at Feb 12, 97 08:11:21 am
From: Helmut Springer <delta@RUS.Uni-Stuttgart.DE>
Organization: Stuttgart University, FRG
X-Pgp-Fingerprint: AE 42 C3 2C A1 3E 55 6D  B3 AC 3C D2 F3 CF FF E7
X-Phone:      +49 711 685-2003q
X-Fax:        +49 711 685-2043
X-Mailer: ELM [version 2.4 PL25 PGP6]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

hi,

Peter da Silva wrote:
[...]
> Netscape 4 doesn't seem to have an option to turn it off.

Preferences/Mail&News/Composer/use HTML Composer  -> 'no'

cheers
  delta

-- 
helmut 'delta' springer             Unix/Net Consulting, InfoSystems, StudBox
delta@RUS.Uni-Stuttgart.DE                          Stuttgart University, FRG
http://home.pages.de/~delta/
phone : +49 711 685-2003           "Freedom's just another word for
FAX   : +49 711 685-2043            nothing left to lose"  Kris Kristofferson

From firewalls-owner  Wed Feb 12 09:01:47 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA23492 for firewalls-outgoing; Wed, 12 Feb 1997 07:31:30 -0800 (PST)
Received: from merle.acns.nwu.edu (merle.acns.nwu.edu [129.105.16.57]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id HAA23412 for <firewalls@GreatCircle.COM>; Wed, 12 Feb 1997 07:30:52 -0800 (PST)
Received: from localhost by merle.acns.nwu.edu with SMTP
	(1.40.112.8/16.2) id AA241801378; Wed, 12 Feb 1997 09:29:38 -0600
Date: Wed, 12 Feb 1997 09:29:38 -0600 (CST)
From: Brian Hatch <bri@ifokr.org>
X-Sender: bri@merle.acns.nwu.edu
To: armin <armin@data.tops.net>
Cc: firewalls@GreatCircle.COM
Subject: Re: e-mail !!!!= HTML   \:-|
In-Reply-To: <Pine.LNX.3.91.970212111420.17770A-100000@data.tops.net>
Message-Id: <Pine.HPP.3.93.970212092205.1672M-100000@merle.acns.nwu.edu>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

-----BEGIN PGP SIGNED MESSAGE-----


+ armin said:
+
+ please, please, please, PLEASE !!!!!!!!
+ stop posting in HTML !!!!!!!!
+ at least _some people in here use pine or other
+ good mail programms. 
+ HTML != email -----> HTML in email SUX 
+ please stop it !

I second this.

If you use a mailer that allows you to pipe the message for viewing 
(such as pine) I use the following to strip out most of the HTML
tags (any that don't span lines will be nuked, the rest survive.
You could trivially write a perl script to handle it completely.)

	sed -e 's/<[^>]*>//g' 


The other alternative, of course, is to write a script which launches
is in lynx, but since most users are writing this email in 
netscape anyway, you'll probably have incompatible tags.


Yes, this is also one of my pet peeves.


					 Bri
__
Brian Hatch, bri@ifokr.org              "Strange that if you cut off part of a 
Systems and Security Engineer            chromosome, you get a boy, and if you
Onsight, Inc.  http://www.avue.com/      cut off part of a boy you get a girl."


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBMwHht6wnNhOoR921AQGHggP/QbZ7gaKhU1XkZXzNUCLYQbO3TtOuCSlZ
G8PYSf4rw+Mh95Xn43E2CimBG5Ml2j4XVf8GVvjptVbDRKOU1jiLvxeXk8gdg8FE
wM16cIGEOOCCMEarMy75wHF8fQV+dyCFWOQ4QeRxe4fMjqj/Hu6r0bjQyGCK8OPb
iBbDx+T3FAg=
=JERd
-----END PGP SIGNATURE-----


From firewalls-owner  Wed Feb 12 09:05:53 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA22674 for firewalls-outgoing; Wed, 12 Feb 1997 07:24:24 -0800 (PST)
Received: from glacier.wise.edt.ericsson.se (glacier-ext.wise.edt.ericsson.se [193.180.251.38]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id HAA22442 for <firewalls@greatcircle.com>; Wed, 12 Feb 1997 07:23:21 -0800 (PST)
Received: from negrita.nmac.ericsson.se (negrita.nmac.ericsson.se [130.100.187.78]) by glacier.wise.edt.ericsson.se (8.7.5/8.7.3/glacier-0.9) with SMTP id QAA08978 for <firewalls@greatcircle.com>; Wed, 12 Feb 1997 16:22:03 +0100 (MET)
Received: by negrita.nmac.ericsson.se (SMI-8.6/SMI-SVR4)
	id QAA11422; Wed, 12 Feb 1997 16:21:17 +0100
Date: Wed, 12 Feb 1997 16:21:17 +0100
From: etxrosd@nmac.ericsson.se (Robert Stahlbrand)
Message-Id: <199702121521.QAA11422@negrita.nmac.ericsson.se>
To: firewalls@greatcircle.com
Subject: Cannot compile x-gw, TIS ver. 2.0 (beta) on Linux (RedHat 4.1)
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-MD5: gV6m3796pZlrQaG1HttWUA==
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi!

I have got a problem! I cannot compile x-gw, TIS ver. 2.0 (beta) on Linux 
(RedHat 4.1). It is (as you can see below) a problem with libXt.so (I think).

Here is the error message:

/usr/X11/lib/libXt.so: undefined reference to `SmcSaveYourselfDone'
/usr/X11/lib/libXt.so: undefined reference to `IceConnectionNumber'
/usr/X11/lib/libXt.so: undefined reference to `SmcDeleteProperties'
/usr/X11/lib/libXt.so: undefined reference to `IceProcessMessages'
/usr/X11/lib/libXt.so: undefined reference to `SmcRequestSaveYourselfPhase2'
/usr/X11/lib/libXt.so: undefined reference to `SmcInteractDone'
/usr/X11/lib/libXt.so: undefined reference to `SmcCloseConnection'
/usr/X11/lib/libXt.so: undefined reference to `SmcSetProperties'
/usr/X11/lib/libXt.so: undefined reference to `SmcOpenConnection'
/usr/X11/lib/libXt.so: undefined reference to `SmcInteractRequest'
/usr/X11/lib/libXt.so: undefined reference to `SmcModifyCallbacks'
/usr/X11/lib/libXt.so: undefined reference to `SmcClientID'
/usr/X11/lib/libXt.so: undefined reference to `SmcGetIceConnection'
make: *** [x-gw] Error 1

This is the compile syntax for x-gw:
cc -g -o x-gw x-gw.o ulib.a ../libfwall.a  -L/usr/X11/lib -lXaw -lXmu -lXt 
-lXext -lX11 -lc

Is there a link missing in the compile syntax? Do I have to install a new 
version of X11 (I use X11R6.1)?

tn-gw, ftp-gw etc. compiles just perfect!
I would be very glad if someone could help me with this.


/Robert Stahlbrand, Ericsson Telecom AB

From firewalls-owner  Wed Feb 12 09:24:17 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA25620 for firewalls-outgoing; Wed, 12 Feb 1997 07:51:07 -0800 (PST)
Received: from rolta.com (gatekeeper.rolta.com [206.154.250.46]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id HAA22957 for <firewalls@greatcircle.com>; Wed, 12 Feb 1997 07:26:00 -0800 (PST)
Received: by rolta.com; id JAA11700; Wed, 12 Feb 1997 09:04:18 -0600
Received: from unknown(204.177.195.232) by gatekeeper.rolta.com via smap (g3.0.1)
	id xma011693; Wed, 12 Feb 97 09:03:48 -0600
Received: by rolta.com; id IAA05276; Wed, 12 Feb 1997 08:38:51 GMT
Received: from Vinay.rolta.com ([172.17.1.84]) by mailserver.rolta.com (8.6.9/8.6.9) with SMTP id VAA08491 for <firewalls@greatcircle.com>; Wed, 12 Feb 1997 21:11:20 GMT
Received: by Vinay.rolta.com with Microsoft Mail
	id <01BC1928.747BFC00@Vinay.rolta.com>; Wed, 12 Feb 1997 21:05:20 +-5-30
Message-ID: <01BC1928.747BFC00@Vinay.rolta.com>
From: Vinay Sawarkar <vinay@rolta.com>
To: "firewalls@greatcircle.com" <firewalls@greatcircle.com>
Subject: Problem with Wellfleet Router
Date: Wed, 12 Feb 1997 21:05:03 +-5-30
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi !

This is not related to firewall but we would appreciate if some =
networking professional helps us in solving unusual problem with our =
Wellfleet 4000 router procured from Intergraph. The router  is gives =
following error message while  booting :=20


" config warning: channel record expected but not found"

A few days  back it used to give following error :

" config warning:  expecting conical connection non was found" =20

Then the screen locks up.

One can Telnet to it and get into the configuration screens.  We saw =
nothing
unusual in the configuration.

We have confirmed that it is not hardware related. =20

Could you please let us know what could be the problem ?

Thanks and Regards,

Vinay Sawarkar
Rolta India Limited
Bombay INDIA

vinay@rolta.com



From firewalls-owner  Wed Feb 12 10:05:34 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA03525 for firewalls-outgoing; Wed, 12 Feb 1997 09:14:36 -0800 (PST)
Received: from peapod.co.uk (mail.peapod.co.uk [195.152.168.34]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id JAA03454 for <firewalls@greatcircle.com>; Wed, 12 Feb 1997 09:14:17 -0800 (PST)
Received: by gateway.peapod.co.uk id <11649-4>; Wed, 12 Feb 1997 17:10:37 +0000
Message-Id: <97Feb12.171037gmt.11649-4@gateway.peapod.co.uk>
X-Sender: david@post.peapod.co.uk
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Wed, 12 Feb 1997 17:16:21 +0000
To: firewalls@greatcircle.com
From: david butler <david@peapod.co.uk>
Subject: Re: [NTSEC] NT Security list
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Is there an index page which goes with all this?

> The URL is:
> 
> http://www.emf.net/~ddonahue/NThacks/NThacks.zip
> 
> Just expand it in any http accessible directory and voi'la, a mirror is
> done.

--
David Butler - Senior Support Consultant
Peapod Internet   tel : +44 181 606 9924 http://www.peapod.co.uk/
mailto:david@peapod.co.uk

From firewalls-owner  Wed Feb 12 10:11:17 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA00664 for firewalls-outgoing; Wed, 12 Feb 1997 08:46:41 -0800 (PST)
Received: from brimstone.rnb.com (brimstone.rnb.com [204.178.80.14]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id IAA00641 for <firewalls@greatcircle.com>; Wed, 12 Feb 1997 08:46:27 -0800 (PST)
Received: by brimstone.rnb.com; id LAA25027; Wed, 12 Feb 1997 11:45:18 -0500 (EST)
Received: from relay.rnb.com(199.99.101.2) by brimstone.rnb.com via smap (3.2)
	id xma024943; Wed, 12 Feb 97 11:44:58 -0500
Received: from monarch.rnb.com (monarch [150.1.33.146])
          by relay.rnb.com (8.8.4/8.8.4) with SMTP
	  id LAA27189 for <firewalls@greatcircle.com>; Wed, 12 Feb 1997 11:44:57 -0500 (EST)
Comments: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Comments: Internet Message: Sender identity is not verified.
Comments: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Date: Wed, 12 Feb 1997 11:43:18 -0500 (EST)
From: Ken Kempster <kempster@monarch.rnb.com>
To: Firewalls <firewalls@greatcircle.com>
Subject: IP filter
Message-ID: <Pine.SOL.3.95.970212114135.4472B-100000@monarch.rnb.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I am thinking of using IP Filter 3.1.7
on a firewall between our internal
net and some Market Data servers.

Does anyone know of any issues/problems
with this product?

any info. would be great.


|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|  Ken Kempster                 kempster@monarch.rnb.com  |
|  Network Systems Engineer          _\|/_                |
|  Republic National Bank            (o o)                |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~oOO-(_)-OOo~~~~~~~~~~~~~~


From firewalls-owner  Wed Feb 12 10:21:31 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA03923 for firewalls-outgoing; Wed, 12 Feb 1997 09:17:39 -0800 (PST)
Received: from csc.com (explorer.csc.com [20.1.10.27]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id JAA03883 for <Firewalls@GreatCircle.COM>; Wed, 12 Feb 1997 09:17:14 -0800 (PST)
Received: from relay.ashton.csc.com by csc.com with smtp
	(Smail3.1.29.1 #1) id m0vuiI2-001AknC; Wed, 12 Feb 97 12:16 EST
Received: by relay.ashton.csc.com; id MAA04496; Wed, 12 Feb 1997 12:16:27 -0500
Received: from jkerr2.sed.csc.com(20.2.53.152) by relay.ashton.csc.com via smap (g3.0.1)
	id sma004494; Wed, 12 Feb 97 12:16:05 -0500
Message-ID: <3301FB5E.5B8F@csc.com>
Date: Wed, 12 Feb 1997 12:18:22 -0500
From: John Kerr <jkerr2@csc.com>
Reply-To: jkerr2@csc.com
Organization: Computer Sciences Corporation
X-Mailer: Mozilla 3.0 (Win95; I)
MIME-Version: 1.0
To: Mark Inaba <minaba@mail1.ci.chi.il.us>
CC: fw <Firewalls@GreatCircle.COM>
Subject: Re: simple fw1 question (really simple, ignore if you're rushed) :) (fwd)
References: <199702111452.IAA13636@mail1>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Mark Inaba wrote:
> 
> oops, i sent this to the wrong address...resending to the
> fw mailing list
> > >
> > >     i just got into the driver's seat of sun's firewall software
> > > and I'd like to make a rule to allow tn3270 telnets from a bunch/group
> > > of workstations to our ibm mainframe. Is there a way to limit
> > > the time that the access is active? I don't really want to (and I'm
> > > not even sure if I can) authenticate individual users who pass thru,
> > > I just want to limit access of that type of access to mon-fri...
> > > can do? how? :)
> > > thanks!
> > >
> > > -Mark
> > >
> > >
> >
> >
Mark,
You will be able to set up users to only allow them acces for a
specified amount of time .  This is done when you create the user
account.  You could then create a group and put all of these useres into
that group and then create a rule in your rule base to allow this group
to access you mainframe.  Hope this helps
	John

From firewalls-owner  Wed Feb 12 10:39:17 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA00684 for firewalls-outgoing; Wed, 12 Feb 1997 08:47:17 -0800 (PST)
Received: from zonk.geko.net.au (zonk.geko.net.au [203.2.239.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id IAA00677 for <firewalls@GreatCircle.COM>; Wed, 12 Feb 1997 08:46:58 -0800 (PST)
Received: from mozart.void.hell.net (dialup1190.geko.net.au [203.18.92.190]) by zonk.geko.net.au (8.7.5/8.6.12) with ESMTP id DAA04536; Thu, 13 Feb 1997 03:46:00 +1100 (EST)
Received: from beethoven ([192.168.0.2]) by mozart.void.hell.net
	 with smtp id m0vuhxe-000Jn4C
	(Debian Smail-3.2 1996-Jul-4 #2); Thu, 13 Feb 1997 03:55:10 +1100 (EST)
Message-Id: <m0vuhxe-000Jn4C@mozart.void.hell.net>
Date: Thu, 13 Feb 1997 03:45:32 +1000
From: <winspace@void.hell.net> (Norman Widders)
To: <firewalls@GreatCircle.COM>
Subject: Re: e-mail !!!!= HTML   \:-|
Reply-To: <winspace@geko.net.au>
Organisation: W.C.E. Consulting
X-Mailer: Mailbase for NT v1.2.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7BIT
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

In reply to the honourable 'peter@baileynm.com ' who said:

> > please, please, please, PLEASE !!!!!!!!
> 
> > stop posting in HTML !!!!!!!!
> 
> It's worse. It's *ILLEGAL* HTML!
> 
> Netscape 4 doesn't seem to have an option to turn it off.
> 

The thing I detest about html, is when a patch or source in C is converted into 
html, stripping out portions indiscriminately ie, the #includes and other things, 
making it uncompilable. Just my $0.02 B)

cheers
+------------------------------------------------------------+
|                                                            |
|   _/_/         _/_/     _/_/_/_/_/_/      _/_/_/_/_/_/     |
|   _/_/        _/_/     _/_/_/            _/_/              |
|    _/_/ _/_/ _/_/      _/_/              _/_/_/            |
|     _/_/_/_/_/_/       _/_/_/            _/_/              |
|      _/_/  _/_/         _/_/_/_/_/_/      _/_/_/_/_/_/     |
|                                                            |
| winspace@geko.net.au - Software Engineering in SQL and C++ |
+------------------------------------------------------------+



From firewalls-owner  Wed Feb 12 10:51:18 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id IAA00215 for firewalls-outgoing; Wed, 12 Feb 1997 08:40:32 -0800 (PST)
Received: from fw.roguewave.com (roguewave.com [198.68.9.6]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id IAA00203 for <firewalls@GreatCircle.COM>; Wed, 12 Feb 1997 08:40:16 -0800 (PST)
Received: by fw.roguewave.com; id IAA26830; Wed, 12 Feb 1997 08:37:35 -0800 (PST)
Received: from unknown(10.68.9.1) by fw.roguewave.com via smap (3.2)
	id xma026827; Wed, 12 Feb 97 08:37:21 -0800
Received: from rw0328 ([10.68.2.128]) by cvo.roguewave.com (8.8.2/8.8.2) with SMTP id IAA14775; Wed, 12 Feb 1997 08:38:03 -0800 (PST)
Message-Id: <199702121638.IAA14775@cvo.roguewave.com>
Comments: Authenticated sender is <snyder@mail.cvo.roguewave.com>
From: "Ron Snyder" <snyder@roguewave.com>
Organization: Rogue Wave Software
To: Bob Beck <beck@obtuse.com>, firewalls@GreatCircle.COM
Date: Wed, 12 Feb 1997 08:36:16 -0800
Subject: Re: TIS smap.c-- blocking incoming email by recipient?
Reply-to: snyder@roguewave.com
In-reply-to: <199702120714.AAA01206@chocolate.obtuse.com>
References: <199702112337.PAA22034@cvo.roguewave.com> from "Ron Snyder" at Feb 11, 97 03:35:42 pm
X-mailer: Pegasus Mail for Win32 (v2.52)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 	I'm sure you could, but why add the complication and need to
> administer the list of users on the firewall? It's just as easy to add
> an alias for each of the users on the mailhub to deliver the mail to
> /dev/null or otherwise throw it away. quick, simple, no bounce, and no
> complication with the firewall.  Yes you can do it on the firewall,
> but this is a pretty basic system admin trick, something you'll
> probably have to do frequently. (At least I know I do :-) I'd
> personally leave this task on the mailhub where you do your regular
> administration of mail addresses. Don't add any more maintenance to 
> your firewall than you need to. 

I will confess to being somewhat "less than forthright" about what 
I'm doing.  _Every_ piece of email to these certain users has been 
spam, and although I could just redirect their stuff to /dev/null, I 
would much rather the spammers remove these names from their list.  

Why don't I just send the spammers email telling them?  Because their 
email addresses are usually bogus, which is why I've been getting the 
bounce notice.

And, since I'm being completely honest, for those userids in the 
list, I'll issue a "471" message, rather than a "571".

It's not really any more work to administer the names on the firewall 
than to administer the names in /etc/aliases (after any coding that 
has to be done).

-ron
--
ron snyder   snyder@roguewave.com       |         This space
Rogue Wave Software, Inc                |         intentionally    
{news,unix} admin                       |         left blank
#include <std-dsclmr.h++>               |   

From firewalls-owner  Wed Feb 12 11:56:41 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA22697 for firewalls-outgoing; Wed, 12 Feb 1997 11:28:14 -0800 (PST)
Received: from emf.emf.net (emf.emf.net [205.149.0.20]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id LAA22661 for <firewalls@GreatCircle.COM>; Wed, 12 Feb 1997 11:28:02 -0800 (PST)
Received: from d4bdonapc01 (dhcp-17-005.srv.ptss.com [155.241.17.5]) by emf.emf.net (EMF-K/K) with ESMTP id LAA27844; Wed, 12 Feb 1997 11:26:53 -0800
Message-Id: <199702121926.LAA27844@emf.emf.net>
From: "David B. Donahue" <ddonahue@emf.net>
To: "david butler" <david@peapod.co.uk>, <firewalls@GreatCircle.COM>
Cc: "NT Security Mailing list" <ntsecurity@iss.net>
Subject: Re: [NTSEC] NT Security list
Date: Wed, 12 Feb 1997 11:18:53 -0800
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1155
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

The page called nt-exploits.htm acts as an index. It's in the zip file.

>From what I've seen in the files, you should be able to rename it without
breaking any links (the sub-pages don't have any backlinks).

Also thanks to the many people who pointed out the UNIX version of PKUNZIP
called Infozip and the UNIX based utility for mirroring web sites called
gnu "wget".

-David Donahue
----------
> From: david butler <david@peapod.co.uk>
> To: firewalls@GreatCircle.COM
> Subject: Re: [NTSEC] NT Security list
> Date: Wednesday, February 12, 1997 9:16 AM
> 
> Is there an index page which goes with all this?
> 
> > The URL is:
> > 
> > http://www.emf.net/~ddonahue/NThacks/NThacks.zip
> > 
> > Just expand it in any http accessible directory and voi'la, a mirror is
> > done.
> 
> --
> David Butler - Senior Support Consultant
> Peapod Internet   tel : +44 181 606 9924 http://www.peapod.co.uk/
> mailto:david@peapod.co.uk

From firewalls-owner  Wed Feb 12 12:52:55 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id MAA00384 for firewalls-outgoing; Wed, 12 Feb 1997 12:26:19 -0800 (PST)
Received: from actcom.co.il (actcom.co.il [192.114.47.1]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id MAA00355 for <firewalls@greatcircle.com>; Wed, 12 Feb 1997 12:26:02 -0800 (PST)
Received: from localhost by actcom.co.il  with SMTP
	(8.8.4/actcom-0.1) id WAA14114;
	Wed, 12 Feb 1997 22:26:24 +0200 (EET)
	 (rfc931-sender: hayam@localhost)
Date: Wed, 12 Feb 1997 22:26:22 +0200 (EET)
From: Avraham Hayam <hayam@actcom.co.il>
To: "Charles L. Johnson" <charlesj@iquest.net>
cc: firewalls@greatcircle.com
Subject: Re: Virus named Penpal Greetings - Is this a hoax?
In-Reply-To: <3300F661.5CC4@iquest.net>
Message-ID: <Pine.SUN.3.95-heb-2.07.970212222428.11939A-100000@actcom.co.il>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Greetings,

The best way to know if it's a hoax or not and before raising an alarm the
best way is to ask CERT.

hayam@actcom.co.il

On Tue, 11 Feb 1997, Charles L. Johnson wrote:

> Firewalls;
> 
> 	I have read the message below several times and believe that this is a hoax.  But I must admit there 
> is the possibility that some hacker has figured a way of exploiting vulnerabilities.  I want to confirm - a 
> second opinion, that this is just a hoax.  Please see clip below;
> 
> If anyone receives mail entitled; PENPAL GREETINGS! please delete it > > WITHOUT reading it!!  This is a 
> warning for all Internet users - there > > is a dangerous virus propagating across the Internet through an
> e-mail
> >
> > message entitled 'PENPAL GREETINGS!". DO NOT DOWNLOAD ANY MESSAGE > > ENTITLED "PENPAL GREETINGS"!!  This message appears to be a friendly > > letter asking you if you are interested in a penpal, but by the time you > 
> > read this letter,it is too late. The "trojan horse" virus will have > > already infected the boot sector of your hard drive, destroying all of > > the data present. 
> 
> It is a self-replicating virus, and once the message > > is read, it will AUTOMATICALLY forward itselfto 
> anyone who's e-mail > > address is present in YOUR mailbox. > > > > This virus will DESTROY your hard drive, 
> and holds the potential to > > DESTROY the hard drive of anyone whose mail is in your in box, and who's > > 
> mail is in their in box and so on.  If this virus keeps getting passed, > > it has the potential to do a great 
> deal of DAMAGE to computer networks > > worldwide. > > > > Brian, Please pass this information along to 
> whomever you think needs to be alerted. > >
> 


From firewalls-owner  Wed Feb 12 13:22:43 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA07485 for firewalls-outgoing; Wed, 12 Feb 1997 13:16:02 -0800 (PST)
Received: from darkstar.sysinfo.com (darkstar.sysinfo.com [204.246.65.62]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id NAA07478 for <firewalls@GreatCircle.COM>; Wed, 12 Feb 1997 13:15:54 -0800 (PST)
Received: from parka.winternet.com (dufresne@parka.winternet.com [198.174.169.9]) by darkstar.sysinfo.com (8.8.2/8.8.2) with SMTP id PAA01747; Wed, 12 Feb 1997 15:14:09 -0600
Date: Wed, 12 Feb 1997 15:04:01 -0600 (CST)
From: Ron DuFresne <dufresne@parka.winternet.com>
To: Avraham Hayam <hayam@actcom.co.il>
cc: "Charles L. Johnson" <charlesj@iquest.net>, firewalls@GreatCircle.COM
Subject: Re: Virus named Penpal Greetings - Is this a hoax?
In-Reply-To: <Pine.SUN.3.95-heb-2.07.970212222428.11939A-100000@actcom.co.il>
Message-ID: <Pine.GSO.3.95q.970212150102.17011C-100000@parka.winternet.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

If this is juat an e-mail, it's a hoax and should be added to the list of
known hoax's that was just recently generated here.  If this is an e-mail
with an attachment, then perhaps there is a slight threat, from those dumb
lusers that lauch everything sent their way.  If it's a *.zip file, as is
slightly pointed to in the thread below, then you deserve what you get for
playing with files from folks you know not, and the admin of the ftp site
from which the file was obtained should be contacted to prevent further
lusers from checking the danged thing out.

Later,

Ron DuFresne

On Wed, 12 Feb 1997, Avraham Hayam wrote:

> Greetings,
> 
> The best way to know if it's a hoax or not and before raising an alarm the
> best way is to ask CERT.
> 
> hayam@actcom.co.il
> 
> On Tue, 11 Feb 1997, Charles L. Johnson wrote:
> 
> > Firewalls;
> > 
> > 	I have read the message below several times and believe that this is a hoax.  But I must admit there 
> > is the possibility that some hacker has figured a way of exploiting vulnerabilities.  I want to confirm - a 
> > second opinion, that this is just a hoax.  Please see clip below;
> > 
> > If anyone receives mail entitled; PENPAL GREETINGS! please delete it > > WITHOUT reading it!!  This is a 
> > warning for all Internet users - there > > is a dangerous virus propagating across the Internet through an
> > e-mail
> > >
> > > message entitled 'PENPAL GREETINGS!". DO NOT DOWNLOAD ANY MESSAGE > > ENTITLED "PENPAL GREETINGS"!!  This message appears to be a friendly > > letter asking you if you are interested in a penpal, but by the time you > 
> > > read this letter,it is too late. The "trojan horse" virus will have > > already infected the boot sector of your hard drive, destroying all of > > the data present. 
> > 
> > It is a self-replicating virus, and once the message > > is read, it will AUTOMATICALLY forward itselfto 
> > anyone who's e-mail > > address is present in YOUR mailbox. > > > > This virus will DESTROY your hard drive, 
> > and holds the potential to > > DESTROY the hard drive of anyone whose mail is in your in box, and who's > > 
> > mail is in their in box and so on.  If this virus keeps getting passed, > > it has the potential to do a great 
> > deal of DAMAGE to computer networks > > worldwide. > > > > Brian, Please pass this information along to 
> > whomever you think needs to be alerted. > >
> > 
> 
> 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
	***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D.  Just don't touch anything.


From firewalls-owner  Wed Feb 12 13:36:41 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA08889 for firewalls-outgoing; Wed, 12 Feb 1997 13:29:14 -0800 (PST)
Received: from upshield.uniq.com.au (upstop.uniq.com.au [192.195.152.113]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id NAA08868 for <firewalls@GreatCircle.COM>; Wed, 12 Feb 1997 13:29:03 -0800 (PST)
Received: (from smtp@localhost) by upshield.uniq.com.au id IAA06979
  (8.8.5/IDA-1.6); Thu, 13 Feb 1997 08:27:20 +1100 (EST)
Received: from upshoo.uniq.com.au(192.195.152.130) by upshield via smap (V1.3)
	id ./smaAAAa001h1; Thu Feb 13 08:26:57 1997
Received: from basil.uniq.com.au (basil.uniq.com.au [192.168.3.1]) by upserv.uniq.com.au with ESMTP id IAA12586
  (8.8.5/IDA-1.6); Thu, 13 Feb 1997 08:22:14 +1100 (EST)
Received: (from pauline@localhost) by basil.uniq.com.au id IAA04458
  (8.8.5/IDA-1.6); Thu, 13 Feb 1997 08:25:07 +1100 (EST)
Date: Thu, 13 Feb 1997 08:25:07 +1100 (EST)
From: Pauline van Winsen - Uniq Professional Services <Pauline.van.Winsen@uniq.com.au>
Message-ID: <199702122125.IAA04458@basil.uniq.com.au>
To: firewalls@GreatCircle.COM, snyder@roguewave.com
Subject: Re: TIS smap.c-- blocking incoming email by recipient?
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Content-MD5: NcCvfTsaEZzuod1knEyPhw==
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

hi ron,

> I will confess to being somewhat "less than forthright" about what 
> I'm doing.  _Every_ piece of email to these certain users has been 
> spam, and although I could just redirect their stuff to /dev/null, I 
> would much rather the spammers remove these names from their list.  
> 
> Why don't I just send the spammers email telling them?  Because their 
> email addresses are usually bogus, which is why I've been getting the 
> bounce notice.
> 
> And, since I'm being completely honest, for those userids in the 
> list, I'll issue a "471" message, rather than a "571".
> 
> It's not really any more work to administer the names on the firewall 
> than to administer the names in /etc/aliases (after any coding that 
> has to be done).

take a look at http://www.cih.com/~hagan/smap-hacks/ - these hacks are
designed to stop spam. for more general spam related pages check out:
http://www.vix.com/spam/mailblock.html

hope this helps,
pauline

Pauline van Winsen                                   pauline@uniq.com.au
Uniq Professional Services Pty Ltd                       www.uniq.com.au
PO Box 70, Paddington, NSW 2021,                      (Sydney) Australia
Phone: +61-2-9380-6360      Fax: +61-2-9380-6416      Pager: 016 287 000
"Perhaps there's a party coming up and you can't quite squeeze into that
glamorous gown; a crash diet may help you on this ocassion."
	  	Keeping in Trim - Introduction, Woman's World, circa 1964.

From firewalls-owner  Wed Feb 12 14:09:10 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA11103 for firewalls-outgoing; Wed, 12 Feb 1997 13:50:41 -0800 (PST)
Received: from netcomsv.netcom.com (uucp4.netcom.com [163.179.3.4]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id NAA11040 for <firewalls@greatcircle.com>; Wed, 12 Feb 1997 13:50:19 -0800 (PST)
Received: by netcomsv.netcom.com with UUCP (8.6.12/SMI-4.1)
	id MAA23245; Wed, 12 Feb 1997 12:20:22 -0800
Received: from ws11.hteinc.com by hteinc.com (8.6.12/1.7)
	id OAA21718; Wed, 12 Feb 1997 14:45:49 -0500
Date: Wed, 12 Feb 97 13:57:42    
From: Kurt Kessel <kkessel@hteinc.com>
Subject: Spit DNS - Another way
To: firewalls@greatcircle.com
X-PRIORITY: 3 (Normal)
X-Mailer: Chameleon 5.0, TCP/IP for Windows, NetManage Inc.
Message-ID: <Chameleon.855776981.kkessel@ws11.hteinc.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I have been watching the split DNS discussions and learned a lot of
the issues, good and bad, for implementing such. As I am beginnging to
resolve our own companies issues, I thought of another deviation of
the split DNS issue without any of the drawbacks normally associated
problems. 

What if a company let the ISP be the primary DNS for the public network,
say mydom.com. Their internal DNS remained the primary for their internal
domain, again mydom.com. The trick would be to configure the firewall as
a DNS client of both DNS servers (ISP and internal). With the use of
proxies and filtering on the FW, no DNS leakage should happen. The proxies
should be able to resolve doman names as needed.

This also has the advantage of removing the DNS load off of the firewall
and letting my ISP or existing internal server handle that traffic.

Now does anybody see any holes in this? Is the concept sound, but
implementation flawed? Any discussion/comments would be appreciated.


Kurt Kessel                           EMail: kkessel@hteinc.com
Systems Consultant/Webmaster          WWW:   http://www.hteinc.com
HTE, Inc.                             Voice: 407-841-3235
Solutions for Government & Utilities  Fax:   407-246-8835


From firewalls-owner  Wed Feb 12 14:57:35 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA15742 for firewalls-outgoing; Wed, 12 Feb 1997 14:37:23 -0800 (PST)
Received: from mail-gw.pacbell.net (mail-gw.pacbell.net [206.13.28.25]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id OAA15656 for <firewalls@GreatCircle.COM>; Wed, 12 Feb 1997 14:37:03 -0800 (PST)
Received: from p133 (ppp-206-170-30-30.hywr01.pacbell.net [206.170.30.30]) by mail-gw.pacbell.net (8.8.5/8.7.1) with SMTP id OAA02790; Wed, 12 Feb 1997 14:35:55 -0800 (PST)
Message-ID: <3302163E.7200@pacbell.net>
Date: Wed, 12 Feb 1997 11:13:18 -0800
From: Dave Sroelov <dsroelov@pacbell.net>
X-Mailer: Mozilla 3.01Gold (WinNT; I)
MIME-Version: 1.0
To: fw-1-mailinglist@us.checkpoint.com, firewalls@GreatCircle.COM
Subject: strange behavior
References: <199702120205.SAA19599@althea.Ebay.Sun.COM>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

being somewhat new to FW-1 i have come across something that is a little
strange.  if i set up a policy with one rule that says to reject all
packet types from source=any to destination=any and log everything, why
does ping still work?

if i specifically add a rule to block icmp packets then ping stops.  i
would think that blocking 'all' packet types would block everything that
FW-1 knows about, and it knows about icmp.

	dave


From firewalls-owner  Wed Feb 12 15:20:50 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA18380 for firewalls-outgoing; Wed, 12 Feb 1997 14:57:15 -0800 (PST)
Received: from gw.iai.com (gw.iai.com [206.64.157.62]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id OAA18362 for <firewalls@greatcircle.com>; Wed, 12 Feb 1997 14:57:05 -0800 (PST)
Received: by gw.iai.com; id RAA06055; Wed, 12 Feb 1997 17:56:06 -0500 (EST)
Received: from milford.ma.iai.com(10.1.1.2) by gw.iai.com via smap (3.2)
	id xma006053; Wed, 12 Feb 97 17:55:52 -0500
Received: by milford.iai.com (AIX 4.1/UCB 5.64/4.03)
          id AA21426; Wed, 12 Feb 1997 17:56:21 -0500
From: jegan@iai.com (James Egan)
Message-Id: <9702122256.AA21426@milford.iai.com>
Subject: Re: Virus named Penpal Greetings
To: firewalls@greatcircle.com
Date: Wed, 12 Feb 1997 17:56:21 -0500 (EST)
In-Reply-To: <199702121420.GAA15752@miles.greatcircle.com> from "harley@icrf.icnet.uk" at Feb 12, 97 02:19:35 pm
Reply-To: Jim.Egan@iai.com
Organization: Integrated Architectures, Inc.
Pgp-Fingerprint: 64 47 DC 51 D9 11 1D FF  31 43 9C 4C E2 A1 FC 04
Pgp-Public-Key: public-key-server@martigny.ai.mit.edu (subject: GET jegan) 
X-Mailer: ELM [version 2.4 PL24 ME5a]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I have reviewed that CIAC hoaxes page and found the following:

The PENPAL GREETINGS! Hoax shown below appears to be an attempt to kill an e-mail chain
letter by claiming that it is a self starting Trojan that destroys your hard drive and then sends copies
of itself to everyone whose address in in your mailbox. Reading an e-mail message does not run it
nor does it run any attachments, so this Trojan must be self starting. Aside from the fact that a
program cannot start itself, the Trojan would also have to know about every different kind of e-mail
program to be able to forward copies of itself to other people. This warning is totally a hoax.

/Jim/
--
James P. Egan                   | Jim.Egan@iai.com 
Integrated Architectures, Inc.  | "Trust no one"

From firewalls-owner  Wed Feb 12 15:51:08 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id PAA24370 for firewalls-outgoing; Wed, 12 Feb 1997 15:44:44 -0800 (PST)
Received: from relay2.smtp.psi.net (relay2.smtp.psi.net [38.8.188.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id PAA24330 for <firewalls@greatcircle.com>; Wed, 12 Feb 1997 15:44:28 -0800 (PST)
Received: from server2 by relay2.smtp.psi.net (8.8.3/SMI-5.4-PSI)
	id SAA19152; Wed, 12 Feb 1997 18:43:28 -0500 (EST)
Message-Id: <199702122343.SAA19152@relay2.smtp.psi.net>
Date: Wed, 12 Feb 1997 18:42:00 -0500
From: Keith Stone <keiths@geotel.com>
Subject: RE: Spit DNS - Another way
To: firewalls <firewalls@greatcircle.com>, Kurt Kessel <kkessel@hteinc.com>
X-Mailer: Worldtalk (NetConnex V4.00a)/MIME
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


I'm considering something somewhat analagous/similar. I want an   
internal-only DNS server that corporate clients go to first to resolve   
hostnames. If it's not our domain, it forwards to the outside.

On the other hand, this same server never gets any initiated requests   
from the outside. Instead, I want there to be a server that *is* visible   
to the outside that has about 10 hostnames/addresses visible to the   
outside. This list would be kept manually, and it could be the ISP that   
hosts it for us.

 ----------
From:  Kurt Kessel
Sent:  Wednesday, February 12, 1997 6:22 PM
To:  firewalls
Subject:  Spit DNS - Another way

I have been watching the split DNS discussions and learned a lot of
the issues, good and bad, for implementing such. As I am beginnging to
resolve our own companies issues, I thought of another deviation of
the split DNS issue without any of the drawbacks normally associated
problems.

What if a company let the ISP be the primary DNS for the public network,
say mydom.com. Their internal DNS remained the primary for their internal
domain, again mydom.com. The trick would be to configure the firewall as
a DNS client of both DNS servers (ISP and internal). With the use of
proxies and filtering on the FW, no DNS leakage should happen. The   
proxies
should be able to resolve doman names as needed.

This also has the advantage of removing the DNS load off of the firewall
and letting my ISP or existing internal server handle that traffic.

Now does anybody see any holes in this? Is the concept sound, but
implementation flawed? Any discussion/comments would be appreciated.


Kurt Kessel                           EMail: kkessel@hteinc.com
Systems Consultant/Webmaster          WWW:   http://www.hteinc.com
HTE, Inc.                             Voice: 407-841-3235
Solutions for Government & Utilities  Fax:   407-246-8835



From firewalls-owner  Wed Feb 12 16:16:39 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id PAA25606 for firewalls-outgoing; Wed, 12 Feb 1997 15:54:11 -0800 (PST)
Received: from gateway.contact.com.sg (gateway.contact.com.sg [203.120.144.21]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id PAA25594 for <firewalls@GreatCircle.COM>; Wed, 12 Feb 1997 15:53:55 -0800 (PST)
Received: from stormbringer.contact ([172.20.1.102])
          by gateway.contact.com.sg (Netscape Mail Server v1.1) with SMTP
          id AAA20884; Thu, 13 Feb 1997 07:46:11 +0800
Message-ID: <33025781.785@contact.com.sg>
Date: Thu, 13 Feb 1997 07:51:29 +0800
From: zeck@contact.com.sg (Zeck Lim)
Reply-To: zeck@contact.com.sg
Organization: CONTACT Sembawang Media 
X-Mailer: Mozilla 3.0 (Win95; I)
MIME-Version: 1.0
To: Dave Sroelov <dsroelov@pacbell.net>
CC: fw-1-mailinglist@us.checkpoint.com, firewalls@GreatCircle.COM
Subject: Re: [FW1] strange behavior
References: <199702120205.SAA19599@althea.Ebay.Sun.COM> <3302163E.7200@pacbell.net>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Dave Sroelov wrote:
> 
> being somewhat new to FW-1 i have come across something that is a little
> strange.  if i set up a policy with one rule that says to reject all
> packet types from source=any to destination=any and log everything, why
> does ping still work?
> 
> if i specifically add a rule to block icmp packets then ping stops.  i
> would think that blocking 'all' packet types would block everything that
> FW-1 knows about, and it knows about icmp.
> 
>         dave

Hi Dave,

FW-1 checks among other things, BEFORE the Rule Base, is the Security 
Policy. You may like to disbale the ping option in that. Alternatively,
you can set it as "last" where it will be processed last, after the
Rule Base.

cheers!
-- 
Zeck Lim
Systems Engineer (UNIX/Security)               Tel: 65-4330469
Contact Sembawang Media Pte Ltd                Fax: 65-4330433

From firewalls-owner  Wed Feb 12 16:51:32 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id QAA29260 for firewalls-outgoing; Wed, 12 Feb 1997 16:34:24 -0800 (PST)
Received: from silence.secnet.com ([199.185.231.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id QAA29242 for <firewalls@GreatCircle.COM>; Wed, 12 Feb 1997 16:34:14 -0800 (PST)
Received: from titus.secnet.com (389834@[199.185.231.30]) by silence.secnet.com (8.8.5/secnet) with SMTP id RAA00516; Wed, 12 Feb 1997 17:34:59 -0700 (MST)
Message-Id: <3.0.32.19970212173433.00735ccc@silence.secnet.com>
X-Sender: jwilkins@silence.secnet.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Wed, 12 Feb 1997 17:34:34 -0700
To: Christopher Klaus <cklaus@iss.net>
From: Jonathan Wilkins <jwilkins@secnet.com>
Subject: Re: Port 135 [and other NT attacks] (fwd)
Cc: firewalls@GreatCircle.COM
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Chris Klaus posted:
>NT DNS Denial Attack
>
>If an attacker spoofs a response that the DNS never requested, DNS will
>terminate.
>There is an advisory on this available at
http://www.iss.net/lists/general/0118.html
>
>Solution:
>
>Currently, Microsoft is working on a solution.

Here's a little more information on this problem:

there were a few different problems discovered in the DNS that Microsoft
put out.. the first was due to the reception of a response to an query that
was never sent.  [basically any DNS packet with the query/response bit set
to true]

I posted an advisory on this and James Gilroy (the developer of DNS at
microsoft) managed to get a fix out in about a day (an admirable feat for a
vendor).. Unfortunately the fix wasn't complete.. I managed to find another
bug a day or so later.. but once more James put out a patch and this one
has passed a few tests I threw at it.. It is due to be released along with
service pack 3 which is due out this quarter..

you can also get a copy at ftp://rhino.microsoft.com/

this fix is only available for intel, and as I don't have a NT system
running on alpha I haven't confirmed whether or not the alpha version of
DNS is vulnerable.. 

if anyone wants to volunteer a little bit of time we can test it out...

					Jonathan
-=-=-=-=-=-=-=-
Jonathan Wilkins      |  Futuaris   | If only they had used their
jwilkins@secnet.com   | Non Irresus | terminals for niceness instead
http://www.secnet.com |  Ridebus    | of evil ...-Maxwell Smart

From firewalls-owner  Wed Feb 12 17:57:05 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id RAA07060 for firewalls-outgoing; Wed, 12 Feb 1997 17:31:46 -0800 (PST)
Received: from MIT.EDU (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.69.0.28]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id RAA06982 for <firewalls@GreatCircle.COM>; Wed, 12 Feb 1997 17:31:26 -0800 (PST)
Received: from [143.251.82.237] by MIT.EDU with SMTP
	id AA26195; Wed, 12 Feb 97 20:30:24 EST
Message-Id: <33029914.5883@alt789.com>
Date: Wed, 12 Feb 1997 20:31:16 -0800
From: David Gormley <DGormley@alt789.com>
Reply-To: DGormley@alt789.com
Organization: Fluid Net Corp.
X-Mailer: Mozilla 3.0 (Win95; I; 16bit)
Mime-Version: 1.0
To: firewalls@GreatCircle.COM
Subject: Mirror of NT Exploits
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

At Bill Stouts request I have put up a mirror site detailing
the NT exploits. This is my companies webpage but as I have'nt
got any direction as to what they want, so I just put one up of me
looking blankly into the screen. It's good that they challenge me
with work. :-))) I certainly look it.?

To get to the mirror just click on my watch in the photo.

Regards,
D.


From firewalls-owner  Wed Feb 12 18:06:46 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id RAA07432 for firewalls-outgoing; Wed, 12 Feb 1997 17:34:09 -0800 (PST)
Received: from socrates.berkeley.edu (socrates.Berkeley.EDU [128.32.25.13]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id RAA07394 for <firewalls@greatcircle.com>; Wed, 12 Feb 1997 17:33:53 -0800 (PST)
Received: from garnet.berkeley.edu (garnet.Berkeley.EDU [128.32.155.6]) by socrates.berkeley.edu (8.8.4/8.8.0) with ESMTP id RAA14751; Wed, 12 Feb 1997 17:32:15 -0800 (PST)
Received: from pine by garnet.berkeley.edu (8.7.5/1.33-960227)
	id RAA00314; Wed, 12 Feb 1997 17:32:10 -0800
Message-Id: <2.2.32.19970213013122.006edb00@garnet.berkeley.edu>
X-Sender: mendes@garnet.berkeley.edu
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Wed, 12 Feb 1997 17:31:22 -0800
To: Kurt Kessel <kkessel@hteinc.com>
From: Jerry Mendes <mendes@garnet.berkeley.edu>
Subject: Re: Spit DNS - Another way
Cc: firewalls@greatcircle.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



Kurt,

Just have to bust ya on your "subject line".  What the heck is a Spit DNS?
Is this the newest technological jump in naming architecture?  :-)

(s)
Jerry

At 01:57 PM 2/12/97, Kurt Kessel wrote:
___________________________________________________________________________
Jerry Mendes, Principal Consultant          Voice: (415) 381-5500
DataComm Insights                           FAX:   (415) 381-5502
150 Seminary Drive                          Email: mendes@garnet.berkeley.edu
Mill Valley, California  94941


From firewalls-owner  Wed Feb 12 18:21:12 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id RAA05731 for firewalls-outgoing; Wed, 12 Feb 1997 17:22:04 -0800 (PST)
Received: from inet.excalib.com.excalib.com (inet.excalib.com [204.30.234.6]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id RAA05468 for <firewalls@greatcircle.com>; Wed, 12 Feb 1997 17:21:01 -0800 (PST)
Received: from excalib.com ([191.9.200.1]) by inet.excalib.com.excalib.com (4.1/SMI-4.1)
	id AA22398; Wed, 12 Feb 97 17:22:19 PST
Received: from carlsbadpo2.excalib by excalib.com (4.1/SMI-4.1)
	id AA18477; Wed, 12 Feb 97 17:09:11 PST
Received: by carlsbadpo2.excalib with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63)
	id <01BC1908.5C6E0C40@carlsbadpo2.excalib>; Wed, 12 Feb 1997 17:15:36 -0800
Message-Id: <c=US%a=_%p=Excalibur_Techno%l=CARLSBADPO2-970213011534Z-684@carlsbadpo2.excalib>
From: Gary Hanna <gary@excalib.com>
To: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: Info on ActiveX/Quicken hack
Date: Wed, 12 Feb 1997 17:15:34 -0800
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello,
 A while back somebody wrote about some ActiveX control that was able to
invoke Quicken transactions, but wasn't able to provide a source for the
info. c|net has a rather interesting article on the topic at
http://www.news.com/News/Item/0,4,7761,4000.html. If what they say in
the article is proven to be true, then I'll certainly refrain from using
MSIE or ActiveX in any form.

 Good day,

 Gary Hanna
 gary@excalib.com

From firewalls-owner  Wed Feb 12 20:10:27 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id TAA12901 for firewalls-outgoing; Wed, 12 Feb 1997 19:20:07 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id TAA12894 for <firewalls@GreatCircle.COM>; Wed, 12 Feb 1997 19:19:59 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-961106)
	id TAA04794; Wed, 12 Feb 1997 19:17:38 -0800 (PST)
Received: from mail.clark.net(168.143.0.10) by mycroft via smap (V1.3mjr)
	id sma004777; Wed Feb 12 19:17:23 1997
Received: from mjr.clark.net (mjr.clark.net [168.143.19.61]) by mail.clark.net (8.8.5/8.6.5) with SMTP id WAA23629; Wed, 12 Feb 1997 22:13:36 -0500 (EST)
Message-Id: <199702130313.WAA23629@mail.clark.net>
Comments: Authenticated sender is <mjr@mail.clark.net.>
From: "Marcus J. Ranum" <mjr@clark.net>
Organization: V-ONE Corp Baltimore office
To: firewalls@GreatCircle.COM
Date: Wed, 12 Feb 1997 22:18:48 +0000
MIME-Version: 1.0
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Subject: Re: Split DNS - Another way
Reply-to: mjr@clark.net
CC: mjr@clark.net
X-mailer: Pegasus Mail for Win32 (v2.42a)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> I have been watching the split DNS discussions and learned a lot of
> the issues, good and bad, for implementing such.

I think a good approach is to turn the problem on its head. What
most folks implement with "split DNS" is actually "split reFrom firewalls-owner  Wed Feb 12 22:50:52 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id WAA11476 for firewalls-outgoing; Wed, 12 Feb 1997 22:41:33 -0800 (PST)
Received: from lhr.aster.com.pk (lhr.aster.com.pk [203.128.6.8]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id WAA11440 for <firewalls@greatcircle.com>; Wed, 12 Feb 1997 22:40:47 -0800 (PST)
Received: by lhr.aster.com.pk (Smail3.1.28.1 #4)
	id m0vuuqO-0004HfC; Thu, 13 Feb 97 11:40 GMT+0500
Date: Thu, 13 Feb 1997 11:40:32 +0500 (GMT+0500)
From: Rafeeq Ur Rehman <rehman@lhr.aster.com.pk>
To: Jim McKenzie <jmckenze@ncfcomm.com>
cc: firewalls@greatcircle.com
Subject: Re: What firewall do I need.
In-Reply-To: <199702130426.WAA19658@cereal.ncfcomm.com>
Message-ID: <Pine.LNX.3.91.970213113910.658D-100000@lhr.aster.com.pk>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Wed, 12 Feb 1997, Jim McKenzie wrote:

> I am about to hook our 130 PC lan running WFW, WIN95, & NT to a dedicated
> internet connection.  What is my risk to hackers, etc. when we make this
> connection, what is the best firewall to use with the least setup and
> administrative work.
> 
I am using FWTK on Linux in such a network with SUN, SCO Unix, and 
Ultrix. I have found it good against test attacks. The LAN is on Internet 
and running smoothly.

Rafeeq Ur Rehman
rehman@lhr.aster.com.pk



From firewalls-owner  Wed Feb 12 23:05:47 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id WAA11057 for firewalls-outgoing; Wed, 12 Feb 1997 22:35:54 -0800 (PST)
Received: from lhr.aster.com.pk (lhr.aster.com.pk [203.128.6.8]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id WAA10977 for <firewalls@GreatCircle.COM>; Wed, 12 Feb 1997 22:35:24 -0800 (PST)
Received: by lhr.aster.com.pk (Smail3.1.28.1 #4)
	id m0vuulS-0004HfC; Thu, 13 Feb 97 11:35 GMT+0500
Date: Thu, 13 Feb 1997 11:35:25 +0500 (GMT+0500)
From: Rafeeq Ur Rehman <rehman@lhr.aster.com.pk>
To: Dave Sroelov <dsroelov@pacbell.net>
cc: fw-1-mailinglist@us.checkpoint.com, firewalls@GreatCircle.COM
Subject: Re: strange behavior
In-Reply-To: <3302163E.7200@pacbell.net>
Message-ID: <Pine.LNX.3.91.970213113456.658C-100000@lhr.aster.com.pk>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Wed, 12 Feb 1997, Dave Sroelov wrote:

> being somewhat new to FW-1 i have come across something that is a little
> strange.  if i set up a policy with one rule that says to reject all
> packet types from source=any to destination=any and log everything, why
> does ping still work?
> 
> if i specifically add a rule to block icmp packets then ping stops.  i
> would think that blocking 'all' packet types would block everything that
> FW-1 knows about, and it knows about icmp.
> 
If you have an application level firewall, it may not stop icmp.

Rafeeq Ur Rehman
rehman@lhr.aster.com.pk



From firewalls-owner  Wed Feb 12 23:37:00 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id XAA15243 for firewalls-outgoing; Wed, 12 Feb 1997 23:25:01 -0800 (PST)
Received: from orpheus.amdahl.com (orpheus.amdahl.com [129.212.11.6]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id XAA15063 for <firewalls@GreatCircle.COM>; Wed, 12 Feb 1997 23:24:23 -0800 (PST)
Received: from juts.ccc.amdahl.com by orpheus.amdahl.com with smtp
	(Smail3.1.29.1 #3) id m0vuvVw-0000zzC; Wed, 12 Feb 97 23:23 PST
Received: by juts.ccc.amdahl.com (/\../\ Smail3.1.14.4 #14.6)
	id <m0vuvW0-0000jOC@juts.ccc.amdahl.com>; Wed, 12 Feb 97 23:23 PST
Date: Wed, 12 Feb 97 13:56:46 PST
From: norbert_steiner@amdahl.com
Subject: FW: Re: In search of password server 
To: firewalls@GreatCircle.COM
X-PRIORITY: 3 (Normal)
X-Mailer: Chameleon 4.6.3, TCP/IP for Windows, NetManage Inc.
Message-ID: <Chameleon.970212140251.nqs10@nqs10-pc.ccc.amdahl.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=us-ascii
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


--- On Wed, 12 Feb 1997 08:54:10 +0000  Kevin Townsend <kev-rhea@mail.zynet.co.uk> wrote:
Brad Larden wrote:
>> 
>> I don't know if such a thing exists as I haven't been able to find anything on
>> the web but what we would like to do is have our users connect/login to their
>> windows 95 (YUK!) pc's and be able to connect to any of the unix machine,
>> netware machines and other proprietry hardware around the place.
>> Whether this mystical device 


>This mystical device (desktop security that includes single sign-on)
>exists as Latches for Windows. The Win 95 version is being launched in
>April. Mail me if anyone wants more info.



You may want to check out Bull's ISM AccessMaster - supports central desktop
administration & central user admin (incl. passwords) + automatic user registration
for applications on unix, Winodws NT 4.0 server and Mainframes.


Regards

Norbert

---
Norbert Steiner                  Amdahl Deutschland GmbH
Forumstr. 24                     41468 Neuss, Germany
ph.: +49.2131/345-140            Fax: +49.2131/345-115
E-mail: norbert_steiner@amdahl.com


From firewalls-owner  Thu Feb 13 09:17:16 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id CAA09215 for firewalls-outgoing; Thu, 13 Feb 1997 02:17:23 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id CAA08944 for <Firewalls@GreatCircle.COM>; Thu, 13 Feb 1997 02:15:57 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-961106)
	id CAA11396; Thu, 13 Feb 1997 02:13:32 -0800 (PST)
Received: from unknown(193.126.4.65) by mycroft via smap (V1.3mjr)
	id sma011359; Thu Feb 13 02:12:54 1997
Received: (from uucp@localhost) by relay.eunet.pt (8.7.5/8.7.3) with UUCP id KAA20969 for Firewalls@GreatCircle.COM; Thu, 13 Feb 1997 10:13:47 GMT
Received: from eniac (eniac [128.22.4.16]) by btagate (8.6.12/8.6.12) with SMTP id LAA31450 for <Firewalls@GreatCircle.COM>; Thu, 13 Feb 1997 11:22:52 GMT
Message-Id: <1.5.4.32.19970213101339.009195ac@btagate>
X-Sender: sys6849@btagate
X-Mailer: Windows Eudora Light Version 1.5.4 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Date: Thu, 13 Feb 1997 10:13:39 +0000
To: Firewalls@GreatCircle.COM
From: Paulo Jorge Delgado <Paulo.Delgado@bta.pt>
Subject: Firewalling X.400
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello,

we are planing to connect to a X.400 VAN, which supports connections
in TCP/IP and X.25. We are probably going to use an Isocor MTA on an
Unix system, which needs to connect to our internal IP network.

The question is, if we choose to connect using TCP/IP, how paranoid
should I be?

If I can get some assurance that the X.400 and X.500 servers are reliable
applications, I may solve the problem with a simple packet-filtering FW,
opening the TCP ports needed for those services and placing the server
on the internal network.

But if I can=B4t get that assurance then maybe I should place it in a
traditional DMZ setup.

Please share your opinion with me.

Many thanks,

Paulo
setup

treat that server
like

+-------------------------------+---------------------------------------+
| Paulo Jorge Delgado           | Internet: Paulo.Delgado@bta.pt        |
| Banco Totta & Acores          | Office:   +351-1-7922467              |
| Av. Miguel Bombarda 4, 7      | Fax:      +351-1-7922481              |
| 1000 Lisboa                   |                                       |
| Portugal                      |                                       |
+-------------------------------+---------------------------------------+


From firewalls-owner  Thu Feb 13 09:19:21 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id HAA02270 for firewalls-outgoing; Thu, 13 Feb 1997 07:21:46 -0800 (PST)
Received: from smtp.gte.net (radius3.gte.net [206.124.68.25]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id CAA15809 for <firewalls@GreatCircle.COM>; Thu, 13 Feb 1997 02:59:07 -0800 (PST)
Received: from gregg ([206.124.86.216]) by smtp.gte.net (SMI-8.6/) via ESMTP id EAA02833; Thu, 13 Feb 1997 04:57:37 -0600
Message-Id: <199702131057.EAA02833@smtp.gte.net>
From: "Gregg Earnhart" <ge@gte.net>
To: "Rafeeq Ur Rehman" <rehman@lhr.aster.com.pk>,
        "Dave Sroelov" <dsroelov@pacbell.net>
Cc: <fw-1-mailinglist@us.checkpoint.com>, <firewalls@GreatCircle.COM>
Subject: Re: strange behavior
Date: Thu, 13 Feb 1997 05:01:30 -0600
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1160
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Take a look at the properties tab (platform depends on location). Then look
at Enable ICMP.  This setting is called rule "zero".  The setting allows
First, before last, and last.  I believe it defaults to first. If the
firewall rule base is any----any---drop for the last rule, then the rule
will allow ICMP before it looks at the last rule.  If the setting is set to
last, then the ICMP rule in the properties tab will be the last rule in the
rule set.

Gregg Earnhart  

----------
> From: Rafeeq Ur Rehman <rehman@lhr.aster.com.pk>
> To: Dave Sroelov <dsroelov@pacbell.net>
> Cc: fw-1-mailinglist@us.checkpoint.com; firewalls@GreatCircle.COM
> Subject: Re: strange behavior
> Date: Thursday, February 13, 1997 12:35 AM
> 
> On Wed, 12 Feb 1997, Dave Sroelov wrote:
> 
> > being somewhat new to FW-1 i have come across something that is a
little
> > strange.  if i set up a policy with one rule that says to reject all
> > packet types from source=any to destination=any and log everything, why
> > does ping still work?
> > 
> > if i specifically add a rule to block icmp packets then ping stops.  i
> > would think that blocking 'all' packet types would block everything
that
> > FW-1 knows about, and it knows about icmp.
> > 
> If you have an application level firewall, it may not stop icmp.
> 
> Rafeeq Ur Rehman
> rehman@lhr.aster.com.pk
> 

From firewalls-owner  Thu Feb 13 20:24:53 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id MAA03013 for firewalls-outgoing; Thu, 13 Feb 1997 12:08:17 -0800 (PST)
Received: from ALABAMA.CF.CS.YALE.EDU (RT-GW.CS.YALE.EDU [128.36.0.13]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id MAA02926 for <Firewalls@GreatCircle.COM>; Thu, 13 Feb 1997 12:07:53 -0800 (PST)
From: long-morrow@CS.YALE.EDU
Received: from SPARKY.CF.CS.YALE.EDU by ALABAMA.CF.CS.YALE.EDU (8.7.1/res.host.cf-4.0)
	with ESMTP id PAA04392; Thu, 13 Feb 1997 15:06:22 -0500 (EST) sender long-morrow@CS.YALE.EDU for 
Received: by SPARKY.CF.CS.YALE.EDU (Sendmail-8.7.1/res.client.cf-4.0)
	id PAA17152; Thu, 13 Feb 1997 15:06:20 -0500 (EST)
Date: Thu, 13 Feb 1997 15:06:20 -0500 (EST)
Message-Id: <199702132006.PAA17152@SPARKY.CF.CS.YALE.EDU>
To: adam@homeport.org, moroni@scranton.com, thommd@CETUS.MNGT.ULETH.CA
Subject: Re: Views on Merits of Beta Testing Solicited -Reply
Cc: Firewalls@GreatCircle.COM, wneugent@smiley.mitre.org
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


>>> Moroni <moroni@scranton.com> 02/12/97 07:38am >>>
>				...
>   The only person I know of who got paid real money for beta testing
>software is the fictional character Angela Bennett in the movie the
>Net.Most people just get software when the final product is retailed.

I know a guy here in Connecticut who makes money beta testing for
software company clients (he tests Mac s/w so his market may be
drying up :-)

Current scuttlebutt on the rumor mill is that MSIE 4.0 will be
released as a platform release without going through a general
Internet-wide beta test release phase.  Both MSIE and NS Navigator
4.0 are late.

						- Morrow


From firewalls-owner  Thu Feb 13 20:32:01 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id MAA08141 for firewalls-outgoing; Thu, 13 Feb 1997 12:33:59 -0800 (PST)
Received: from mule1.mindspring.com (mule1.mindspring.com [204.180.128.167]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id MAA08111 for <firewalls@GreatCircle.COM>; Thu, 13 Feb 1997 12:33:46 -0800 (PST)
Received: from mycomputer.mindspring.com (ip72.washington5.dc.pub-ip.psi.net [38.12.246.72])
          by mule1.mindspring.com (8.8.4/8.8.4) with SMTP
	  id PAA30390; Thu, 13 Feb 1997 15:32:32 -0500
Message-Id: <3.0.32.19970213153115.006aa22c@pop.mindspring.com>
X-Sender: mhl@pop.mindspring.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Thu, 13 Feb 1997 15:32:36 -0500
To: Kurt Kessel <kkessel@hteinc.com>, firewalls@GreatCircle.COM
From: Matt Larson <matt@acmebw.com>
Subject: Re: Split DNS - Another way
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 01:57 PM 2/12/97, Kurt Kessel wrote:
>What if a company let the ISP be the primary DNS for the public network,
>say mydom.com. Their internal DNS remained the primary for their internal
>domain, again mydom.com. The trick would be to configure the firewall as
>a DNS client of both DNS servers (ISP and internal). With the use of
>proxies and filtering on the FW, no DNS leakage should happen. The proxies
>should be able to resolve doman names as needed.

What you've described would require modifying the resolver on the firewall
host, which is exactly Marcus Ranum described in a follow up to your posting.

I know of two major ways (with variations, of course) to solve the split
DNS problem.

One way gives the firewall name server visibility to the Internet root name
servers and makes it authoritative for the external version of the
company's DNS information.  The firewall's resolver points to an internal
name server that is authoritative for the internal version of the company's
DNS information.  This internal name server forwards unresolved queries to
the firewall name server.  Internal resolvers point to the internal name
server, which either answers the query (for internal host names) or
forwards it to the firewall's name server (for Internet host names).

The potential problem with this approach is that the internal name server
must be authoritative for all internal DNS information.  The internal name
server is forwarding to the firewall, so if it doesn't know about an
internal host name, it'll forward the query to the firewall.  The firewall
definitely won't know the answer or could have the wrong answer (since the
firewall's name server knows about only the external DNS information).  For
example, let's say the internal name server is authoritative for
company.com and has NS records for subdomain.company.com.  If the internal
name server is forwarding and receives a query for
host.subdomain.company.com, it'll forward it to the firewall, despite
having NS records for that subdomain.  To avoid this problem, you have to
make the internal name server a secondary for subdomain.company.com.

The second way to implement a split DNS scenario requires an additional
external name server: this name server has visibility to the Internet root
name servers and is authoritative for the external version of the company's
DNS information.  The firewall name server also sees the Internet root name
servers but is authoritative for the zone corresponding to the top level
company domain name (i.e., company.com in this example).  The firewall's
resolver points to its own name server.  Everything on the inside stays the
same: internal hosts point to an internal name server, which forwards to
the firewall.

In this approach, proxies on the firewall can still resolve external names
or internal ones.  If the firewall name server doesn't have information
about a name (i.e., host.subdomain.company.com), it knows which internal
name server is authoritative because of the NS records in the company.com
zone.  Therefore the problem with the first approach is solved: any
internal host name queries forwarded to the firewall will "bounce back" to
the appropriate internal name server.

Security is an issue, since you have internal DNS information in the
firewall name server.  The "secure zones" feature of modern name servers
can solve this problem.  You can also mitigate the security issue by
keeping only NS records for company.com in the firewall name server by
using the "stub" instead of the "secondary" directive.

My preference is the second solution.  I think it's cleaner to have a
separate name server for external DNS information.  Often this doesn't
require extra hardware anyway, since an ISP often throws in DNS service for
free.

Matt Larson



--
Matt Larson <matt@acmebw.com>
Acme Byte & Wire -- DNS and Internet security consulting and training
(301) 571-0444 voice / (301) 564-0890 fax / http://www.acmebw.com


From firewalls-owner  Thu Feb 13 20:43:20 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id JAA02709 for firewalls-outgoing; Thu, 13 Feb 1997 09:51:25 -0800 (PST)
Received: from mail1 (mail1.ci.chi.il.us [199.177.48.3]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id JAA02502 for <firewalls@GreatCircle.COM>; Thu, 13 Feb 1997 09:50:37 -0800 (PST)
Received: by mail1 (SMI-8.6/SMI-SVR4)
	id LAA22030; Thu, 13 Feb 1997 11:44:29 -0600
From: minaba@mail1.ci.chi.il.us (Mark Inaba)
Message-Id: <199702131744.LAA22030@mail1>
Subject: e-mail !!!!= HTML   \:-| (reply)
To: firewalls@GreatCircle.COM
Date: Thu, 13 Feb 1997 11:44:28 -0600 (CST)
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Forwarded message:
> please, please, please, PLEASE !!!!!!!!
> 
> stop posting in HTML !!!!!!!!

	is that what that gibberish is that my elm reader
gags on? sometimes I get 'mime' stuff that isn't really..
and sometimes some of the mail just scrolls off the screen
and I have trouble saving it to my =fw dir..
hmmm wish I could see these things..now i'm curious!
-Mark

From firewalls-owner  Thu Feb 13 20:56:20 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id OAA00184 for firewalls-outgoing; Thu, 13 Feb 1997 14:12:21 -0800 (PST)
Received: from relay1.UU.NET (relay1.UU.NET [192.48.96.5]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id OAA29781 for <Firewalls@GreatCircle.COM>; Thu, 13 Feb 1997 14:11:23 -0800 (PST)
Received: from websgi by relay1.UU.NET with SMTP 
	(peer crosschecked as: websgi.icomnet.com [206.156.67.2])
	id QQccts23182; Thu, 13 Feb 1997 17:07:56 -0500 (EST)
Received: from Optiplex by websgi via SMTP (940816.SGI.8.6.9/940406.SGI)
	for <Firewalls@GreatCircle.COM> id QAA00127; Thu, 13 Feb 1997 16:55:21 -0800
Message-Id: <199702140055.QAA00127@websgi>
Comments: Authenticated sender is <dkite@mail.icomnet.com>
From: "Doug Kite" <dkite@websgi.icomnet.com>
To: Firewalls@GreatCircle.COM
Date: Thu, 13 Feb 1997 17:09:49 +0000
MIME-Version: 1.0
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Subject: lpr/lpd and firewall
X-mailer: Pegasus Mail for Windows (v2.52)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

If you HAVE to let lpr-type printing  get through your firewall, 
what steps can you take to minimize the risks (i.e. what is the most 
secure way to do this)?

I know the books I have been reading say just don't let it through, 
but unfortunately, I have no choice on the matter.

Thanks,
Doug

__________________________________________________
Doug Kite                email: dkite@icomnet.com
Network Administrator         phone: 919-559-6442
Lenoir County MIS               fax: 919-523-0371

From firewalls-owner  Thu Feb 13 21:24:09 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA23148 for firewalls-outgoing; Thu, 13 Feb 1997 11:23:31 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id LAA23004 for <firewalls@GreatCircle.COM>; Thu, 13 Feb 1997 11:22:54 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-961106)
	id CAA13453; Thu, 13 Feb 1997 02:47:37 -0800 (PST)
Received: from radius3.gte.net(206.124.68.25) by mycroft via smap (V1.3mjr)
	id sma013402; Thu Feb 13 02:46:38 1997
Received: from gregg ([206.124.86.216]) by smtp.gte.net (SMI-8.6/) via ESMTP id EAA02589; Thu, 13 Feb 1997 04:47:53 -0600
Message-Id: <199702131047.EAA02589@smtp.gte.net>
From: "Gregg Earnhart" <ge@gte.net>
To: <DGormley@alt789.com>, <firewalls@GreatCircle.COM>
Subject: Re: Mirror of NT Exploits
Date: Thu, 13 Feb 1997 04:51:46 -0600
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1160
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

What is the URL?

----------
> From: David Gormley <DGormley@alt789.com>
> To: firewalls@GreatCircle.COM
> Subject: Mirror of NT Exploits
> Date: Wednesday, February 12, 1997 10:31 PM
> 
> Hi,
> 
> At Bill Stouts request I have put up a mirror site detailing
> the NT exploits. This is my companies webpage but as I have'nt
> got any direction as to what they want, so I just put one up of me
> looking blankly into the screen. It's good that they challenge me
> with work. :-))) I certainly look it.?
> 
> To get to the mirror just click on my watch in the photo.
> 
> Regards,
> D.

From firewalls-owner  Thu Feb 13 21:52:59 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id QAA28508 for firewalls-outgoing; Thu, 13 Feb 1997 16:05:06 -0800 (PST)
Received: from relay1.UU.NET (relay1.UU.NET [192.48.96.5]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id QAA28492 for <firewalls@greatcircle.com>; Thu, 13 Feb 1997 16:04:58 -0800 (PST)
Received: from magic.bunt.com by relay1.UU.NET with SMTP 
	(peer crosschecked as: dns1.bunt.com [195.178.0.23])
	id QQcctk27207; Thu, 13 Feb 1997 15:03:03 -0500 (EST)
Received: from pppl15.bunt.com (pppl15.bunt.com [195.178.1.19]) by magic.bunt.com (8.6.12/8.6.9) with SMTP id VAA09614 for <firewalls@greatcircle.com>; Thu, 13 Feb 1997 21:00:47 +0100
Received: by pppl15.bunt.com with Microsoft Mail
	id <01BC19F0.AAEDFC20@pppl15.bunt.com>; Thu, 13 Feb 1997 20:58:31 +-100
Message-ID: <01BC19F0.AAEDFC20@pppl15.bunt.com>
From: Bill Powers <powersw@magic.bunt.com>
To: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: Guardian questions
Date: Thu, 13 Feb 1997 20:50:50 +-100
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

hello,

I have been watching the list for awhile now and haven't noticed anyone =
making any reference to the Guardian firewall.  I am looking at =
implementing a firewall and am looking at the Sidewinder and Guardian.  =
I am leaning more to the guardian at the moment but have a few concerns =
that someone may be able to shed some light on.  It is almost more =
important for me to have a highly detailed log of the activities than =
actually denying access.  I will be running it on an NT box so =
horsepower requirements are a concern, 200-500 concurrent sessions would =
not be uncommon.  I am looking for personal experiences to go along with =
the sales hype.

Many thanks.....

Bill sends.....:-)
powersw@magic.bunt.com




From firewalls-owner  Thu Feb 13 22:16:42 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id NAA25374 for firewalls-outgoing; Thu, 13 Feb 1997 13:55:00 -0800 (PST)
Received: from relay6.UU.NET (relay6.UU.NET [192.48.96.16]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id NAA25141 for <firewalls@GreatCircle.COM>; Thu, 13 Feb 1997 13:54:01 -0800 (PST)
Received: from wanggate by relay6.UU.NET with SMTP 
	(peer crosschecked as: wanggate.wang.co.nz [192.58.229.1])
	id QQccth28271; Thu, 13 Feb 1997 14:15:55 -0500 (EST)
Received: by wanggate (951211.SGI.8.6.12.PATCH1042/951211.SGI)
	for <firewalls@GreatCircle.COM> id HAA18272; Fri, 14 Feb 1997 07:52:14 +1300
Received: from wnx1(172.17.28.6) by wanggate via smap (3.1)
	id xmaa18260; Fri, 14 Feb 97 07:51:30 +1300
Received: by WNX1 with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.57)
	id <01BC1A4B.71A66190@WNX1>; Fri, 14 Feb 1997 07:48:19 +1300
Message-ID: <c=NZ%a=_%p=WANGNZ%l=WNX1-970213184813Z-18421@WNX1>
From: Mahesh Ravji <Mahesh.Ravji@wang.co.nz>
To: "'Mike Topalovich'" <TOPALOVICH@terraglyph.com>,
        "'firewalls@greatcircle.com'" <firewalls@GreatCircle.COM>
Subject: RE: DHCP
Date: Fri, 14 Feb 1997 07:48:13 +1300
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.994.57
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

There was a utility with the NT3.5 and 3.51 Resource Kit called
DHCPCMD.EXE which was used to dump the DHCP database in various formats.
 I don't have the 4.0 Resource Kit so hopefully someone on the list may
be able to help here.

Mahesh.

>-----Original Message-----
>From:	Mike Topalovich [SMTP:TOPALOVICH@terraglyph.com]
>Sent:	Tuesday, 11 February 1997 06:35
>To:	'firewalls@greatcircle.com'
>Subject:	RE: DHCP
>
>
>I believe the log files are saved as .MDB database files, aren't they?
>I should probably check before posting this, but I'm pretty sure you can
>open the logs using Access or any other RDB with an Access filter.  If
>it isn't in .MDB format, then I would imagine it's in some other
>ODBC-accessable format.  Just open the logs in a RDB and print from
>there.
>
>>----------
>>From: 	Hisham Abdullatif Al-Rumaihi[SMTP:rumaihi@admin.uob.bh]
>>Sent: 	Friday, January 31, 1997 11:41 PM
>>To: 	firewalls@greatcircle.com
>>Subject: 	DHCP
>>
>>Hi,
>>
>>We are using DHCP server runing on windows NT 4.0, is it possible to
>>view/print the DHCP database?.
>>
>>Can you suggust any mailing list that is relatd to (networks).
>>
>>Thank you.
>>

From firewalls-owner  Thu Feb 13 22:25:08 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id AAA20548 for firewalls-outgoing; Thu, 13 Feb 1997 00:44:33 -0800 (PST)
Received: from wizard.abirnet.co.il (wizard.abirnet.co.il [194.90.211.10]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id AAA20516 for <firewalls@GreatCircle.COM>; Thu, 13 Feb 1997 00:44:20 -0800 (PST)
Received: from ziv.netwizard.co.il (z1.abirnet.co.il [194.90.211.21]) by wizard.abirnet.co.il (8.7.4/8.7.3) with SMTP id LAA05874; Fri, 14 Feb 1997 11:20:32 +0200
Date: Thu, 13 Feb 97 10:42:22    
From: Ziv Dascalu <ziv@AbirNet.com>
Subject: Re: What firewall do I need. 
To: Jim McKenzie <jmckenze@ncfcomm.com>,
        Rafeeq Ur Rehman <rehman@lhr.aster.com.pk>
Cc: firewalls@GreatCircle.COM
X-PRIORITY: 3 (Normal)
X-Mailer: Chameleon 5.0, TCP/IP for Windows, NetManage Inc.
Message-ID: <Chameleon.855823551.ziv@ziv.netwizard.co.il>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


--- On Thu, 13 Feb 1997 11:40:32 +0500 (GMT+0500)  Rafeeq Ur Rehman 
<rehman@lhr.aster.com.pk> wrote:

>On Wed, 12 Feb 1997, Jim McKenzie wrote:
>
>> I am about to hook our 130 PC lan running WFW, WIN95, & NT to a dedicated
>> internet connection.  What is my risk to hackers, etc. when we make this
>> connection, what is the best firewall to use with the least setup and
>> administrative work.
>> 
>I am using FWTK on Linux in such a network with SUN, SCO Unix, and 
>Ultrix. I have found it good against test attacks. The LAN is on Internet 
>and running smoothly.
>

I think that if you are looking for a solution with the least setup and 
administrative work you should look at AbirNet SessionWall (I am working
for AbirNet), it provides you with a protection solution that sounds like it fits
your need.
you can download a free trial version of AbirNet SessionWall at
 http://www.abirnet.com

AGAIN, I have to mention that I am working for AbirNet.

   Ziv Dascalu        Email: ziv@AbirNet.com
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
              A  B  I  R  N  E  T 
           Active Network Protection 
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 AbirNet provides the next generation in Firewalls and 
 Internet and Intranet intrusion and abuse protection.
 AbirNet provides Windows 95 and NT-based software 
 that delivers no-overhead see-it-all filtering, 
 blocking, alerting, logging, and scanning.
 Ask about SessionWall and SessionView  (800)245-1688.

 Get a free trial version at <http://www.AbirNet.com>
-----------  <http://www.AbirNet.com>  ---------------


From firewalls-owner  Thu Feb 13 22:25:09 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id LAA27468 for firewalls-outgoing; Thu, 13 Feb 1997 11:44:01 -0800 (PST)
Received: from noc.ucsd.edu (ucsd.edu [132.239.254.201]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id LAA27233 for <firewalls@GreatCircle.COM>; Thu, 13 Feb 1997 11:43:01 -0800 (PST)
Received: from raven.webwebs.com by noc.ucsd.edu; id LAA10195
	sendmail 8.8.5/UCSD8.3 via SMTP
	Thu, 13 Feb 1997 11:41:05 -0800 (PST)
Message-Id: <2.2.32.19970213195321.00e0c1f4@popmail.ucsd.edu>
X-Sender: dschiffrin@popmail.ucsd.edu
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Thu, 13 Feb 1997 11:53:21 -0800
To: Ziv Dascalu <ziv@AbirNet.com>
From: David Schiffrin <dschiffrin@ucsd.edu>
Subject: Re: What firewall do I need. 
Cc: firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


You've GOT to be kidding. You recommend someone secure their corporate network
with a BETA TEST VERSION of your WINDOWS 95 software!?!?!?!?!

What planet do you live on?

How does "no-overhead see-it-all filtering, blocking, alerting, logging,and
scanning." work??

How can you do "no-overhead" filtering? do you have an infinitely fast Win95PC?

just my incredulous $.02

-dave

t 10:42 AM 2/13/97, Ziv Dascalu wrote:
>
>--- On Thu, 13 Feb 1997 11:40:32 +0500 (GMT+0500)  Rafeeq Ur Rehman 
><rehman@lhr.aster.com.pk> wrote:
>
>>On Wed, 12 Feb 1997, Jim McKenzie wrote:
>>
>>> I am about to hook our 130 PC lan running WFW, WIN95, & NT to a dedicated
>>> internet connection.  What is my risk to hackers, etc. when we make this
>>> connection, what is the best firewall to use with the least setup and
>>> administrative work.
>>> 
>>I am using FWTK on Linux in such a network with SUN, SCO Unix, and 
>>Ultrix. I have found it good against test attacks. The LAN is on Internet 
>>and running smoothly.
>>
>
>I think that if you are looking for a solution with the least setup and 
>administrative work you should look at AbirNet SessionWall (I am working
>for AbirNet), it provides you with a protection solution that sounds like
it fits
>your need.
>you can download a free trial version of AbirNet SessionWall at
> http://www.abirnet.com
>
>AGAIN, I have to mention that I am working for AbirNet.
>
>   Ziv Dascalu        Email: ziv@AbirNet.com
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>              A  B  I  R  N  E  T 
>           Active Network Protection 
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> AbirNet provides the next generation in Firewalls and 
> Internet and Intranet intrusion and abuse protection.
> AbirNet provides Windows 95 and NT-based software 
> that delivers no-overhead see-it-all filtering, 
> blocking, alerting, logging, and scanning.
> Ask about SessionWall and SessionView  (800)245-1688.
>
> Get a free trial version at <http://www.AbirNet.com>
>-----------  <http://www.AbirNet.com>  ---------------
>
>
>
--------------------------------------------------------------------------------
"The devices of power and its minions are the same in all countries and in all 
ages.  It marks its victim; denounces it; and excites the public hatred, to 
conceal its own abuses and encroachments."  
					-- Senator Henry Clay, March 14, 1834.
David Schiffrin
dschiffrin@ucsd.edu


From firewalls-owner  Thu Feb 13 22:39:27 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id QAA01352 for firewalls-outgoing; Thu, 13 Feb 1997 16:57:49 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id QAA01321 for <firewalls@GreatCircle.COM>; Thu, 13 Feb 1997 16:17:08 -0800 (PST)
Received: by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-961106)
	id PAA00750; Thu, 13 Feb 1997 15:24:29 -0800 (PST)
Received: from gatekeeper2.mcimail.com(192.147.45.10) by mycroft via smap (V1.3mjr)
	id sma003228; Thu Feb 13 14:44:48 1997
Received: from mailgate2.mcimail.com (mailgate2.mcimail.com [166.40.135.23]) by gatekeeper2.mcimail.com (8.6.12/8.6.10) with SMTP id WAA24572; Thu, 13 Feb 1997 22:49:11 GMT
Received: from mcimail.com by mailgate2.mcimail.com id aa20418;
          13 Feb 97 22:46 WET
Date: Thu, 13 Feb 97 17:45 EST
From: Peter Ngo <Peter_Ngo+aEPS4-Carr%EPS@mcimail.com>
To: firewalls <firewalls@GreatCircle.COM>
Cc: Recipient <mjr@clark.net>
Subject: Re[2]: Split DNS - Another way
Message-Id: <24970213224542/0007044148PJ1EM@MCIMAIL.COM>
X-MB-Info: Serial #: 191-30-2807  VERSION: 2.01H
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

     Marcus,

     Is it a good idea to put the DNS server installed at the firewall,
     even it's just an external name server?  If people from the external
     network want to access to the perimeter (DMZ) for some business
     requirements, then the DNS will have to resolve addresses on the DMZ.

     The idea is to protected the internal network from being attacked from
     outside. What's about the fake DNS server that Brent Chapman and
     Elizabeth D. Zwitcky discussed in the book "Building the Internet
     firewalls"?

     How about putting the DNS server on a dedicated machine (or probably
     two to act as a secondary DNS server) on the DMZ to resolve external
     addresses and the DMZ ones! The internal DNS server can be set as a
     secondary one if someone from the internal network want to access to
     the DMZ and vice versa. The firewall is then just configured to
     perform IP/Services/ Authorization/Authentication filtering.

     Any ideas?

     Peter



______________________________ Reply Separator _________________________________
Subject: Re: Split DNS - Another way
Author:  mjr|INTERNET|mjr@clark.net  at MCIMAIL
Date:    2/13/97 1:41 AM


> I have been watching the split DNS discussions and learned a lot of
> the issues, good and bad, for implementing such.

I think a good approach is to turn the problem on its head. What
most folks implement with "split DNS" is actually "split resolving"
which is what you really want!  So, suppose I have a firewall on
the perimeter of my network, acting as an external nameserver,
and I have an internal full nameserver: I want the firewall and all
its proxies to resolve all addresses for *.v-one.com against the
internal nameserver and use the Internet for everything else. Turns
out that this hack works just great. My internal nameserver can
slave from the firewall, which has only a few v-one.com names
in it, and the only machine that needs to have DNS magic
installed is the firewall.

I've posted a patch for implementing this against a (somewhat
recent) version of the official bind release. Since the bind releases
change frequently, you may have to do some hand patching but
the code is trivial.
Bind is at:         http://www.vix.com/isc/bind/index.html
My patch is at:  http://www.clark.net/pub/mjr/pubs/dns/

In the past I have implemented some truly sick and twisted
DNS configurations to try to make "split dns" work right
without having to adjust any code. It's simply a royal pain
in the neck and doesn't work very well. Patching the resolver
code is easy and clean and you can do it without needing
to replace the nameserver -- so for something like a Sun you
just patch the shared library. Clean as a whistle, and it's
easy to test.

mjr.
-----
Marcus J. Ranum, Chief Scientist, V-ONE Corporation
Work:       http://www.v-one.com
Personal:   http://www.clark.net/pub/mjr



From firewalls-owner  Thu Feb 13 23:02:43 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id GAA27179 for firewalls-outgoing; Thu, 13 Feb 1997 06:46:22 -0800 (PST)
Received: from mailhost.netrunner.net (mailhost-net.netrunner.net [207.234.128.253]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id GAA26933 for <firewalls@GreatCircle.COM>; Thu, 13 Feb 1997 06:44:52 -0800 (PST)
Received: from jim (max106.dialisdn.com [199.77.100.106]) by mailhost.netrunner.net (8.7.5/8.7.5) with SMTP id JAA24159; Thu, 13 Feb 1997 09:52:29 -0500 (EST)
Message-ID: <33032889.73C7@netrunner.net>
Date: Thu, 13 Feb 1997 09:43:21 -0500
From: Jim Canfield <jcanfiel@netrunner.net>
Organization: Davocom One
X-Mailer: Mozilla 3.01Gold (Win95; I)
MIME-Version: 1.0
To: Ziv Dascalu <ziv@AbirNet.com>
CC: Jim McKenzie <jmckenze@ncfcomm.com>,
        Rafeeq Ur Rehman <rehman@lhr.aster.com.pk>, firewalls@GreatCircle.COM
Subject: Re: What firewall do I need.
References: <Chameleon.855823551.ziv@ziv.netwizard.co.il>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Jim 

You have asked one of the great questions of the '90's. 

What firewall do I need?

 questions that need to be answered, 

What data do you need to protect?
How many people need access to the Internet?
Will you be hosting a web server or are you just going to use the link
for browsing/e-mail..
yata yata yata...

You can use simple solutions...ie. IPX to IP gateway, (CISCO, Novell,
Bay Networks) 
The Abirnet solution, NEC Privatenet et.al for inexpensive, IP to IP
firewalls, remember the security is very much a part of what OS you are
using... 95 is not C2 certified, NT is not C2 (Red Book)certified 

To the middle to hugh end solutions...Cyberguard, Sidewinder, Gauntlet
FW-1 excuse me for forgetting the 101 others...

To decide on a FW you need to determine a corp security policy who,
what, where, when, why and how... What services you need to provide,
internal security concerns and more things to numerous to list.

So determine what you need to provide to users and decide what level of
security you believe you need and can afford...

Good luck.

Jim Canfield






Ziv Dascalu wrote:
> 
> --- On Thu, 13 Feb 1997 11:40:32 +0500 (GMT+0500)  Rafeeq Ur Rehman
> <rehman@lhr.aster.com.pk> wrote:
> 
> >On Wed, 12 Feb 1997, Jim McKenzie wrote:
> >
> >> I am about to hook our 130 PC lan running WFW, WIN95, & NT to a dedicated
> >> internet connection.  What is my risk to hackers, etc. when we make this
> >> connection, what is the best firewall to use with the least setup and
> >> administrative work.
> >>
> >I am using FWTK on Linux in such a network with SUN, SCO Unix, and
> >Ultrix. I have found it good against test attacks. The LAN is on Internet
> >and running smoothly.
> >
> 
> I think that if you are looking for a solution with the least setup and
> administrative work you should look at AbirNet SessionWall (I am working
> for AbirNet), it provides you with a protection solution that sounds like it fits
> your need.
> you can download a free trial version of AbirNet SessionWall at
>  http://www.abirnet.com
> 
> AGAIN, I have to mention that I am working for AbirNet.
> 
>    Ziv Dascalu        Email: ziv@AbirNet.com
>  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>               A  B  I  R  N  E  T
>            Active Network Protection
>  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>  AbirNet provides the next generation in Firewalls and
>  Internet and Intranet intrusion and abuse protection.
>  AbirNet provides Windows 95 and NT-based software
>  that delivers no-overhead see-it-all filtering,
>  blocking, alerting, logging, and scanning.
>  Ask about SessionWall and SessionView  (800)245-1688.
> 
>  Get a free trial version at <http://www.AbirNet.com>
> -----------  <http://www.AbirNet.com>  ---------------

From firewalls-owner  Thu Feb 13 23:08:28 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id TAA13901 for firewalls-outgoing; Thu, 13 Feb 1997 19:34:47 -0800 (PST)
Received: from anna-atm.rz.uni-frankfurt.de (anna-eth.rz.uni-frankfurt.de [141.2.149.2]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id TAA13887 for <firewalls@greatcircle.com>; Thu, 13 Feb 1997 19:34:38 -0800 (PST)
Received: from defol.sunsite.de (actually dialin021.rz.uni-frankfurt.de) 
          by anna-atm.rz.uni-frankfurt.de with Local SMTP (PP);
          Fri, 14 Feb 1997 04:33:07 +0000
Received: from [127.0.0.1] by defol.sunsite.de (NTMail 3.02.07) with ESMTP 
          id fa000031 for <firewalls@greatcircle.com>;
          Wed, 12 Feb 1997 14:16:28 +0000
Reply-To: liesegan <liesegan@stud.uni-frankfurt.de>
From: Jens Liesegang <liesegan@sunsite.de>
To: firewalls <firewalls@greatcircle.com>
Subject: FW-1 logging all packets
Date: Wed, 12 Feb 1997 14:16:26 +0100
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1160
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-2
Content-Transfer-Encoding: 7bit
X-Info: Evaluation version at defol.sunsite.de
Message-Id: <13162834500071@sunsite.de>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

How can I force FW-1 NT 2.1c to log all packets passed over a WAN line?

After installing a security policy and configuring the settings the log
viewer only shows: WAN line up/down.
In the properties setup I have enabled 'log established TCP packets'.

Greetings
______________________
Jens Liesegang
liesegan@rz.uni-frankfurt.de

From firewalls-owner  Thu Feb 13 23:09:01 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id WAA09620 for firewalls-outgoing; Thu, 13 Feb 1997 22:20:06 -0800 (PST)
Received: from relay3.UU.NET (relay3.UU.NET [192.48.96.8]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id WAA09608 for <firewalls@greatcircle.com>; Thu, 13 Feb 1997 22:19:56 -0800 (PST)
Received: from alpha.mellis.com by relay3.UU.NET with ESMTP 
	(peer crosschecked as: alpha.mellis.com [205.149.187.2])
	id QQcctx11243; Thu, 13 Feb 1997 18:24:42 -0500 (EST)
Received: (from pcc@localhost) by alpha.mellis.com (8.8.5/8.7.3) id PAA01667; Thu, 13 Feb 1997 15:24:27 -0800 (PST)
Date: Thu, 13 Feb 1997 15:24:26 -0800 (PST)
From: Philip Cox <pcc@ntsinc.com>
X-Sender: pcc@alpha.mellis.com
To: firewalls@greatcircle.com
Subject: Experience with BoKS
Message-ID: <Pine.BSI.3.91.970213151944.1634A-100000@alpha.mellis.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Has anyone on this list used or implemented this system for clients? I 
read the info on the web, but it was not informative enough, I would like 
a real worl critique.

Thanks in advance,

Phil

From firewalls-owner  Thu Feb 13 23:23:46 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id TAA12173 for firewalls-outgoing; Thu, 13 Feb 1997 19:16:36 -0800 (PST)
Received: from relay7.UU.NET (relay7.UU.NET [192.48.96.17]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id TAA12159 for <firewalls@greatcircle.com>; Thu, 13 Feb 1997 19:16:22 -0800 (PST)
Received: from ACML.COM by relay7.UU.NET with SMTP 
	(peer crosschecked as: [207.140.173.10])
	id QQcctm25208; Thu, 13 Feb 1997 15:32:46 -0500 (EST)
Received: from smtpngw.acml.com by ACML.COM (SMI-8.6/SMI-SVR4)
	id PAA09689; Thu, 13 Feb 1997 15:28:30 -0500
Received: by smtpngw.acml.com (IBM OS/2 SENDMAIL VERSION 1.3.18/2.12um) id AA8121; Thu, 13 Feb 97 15:28:45 -0500
Message-Id: <9702132028.AA8121@smtpngw.acml.com>
Received: from ALLIANCE with "Lotus Notes Mail Gateway for SMTP" id
  70DD2C82298CAEFA8525643D007012A8; Thu, 13 Feb 97 15:28:45 
To: firewalls <firewalls@greatcircle.com>
From: John Chen/New York/ACMC
  <John_Chen@ACML.COM>
Date: 13 Feb 97 15:27:46 
Subject: Firewatch product
Mime-Version: 1.0
Content-Type: Text/Plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi all

Is anynoe familiar with Firewatch product?  How is that product working with 
checkpoint FW-1?  Do I need this software?

Please help.

Thanks in advance.

John

From firewalls-owner  Thu Feb 13 23:29:38 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id UAA18501 for firewalls-outgoing; Thu, 13 Feb 1997 20:11:18 -0800 (PST)
Received: from x11.boston.juno.com (x11.boston.juno.com [205.231.100.26]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id UAA18479 for <firewalls@GreatCircle.COM>; Thu, 13 Feb 1997 20:11:09 -0800 (PST)
Received: (from wiseleo@juno.com) by x11.boston.juno.com (queuemail)
	id XGB13775; Thu, 13 Feb 1997 23:08:22 EST
To: peter@baileynm.com
Cc: firewalls@GreatCircle.COM
Date: Wed, 12 Feb 1997 21:42:32 PST
Subject: Re: e-mail !!!!= HTML   \:-| <== The cure!
Message-ID: <19970213.200251.9526.3.wiseleo@juno.com>
References: <9702121411.AA26220@sonic.nmti.com.nmti.com>
X-Mailer: Juno 1.00
X-Juno-Line-Breaks: 1-2,4-5,7-10,12-13,17-20,22-31
From: wiseleo@juno.com (Leonid S Knyshov)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Ok, here are the instructions on how to turn off the bloody most hated
HTML in Communicator 4.0:

Before I begin, I want to apologize for offtopic post, but I think it
will benefit some people :)

Go to Edit->Preferences->Mail and News Preferences and find the bloody
checkbox that says "Use HTML Composer" or something in that effect.

Make _sure_ its checked OFF.

After that you are done, and no one will complain to you about that
anymore :)

Side Note: I don't remember the exact names, I uninstalled that program
after getting tired of crashes... But since you are on the firewalls
list, you probably have the intelligence to find that option :) (No
Offense to any member of the list)

Leo.

On Wed, 12 Feb 1997 08:11:21 -0600 (CST) peter@baileynm.com (Peter da
Silva) writes:
>> please, please, please, PLEASE !!!!!!!!
>
>> stop posting in HTML !!!!!!!!
>
>It's worse. It's *ILLEGAL* HTML!
>
>Netscape 4 doesn't seem to have an option to turn it off.

See above :)

From firewalls-owner  Thu Feb 13 23:33:45 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id TAA11405 for firewalls-outgoing; Thu, 13 Feb 1997 19:11:59 -0800 (PST)
Received: from lancomp-gate.LANcomp.COM (lancomp-gate.lancomp.com [199.170.17.253]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with SMTP id KAA09650 for <firewalls@GreatCircle.COM>; Thu, 13 Feb 1997 10:25:25 -0800 (PST)
Received: from devils.LANcomp.COM ([192.168.1.102]) by lancomp-gate.LANcomp.COM
          via smtpd (for miles.greatcircle.com [198.102.244.34]) with SMTP; 13 Feb 1997 18:24:27 UT
Received: from bmaggio.LANcomp.COM by LANcomp.COM (5.x/SMI-SVR4)
	id AA04380; Thu, 13 Feb 1997 12:37:42 -0500
Date: Thu, 13 Feb 1997 12:37:43 -0500 (Eastern Standard Time)
From: Bill Maggio <bmaggio@LANcomp.COM>
Reply-To: Bill Maggio <bmaggio@LANcomp.COM>
Subject: Authenticating FTP Proxy with Firewall-1 
To: fw-1-mailinglist@us.checkpoint.com, firewalls@GreatCircle.COM
Message-Id: <Roam4.0.5.855855463.25107.bmaggio@LANcomp.COM>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

Has anyone run into the following problem/issue/glitch with the FW-1 2.1
authenticating FTP proxy server:

   When an user behind the firewall gets authenticated by FW-1, if 
   their remote ftp login is _not_ the same as the internal FW-1 login, 
   the user gets an error message and must hit carriage return to get a 
   standard ftp login prompt from the remote server.  This is causing 
   grief for the FW-1 support staff because the "end-users" cannot seem 
   to grasp the concept of these messages.

Is there a way to have the authenticating ftp proxy _not_ automatically
send the internal FW-1 login as part of the string to the remote server?
Or just let the remote ftp server authenticate as if there were no firewall
in the middle?  

Or is there some other workaround that is possible?

Any insight or workaround is greatly appreciated!

Thx,

Bill Maggio
LANcomp
bmaggio@LANcomp.COM
908-981-1991



From firewalls-owner  Thu Feb 13 23:38:46 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id TAA11379 for firewalls-outgoing; Thu, 13 Feb 1997 19:11:28 -0800 (PST)
Received: from relay5.UU.NET (relay5.UU.NET [192.48.96.15]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id QAA00260 for <firewalls@greatcircle.com>; Thu, 13 Feb 1997 16:14:05 -0800 (PST)
Received: from relay.hq.tis.com by relay5.UU.NET with ESMTP 
	(peer crosschecked as: relay.hq.tis.com [192.94.214.100])
	id QQccte08536; Thu, 13 Feb 1997 13:36:26 -0500 (EST)
Received: by relay.hq.tis.com; id NAA27349; Thu, 13 Feb 1997 13:35:28 -0500 (EST)
Received: from clipper.hq.tis.com(10.33.1.2) by relay.hq.tis.com via smap (3.2)
	id xma027340; Thu, 13 Feb 97 13:35:12 -0500
Received: from gildor.hq.tis.com (dyn098.hq.tis.com [10.33.10.98]) by clipper.hq.tis.com (8.7.5/8.7.3) with SMTP id NAA24785; Thu, 13 Feb 1997 13:31:58 -0500 (EST)
Message-Id: <3.0.32.19970213133408.006916a8@pop.hq.tis.com>
X-Sender: avolio@pop.hq.tis.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Thu, 13 Feb 1997 13:34:10 -0500
To: "Jim McKenzie" <jmckenze@ncfcomm.com>, <firewalls@greatcircle.com>
From: Frederick M Avolio <avolio@tis.com>
Subject: Re: What firewall do I need.
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Well, most vendors will not just post and tell you theirs is the best (like
Abirnet did... yikes.. Abirnet recommends Abirnet. Surprise! :-))

Take a look at the archives here, look at firewall reviews in magazines, etc.

You certainly need a firewall. I'd never suggest -- based on your network
-- configuring one yourself from the FWTK as someone did (unless you are
UNIX, TCP/IP, and security expert).

Sounds to me like you might be interested in a Windows NT based firewall.
There are about 5 or so such products out there.

Fred

At 10:15 PM 2/12/97 -0600, Jim McKenzie wrote:
>I am about to hook our 130 PC lan running WFW, WIN95, & NT to a dedicated
>internet connection.  What is my risk to hackers, etc. when we make this
>connection, what is the best firewall to use with the least setup and
>administrative work.
>
>Thanks for your help
>
>Jim McKenzie
>
>

From firewalls-owner  Fri Feb 14 00:14:38 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id TAA12278 for firewalls-outgoing; Thu, 13 Feb 1997 19:18:20 -0800 (PST)
Received: from relay3.UU.NET (relay3.UU.NET [192.48.96.8]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id MAA07607 for <firewalls@GreatCircle.COM>; Thu, 13 Feb 1997 12:31:00 -0800 (PST)
Received: from nova.unix.portal.com by relay3.UU.NET with SMTP 
	(peer crosschecked as: nova.unix.portal.com [156.151.1.101])
	id QQcctl23494; Thu, 13 Feb 1997 15:15:05 -0500 (EST)
Received: from demon.corp (demon.corp.portal.com [156.151.1.10]) by nova.unix.portal.com (8.6.11/8.6.5) with SMTP id MAA13641 for <firewalls@GreatCircle.COM>; Thu, 13 Feb 1997 12:13:20 -0800
Date: Thu, 13 Feb 1997 12:13:20 -0800 (PST)
From: Dana Bourgeois <fg@portal.com>
X-Sender: fg@demon.corp
Reply-To: Dana Bourgeois <fg@portal.com>
To: firewalls@GreatCircle.COM
Subject: Re: Split DNS - Another way
In-Reply-To: <199702130313.WAA23629@mail.clark.net>
Message-ID: <Pine.SUN.3.95.970213120512.12745B-100000@demon.corp>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Wed, 12 Feb 1997, Marcus J. Ranum wrote:

> > I have been watching the split DNS discussions and learned a lot of
> > the issues, good and bad, for implementing such.
> 
> I think a good approach is to turn the problem on its head. What
> most folks implement with "split DNS" is actually "split resolving"
> which is what you really want!  So, suppose I have a firewall on
> the perimeter of my network, acting as an external nameserver,
> and I have an internal full nameserver: I want the firewall and all
> its proxies to resolve all addresses for *.v-one.com against the
> internal nameserver and use the Internet for everything else. Turns
> out that this hack works just great. My internal nameserver can
> slave from the firewall, which has only a few v-one.com names
> in it, and the only machine that needs to have DNS magic
> installed is the firewall.

This is correct, the issue is resolving and which DNS server is used by
whom for what. 

My question is: why is a patch needed?  If there is an external DNS server
in the DMZ that knows only the DNS info on what is externally
visible, and the firewall forwards DNS packets from external to DMZ and
back but never internal <--> external or internal <--> DMZ, then why can't
the firewall simply run a resolv.conf file that points to the internal DNS
server server?  


   Dana  Bourgeois
----------------------
    fg@portal.com
Natasha: Black RX-7 R1


From firewalls-owner  Fri Feb 14 00:15:11 1997
Received: (majordom@localhost) by miles.greatcircle.com (8.8.5/Lists-960417-1) id TAA12287 for firewalls-outgoing; Thu, 13 Feb 1997 19:18:35 -0800 (PST)
Received: from ALABAMA.CF.CS.YALE.EDU (RT-GW.CS.YALE.EDU [128.36.0.13]) by miles.greatcircle.com (8.8.5/Miles-960830-1) with ESMTP id LAA28561 for <firewalls@GreatCircle.COM>; Thu, 13 Feb 1997 11:49:00 -0800 (PST)
From: long-morrow@CS.YALE.EDU
Received: from SPARKY.CF.CS.YALE.EDU by ALABAMA.CF.CS.YALE.EDU (8.7.1/res.host.cf-4.0)
	with ESMTP id OAA03574; Thu, 13 Feb 1997 14:47:30 -0500 (EST) sender long-morrow@CS.YALE.EDU for 
Received: by SPARKY.CF.CS.YALE.EDU (Sendmail-8.7.1/res.client.cf-4.0)
	id OAA17080; Thu, 13 Feb 1997 14:47:21 -0500 (EST)
Date: Thu, 13 Feb 1997 14:47:21 -0500 (EST)
Message-Id: <199702131947.OAA17080@SPARKY.CF.CS.YALE.EDU>
To: firewalls@GreatCircle.COM, mjr@clark.net
Subject: Re: e-mail !!!!= HTML   \:-|
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Thus spake "Marcus J. Ranum" <mjr@clark.net>:
>> > > stop posting in HTML !!!!!!!!
>Since I deliberately run an ancient feature-free browser on
>my home system, I can't check, but can someone let us
>know if the mailer interprets javascript in HTML mail
>messages?? That could make for some nasty mailbombs. :(

Sending myself E-mail from Netscape (and then reading it via the
built-in mail window with POP retrieval) I found that Javascript is
indeed sent and interpreted by Netscape Navigator.

I guess I could have been real nasty and actually SENT it to
the entire mailing list just to show everyone ... but I'm a nice guy :-)

You can test it with the URL http://www.cs.yale.edu/HTML/YALE/CS/perlis96.html
(which includes one of those annoying bottom horizontal
scrolling ticker-tape marquees implemented in Javascript
I found for the borrowing -- to publicize our annual Symposium).

Point Netscape at the Web page, then mail the document to yourself as source.

The resulting mail message in your inbox should look like:


From Morrow.Long@Yale.EDU Thu Feb 13 14:36:33 1997
Received: from 128.36.0.30 by RA.DEPT.CS.YALE.EDU (8.7.1/res.host.cf-4.0)
	with SMTP id OAA10995; Thu, 13 F