From firewalls-owner  Thu Jan  1 00:29:31 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id AAA27144; Thu, 1 Jan 1998 00:27:03 -0800 (PST)
Received: from wizard.abirnet.co.il (wizard.abirnet.co.il [194.90.211.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id AAA27137 for <firewalls@GreatCircle.COM>; Thu, 1 Jan 1998 00:26:54 -0800 (PST)
Received: from hagit1.abirnet.co.il (hagit1.abirnet.co.il [194.90.211.84])
	by wizard.abirnet.co.il (8.8.5/8.8.5) with SMTP id KAA05797;
	Thu, 1 Jan 1998 10:29:37 +0200
From: "Hagit" <hagit@abirnet.com>
To: <firewalls@GreatCircle.COM>, "Paul Alukal" <pva@bluerose.tju.edu>
Subject: Re: Intrusion Detection - Switched Network
Date: Thu, 1 Jan 1998 10:34:28 +0200
Message-ID: <01bd1690$12fb4240$54d35ac2@hagit1.abirnet.co.il>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 4.71.1712.3
X-MimeOLE: Produced By Microsoft MimeOLE V4.71.1712.3
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

SessionWall-3 is an Intrusion Detection System that works in a switched network
environment.

<snip>

>The question is this. If the network is fully switched, how effective
>is any intrusion detection system (without using an shared hub)? By
>switched network, I mean each network device  is connected directly to
>a port on a switch. The switch technology gives each port a different
>virtual circuit through the switch (unlike a shared hub), that even
>makes sniffing difficult (or impossible).
>

Even when working in a switched network  IP addresses can be spoofed, machines
can get SYN flooded, or attacked in many other ways. working in switched
environment does not mean being protected from intrusions.

>Some thoughts are to place the intrusion detection system near a choke
>point (like a firewall), but this will still need some shared hub.
>Installing any intrusion detection system on a firewall itself is out
>of question (due to complexity).
>

What we begin to see today, is IDS shaking hands with routers and firewalls,
where the IDS could control the firewall or the router, OPSEC for controlling
firewall-1 is a good example for that trend.

>Assuming the network will have ATM backbone with different VLAN's in
>the network, we can think of an intrusion detection system with
>multiple interfaces to each VLAN, still if the network is switched, how
>effective will be the intrusion detection?
>
Plug the IDS  into the monitoring port of the switched hub, it should be
effective enough. What can cause the IDS to be less effective is the load on the
netwrok, if the network is highly loaded, IDS which monitors each packet going
on the net, can miss some of the traffic. In SessionWall-3, you can exclude
services to reduce the system load and remain effective even in high utilized
environments.

>Is there any commercial (or other) system which is capable of doing a
>true intrusion detection in these kind of situations?
>
>Thanks in advance for any comments or suggestions.
>
>Paul Alukal

Try SessionWall-3, it is preconfigured to work in the monitoring port of a
switched hub.
You can download a test drive at http://www.abirnet.com

Hagit Oron
 AbirNet
  --------------------------------------------------------------------------
   AbirNet provides the next generation in Internet and Intranet Protection
    Get an EVALUATION COPY at <http://www.AbirNet.com>
---------------------------------------------------------------------------




From firewalls-owner  Thu Jan  1 02:29:36 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id CAA09704; Thu, 1 Jan 1998 02:06:06 -0800 (PST)
Received: from wizard.abirnet.co.il (wizard.abirnet.co.il [194.90.211.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id CAA09649 for <firewalls@GreatCircle.COM>; Thu, 1 Jan 1998 02:05:10 -0800 (PST)
Received: from hagit1.abirnet.co.il (hagit1.abirnet.co.il [194.90.211.84])
	by wizard.abirnet.co.il (8.8.5/8.8.5) with SMTP id MAA09121;
	Thu, 1 Jan 1998 12:07:42 +0200
From: "Hagit" <hagit@abirnet.com>
To: <firewalls@GreatCircle.COM>, "Lars Bertelsen" <lbe@login.dknet.dk>
Subject: Re: Intrusion Detection - Question.
Date: Thu, 1 Jan 1998 12:12:34 +0200
Message-ID: <01bd169d$c72af640$54d35ac2@hagit1.abirnet.co.il>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 4.71.1712.3
X-MimeOLE: Produced By Microsoft MimeOLE V4.71.1712.3
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



On Wed 31 Dec 1997 you Wrote:
>Now I think I'm definitely missing something here!
>
>When we are talking about intrusion detection in this context, what is it
>that people mean?
>I can think of several things, but it seems to me that this is a well
>established set of meanings of which I seem to be unaware. God how I hate
>that! :-)

The term IDS is used to describe a machine that monitors the traffic  on the
network  looking for known signatures of what might be attack on one or more of
the devices (Servers, stations, routers etc).

>
>Another question springs to mind: While I can easily see the problems
>discussed in accessing packet information in a switched environment, and
>while I fully understand it's implications from the point of view of
>network troubleshooting, I'm not shure I understand why it has to be a
>problem from a security point of view.
>

Working in switched environment does not mean protecting the network from
intruders.
Since IDS work by monitoring all network traffic, it is impossible  for such a
system to work in a switched environment, unless of course it is plugged in the
promiscious port of the switch.

>>From what I have read I assume that we are talking about some sort of
>sniffing on the network, looking for specific sorts of traffic that
>shouldn't be there (or should but isn't!).
>
>As i see it, intrusion from a practical point of view means that you have
>one or more connections to the world.
>It would also seem to me that you would have to have one or more servers
>worth protecting.
>

Why just servers?
Wouldn't  you like to know if someone is WinNuking workstations?
Wouldn't you like to know if someone is trying to Land attack your Cicso router?
Some Intrusion detection systems can detect Malicious HTML signatures, wouldn't
you like to know which user just downloaded (or recived email) containing such a
signature?

>Now I can't help thinking that the simple approach would be to do the
>sniffing at the connection to the world, either by means of monitoring that
>specific port in the switch or if that is not possible then by simply
>attaching a small hub to the port and plugging the sniffer and the router
>into that hub.

You can plug Intrusion detetction system in some vulenrable locations in the
network, the segment that opens the network to the outside world is certainly
one of them.

>Assuming that intrusion means intrusion from the outside, I can't see other
>than that any unwanted traffic would have to come this way!
>
>Now we might want to take this one step further and protect ourselves
>against "inside intrusion" too; people actually sitting on the internal net
>and doing things they shouldn't, either from actual machines on the network
>or through unathorized backdoors (I still remember the number of users  who
>got hopping mad when we switched to digital phones and they couldn't user
>their PC card modems any more! :-) )

All recent surveys about intrusion detection indicate that most of the
intrusions come from users inside the network.
Plugging an Intrusion Detection System in every segment of the network is a good
protection.

>
>Again it would seem to me to be a question of identifying the danger points
>and do the monitoring there.
>Aggreed, this is more complicated than just sniffing everything on a
>non-switched network, and if there are many servers it might be a fairly
>big job to set up. But I can't see why it would be anything that couldn't
>be solved with the technologies that we already have at our disposals.
>

Can you expand here, to what technologies do you refer?


Cheers
Hagit
  --------------------------------------------------------------------------
   AbirNet provides the next generation in Internet and Intranet Protection
   Get an EVALUATION COPY at <http://www.AbirNet.com>
---------------------------------------------------------------------------




From firewalls-owner  Thu Jan  1 04:44:31 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id EAA19489; Thu, 1 Jan 1998 04:34:01 -0800 (PST)
Received: from mtigwc03.worldnet.att.net (mtigwc03.worldnet.att.net [204.127.131.34]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id EAA19472 for <firewalls@GreatCircle.COM>; Thu, 1 Jan 1998 04:33:52 -0800 (PST)
From: mht@clark.net
Received: from highlander ([12.68.178.24]) by mtigwc03.worldnet.att.net
          (post.office MTA v2.0 0613 ) with SMTP id AAB1182;
          Thu, 1 Jan 1998 12:36:36 +0000
Message-Id: <3.0.3.32.19980101073410.00860d50@pop3.clark.net>
X-Sender: mht@pop3.clark.net
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Thu, 01 Jan 1998 07:34:10 -0500
To: Frank Willoughby <frankw@in.net>, James Terry <james@imx-exchange.com>
Subject: Re: firewall audit service referral -reply
Cc: firewalls@GreatCircle.COM
In-Reply-To: <3.0.3.32.19971231220823.007cc220@in.net>
References: <34AA9991.62140279@imx-exchange.com>
 <418996AD2954D11180860000E8D5C667018538@ns.rc.on.ca>
 <3488EB31.B5D806F6@gnss.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

<comments within>


>>could anyone recommend a good firewall testing service?
>>
>>thanks,
>>james@imx-exchange.com
>
>It depends on what you are looking for.  
>
>Fortified Networks does firewall testing for customers (corporations,
>governments, etc).  
>
>FNITL is an independent test laboratory for testing firewalls & other
>InfoSec products.
>The most frequent testing performed are Quality Assurance Tests of Internet
>Firewalls 
>& other InfoSec products - primarily for vendors, etc.

This is just one of many companies that perform these kind of services.

>
>CAUTION:
>Beware of any organizations which will perform a remote firewall
>penetration test.
>This is an inherently dangerous practice which has the potential of leading
>hackers
>to their next victims.

There are several big N-1 firms that do the above for a large fee plus they
offer other services as well.. As Frank states in his CAUTION message, be
aware of any big N-1 firm that state they have expert resources inhouse.
When inquiring to companies to perform the remote firewall penetration
test, ask them about their methodology, their deliverables and the risk
analysis before they conduct a test.

/mht

>
>Best Regards,
>
>
>Frank
>The opinions of the author of this mail may not necessarily be 
>representative of the opinions of Fortifed Networks, Inc.
>
>Fortified Networks, Inc. - http://www.fortified.com/
>Home of the Free Internet Firewall Evaluation Checklist
>Expert (vendor-neutral) Computer and Network Security Solutions
>Phone: (317) 573-0800     Fax: (317) 573-0817
>
>
------------------------------------------------------
"GREETINGS PROFESSOR FALKEN."
	"SHALL WE PLAY A GAME??"
------------------------------------------------------


From firewalls-owner  Thu Jan  1 09:29:36 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA02557; Thu, 1 Jan 1998 09:16:57 -0800 (PST)
Received: from homeport.org (lighthouse.homeport.org [205.136.65.198]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA02549 for <firewalls@greatcircle.com>; Thu, 1 Jan 1998 09:16:48 -0800 (PST)
Received: (adam@localhost) by homeport.org (8.8.5/8.6.9) id MAA03330; Thu, 1 Jan 1998 12:14:25 -0500 (EST)
From: Adam Shostack <adam@homeport.org>
Message-Id: <199801011714.MAA03330@homeport.org>
Subject: Re: off topic: ssl setup on web server - now browser crypto strength
In-Reply-To: <199801010150.MAA14312@gate.quick.com.au> from "Simon J. Gerraty" at "Jan 1, 98 12:50:07 pm"
To: sjg@quick.com.au (Simon J. Gerraty)
Date: Thu, 1 Jan 1998 12:14:25 -0500 (EST)
Cc: firewalls@greatcircle.com (Firewalls mailing list)
X-Mailer: ELM [version 2.4ME+ PL27 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Simon J. Gerraty wrote:

| Yes I had a lok at it and it works very well.  I had no trouble setting up
| 128bit sessions to an apache server.  Problem is that whether the author
| wrote this thing outside the U.S. or not, he chose a U.S. based site? as
| home for it :-)  so we are back to all the shadows of ITAR.

	I use it as well.  Easier than filling out the form on
Netscape's web pages. :)

	Someone else pointed out that only the READMEs sit in the US.

| The other problem with something like fortify is that it may provoke the U.S.
| govt into revoking export of all versions of netscape etc.

	Worrying about this is giving in to that most pernicious of
policemen, the policeman within.  One can spend months worrying about
all the implications of having anything at all American involved in
writing crypto, leading to not writing crypto code at all.  If Uncle
Sam wants to try to tell Netscape and Microsoft that they can't even
export weak crypto, then there will be enough money involved to
demonstrate that the law is an ass and in violation of the 1st
Ammendment to our Constitution.

	Incidentally, John Gilmore has recently put up for FTP without
restriction an authenticating DNS server in source form, including
RSAREF.  See Risks 19.51 or .52 for details.

	The government is free to respond, but has to explain its
actions.

Adam





| Like I said, a non-U.S. origin web browser is the best solution... :-)
| (Oh, and I don't see that happening anytime soon :-)
| 
| --sjg
| 


-- 
"Remember, the holiday I'm currently celebrating has nothing to
 do with love, and everything to do with a guerilla war against
 an invading hegemony."					  - NJM


From firewalls-owner  Thu Jan  1 11:29:28 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA10168; Thu, 1 Jan 1998 11:28:32 -0800 (PST)
Received: from dns1.enterprise.net (dns1.enterprise.net [194.72.192.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id LAA10161 for <firewalls@greatcircle.com>; Thu, 1 Jan 1998 11:28:24 -0800 (PST)
Received: from ppp387.enterprise.net (ppp220.enterprise.net [194.72.195.220])
	by dns1.enterprise.net (8.8.5/8.8.5) with SMTP id TAA05298
	for <firewalls@greatcircle.com>; Thu, 1 Jan 1998 19:27:46 GMT
Received: by ppp387.enterprise.net with Microsoft Mail
	id <01BD16EB.19432B80@ppp387.enterprise.net>; Thu, 1 Jan 1998 19:26:03 -0500
Message-ID: <01BD16EB.19432B80@ppp387.enterprise.net>
From: Gadbois <gadbois@enterprise.net>
To: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: Firewall  Security Advisory
Date: Thu, 1 Jan 1998 19:25:07 -0500
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Forwarding this advisory I received on the Checkpoint FW-1 in case you haven't seen it.  Take care.

Brian

> Original Message Follows

>WE HAVE RECEIVED INFORMATION CONCERNING A SECURITY PROBLEM
>PRESENT IN CHECKPOINT'S FIREWALL-1 WHICH ALLOWS UNAUTHORIZED USERS TO
>ACCESS THE SNMP DAEMON RUNNING ON THE FIREWALL. THIS ALLOWS OUTSIDERS
> TO OBTAIN INTERNAL AND CONFIDENTIAL INFORMATION ABOUT THE INSTALLATION AND
>OPERATION OF THE FIREWALL AND THE NETWORK WHICH IT PROTECTS, WITHOUT
>BEING TRACED.  THE FOLLOWING ADVISORY IS A RETRANSMISSION OF A SECURE
>NETWORKS INC. ADVISORY PUBLISHED ON 9 DEC 97.
>[*** START SNI ADVISORY, "CHECKPOINT FIREWALL-1 SECURITY ADVISORY" **
>*]
> 
>PROBLEM DESCRIPTION: THE DEFAULT RECOMMENDED CONFIGURATION OF
>FIREWALL-1 ALLOWS OUTSIDE USERS TO OBTAIN CONFIDENTIAL OPERATION AND
>STATISTICAL INFORMATION FROM THE SIMPLE NETWORK MANAGEMENT PROTOCOL
>(SNMP) DAEMON.
>ONCE OBTAINED, THIS INFORMATION CAN BE USED BY POTENTIAL INTRUDERS TO
>FIND VULNERABILITIES IN THE FIREWALL OR CONNECTED SYSTEMS. IN ADDITION,
>POTENTIAL INTRUDERS CAN OBTAIN STATISTICS ON THE FIREWALL'S OPERATION.
>FINDING SOFTWARE ON THE FIREWALL WITH KNOWN VULNERABILITIES CAN, IN SOME
>CASES, BE EXPLOITED IMMEDIATELY TO CAUSE A DENIAL OF SERVICE (DOS) AT
>TACK.
>IT IS POSSIBLE FOR PEOPLE WISHING TO SEE THE VOLUME OF TRAFFIC GOING IN
>AND OUT OF A TARGET FIREWALL'S NETWORK TO OBTAIN THIS INFORMATION IN A
>FORM THAT CAN BE DIRECTLY IMPORTED INTO ANY NUMBER OF NETWORK MONITORING
>TOOLS THAT CAN GRAPH IT BY TIME OF DAY.
> 
>TECHNICAL DETAILS: FIREWALL-1 MAKES USE OF THE SNMP SERVICE ON ALL
>PLATFORMS TO OBTAIN INFORMATION ABOUT THE MACHINE ON WHICH THE FIREWALL
>IS RUNNING, AND TO SHOW THE USER REAL-TIME STATISTICS ABOUT THE FIREWALL.
>FOR THOSE UNFAMILIAR WITH THE FIREWALL-1 USER INTERFACE, THE FIRST OPTION
>AVAILABLE IN THE GLOBAL PROPERTIES DIALOG BOX IS:
>     "ENABLE FIREWALL-1 CONTROL CONNECTIONS [ESSENTIAL]" [1].
>THE WORD 'ESSENTIAL' IS CONTAINED IN THE USER INTERFACE WINDOW ITSELF,
>CAUSING UNFAMILIAR USERS TO BE VERY RELUCTANT TO REMOVE IT SINCE THEY
>FEEL THE VENDOR SHOULD KNOW BEST ABOUT THIS.
>THE DEFAULT CONFIGURATION IS TO HAVE THIS SELECTED AND MARKED "FIRST" SO
>THAT IT IS EVALUATED BEFORE THE RULE-SET DEFINED BY THE FIREWALL
>ADMINISTRATOR. SINCE FIREWALL-1 OPERATIONS ON A FIRST-MATCH RATHER THAN
>A BEST-MATCH PRINCIPLE, NOTHING IN THE RULE-SET OVERRIDES THIS.
>THE DOCUMENTATION MAKES IT VERY CLEAR THAT WHILE THIS BOX IS SELECTED,
>CONTROL CONNECTIONS REQUIRED FOR USE OF THE REMOTE GUI ARE ONLY ALLOWED
>IF THE IP ADDRESS IS LISTED IN A SPECIFIC TEXT FILE. ALL OTHER CONNECTION
>ATTEMPTS WILL BE REJECTED. NO MENTION IS MADE OF THE FACT THAT ACCESS IS
>ALLOWED TO THE SNMP PORTS FROM ANY ADDRESS. IF ACCESS WERE RESTRICTED TO
>ADDRESSES THAT APPEAR IN THE TEXT FILE, THIS PROBLEM WOULD BE PRESENT TO
>A LESSER DEGREE, ALLOWING AN ATTACKER TO SPOOF UDP PACKETS TO SET
>VARIABLES, WITHOUT NEEDING TO RECEIVE A REPLY.
>THE SNMP DAEMON REVEALS THE VERSION OF THE OPERATING SYSTEM AND FIREWALL,
>AS WELL AS THE CONFIGURATION OF THE SECURITY PERIMETER SUCH AS THE
>PRESENCE OR ABSENCE OF A SERVICE NETWORK (DMZ). THE OS VENDOR'S SNMP
>DAEMON WILL GENERALLY MAKE AVAILABLE INFORMATION SUCH AS A LIST OF ALL
>ACTIVE CONNECTIONS, A LIST OF ALL RUNNING SERVICES AND THE ENTIRE ROUTING
>TABLE (WHICH IF THE FIREWALL RUNS RIP CONTAINS A SIZABLE AMOUNT OF
>INFORMATION). INFORMATION SUCH AS THE AMOUNT OF TRAFFIC TRAVELING ON ANY
>GIVEN INTERFACE CAN BE USEFUL FOR COMPETITORS GAINING INFORMATION ON
>NETWORK TRAFFIC.
>IN ADDITION TO THE STANDARD MIB, VARIOUS VENDORS MAKE THEIR OWN
>INFORMATION AVAILABLE VIA ENTERPRISE MIBS. AS THE REFERANCE SECTION TO
>THIS ADVISORY NOTES, THIS MAY BE IMPORTANT FOR NT USERS OF THE CHECKPOINT
>FIREWALL [2].
>CHECKPOINT HAS THEIR OWN ENTERPRISE MIB (ENTERPRISES.1919). THIS PROVIDES
>OTHER INFORMATION USEFUL TO THE POTENTIAL INTRUDER SUCH AS THE NUMBER OF
>DENIED, DROPPED, ALLOWED AND LOGGED PACKETS AS WELL AS THE CURRENT STATE
>OF THE FIREWALL. PROVIDED AS WELL, IS THE TEXT OF THE LAST SNMP TRAP
>GENERATED.
>TO AN INTRUDER, THE INFORMATION OBTAINED CAN IN MANY CASES POINT THEM
>DIRECTLY TO A WAY IN WHICH THEY CAN GAIN REMOTE ACCESS TO THE PROTECTED
>NETWORK.
>ACCESS TO THE SNMP DAEMON IS ALLOWED IN RULE-SET 0 (PROPERTIES) NO
>LOGGING OF THESE ACCESSES IS MADE.
> 
>VULNERABLE OPERATING SYSTEMS AND SOFTWARE: ALL PLATFORMS RUNNING
>VERSIONS OF FIREWALL-1 FROM CHECKPOINT WHERE THE ADMINISTRATOR HAS NOT
>DISABLED THE "ENABLE REMOTE CONNECTIONS" OPTION FROM THE PROPERTIES, OR
>HAS IN SOME OTHER WAY ENABLED ACCESS TO THE SNMP SERVER ON THE FIREWALL.
>
>FIX INFORMATION:
> 
>A.  VENDOR PATCH: ACCORDING TO CHECKPOINT SOFTWARE, A PATCH FOR THIS
>PROBLEM IS AVAILABLE VIA:
>      HTTP://WWW.CHECKPOINT.COM/SUPPORT (ALL LOWERCASE)
>IT SHOULD BE NOTED THAT THIS URL IS PASSWORD PROTECTED AND IS ONLY
>ACCESSABLE VIA CHECKPOINT AUTHORIZED RESELLERS.
>B.  QUICK FIX: IMMEDIATELY UNSELECT THE "ENABLE REMOTE CONNECTIONS"
>OPTION. ALSO, BLOCK ALL SNMP TRAFFIC AT YOUR BORDER ROUTER (UDP PORT 161).
>IF YOU ABSOLUTELY REQUIRE REMOTE ACCESS, A QUALIFIED SECURITY
>ADMINISTRATOR CAN ASSIST YOU IN DESIGNING A POLICY THAT GRANTS THIS
>ACCESS IN THE REGULAR RULE-BASE.  PLEASE NOTE THAT THIS SUGGESTION IS
>NOT SUPPORTED BY CHECKPOINT AND IS PROVIDED WITHIN THIS ADVISORY ON AN
>'AS IS' BASIS. SNI (SECURE NETWORKS INC.) ACCEPTS NO LIABILTY FOR THIS
>SUGGESTED FIX, AND END USERS SHOULD APPLY IT ONLY AFTER CONSULTING THEIR
>IN-HOUSE SECURITY ADMINISTRATOR.
> 
>ADDITIONAL INFORMATION: THE INFORMATION PROVIDED IN THIS ADVISORY 
>WAS PROVIDED TO SNI BY STEVE BIRNBAUM <SBIRN@SECURITY.ORG.IL>.
> 
>REFERENCES (FROM FOOTNOTES IN TEXT ABOVE):
>     [1] MANAGING FIREWALL-1 USING THE WINDOWS GUI, FIGURE 1-11.
>     [2] BUGTRAQ MAILING LIST POST CONCERNING MIB ENTERPRISES.77
>A RECENT POST TO A SECURITY MAILING LIST BY CHRISTOPHER ROULAND
>(CROULAND@EXAMNYC.LEHMAN.COM) POINTED OUT THAT THE MICROSOFT LAN-MANAGER
>ENTERPRISE MIB (ENTERPRISES.77) LISTED VAST AMOUNTS OF INFORMATION THAT
>SHOULD BE HEAVILY GUARDED.
>THIS INCLUDES A LIST OF RUNNING SERVICES AND THEIR STATE, A LIST OF ALL
>USERS THAT EXIST ON THE MACHINE, ANY CONNECTED SHARES AND THE NUMBEROF
>FAILED PASSWORD ATTEMPTS AMONG OTHER THINGS. FURTHER, HE FOUND A CERTAIN
>VARIABLE THAT COULD BE SET TO 0 IN MICROSOFT'S ENTERPRISE MIB WHICH
>RESULTED IN A CLEARING OF THE WINS DATABASE. GIVING SUCH INFORMATION AS
>THE PRESENCE OF ANY SHARES AND THE USER LIST ON A FIREWALL IS A POSSIBLY
>DISASTROUS BREACH OF SECURITY.
>[*** END SNI ADVISORY, "CHECKPOINT FIREWALL-1 SECURITY ADVISORY" ***]
> 


From firewalls-owner  Thu Jan  1 12:48:10 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA15218; Thu, 1 Jan 1998 12:33:24 -0800 (PST)
Received: from cmcl2.nyu.edu (NYU.EDU [128.122.253.92]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA15189 for <firewalls@GreatCircle.COM>; Thu, 1 Jan 1998 12:33:16 -0800 (PST)
Received: from [128.122.237.106] ("port 2048"@DIAL6-ASYNC38.DIAL.NET.NYU.EDU)
 by cmcl2.nyu.edu (PMDF V5.1-10 #24942)
 with ESMTP id <0EM40052UH2IKM@cmcl2.nyu.edu> for firewalls@GreatCircle.COM;
 Thu,  1 Jan 1998 15:32:45 -0500 (EST)
Date: Thu, 01 Jan 1998 15:32:45 -0500 (EST)
Date-warning: Date header was inserted by cmcl2.nyu.edu
From: Jimmy Kyriannis <jimmy.kyriannis@nyu.edu>
Subject: Re: Intrusion Detection - Switched Network
In-reply-to: <199712301602.LAA15151@bluerose.tju.edu>
X-Sender: kyriann@cmcl2-f.nyu.edu
To: Paul Alukal <pva@bluerose.tju.edu>
Cc: firewalls@GreatCircle.COM
Message-id: <v03102800b0d166d26564@[128.122.175.192]>
MIME-version: 1.0
Content-type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


I can't speak for ATM-only switches, but some conventional LAN switches,
such as the Catalyst allow for the administrative creation of a port which
can present all traffic flowing through a VLAN.  As long as the bandwidth
available on this port exceeds the total bandwidth consumed by the VLAN,
you'll be able to use that port for sniffing/analysis purposes without
packet loss.  According to Cisco engineers, the Catalyst 5x00's, at least,
do this in hardware with no performance loss.


Jimmy

At 11:02 AM -0500 12/30/97, Paul Alukal wrote:
>Hello everyone,
>
>I am interested in any feedback from users who use any type of
>intrusion detection systems (commercial or others) on a switched
>network.
>
>The question is this. If the network is fully switched, how effective
>is any intrusion detection system (without using an shared hub)? By
>switched network, I mean each network device  is connected directly to
>a port on a switch. The switch technology gives each port a different
>virtual circuit through the switch (unlike a shared hub), that even
>makes sniffing difficult (or impossible).
>
>Some thoughts are to place the intrusion detection system near a choke
>point (like a firewall), but this will still need some shared hub.
>Installing any intrusion detection system on a firewall itself is out
>of question (due to complexity).
>
>Assuming the network will have ATM backbone with different VLAN's in
>the network, we can think of an intrusion detection system with
>multiple interfaces to each VLAN, still if the network is switched, how
>effective will be the intrusion detection?
>
>Is there any commercial (or other) system which is capable of doing a
>true intrusion detection in these kind of situations?
>
>Thanks in advance for any comments or suggestions.
>
>Paul Alukal




From firewalls-owner  Thu Jan  1 13:29:28 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id NAA20716; Thu, 1 Jan 1998 13:23:38 -0800 (PST)
Received: from wizard.abirnet.co.il (wizard.abirnet.co.il [194.90.211.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id NAA20706 for <firewalls@GreatCircle.COM>; Thu, 1 Jan 1998 13:23:26 -0800 (PST)
Received: from ziv_note.abirnet.com (ziv-note.abirnet.co.il [194.90.211.23])
	by wizard.abirnet.co.il (8.8.5/8.8.5) with SMTP id XAA32641;
	Thu, 1 Jan 1998 23:22:30 +0200
Date: Thu,  1 Jan 98 23:21:08 +0200
From: Ziv Dascalu  <ziv@AbirNet.com>
Subject: Re: Intrusion Detection - Switched Network 
To: blast  <blast@broder.com>, Rabid Wombat  <wombat@mcfeely.bsfs.org>
Cc: "Paul D. Robertson"  <proberts@clark.net>, firewalls@GreatCircle.COM,
        Paul Alukal  <pva@bluerose.tju.edu>
X-Mailer: Chameleon ATX 6.0.1, Standards Based IntraNet Solutions, NetManage Inc.
X-Priority: 3 (Normal)
References: <Pine.BSF.3.91.971231042041.13583A-100000@mcfeely.bsfs.org> 
Message-ID: <Chameleon.883689801.ziv@ziv_note.abirnet.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


--- On Wed, 31 Dec 1997 04:24:13 -0500 (EST)  Rabid Wombat <wombat@mcfeely.bsfs.org> wrote:
> 
> Switches are designed to support a large volume of traffic; if you 
> aggregate all the traffic in multiple collision domains onto one 
> monitoring segment, you'd flood it. Hence the decision to provide a 
> monitoring port that can handle one collision domain at a time.
> 
> -r.w.
> 
> On Tue, 30 Dec 1997, blast wrote:
> 
> > On Tue, 30 Dec 1997, Paul D. Robertson wrote:
> > 
> > > On Tue, 30 Dec 1997, Paul Alukal wrote:
> > > 
> > > > Is there any commercial (or other) system which is capable of doing a
> > > > true intrusion detection in these kind of situations?
> > > 
> > > Most good switches will allow you to set particular ports to get all 
> > > traffic as if it were a hub.  This is where you configure the IDS.
> > 
> > Paul Alukal has a valid question and I have yet to find any 
> > 'administrative' port on any switch that facilitates an IDS
> > on each segment concurrently.
> > 
> > Paul Robertson is right in saying that most "good switches"
> > have a port (single) to monitor a particular "domain" (collision/VLAN).
> > Problem is that these ports were not designed with an IDS in mind and 
> > may only offer your IDS a view one world (collision-domain) at a time.
> > This constraint may or may not facilitate your IDS.
> > 

---------------End of Original Message-----------------

So a possible solution for IDS systems may be point solution in critical places or having it 
physically connected to multiple segments by supporting multiple NICs

Ziv

...=====  A B I R N E T          Active Network Protection  	(http://www.abirnet.com) =====


From firewalls-owner  Thu Jan  1 23:44:25 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id XAA14253; Thu, 1 Jan 1998 23:34:39 -0800 (PST)
Received: from mastech.com (firewall.mastech.com [208.0.144.226]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id XAA14243 for <Firewalls@GreatCircle.COM>; Thu, 1 Jan 1998 23:34:34 -0800 (PST)
Received: by firewall.mastech.com id <26993>; Fri, 2 Jan 1998 02:30:50 -0500
From: "P Mohan" <mohanp@india.mastech.com>
To: Firewalls@GreatCircle.COM
Date: Fri, 2 Jan 1998 02:52:59 -0500
Subject: FTP server
Reply-to: mohanp@india.mastech.com
X-mailer: Pegasus Mail for Windows (v2.23)
Message-Id: <98Jan2.023050est.26993@firewall.mastech.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Friends,

I am planning to setup one FTP server (Internet) and give access to 
my client to use that. How do I do this ? Is there any web site where 
I can get more info on this?  


Thanks in advance

P.Mohan
mohanp@india.mastech.com

From firewalls-owner  Fri Jan  2 03:14:28 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id DAA27225; Fri, 2 Jan 1998 03:00:18 -0800 (PST)
Received: from castle.us-state.gov (castle.us-state.gov [198.76.102.19]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id DAA27210 for <firewalls@greatcircle.com>; Fri, 2 Jan 1998 03:00:10 -0800 (PST)
Received: by castle.us-state.gov; id AA22398; Fri, 2 Jan 98 05:59:29 EST
Received: from pubhost.us-state.gov(198.76.102.34) by castle.us-state.gov via smap (V1.3mjr)
	id sma022384; Fri Jan  2 05:59:22 1998
Received: by pubhost.us-state.gov; id AA06061; Fri, 2 Jan 98 05:59:18 EST
Received: by localhost with Microsoft MAPI; Fri, 2 Jan 1998 05:54:38 -0500
Message-Id: <01BD1742.E93E3350@gcrum@us-state.gov>
From: Gary Crumrine <gcrum@us-state.gov>
Reply-To: "gcrum@us-state.gov" <gcrum@us-state.gov>
To: "'Ted Doty'" <ted@iss.net>,
        "firewalls@greatcircle.com"
	 <firewalls@greatcircle.com>
Subject: RE: Intrusion Detection - Switched Network
Date: Fri, 2 Jan 1998 05:54:37 -0500
Organization: US Dept of State
X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4025
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Some very important points that you bring out Ted, is that 1) Network 
monitoring tools are to be considered only a part of the whole picture, and 
not relied upon to be the ultimate wall of defense.  It should only be used 
to flag activity that requires further review by your administrative and 
security staff.  2) In this day and age, my opinion is that the biggest 
threat we see is from the inside...  When working with forensic data from 
various customer sites, it appears much more activity on our so called 
trusted networks is occurring that is not detected.  Industry is slowly 
turning their eyes internally, and it is good they have begun to do so. 
 Any tool that can be used flag this activity is sorely needed and a 
welcome relief to those of us who used to sit and pound out script after 
script in order to keep one step ahead of the bad guys.  The only thing I 
fear though, is that we will soon rely too much on this technology, and 
lose the skills and insight you gain from in depth study of log data. 
  Nothing quite as satisfying as your daily dose of analytics I always 
say...;^)

-----Original Message-----
From:	Ted Doty [SMTP:ted@iss.net]
Sent:	Wednesday, December 31, 1997 10:44 AM
To:	firewalls@greatcircle.com
Subject:	Re: Intrusion Detection - Switched Network

On Tue, 30 Dec 1997 13:06:19 -0500 (EST), Brad <brad@freedom.gmsociety.org>
wrote:

>> I am interested in any feedback from users who use any type of
>> intrusion detection systems (commercial or others) on a switched
>> network.
>
>THis is a problem I think every vendor is facing at this point.  I am not
>aware of any product that will do this yet.

ODS has a product called the "Secure Switch", which includes our RealSecure
IDS.  Look at http://www.ods.com and click on "Security".

>There are workarounds, host based intrusion detection being one, but this
>can get unweildy if you have hundred or thousands of hosts that need to be 
>installedon and managed.  Then there is the overhead associated with
>running IDS on each host.

Host based and network based IDS do different things, have different
strengths and weaknesses, and should be used for different purposes.

Network based IDS is efficient from a management point of view (a single
device can collect IDS information for an entire subnet), but is somewhat
subject to false positives (reporting an event as possibly malicious when
it is not, e.g. reporting a large number of legitimate hits on a fast web
server as a possible Syn flood).

Host based IDS requires more management effort, does not typically act in
real time, but has access to more refined levels of information (host audit
logs), so has a much lower level of false positives.

An appropriate strategy might be to run network IDS for wide coverage, with
host based IDS on critical systems, or on hosts that are reported to be
engaged in suspicious activity by the network IDS.

>> The question is this. If the network is fully switched, how effective
>> is any intrusion detection system (without using an shared hub)?

It has to be in the hub if you want to do network based IDS on fully
switched networks.  The IDS has to live somewhere on the data path.

>> Some thoughts are to place the intrusion detection system near a choke
>> point (like a firewall), but this will still need some shared hub.
>> Installing any intrusion detection system on a firewall itself is out
>> of question (due to complexity).

[snip]

>A problem with this is that you dont see the internal traffic, only stuff
>passing through that choke point.
>
>I envision that IDS will need to be integrated into the switches, and
>routers, themselves somehow, as an extra card, additions to switch or
>router OS's, etc...

It's a much more compelling argument to integrate IDS with a switch, rather
than with either firewalls or routers.  Since a standalone IDS could use
the firewall or router API (e.g. Checkpoint's OpSec) to update access
rules, the firewalls can concentrate on firewalling and the routers can
focus on routing.  One advantage of disassociating the IDS from the
firewall is that an IDS deep inside your network could update the Internet
perimeter defenses; this is useful for things like Smurf attacks.

Still ,the only way to get on the data path in switched networks is to
integrate into the switch itself.

Note that we're talking about two different types of monitoring here.  IDS
in combination with firewalls (and probably routers, too) is primarilly
focused on enhancing external security (strengthing the perimeter).  IDS in
the switch is primarily useful for detecting internal threats and misuse.
Internal IDS is most effectively used as deterence.  In other words, let
everyone know that monitoring is going on.

>> Assuming the network will have ATM backbone with different VLAN's in
>> the network, we can think of an intrusion detection system with
>> multiple interfaces to each VLAN, still if the network is switched, how
>> effective will be the intrusion detection?

Don't think you should need multiple interfaces, as long as the IDS
understands how to grok an ATM cell stream.  There are a lot of possible
encapsulations: RFC 1577, LANE, "Legacy" formats like Fore IP.  You may
need to do some network tuning. ;-)

>Thisis definitely feasable, but you bring up another problem, IDS systems
>that work at ATM speeds, of which, again I know of none.
>The closest thing that I know if is NetRanger, from WheelGroup, which 
scale
>up to full FDDI and Fast Ethernet speeds.  Butnot even NetRanger can work
>with ATM yet.

The ODS SecureSwitch has ATM/OC-3 interface modules.  I haven't seen any
performance figures, but it appears to be a supported configuration.

I haven't heard of any published performance tests for IDS systems.  If
anyone from the trade press is listening, this might be a useful article
for the community.

Disclaimer: I work for ISS, which makes RealSecure, which runs in the ODS
SecureSwitch.

- Ted

--------------------------------------------------------------
Ted Doty, Internet Security Systems | Phone: +1 770 395 0150
41 Perimeter Center East            | Fax:   +1 770 395 1972
Atlanta, GA 30346  USA              | Web: http://www.iss.net
--------------------------------------------------------------
PGP key fingerprint: 362A EAC7 9E08 1689  FD0F E625 D525 E1BE


From firewalls-owner  Fri Jan  2 03:44:25 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id DAA02900; Fri, 2 Jan 1998 03:37:00 -0800 (PST)
Received: from proteus.asyk.ase.gr (proteus.asyk.ase.gr [193.242.241.61]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id DAA02738 for <Firewalls@GreatCircle.com>; Fri, 2 Jan 1998 03:36:27 -0800 (PST)
Received: by proteus.asyk.ase.gr with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.995.52)
	id <01BD1783.5C8A3D00@proteus.asyk.ase.gr>; Fri, 2 Jan 1998 13:35:59 +0200
Message-ID: <c=US%a=_%p=ASYK_S.A.%l=PROTEUS-980102113557Z-762@proteus.asyk.ase.gr>
From: Vasilis Vergotis <V.Vergotis@asyk.ase.gr>
To: "'Firewalls@GreatCircle.com'" <Firewalls@GreatCircle.com>
Subject: DNS and Mail setup via firewall
Date: Fri, 2 Jan 1998 13:35:57 +0200
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.995.52
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello to everybody and happy new year!

I would be gratefull if you could give some advice to the following
theme:

There has been recently taken place to my company's network, a firewall
instalation whitch has been placed in front of the Internet connection.
Therefore the network has been split into a public part (whitch contains
nothing for the moment), a DMZ zone (whitch contains the public DNS and
mail server) and the internal private network (whitch contains the
internal DNS and mail server).

The external mail server receives the mail for the zone company.gr  and
it forwards it to the internal mail server via SMTP. The external DNS
server knows nothing about the internal.

Internally the DNS server is knows only the zone internal.company.gr for
whitch he is primary and for the things he does not know he asks the
external DNS server. The internal mail server receives the mail for the
zone internal.company.gr as well as the mail for the zone company.gr
that the external mail server forwards.

The problem is that the internal mail server cannot deliver mail to the
account with the e-mail address user@company.gr that has been created to
him. It sends back a message reporting that the recipient is unknown.

What goes wrong with the above configuration? I suspect that there is
something wrong with the DNS. Do i have to use the same zone
(company.gr) both for the internal and the DMZ network ? Can i use
e-mail addresses xxx@company.gr for the internal network with the above
configuration ?

Please send any help to my personal address to as i am not a member of
the list.

Thanks in advance,

Vassilis.


From firewalls-owner  Fri Jan  2 04:44:31 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id DAA04913; Fri, 2 Jan 1998 03:49:59 -0800 (PST)
Received: from bermuda.io.com (bermuda.io.com [199.170.88.7]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id DAA04843 for <firewalls@GreatCircle.COM>; Fri, 2 Jan 1998 03:49:40 -0800 (PST)
Received: from localhost (cooper@localhost)
	by bermuda.io.com (8.8.5/8.8.5) with SMTP id FAA10413
	for <firewalls@GreatCircle.COM>; Fri, 2 Jan 1998 05:49:09 -0600 (CST)
X-Authentication-Warning: bermuda.io.com: cooper owned process doing -bs
Date: Fri, 2 Jan 1998 05:49:09 -0600 (CST)
From: William Cooper <cooper@io.com>
To: "'firewalls@greatcircle.com'" <firewalls@GreatCircle.COM>
Subject: Re: Firewall  Security Advisory
In-Reply-To: <01BD16EB.19432B80@ppp387.enterprise.net>
Message-ID: <Pine.BSI.3.96.980102053409.10016A-100000@bermuda.io.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

this is a lame-

- properly configured this should never have been a problem, tho
admittedly it was a prob. w/ default config. on FW-1 until recently

- it is no longer a default on FW-1 and hasn't been for a month+

- patch was avail. 3 weeks+ before sec. advisory was posted

- this was posted to BUGTRAQ over 3 weeks ago, if you're serious about
network security and you didn't see it there, _and_ you managed to miss
the numberous references in the trade rags, _AND_ you didn't bother to
check CheckPoint's site to see if there were any new patches available,
you don't deserve to know about it in the first place (MO).  info re:
bugtraq at http://www.geek-girl.com/bugtraq/.

- bill

cooper@io.com

On Thu, 1 Jan
1998, Gadbois wrote:

> Forwarding this advisory I received on the Checkpoint FW-1 in case you
> haven't seen it.  Take care. 



From firewalls-owner  Fri Jan  2 06:44:28 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA15472; Fri, 2 Jan 1998 06:42:53 -0800 (PST)
Received: from loki.iss.net (loki.iss.net [208.21.0.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id GAA15464 for <firewalls@greatcircle.com>; Fri, 2 Jan 1998 06:42:46 -0800 (PST)
Received: from tdoty (tdoty.iss.net [208.21.4.61]) by loki.iss.net (8.8.7/8.7.3) with SMTP id JAA28004 for <firewalls@greatcircle.com>; Fri, 2 Jan 1998 09:42:14 -0500
Message-Id: <3.0.3.32.19980102093733.00a09100@mail.iss.net>
X-Sender: tdoty@mail.iss.net
X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.3 (32)
Date: Fri, 02 Jan 1998 09:37:33 -0500
To: firewalls@greatcircle.com
From: Ted Doty <ted@iss.net>
Subject: Re: Intrusion Detection - Question.
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Wed, 31 Dec 1997 09:50:47, "Paul D. Robertson" <proberts@clark.net> wrote:

On Wed, 31 Dec 1997, Lars Bertelsen wrote:

>> When we are talking about intrusion detection in this context, what is it
>> that people mean?
>> I can think of several things, but it seems to me that this is a well
>> established set of meanings of which I seem to be unaware. God how I hate
>> that! :-)
>
>At least from my perspective, we're discussing network monitoring tools 
>such as NFR, NetRanger, etc.  Which can alert based on certain traffic 
>patterns which are typicly associated with network intrusion.

A couple concrete examples might help clarify the distinction between what
firewalls and IDS do.  A firewall will typically grant or restrict access
to services (e.g. HTTP) based on policy (internal users can use browsers to
access arbitrary sites, external users are only allowed access to the DMZ
firewall).  IDS, on the other hand, looks for patterns within the allowed
traffic that suggests a deviation from policy, typically be exploiting a
vulnerability in a client or server program to gain additional privileges.

One such example is the Microsoft Internet Explorer 3.0/3.01 but that
causes the browser to locally execute URLs that have a .url or .lnk
extension.  An attacker could set up a web page offering cool inducements
("Click here for nude gifs of Socks the cat!") which in actuality point to
Mail_me_all_your_cached_passwords.url.

Another example is DNS.  Since we all rely on DNS to associate hard to
remember IP addresses from easy to remember hostnames, the firewall has to
pass incoming DNS traffic (at least from particular sources).  One known
attack returns an address longer than 4 bytes, to overflow a buffer in some
DNS implementations and execute arbitrary commands.

Typically the IDS will take appropriate action when it sees this kind of
shenanigans, for example killing the session with appropriately crafted TCP
RST messages, adding new firewall rules to block the miscreant, and making
pagers sing and network management consoles glow appropriately.

There seem to be two flavors of IDS, one that looks for known bad
signatures, and one that uses an expert system to detect patterns falling
outside the norm.  My examples use signatures (these are actual examples
from our RealSecure IDS).  The Network Intrusion Detection Expert System
(NIDES) from SRI is an example of a learning system to detect anomolous
usage patterns.

- Ted

--------------------------------------------------------------
Ted Doty, Internet Security Systems | Phone: +1 770 395 0150
41 Perimeter Center East            | Fax:   +1 770 395 1972
Atlanta, GA 30346  USA              | Web: http://www.iss.net
--------------------------------------------------------------
PGP key fingerprint: 362A EAC7 9E08 1689  FD0F E625 D525 E1BE

From firewalls-owner  Fri Jan  2 07:14:38 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA18839; Fri, 2 Jan 1998 07:08:21 -0800 (PST)
Received: from mco.edu (mco004.mco.edu [136.247.10.56]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id HAA18802 for <firewalls@greatcircle.com>; Fri, 2 Jan 1998 07:08:11 -0800 (PST)
Received: from mco-Message_Server by mco.edu
	with Novell_GroupWise; Fri, 02 Jan 1998 10:06:27 -0500
Message-Id: <s4acbc23.088@mco.edu>
X-Mailer: Novell GroupWise 4.1
Date: Fri, 02 Jan 1998 10:06:01 -0500
From: Jeff Zarend <jzarend@mco.edu>
To: firewalls@greatcircle.com
Subject: Batch load of users
Mime-Version: 1.0
Content-Type: text/plain
Content-Disposition: inline
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I want to batch load a user list for Checkpoint's Firewall-1.  I will use
DBIMPORT.
My problem is that the password field looks like it needs to be encrypted.
I have a flat text file, with the passwords in clear text (I randomly
generated the passwords).  Does anyone have a utility to encrypt
the text passwords, so they are acceptable to Firewall-1's batch load?

Thanks,
Jeff Zarend
Medical College of Ohio
jzarend@mco.edu
(419) 383-4505
 

From firewalls-owner  Fri Jan  2 07:45:14 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA20983; Fri, 2 Jan 1998 07:23:45 -0800 (PST)
Received: from tcs-sec.com (tcsfw-1.tcs-sec.com [208.219.129.41]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id HAA20913 for <firewalls@GreatCircle.COM>; Fri, 2 Jan 1998 07:23:29 -0800 (PST)
Received: (from uucp@localhost) by tcs-sec.com (8.8.7/8.6.9) id LAA00059; Fri, 2 Jan 1998 11:24:58 -0500
Received: from lambic.tcs-sec.com(205.197.27.135) by tcsfw-1.tcs-sec.com via smap (V1.3)
	id sma000057; Fri Jan  2 11:24:46 1998
Message-Id: <3.0.5.32.19980102102426.007d13c0@lambic>
X-Sender: gperry@lambic
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.5 (32)
Date: Fri, 02 Jan 1998 10:24:26 -0500
To: Frank Willoughby <frankw@in.net>, James Terry <james@imx-exchange.com>
From: Gregory Perry <gperry@tcs-sec.com>
Subject: Re: firewall audit service referral
Cc: firewalls@GreatCircle.COM
In-Reply-To: <3.0.3.32.19971231220823.007cc220@in.net>
References: <34AA9991.62140279@imx-exchange.com>
 <418996AD2954D11180860000E8D5C667018538@ns.rc.on.ca>
 <3488EB31.B5D806F6@gnss.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>CAUTION:
>Beware of any organizations which will perform a remote firewall
>penetration test.
>This is an inherently dangerous practice which has the potential of leading
>hackers
>to their next victims.
>
>Best Regards,
>
>
>Frank

I don't guess I understand what you are getting at, remote penetration
testing is an absolute necessity for any type of Internet related security
audit - which would you rather happen, have an outside firm discover flaws
in your Internet connected network, or have a hacker find and exploit the
flaw(s) instead?



__________________________________________________________________

Gregory Perry                                phone:  703.318.7134
Trusted Computer Solutions, Inc.               fax:  703.318.5041
13873 Park Center Road Suite 225        email: gperry@tcs-sec.com
Herndon, VA  20171                         http://www.tcs-sec.com
__________________________________________________________________

From firewalls-owner  Fri Jan  2 08:00:34 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA19764; Fri, 2 Jan 1998 07:14:33 -0800 (PST)
Received: from loki.iss.net (loki.iss.net [208.21.0.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id HAA19709 for <firewalls@greatcircle.com>; Fri, 2 Jan 1998 07:14:20 -0800 (PST)
Received: from tdoty (tdoty.iss.net [208.21.4.61]) by loki.iss.net (8.8.7/8.7.3) with SMTP id KAA29532; Fri, 2 Jan 1998 10:13:55 -0500
Message-Id: <3.0.3.32.19980102100915.00a09530@mail.iss.net>
X-Sender: tdoty@mail.iss.net
X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.3 (32)
Date: Fri, 02 Jan 1998 10:09:15 -0500
To: "gcrum@us-state.gov" <gcrum@us-state.gov>
From: Ted Doty <ted@iss.net>
Subject: RE: Intrusion Detection - Switched Network
Cc: "firewalls@greatcircle.com" <firewalls@greatcircle.com>
In-Reply-To: <01BD1742.E93E3350@gcrum@us-state.gov>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 05:54 AM 1/2/98 -0500, Gary Crumrine wrote:
>Some very important points that you bring out Ted, is that 1) Network 
>monitoring tools are to be considered only a part of the whole picture, and 
>not relied upon to be the ultimate wall of defense.  It should only be used 
>to flag activity that requires further review by your administrative and 
>security staff.  

Well, not really.  Some traffic can be identified as known bad (for
example, session hijacking attacks), and the IDS should take action to stop
it.  You don't want the admins involved, because by the time a human can
react the damage is already done.

OTOH, other types of events can be "interesting" without even being
"suspicious".  For example, suppose I see cleartext SMB passwords going
across my LAN.  This can mean all kinds of things, only some of which are
malicious.  I may have old LAN Manager clients, so my NT servers are
defaulting down to a brain dead authentication scheme.  I may have a
misconfiguration in one of my servers.  Or I might have a man-in-the-middle
password downgrade attack in progress.  In any case, I'll have to do some
investigating to determine what's really going on, and whether it needs
action.

- Ted

--------------------------------------------------------------
Ted Doty, Internet Security Systems | Phone: +1 770 395 0150
41 Perimeter Center East            | Fax:   +1 770 395 1972
Atlanta, GA 30346  USA              | Web: http://www.iss.net
--------------------------------------------------------------
PGP key fingerprint: 362A EAC7 9E08 1689  FD0F E625 D525 E1BE

From firewalls-owner  Fri Jan  2 08:09:08 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA20053; Fri, 2 Jan 1998 07:16:30 -0800 (PST)
Received: from friday.datasource.net (friday.datasource.net [205.183.26.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id HAA19865 for <firewalls@GreatCircle.COM>; Fri, 2 Jan 1998 07:15:43 -0800 (PST)
Received: from friday.datasource.net (root@localhost) by friday.datasource.net (8.7.5/8.7.3) with ESMTP id JAA07116; Fri, 2 Jan 1998 09:13:33 -0600 (CST)
Received: from datasource.net ([192.168.0.80]) by friday.datasource.net (8.7.5/8.7.3) with ESMTP id JAA07112; Fri, 2 Jan 1998 09:13:32 -0600 (CST)
Message-ID: <34AD0616.9B0187DF@datasource.net>
Date: Fri, 02 Jan 1998 09:21:58 -0600
From: Nathan Steinbauer <nathan@datasource.net>
Reply-To: nathan@datasource.net
Organization: DataSource Hagen
X-Mailer: Mozilla 4.02 [en] (Win95; I)
MIME-Version: 1.0
To: Modify <mdy@sekurity.org>
CC: "N.Z. Sanderson" <sanderson_nz@hotmail.com>, firewalls@GreatCircle.COM
Subject: Re: Borderware vs Firewall - 1
References: <Pine.LNX.3.96.971231110819.19037A-100000@obscure.sekurity.org>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

In defense of Secure Computing, Borderware is made for small to medium
sized companies.  In a 12,000 desktop company Secure would recommend
their Sidewinder, which does handle heavy usage well and is very
flexible.

My $.02

Nate


Modify wrote:
> 
> I tested both products and I would choose Firewall1 over Borderware any
> day.  (Personal Opinion)  I found that Borderware couldnt handle heavy
> loads (probably okay for a small company)  The help was crap and the
> service wasnt all that wonderful either!  Firewall1 had decent help and
> pretty darn good service from the home office.  Also, Firewall1 handled
> the large load we needed with 12,000 people in this company.  Firewall1
> also had a much more crisp, clear, easy to use interface for rule sets
> etc..etc..  All of which is personal opinion.
> 
> Modify
> 
> On Tue, 30 Dec 1997, N.Z. Sanderson wrote:
> 
> > Hi there . . .
> >
> > I am looking to at a comparison of two Firewall products:
> >
> > 1/    Secure Computings Borderware
> > 2/    Checkpoints Firewall - 1
> > ________
> > H  E  L  P
> > ---------
> > Has anyone either have there own comparison OR an opinion (good/bad) on
> > the above products.
> >
> > look forward to some answers . . . . . as these firewalls look good on
> > paper but how are they implemented.
> >
> > thanks in advance for your help . .
> >
> > Nigel Sanderson
> >
> >
> > ______________________________________________________
> > Get Your Private, Free Email at http://www.hotmail.com
> >

-- 
Nathan Steinbauer
Internet Consultant
DataSource Hagen
612.844.1459
nathan@datasource.net
http://www.datasource.net

From firewalls-owner  Fri Jan  2 08:11:12 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA18677; Fri, 2 Jan 1998 07:07:39 -0800 (PST)
Received: from imo11.mx.aol.com (imo11.mx.aol.com [198.81.19.165]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id HAA18670 for <Firewalls@GreatCircle.COM>; Fri, 2 Jan 1998 07:07:34 -0800 (PST)
From: GCrum2 <GCrum2@aol.com>
Message-ID: <ba63ceb0.34ad0295@aol.com>
Date: Fri, 2 Jan 1998 10:06:58 EST
To: Firewalls@GreatCircle.COM
Subject: firewRe: Looking for a good conference on firewalls and network s
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7bit
Organization: AOL (http://www.aol.com)
X-Mailer: Inet_Mail_Out (IMOv11)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I heard that the person who is teaching this course in question is in trouble
for stealing the material and is being sued.   I would really hate to spend
money and schedule flights etc for this course, only to show up and find out
that the course was cancelled because of someone's legal troubles.   

I am very surprised that their employer knowingly lets them continue to use
their name in the advertizement, or lets the person to continue to represent
them on the speaking tour.  Somehow, I tend to shy away from people involved
with shady acts for some reason.  If the charges are true, I'd have a problem
with that.  

I guess though, that we should give them the benefit of the doubt...the truth
seems to have a way of coming out in the end, so I will reserve judgement
until then.  Just use caution.  

As for SANS in general, I find them a very informative and forthright
organization.  In the Washington DC area, there are several very good
conferences that are held each year.  Infowarcom is one of those, as well as
one put on by NCSA I think...not sure.  COMNET and fed imaging are others that
come to mind.

-----Original Message-----
From:	<snip>
Sent:	Wednesday, December 31, 1997 7:05 PM
To:	Pablo Martinez; Firewalls@GreatCircle.COM
Subject:	Re: Looking for a good conference on firewalls and network security
-reply

I was just perusing the SANS May Conference, and found a course titled
"Firewall Management and Troubleshooting"  Anybody know anything about the
speaker or the contents of the course.???




At 03:17 PM 12/18/97 -0500, Pablo Martinez wrote:
>I am relatively new to this area and I am in the process of 
>registering in a couple of courses on network/Internet security. 
>I would also like to attend to a good conference/symposium on 
>network security (including firewalls) where I could get info on the 
>latest trends and research (courses usually do not cover that 
>in detail).  Any suggestions?  So far I have info on 
>
> - 1998 IEEE Symposium on Security and Privacy
> - The Internet Society's Symposium on Network and Distributed System 
>   Security
>
>thanks,
>-- 
>Pablo Martinez				101 Crawfords Corner Rd	
>Internet Communications Business 	Holmdel, NJ 07733-3030
>Lucent Technologies			732 817-2731
>pablo@lucent.com			732 817-4504 FAX
>
>



From firewalls-owner  Fri Jan  2 09:14:42 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA10009; Fri, 2 Jan 1998 09:06:11 -0800 (PST)
Received: from landfield.com (ns.landfield.com [208.196.145.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA09948 for <Firewalls@GreatCircle.COM>; Fri, 2 Jan 1998 09:05:54 -0800 (PST)
Received: (from kent@localhost)
	by landfield.com (8.8.8/8.8.8) id LAA21021;
	Fri, 2 Jan 1998 11:06:21 -0600 (CST)
From: Kent Landfield <kent@landfield.com>
Message-Id: <199801021706.LAA21021@landfield.com>
Subject: Re: FTP server
To: mohanp@india.mastech.com
Date: Fri, 2 Jan 1998 11:06:20 -0600 (CST)
Cc: Firewalls@GreatCircle.COM
In-Reply-To: <98Jan2.023050est.26993@firewall.mastech.com> from "P Mohan" at Jan 2, 98 02:52:59 am
X-Mailer: ELM [version 2.4 PL25]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

# Friends,
# 
# I am planning to setup one FTP server (Internet) and give access to 
# my client to use that. How do I do this ? Is there any web site where 
# I can get more info on this?  
# 
# 
# Thanks in advance
# 
# P.Mohan
# mohanp@india.mastech.com

Take a look at the WU-FTPD Resource Center 

	httpd://www.landfield.com/wu-ftpd.

-- 
Kent Landfield                        Phone: 1-817-545-2502             
Email: kent@landfield.com             http://www.landfield.com/
Email: kent@nfr.net                   http://www.nfr.net/
Please send comp.sources.misc related mail to kent@landfield.com
Search the Usenet Hypertext FAQ Archive at http://www.faqs.org/faqs/

From firewalls-owner  Fri Jan  2 11:44:38 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA23781; Fri, 2 Jan 1998 11:42:07 -0800 (PST)
Received: from tcs-sec.com (tcsfw-1.tcs-sec.com [208.219.129.41]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id LAA23774 for <firewalls@GreatCircle.COM>; Fri, 2 Jan 1998 11:41:59 -0800 (PST)
Received: (from uucp@localhost) by tcs-sec.com (8.8.7/8.6.9) id PAA01148 for <firewalls@GreatCircle.COM>; Fri, 2 Jan 1998 15:43:30 -0500
Received: from lambic.tcs-sec.com(205.197.27.135) by tcsfw-1.tcs-sec.com via smap (V1.3)
	id sma001146; Fri Jan  2 15:43:15 1998
Message-Id: <3.0.5.32.19980102144255.007f53d0@lambic>
X-Sender: gperry@lambic
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.5 (32)
Date: Fri, 02 Jan 1998 14:42:55 -0500
To: <firewalls@GreatCircle.COM>
From: Gregory Perry <gperry@tcs-sec.com>
Subject: Re: Intrusion Detection - Question.
In-Reply-To: <01bd169d$c72af640$54d35ac2@hagit1.abirnet.co.il>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>Working in switched environment does not mean protecting the network from
>intruders.
>Since IDS work by monitoring all network traffic, it is impossible  for
such a
>system to work in a switched environment, unless of course it is plugged
in the
>promiscious port of the switch.
>
>>>From what I have read I assume that we are talking about some sort of
>>sniffing on the network, looking for specific sorts of traffic that
>>shouldn't be there (or should but isn't!).
>>
>>Now I can't help thinking that the simple approach would be to do the
>>sniffing at the connection to the world, either by means of monitoring that
>>specific port in the switch or if that is not possible then by simply
>>attaching a small hub to the port and plugging the sniffer and the router
>>into that hub.

Where is RMON-2 and 3 at in terms of dispatching intelligent agents to
detect intrusions (or other suspicious network activity) as opposed to
running a port on the hub in promiscuous mode?

Bandwidth concerns would be enough to merit a proactive agent type scenario
as opposed to a centralized management server that parses all data on the
network, ATM would be out for this application for example...


__________________________________________________________________

Gregory Perry                                phone:  703.318.7134
Trusted Computer Solutions, Inc.               fax:  703.318.5041
13873 Park Center Road Suite 225        email: gperry@tcs-sec.com
Herndon, VA  20171                         http://www.tcs-sec.com
__________________________________________________________________

From firewalls-owner  Fri Jan  2 13:14:42 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id NAA28904; Fri, 2 Jan 1998 13:04:11 -0800 (PST)
Received: from tango.lightech.com.ar (tango.lightech.com.ar [200.0.253.134]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id NAA28897 for <firewalls@greatcircle.com>; Fri, 2 Jan 1998 13:04:02 -0800 (PST)
Received: from lightech.com.ar (plata.gaucho.com.ar [200.5.254.173])
	by tango.lightech.com.ar (8.8.7/8.8.7) with ESMTP id UAA17781;
	Fri, 2 Jan 1998 20:41:01 GMT
Message-ID: <34AD01AF.97E7A701@lightech.com.ar>
Date: Fri, 02 Jan 1998 18:03:11 +0300
From: Sergio Bollini <sbollini@lightech.com.ar>
Organization: LighTech
X-Mailer: Mozilla 4.04 [en] (X11; I; SunOS 5.5.1 sun4m)
MIME-Version: 1.0
To: "fw-1-mailinglist@us.checkpoint.com" <fw-1-mailinglist@us.checkpoint.com>,
        "firewalls@greatcircle.com" <firewalls@greatcircle.com>
Subject: fw-1 asmtpd banner
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello all!

Just a little question: does anybody know how to modify the fw-1 smtp
server's banner? I think it isn't a good idea to advertise that you are
using a firewall (not to mention product and version).

TIA

--
Sergio E. Bollini
LighTech                        Voice:  (54-1) 373-1141
Ayacucho 563. Piso 13 Dto "A"   FAX:    (54-1) 373-1215
(1026)  Buenos Aires            e-mail: sbollini@lightech.com.ar
Argentina                       URL:    http://www.lightech.com.ar




From firewalls-owner  Fri Jan  2 15:14:52 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA07465; Fri, 2 Jan 1998 15:07:48 -0800 (PST)
Received: from vulcan.achq.dnd.ca ([205.200.255.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id PAA07448 for <firewalls@greatcircle.com>; Fri, 2 Jan 1998 15:07:41 -0800 (PST)
Received: by vulcan.achq.dnd.ca; (5.65v3.2/1.3/10May95) id AA03205; Fri, 2 Jan 1998 17:10:31 -0600
Message-Id: <34AD73E7.DF4A5A0F@vulcan.achq.dnd.ca>
Date: Fri, 02 Jan 1998 17:10:34 -0600
Received: from [205.200.255.102] by vulcan (smtpxd); id XA03202
From: Rob Janzen <rob@vulcan.achq.dnd.ca>
Reply-To: rob@vulcan.achq.dnd.ca
Organization: 17 Wing Winnipeg
X-Mailer: Mozilla 4.03 [en] (Win95; I)
Mime-Version: 1.0
To: firewalls@greatcircle.com
Subject: TACAS+ Authentication
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Good morning:

I curently have a systems running CiscoSecure 1.x to provide tacas+
authentication for dial-in users.

The system running it is using SunOS 4.1.4.  To reduce the numbers of
versions of UNIX that I need to maintain, I would like to upgrade the
server to Solaris.  I have two questions:

Will CiscoSecure 1.x run under Solaris?
If not, can anyone recommend a good freeware replacement that will?

(Our budget is tight enough that avoiding paying for an upgrade is a
*good thing*....)

Thanks.

Rob Janzen


From firewalls-owner  Fri Jan  2 17:44:39 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id RAA16806; Fri, 2 Jan 1998 17:29:42 -0800 (PST)
Received: from gatekeeper.bh.org (gatekeeper.bh.org [204.68.182.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id RAA16799 for <firewalls@greatcircle.com>; Fri, 2 Jan 1998 17:29:37 -0800 (PST)
Received: from bh.org (bhhome.bh.org [204.68.182.2])
	by gatekeeper.bh.org (8.8.8/8.8.5) with ESMTP id UAA13649;
	Fri, 2 Jan 1998 20:27:57 -0500
Message-ID: <34AD9480.A6B46B48@bh.org>
Date: Fri, 02 Jan 1998 20:29:36 -0500
From: Bill Heiser <bill@bh.org>
X-Mailer: Mozilla 4.04 [en] (WinNT; U)
MIME-Version: 1.0
To: Sergio Bollini <sbollini@lightech.com.ar>
CC: "fw-1-mailinglist@us.checkpoint.com" <fw-1-mailinglist@us.checkpoint.com>,
        "firewalls@greatcircle.com" <firewalls@greatcircle.com>
Subject: Re: [FW1] fw-1 asmtpd banner
References: <34AD01AF.97E7A701@lightech.com.ar>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



Sergio Bollini wrote:

> Just a little question: does anybody know how to modify the fw-1 smtp
> server's banner? I think it isn't a good idea to advertise that you are
> using a firewall (not to mention product and version).

I second this request - the SMTP Security Server should definitly not
advertise what it is ...




From firewalls-owner  Fri Jan  2 18:59:51 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id SAA23882; Fri, 2 Jan 1998 18:55:39 -0800 (PST)
Received: from lint.cisco.com (lint.cisco.com [171.68.223.44]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id SAA23875 for <firewalls@greatcircle.com>; Fri, 2 Jan 1998 18:55:34 -0800 (PST)
Received: from lint.cisco.com (rfarnswo-isdn2.cisco.com [171.68.22.43]) by lint.cisco.com (8.8.5/CISCO.SERVER.1.2) with ESMTP id SAA23336; Fri, 2 Jan 1998 18:55:03 -0800 (PST)
Message-ID: <34ADA873.A5D3427F@lint.cisco.com>
Date: Fri, 02 Jan 1998 18:54:44 -0800
From: "Roger W. Farnsworth" <rfarnswo@cisco.com>
Reply-To: rfarnswo@cisco.com
Organization: Cisco Systems, Inc.
X-Mailer: Mozilla 4.04 [en] (Win95; U)
MIME-Version: 1.0
To: rob@vulcan.achq.dnd.ca
CC: firewalls@greatcircle.com
Subject: Re: TACAS+ Authentication
References: <34AD73E7.DF4A5A0F@vulcan.achq.dnd.ca>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Rob,

Cisco's main AAA servers are commercially supported products for Solaris
and Windows NT.  Cisco Secure ACS is the family name.  We provide
support and regular maintenance releases for these products.  We also
charge for them.

With that said, there are freeware reference implementations of TACACS+
available via anonymous ftp from Cisco.  

ftp://ftp-eng/pub/tacacs+/

These software downloads are provided for the convenience of software
developers looking to code their own T+ servers and or applications. 
Cisco provides this software as-is, without warranty or support, for
those that have a need for it.

The latest version (including docs) is available at:

ftp://ftp-eng/pub/tacacs+/tac_plus.F4.0.1.alpha.tar.Z

If you would like to download the reference implementation and compile
it for Solaris, feel free.  But you will be on your own for support
outside the included documentation.  If you don't have the budget for a
supported copy of Cisco Secure, but do have the budget to do your own
compiling, troubleshooting, and bug fixes, then this is probably the
right way to go.  Personally, I'd rather pay for the program and let
Cisco take the abuse.  ;-)

Cheers,

R.

Rob Janzen wrote:
> 
> Good morning:
> 
> I curently have a systems running CiscoSecure 1.x to provide tacas+
> authentication for dial-in users.
> 
> The system running it is using SunOS 4.1.4.  To reduce the numbers of
> versions of UNIX that I need to maintain, I would like to upgrade the
> server to Solaris.  I have two questions:
> 
> Will CiscoSecure 1.x run under Solaris?
> If not, can anyone recommend a good freeware replacement that will?
> 
> (Our budget is tight enough that avoiding paying for an upgrade is a
> *good thing*....)
> 
> Thanks.
> 
> Rob Janzen

-- 

Roger W. Farnsworth
Manager, Cisco Security Solutions

From firewalls-owner  Fri Jan  2 21:14:30 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id UAA03099; Fri, 2 Jan 1998 20:59:44 -0800 (PST)
Received: from davinci.netaxis.COM (davinci.netaxis.com [198.69.103.4]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id UAA03091 for <firewalls@greatcircle.com>; Fri, 2 Jan 1998 20:59:39 -0800 (PST)
From: ME22g701Q@worktow1est.com
Received: from Z9R84HG6q (jac-fl3-13.ix.netcom.com [204.31.245.109]) by davinci.netaxis.COM (8.8.8/8.7.3) with SMTP id XAA13560; Fri, 2 Jan 1998 23:44:00 -0500 (EST)
DATE: 01 Jan 98 11:59:53 PM
Message-ID: <052aM05d4tWmmp7KunH>
TO: eduacation@children423.net
SUBJECT: Give Your Child "One of the Best Children's Videos""
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

The holidays are upon us.  If you're like a lot of people, you struggle to
find gifts for your children that will entertain and amuse them at the same
time.  Well, here's a gift that will delight your child -

A Is For Airplane!

"A Is For Airplane" is the award-winning educational video that shows kids
all the fun and teamwork involved in running an airline.  "A Is For Airplane"
gets viewers behind the scenes at the airport!  Kids get to see:

*  The ticket counter!
*  Inside the baggage system!
*  On the ramp with the baggage loaders and fuelers!
*  In the catering kitchens!
*  Inside the control tower!
*  In the hangar with the mechanics!
*  At the boarding gate!
*  And even in the COCKPIT of a real Boeing 757!

Parenting Magazine calls "A Is For Airplane" "One of the Best Videos of
1996!"  It's also Approved by the Parent's Choice Foundation!

Thousands of copies of "A Is For Airplane" have been sold for $14.95, but as
an Internet Special this holiday season you can get "A Is For Airplane" for
only $11.95 (plus shipping and handling.)  ORDER TODAY FOR GUARANTEED HOLIDAY
DELIVERY!

You can order "A Is For Airplane" by calling our toll-free number -
800-250-4210.

If you'd like more information, visit our Website at
www.ppmm.com/jfp/jfp1297.htm

or CLICK HERE!

Thank you for your time...

Johnson Family Productions
Madison, WI


From firewalls-owner  Fri Jan  2 21:59:46 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id VAA09298; Fri, 2 Jan 1998 21:52:35 -0800 (PST)
Received: from ns.telegroup.com (ns.telegroup.com [208.219.0.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id VAA09291 for <firewalls@greatcircle.com>; Fri, 2 Jan 1998 21:52:29 -0800 (PST)
Received: from telegroup.com ([208.219.1.30])
	by ns.telegroup.com (8.8.5/8.8.5) with SMTP id XAA12345
	for <firewalls@greatcircle.com>; Fri, 2 Jan 1998 23:48:38 -0600 (CST)
Received: from radius.telegroup.com (radius.telegroup.com [10.1.2.10])
	by telegroup.com (8.8.5/8.8.5) with ESMTP id XAA19679
	for <firewalls@greatcircle.com>; Fri, 2 Jan 1998 23:52:10 -0600 (CST)
Received: from mandrake.telegroup.com (macke@[208.219.1.177]) by radius.telegroup.com (8.8.5/8.8.3) with SMTP id XAA27619 for <firewalls@greatcircle.com>; Fri, 2 Jan 1998 23:52:10 -0600 (CST)
Date: Fri, 2 Jan 1998 23:52:09 -0600 (CST)
From: Brian Macke <macke@telegroup.com>
Reply-To: bmacke@telegroup.com
To: firewalls@greatcircle.com
Subject: Re: Give Your Child "One of the Best Children's Videos""
In-Reply-To: <052aM05d4tWmmp7KunH>
Message-ID: <Pine.LNX.3.96.980102234312.26916B-100000@mandrake.telegroup.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On 1 Jan 1998 ME22g701Q@worktow1est.com wrote:

> [ More advertising drivel ]

> *  The ticket counter!
> *  Inside the baggage system!
> *  On the ramp with the baggage loaders and fuelers!
> *  In the catering kitchens!
> *  Inside the control tower!
> *  In the hangar with the mechanics!
> *  At the boarding gate!
> *  And even in the COCKPIT of a real Boeing 757!

What? No grisly images of a bust/shakedown of someone attempting to
smuggle drugs through an airport? What better message for little kiddies
than showing what will happen if you're not smart and hide your drugs the
right way....

> Parenting Magazine calls "A Is For Airplane" "One of the Best Videos of
> 1996!"  It's also Approved by the Parent's Choice Foundation!

....and the Firewalls Mailing list calls this "S is for SPAM and L is for
lawsuit."

> Thousands of copies of "A Is For Airplane" have been sold for $14.95, but as
> an Internet Special this holiday season you can get "A Is For Airplane" for
> only $11.95 (plus shipping and handling.)  ORDER TODAY FOR GUARANTEED HOLIDAY
> DELIVERY!

Well, whoopie! That'll get me outta my Dilbertesque cave and talk to
humans for the first time in years...

> or CLICK HERE!

WHERE? WHERE? I keep clicking and nothing happens?!?! Is this a VIRUS? Do
I need the Quickmail Upgrade so I can click on things and make things
magically happen??? The Help Desk is busy... HELP ME!

-Brian James Macke					macke@telegroup.com
 Unix SysAdmin/Security Specialist			Telegroup, Inc.
    "In order to get that which you wish for, you must first get that which 
     builds it."			-- Unknown


From firewalls-owner  Sat Jan  3 00:44:26 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id AAA18672; Sat, 3 Jan 1998 00:29:27 -0800 (PST)
Received: from do.nachtwacht.nl (pino.demon.nl [194.159.226.41]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id AAA18662 for <firewalls@greatcircle.com>; Sat, 3 Jan 1998 00:29:21 -0800 (PST)
Received: from localhost (arjan@localhost)
          by do.nachtwacht.nl (8.8.4/8.8.4) with SMTP
	  id KAA00543; Sat, 3 Jan 1998 10:29:29 +0100
Date: Sat, 3 Jan 1998 10:29:29 +0100 (MET)
From: Arjan Vos <arjan@pino.demon.nl>
To: Gregory Perry <gperry@tcs-sec.com>
cc: Frank Willoughby <frankw@in.net>, James Terry <james@imx-exchange.com>,
        firewalls@greatcircle.com
Subject: Re: firewall audit service referral
In-Reply-To: <3.0.5.32.19980102102426.007d13c0@lambic>
Message-ID: <Pine.LNX.3.95.980103102238.514A-100000@do.nachtwacht.nl>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Fri, 2 Jan 1998, Gregory Perry wrote:

> >CAUTION:
> >Beware of any organizations which will perform a remote firewall
> >penetration test.
> >This is an inherently dangerous practice which has the potential of leading
> >hackers
> >to their next victims.
> >
> >Best Regards,
> >
> >
> >Frank
> 
> I don't guess I understand what you are getting at, remote penetration
> testing is an absolute necessity for any type of Internet related security
> audit - which would you rather happen, have an outside firm discover flaws
> in your Internet connected network, or have a hacker find and exploit the
> flaw(s) instead?
> 

Some months ago, there has been some discussions on this list about the
dangers - and pros and cons so to say - of doing remote penetration tests.
Frank did make some good points for *not* doing remote penetration tests,
though I think his points are not a reason enough for skipping these
tests. They do however bring forward the requirements of care that should
be taken when doing remote tests. And unfortunately it is true that some
companies who do penetation testing do not take enough care - maybe then
it is better not to perform remote penetration tests.

Check out the archives, because the discussion was very interesting...

Gr. Arjan

--
Eat hard
Sleep hard
Wear glasses if you need them


From firewalls-owner  Sat Jan  3 04:14:26 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id EAA02881; Sat, 3 Jan 1998 04:01:06 -0800 (PST)
Received: from relay.kacst.edu.sa (ns1.kacst.edu.sa [198.77.88.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id EAA02874 for <Firewalls@GreatCircle.COM>; Sat, 3 Jan 1998 04:00:59 -0800 (PST)
Received: from ns1.kfupm.edu.sa ([198.77.102.26]) by relay.kacst.edu.sa (8.7.5/8.7.3) with ESMTP id OAA21000 for <Firewalls@GreatCircle.COM>; Sat, 3 Jan 1998 14:55:35 -0300 (GMT)
Received: from dpc107.dpc.kfupm.edu.sa ([196.15.32.8]) by ns1.kfupm.edu.sa (8.7.5/8.7.3) with ESMTP id OAA45704 for <Firewalls@GreatCircle.COM>; Sat, 3 Jan 1998 14:54:06 +0300
Received: (from s961807@localhost) by dpc107.dpc.kfupm.edu.sa (8.7.5/8.7.3) id OAA101299; Sat, 3 Jan 1998 14:56:43 +0300
Date: Sat, 3 Jan 1998 14:56:42 +0300 (SAUST)
From: zaki al-halal <s961807@dpc.kfupm.edu.sa>
To: Firewalls@GreatCircle.COM
Message-ID: <Pine.A32.3.91.980103145610.52342G-100000@dpc107.dpc.kfupm.edu.sa>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



From firewalls-owner  Sat Jan  3 06:29:30 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA11981; Sat, 3 Jan 1998 06:26:35 -0800 (PST)
Received: from alpha2000.tech-comm.com ([209.149.125.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id GAA11945 for <firewalls@greatcircle.com>; Sat, 3 Jan 1998 06:26:25 -0800 (PST)
Received: by alpha2000.tech-comm.com; (8.8.5/1.1.8.2/05Jun95-1217PM)
	id IAA22263; Sat, 3 Jan 1998 08:20:20 -0600 (CST)
Date: Sat, 3 Jan 1998 08:20:20 -0600 (CST)
From: Dick Brooks <dick@tech-comm.com>
Message-Id: <199801031420.IAA22263@alpha2000.tech-comm.com>
To: rfarnswo@cisco.com, rob@vulcan.achq.dnd.ca
Subject: Re: TACAS+ Authentication
Cc: firewalls@greatcircle.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Roger wrote:

>The latest version (including docs) is available at:

>ftp://ftp-eng/pub/tacacs+/tac_plus.F4.0.1.alpha.tar.Z

I just tried to donload the above and recevied an error:

ftp> get pub/tacacs+/tac_plus.F4.0.1.alpha.tar.Z
local: pub/tacacs+/tac_plus.F4.0.1.alpha.tar.Z: No such file or directory


Dick Brooks                            dick@8760.com
Chief Technical Officer                Tel. 205-250-8053
Group 8760 LLC                         WWW URL:  http://www.8760.com/
SECURE ELECTRONIC COMMERCE SOLUTIONS FOR HEALTHCARE AND NATURAL GAS INDUSTRIES

From firewalls-owner  Sat Jan  3 09:29:35 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA20127; Sat, 3 Jan 1998 09:17:06 -0800 (PST)
Received: from lint.cisco.com (lint.cisco.com [171.68.223.44]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA20120 for <firewalls@greatcircle.com>; Sat, 3 Jan 1998 09:17:02 -0800 (PST)
Received: from rfarnswo-pc.cisco.com (rfarnswo-isdn2.cisco.com [171.68.22.43]) by lint.cisco.com (8.8.5/CISCO.SERVER.1.2) with SMTP id JAA18506; Sat, 3 Jan 1998 09:16:17 -0800 (PST)
Message-Id: <3.0.3.32.19980103091340.008954d0@lint.cisco.com>
X-Sender: rfarnswo@lint.cisco.com
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Sat, 03 Jan 1998 09:13:40 -0800
To: Dick Brooks <dick@tech-comm.com>, rob@vulcan.achq.dnd.ca
From: "Roger  W. Farnsworth" <rfarnswo@cisco.com>
Subject: Re: TACACS+ Authentication
Cc: firewalls@greatcircle.com
In-Reply-To: <199801031420.IAA22263@alpha2000.tech-comm.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Let me check.

R.

At 08:20 AM 1/3/98 -0600, Dick Brooks wrote:
>Roger wrote:
>
>>The latest version (including docs) is available at:
>
>>ftp://ftp-eng/pub/tacacs+/tac_plus.F4.0.1.alpha.tar.Z
>
>I just tried to donload the above and recevied an error:
>
>ftp> get pub/tacacs+/tac_plus.F4.0.1.alpha.tar.Z
>local: pub/tacacs+/tac_plus.F4.0.1.alpha.tar.Z: No such file or directory
>
>
>Dick Brooks                            dick@8760.com
>Chief Technical Officer                Tel. 205-250-8053
>Group 8760 LLC                         WWW URL:  http://www.8760.com/
>SECURE ELECTRONIC COMMERCE SOLUTIONS FOR HEALTHCARE AND NATURAL GAS
INDUSTRIES
>
>

From firewalls-owner  Sat Jan  3 09:44:27 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA21409; Sat, 3 Jan 1998 09:37:07 -0800 (PST)
Received: from lint.cisco.com (lint.cisco.com [171.68.223.44]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA21385 for <firewalls@greatcircle.com>; Sat, 3 Jan 1998 09:37:00 -0800 (PST)
Received: from rfarnswo-pc.cisco.com (rfarnswo-isdn2.cisco.com [171.68.22.43]) by lint.cisco.com (8.8.5/CISCO.SERVER.1.2) with SMTP id JAA23618 for <firewalls@greatcircle.com>; Sat, 3 Jan 1998 09:36:48 -0800 (PST)
Message-Id: <3.0.3.32.19980103093623.008935e0@lint.cisco.com>
X-Sender: rfarnswo@lint.cisco.com
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Sat, 03 Jan 1998 09:36:23 -0800
To: firewalls@greatcircle.com
From: "Roger  W. Farnsworth" <rfarnswo@cisco.com>
Subject: Re: TACACS+ Authentication
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Dick,

I'm puzzled.  I just downloaded the file with no problems.  9:22a PST.  I
got it while connected with Netscape and again with my ftp client.  I can't
imagine what the problem might be.  If you keep having problems, please
contact me directly and we'll try to sort it out.

R.

At 08:20 AM 1/3/98 -0600, Dick Brooks wrote:
>Roger wrote:
>
>>The latest version (including docs) is available at:
>
>>ftp://ftp-eng/pub/tacacs+/tac_plus.F4.0.1.alpha.tar.Z
>
>I just tried to donload the above and recevied an error:
>
>ftp> get pub/tacacs+/tac_plus.F4.0.1.alpha.tar.Z
>local: pub/tacacs+/tac_plus.F4.0.1.alpha.tar.Z: No such file or directory
>
>
>Dick Brooks                            dick@8760.com
>Chief Technical Officer                Tel. 205-250-8053
>Group 8760 LLC                         WWW URL:  http://www.8760.com/
>SECURE ELECTRONIC COMMERCE SOLUTIONS FOR HEALTHCARE AND NATURAL GAS
INDUSTRIES
>
>

From firewalls-owner  Sat Jan  3 11:28:19 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA01286; Sat, 3 Jan 1998 11:08:28 -0800 (PST)
Received: from mail.matav.hu (castor.matav.net [145.236.224.250]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id LAA01271 for <firewalls@greatcircle.com>; Sat, 3 Jan 1998 11:08:17 -0800 (PST)
Received: (qmail 26215 invoked from network); 3 Jan 1998 20:08:05 +0100
Received: from line-208-135.dial.matav.net (HELO default) (145.236.208.135)
  by mail.matav.hu with SMTP; 3 Jan 1998 20:08:05 +0100
Reply-To: "Takacs Istvan" <anonymus@mail.matav.hu>
From: "Takacs Istvan" <anonymus@mail.matav.hu>
To: <firewalls@greatcircle.com>
Subject: Re: Re: Intrusion Detection - Switched Network
Date: Sat, 3 Jan 1998 20:06:54 +0100
Message-ID: <01bd187a$c1752ac0$LocalHost@default>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-2"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 4.71.1712.3
X-MimeOLE: Produced By Microsoft MimeOLE V4.71.1712.3
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

> It has to be in the hub if you want to do network based IDS on fully
> switched networks.  The IDS has to live somewhere on the data path.

Could you offer me a product, which has that kind of security feature?

Regards.

                           Istvan Takacs
           mailto:anonymus@mail.matav.hu

p.s.: Happy New Year!



From firewalls-owner  Sat Jan  3 11:29:21 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA01285; Sat, 3 Jan 1998 11:08:25 -0800 (PST)
Received: from mail.matav.hu (castor.matav.net [145.236.224.250]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id LAA01272 for <Firewalls@GreatCircle.COM>; Sat, 3 Jan 1998 11:08:17 -0800 (PST)
Received: (qmail 26184 invoked from network); 3 Jan 1998 20:08:00 +0100
Received: from line-208-135.dial.matav.net (HELO default) (145.236.208.135)
  by mail.matav.hu with SMTP; 3 Jan 1998 20:08:00 +0100
Reply-To: "Takacs Istvan" <anonymus@mail.matav.hu>
From: "Takacs Istvan" <anonymus@mail.matav.hu>
To: <Firewalls@GreatCircle.COM>
Subject: Any document about cracker's technic?
Date: Sat, 3 Jan 1998 19:55:51 +0100
Message-ID: <01bd1879$3656a780$LocalHost@default>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-2"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 4.71.1712.3
X-MimeOLE: Produced By Microsoft MimeOLE V4.71.1712.3
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

Could you offer me some good links, books, videos
or any kind of documents about the crackers technics?

You always talk about the IDS, and how they work.
But I'd like to know what I have to look for in my company's
network.
We just started to use the commercial side of Internet and for this
reason I think we have to prepare to the crackers attacks.

I don't ask for exact description, just for how they try to
break into the internal network.

Thank you!

Regards.

                            Istvan Takacs
               mailto:anonymus@mail.matav.hu

p.s.: Please, write to my own address, too. Thanks.


From firewalls-owner  Sat Jan  3 14:59:27 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id OAA16629; Sat, 3 Jan 1998 14:46:48 -0800 (PST)
Received: from brussels.cisco.com (brussels.cisco.com [171.68.129.238]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id OAA16622 for <firewalls@GreatCircle.COM>; Sat, 3 Jan 1998 14:46:42 -0800 (PST)
Received: from evyncke-pc.cisco.com (evyncke-isdn-home.cisco.com [171.68.148.198])
	by brussels.cisco.com (8.8.5/8.8.5) with SMTP id XAA06477;
	Sat, 3 Jan 1998 23:44:32 +0100 (MET)
Message-Id: <3.0.5.32.19980103234333.00926a10@brussels.cisco.com>
X-Sender: evyncke@brussels.cisco.com
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.5 (32)
Date: Sat, 03 Jan 1998 23:43:33 +0100
To: "Roger  W. Farnsworth" <rfarnswo@cisco.com>, firewalls@GreatCircle.COM
From: Eric Vyncke <evyncke@cisco.com>
Subject: Re: TACACS+ Authentication
Cc: dick@8760.com
In-Reply-To: <3.0.3.32.19980103093623.008935e0@lint.cisco.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Dick,

I have just done it as well from outside Cisco (so there is no
protection involved), be sure to use
ftp://ftp-eng.cisco.com/pub/tacacs+/tac_plus.F4.0.1.alpha.tar.Z

with the cisco.com that Roger forgot ;-)

Best regards

-eric

At 09:36 3/01/98 -0800, Roger  W. Farnsworth wrote:
>Dick,
>
>I'm puzzled.  I just downloaded the file with no problems.  9:22a PST.  I
>got it while connected with Netscape and again with my ftp client.  I can't
>imagine what the problem might be.  If you keep having problems, please
>contact me directly and we'll try to sort it out.
>
>R.
>
>At 08:20 AM 1/3/98 -0600, Dick Brooks wrote:
>>Roger wrote:
>>
>>>The latest version (including docs) is available at:
>>
>>>ftp://ftp-eng/pub/tacacs+/tac_plus.F4.0.1.alpha.tar.Z
>>
>>I just tried to donload the above and recevied an error:
>>
>>ftp> get pub/tacacs+/tac_plus.F4.0.1.alpha.tar.Z
>>local: pub/tacacs+/tac_plus.F4.0.1.alpha.tar.Z: No such file or directory
>>
>>
>>Dick Brooks                            dick@8760.com
>>Chief Technical Officer                Tel. 205-250-8053
>>Group 8760 LLC                         WWW URL:  http://www.8760.com/
>>SECURE ELECTRONIC COMMERCE SOLUTIONS FOR HEALTHCARE AND NATURAL GAS
>INDUSTRIES
>>
>>
>
Eric Vyncke      
Technical Consultant               Cisco Systems Belgium SA/NV
Phone:  +32-2-778.4677             Fax:    +32-2-778.4300
E-mail: evyncke@cisco.com          Mobile: +32-75-312.458

From firewalls-owner  Sat Jan  3 17:14:31 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id RAA26380; Sat, 3 Jan 1998 17:03:11 -0800 (PST)
Received: from alpha2000.tech-comm.com ([209.149.125.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id RAA26373 for <firewalls@GreatCircle.COM>; Sat, 3 Jan 1998 17:03:07 -0800 (PST)
Received: by alpha2000.tech-comm.com; (8.8.5/1.1.8.2/05Jun95-1217PM)
	id SAA23375; Sat, 3 Jan 1998 18:56:58 -0600 (CST)
Date: Sat, 3 Jan 1998 18:56:58 -0600 (CST)
From: Dick Brooks <dick@tech-comm.com>
Message-Id: <199801040056.SAA23375@alpha2000.tech-comm.com>
To: evyncke@cisco.com, firewalls@GreatCircle.COM, rfarnswo@cisco.com
Subject: Re: TACACS+ Authentication
Cc: dick@8760.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Thanks.

From firewalls-owner  Sat Jan  3 20:14:51 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id UAA09006; Sat, 3 Jan 1998 20:00:23 -0800 (PST)
Received: from peyote.coast.net (peyote.coast.net [206.84.176.169]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id UAA08979; Sat, 3 Jan 1998 20:00:14 -0800 (PST)
Received: from peyote.coast.net (kimminau@peyote.coast.net [206.84.176.169])
	by peyote.coast.net (8.8.7/8.8.7) with SMTP id WAA27686;
	Sat, 3 Jan 1998 22:59:38 -0500
Date: Sat, 3 Jan 1998 22:59:38 -0500 (EST)
From: Eric Kimminau <kimminau@mail.coast.net>
To: Firewalls@GreatCircle.COM
cc: firewalls-digest@GreatCircle.COM, V.Vergotis@asyk.ase.gr
Subject: Re: Firewalls-Digest V7 #3
In-Reply-To: <199801030901.BAA21198@honor.greatcircle.com>
Message-ID: <Pine.LNX.3.96.980103224805.27553A-100000@peyote.coast.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Sat, 3 Jan 1998, Firewalls-Digest wrote:
> Date: Fri, 2 Jan 1998 13:35:57 +0200
> From: Vasilis Vergotis <V.Vergotis@asyk.ase.gr>
> Subject: DNS and Mail setup via firewall
> 
> Hello to everybody and happy new year!

Happy New Year!
 
> The external mail server receives the mail for the zone company.gr  and
> it forwards it to the internal mail server via SMTP. The external DNS
> server knows nothing about the internal.
> 
> Internally the DNS server is knows only the zone internal.company.gr for

this is a problem unless you have DNS set up correctly with MV records for
company.gr which forwards to the external mail server which would then
forward to user@internal.company.gr. A much simpler solution would be to
MX mail.company.gr to mail.internal.company.gr on the internal DNS
server.

> whitch he is primary and for the things he does not know he asks the
> external DNS server. The internal mail server receives the mail for the
> zone internal.company.gr as well as the mail for the zone company.gr
> that the external mail server forwards.

so as far as everyone inside the company is concerned, the internal mail
server IS company.gr. You should also be looking in the sendmail book
concerning CW records.

Hope that helps.
                                Eric.
=============================================================================
"I am the downhill tumble and roll champ, king of the toad finders, captain
of the high altitude tree branch vista club, second place finisher in the
round the yard backward dash, premier burper state division, sodbuster and
worm scout first order, and generalissimo of the mud and mayhem society."
                                                               Calvin, 1995  
Eric Kimminau                                            kimminau@coast.net  


From firewalls-owner  Sun Jan  4 01:59:29 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id BAA03873; Sun, 4 Jan 1998 01:51:18 -0800 (PST)
Received: from xanadu.io.com (xanadu.io.com [199.170.88.6]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id BAA03779 for <Firewalls@GreatCircle.COM>; Sun, 4 Jan 1998 01:50:59 -0800 (PST)
Received: from localhost (cooper@localhost)
	by xanadu.io.com (8.8.5/8.8.5) with SMTP id DAA18322;
	Sun, 4 Jan 1998 03:50:46 -0600 (CST)
X-Authentication-Warning: xanadu.io.com: cooper owned process doing -bs
Date: Sun, 4 Jan 1998 03:50:46 -0600 (CST)
From: William Cooper <cooper@io.com>
To: Takacs Istvan <anonymus@mail.matav.hu>
cc: Firewalls@GreatCircle.COM
Subject: Re: Any document about cracker's technic?
In-Reply-To: <01bd1879$3656a780$LocalHost@default>
Message-ID: <Pine.BSI.3.96.980104031519.21128A-100000@xanadu.io.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

www.rootshell.com is a good place for exploits used to break/break into
systems.  for a million others just do a web search!

- bill



On Sat, 3 Jan 1998, Takacs Istvan wrote:

> Hi,
> 
> Could you offer me some good links, books, videos
> or any kind of documents about the crackers technics?
> 
> You always talk about the IDS, and how they work.
> But I'd like to know what I have to look for in my company's
> network.
> We just started to use the commercial side of Internet and for this
> reason I think we have to prepare to the crackers attacks.
> 
> I don't ask for exact description, just for how they try to
> break into the internal network.
> 
> Thank you!
> 
> Regards.
> 
>                             Istvan Takacs
>                mailto:anonymus@mail.matav.hu
> 
> p.s.: Please, write to my own address, too. Thanks.
> 

- bill

cooper@io.com


From firewalls-owner  Sun Jan  4 08:00:29 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA19625; Sun, 4 Jan 1998 07:47:26 -0800 (PST)
Received: from mail.matav.hu (castor.matav.net [145.236.224.250]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id HAA19618 for <firewalls@greatcircle.com>; Sun, 4 Jan 1998 07:47:20 -0800 (PST)
Received: (qmail 11569 invoked from network); 4 Jan 1998 16:47:18 +0100
Received: from line-208-102.dial.matav.net (HELO default) (145.236.208.102)
  by mail.matav.hu with SMTP; 4 Jan 1998 16:47:18 +0100
Reply-To: "Takacs Istvan" <anonymus@mail.matav.hu>
From: "Takacs Istvan" <anonymus@mail.matav.hu>
To: <firewalls@greatcircle.com>
Subject: Re: Any documents about crackers techniks?
Date: Sun, 4 Jan 1998 16:37:39 +0100
Message-ID: <01bd1926$b052a5e0$LocalHost@default>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-2"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 4.71.1712.3
X-MimeOLE: Produced By Microsoft MimeOLE V4.71.1712.3
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

I'd like to thanks for everyone, who sent me an answer for the topic
above!

Thank you very much!

Regards.

                         Istvan Takacs 
          mailto:anonymus@mail.matav.hu


From firewalls-owner  Sun Jan  4 08:44:37 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA24197; Sun, 4 Jan 1998 08:36:42 -0800 (PST)
Received: from www.allensysgroup.com ([205.245.8.5]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id IAA24190 for <firewalls@greatcircle.com>; Sun, 4 Jan 1998 08:36:38 -0800 (PST)
Received: from bobby ([166.55.57.197]) by www.allensysgroup.com
          (Post.Office MTA v3.1 release PO205e ID# 0-40603U300L100S0)
          with ESMTP id AAA131; Sun, 4 Jan 1998 11:35:03 -0500
From: bbrown@allensysgroup.com (Bobby Brown)
To: "Takacs Istvan" <anonymus@mail.matav.hu>, <firewalls@greatcircle.com>
Subject: Re: Any documents about crackers techniks?
Date: Sun, 4 Jan 1998 11:41:26 -0500
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1155
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-2
Content-Transfer-Encoding: 7bit
Message-ID: <19980104163502140.AAA131@bobby>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

With your thanks, how about a summary of your responses
that should always be sent back to the list.

Bobby


----------
> From: Takacs Istvan <anonymus@mail.matav.hu>
> To: firewalls@greatcircle.com
> Subject: Re: Any documents about crackers techniks?
> Date: Sunday, January 04, 1998 10:37 AM
> 
> Hi,
> 
> I'd like to thanks for everyone, who sent me an answer for the topic
> above!
> 
> Thank you very much!
> 
> Regards.
> 
>                          Istvan Takacs 
>           mailto:anonymus@mail.matav.hu

From firewalls-owner  Sun Jan  4 08:59:30 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA23883; Sun, 4 Jan 1998 08:29:25 -0800 (PST)
Received: from mtigwc04.worldnet.att.net (mtigwc04.worldnet.att.net [204.127.131.33]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id IAA23869 for <firewalls@GreatCircle.COM>; Sun, 4 Jan 1998 08:29:20 -0800 (PST)
From: mht@clark.net
Received: from highlander ([12.68.178.232]) by mtigwc04.worldnet.att.net
          (post.office MTA v2.0 0613 ) with SMTP id AAA15543
          for <firewalls@GreatCircle.COM>; Sun, 4 Jan 1998 16:29:11 +0000
Message-Id: <3.0.3.32.19980104112649.00a21cd0@pop3.clark.net>
X-Sender: mht@pop3.clark.net
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Sun, 04 Jan 1998 11:26:49 -0500
To: firewalls@GreatCircle.COM
Subject: Has anyone compared SessionWall 3 release 2 to Network Flight
  Recorder??
In-Reply-To: <01bd1926$b052a5e0$LocalHost@default>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

Just wondering if anyone out there has compared SessionWall 3 Release 
2 versus Network Flight Recorder or similiar products??

/mht
-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNK+4SJazO9ALfO1FEQJ50gCeIhEsOQPhkBQgNuXFutjsNyVbYjoAn353
xJe2oM35qExWltqP/CVKhIGE
=PqpV
-----END PGP SIGNATURE-----

------------------------------------------------------
"GREETINGS PROFESSOR FALKEN."
	"SHALL WE PLAY A GAME??"
------------------------------------------------------


From firewalls-owner  Sun Jan  4 09:59:41 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA05724; Sun, 4 Jan 1998 09:50:06 -0800 (PST)
Received: from smtp1.mailsrvcs.net (smtp1.gte.net [207.115.153.30]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA05712 for <firewalls@GreatCircle.COM>; Sun, 4 Jan 1998 09:50:00 -0800 (PST)
Received: from earnhart ([199.180.4.35])
	by smtp1.mailsrvcs.net  with SMTP id LAA22421;
	Sun, 4 Jan 1998 11:49:11 -0600 (CST)
Message-ID: <007e01bc8b5a$b40e12f0$2304b4c7@earnhart.gte.net>
From: "Gregg Earnhart" <ge@gte.net>
To: <mht@clark.net>, <firewalls@GreatCircle.COM>
Subject: Re: Has anyone compared SessionWall 3 release 2 to Network Flight Recorder??
Date: Mon, 7 Jul 1997 23:52:13 -0500
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 4.72.2106.4
X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I have had SessionWall since the first Beta.  I have had RealSecure prior to
SessionWall.  I hate RealSecure!  I played with NFR for a week or two and
being a GUI guy, I went back to SessionWall.  A whole new look in
SessionWall is coming out next week!!!  Many of the request that I had from
Abirnet have been added in (unusual for a company to actually add features
that are requested ---ISS).  I hope to deploy SessionWall after the first of
the year.

Gregg Earnhart
GTE

---------------------------
The views expressed are simply my own and no one else.
---------------------------
-----Original Message-----
From: mht@clark.net <mht@clark.net>
To: firewalls@GreatCircle.COM <firewalls@GreatCircle.COM>
Date: Sunday, January 04, 1998 12:14 PM
Subject: Has anyone compared SessionWall 3 release 2 to Network Flight
Recorder??


>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>Hello,
>
>Just wondering if anyone out there has compared SessionWall 3 Release
>2 versus Network Flight Recorder or similiar products??
>
>/mht
>-----BEGIN PGP SIGNATURE-----
>Version: PGP for Personal Privacy 5.0
>Charset: noconv
>
>iQA/AwUBNK+4SJazO9ALfO1FEQJ50gCeIhEsOQPhkBQgNuXFutjsNyVbYjoAn353
>xJe2oM35qExWltqP/CVKhIGE
>=PqpV
>-----END PGP SIGNATURE-----
>
>------------------------------------------------------
>"GREETINGS PROFESSOR FALKEN."
> "SHALL WE PLAY A GAME??"
>------------------------------------------------------
>


From firewalls-owner  Sun Jan  4 10:44:27 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id KAA08586; Sun, 4 Jan 1998 10:38:10 -0800 (PST)
Received: from mtigwc04.worldnet.att.net (mtigwc04.worldnet.att.net [204.127.131.33]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id KAA08551 for <firewalls@GreatCircle.COM>; Sun, 4 Jan 1998 10:38:01 -0800 (PST)
From: mht@clark.net
Received: from highlander ([12.68.178.232]) by mtigwc04.worldnet.att.net
          (post.office MTA v2.0 0613 ) with SMTP id AAA26242;
          Sun, 4 Jan 1998 18:37:51 +0000
Message-Id: <3.0.3.32.19980104133527.00a38d40@pop3.clark.net>
X-Sender: mht@pop3.clark.net
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Sun, 04 Jan 1998 13:35:27 -0500
To: "Gregg Earnhart" <ge@gte.net>, <firewalls@GreatCircle.COM>
Subject: Re: SessionWall 3 release 2 vs Network Flight Recorder??
In-Reply-To: <007e01bc8b5a$b40e12f0$2304b4c7@earnhart.gte.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Gregg,

<comments within>

At 11:52 PM 7/7/97 -0500, Gregg Earnhart wrote:
>I have had SessionWall since the first Beta.  I have had RealSecure 
prior to
>SessionWall. 

I just received Session Wall Release 2, and I saw some significant 
changes but not enough changes to allow myself to use a product that 
ships with no real documentation.. :(  I still have a problem with 
their license agreement which cannot be printed out from their 
installation script.

 I hate RealSecure! 

Yes, I tend to agree with you on that.  RealSecure is a very powerful 
tool, but it requires a clear understanding in what options you 
choose in a particular environment when using it..

 I played with NFR for a week or two and
>being a GUI guy, I went back to SessionWall.  A whole new look in
>SessionWall is coming out next week!!!

Overall, I wish one of the local trades magazines would initiate a 
Consumer Report comparison of the current IDS tools  or "clue-
gathering tools" available and new ones that are emerging...  (HINT, 
HINT)


/mht
  Many of the request that I had from
>Abirnet have been added in (unusual for a company to actually add 
features
>that are requested ---ISS).  I hope to deploy SessionWall after the 
first of
>the year.
>
>Gregg Earnhart
>GTE
>
>---------------------------
>The views expressed are simply my own and no one else.
>---------------------------
>-----Original Message-----
>From: mht@clark.net <mht@clark.net>
>To: firewalls@GreatCircle.COM <firewalls@GreatCircle.COM>
>Date: Sunday, January 04, 1998 12:14 PM
>Subject: Has anyone compared SessionWall 3 release 2 to Network 
Flight
>Recorder??
>
>
>>-----BEGIN PGP SIGNED MESSAGE-----
>>Hash: SHA1
>>
>>Hello,
>>
>>Just wondering if anyone out there has compared SessionWall 3 
Release
>>2 versus Network Flight Recorder or similiar products??
>>
>>/mht
>>-----BEGIN PGP SIGNATURE-----
>>Version: PGP for Personal Privacy 5.0
>>Charset: noconv
>>
>>iQA/AwUBNK+4SJazO9ALfO1FEQJ50gCeIhEsOQPhkBQgNuXFutjsNyVbYjoAn353
>>xJe2oM35qExWltqP/CVKhIGE
>>=PqpV
>>-----END PGP SIGNATURE-----
>>
>>------------------------------------------------------
>>"GREETINGS PROFESSOR FALKEN."
>> "SHALL WE PLAY A GAME??"
>>------------------------------------------------------
>>
>
>
-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNK/WbZazO9ALfO1FEQLqngCdG29jn+TChYlWGqv+bpWHooWJgnAAoLlW
9Nsz8YbouSuIxIepwiGNyU/F
=WvLa
-----END PGP SIGNATURE-----


From firewalls-owner  Sun Jan  4 12:14:43 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA18814; Sun, 4 Jan 1998 12:04:48 -0800 (PST)
Received: from jurua.dcc.fua.br (jurua.dcc.fua.br [200.17.49.14]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA18776 for <Firewalls@GreatCircle.COM>; Sun, 4 Jan 1998 12:04:35 -0800 (PST)
Received: from taruman.dcc.fua.br (taruman [200.17.49.19])
          by jurua.dcc.fua.br (8.8.5/8.8.4) with ESMTP
	  id UAA17064 for <Firewalls@GreatCircle.COM>; Sun, 4 Jan 1998 20:04:00 GMT
Received: (from ebm@localhost)
          by taruman.dcc.fua.br (8.8.5/8.8.4)
	  id OAA17268 for Firewalls@GreatCircle.COM; Sun, 4 Jan 1998 14:59:15 -0400
Date: Sun, 4 Jan 1998 14:59:15 -0400
From: Edierley Batista Messias <ebm@dcc.fua.br>
Message-Id: <199801041859.OAA17268@taruman.dcc.fua.br>
To: Firewalls@GreatCircle.COM
Subject: Service in Port 1049
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Content-MD5: 8tn+H3r7opkBssNMBwe62A==
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi everbody.

Some body know, some service that run in port 1049?

Thanks.

Edierley Messias
ebm@dcc.fua.br

From firewalls-owner  Sun Jan  4 13:29:28 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id NAA25886; Sun, 4 Jan 1998 13:22:22 -0800 (PST)
Received: from alpha2000.tech-comm.com ([209.149.125.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id NAA25869 for <firewalls@greatcircle.com>; Sun, 4 Jan 1998 13:22:14 -0800 (PST)
Received: by alpha2000.tech-comm.com; (8.8.5/1.1.8.2/05Jun95-1217PM)
	id PAA24851; Sun, 4 Jan 1998 15:16:02 -0600 (CST)
Date: Sun, 4 Jan 1998 15:16:02 -0600 (CST)
From: Dick Brooks <dick@tech-comm.com>
Message-Id: <199801042116.PAA24851@alpha2000.tech-comm.com>
To: anonymus@mail.matav.hu, bbrown@allensysgroup.com,
        firewalls@greatcircle.com
Subject: Re: Any documents about crackers techniks?
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Bobby writes:

>With your thanks, how about a summary of your responses
>that should always be sent back to the list.

>Bobby

Good point. The solution required two things:

Use the FQDN ftp-eng.cisco.com to access the host, the original post only 
contained ftp-eng. 

Remove the + from tacacs+ (i.e. tacacs).

Dick Brooks

From firewalls-owner  Sun Jan  4 13:44:39 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id NAA26389; Sun, 4 Jan 1998 13:31:24 -0800 (PST)
Received: from imo18.mx.aol.com (imo18.mx.aol.com [198.81.19.175]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id NAA26380 for <firewalls@GreatCircle.COM>; Sun, 4 Jan 1998 13:31:15 -0800 (PST)
From: Kf4aejmatt <Kf4aejmatt@aol.com>
Message-ID: <be6a3a40.34affca1@aol.com>
Date: Sun, 4 Jan 1998 16:18:22 EST
To: firewalls@GreatCircle.COM
Subject: scientific atlanta 8590,8600
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7bit
Organization: AOL (http://www.aol.com)
X-Mailer: Inet_Mail_Out (IMOv11)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

i have a 8590 and a 8600 and i like to find the by-pass chip for one of them
please call me or e-mail me back
or send the information to
Matt Arnold 
50 lee rd 225
smiths,al 36877
334-298-2939

From firewalls-owner  Sun Jan  4 15:14:28 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA06196; Sun, 4 Jan 1998 15:11:02 -0800 (PST)
Received: from mail-syd.atinet.com.au (atinet.com.au [203.35.110.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id PAA06139 for <Firewalls@GreatCircle.COM>; Sun, 4 Jan 1998 15:10:37 -0800 (PST)
Received: from ppp-101.atinet.com.au (ppp-101.atinet.com.au [203.35.110.101]) by mail-syd.atinet.com.au (NTMail 3.02.13) with ESMTP id va025267 for <Firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 10:09:50 +1100
Received: from beethoven (beethoven.winspace.net [192.168.0.2]) by mozart.winspace.net (8.8.8/8.7.3) with SMTP id KAA06431; Mon, 5 Jan 1998 10:10:30 +1100
X-Fubar: winspace@atinet.com.au
From: "Norman Widders" <winspace@atinet.com.au>
Date: Mon, 5 Jan 1998 10:10:52 +1000 (GMT)
Subject: Hardware for seperating LAN from dialouts
To: <Firewalls@GreatCircle.COM>
Reply-To: <winspace@atinet.com.au>
Organization: Paladin Corporation
Message-Id: <Paladin.2.33.883955452-105157383731395.beethoven>
X-Mailer: Paladin IMAP4 Client v2.33
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Content-Transfer-Encoding: 7BIT
Content-ID: <Paladin.2.33.beethoven.883955452.1>
X-Info: All Things Internet POP3 Server
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Just wondered if anybody has used those hardware devices
that disable LAN connections while a modem dials out
to the Internet.

It detects when the modem is active thus severing the
link to the LAN physically and reconnects the LAN
once the modem has disconnected from the LAN. 

The device is connected to both the modem and LAN and
sounds good in theory and I am just wondering
what other peoples experience with these are, at $85
it is an ideal solution for small organisations
that just want to poll their ISP a few times a day
for email.

--
Wheres my valium ?



From firewalls-owner  Sun Jan  4 17:44:28 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id RAA20776; Sun, 4 Jan 1998 17:34:43 -0800 (PST)
Received: from sophia.pacific.net.sg (sophia.pacific.net.sg [203.120.90.81]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id RAA20769 for <FIREWALLS@GreatCircle.COM>; Sun, 4 Jan 1998 17:34:38 -0800 (PST)
Received: from pop1.pacific.net.sg (pop1.pacific.net.sg [203.120.90.85])
	by sophia.pacific.net.sg with ESMTP
	id JAA25767 for <FIREWALLS@GreatCircle.COM>; Mon, 5 Jan 1998 09:35:13 +0800 (SGT)
Received: from benmgmt.sin-co.sg.dhl.com ([199.40.38.112])
        by pop1.pacific.net.sg with ESMTP
        id JAA05408 for <FIREWALLS@GreatCircle.COM>; Mon, 5 Jan 1998 09:34:37 +0800 (SGT)
Message-ID: <34B03918.DB1755B5@sin-co.sg.dhl.com>
Date: Mon, 05 Jan 1998 09:36:24 +0800
From: Hardi Ismail - Human Resources <hardi@sin-co.sg.dhl.com>
Reply-To: hardi@sin-co.sg.dhl.com
Organization: DHL International - Singapore Country Office
X-Mailer: Mozilla 4.01 [en] (Win95; I)
MIME-Version: 1.0
To: FIREWALLS@GreatCircle.COM
Subject: (no subject)
X-Priority: 3 (Normal)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

USUBSCRIBE FIREWALLS


From firewalls-owner  Sun Jan  4 23:15:05 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id XAA12545; Sun, 4 Jan 1998 23:01:45 -0800 (PST)
Received: from wizard.abirnet.co.il (wizard.abirnet.co.il [194.90.211.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id XAA12536 for <Firewalls@GreatCircle.COM>; Sun, 4 Jan 1998 23:01:38 -0800 (PST)
Received: from hagit1.abirnet.co.il (hagit1.abirnet.co.il [194.90.211.84])
	by wizard.abirnet.co.il (8.8.5/8.8.5) with SMTP id JAA18255;
	Mon, 5 Jan 1998 09:00:39 +0200
From: "Hagit" <hagit@abirnet.com>
To: "Edierley Batista Messias" <ebm@dcc.fua.br>, <Firewalls@GreatCircle.COM>
Subject: Re: Service in Port 1049
Date: Mon, 5 Jan 1998 09:06:05 +0200
Message-ID: <01bd19a8$63b2bc20$54d35ac2@hagit1.abirnet.co.il>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 4.71.1712.3
X-MimeOLE: Produced By Microsoft MimeOLE V4.71.1712.3
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

No UDP or TCP service on port 1049 is listed in the IANA list.
See ftp://ftp.isi.edu/in-notes/iana/assignments/port-numbers

Hagit 
 --------------------------------------------------------------------------
   AbirNet provides the next generation in Internet and Intranet Protection
   Get an EVALUATION COPY at <http://www.AbirNet.com> 
---------------------------------------------------------------------------
        

-----Original Message-----
From: Edierley Batista Messias <ebm@dcc.fua.br>
To: Firewalls@GreatCircle.COM <Firewalls@GreatCircle.COM>
Date: Sunday, January 04, 1998 10:45 PM
Subject: Service in Port 1049


>Hi everbody.
>
>Some body know, some service that run in port 1049?
>
>Thanks.
>
>Edierley Messias
>ebm@dcc.fua.br


From firewalls-owner  Mon Jan  5 00:29:38 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id AAA19237; Mon, 5 Jan 1998 00:15:22 -0800 (PST)
Received: from mail-syd.atinet.com.au (atinet.com.au [203.35.110.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id AAA19216 for <Firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 00:15:04 -0800 (PST)
Received: from ppp-122.atinet.com.au (ppp-122.atinet.com.au [203.35.110.122]) by mail-syd.atinet.com.au (NTMail 3.02.13) with ESMTP id sa025368 for <Firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 19:14:30 +1100
Received: from beethoven (beethoven.winspace.net [192.168.0.2]) by mozart.winspace.net (8.8.8/8.7.3) with SMTP id TAA07973; Mon, 5 Jan 1998 19:14:59 +1100
From: "Norman Widders" <winspace@atinet.com.au>
Date: Mon, 5 Jan 1998 18:40:26 +1000 (GMT)
Subject: rootshell has a mailing list
To: <Firewalls@GreatCircle.COM>
Reply-To: <winspace@atinet.com.au>
Organization: Paladin Corporation
Message-Id: <Paladin.2.33.883986026-959915837345291.beethoven>
X-Mailer: Paladin IMAP4 Client v2.33
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Content-Transfer-Encoding: 7BIT
Content-ID: <Paladin.2.33.beethoven.883986026.1>
X-Info: All Things Internet POP3 Server
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

folks,

www.rootshell.com has a mailing list, well worth subscribing imho
just to keep abreast of current exploits, useful if you like to see
what it is that they are using on us... just started on 1/2/1998, ymmv

--
wheres my valium ?


From firewalls-owner  Mon Jan  5 00:44:37 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id AAA19449; Mon, 5 Jan 1998 00:23:59 -0800 (PST)
Received: from guvnor.blackwell.co.uk (guvnor.blackwell.co.uk [194.130.176.129]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id AAA19442 for <firewalls@greatcircle.com>; Mon, 5 Jan 1998 00:23:53 -0800 (PST)
Received: from exchange1.blackwell.co.uk by guvnor.blackwell.co.uk (MX V4.2
          VAX) with SMTP; Mon, 05 Jan 1998 08:24:52 BST
Received: by EXCHANGE1 with Internet Mail Service (5.0.1458.49) id <ZCX5F3WC>;
          Mon, 5 Jan 1998 08:27:09 -0000
Message-ID: <3BFE2589D330D111AE87006008062DE40DB551@pc37.blackwell.co.uk>
From: Martin Hepworth <martin.hepworth@blackwell.co.uk>
To: "'Simon J. Gerraty'" <sjg@quick.com.au>,
        Pauline van Winsen - Uniq
    Professional Services <Pauline.van.Winsen@uniq.com.au>
CC: firewalls@greatcircle.com
Subject: RE: off topic: ssl setup on web server - now browser crypto stren gth
Date: Mon, 5 Jan 1998 08:24:59 -0000
X-Priority: 3
X-Mailer: Internet Mail Service (5.0.1458.49)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


> -----Original Message-----
> From:	Simon J. Gerraty [SMTP:sjg@quick.com.au]
> Sent:	Thursday, January 01, 1998 1:50 AM
> To:	Pauline van Winsen - Uniq Professional Services
> Cc:	firewalls@greatcircle.com
> Subject:	Re: off topic: ssl setup on web server - now browser
> crypto strength
> 
> Pauline van Winsen writes:
> >> Of course folk outside the U.S. are stuffed anyway, until a decent
> >> non-U.S. based browser (not limited to 40bit RC4) comes along.
> >> I don't think there is any interest in any govt anywhere to see
> this issue
> >> solved to the satisfaction of net users though.
> 
> >has anyone checked out fortify?
> 
> >http://www.geocities.com/Eureka/Plaza/6333/
> 
> Yes I had a lok at it and it works very well.  I had no trouble
> setting up
> 128bit sessions to an apache server.  Problem is that whether the
> author
> wrote this thing outside the U.S. or not, he chose a U.S. based site?
> as
> home for it :-)  so we are back to all the shadows of ITAR.
> 
	[Martin Hepworth]  In that case check out:
	ftp.ox.ac.uk/pub/crypto/SSL

	The actual software is based in three locations - two in the UK,
one in OZ, so although the 'advert' is in the US the actual
download-ables are outside the US........sounds like a gray area in ITAR
to me ?-)  

From firewalls-owner  Mon Jan  5 01:31:10 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id BAA28541; Mon, 5 Jan 1998 01:17:11 -0800 (PST)
Received: from mail.matav.hu (castor.matav.net [145.236.224.250]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id BAA27885 for <firewalls@greatcircle.com>; Mon, 5 Jan 1998 01:15:36 -0800 (PST)
Received: (qmail 16289 invoked from network); 5 Jan 1998 10:15:40 +0100
Received: from line-210-27.dial.matav.net (HELO default) (145.236.210.27)
  by mail.matav.hu with SMTP; 5 Jan 1998 10:15:40 +0100
Reply-To: "Takacs Istvan" <anonymus@mail.matav.hu>
From: "Takacs Istvan" <anonymus@mail.matav.hu>
To: <firewalls@greatcircle.com>
Subject: Answers for cackers techniks
Date: Mon, 5 Jan 1998 10:15:24 +0100
Message-ID: <01bd19ba$74986dc0$LocalHost@default>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-2"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 4.71.1712.3
X-MimeOLE: Produced By Microsoft MimeOLE V4.71.1712.3
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

Here are the received answers.

==================================================================
> Visit the l0pht group www.l0pht.com.. for some information
==================================================================
> www.rootshell.com is a good place for exploits used to break/break into
> systems.  for a million others just do a web search!
==================================================================
> There are many ways hackers can get access to your network, and there are
new
> ways invented everyday.
> Now, you don't need to know about ALL the ways out there, you need to
focus only
> of those vulnerabilities of the devices that are connected on your
network,
> meaning  servers, routers, workstation etc.

> A good start in protecting your network will be to install all the latest
> service packs, hot fixes and patches, and keep looking if new ones come
by. This
> is usually a free service.
> You are already subscribed to the firewalls mailing list where new
intrusion
> signatures are discussed, so you will get posted.
> An Intrusion detection system is highly recommended especially for someone
who
> just started Internet connection. These systems will monitor the traffic
going
> on your LAN, you can track WWW sites users are viewing and of course get
real
> time alerts when someone is doing malicious activity on the net.
> After getting to know your net traffic, your next step should be firewall
which
> you should configure according to all the data you collected using the
> monitoring and IDS.
=================================================================
> Try "Maximum Security: A Hacker's Guide to Protecting Your Internet Site
> and network". Published by Macmillan Computer Publishing, authored by
> Anonymous. I don't know the ISBN, but you can find it here:
> http://www.amazon.com
> and searching their catalog. The book came out sometime last year.
> (August, 1997, I believe). It is a very comprehensive coverage of cracking
> techniques.
=================================================================
> Try  http://www.unitedcouncil.org/hackt.html I think you will be
> impressed with the amount of info we have.
=================================================================
> I do a weekly newsletter on network security, that includes hacker info.
> Let me know if you would like to see a copy.
email   alan@livingston.com
=================================================================


Regards

                         Istvan Takacs
         mailto:anonymus@mail.matav.hu


From firewalls-owner  Mon Jan  5 04:44:44 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id EAA17920; Mon, 5 Jan 1998 04:32:03 -0800 (PST)
Received: from mailout02.btx.dtag.de (mailout02.btx.dtag.de [194.25.2.150]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id EAA17913 for <firewalls@greatcircle.com>; Mon, 5 Jan 1998 04:31:57 -0800 (PST)
Received: from (fwd11.btx.dtag.de) [194.25.2.171] 
	by mailout02.btx.dtag.de with smtp 
	id 0xpBhJ-0005cR-00; Mon, 5 Jan 1998 13:32:01 +0100
Received:  (0407352555-0001(btxid)@[193.159.17.104]) 
	by fwd11.btx.dtag.de with (S3.1.29.1) 
	id <m0xpBh7-0003eIC>; Mon, 5 Jan 1998 13:31:49 +0100
Message-Id: <m0xpBh7-0003eIC@fwd11.btx.dtag.de>
Date: Mon, 5 Jan 1998 13:31:49 +0100
To: firewalls@greatcircle.com
Subject: Comparision of Firewall Products
X-Mailer: T-Online eMail 2.0
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8BIT
X-Sender: 0407352555-0001@t-online.de
From: MarkusLindingerHamburg@t-online.de (Lindinger)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

We are about to implement a firewall system for about 500 users.
I checked the papers from Borderware, FW-1, Raptor´s Eagle Firewall,
TIS/Gauntlet and Sidewinder (I suppose, I should contact Cisco too?).

After that, I have a rude survey about their features, but not about 
their proof and abilities in practise. 

Who can give some pros and cons, to get a better background?

Thanks
Markus


From firewalls-owner  Mon Jan  5 05:45:06 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id FAA24279; Mon, 5 Jan 1998 05:22:27 -0800 (PST)
Received: from mtigwc04.worldnet.att.net (mtigwc04.worldnet.att.net [204.127.131.33]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id FAA24249 for <firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 05:22:18 -0800 (PST)
From: mht@clark.net
Received: from highlander ([12.68.178.197]) by mtigwc04.worldnet.att.net
          (post.office MTA v2.0 0613 ) with SMTP id AAA16124;
          Mon, 5 Jan 1998 13:22:03 +0000
Message-Id: <3.0.3.32.19980105081940.00808730@pop3.clark.net>
X-Sender: mht@pop3.clark.net
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Mon, 05 Jan 1998 08:19:40 -0500
To: MarkusLindingerHamburg@t-online.de (Lindinger), firewalls@GreatCircle.COM
Subject: Re: Comparision of Firewall Products
In-Reply-To: <m0xpBh7-0003eIC@fwd11.btx.dtag.de>
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Markus,

I think LAN TIMES did a comparison report a while back. Check out=20
www.lantimes.com

Your security policy, network architecture, business model, needs and=20
technical resources, etc should also factor into your equation while=20
evaluating the different firewall systems.

A firewall is just one component of many when installing a firewall=20
system for your particular organization.=20


/mht

At 01:31 PM 1/5/98 +0100, Lindinger wrote:
>We are about to implement a firewall system for about 500 users.
>I checked the papers from Borderware, FW-1, Raptor=B4s Eagle Firewall,
>TIS/Gauntlet and Sidewinder (I suppose, I should contact Cisco=20
too?).
>
>After that, I have a rude survey about their features, but not about=20

>their proof and abilities in practise.=20
>
>Who can give some pros and cons, to get a better background?
>
>Thanks
>Markus
>
>
-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNLDd65azO9ALfO1FEQJLFgCfWxzyhiIvGzbRWNYFdHDDPk/CtGkAn2ZB
e5TGzoXA/bjIggVJDuqN9QDl
=3Db4Dl
-----END PGP SIGNATURE-----


From firewalls-owner  Mon Jan  5 07:15:27 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA01167; Mon, 5 Jan 1998 07:06:43 -0800 (PST)
Received: from mail.sunbeach.net (mail.sunbeach.net [205.214.199.134]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id HAA01133 for <Firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 07:06:28 -0800 (PST)
Received: from mercury [205.214.195.1] by mail.sunbeach.net
  (SMTPD32-4.03) id AB9081B50122; Mon, 05 Jan 1998 10:17:52 +03d00
Message-Id: <3.0.3.32.19980105110522.007347a0@mail.sunbeach.net>
X-Sender: ian@mail.sunbeach.net
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Mon, 05 Jan 1998 11:05:22 -0400
To: <winspace@atinet.com.au>, <Firewalls@GreatCircle.COM>
From: Ian KC Worrell <ian@sunbeach.net>
Subject: Re: Hardware for seperating LAN from dialouts
In-Reply-To: <Paladin.2.33.883955452-105157383731395.beethoven>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I use my lap top in the office, and it has both a network card and a modem
in it.  As my office network is on a different IP address range that my
Internet Connection, I can actually have both connected at the same time!

There seems to be no problem with the routing at all!

Ian

At 10:10 AM 1/5/98 +1000, Norman Widders wrote:
>Just wondered if anybody has used those hardware devices
>that disable LAN connections while a modem dials out
>to the Internet.
>
>It detects when the modem is active thus severing the
>link to the LAN physically and reconnects the LAN
>once the modem has disconnected from the LAN. 
>
>The device is connected to both the modem and LAN and
>sounds good in theory and I am just wondering
>what other peoples experience with these are, at $85
>it is an ideal solution for small organisations
>that just want to poll their ISP a few times a day
>for email.
>
>--
>Wheres my valium ?
>
>
>
>


From firewalls-owner  Mon Jan  5 07:30:20 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA02308; Mon, 5 Jan 1998 07:25:59 -0800 (PST)
Received: from steed.jerboa.com (steed.jerboa.com [209.21.153.162]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id HAA02296 for <firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 07:25:50 -0800 (PST)
Received: by steed.jerboa.com; id KAA08326; Mon, 5 Jan 1998 10:27:03 -0500 (EST)
Received: from squirrel.jerboa.com(10.0.0.200) by steed.jerboa.com via smap (4.0a)
	id xma008324; Mon, 5 Jan 98 10:26:50 -0500
Received: from emma.jerboa.com (emma.jerboa.com [10.0.0.60]) by squirrel.jerboa.com (8.8.5/8.7.3) with SMTP id KAA19562; Mon, 5 Jan 1998 10:26:14 -0500 (EST)
Message-Id: <3.0.3.32.19980105102235.00af6230@squirrel>
X-Sender: ian@squirrel
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Mon, 05 Jan 1998 10:22:35 -0500
To: mht@clark.net, MarkusLindingerHamburg@t-online.de (Lindinger),
        firewalls@GreatCircle.COM
From: Ian Poynter <ian@jerboa.com>
Subject: Re: Comparision of Firewall Products
In-Reply-To: <3.0.3.32.19980105081940.00808730@pop3.clark.net>
References: <m0xpBh7-0003eIC@fwd11.btx.dtag.de>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

At 08:19 AM 1/5/98 -0500, mht@clark.net wrote:
>I think LAN TIMES did a comparison report a while back. Check out 
>www.lantimes.com

Be careful with this one, the test methodology didn't look at security at all 
(see http://www.lantimes.com/97/97aug/708a060c.html; they didn't test 
installation either).  I wasn't completely happy that the performance numbers 
were comparing apples with apples either.  Still, it's useful as a feature 
comparison, though.

>Your security policy, network architecture, business model, needs and 
>technical resources, etc should also factor into your equation while 
>evaluating the different firewall systems.
>
>A firewall is just one component of many when installing a firewall 
>system for your particular organization. 

Now this I agree with :-).

Ian


-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNLD6usj1wUcX1Ha3EQID8QCg2Q6gT0RaW4kQMP+WBWQ3bAH70GoAnj0S
hf30Ml+vAOoa4IGD/fiTstGN
=lXXh
-----END PGP SIGNATURE-----

-----
Ian Poynter                                        ian@jerboa.com
Jerboa, Inc.                                      +1-617-492-8084
PO Box 382648, Cambridge, MA 02238          http://www.jerboa.com
Providing unbiased Internet consulting for businesses.
Fingerprints RSA: BA 0C 82 C5 F2 03 3D 95  7C CE FD D3 57 4E 15 73
           DSS: 2769 277A 9F69 F605 3743  D574 C8F5 C147 17D4 76B7

From firewalls-owner  Mon Jan  5 07:44:49 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA03750; Mon, 5 Jan 1998 07:41:29 -0800 (PST)
Received: from granite.sentex.net (granite.sentex.ca [199.212.134.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id HAA03736 for <Firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 07:41:23 -0800 (PST)
Received: from eagle.woodbridge.com ([206.222.77.97] (may be forged)) by granite.sentex.net (8.8.6/8.6.9) with SMTP id KAA09273 for <Firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 10:40:47 -0500 (EST)
Received: from woodux.woodbridge.com by eagle.woodbridge.com
          via smtpd (for granite.sentex.ca [199.212.134.1]) with SMTP; 5 Jan 1998 15:37:10 UT
Received: from simonyi ([192.81.85.21]) by woodux with SMTP
	(1.39.111.2/16.2) id AA031504897; Mon, 5 Jan 1998 10:41:37 -0500
Received: by localhost with Microsoft MAPI; Mon, 5 Jan 1998 10:38:41 -0500
Message-Id: <01BD19C6.17027D20.msimonyi@woodbridge.com>
From: Michael Simonyi <msimonyi@woodbridge.com>
To: "Firewalls@GreatCircle.COM" <Firewalls@GreatCircle.COM>
Subject: named service
Date: Mon, 5 Jan 1998 10:38:40 -0500
X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

To all

We are running an HP 817 w/ HPUX 10.0, and every once and a while the named 
service hangs.  It's still a running process but does not do anything.
I have to kill it and restart it and then every things fine.

Any clues? Do I need as patch?  Is there any way I can monitor the process 
and to see it's in trouble rather than having our help line ring off the 
wall?

Mike


From firewalls-owner  Mon Jan  5 08:27:48 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA08376; Mon, 5 Jan 1998 08:13:28 -0800 (PST)
Received: from granite.sentex.net (granite.sentex.ca [199.212.134.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id IAA08115 for <Firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 08:12:35 -0800 (PST)
Received: from eagle.woodbridge.com ([206.222.77.97] (may be forged)) by granite.sentex.net (8.8.6/8.6.9) with SMTP id LAA14726 for <Firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 11:11:56 -0500 (EST)
Received: from woodux.woodbridge.com by eagle.woodbridge.com
          via smtpd (for granite.sentex.ca [199.212.134.1]) with SMTP; 5 Jan 1998 16:08:19 UT
Received: from simonyi ([192.81.85.21]) by woodux with SMTP
	(1.39.111.2/16.2) id AA037326766; Mon, 5 Jan 1998 11:12:46 -0500
Received: by localhost with Microsoft MAPI; Mon, 5 Jan 1998 11:09:50 -0500
Message-Id: <01BD19CA.711D0F60.msimonyi@woodbridge.com>
From: Michael Simonyi <msimonyi@woodbridge.com>
To: "Firewalls@GreatCircle.COM" <Firewalls@GreatCircle.COM>
Subject: Raptor 
Date: Mon, 5 Jan 1998 11:09:49 -0500
X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

To all:

We have an HP 712 w/ HPUX 10.01 running the Raptor FW.

Problem :

After every reboot, the system is fine.  Then after about a week or two the 
log file starts recording the following error messages:

    Eagle notifyd: 605 Can't execute /usr/bin/mailx (to many open files)
    Eagle notifyd: 606 failed to notify:transport=mail priority=Alert, 
(root,0)

We keep bumping up our number of open files, the problem goes away. Then it 
comes right back.  We have reconfigured the box several times and up'd the 
files open to allow more than our primary host.  We just can't clean this 
problem up.

Mike  


From firewalls-owner  Mon Jan  5 09:30:45 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA12250; Mon, 5 Jan 1998 08:38:08 -0800 (PST)
Received: from cheez.lowprofile.net (cheez.lowprofile.net [206.97.249.88]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id IAA12226 for <Firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 08:38:01 -0800 (PST)
Received: from cheez.lowprofile.net (cheez.lowprofile.net [206.97.249.88])
	by cheez.lowprofile.net (8.8.5/8.8.5) with SMTP id KAA24549;
	Mon, 5 Jan 1998 10:46:44 -0600
Date: Mon, 5 Jan 1998 10:46:44 -0600 (CST)
From: "Daniel \"Cheez\" Brown" <cheez@cheez.lowprofile.net>
To: Michael Simonyi <msimonyi@woodbridge.com>
cc: "Firewalls@GreatCircle.COM" <Firewalls@GreatCircle.COM>
Subject: Re: named service
In-Reply-To: <01BD19C6.17027D20.msimonyi@woodbridge.com>
Message-ID: <Pine.LNX.3.95.980105104456.24540A-100000@cheez.lowprofile.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Michael-
	Upgrade to HPUX 10.10 / 10.20 because there is a bug in HPUX 10.01
named. You can also patch it with one of the PHSS patches out by HP, but my
feeling is that 10.10 is much better than 10.01. Patching it will work as
well.

Good luck,

+----Daniel "Cheez" Brown------------Global Data Systems-------+
| http://cheez.lowprofile.net | Security Advisor, Global Reach |
|     cheez@lowprofile.net    |  Cisco Systems WAN Specialist  |
| UNIX/Linux/HP-UX specialist |  Remote Management Specialist  |
|      If at first you don't succeed, redefine success.        |
| Contrary to popular opinion, UNIX is user friendly. It just  |
+-happens to be very selective about who it makes friends with.+

On Mon, 5 Jan 1998, Michael Simonyi wrote:

> To all
> 
> We are running an HP 817 w/ HPUX 10.0, and every once and a while the named 
> service hangs.  It's still a running process but does not do anything.
> I have to kill it and restart it and then every things fine.
> 
> Any clues? Do I need as patch?  Is there any way I can monitor the process 
> and to see it's in trouble rather than having our help line ring off the 
> wall?
> 
> Mike
> 


From firewalls-owner  Mon Jan  5 10:15:56 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA24724; Mon, 5 Jan 1998 09:44:34 -0800 (PST)
Received: from tango.lightech.com.ar (tango.lightech.com.ar [200.0.253.134]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA22774 for <firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 09:36:13 -0800 (PST)
Received: from lightech.com.ar (router1-p04.pccp.com.ar [200.0.253.20])
	by tango.lightech.com.ar (8.8.7/8.8.7) with ESMTP id RAA21387;
	Mon, 5 Jan 1998 17:13:39 GMT
Message-ID: <34B1007E.9B1CE4A4@lightech.com.ar>
Date: Mon, 05 Jan 1998 12:47:11 -0300
From: Sergio Bollini <sbollini@lightech.com.ar>
Reply-To: sbollini@lightech.com.ar
Organization: LighTech
X-Mailer: Mozilla 4.04 [en] (Win95; I)
MIME-Version: 1.0
To: "firewalls@GreatCircle.COM" <firewalls@GreatCircle.COM>,
        "Mailing List, Firewall-1" <fw-1-mailinglist@us.checkpoint.com>
Subject: FW-1 3.0 and Solaris 2.6 ok?
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------msB846C7587AF8D45A2076687C"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

This is a cryptographically signed message in MIME format.

--------------msB846C7587AF8D45A2076687C
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Hello all!
Does anybody know is FW-1 3.0b will work correctly on Solaris 2.6? Is
there any issues or unsolved problems?
TIA

--
Sergio E. Bollini
LighTech                        Voice:  (54-1) 373-1141
Ayacucho 563. Piso 13 Dto "A"   FAX:    (54-1) 373-1215
(1026)  Buenos Aires            e-mail: sbollini@lightech.com.ar
Argentina                       URL:    http://www.lightech.com.ar


--------------msB846C7587AF8D45A2076687C
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIIQDwYJKoZIhvcNAQcCoIIQADCCD/wCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC
Dn0wggnDMIIJLKADAgECAhB4X82i1DyEFmZajMCjf7qtMA0GCSqGSIb3DQEBBAUAMGIxETAP
BgNVBAcTCEludGVybmV0MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE0MDIGA1UECxMrVmVy
aVNpZ24gQ2xhc3MgMSBDQSAtIEluZGl2aWR1YWwgU3Vic2NyaWJlcjAeFw05NzA0MTAwMDAw
MDBaFw05ODA0MTAyMzU5NTlaMIIBFDERMA8GA1UEBxMISW50ZXJuZXQxFzAVBgNVBAoTDlZl
cmlTaWduLCBJbmMuMTQwMgYDVQQLEytWZXJpU2lnbiBDbGFzcyAxIENBIC0gSW5kaXZpZHVh
bCBTdWJzY3JpYmVyMUYwRAYDVQQLEz13d3cudmVyaXNpZ24uY29tL3JlcG9zaXRvcnkvQ1BT
IEluY29ycC4gYnkgUmVmLixMSUFCLkxURChjKTk2MSYwJAYDVQQLEx1EaWdpdGFsIElEIENs
YXNzIDEgLSBOZXRzY2FwZTEXMBUGA1UEAxMOU2VyZ2lvIEJvbGxpbmkxJzAlBgkqhkiG9w0B
CQEWGHNib2xsaW5pQGxpZ2h0ZWNoLmNvbS5hcjBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCt
Iw69fHnhJqxaDdc0Rakxy2ceJTT00bQiu/mm42O7ILzd/zKGwsT4+uQcHsFUm6Bjhcthh2ND
7iI7eQqGcGi5AgMBAAGjggcIMIIHBDAJBgNVHRMEAjAAMIICHwYDVR0DBIICFjCCAhIwggIO
MIICCgYLYIZIAYb4RQEHAQEwggH5FoIBp1RoaXMgY2VydGlmaWNhdGUgaW5jb3Jwb3JhdGVz
IGJ5IHJlZmVyZW5jZSwgYW5kIGl0cyB1c2UgaXMgc3RyaWN0bHkgc3ViamVjdCB0bywgdGhl
IFZlcmlTaWduIENlcnRpZmljYXRpb24gUHJhY3RpY2UgU3RhdGVtZW50IChDUFMpLCBhdmFp
bGFibGUgYXQ6IGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9DUFM7IGJ5IEUtbWFpbCBhdCBD
UFMtcmVxdWVzdHNAdmVyaXNpZ24uY29tOyBvciBieSBtYWlsIGF0IFZlcmlTaWduLCBJbmMu
LCAyNTkzIENvYXN0IEF2ZS4sIE1vdW50YWluIFZpZXcsIENBIDk0MDQzIFVTQSBUZWwuICsx
ICg0MTUpIDk2MS04ODMwIENvcHlyaWdodCAoYykgMTk5NiBWZXJpU2lnbiwgSW5jLiAgQWxs
IFJpZ2h0cyBSZXNlcnZlZC4gQ0VSVEFJTiBXQVJSQU5USUVTIERJU0NMQUlNRUQgYW5kIExJ
QUJJTElUWSBMSU1JVEVELqAOBgxghkgBhvhFAQcBAQGhDgYMYIZIAYb4RQEHAQECMCwwKhYo
aHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JlcG9zaXRvcnkvQ1BTIDARBglghkgBhvhCAQEE
BAMCB4AwNgYJYIZIAYb4QgEIBCkWJ2h0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9yZXBvc2l0
b3J5L0NQUzCCBIcGCWCGSAGG+EIBDQSCBHgWggR0Q0FVVElPTjogVGhlIENvbW1vbiBOYW1l
IGluIHRoaXMgQ2xhc3MgMSBEaWdpdGFsIApJRCBpcyBub3QgYXV0aGVudGljYXRlZCBieSBW
ZXJpU2lnbi4gSXQgbWF5IGJlIHRoZQpob2xkZXIncyByZWFsIG5hbWUgb3IgYW4gYWxpYXMu
IFZlcmlTaWduIGRvZXMgYXV0aC0KZW50aWNhdGUgdGhlIGUtbWFpbCBhZGRyZXNzIG9mIHRo
ZSBob2xkZXIuCgpUaGlzIGNlcnRpZmljYXRlIGluY29ycG9yYXRlcyBieSByZWZlcmVuY2Us
IGFuZCAKaXRzIHVzZSBpcyBzdHJpY3RseSBzdWJqZWN0IHRvLCB0aGUgVmVyaVNpZ24gCkNl
cnRpZmljYXRpb24gUHJhY3RpY2UgU3RhdGVtZW50IChDUFMpLCBhdmFpbGFibGUKaW4gdGhl
IFZlcmlTaWduIHJlcG9zaXRvcnkgYXQ6IApodHRwczovL3d3dy52ZXJpc2lnbi5jb207IGJ5
IEUtbWFpbCBhdApDUFMtcmVxdWVzdHNAdmVyaXNpZ24uY29tOyBvciBieSBtYWlsIGF0IFZl
cmlTaWduLApJbmMuLCAyNTkzIENvYXN0IEF2ZS4sIE1vdW50YWluIFZpZXcsIENBIDk0MDQz
IFVTQQoKQ29weXJpZ2h0IChjKTE5OTYgVmVyaVNpZ24sIEluYy4gIEFsbCBSaWdodHMgClJl
c2VydmVkLiBDRVJUQUlOIFdBUlJBTlRJRVMgRElTQ0xBSU1FRCBBTkQgCkxJQUJJTElUWSBM
SU1JVEVELgoKV0FSTklORzogVEhFIFVTRSBPRiBUSElTIENFUlRJRklDQVRFIElTIFNUUklD
VExZClNVQkpFQ1QgVE8gVEhFIFZFUklTSUdOIENFUlRJRklDQVRJT04gUFJBQ1RJQ0UKU1RB
VEVNRU5ULiAgVEhFIElTU1VJTkcgQVVUSE9SSVRZIERJU0NMQUlNUyBDRVJUQUlOCklNUExJ
RUQgQU5EIEVYUFJFU1MgV0FSUkFOVElFUywgSU5DTFVESU5HIFdBUlJBTlRJRVMKT0YgTUVS
Q0hBTlRBQklMSVRZIE9SIEZJVE5FU1MgRk9SIEEgUEFSVElDVUxBUgpQVVJQT1NFLCBBTkQg
V0lMTCBOT1QgQkUgTElBQkxFIEZPUiBDT05TRVFVRU5USUFMLApQVU5JVElWRSwgQU5EIENF
UlRBSU4gT1RIRVIgREFNQUdFUy4gU0VFIFRIRSBDUFMKRk9SIERFVEFJTFMuCgpDb250ZW50
cyBvZiB0aGUgVmVyaVNpZ24gcmVnaXN0ZXJlZApub252ZXJpZmllZFN1YmplY3RBdHRyaWJ1
dGVzIGV4dGVuc2lvbiB2YWx1ZSBzaGFsbCAKbm90IGJlIGNvbnNpZGVyZWQgYXMgYWNjdXJh
dGUgaW5mb3JtYXRpb24gdmFsaWRhdGVkIApieSB0aGUgSUEuMA0GCSqGSIb3DQEBBAUAA4GB
AA00fYs+ZSeHAn3y/UrA5hFaMGQZVElGGB8ukDAtVDRTqgD9t1JdL2OiJ5DyYtvhS/m7YBjN
dH+SnqyXydUYZbiIPshLfy2oTG+Pga8e8RLLiHvlU/uzQqNBpQNga+x9ia4T3aAb1tC5mxud
EWFdLDqU22kiSFeRWU3Zh9Jizo2OMIICfTCCAeagAwIBAgIUdRNrWPOAaVd1pqJNWRBNnOp2
SvEwDQYJKoZIhvcNAQECBQAwXzELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJ
bmMuMTcwNQYDVQQLEy5DbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0
aG9yaXR5MB4XDTk3MDYyNDA3MDAwMFoXDTk5MDYyNDA3MDAwMFowYjERMA8GA1UEBxMISW50
ZXJuZXQxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTQwMgYDVQQLEytWZXJpU2lnbiBDbGFz
cyAxIENBIC0gSW5kaXZpZHVhbCBTdWJzY3JpYmVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB
iQKBgQC2FKbPTdAFDdjKI9BvqrQpkmOOLPhvltcunXZLEbE2jVfJw/0cxrr+Hgi6M8qV6r7j
W80GqLd5HUQq7XPysVKDaBBwZJHXPmv5912dFEObbpdFmIFH0S3L3bty10w/cariQPJUObwW
7s987LrbP2wqsxaxhhKdrpM01bjV0Pc+qQIDAQABozMwMTARBglghkgBhvhCAQEEBAMCAQYw
DwYDVR0TBAgwBgEB/wIBATALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQECBQADgYEAkgxL6bqT
zf/a5mD9nmQDZhUvVjw4TGhKR8Xzq48l2WZDc0MVc0S+FEiBWncMzHrq2bG88ov/EbHfFFBI
3GUdC4n5oV5IUm/ttWv0uAhMOPC5iWcpD+DgN/em69T01UKpXf295558G+dPhS0EoWAuhbjr
4vrvFAUmFRhVbxOhHXEwggIxMIIBmgIFAqQAAAEwDQYJKoZIhvcNAQECBQAwXzELMAkGA1UE
BhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAxIFB1Ymxp
YyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTk2MDEyOTAwMDAwMFoXDTk5
MTIzMTIzNTk1OVowXzELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcw
NQYDVQQLEy5DbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDlGb9to1ZhLZlIcfZn3rmN67eehoAKkQ76
OCWvRoiC5XOooJskXQ0fzGVuDLDQVoQYh5oGmxChc9+0WDlrbsH2FdWoqD+qEgaNMax/sDTX
jzRniAnNFBHiTkVWaR94AoDa3EeRKbs2yWNcxeDXLYd7obcysHswuiovMaruo2fa2wIDAQAB
MA0GCSqGSIb3DQEBAgUAA4GBAFJzuppV3Nw/gn2wkJhiKoJMdgBuJT3VwglwVwEMD3cfGKH7
HGAOoHU7SSFB/qdcLUxCSdP/KNiM6p3+yQfid4JTI95V885Ek/r6TL3KNvNbZrKeyPIMXl7U
obQhCTPKO1n8ksI4/K3ZliTgLfqjKfUzaHhOtLyfaTXiqJiUczvEMYIBWjCCAVYCAQEwdjBi
MREwDwYDVQQHEwhJbnRlcm5ldDEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNDAyBgNVBAsT
K1ZlcmlTaWduIENsYXNzIDEgQ0EgLSBJbmRpdmlkdWFsIFN1YnNjcmliZXICEHhfzaLUPIQW
ZlqMwKN/uq0wCQYFKw4DAhoFAKB9MBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI
hvcNAQkFMQ8XDTk4MDEwNTE1NDcxMVowHgYJKoZIhvcNAQkPMREwDzANBggqhkiG9w0DAgIB
KDAjBgkqhkiG9w0BCQQxFgQUvUw2hIXMhd7pzjmhowv70dA+ZdwwDQYJKoZIhvcNAQEBBQAE
QF83JxCdoG8l0WhRM3xC/rhtlhfB2YZMSN/Za6dzrmGeGeVvei6xj/fkgJQdnyutqWr9NXG0
DK68C01HoAMFirM=
--------------msB846C7587AF8D45A2076687C--



From firewalls-owner  Mon Jan  5 10:32:18 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id KAA03198; Mon, 5 Jan 1998 10:23:19 -0800 (PST)
Received: from raven.axent.com (raven.axent.com [205.159.112.243]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id KAA03190 for <Firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 10:23:09 -0800 (PST)
Received: by raven.axent.com with Internet Mail Service (5.0.1458.49)
	id <Z8P5DYYF>; Mon, 5 Jan 1998 11:25:41 -0700
Message-ID: <D76E0932FE4ED11196880060B06716E90DF88F@raven.axent.com>
From: Darin Fisher <oz@axent.com>
To: "'Takacs Istvan'" <anonymus@mail.matav.hu>, Firewalls@GreatCircle.COM
Subject: RE: Any document about cracker's technic?
Date: Mon, 5 Jan 1998 11:25:38 -0700
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1458.49)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Try:

http://www.axent.com/swat/swat.html
http://www.l0pht.com

thanx
darin

----
#include <cya/company/disclaim.h>
"In order to succeed, one must pay attention" 

-----Original Message-----
From: Takacs Istvan [mailto:anonymus@mail.matav.hu]
Sent: Saturday, January 03, 1998 11:56 AM
To: Firewalls@GreatCircle.COM
Subject: Any document about cracker's technic?


Hi,

Could you offer me some good links, books, videos
or any kind of documents about the crackers technics?

You always talk about the IDS, and how they work.
But I'd like to know what I have to look for in my company's
network.
We just started to use the commercial side of Internet and for this
reason I think we have to prepare to the crackers attacks.

I don't ask for exact description, just for how they try to
break into the internal network.

Thank you!

Regards.

                            Istvan Takacs
               mailto:anonymus@mail.matav.hu

p.s.: Please, write to my own address, too. Thanks.

From firewalls-owner  Mon Jan  5 13:30:54 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA23758; Mon, 5 Jan 1998 12:01:13 -0800 (PST)
Received: from deimos.frii.com (deimos.frii.com [208.146.240.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA23698 for <firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 12:00:51 -0800 (PST)
Received: from ralph (ralph.ball.com [162.18.91.40]) by deimos.frii.com (8.8.5/8.8.4) with SMTP id NAA16743 for <firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 13:01:15 -0700 (MST)
Message-ID: <34B13BF6.979@frii.com>
Date: Mon, 05 Jan 1998 13:00:54 -0700
From: "Franklin R. Jones" <grat@frii.com>
Organization: Wyldwood Computing
X-Mailer: Mozilla 3.04 (X11; I; SunOS 5.5.1 sun4u)
MIME-Version: 1.0
To: firewalls@GreatCircle.COM
Subject: Re: FW-1 3.0 and Solaris 2.6 ok?
References: <34B1007E.9B1CE4A4@lightech.com.ar>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Sergio Bollini wrote:

> Does anybody know is FW-1 3.0b will work correctly on Solaris 2.6? Is
> there any issues or unsolved problems?
> TIA

	No hands on as of yet, but 2.6 is listed as "supported" OS
rev for V3. I haven't run into any problems application-wise upgrading
to 2.6 from 2.5.x, so my feelings are that it would be a reliable
config. There is a recommeded patch cluster out for 2.6 which includes
several (8 or 9) security patches for various things and I would
recommend installing the cluster.

fj..

From firewalls-owner  Mon Jan  5 13:34:20 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA15653; Mon, 5 Jan 1998 11:25:49 -0800 (PST)
Received: from elmont.dart.org (elmont.dart.org [207.86.10.34]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id LAA15469 for <firewalls@greatcircle.com>; Mon, 5 Jan 1998 11:25:08 -0800 (PST)
Message-ID:  <7724B134818D357C%7724B134818D357C@dart.org>
Date: Mon, 5 Jan 1998 13:25:12 -0500
From: fw-list@dart.org
To: firewalls@greatcircle.com
Subject: land.c hack code
X-SMF-Hop-Count: 1
MIME-Version: 1.0
Content-type: text/plain; charset="US-ASCII"
Content-transfer-encoding: 7bit
X-Mailer: Connect2-SMTP 4.32 MHS/SMF to SMTP Gateway
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Message Source: http://207.86.10.38/msg/fw-list/M908.HTM
From: Darwin Collins


Does anyone know where I can get a copy of the land.c hack code.

Basically, I need to test some homebrewed stuff, and see if it can handle it.

Thanks


From firewalls-owner  Mon Jan  5 13:34:23 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id KAA09562; Mon, 5 Jan 1998 10:57:39 -0800 (PST)
Received: from NOC.cs.ruu.nl (magic.cs.ruu.nl [131.211.80.22]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id KAA09484 for <firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 10:57:14 -0800 (PST)
Received: from localhost (edwin@localhost)
	by NOC.cs.ruu.nl (8.8.6/8.8.6/UU-CS) with ESMTP id TAA25709
	for <firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 19:57:11 +0100 (MET)
Date: Mon, 5 Jan 1998 19:57:11 +0100 (MET)
From: Edwin Kremer <edwin@NOC.cs.ruu.nl>
X-Sender: edwin@magic.cs.ruu.nl
To: Firewalls List <firewalls@GreatCircle.COM>
Subject: ANN/CfP: 1st International SANE Conference
Message-ID: <Pine.GSO.3.96.980105194954.25688C-100000@magic.cs.ruu.nl>
X-Org: Department of Computer Science; Utrecht University
X-Org: P.O. Box 80.089; 3508 TB  Utrecht; The Netherlands.
X-Org: phone: +31-30-2534104; telefax: +31-30-2513791
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=ISO-8859-1
Content-Transfer-Encoding: 8BIT
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello,

below you'll find the announcement and call for papers for the SANE'98
conference to be held on November 18-20 in Maastricht, The Netherlands,
and organized by the NLUUG and co-sponsored by USENIX and Stichting NLnet.

Security and firewalls-related paper submissions are very welcome.

If you prefer to read the Call for Papers in a different format, please
visit the SANE'98 WWW site:

	http://www.nluug.nl/events/sane98/


Thanks for your time.

		best regards,
						--[ Edwin ]--
--
Edwin H. Kremer, systems- and network administrator.   <edwin.kremer@cs.ruu.nl>
Dept. of Computer Science,  Utrecht University, The Netherlands   [WHOIS: ehk3]
-------------------- http://www.cs.ruu.nl/people/edwin/ -----------------------

---------------------------------------------------------------------------
                      Announcement and Call for Papers


                      1st International SANE Conference

                            November 18-20, 1998

                         Maastricht, The Netherlands


 A conference organized by the NLUUG, the UNIX User Group - The Netherlands
   co-sponsored by USENIX, the Advanced Computing Systems Association, and
                               Stichting NLnet


--------
OVERVIEW
--------
Technology is  advancing,  the  systems  administration  profession  is
changing  rapidly,  and you have to master new skills to keep apace. At
the  International  SANE   (System   Administration   and   Networking)
conference  you  can  join the community of system administrators while
attending a program that brings you the latest  in  tools,  techniques,
security and networking. You can learn from tutorials, refereed papers,
invited  talks  and  Birds-of-a-Feather  sessions.  Visit  the   Vendor
Exhibition for the hottest products and the latest books available. The
official language at the conference will  be  English.  The  conference
will  be  located  at  the Maastricht Exposition and Conference Center,
MECC.

----------------
TUTORIAL PROGRAM
----------------
On Wednesday November 18, 1998, up to four in-depth tutorials  will  be
presented to you by the most popular and widely acclaimed speakers.

------------------
TECHNICAL SESSIONS
------------------
Two  days   of   technical   sessions,   including   keynote   address,
presentations  of  refereed  papers  and  invited talks will follow the
tutorial day.

---------------------
CONFERENCE ORGANIZERS
---------------------
Program Co-chairs:
  Edwin Kremer, Department of Computer Science, Utrecht University
  Jan Christiaan van Winkel, AT Computing
Program Committee:
  Jos Alsters, C&CZ, KU Nijmegen
  Bob Eskes, ASR, Hollandse Signaalapparaten
  Peter den Haan, C&CZ, KU Nijmegen
  Patrick Schoo, Department of Mathematics, Utrecht University
  Michael Utermöhle, Dept. of Computer Science, University of Paderborn
  Jos Vos, X/OS Experts in Open Systems
  Elizabeth Zwicky, Silicon Graphics, Inc.
Event Organization:
  Chel van Gennip, Hiscom
  Mariëlle Klatten, NLUUG
  Monique Rours, NLUUG

---------------
IMPORTANT DATES
---------------
Extended abstracts due:      April 17, 1998
Notification to speakers:       May 8, 1998
Final papers due:         September 4, 1998

Complete program and registration information will be available in June
1998. To receive information about the conference, please contact:

	sane98-info@nluug.nl

or visit the conference WWW site:

	http://www.nluug.nl/events/sane98/


-----------------
CONFERENCE TOPICS
-----------------
Presentations are being solicited in areas including but not limited to:

   * Security tools and techniques
   * Managing enterprise-wide email (what about UCE?)
   * Experiences with free software, including operating systems, in a
     professional environment
   * Innovative system administration tools & techniques
   * Distributed or automated system administration
   * Incorporation of commercial system administration technology
   * Adventures in nomadic and wireless computing
   * Intranet development, support, and maintenance
   * Integrating new networking technologies
   * Integration of heterogeneous platforms
   * Performance analysis, monitoring and tuning
   * Support strategies in use at your site
   * Effective training techniques for system administration and users

-------------
INVITED TALKS
-------------
If you have a topic of interest that is not (yet) very well suited  for
a  refereed  paper  submission, please submit a proposal for an invited
talk to the Program Committee at the address: sane98@nluug.nl

--------------------------
REFEREED PAPER SUBMISSIONS
--------------------------
An extended abstract of up to four pages  is  required  for  the  paper
selection  process.  Abstracts  accompanied by non-disclosure agreement
forms are not acceptable  and  will  be  returned  unread.  Authors  of
accepted  submissions must provide a final paper for publication in the
conference proceedings. Final papers are held in the highest confidence
prior  to publication in the conference proceedings. Authors agree with
publication of the final paper in the members-only area  on  the  NLUUG
WWW   site  and/or  the  conference  CD-ROM.   Please  submit  extended
abstracts by one of the following methods:

 E-mail to:        sane98@nluug.nl
 Fax to:           +31 20 6950018
 Postal mail to:   NLUUG
                   PO Box 22727
                   1100 DE AMSTERDAM
                   The Netherlands

---------------------------------------------------------------------------


From firewalls-owner  Mon Jan  5 13:34:26 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id KAA01490; Mon, 5 Jan 1998 10:15:14 -0800 (PST)
Received: from viper.netsolv.com (jridgway.jxn.netdoor.com [208.137.130.254]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id KAA29629 for <firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 10:05:18 -0800 (PST)
Received: from viper ([172.30.100.3]) by viper.netsolv.com
          (Netscape Messaging Server 3.01)  with SMTP id 294
          for <firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 12:05:27 -0600
Received: from netsolv.com ([206.58.71.2])
	by pike.netdoor.com (8.8.8/8.8.5) with SMTP id MAA02085
	for <jridgway@netdoor.com>; Mon, 5 Jan 1998 12:00:19 -0600 (CST)
Received: from loudecho.us.checkpoint.com [206.184.151.194] by netsolv.com with ESMTP
  (SMTPD32-4.02c) id AE43201501CA; Mon, 05 Jan 1998 11:02:27 EST5EDT
Received: from localhost (daemon@localhost)
          by loudecho.us.checkpoint.com (8.8.8/8.8.4) with SMTP
	  id JAA29559; Mon, 5 Jan 1998 09:47:19 -0800 (PST)
Received: by loudecho.us.checkpoint.com (bulk_mailer v1.5 with hacks by jwright@us.checkpoint.com); Mon, 5 Jan 1998 09:37:48 -0800
Received: (from majordom@localhost)
          by loudecho.us.checkpoint.com (8.8.8/8.8.4)
	  id JAA28644 for fw-1-mailinglist-outgoing; Mon, 5 Jan 1998 09:37:38 -0800 (PST)
Received: from peets.us.checkpoint.com ([206.184.151.193])
          by loudecho.us.checkpoint.com (8.8.8/8.8.4) with ESMTP
	  id JAA28571 for <fw-1-mailinglist@loudecho.us.checkpoint.com>; Mon, 5 Jan 1998 09:36:48 -0800 (PST)
Received: from oak.us.checkpoint.com (oak.us.checkpoint.com [206.86.35.94]) by peets.us.checkpoint.com (8.8.7/8.8.3) with SMTP id JAA22848 for <fw-1-mailinglist@peets.us.checkpoint.com>; Mon, 5 Jan 1998 09:37:50 -0800 (PST)
Received: (qmail 6480 invoked by alias); 5 Jan 1998 17:36:44 -0000
Delivered-To: fw-1-mailinglist@us.checkpoint.com
Received: (qmail 6470 invoked from network); 5 Jan 1998 17:36:41 -0000
Received: from tango.lightech.com.ar (200.0.253.134)
  by oak.us.checkpoint.com with SMTP; 5 Jan 1998 17:36:41 -0000
Received: from lightech.com.ar (router1-p04.pccp.com.ar [200.0.253.20])
	by tango.lightech.com.ar (8.8.7/8.8.7) with ESMTP id RAA21387;
	Mon, 5 Jan 1998 17:13:39 GMT
Message-ID: <34B1007E.9B1CE4A4@lightech.com.ar>
Date: Mon, 05 Jan 1998 12:47:11 -0300
From: Sergio Bollini <sbollini@lightech.com.ar>
Reply-To: sbollini@lightech.com.ar
Organization: LighTech
X-Mailer: Mozilla 4.04 [en] (Win95; I)
MIME-Version: 1.0
To: "firewalls@GreatCircle.COM" <firewalls@GreatCircle.COM>,
        "Mailing List, Firewall-1" <fw-1-mailinglist@us.checkpoint.com>
Subject: [FW1] FW-1 3.0 and Solaris 2.6 ok?
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------msB846C7587AF8D45A2076687C"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


This is a cryptographically signed message in MIME format.

--------------msB846C7587AF8D45A2076687C
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Hello all!
Does anybody know is FW-1 3.0b will work correctly on Solaris 2.6? Is
there any issues or unsolved problems?
TIA

--
Sergio E. Bollini
LighTech                        Voice:  (54-1) 373-1141
Ayacucho 563. Piso 13 Dto "A"   FAX:    (54-1) 373-1215
(1026)  Buenos Aires            e-mail: sbollini@lightech.com.ar
Argentina                       URL:    http://www.lightech.com.ar


--------------msB846C7587AF8D45A2076687C
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIIQDwYJKoZIhvcNAQcCoIIQADCCD/wCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC
Dn0wggnDMIIJLKADAgECAhB4X82i1DyEFmZajMCjf7qtMA0GCSqGSIb3DQEBBAUAMGIxETAP
BgNVBAcTCEludGVybmV0MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE0MDIGA1UECxMrVmVy
aVNpZ24gQ2xhc3MgMSBDQSAtIEluZGl2aWR1YWwgU3Vic2NyaWJlcjAeFw05NzA0MTAwMDAw
MDBaFw05ODA0MTAyMzU5NTlaMIIBFDERMA8GA1UEBxMISW50ZXJuZXQxFzAVBgNVBAoTDlZl
cmlTaWduLCBJbmMuMTQwMgYDVQQLEytWZXJpU2lnbiBDbGFzcyAxIENBIC0gSW5kaXZpZHVh
bCBTdWJzY3JpYmVyMUYwRAYDVQQLEz13d3cudmVyaXNpZ24uY29tL3JlcG9zaXRvcnkvQ1BT
IEluY29ycC4gYnkgUmVmLixMSUFCLkxURChjKTk2MSYwJAYDVQQLEx1EaWdpdGFsIElEIENs
YXNzIDEgLSBOZXRzY2FwZTEXMBUGA1UEAxMOU2VyZ2lvIEJvbGxpbmkxJzAlBgkqhkiG9w0B
CQEWGHNib2xsaW5pQGxpZ2h0ZWNoLmNvbS5hcjBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCt
Iw69fHnhJqxaDdc0Rakxy2ceJTT00bQiu/mm42O7ILzd/zKGwsT4+uQcHsFUm6Bjhcthh2ND
7iI7eQqGcGi5AgMBAAGjggcIMIIHBDAJBgNVHRMEAjAAMIICHwYDVR0DBIICFjCCAhIwggIO
MIICCgYLYIZIAYb4RQEHAQEwggH5FoIBp1RoaXMgY2VydGlmaWNhdGUgaW5jb3Jwb3JhdGVz
IGJ5IHJlZmVyZW5jZSwgYW5kIGl0cyB1c2UgaXMgc3RyaWN0bHkgc3ViamVjdCB0bywgdGhl
IFZlcmlTaWduIENlcnRpZmljYXRpb24gUHJhY3RpY2UgU3RhdGVtZW50IChDUFMpLCBhdmFp
bGFibGUgYXQ6IGh0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9DUFM7IGJ5IEUtbWFpbCBhdCBD
UFMtcmVxdWVzdHNAdmVyaXNpZ24uY29tOyBvciBieSBtYWlsIGF0IFZlcmlTaWduLCBJbmMu
LCAyNTkzIENvYXN0IEF2ZS4sIE1vdW50YWluIFZpZXcsIENBIDk0MDQzIFVTQSBUZWwuICsx
ICg0MTUpIDk2MS04ODMwIENvcHlyaWdodCAoYykgMTk5NiBWZXJpU2lnbiwgSW5jLiAgQWxs
IFJpZ2h0cyBSZXNlcnZlZC4gQ0VSVEFJTiBXQVJSQU5USUVTIERJU0NMQUlNRUQgYW5kIExJ
QUJJTElUWSBMSU1JVEVELqAOBgxghkgBhvhFAQcBAQGhDgYMYIZIAYb4RQEHAQECMCwwKhYo
aHR0cHM6Ly93d3cudmVyaXNpZ24uY29tL3JlcG9zaXRvcnkvQ1BTIDARBglghkgBhvhCAQEE
BAMCB4AwNgYJYIZIAYb4QgEIBCkWJ2h0dHBzOi8vd3d3LnZlcmlzaWduLmNvbS9yZXBvc2l0
b3J5L0NQUzCCBIcGCWCGSAGG+EIBDQSCBHgWggR0Q0FVVElPTjogVGhlIENvbW1vbiBOYW1l
IGluIHRoaXMgQ2xhc3MgMSBEaWdpdGFsIApJRCBpcyBub3QgYXV0aGVudGljYXRlZCBieSBW
ZXJpU2lnbi4gSXQgbWF5IGJlIHRoZQpob2xkZXIncyByZWFsIG5hbWUgb3IgYW4gYWxpYXMu
IFZlcmlTaWduIGRvZXMgYXV0aC0KZW50aWNhdGUgdGhlIGUtbWFpbCBhZGRyZXNzIG9mIHRo
ZSBob2xkZXIuCgpUaGlzIGNlcnRpZmljYXRlIGluY29ycG9yYXRlcyBieSByZWZlcmVuY2Us
IGFuZCAKaXRzIHVzZSBpcyBzdHJpY3RseSBzdWJqZWN0IHRvLCB0aGUgVmVyaVNpZ24gCkNl
cnRpZmljYXRpb24gUHJhY3RpY2UgU3RhdGVtZW50IChDUFMpLCBhdmFpbGFibGUKaW4gdGhl
IFZlcmlTaWduIHJlcG9zaXRvcnkgYXQ6IApodHRwczovL3d3dy52ZXJpc2lnbi5jb207IGJ5
IEUtbWFpbCBhdApDUFMtcmVxdWVzdHNAdmVyaXNpZ24uY29tOyBvciBieSBtYWlsIGF0IFZl
cmlTaWduLApJbmMuLCAyNTkzIENvYXN0IEF2ZS4sIE1vdW50YWluIFZpZXcsIENBIDk0MDQz
IFVTQQoKQ29weXJpZ2h0IChjKTE5OTYgVmVyaVNpZ24sIEluYy4gIEFsbCBSaWdodHMgClJl
c2VydmVkLiBDRVJUQUlOIFdBUlJBTlRJRVMgRElTQ0xBSU1FRCBBTkQgCkxJQUJJTElUWSBM
SU1JVEVELgoKV0FSTklORzogVEhFIFVTRSBPRiBUSElTIENFUlRJRklDQVRFIElTIFNUUklD
VExZClNVQkpFQ1QgVE8gVEhFIFZFUklTSUdOIENFUlRJRklDQVRJT04gUFJBQ1RJQ0UKU1RB
VEVNRU5ULiAgVEhFIElTU1VJTkcgQVVUSE9SSVRZIERJU0NMQUlNUyBDRVJUQUlOCklNUExJ
RUQgQU5EIEVYUFJFU1MgV0FSUkFOVElFUywgSU5DTFVESU5HIFdBUlJBTlRJRVMKT0YgTUVS
Q0hBTlRBQklMSVRZIE9SIEZJVE5FU1MgRk9SIEEgUEFSVElDVUxBUgpQVVJQT1NFLCBBTkQg
V0lMTCBOT1QgQkUgTElBQkxFIEZPUiBDT05TRVFVRU5USUFMLApQVU5JVElWRSwgQU5EIENF
UlRBSU4gT1RIRVIgREFNQUdFUy4gU0VFIFRIRSBDUFMKRk9SIERFVEFJTFMuCgpDb250ZW50
cyBvZiB0aGUgVmVyaVNpZ24gcmVnaXN0ZXJlZApub252ZXJpZmllZFN1YmplY3RBdHRyaWJ1
dGVzIGV4dGVuc2lvbiB2YWx1ZSBzaGFsbCAKbm90IGJlIGNvbnNpZGVyZWQgYXMgYWNjdXJh
dGUgaW5mb3JtYXRpb24gdmFsaWRhdGVkIApieSB0aGUgSUEuMA0GCSqGSIb3DQEBBAUAA4GB
AA00fYs+ZSeHAn3y/UrA5hFaMGQZVElGGB8ukDAtVDRTqgD9t1JdL2OiJ5DyYtvhS/m7YBjN
dH+SnqyXydUYZbiIPshLfy2oTG+Pga8e8RLLiHvlU/uzQqNBpQNga+x9ia4T3aAb1tC5mxud
EWFdLDqU22kiSFeRWU3Zh9Jizo2OMIICfTCCAeagAwIBAgIUdRNrWPOAaVd1pqJNWRBNnOp2
SvEwDQYJKoZIhvcNAQECBQAwXzELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJ
bmMuMTcwNQYDVQQLEy5DbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0
aG9yaXR5MB4XDTk3MDYyNDA3MDAwMFoXDTk5MDYyNDA3MDAwMFowYjERMA8GA1UEBxMISW50
ZXJuZXQxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTQwMgYDVQQLEytWZXJpU2lnbiBDbGFz
cyAxIENBIC0gSW5kaXZpZHVhbCBTdWJzY3JpYmVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB
iQKBgQC2FKbPTdAFDdjKI9BvqrQpkmOOLPhvltcunXZLEbE2jVfJw/0cxrr+Hgi6M8qV6r7j
W80GqLd5HUQq7XPysVKDaBBwZJHXPmv5912dFEObbpdFmIFH0S3L3bty10w/cariQPJUObwW
7s987LrbP2wqsxaxhhKdrpM01bjV0Pc+qQIDAQABozMwMTARBglghkgBhvhCAQEEBAMCAQYw
DwYDVR0TBAgwBgEB/wIBATALBgNVHQ8EBAMCAQYwDQYJKoZIhvcNAQECBQADgYEAkgxL6bqT
zf/a5mD9nmQDZhUvVjw4TGhKR8Xzq48l2WZDc0MVc0S+FEiBWncMzHrq2bG88ov/EbHfFFBI
3GUdC4n5oV5IUm/ttWv0uAhMOPC5iWcpD+DgN/em69T01UKpXf295558G+dPhS0EoWAuhbjr
4vrvFAUmFRhVbxOhHXEwggIxMIIBmgIFAqQAAAEwDQYJKoZIhvcNAQECBQAwXzELMAkGA1UE
BhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAxIFB1Ymxp
YyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTk2MDEyOTAwMDAwMFoXDTk5
MTIzMTIzNTk1OVowXzELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcw
NQYDVQQLEy5DbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDlGb9to1ZhLZlIcfZn3rmN67eehoAKkQ76
OCWvRoiC5XOooJskXQ0fzGVuDLDQVoQYh5oGmxChc9+0WDlrbsH2FdWoqD+qEgaNMax/sDTX
jzRniAnNFBHiTkVWaR94AoDa3EeRKbs2yWNcxeDXLYd7obcysHswuiovMaruo2fa2wIDAQAB
MA0GCSqGSIb3DQEBAgUAA4GBAFJzuppV3Nw/gn2wkJhiKoJMdgBuJT3VwglwVwEMD3cfGKH7
HGAOoHU7SSFB/qdcLUxCSdP/KNiM6p3+yQfid4JTI95V885Ek/r6TL3KNvNbZrKeyPIMXl7U
obQhCTPKO1n8ksI4/K3ZliTgLfqjKfUzaHhOtLyfaTXiqJiUczvEMYIBWjCCAVYCAQEwdjBi
MREwDwYDVQQHEwhJbnRlcm5ldDEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNDAyBgNVBAsT
K1ZlcmlTaWduIENsYXNzIDEgQ0EgLSBJbmRpdmlkdWFsIFN1YnNjcmliZXICEHhfzaLUPIQW
ZlqMwKN/uq0wCQYFKw4DAhoFAKB9MBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZI
hvcNAQkFMQ8XDTk4MDEwNTE1NDcxMVowHgYJKoZIhvcNAQkPMREwDzANBggqhkiG9w0DAgIB
KDAjBgkqhkiG9w0BCQQxFgQUvUw2hIXMhd7pzjmhowv70dA+ZdwwDQYJKoZIhvcNAQEBBQAE
QF83JxCdoG8l0WhRM3xC/rhtlhfB2YZMSN/Za6dzrmGeGeVvei6xj/fkgJQdnyutqWr9NXG0
DK68C01HoAMFirM=
--------------msB846C7587AF8D45A2076687C--




================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================


From firewalls-owner  Mon Jan  5 13:45:10 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id NAA10378; Mon, 5 Jan 1998 13:15:47 -0800 (PST)
Received: from moat.pweh.com ([192.54.250.131]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA00140 for <firewalls@greatcircle.com>; Mon, 5 Jan 1998 12:32:36 -0800 (PST)
Received: (from uucp@localhost)
	by moat.pweh.com (8.8.8/8.8.8) id PAA10742
	for <firewalls@greatcircle.com>; Mon, 5 Jan 1998 15:32:44 -0500 (EST)
Received: from drawbridge.eh.pweh.com(191.29.71.250) by moat.pweh.com via smap (4.0a)
	id xma010708; Mon, 5 Jan 98 15:32:41 -0500
Received: (from uucp@localhost)
	by drawbridge.eh.pweh.com (8.8.8/8.8.8) id PAA16539
	for <firewalls@greatcircle.com>; Mon, 5 Jan 1998 15:32:40 -0500 (EST)
Received: from fs17005.eh.pweh.com(191.29.170.5) by drawbridge.eh.pweh.com via smap (4.0a)
	id xma016461; Mon, 5 Jan 98 15:32:33 -0500
Received: from clbdev2.eh.pweh.com by pweh011.eh.pweh.com (SMI-8.6/SMI-SVR4)
	id PAA29328; Mon, 5 Jan 1998 15:32:31 -0500
Received: (from miorelli@localhost)
	by clbdev2.eh.pweh.com (8.8.5/8.8.5) id PAA05221
	for firewalls@greatcircle.com; Mon, 5 Jan 1998 15:32:32 -0500 (EST)
Date: Mon,  5 Jan 98 15:32 EST
From: BoB Miorelli <miorelli@pweh.com>
To: firewalls@greatcircle.com
Received: from miorelli by clbdev2.eh.pweh.com; Mon,  5 Jan 98 15:32 EST
Subject: NT Web proxy server
Content-Type: text/plain
Message-ID: <34b1435f0.1464@clbdev2.eh.pweh.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi --

I'm looking for a Web proxy server that does caching for
my kid's school (K-8).  The computer lab is networked
to a server which would run the proxy.  The server
is a Pentium running NT 4.0.  I'm looking for
recommendations on proxy server software from anyone
that is running it on NT 4.0 using a dialup-on-demand
type of setup.  The only proxy servers for NT that
I am aware of are Microsoft and Netscape, but I'm
sure there are others.

Any and all comments are welcome.

Thanks.

-->BoB 


-->BoB Miorelli, Pratt & Whitney
miorelli@pweh.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
In theory, theory and practice are the same; 
in practice they are distinct.

From firewalls-owner  Mon Jan  5 13:59:56 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id NAA08519; Mon, 5 Jan 1998 13:08:00 -0800 (PST)
Received: from c00069-100lez.eos.ncsu.edu (c00069-100lez.eos.ncsu.edu [152.1.26.28]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id NAA08482 for <firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 13:07:50 -0800 (PST)
Received: from localhost (jkwilli2@localhost)
          by c00069-100lez.eos.ncsu.edu (8.8.4/EC02Jan97) with SMTP
	  id QAA23031; Mon, 5 Jan 1998 16:07:54 -0500 (EST)
X-Authentication-Warning: c00069-100lez.eos.ncsu.edu: jkwilli2 owned process doing -bs
Date: Mon, 5 Jan 1998 16:07:53 -0500 (EST)
From: Ken Williams <jkwilli2@unity.ncsu.edu>
X-Sender: jkwilli2@c00069-100lez.eos.ncsu.edu
To: fw-list@dart.org
cc: firewalls@GreatCircle.COM
Subject: Re: land.c hack code
In-Reply-To: <7724B134818D357C%7724B134818D357C@dart.org>
Message-ID: <Pine.SOL.3.96.980105160424.22809A-100000@c00069-100lez.eos.ncsu.edu>
X-Bullshit: The header is genuine....WTF did you expect?
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Mon, 5 Jan 1998 fw-list@dart.org wrote:

>Message Source: http://207.86.10.38/msg/fw-list/M908.HTM
>>From: Darwin Collins
>
>
>Does anyone know where I can get a copy of the land.c hack code.
>
>Basically, I need to test some homebrewed stuff, and see if it can handle it.
>
>Thanks
>

you can get a copy of land.c and also the enhanced version, latierra.c,
from http://www.rootshell.com
the specific URL's for these two are:
http://www.rootshell.com/archive-acz9smq232qz7avi9jeacjvd/199711/land.c
http://www.rootshell.com/archive-acz9smq232qz7avi9jeacjvd/199711/latierra.c

for reference, they are in the Nov '97 archive at rootshell.com.

you will also probably want to check out teardrop.c too.  the URL for that
source code is:
http://www.rootshell.com/archive-acz9smq232qz7avi9jeacjvd/199711/teardrop.c

hasta,

Ken 

/<--------------{ TATTOOMAN -aka- rute }-------------->\  
  NCSU Computer Science    Member of E.H.A.P.   
  jkwilli2@unity.ncsu.edu  http://www.hackers.com/ehap/ 
  UNIX ICQ UIN# 4231260    ehap@hackers.com     
  FTP Site:  ftp://152.7.11.38/pub/personal/tattooman/
  WWW 2:     http://www4.ncsu.edu/~jkwilli2/
\<---------{ http://152.7.11.38/~tattooman/ }--------->/




From firewalls-owner  Mon Jan  5 14:28:37 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id NAA14728; Mon, 5 Jan 1998 13:47:42 -0800 (PST)
Received: from mailgw1.almaden.ibm.com ([198.4.83.39]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id NAA14721 for <Firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 13:47:38 -0800 (PST)
From: trall@almaden.ibm.com
Received: by mailgw1.almaden.ibm.com(Lotus SMTP MTA SMTP v4.6 (462.2 9-3-1997))  id 88256583.0077C768 ; Mon, 5 Jan 1998 13:48:18 -0800
X-Lotus-FromDomain: ALMADEN
To: Firewalls@GreatCircle.COM
Message-ID: <88256583.00757996.00@mailgw1.almaden.ibm.com>
Date: Mon, 5 Jan 1998 13:47:38 -0800
Subject: Re: Hardware for seperating LAN from dialouts
Mime-Version: 1.0
Content-type: text/plain; charset=us-ascii
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Ian KC Worrell <ian@sunbeach.net> wrote:
>I use my lap top in the office, and it has both a network card and a modem
>in it.  As my office network is on a different IP address range that my
>Internet Connection, I can actually have both connected at the same time!
>
>There seems to be no problem with the routing at all!
>At 10:10 AM 1/5/98 +1000, Norman Widders wrote:
>>Just wondered if anybody has used those hardware devices
>>that disable LAN connections while a modem dials out
>>to the Internet.
>>
>>It detects when the modem is active thus severing the
>>link to the LAN physically and reconnects the LAN
>>once the modem has disconnected from the LAN.
>>
>>The device is connected to both the modem and LAN and
>>sounds good in theory and I am just wondering
>>what other peoples experience with these are, at $85
>>it is an ideal solution for small organisations
>>that just want to poll their ISP a few times a day
>>for email.

Yes, it's generally possible to arrange the routing so that you can
simultaneously connect with a modem and your lan interface.  And that's
fine if you don't care about security (but then why are you posting to this
list?).

Assuming the lan is behind a firewall, most administrators don't want
uncontrolled lan machines connecting directly to the Internet.

There is a degree of protection obtained if the machine is disconnected
from the lan while the modem is being used to access the Internet (and a
device that does this automatically would make this easier).  But when you
hangup and reconnect your lan, you're still exposing the lan to viruses,
etc. that were acquired while dialed to the Internet.  A trojan horse
could, for example, slurp up confidential data on your lan, then dial the
Internet (or wait until the next time you do it), and send the data to your
competitor.

In summary, you probably shouldn't do this at all unless the dialing host
is reasonably secure itself.

Tony Rall



From firewalls-owner  Mon Jan  5 15:22:42 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id OAA21008; Mon, 5 Jan 1998 14:22:30 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id OAA20778 for <firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 14:21:49 -0800 (PST)
Received: from magna.com.au by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-970426)
	id OAA16965; Mon, 5 Jan 1998 14:20:27 -0800 (PST)
Received: from magna.magna.com.au (saccess-01-082.magna.com.au [203.111.79.82]) by magna.com.au (8.8.5/8.6.10) with SMTP id JAA13462; Tue, 6 Jan 1998 09:20:58 +1100 (EST)
Date: Tue, 6 Jan 1998 09:20:58 +1100 (EST)
Message-Id: <199801052220.JAA13462@magna.com.au>
X-Sender: iank@magna.com.au
X-Mailer: Windows Eudora Light Version 1.5.2
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: Ian KC Worrell <ian@sunbeach.net>
From: Ian Krieger <iank@magna.com.au>
Subject: Re: Hardware for seperating LAN from dialouts
Cc: firewalls@GreatCircle.COM
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Sorry I may be mistaken but most users would be running windows 95 on their
laptops and desktops in offices, sorry guys, Win95 dosen't support IP
routing,like there's a supprise, hence you would not need to overly worry
about having to sever you network connection when wanting to retrieve mail
every once and again.

If I have misunderstood the question / query, well hey I'm only human.


Ian.

At 11:05 AM 1/5/98 -0400, you wrote:
>I use my lap top in the office, and it has both a network card and a modem
>in it.  As my office network is on a different IP address range that my
>Internet Connection, I can actually have both connected at the same time!
>
>There seems to be no problem with the routing at all!
>
>Ian
>
>At 10:10 AM 1/5/98 +1000, Norman Widders wrote:
>>Just wondered if anybody has used those hardware devices
>>that disable LAN connections while a modem dials out
>>to the Internet.
>>
>>It detects when the modem is active thus severing the
>>link to the LAN physically and reconnects the LAN
>>once the modem has disconnected from the LAN. 
>>
>>The device is connected to both the modem and LAN and
>>sounds good in theory and I am just wondering
>>what other peoples experience with these are, at $85
>>it is an ideal solution for small organisations
>>that just want to poll their ISP a few times a day
>>for email.
>>
>>--
>>Wheres my valium ?
>>
>>
>>
>>
>
>
>
----------------------------------------------------------------
Ian W Krieger					IanK@Magna.com.au

"qlm tera'ngan!" - Translated from Klingon "Attention Earther!"


From firewalls-owner  Mon Jan  5 16:00:15 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA09148; Mon, 5 Jan 1998 15:48:19 -0800 (PST)
Received: from ns.acadiacom.net (ns.acadiacom.net [206.104.52.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id PAA08950 for <firewalls@greatcircle.com>; Mon, 5 Jan 1998 15:47:45 -0800 (PST)
Received: from unitedcouncil.org (unverified [206.104.52.77]) by ns.acadiacom.net
 (Rockliffe SMTPRA 2.1.4) with ESMTP id <B0000595991@ns.acadiacom.net> for <firewalls@GreatCircle.COM>;
 Mon, 05 Jan 1998 17:50:36 -0600
Message-ID: <348689F7.F62A57A2@unitedcouncil.org>
Date: Thu, 04 Dec 1997 05:46:16 -0500
From: Sandman <sandman@unitedcouncil.org>
Reply-To: sandman@unitedcouncil.org
X-Mailer: Mozilla 4.04 [en] (Win95; I)
MIME-Version: 1.0
To: firewalls@GreatCircle.COM
Subject: Re: land.c hack code
References: <7724B134818D357C%7724B134818D357C@dart.org>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

 http://www.unitedcouncil.org has it in the The C Source Code Library.

       -Sandman
The United Council
http://www.unitedcouncil.org
sandman@unitedcouncil


From firewalls-owner  Mon Jan  5 16:14:41 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id QAA11611; Mon, 5 Jan 1998 16:01:58 -0800 (PST)
Received: from inergen.sybase.com (inergen.sybase.com [192.138.151.43]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id QAA11560 for <firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 16:01:43 -0800 (PST)
Received: from smtp1.sybase.com (sybgate.sybase.com [130.214.220.35])
          by inergen.sybase.com (8.8.4/8.8.4) with SMTP
	  id QAA20812; Mon, 5 Jan 1998 16:03:28 -0800 (PST)
Received: from  by smtp1.sybase.com (4.1/SMI-4.1/SybH3.5-030896)
	id AB09026; Mon, 5 Jan 98 16:04:41 PST
Received: by gwwest.sybase.com(Lotus SMTP MTA v1.1 (385.6 5-6-1997))  id 88256584.00007D14 ; Mon, 5 Jan 1998 16:05:20 -0800
X-Lotus-Fromdomain: SYBASENOTES
From: "Ryan Russell"<ryanr@sybase.com>
To: iank@magna.com.au
Cc: ian@sunbeach.net, firewalls@GreatCircle.COM
Message-Id: <88256583.00839BF7.00@gwwest.sybase.com>
Date: Mon, 5 Jan 1998 16:00:07 -0800
Subject: Re: Hardware for seperating LAN from dialouts
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Actually, Win95 DOES support routing.  And, I'm told it
even works in OSR2.

The point is, it doesn't need to route.  If you're connected to
the Internet & your LAN at the same time, and I break into
your machine (via the Internet,) I now have control of a machine on
your LAN.

It's against MY company policy... as the saying goes,
your paranoia level may vary..

                    Ryan





iank@magna.com.au on 01/05/98 02:20:58 PM

To:   ian@sunbeach.net
cc:   firewalls@GreatCircle.COM (bcc: Ryan Russell/SYBASE)
Subject:  Re: Hardware for seperating LAN from dialouts




Sorry I may be mistaken but most users would be running windows 95 on their
laptops and desktops in offices, sorry guys, Win95 dosen't support IP
routing,like there's a supprise, hence you would not need to overly worry
about having to sever you network connection when wanting to retrieve mail
every once and again.
If I have misunderstood the question / query, well hey I'm only human.

Ian.
At 11:05 AM 1/5/98 -0400, you wrote:
>I use my lap top in the office, and it has both a network card and a modem
>in it.  As my office network is on a different IP address range that my
>Internet Connection, I can actually have both connected at the same time!
>
>There seems to be no problem with the routing at all!
>
>Ian
>
>At 10:10 AM 1/5/98 +1000, Norman Widders wrote:
>>Just wondered if anybody has used those hardware devices
>>that disable LAN connections while a modem dials out
>>to the Internet.
>>
>>It detects when the modem is active thus severing the
>>link to the LAN physically and reconnects the LAN
>>once the modem has disconnected from the LAN.
>>
>>The device is connected to both the modem and LAN and
>>sounds good in theory and I am just wondering
>>what other peoples experience with these are, at $85
>>it is an ideal solution for small organisations
>>that just want to poll their ISP a few times a day
>>for email.
>>
>>--
>>Wheres my valium ?
>>
>>
>>
>>
>
>
>
----------------------------------------------------------------
Ian W Krieger                      IanK@Magna.com.au
"qlm tera'ngan!" - Translated from Klingon "Attention Earther!"






From firewalls-owner  Mon Jan  5 18:07:53 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id RAA28114; Mon, 5 Jan 1998 17:49:27 -0800 (PST)
Received: from hq.si.net (hq.si.net [192.156.192.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id RAA28039 for <firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 17:49:10 -0800 (PST)
Received: from hq.si.net (hq [192.156.192.10]) by hq.si.net (8.8.5/8.7.3) with SMTP id UAA22068 for <firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 20:51:10 -0500 (EST)
Date: Mon, 5 Jan 1998 20:51:10 -0500 (EST)
From: Ming Lu <mlu@hq.si.net>
To: firewalls@GreatCircle.COM
Subject: Bank Security
Message-ID: <Pine.SOL.3.91.980105204225.20137I-100000@hq.si.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Hi all:

I am looking any info regarding bank security requirements (I know that
it is a knid of sensetive...:-)) and implementations. It would be greatly 
appreciated if anyone can help on this.

TIA

_ming

From firewalls-owner  Mon Jan  5 18:29:55 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id RAA27207; Mon, 5 Jan 1998 17:45:00 -0800 (PST)
Received: from mtigwc04.worldnet.att.net (mtigwc04.worldnet.att.net [204.127.131.33]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id RAA26975 for <firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 17:44:17 -0800 (PST)
From: mht@clark.net
Received: from highlander ([12.68.178.197]) by mtigwc04.worldnet.att.net
          (post.office MTA v2.0 0613 ) with SMTP id AAB17479;
          Tue, 6 Jan 1998 01:44:26 +0000
Message-Id: <3.0.3.32.19980105203733.00a62540@pop3.clark.net>
X-Sender: mht@pop3.clark.net
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Mon, 05 Jan 1998 20:37:33 -0500
To: Ian Poynter <ian@jerboa.com>,
        MarkusLindingerHamburg@t-online.de (Lindinger),
        firewalls@GreatCircle.COM
Subject: Re: Comparision of Firewall Products
In-Reply-To: <3.0.3.32.19980105102235.00af6230@squirrel>
References: <3.0.3.32.19980105081940.00808730@pop3.clark.net>
 <m0xpBh7-0003eIC@fwd11.btx.dtag.de>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

<comments within>


At 10:22 AM 1/5/98 -0500, Ian Poynter wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>At 08:19 AM 1/5/98 -0500, mht@clark.net wrote:
>>I think LAN TIMES did a comparison report a while back. Check out 
>>www.lantimes.com
>
>Be careful with this one, the test methodology didn't look at security at
all 
>(see http://www.lantimes.com/97/97aug/708a060c.html; they didn't test 
>installation either).  I wasn't completely happy that the performance
numbers 
>were comparing apples with apples either.  Still, it's useful as a feature 
>comparison, though.

Yes, I will tend to agree with Ian on his point, the test methodology used
did not test the installation procedures, but listed features of each, pros
and cons.  But as Ian points out it is a starting point in comparison
testing. :)

>
>>Your security policy, network architecture, business model, needs and 
>>technical resources, etc should also factor into your equation while 
>>evaluating the different firewall systems.
>>
>>A firewall is just one component of many when installing a firewall 
>>system for your particular organization. 
>
>Now this I agree with :-).

To add to this point, on each point stated, a rating or point should be
assigned to each factor when evaluating a firewall system, either you can
use a scale of 1-10 when evaluating a solution or solutions to a particular
organization..


/mht

>
>Ian
>
>
>-----BEGIN PGP SIGNATURE-----
>Version: PGP for Personal Privacy 5.0
>Charset: noconv
>
>iQA/AwUBNLD6usj1wUcX1Ha3EQID8QCg2Q6gT0RaW4kQMP+WBWQ3bAH70GoAnj0S
>hf30Ml+vAOoa4IGD/fiTstGN
>=lXXh
>-----END PGP SIGNATURE-----
>
>-----
>Ian Poynter                                        ian@jerboa.com
>Jerboa, Inc.                                      +1-617-492-8084
>PO Box 382648, Cambridge, MA 02238          http://www.jerboa.com
>Providing unbiased Internet consulting for businesses.
>Fingerprints RSA: BA 0C 82 C5 F2 03 3D 95  7C CE FD D3 57 4E 15 73
>           DSS: 2769 277A 9F69 F605 3743  D574 C8F5 C147 17D4 76B7
>
>
------------------------------------------------------
"GREETINGS PROFESSOR FALKEN."
	"SHALL WE PLAY A GAME??"
------------------------------------------------------


From firewalls-owner  Mon Jan  5 20:15:40 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id UAA16605; Mon, 5 Jan 1998 20:09:20 -0800 (PST)
Received: from mail.atl.bellsouth.net (mail.atl.bellsouth.net [205.152.0.21]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id UAA16597 for <firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 20:09:14 -0800 (PST)
Received: from nope (bims008201.bims.bellsouth.net [205.152.8.201])
	by mail.atl.bellsouth.net (8.8.5/8.8.5) with ESMTP id XAA10773;
	Mon, 5 Jan 1998 23:10:08 -0500 (EST)
Message-Id: <199801060410.XAA10773@mail.atl.bellsouth.net>
From: "Steve Jackson Brown" <sjbrown@bellsouth.net>
To: <mht@clark.net>, <firewalls@GreatCircle.COM>
Subject: Re: SessionWall 3 release 2 vs Network Flight Recorder??
Date: Mon, 5 Jan 1998 23:04:33 -0500
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1161
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk




> Yes, I tend to agree with you on that.  RealSecure is a very powerful 
> tool, but it requires a clear understanding in what options you 
> choose in a particular environment when using it..

Here are two Abirnet vs. RealSecure comparisions I found on ww.zdnet.com:

http://www.zdnet.com/pcweek/reviews/0421/21wall.html
and
http://www.zdnet.com/pcweek/reviews/0929/29wall.html

It looks to me from the review that one is a swiss-army knife that watches
all kind of network
issues and one is optimized for network security. Read the reviews to form
your own opinion. In
searching for comparisions, the most recent Top Technology Picks for '97 of
PC Week was IDS technology:
   
http://www.zdnet.com/pcweek/sr/1222/22netb.html

So far now, 2 magazines picked IDS as a top technology released in 1997. It
will be interesting to find
out what new technology is going to be released in 1998.  Anyone know of
any reviews of other IDS 
systems?

> Overall, I wish one of the local trades magazines would initiate a 
> Consumer Report comparison of the current IDS tools  or "clue-
> gathering tools" available and new ones that are emerging...  (HINT, 
> HINT)

Is NFR really an intrusion detection system?  From the web site,
www.nfr.com, 

"NFRs provide valuable information about the growth of your network, its
usage patterns, bottlenecks and potential mis-configurations, and more.
Imagine the usefulness of being able to learn how any aspect of your
network has changed over time! NFR also lets you store and browse data you
want to gather as it passes through or within your network."

This description seems like performance monitoring and network traffic
policy monitoring.  It's probably possible someone could build an intrusion
detection system with NFR. NFR itself does not seem like
an intrusion detection package. 

Maybe CSI or NCSA could do the "Consumer Reports" of IDS tools.  


From firewalls-owner  Mon Jan  5 22:14:43 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id WAA25455; Mon, 5 Jan 1998 22:04:28 -0800 (PST)
Received: from aims.gov.au (pearl.aims.gov.au [138.7.32.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id WAA25445 for <firewalls@greatcircle.com>; Mon, 5 Jan 1998 22:04:22 -0800 (PST)
Received: from aims.gov.au by aims.gov.au (SMI-8.6/SMI-SVR4)
	id QAA10286; Tue, 6 Jan 1998 16:04:36 +1000
Message-ID: <34B1C8DC.2BE94D49@aims.gov.au>
Date: Tue, 06 Jan 1998 16:02:04 +1000
From: Kerry Jones <kjones@aims.gov.au>
X-Mailer: Mozilla 4.04 [en] (WinNT; I)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: DNS on firewall??
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

Simple question. Is it a good idea to run a DNS server on a
Firewall?????

AUNIC require at least 2 DNS servers, so I am trying to decide where to
configure the 2nd DNS server for our domain (Primary one is currently on
the DMZ). Will putting the secondary DNS on the firewall create a
security hole in the Firewall which would best be avoided????????
Is it acceptable (secure) to put the DNS and other services (e.g.
http/ftp) on the Firewall??

What do you think??
What are your opinions??

I have a fairly standard setup as follows;

Internet
    |
 router
    |
 firewall - dmz (1 machine: http/ftp/dns)
      |
  internal network.

--
Kerry Jones
kjones@aims.gov.au


From firewalls-owner  Mon Jan  5 22:59:34 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id WAA00600; Mon, 5 Jan 1998 22:46:15 -0800 (PST)
Received: from imo18.mx.aol.com (imo18.mx.aol.com [198.81.19.175]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id WAA00593 for <firewalls@GreatCircle.COM>; Mon, 5 Jan 1998 22:46:11 -0800 (PST)
From: MYundt <MYundt@aol.com>
Message-ID: <6dda8f0f.34b1d341@aol.com>
Date: Tue, 6 Jan 1998 01:46:24 EST
To: firewalls@GreatCircle.COM
Subject: tocom
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7bit
Organization: AOL (http://www.aol.com)
X-Mailer: Inet_Mail_Out (IMOv11)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I have a tocom 5507 and I was wondering about a replacement

From firewalls-owner  Mon Jan  5 23:44:33 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id XAA03366; Mon, 5 Jan 1998 23:35:11 -0800 (PST)
Received: from relay1.shore.net (relay1.shore.net [192.233.85.129]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id XAA03348 for <firewalls@greatcircle.com>; Mon, 5 Jan 1998 23:35:03 -0800 (PST)
Received: from [198.115.179.81] (vin.shore.net [198.115.179.81])
	by relay1.shore.net (8.8.7/8.8.7) with ESMTP id CAA27133;
	Tue, 6 Jan 1998 02:35:10 -0500 (EST)
Message-Id: <v03007803b0d78aac7c00@[198.115.179.81]>
In-Reply-To: <Pine.SOL.3.91.980105204225.20137I-100000@hq.si.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Date: Tue, 6 Jan 1998 02:35:10 -0500
To: Ming Lu <mlu@hq.si.net>
From: Vin McLellan <vin@shore.net>
Subject: Re: Bank Security
Cc: firewalls@greatcircle.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Ming Lu <mlu@hq.si.net> wrote:
>
>I am looking any info regarding bank security requirements (I know that
>it is a knid of sensetive...:-)) and implementations. It would be greatly
>appreciated if anyone can help on this.

Hi Ming:

	As you doubtless know, US government export policy tries to limit
the relative strength of the crypto used in international commerce so as to
sustain its eavesdropping and signals intelligence capabilities.

	In some product categories, Web-based transactions among them, the
US government allows US vendors to supply strong crypto to banks for
certain types of web-based transactions.  Even then, however, there are
typically constraints on _exactly_ what type of "financial" info can be
strongly encrypted in the "enhanced" SSL channel and on what type of
banking institution is allowed to use those servers. To qualify for access
to strong SSL products from US vendors, an international bank must be
further qualified by a American CA.

	Non-Americans who seek strong crypto for web-based commerce and
online banking transactions might be interested in three rather

1. Fortify: http://www.geocities.com/Eureka/Plaza/6333/

"Fortify is a program that provides world-wide, unconditional, full
strength 128-bit cryptography to users of Netscape Navigator (v3) and
Communicator (v4)."

2. Xpresso and Twister: http://www.brokat.com/uk/solutions.html

"The XPRESSO Security Package=AE consists of the XPRESSO Security Server,
which is integrated into the existing web server environment of an Internet
service
provider, and the Java based XPRESSO Client, which can easily be loaded and
executed in the customer's browser. After loading the XPRESSO Client in the
browser via a standard SSL browser/web server channel, an additional 128 bit
encrypted channel is installed between the XPRESSO Client and the XPRESSO
Security Server. "

("The XPRESSO Security Package=AE is one gateway of the electronic services
delivery platform BROKAT Twister, which forms the basis for most BROKAT
Internet banking solutions. Twister allows the easy and flexible integration=
 of
online transactions in arbitrary system environments.")

3. Stronghold and Safe Passage: http://stronghold.ukweb.com/

"The popular Stronghold server and the new Safe Passage web proxy together
provide
 complete point-to-point 128-bit (or greater) encryption. "

	Surete,

		_Vin

"Cryptography is like literacy in the Dark Ages. Infinitely potent, for
good and ill... yet basically an intellectual construct, an idea, which by
its nature will resist efforts to restrict it to bureaucrats and others who
deem only themselves worthy of such Privilege."
_ A thinking man's Creed for Crypto/ vbm.

 *     Vin McLellan + The Privacy Guild + <vin@shore.net>    *
  53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548



From firewalls-owner  Tue Jan  6 02:14:53 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id CAA16934; Tue, 6 Jan 1998 02:11:22 -0800 (PST)
Received: from mail1.teleport.com (mail1.teleport.com [192.108.254.26]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id CAA16925 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 02:11:16 -0800 (PST)
Received: from dark_corner (ip-pdx35-38.teleport.com [206.163.127.118]) by mail1.teleport.com (8.8.7/8.7.3) with SMTP id CAA25879; Tue, 6 Jan 1998 02:11:27 -0800 (PST)
Message-Id: <199801061011.CAA25879@mail1.teleport.com>
X-Sender: signe@mail.teleport.com
X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0
Date: Tue, 06 Jan 1998 02:11:07 -0800
To: Ken Williams <jkwilli2@unity.ncsu.edu>, fw-list@dart.org
From: Jay Rossiter / Signe <signe@teleport.com>
Subject: Re: land.c hack code
Cc: firewalls@GreatCircle.COM
In-Reply-To: <Pine.SOL.3.96.980105160424.22809A-100000@c00069-100lez.eos
 .ncsu.edu>
References: <7724B134818D357C%7724B134818D357C@dart.org>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 16:07 98/01/05 -0500, Ken Williams wrote:
>you can get a copy of land.c and also the enhanced version, latierra.c,
>from http://www.rootshell.com
>the specific URL's for these two are:
>http://www.rootshell.com/archive-acz9smq232qz7avi9jeacjvd/199711/land.c
>http://www.rootshell.com/archive-acz9smq232qz7avi9jeacjvd/199711/latierra.c

	...One minor problem with giving the URLs for those files out, is that the
directories they are in change at regular intervals.  (As stated on the
rootshell website)

The 'archive-acz9smq232qz7avi9jeacjvd" is just a random alphanumeric string
that it generates.


---
PGP Located on PGP Keyservers, and by fingering 'ammonia@teleport.com'
Key fingerprint =  BF 2D 7E F4 41 A5 FD 30  B1 91 1D BA 35 28 A4 8C
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
GCS/GAT d- s:- a--- C++++ S+++ P+ L++ E---- W+++ N+++ o-- K- w++++ O---- 
M-- V-- PS+ PE Y+ PGP++ t+ 5 X+ R+++ tv-- b+ DI+++ D++ G++ e h++ r+++ z** 




From firewalls-owner  Tue Jan  6 02:29:41 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id CAA18243; Tue, 6 Jan 1998 02:22:04 -0800 (PST)
Received: from promete.tetm.tubitak.gov.tr (promete.tetm.tubitak.gov.tr [193.140.80.8]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id CAA18140 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 02:21:45 -0800 (PST)
Received: from localhost by promete.tetm.tubitak.gov.tr; (5.65/1.1.8.2/27Dec95-0156PM)
	id AA26397; Tue, 6 Jan 1998 12:22:27 +0300
Date: Tue, 6 Jan 1998 12:22:27 +0300 (EET)
From: Levent Yuce <ylevent@promete.tetm.tubitak.gov.tr>
To: firewalls@GreatCircle.COM
Message-Id: <Pine.OSF.3.95.980106121928.26086B-100000@promete.tetm.tubitak.gov.tr>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

I am new in this mailling list ,I am very interested in security ,I would
like to receive some addresses about security and more info that you can
send to my address.

With my best wishes
Levent yuce
ylevent@tubitak.gov.tr


From firewalls-owner  Tue Jan  6 04:14:50 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id EAA00951; Tue, 6 Jan 1998 04:11:13 -0800 (PST)
Received: from server-one ([207.0.213.4]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id EAA00944 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 04:11:08 -0800 (PST)
Received: from [207.0.213.5] by server-one (NTMail 3.02.13) with ESMTP id wa175704 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 08:11:18 -0400
Reply-To: "Esteban Vasquez" <esteban@iamnet.com>
From: "Esteban Vasquez" <esteban@iamnet.com>
To: "BoB Miorelli" <miorelli@pweh.com>, <firewalls@greatcircle.com>
Subject: Re: NT Web proxy server
Date: Tue, 6 Jan 1998 08:11:21 -0400
Message-ID: <01bd1a9c$33439790$05d500cf@administrativo.iamnet.com>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 4.71.1712.3
X-MimeOLE: Produced By Microsoft MimeOLE V4.71.1712.3
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Try wingate at www.wingate.net

-----Original Message-----
From: BoB Miorelli <miorelli@pweh.com>
To: firewalls@greatcircle.com <firewalls@greatcircle.com>
Date: Lunes 5 de Enero de 1998 06:23 PM
Subject: NT Web proxy server


>Hi --
>
>I'm looking for a Web proxy server that does caching for
>my kid's school (K-8).  The computer lab is networked
>to a server which would run the proxy.  The server
>is a Pentium running NT 4.0.  I'm looking for
>recommendations on proxy server software from anyone
>that is running it on NT 4.0 using a dialup-on-demand
>type of setup.  The only proxy servers for NT that
>I am aware of are Microsoft and Netscape, but I'm
>sure there are others.
>
>Any and all comments are welcome.
>
>Thanks.
>
>-->BoB 
>
>
>-->BoB Miorelli, Pratt & Whitney
>miorelli@pweh.com
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
>In theory, theory and practice are the same; 
>in practice they are distinct.


From firewalls-owner  Tue Jan  6 04:59:34 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id EAA02281; Tue, 6 Jan 1998 04:54:19 -0800 (PST)
Received: from mail-syd.atinet.com.au (atinet.com.au [203.35.110.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id EAA02267 for <Firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 04:54:05 -0800 (PST)
Received: from ppp-137.atinet.com.au (ppp-137.atinet.com.au [203.35.110.137]) by mail-syd.atinet.com.au (NTMail 3.02.13) with ESMTP id ba025637 for <Firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 23:53:30 +1100
Received: from beethoven (beethoven.winspace.net [192.168.0.2]) by mozart.winspace.net (8.8.8/8.7.3) with SMTP id WAA23922; Tue, 6 Jan 1998 22:08:49 +1100
From: "Norman Widders" <winspace@atinet.com.au>
Date: Tue, 6 Jan 1998 22:08:59 +1000 (GMT)
Subject: Re: Hardware for seperating LAN from dialouts
To: <Firewalls@GreatCircle.COM>
Reply-To: <winspace@atinet.com.au>
Organization: Paladin Corporation
Message-Id: <Paladin.2.33.884084939-761423411187931.beethoven>
X-Mailer: Paladin IMAP4 Client v2.33
In-Reply-To: <199801052220.JAA13462@magna.com.au>
References: <199801052220.JAA13462@magna.com.au>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Content-Transfer-Encoding: 7BIT
Content-ID: <Paladin.2.33.beethoven.884084939.1>
X-Info: All Things Internet POP3 Server
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

<thread>

hmmm further to seperating the LAN while dialing out with
the modem..

quoting mjr, the only 100% solution is physically cutting
the wire or words to that effect.. which is what the device 
is _supposed_ to do while the unix boxen is connected to 
the (C) Internet.

</thread>

--
wheres my valium ?




From firewalls-owner  Tue Jan  6 05:14:53 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id EAA02282; Tue, 6 Jan 1998 04:54:27 -0800 (PST)
Received: from mail-syd.atinet.com.au (atinet.com.au [203.35.110.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id EAA02268 for <Firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 04:54:10 -0800 (PST)
Received: from ppp-137.atinet.com.au (ppp-137.atinet.com.au [203.35.110.137]) by mail-syd.atinet.com.au (NTMail 3.02.13) with ESMTP id ca025638 for <Firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 23:53:33 +1100
Received: from beethoven (beethoven.winspace.net [192.168.0.2]) by mozart.winspace.net (8.8.8/8.7.3) with SMTP id WAA23861; Tue, 6 Jan 1998 22:02:19 +1100
From: "Norman Widders" <winspace@atinet.com.au>
Date: Tue, 6 Jan 1998 22:02:28 +1000 (GMT)
Subject: Re: Hardware for seperating LAN from dialouts
To: <Firewalls@GreatCircle.COM>
Reply-To: <winspace@atinet.com.au>
Organization: Paladin Corporation
Message-Id: <Paladin.2.33.884084549-328024486547110.beethoven>
X-Mailer: Paladin IMAP4 Client v2.33
In-Reply-To: <199801052220.JAA13462@magna.com.au>
References: <199801052220.JAA13462@magna.com.au>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Content-Transfer-Encoding: 7BIT
Content-ID: <Paladin.2.33.beethoven.884084549.1>
X-Info: All Things Internet POP3 Server
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

running win95 ? no
routing/forwarding ? no

The modem is on a BSD box that dials out, whether it has
routing/forwarding or not is not the issue.. 

The issue is that the unix box _if_ it was taken over
could be used to launch attacks against the LAN and internal
servers... another scenario mentioned is that if the box
was comprimised whats to stop the attacker enabling routing/forwarding,
lowering all defences, and then forcing a reboot... next time it dials 
out.. wham ! 

A hardware device that physically disconnects the rj45 while the modem
is alive sounds nice... ymmv

Who the hell gives users modems on their desk anyway, shoot first
ask questions later, imho.

--
wheres my valium ?





From firewalls-owner  Tue Jan  6 05:29:49 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id EAA02244; Tue, 6 Jan 1998 04:53:52 -0800 (PST)
Received: from mail-gw1.fmso.navy.mil (mail-gw1.fmso.navy.mil [138.155.40.24]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id EAA02217 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 04:53:43 -0800 (PST)
Received: from 138.155.40.96 (moose.fmso.navy.mil [138.155.40.96]) by mail-gw1.fmso.navy.mil (8.8.5/8.6.12) with ESMTP id HAA21201 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 07:06:44 -0500
Received: from fmso.navy.mil (unverified [138.155.40.100]) by 138.155.40.96
 (Integralis SMTPRS 2.04) with SMTP id <B0000017622@138.155.40.96>;
 Tue, 06 Jan 1998 07:49:06 -0500
Received: from ccMail by fmso.navy.mil
  (IMA Internet Exchange 2.12 Enterprise) id 00062295; Tue, 6 Jan 1998 07:55:41 -0500
MIME-Version: 1.0
Date: Tue, 6 Jan 1998 07:49:23 -0500
Message-Id: <00062295.001261@mech.disa.mil>
From: RANDAL_LATHROP@mech.disa.mil (RANDAL LATHROP)
Subject: Re[2]: Hardware for seperating LAN from dialouts
To: Ian KC Worrell <ian@sunbeach.net>, Ian Krieger <iank@magna.com.au>
Cc: firewalls@greatcircle.com
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Content-Description: cc:Mail note part
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

     With Windows 95 (even WfWg 3.11) you can have multiple network 
     interfaces each with a separate IP address and IP packets will be 
     routed properly.  For this to work, you must set up a static routing 
     table.  For the situation described below you can reach both the LAN 
     through the network card and the Internet through the modem 
     simultaneously.  If the LAN does not have any connectivity to the 
     Internet, the default router would be out through the modem 
     connection.  Static routes must be set up for IP addresses on the LAN 
     that are on different network segments than your network card.  
     Windows 95 will not learn dynamic routes and it will not forward IP 
     packets.  If you set the "Enable IP Routing" checkbox in TCP/IP 
     properties on a Windows 95 system, you will lock-up it when it is 
     restarted (back up your registry before doing this).


______________________________ Reply Separator _________________________________
Subject: Re: Hardware for seperating LAN from dialouts
Author:  Ian Krieger <iank@magna.com.au> at internet-emh1
Date:    1/6/98 9:20 AM


Sorry I may be mistaken but most users would be running windows 95 on their 
laptops and desktops in offices, sorry guys, Win95 dosen't support IP 
routing,like there's a supprise, hence you would not need to overly worry 
about having to sever you network connection when wanting to retrieve mail 
every once and again.
     
If I have misunderstood the question / query, well hey I'm only human.
     
     
Ian.
     
At 11:05 AM 1/5/98 -0400, you wrote:
>I use my lap top in the office, and it has both a network card and a modem 
>in it.  As my office network is on a different IP address range that my 
>Internet Connection, I can actually have both connected at the same time! 
>
>There seems to be no problem with the routing at all! 
>
>Ian
>
>At 10:10 AM 1/5/98 +1000, Norman Widders wrote:
>>Just wondered if anybody has used those hardware devices 
>>that disable LAN connections while a modem dials out 
>>to the Internet.
>>
>>It detects when the modem is active thus severing the 
>>link to the LAN physically and reconnects the LAN 
>>once the modem has disconnected from the LAN. 
>>
>>The device is connected to both the modem and LAN and 
>>sounds good in theory and I am just wondering
>>what other peoples experience with these are, at $85 
>>it is an ideal solution for small organisations 
>>that just want to poll their ISP a few times a day 
>>for email.
>>
>>--
>>Wheres my valium ?
>>
>>
>>
>>
>
>
>
---------------------------------------------------------------- 
Ian W Krieger                                   IanK@Magna.com.au
     
"qlm tera'ngan!" - Translated from Klingon "Attention Earther!"
     

From firewalls-owner  Tue Jan  6 05:44:55 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id EAA02432; Tue, 6 Jan 1998 04:58:30 -0800 (PST)
Received: from mail-gw1.fmso.navy.mil (mail-gw1.fmso.navy.mil [138.155.40.24]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id EAA02421 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 04:58:23 -0800 (PST)
Received: from 138.155.40.96 (moose.fmso.navy.mil [138.155.40.96]) by mail-gw1.fmso.navy.mil (8.8.5/8.6.12) with ESMTP id HAA21409 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 07:11:26 -0500
Received: from fmso.navy.mil (unverified [138.155.40.100]) by 138.155.40.96
 (Integralis SMTPRS 2.04) with SMTP id <B0000017636@138.155.40.96>;
 Tue, 06 Jan 1998 07:53:06 -0500
Received: from ccMail by fmso.navy.mil
  (IMA Internet Exchange 2.12 Enterprise) id 000622BB; Tue, 6 Jan 1998 07:59:18 -0500
MIME-Version: 1.0
Date: Tue, 6 Jan 1998 07:52:57 -0500
Message-Id: <000622BB.001261@mech.disa.mil>
From: RANDAL_LATHROP@mech.disa.mil (RANDAL LATHROP)
Subject: Re[2]: Hardware for seperating LAN from dialouts
To: iank@magna.com.au, "Ryan Russell"<ryanr@sybase.com>
Cc: ian@sunbeach.net, firewalls@greatcircle.com
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Content-Description: cc:Mail note part
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

     But this is true only if you are running a service (daemon) that can 
     be exploited.  If you do not share any resources on your system, are 
     not running FTPD, TELNETD, or HTTPD, what else is running that can be 
     subverted for illicit use?
     
     
     Randal


______________________________ Reply Separator _________________________________
Subject: Re: Hardware for seperating LAN from dialouts
Author:  "Ryan Russell"<ryanr@sybase.com> at internet-emh1
Date:    1/5/98 4:00 PM


     
Actually, Win95 DOES support routing.  And, I'm told it 
even works in OSR2.
     
The point is, it doesn't need to route.  If you're connected to 
the Internet & your LAN at the same time, and I break into
your machine (via the Internet,) I now have control of a machine on 
your LAN.
     
It's against MY company policy... as the saying goes, 
your paranoia level may vary..
     
                    Ryan
     
     
     
     
     
iank@magna.com.au on 01/05/98 02:20:58 PM
     
To:   ian@sunbeach.net
cc:   firewalls@GreatCircle.COM (bcc: Ryan Russell/SYBASE) 
Subject:  Re: Hardware for seperating LAN from dialouts
     
     
     
     
Sorry I may be mistaken but most users would be running windows 95 on their 
laptops and desktops in offices, sorry guys, Win95 dosen't support IP 
routing,like there's a supprise, hence you would not need to overly worry 
about having to sever you network connection when wanting to retrieve mail 
every once and again.
If I have misunderstood the question / query, well hey I'm only human.
     
Ian.
At 11:05 AM 1/5/98 -0400, you wrote:
>I use my lap top in the office, and it has both a network card and a modem 
>in it.  As my office network is on a different IP address range that my 
>Internet Connection, I can actually have both connected at the same time! 
>
>There seems to be no problem with the routing at all! 
>
>Ian
>
>At 10:10 AM 1/5/98 +1000, Norman Widders wrote:
>>Just wondered if anybody has used those hardware devices 
>>that disable LAN connections while a modem dials out 
>>to the Internet.
>>
>>It detects when the modem is active thus severing the 
>>link to the LAN physically and reconnects the LAN 
>>once the modem has disconnected from the LAN.
>>
>>The device is connected to both the modem and LAN and 
>>sounds good in theory and I am just wondering
>>what other peoples experience with these are, at $85 
>>it is an ideal solution for small organisations 
>>that just want to poll their ISP a few times a day 
>>for email.
>>
>>--
>>Wheres my valium ?
>>
>>
>>
>>
>
>
>
---------------------------------------------------------------- 
Ian W Krieger                      IanK@Magna.com.au
"qlm tera'ngan!" - Translated from Klingon "Attention Earther!"
     
     
     
     
     

From firewalls-owner  Tue Jan  6 07:01:09 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id FAA09711; Tue, 6 Jan 1998 05:41:57 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id FAA09693 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 05:41:49 -0800 (PST)
Received: from m6.sprynet.com by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-970426)
	id FAA20037; Tue, 6 Jan 1998 05:40:35 -0800 (PST)
Received: from zepher (hdn88-048.hil.compuserve.com [206.175.98.48]) by m6.sprynet.com (8.6.12/8.6.12) with SMTP id FAA25976; Tue, 6 Jan 1998 05:41:25 -0800
Message-Id: <3.0.3.32.19980106084416.006a2dd8@m6.sprynet.com>
X-Sender: jsk347@m6.sprynet.com
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Tue, 06 Jan 1998 08:44:16 -0500
To: Kerry Jones <kjones@aims.gov.au>, firewalls@GreatCircle.COM
From: Steve Kruse <jsk347@sprynet.com>
Subject: Re: DNS on firewall??
In-Reply-To: <34B1C8DC.2BE94D49@aims.gov.au>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 04:02 PM 1/6/98 +1000, Kerry Jones wrote:
>Hi,
>
>Simple question. Is it a good idea to run a DNS server on a
>Firewall?????
>
>     ((((stuff deleted)))
>--
>Kerry Jones
>kjones@aims.gov.au
>

Kerry:

Speaking "as a general rule", it would be far better to put your internal 
DNS on your private net and NOT on the firewall.  Let the firewall be a 
firewall...not an application server, and that includes DNS.  There are, I 
believe, some firewalls out there that have a "secure(???)" version of DNS 
that is built into them and for that, I suspose it would be OK, but unless 
you have one of those, I would not put it on.  Far better to err on the side 
of safety that to save a little bit of money for the cost of a PC to run your 
DNS behind the firewall.  Once you put your internal DNS up, some simple rules
will allow the DNS traffic to get through.

My US$.02...your milage may vary.

Steve Kruse
Milkyway Networks

From firewalls-owner  Tue Jan  6 07:31:09 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA15416; Tue, 6 Jan 1998 06:07:38 -0800 (PST)
Received: from gargoyle.clark.net (gargoyle.clark.net [168.143.0.250]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id GAA15239 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 06:06:58 -0800 (PST)
Received: (qmail 24606 invoked by uid 500); 6 Jan 1998 14:13:13 -0000
Date: Tue, 6 Jan 1998 09:13:12 -0500 (EST)
From: "Paul D. Robertson" <proberts@clark.net>
X-Sender: proberts@gargoyle
To: RANDAL LATHROP <RANDAL_LATHROP@mech.disa.mil>
cc: Ian KC Worrell <ian@sunbeach.net>, Ian Krieger <iank@magna.com.au>,
        firewalls@GreatCircle.COM
Subject: Re: Re[2]: Hardware for seperating LAN from dialouts
In-Reply-To: <00062295.001261@mech.disa.mil>
Message-ID: <Pine.LNX.3.91.980106090838.24557B-100000@gargoyle>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Tue, 6 Jan 1998, RANDAL LATHROP wrote:

>      With Windows 95 (even WfWg 3.11) you can have multiple network 
>      interfaces each with a separate IP address and IP packets will be 
>      routed properly.  For this to work, you must set up a static routing 
>      table.  For the situation described below you can reach both the LAN 

*Or* you need to have a program that does routing.  The Win95 original beta
included such code.  I doubt that it would that difficult to hack up 
something either.  

>      Windows 95 will not learn dynamic routes and it will not forward IP 
>      packets.  If you set the "Enable IP Routing" checkbox in TCP/IP 
                ^ By default, as shipped.  

Unless you have total control over the machine configuration, especially 
during Internet usage, it is best not to rely on its configuration for 
security.  

Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
proberts@clark.net      which may have no basis whatsoever in fact."
                                                                     PSB#9280


From firewalls-owner  Tue Jan  6 07:58:04 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id FAA08867; Tue, 6 Jan 1998 05:37:52 -0800 (PST)
Received: from mailserver1.mdc.com (MAILSERVER1.LGB.CAL.BOEING.COM [129.200.140.50]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id FAA08820 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 05:37:40 -0800 (PST)
Received: by MAILSERVER1.MDC.COM with Internet Mail Service (5.0.1458.49)
	id <Z6K5SX58>; Tue, 6 Jan 1998 07:39:49 -0600
Message-ID: <CE0690979441D111B55D0000F840E2B908171D@MAILSERVER1.MDC.COM>
From: "Waegner.Rick" <RWaegner@hou.mdc.com>
To: firewalls@GreatCircle.COM, "'Franklin R. Jones'" <grat@frii.com>
Subject: RE: FW-1 3.0 and Solaris 2.6 ok?
Date: Tue, 6 Jan 1998 07:39:47 -0600
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1458.49)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

We are currently implementing FW-1 v3.0 on a solaris 2.6 platform and
have had  problems. Yes, Solaris 2.6 is "supported" but not by the FW-1
package that will be dilivered to you, you must download all of the
packages that make up the "FW-1 V3.0 b" (DES, FW-1, Motif Intfc,
etc...). If you install 3.0 on Solaris 2.6, the machine will get stuck
in a reboot cycle that can only be fixed with a reload of the OS. FW-1
V3.0 will mangle /etc/rcS.d/S30rootusr.sh upon install and reboot. Once
this "bug" is fixed with the downloaded 3.0b, it seems to be very
stable.
Rick Waegner

The Boeing Company
UNIX Sysadmin
richard.a.waegner@boeing.com
281.283.5485

> ----------
> From: 	Franklin R. Jones
> Sent: 	Monday, January 5, 1998 15:00
> To: 	firewalls@GreatCircle.COM
> Subject: 	Re: FW-1 3.0 and Solaris 2.6 ok?
> 
> Sergio Bollini wrote:
> 
> > Does anybody know is FW-1 3.0b will work correctly on Solaris 2.6?
> Is
> > there any issues or unsolved problems?
> > TIA
> 
> 	No hands on as of yet, but 2.6 is listed as "supported" OS
> rev for V3. I haven't run into any problems application-wise upgrading
> to 2.6 from 2.5.x, so my feelings are that it would be a reliable
> config. There is a recommeded patch cluster out for 2.6 which includes
> several (8 or 9) security patches for various things and I would
> recommend installing the cluster.
> 
> fj..
> 

From firewalls-owner  Tue Jan  6 08:00:22 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA18264; Tue, 6 Jan 1998 06:20:18 -0800 (PST)
Received: from gargoyle.clark.net (gargoyle.clark.net [168.143.0.250]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id GAA18251 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 06:20:12 -0800 (PST)
Received: (qmail 24644 invoked by uid 500); 6 Jan 1998 14:26:32 -0000
Date: Tue, 6 Jan 1998 09:26:32 -0500 (EST)
From: "Paul D. Robertson" <proberts@clark.net>
X-Sender: proberts@gargoyle
To: RANDAL LATHROP <RANDAL_LATHROP@mech.disa.mil>
cc: iank@magna.com.au, Ryan Russell <ryanr@sybase.com>, ian@sunbeach.net,
        firewalls@GreatCircle.COM
Subject: Re: Re[2]: Hardware for seperating LAN from dialouts
In-Reply-To: <000622BB.001261@mech.disa.mil>
Message-ID: <Pine.LNX.3.91.980106091410.24557C-100000@gargoyle>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Tue, 6 Jan 1998, RANDAL LATHROP wrote:

>      But this is true only if you are running a service (daemon) that can 
>      be exploited.  If you do not share any resources on your system, are 

Or a client that can be exploited, or if portions of the OS can be 
exploited...

If you've got a few thousand users, and you have enough control over the 
OS, stack, clients, and configuration, as well as a way to audit that, 
then you're doing well enough to probably not worry about it.  For the 
real world, it's *trivially* easy to get a user to load (a) a demo for 
finance/mailroom/logistics/pick_a_target, or (b) a game, or extension to 
Quake, or (c) New version of a browser, E-mail client, or IRC program.  
If it's done right, most of them will get the IS people to lend them a 
modem for the duration of the attack... er demo.

How many places go through testing new Internet clients on a test bed 
with modems, LAN cards, and record and decode the traffic?  How many 
places have enough control over their user population to specify client 
versions, and distribution channels?  Probably about as many who run 
virus suscptable systems with no scanners, no protection, and who get 
zero incidents.  Next time you see a virus, ask yourself what would have 
happened if that was a sleeping trojan... 

Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
proberts@clark.net      which may have no basis whatsoever in fact."
                                                                     PSB#9280


From firewalls-owner  Tue Jan  6 08:50:01 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA09136; Tue, 6 Jan 1998 08:08:38 -0800 (PST)
Received: from relay6.UU.NET (relay6.UU.NET [192.48.96.16]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id IAA09123 for <firewalls@GreatCircle.com>; Tue, 6 Jan 1998 08:08:32 -0800 (PST)
Received: from maestro.Maestro.COM by relay6.UU.NET with SMTP 
	(peer crosschecked as: [198.102.66.11])
	id QQdxee25252; Tue, 6 Jan 1998 11:08:50 -0500 (EST)
Received: from localhost 
	by maestro.Maestro.COM (4.1/MAESTRO-0.1/07-03-93)
	id AA04699; Tue, 6 Jan 98 11:05:03 EST
Date: Tue, 6 Jan 1998 11:05:03 -0500 (EST)
From: Sick Puppy <sikpuppy@maestro.maestro.com>
To: firewalls@GreatCircle.com
Subject: Wannabe needs a good book
Message-Id: <Pine.SUN.3.96.980106105930.4657A-100000@maestro.maestro.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Over the past few years our educational research has provided us with a
great deal of information on Internet services, operating systems and
various protocols.  However, all of it is very narrowly focused and
platform specific.  One of our wannabe's, ChewYou, (oriental as the name
implies), need a good top down introduction to networking.  Sorry to say
we have nothing like that.  Can someone please suggest a good book on the
general topic of networking, with some emphasis on TCP/IP, that we can
steal?
                                                 SP, tCED


From firewalls-owner  Tue Jan  6 09:01:15 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id FAA09492; Tue, 6 Jan 1998 05:40:30 -0800 (PST)
Received: from maildeliver0.tiac.net (maildeliver0.tiac.net [199.0.65.19]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id FAA09448 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 05:40:17 -0800 (PST)
Received: from www.hollyfeld.org (root@dns.hollyfeld.org [204.130.199.1]) by maildeliver0.tiac.net (8.8.7/8.8) with ESMTP id IAA15661; Tue, 6 Jan 1998 08:40:34 -0500 (EST)
Received: from www.hollyfeld.org (www.hollyfeld.org [204.130.199.143])
          by www.hollyfeld.org (8.8.4/8.8.4) with SMTP
	  id IAA17373; Tue, 6 Jan 1998 08:40:55 -0500
Date: Tue, 6 Jan 1998 08:40:54 -0500 (EST)
From: Daniel Garcia <dgarcia@hollyfeld.org>
To: MYundt <MYundt@aol.com>
cc: firewalls@GreatCircle.COM
Subject: Re: tocom
In-Reply-To: <6dda8f0f.34b1d341@aol.com>
Message-ID: <Pine.LNX.3.95.980106084040.30838A-100000@www.hollyfeld.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Tue, 6 Jan 1998, MYundt wrote:
> I have a tocom 5507 and I was wondering about a replacement

And you asked about this on the firewalls list because....

--Dg


From firewalls-owner  Tue Jan  6 09:02:27 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA19212; Tue, 6 Jan 1998 08:53:43 -0800 (PST)
Received: from starbase.tos.net (starbase.tos.net [208.137.47.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id IAA19155 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 08:53:11 -0800 (PST)
Received: (from mail@localhost)
          by starbase.tos.net (8.8.4/8.8.4)
	  id KAA28389 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 10:53:56 -0600
Message-Id: <199801061653.KAA28389@starbase.tos.net>
Received: from unknown(172.16.1.147) by starbase.tos.net via smap (V1.3)
	id sma028385; Tue Jan  6 10:53:46 1998
X-Sender: macgyver@smtp.tos.net
X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0
Date: Tue, 06 Jan 1998 10:50:13 -0600
To: Firewalls Mailing List <firewalls@greatcircle.com>
From: MacGyver <macgyver@tos.net>
Subject: Re: Bank Security
In-Reply-To: <v03007803b0d78aac7c00@[198.115.179.81]>
References: <Pine.SOL.3.91.980105204225.20137I-100000@hq.si.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 02:35 AM 1/6/98 -0500, you wrote:
>Ming Lu <mlu@hq.si.net> wrote:
>>
>>I am looking any info regarding bank security requirements (I know that
>>it is a knid of sensetive...:-)) and implementations. It would be greatly
>>appreciated if anyone can help on this.
>

Another software solution you might wish to consider:


http://www.datafellows.com

They provide high-grade crypto solutions both in the US and abroad.  They
offer a web-server add-on of sorts that allows you to employ encryption
levels up to 2048 bit.  Of course you pay for this flexibility with the
high prices...



From firewalls-owner  Tue Jan  6 09:11:21 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA19913; Tue, 6 Jan 1998 08:58:09 -0800 (PST)
Received: from starbase.tos.net (starbase.tos.net [208.137.47.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id IAA19839 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 08:57:51 -0800 (PST)
Received: (from mail@localhost)
          by starbase.tos.net (8.8.4/8.8.4)
	  id KAA28419 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 10:58:56 -0600
Message-Id: <199801061658.KAA28419@starbase.tos.net>
Received: from unknown(172.16.1.147) by starbase.tos.net via smap (V1.3)
	id sma028417; Tue Jan  6 10:58:26 1998
X-Sender: macgyver@smtp.tos.net
X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0
Date: Tue, 06 Jan 1998 10:54:53 -0600
To: Firewalls Mailing List <firewalls@greatcircle.com>
From: MacGyver <macgyver@tos.net>
Subject: Stateful Inspection Anyone?
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi folks,

I've been wondering this for a while, but just haven't gotten around to
asking anyone yet:

Checkpoint's Firewall-1 has a feature known as "stateful inspection" which
they tout as the end-all and be-all of packet-filtering and inspection.
Anyone had any experience in using this feature or have any thoughts
regarding stateful inspection?  How large of a performance impact is there
when stateful inspection is enabled?  Are the gains worth the added load?

Hope this spurs some interesting discussion.


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        ^               Habeeb J. Dihu
     -'   `-            Managing Senior Technologist
   " '     ` "          Cirrus Technologies
 "  '       `  "        
"  '      .  `  "                  
"  '    .' ` `  "       'I don't believe in the no-win scenario'
 " `   '    `' "           -- Captain James T. Kirk,  Star Trek II: TWK
   `  ' _  _ '          'There is an old Vulcan proverb, `Only Nixon
    '                    could go to China.`'
                           -- Captain Spock, Star Trek VI: TUC
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



From firewalls-owner  Tue Jan  6 09:13:31 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA05013; Tue, 6 Jan 1998 07:43:56 -0800 (PST)
Received: from mco.edu (mco004.mco.edu [136.247.10.56]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id HAA04998 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 07:43:49 -0800 (PST)
Received: from mco-Message_Server by mco.edu
	with Novell_GroupWise; Tue, 06 Jan 1998 10:42:39 -0500
Message-Id: <s4b20a9f.044@mco.edu>
X-Mailer: Novell GroupWise 4.1
Date: Tue, 06 Jan 1998 10:42:30 -0500
From: Jeff Zarend <jzarend@mco.edu>
To: firewalls@greatcircle.com
Subject: AHTTPD.LOG filling up
Mime-Version: 1.0
Content-Type: text/plain
Content-Disposition: inline
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I'm having a problem with Firewall-1's AHTTPD.LOG looping & filling up the
system
disk drive.  This is on NT 4.0.  Is or has anyone else experienced this?


Jeff Zarend
Systems Manager
Medical College of Ohio
jzarend@mco.edu
 

From firewalls-owner  Tue Jan  6 09:15:39 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA04376; Tue, 6 Jan 1998 07:40:19 -0800 (PST)
Received: from hq.si.net (hq.si.net [192.156.192.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id HAA04317 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 07:40:05 -0800 (PST)
Received: from hq.si.net (hq [192.156.192.10]) by hq.si.net (8.8.5/8.7.3) with SMTP id KAA29131; Tue, 6 Jan 1998 10:42:08 -0500 (EST)
Date: Tue, 6 Jan 1998 10:42:08 -0500 (EST)
From: Ming Lu <mlu@hq.si.net>
To: Kerry Jones <kjones@aims.gov.au>
cc: firewalls@GreatCircle.COM
Subject: Re: DNS on firewall??
In-Reply-To: <34B1C8DC.2BE94D49@aims.gov.au>
Message-ID: <Pine.SOL.3.91.980106102255.28649C-100000@hq.si.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


If you don't use split DNS, I don't see the real difference between
puting both dns servers on DMZ and one on firewall, another in the
DMZ. Actually put primary one on the firewall and put the secondary
on DMZ would be better choice than both of them on DMZ. 

_ming

On Tue, 6 Jan 1998, Kerry Jones wrote:

> Hi,
> 
> Simple question. Is it a good idea to run a DNS server on a
> Firewall?????
> 
> AUNIC require at least 2 DNS servers, so I am trying to decide where to
> configure the 2nd DNS server for our domain (Primary one is currently on
> the DMZ). Will putting the secondary DNS on the firewall create a
> security hole in the Firewall which would best be avoided????????
> Is it acceptable (secure) to put the DNS and other services (e.g.
> http/ftp) on the Firewall??
> 
> What do you think??
> What are your opinions??
> 
> I have a fairly standard setup as follows;
> 
> Internet
>     |
>  router
>     |
>  firewall - dmz (1 machine: http/ftp/dns)
>       |
>   internal network.
> 
> --
> Kerry Jones
> kjones@aims.gov.au
> 
> 

From firewalls-owner  Tue Jan  6 09:15:50 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA21714; Tue, 6 Jan 1998 09:07:21 -0800 (PST)
Received: from hq.si.net (hq.si.net [192.156.192.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA21698 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 09:07:15 -0800 (PST)
Received: from hq.si.net (hq [192.156.192.10]) by hq.si.net (8.8.5/8.7.3) with SMTP id MAA00208; Tue, 6 Jan 1998 12:09:18 -0500 (EST)
Date: Tue, 6 Jan 1998 12:09:18 -0500 (EST)
From: Ming Lu <mlu@hq.si.net>
To: BoB Miorelli <miorelli@pweh.com>
cc: firewalls@GreatCircle.COM
Subject: Re: NT Web proxy server
In-Reply-To: <34b1435f0.1464@clbdev2.eh.pweh.com>
Message-ID: <Pine.SOL.3.91.980106113432.29472A-100000@hq.si.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


You can use Squid, which is free and VERY easy to set up;
http://squid.nlant.net/Squid. It is VERY FAST. Sun's new web cache
server based on this code (because of its performance). OS plateform
you can use either Linux (free) or solaris x86 (take look at
http://www.standishgroup.com/syst.html). As to the hardware, you can
use 486 or better with at leat 64 M RAM; At leat 2G hard disk space (
it really depends on  a lot of other factors, such as cache expiration
time, etc.) just for cache itself (1 G would be more than enough for
UNIX OS, unless you would like to do something else on the same machine).
As to the 04/19/97, squid had been ported to OS/2 Warp platform. I am 
sure that someone may also have ported it to NT, if NT is really you favored
platform...:-). drop a mail to squid-users@nlanr.net, someone will help
you out on this. If you need help on UNIX plateforms, I would be more than
glad to help.

_ming

On Mon, 5 Jan 1998, BoB Miorelli wrote:

> Hi --
> 
> I'm looking for a Web proxy server that does caching for
> my kid's school (K-8).  The computer lab is networked
> to a server which would run the proxy.  The server
> is a Pentium running NT 4.0.  I'm looking for
> recommendations on proxy server software from anyone
> that is running it on NT 4.0 using a dialup-on-demand
> type of setup.  The only proxy servers for NT that
> I am aware of are Microsoft and Netscape, but I'm
> sure there are others.
> 
> Any and all comments are welcome.
> 
> Thanks.
> 
> -->BoB 
> 
> 
> -->BoB Miorelli, Pratt & Whitney
> miorelli@pweh.com
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
> In theory, theory and practice are the same; 
> in practice they are distinct.
> 

From firewalls-owner  Tue Jan  6 09:30:04 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA08260; Tue, 6 Jan 1998 08:03:51 -0800 (PST)
Received: from mtigwc04.worldnet.att.net (mtigwc04.worldnet.att.net [204.127.131.33]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id IAA08229 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 08:03:42 -0800 (PST)
From: mht@clark.net
Received: from highlander ([12.68.19.215]) by mtigwc04.worldnet.att.net
          (post.office MTA v2.0 0613 ) with SMTP id AAA24167;
          Tue, 6 Jan 1998 16:04:01 +0000
Message-Id: <3.0.3.32.19980106110133.03931100@pop3.clark.net>
X-Sender: mht@pop3.clark.net
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Tue, 06 Jan 1998 11:01:33 -0500
To: "Steve Jackson Brown" <sjbrown@bellsouth.net>, <firewalls@GreatCircle.COM>
Subject: Re: SessionWall 3 release 2 vs Network Flight Recorder??
In-Reply-To: <199801060410.XAA10773@mail.atl.bellsouth.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Another article that needs mentioning is Network Magazine October, 1997
www.network-mag.com "Detecting Network Intruders"  :)



At 11:04 PM 1/5/98 -0500, Steve Jackson Brown wrote:
>
>
>
>> Yes, I tend to agree with you on that.  RealSecure is a very powerful 
>> tool, but it requires a clear understanding in what options you 
>> choose in a particular environment when using it..
>
>Here are two Abirnet vs. RealSecure comparisions I found on ww.zdnet.com:
>
>http://www.zdnet.com/pcweek/reviews/0421/21wall.html
>and
>http://www.zdnet.com/pcweek/reviews/0929/29wall.html
>
>It looks to me from the review that one is a swiss-army knife that watches
>all kind of network
>issues and one is optimized for network security. Read the reviews to form
>your own opinion. In
>searching for comparisions, the most recent Top Technology Picks for '97 of
>PC Week was IDS technology:
>   
>http://www.zdnet.com/pcweek/sr/1222/22netb.html
>
>So far now, 2 magazines picked IDS as a top technology released in 1997. It
>will be interesting to find
>out what new technology is going to be released in 1998.  Anyone know of
>any reviews of other IDS 
>systems?
>
>> Overall, I wish one of the local trades magazines would initiate a 
>> Consumer Report comparison of the current IDS tools  or "clue-
>> gathering tools" available and new ones that are emerging...  (HINT, 
>> HINT)
>
>Is NFR really an intrusion detection system?  From the web site,
>www.nfr.com, 
>
>"NFRs provide valuable information about the growth of your network, its
>usage patterns, bottlenecks and potential mis-configurations, and more.
>Imagine the usefulness of being able to learn how any aspect of your
>network has changed over time! NFR also lets you store and browse data you
>want to gather as it passes through or within your network."
>
>This description seems like performance monitoring and network traffic
>policy monitoring.  It's probably possible someone could build an intrusion
>detection system with NFR. NFR itself does not seem like
>an intrusion detection package. 
>
>Maybe CSI or NCSA could do the "Consumer Reports" of IDS tools.  


>
>

From firewalls-owner  Tue Jan  6 09:45:15 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA03512; Tue, 6 Jan 1998 07:35:13 -0800 (PST)
Received: from gate.eds.de (gate.eds.de [204.71.114.5]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id HAA03462 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 07:34:49 -0800 (PST)
Received: from online.ols.de.eds.com (ep160768.ols.de.eds.com) by gate.eds.de with SMTP id AA14749
  (InterLock SMTP Gateway 3.0 for <firewalls@greatcircle.com>);
  Tue, 6 Jan 1998 15:34:18 GMT
Received: from ep161081 (ep161081.ols.de.eds.com [134.46.190.55])
	by online.ols.de.eds.com (8.8.8/8.8.8) with SMTP id RAA26818;
	Tue, 6 Jan 1998 17:38:46 +0100
Message-Id: <3.0.3.32.19980106163903.0091b100@mail.ols.de.eds.com>
X-Sender: bzwrdw@mail.ols.de.eds.com
X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.3 (32)
Date: Tue, 06 Jan 1998 16:39:03 +0100
To: RANDAL_LATHROP@mech.disa.mil (RANDAL LATHROP)
From: Oliver Kubis <oliverk@ols-eds.de>
Subject: Re: Re[2]: Hardware for seperating LAN from dialouts
Cc: firewalls@greatcircle.com, ryanr@sybase.com
In-Reply-To: <000622BB.001261@mech.disa.mil>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

IMHO, dangers differ from the type of operating system and services of the
machine the modem is attached to. A unix, carrying a number of additional
services, might be more vulnerable to attack than a 'simple' standard PC,
not running any of those services.

What happens to services on connected systems (PC is connected to a LAN,
which might have a ftp server somewhere...) - do you think the PC with ip
forwarding/routing could be an entry point to attack other computers on the
attached network?

Apart from any services being used for illicit use, could other risks arise
from people sniffing on network traffic that passes the exposed computer?
Do you think that's possible?

-- Oliver

PS: A fuzzy search of the firewall archives (at
http://www.nexial.nl/cgi-bin/firewalls) returned some interesting hints on
the potential dangers of dial-out connections with parallel LAN connection
- I searched for "forwarding dial modems" and got some good results.

---------------
At 07:52 06.01.98 -0500, you wrote:
>     But this is true only if you are running a service (daemon) that can 
>     be exploited.  If you do not share any resources on your system, are 
>     not running FTPD, TELNETD, or HTTPD, what else is running that can be 
>     subverted for illicit use?
>     
>     
>     Randal
>
>
>______________________________ Reply Separator
_________________________________
>Subject: Re: Hardware for seperating LAN from dialouts
>Author:  "Ryan Russell"<ryanr@sybase.com> at internet-emh1
>Date:    1/5/98 4:00 PM
>
>
>     
>Actually, Win95 DOES support routing.  And, I'm told it 
>even works in OSR2.
>     
>The point is, it doesn't need to route.  If you're connected to 
>the Internet & your LAN at the same time, and I break into
>your machine (via the Internet,) I now have control of a machine on 
>your LAN.
>     
>It's against MY company policy... as the saying goes, 
>your paranoia level may vary..
>     
>                    Ryan
>     
>     
>     
>     
>     
>iank@magna.com.au on 01/05/98 02:20:58 PM
>     
>To:   ian@sunbeach.net
>cc:   firewalls@GreatCircle.COM (bcc: Ryan Russell/SYBASE) 
>Subject:  Re: Hardware for seperating LAN from dialouts
>     
>     
>     
>     
>Sorry I may be mistaken but most users would be running windows 95 on their 
>laptops and desktops in offices, sorry guys, Win95 dosen't support IP 
>routing,like there's a supprise, hence you would not need to overly worry 
>about having to sever you network connection when wanting to retrieve mail 
>every once and again.
>If I have misunderstood the question / query, well hey I'm only human.
>     
>Ian.
>At 11:05 AM 1/5/98 -0400, you wrote:
>>I use my lap top in the office, and it has both a network card and a modem 
>>in it.  As my office network is on a different IP address range that my 
>>Internet Connection, I can actually have both connected at the same time! 
>>
>>There seems to be no problem with the routing at all! 
>>
>>Ian
>>
>>At 10:10 AM 1/5/98 +1000, Norman Widders wrote:
>>>Just wondered if anybody has used those hardware devices 
>>>that disable LAN connections while a modem dials out 
>>>to the Internet.
>>>
>>>It detects when the modem is active thus severing the 
>>>link to the LAN physically and reconnects the LAN 
>>>once the modem has disconnected from the LAN.
>>>
>>>The device is connected to both the modem and LAN and 
>>>sounds good in theory and I am just wondering
>>>what other peoples experience with these are, at $85 
>>>it is an ideal solution for small organisations 
>>>that just want to poll their ISP a few times a day 
>>>for email.
>>>
>>>--
>>>Wheres my valium ?
>>>
>>>
>>>
>>>
>>
>>
>>
>---------------------------------------------------------------- 
>Ian W Krieger                      IanK@Magna.com.au
>"qlm tera'ngan!" - Translated from Klingon "Attention Earther!"


--
Oliver Kubis
EDS Electronic Data Systems Industrien (Deutschland) GmbH
Phone +49-6142-80-2942 Fax +49-6142-80-1755 Email oliverk@ols-eds.de
PGP key fingerprint = C1 ED 3E E0 95 B5 05 28  A4 A4 E5 72 33 A7 20 B0

"It's a small world, unless you have to clean it." - Roger Wilco

From firewalls-owner  Tue Jan  6 11:57:07 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA22453; Tue, 6 Jan 1998 11:33:22 -0800 (PST)
Received: from mailserver1.mdc.com (MAILSERVER1.LGB.CAL.BOEING.COM [129.200.140.50]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id LAA22356 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 11:33:00 -0800 (PST)
Received: by MAILSERVER1.MDC.COM with Internet Mail Service (5.0.1458.49)
	id <Z6K5SZ11>; Tue, 6 Jan 1998 13:35:09 -0600
Message-ID: <CE0690979441D111B55D0000F840E2B908172D@MAILSERVER1.MDC.COM>
From: "Waegner.Rick" <RWaegner@hou.mdc.com>
To: "'Franklin R. Jones'" <grat@frii.com>
Cc: firewalls@greatcircle.com
Subject: RE: FW-1 3.0 and Solaris 2.6 ok?
Date: Tue, 6 Jan 1998 13:35:06 -0600
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1458.49)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

fj,

	No, they are not on the release cd YET!!! You can download them
from the sun web site.
We did not know about the "bug" until AFTER we paid xxxx.xx for it! I
was NOT very happy. Let me know how it goes!


Rick Waegner

The Boeing Company
UNIX Sysadmin
richard.a.waegner@boeing.com
281.283.5485

> ----------
> From: 	Franklin R. Jones
> Sent: 	Tuesday, January 6, 1998 13:54
> To: 	Waegner.Rick
> Cc: 	firewalls@greatcircle.com
> Subject: 	Re: FW-1 3.0 and Solaris 2.6 ok?
> 
> Waegner.Rick wrote:
> > 
> > We are currently implementing FW-1 v3.0 on a solaris 2.6 platform
> and
> > have had  problems. Yes, Solaris 2.6 is "supported" but not by the
> FW-1
> > package that will be dilivered to you, you must download all of the
> > packages that make up the "FW-1 V3.0 b" (DES, FW-1, Motif Intfc,
> > etc...). If you install 3.0 on Solaris 2.6, the machine will get
> stuck
> > in a reboot cycle that can only be fixed with a reload of the OS.
> FW-1
> 
> 	ouch!
> 
> > V3.0 will mangle /etc/rcS.d/S30rootusr.sh upon install and reboot.
> Once
> > this "bug" is fixed with the downloaded 3.0b, it seems to be very
> > stable.
> 
> Thanks for the heads up, Rick. I'm about to head down that trail
> myself.
> You make referece to all the packages that make up V3.0b, are these
> FW1 patches (e.g. from the sun web site) or FW1 product packages (on 
> the release CD)?
> 
> also nice that they make no mention of this problem in the install
> docs that I've seen...
> 
> fj..
> 

From firewalls-owner  Tue Jan  6 11:59:37 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id KAA13752; Tue, 6 Jan 1998 10:55:51 -0800 (PST)
Received: from deimos.frii.com (deimos.frii.com [208.146.240.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id KAA13582 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 10:55:17 -0800 (PST)
Received: from ralph (ralph.ball.com [162.18.91.40]) by deimos.frii.com (8.8.5/8.8.4) with SMTP id LAA15975; Tue, 6 Jan 1998 11:54:52 -0700 (MST)
Message-ID: <34B27DEA.61EF@frii.com>
Date: Tue, 06 Jan 1998 11:54:34 -0700
From: "Franklin R. Jones" <grat@frii.com>
Organization: Wyldwood Computing
X-Mailer: Mozilla 3.04 (X11; I; SunOS 5.5.1 sun4u)
MIME-Version: 1.0
To: "Waegner.Rick" <RWaegner@hou.mdc.com>
CC: firewalls@greatcircle.com
Subject: Re: FW-1 3.0 and Solaris 2.6 ok?
References: <CE0690979441D111B55D0000F840E2B908171D@MAILSERVER1.MDC.COM>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Waegner.Rick wrote:
> 
> We are currently implementing FW-1 v3.0 on a solaris 2.6 platform and
> have had  problems. Yes, Solaris 2.6 is "supported" but not by the FW-1
> package that will be dilivered to you, you must download all of the
> packages that make up the "FW-1 V3.0 b" (DES, FW-1, Motif Intfc,
> etc...). If you install 3.0 on Solaris 2.6, the machine will get stuck
> in a reboot cycle that can only be fixed with a reload of the OS. FW-1

	ouch!

> V3.0 will mangle /etc/rcS.d/S30rootusr.sh upon install and reboot. Once
> this "bug" is fixed with the downloaded 3.0b, it seems to be very
> stable.

Thanks for the heads up, Rick. I'm about to head down that trail myself.
You make referece to all the packages that make up V3.0b, are these
FW1 patches (e.g. from the sun web site) or FW1 product packages (on 
the release CD)?

also nice that they make no mention of this problem in the install
docs that I've seen...

fj..

From firewalls-owner  Tue Jan  6 13:06:29 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA01567; Tue, 6 Jan 1998 07:22:58 -0800 (PST)
Received: from ALABAMA.CF.CS.YALE.EDU (RT-GW.CS.YALE.EDU [128.36.0.13]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id HAA01540 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 07:22:47 -0800 (PST)
Received: from SPARKY.CF.CS.YALE.EDU by ALABAMA.CF.CS.YALE.EDU (8.7.1/res.host.cf-4.0)
	with ESMTP id KAA10458; Tue, 6 Jan 1998 10:22:53 -0500 (EST) sender long-morrow@CS.YALE.EDU for 
Received: by SPARKY.CF.CS.YALE.EDU (Sendmail-8.7.1/res.client.cf-4.0)
	id KAA17141; Tue, 6 Jan 1998 10:22:50 -0500 (EST)
Date: Tue, 6 Jan 1998 10:22:50 -0500 (EST)
Message-Id: <199801061522.KAA17141@SPARKY.CF.CS.YALE.EDU>
To: RANDAL_LATHROP@mech.disa.mil, iank@magna.com.au, ryanr@sybase.com
Subject: Re:  Re[2]: Hardware for seperating LAN from dialouts
Cc: firewalls@greatcircle.com, ian@sunbeach.net
From: "H. Morrow Long" <morrow.long@yale.edu>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

RANDAL_LATHROP@mech.disa.mil (RANDAL LATHROP) wrote:
>     But this is true only if you are running a service (daemon) that can 
>     be exploited.  If you do not share any resources on your system, are 
>     not running FTPD, TELNETD, or HTTPD, what else is running that can be 
>     subverted for illicit use?

You have to be very careful about file/disk shares on Windows 95 PCs,
when dialing out to the Internet.  Most "shares" that users have set
up are very insecurely passworded and are read/write.  Filesharing
should be turned off if you are connected to the Internet and 
NetBIOS over TCP/IP (esp. TCP port 139) is not filtered out.

Port scan a Windows 95 PC and you will see a service listening at port
139 usually.  Not only can file shares be attached but there may be
remote access to RPC services and the registry....

Windows 95 actually warns you to turn off file sharing when you use 
dial-up networking to connect to the Internet (and there is a patch
to make it do so for cable modems now as well) but not if you are on
a LAN attached to the Internet.

And of course then there are the people who bring up CC, PCAnywhere, etc.
on their Windows 95 machines....

- Morrow


From firewalls-owner  Tue Jan  6 14:01:33 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA05378; Tue, 6 Jan 1998 12:32:17 -0800 (PST)
Received: from new-murphey.tenet.edu (new-murphey.tenet.edu [198.213.2.103]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA05367 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 12:32:11 -0800 (PST)
Received: from newmail.tenet.edu
          (wanmaster.wichita-falls.isd.tenet.edu [207.64.60.184])
          by new-murphey.tenet.edu (Post.Office MTA v3.1.2
          release (PO203-101c) ID# 0-40960U100000L30000S0) with ESMTP
          id AAA16668 for <firewalls@GreatCircle.COM>;
          Tue, 6 Jan 1998 14:32:30 -0600
Message-ID: <34B294C2.583B0C00@newmail.tenet.edu>
Date: Tue, 06 Jan 1998 14:32:02 -0600
From: "ALBERT KIRCHHOFF" <albertk@tenet.edu>
Organization: Wichita Falls Independent School District
X-Mailer: Mozilla 4.03 [en] (Win95; I)
MIME-Version: 1.0
To: "firewalls@GreatCircle.COM" <firewalls@GreatCircle.COM>
Subject: Problem using Proxy Next with FW-1
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

We are a K-12 school district. Our acceptable use policy requires HTTP
users to authenticate through our firewall before allowing our users
access to the Internet. We are pointing the "Proxy Next" to a box behind
the firewall which provides filtering with SURFWATCH.

Periodically, after authenticating, the browser will say that it has
contacted the host and is waiting for a reply and finally return with
the error "Document contains no data"?




From firewalls-owner  Tue Jan  6 14:01:50 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id NAA13977; Tue, 6 Jan 1998 13:17:15 -0800 (PST)
Received: from gateway2.ey.com (gateway2.ey.com [199.50.26.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id NAA13804 for <firewalls@GreatCircle.com>; Tue, 6 Jan 1998 13:16:40 -0800 (PST)
From: CHRIS.NICHOLS@EY.COM
Received: by gateway2.ey.com id AA25592
  (InterLock SMTP Gateway 3.0 for firewalls@GreatCircle.com);
  Tue, 6 Jan 1998 16:17:00 -0500
Received: by gateway2.ey.com (Protected-side Proxy Mail Agent-1);
  Tue, 6 Jan 1998 16:17:00 -0500
To: "        -         (052)firewalls(a)GreatCircle.com" <firewalls@GreatCircle.com>
Subject: NT Web proxy server
Message-Id: <0014500016645557000002L072*@MHS>
Date: Tue, 6 Jan 1998 16:14:20 -0500
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Novell's Border Manager does caching amongst other things.

Chris

---------------------- Forwarded by Chris Nichols/MissouriKansas/AUDIT/EYLLP/US
on 01/06/98 07:41 AM ---------------------------

        firewalls-owner@GreatCircle.COM
        01/05/98 05:20 PM
Please respond to firewalls-owner@GreatCircle.COM @ INTERNET
To: firewalls@GreatCircle.COM @ INTERNET
cc:
Subject: NT Web proxy server

Hi --

I'm looking for a Web proxy server that does caching for
my kid's school (K-8).  The computer lab is networked
to a server which would run the proxy.  The server
is a Pentium running NT 4.0.  I'm looking for
recommendations on proxy server software from anyone
that is running it on NT 4.0 using a dialup-on-demand
type of setup.  The only proxy servers for NT that
I am aware of are Microsoft and Netscape, but I'm
sure there are others.

Any and all comments are welcome.

Thanks.

-->BoB


-->BoB Miorelli, Pratt & Whitney
miorelli@pweh.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In theory, theory and practice are the same;
in practice they are distinct.

From firewalls-owner  Tue Jan  6 14:29:51 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA04078; Tue, 6 Jan 1998 12:23:59 -0800 (PST)
Received: from firewall.mobility.com (firewall.mobility.com [161.216.124.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id MAA03827 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 12:23:10 -0800 (PST)
Message-Id: <199801062023.MAA03827@honor.greatcircle.com>
Received: from [161.216.252.1] by firewall.mobility.com
          via smtpd (for honor.greatcircle.com [198.102.244.44]) with SMTP; 6 Jan 1998 20:23:28 UT
Received: from ex13.mobility.com ([161.217.3.50]) by [161.216.252.1]
          via smtpd (for honor.greatcircle.com [198.102.244.44]) with SMTP; 6 Jan 1998 20:15:16 UT
Received: by CC20EHUB04.mobility.com with Internet Mail Service (5.0.1458.49)
	id <Z30VPL9F>; Tue, 6 Jan 1998 15:23:22 -0500
From: "Grigorof, Adrian" <agrigoro@mobility.com>
To: firewalls@greatcircle.com
Subject: E-mail Encryption
Date: Tue, 6 Jan 1998 15:21:57 -0500
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1458.49)
Content-Type: multipart/mixed;
	boundary="---- =_NextPart_000_01BD1AB7.06336210"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------ =_NextPart_000_01BD1AB7.06336210
Content-Type: text/plain;
	charset="iso-8859-1"

I am looking for a product to be used in encrypting e-mail to be sent
over the Internet. I've heard something about a product called Puffer by
Briggs Softworks but I haven't tested it so far.  

The ideal software should be user friendly otherwise it won't be used by
"normal" users...how can you stop them from sending clear text messages
or unencrypted attachments?

Any ideas, suggestions?

Thanks,

Adrian Grigorof
Internet Administrator
Bell Mobility Cellular Inc.
Toronto
www.bellmobility.ca






------ =_NextPart_000_01BD1AB7.06336210
Content-Type: application/ms-tnef
Content-Transfer-Encoding: base64

eJ8+IhcUAQaQCAAEAAAAAAABAAEAAQeQBgAIAAAA5AQAAAAAAADoAAEIgAcAGAAAAElQTS5NaWNy
b3NvZnQgTWFpbC5Ob3RlADEIAQSAAQASAAAARS1tYWlsIEVuY3J5cHRpb24AYAYBCYABACEAAABD
QjIzMTg0Rjc2ODZEMTExOTIxQjQ0NDU1MzU0MDAwMAC/BgEggAMADgAAAM4HAQAGAA8AFwAUAAIA
GAEBBYADAA4AAADOBwEABgAPABUAOQACADsBAQ2ABAACAAAAAgACAAEDkAYAlAsAACkAAAALAAIA
AQAAAAMALgAAAAAAQAA5AOA2s7zgGr0BHgBwAAEAAAASAAAAUG9ydCBEZXNjcmlwdGlvbnMAAAAC
AXEAAQAAABsAAAABvQ5Wg1I5s0ZeehQR0ZMBAIBfwR+IAyI5jSAAAgEJEAEAAADUBgAA0AYAAKgO
AABMWkZ19aVHiQMACgByY3BnMTI1cjIMYGMxAzABBwtgbpEOEDAzMw8WZmUPkk8B9wKkA2MCAGNo
CsBzhGV0AtFwcnEyAACSKgqhbm8SUCAwAdCFAdA2D6AwNTA0FCGzAdAUEDR9B20S8mYHQPsFQAdt
fQKDAFAD1BH/Ewv+YhPhFFATshqEFNAHExXnsGhlbHYYsA3gYRdhqwKRCOY7CW8wHZ9lDjD+NR7K
H+EfnyCpHrQg0h8/PyMPIs0iTyB/Hs8QYDI4/yiaKbEpbyp5HrQqoikPLN/vLJ0sHypPLhQ5DlAx
ZDLBhyrjMsACgnN0eWwHkB8cIBiwAAATUAPwZGN0CmwKsVw1GGFkanVzNDAFEGdoBUIXwgwBY4cJ
wDUgAzBzbmV4GMAvB7AFsADAAnNzAFBzYpYyFFA0IGET8FxrCeD+cAuQNP81YwhgNVALgBww+mUc
UGwBQDZbDDA3JCrANzoABKALgGcqsTemYmH9GKBkAiA4YDgGHCA2UD5R/CAxM/MOUDlfOm87fwBR
/zy8AKA3Lj8/QEYz5A/AQU9/Ql9Dbw5QPK9Fz0bfQHMz+wKCExBjOSBOYTZQQHAccEkcUCBEARBh
dRZBUAUKwGEJwGFwaCBGRwIhOOQoAGZpLQ+QOF8BQDvwUvNJzzVjYgsgcs8JUFUSGDBVEnc0KAEY
kP5wAdBQMjZ/TV9OZlKQUVBbBRACMC1R8ANhOhZgb6FacFN1YmoFkHRacKBEYXRlOjjkNlK//1PP
VN9V71b5NIBAYw4hTmFvPXYOUFgvWT5SPEEYkSDuSEBRBJA45DdcL10/Xk+/X107z2B/D5BsMAjQ
Ygqw/HQ4TLoPVEjQYn9jhmzA82SQC1B5L1IAX3ALEWUF/nM45CrAZf9nD2gfX29XD79uH28vcDVa
klo0W2k5cn93Nf8DMGxzOXZfd299YET4b2N1B4ACMAXQUcBPlo91ZFB1DGAJUGNmMn5osVARSHlw
BJBqMWscwf0BVTNJMXsBevB7MHQRAYD+blrwAGAJ8FBgf8ACATigfWESZQDwf8A0QIMgDlB26QiQ
d2sLgGRuAIciBPD/B0AQYQFADgBz4kBCiIUCEN5vBUIYsRLyW4BtC1FbgKAgQzpcXFnAb1Gh3m1R
8AMQB5CLME0N4ANg5HNvAYAgTwEgDeCGcFpcjOZFAMADEC5OMHTfg7AYoHswN+FqMnhI8Y6i/VD0
YwMgEvMAgAWQHEBEYf9JkA5wOKCQggGQACCREodx/4ABAcGQgRhwD3AAAEmQDND5AZAgLhzSkHgO
UJEyFkD/e4CRr5K/k88PwEmQBYGVb9uWf5ePbG4ASZBslS+Z732a9SmT/CgAmM+dr5rkYvwgKAKR
ns+Qw1wQnH+hP/+iT6NfkPBl0KSikX+mD6cf/5P8KsCkr6ovqz+sT5DwesD/qS+uv6/PsNQK+QMw
eu97/7F9jXtJIIuhCQBvh2H3QKCF8bmgIBkABHAOcAVAcHRvIGITgLgACYAgP7YxCfAFAIMQHHBA
kWUt743yuzUYoIARb2SxuzAcINwgSQIwBJEYsC6+cAAQ/HF1icATgFCxQEFwcYyQ/weAvkBAggGg
agG6mYgRNGDPN+Ac4jeyOGBQdQEgBJCrwli7YHnCSUK4MWcGQeWMoXcFsGtzApC7YMER/7mQGHAc
UAuQv0W7IQeQW4C/u9EFQIyQulAKwL8AIAqF/QqFVL5RtqBAUAMgjJJwUfW9gWgIYGw34Lt0BcAD
UP8IkIWQb/C94L5BdNAEAMmBvwVAxYDGqbt2xAFyAGQCYD+/VBNQOKIAEM6HyyNzhe/KoAfgHJAD
oHkIYL2Qu0D+cL4yi7ADUr2SQHOQIL/x28dBOEAgB4FJEGcHkQWx/nU4ILw0u8FbcAGQGGB/8mRz
P8iMQW7EEMmic9osvZB1xQDHYWkCINWe98lgAHDFsCzVvXQABzADoH5HuDEFsIygCoW+htohbb8L
gAQAuCBbcAWwCoVCHDBxAyBNb2IDEFCAxBBD591xUSDbY2MuyPba4QIw/m8KhQKSCJDK0BXjytAL
gAc0MJBAZQBZUEVSTBhJTkscEAJAcDov9C934tAuu3DCAARg3dSuLhyQwkES8mRbcGHgkws9UQuA
MXTwIADQyQDqefm6zhGMggAAqgBLqQsCAFXmsBfmsRTmsXfnUy5AAGIAZQBs6BFtNABv59Fp6BHo
wHQAonnnsWMAYeax4OW9GjjmsWjpEekgcAA6/AAv67Hnb+h/6YLrwOaw/xzQApLK0BiQFkEIwQvy
gdX/4t8ckRzRyIzyP+AjCvO2X1e3b+GB3/Z95rEA93AeADFAAQAAABEAAABBR1JJR09STzI4NzRC
RTMyAAAAAAMAGkAAAAAAHgAwQAEAAAARAAAAQUdSSUdPUk8yODc0QkUzMgAAAAADABlAAAAAAAMA
NgAAAAAACwAAgAggBgAAAAAAwAAAAAAAAEYAAAAAA4UAAAAAAAADAAGACCAGAAAAAADAAAAAAAAA
RgAAAAAQhQAAAAAAAAMAAoAIIAYAAAAAAMAAAAAAAABGAAAAAFKFAAC3DQAAHgADgAggBgAAAAAA
wAAAAAAAAEYAAAAAVIUAAAEAAAAEAAAAOC4wAAMABIAIIAYAAAAAAMAAAAAAAABGAAAAAAGFAAAA
AAAACwAFgAggBgAAAAAAwAAAAAAAAEYAAAAADoUAAAAAAAADAAaACCAGAAAAAADAAAAAAAAARgAA
AAARhQAAAAAAAAMAB4AIIAYAAAAAAMAAAAAAAABGAAAAABiFAAAAAAAAHgAIgAggBgAAAAAAwAAA
AAAAAEYAAAAANoUAAAEAAAABAAAAAAAAAB4ACYAIIAYAAAAAAMAAAAAAAABGAAAAADeFAAABAAAA
AQAAAAAAAAAeAAqACCAGAAAAAADAAAAAAAAARgAAAAA4hQAAAQAAAAEAAAAAAAAAAwAmAAAAAAAD
AIAQ/////wIB+T8BAAAAbgAAAAAAAADcp0DIwEIQGrS5CAArL+GCAQAAAAYAAAAvTz1CRUxMTU9C
SUxJVFkvT1U9SFVCL0NOPVJFQ0lQSUVOVFMvQ049TVMtTUFJTC9DTj1XUklORk9URUNIL0NOPUFH
UklHT1JPMjg3NEJFMzIAAAAeAPg/AQAAABEAAABHcmlnb3JvZiwgQWRyaWFuAAAAAB4AOEABAAAA
EQAAAEFHUklHT1JPMjg3NEJFMzIAAAAAAgH7PwEAAABuAAAAAAAAANynQMjAQhAatLkIACsv4YIB
AAAABgAAAC9PPUJFTExNT0JJTElUWS9PVT1IVUIvQ049UkVDSVBJRU5UUy9DTj1NUy1NQUlML0NO
PVdSSU5GT1RFQ0gvQ049QUdSSUdPUk8yODc0QkUzMgAAAB4A+j8BAAAAEQAAAEdyaWdvcm9mLCBB
ZHJpYW4AAAAAHgA5QAEAAAARAAAAQUdSSUdPUk8yODc0QkUzMgAAAABAAAcwQGsjad8avQFAAAgw
QDUE7uAavQEeAD0AAQAAAAEAAAAAAAAAHgAdDgEAAAASAAAARS1tYWlsIEVuY3J5cHRpb24AAAAL
ACkAAAAAAAsAIwAAAAAAAwAGEG2xnR0DAAcQlAEAAAMAEBAAAAAAAwAREAAAAAAeAAgQAQAAAGUA
AABJQU1MT09LSU5HRk9SQVBST0RVQ1RUT0JFVVNFRElORU5DUllQVElOR0UtTUFJTFRPQkVTRU5U
T1ZFUlRIRUlOVEVSTkVUSVZFSEVBUkRTT01FVEhJTkdBQk9VVEFQUk9EVUNUAAAAALp6

------ =_NextPart_000_01BD1AB7.06336210--

From firewalls-owner  Tue Jan  6 16:46:11 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA13011; Tue, 6 Jan 1998 15:43:23 -0800 (PST)
Received: from hq.si.net (hq.si.net [192.156.192.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id PAA13004 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 15:43:17 -0800 (PST)
Received: from hq.si.net (hq [192.156.192.10]) by hq.si.net (8.8.5/8.7.3) with SMTP id SAA04728; Tue, 6 Jan 1998 18:44:49 -0500 (EST)
Date: Tue, 6 Jan 1998 18:44:49 -0500 (EST)
From: Ming Lu <mlu@hq.si.net>
To: Darin Fisher <oz@axent.com>
cc: "'Olivier NOUET'" <Olivier.Nouet@cominfo.fr>,
        "'FWLIST'" <firewalls@GreatCircle.COM>
Subject: RE: A site about security
In-Reply-To: <D76E0932FE4ED11196880060B06716E9026284@raven.axent.com>
Message-ID: <Pine.SOL.3.91.980106184346.29472C-100000@hq.si.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


I got message:"HTTP/1.0 403 Access Forbidden"

_ming

On Mon, 29 Dec 1997, Darin Fisher wrote:

> Check out http://www.axent.com/swat/
> 
> ----
> #include <cya/company/disclaim.h>
> "In order to succeed, one must pay attention" 
> 
> -----Original Message-----
> From: Olivier NOUET [mailto:Olivier.Nouet@cominfo.fr]
> Sent: Wednesday, December 24, 1997 1:04 AM
> To: 'FWLIST'
> Subject: A site about security
> 
> 
> 
> 
> 	I'm looking for a site about security problems, with real life
> problems (reports of attacks, problems on softs, etc...) to make a
> summary.
> 	Thanks !!
> 
> Olivier Nouet/Cominfo
> 

From firewalls-owner  Tue Jan  6 16:48:36 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA05368; Tue, 6 Jan 1998 15:09:06 -0800 (PST)
Received: from nx.numerix.com (nx.numerix.com [208.214.237.66]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id PAA05323 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 15:08:54 -0800 (PST)
Received: from nx.numerix.com  by nx.numerix.com (8.8.7/8.8.6) with SMTP id RAA30201; Tue, 6 Jan 1998 17:08:50 -0600
Date: Tue, 6 Jan 1998 17:10:54 -0600 (CST)
From: Greg Whalin <gwhalin@numerix.com>
To: "Grigorof, Adrian" <agrigoro@mobility.com>
cc: firewalls@GreatCircle.COM
Subject: Re: E-mail Encryption
In-Reply-To: <199801062023.MAA03827@honor.greatcircle.com>
Message-ID: <Pine.LNX.3.96.980106171036.25274D-100000@co.numerix.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

How about PGP?  Or how about Netscape with client certificates?

--------------------
Greg Whalin
gwhalin@numerix.com

On Tue, 6 Jan 1998, Grigorof, Adrian wrote:

> I am looking for a product to be used in encrypting e-mail to be sent
> over the Internet. I've heard something about a product called Puffer by
> Briggs Softworks but I haven't tested it so far.  
> 
> The ideal software should be user friendly otherwise it won't be used by
> "normal" users...how can you stop them from sending clear text messages
> or unencrypted attachments?
> 
> Any ideas, suggestions?
> 
> Thanks,
> 
> Adrian Grigorof
> Internet Administrator
> Bell Mobility Cellular Inc.
> Toronto
> www.bellmobility.ca
> 
> 
> 
> 
> 
> 


From firewalls-owner  Tue Jan  6 16:49:01 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA13412; Tue, 6 Jan 1998 15:46:17 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id PAA03318 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 15:00:08 -0800 (PST)
Received: from hotmail.com by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-970426)
	id OAA23885; Tue, 6 Jan 1998 14:58:59 -0800 (PST)
Received: (qmail 6992 invoked by uid 0); 6 Jan 1998 22:59:58 -0000
Message-ID: <19980106225958.6991.qmail@hotmail.com>
Received: from 203.15.102.65 by www.hotmail.com with HTTP;
	Tue, 06 Jan 1998 14:59:58 PST
X-Originating-IP: [203.15.102.65]
From: "Paul Jones" <pj_27@hotmail.com>
To: firewalls@GreatCircle.COM
Subject: Real Audio
Content-Type: text/plain
Date: Tue, 06 Jan 1998 14:59:58 PST
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

We would like some information regarding the security implications of 
running Real Audio through our firewall (Gauntlet).

Any information you can provide would be appreciated.


Thanks in advance,

Paul

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com

From firewalls-owner  Tue Jan  6 17:39:34 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA13127; Tue, 6 Jan 1998 15:44:16 -0800 (PST)
Received: from columbia.digiweb.com (columbia.digiweb.com [206.161.225.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id PAA13112 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 15:44:09 -0800 (PST)
Received: from [207.213.51.19] (19.underground.net [207.213.51.19] (may be forged))
	by columbia.digiweb.com (8.8.8/8.8.5) with ESMTP id SAA04487;
	Tue, 6 Jan 1998 18:43:07 -0500 (EST)
X-Sender: dyabolyk@digiweb.com
Message-Id: <l03130304b0d871555aa5@[207.213.51.19]>
In-Reply-To: <Pine.SUN.3.96.980106105930.4657A-100000@maestro.maestro.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Tue, 6 Jan 1998 15:42:29 -0800
To: Sick Puppy <sikpuppy@maestro.com>, firewalls@GreatCircle.COM
From: aldous valdheims <dyabolyk@dyabolyk.com>
Subject: Re: Wannabe needs a good book
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 11:05 AM -0500 1.6.1998, Sick Puppy wrote:
>Can someone please suggest a good book on the
>general topic of networking, with some emphasis on TCP/IP, that we can
>steal?

One of my favorites is Computer Networks, 2nd edition by I think it is
tannenbaum, but I may have to be corrected on that, I don't have a copy of
it with me right now.  It gives a really thorough coverage of network
protocols and network layers, from the actual wiring on up to applications.
Get it and get crazy.


--jt





From firewalls-owner  Tue Jan  6 18:15:35 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA14277; Tue, 6 Jan 1998 15:51:14 -0800 (PST)
Received: from aims.gov.au (pearl.aims.gov.au [138.7.32.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id PAA09621 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 15:26:49 -0800 (PST)
Received: from aims.gov.au by aims.gov.au (SMI-8.6/SMI-SVR4)
	id JAA07504; Wed, 7 Jan 1998 09:27:08 +1000
Message-ID: <34B2BD37.402DDEBC@aims.gov.au>
Date: Wed, 07 Jan 1998 09:24:39 +1000
From: Kerry Jones <kjones@aims.gov.au>
X-Mailer: Mozilla 4.04 [en] (WinNT; I)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: Split DNS??
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

This is a great Mailing list..I am so impressed with the answers I got
from my last question DNS on Firewalls!!.. I'm going to ask another..

What are the benefits of running split DNS??? Is it more secure?? Or is
it a pain in the ass which doesn't increase security much at all?? Can
someone give me a bit of an overview of how it would be done.

Is it a simple matter of running 1 DNS on the DMZ (for internet) and
another totally separate DNS on the internal network (for local
machines)??  Would the 2 DNS servers be totally independent of one
another or would one have to update the other one?

Thanks in advance...

--
Kerry Jones
kjones@aims.gov.au


From firewalls-owner  Tue Jan  6 18:16:08 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA14442; Tue, 6 Jan 1998 15:52:41 -0800 (PST)
Received: from www.allensysgroup.com ([205.245.8.5]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id PAA04910 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 15:06:49 -0800 (PST)
Received: from houdini ([10.1.4.76]) by www.allensysgroup.com
          (Post.Office MTA v3.1 release PO205e ID# 0-40603U300L100S0)
          with ESMTP id AAA210; Tue, 6 Jan 1998 18:05:32 -0500
From: alanb@allensysgroup.com (Alan Bolt)
To: "Grigorof, Adrian" <agrigoro@mobility.com>, <firewalls@greatcircle.com>
Subject: Re: E-mail Encryption
Date: Tue, 6 Jan 1998 18:18:36 -0500
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1161
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Message-ID: <19980106230532656.AAA210@houdini>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Have you not looked into PGP?
It has grown to have much better interface
for users and does what you seem to want

Bobby Brown
Network Administrator
Allen Systems Group

----------
> From: Grigorof, Adrian <agrigoro@mobility.com>
> To: firewalls@greatcircle.com
> Subject: E-mail Encryption
> Date: Tuesday, January 06, 1998 3:21 PM
> 
> I am looking for a product to be used in encrypting e-mail to be sent
> over the Internet. I've heard something about a product called Puffer by
> Briggs Softworks but I haven't tested it so far.  
> 
> The ideal software should be user friendly otherwise it won't be used by
> "normal" users...how can you stop them from sending clear text messages
> or unencrypted attachments?
> 
> Any ideas, suggestions?
> 
> Thanks,
> 
> Adrian Grigorof
> Internet Administrator
> Bell Mobility Cellular Inc.
> Toronto
> www.bellmobility.ca
> 
> 
> 
> 
> 
> 

From firewalls-owner  Tue Jan  6 18:18:27 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA14673; Tue, 6 Jan 1998 15:54:48 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id PAA07928 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 15:19:43 -0800 (PST)
Received: from gdsconnect.com by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-970426)
	id NAA22901; Tue, 6 Jan 1998 13:29:43 -0800 (PST)
Received: from altos.gdsconnect.com ([192.168.27.2]) by fws.gdsconnect.com with ESMTP id <17922>; Tue, 6 Jan 1998 16:32:04 -0500
Received: by ALTOS with Internet Mail Service (5.0.1457.3)
	id <Z8V3WSBB>; Tue, 6 Jan 1998 16:37:05 -0500
Message-ID: <A1F2B23A4F10D1118DDB00A0C9193FCF016C01@ALTOS>
From: Gordon LaSane <glasane@gdsconnect.com>
To: MacGyver <macgyver@tos.net>,
        Firewalls Mailing List <firewalls@GreatCircle.COM>
Subject: RE: Stateful Inspection Anyone?  Explore your options.
Date: Tue, 6 Jan 1998 16:37:03 -0500
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1457.3)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

One of the biggest complaints about stateful inspection is that if the
state table becomes corrupt, the network could become vulnerable to the
outside. 

Check out application gateways, these proxy servers take a users request
for an Internet service and forward it to the actual service. Proxies
replace the actual service, acting as a gateway and are for this reason
commonly referred to as application gateways.

Visit http://www.securecomputing.com or contact me.

	Gordon LaSane

	Global  Data  Systems, Inc.
	Internet and Intranet Firewalls and Security Group
	Consulting and Installing Solutions for Your Company's Data
Security:
	Remote User Authentication
	Internet Access
	Virtual Private Networks
	Web Filtering
	Intranets
	Firewalls	
		
	Gordon LaSane
	781/740-8818 x13 ph
	781/740-8830 fax

	glasane@gdsconnect.com

	Visit us on the web at   http://www.gdsconnect.com



	-----Original Message-----
	From:	MacGyver [SMTP:macgyver@tos.net]
	Sent:	Tuesday, January 06, 1998 11:55 AM
	To:	Firewalls Mailing List
	Subject:	Stateful Inspection Anyone?

	Hi folks,

	I've been wondering this for a while, but just haven't gotten
around to
	asking anyone yet:

	Checkpoint's Firewall-1 has a feature known as "stateful
inspection" which
	they tout as the end-all and be-all of packet-filtering and
inspection.
	Anyone had any experience in using this feature or have any
thoughts
	regarding stateful inspection?  How large of a performance
impact is there
	when stateful inspection is enabled?  Are the gains worth the
added load?

	Hope this spurs some interesting discussion.



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
	        ^               Habeeb J. Dihu
	     -'   `-            Managing Senior Technologist
	   " '     ` "          Cirrus Technologies
	 "  '       `  "        
	"  '      .  `  "                  
	"  '    .' ` `  "       'I don't believe in the no-win scenario'
	 " `   '    `' "           -- Captain James T. Kirk,  Star Trek
II: TWK
	   `  ' _  _ '          'There is an old Vulcan proverb, `Only
Nixon
	    '                    could go to China.`'
	                           -- Captain Spock, Star Trek VI: TUC

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


From firewalls-owner  Tue Jan  6 19:00:21 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id RAA02536; Tue, 6 Jan 1998 17:19:06 -0800 (PST)
Received: from hotmail.com (F81.hotmail.com [207.82.250.187]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id RAA02498 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 17:18:54 -0800 (PST)
Received: (qmail 2295 invoked by uid 0); 7 Jan 1998 01:19:17 -0000
Message-ID: <19980107011917.2294.qmail@hotmail.com>
Received: from 203.15.102.65 by www.hotmail.com with HTTP;
	Tue, 06 Jan 1998 17:19:14 PST
X-Originating-IP: [203.15.102.65]
From: "Paul Jones" <pj_27@hotmail.com>
To: firewalls@greatcircle.com
Subject: Real Audio
Content-Type: text/plain
Date: Tue, 06 Jan 1998 17:19:14 PST
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

We would like some information regarding the security implications of 
running Real Audio through our firewall (Gauntlet).

Any information you can provide would be appreciated.


Thanks in advance,

Paul

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com

From firewalls-owner  Tue Jan  6 19:02:42 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id QAA16581; Tue, 6 Jan 1998 16:01:34 -0800 (PST)
Received: from hq.si.net (hq.si.net [192.156.192.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id QAA16479 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 16:01:15 -0800 (PST)
Received: from hq.si.net (hq [192.156.192.10]) by hq.si.net (8.8.5/8.7.3) with SMTP id TAA04907; Tue, 6 Jan 1998 19:03:21 -0500 (EST)
Date: Tue, 6 Jan 1998 19:03:21 -0500 (EST)
From: Ming Lu <mlu@hq.si.net>
To: John Palmer <jpalmer@pobox.com>
cc: "joej@ultranet.com" <joej@ma.ultranet.com>,
        "firewalls@GreatCircle.COM" <firewalls@GreatCircle.COM>
Subject: RE: Intro & question: looking for FW recommendation
In-Reply-To: <3.0.3.32.19971229185509.006be284@netsync.net>
Message-ID: <Pine.SOL.3.91.980106185335.29472D-100000@hq.si.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Mon, 29 Dec 1997, John Palmer wrote:

> At 08:46 AM 12/29/97 -0500, Joseph Judge wrote:
> >Step 1 --- Work with the corporate folks ... 
> 
> I'm all for working with corporate IS. But that comes last on my list of
[snip]
 
> It's obvious that one possible solution would be to use the same firewall
> that corporate uses. The only problem there is that corporate bought the
> equivalent of a greyhound bus, where we only need a four-door [car] to meet
> our needs. I can't cost-justify their hardware/software implementation
> locally. With a lower user-licensed copy, and NT on Intel (instead of a
> non-Intel box) I can.

You can use either linux or solaris x86 with a 486 or better. It would be 
much better solution than... in anyway. just look at 
http://www.standishgroup.com/syst.html.
 
> 
> Working on that aspect now. I'll check out the book you recommended. A
> search through Amazon.com turned up many books, have a list of them on my
> desk... somewhere. But which book to start with...?... this is what
> prompted me to look around more before blatantly buying books. You're
> probably right though... any book would be helpful. :)

<Firewalls and Internet Security> and < Building Internet Firewalls> are 
two good books to start with.
 
_ming

From firewalls-owner  Tue Jan  6 19:06:33 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA02561; Tue, 6 Jan 1998 09:59:09 -0800 (PST)
Received: from main.geminisecure.com (main.geminisecure.com [205.179.16.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id JAA02502 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 09:58:53 -0800 (PST)
Received: (from leonard@localhost) by main.geminisecure.com (8.6.9/8.6.9) id JAA06588; Tue, 6 Jan 1998 09:52:34 -0800
Date: Tue, 6 Jan 1998 09:52:33 -0800 (PST)
From: Leonard Miyata <leonard@geminisecure.com>
To: Kerry Jones <kjones@aims.gov.au>
cc: firewalls@GreatCircle.COM
Subject: Re: DNS on firewall??
In-Reply-To: <34B1C8DC.2BE94D49@aims.gov.au>
Message-ID: <Pine.BSD/.3.91.980106093842.6575A-100000@main.geminisecure.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi There

If your talking about a PUBLIC Secondary DNS Server....
Remember, the purpose of the Public Secondary DNS is to
provide backup records of the Primary. If your Primary
DNS Server goes down in the middle of the night, your
Secondary Server (which anyone can find by asking the
root DNS server for the official postings) can be used
to query items like, where to forward SMTP mail
for delivery to your site, or where your official WWW
web server is located. A Public DNS server must of course 
be in a PUBLIC location, (like your ISP or a different 
subnet in your DMZ) for fault tolerance.

If your talking about a PRIVATE DNS Server, (such
as used in a 'split' DNS configuration) for resolving
private name/address of your internal net, Parts of it may
be on the firewall to allow inside access to the DMZ,
but this is a PRIVATE configuration, and is a totally
different issue....

Personal Opinions provided by
Leonard Miyata
aka leonard@geminisecure.com
GEMINI COMPUTERS Inc.

On Tue, 6 Jan 1998, Kerry Jones wrote:

> Hi,
> 
> Simple question. Is it a good idea to run a DNS server on a
> Firewall?????
> 
> AUNIC require at least 2 DNS servers, so I am trying to decide where to
> configure the 2nd DNS server for our domain (Primary one is currently on
> the DMZ). Will putting the secondary DNS on the firewall create a
> security hole in the Firewall which would best be avoided????????
> Is it acceptable (secure) to put the DNS and other services (e.g.
> http/ftp) on the Firewall??
> 
> What do you think??
> What are your opinions??
> 
> I have a fairly standard setup as follows;
> 
> Internet
>     |
>  router
>     |
>  firewall - dmz (1 machine: http/ftp/dns)
>       |
>   internal network.
> 
> --
> Kerry Jones
> kjones@aims.gov.au
> 
> 

From firewalls-owner  Tue Jan  6 19:06:38 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id QAA21683; Tue, 6 Jan 1998 16:18:26 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id QAA21664 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 16:18:18 -0800 (PST)
Received: from starbase.tos.net by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-970426)
	id QAA24620; Tue, 6 Jan 1998 16:17:09 -0800 (PST)
Received: (from mail@localhost)
          by starbase.tos.net (8.8.4/8.8.4)
	  id SAA31044 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 18:18:55 -0600
Message-Id: <199801070018.SAA31044@starbase.tos.net>
Received: from macgyver-1.pr.mcs.net(205.253.24.113) by starbase.tos.net via smap (V1.3)
	id sma031040; Tue Jan  6 18:18:38 1998
X-Sender: macgyver@smtp.tos.net
X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0
Date: Tue, 06 Jan 1998 18:14:58 -0600
To: Firewalls Mailing List <firewalls@GreatCircle.COM>
From: MacGyver <macgyver@tos.net>
Subject: Re: E-mail Encryption
In-Reply-To: <199801062023.MAA03827@honor.greatcircle.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 03:21 PM 1/6/98 -0500, you wrote:
>I am looking for a product to be used in encrypting e-mail to be sent
>over the Internet. I've heard something about a product called Puffer by
>Briggs Softworks but I haven't tested it so far.  
>

Actually, I recommend two products for this:  PGP for the encryption
portion, and Eudora for the mail client.

>The ideal software should be user friendly otherwise it won't be used by
>"normal" users...how can you stop them from sending clear text messages
>or unencrypted attachments?

Using Eudora 4.0 onward (I'm not sure if previous versions support this
feature), you have the ability to set an "output filter", which can be set
to call any arbitrary program.  PGP 5.0+ has a Eudora plugin option that
you can use to automagically guarantee that all emails sent out are
encrypted in an invisible way to the user.

>
>Any ideas, suggestions?
>
>Thanks,
>
>Adrian Grigorof
>Internet Administrator
>Bell Mobility Cellular Inc.
>Toronto
>www.bellmobility.ca
>

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        ^               Habeeb J. Dihu
     -'   `-            Managing Senior Technologist
   " '     ` "          Cirrus Technologies
 "  '       `  "        
"  '      .  `  "                  
"  '    .' ` `  "       'I don't believe in the no-win scenario'
 " `   '    `' "           -- Captain James T. Kirk,  Star Trek II: TWK
   `  ' _  _ '          'There is an old Vulcan proverb, `Only Nixon
    '                    could go to China.`'
                           -- Captain Spock, Star Trek VI: TUC
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



From firewalls-owner  Tue Jan  6 19:43:50 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id RAA02549; Tue, 6 Jan 1998 17:19:09 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id RAA02426 for <Firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 17:18:41 -0800 (PST)
Received: from mail-syd.atinet.com.au by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-970426)
	id RAA25008; Tue, 6 Jan 1998 17:17:31 -0800 (PST)
Received: from ppp-127.atinet.com.au (ppp-127.atinet.com.au [203.35.110.127]) by mail-syd.atinet.com.au (NTMail 3.02.13) with ESMTP id ba025793 for <Firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 12:17:09 +1100
Received: from beethoven (beethoven.winspace.net [192.168.0.2]) by mozart.winspace.net (8.8.8/8.7.3) with SMTP id MAA31941; Wed, 7 Jan 1998 12:17:48 +1100
From: "Norman Widders" <winspace@atinet.com.au>
Date: Wed, 7 Jan 1998 12:17:50 +1000 (GMT)
Subject: RE: E-mail Encryption
To: <agrigoro@mobility.com>
Reply-To: <winspace@atinet.com.au>
Organization: Paladin Corporation
Message-Id: <Paladin.2.33.884135870-640068234193792.beethoven>
X-Mailer: Paladin IMAP4 Client v2.33
In-Reply-To: <199801062023.MAA03827@honor.greatcircle.com>
References: <199801062023.MAA03827@honor.greatcircle.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Content-Transfer-Encoding: 7BIT
Content-ID: <Paladin.2.33.beethoven.884135870.1>
X-Info: All Things Internet POP3 Server
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Tue, 6 Jan 1998 15:21:57 -0500
"Grigorof, Adrian" <agrigoro@mobility.com> wrote:

Sorry about the plug folks but it was requested :)

You might want to try Paladin which has PGP 5 and a fairly 
friendly interface. It also uses DES internally, forces 
users to use strong passwords and has a few other features... 
not a commercial product yet so get it while its free, if you 
are interested. (Diamond and Sapphire are options)

For normal users, you still will face a learning-curve explaining
to them about Public-keys and all that but nothing a little training
wont fix.

The current version only encrypts the email message but future
releases will encrypt the attachments also, sometime 2nd Quarter.
Oh its an IMAP4 client not POP3, and has Authenticated-SMTP also.


> I am looking for a product to be used in encrypting e-mail to be sent
> over the Internet. I've heard something about a product called Puffer by
> Briggs Softworks but I haven't tested it so far.  
> 
> The ideal software should be user friendly otherwise it won't be used by
> "normal" users...how can you stop them from sending clear text messages
> or unencrypted attachments?

--
Yours faithfully, Norman Widders.

+-----------------------------------------------------------
|   winspace@atinet.com.au
|   http://www.geocities.com/researchtriangle/4431
|   Home of the Paladin IMAP4 E-Mail client.
|   Paladin Corporation Pty. Ltd.      
+-----------------------------------------------------------



From firewalls-owner  Tue Jan  6 19:45:50 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id RAA07103; Tue, 6 Jan 1998 17:42:11 -0800 (PST)
Received: from strato-fe0.ultra.net (strato-fe0.ultra.net [146.115.8.190]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id RAA07061 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 17:42:01 -0800 (PST)
Received: from joespc.judgefamily.org (joesmac.ma.ultranet.com [146.115.236.247]) by strato-fe0.ultra.net (8.8.5/ult.n14767) with SMTP id UAA19404; Tue, 6 Jan 1998 20:42:23 -0500 (EST)
Received: by localhost with Microsoft MAPI; Tue, 6 Jan 1998 20:43:54 -0500
Message-ID: <01BD1AE3.CDC54D80.joej@ultranet.com>
From: Joseph Judge <joej@ultranet.com>
Reply-To: "joej@ultranet.com" <joej@ultranet.com>
To: "'Paul Jones'" <pj_27@hotmail.com>,
        "firewalls@GreatCircle.COM"
	 <firewalls@GreatCircle.COM>
Subject: RE: Real Audio
Date: Tue, 6 Jan 1998 20:43:53 -0500
X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


What info are you looking for ? Security issues or how-to ?

Gauntlet should have a "rap" (real audio proxy) ... which requires the
internal clients to be configured for TCP via the firewall proxy.

	-- joe


On Tuesday, January 06, 1998 6:00 PM, Paul Jones 
[SMTP:pj_27@hotmail.com] wrote:
> Hi,
>
> We would like some information regarding the security implications of
>
> running Real Audio through our firewall (Gauntlet).
>
> Any information you can provide would be appreciated.
>
>
> Thanks in advance,
>
> Paul
>
> ______________________________________________________
> Get Your Private, Free Email at http://www.hotmail.com


From firewalls-owner  Tue Jan  6 19:47:09 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id RAA07575; Tue, 6 Jan 1998 17:45:54 -0800 (PST)
Received: from cebu.mozcom.com (cebu.mozcom.com [207.0.115.45]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id QAA27881 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 16:59:09 -0800 (PST)
Received: from localhost (derts@localhost) by cebu.mozcom.com (8.8.8/8.6.9) with SMTP id IAA32408; Wed, 7 Jan 1998 08:50:52 GMT
Date: Wed, 7 Jan 1998 08:50:52 +0000 (   )
From: Ederlindo Cojuangco <derts@cebu.mozcom.com>
To: "Grigorof, Adrian" <agrigoro@mobility.com>
cc: firewalls@GreatCircle.COM
Subject: Re: E-mail Encryption
In-Reply-To: <199801062023.MAA03827@honor.greatcircle.com>
Message-ID: <Pine.LNX.3.95.980107084848.32389A-100000@cebu.mozcom.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

	How about PGP key?  I was searching information with regards to
this PGP (Pretty Good Privacy) Key and unfortunately I was not able to
look for a software on how to use this one?  Any idea out there?  Just
curious on how to use this one.
	Thanks.

ederts

On Tue, 6 Jan 1998, Grigorof, Adrian wrote:

> I am looking for a product to be used in encrypting e-mail to be sent
> over the Internet. I've heard something about a product called Puffer by
> Briggs Softworks but I haven't tested it so far.  
> 
> The ideal software should be user friendly otherwise it won't be used by
> "normal" users...how can you stop them from sending clear text messages
> or unencrypted attachments?
> 
> Any ideas, suggestions?
> 
> Thanks,
> 
> Adrian Grigorof
> Internet Administrator
> Bell Mobility Cellular Inc.
> Toronto
> www.bellmobility.ca
> 
> 
> 
> 
> 
> 


From firewalls-owner  Tue Jan  6 19:47:12 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id RAA07254; Tue, 6 Jan 1998 17:43:48 -0800 (PST)
Received: from gateway.mpath.com (gateway.mpath.com [204.242.182.129]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id RAA07246 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 17:43:43 -0800 (PST)
Received: from mpath.com (nodserv.mpath.com [206.233.214.16])
	by gateway.mpath.com (8.8.5/8.8.5) with ESMTP id RAA25094;
	Tue, 6 Jan 1998 17:44:07 -0800 (PST)
Received: from localhost (vision@localhost)
	by mpath.com (8.8.5/8.8.5) with SMTP id RAA06165;
	Tue, 6 Jan 1998 17:43:34 -0800 (PST)
Date: Tue, 6 Jan 1998 17:43:34 -0800 (PST)
From: Max Vision <vision@mpath.com>
To: Paul Jones <pj_27@hotmail.com>
cc: firewalls@GreatCircle.COM
Subject: Re: Real Audio
In-Reply-To: <19980106225958.6991.qmail@hotmail.com>
Message-ID: <Pine.SOL.3.95.980106173756.1006C-100000@nodserv.mpath.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

If you mean allowing outside access to a realaudio server at your site:
 not likely, but possible.  any server can receive a denial of service
 attack, but compromise (via protocol or overflow bugs) of something
 like a non-authenticating audio server is extremely unlikely.

If you mean allowing your users to listen to realaudio on the net:
 no security threat.
 (unless you have gullible users clicking on a realaudio file that
  instructs them to change their password to "changeme" or something
  equally r00tish. :)

Max

On Tue, 6 Jan 1998, Paul Jones wrote:
> Hi,
> 
> We would like some information regarding the security implications of 
> running Real Audio through our firewall (Gauntlet).
> 
> Any information you can provide would be appreciated.
> 
> Thanks in advance,
> 
> Paul
> 


From firewalls-owner  Tue Jan  6 20:45:29 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id TAA05667; Tue, 6 Jan 1998 19:45:07 -0800 (PST)
Received: from fw.itm-inst.com ([206.239.41.100]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id TAA28885 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 19:18:13 -0800 (PST)
Received: by fw.itm-inst.com; id WAA11476; Tue, 6 Jan 1998 22:17:48 -0500 (EST)
Received: from unknown(10.0.3.121) by fw.itm-inst.com via smap (2.0)
	id xma011472; Tue, 6 Jan 98 22:17:19 -0500
Message-Id: <3.0.3.32.19980106221344.00700264@fw.itm-inst.com>
X-Sender: rmurphy@fw.itm-inst.com
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Tue, 06 Jan 1998 22:13:44 -0500
To: "Paul Jones" <pj_27@hotmail.com>
From: Rick Murphy <rmurphy@itm-inst.com>
Subject: Re: Real Audio
Cc: firewalls@GreatCircle.COM
In-Reply-To: <19980106225958.6991.qmail@hotmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 02:59 PM 1/6/98 PST, Paul Jones wrote:
>We would like some information regarding the security implications of 
>running Real Audio through our firewall (Gauntlet).
The Gauntlet RealAudio proxy verifies that the setup protocol is indeed
RealAudio; once the setup is complete it opens a single point UDP forwarder
from the outside to the system running the player. 
Given the nature of the protocol, and the endpoint verification, there's
not much you could do to exploit the connection. 

If you permit HTTP, you shouldn't be worried about RealAudio/RealVideo.
HTTP hosts all sorts of exploits..
	-Rick


From firewalls-owner  Tue Jan  6 21:31:15 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id VAA22895; Tue, 6 Jan 1998 21:03:32 -0800 (PST)
Received: from m23.boston.juno.com (m23.boston.juno.com [205.231.100.188]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id VAA22756 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 21:03:05 -0800 (PST)
Received: (from jnthomas1@juno.com)
 by m23.boston.juno.com (queuemail) id AHI29146; Wed, 07 Jan 1998 00:02:24 EST
To: firewalls@GreatCircle.COM
Date: Tue, 6 Jan 1998 20:29:19 -0800
Subject: FW-1 xlate.conf
Message-ID: <19980106.202921.3526.2.jnthomas1@juno.com>
X-Mailer: Juno 1.49
X-Juno-Line-Breaks: 1,6,8-12
From: jnthomas1@juno.com (Jeff Thomas)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Running FW-1 2.1 on Solaris 2.51.  Ran fwxlconf to add the ip address
translation.  When installing the policy
I get a message saying "Error in line xx illegal token <^[>".  Had no
problems adding translation or with previous attempts.  I used cat -vet
to see all control characters in the file.  Nothing wrong in the file. I
do not see this character pattern in the file.   I tried removing several
lines, but the error just reports a different line.
Any suggestions.  Sun said 2.1 may be bug friendly and recommended
upgrding to 2.1C or 3.0


jeff thomas
jnthomas1@juno.com

From firewalls-owner  Tue Jan  6 21:39:05 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id VAA22927; Tue, 6 Jan 1998 21:03:38 -0800 (PST)
Received: from m23.boston.juno.com (m23.boston.juno.com [205.231.100.188]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id VAA22778 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 21:03:09 -0800 (PST)
Received: (from jnthomas1@juno.com)
 by m23.boston.juno.com (queuemail) id AHH29146; Wed, 07 Jan 1998 00:02:24 EST
To: firewalls@GreatCircle.COM
Date: Tue, 6 Jan 1998 20:08:06 -0800
Subject: FW-1 Xlate.conf
Message-ID: <19980106.202921.3526.1.jnthomas1@juno.com>
X-Mailer: Juno 1.49
X-Juno-Line-Breaks: 1,3,5,7,9-14
From: jnthomas1@juno.com (Jeff Thomas)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Running FW-1 2.1 on Solaris 2.51.  I added an entry through fwxlconf. 
When I went to do policy
install I got a message saying "error in line xx illegal token <^[>". 
The line is not the most recent entry, but
several lines above.  Previous compliations have been no problems.  I did
cat -vet on the xlate.conf file
to see all the control characters and see no problems.  Any ideas how to
get rid of this error. Do I need
to zap out the xlate.conf file and start over?  Sun said 2.1 is
bug-friendly.  Recommended upgrading
to 2.1C or 3.0.  Need to add entries to xlate.conf immediately


jeff thomas
jnthomas1@juno.com

From firewalls-owner  Tue Jan  6 21:40:38 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id UAA18150; Tue, 6 Jan 1998 20:46:16 -0800 (PST)
Received: from cebu.mozcom.com (cebu.mozcom.com [207.0.115.45]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id UAA09080 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 20:01:55 -0800 (PST)
Received: from localhost (derts@localhost) by cebu.mozcom.com (8.8.8/8.6.9) with SMTP id LAA06293; Wed, 7 Jan 1998 11:52:29 GMT
Date: Wed, 7 Jan 1998 11:52:28 +0000 (   )
From: Ederlindo Cojuangco <derts@cebu.mozcom.com>
To: Alan Bolt <alanb@allensysgroup.com>
cc: "Grigorof, Adrian" <agrigoro@mobility.com>, firewalls@GreatCircle.COM
Subject: Re: E-mail Encryption
In-Reply-To: <19980106230532656.AAA210@houdini>
Message-ID: <Pine.LNX.3.95.980107115038.6288A-100000@cebu.mozcom.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

	Is there any site where we can download it?  All I got from my
search is only an information but no software to use it.  Can anybody have
any idea on this matter?
	Thanks in advance.

ederts
	
On Tue, 6 Jan 1998, Alan Bolt wrote:

> Have you not looked into PGP?
> It has grown to have much better interface
> for users and does what you seem to want
> 
> Bobby Brown
> Network Administrator
> Allen Systems Group
> 
> ----------
> > From: Grigorof, Adrian <agrigoro@mobility.com>
> > To: firewalls@greatcircle.com
> > Subject: E-mail Encryption
> > Date: Tuesday, January 06, 1998 3:21 PM
> > 
> > I am looking for a product to be used in encrypting e-mail to be sent
> > over the Internet. I've heard something about a product called Puffer by
> > Briggs Softworks but I haven't tested it so far.  
> > 
> > The ideal software should be user friendly otherwise it won't be used by
> > "normal" users...how can you stop them from sending clear text messages
> > or unencrypted attachments?
> > 
> > Any ideas, suggestions?
> > 
> > Thanks,
> > 
> > Adrian Grigorof
> > Internet Administrator
> > Bell Mobility Cellular Inc.
> > Toronto
> > www.bellmobility.ca
> > 
> > 
> > 
> > 
> > 
> > 
> 


From firewalls-owner  Tue Jan  6 21:42:16 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id UAA19037; Tue, 6 Jan 1998 20:50:36 -0800 (PST)
Received: from mcfeely.bsfs.org (mcfeely.bsfs.org [204.91.13.34]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id UAA10105 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 20:07:30 -0800 (PST)
Received: (from wombat@localhost) by mcfeely.bsfs.org (8.6.12/8.6.12) id IAA24002; Tue, 6 Jan 1998 08:59:03 -0500
Date: Tue, 6 Jan 1998 08:59:01 -0500 (EST)
From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: Sick Puppy <sikpuppy@maestro.com>
cc: firewalls@GreatCircle.COM
Subject: Re: Wannabe needs a good book
In-Reply-To: <Pine.SUN.3.96.980106105930.4657A-100000@maestro.maestro.com>
Message-ID: <Pine.BSF.3.91.980106083703.23952C-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Wombat's Newbie Reading List:

Internetworking with TCP/IP
Volume 1
Douglas Comer
Prentice Hall
ISBN 0-13-468505-9

(Comer also has a general networking book out, but I loaned it to a 
newbie at the office - it is a better place to start for the novice than 
the above)

Internet Routing Architectures
Bassam Halabi
Cisco Press
ISBN 1-56205-652-2

The O'Reily "zoo" books
Getting Connected: The Internet at 56k and up (good newbie book)
TCP/IP
DNS and Bind
Sendmail
System Administration
Managing IP Networks with Cisco Routers
 (at http://www.oreilly.com - I'm to lazy to type the ISBNs)


Interconnections
Bridges and Routers
Radia Perlman
Addison Wesley
ISBN 0-201-56332-0
a bit dated in some areas, but good theoretical background on algorithms and 
the early "building blocks" - Master this, and you can be an "oldbie." 


... and "read an RFC a week" ...  :)
http://www.cis.ohio-state.edu/hypertext/information/rfc.html


-r.w.


On Tue, 6 Jan 1998, Sick Puppy wrote:

> Over the past few years our educational research has provided us with a
> great deal of information on Internet services, operating systems and
> various protocols.  However, all of it is very narrowly focused and
> platform specific.  One of our wannabe's, ChewYou, (oriental as the name
> implies), need a good top down introduction to networking.  Sorry to say
> we have nothing like that.  Can someone please suggest a good book on the
> general topic of networking, with some emphasis on TCP/IP, that we can
> steal?
>                                                  SP, tCED
> 
> 

From firewalls-owner  Tue Jan  6 21:43:33 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id KAA09648; Tue, 6 Jan 1998 10:34:48 -0800 (PST)
Received: from ALABAMA.CF.CS.YALE.EDU (RT-GW.CS.YALE.EDU [128.36.0.13]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id KAA09618 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 10:34:39 -0800 (PST)
Received: from SPARKY.CF.CS.YALE.EDU by ALABAMA.CF.CS.YALE.EDU (8.7.1/res.host.cf-4.0)
	with ESMTP id NAA04791; Tue, 6 Jan 1998 13:34:15 -0500 (EST) sender long-morrow@CS.YALE.EDU for 
Received: by SPARKY.CF.CS.YALE.EDU (Sendmail-8.7.1/res.client.cf-4.0)
	id NAA17454; Tue, 6 Jan 1998 13:34:12 -0500 (EST)
Date: Tue, 6 Jan 1998 13:34:12 -0500 (EST)
Message-Id: <199801061834.NAA17454@SPARKY.CF.CS.YALE.EDU>
To: RANDAL_LATHROP@mech.disa.mil, oliverk@ols-eds.de
Subject: Re: Re[2]: Hardware for seperating LAN from dialouts
Cc: firewalls@greatcircle.com, ryanr@sybase.com
From: "H. Morrow Long" <morrow.long@yale.edu>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

oliverk@ols-eds.de wrote:
>What happens to services on connected systems (PC is connected to a LAN,
>which might have a ftp server somewhere...) - do you think the PC with ip
>forwarding/routing could be an entry point to attack other computers on the
>attached network?

Yes.  It is a somewhat remote possibility as someone would have to know
about the dialup link, the networks and hosts involved -- and source
routing would most likely have to be enabled on the PC w/IP-forwarding
dialup up the Internet.  Presuming you are getting a different dynamic
IP address each time you dial up via PPP the possibility that someone
might exploit it is fairly remote. But it is a possibility nonetheless,
and one that should not be discounted by anyone with valuables to protect.

>Apart from any services being used for illicit use, could other risks arise
>from people sniffing on network traffic that passes the exposed computer?
>Do you think that's possible?

Yes.  Presuming you could install a remote sniffer on many networks
there is a good changed you would find yourself on a PC attached to a
LAN hub without eavesdrop protection (or on a hub where the port
protection has not been configured).

Note that running an anonymous FTP server on a PC on your LAN which is
also dialed up to the Internet presents an immediate security problem
to your internal network because many FTP servers allow the FTP 'port
bounce' attack ( a remote client of the anonymous FTP server can
request that an ftp-data connection be established from the FTP server
to a port on a 3rd party host.  In this way one can probe your internal
network for services and weaknesses.).

H. Morrow Long, Yale Univ IT ISO -Info Technology Services Info Security Officer
175 Whitney Avenue, New Haven, CT 06520-8276, (203)432-1248(voice) 432-0593(FAX)
INET: http://pantheon.yale.edu/~long/ mailto:Morrow.Long@yale.edu
PAGE: (203)370-3081, (800)347-2574,   mailto:1165469@pager.mcb.com  PIN# 1165469
PGP 1024/54F9FD69 1997/08/25 fp 97 ED E7 9D 41 8A 90 8C  4D 7C 22 56 80 BA 84 09

From firewalls-owner  Tue Jan  6 21:43:36 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id TAA06074; Tue, 6 Jan 1998 19:48:03 -0800 (PST)
Received: from pentagon.io.com (pentagon.io.com [199.170.88.5]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id TAA02656 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 19:31:20 -0800 (PST)
Received: from localhost (cooper@localhost)
	by pentagon.io.com (8.8.5/8.8.5) with SMTP id VAA10893;
	Tue, 6 Jan 1998 21:31:26 -0600 (CST)
X-Authentication-Warning: pentagon.io.com: cooper owned process doing -bs
Date: Tue, 6 Jan 1998 21:31:26 -0600 (CST)
From: William Cooper <cooper@io.com>
To: Gordon LaSane <glasane@gdsconnect.com>
cc: MacGyver <macgyver@tos.net>,
        Firewalls Mailing List <firewalls@GreatCircle.COM>
Subject: RE: Stateful Inspection Anyone?  Explore your options.
In-Reply-To: <A1F2B23A4F10D1118DDB00A0C9193FCF016C01@ALTOS>
Message-ID: <Pine.BSI.3.96.980106211319.9610A-100000@pentagon.io.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


On Tue, 6 Jan 1998, Gordon LaSane wrote:

> Visit http://www.xxxxxxxxxxxxxx.com or contact me.

[shameless advertising deleted]

i haven't checked the charter recently, but almost certainly this kind of
blatant advertising is not permitted, at the very least it's not
appropriate for dist. to the list (IMO) so keep it in private email.

> 	Hi folks,
> 

> 	I've been wondering this for a while, but just haven't gotten
> around to
> 	asking anyone yet: 
> 
> 	Checkpoint's Firewall-1 has a feature known as "stateful
> inspection" 

"stateful inspection" is not a feature, it's the name for the technology
upon which the FireWall-1 product is based.  in a nutshell it refers to
the fact that each packet is inspected "in context."  say you wanted to
allow your users to ftp download to their hosts (protected by FW-1) thru
the firewall.  now say a packet show up from the Internet that says it's
a packet destined for host 192.3.3.3 (a protected host) and is in response
to an FTP request made from that machine.  FW-1 looks at that packet in
context by examining the logs and searching for the outbound FTP request
that this packet is supposed to be in response to.  if there was no
outbound request, the incoming packet is refused.

> which
> 	they tout as the end-all and be-all of packet-filtering and
> inspection.
> 	Anyone had any experience in using this feature or have any
> thoughts
> 	regarding stateful inspection?

anyone who uses FW-1 has experience w/ stateful inspection.

>  How large of a performance
> impact is there
> 	when stateful inspection is enabled?  Are the gains worth the
> added load?

FW-1 will currently run at speeds of up ot 86Mbps, w/ fastpath enabled,
on a big sun box w/ lots of RAM.

> 
> 	Hope this spurs some interesting discussion.

hope you go do some reading before asking your next question, i applaud
your curiousity but your questions should be a little better researched.
all of the above info is easy to find.

Regards,

- bill

cooper@io.com


From firewalls-owner  Tue Jan  6 21:45:10 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id SAA21076; Tue, 6 Jan 1998 18:42:45 -0800 (PST)
Received: from ALABAMA.CF.CS.YALE.EDU (RT-GW.CS.YALE.EDU [128.36.0.13]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id SAA20900 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 18:42:13 -0800 (PST)
Received: from SPARKY.CF.CS.YALE.EDU by ALABAMA.CF.CS.YALE.EDU (8.7.1/res.host.cf-4.0)
	with ESMTP id VAA24449; Tue, 6 Jan 1998 21:42:10 -0500 (EST) sender long-morrow@CS.YALE.EDU for 
Received: by SPARKY.CF.CS.YALE.EDU (Sendmail-8.7.1/res.client.cf-4.0)
	id VAA18330; Tue, 6 Jan 1998 21:42:08 -0500 (EST)
Date: Tue, 6 Jan 1998 21:42:08 -0500 (EST)
Message-Id: <199801070242.VAA18330@SPARKY.CF.CS.YALE.EDU>
To: firewalls@GreatCircle.COM, glasane@gdsconnect.com, macgyver@tos.net
Subject: RE: Stateful Inspection Anyone?  Explore your options.
From: "H. Morrow Long" <morrow.long@yale.edu>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

There is no guaruntee that application specific proxies (aka
application level gateways) won't misbehave, malfunction or be
misconfigured either.

It is entirely within the realm of possibility that someone someday
might come upon a way to make an inbound telnet proxy service on a
firewall proxy server overflow a buffer (or overwrite some other memory
region) or otherwise discover and exploit a bug which could allow them to
bypass a 'strong authentication' challenge and be allowed into an
internal corporate network (which is why allowing any inbound access from
the Internet to your internal secure net -- even when strongly authenticated
 -- is always riskier than not doing so.).

>From: Gordon LaSane <glasane@gdsconnect.com>	...
>One of the biggest complaints about stateful inspection is that if the
>state table becomes corrupt, the network could become vulnerable to the
>outside. 
>
>Check out application gateways, these proxy servers take a users request
>for an Internet service and forward it to the actual service. Proxies
>replace the actual service, acting as a gateway and are for this reason
>commonly referred to as application gateways.


H. Morrow Long, Yale Univ IT ISO -Info Technology Services Info Security Officer
175 Whitney Avenue, New Haven, CT 06520-8276, (203)432-1248(voice) 432-0593(FAX)
INET: http://pantheon.yale.edu/~long/ mailto:Morrow.Long@yale.edu
PAGE: (203)370-3081, (800)347-2574,   mailto:1165469@pager.mcb.com  PIN# 1165469
PGP 1024/54F9FD69 1997/08/25 fp 97 ED E7 9D 41 8A 90 8C  4D 7C 22 56 80 BA 84 09

From firewalls-owner  Tue Jan  6 21:45:51 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id VAA02810; Tue, 6 Jan 1998 21:37:40 -0800 (PST)
Received: from relay2.phx.genuity.net (relay2.phx.genuity.net [207.240.5.57]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id VAA02715 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 21:37:21 -0800 (PST)
Received: from x-files.genuity.net (x-files.genuity.net [207.240.3.45])
	by relay2.phx.genuity.net (8.8.7/8.8.5) with ESMTP id FAA08547
	for <firewalls@greatcircle.com>; Wed, 7 Jan 1998 05:37:46 GMT
Received: by X-FILES with Internet Mail Service (5.0.1458.49)
	id <CMBN96Y8>; Tue, 6 Jan 1998 22:38:14 -0700
Message-ID: <2E8F4FDB9F00D01186A6080009B30C7F02253FE9@X-FILES>
From: Scott Knievel <sknievel@genuity.net>
To: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: INSPECT language
Date: Tue, 6 Jan 1998 22:38:11 -0700
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1458.49)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I am looking for some good information on the INSPECT language for
CheckPoints FireWall-1 product.   Any suggestions?

Thanks,

Scott Knievel
Technical Support Engineer
Genuity Inc.
www.genuity.net

From firewalls-owner  Tue Jan  6 22:15:31 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id VAA03519; Tue, 6 Jan 1998 21:45:18 -0800 (PST)
Received: from gate.quick.com.au (gate.quick.com.au [203.12.250.130]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id VAA26994 for <firewalls@greatcircle.com>; Tue, 6 Jan 1998 21:16:52 -0800 (PST)
Received: (from sjg@localhost) by gate.quick.com.au (8.8.5/8.7.3) id QAA29168; Wed, 7 Jan 1998 16:16:54 +1100 (EST)
Date: Wed, 7 Jan 1998 16:16:54 +1100 (EST)
From: "Simon J. Gerraty" <sjg@quick.com.au>
Message-Id: <199801070516.QAA29168@gate.quick.com.au>
To: Kerry Jones <kjones@aims.gov.au>
Cc: firewalls@greatcircle.com
Subject: Re: Split DNS??
References: <34B2BD37.402DDEBC@aims.gov.au>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Kerry,

>What are the benefits of running split DNS??? Is it more secure?? Or is
>it a pain in the ass which doesn't increase security much at all?? Can
>someone give me a bit of an overview of how it would be done.

The main benefit of running a split DNS is to provide different MX lists
to internal vs external MTAs.  The alternative is that external mail
is always delayed while the first connection attempt to an unreachable
internal mailhost times out, or internal mail is needlessly routed via
the firewall (which may be unacceptable for other reasons).

The simplest way to run a split DNS is to have a DNS server on the 
firewall or DMZ (or even your friendly ISP if you trust them)
which is registered externally as authoritative for your domain.
Then run another server (or two :-) internally that are also 
authoritative for the domain, but have a more complete picture.
Note that your firewall uses the internal nameservers not the
external one - that's just for outsiders.

Some folk like split DNS because they think that "hiding" their internal
hostnames makes them more secure.  Such info leaks out in so many ways
that this "security by obscurity" is a myth.

Having said that, there is no need for your external DNS to contain 
much more than an NS list, an MX list and the address of your firewall.  

There are more specific details that need to be sorted out as to
how your internal nameservers resolve external names (or even if
they do), but the above  should get you started.

--sjg


From firewalls-owner  Tue Jan  6 22:47:53 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id VAA04825; Tue, 6 Jan 1998 21:50:51 -0800 (PST)
Received: from inergen.sybase.com (inergen.sybase.com [192.138.151.43]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id VAA04669 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 21:50:18 -0800 (PST)
Received: from smtp1.sybase.com (sybgate.sybase.com [130.214.220.35])
          by inergen.sybase.com (8.8.4/8.8.4) with SMTP
	  id VAA29970; Tue, 6 Jan 1998 21:52:17 -0800 (PST)
Received: from gwwest.sybase.com by smtp1.sybase.com (4.1/SMI-4.1/SybH3.5-030896)
	id AA15660; Tue, 6 Jan 98 21:53:30 PST
Received: by gwwest.sybase.com(Lotus SMTP MTA v1.1 (385.6 5-6-1997))  id 88256585.002079A3 ; Tue, 6 Jan 1998 21:54:42 -0800
X-Lotus-Fromdomain: SYBASENOTES
From: "Ryan Russell"<ryanr@sybase.com>
To: glasane@gdsconnect.com
Cc: macgyver@tos.net, firewalls@GreatCircle.COM
Message-Id: <88256585.001FDAA6.00@gwwest.sybase.com>
Date: Tue, 6 Jan 1998 21:49:15 -0800
Subject: RE: Stateful Inspection Anyone? Explore your options.
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


One of the biggest complaints about proxies is that
if the TCP connection table becomes corrupt, the network
could become vulnerable to the outside.

Quit spreading FUD.

               Ryan






glasane@gdsconnect.com on 01/06/98 01:37:03 PM

To:   macgyver@tos.net, firewalls@GreatCircle.COM
cc:    (bcc: Ryan Russell/SYBASE)
Subject:  RE: Stateful Inspection Anyone?  Explore your options.




One of the biggest complaints about stateful inspection is that if the
state table becomes corrupt, the network could become vulnerable to the
outside.
Check out application gateways, these proxy servers take a users request
for an Internet service and forward it to the actual service. Proxies
replace the actual service, acting as a gateway and are for this reason
commonly referred to as application gateways.
Visit http://www.securecomputing.com or contact me.
     Gordon LaSane
     Global  Data  Systems, Inc.
     Internet and Intranet Firewalls and Security Group
     Consulting and Installing Solutions for Your Company's Data
Security:
     Remote User Authentication
     Internet Access
     Virtual Private Networks
     Web Filtering
     Intranets
     Firewalls
     Gordon LaSane
     781/740-8818 x13 ph
     781/740-8830 fax
     glasane@gdsconnect.com
     Visit us on the web at   http://www.gdsconnect.com


     -----Original Message-----
     From:     MacGyver [SMTP:macgyver@tos.net]
     Sent:     Tuesday, January 06, 1998 11:55 AM
     To:  Firewalls Mailing List
     Subject:  Stateful Inspection Anyone?
     Hi folks,
     I've been wondering this for a while, but just haven't gotten
around to
     asking anyone yet:
     Checkpoint's Firewall-1 has a feature known as "stateful
inspection" which
     they tout as the end-all and be-all of packet-filtering and
inspection.
     Anyone had any experience in using this feature or have any
thoughts
     regarding stateful inspection?  How large of a performance
impact is there
     when stateful inspection is enabled?  Are the gains worth the
added load?
     Hope this spurs some interesting discussion.


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
             ^               Habeeb J. Dihu
          -'   `-            Managing Senior Technologist
        " '     ` "          Cirrus Technologies
      "  '       `  "
     "  '      .  `  "
     "  '    .' ` `  "       'I don't believe in the no-win scenario'
      " `   '    `' "           -- Captain James T. Kirk,  Star Trek
II: TWK
        `  ' _  _ '          'There is an old Vulcan proverb, `Only
Nixon
         '                    could go to China.`'
                                -- Captain Spock, Star Trek VI: TUC
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~






From firewalls-owner  Tue Jan  6 23:45:38 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id WAA15642; Tue, 6 Jan 1998 22:58:16 -0800 (PST)
Received: from mailhub.vector.co.za (mailhub.vector.co.za [192.96.164.70]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id WAA15561 for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 22:57:54 -0800 (PST)
Received: from vcsfk.co.za (vcsfk.vector.co.za [192.96.164.71]) by mailhub.vector.co.za (8.7.5/8.7) with SMTP id IAA19757; Wed, 7 Jan 1998 08:57:15 +0200 (SAT)
Received: from vcsfk by vcsfk.co.za (SMI-8.6/SMI-SVR4)
	id IAA00612; Wed, 7 Jan 1998 08:57:32 -0200
Message-Id: <199801071057.IAA00612@vcsfk.co.za>
Date: Wed, 7 Jan 1998 08:57:31 -0200 (GMT)
From: Feroz Khan - VCS <Feroz.Khan@VECTOR.CO.ZA>
Reply-To: Feroz Khan - VCS <Feroz.Khan@VECTOR.CO.ZA>
Subject: Re: FW-1 3.0 and Solaris 2.6 ok?
To: RWaegner@hou.mdc.com, grat@frii.com
Cc: firewalls@GreatCircle.COM
MIME-Version: 1.0
Content-Type: TEXT/plain; charset=us-ascii
Content-MD5: VWCK0tG1j2ZswcO/jo9/oA==
X-Mailer: dtmail 1.2.0 CDE Version 1.2 SunOS 5.6 sun4c sparc 
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

There seems to be some confusion with regards to Solaris 2.6 and FW-1. Here
is what I have tested:

Checkpoint: Works with 3.0b or greater.

Solstice:  Must be installed on 2.5.1 first. One of the following patches
           must then be installed:
             Non-VPN - 105477
             VPN-FWZ - 105478
             VPN-DES - 105474
           At this point, you can do an OS upgrade to Solaris 2.6.
           
Hope this helps,
Feroz
           


From firewalls-owner  Wed Jan  7 02:37:29 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id BAA21075; Wed, 7 Jan 1998 01:45:52 -0800 (PST)
Received: from szrtfw2.szerencsejatek.hu ([194.88.40.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id AAA12370 for <firewalls@greatcircle.com>; Wed, 7 Jan 1998 00:58:30 -0800 (PST)
Message-Id: <199801070858.AAA12370@honor.greatcircle.com>
Received: from SZRTFW2 [194.88.40.3]
	(HELO localhost)
	by szrtfw2.szerencsejatek.hu (AltaVista Mail V1.0/1.0 BL18 listener)
	id 0000_002b_34b3_4438_3490;
	Wed, 07 Jan 1998 10:00:40 +0100
From: "Takacs Istvan" <anonymus@mail.matav.hu>
To: <firewalls@greatcircle.com>
Subject: LanOptics Guardian???
Date: Wed, 7 Jan 1998 08:04:23 +0100
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1162
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-2
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

Have you ever used that firewall above? What is your experience?
I've read some articles about it, but they seem as an official
advertisement
from the LanOptics.

Thank you.

Regards.

	      Istvan Takacs 
      mailto:anonymus@mail.matav.hu

From firewalls-owner  Wed Jan  7 04:45:54 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id DAA08550; Wed, 7 Jan 1998 03:49:48 -0800 (PST)
Received: from send1b.yahoomail.com (send1b.yahoomail.com [205.180.60.23]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id DAA08511 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 03:49:33 -0800 (PST)
Message-ID: <19980107114944.20663.rocketmail@send1b.yahoomail.com>
Received: from [193.106.105.2] by send1b; Wed, 07 Jan 1998 03:49:44 PST
Date: Wed, 7 Jan 1998 03:49:44 -0800 (PST)
From: BEAUVALOT Erik <erik_beauvalot@yahoo.com>
Subject: Re: Real Audio
To: Rick Murphy <rmurphy@itm-inst.com>, Paul Jones <pj_27@hotmail.com>
Cc: firewalls@GreatCircle.COM
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

take a look at :

	http://www.beauvalot.com/ra

	You have every thing to configure your
	proxy to be able to play real audio file ....

Regards,




---Rick Murphy <rmurphy@itm-inst.com> wrote:
>
> At 02:59 PM 1/6/98 PST, Paul Jones wrote:
> >We would like some information regarding the security implications
of 
> >running Real Audio through our firewall (Gauntlet).
> The Gauntlet RealAudio proxy verifies that the setup protocol is
indeed
> RealAudio; once the setup is complete it opens a single point UDP
forwarder
> from the outside to the system running the player. 
> Given the nature of the protocol, and the endpoint verification,
there's
> not much you could do to exploit the connection. 
> 
> If you permit HTTP, you shouldn't be worried about
RealAudio/RealVideo.
> HTTP hosts all sorts of exploits..
> 	-Rick
> 
> 

_________________________________________________________
DO YOU YAHOO!?
Get your free @yahoo.com address at http://mail.yahoo.com


From firewalls-owner  Wed Jan  7 05:31:11 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id FAA18949; Wed, 7 Jan 1998 05:15:08 -0800 (PST)
Received: from honcho.columbiasc.ncr.com (h153-78-17-231.NCR.COM [153.78.17.231]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id FAA18931 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 05:14:50 -0800 (PST)
Received: from exchsmtp.ColumbiaSC.NCR.COM (xgate.ColumbiaSC.NCR.COM [153.78.17.107]) by honcho.columbiasc.ncr.com (8.7.6/8.6.12) with SMTP id IAA01713 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 08:15:13 -0500 (EST)
Received: by exchsmtp.ColumbiaSC.NCR.COM with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63)
	id <01BD1B44.07FB2EB0@exchsmtp.ColumbiaSC.NCR.COM>; Wed, 7 Jan 1998 08:12:44 -0500
Message-ID: <c=US%a=_%p=NCR%l=ENGPO-980107131412Z-21305@exchsmtp.ColumbiaSC.NCR.COM>
From: "Caldwell, Matt" <caldwm@xgate.columbiasc.ncr.com>
To: "'firewalls@GreatCircle.COM'" <firewalls@GreatCircle.COM>
Subject: RE: firewall audit service referral
Date: Wed, 7 Jan 1998 08:14:12 -0500
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

However, remote penetration testing does have it's Pro's, It saves the
customer travel time and the expenses 
associated. It is always good to investigate who you are dealing with,
and to at least see someone face to face to talk about non-disclosure
agreements and that sort of thing.  I have had an incident in which the
roles where switched, the customer was not legitimate and wanted me to
attack a legitimate company. Beware who you do business with and how. I
have learned one thing and that is security is not inherently safety.

Matthew F. Caldwell - Security Analyst
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Visionary Corporate Computing Concepts (VC3)
Email:        matt.caldwell@vc3.com
Company Web: http://www.vc3.com/
Personal  Web: http://www.vc3.com/~caldwm
Office Phone: 803-733-7333
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

>----------
>From: 	Frank Willoughby[SMTP:frankw@in.net]
>Sent: 	Wednesday, December 31, 1997 11:08 PM
>To: 	James Terry
>Cc: 	firewalls@GreatCircle.COM
>Subject: 	Re: firewall audit service referral
>
>At 11:14 AM 12/31/97 -0800, James Terry <james@imx-exchange.com> allegedly
>wrote:
>
>8< [snip]
>
>
>>Hello,
>>
>>could anyone recommend a good firewall testing service?
>>
>>thanks,
>>james@imx-exchange.com
>
>It depends on what you are looking for.  
>
>Fortified Networks does firewall testing for customers (corporations,
>governments, etc).  
>
>FNITL is an independent test laboratory for testing firewalls & other
>InfoSec products.
>The most frequent testing performed are Quality Assurance Tests of Internet
>Firewalls 
>& other InfoSec products - primarily for vendors, etc.
>
>CAUTION:
>Beware of any organizations which will perform a remote firewall
>penetration test.
>This is an inherently dangerous practice which has the potential of leading
>hackers
>to their next victims.
>
>Best Regards,
>
>
>Frank
>The opinions of the author of this mail may not necessarily be 
>representative of the opinions of Fortifed Networks, Inc.
>
>Fortified Networks, Inc. - http://www.fortified.com/
>Home of the Free Internet Firewall Evaluation Checklist
>Expert (vendor-neutral) Computer and Network Security Solutions
>Phone: (317) 573-0800     Fax: (317) 573-0817
>

From firewalls-owner  Wed Jan  7 06:01:55 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id DAA05025; Wed, 7 Jan 1998 03:21:05 -0800 (PST)
Received: from staffmail.ccn.ac.uk (staffmail.ccn.ac.uk [194.66.186.89]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id DAA04983 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 03:20:42 -0800 (PST)
Received: by staffmail.ccn.ac.uk with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5)
	id <01BD1B5E.6E8D4630@staffmail.ccn.ac.uk>; Wed, 7 Jan 1998 11:21:43 -0000
Message-ID: <c=US%a=_%p=City_College_Nor%l=STAFFMAIL-980107112141Z-7472@staffmail.ccn.ac.uk>
From: "Marriage, Michael" <mikem@ccn.ac.uk>
To: "'firewalls@GreatCircle.COM'" <firewalls@GreatCircle.COM>
Subject: MS Proxy and netmeeting
Date: Wed, 7 Jan 1998 11:21:41 -0000
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Has anyone configured MS Proxy to work with netmeeting? If so what are
the key points that I should be looking at. We have barred NETBIOS like
packets on site though our router. Is this going to cause problems with
Netmeeting.

Is there an up to date list of TCP/IP information on ports used by the
myriad microsoft network aware packages in a human readable form for us
very mere mortals.

i.e.
	Net Meeting
	Secure HTTP ( ok so its no Microsoft but they use it )
	NetBIOS
	Visual interdev ( copy to web functions )
	ODBC
---------------------------------------------------------------------
Mike Marriage
Systems Engineering Team Leader
City College Norwich

Email   mikem@ccn.ac.uk
Tel	01603 773025
Fax      01603 773122 ( Please mark for my attention ) 
------------------------------------------------------------------------
-



From firewalls-owner  Wed Jan  7 06:16:00 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA23760; Wed, 7 Jan 1998 06:03:09 -0800 (PST)
Received: from lafcol (lafcol.lafayette.edu [139.147.8.5]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id GAA23732 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 06:02:59 -0800 (PST)
Received: from localhost by lafcol (SMI-8.6/SMI-SVR4)
	id JAA05054; Wed, 7 Jan 1998 09:02:44 -0500
Date: Wed, 7 Jan 1998 09:02:37 -0500 (EST)
From: John Mulligan <mulligan@lafcol.lafayette.edu>
To: firewalls@GreatCircle.COM
Subject: Re: E-mail Encryption
In-Reply-To: <Pine.LNX.3.96.980106171036.25274D-100000@co.numerix.com>
Message-ID: <Pine.SOL.3.93.980107085530.4959B-100000@lafcol.lafayette.edu>
X-UIN: 1058259
X-URL: http://www.lafayette.edu/~mulligaj
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

-----BEGIN PGP SIGNED MESSAGE-----

On Tue, 6 Jan 1998, Greg Whalin wrote:
> How about PGP?  Or how about Netscape with client certificates?

This may not be what you are looking for, but I recently purchased Eudora
Pro 3.03 and it came bundled with a PGP 5 plug-in.  It was integrated
rather nicely with the mailer (and the Win95 file explorer as well).  The
bundle I got had no support for RSA keys, just DSS, but you can download a
upgrade to use RSA keys for just $5.  It may be a good solution if you
have a whole lot of "regular" users that dont want a lot of hassle.

I would definitly look into PGP rather than other encryption products.
Its (sort-of) free, the source is public so its secure, and it is already
widely used.

Also... I just read an article in Computer Shopper about how the IETF is
conisdering using PGP as a standard for email encryption/signing.  I dont
know how true that is, but it is something to consider.  ....If someone
cares to comment (off the list) about that.

One more... I use PINE 3.93 to send most of my mail, and it comes with
hooks built in to use PGP.  Its a great solution if you need unix platform
stuff.

Well... thats my two cents.

- - john


John P. Mulligan <mulligaj@lafayette.edu>

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQB1AwUBNLOLAn+KnP1k0ErJAQH6XQMAun3QRjE3ERT/TbWu/gDU7Yr4vLWOCpr5
wWrW8BL84FjWHXjPH2fMipNrMhY1SUaJ0t0vCKpDpAaw4yRbd6gKzZe90JnEHA5p
LuCv2q/cmEoL7jTBuvh6oikKmxEgeP9u
=qytl
-----END PGP SIGNATURE-----


From firewalls-owner  Wed Jan  7 06:31:02 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id DAA08163; Wed, 7 Jan 1998 03:48:00 -0800 (PST)
Received: from uwns.underworld.net (uwns.student.umd.edu [129.2.176.105]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id DAA08100 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 03:47:43 -0800 (PST)
Received: from localhost (carl@localhost)
	by uwns.underworld.net (8.8.7/8.8.6) with SMTP id GAA10784;
	Wed, 7 Jan 1998 06:47:37 -0500
Date: Wed, 7 Jan 1998 06:47:36 -0500 (EST)
From: carl <carl@outside.net>
X-Sender: carl@uwns.underworld.net
To: Ederlindo Cojuangco <derts@cebu.mozcom.com>
cc: Alan Bolt <alanb@allensysgroup.com>,
        "Grigorof, Adrian" <agrigoro@mobility.com>, firewalls@GreatCircle.COM
Subject: Re: E-mail Encryption
In-Reply-To: <Pine.LNX.3.95.980107115038.6288A-100000@cebu.mozcom.com>
Message-ID: <Pine.LNX.3.96.980107064708.10777A-100000@uwns.underworld.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


www.pgp.com would probably be a pretty good place to start...

Carl Downing
Outside Broadcast Network

"Why did he bother her?"

On Wed, 7 Jan 1998, Ederlindo Cojuangco wrote:

> 	Is there any site where we can download it?  All I got from my
> search is only an information but no software to use it.  Can anybody have
> any idea on this matter?
> 	Thanks in advance.
> 
> ederts
> 	
> On Tue, 6 Jan 1998, Alan Bolt wrote:
> 
> > Have you not looked into PGP?
> > It has grown to have much better interface
> > for users and does what you seem to want
> > 
> > Bobby Brown
> > Network Administrator
> > Allen Systems Group
> > 
> > ----------
> > > From: Grigorof, Adrian <agrigoro@mobility.com>
> > > To: firewalls@greatcircle.com
> > > Subject: E-mail Encryption
> > > Date: Tuesday, January 06, 1998 3:21 PM
> > > 
> > > I am looking for a product to be used in encrypting e-mail to be sent
> > > over the Internet. I've heard something about a product called Puffer by
> > > Briggs Softworks but I haven't tested it so far.  
> > > 
> > > The ideal software should be user friendly otherwise it won't be used by
> > > "normal" users...how can you stop them from sending clear text messages
> > > or unencrypted attachments?
> > > 
> > > Any ideas, suggestions?
> > > 
> > > Thanks,
> > > 
> > > Adrian Grigorof
> > > Internet Administrator
> > > Bell Mobility Cellular Inc.
> > > Toronto
> > > www.bellmobility.ca
> > > 
> > > 
> > > 
> > > 
> > > 
> > > 
> > 
> 


From firewalls-owner  Wed Jan  7 07:05:43 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id DAA08502; Wed, 7 Jan 1998 03:49:29 -0800 (PST)
Received: from mail.zrz.TU-Berlin.DE (mail.zrz.TU-Berlin.DE [130.149.4.15]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id BAA15671 for <firewalls@greatcircle.com>; Wed, 7 Jan 1998 01:16:11 -0800 (PST)
Received: from fb3-s7.math.tu-berlin.de by mail.zrz.TU-Berlin.DE 
          with SMTP (IC-PP); Wed, 7 Jan 1998 10:14:58 +0100
Received: from fb3-s12.math.TU-Berlin.DE by fb3-s7.math.tu-berlin.de with SMTP 
          id AA02599 (5.67b8/IDA-1.4.4); Wed, 7 Jan 1998 10:14:47 +0100
Received: by fb3-s12.math.tu-berlin.de id AA18809 (5.67b8/IDA-1.4.4);
          Wed, 7 Jan 1998 10:13:46 +0100
Date: Wed, 7 Jan 1998 10:13:46 +0100
Message-Id: <199801070913.AA18809@fb3-s12.math.tu-berlin.de>
From: Bogdan Pelc <pelc@fb3-s7.math.tu-berlin.de>
To: kjones@aims.gov.au
Cc: firewalls@greatcircle.com
In-Reply-To: <34B2BD37.402DDEBC@aims.gov.au> (message from Kerry Jones on Wed, 07 Jan 1998 09:24:39 +1000)
Subject: Re: Split DNS??
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>>>>> "KJ" == Kerry Jones <kjones@aims.gov.au> writes:

  KJ> Hi, This is a great Mailing list..I am so impressed with the answers
  KJ> I got from my last question DNS on Firewalls!!.. I'm going to ask
  KJ> another..

  KJ> What are the benefits of running split DNS??? Is it more secure?? Or
  KJ> is it a pain in the ass which doesn't increase security much at all??
  KJ> Can someone give me a bit of an overview of how it would be done.

  KJ> Is it a simple matter of running 1 DNS on the DMZ (for internet) and
  KJ> another totally separate DNS on the internal network (for local
  KJ> machines)??  Would the 2 DNS servers be totally independent of one
  KJ> another or would one have to update the other one?

  KJ> Thanks in advance...

  KJ> -- Kerry Jones kjones@aims.gov.au

Hi, I am new on the list, so Hallo Everybody.

DNS.
Some Firewalls have its own SplitDNS-proxies, which implement secure DNS
(For example Eagle from Raptor). The securest way to setup DNS I know ist:
2 DNS-Server.
First on the Firewall. It's fake-server. It knows only about the ftp, www
and so on. So it knows the firewall itself and some Machines on DMZ you
want to expose. But be carefull I would do IP-Redirection inorder to hide
the IP_Information for the DMZ!
Second on your Internal network. It knows all internal Maschines.

Attention:
The Machines schould be so configured, that:
1. Internal Machines, DMZ Machines _AND_ Firewall itself (!!!) (so all
Machines) ask the internal server for the IP. Is it internal IP, than it
knows it (he is the primary server for your internal Domain). Is it other
IP, so it forwards the question to the fakeserver on the FW and it makes the
question to the next DNS-Server on the internet and so on. When it gets the
answer it replies to the internal server and it replies to the Machine.

There are some Problems with the IN-addr.arpa but one can do it right.

Hope it helps.

-- 
____________________________________________________________________________
     Bogdan Pelc; Sekr. MA 6-3, Ma682; Tel: 030-31423607, 030-31422491
			  pelc@math.tu-berlin.de

Do You realize , that this world is totally FUGAZI, where are the poets,
where are the visionaries ...  (FISH)

From firewalls-owner  Wed Jan  7 07:27:11 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id CAA28823; Wed, 7 Jan 1998 02:45:49 -0800 (PST)
Received: from voyager.viser.net (voyager.viser.net [209.104.200.8]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id CAA25882 for <firewalls@greatcircle.com>; Wed, 7 Jan 1998 02:18:29 -0800 (PST)
From: brian@viser.net
Received: from viser.net (salm-40.viser.net [209.104.200.70])
	by voyager.viser.net (8.8.7/8.8.7) with SMTP id CAA27696;
	Wed, 7 Jan 1998 02:21:30 -0800 (PST)
Date: Wed, 7 Jan 1998 02:21:30 -0800 (PST)
Message-Id: <199801071021.CAA27696@voyager.viser.net>
To: brian@viser.net
Subject: Warning!
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

WARNING! AFTER YOU CALL MY AMAZING RECORDED HOTLINE at the phone number below and receive your FREE report, NO OTHER PASSAGE TO WEALTH WILL EVER MAKE SENSE TO YOU AGAIN!  I will show you how to eliminate your fears of being poor forever!

DISCOVER THE SECRETS TO IMMEDIATE HOME BASED INCOME!  I have invented a failproof automatic money generating business that works by itself, month after month and YEAR AFTER YEAR, BY ITSELF!

If you are interested in becoming successful NOW!  Then simply CALL MY AMAZING RECORDED MESSAGE AT 503-390-5735 or 503-371-5848 and you will receive your FREE information about how you will become successful IMMEDIATELY!  

Thank you,

National Home Office Council
Brian L. Lee
President


From firewalls-owner  Wed Jan  7 08:10:20 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id BAA21300; Wed, 7 Jan 1998 01:48:32 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id BAA16205 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 01:17:47 -0800 (PST)
Received: from inet.unisource.nl by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-970426)
	id BAA29002; Wed, 7 Jan 1998 01:16:40 -0800 (PST)
Received: from inet.unisource.nl (lassie.gv-itf.unisource.nl [62.12.30.6])
	by inet.unisource.nl (8.8.5/8.8.5) with ESMTP id KAA13055
	for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 10:17:39 +0100 (MET)
Message-ID: <34B346FD.604A8185@inet.unisource.nl>
Date: Wed, 07 Jan 1998 10:12:29 +0100
From: Andre van der Lans <andre.van.der.lans@inet.unisource.nl>
Organization: Unisource Business Networks
X-Mailer: Mozilla 4.03 [en] (X11; I; Linux 2.0.30 i586)
MIME-Version: 1.0
To: firewalls@GreatCircle.COM
Subject: Audit and Scanning tools
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Buenos dias, Buenos nodges, Buenos Aires

Does anyboby know if there are some audit and scanning tools available
for Firewalls, which can automaticaly scan logfiles for hacking attempts
and which can generate reports on traffick and other activities,

Regards, Andre


-- 
Andre van der Lans
Unisource Business Networks Netherlands bv
Koningin Sophie St 120, 2595 TM The Hague
Tel +31 703711069, Fax +31 703712638
Email: andre.van.der.lans@inet.unisource.nl

From firewalls-owner  Wed Jan  7 08:23:35 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id AAA03459; Wed, 7 Jan 1998 00:20:27 -0800 (PST)
Received: from inet.unisource.nl (mail.inet.unisource.nl [194.151.95.4]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id AAA03395 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 00:20:12 -0800 (PST)
Received: from inet.unisource.nl (lassie.gv-itf.unisource.nl [62.12.30.6])
	by inet.unisource.nl (8.8.5/8.8.5) with ESMTP id JAA12368;
	Wed, 7 Jan 1998 09:20:36 +0100 (MET)
Message-ID: <34B3399E.FC1D7A47@inet.unisource.nl>
Date: Wed, 07 Jan 1998 09:15:26 +0100
From: Andre van der Lans <andre.van.der.lans@inet.unisource.nl>
Organization: Unisource Business Networks
X-Mailer: Mozilla 4.03 [en] (X11; I; Linux 2.0.30 i586)
MIME-Version: 1.0
To: Randall Kizer <rkizer@guten.sddpc.org>, firewalls@GreatCircle.COM
Subject: Re: Firewall for ISP
References: <3.0.3.32.19971219073449.0092f250@guten.sannet.gov>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Randall Kizer wrote:
> 
> Jaime,
> 
> We've just implemented a PIX firewall to evaluate it.  Would you, or anyone
> else reading this e-mail, please share your experiences with this product.
> You mentioned "it has some weakness", can you be more specific?  What are
> some of its strengths?
> 
> Randall
> rkizer@sddpc.org
> 
> >From: "Jaime Blanco" <support@sinfo.net>
> >To: <firewalls@greatcircle.com>
> >Cc: <inet-access@earth.com>
> >Subject: Firewall for ISP
> >Date: Wed, 17 Dec 1997 20:38:06 -0500
Beunos dias,

The Cisco PIX isn't realy a firewall. It's a cut through proxy which
means that when a packet is checked for authentication, the PIX simply
gona forward all these packages and none of the following packages are
beeing screened. It's difficult to get the logging done and the ligging
is alsow done with syslog on a remote machine ( The PIX hasn't got a
hard disk). Another issue is that the GUI quits working when the
configurationfile has more than 400 entries. 

Last but not least, the Cisco PIX is a expensive product and for the
same prise or less you can get a much better Firewall.

-- 
Andre van der Lans
Unisource Business Networks Netherlands bv
Koningin Sophie St 120, 2595 TM The Hague
Tel +31 703711069, Fax +31 703712638
Email: andre.van.der.lans@inet.unisource.nl

From firewalls-owner  Wed Jan  7 09:01:30 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA12580; Wed, 7 Jan 1998 07:33:55 -0800 (PST)
Received: from mail.baileynm.com (fw.baileynm.com [206.109.159.11]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id HAA12550 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 07:33:46 -0800 (PST)
Received: (qmail 22396 invoked from smtpd); 7 Jan 1998 15:34:16 -0000
Received: from web.nmti.com (root@198.178.0.201)
  by fw.nmti.com with SMTP; 7 Jan 1998 15:34:16 -0000
Received: from baileynm.com (grendel.nmti.com [198.178.0.150]) by web.nmti.com (8.6.12/8.6.9) with SMTP id JAA24190; Wed, 7 Jan 1998 09:34:15 -0600
Received: by baileynm.com; (5.65v3.2/1.1.8.2/08Sep97-0924AM)
	id AA10534; Wed, 7 Jan 1998 09:36:59 -0600
From: Peter da Silva <peter@baileynm.com>
Message-Id: <9801071536.AA10534@baileynm.com>
Subject: Re: E-mail Encryption
To: macgyver@tos.net (MacGyver)
Date: Wed, 7 Jan 1998 09:36:59 -0600 (CST)
Cc: firewalls@GreatCircle.COM
In-Reply-To: <199801070018.SAA31044@starbase.tos.net> from "MacGyver" at Jan 6, 98 06:14:58 pm
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Using Eudora 4.0 onward (I'm not sure if previous versions support this
> feature), you have the ability to set an "output filter", which can be set
> to call any arbitrary program.  PGP 5.0+ has a Eudora plugin option that
> you can use to automagically guarantee that all emails sent out are
> encrypted in an invisible way to the user.

Unfortunately PGP 5.0+ encryption is incompatible with PGP 2.6, which is
what most of the people who use PGP are using. I understand the political
reasons for switching to D-H key exchange to get out from under RSA, but
I'm going to stick with 2.6 until there's a really compatible upgrade path
that works on both protocols and all platforms.

From firewalls-owner  Wed Jan  7 09:32:34 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id BAA22455; Wed, 7 Jan 1998 01:58:07 -0800 (PST)
Received: from binariang.maxisnet.com.my ([202.190.228.82]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id BAA13035 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 01:02:28 -0800 (PST)
Received: from SUBGTD-Message_Server by binariang.maxisnet.com.my
	with Novell_GroupWise; Wed, 07 Jan 1998 16:48:47 +0800
Message-Id: <s4b3b1ef.072@binariang.maxisnet.com.my>
X-Mailer: Novell GroupWise 4.1
Date: Wed, 07 Jan 1998 17:48:18 +0800
From: Low Peng Chiew (Griffin) <LOWPC@binariang.maxisnet.com.my>
To: glasane@gdsconnect.com, ryanr@sybase.com
Cc: firewalls@GreatCircle.COM, macgyver@tos.net
Subject: Re: RE: Stateful Inspection Anyone? Explore your options.
Mime-Version: 1.0
Content-Type: text/plain
Content-Disposition: inline
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>>> "Ryan Russell" <ryanr@sybase.com> 01/07 1:49 PM >>>

One of the biggest complaints about proxies is that
if the TCP connection table becomes corrupt, the network
could become vulnerable to the outside.

Quit spreading FUD.

 -Are you implying that this is only a very small possibility 
-or none at all?

-ciao!

----- he who knows not, --------------------
------and knows not he knows not, ----
------he's probably a salesman--------

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               

From firewalls-owner  Wed Jan  7 10:14:32 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id BAA21943; Wed, 7 Jan 1998 01:53:58 -0800 (PST)
Received: from mail.zrz.TU-Berlin.DE (mail.zrz.TU-Berlin.DE [130.149.4.15]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id BAA17571 for <firewalls@greatcircle.com>; Wed, 7 Jan 1998 01:23:44 -0800 (PST)
Received: from fb3-s7.math.tu-berlin.de by mail.zrz.TU-Berlin.DE 
          with SMTP (IC-PP); Wed, 7 Jan 1998 10:23:20 +0100
Received: from fb3-s12.math.TU-Berlin.DE by fb3-s7.math.tu-berlin.de with SMTP 
          id AA02798 (5.67b8/IDA-1.4.4); Wed, 7 Jan 1998 10:23:13 +0100
Received: by fb3-s12.math.tu-berlin.de id AA09645 (5.67b8/IDA-1.4.4);
          Wed, 7 Jan 1998 10:22:12 +0100
Date: Wed, 7 Jan 1998 10:22:12 +0100
Message-Id: <199801070922.AA09645@fb3-s12.math.tu-berlin.de>
From: Bogdan Pelc <pelc@fb3-s7.math.tu-berlin.de>
To: kjones@aims.gov.au
Cc: firewalls@greatcircle.com
In-Reply-To: <34B1C8DC.2BE94D49@aims.gov.au> (message from Kerry Jones on Tue, 06 Jan 1998 16:02:04 +1000)
Subject: Re: DNS on firewall??
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


 Hi,
 Simple question. Is it a good idea to run a DNS server on a
 Firewall?????

 AUNIC require at least 2 DNS servers, so I am trying to decide where to
 configure the 2nd DNS server for our domain (Primary one is currently on
 the DMZ). Will putting the secondary DNS on the firewall create a
====
I would not place primary DNS for my internal domain on the DMZ.
====
 security hole in the Firewall which would best be avoided????????
 Is it acceptable (secure) to put the DNS and other services (e.g.
 http/ftp) on the Firewall??

 What do you think??
 What are your opinions??

 I have a fairly standard setup as follows;

Internet
    |
 router
    |
 firewall - dmz (1 machine: http/ftp/dns)
      |
  internal network.

Oh, please. Primary DNS on ftp/http-Host? Are you sure it is secure?

====== It is three-homed FW. I is not the first time I see that one names
this DMZ. It is not DMZ it is only one Interface of the firewall. It would
be DMZ if you would have router between FW and internal net. You ask what's
the difference? I say, think aboout sniffing :) ===

[... TEXT DELETED ...]

So long!

-- 
____________________________________________________________________________
     Bogdan Pelc; Sekr. MA 6-3, Ma682; Tel: 030-31423607, 030-31422491
			  pelc@math.tu-berlin.de

Do You realize , that this world is totally FUGAZI, where are the poets,
where are the visionaries ...  (FISH)

From firewalls-owner  Wed Jan  7 10:32:17 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA08395; Wed, 7 Jan 1998 07:15:53 -0800 (PST)
Received: from eos4.edmin.com (eos4.edmin.com [207.67.208.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id GAA01600 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 06:45:04 -0800 (PST)
Received: from eos4 (eos4.edmin.com [207.67.208.3]) by eos4.edmin.com (8.8.5/8.8.9) with SMTP id GAA04269; Wed, 7 Jan 1998 06:47:01 -0800 (PST)
Date: Wed, 7 Jan 1998 06:47:00 -0800 (PST)
From: bk <sp@eos4.edmin.com>
X-Sender: sp@eos4
To: Ederlindo Cojuangco <derts@cebu.mozcom.com>
cc: Alan Bolt <alanb@allensysgroup.com>,
        "Grigorof, Adrian" <agrigoro@mobility.com>, firewalls@GreatCircle.COM
Subject: Re: E-mail Encryption
In-Reply-To: <Pine.LNX.3.95.980107115038.6288A-100000@cebu.mozcom.com>
Message-ID: <Pine.UW2.3.94.980107064458.4245E-100000@eos4>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



good morning:

for eudora with the pgp plugin try:

www.qualcomm.com or www.eudora.com

for pgp:

www.pgp.com

bobbi

On Wed, 7 Jan 1998, Ederlindo Cojuangco wrote:

> 	Is there any site where we can download it?  All I got from my
> search is only an information but no software to use it.  Can anybody have
> any idea on this matter?
> 	Thanks in advance.
> 
> ederts
> 	
> On Tue, 6 Jan 1998, Alan Bolt wrote:
> 
> > Have you not looked into PGP?
> > It has grown to have much better interface
> > for users and does what you seem to want
> > 
> > Bobby Brown
> > Network Administrator
> > Allen Systems Group
> > 
> > ----------
> > > From: Grigorof, Adrian <agrigoro@mobility.com>
> > > To: firewalls@greatcircle.com
> > > Subject: E-mail Encryption
> > > Date: Tuesday, January 06, 1998 3:21 PM
> > > 
> > > I am looking for a product to be used in encrypting e-mail to be sent
> > > over the Internet. I've heard something about a product called Puffer by
> > > Briggs Softworks but I haven't tested it so far.  
> > > 
> > > The ideal software should be user friendly otherwise it won't be used by
> > > "normal" users...how can you stop them from sending clear text messages
> > > or unencrypted attachments?
> > > 
> > > Any ideas, suggestions?
> > > 
> > > Thanks,
> > > 
> > > Adrian Grigorof
> > > Internet Administrator
> > > Bell Mobility Cellular Inc.
> > > Toronto
> > > www.bellmobility.ca
> > > 
> > > 
> > > 
> > > 
> > > 
> > > 
> > 
> 
> 










From firewalls-owner  Wed Jan  7 12:05:54 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id BAA21330; Wed, 7 Jan 1998 01:48:53 -0800 (PST)
Received: from mail.zrz.TU-Berlin.DE (mail.zrz.TU-Berlin.DE [130.149.4.15]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id BAA21310 for <firewalls@greatcircle.com>; Wed, 7 Jan 1998 01:48:39 -0800 (PST)
Received: from fb3-s7.math.tu-berlin.de by mail.zrz.TU-Berlin.DE 
          with SMTP (IC-PP); Wed, 7 Jan 1998 10:49:00 +0100
Received: from fb3-s12.math.TU-Berlin.DE by fb3-s7.math.tu-berlin.de with SMTP 
          id AA03442 (5.67b8/IDA-1.4.4); Wed, 7 Jan 1998 10:48:53 +0100
Received: by fb3-s12.math.tu-berlin.de id AA09611 (5.67b8/IDA-1.4.4);
          Wed, 7 Jan 1998 10:47:52 +0100
Date: Wed, 7 Jan 1998 10:47:52 +0100
Message-Id: <199801070947.AA09611@fb3-s12.math.tu-berlin.de>
From: Bogdan Pelc <pelc@fb3-s7.math.tu-berlin.de>
To: sjg@quick.com.au
Cc: kjones@aims.gov.au, firewalls@greatcircle.com
In-Reply-To: <199801070516.QAA29168@gate.quick.com.au> (sjg@quick.com.au)
Subject: Re: Split DNS??
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>>>>> "SJG" == Simon J Gerraty <sjg@quick.com.au> writes:

  SJG> Kerry,
  >> What are the benefits of running split DNS??? Is it more secure?? Or
  >> is it a pain in the ass which doesn't increase security much at all??
  >> Can someone give me a bit of an overview of how it would be done.

  SJG> The main benefit of running a split DNS is to provide different MX
  SJG> lists to internal vs external MTAs.  The alternative is that
  SJG> external mail is always delayed while the first connection attempt
  SJG> to an unreachable internal mailhost times out, or internal mail is
  SJG> needlessly routed via the firewall (which may be unacceptable for
  SJG> other reasons).

  SJG> The simplest way to run a split DNS is to have a DNS server on the
  SJG> firewall or DMZ (or even your friendly ISP if you trust them) which
  SJG> is registered externally as authoritative for your domain.  Then run
  SJG> another server (or two :-) internally that are also authoritative
  SJG> for the domain, but have a more complete picture.  Note that your
  SJG> firewall uses the internal nameservers not the external one - that's
  SJG> just for outsiders.

Yeah.

  SJG> Some folk like split DNS because they think that "hiding" their
  SJG> internal hostnames makes them more secure.  Such info leaks out in
  SJG> so many ways that this "security by obscurity" is a myth.

Really. If I have FW so conigured, that I have service Redirections and
IP-Hiding, I have no modems in my company, which I don't know about then
there is no way for internal-IP to go to the outside world. I mean there is
no way through the FW, I don't mean that one worker tells it somebody and
he tells it somebody and so on, but Hacker on the other side of our Earth
would in the most cases know no of my workers and their freinds (I hope so
:)
If I have proxies then I have this plus, that i cannot talk to ftp http and
so on directly, only through my proxies and if they are intelligent (for
example after 1000 POST oparetion between some time interval, thay droped
the connection) then I am a little bit in plus.

BTW.
I would take the test IP-Adresses (192.168.* and 10.* and so on) for my
internal network. So the IP-Range is known, but If I have FW between
I can do nothing to get to my internal Machines (well nearly nothing)
I think it is a kind of security. For I can do source routing but My FW
hopefully do not route such packets. My FW do IP-Spoofing
detection. test-ip are not routeable through the Internet (they should not
be routeable). And if hobby-Invader tries to get into my company (it is NOT
tu-berlin.de :))) it is more difficult for him if I have IP-hiding if he's
profi than I have a big Problem, but than it is not only ip-Hiding where I
have problems. But if my DNS is secure then I have some plus on my side,
but if it is insecure (it is really easie to do it so) then I have no
chance and the /etc/motd sais to me on a rainy morning: I got you! And the
rain bevomes havier and havier ... ;)))

  SJG> Having said that, there is no need for your external DNS to contain
  SJG> much more than an NS list, an MX list and the address of your
  SJG> firewall.

  SJG> There are more specific details that need to be sorted out as to how
  SJG> your internal nameservers resolve external names (or even if they
  SJG> do), but the above should get you started.

  SJG> --sjg

What are your Opinions?

-- 
____________________________________________________________________________
     Bogdan Pelc; Sekr. MA 6-3, Ma682; Tel: 030-31423607, 030-31422491
			  pelc@math.tu-berlin.de

Do You realize , that this world is totally FUGAZI, where are the poets,
where are the visionaries ...  (FISH)


From firewalls-owner  Wed Jan  7 12:15:02 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA01831; Wed, 7 Jan 1998 11:17:53 -0800 (PST)
Received: from gte.com (h132-197-8-26.gte.com [132.197.8.26]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id KAA27884 for <Firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 10:58:37 -0800 (PST)
Received: from [132.197.71.1] by gte.com (8.8.4/8.8.4)
X-Sender: rhb1@pophost.gte.com
Message-Id: <v02130506b0d983b02fb1@[132.197.71.1]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Wed, 7 Jan 1998 15:11:23 -0400
To: rmckosky@gte.com, enorris@gte.com, djuitt@gte.com, ccarroll@gte.com,
        Jyri Kaljundi <jk@stallion.ee>, Firewalls@GreatCircle.COM,
        rhb1@gte.com
From: rhb1@gte.com (Bob Bryant)
Subject: test
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

test

*******************************************************************************
Robert Bryant                           email           rhb1@gte.com
Member Technical Staff                  Fax             617-466-2838
Secure Systems Department
GTE Labrotories                         office ph       617-466-2821
40 Sylvan Rd    MS/55                   Cell ph         617-733-7757
Waltham, MA 02254
****************************************************************************
***



From firewalls-owner  Wed Jan  7 12:26:48 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA14129; Wed, 7 Jan 1998 12:13:09 -0800 (PST)
Received: from redcross.dk (ns.redcross.dk [147.29.204.52]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA14094 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 12:12:59 -0800 (PST)
Received: from [192.168.51.1] by redcross.dk with ESMTP (Eudora Internet Mail
 Server 2.0); Wed, 7 Jan 1998 21:23:45 +0100
X-Sender: lars-bertelsen@mail.redcross.dk
Message-Id: <v03130300b0d9a2881d3b@[192.168.51.1]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
X-Mailer: Eudora 2.0.1
X-Charset: US-DK
X-Char-Esc: 29
To: firewalls@GreatCircle.COM
From: Lars Bertelsen <lbe@login.dknet.dk>
Subject: Cern HTTP vs Squid?
Date: Wed, 7 Jan 1998 21:23:46 +0100
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Does anyone have an opinion on which of these is the safer to use as a
caching HTTP proxy? Silly me! Of course you do! Right? :-))

Lars Bertelsen
Gartnervang 29         tlf. 4635 1115
4000 Roskilde, DK      e-mail of choice: lbe@login.dknet.dk



From firewalls-owner  Wed Jan  7 12:29:18 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA01343; Wed, 7 Jan 1998 11:15:17 -0800 (PST)
Received: from proxy1.ect.gov.br (proxy1.ect.gov.br [200.18.88.240]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id JAA09646 for <firewalls@greatcircle.com>; Wed, 7 Jan 1998 09:38:33 -0800 (PST)
Received: from sac00001.desit (unverified [10.1.2.1]) by proxy1.ect.gov.br
 (EMWAC SMTPRS 0.83) with SMTP id <B0000000373@proxy1.ect.gov.br>;
 Wed, 07 Jan 1998 14:38:10 -0300
Received: by sac00001.desit with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63)
	id <01BD1B48.1E659150@sac00001.desit>; Wed, 7 Jan 1998 08:41:59 -0300
Message-ID: <c=US%a=_%p=ECT%l=SAC00001-980107114158Z-239@sac00001.desit>
From: Alex do Nascimento <alexn@ect.gov.br>
To: "'Ming Lu'" <mlu@hq.si.net>
Cc: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: RE: A site about security
Date: Wed, 7 Jan 1998 08:41:58 -0300
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Ming, 

Try http://www.axent.com/swat/swat.htm

	Bye
		Alex.

>----------
>De: 	Ming Lu[SMTP:mlu@hq.si.net]
>Enviada: 	Tuesday, January 06, 1998 8:44 PM
>Para: 	Darin Fisher
>Cc: 	'Olivier NOUET'; 'FWLIST'
>Assunto: 	RE: A site about security
>
>
>I got message:"HTTP/1.0 403 Access Forbidden"
>
>_ming
>
>

From firewalls-owner  Wed Jan  7 12:31:07 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA01965; Wed, 7 Jan 1998 11:19:12 -0800 (PST)
Received: from ns.rc.on.ca (ns.ntadvice.com [207.176.151.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id KAA16607 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 10:07:31 -0800 (PST)
Received: by ns.rc.on.ca with Internet Mail Service (5.5.1939.0)
	id <ZA5NGC3R>; Wed, 7 Jan 1998 13:07:51 -0500
Message-ID: <418996AD2954D11180860000E8D5C66701868C@ns.rc.on.ca>
From: Russ <Russ.Cooper@rc.on.ca>
To: "'Firewalls Mailing List'" <firewalls@GreatCircle.COM>
Subject: Goodbye, and thanks!
Date: Wed, 7 Jan 1998 13:07:45 -0500 
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.1939.0)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Just a note to say goodbye, and thanks very much. The Firewalls list,
and its members, gave me an opportunity that I can never repay, so
thanks for that.

Unfortunately, 90% of the spam I do receive comes to me through the
Firewalls list, and since there clearly is no intention on stopping it,
or even curtailing it, the list's usefulness has become null.

I'll be establishing a moderated "Using NT with Firewalls" list some
time in the near future to promote my favorite topic, I'll let you know.
If any non-Telco organization can use an NT Consultant on a recurring
basis (say a weekly call for example) drop me a note at
Russ.Cooper@rc.on.ca

Cheers,
Russ Cooper
R.C. Consulting, Inc. - NT/Internet Security
Owner and Moderator of the NTBugTraq mailing list -
http://www.ntbugtraq.com


From firewalls-owner  Wed Jan  7 12:32:59 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA08317; Wed, 7 Jan 1998 11:42:21 -0800 (PST)
Received: from ziggy.stardust.com (ziggy.stardust.com [205.184.205.34]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id LAA08197 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 11:42:00 -0800 (PST)
Received: from allens (allens.stardust.com [205.184.204.73])
	by ziggy.stardust.com (8.8.7/8.8.7) with SMTP id LAA05980;
	Wed, 7 Jan 1998 11:42:11 -0800
Message-Id: <3.0.5.32.19980107114055.00a21c80@stardust.com>
X-Sender: lazlor@stardust.com
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.5 (32)
Date: Wed, 07 Jan 1998 11:40:55 -0800
To: Peter da Silva <peter@baileynm.com>, macgyver@tos.net (MacGyver)
From: "Allen K. Smith" <lazlor@stardust.com>
Subject: Re: E-mail Encryption
Cc: firewalls@GreatCircle.COM
In-Reply-To: <9801071536.AA10534@baileynm.com>
References: <199801070018.SAA31044@starbase.tos.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I use the commercial version of pgp 5.0 and it supports both RSA and DH.

At 09:36 AM 1/7/98 -0600, Peter da Silva wrote:
>> Using Eudora 4.0 onward (I'm not sure if previous versions support this
>> feature), you have the ability to set an "output filter", which can be set
>> to call any arbitrary program.  PGP 5.0+ has a Eudora plugin option that
>> you can use to automagically guarantee that all emails sent out are
>> encrypted in an invisible way to the user.
>
>Unfortunately PGP 5.0+ encryption is incompatible with PGP 2.6, which is
>what most of the people who use PGP are using. I understand the political
>reasons for switching to D-H key exchange to get out from under RSA, but
>I'm going to stick with 2.6 until there's a really compatible upgrade path
>that works on both protocols and all platforms.
>
>

Allen Smith, lazlor@stardust.com
IP Multicast.  Turn it on and tune-in to the future.

From firewalls-owner  Wed Jan  7 12:34:39 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id KAA28100; Wed, 7 Jan 1998 10:59:47 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id KAA28050 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 10:59:35 -0800 (PST)
Received: from camel8.mindspring.com by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-970426)
	id KAA03495; Wed, 7 Jan 1998 10:58:12 -0800 (PST)
Received: from jeffknt ([38.214.19.38])
	by camel8.mindspring.com (8.8.5/8.8.5) with SMTP id NAA12242;
	Wed, 7 Jan 1998 13:57:37 -0500 (EST)
Received: by localhost with Microsoft MAPI; Wed, 7 Jan 1998 13:54:17 -0500
Message-ID: <01BD1B73.BF1D9D60.jeffk@secure-it.net>
From: Jeff Kalwerisky <jeffk@secure-it.net>
Reply-To: "jeffk@secure-it.net" <jeffk@secure-it.net>
To: "'Andre van der Lans'" <andre.van.der.lans@inet.unisource.nl>
Cc: "firewalls@GreatCircle.COM" <firewalls@GreatCircle.COM>
Subject: RE: Audit and Scanning tools
Date: Wed, 7 Jan 1998 13:54:15 -0500
Organization: SecureIT
X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi Andre:

>>Does anybody know if there are some audit and scanning tools available
for Firewalls, which can automatically scan logfiles for hacking attempts
and which can generate reports on traffic and other activities,

Good point. It's usually difficult to see what's actually happening in a 
firewall log file. I heard it recently described - very aptly - as "... 
having your nose up against the window"!

Since you asked, here's a (low-key) plug.

SecureIT has a product, called SecureVIEW, which creates a data mart from a 
firewall's logfile so that you can "slice and dice" the info in the log. 
The log data can then be viewed by user department, time of day, type of 
traffic, sites visited, kind of security threat, etc., etc.,  with a nice 
array of graphs, bar charts, and reports.
Download a copy from the Web site:  www.secure-it.net

Happy 1998. (:-)

Regards,
Jeff Kalwerisky			Ph:  770.248.1005
Director, Consulting Services		Fax: 770,248.1006
SecureIt, Inc.			Email: jeffk@secure-it.net
3770 Data Drive			Web: www. secure-it.net
Norcross, GA 30092
"Securing Information Technology Assets"




From firewalls-owner  Wed Jan  7 12:59:37 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA18231; Wed, 7 Jan 1998 12:41:22 -0800 (PST)
Received: from bbp0100e01.pacifico.fin.ec (pacifico.fin.ec [157.100.165.33]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA18086 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 12:40:23 -0800 (PST)
From: SVelaste@pacifico.fin.ec
Received: by BBP0100E01 with Internet Mail Service (5.0.1458.49)
	id <Z48Z21BA>; Wed, 7 Jan 1998 15:36:19 -0500
Message-ID: <50DE363880FBD011931C0001FA449C1A01D9221C@BBP0100E00>
To: firewalls@GreatCircle.COM
Subject: Test Proxy and FireWall.
Date: Wed, 7 Jan 1998 15:35:45 -0500
X-Priority: 1
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1458.49)
Content-Type: text/plain;
	charset="ISO-8859-1"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> Hi, I=B4m testing Proxy and FireWall products and need programs to =
test
> security and reliabitity from them. If any of you have a program to
> make this testing more real please send them to me.
>=20
> Best regards.
>=20
> Spencer Velastegui Nunez (* SVelaste@pacifico.fin.ec)
> Las opiniones del autor de este mensaje no necesariamente
> son representativas de las opiniones del Banco del Pacifico.
>=20
> Banco del Pacifico Grupo Financiero, - http://www.bp.fin.ec
> Administracion de Redes y Proyectos - Div. de Tecnologia
> * Telf.(593 04) 328-333 ext.5000
> Guayaquil-Ecuador.

From firewalls-owner  Wed Jan  7 14:00:38 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id AAA05615; Wed, 7 Jan 1998 00:29:31 -0800 (PST)
Received: from majestix.skp.de (majestix.skp.de [194.163.133.195]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id AAA05374 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 00:28:46 -0800 (PST)
Received: (from mail@localhost) by majestix.skp.de (8.7.5/8.7.3) id JAA21194; Wed, 7 Jan 1998 09:30:02 +0100
X-Authentication-Warning: majestix.skp.de: mail set sender to <lau@skp.de> using -f
Received: from hagbard(192.168.0.5) by majestix.skp.de via smap (V1.3)
	id sma021182; Wed Jan  7 09:29:50 1998
Date: Wed, 07 Jan 1998 09:28:02 +0100
To: Gordon LaSane <glasane@gdsconnect.com>
From: Oliver Lau <lau@skp.de>
Cc: <firewalls@GreatCircle.COM>, Martin Sauer <ms@majestix.skp.de>
Subject: Re[2]: Stateful Inspection Anyone?  Explore your options.
In-Reply-To: <A1F2B23A4F10D1118DDB00A0C9193FCF016C01@ALTOS>
References: <A1F2B23A4F10D1118DDB00A0C9193FCF016C01@ALTOS>
X-encrypted: 128 bit stable
Message-Id: <34B358B255.B791.lau@skp.de>
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-Mailer: Becky! ver 1.20
X-Priority: 4
X-MSMail-Priority: Low
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Greetings, Gordon!

On Tue, 6 Jan 1998 16:37:03 -0500
Gordon LaSane <glasane@gdsconnect.com> wrote:

|  One of the biggest complaints about stateful inspection is that if the
|  state table becomes corrupt, the network could become vulnerable to the
|  outside.

You surely haven't had a look inside stateful inspection firewalls, have
you? You have to distinguish between two possibilities on how tables
can become corrupt:

	1.) accidentally deleted entries
	2.) forged entries

Accidentally deleted entries only have one effect: active connections
become inactive and therefore further packets belonging to this
connections could no longer traverse the firewall.

Forged entries may have the effect you described. But this is a point
where we discuss the security of the firewall itself and not the
security services a firewall should provide for networks.

|
|  [snipped commercial offerings]
|



Regards,
Oliver Lau
[CTO]
Sauer und Partner GmbH, NetzwerkTechnologie und Sicherheit
Dietrich-Bonhoeffer-Strasse 1-3, 35037 Marburg, Germany
fon: +49 6421 938300, fax: +49 6421 938390, URL: http://www.skp.de/
PGP-Fingerprint: 6696 C8B6 F351 A381  D1C9 BC41 98F2 6DE3

From firewalls-owner  Wed Jan  7 14:15:44 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA16154; Wed, 7 Jan 1998 12:26:30 -0800 (PST)
Received: from relay1.shore.net (relay1.shore.net [192.233.85.129]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA16057 for <firewalls@greatcircle.com>; Wed, 7 Jan 1998 12:26:10 -0800 (PST)
Received: from [198.115.179.81] (vin.shore.net [198.115.179.81])
	by relay1.shore.net (8.8.7/8.8.7) with ESMTP id PAA17577;
	Wed, 7 Jan 1998 15:26:15 -0500 (EST)
Message-Id: <v03007800b0d956439d78@[198.115.179.81]>
In-Reply-To: <199801062023.MAA03827@honor.greatcircle.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Wed, 7 Jan 1998 15:26:46 -0500
To: "Grigorof, Adrian" <agrigoro@mobility.com>
From: Vin McLellan <vin@shore.net>
Subject: Re: E-mail Encryption
Cc: firewalls@greatcircle.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

	Adrian Grigorof <agrigoro@mobility.com> queried the List:

>I am looking for a product to be used in encrypting e-mail to be sent
>over the Internet. I've heard something about a product called Puffer by
>Briggs Softworks but I haven't tested it so far.

	Kent Brigg's Puffer is a classy piece of code, a general-purpose
encryption engine for Windows -- available in freeware and commercial
versions, both for the US/Canadian market and and the larger "export"
market outside those boundries. See: http://www.briggsoft.com/puffer.htm
Puffer uses Diffie-Hellman PKC, 40-bit PC1 (a clone of Ron Rivest's RC4) in
export versions,  and 128 bit CAST or 160-bit Blowfish for the US/Canada
versions.

	I suggest, however, that you might want to review your operational
requirements to determine if you really want your users to be restricted in
their exchange of encrypted e-mail (and digital signatures, which have vast
utility yet to be explored in most organizations) to only those who have
obtained Puffer.

	(You're a Canadian firm. Do you really want your users to be
isolated from the Canada's all-government RSA-based PKI that, as I recall,
Entrust will establish this year?)

	The crucial idea behind e-mail (encypted or otherwise) is that it
is a message format which can be read by almost anyone you send it to.
Subcultures of geeks like me and thee (including the volunteers active in
the various IETF WGs) get caught up in fads, lobbying efforts, and
marketing campaigns -- but without a market-driven defacto standard that
allows for interoperability, without the scale available in a hierarchial
PKI infrastructure, e-mail encryption will always be just a curiousity.

	There have been many proposed IETF standards for e-mail encryption
over the past decade.  They all died; quite embarrassing, really.  PGP has
been a wonderful user-driven small-scale option, but it (though I loved it
myself) has never been more than a pimple on this huge market's lazy and
lugubrious ass.

	The defining event for this technology was the incorporation of
_interoperable_ S/MIME-enabled e-mail packages in Netscape Communicator and
Microsoft Outlook and Outlook Express last year.  That alone made
user-friendly e-mail crypt/decrypt (and digital signatures!) available on
tens of millions of desktops with the ubiquitous browser.

	Entrust, OpenSoft, Baltimore, Deming/Worldtalk already have S/MIME
products in the market -- with non-American vendors (e.g., Baltimore)
offering full strong-crypto interoperability with American products using
RC2, DES and 3DES -- and I think there are now a half-dozen developer's
kits available internationally.  According to Giga Research, another _40_
vendors of e-mail and other communications software (including Novell and
IBM) are wholly committed to the S/MIME format -- and why not, now that
S/MIME in the browsers offers them universal interoperability!

	Worldtalk, a US company, offers a WorldSecure Client for Microsoft
E-mail that integrates S/MIME with the Windows 95 Inbox (Windows Messaging
Service), Microsoft Exchange client, as well as Microsoft Outlook. They've
also got a plug-in for Eudora Pro.  Worldsecure works with these '95/NT
clients using virtually any messaging service, including those provided by
Microsoft Exchange Server, Microsoft Mail 3.2/3.5, and POP3/IMAP4 servers
(including Worldtalk's NetTalk.)  See:
<http://www.worldtalk.com/html/secure/sm.htm>

	The cool thing is that encrypted e-mail fromWorldtalk customers in
Toronto can be freely exchanged with British or German users of, say,
Mailsecure (on Microsoft Exchange or Outlook, sold internationally by
Baltimore Technologies, an Irish firm.)
<http://www.baltimore.ie/mailsecure.htm>  In this exchange, both parties
can be using DES; RC2 (128-bit default,) or 3DES (112-bit key) for message
confidentiality -- with 1024 or 2048-bit RSA public key tech used for key
exchange and digital signatures on message digests (MD4 or SHA-1.)

	I'm not particularly objective in the crypto wars, since I've been
a long-term consultant to SDTI, which -- for another 1,000 days -- owns the
(US-only) patent for RSA's PKC, which is used for key-exchange and digital
sigs in S/MIME.  But surely it is self-evident that the multiple
alternatives -- however good their technology; however fervent their
supporters -- pale beside that market fact of universal interoperability.
No one company could forge this community of users; it took a conscious and
shared design decision by the bulk of the international vendor community --
both on the mail protocol, and in the common commitment to RSA keys and the
X509 Certs.

>The ideal software should be user friendly otherwise it won't be used by
>"normal" users

	The ideal, but of course!  (Although I think interoperability and
international availability are right up there with user-friendliness as
design priorities.)  Do you want to exchange a digitally-signed contract,
or RFP, or a job proposal, or a tax return, or a job offer only with your
friends and associates -- or isn't it more likely that tomorrow you'll want
to get it all (confidentiality, authentication, non-repudiation) in your
e-mail exwith people today unknown?

>...how can you stop them from sending clear text messages
>or unencrypted attachments?

	I think we are going to continue to see many efforts to imbed this
type of security policy -- including key-recovery for e-mail -- in the
technology with filters and the like. Personally, I find them wrong-headed,
intrusive, impolitic, and often counterproductive.  (Although I think
Baltimore and others offer such mail-server-based control schemes for
S/MIME too. <bah, humbug!>)

	On the other hand, a educational campaign to illustrate the
commercial and organization advantages of digital signatures (with or
without encryption) could develop new user habits based on the power of PKC
as a productivity-enhancer.  Security mavens could become Enablers who help
the users achieve what _they_ want; rather than pain-in-the-rear corporate
cops who demand that their users burden themselves with layers of
rigamarole, which often makes it more difficult and more costly for them to
get their jobs done -- whatever the fiduciary justification.

	Encrypted e-mail -- authenticated messages, legally binding
signatures, with non-repudiation -- can make life easier and more
productive for user.   Now,  wouldn't that toss corporate security into a
revolutionary posture vis a vis our users?

	Suerte,

		_Vin

"Cryptography is like literacy in the Dark Ages. Infinitely potent, for
good and ill... yet basically an intellectual construct, an idea, which by
its nature will resist efforts to restrict it to bureaucrats and others who
deem only themselves worthy of such Privilege."
_ A thinking man's Creed for Crypto/ vbm.

 *     Vin McLellan + The Privacy Guild + <vin@shore.net>    *
  53 Nichols St., Chelsea, MA 02150 USA <617> 884-5548



From firewalls-owner  Wed Jan  7 17:01:15 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id QAA09131; Wed, 7 Jan 1998 16:57:25 -0800 (PST)
Received: from ns2.shopping.com (ns2.shopping.com [208.139.183.6]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id QAA09109 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 16:57:19 -0800 (PST)
Received: from greyghost ([208.139.183.248])
          by ns2.shopping.com (2.0 Build 2119 (Berkeley 8.8.4)/8.8.4) with SMTP
	  id QAA00532 for <firewalls@GreatCircle.COM>; Wed, 07 Jan 1998 16:57:52 -0800
Message-Id: <3.0.1.32.19980107165819.0091f700@ns2.shopping.com>
X-Sender: jpham@ns2.shopping.com
X-Mailer: Windows Eudora Light Version 3.0.1 (32)
Date: Wed, 07 Jan 1998 16:58:19 -0800
To: firewalls@GreatCircle.COM
From: Joy Pham <jpham@ns2.shopping.com>
Subject: Remote Access
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

How do you all feel about having users dial into the network using Carbon
Copy?  How much security breach are we talking about?  I've personally do
not like any kind of remote control software but I really don't have any
valid arguments as to why we can't implement it at my company.  Any ideas,
suggestions, arguments would be appreciated.

Thank you,
Joy


From firewalls-owner  Wed Jan  7 17:09:25 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id OAA07739; Wed, 7 Jan 1998 14:24:13 -0800 (PST)
Received: from mail.baileynm.com (fw.baileynm.com [206.109.159.11]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id OAA07666 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 14:23:55 -0800 (PST)
Received: (qmail 24702 invoked from smtpd); 7 Jan 1998 22:24:23 -0000
Received: from web.nmti.com (root@198.178.0.201)
  by fw.nmti.com with SMTP; 7 Jan 1998 22:24:23 -0000
Received: from baileynm.com (grendel.nmti.com [198.178.0.150]) by web.nmti.com (8.6.12/8.6.9) with SMTP id QAA10354; Wed, 7 Jan 1998 16:24:22 -0600
Received: by baileynm.com; (5.65v3.2/1.1.8.2/08Sep97-0924AM)
	id AA13340; Wed, 7 Jan 1998 16:27:06 -0600
From: Peter da Silva <peter@baileynm.com>
Message-Id: <9801072227.AA13340@baileynm.com>
Subject: Re: E-mail Encryption
To: jsk347@sprynet.com (Steve Kruse)
Date: Wed, 7 Jan 1998 16:27:06 -0600 (CST)
Cc: peter@baileynm.com, macgyver@tos.net, firewalls@GreatCircle.COM
In-Reply-To: <3.0.3.32.19980107160808.006a33b4@m6.sprynet.com> from "Steve Kruse" at Jan 7, 98 04:08:08 pm
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> I think it might have been mentioned on here, but there is a $5.00
> "up-downgrade" that lets you use the RSA which IS compatabile with PGP 2.x.
>  Check the PGP website for info.  

And if I'm not running Windoze?


From firewalls-owner  Wed Jan  7 17:12:10 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA25311; Wed, 7 Jan 1998 15:45:08 -0800 (PST)
Received: from f85.hotmail.com (F85.hotmail.com [207.82.250.191]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id OAA15574 for <firewalls@GreatCircle.com>; Wed, 7 Jan 1998 14:57:11 -0800 (PST)
Received: (from root@localhost)
	by f85.hotmail.com (8.8.5/8.8.5) id OAA11676;
	Wed, 7 Jan 1998 14:57:25 -0800 (PST)
Message-Id: <199801072257.OAA11676@f85.hotmail.com>
Received: from 15.255.208.3 by www.hotmail.com with HTTP;
	Wed, 07 Jan 1998 14:57:24 PST
X-Originating-IP: [15.255.208.3]
From: "James Lau" <jlau@hotmail.com>
To: firewalls@GreatCircle.com
Cc: jlau@hotmail
Subject: Content filtering
Content-Type: text/plain
Date: Wed, 07 Jan 1998 14:57:24 PST
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello all,

This may be a little bit off topic but please bare with me or 
points me to a right mailing list.

I'm looking for a solution to filter the contents of web traffics,
ftp files and email.  I know this is not totally firewall related
but there are a few firewall products can do that. (That's why I
ask.)  Unfortunately most (may be all) of them use proxy which
require changes of configuration which we cannot force my users
to do.  Is there any solution out there which doesn't require
changing of configuration?  Or is the proxy the only solution?
Any ideas?

Thanks in advance.
James

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com

From firewalls-owner  Wed Jan  7 17:51:34 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA25554; Wed, 7 Jan 1998 15:47:13 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id PAA20212 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 15:18:29 -0800 (PST)
Received: from mail.mel.aone.net.au by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-970426)
	id PAA05779; Wed, 7 Jan 1998 15:17:10 -0800 (PST)
Received: from PORSCHE (d254-1.cpe.Maroochydore.aone.net.au [203.61.33.254])
	by mail.mel.aone.net.au (8.8.6/8.8.6) with SMTP id KAA20802;
	Thu, 8 Jan 1998 10:17:55 +1100 (EST)
Message-Id: <3.0.32.19980108091436.0089a5a0@starvision.net.au>
X-Sender: shanem@starvision.net.au
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Thu, 08 Jan 1998 09:14:38 +1000
To: "Marriage, Michael" <mikem@ccn.ac.uk>,
        "'firewalls@GreatCircle.COM'" <firewalls@GreatCircle.COM>
From: Shane Miller <shanem@sv.net.au>
Subject: Re: MS Proxy and netmeeting
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 11:21 7/01/98 -0000, Marriage, Michael wrote:
>Has anyone configured MS Proxy to work with netmeeting? If so what are
>the key points that I should be looking at. We have barred NETBIOS like
>packets on site though our router. Is this going to cause problems with
>Netmeeting.
>
>Is there an up to date list of TCP/IP information on ports used by the
>myriad microsoft network aware packages in a human readable form for us
>very mere mortals.
<snip>

Microsoft has technical information NetMeeting including a section on
configuring a firewall for use with NetMeeting at
http://www.microsoft.com/netmeeting/reskit/

Don't know about similar info on other MS products.

Regards



Shane Miller

Network Administrator
Caloundra City Libraries
Queensland, Australia.

Voice:  +61 (7) 5499 5405    
GSM:  +61 (412) 877 371
Fax:  +61 (7) 5491 8756

From firewalls-owner  Wed Jan  7 18:08:19 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA20765; Wed, 7 Jan 1998 15:22:01 -0800 (PST)
Received: from hq.si.net (hq.si.net [192.156.192.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id PAA20744 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 15:21:54 -0800 (PST)
Received: from hq.si.net (hq [192.156.192.10]) by hq.si.net (8.8.5/8.7.3) with SMTP id SAA19741; Wed, 7 Jan 1998 18:24:05 -0500 (EST)
Date: Wed, 7 Jan 1998 18:24:05 -0500 (EST)
From: Ming Lu <mlu@hq.si.net>
To: Peter da Silva <peter@baileynm.com>
cc: MacGyver <macgyver@tos.net>, firewalls@GreatCircle.COM
Subject: Re: E-mail Encryption
In-Reply-To: <9801071536.AA10534@baileynm.com>
Message-ID: <Pine.SOL.3.91.980107181919.18133B-100000@hq.si.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Wed, 7 Jan 1998, Peter da Silva wrote:

> > Using Eudora 4.0 onward (I'm not sure if previous versions support this
> > feature), you have the ability to set an "output filter", which can be set
> > to call any arbitrary program.  PGP 5.0+ has a Eudora plugin option that
> > you can use to automagically guarantee that all emails sent out are
> > encrypted in an invisible way to the user.
> 
> Unfortunately PGP 5.0+ encryption is incompatible with PGP 2.6, which is
> what most of the people who use PGP are using. I understand the political
> reasons for switching to D-H key exchange to get out from under RSA, but
> I'm going to stick with 2.6 until there's a really compatible upgrade path
> that works on both protocols and all platforms.
> 

I agree with you too, I am quite pleased with 2.6 especially 2.63i version.
but PGP 5.0+ encryption is becoming more and more popular too, specially 
among PC users, a kind of Bill G phenomenon...:-(.

_ming

From firewalls-owner  Wed Jan  7 18:46:13 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id SAA29326; Wed, 7 Jan 1998 18:32:37 -0800 (PST)
Received: from promenade.geocities.com (promenade.geocities.com [206.111.43.199]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id SAA29275 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 18:32:26 -0800 (PST)
Received: from geocities.com ([206.252.145.145]) by promenade.geocities.com
          (Post.Office MTA Undefined release Undefined
          ID# 0-44422U200L2S100) with ESMTP id AAA28680
          for <firewalls@GreatCircle.COM>; Tue, 6 Jan 1998 19:37:29 -0800
Message-ID: <34B2F88B.338919A@geocities.com>
Date: Tue, 06 Jan 1998 22:37:47 -0500
From: jfielden@geocities.com (Josh Fielden)
X-Mailer: Mozilla 4.03 [en] (WinNT; I)
MIME-Version: 1.0
To: firewalls@GreatCircle.COM
Subject: Re: Wannabe needs a good book
References: <l03130304b0d871555aa5@[207.213.51.19]>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Well, I always recommend anythign O'Reilly, but "TCP/IP Network
Administration" is really good. It's a "Blue Cover"

JF

aldous valdheims wrote:
> 
> At 11:05 AM -0500 1.6.1998, Sick Puppy wrote:
> >Can someone please suggest a good book on the
> >general topic of networking, with some emphasis on TCP/IP, that we can
> >steal?
> 
> One of my favorites is Computer Networks, 2nd edition by I think it is
> tannenbaum, but I may have to be corrected on that, I don't have a copy of
> it with me right now.  It gives a really thorough coverage of network
> protocols and network layers, from the actual wiring on up to applications.
> Get it and get crazy.
> 
> --jt

From firewalls-owner  Wed Jan  7 19:15:46 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA02099; Wed, 7 Jan 1998 11:20:32 -0800 (PST)
Received: from post3.inre.asu.edu (post3.inre.asu.edu [129.219.10.148]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id KAA20010 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 10:21:46 -0800 (PST)
Received: from general3.asu.edu by asu.edu (PMDF V5.1-10 #24133)
 with ESMTP id <01IS3DPUYYJ48X7DW8@asu.edu> for firewalls@GreatCircle.COM; Wed,
 7 Jan 1998 11:22:14 MST
Received: from general3.asu.edu (localhost [127.0.0.1])
 by general3.asu.edu (8.8.5/8.8.5) with SMTP id LAA12415; Wed,
 07 Jan 1998 11:22:07 -0700 (MST)
Date: Wed, 07 Jan 1998 11:22:07 -0700 (MST)
From: Vandana Shah <vana.shah@asu.edu>
Subject: Re: E-mail Encryption
In-reply-to: <19980106230532656.AAA210@houdini>
X-Sender: vanashah@general3.asu.edu
To: Alan Bolt <alanb@allensysgroup.com>
Cc: "Grigorof, Adrian" <agrigoro@mobility.com>, firewalls@GreatCircle.COM
Message-id: <Pine.SOL.3.91.980107112140.12193A-100000@general3.asu.edu>
MIME-version: 1.0
Content-type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello,
	Can u expand the word PGP. I am not aware of that.
thanks

-Vandana
On Tue, 6 Jan 1998, Alan Bolt wrote:

> Have you not looked into PGP?
> It has grown to have much better interface
> for users and does what you seem to want
> 
> Bobby Brown
> Network Administrator
> Allen Systems Group
> 
> ----------
> > From: Grigorof, Adrian <agrigoro@mobility.com>
> > To: firewalls@greatcircle.com
> > Subject: E-mail Encryption
> > Date: Tuesday, January 06, 1998 3:21 PM
> > 
> > I am looking for a product to be used in encrypting e-mail to be sent
> > over the Internet. I've heard something about a product called Puffer by
> > Briggs Softworks but I haven't tested it so far.  
> > 
> > The ideal software should be user friendly otherwise it won't be used by
> > "normal" users...how can you stop them from sending clear text messages
> > or unencrypted attachments?
> > 
> > Any ideas, suggestions?
> > 
> > Thanks,
> > 
> > Adrian Grigorof
> > Internet Administrator
> > Bell Mobility Cellular Inc.
> > Toronto
> > www.bellmobility.ca
> > 
> > 
> > 
> > 
> > 
> > 
> 

*********
Vandana Shah
1031 E Lemon Street, #31
Tempe, AZ 85281

ph: (602)927-9720
email: vshah@asu.edu


From firewalls-owner  Wed Jan  7 21:01:25 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id UAA23153; Wed, 7 Jan 1998 20:25:55 -0800 (PST)
Received: from dfw-ix7.ix.netcom.com (dfw-ix7.ix.netcom.com [206.214.98.7]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id UAA23003 for <firewalls@greatcircle.com>; Wed, 7 Jan 1998 20:25:25 -0800 (PST)
From: pads@mouse.com
Received: (from smap@localhost)
          by dfw-ix7.ix.netcom.com (8.8.4/8.8.4)
	  id WAA24028; Wed, 7 Jan 1998 22:23:02 -0600 (CST)
Date: Wed, 7 Jan 1998 22:23:02 -0600 (CST)
Received: from 1cust198.tnt2.oxnard.ca.da.uu.net(208.252.94.198) by dfw-ix7.ix.netcom.com via smap (V1.3)
	id rma022562; Wed Jan  7 22:22:14 1998
Subject: Personalized Mouse Pads
Message-Id: <eaep.3.0.reg.SteIUZ.35802.8512173611@smtp.ix.netcom.com>
Content-Type: TEXT/PLAIN charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


     Have you ever wondered why your mother gave you the name she did?  Were you named after 
a close relative, family friend or possibly a television celebrity?  

     Well, we can't tell you why either!  However, what we can tell you is exactly what your name 
means!  

     We print your name and it's meaning on an attractive mouse pad with a custom art background 
of vibrant colors and scenery.  Not only is it pleasant to look at, but everytime you sit down to your 
computer, you'll be reminded of just how great you are. 

     We have the largest most comprehensive database of names anywhere.  And we can print 
names in both Spanish and English.

     We are so sure you'll be pleased with your personalized mouse pad, that we offer a 30 day 
unconditional money back guarantee.

     Placing your order is easy too!  Just complete the order form below and mail it along with just $10 
plus shipping and handling. (see below), and we will rush your personalized mouse pad by first class 
mail. 

     Choose your background preference!!

ABC BLOCKS                                         ANGELS                                         CLOUDS   

DOLPHINS                                            PRAYING HANDS                          SPORTS 

TEDDY BEAR                                        UNICORN                    or               WATERFALL

                                                              EASY ORDER FORM   

NAME REQUESTED                            MALE/FEMALE                               BACKGROUND PREF.

_________________                            ____________                     ________________________

_________________                            ____________                     ________________________

_________________                            ____________                     ________________________

QUANITY ORDERED_______________                  AMOUNT SENT$_______________

CASH CHECK OR MONEY ORDER'S ONLY!!!!                       US FUNDS ONLY!!!!!!!

USA MAILORDERS $12 EA                                   ALL OTHER ORDERS $14 EA
(includes $2 shipping/handling charge)                   (includes $4 shipping/handling charge)

MOST ORDERS SHIPPED WITHIN 48 HOURS.  IF  PAYING BY CHECK,  YOUR ORDER WILL 
BE SENT IMMEDIATELY FOLLOWING BANK APPROVAL.

PLEASE MAIL YOUR ORDER TO:       3J PRODUCTS
                                                               PO BOX 7183
                                                               OXNARD CA 93031

              


From firewalls-owner  Wed Jan  7 21:44:21 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id VAA07263; Wed, 7 Jan 1998 21:15:26 -0800 (PST)
Received: from hotmail.com (F79.hotmail.com [207.82.250.185]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id VAA07167 for <firewalls@greatcircle.com>; Wed, 7 Jan 1998 21:15:02 -0800 (PST)
Received: (qmail 26928 invoked by uid 0); 8 Jan 1998 05:15:38 -0000
Message-ID: <19980108051538.26927.qmail@hotmail.com>
Received: from 207.151.71.1 by www.hotmail.com with HTTP;
	Wed, 07 Jan 1998 21:15:38 PST
X-Originating-IP: [207.151.71.1]
From: "The Shepherd" <the__shepherd@hotmail.com>
To: firewalls@greatcircle.com
Subject: Fwd: Re: Goodbye, and thanks! --- (or, SPAM from the SPAM 
    haters)
Content-Type: text/plain
Date: Wed, 07 Jan 1998 21:15:38 PST
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>Unfortunately, 90% of the spam I do receive comes to me through the
>Firewalls list, and since there clearly is no intention on stopping
>it, or even curtailing it, the list's usefulness has become null.

Hear, Hear. (Although, I think you're being just a *tad* harsh.  The
occasional religious discussions about *nix vs. NT are pretty
entertaining, and you must admit you are amused by Sick Puppy's
inane rantings.)


Case-in-point:
>If any non-Telco organization can use an NT Consultant on a recurring
>basis (say a weekly call for example) drop me a note at
>Russ.Cooper@rc.on.ca

Gotta Love it.




______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com

From firewalls-owner  Wed Jan  7 21:48:23 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA21308; Wed, 7 Jan 1998 15:25:11 -0800 (PST)
Received: from starbase.tos.net (starbase.tos.net [208.137.47.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id PAA21253 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 15:24:57 -0800 (PST)
Received: (from mail@localhost)
          by starbase.tos.net (8.8.4/8.8.4)
	  id RAA08936; Wed, 7 Jan 1998 17:09:06 -0600
Received: from unknown(172.16.1.216) by starbase.tos.net via smap (V1.3)
	id sma008929; Wed Jan  7 17:08:58 1998
Message-Id: <Version.32.19980107163553.01064e50@smtp.tos.net>
X-Sender: macgyver@smtp.tos.net
X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0
Date: Wed, 07 Jan 1998 17:05:20 -0600
To: Peter da Silva <peter@baileynm.com>, jsk347@sprynet.com (Steve Kruse)
From: MacGyver <macgyver@tos.net>
Subject: Re: E-mail Encryption
Cc: peter@baileynm.com, firewalls@GreatCircle.COM
In-Reply-To: <9801072227.AA13340@baileynm.com>
References: <3.0.3.32.19980107160808.006a33b4@m6.sprynet.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

-----BEGIN PGP SIGNED MESSAGE-----

At 04:27 PM 1/7/98 -0600, Peter da Silva wrote:
>> I think it might have been mentioned on here, but there is a $5.00
>> "up-downgrade" that lets you use the RSA which IS compatabile with PGP 2.x.
>>  Check the PGP website for info.  
>
>And if I'm not running Windoze?
> 

If you're not running on a Mac or Win95/98, you can grab PGP 4.x.
It fully supports RSA, as does the COMMERCIAL version of PGP 5.x, which if
you plan to use it for anything other than personal use, you have to buy
anyway.  PGP 5.x (commercial) is NOT incompatible with previous versions of
PGP, but is a superset of functions provided in previous versions.


- --
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        ^               Habeeb J. Dihu
     -'   `-            Managing Senior Technologist
   " '     ` "          Cirrus Technologies
 "  '       `  "        
"  '      .  `  "                  
"  '    .' ` `  "       'I don't believe in the no-win scenario'
 " `   '    `' "           -- Captain James T. Kirk,  Star Trek II: TWK
   `  ' _  _ '          'There is an old Vulcan proverb, `Only Nixon 
    '                    could go to China.`'
                           -- Captain Spock, Star Trek VI: TUC
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-----BEGIN PGP SIGNATURE-----
Version: PGP for Business Security 5.5.2

iQCVAwUBNLQKL1TtNfTWxXdNAQH/uQP/STbPuT3/+6Fc6gzMPC3/Nc6wSUC8p5kl
qfb4cv4q8TYeXms8Kx6Z2VxPNsE//oT2ls5obfZsibVEjl3DM/HW6Chcv857B2Lo
TfkB1MzFupr9vbLWRcRVj4YSBt6IEY2lVhGrFZzm3H4yknb8Gj16aHf5ddePorN1
ocFl+MNLg8A=
=g8hP
-----END PGP SIGNATURE-----


From firewalls-owner  Wed Jan  7 22:39:17 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id VAA05633; Wed, 7 Jan 1998 21:04:50 -0800 (PST)
Received: from c00956-100lez.eos.ncsu.edu (c00956-100lez.eos.ncsu.edu [152.1.26.76]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id SAA25681 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 18:16:34 -0800 (PST)
Received: from localhost (jkwilli2@localhost)
          by c00956-100lez.eos.ncsu.edu (8.8.4/UC02Jan97) with SMTP
	  id VAA16765; Wed, 7 Jan 1998 21:16:38 -0500 (EST)
X-Authentication-Warning: c00956-100lez.eos.ncsu.edu: jkwilli2 owned process doing -bs
Date: Wed, 7 Jan 1998 21:16:38 -0500 (EST)
From: Ken Williams <jkwilli2@unity.ncsu.edu>
X-Sender: jkwilli2@c00956-100lez.eos.ncsu.edu
To: Peter da Silva <peter@baileynm.com>
cc: Steve Kruse <jsk347@sprynet.com>, macgyver@tos.net,
        firewalls@GreatCircle.COM
Subject: Re: E-mail Encryption
In-Reply-To: <9801072227.AA13340@baileynm.com>
Message-ID: <Pine.SOL.3.96.980107211304.16517A-100000@c00956-100lez.eos.ncsu.edu>
X-PreMailer: Microsoft-Unix '99 ProMail ver 0.98 beta
X-Content: Justify my text? I'm sorry but it has no excuse.
X-Crypto: When cryptography is outlawed
X-Crypto: bayl bhgynjf jvyy unir cevinpl.
X-Disclaimer: This email is meant for educational purposes only.
X-Disclaimer: The contents of this email do not reflect the thoughts
X-Disclaimer: or opinions of either myself or my employer.
X-Disclaimer: Any errors in spelling
X-Disclaimer: tact or fact are transmission errors.
X-Disclaimer: The best safeguard
X-Disclaimer: second only to abstinence
X-Disclaimer: is the use of a good mail filter.
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Wed, 7 Jan 1998, Peter da Silva wrote:

>> I think it might have been mentioned on here, but there is a $5.00
>> "up-downgrade" that lets you use the RSA which IS compatabile with PGP 2.x.
>>  Check the PGP website for info.  
>
>And if I'm not running Windoze?

then you can get it for *nix or mac too from www.pgp.com and do the same
thing.  in the case of some *nix versions, i know that there is virtually
100% downward compatibility between the Unix 5.0 and Unix 2.6 versions.

Respectfully,

Ken 

/<--------------{ TATTOOMAN -aka- rute }-------------->\  
  NCSU Computer Science    Member of E.H.A.P.   
  jkwilli2@unity.ncsu.edu  http://www.hackers.com/ehap/ 
  UNIX ICQ UIN# 4231260    ehap@hackers.com     
  FTP Site:  ftp://152.7.11.38/pub/personal/tattooman/
  WWW 2:     http://www4.ncsu.edu/~jkwilli2/
\<---------{ http://152.7.11.38/~tattooman/ }--------->/




From firewalls-owner  Wed Jan  7 22:45:25 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id VAA12685; Wed, 7 Jan 1998 21:43:28 -0800 (PST)
Received: from imsp015.netvigator.com (imsp015.netvigator.com [205.252.144.206]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id VAA12638 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 21:43:16 -0800 (PST)
Received: from js-computer (hhtam037039.netvigator.com [208.139.101.39])
	by imsp015.netvigator.com (8.8.8/8.8.8) with SMTP id NAA05952
	for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 13:43:23 +0800 (HKT)
Message-Id: <199801080543.NAA05952@imsp015.netvigator.com>
Date: Sun, 01 Feb 1998 08:52:25 +0800
From: MS <"ims02@netvigator.com"@netvigator.com>
Reply-To: "ims02@netvigator.com"@netvigator.com
X-Mailer: Mozilla 3.0Gold (Win95; I)
MIME-Version: 1.0
To: firewalls@GreatCircle.COM
Subject: Proxy Servers on DMZ??
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

Does anybody tell me whether the proxy servers (eg WEB, email) be placed
at DMZ segment
instead of at internal segment so as to protect the internal network?

Jim

From firewalls-owner  Wed Jan  7 22:45:48 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id VAA10193; Wed, 7 Jan 1998 21:31:34 -0800 (PST)
Received: from gate.quick.com.au (gate.quick.com.au [203.12.250.130]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id VAA10127 for <firewalls@greatcircle.com>; Wed, 7 Jan 1998 21:31:18 -0800 (PST)
Received: (from sjg@localhost) by gate.quick.com.au (8.8.5/8.7.3) id QAA12993; Thu, 8 Jan 1998 16:30:26 +1100 (EST)
Date: Thu, 8 Jan 1998 16:30:26 +1100 (EST)
From: "Simon J. Gerraty" <sjg@quick.com.au>
Message-Id: <199801080530.QAA12993@gate.quick.com.au>
To: Bogdan Pelc <pelc@fb3-s7.math.tu-berlin.de>
Cc: firewalls@greatcircle.com
Subject: Re: Split DNS??
References: <199801070947.AA09611@fb3-s12.math.tu-berlin.de>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Bogdan Pelc writes:
>  SJG> Some folk like split DNS because they think that "hiding" their
>  SJG> internal hostnames makes them more secure.  Such info leaks out in
>  SJG> so many ways that this "security by obscurity" is a myth.

>Really. If I have FW so conigured, that I have service Redirections and

The most common means by which such info "leaks" is in e-mail and news
headers.  You can configure sendmail on your firewall to hide
from addresses etc, but unless you make sendmail remove Received
headers (bad idea btw), the original hostname and each hop will be 
leaked.  Regardless of whether you have an air gap such info can
be useful for social engineering ("Hi, I'm from XYZ, I need to 
install an urgent patch on host fubar and the sysadmin is away...
what's the passwd?") lame, but you get the idea.  If asked nicely
many people are only too pleased to help :-)


>What are your Opinions?

That depends on the site.  My own little site here runs two bind's on
the firewall, one that the outside world looks at and is bound to
the ppp interface only, and another which is a secondary for my 
internal domains and forwards via the bind on the ppp interface 
(its the only one the kernel will allow to talk to the outside world)
and the other internal nameservers forward to the bind listening
on the firewall's ethernet.  External sites provide secondary DNS
for my external view.

I also run the firewalls and DNS for a _big_ corp, and there I set
things up such that there is zero DNS traffic through the firewall.
The reasons are many but include:
1. internally rooted DNS allows extended disconnection from Internet
without impact on corporate network.
2. use of illegal nets on corp net means external address resolution
is meaningless in most cases.
3. the forwarding model described above does not scale well to 
_big_ corporate nets.
4. passing zero DNS traffic through firewall ensures that Internet
is not poluted with internal roots.

--sjg


>-- 
>____________________________________________________________________________
>     Bogdan Pelc; Sekr. MA 6-3, Ma682; Tel: 030-31423607, 030-31422491
>			  pelc@math.tu-berlin.de

>Do You realize , that this world is totally FUGAZI, where are the poets,
>where are the visionaries ...  (FISH)


From firewalls-owner  Thu Jan  8 00:42:33 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id XAA10023; Wed, 7 Jan 1998 23:43:51 -0800 (PST)
Received: from mail-syd.atinet.com.au (atinet.com.au [203.35.110.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id XAA09841 for <Firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 23:43:16 -0800 (PST)
Received: from ppp-129.atinet.com.au (ppp-129.atinet.com.au [203.35.110.129]) by mail-syd.atinet.com.au (NTMail 3.02.13) with ESMTP id fa026265 for <Firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 18:42:49 +1100
Received: from beethoven (beethoven.winspace.net [192.168.0.2]) by mozart.winspace.net (8.8.8/8.7.3) with SMTP id SAA19992; Thu, 8 Jan 1998 18:43:36 +1100
From: "Norman Widders" <winspace@atinet.com.au>
Date: Thu, 8 Jan 1998 18:43:34 +1000 (GMT)
Subject: Re: E-mail Encryption
To: <Firewalls@GreatCircle.COM>
Reply-To: <winspace@atinet.com.au>
Organization: Paladin Corporation
Message-Id: <Paladin.2.34.884245414-379889516353721.beethoven>
X-Mailer: Paladin IMAP4 Client v2.34
In-Reply-To: <Version.32.19980107163553.01064e50@smtp.tos.net>
References: <3.0.3.32.19980107160808.006a33b4@m6.sprynet.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Content-Transfer-Encoding: 7BIT
Content-ID: <Paladin.2.34.beethoven.884245414.1>
X-Info: All Things Internet POP3 Server
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Wed, 07 Jan 1998 17:05:20 -0600
MacGyver <macgyver@tos.net> wrote:

In case it wasnt mentioned...

For those outside the USA goto http://www.pgpi.com 
where they scanned the software in from printouts.. ie source.
assuming one wants to roll-ones-own.... 

> If you're not running on a Mac or Win95/98, you can grab PGP 4.x.
> It fully supports RSA, as does the COMMERCIAL version of PGP 5.x, which if
> you plan to use it for anything other than personal use, you have to buy
> anyway.  PGP 5.x (commercial) is NOT incompatible with previous versions of
> PGP, but is a superset of functions provided in previous versions.

--
wheres my valium ?


From firewalls-owner  Thu Jan  8 01:15:44 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id XAA11449; Wed, 7 Jan 1998 23:49:24 -0800 (PST)
Received: from mail-syd.atinet.com.au (atinet.com.au [203.35.110.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id XAA11297 for <Firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 23:48:56 -0800 (PST)
Received: from ppp-129.atinet.com.au (ppp-129.atinet.com.au [203.35.110.129]) by mail-syd.atinet.com.au (NTMail 3.02.13) with ESMTP id ea026368 for <Firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 18:48:53 +1100
Received: from beethoven (beethoven.winspace.net [192.168.0.2]) by mozart.winspace.net (8.8.8/8.7.3) with SMTP id SAA20037; Thu, 8 Jan 1998 18:49:40 +1100
From: "Norman Widders" <winspace@atinet.com.au>
Date: Thu, 8 Jan 1998 18:49:39 +1000 (GMT)
Subject: RE: Fwd: Re: Goodbye, and thanks! --- (or, SPAM from the SPAM     haters)
To: <Firewalls@GreatCircle.COM>
Reply-To: <winspace@atinet.com.au>
Organization: Paladin Corporation
Message-Id: <Paladin.2.34.884245779-559473724372095.beethoven>
X-Mailer: Paladin IMAP4 Client v2.34
In-Reply-To: <19980108051538.26927.qmail@hotmail.com>
References: <19980108051538.26927.qmail@hotmail.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Content-Transfer-Encoding: 7BIT
Content-ID: <Paladin.2.34.beethoven.884245779.1>
X-Info: All Things Internet POP3 Server
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Wed, 07 Jan 1998 21:15:38 PST
"The Shepherd" <the__shepherd@hotmail.com> wrote:

Heres to Spam, heres to sikpuppy, heres to fluffy-pink handcuffs and bondage...
.. heres to Microsoft purchasing hotmail.com B)

Just my $0.02c


> >Unfortunately, 90% of the spam I do receive comes to me through the
> >Firewalls list, and since there clearly is no intention on stopping
> >it, or even curtailing it, the list's usefulness has become null.
> 
> Hear, Hear. (Although, I think you're being just a *tad* harsh.  The
> occasional religious discussions about *nix vs. NT are pretty
> entertaining, and you must admit you are amused by Sick Puppy's
> inane rantings.)

--
wheres my valium ?



From firewalls-owner  Thu Jan  8 02:32:42 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id XAA08504; Wed, 7 Jan 1998 23:36:15 -0800 (PST)
Received: from mail-syd.atinet.com.au (atinet.com.au [203.35.110.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id XAA08465 for <Firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 23:35:57 -0800 (PST)
Received: from ppp-129.atinet.com.au (ppp-129.atinet.com.au [203.35.110.129]) by mail-syd.atinet.com.au (NTMail 3.02.13) with ESMTP id da026263 for <Firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 18:35:46 +1100
Received: from beethoven (beethoven.winspace.net [192.168.0.2]) by mozart.winspace.net (8.8.8/8.7.3) with SMTP id SAA19935; Thu, 8 Jan 1998 18:36:33 +1100
From: "Norman Widders" <winspace@atinet.com.au>
Date: Thu, 8 Jan 1998 18:36:31 +1000 (GMT)
Subject: relative strengths of different encyrption techniques
To: <TB186459@shellus.com>
CC: <Firewalls@GreatCircle.COM>
Reply-To: <winspace@atinet.com.au>
Organization: Paladin Corporation
Message-Id: <Paladin.2.34.884244991-154472847641083.beethoven>
X-Mailer: Paladin IMAP4 Client v2.34
In-Reply-To: <D193F6640135D111B2A800805F8B6002021891@icsscx03.shell.com>
References: <D193F6640135D111B2A800805F8B6002021891@icsscx03.shell.com>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Content-Transfer-Encoding: 7BIT
Content-ID: <Paladin.2.34.beethoven.884244991.1>
X-Info: All Things Internet POP3 Server
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Wed, 7 Jan 1998 16:46:31 -0600
"Bowers T (Thomas)  at MSXSSC" <TB186459@shellus.com> wrote:

PGP recommends 3k bits nowadays just to be safe...

> 
> I'm not a crpytologist but...
> 
> I've been asked to estimate the time it takes to crack various
> encyrption
> techniques...
> 
> Yes...  I understand the more bits, the better...
> 
> 
> I understand that most reasonable people will deploy the best technique
> available...  and so will we.    That, however, doesn't alleviate me
> from
> trying to estimate how many days/months/years/light_years of compute
> cycles it will take for someone to crack the technique we select.
> 
> 
> Are there any references on the relative strengths of different
> encyrption
> techniques...  
> 
> 
> Any help would be appreciated...
> 
> 
> 
> T. Bowers
> 
> 
> 
> 
> 
> Tom Bowers
> Network Engineering
> Shell Services Company
> PHONE:  (1)  713-245-1269
> FAX:  (1) 713-245-1010
> E-MAIL: tbowers@shellus.com

--
Yours faithfully, Norman Widders.

+-----------------------------------------------------------
|   winspace@atinet.com.au
|   http://www.atinet.com.au/~winspace/
|   Home of the Paladin IMAP4 E-Mail client.
|   Paladin Corporation Pty. Ltd.      
+-----------------------------------------------------------



From firewalls-owner  Thu Jan  8 02:38:14 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id AAA23555; Thu, 8 Jan 1998 00:44:59 -0800 (PST)
Received: from mail-syd.atinet.com.au (atinet.com.au [203.35.110.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id XAA13364 for <Firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 23:55:29 -0800 (PST)
Received: from ppp-129.atinet.com.au (ppp-129.atinet.com.au [203.35.110.129]) by mail-syd.atinet.com.au (NTMail 3.02.13) with ESMTP id ca026392 for <Firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 18:55:19 +1100
Received: from beethoven (beethoven.winspace.net [192.168.0.2]) by mozart.winspace.net (8.8.8/8.7.3) with SMTP id SAA20079; Thu, 8 Jan 1998 18:56:05 +1100
From: "Norman Widders" <winspace@atinet.com.au>
Date: Thu, 8 Jan 1998 18:56:03 +1000 (GMT)
Subject: Re: Split DNS??
To: <Firewalls@GreatCircle.COM>
Reply-To: <winspace@atinet.com.au>
Organization: Paladin Corporation
Message-Id: <Paladin.2.34.884246163-961060383185765.beethoven>
X-Mailer: Paladin IMAP4 Client v2.34
In-Reply-To: <199801080530.QAA12993@gate.quick.com.au>
References: <199801070947.AA09611@fb3-s12.math.tu-berlin.de>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Content-Transfer-Encoding: 7BIT
Content-ID: <Paladin.2.34.beethoven.884246163.1>
X-Info: All Things Internet POP3 Server
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Thu, 8 Jan 1998 16:30:26 +1100 (EST)
"Simon J. Gerraty" <sjg@quick.com.au> wrote:

Talking about sendmail and rewriting From: headers (which I do)...

hmmm, The Message-id: field also can give away internal machine names too...
depending upon who is creating this header field and how....
Have a close look at the RFC822 headers and you will see for yourself...


> The most common means by which such info "leaks" is in e-mail and news
> headers.  You can configure sendmail on your firewall to hide
> from addresses etc, but unless you make sendmail remove Received
> headers (bad idea btw), the original hostname and each hop will be 
> leaked.  Regardless of whether you have an air gap such info can
> be useful for social engineering ("Hi, I'm from XYZ, I need to 
> install an urgent patch on host fubar and the sysadmin is away...
> what's the passwd?") lame, but you get the idea.  If asked nicely
> many people are only too pleased to help :-)
> 
> 
> >What are your Opinions?
> 
> That depends on the site.  My own little site here runs two bind's on
> the firewall, one that the outside world looks at and is bound to
> the ppp interface only, and another which is a secondary for my 
> internal domains and forwards via the bind on the ppp interface 
> (its the only one the kernel will allow to talk to the outside world)
> and the other internal nameservers forward to the bind listening
> on the firewall's ethernet.  External sites provide secondary DNS
> for my external view.
> 
> I also run the firewalls and DNS for a _big_ corp, and there I set
> things up such that there is zero DNS traffic through the firewall.
> The reasons are many but include:
> 1. internally rooted DNS allows extended disconnection from Internet
> without impact on corporate network.
> 2. use of illegal nets on corp net means external address resolution
> is meaningless in most cases.
> 3. the forwarding model described above does not scale well to 
> _big_ corporate nets.
> 4. passing zero DNS traffic through firewall ensures that Internet
> is not poluted with internal roots.
> 
> --sjg
> 
> 
> >-- 
> >____________________________________________________________________________
> >     Bogdan Pelc; Sekr. MA 6-3, Ma682; Tel: 030-31423607, 030-31422491
> >			  pelc@math.tu-berlin.de
> 
> >Do You realize , that this world is totally FUGAZI, where are the poets,
> >where are the visionaries ...  (FISH)

--
Yours faithfully, Norman Widders.

+-----------------------------------------------------------
|   winspace@atinet.com.au
|   http://www.atinet.com.au/~winspace/
|   Home of the Paladin IMAP4 E-Mail client.
|   Paladin Corporation Pty. Ltd.      
+-----------------------------------------------------------



From firewalls-owner  Thu Jan  8 04:46:16 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id DAA18332; Thu, 8 Jan 1998 03:12:55 -0800 (PST)
Received: from gatekeeper.alcatel.no (ns0.alcatel.no [193.213.238.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id DAA18236 for <Firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 03:12:29 -0800 (PST)
Received: from alcatel.no by gatekeeper.alcatel.no (8.8.8/Alcanet-SC)
	id MAA23197; Thu, 8 Jan 1998 12:13:07 +0100 (MET)
Message-ID: <34B4B4C3.9EC9778B@alcatel.no>
Date: Thu, 08 Jan 1998 12:13:07 +0100
From: Kare Presttun <Kare.Presttun@alcatel.no>
Organization: Alcanet International
X-Mailer: Mozilla 4.04 [en] (Win95; I)
MIME-Version: 1.0
To: Firewalls@GreatCircle.COM
Subject: Re: Firewalls-Digest V7 #11
References: <199801080915.BAA29122@honor.greatcircle.com>
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

Sorry about the previous post. Some bug in my mail client
made the message go out when I hit "return" while in edit
mode. Hope it does not happen again.

Best regards,
-- =

--------------------------------------------------------
K=E5re Presttun                     Alcanet International
Tel   : +47 2263 7601             P.O. Box 60
Fax   : +47 2263 8887             N-0508 Oslo
Mobile: +47 9082 7068             NORWAY
mailto:Kare.Presttun@alcatel.no   http://www.alcatel.no/

From firewalls-owner  Thu Jan  8 05:16:19 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id DAA23458; Thu, 8 Jan 1998 03:50:19 -0800 (PST)
Received: from robban.IP80 (smtp2.port80.se [193.14.170.78]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id DAA23356 for <firewalls@greatcircle.com>; Thu, 8 Jan 1998 03:49:53 -0800 (PST)
Received: from robban (localhost [127.0.0.1])
          by robban (Viking/0.9.32-dev) with SMTP
          (for multiple);
          Thu, 08 Jan 1998 12:49:05 +0100
Message-Id: <3.0.5.32.19980108124904.00b37a00@robtex.com>
X-Sender: robban@robtex.com
X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.5 (32)
Date: Thu, 08 Jan 1998 12:49:04 +0100
To: BoB Miorelli <miorelli@pweh.com>, firewalls@greatcircle.com
From: Robert Olsson <robban@robtex.com>
Subject: Re: NT Web proxy server
In-Reply-To: <34b1435f0.1464@clbdev2.eh.pweh.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Please try our product "Viking". It does dialup, caching, url-filter in
addition to other functions like being a web/intranet-server and mailserver.

http://www.robtex.com/viking/

Regards

Robert Olsson
RobTex

At 15:32 1998-01-05 EST, you wrote:
>Hi --
>
>I'm looking for a Web proxy server that does caching for
>my kid's school (K-8).  The computer lab is networked
>to a server which would run the proxy.  The server
>is a Pentium running NT 4.0.  I'm looking for
>recommendations on proxy server software from anyone
>that is running it on NT 4.0 using a dialup-on-demand
>type of setup.  The only proxy servers for NT that
>I am aware of are Microsoft and Netscape, but I'm
>sure there are others.
>
>Any and all comments are welcome.
>
>Thanks.
>
>-->BoB 
>
>
>-->BoB Miorelli, Pratt & Whitney
>miorelli@pweh.com
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
>In theory, theory and practice are the same; 
>in practice they are distinct.
>



From firewalls-owner  Thu Jan  8 05:46:16 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id FAA08210; Thu, 8 Jan 1998 05:39:47 -0800 (PST)
Received: from smtp2.mailsrvcs.net (smtp2.gte.net [207.115.153.31]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id FAA08192 for <firewalls@greatcircle.com>; Thu, 8 Jan 1998 05:39:40 -0800 (PST)
Received: from glearnhart ([206.124.85.16])
	by smtp2.mailsrvcs.net  with SMTP id HAA20553
	for <firewalls@greatcircle.com>; Thu, 8 Jan 1998 07:39:46 -0600 (CST)
Message-ID: <003c01bd1c3b$01552f50$10557cce@glearnhart.gte.net>
From: "Gregg Earnhart" <ge@gte.net>
To: <firewalls@greatcircle.com>
Subject: Intrusion detection
Date: Thu, 8 Jan 1998 07:40:38 -0600
MIME-Version: 1.0
Content-Type: multipart/alternative;
	boundary="----=_NextPart_000_0039_01BD1C08.B66FD3A0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 4.72.2106.4
X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

This is a multi-part message in MIME format.

------=_NextPart_000_0039_01BD1C08.B66FD3A0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Does a list discussing intrusion detection exists?
Is there a need for such a list or NG to discuss intrusion detection
systems?


Gregg Earnhart
Sr. Security Engineer


------=_NextPart_000_0039_01BD1C08.B66FD3A0
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD W3 HTML//EN">
<HTML>
<HEAD>

<META content=3Dtext/html;charset=3Diso-8859-1 =
http-equiv=3DContent-Type>
<META content=3D'"MSHTML 4.72.2106.6"' name=3DGENERATOR>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV>Does a list discussing intrusion detection exists?<BR>Is there a =
need for=20
such a list or NG to discuss intrusion =
detection<BR>systems?<BR><BR><BR>Gregg=20
Earnhart<BR>Sr. Security Engineer<BR></DIV></BODY></HTML>

------=_NextPart_000_0039_01BD1C08.B66FD3A0--


From firewalls-owner  Thu Jan  8 06:01:34 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id FAA09103; Thu, 8 Jan 1998 05:45:26 -0800 (PST)
Received: from ykbgate ([195.33.225.162]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id FAA09079 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 05:45:18 -0800 (PST)
Received: by ykbgate; (5.65v3.2/1.3/10May95) id AA15265; Thu, 8 Jan 1998 11:33:46 +0200
Received: by plaza.ykb.com; (5.65v3.2/1.3/10May95) id AA20617; Thu, 8 Jan 1998 15:41:24 +0200
X-Lotus-Fromdomain: YKBNOTES
From: "icakmakli"<icakmakli@ykb.com>
To: firewalls@GreatCircle.COM
Message-Id: <C2256586.004BB43E.00@newsserv.ykb.com>
Date: Thu, 8 Jan 1998 15:46:07 +0200
Subject: Invision
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Has anybody run Invision Workstation through the firewall? Is there any
information about the CSK Software's Invision program on which ports it
runs? Regards.



From firewalls-owner  Thu Jan  8 06:31:33 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA13648; Thu, 8 Jan 1998 06:10:10 -0800 (PST)
Received: from diablo.cisco.com (diablo.cisco.com [171.68.223.106]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id GAA13497 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 06:09:41 -0800 (PST)
Received: from clonvick-pc.cisco.com (houcons.cisco.com [171.68.41.7]) by diablo.cisco.com (8.8.5/CISCO.SERVER.1.2) with SMTP id GAA06608; Thu, 8 Jan 1998 06:09:45 -0800 (PST)
Message-Id: <2.2.32.19980108140808.0088d480@localhost>
X-Sender: clonvick@localhost
X-Mailer: Windows Eudora Pro Version 2.2 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Thu, 08 Jan 1998 08:08:08 -0600
To: Andre van der Lans <andre.van.der.lans@inet.unisource.nl>,
        Randall Kizer <rkizer@guten.sddpc.org>, firewalls@GreatCircle.COM
From: Chris Lonvick <clonvick@cisco.com>
Subject: Re: Firewall for ISP
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

Just a point here - the "cut-through proxy" feature is an in-stream
authentication mechanism tied to TACACS+ or RADIUS for Telnet, FTP 
and HTTP.  All packets in all streams are checked.  The Product 
Overview that explains this is at
  http://www.cisco.com/univercd/cc/td/doc/prod_cat/pcpix.htm

OBTW, I received 53 copies of the original note from Jaime's
repetitious mailer.  Does this qualify me for some prize?
(For the humor impaired: this is it. :-)

Later,

Chris Lonvick
Cisco Systems
Consulting Engineering
Houston, TX, USA
+1.713.778.5663

At 09:15 AM 1/7/98 +0100, Andre van der Lans wrote:
>Randall Kizer wrote:
>> 
>> Jaime,
>> 
>> We've just implemented a PIX firewall to evaluate it.  Would you, or anyone
>> else reading this e-mail, please share your experiences with this product.
>> You mentioned "it has some weakness", can you be more specific?  What are
>> some of its strengths?
>> 
>> Randall
>> rkizer@sddpc.org
>> 
>> >From: "Jaime Blanco" <support@sinfo.net>
>> >To: <firewalls@greatcircle.com>
>> >Cc: <inet-access@earth.com>
>> >Subject: Firewall for ISP
>> >Date: Wed, 17 Dec 1997 20:38:06 -0500
>Beunos dias,
>
>The Cisco PIX isn't realy a firewall. It's a cut through proxy which
>means that when a packet is checked for authentication, the PIX simply
>gona forward all these packages and none of the following packages are
>beeing screened. It's difficult to get the logging done and the ligging
>is alsow done with syslog on a remote machine ( The PIX hasn't got a
>hard disk). Another issue is that the GUI quits working when the
>configurationfile has more than 400 entries. 
>
>Last but not least, the Cisco PIX is a expensive product and for the
>same prise or less you can get a much better Firewall.
>
>-- 
>Andre van der Lans
>Unisource Business Networks Netherlands bv
>Koningin Sophie St 120, 2595 TM The Hague
>Tel +31 703711069, Fax +31 703712638
>Email: andre.van.der.lans@inet.unisource.nl
>
>


From firewalls-owner  Thu Jan  8 06:56:20 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA14557; Thu, 8 Jan 1998 06:14:40 -0800 (PST)
Received: from cebu.mozcom.com (cebu.mozcom.com [207.0.115.45]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id GAA14487 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 06:14:24 -0800 (PST)
Received: from localhost (derts@localhost) by cebu.mozcom.com (8.8.8/8.6.9) with SMTP id WAA02339 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 22:05:29 GMT
Date: Thu, 8 Jan 1998 22:05:28 +0000 (   )
From: Ederlindo Cojuangco <derts@cebu.mozcom.com>
To: firewalls@GreatCircle.COM
Subject: Re: E-mail Encryption
In-Reply-To: <Pine.SOL.3.91.980107181919.18133B-100000@hq.si.net>
Message-ID: <Pine.LNX.3.95.980108220103.2331B-100000@cebu.mozcom.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

	Whew!  I am done with my research.  I know some are already using
PGP but for those who are curious like me try to visit this page:
        http://www.pgpi.com
	Hope this helps.
	Thanks for all your mails.


ederts


From firewalls-owner  Thu Jan  8 06:57:56 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id FAA10381; Thu, 8 Jan 1998 05:53:18 -0800 (PST)
Received: from maddie.atlantic.com (maddie.atlantic.com [198.252.200.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id FAA10352 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 05:53:11 -0800 (PST)
Received: (from pokey@localhost) by maddie.atlantic.com (8.8.5/8.7.3) id IAA30843; Thu, 8 Jan 1998 08:52:28 -0500
From: Rick Romkey <pokey@maddie.atlantic.com>
Message-Id: <199801081352.IAA30843@maddie.atlantic.com>
Subject: Re: FW-1 3.0 and Solaris 2.6 ok?
To: macgyver@tos.net (MacGyver)
Date: Thu, 8 Jan 1998 08:52:27 -0500 (EST)
Cc: TrevorPaquette@mcc.net, Feroz.Khan@VECTOR.CO.ZA, firewalls@GreatCircle.COM,
        RWaegner@hou.mdc.com, grat@frii.com
In-Reply-To: <Version.32.19980107203027.0134bbc0@smtp.tos.net> from "MacGyver" at Jan 7, 98 08:33:28 pm
X-Mailer: ELM [version 2.4 PL23]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> That's not been my experience at all.  We've installed over two dozen FW1
> installations recently on Solaris 2.6, with FW1 3.0b.  The only cavaet is
> to make sure you do *NOT* attempt to install FW1 "out of the box" download
> the "patched" version that Sun distributes as a patch (it's really a whole
> new set of binaries).  Once you do that, you're in good shape.

According to CheckPoint, Sun does not release different binaries than
ChecPoint themselves.  They simply re-package what CheckPoint creates.

-Rick

----------------------------------------------------------------------------
 Rick E Romkey     |          A T L A N T I C           |     Internet
pokey@atlantic.com |  Computing Technology Corporation  |   Specialists
 (860) 667-9596    |     http://www.atlantic.com/       |    
-----------------------------------------------------------------------------


From firewalls-owner  Thu Jan  8 06:59:19 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id FAA10500; Thu, 8 Jan 1998 05:53:48 -0800 (PST)
Received: from honcho.columbiasc.ncr.com (h153-78-17-231.NCR.COM [153.78.17.231]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id FAA10447 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 05:53:34 -0800 (PST)
Received: from exchsmtp.ColumbiaSC.NCR.COM (xgate.ColumbiaSC.NCR.COM [153.78.17.107]) by honcho.columbiasc.ncr.com (8.7.6/8.6.12) with SMTP id IAA15487 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 08:54:14 -0500 (EST)
Received: by exchsmtp.ColumbiaSC.NCR.COM with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63)
	id <01BD1C12.A4E6A550@exchsmtp.ColumbiaSC.NCR.COM>; Thu, 8 Jan 1998 08:51:43 -0500
Message-ID: <c=US%a=_%p=NCR%l=ENGPO-980108135314Z-25613@exchsmtp.ColumbiaSC.NCR.COM>
From: "Caldwell, Matt" <caldwm@xgate.columbiasc.ncr.com>
To: "'Bowers T (Thomas)  at MSXSSC'" <TB186459@shellus.com>
Cc: "'firewalls@GreatCircle.COM'" <firewalls@GreatCircle.COM>
Subject: RE: relative strengths of different encryption techniques
Date: Thu, 8 Jan 1998 08:53:14 -0500
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.994.63
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I suggest you get "Applied Cryptography" from Amazon or Such, it has a
reference section that has a chart to show the time relative to the
processor speed etc. 

Matthew F. Caldwell - Security Analyst
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Visionary Corporate Computing Concepts (VC3)
Email:        matt.caldwell@vc3.com
Company Web: http://www.vc3.com/
Personal  Web: http://www.vc3.com/~caldwm
Office Phone: 803-733-7333
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

>----------
>From: 	Bowers T (Thomas)  at MSXSSC[SMTP:TB186459@shellus.com]
>Sent: 	Wednesday, January 07, 1998 5:46 PM
>To: 	'firewalls@greatcircle.com'
>Subject: 	relative strengths of different encyrption techniques
>
>
>I'm not a crpytologist but...
>
>I've been asked to estimate the time it takes to crack various
>encyrption
>techniques...
>
>Yes...  I understand the more bits, the better...
>
>
>I understand that most reasonable people will deploy the best technique
>available...  and so will we.    That, however, doesn't alleviate me
>from
>trying to estimate how many days/months/years/light_years of compute
>cycles it will take for someone to crack the technique we select.
>
>
>Are there any references on the relative strengths of different
>encyrption
>techniques...  
>
>
>Any help would be appreciated...
>
>
>
>T. Bowers
>
>
>
>
>
>Tom Bowers
>Network Engineering
>Shell Services Company
>PHONE:  (1)  713-245-1269
>FAX:  (1) 713-245-1010
>E-MAIL: tbowers@shellus.com
>

From firewalls-owner  Thu Jan  8 07:01:56 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA11834; Thu, 8 Jan 1998 06:00:50 -0800 (PST)
Received: from mailserver1.mdc.com (MAILSERVER1.LGB.CAL.BOEING.COM [129.200.140.50]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id GAA11766 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 06:00:35 -0800 (PST)
Received: by MAILSERVER1.MDC.COM with Internet Mail Service (5.0.1458.49)
	id <CQKK5NR5>; Thu, 8 Jan 1998 08:03:02 -0600
Message-ID: <CE0690979441D111B55D0000F840E2B9081735@MAILSERVER1.MDC.COM>
From: "Waegner.Rick" <RWaegner@hou.mdc.com>
To: "Paquette, Trevor" <TrevorPaquette@mcc.net>,
        "'Feroz Khan - VCS'"
	 <Feroz.Khan@VECTOR.CO.ZA>,
        "'MacGyver'" <macgyver@tos.net>
Cc: firewalls@GreatCircle.COM, grat@frii.com
Subject: RE: FW-1 3.0 and Solaris 2.6 ok?
Date: Thu, 8 Jan 1998 08:03:00 -0600
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1458.49)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Habeeb,

	You are correct about FW-1 3.0b and Solaris 2.6 working fine.
But, the original question was FW-1 3.0 and Solaris 2.6. BTW FW-1 3.0 is
what you get from Sun, Checkpoint is already shipping FW-1 3.0b as well
are their VAR's (except Sun!!)

Rick Waegner

The Boeing Company
UNIX Sysadmin
richard.a.waegner@boeing.com
281.283.5485

> ----------
> From: 	MacGyver
> Sent: 	Wednesday, January 7, 1998 21:33
> To: 	Paquette, Trevor; 'Feroz Khan - VCS'
> Cc: 	firewalls@GreatCircle.COM; Waegner.Rick; grat@frii.com
> Subject: 	RE: FW-1 3.0 and Solaris 2.6 ok?
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> 
> At 02:35 PM 1/7/98 -0700, Paquette, Trevor wrote:
> >Huh?? Are you then saying that Firewall-1 3.0b cannot be installed on
> a
> >Solaris 2.6 system out of the box? One must install Solaris 2.5.1,
> THEN
> >install Firewall-1 3.0b, THEN upgrade to Solaris 2.6??
> >
> >That smells very fishy to me. Have you confirmed this with Sun? 
> >
> 
> That's not been my experience at all.  We've installed over two dozen
> FW1
> installations recently on Solaris 2.6, with FW1 3.0b.  The only cavaet
> is
> to make sure you do *NOT* attempt to install FW1 "out of the box"
> download
> the "patched" version that Sun distributes as a patch (it's really a
> whole
> new set of binaries).  Once you do that, you're in good shape.
> 
> The only Solaris 2.6 issue that came back to bite me is that Sun
> hasn't yet
> released 2.6 drivers for it's SBus Quad-Ethernet cards -- who'd have
> figured they'd release an OS without at least drivers for some
> standard and
> semi-standard peripherals.
> 
> 
> - --
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> ~~
>         ^               Habeeb J. Dihu
>      -'   `-            Managing Senior Technologist
>    " '     ` "          Cirrus Technologies
>  "  '       `  "        
> "  '      .  `  "                  
> "  '    .' ` `  "       'I don't believe in the no-win scenario'
>  " `   '    `' "           -- Captain James T. Kirk,  Star Trek II:
> TWK
>    `  ' _  _ '          'There is an old Vulcan proverb, `Only Nixon 
>     '                    could go to China.`'
>                            -- Captain Spock, Star Trek VI: TUC
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> ~~
> 
> -----BEGIN PGP SIGNATURE-----
> Version: PGP for Business Security 5.5.2
> 
> iQCVAwUBNLQ6+FTtNfTWxXdNAQGmuwP/Rq1/YrKq8T5fPDnrwnkIvdnu9kOwPL1v
> gMm33RXtOv0nHyyhiuHd2WdaCkwf0Gmcpcw6xW53MlvmXllMHx4rbsU3Eiv/oIrX
> JzAs4U8GFg/afymQEi3mu9EOMSr3aztdHUryZS8rp+L2lAEv/mknacmEX4x0GOYf
> wVYLXWbyN+s=
> =MBO7
> -----END PGP SIGNATURE-----
> 

From firewalls-owner  Thu Jan  8 07:03:30 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA14692; Thu, 8 Jan 1998 06:15:19 -0800 (PST)
Received: from mail.zrz.TU-Berlin.DE (mail.zrz.TU-Berlin.DE [130.149.4.15]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id FAA10754 for <firewalls@greatcircle.com>; Thu, 8 Jan 1998 05:55:04 -0800 (PST)
Received: from fb3-s7.math.tu-berlin.de by mail.zrz.TU-Berlin.DE 
          with SMTP (IC-PP); Thu, 8 Jan 1998 14:54:56 +0100
Received: from fb3-s12.math.TU-Berlin.DE by fb3-s7.math.tu-berlin.de with SMTP 
          id AA16891 (5.67b8/IDA-1.4.4); Thu, 8 Jan 1998 14:54:53 +0100
Received: by fb3-s12.math.tu-berlin.de id AA19530 (5.67b8/IDA-1.4.4);
          Thu, 8 Jan 1998 14:53:52 +0100
Date: Thu, 8 Jan 1998 14:53:52 +0100
Message-Id: <199801081353.AA19530@fb3-s12.math.tu-berlin.de>
From: Bogdan Pelc <pelc@fb3-s7.math.tu-berlin.de>
To: sjg@quick.com.au
Cc: firewalls@greatcircle.com
In-Reply-To: <199801080530.QAA12993@gate.quick.com.au> (sjg@quick.com.au)
Subject: Re: Split DNS??
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>>>>> "SJG" == Simon J Gerraty <sjg@quick.com.au> writes:


[... TEXT DELETED ...]

  SJG> The most common means by which such info "leaks" is in e-mail and
  SJG> news headers.  You can configure sendmail on your firewall to hide

Yes, I must think about for a moment ... I will write later.

  SJG> from addresses etc, but unless you make sendmail remove Received
  SJG> headers (bad idea btw), the original hostname and each hop will be
  SJG> leaked.  Regardless of whether you have an air gap such info can be
  SJG> useful for social engineering ("Hi, I'm from XYZ, I need to install
  SJG> an urgent patch on host fubar and the sysadmin is away...  what's
  SJG> the passwd?") lame, but you get the idea.  If asked nicely many
  SJG> people are only too pleased to help :-)

[... TEXT DELETED ...]


  SJG> That depends on the site.  My own little site here runs two bind's
  SJG> on the firewall, one that the outside world looks at and is bound to
  SJG> the ppp interface only, and another which is a secondary for my
  SJG> internal domains and forwards via the bind on the ppp interface (its
  SJG> the only one the kernel will allow to talk to the outside world) and
  SJG> the other internal nameservers forward to the bind listening on the
  SJG> firewall's ethernet.  External sites provide secondary DNS for my
  SJG> external view.

Well, yes for small site with not to high security it's ok, i think. But if
your Firewall get hacked, also your both DNS get hacked, didn' they?  If
you have primary DNS for your Site in the internal network (for example
network with test-IPs 10. than I have to hack one machine more, that is the
Internal DNS-Server). Yes I know if the FW get hacked, than the game is
nearly over, but I think its somewhat more dificult. I have to go through
the DMZ, I have to go through the router to my internal net, and this I can
do only with the FW-IP, so I have to install my hack-software on the FW
first and so on ...

  SJG> I also run the firewalls and DNS for a _big_ corp, and there I set
  SJG> things up such that there is zero DNS traffic through the firewall.
  SJG> The reasons are many but include: 1. internally rooted DNS allows
  SJG> extended disconnection from Internet without impact on corporate

I don't understand Point Nr. 1. Sorry :(

  SJG> network. 2. use of illegal nets on corp net means external address
  SJG> resolution is meaningless in most cases.  3. the forwarding model
  SJG> described above does not scale well to _big_ corporate nets.
  SJG> 4. passing zero DNS traffic through firewall ensures that Internet
  SJG> is not poluted with internal roots.

2.3 I don't understand it either. So if I am on the Corp-net, and I want to
nslookup www.microsoft.com, so how do I get the IP if I have no DNS-traffic
through the FW? It seems that I get the IP from DNS on the firewall. Did
you mean that? But so there is no problem to have primary DNS on Corp-net
for the Corp-net with forward to the Firewall, which have forward to my ISP.

4. I cannot imagine that, because it's one DNS-forward more as for the
situation without the firewall (If I have no FW than I forward to my
ISP-DNS directly). If I have caching server it should scale
good. I have here site with 400+ Machines, and DNS is OK. I cannot imagine,
that one DNS-forward more and caching DNS-Server should not scale good.

Could you please explain?

[... TEXT DELETED ...]

-- 
____________________________________________________________________________
     Bogdan Pelc; Sekr. MA 6-3, Ma682; Tel: 030-31423607, 030-31422491
			  pelc@math.tu-berlin.de

Do You realize , that this world is totally FUGAZI, where are the poets,
where are the visionaries ...  (FISH)



From firewalls-owner  Thu Jan  8 07:05:16 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id VAA05722; Wed, 7 Jan 1998 21:06:44 -0800 (PST)
Received: from starbase.tos.net (starbase.tos.net [208.137.47.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id SAA00241 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 18:36:38 -0800 (PST)
Received: (from mail@localhost)
          by starbase.tos.net (8.8.4/8.8.4)
	  id UAA10441; Wed, 7 Jan 1998 20:37:31 -0600
Received: from macgyver-1.pr.mcs.net(205.253.24.113) by starbase.tos.net via smap (V1.3)
	id sma010438; Wed Jan  7 20:37:06 1998
Message-Id: <Version.32.19980107203027.0134bbc0@smtp.tos.net>
X-Sender: macgyver@smtp.tos.net
X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0
Date: Wed, 07 Jan 1998 20:33:28 -0600
To: "Paquette, Trevor" <TrevorPaquette@mcc.net>,
        "'Feroz Khan - VCS'" <Feroz.Khan@VECTOR.CO.ZA>
From: MacGyver <macgyver@tos.net>
Subject: RE: FW-1 3.0 and Solaris 2.6 ok?
Cc: firewalls@GreatCircle.COM, RWaegner@hou.mdc.com, grat@frii.com
In-Reply-To: <C925EB174777D111BAA50060083DB80E023C64@A01EX001.mcc.net>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

-----BEGIN PGP SIGNED MESSAGE-----

At 02:35 PM 1/7/98 -0700, Paquette, Trevor wrote:
>Huh?? Are you then saying that Firewall-1 3.0b cannot be installed on a
>Solaris 2.6 system out of the box? One must install Solaris 2.5.1, THEN
>install Firewall-1 3.0b, THEN upgrade to Solaris 2.6??
>
>That smells very fishy to me. Have you confirmed this with Sun? 
>

That's not been my experience at all.  We've installed over two dozen FW1
installations recently on Solaris 2.6, with FW1 3.0b.  The only cavaet is
to make sure you do *NOT* attempt to install FW1 "out of the box" download
the "patched" version that Sun distributes as a patch (it's really a whole
new set of binaries).  Once you do that, you're in good shape.

The only Solaris 2.6 issue that came back to bite me is that Sun hasn't yet
released 2.6 drivers for it's SBus Quad-Ethernet cards -- who'd have
figured they'd release an OS without at least drivers for some standard and
semi-standard peripherals.


- --
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        ^               Habeeb J. Dihu
     -'   `-            Managing Senior Technologist
   " '     ` "          Cirrus Technologies
 "  '       `  "        
"  '      .  `  "                  
"  '    .' ` `  "       'I don't believe in the no-win scenario'
 " `   '    `' "           -- Captain James T. Kirk,  Star Trek II: TWK
   `  ' _  _ '          'There is an old Vulcan proverb, `Only Nixon 
    '                    could go to China.`'
                           -- Captain Spock, Star Trek VI: TUC
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-----BEGIN PGP SIGNATURE-----
Version: PGP for Business Security 5.5.2

iQCVAwUBNLQ6+FTtNfTWxXdNAQGmuwP/Rq1/YrKq8T5fPDnrwnkIvdnu9kOwPL1v
gMm33RXtOv0nHyyhiuHd2WdaCkwf0Gmcpcw6xW53MlvmXllMHx4rbsU3Eiv/oIrX
JzAs4U8GFg/afymQEi3mu9EOMSr3aztdHUryZS8rp+L2lAEv/mknacmEX4x0GOYf
wVYLXWbyN+s=
=MBO7
-----END PGP SIGNATURE-----


From firewalls-owner  Thu Jan  8 07:05:12 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id KAA26457; Wed, 7 Jan 1998 10:50:35 -0800 (PST)
Received: from firewall1-int.glaxowellcome.com (firewall1.glaxowellcome.com [192.58.204.204]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id KAA26432 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 10:50:23 -0800 (PST)
Received: by firewall1-int.glaxowellcome.com id OAA23460; Wed, 7 Jan 1998 14:00:42 -0500 (EST)
Received: from ussun2m.glaxo.com(152.51.20.99) by firewall1.glaxo.com via smap (3.2)
	id xma023444; Wed, 7 Jan 98 14:00:28 -0500
Received: by ussun2m.glaxo.com id NAA19678; Wed, 7 Jan 1998 13:48:21 -0500 (EST)
Received: by us1n36.glaxo.com with Internet Mail Service (5.0.1458.49)
	id <CL91X1X8>; Wed, 7 Jan 1998 13:50:38 -0500
Message-ID: <EDD7839F2926D1119E200080D870054638AF75@us2n24.glaxo.com>
From: "Hull, Gary G" <ggh14854@glaxowellcome.com>
To: "'firewalls@GreatCircle.COM'" <firewalls@GreatCircle.COM>
Subject: RE: E-Mail Encryption
Date: Wed, 7 Jan 1998 13:50:28 -0500
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1458.49)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Can anyone tell me how the Secret Agent product of AT&T compares to that
of WorldTalks Secure Messenger?
Gary G. Hull
Senior Manager - Systems Security
Tel : (919) 483-2921 - Fax : (919)  483-0208
email: ggh14854@glaxowellcome.com 


> ----------
> From: 	G2 Security Division[SMTP:AFZJ-I-S@IRWIN.ARMY.MIL]
> Sent: 	Wednesday, January 07, 1998 12:08 PM
> To: 	'firewalls@GreatCircle.COM'
> Subject: 	Re:  E-Mail Encryption
> 
> On Tue, 6 Jan 1998, Grigorof, Adrian wrote:
> > I am looking for a product to be used in encrypting e-mail to be
> sent
> over the Internet.
> 
> Have you looked at AT&T's Secret Agent?  It is a digital signature and
> 
> encryption utility.  It runs National Institut of Standards and
> Technology 
> (NIST) DES, NIST Digital Signature Standard, NIST Secure Hash
> Standards 
> (See FIPS 180-1), Diffie-Hellman, RSA, and Triple DES.  It interfaces
> with 
> PCMCIA cards for message authentication and I believe hardware
> encryption 
> via e.g., FORTEZZA.  Their reps at the National Information Systems 
> Security Conference indicated that planned version upgrades would
> allow one 
> to set up a macro on MS WORD so a user could run the encryption from a
> GUI 
> button.
> 
> Try http://www.att.com/bcs/secure_software
> 
> Wolfgang at (760) 380-3379
> 

From firewalls-owner  Thu Jan  8 07:05:18 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA08109; Wed, 7 Jan 1998 09:31:19 -0800 (PST)
Received: from gte.com (h132-197-8-26.gte.com [132.197.8.26]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA08077 for <Firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 09:31:11 -0800 (PST)
Received: from [132.197.71.1] by gte.com (8.8.4/8.8.4)
X-Sender: rhb1@pophost.gte.com
Message-Id: <v02130503b0d969bb1696@[132.197.71.1]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Wed, 7 Jan 1998 13:44:16 -0400
To: rmckosky@gte.com, enorris@gte.com, djuitt@gte.com, ccarroll@gte.com,
        Jyri Kaljundi <jk@stallion.ee>, Firewalls@GreatCircle.COM,
        rhb1@gte.com
From: rhb1@gte.com (Bob Bryant)
Subject: ctia hotel confirmations
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I have confirmed with the Salt Lake City Hilton that the following hotel
reservations have been made.
name                    dates                   confirmation  #
R stanley               13-16                   832781
C Carroll               13-16                   832780
R McKosky          12-16                   832816
Djuitt                     13-16                   831992
R Bryant                12-16                   832815
E Norris                  12-16                  831991
I did this so we would not get the "Mary and Joseph" responce in the lobby.

*******************************************************************************
Robert Bryant                           email           rhb1@gte.com
Member Technical Staff                  Fax             617-466-2838
Secure Systems Department
GTE Labrotories                         office ph       617-466-2821
40 Sylvan Rd    MS/55                   Cell ph         617-733-7757
Waltham, MA 02254
****************************************************************************
***



From firewalls-owner  Thu Jan  8 07:07:49 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id NAA21969; Wed, 7 Jan 1998 13:05:21 -0800 (PST)
Received: from m6.sprynet.com (m6.sprynet.com [165.121.2.89]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id NAA21961 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 13:05:14 -0800 (PST)
Received: from zepher (hdn90-069.hil.compuserve.com [206.175.99.69]) by m6.sprynet.com (8.6.12/8.6.12) with SMTP id NAA03004; Wed, 7 Jan 1998 13:05:27 -0800
Message-Id: <3.0.3.32.19980107160808.006a33b4@m6.sprynet.com>
X-Sender: jsk347@m6.sprynet.com
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Wed, 07 Jan 1998 16:08:08 -0500
To: Peter da Silva <peter@baileynm.com>, macgyver@tos.net (MacGyver)
From: Steve Kruse <jsk347@sprynet.com>
Subject: Re: E-mail Encryption
Cc: firewalls@GreatCircle.COM
In-Reply-To: <9801071536.AA10534@baileynm.com>
References: <199801070018.SAA31044@starbase.tos.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I think it might have been mentioned on here, but there is a $5.00
"up-downgrade" that lets you use the RSA which IS compatabile with PGP 2.x.
 Check the PGP website for info.  

Steve Kruse

At 09:36 AM 1/7/98 -0600, Peter da Silva wrote:
>> Using Eudora 4.0 onward (I'm not sure if previous versions support this
>> feature), you have the ability to set an "output filter", which can be set
>> to call any arbitrary program.  PGP 5.0+ has a Eudora plugin option that
>> you can use to automagically guarantee that all emails sent out are
>> encrypted in an invisible way to the user.
>
>Unfortunately PGP 5.0+ encryption is incompatible with PGP 2.6, which is
>what most of the people who use PGP are using. I understand the political
>reasons for switching to D-H key exchange to get out from under RSA, but
>I'm going to stick with 2.6 until there's a really compatible upgrade path
>that works on both protocols and all platforms.
>

From firewalls-owner  Thu Jan  8 07:07:53 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id NAA26945; Wed, 7 Jan 1998 13:36:01 -0800 (PST)
Received: from gate4.mcc.net (gate4.mcc.net [207.245.25.250]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id NAA26785 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 13:35:12 -0800 (PST)
Received: from [10.1.1.25] ([10.1.1.25] EHLO a01ex001.mcc.net ident: SOCKFAULT1 [port 1731]) by gate.mcc.net with ESMTP id <421805-13943>; Wed, 7 Jan 1998 14:35:31 -0700
Received: by A01EX001.mcc.net with Internet Mail Service (5.0.1458.49)
	id <CFL02107>; Wed, 7 Jan 1998 14:35:34 -0700
Message-ID: <C925EB174777D111BAA50060083DB80E023C64@A01EX001.mcc.net>
From: "Paquette, Trevor" <TrevorPaquette@mcc.net>
To: "'Feroz Khan - VCS'" <Feroz.Khan@VECTOR.CO.ZA>
Cc: firewalls@GreatCircle.COM, RWaegner@hou.mdc.com, grat@frii.com
Subject: RE: FW-1 3.0 and Solaris 2.6 ok?
Date: 	Wed, 7 Jan 1998 14:35:31 -0700
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1458.49)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Huh?? Are you then saying that Firewall-1 3.0b cannot be installed on a
Solaris 2.6 system out of the box? One must install Solaris 2.5.1, THEN
install Firewall-1 3.0b, THEN upgrade to Solaris 2.6??

That smells very fishy to me. Have you confirmed this with Sun? 

> -----Original Message-----
> From:	Feroz Khan - VCS [SMTP:Feroz.Khan@VECTOR.CO.ZA]
> Sent:	Wednesday, January 07, 1998 3:58 AM
> To:	RWaegner@hou.mdc.com; grat@frii.com
> Cc:	firewalls@GreatCircle.COM
> Subject:	Re: FW-1 3.0 and Solaris 2.6 ok?
> 
> Hi,
> 
> There seems to be some confusion with regards to Solaris 2.6 and FW-1.
> Here
> is what I have tested:
> 
> Checkpoint: Works with 3.0b or greater.
> 
> Solstice:  Must be installed on 2.5.1 first. One of the following
> patches
>            must then be installed:
>              Non-VPN - 105477
>              VPN-FWZ - 105478
>              VPN-DES - 105474
>            At this point, you can do an OS upgrade to Solaris 2.6.
>            
> Hope this helps,
> Feroz
>            

From firewalls-owner  Thu Jan  8 07:07:56 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA04769; Wed, 7 Jan 1998 09:17:30 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA04509 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 09:16:39 -0800 (PST)
Received: from inergen.sybase.com by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-970426)
	id JAA01526; Wed, 7 Jan 1998 09:09:47 -0800 (PST)
Received: from smtp1.sybase.com (sybgate.sybase.com [130.214.220.35])
          by inergen.sybase.com (8.8.4/8.8.4) with SMTP
	  id JAA27822; Wed, 7 Jan 1998 09:11:52 -0800 (PST)
Received: from  by smtp1.sybase.com (4.1/SMI-4.1/SybH3.5-030896)
	id AB20240; Wed, 7 Jan 98 09:13:06 PST
Received: by gwwest.sybase.com(Lotus SMTP MTA v1.1 (385.6 5-6-1997))  id 88256585.0067673A ; Wed, 7 Jan 1998 09:14:17 -0800
X-Lotus-Fromdomain: SYBASENOTES
From: "Ryan Russell"<ryanr@sybase.com>
To: LOWPC@binariang.maxisnet.com.my
Cc: glasane@gdsconnect.com, firewalls@GreatCircle.COM, macgyver@tos.net
Message-Id: <88256585.005D9269.00@gwwest.sybase.com>
Date: Wed, 7 Jan 1998 09:08:30 -0800
Subject: Re: RE: Stateful Inspection Anyone? Explore your options.
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


I'm implying that 's a small possibility, at least as far as
my experience goes.  The possibility of state table corruption
has been discussed as a potential problem, but since I've
been on the list, no one has mentioned that they've seen it happen.

Whatever the chances are aside, I believe that the same problem
would exist for the TCP connection tables that the OS maintains that
proxies rely on.  The code and data structures would be very similar
between the two (though, this is a guess on my part.. I haven't actually
written a SPF firewall or a TCP stack for an OS.)

The problem of corrupt memory would likely affect any security software
in adverse ways.  I don't know of any (with the possible exception of
virus scanners) that do any self-integritity checking.

I mostly took exception because the guy making the statement appeared
to be doing so in order to make a sales pitch.

                              Ryan






>>> "Ryan Russell" <ryanr@sybase.com> 01/07 1:49 PM >>>

One of the biggest complaints about proxies is that
if the TCP connection table becomes corrupt, the network
could become vulnerable to the outside.

Quit spreading FUD.

 -Are you implying that this is only a very small possibility
-or none at all?

-ciao!

----- he who knows not, --------------------
------and knows not he knows not, ----
------he's probably a salesman--------














                !
!



From firewalls-owner  Thu Jan  8 07:09:16 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id OAA05940; Wed, 7 Jan 1998 14:15:49 -0800 (PST)
Received: from merlot.im1ru12.org (iq-ind-dns000-net-67.iquest.net [209.43.13.67]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id OAA05820 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 14:15:24 -0800 (PST)
Received: (qmail 20523 invoked by uid 512); 7 Jan 1998 22:07:01 -0000
Date: Wed, 7 Jan 1998 17:07:01 -0500 (EST)
From: "Chad O'leary" <chad@rumor.net>
X-Sender: chad@merlot.im1ru12.org
To: Andre van der Lans <andre.van.der.lans@inet.unisource.nl>
cc: Randall Kizer <rkizer@guten.sddpc.org>, firewalls@GreatCircle.COM
Subject: Re: Firewall for ISP
In-Reply-To: <34B3399E.FC1D7A47@inet.unisource.nl>
Message-ID: <Pine.LNX.3.96.980107160345.18590E-100000@merlot.im1ru12.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I hope this starts some PIX discussion, it's not meant to be total
flame mail. 

On Wed, 7 Jan 1998, Andre van der Lans wrote:

> Randall Kizer wrote:
> > 
> > Jaime,
> > 
> > We've just implemented a PIX firewall to evaluate it.  Would you, or anyone
> > else reading this e-mail, please share your experiences with this product.
> > You mentioned "it has some weakness", can you be more specific?  What are
> > some of its strengths?
> > 
> > Randall
> > rkizer@sddpc.org
> > 
> > >From: "Jaime Blanco" <support@sinfo.net>
> > >To: <firewalls@greatcircle.com>
> > >Cc: <inet-access@earth.com>
> > >Subject: Firewall for ISP
> > >Date: Wed, 17 Dec 1997 20:38:06 -0500
> Beunos dias,
> 
> The Cisco PIX isn't realy a firewall.

Insert flame here...

> It's a cut through proxy which

It's a stateful packet filter, NOT a proxy.

> means that when a packet is checked for authentication, the PIX simply
> gona forward all these packages and none of the following packages are
> beeing screened.

Ummmm. Each packet header is inspected. The payload can be inspected.
i.e. SMTP data which would normally make sendmail puke is denied. If you
want to block java, just enable it. That's a little more than "a packet is
checked." 

> It's difficult to get the logging done

It's on by default! Type show syslog.

> and the ligging
> is alsow done with syslog on a remote machine

CAN be done. You don't have to. I personally like it that way.

> ( The PIX hasn't got a
> hard disk).

One less thing to break! 

> Another issue is that the GUI quits working when the
> configurationfile has more than 400 entries.

OK, you have a point. Sounds like a bug. Report it to Cisco if you want.
I looked at the "GUI" (web based) after it had been here for a while. It
was functional. But command line is much faster and more intuitive for
*me*. Others may care, do your part and report the bug.

> Last but not least, the Cisco PIX is a expensive product and for the
> same prise or less you can get a much better Firewall.

Do your homework. The solution depends on the environment and the
application.
 
> 
> -- 
> Andre van der Lans
> Unisource Business Networks Netherlands bv
> Koningin Sophie St 120, 2595 TM The Hague
> Tel +31 703711069, Fax +31 703712638
> Email: andre.van.der.lans@inet.unisource.nl
> 

--Chad


From firewalls-owner  Thu Jan  8 07:49:26 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA21330; Thu, 8 Jan 1998 06:45:34 -0800 (PST)
Received: from filer2.isc.rit.edu (filer2.isc.rit.edu [129.21.3.107]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id GAA16503 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 06:22:27 -0800 (PST)
Received: from grace.isc.rit.edu by osfmail.isc.rit.edu (PMDF V5.1-10 #21576)
 with ESMTP id <0EMG00J6SYMIRC@osfmail.isc.rit.edu> for
 firewalls@GreatCircle.COM; Thu,  8 Jan 1998 09:23:06 -0500 (EST)
Received: from localhost (jlt8903@localhost) by grace.isc.rit.edu (8.8.5/8.8.5)
 with SMTP id JAA24077 for <firewalls@GreatCircle.COM>; Thu,
 08 Jan 1998 09:23:06 -0500 (EST)
Date: Thu, 08 Jan 1998 09:23:05 -0500 (EST)
From: Jason Terwilliger <jlt8903@osfmail.isc.rit.edu>
Subject: Re: Wannabe needs a good book
In-reply-to: <Pine.BSF.3.91.980106083703.23952C-100000@mcfeely.bsfs.org>
X-Sender: jlt8903@grace.isc.rit.edu
To: firewalls@GreatCircle.COM
Message-id: <Pine.OSF.3.95.980108091752.11743D-100000@grace.isc.rit.edu>
MIME-version: 1.0
Content-type: TEXT/PLAIN; charset=US-ASCII
X-Authentication-warning: grace.isc.rit.edu: jlt8903 owned process doing -bs
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


> Wombat's Newbie Reading List:
> 
> Internetworking with TCP/IP
> Volume 1
> Douglas Comer
> Prentice Hall
> ISBN 0-13-468505-9
> 
> (Comer also has a general networking book out, but I loaned it to a 
> newbie at the office - it is a better place to start for the novice than 
> the above)

I believe the general networking book by D. Comer you refer to is

"Computer Networks and Internets"
Prentice Hall
ISBN 0-13-239070-1

It's a pretty good book for the beginner (we used it for our first couple
courses in networking). The price (general retail) is US$66

Hope this is what you were talking about.

~Jason


From firewalls-owner  Thu Jan  8 10:01:13 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA26948; Thu, 8 Jan 1998 09:39:24 -0800 (PST)
Received: from redcross.dk (ns.redcross.dk [147.29.204.52]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA26903 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 09:39:14 -0800 (PST)
Received: from [192.168.51.1] by redcross.dk with ESMTP (Eudora Internet Mail
 Server 2.0); Thu, 8 Jan 1998 18:50:01 +0100
X-Sender: lars-bertelsen@mail.redcross.dk
Message-Id: <v03130303b0dacfa09fb9@[192.168.51.1]>
In-Reply-To: <199801080543.NAA05952@imsp015.netvigator.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
X-Mailer: Eudora 2.0.1
X-Charset: US-DK
X-Char-Esc: 29
To: firewalls@GreatCircle.COM
From: Lars Bertelsen <lbe@login.dknet.dk>
Subject: Re: Proxy Servers on DMZ??
Date: Thu, 8 Jan 1998 18:50:02 +0100
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

In your message you write:

>Hi,
>
>Does anybody tell me whether the proxy servers (eg WEB, email) be placed
>at DMZ segment
>instead of at internal segment so as to protect the internal network?
>
>Jim

The proxies would be on a machine in the dmz. This way, if someone invades
your proxy server they still have the very conservatively configured
internal router to contend with.
It is essential in this scheme that the internal router  is configured on
the basis that the proxy server is considered "hostile", meaning that it
should have very limited access to your internal network.

Lars Bertelsen
Gartnervang 29         tlf. 4635 1115
4000 Roskilde, DK      e-mail of choice: lbe@login.dknet.dk



From firewalls-owner  Thu Jan  8 10:16:47 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id KAA01396; Thu, 8 Jan 1998 10:01:24 -0800 (PST)
Received: from starbase.tos.net (starbase.tos.net [208.137.47.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id KAA01331 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 10:01:03 -0800 (PST)
Received: (from mail@localhost)
          by starbase.tos.net (8.8.4/8.8.4)
	  id MAA17853; Thu, 8 Jan 1998 12:01:25 -0600
Received: from gatekeeper1.bakernet.com(208.193.53.2) by starbase.tos.net via smap (V1.3)
	id sma017837; Thu Jan  8 12:01:02 1998
Message-Id: <Version.32.19980108115241.00dffef0@smtp.tos.net>
X-Sender: macgyver@smtp.tos.net
X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0
Date: Thu, 08 Jan 1998 11:57:14 -0600
To: "Waegner.Rick" <RWaegner@hou.mdc.com>,
        "Paquette, Trevor" <TrevorPaquette@mcc.net>,
        "'Feroz Khan - VCS'" <Feroz.Khan@VECTOR.CO.ZA>
From: MacGyver <macgyver@tos.net>
Subject: RE: FW-1 3.0 and Solaris 2.6 ok?
Cc: firewalls@GreatCircle.COM, grat@frii.com
In-Reply-To: <CE0690979441D111B55D0000F840E2B9081735@MAILSERVER1.MDC.COM
 >
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

-----BEGIN PGP SIGNED MESSAGE-----

At 08:03 AM 1/8/98 -0600, Waegner.Rick wrote:
>Habeeb,
>
>	You are correct about FW-1 3.0b and Solaris 2.6 working fine.
>But, the original question was FW-1 3.0 and Solaris 2.6. BTW FW-1 3.0 is
>what you get from Sun, Checkpoint is already shipping FW-1 3.0b as well
>are their VAR's (except Sun!!)
>
>Rick Waegner

My apologies...it was late, and I wasn't clear. :)  What Sun sends you is
the 3.0 version, what they call the "patch" to fix it is really the 3.0b
version which you download. :)


- --
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        ^               Habeeb J. Dihu
     -'   `-            Managing Senior Technologist
   " '     ` "          Cirrus Technologies
 "  '       `  "        
"  '      .  `  "                  
"  '    .' ` `  "       'I don't believe in the no-win scenario'
 " `   '    `' "           -- Captain James T. Kirk,  Star Trek II: TWK
   `  ' _  _ '          'There is an old Vulcan proverb, `Only Nixon 
    '                    could go to China.`'
                           -- Captain Spock, Star Trek VI: TUC
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-----BEGIN PGP SIGNATURE-----
Version: PGP for Business Security 5.5.2

iQCVAwUBNLUTeVTtNfTWxXdNAQEXqwP/ScrtZOY8jNl0lKE9QDyGuIkLQ0gPd6He
NQbXMvi9Q5nZhO+eCuzD3oUWxaX/UC74ja4jHXTv2ieODCalDkhNPomFmN/J05e8
mLqBOd1AqMiEnOG4vJvt/rhemnErtNw18FnWLKjVOam4cEKHJUNZEY6ZpbTH8ffJ
q7Oud4JNEj4=
=lPrB
-----END PGP SIGNATURE-----


From firewalls-owner  Thu Jan  8 10:24:47 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA11981; Thu, 8 Jan 1998 08:29:54 -0800 (PST)
Received: from Zool.AirTouch.COM (zool.airtouch.com [151.144.254.21]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id IAA11812 for <firewalls@greatcircle.com>; Thu, 8 Jan 1998 08:29:19 -0800 (PST)
From: Mike.Skala@zool.AirTouch.COM
Received: from notes.airtouch.com by Zool.AirTouch.COM (SMI-8.6/SMI-SVR4)
	id IAA20789; Thu, 8 Jan 1998 08:29:41 -0800
Received: by notes.airtouch.com(Lotus SMTP MTA v1.1 (385.6 5-6-1997))  id 88256586.005AAD9A ; Thu, 8 Jan 1998 08:30:26 -0800
X-Lotus-FromDomain: AIRTOUCH
To: TB186459@shellus.com, firewalls@greatcircle.com
Message-ID: <88256586.005964B9.00@notes.airtouch.com>
Date: Thu, 8 Jan 1998 08:33:25 -0800
Subject: Re: relative strengths of different encyrption techniques
Mime-Version: 1.0
Content-type: text/plain; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk






Mike Skala@AIRTOUCH
01/08/98 08:33 AM

To start:

A 56-bit key can be broken on average in 2(superscript: 55) = 3.6 x 10
(superscript: 16) trials or

Trials/Second       Time Required
1                   10(superscript: 9) years
10(superscript: 3)                 10(superscript: 6) years
10(superscript: 6)                 10(superscript: 3) years
10(superscript: 9)                 1 year
10(superscript: 12)                10 hours

Also, in amount of time needed to mount a $1 million hardware brute-force
attack:

Year 56-bit         112-bit        128-bit

1995 3 years        10(superscript: 17) years      10(superscript: 22)
years
2000 115 days  10(superscript: 16) years      10(superscript: 21) years
2010 1.5 days  10(superscript: 14) years      10(superscript: 19) years
2020 21 minutes     10(superscript: 12) years      10(superscript: 17 )
years
2030 13 seconds     10(superscript: 10) years      10(superscript: 15)
years

Note:     DES = 56-bit key
     Triple DES = equivalent to 112-bit key
     IDEA (Int'l Data Encryption Algorithm = 128-bit key

I hope the superscripting came through for the numbers above.

Source:  Schneier, Bruce, "E-Mail Security: How to Keep Your Electronic
Messages Private" via Dr. Howard Podell's seminar on "Enterprise Security:
WWW, Internet, and Intranet Security Issues for Effective Systems
Development."






TB186459@shellus.com on 01/07/98 02:46:31 PM


To:   firewalls@greatcircle.com
cc:    (bcc: Mike Skala/Corporate/AirTouch)
Subject:  relative strengths of different encyrption techniques





I'm not a crpytologist but...
I've been asked to estimate the time it takes to crack various
encyrption
techniques...
Yes...  I understand the more bits, the better...

I understand that most reasonable people will deploy the best technique
available...  and so will we.    That, however, doesn't alleviate me
from
trying to estimate how many days/months/years/light_years of compute
cycles it will take for someone to crack the technique we select.

Are there any references on the relative strengths of different
encyrption
techniques...

Any help would be appreciated...


T. Bowers




Tom Bowers
Network Engineering
Shell Services Company
PHONE:  (1)  713-245-1269
FAX:  (1) 713-245-1010
E-MAIL: tbowers@shellus.com






From firewalls-owner  Thu Jan  8 12:01:58 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA22653; Thu, 8 Jan 1998 09:20:12 -0800 (PST)
Received: from citel.upc.es (citel.upc.es [147.83.36.47]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA21695 for <firewalls@greatcircle.com>; Thu, 8 Jan 1998 09:15:50 -0800 (PST)
Received: from alu-etsetb.upc.es (jolibus.upc.es [147.83.36.68])
	by citel.upc.es (8.8.8/8.8.5) with ESMTP id SAA29033
	for <firewalls@greatcircle.com>; Thu, 8 Jan 1998 18:14:36 GMT
Message-ID: <34B509E4.D64A08FD@alu-etsetb.upc.es>
Date: Thu, 08 Jan 1998 18:16:20 +0100
From: Francesc Guasch <frankie@alu-etsetb.upc.es>
X-Mailer: Mozilla 4.04 [en] (X11; I; Linux 2.0.32 i586)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: Re: Proxy Servers on DMZ??
References: <199801080543.NAA05952@imsp015.netvigator.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

MS wrote:
> 
> Hi,
> 
> Does anybody tell me whether the proxy servers (eg WEB, email) be placed
> at DMZ segment
> instead of at internal segment so as to protect the internal network?
> 
imho the proxy server weakens the box and the network so being
in the dmz protects your internal network from attaks produced
there.

-- 
 ^-^.-----.             mailto:frankie@citel.upc.es
 o o       )            http://citel.upc.es/~frankie
  Y (_ (___(ssss

From firewalls-owner  Thu Jan  8 12:03:45 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA18027; Thu, 8 Jan 1998 08:54:30 -0800 (PST)
Received: from mailme.wirehub.nl (ns2.wirehub.net [194.165.94.5]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id IAA17877 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 08:53:59 -0800 (PST)
Received: from NLPC067.UTRECHT ([195.118.0.19])
	by mailme.wirehub.nl (8.8.7/8.8.7) with ESMTP id RAA22502
	for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 17:54:24 +0100 (CET)
Message-Id: <199801081654.RAA22502@mailme.wirehub.nl>
From: "Johan Teekens" <calculus@pi.net>
To: <firewalls@GreatCircle.COM>
Subject: IBM firewall
Date: Thu, 8 Jan 1998 17:55:12 +0100
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1155
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Next week an RS6000, model 43p, with AIX, is going to be delivered to me,
on wich I have to install the IBM firewall, this is not exactly what I
wanted, I wanted Raptor or Linux, but for political reasons we have to buy
the IBM firewall.
Has anyone any experience with it, what are the advantages? How stable is
it? Where are it's holes?

It's not that I don' t trust it or anything, but this software is quite new
for me, and the art of automation this to decrease the risk of anything
going wrong, I can't estimate that risk at the moment.

Can anyone tell me what is going to happen to me?

From firewalls-owner  Thu Jan  8 12:05:13 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA21799; Thu, 8 Jan 1998 11:24:36 -0800 (PST)
Received: from ns1.content.net (ns1.content.net [198.87.147.254]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id KAA06887 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 10:28:08 -0800 (PST)
Received: from localhost (richard@localhost)
	by ns1.content.net (8.8.4/8.8.6) with SMTP id NAA17770;
	Thu, 8 Jan 1998 13:27:10 -0500 (EST)
Date: Thu, 8 Jan 1998 13:27:09 -0500 (EST)
From: Richard Stiennon <richard@stiennon.com>
X-Sender: richard@ns1.content.net
To: "Caldwell, Matt" <caldwm@xgate.columbiasc.ncr.com>
cc: "'firewalls@GreatCircle.COM'" <firewalls@GreatCircle.COM>,
        beberg@distributed.net
Subject: RE: relative strengths of different encryption techniques
In-Reply-To: <c=US%a=_%p=NCR%l=ENGPO-980108135314Z-25613@exchsmtp.ColumbiaSC.NCR.COM>
Message-ID: <Pine.GSO.3.95.980108130638.5859J-100000@ns1.content.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



On Thu, 8 Jan 1998, Caldwell, Matt wrote:

> I suggest you get "Applied Cryptography" from Amazon or Such, it has a
> reference section that has a chart to show the time relative to the
> processor speed etc. 
> 

*PLEASE* use this URL to purchase Applied Cryptography by Bruce Schneier

http://www.amazon.com/exec/obidos/ISBN=0471117099/distributednetA/

You will be helping to fund the RC5-64 key cracking effort at
www.distributed.net

A most worthy cause :-)
If you are not already participating it is easy to grab the client and
become part of the biggest computer in history.

-Richard Stiennon


From firewalls-owner  Thu Jan  8 12:09:34 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA27799; Thu, 8 Jan 1998 11:58:09 -0800 (PST)
Received: from ihgw1.lucent.com (ihgw1.lucent.com [207.19.48.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id LAA27786 for <Firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 11:58:03 -0800 (PST)
To: "Firewalls@GreatCircle.COM" <Firewalls@GreatCircle.COM>,
        Pablo Martinez <pablo@lucent.com>
Received: from mtgbcs.mt.lucent.com by ihig1.firewall.lucent.com (SMI-8.6/EMS-L sol2)
	id OAA21524; Thu, 8 Jan 1998 14:18:28 -0600
Received: from lucent.com by  mtgbcs.mt.lucent.com (SMI-8.6/EMS-1.3.1 sol2)
	id PAA18799; Thu, 8 Jan 1998 15:00:18 -0500
Message-ID: <34B532C5.A16CA63E@lucent.com>
Date: Thu, 08 Jan 1998 15:10:45 -0500
From: Pablo Martinez <pablo@lucent.com>
Organization: Lucent Technologies
X-Mailer: Mozilla 4.04 [en] (WinNT; U)
MIME-Version: 1.0
Original-To: "Firewalls@GreatCircle.COM" <Firewalls@GreatCircle.COM>,
        Pablo Martinez <pablo@lucent.com>
Subject: Diferrence between Circuit-level Gateway and a generic application proxy
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I have a question for you guys.  What is the key difference between 
a generic application proxy running in an application gateway firewall 
and a circuit-level gateway?  I know that the circuit gateway 
is a proxy that runs at the transport layer while the application 
proxy runs at the application layer.  However,  the part that 
confuses me a little is that it is "generic."  Are these generic 
proxies just "forwarding" a specified protocol to a specified port 
on an specified separate server for further procesing (similar 
to Raptor's Generic Service Passer)? 


-- 
Pablo Martinez				101 Crawfords Corner Rd	
Internet Communications Business 	Holmdel, NJ 07733-3030
Lucent Technologies			732 817-2731
pablo@lucent.com			732 817-4504 FAX

From firewalls-owner  Thu Jan  8 12:11:57 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA21696; Thu, 8 Jan 1998 09:15:51 -0800 (PST)
Received: from enteract.com (enteract.com [206.54.252.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA21079 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 09:12:17 -0800 (PST)
Received: from jimst.alephconsult.com (jimst.sa.enteract.com [207.229.133.64]) by enteract.com (8.8.8/8.7.6) with SMTP id LAA11899; Thu, 8 Jan 1998 11:12:39 -0600 (CST)
Received: by localhost with Microsoft MAPI; Thu, 8 Jan 1998 11:12:35 -0600
Message-ID: <01BD1C26.526493A0.jimst@enteract.com>
From: James Strompolis <jimst@enteract.com>
Reply-To: "jimst@enteract.com" <jimst@enteract.com>
To: "'Kerry Jones'" <kjones@aims.gov.au>,
        "firewalls@GreatCircle.COM"
	 <firewalls@GreatCircle.COM>
Subject: RE: DNS on firewall??
Date: Thu, 8 Jan 1998 11:08:11 -0600
Organization: Aleph Consultants, Inc.
X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Why not pay your ISP to be your secondary?  Takes the secondary off-site making things somewhat more reliable.

- James Strompolis
  Aleph Consultants, Inc.
  jimst@enteract.com

On Tuesday, January 06, 1998 12:02 AM, Kerry Jones [SMTP:kjones@aims.gov.au] wrote:
> Hi,
> 
> Simple question. Is it a good idea to run a DNS server on a
> Firewall?????
> 
> AUNIC require at least 2 DNS servers, so I am trying to decide where to
> configure the 2nd DNS server for our domain (Primary one is currently on
> the DMZ). Will putting the secondary DNS on the firewall create a
> security hole in the Firewall which would best be avoided????????
> Is it acceptable (secure) to put the DNS and other services (e.g.
> http/ftp) on the Firewall??
> 
> What do you think??
> What are your opinions??
> 
> I have a fairly standard setup as follows;
> 
> Internet
>     |
>  router
>     |
>  firewall - dmz (1 machine: http/ftp/dns)
>       |
>   internal network.
> 
> --
> Kerry Jones
> kjones@aims.gov.au
> 


From firewalls-owner  Thu Jan  8 13:16:17 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA06443; Thu, 8 Jan 1998 12:47:16 -0800 (PST)
Received: from new-murphey.tenet.edu (new-murphey.tenet.edu [198.213.2.103]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA06301 for <firewalls@greatcircle.com>; Thu, 8 Jan 1998 12:46:47 -0800 (PST)
Received: from newmail.tenet.edu
          (wanmaster.wichita-falls.isd.tenet.edu [207.64.60.184])
          by new-murphey.tenet.edu (Post.Office MTA v3.1.2
          release (PO203-101c) ID# 0-40960U100000L30000S0) with ESMTP
          id AAA22823 for <firewalls@greatcircle.com>;
          Thu, 8 Jan 1998 14:47:24 -0600
Message-ID: <34B53B41.4C00D331@newmail.tenet.edu>
Date: Thu, 08 Jan 1998 14:46:58 -0600
From: "ALBERT KIRCHHOFF" <albertk@tenet.edu>
Organization: Wichita Falls Independent School District
X-Mailer: Mozilla 4.03 [en] (Win95; I)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: Problems with Proxy Next in Firewall-1
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

We are a K-12 school district. Our acceptable use policy requires HTTP
users to authenticate through our firewall before allowing our users
access to the Internet. We are pointing the "Proxy Next" to a box behind

the firewall which provides filtering with SURFWATCH.

Periodically, after authenticating, the browser will say that it has
contacted the host and is waiting for a reply and finally return with
the error "Document contains no data"?



Thanks in advance,
albertk@tenet.edu


From firewalls-owner  Thu Jan  8 13:31:01 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA18796; Thu, 8 Jan 1998 08:57:49 -0800 (PST)
Received: from hq.si.net (hq.si.net [192.156.192.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id IAA18724 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 08:57:22 -0800 (PST)
Received: from hq.si.net (hq [192.156.192.10]) by hq.si.net (8.8.5/8.7.3) with SMTP id LAA00384; Thu, 8 Jan 1998 11:59:26 -0500 (EST)
Date: Thu, 8 Jan 1998 11:59:25 -0500 (EST)
From: Ming Lu <mlu@hq.si.net>
To: MacGyver <macgyver@tos.net>
cc: "Paquette, Trevor" <TrevorPaquette@mcc.net>,
        "'Feroz Khan - VCS'" <Feroz.Khan@VECTOR.CO.ZA>,
        firewalls@GreatCircle.COM, RWaegner@hou.mdc.com, grat@frii.com
Subject: RE: FW-1 3.0 and Solaris 2.6 ok?
In-Reply-To: <Version.32.19980107203027.0134bbc0@smtp.tos.net>
Message-ID: <Pine.SOL.3.91.980108115651.29893A-100000@hq.si.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Wed, 7 Jan 1998, MacGyver wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> 
> At 02:35 PM 1/7/98 -0700, Paquette, Trevor wrote:
> >Huh?? Are you then saying that Firewall-1 3.0b cannot be installed on a
> >Solaris 2.6 system out of the box? One must install Solaris 2.5.1, THEN
> >install Firewall-1 3.0b, THEN upgrade to Solaris 2.6??
> >
> >That smells very fishy to me. Have you confirmed this with Sun? 
> >
> 
> That's not been my experience at all.  We've installed over two dozen FW1
> installations recently on Solaris 2.6, with FW1 3.0b.  The only cavaet is
> to make sure you do *NOT* attempt to install FW1 "out of the box" download
> the "patched" version that Sun distributes as a patch (it's really a whole
> new set of binaries).  Once you do that, you're in good shape.
> 
> The only Solaris 2.6 issue that came back to bite me is that Sun hasn't yet
> released 2.6 drivers for it's SBus Quad-Ethernet cards -- who'd have
> figured they'd release an OS without at least drivers for some standard and
> semi-standard peripherals.
> 

Did you mean Fast quad-ethernet card (100/10) or Quad-Ethernet card (10)?

_ming

From firewalls-owner  Thu Jan  8 14:31:35 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id NAA16567; Thu, 8 Jan 1998 13:33:03 -0800 (PST)
Received: from vector.dalsemi.com (vector.DALSEMI.COM [198.3.123.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id NAA16503 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 13:32:46 -0800 (PST)
Received: from galahad.dalsemi.com (galahad.dalsemi.com [180.0.42.20]) by vector.dalsemi.com (8.7.5/8.6.5) with SMTP id PAA17168; Thu, 8 Jan 1998 15:33:11 -0600 (CST)
Received: from ssawicki.dalsemi.com (ssawicki.dalsemi.com [180.0.60.61]) by galahad.dalsemi.com (8.6.beta.10/8.3) with SMTP id PAA22417; Thu, 8 Jan 1998 15:42:40 -0600
Received: by ssawicki.dalsemi.com with Microsoft Mail
	id <01BD1C4A.BAD94240@ssawicki.dalsemi.com>; Thu, 8 Jan 1998 15:33:12 -0600
Message-ID: <01BD1C4A.BAD94240@ssawicki.dalsemi.com>
From: Scott Sawicki <ssawicki@dalsemi.com>
To: "firewalls@GreatCircle.COM" <firewalls@GreatCircle.COM>,
        "'Mike.Skala@AIRTOUCH.com'" <Mike.Skala@AIRTOUCH.com>
Subject: RE: relative strengths of different encyrption techniques
Date: Thu, 8 Jan 1998 15:33:11 -0600
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

for 1024bit public key cryptography for email and transactions see:

	http://www.dalsemi.com/News_Center/Press_Releases/1998/4q97.html
	http://www.ibutton.com/Crypto/


From firewalls-owner  Thu Jan  8 14:42:10 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA18904; Thu, 8 Jan 1998 08:59:03 -0800 (PST)
Received: from cs.tamu.edu (clavin.cs.tamu.edu [128.194.130.106]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id IAA18884 for <Firewalls@greatcircle.com>; Thu, 8 Jan 1998 08:58:50 -0800 (PST)
Received: from cs.tamu.edu (pvme43 [128.194.136.74])
	by cs.tamu.edu (8.8.8/8.8.8) with ESMTP id KAA02787
	for <Firewalls@greatcircle.com>; Thu, 8 Jan 1998 10:57:26 -0600 (CST)
Message-ID: <34B505F4.9C8D23E4@cs.tamu.edu>
Date: Thu, 08 Jan 1998 10:59:32 -0600
From: Jeff Bourne <bournej@cs.tamu.edu>
X-Mailer: Mozilla 4.03 [en] (Win95; U)
MIME-Version: 1.0
To: Firewalls@greatcircle.com
Subject: Re: ctia hotel confirmations
References: <v02130503b0d969bb1696@[132.197.71.1]>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

So what???

Bob Bryant wrote:
> 
> I have confirmed with the Salt Lake City Hilton that the following hotel
> reservations have been made.
> name                    dates                   confirmation  #
> R stanley               13-16                   832781
> C Carroll               13-16                   832780
> R McKosky          12-16                   832816
> Djuitt                     13-16                   831992
> R Bryant                12-16                   832815
> E Norris                  12-16                  831991
> I did this so we would not get the "Mary and Joseph" responce in the lobby.
> 
> *******************************************************************************
> Robert Bryant                           email           rhb1@gte.com
> Member Technical Staff                  Fax             617-466-2838
> Secure Systems Department
> GTE Labrotories                         office ph       617-466-2821
> 40 Sylvan Rd    MS/55                   Cell ph         617-733-7757
> Waltham, MA 02254
> ****************************************************************************
> ***

-- 
CPT(P) Jeff Bourne      H: (409)-268-7543
4004 Oaklawn            W: (409)-862-4871
Bryan, TX  77801        F: (409)-260-0149

From firewalls-owner  Thu Jan  8 15:32:50 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA06209; Thu, 8 Jan 1998 08:05:06 -0800 (PST)
Received: from maili.intern.Austria.EU.net (melone.austria.eu.net [193.154.142.240]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id IAA06080 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 08:04:36 -0800 (PST)
Received: from vindobona.intern.austria.eu.net (vindobona.intern.Austria.EU.net [192.168.191.165])
	by maili.intern.Austria.EU.net (8.8.6/8.8.6) with ESMTP id RAA23413;
	Thu, 8 Jan 1998 17:05:01 -0100 (GMT)
Received: (from cr@localhost) by vindobona.intern.austria.eu.net (8.7.6/8.7.3) id RAA01030; Thu, 8 Jan 1998 17:04:37 +0100
Date: Thu, 8 Jan 1998 17:04:37 +0100
Message-Id: <199801081604.RAA01030@vindobona.intern.austria.eu.net>
From: Christian Reiser <C.Reiser@Austria.EU.net>
To: chad@rumor.net
CC: andre.van.der.lans@inet.unisource.nl, rkizer@guten.sddpc.org,
        firewalls@GreatCircle.COM
In-reply-to: <Pine.LNX.3.96.980107160345.18590E-100000@merlot.im1ru12.org>
	(chad@rumor.net)
Subject: Re: Firewall for ISP
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


>> Another issue is that the GUI quits working when the
>> configurationfile has more than 400 entries.
>
>OK, you have a point. Sounds like a bug. Report it to Cisco if you want.
>I looked at the "GUI" (web based) after it had been here for a while. It
>was functional. But command line is much faster and more intuitive for
>*me*. Others may care, do your part and report the bug.

Sorry, but there is one point I don't understand. What do you need a
config-file for, that has more than 400 entries? I wouldn't understand it any
more. 

I installed 3 PIX in the last month for customers having about 50 lines each
(including all the default staff). For ordinary installations you don't need
more than that.

Here in our office I run a slightly more complicated configuration with 74
lines, but I can't imagine a configuration with more than 100 lines.

BTW, I also prefere the command line interface.

Greatings from Vienna/Austria
mfg
CR

-- 
Christian Reiser (EUnet Austria)      e-mail: C.Reiser@Austria.EU.net
Tel: +431 899 33-0                         http://www.Austria.EU.net/
Fax: +431 899 33-533        CR86-RIPE         priv: C.Reiser@ieee.org
      To get my PGP-Key send e-mail with Subject: Query PGP Key

From firewalls-owner  Thu Jan  8 15:54:03 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id KAA08565; Thu, 8 Jan 1998 10:35:11 -0800 (PST)
Received: from mail.clark.net (mail.clark.net [168.143.0.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id KAA08449 for <Firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 10:34:41 -0800 (PST)
From: phoenix@clark.net
Received: from clark.net (phoenix@explorer.clark.net [168.143.0.7])
	by mail.clark.net (8.8.8/8.8.8) with ESMTP id NAA18858;
	Thu, 8 Jan 1998 13:35:19 -0500 (EST)
Received: from localhost (phoenix@localhost) by clark.net (8.8.8/8.8.8) with SMTP id NAA29766; Thu, 8 Jan 1998 13:35:14 -0500 (EST)
X-Authentication-Warning: clark.net: phoenix owned process doing -bs
Date: Thu, 8 Jan 1998 13:35:13 -0500 (EST)
To: Bob Bryant <rhb1@gte.com>
cc: rmckosky@gte.com, enorris@gte.com, djuitt@gte.com, ccarroll@gte.com,
        Jyri Kaljundi <jk@stallion.ee>, Firewalls@GreatCircle.COM
Subject: Re: ctia hotel confirmations
In-Reply-To: <v02130503b0d969bb1696@[132.197.71.1]>
Message-ID: <Pine.GSO.3.96.980108133125.26102A-100000@clark.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

     Umm... good thing we're all friends here.  This information has
serious practical joke value.  ;)  I wonder how many cancellations The
Salt Lake City Hilton will receive...


On Wed, 7 Jan 1998, Bob Bryant wrote:

> I have confirmed with the Salt Lake City Hilton that the following hotel
> reservations have been made.
> name                    dates                   confirmation  #
> R stanley               13-16                   832781
> C Carroll               13-16                   832780
> R McKosky          12-16                   832816
> Djuitt                     13-16                   831992
> R Bryant                12-16                   832815
> E Norris                  12-16                  831991
> I did this so we would not get the "Mary and Joseph" responce in the lobby.
> 
> *******************************************************************************
> Robert Bryant                           email           rhb1@gte.com
> Member Technical Staff                  Fax             617-466-2838
> Secure Systems Department
> GTE Labrotories                         office ph       617-466-2821
> 40 Sylvan Rd    MS/55                   Cell ph         617-733-7757
> Waltham, MA 02254
> ****************************************************************************
> ***


Trees:2 Skiers:0



From firewalls-owner  Thu Jan  8 17:30:28 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA09418; Thu, 8 Jan 1998 08:18:56 -0800 (PST)
Received: from mailrelay.atsi.com ([204.209.211.162]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id IAA09322 for <firewalls@greatcircle.com>; Thu, 8 Jan 1998 08:18:33 -0800 (PST)
Received: (from styx@localhost) by mailrelay.atsi.com (8.7.5/8.6.9) id KAA28766 for <firewalls@greatcircle.com>; Thu, 8 Jan 1998 10:24:23 -0700
Received: from mailhub.atsi.com by mailrelay.atsi.com via smap (V2.0)
	id xma028760; Thu, 8 Jan 98 10:24:04 -0700
Received: from zeus.atsi.com (BRobinson@atsi.com) by atsi.com (8.8.7/8.8.7) with SMTP id JAA24819; Thu, 8 Jan 1998 09:15:59 -0700 (MST)
Received: by zeus.atsi.com (SMI-8.6/SMI-SVR4)
	id JAA06461; Thu, 8 Jan 1998 09:20:22 -0700
Date: Thu, 8 Jan 1998 09:20:22 -0700
Message-Id: <199801081620.JAA06461@zeus.atsi.com>
From: Bret Robinson <brobinso@atsi.com>
To: firewalls@greatcircle.com
Subject: SKIP question
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I have a question about SKIP that I hope someone can help me with. We are
testing a set-up that will allow employees to access our internal network
from home and also allow us to connect to partners' sites using SKIP. The
two set-ups are shown below:

   Employee access                Partner site access
  -----------------              ---------------------

      home-pc                        partner network
         |                                  |
         |                                  |
         |                                  |
         |                                  |
    SKIP firewall                     SKIP firewall
         |                                  |
         |                                  |
         |                                  |
         |                                  |
   internal host(s)                   SKIP firewall
                                            |
                                            |
                                            |
                                            |
                                      internal host(s)



Access between both the home-pc and SKIP firewall/gateway and between the
two SKIP firewall/gateways is across the local cable companies network 
(ie - Internet/untrusted network). The product(s) that we are testing is
Sun's SKIP and their EFS software that runs on the SKIP firewall. We have
also done the same test using just SKIP - without the EFS. Connecting to an
internal host from the PC (using SKIP for Win95) was working until the
cable company reconfigured their routers. We are using an "unregistered"
network address on our internal network and it turns out that packets being
sent back to the PC have a source address of the internal machine. The
routers are configured to drop any packets that *don't* have a source
address of the our DMZ. Sooo, my question is does any one know how to
configure SKIP (or EFS) so that the packets going back to the PC through
the SKIP firewall have the source address re-written with the address of
the external interface of that machine. We did get this to work using EFS,
but the PC doesn't seem to want to look inside that packet to find the
*real* IP packet. Is there something that we need to configure on the PC to
see the encrypted packet? Or is there something else missing in the config
of the SKIP firewall? Also, is the set-up we are trying to achieve with our
business partners possible just using SKIP? Its probably possible with SKIP
and EFS, but we don't want to have all our partners go out and by a new
Sparc and SKIP/EFS. We are hoping we can use Solaris x86 and SKIP for the
SKIP firewalls/gateways.

The home-pc has been configured to use encryption between itself and the
external interface of the SKIP gateway and also between itself and the
internal network using the SKIP gateway as the "tunnel".

The SKIP firewall/gateway is a Sparc Ultra running both SKIP and EFS. We
are also testing using another gateway running Solaris x86 with just
SKIP. Both are running Solaris 2.5.1.

The local Sun SE's have not been able to resolve the question yet. They
also tell me that SKIP encrypts the entire IP packet and puts it into
another packet (as the data portion) regardless of whether the packet is
going through a tunnel or not. Is this true?

Any help would be *very* appreciated.

Bret Robinson

| Bret Robinson, Snr. System Admin    \       Voice: +1-403-213-8413        |
| Applied Terravision Systems, Inc.    \        Fax: +1-403-264-2122        | 
| Calgary, Alberta     Canada           \     Web site: www.atsi.com        |
| BRobinson@atsi.com                     \                                  |
|       "Keep your stick on the ice"      \___ o  <- puck (for US viewers)  |

From firewalls-owner  Thu Jan  8 17:32:03 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA04220; Thu, 8 Jan 1998 12:36:18 -0800 (PST)
Received: from asd ([209.1.236.56]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA04178 for <firewalls@greatcircle.com>; Thu, 8 Jan 1998 12:36:05 -0800 (PST)
Received: by shared1-mail.whowhere.com id <36926-251>; Thu, 8 Jan 1998 12:36:33 -0800
To: firewalls@greatcircle.com
Date: 	Thu, 08 Jan 1998 12:36:27 -0700
From: "Simon K Ash" <simon.ash@eudoramail.com>
Message-ID: <DEPNKAAJNCMOHAAA@shared1-mail.whowhere.com>
Mime-Version: 1.0
X-Sent-Mail: on
X-Mailer: MailCity Service
Subject: Proxy server to hide IP Add.. from your Firewall
X-Sender-Ip: 203.98.17.26
Organization: Eudora Web-Mail  (http://www.eudoramail.com)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Question 1

Is it possible to use a proxy server (such a MS Proxy) inside Firewall-1, to hide
a group of IP Addresses from Firewall-1. This would allow you to buy a 100 node licence
and have it protecting 250 in reality, and greatly reduce the cost of Firewall-1.


Can anyone see any problems with this concept?



Join 18 million Eudora users by signing up for a free Eudora Web-Mail account at http://www.eudoramail.com

From firewalls-owner  Thu Jan  8 17:33:27 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA02019; Thu, 8 Jan 1998 12:22:35 -0800 (PST)
Received: from hq.si.net (hq.si.net [192.156.192.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA01945 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 12:22:17 -0800 (PST)
Received: from hq.si.net (hq [192.156.192.10]) by hq.si.net (8.8.5/8.7.3) with SMTP id PAA02713; Thu, 8 Jan 1998 15:24:22 -0500 (EST)
Date: Thu, 8 Jan 1998 15:24:22 -0500 (EST)
From: Ming Lu <mlu@hq.si.net>
To: Ryan Russell <ryanr@sybase.com>
cc: LOWPC@binariang.maxisnet.com.my, glasane@gdsconnect.com,
        firewalls@GreatCircle.COM, macgyver@tos.net
Subject: Re: RE: Stateful Inspection Anyone? Explore your options.
In-Reply-To: <88256585.005D9269.00@gwwest.sybase.com>
Message-ID: <Pine.SOL.3.91.980108152251.29893E-100000@hq.si.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Wed, 7 Jan 1998, Ryan Russell wrote:

> 
> I'm implying that 's a small possibility, at least as far as
> my experience goes.  The possibility of state table corruption
> has been discussed as a potential problem, but since I've
> been on the list, no one has mentioned that they've seen it happen.
> 
> Whatever the chances are aside, I believe that the same problem
> would exist for the TCP connection tables that the OS maintains that
> proxies rely on.  The code and data structures would be very similar
> between the two (though, this is a guess on my part.. I haven't actually
> written a SPF firewall or a TCP stack for an OS.)
> 
> The problem of corrupt memory would likely affect any security software
> in adverse ways.  I don't know of any (with the possible exception of
> virus scanners) that do any self-integritity checking.
> 
> I mostly took exception because the guy making the statement appeared
> to be doing so in order to make a sales pitch.
> 
>                               Ryan

I talked to him, he is nice guy, but also a salsman though.

_ming

From firewalls-owner  Thu Jan  8 17:34:59 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA02761; Thu, 8 Jan 1998 12:26:16 -0800 (PST)
Received: from hq.si.net (hq.si.net [192.156.192.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA02687 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 12:25:54 -0800 (PST)
Received: from hq.si.net (hq [192.156.192.10]) by hq.si.net (8.8.5/8.7.3) with SMTP id PAA02734; Thu, 8 Jan 1998 15:27:53 -0500 (EST)
Date: Thu, 8 Jan 1998 15:27:53 -0500 (EST)
From: Ming Lu <mlu@hq.si.net>
To: "Caldwell, Matt" <caldwm@xgate.columbiasc.ncr.com>
cc: "'Bowers T (Thomas) at MSXSSC'" <TB186459@shellus.com>,
        "'firewalls@GreatCircle.COM'" <firewalls@GreatCircle.COM>
Subject: RE: relative strengths of different encryption techniques
In-Reply-To: <c=US%a=_%p=NCR%l=ENGPO-980108135314Z-25613@exchsmtp.ColumbiaSC.NCR.COM>
Message-ID: <Pine.SOL.3.91.980108152653.29893F-100000@hq.si.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


It is a damm good book!

_ming

On Thu, 8 Jan 1998, Caldwell, Matt wrote:

> I suggest you get "Applied Cryptography" from Amazon or Such, it has a
> reference section that has a chart to show the time relative to the
> processor speed etc. 
> 
> Matthew F. Caldwell - Security Analyst
> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
> Visionary Corporate Computing Concepts (VC3)
> Email:        matt.caldwell@vc3.com
> Company Web: http://www.vc3.com/
> Personal  Web: http://www.vc3.com/~caldwm
> Office Phone: 803-733-7333
> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
> 
> >----------
> >From: 	Bowers T (Thomas)  at MSXSSC[SMTP:TB186459@shellus.com]
> >Sent: 	Wednesday, January 07, 1998 5:46 PM
> >To: 	'firewalls@greatcircle.com'
> >Subject: 	relative strengths of different encyrption techniques
> >
> >
> >I'm not a crpytologist but...
> >
> >I've been asked to estimate the time it takes to crack various
> >encyrption
> >techniques...
> >
> >Yes...  I understand the more bits, the better...
> >
> >
> >I understand that most reasonable people will deploy the best technique
> >available...  and so will we.    That, however, doesn't alleviate me
> >from
> >trying to estimate how many days/months/years/light_years of compute
> >cycles it will take for someone to crack the technique we select.
> >
> >
> >Are there any references on the relative strengths of different
> >encyrption
> >techniques...  
> >
> >
> >Any help would be appreciated...
> >
> >
> >
> >T. Bowers
> >
> >
> >
> >
> >
> >Tom Bowers
> >Network Engineering
> >Shell Services Company
> >PHONE:  (1)  713-245-1269
> >FAX:  (1) 713-245-1010
> >E-MAIL: tbowers@shellus.com
> >
> 

From firewalls-owner  Thu Jan  8 17:39:23 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id QAA22569; Thu, 8 Jan 1998 16:31:15 -0800 (PST)
Received: from abhiweb.com (idi-fk-gw.abhiweb.com [205.138.236.250]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id QAA22488 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 16:30:50 -0800 (PST)
Message-Id: <3.0.5.32.19980108163752.008d2360@bonn.abhiweb.com>
X-Sender: byrd@bonn.abhiweb.com
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.5 (32)
Date: Thu, 08 Jan 1998 16:37:52 -0800
To: firewalls@GreatCircle.COM
From: Bruce Byrd <byrd@internetdevices.com>
Subject: Re: NT Web proxy server
In-Reply-To: <34b1435f0.1464@clbdev2.eh.pweh.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

You might want to consider the Fort Knox Firewall Device from Internet
Devices. It's a proxy firewall (with transparent and authenticated proxy
support), web cache, URL blocker, spam email filter, and more. It's a stand
alone box and is mangaged with a web browser. 

Info, documentation, and pricing at:

http://www.InternetDevices.com

Regards,

Bruce Byrd
Internet Devices, Inc. 

At 03:32 PM 1/5/98 EST, BoB Miorelli wrote:
>Hi --
>
>I'm looking for a Web proxy server that does caching for
>my kid's school (K-8).  The computer lab is networked
>to a server which would run the proxy.  The server
>is a Pentium running NT 4.0.  I'm looking for
>recommendations on proxy server software from anyone
>that is running it on NT 4.0 using a dialup-on-demand
>type of setup.  The only proxy servers for NT that
>I am aware of are Microsoft and Netscape, but I'm
>sure there are others.
>
>Any and all comments are welcome.
>
>Thanks.
>
>-->BoB 
>
>
>-->BoB Miorelli, Pratt & Whitney
>miorelli@pweh.com
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
>In theory, theory and practice are the same; 
>in practice they are distinct.
>
>

From firewalls-owner  Thu Jan  8 18:18:21 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id QAA18354; Thu, 8 Jan 1998 16:11:25 -0800 (PST)
Received: from kanga.ichr.uwa.edu.au (kanga.ichr.uwa.edu.au [130.95.224.4]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id QAA18314 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 16:11:11 -0800 (PST)
References: TVWTICHR, Company Limited by Guarantee, ACN 009 278 755
Received: from roo (www2 [130.95.224.12])
	by kanga.ichr.uwa.edu.au (8.8.7/8.8.7) with SMTP id IAA27367
	for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 08:11:53 +0800 (WST)
Message-Id: <199801090011.IAA27367@kanga.ichr.uwa.edu.au>
Date: Fri, 9 Jan 1998 08:11:53 +0800 (WST)
From: John Gibbins <johng@ichr.uwa.edu.au>
Reply-To: John Gibbins <johng@ichr.uwa.edu.au>
Subject: Re: FW-1 3.0 and Solaris 2.6 ok?
To: firewalls@GreatCircle.COM
MIME-Version: 1.0
Content-Type: TEXT/plain; charset=us-ascii
Content-MD5: Jzn7vvF9J+ZmQL2LWqOwXA==
X-Mailer: dtmail 1.2.0 CDE Version 1.2 SunOS 5.6 sun4m sparc 
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Feroz Khan - VCS <Feroz.Khan@VECTOR.CO.ZA> said:
> 
> There seems to be some confusion with regards to Solaris 2.6 and FW-1. Here
> is what I have tested:
> 
> Checkpoint: Works with 3.0b or greater.
> 
> Solstice:  Must be installed on 2.5.1 first. One of the following patches
>            must then be installed:
>              Non-VPN - 105477
>              VPN-FWZ - 105478
>              VPN-DES - 105474
>            At this point, you can do an OS upgrade to Solaris 2.6.
>            
> Hope this helps,
> Feroz

I'm not sure what the supported position is, but I did an initial install
of Sol2.6 (no patches) and installed 3.0b directly on top.  I have had no
problems with it.  I received an updated copy of fwmod.5.x.o with 3.0b which
I copied in after installing fw1.  We don't have the encrytion option (I doubt
this makes any difference, but just in case).   

Having to install one O/S and then upgrade seems a bit messy.

I might also note that I successfully tried 3.0b on a Solaris 2.4 machine
without problems.  I am told that this is not a supported platform, so
maybe I don't push the system very hard :-)

regards
johng 
--
John Gibbins                           TVW Telethon Institute
The University of Western Australia             for Child Health Research
email:  johng@ichr.uwa.edu.au          PO Box 855                   ,-_|\
Phone:  +61-8-93408547                 WEST PERTH  W.A. 6872       /     \
Fax:    +61-8-93883414                 AUSTRALIA                   *_,-._/
A crank is a little thing that makes revolutions - Henry George         v


From firewalls-owner  Thu Jan  8 18:32:44 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id QAA20717; Thu, 8 Jan 1998 16:21:50 -0800 (PST)
Received: from spiffy.paradigmsim.com (spiffy.paradigmsim.com [206.7.114.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id QAA20675 for <Firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 16:21:38 -0800 (PST)
Received: from kennyspc.paradigmsim.com by spiffy.paradigmsim.com via SMTP (940816.SGI.8.6.9/940406.SGI.AUTO)
	 id SAA04147; Thu, 8 Jan 1998 18:12:40 -0600
Received: by kennyspc.paradigmsim.com with Microsoft Mail
	id <01BD1C62.69320360@kennyspc.paradigmsim.com>; Thu, 8 Jan 1998 18:22:43 -0600
Message-ID: <01BD1C62.69320360@kennyspc.paradigmsim.com>
From: Ken Atkinson <kenny@paradigmsim.com>
To: Bob Bryant <rhb1@gte.com>, "'phoenix@clark.net'" <phoenix@clark.net>
Cc: "rmckosky@gte.com" <rmckosky@gte.com>,
        "enorris@gte.com"
	 <enorris@gte.com>,
        "djuitt@gte.com" <djuitt@gte.com>,
        "ccarroll@gte.com" <ccarroll@gte.com>, Jyri Kaljundi <jk@stallion.ee>,
        "Firewalls@GreatCircle.COM" <Firewalls@GreatCircle.COM>
Subject: RE: ctia hotel confirmations
Date: Thu, 8 Jan 1998 18:22:42 -0600
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

what a dumbass.

----------
From: 	phoenix@clark.net[SMTP:phoenix@clark.net]
Sent: 	Thursday, January 08, 1998 7:35 AM
To: 	Bob Bryant
Cc: 	rmckosky@gte.com; enorris@gte.com; djuitt@gte.com; ccarroll@gte.com; Jyri Kaljundi; Firewalls@GreatCircle.COM
Subject: 	Re: ctia hotel confirmations

     Umm... good thing we're all friends here.  This information has
serious practical joke value.  ;)  I wonder how many cancellations The
Salt Lake City Hilton will receive...


On Wed, 7 Jan 1998, Bob Bryant wrote:

> I have confirmed with the Salt Lake City Hilton that the following hotel
> reservations have been made.
> name                    dates                   confirmation  #
> R stanley               13-16                   832781
> C Carroll               13-16                   832780
> R McKosky          12-16                   832816
> Djuitt                     13-16                   831992
> R Bryant                12-16                   832815
> E Norris                  12-16                  831991
> I did this so we would not get the "Mary and Joseph" responce in the lobby.
> 
> *******************************************************************************
> Robert Bryant                           email           rhb1@gte.com
> Member Technical Staff                  Fax             617-466-2838
> Secure Systems Department
> GTE Labrotories                         office ph       617-466-2821
> 40 Sylvan Rd    MS/55                   Cell ph         617-733-7757
> Waltham, MA 02254
> ****************************************************************************
> ***


Trees:2 Skiers:0





From firewalls-owner  Thu Jan  8 19:01:38 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id RAA00318; Thu, 8 Jan 1998 17:04:42 -0800 (PST)
Received: from ns.ISPNSP.NET (ns.ispnsp.net [207.112.214.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id RAA00291 for <firewalls@greatcircle.com>; Thu, 8 Jan 1998 17:04:33 -0800 (PST)
Received: from ispnsp.net by ns.ISPNSP.NET (SMI-8.6/SMI-SVR4)
	id TAA17082; Thu, 8 Jan 1998 19:14:09 -0600
Message-ID: <34B52294.50219B8@ispnsp.net>
Date: Thu, 08 Jan 1998 19:01:40 +0000
From: hostmaster <hostmaster@ISPNSP.NET>
Organization: ISPNSP.NET
X-Mailer: Mozilla 4.04 [en] (WinNT; I)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: Re: usubscribe firewalls
References: <199712090603.WAA16035@honor.greatcircle.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



> usubscribe firewalls




From firewalls-owner  Thu Jan  8 19:19:19 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id NAA18733; Thu, 8 Jan 1998 13:47:50 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id NAA18653 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 13:47:35 -0800 (PST)
Received: from hotmail.com by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-970426)
	id NAA15246; Thu, 8 Jan 1998 13:46:38 -0800 (PST)
Received: (qmail 23288 invoked by uid 0); 8 Jan 1998 21:47:20 -0000
Message-ID: <19980108214720.23287.qmail@hotmail.com>
Received: from 206.66.180.230 by www.hotmail.com with HTTP;
	Thu, 08 Jan 1998 13:47:20 PST
X-Originating-IP: [206.66.180.230]
From: "conor coghlan" <conor_coghlan@hotmail.com>
To: firewalls@GreatCircle.COM
Subject: fw v router
Content-Type: text/plain
Date: Thu, 08 Jan 1998 13:47:20 PST
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

what are some of the advantages and disadvantages of using a firewall vs 
a router to secure an internal portion of your network that may not be 
secure? when is a router sufficient? why would you need more than a 
router.

thanks in advance



______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com

From firewalls-owner  Thu Jan  8 20:10:30 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id RAA01362; Thu, 8 Jan 1998 17:09:24 -0800 (PST)
Received: from mail.diginsite.com (mail.diginsite.com [208.2.189.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id RAA01319 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 17:09:12 -0800 (PST)
Received: from localhost (dlang@localhost)
	by mail.diginsite.com (8.8.8/8.8.6) with SMTP id RAA20298;
	Thu, 8 Jan 1998 17:58:43 -0800
Date: Thu, 8 Jan 1998 17:58:43 -0800 (PST)
From: David Lang <dlang@diginsite.com>
To: Christian Reiser <C.Reiser@Austria.EU.net>
cc: chad@rumor.net, andre.van.der.lans@inet.unisource.nl,
        rkizer@guten.sddpc.org, firewalls@GreatCircle.COM
Subject: Re: Firewall for ISP
In-Reply-To: <199801081604.RAA01030@vindobona.intern.austria.eu.net>
Message-ID: <Pine.LNX.3.96.980108175550.11860B-100000@mail.diginsite.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

as you need a different line for each source/destination/service
combination it can add up quickly.

Case in point (from an internal firewall implementation with the PIX)

10 source machines
10 destinations
6 services telnet, ftp, dns, mail, web, ssl
600 lines (assuming you are needing to let them in from the "outside"

David Lang

On Thu, 8 Jan 1998, Christian Reiser wrote:

> 
> >> Another issue is that the GUI quits working when the
> >> configurationfile has more than 400 entries.
> >
> >OK, you have a point. Sounds like a bug. Report it to Cisco if you want.
> >I looked at the "GUI" (web based) after it had been here for a while. It
> >was functional. But command line is much faster and more intuitive for
> >*me*. Others may care, do your part and report the bug.
> 
> Sorry, but there is one point I don't understand. What do you need a
> config-file for, that has more than 400 entries? I wouldn't understand it any
> more. 
> 
> I installed 3 PIX in the last month for customers having about 50 lines each
> (including all the default staff). For ordinary installations you don't need
> more than that.
> 
> Here in our office I run a slightly more complicated configuration with 74
> lines, but I can't imagine a configuration with more than 100 lines.
> 
> BTW, I also prefere the command line interface.
> 
> Greatings from Vienna/Austria
> mfg
> CR
> 
> -- 
> Christian Reiser (EUnet Austria)      e-mail: C.Reiser@Austria.EU.net
> Tel: +431 899 33-0                         http://www.Austria.EU.net/
> Fax: +431 899 33-533        CR86-RIPE         priv: C.Reiser@ieee.org
>       To get my PGP-Key send e-mail with Subject: Query PGP Key
> 


From firewalls-owner  Thu Jan  8 20:16:19 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id SAA22981; Thu, 8 Jan 1998 18:51:10 -0800 (PST)
Received: from i-2000.com (i-2000.com [204.97.92.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id SAA22815 for <Firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 18:50:17 -0800 (PST)
From: edpaudit@i-2000.com
Received: from [206.231.224.246] (edpaudit.dh.i-2000.com [206.231.224.246]) by i-2000.com (8.8.8/8.7) with SMTP id VAA22878 for <Firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 21:51:00 -0500 (EST)
Date: Thu, 8 Jan 1998 21:51:00 -0500 (EST)
Message-Id: <199801090251.VAA22878@i-2000.com>
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Subject: Firewall Audit Tools
To: Firewalls@GreatCircle.COM
X-Mailer: SPRY Mail Version: 04.10.06.22
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

There are tools that can be used for auditing and reviewing Internet security at 
 an outfit called ISS. I think their Web site is www.iss.com

Jeffrey Loewenstein
edpaudit@i-2000.com 

From firewalls-owner  Thu Jan  8 20:43:57 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id TAA28032; Thu, 8 Jan 1998 19:15:21 -0800 (PST)
Received: from fw.itm-inst.com ([206.239.41.100]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id SAA22862 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 18:50:26 -0800 (PST)
Received: by fw.itm-inst.com; id VAA18070; Thu, 8 Jan 1998 21:50:18 -0500 (EST)
Received: from unknown(10.0.3.121) by fw.itm-inst.com via smap (2.0)
	id xma018062; Thu, 8 Jan 98 21:49:58 -0500
Message-Id: <3.0.3.32.19980108214702.006d5964@fw.itm-inst.com>
X-Sender: rmurphy@fw.itm-inst.com
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Thu, 08 Jan 1998 21:47:02 -0500
To: Oliver Lau <lau@skp.de>
From: Rick Murphy <rmurphy@itm-inst.com>
Subject: Re: Re[2]: Stateful Inspection Anyone?  Explore your options.
Cc: <firewalls@GreatCircle.COM>
In-Reply-To: <34B358B255.B791.lau@skp.de>
References: <A1F2B23A4F10D1118DDB00A0C9193FCF016C01@ALTOS>
 <A1F2B23A4F10D1118DDB00A0C9193FCF016C01@ALTOS>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 09:28 AM 1/7/98 +0100, Oliver Lau wrote:
>You surely haven't had a look inside stateful inspection firewalls, have
>you? You have to distinguish between two possibilities on how tables
>can become corrupt:
>
>	1.) accidentally deleted entries
>	2.) forged entries
You forgot at least one other reason:
 - You neglected to disable IP forwarding. Before the firewall starts
to inspect, you're wide open.
Yeah, it's a "user configuration error". Unfortunately, that's the
way the OS works by default.
	-Rick


From firewalls-owner  Thu Jan  8 20:46:15 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id SAA23814; Thu, 8 Jan 1998 18:55:10 -0800 (PST)
Received: from abhiweb.com (idi-fk-gw.abhiweb.com [205.138.236.250]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id SAA23766 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 18:54:56 -0800 (PST)
Message-Id: <3.0.5.32.19980108190146.00abb8d0@bonn.abhiweb.com>
X-Sender: byrd@bonn.abhiweb.com
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.5 (32)
Date: Thu, 08 Jan 1998 19:01:46 -0800
To: "James Lau" <jlau@hotmail.com>, firewalls@GreatCircle.COM
From: Bruce Byrd <byrd@internetdevices.com>
Subject: Re: Content filtering
Cc: hotmail!jlau@uunet.uu.net
In-Reply-To: <199801072257.OAA11676@f85.hotmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Check out the Fort Knox Firewall Device from Internet Devices. It has
transparent HTTP, SMTP, and FTP proxies which don't require client
reconfiguration. Web site filtering can be done with individually defined
filters or through a URL blocking feature using a list licensed from Cyber
Patrol. SMTP filtering criteria can be To/From/Size/MIME type. 

http://www.InternetDevices.com

Regards,

Bruce Byrd
Internet Devices, Inc. 


At 02:57 PM 1/7/98 PST, James Lau wrote:
>Hello all,
>
>This may be a little bit off topic but please bare with me or 
>points me to a right mailing list.
>
>I'm looking for a solution to filter the contents of web traffics,
>ftp files and email.  I know this is not totally firewall related
>but there are a few firewall products can do that. (That's why I
>ask.)  Unfortunately most (may be all) of them use proxy which
>require changes of configuration which we cannot force my users
>to do.  Is there any solution out there which doesn't require
>changing of configuration?  Or is the proxy the only solution?
>Any ideas?
>
>Thanks in advance.
>James
>
>______________________________________________________
>Get Your Private, Free Email at http://www.hotmail.com
>
>

From firewalls-owner  Thu Jan  8 21:22:43 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id TAA05032; Thu, 8 Jan 1998 19:42:11 -0800 (PST)
Received: from nm.cnnic.net.cn (nm.cnnic.net.cn [159.226.1.8]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id TAA04958 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 19:41:56 -0800 (PST)
From: guard@cnnic.net.cn
Received: from cnnic.net.cn (localhost [127.0.0.1]) by nm.cnnic.net.cn (950413.SGI.8.6.12/950213.SGI.AUTOCF) via ESMTP id LAA03191 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 11:46:02 -0800
Message-ID: <34B67E79.9D027911@cnnic.net.cn>
Date: Fri, 09 Jan 1998 11:46:01 -0800
X-Mailer: Mozilla 4.02 [en] (X11; I; IRIX64 6.2 IP28)
MIME-Version: 1.0
To: firewalls@GreatCircle.COM
Subject: Stateful inspection
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello everybody,
I am expecting some further information about Stateful inspection.
I mean its theory and practice ,and if possible its implemention
mechanism.
I first heard this technique from checkpoint.
Anyone can tell me that or good referal sites ?
Thanks a lot .


From firewalls-owner  Thu Jan  8 21:29:18 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA24330; Thu, 8 Jan 1998 11:40:12 -0800 (PST)
Received: from send1a.yahoomail.com (send1a.yahoomail.com [205.180.60.22]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id LAA24302 for <firewalls-digest@greatcircle.com>; Thu, 8 Jan 1998 11:40:05 -0800 (PST)
Message-ID: <19980108194024.28438.rocketmail@send1a.yahoomail.com>
Received: from [158.107.48.99] by send1a; Thu, 08 Jan 1998 11:40:24 PST
Date: Thu, 8 Jan 1998 11:40:24 -0800 (PST)
From: Spyke <googlyoogly@yahoo.com>
Subject: Firewall Security in a Microsoft World
To: firewalls-digest@greatcircle.com
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I have a few questions that I hope that the group can answer to some
degree for a Windows NT 4.0 setup:

1) Microsoft Proxy 2.0 is very easy to administer. To allow services
that aren't already proxied (HTTP/SHTTP/FTP) administrators have
simply allowed the installation of Winsock on client computers and
allowed the traffic through the Winsock proxy. An example would be
AOL, POP, or a proprietary protocol that you initiate through a
specific port, but subsequent connections can't be tied to a specific
return port. What known risks is being taken on by freely allowing
these Winsock services through the Winsock proxy. After all, it *is* a
proxy.

2) Microsoft Proxy 2.0 recommends that the server service be unbound
from the Internet NIC. For easy administration, administrators still
allow the server service to be bound to the *internal* NIC. (Remote
administration of IIS, disk volumes, remote backup, etc.) Are there
any risks with this implementation?

Your answers would be appreciated. I'm curious what technical security
reasons would cause these configurations to be insecure. Please,
simply stating that because it is a proprietary Microsoft product,
thus insecure, doesn't really help anyone.

Thank you!



_________________________________________________________
DO YOU YAHOO!?
Get your free @yahoo.com address at http://mail.yahoo.com


From firewalls-owner  Thu Jan  8 21:41:17 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id VAA23156; Thu, 8 Jan 1998 21:10:02 -0800 (PST)
Received: from alcove.wittsend.com (alcove.wittsend.com [130.205.0.20]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id VAA22914 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 21:09:01 -0800 (PST)
Received: (from mhw@localhost)
	by alcove.wittsend.com (8.8.7/8.8.7) id XAA11337;
	Thu, 8 Jan 1998 23:55:02 -0500
From: "Michael H. Warfield" <mhw@wittsend.com>
Message-Id: <199801090455.XAA11337@alcove.wittsend.com>
Subject: Re: Re[2]: Stateful Inspection Anyone?  Explore your options.
In-Reply-To: <3.0.3.32.19980108214702.006d5964@fw.itm-inst.com> from Rick Murphy at "Jan 8, 98 09:47:02 pm"
To: rmurphy@itm-inst.com (Rick Murphy)
Date: Thu, 8 Jan 1998 23:55:01 -0500 (EST)
Cc: lau@skp.de, firewalls@GreatCircle.COM
X-Mailer: ELM [version 2.4ME+ PL33 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Rick Murphy enscribed thusly:
> At 09:28 AM 1/7/98 +0100, Oliver Lau wrote:
> >You surely haven't had a look inside stateful inspection firewalls, have
> >you? You have to distinguish between two possibilities on how tables
> >can become corrupt:
> >
> >	1.) accidentally deleted entries
> >	2.) forged entries
> You forgot at least one other reason:
>  - You neglected to disable IP forwarding. Before the firewall starts
> to inspect, you're wide open.
> Yeah, it's a "user configuration error". Unfortunately, that's the
> way the OS works by default.
> 	-Rick

	Gee Wiz!  I'll bet if you forget to disable IP forwarding on a
Proxy firewall, that firewall will be real useful too!  Or how about
proxy firewalls that you THINK are safe and have no IP forwarding
enabled, but you neglete to make sure it is also incapable of source routing?
I know of at least one common OS that has source routing enabled in its
TCP/IP stack with no way to disable it (short of replacing the stack with
another vendor's).

	Mike
-- 
 Michael H. Warfield    |  (770) 985-6132   |  mhw@WittsEnd.com
  (The Mad Wizard)      |  (770) 925-8248   |  http://www.wittsend.com/mhw/
  NIC whois:  MHW9      |  An optimist believes we live in the best of all
 PGP Key: 0xDF1DD471    |  possible worlds.  A pessimist is sure of it!

From firewalls-owner  Thu Jan  8 22:02:03 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id VAA01266; Thu, 8 Jan 1998 21:45:38 -0800 (PST)
Received: from mail.secureservers.net (geek-gw.ptw.com [207.212.186.129]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id VAA29287 for <firewalls@greatcircle.com>; Thu, 8 Jan 1998 21:36:56 -0800 (PST)
Received: (qmail 30017 invoked from network); 9 Jan 1998 05:58:31 -0000
Received: from localhost (bextreme@127.0.0.1)
  by localhost with SMTP; 9 Jan 1998 05:58:31 -0000
Date: Thu, 8 Jan 1998 21:58:29 -0800 (PST)
From: Jesse Brown <bextreme@pobox.com>
X-Sender: bextreme@geek-gw.ptw.com
To: firewalls@greatcircle.com
Subject: HTTP/POP3/SMTP Proxies? 
Message-ID: <Pine.LNX.3.96.980108215758.1869C-100000@geek-gw.ptw.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello, I was wondering if anyone had any recommendations for free proxy
software that will run on x86 Linux that can either proxy HTTP, POP3,
SMTP, etc, or just a general proxy that will allow me to redirect a
connection like http. 

-J

--
Jesse Brown - bextreme@pobox.com  



From firewalls-owner  Thu Jan  8 22:07:49 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA22234; Thu, 8 Jan 1998 11:27:09 -0800 (PST)
Received: from mail.diginsite.com (mail.diginsite.com [208.2.189.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA23367 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 09:23:23 -0800 (PST)
Received: from localhost (dlang@localhost)
	by mail.diginsite.com (8.8.8/8.8.6) with SMTP id KAA05674;
	Thu, 8 Jan 1998 10:14:10 -0800
Date: Thu, 8 Jan 1998 10:14:10 -0800 (PST)
From: David Lang <dlang@diginsite.com>
To: MacGyver <macgyver@tos.net>
cc: Peter da Silva <peter@baileynm.com>, Steve Kruse <jsk347@sprynet.com>,
        firewalls@GreatCircle.COM
Subject: Re: E-mail Encryption
In-Reply-To: <Version.32.19980107163553.01064e50@smtp.tos.net>
Message-ID: <Pine.LNX.3.96.980108101240.5443B-100000@mail.diginsite.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

PGP 5. allows you to use the RSA keys. If you do it is compatable with the
2.6 version, however if you use the default settings you cannot
inter-operate with the RSA encryption.

David Lang



On Wed, 7 Jan 1998, MacGyver wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> 
> At 04:27 PM 1/7/98 -0600, Peter da Silva wrote:
> >> I think it might have been mentioned on here, but there is a $5.00
> >> "up-downgrade" that lets you use the RSA which IS compatabile with PGP 2.x.
> >>  Check the PGP website for info.  
> >
> >And if I'm not running Windoze?
> > 
> 
> If you're not running on a Mac or Win95/98, you can grab PGP 4.x.
> It fully supports RSA, as does the COMMERCIAL version of PGP 5.x, which if
> you plan to use it for anything other than personal use, you have to buy
> anyway.  PGP 5.x (commercial) is NOT incompatible with previous versions of
> PGP, but is a superset of functions provided in previous versions.
> 
> 
> - --
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>         ^               Habeeb J. Dihu
>      -'   `-            Managing Senior Technologist
>    " '     ` "          Cirrus Technologies
>  "  '       `  "        
> "  '      .  `  "                  
> "  '    .' ` `  "       'I don't believe in the no-win scenario'
>  " `   '    `' "           -- Captain James T. Kirk,  Star Trek II: TWK
>    `  ' _  _ '          'There is an old Vulcan proverb, `Only Nixon 
>     '                    could go to China.`'
>                            -- Captain Spock, Star Trek VI: TUC
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> 
> -----BEGIN PGP SIGNATURE-----
> Version: PGP for Business Security 5.5.2
> 
> iQCVAwUBNLQKL1TtNfTWxXdNAQH/uQP/STbPuT3/+6Fc6gzMPC3/Nc6wSUC8p5kl
> qfb4cv4q8TYeXms8Kx6Z2VxPNsE//oT2ls5obfZsibVEjl3DM/HW6Chcv857B2Lo
> TfkB1MzFupr9vbLWRcRVj4YSBt6IEY2lVhGrFZzm3H4yknb8Gj16aHf5ddePorN1
> ocFl+MNLg8A=
> =g8hP
> -----END PGP SIGNATURE-----
> 
> 


From firewalls-owner  Thu Jan  8 22:18:12 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA24440; Thu, 8 Jan 1998 09:28:22 -0800 (PST)
Received: from zeke.gov.yk.ca (ZEKE.GOV.YK.CA [199.247.128.34]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA24315 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 09:27:42 -0800 (PST)
Received: by zeke.gov.yk.ca; id JAA27571; Thu, 8 Jan 1998 09:28:21 -0800 (PST)
Received: from unknown(199.247.130.39) by zeke.gov.yk.ca via smap (4.0)
	id xma027472; Thu, 8 Jan 98 09:27:54 -0800
Received: from 185580 ([199.247.134.102]) by tempest.gov.yk.ca (8.7.5/8.7.3) with SMTP id JAA30980; Thu, 8 Jan 1998 09:24:41 -0800
Message-Id: <1.5.4.32.19980108172754.00913db0@mailhost.gov.yk.ca>
X-Sender: kwiat@mailhost.gov.yk.ca
X-Mailer: Windows Eudora Light Version 1.5.4 (32)
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Date: Thu, 08 Jan 1998 09:27:54 -0800
To: Joy Pham <jpham@ns2.shopping.com>, firewalls@GreatCircle.COM
From: Larry Kwiat <Larry.Kwiat@gov.yk.ca>
Subject: Re: Remote Access
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Well, if the user had a modem on their office machine on your net , and, 
if they had a copy of carbon copy on it and were unskilled, and,
someone who was quite skilled had access to the same number, and,
dialled in and gained access to the computer, and,
logged on, and,
loaded and executed something that allowed access to the computer's bus, and,
put the ethernet card into promiscuous mode, and,
did some more fiddling,

they would be in quite a privileged position on your network.

they would be in a position I certainly wouldn't want to see anyone in.

About like having someone walk through the open doors of a bank at 3:00 a.m.
with all the alarms turned off, with the money lying around on tables...

and maybe all the policemen are asleep too.

If you have some dial-in control, a central dial-in modem setup, and so on,
it is a better solution to stay away from these kinds of things, I think.

I haven't given away any big secrets here, but generally, this kind of thing
isn't done or allowed.

The argument I'd make is that anyone who makes opinions _for_ the kind of 
access you mention is betting the net worth of the information on the whole
network against their being right in a very minor way. If they lose the bet,
much more than their own personal assets are on the line. Senior management
likes it when these kinds of decisions are put to them in a clear,
understandable
way. They are justifiably paranoid of "techy" solutions to information access.

I'd be real nervous myself.

At 04:58 PM 1/7/98 -0800, Joy Pham wrote:
>How do you all feel about having users dial into the network using Carbon
>Copy?  How much security breach are we talking about?  I've personally do
>not like any kind of remote control software but I really don't have any
>valid arguments as to why we can't implement it at my company.  Any ideas,
>suggestions, arguments would be appreciated.
>
>Thank you,
>Joy
>

=+=+=+=+=+=+=+=+=+=+=+=+=+=

Sincerely,

Larry Kwiat
Electronic Information Security Coordinator / 
System Integration Specialist
Information Services Branch
Government of Yukon
(403)667-8081
kwiat@gov.yk.ca


From firewalls-owner  Thu Jan  8 22:29:46 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA07990; Thu, 8 Jan 1998 15:23:07 -0800 (PST)
Received: from pse01.pios.com (PSE01.PIOS.COM [199.33.129.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id PAA07876 for <Firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 15:22:44 -0800 (PST)
Received: by pse01.pios.com; (5.65v3.2/1.3/10May95) id AA04751; Thu, 8 Jan 1998 18:23:14 -0500
Received: from pio_mail2.cle2.pios.com by gemini.pios.com (PMDF V5.0-6 #18985)
 id <01IS56RH125C8X1EHE@gemini.pios.com> for Firewalls@GreatCircle.COM; Thu,
 08 Jan 1998 18:24:17 -0500 (EST)
Received: by pio_mail2.cle2.pios.com with SMTP
 (Microsoft Exchange Server Internet Mail Connector Version 4.0.995.52)
 id <01BD1C62.AB792D20@pio_mail2.cle2.pios.com>; Thu, 08 Jan 1998 18:24:34 -0500
Date: Thu, 08 Jan 1998 18:24:32 -0500
From: "Stout, William" <StoutW@pios.com>
Subject: RE: relative strengths of different encyrption techniques
To: "'Firewalls-GC'" <Firewalls@GreatCircle.COM>
Message-Id: 
 <c=US%a=_%p=PIOS%l=PIO_MAIL2-980108232432Z-4052@pio_mail2.cle2.pios.com>
Mime-Version: 1.0
X-Mailer: Microsoft Exchange Server Internet Mail Connector Version 4.0.995.52
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> ----- Original Message -----
> From:	Bowers T (Thomas)  at MSXSSC [SMTP:TB186459@shellus.com]
> Sent:	Wednesday, January 07, 1998, 14:46:31
> To:	Stout, William
> Subject:	relative strengths of different encyrption techniques
> 
> 
> I'm not a crpytologist but...
> 
> I've been asked to estimate the time it takes to crack various
> encyrption
> techniques...
>
> Yes...  I understand the more bits, the better...

This is a trick question, right?

Brute force attacks don't care about the algorithm.  They care about key
lengths.  There are _faulty_ encryption algorithms though out there
which have flaws that can be exploited, nearly all of which are
proprietary.

Encryption is only 'security through time'[tm].  A secret key is known
to be a member of a range of values, and discovered by trying each key
in an order of highest probability.  Note that 'time' varies, as the
guesser may happen to come across the right key near the beginning of
the range, though key length has a big impact on the average time to
guess the right password.  If you're encrypting passwords, and your
password is 'password', it don't matter if you're using 40-bit or
4096-bit encryption, or are using LanManager algorithms or NSA's latest.
 A gripe of mine - maximum key strength is incorrectly judged by the
minimum amount of time it takes to process the entire key range, for
some odd reason I think it should be measured on the minimum amount of
time to discover the first usable key in the key range.

Thought for the day - A short alphanumeric string is a weak way of
identifying an individual.

'Dancing cyphers' can help, where the encrypting nodes synchronously
'dance across the range', similar to how spread-spectrum
frequency-hopping radio works, where the frequency (key) for each piece
of the message is different.  FWIW - 128-bit encryption is approximately
10,000,000,000,000,000 times stronger (multiple of 'x' more possible
values) than 112-bit encryption (10^128)/(10^112).

Bill Stout


From firewalls-owner  Thu Jan  8 23:41:59 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id OAA13303; Wed, 7 Jan 1998 14:47:48 -0800 (PST)
Received: from gate3.shellus.com (gate3.shellus.com [204.71.91.4]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id OAA13084 for <firewalls@greatcircle.com>; Wed, 7 Jan 1998 14:47:07 -0800 (PST)
Received: by gate3.shellus.com; id QAA11038; Wed, 7 Jan 1998 16:28:37 -0600 (CST)
Received: from unknown(134.163.2.2) by gate3.shellus.com via smap (3.2)
	id xma011025; Wed, 7 Jan 98 16:28:16 -0600
Received: from icsscxh1 by icsrv01 (AIX 4.1/UCB 5.64/FEJ.AIX.1.2)
          id AA42484; Wed, 7 Jan 1998 16:45:13 -0600
Received: by icsscxh1.shell.com with Internet Mail Service (5.0.1458.49)
	id <C3NLCT0T>; Wed, 7 Jan 1998 16:47:58 -0600
Message-Id: <D193F6640135D111B2A800805F8B6002021891@icsscx03.shell.com>
From: "Bowers T (Thomas)  at MSXSSC" <TB186459@shellus.com>
To: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: relative strengths of different encyrption techniques
Date: Wed, 7 Jan 1998 16:46:31 -0600
X-Priority: 3
Mime-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1458.49)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


I'm not a crpytologist but...

I've been asked to estimate the time it takes to crack various
encyrption
techniques...

Yes...  I understand the more bits, the better...


I understand that most reasonable people will deploy the best technique
available...  and so will we.    That, however, doesn't alleviate me
from
trying to estimate how many days/months/years/light_years of compute
cycles it will take for someone to crack the technique we select.


Are there any references on the relative strengths of different
encyrption
techniques...  


Any help would be appreciated...



T. Bowers





Tom Bowers
Network Engineering
Shell Services Company
PHONE:  (1)  713-245-1269
FAX:  (1) 713-245-1010
E-MAIL: tbowers@shellus.com

From firewalls-owner  Thu Jan  8 23:48:15 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id XAA19604; Thu, 8 Jan 1998 23:15:10 -0800 (PST)
Received: from gargoyle.clark.net (pm1-39.dcwt.infi.net [208.136.65.39]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id WAA14611 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 22:49:37 -0800 (PST)
Received: (qmail 599 invoked by uid 500); 9 Jan 1998 06:57:16 -0000
Date: Fri, 9 Jan 1998 01:57:16 -0500 (EST)
From: "Paul D. Robertson" <proberts@clark.net>
X-Sender: proberts@gargoyle
To: Simon K Ash <simon.ash@eudoramail.com>
cc: firewalls@GreatCircle.COM
Subject: Re: Proxy server to hide IP Add.. from your Firewall
In-Reply-To: <DEPNKAAJNCMOHAAA@shared1-mail.whowhere.com>
Message-ID: <Pine.LNX.3.91.980109015340.500A-100000@gargoyle>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Thu, 8 Jan 1998, Simon K Ash wrote:

> Question 1
> 
> Is it possible to use a proxy server (such a MS Proxy) inside Firewall-1, to hide
> a group of IP Addresses from Firewall-1. This would allow you to buy a 100 node licence
> and have it protecting 250 in reality, and greatly reduce the cost of Firewall-1.
> 
> 
> Can anyone see any problems with this concept?

It's a violation of the license agreement and can get you sued.
It's unethical as well.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
proberts@clark.net      which may have no basis whatsoever in fact."
                                                                     PSB#9280


From firewalls-owner  Fri Jan  9 00:01:38 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id XAA22819; Thu, 8 Jan 1998 23:27:26 -0800 (PST)
Received: from majestix.skp.de (majestix.skp.de [194.163.133.195]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id XAA22570 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 23:26:34 -0800 (PST)
Received: (from mail@localhost) by majestix.skp.de (8.7.5/8.7.3) id IAA12156; Fri, 9 Jan 1998 08:28:35 +0100
X-Authentication-Warning: majestix.skp.de: mail set sender to <lau@skp.de> using -f
Received: from hagbard(192.168.0.5) by majestix.skp.de via smap (V1.3)
	id sma012154; Fri Jan  9 08:28:32 1998
Date: Fri, 09 Jan 1998 08:26:13 +0100
To: <firewalls@GreatCircle.COM>
From: Oliver Lau <lau@skp.de>
Cc: Simon K Ash <simon.ash@eudoramail.com>
Subject: Re: Proxy server to hide IP Add.. from your Firewall
In-Reply-To: <DEPNKAAJNCMOHAAA@shared1-mail.whowhere.com>
References: <DEPNKAAJNCMOHAAA@shared1-mail.whowhere.com>
Message-Id: <34B5ED35D2.FF56.lau@skp.de>
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-Mailer: Becky! ver 1.20
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Greetings!

On Thu, 08 Jan 1998 12:36:27 -0700
"Simon K Ash" <simon.ash@eudoramail.com> wrote:

|  Question 1
|  
|  Is it possible to use a proxy server (such a MS Proxy) inside Firewall-1, to
|  hide
|  a group of IP Addresses from Firewall-1. This would allow you to buy a 100
|  node licence
|  and have it protecting 250 in reality, and greatly reduce the cost of
|  Firewall-1.

Your idea will work with any firewall that is capable of network address
translation in some fashion. What you miss is granularity in Firewall-1
configuration. What you will gain is extra security by means of a multi-
tiered approach. You will have to weigh these aspects to make the best
out of it.


Cheers,

Oliver Lau
[CTO]
Sauer und Partner GmbH, NetzwerkTechnologie und Sicherheit
Dietrich-Bonhoeffer-Strasse 1-3, 35037 Marburg, Germany
fon: +49 6421 938300, fax: +49 6421 938390, URL: http://www.skp.de/
PGP-Fingerprint: 6696 C8B6 F351 A381  D1C9 BC41 98F2 6DE3

From firewalls-owner  Fri Jan  9 00:05:50 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA02333; Wed, 7 Jan 1998 11:22:17 -0800 (PST)
Received: from main.geminisecure.com (main.geminisecure.com [205.179.16.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id JAA13957 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 09:57:00 -0800 (PST)
Received: (from leonard@localhost) by main.geminisecure.com (8.6.9/8.6.9) id JAA11868; Wed, 7 Jan 1998 09:50:54 -0800
Date: Wed, 7 Jan 1998 09:50:54 -0800 (PST)
From: Leonard Miyata <leonard@geminisecure.com>
To: Kerry Jones <kjones@aims.gov.au>
cc: firewalls@GreatCircle.COM
Subject: Re: Split DNS??
In-Reply-To: <34B2BD37.402DDEBC@aims.gov.au>
Message-ID: <Pine.BSD/.3.91.980107094113.11855A-100000@main.geminisecure.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi There Again..

First of all, Regardless what you setup, You still need your
PUBLIC Primary and Secondary DNS Servers to be authoritive to
your Domain. This is a Internet DNS requirement and must be
available for Public Internet Access...

As for Split DNS, it can cover limited to complete access from
your inside network to the Internet, and may include setting up
a complete independent DNS tree in your inside network. (This
would be necessary in the case of using Private Address space
and NAT...) The whole issue is a BIG BIG can of worms.

Since it sounds like your implementing this, you must get
the O'reilly books 'DNS and Bind' (the grasshopper book)
authors Paul Albitz and Cricket Liu, and 'Building Internet
Firewalls' by Chapman and Zwicky. Both of them together
provide good write ups, comments and suggestions on the
interaction of Firewalls, DNS, and DMZ configurations

Personal Opinions provided by
Leonard Miyata
aka leonard@geminisecure.com
GEMINI COMPUTERS INC.

On Wed, 7 Jan 1998, Kerry Jones wrote:

> Hi,
> 
> This is a great Mailing list..I am so impressed with the answers I got
> from my last question DNS on Firewalls!!.. I'm going to ask another..
> 
> What are the benefits of running split DNS??? Is it more secure?? Or is
> it a pain in the ass which doesn't increase security much at all?? Can
> someone give me a bit of an overview of how it would be done.
> 
> Is it a simple matter of running 1 DNS on the DMZ (for internet) and
> another totally separate DNS on the internal network (for local
> machines)??  Would the 2 DNS servers be totally independent of one
> another or would one have to update the other one?
> 
> Thanks in advance...
> 
> --
> Kerry Jones
> kjones@aims.gov.au
> 
> 

From firewalls-owner  Fri Jan  9 00:05:51 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id SAA19423; Thu, 8 Jan 1998 18:36:18 -0800 (PST)
Received: from mako.netlink.co.nz (mako.netlink.co.nz [202.37.60.47]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id SAA19365 for <firewalls@greatcircle.com>; Thu, 8 Jan 1998 18:35:59 -0800 (PST)
Received: from dave.loka.co.nz (loka.wn.netlink.net.nz [202.37.61.23]) by mako.netlink.co.nz (8.8.6/8.8.6)
	 with SMTP id PAA04055; Fri, 9 Jan 1998 15:36:34 +1300 (NZDT)
Received: by dave.loka.co.nz with Microsoft Mail
	id <01BD1D14.5915E340@dave.loka.co.nz>; Fri, 9 Jan 1998 15:36:26 +1300
Message-ID: <01BD1D14.5915E340@dave.loka.co.nz>
From: D Cathro <david@loka.co.nz>
To: "'Bowers T (Thomas)  at MSXSSC'" <TB186459@shellus.com>
Cc: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: RE: relative strengths of different encyrption techniques
Date: Fri, 9 Jan 1998 15:36:25 +1300
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Tom

Have a look at http://www.bsa.org/policy/encryption/cryptographers.html =
It is a paper called "MINIMAL KEY LENGTHS FOR SYMMETRIC CIPHERS TO =
PROVIDE ADEQUATE COMMERCIAL SECURITY" It is now two years old but =
provides good background reading.=20

Follow this up by having a look at some of the links from the RSA page =
http://www.rsa.com/rsalabs/97challenge/html/links.html =20
Some of it is pretty sobering stuff but it needs to be taken in context =
of who you are trying to protect your information from, how much money =
than have, and how easy it is to get the protected information by other =
means.=20


my 2 cents worth.

David Cathro=20
Loka Limited  Email  david@loka.co.nz


-----Original Message-----
From:	Bowers T (Thomas)  at MSXSSC [SMTP:TB186459@shellus.com]
Sent:	Thursday, 8 January 1998 11:47
To:	'firewalls@greatcircle.com'
Subject:	relative strengths of different encyrption techniques


I'm not a crpytologist but...

I've been asked to estimate the time it takes to crack various
encyrption
techniques...

Yes...  I understand the more bits, the better...


I understand that most reasonable people will deploy the best technique
available...  and so will we.    That, however, doesn't alleviate me
from
trying to estimate how many days/months/years/light_years of compute
cycles it will take for someone to crack the technique we select.


Are there any references on the relative strengths of different
encyrption
techniques... =20


Any help would be appreciated...



T. Bowers





Tom Bowers
Network Engineering
Shell Services Company
PHONE:  (1)  713-245-1269
FAX:  (1) 713-245-1010
E-MAIL: tbowers@shellus.com


From firewalls-owner  Fri Jan  9 00:09:34 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA02888; Wed, 7 Jan 1998 09:08:45 -0800 (PST)
Received: from irwin-exch2.army.mil (IRWIN-EXCH2.ARMY.MIL [144.147.50.11]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id JAA02822 for <firewalls@GreatCircle.COM>; Wed, 7 Jan 1998 09:08:31 -0800 (PST)
Received: by irwin-exch2.army.mil with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5)
	id <01BD1B4B.D0ED6D40@irwin-exch2.army.mil>; Wed, 7 Jan 1998 09:08:27 -0800
Message-ID: <c=US%a=_%p=ARMY%l=IRWEXCH3-980107170851Z-3101@irwin-exch2.army.mil>
From: G2 Security Division <AFZJ-I-S@IRWIN.ARMY.MIL>
To: "'firewalls@GreatCircle.COM'" <firewalls@GreatCircle.COM>
Subject: Re:  E-Mail Encryption
Date: Wed, 7 Jan 1998 09:08:51 -0800
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.993.5
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Tue, 6 Jan 1998, Grigorof, Adrian wrote:
> I am looking for a product to be used in encrypting e-mail to be sent
over the Internet.

Have you looked at AT&T's Secret Agent?  It is a digital signature and 
encryption utility.  It runs National Institut of Standards and Technology 
(NIST) DES, NIST Digital Signature Standard, NIST Secure Hash Standards 
(See FIPS 180-1), Diffie-Hellman, RSA, and Triple DES.  It interfaces with 
PCMCIA cards for message authentication and I believe hardware encryption 
via e.g., FORTEZZA.  Their reps at the National Information Systems 
Security Conference indicated that planned version upgrades would allow one 
to set up a macro on MS WORD so a user could run the encryption from a GUI 
button.

Try http://www.att.com/bcs/secure_software

Wolfgang at (760) 380-3379


From firewalls-owner  Fri Jan  9 00:32:18 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id AAA01708; Fri, 9 Jan 1998 00:22:32 -0800 (PST)
Received: from maili.intern.Austria.EU.net (melone.austria.eu.net [193.154.142.240]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id AAA01677 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 00:22:23 -0800 (PST)
Received: from vindobona.intern.austria.eu.net (vindobona.intern.Austria.EU.net [192.168.191.165])
	by maili.intern.Austria.EU.net (8.8.6/8.8.6) with ESMTP id JAA02086;
	Fri, 9 Jan 1998 09:23:31 -0100 (GMT)
Received: (from cr@localhost) by vindobona.intern.austria.eu.net (8.7.6/8.7.3) id JAA02875; Fri, 9 Jan 1998 09:23:08 +0100
Date: Fri, 9 Jan 1998 09:23:08 +0100
Message-Id: <199801090823.JAA02875@vindobona.intern.austria.eu.net>
From: Christian Reiser <C.Reiser@Austria.EU.net>
To: brobinso@atsi.com
CC: firewalls@GreatCircle.COM
In-reply-to: <199801081620.JAA06461@zeus.atsi.com> (message from Bret Robinson
	on Thu, 8 Jan 1998 09:20:22 -0700)
Subject: Re: SKIP question
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


>I have a question about SKIP that I hope someone can help me with. We are
>testing a set-up that will allow employees to access our internal network
>from home and also allow us to connect to partners' sites using SKIP. The
>two set-ups are shown below:

[lots of problems with SKIP deleted]

I am afraid, this won't help very much, but I prefere VPN-solutions, where I
don't depend on any IP infrastructural feature of an ISP. What if the external
PC is travelling around using a great number of different ISPs to dial into
the Net and connect to your site?

There are products out there, where encrypted IP-tunneling over IP is
done. Some of them are even independend of the firewall (no CPU-power needed
there, no maintenance/changes for new users). Well, they don't use standard
protocols, but so what, I doubt, wether two different SKIP-products would work
together.

Greatings from Vienna/Austria
mfg
CR

-- 
Christian Reiser (EUnet Austria)      e-mail: C.Reiser@Austria.EU.net
Tel: +431 899 33-0                         http://www.Austria.EU.net/
Fax: +431 899 33-533        CR86-RIPE         priv: C.Reiser@ieee.org
      To get my PGP-Key send e-mail with Subject: Query PGP Key

From firewalls-owner  Fri Jan  9 00:46:28 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id AAA00392; Fri, 9 Jan 1998 00:15:29 -0800 (PST)
Received: from maili.intern.Austria.EU.net (melone.austria.eu.net [193.154.142.240]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id AAA00305 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 00:15:00 -0800 (PST)
Received: from vindobona.intern.austria.eu.net (vindobona.intern.Austria.EU.net [192.168.191.165])
	by maili.intern.Austria.EU.net (8.8.6/8.8.6) with ESMTP id JAA01988;
	Fri, 9 Jan 1998 09:14:58 -0100 (GMT)
Received: (from cr@localhost) by vindobona.intern.austria.eu.net (8.7.6/8.7.3) id JAA02861; Fri, 9 Jan 1998 09:14:34 +0100
Date: Fri, 9 Jan 1998 09:14:34 +0100
Message-Id: <199801090814.JAA02861@vindobona.intern.austria.eu.net>
From: Christian Reiser <C.Reiser@Austria.EU.net>
To: dlang@diginsite.com
CC: C.Reiser@Austria.EU.net, chad@rumor.net,
        andre.van.der.lans@inet.unisource.nl, rkizer@guten.sddpc.org,
        firewalls@GreatCircle.COM
In-reply-to: <Pine.LNX.3.96.980108175550.11860B-100000@mail.diginsite.com>
	(message from David Lang on Thu, 8 Jan 1998 17:58:43 -0800 (PST))
Subject: Re: Firewall for ISP
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


>[Why have a config file of 400+ lines on a PIX?]
>
>as you need a different line for each source/destination/service
>combination it can add up quickly.
>
>Case in point (from an internal firewall implementation with the PIX)
>
>10 source machines
>10 destinations
>6 services telnet, ftp, dns, mail, web, ssl
>600 lines (assuming you are needing to let them in from the "outside"

Well, for me this assumption is wrong. I would not let anybody in over my
firewall based on the IP-Adress. This is error prone and very unhandy
especially if ISPs use dynamic IPs for dial-in. Authentication from the
outside to the internal network has to be done by cryptography. I implement
VPNs, for example the AltaVista Tunnel. So I have only two lines for that on
the PIX.

If it comes to the question, who is allowed to connect to the internet from
the internal network (something I am asked quite frequently), I propose having
an internal cashing proxy (usefull anyway), with the permission stuff done
there. This is much simpler and nobody has to touch the firewall just because
somebody new has joined the company.

Greatings from Vienna/Austria
mfg
CR

-- 
Christian Reiser (EUnet Austria)      e-mail: C.Reiser@Austria.EU.net
Tel: +431 899 33-0                         http://www.Austria.EU.net/
Fax: +431 899 33-533        CR86-RIPE         priv: C.Reiser@ieee.org
      To get my PGP-Key send e-mail with Subject: Query PGP Key

From firewalls-owner  Fri Jan  9 00:49:06 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id XAA20543; Thu, 8 Jan 1998 23:19:38 -0800 (PST)
Received: from majestix.skp.de (majestix.skp.de [194.163.133.195]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id XAA20406 for <firewalls@GreatCircle.COM>; Thu, 8 Jan 1998 23:19:09 -0800 (PST)
Received: (from mail@localhost) by majestix.skp.de (8.7.5/8.7.3) id IAA11485; Fri, 9 Jan 1998 08:21:02 +0100
X-Authentication-Warning: majestix.skp.de: mail set sender to <lau@skp.de> using -f
Received: from hagbard(192.168.0.5) by majestix.skp.de via smap (V1.3)
	id sma011480; Fri Jan  9 08:20:56 1998
Date: Fri, 09 Jan 1998 08:18:36 +0100
To: Rick Murphy <rmurphy@itm-inst.com>
From: Oliver Lau <lau@skp.de>
Cc: <firewalls@GreatCircle.COM>, Oliver Lau <lau@majestix.skp.de>
Subject: Re[3]: Stateful Inspection Anyone?  Explore your options.
In-Reply-To: <3.0.3.32.19980108214702.006d5964@fw.itm-inst.com>
References: <A1F2B23A4F10D1118DDB00A0C9193FCF016C01@ALTOS> <3.0.3.32.19980108214702.006d5964@fw.itm-inst.com>
Message-Id: <34B5EB6C2AB.FF54.lau@skp.de>
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-Mailer: Becky! ver 1.20
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Greetings!

On Thu, 08 Jan 1998 21:47:02 -0500
Rick Murphy <rmurphy@itm-inst.com> wrote:

|  At 09:28 AM 1/7/98 +0100, Oliver Lau wrote:
|  >You surely haven't had a look inside stateful inspection firewalls, have
|  >you? You have to distinguish between two possibilities on how tables
|  >can become corrupt:
|  >
|  >	1.) accidentally deleted entries
|  >	2.) forged entries
|  You forgot at least one other reason:
|   - You neglected to disable IP forwarding. Before the firewall starts
|  to inspect, you're wide open.
|  Yeah, it's a "user configuration error". Unfortunately, that's the
|  way the OS works by default.

Disregarding OS's default behaviour, the situation will change rapidly,
when filtering is no longer done above the protocol stack but below.
What does this mean? When the firewall filtering engine grabs the
packets directly from the NIC driver, the packets -- depending on the
rulesets -- will never reach the protocol stack. While routing/forwarding is
done at the protocol stack, a firewall machine firing up won't let any
packets pass between the networks. 


Regards,

Oliver Lau
[CTO]
Sauer und Partner GmbH, NetzwerkTechnologie und Sicherheit
Dietrich-Bonhoeffer-Strasse 1-3, 35037 Marburg, Germany
fon: +49 6421 938300, fax: +49 6421 938390, URL: http://www.skp.de/
PGP-Fingerprint: 6696 C8B6 F351 A381  D1C9 BC41 98F2 6DE3

From firewalls-owner  Fri Jan  9 03:54:35 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id CAA00308; Fri, 9 Jan 1998 02:45:17 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id CAA24702 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 02:16:29 -0800 (PST)
Received: from promete.tetm.tubitak.gov.tr by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-970426)
	id BAA20091; Fri, 9 Jan 1998 01:17:20 -0800 (PST)
Received: from localhost by promete.tetm.tubitak.gov.tr; (5.65/1.1.8.2/27Dec95-0156PM)
	id AA02502; Fri, 9 Jan 1998 11:18:45 +0300
Date: Fri, 9 Jan 1998 11:18:44 +0300 (EET)
From: Levent Yuce <ylevent@promete.tetm.tubitak.gov.tr>
To: firewalls@GreatCircle.COM
Message-Id: <Pine.OSF.3.95.980109111544.27019A-100000@promete.tetm.tubitak.gov.tr>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Hi ,

I would like to ask how I can hide  my ip addresses from outside  
Also I want to learn if I can Hide my ip address when I make a telnet
connection ,web oriented connection ,ftp oriented connection.

With my best wishes
Levent YUCE


From firewalls-owner  Fri Jan  9 03:55:05 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id BAA17105; Fri, 9 Jan 1998 01:46:05 -0800 (PST)
Received: from guvnor.blackwell.co.uk (guvnor.blackwell.co.uk [194.130.176.129]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id BAA09681 for <firewalls@greatcircle.com>; Fri, 9 Jan 1998 01:12:29 -0800 (PST)
Received: from exchange1.blackwell.co.uk by guvnor.blackwell.co.uk (MX V4.2
          VAX) with SMTP; Fri, 09 Jan 1998 09:14:08 BST
Received: by EXCHANGE1 with Internet Mail Service (5.0.1458.49) id <ZCX5FZQ2>;
          Fri, 9 Jan 1998 09:16:21 -0000
Message-ID: <3BFE2589D330D111AE87006008062DE40DB56D@pc37.blackwell.co.uk>
From: Martin Hepworth <martin.hepworth@blackwell.co.uk>
To: "'Jesse Brown'" <bextreme@pobox.com>, firewalls@greatcircle.com
Subject: RE: HTTP/POP3/SMTP Proxies?
Date: Fri, 9 Jan 1998 09:14:17 -0000
X-Priority: 3
X-Mailer: Internet Mail Service (5.0.1458.49)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


HI
Try TIS's FWTK, works well from my own experience and from what I've
heard from others

Martin Hepworth
Blackwells Information Services
tel +44 1865 792792 x 3233

WYDSIWGY - 1st rule of computer security
What You don't See Is What Gets you

> -----Original Message-----
> From:	Jesse Brown [SMTP:bextreme@pobox.com]
> Sent:	Friday, January 09, 1998 5:58 AM
> To:	firewalls@greatcircle.com
> Subject:	HTTP/POP3/SMTP Proxies?
> 
> Hello, I was wondering if anyone had any recommendations for free
> proxy
> software that will run on x86 Linux that can either proxy HTTP, POP3,
> SMTP, etc, or just a general proxy that will allow me to redirect a
> connection like http. 
> 
> -J
> 
> --
> Jesse Brown - bextreme@pobox.com  
> 

From firewalls-owner  Fri Jan  9 03:56:48 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id BAA17278; Fri, 9 Jan 1998 01:47:38 -0800 (PST)
Received: from inet.unisource.nl (mail.inet.unisource.nl [194.151.95.4]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id BAA12876 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 01:24:47 -0800 (PST)
Received: from inet.unisource.nl (inet.unisource.nl [194.151.95.4])
	by inet.unisource.nl (8.8.5/8.8.5) with SMTP id KAA29179;
	Fri, 9 Jan 1998 10:25:26 +0100 (MET)
Date: Fri, 9 Jan 1998 10:25:26 +0100 (MET)
From: Rob Poland <rob.poland@inet.unisource.nl>
Reply-To: Rob Poland <rob.poland@inet.unisource.nl>
Subject: Re: Multiport NICs on FW1
To: Chuck Statton <chuck.statton@gte.com>
cc: fw-1-mailinglist@us.checkpoint.com, firewalls@GreatCircle.COM,
        firewall-wizards@nfr.net
In-Reply-To: <007f01bd1bca$7d3019d0$dae89788@sleepy.tmtrfl.tel.gte.com>
Message-ID: <ML-3.3.884337926.113.robp@inet.unisource.nl>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I presume you are using one interface on the Internet and the others connected
to your INTERNAL NETWORKS. 
	Is it possible to 'firewall' multiple interfaces (connected to
different ISP's) to multiple interfaces on different Internal networks with a
one to one relationship, with each a seperate set of rules, on a FW-1 or any
other FW? Which hardware configuration would be suitable (multi-processor)? Any
experiences on performance and security issues?

 ISP-1      ISP-2       ISP-3       ....     ISP-n
   |          |           |
   |          |           |
   |          |           |
  --------   --------    --------
  DMZ-1 |    DMZ-2 |     DMZ-3 |
       --------------------------
      |           FW             |
       --------------------------
        |          |          |
        |          |          |
        |          |          |
    INTERNAL   INTERNAL   INTERNAL     .....  INTERNAL
    NETWORK-1  NETWORK-2  NETWORK-3           NETWORK-n

> We currently use Sun Ultra's for all of our firewalls.  I know we have at
> least one of them running with two FDDI boards and a quad ethernet board
> (we had to remove the graphics cards to accomplish this).  I would assume
> you could use any combination.
> 
> Chuck Statton
> GTE
> -----Original Message-----
> From: Dean Ethier <Dean_Ethier@dmr.ca>
> To: fw-1-mailinglist@us.checkpoint.com <fw-1-mailinglist@us.checkpoint.com>
> Date: Wednesday, January 07, 1998 6:41 PM
> Subject: [FW1] Multiport NICs on FW1
> 
> 
> >
> >
> >I know this question has been asked here already, but here goes again.  I
> >need to talk to people who have had success in setting this up.
> >Specifically, I'm interested in finding out how many interfaces you've
> >been able to set up on a single box.  I would like to set this up on
> >something like a Compaq PrLiant 800 running NT, but I'm not totally opposed
> >to going Unix if I have to.
> >
> >TIA
> >Dean Ethier
> >DMR Consulting Group Ltd
> >dean.ethier@dmr.com

From firewalls-owner  Fri Jan  9 05:16:34 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id EAA20189; Fri, 9 Jan 1998 04:45:56 -0800 (PST)
Received: from castle.us-state.gov (castle.us-state.gov [198.76.102.19]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id EAA20179 for <Firewalls@greatcircle.com>; Fri, 9 Jan 1998 04:45:48 -0800 (PST)
Received: by castle.us-state.gov; id AA12743; Fri, 9 Jan 98 07:46:29 EST
Received: from pubhost.us-state.gov(198.76.102.34) by castle.us-state.gov via smap 
	id sma012695; Fri Jan  9 07:46:08 1998
Received: by pubhost.us-state.gov; id AA26265; Fri, 9 Jan 98 07:46:00 EST
Received: by localhost with Microsoft MAPI; Fri, 9 Jan 1998 07:41:14 -0500
Message-Id: <01BD1CD1.F62FC3F0@gcrum@us-state.gov>
From: Gary Crumrine <gcrum@us-state.gov>
Reply-To: "gcrum@us-state.gov" <gcrum@us-state.gov>
To: "'phoenix@clark.net'" <phoenix@clark.net>, Bob Bryant <rhb1@gte.com>
Cc: "rmckosky@gte.com" <rmckosky@gte.com>,
        "enorris@gte.com"
	 <enorris@gte.com>,
        "djuitt@gte.com" <djuitt@gte.com>,
        "ccarroll@gte.com" <ccarroll@gte.com>,
        Jyri Kaljundi
	 <jk@stallion.ee>,
        "Firewalls@GreatCircle.COM"
	 <Firewalls@GreatCircle.COM>
Subject: RE: ctia hotel confirmations
Date: Fri, 9 Jan 1998 07:41:12 -0500
Organization: US Dept of State
X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4025
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Kind of makes one wonder how many GTE engineers it takes to change a lightbulb.....;^)))

-----Original Message-----
From:	phoenix@clark.net [SMTP:phoenix@clark.net]
Sent:	Thursday, January 08, 1998 1:35 PM
To:	Bob Bryant
Cc:	rmckosky@gte.com; enorris@gte.com; djuitt@gte.com; ccarroll@gte.com; Jyri Kaljundi; Firewalls@GreatCircle.COM
Subject:	Re: ctia hotel confirmations

     Umm... good thing we're all friends here.  This information has
serious practical joke value.  ;)  I wonder how many cancellations The
Salt Lake City Hilton will receive...


On Wed, 7 Jan 1998, Bob Bryant wrote:

> I have confirmed with the Salt Lake City Hilton that the following hotel
> reservations have been made.
> name                    dates                   confirmation  #
> R stanley               13-16                   832781
> C Carroll               13-16                   832780
> R McKosky          12-16                   832816
> Djuitt                     13-16                   831992
> R Bryant                12-16                   832815
> E Norris                  12-16                  831991
> I did this so we would not get the "Mary and Joseph" responce in the lobby.
> 
> *******************************************************************************
> Robert Bryant                           email           rhb1@gte.com
> Member Technical Staff                  Fax             617-466-2838
> Secure Systems Department
> GTE Labrotories                         office ph       617-466-2821
> 40 Sylvan Rd    MS/55                   Cell ph         617-733-7757
> Waltham, MA 02254
> ****************************************************************************
> ***


Trees:2 Skiers:0



From firewalls-owner  Fri Jan  9 05:38:55 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id EAA20718; Fri, 9 Jan 1998 04:54:24 -0800 (PST)
Received: from stl_firewall ([192.172.5.200]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id EAA20711 for <firewalls@greatcircle.com>; Fri, 9 Jan 1998 04:54:18 -0800 (PST)
From: STEVE.CONNOLLY@arpstl-emh2.army.mil
Received: from ARPSTL-EMH2.ARMY.MIL by stl_firewall (AIX 4.1/UCB 5.64/4.03)
          id AA15250; Fri, 9 Jan 1998 06:39:39 -0600
X400-Originator: STEVE.CONNOLLY@arpstl-emh2.army.mil
X400-Recipients: firewalls@greatcircle.com
X400-Mts-Identifier: [/ADMD=BLANK/C=US/;0008200001595523000002]
X400-Content-Type: P2-1988 (22)
Message-Id: <0008200001595523000002*@MHS>
To: "        -         (052)firewalls(a)greatcircle.com" <firewalls@greatcircle.com>,
        "/S=firewalls-owner(a)GreatCircle.COM/ADMD=BLANK/C=US/"@ARPSTL-EMH2.ARMY.MIL (a)
Subject: Re:Problems with Proxy Next in Firewall-1
Date: Fri, 9 Jan 1998 07:02:46 -0500
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I'm not sure what proxy server you guys are using... but we were using
Netscape's Proxy Server ver 2.5(I think), and we were having some of the same
problems.  It ended up being that our cache was corrupted.  You may want to see
if you can clear the cache on your proxy server.

sc

____________________Reply Separator____________________
Subject:    Problems with Proxy Next in Firewall-1
Author: firewalls-owner@GreatCircle.COM
Date:       1/8/98 8:40 PM

We are a K-12 school district. Our acceptable use policy requires HTTP
users to authenticate through our firewall before allowing our users
access to the Internet. We are pointing the "Proxy Next" to a box behind

the firewall which provides filtering with SURFWATCH.

Periodically, after authenticating, the browser will say that it has
contacted the host and is waiting for a reply and finally return with
the error "Document contains no data"?



Thanks in advance,
albertk@tenet.edu

From firewalls-owner  Fri Jan  9 05:41:40 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id FAA21996; Fri, 9 Jan 1998 05:10:38 -0800 (PST)
Received: from lintjr.cisco.com (lintjr.cisco.com [171.68.10.78]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id FAA21988 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 05:10:33 -0800 (PST)
Received: from big-dawgs.cisco.com (herndon-dhcp-53.cisco.com [171.68.53.53]) by lintjr.cisco.com (8.8.5/CISCO.SERVER.1.2) with SMTP id FAA01783; Fri, 9 Jan 1998 05:10:38 -0800 (PST)
Message-Id: <3.0.5.32.19980109081035.008254a0@lint.cisco.com>
X-Sender: pferguso@lint.cisco.com
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.5 (32)
Date: Fri, 09 Jan 1998 08:10:35 -0500
To: Peter da Silva <peter@baileynm.com>
From: Paul Ferguson <ferguson@cisco.com>
Subject: Re: E-mail Encryption
Cc: macgyver@tos.net (MacGyver), firewalls@GreatCircle.COM
In-Reply-To: <9801071536.AA10534@baileynm.com>
References: <199801070018.SAA31044@starbase.tos.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 09:36 AM 1/7/98 -0600, Peter da Silva wrote:

>
>Unfortunately PGP 5.0+ encryption is incompatible with PGP 2.6, which is
>what most of the people who use PGP are using. I understand the political
>reasons for switching to D-H key exchange to get out from under RSA, but
>I'm going to stick with 2.6 until there's a really compatible upgrade path
>that works on both protocols and all platforms.
>

That's what I thought when I first upgraded from Eudora 3.0.3 to 3.0.5,
which included the Eudora Pro PGP 5.0 OEM plugin.

But it's not true.

If you go to http://www.pgp.com/products/eudora.cgi (and for a nominal
$5 fee), you'll see that it does indeed support RSA signatures.

I'm using it, and it works fine.

- paul


--
Paul Ferguson                                           ||        ||
Consulting Engineering                                  ||        ||
Herndon, Virginia   USA                                ||||      ||||
tel: +1.703.397.5938                               ..:||||||:..:||||||:..
mailto:ferguson@cisco.com                         c i s c o S y s t e m s

From firewalls-owner  Fri Jan  9 05:46:28 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id FAA24972; Fri, 9 Jan 1998 05:39:55 -0800 (PST)
Received: from loki.iss.net (loki.iss.net [208.21.0.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id FAA24924 for <firewalls@greatcircle.com>; Fri, 9 Jan 1998 05:39:42 -0800 (PST)
Received: from tdoty (tdoty.iss.net [208.21.4.61]) by loki.iss.net (8.8.7/8.7.3) with SMTP id IAA30340 for <firewalls@greatcircle.com>; Fri, 9 Jan 1998 08:40:31 -0500
Message-Id: <3.0.3.32.19980109083526.00a126a0@mail.iss.net>
X-Sender: tdoty@mail.iss.net
X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.3 (32)
Date: Fri, 09 Jan 1998 08:35:26 -0500
To: firewalls@greatcircle.com
From: Ted Doty <ted@iss.net>
Subject: Re: relative strengths of different encyrption techniques
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Thu, 8 Jan 1998 08:33:25 -0800 Mike.Skala@zool.AirTouch.COM wrote:

>A 56-bit key can be broken on average in 2(superscript: 55) = 3.6 x 10
>(superscript: 16) trials or
>
>Trials/Second       			Time Required
>1                   			10(superscript: 9) years
>10(superscript: 3)                 10(superscript: 6) years
>10(superscript: 6)                 10(superscript: 3) years
>10(superscript: 9)                 1 year
>10(superscript: 12)                10 hours

[rest of posting deleted]

There are two ways to attack ciphers: brute force key cracking (attack the
key) and cryptanalysis (attack the cipher).  Cryptanalysis, while
difficult, has shown itself to be particularly effective against naieve
encryption techniques like the Windows 95 PWL encryption.  A weak cipher is
easily broken by cryptanalysis no matter how long the key is.

The reason that most folks want to use well known ciphers like IDEA or
Triple DES is that the cipher itself is resistant to cryptanalitic
techniques.  As a result, attackers must fall back on brute force key
attacks, which are impractical for key sizes bigger than 80 bits or so.

Schneier's book is an excellent reference for cryptanalysis.

- Ted

--------------------------------------------------------------
Ted Doty, Internet Security Systems | Phone: +1 770 395 0150
41 Perimeter Center East            | Fax:   +1 770 395 1972
Atlanta, GA 30346  USA              | Web: http://www.iss.net
--------------------------------------------------------------
PGP key fingerprint: 362A EAC7 9E08 1689  FD0F E625 D525 E1BE

From firewalls-owner  Fri Jan  9 09:25:01 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA23089; Fri, 9 Jan 1998 07:58:02 -0800 (PST)
Received: from inergen.sybase.com (inergen.sybase.com [192.138.151.43]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id HAA23050 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 07:57:49 -0800 (PST)
Received: from smtp1.sybase.com (sybgate.sybase.com [130.214.220.35])
          by inergen.sybase.com (8.8.4/8.8.4) with SMTP
	  id IAA09286; Fri, 9 Jan 1998 08:00:21 -0800 (PST)
Received: from  by smtp1.sybase.com (4.1/SMI-4.1/SybH3.5-030896)
	id AB17954; Fri, 9 Jan 98 07:58:00 PST
Received: by gwwest.sybase.com(Lotus SMTP MTA v1.1 (385.6 5-6-1997))  id 88256587.005820FD ; Fri, 9 Jan 1998 08:02:36 -0800
X-Lotus-Fromdomain: SYBASENOTES
From: "Ryan Russell"<ryanr@sybase.com>
To: rmurphy@itm-inst.com
Cc: lau@skp.de, firewalls@GreatCircle.COM
Message-Id: <88256587.00577C38.00@gwwest.sybase.com>
Date: Fri, 9 Jan 1998 07:56:32 -0800
Subject: Re: Re[2]: Stateful Inspection Anyone? Explore your options.
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Fortunatly, Checkpoint finally addressed that in the install
script of 3.0.  It asks you now if you want IP forwarding off
until the firewall starts up.

                    Ryan






rmurphy@itm-inst.com on 01/08/98 06:47:02 PM

To:   lau@skp.de
cc:   firewalls@GreatCircle.COM (bcc: Ryan Russell/SYBASE)
Subject:  Re: Re[2]: Stateful Inspection Anyone?  Explore your options.




At 09:28 AM 1/7/98 +0100, Oliver Lau wrote:
>You surely haven't had a look inside stateful inspection firewalls, have
>you? You have to distinguish between two possibilities on how tables
>can become corrupt:
>
>    1.) accidentally deleted entries
>    2.) forged entries
You forgot at least one other reason:
 - You neglected to disable IP forwarding. Before the firewall starts
to inspect, you're wide open.
Yeah, it's a "user configuration error". Unfortunately, that's the
way the OS works by default.
     -Rick






From firewalls-owner  Fri Jan  9 09:47:22 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA29575; Fri, 9 Jan 1998 08:37:38 -0800 (PST)
Received: from hosaka.smallworks.com (hosaka.SmallWorks.COM [192.207.126.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id IAA29542 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 08:37:30 -0800 (PST)
Received: from steve.smallworks.com (steve.SmallWorks.COM [192.207.126.59])
	by hosaka.smallworks.com (8.8.7/8.8.7) with SMTP id KAA00675
	for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 10:38:21 -0600 (CST)
Message-Id: <3.0.3.32.19980109103204.006c54c4@smallworks.com>
X-Sender: steve@smallworks.com
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Fri, 09 Jan 1998 10:32:04 -0600
To: firewalls@GreatCircle.COM
From: Steve Bagwell <steve@smallworks.com>
Subject: Re: usubscribe firewalls
In-Reply-To: <34B52294.50219B8@ispnsp.net>
References: <199712090603.WAA16035@honor.greatcircle.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


 usubscribe firewalls

----------------------------------------------------------------------------
---------
             Steve Bagwell /SmallWorks, Inc. /steve@smallworks.com
                   ph512.338.0619-x305 / F512.338.0625		      
4501 Spicewood Springs rd. #1001,   Austin, TX 78759

http://www.smallworks.com     
----------------------------------------------------------------------------
----------

From firewalls-owner  Fri Jan  9 10:01:52 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA15121; Fri, 9 Jan 1998 07:11:06 -0800 (PST)
Received: from outside.grey.net ([205.189.82.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id HAA15091 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 07:10:56 -0800 (PST)
Received: (from denny@localhost)
	by outside.grey.net (8.8.7/8.8.7) id KAA03011;
	Fri, 9 Jan 1998 10:09:33 -0500
Message-ID: <19980109100932.37293@outside.grey.net>
Date: Fri, 9 Jan 1998 10:09:32 -0500
From: "Douglas A. Denny" <denny@sprint.ca>
To: Christian Reiser <C.Reiser@Austria.EU.net>
Cc: firewalls@GreatCircle.COM
Subject: Re: SKIP question
References: <199801081620.JAA06461@zeus.atsi.com> <199801090823.JAA02875@vindobona.intern.austria.eu.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 0.88e
In-Reply-To: <199801090823.JAA02875@vindobona.intern.austria.eu.net>; from Christian Reiser on Fri, Jan 09, 1998 at 09:23:08AM +0100
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Fri, Jan 09, 1998 at 09:23:08AM +0100, Christian Reiser wrote:

> I am afraid, this won't help very much, but I prefere VPN-solutions, where I
> don't depend on any IP infrastructural feature of an ISP. What if the external
> PC is travelling around using a great number of different ISPs to dial into
> the Net and connect to your site?

	As I understand the inner workings of SKIP, it _is_ ISP IP structure
free for the clients. Servers do have dedicated IP numbers, but the beauty of
SKIP clients is that it is a) stateless b) clients are supported on most major
platforms c) interoperable between all SKIP implementations. Skip is skip is
skip. There is a SKIP specific mailing list hosted by Sun.

Check out:
http://www.sun.com/security/skip/
http://skip.incog.com/



From firewalls-owner  Fri Jan  9 11:25:52 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id KAA26603; Fri, 9 Jan 1998 10:46:10 -0800 (PST)
Received: from fw.itm-inst.com ([206.239.41.100]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA15803 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 09:56:20 -0800 (PST)
Received: by fw.itm-inst.com; id MAA20488; Fri, 9 Jan 1998 12:55:49 -0500 (EST)
Received: from unknown(10.0.3.121) by fw.itm-inst.com via smap (2.0)
	id xma020485; Fri, 9 Jan 98 12:55:36 -0500
Message-Id: <3.0.3.32.19980109124728.006c4fa4@fw.itm-inst.com>
X-Sender: rmurphy@fw.itm-inst.com
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Fri, 09 Jan 1998 12:47:28 -0500
To: "Michael H. Warfield" <mhw@wittsend.com>
From: Rick Murphy <rmurphy@itm-inst.com>
Subject: Re: Re[2]: Stateful Inspection Anyone?  Explore your options.
Cc: lau@skp.de, firewalls@GreatCircle.COM
In-Reply-To: <199801090455.XAA11337@alcove.wittsend.com>
References: <3.0.3.32.19980108214702.006d5964@fw.itm-inst.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

At 11:55 PM 1/8/98 -0500, Michael H. Warfield wrote:
>	Gee Wiz!  I'll bet if you forget to disable IP forwarding on a
>Proxy firewall, that firewall will be real useful too!  Or how about
Any commercial firewall that depends on the setting of the IP forwarding
flag is broken, IMHO.
At the very least, the firewall software should lock something this
simple down during installation..
	-Rick


From firewalls-owner  Fri Jan  9 12:17:29 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA15741; Fri, 9 Jan 1998 07:15:56 -0800 (PST)
Received: from gateway.reims.net (gateway.reims.net [194.75.234.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id HAA15540 for <firewalls@greatcircle.com>; Fri, 9 Jan 1998 07:14:53 -0800 (PST)
Received: by gateway.reims.net; id PAA24980; Fri, 9 Jan 1998 15:15:55 GMT
Received: from smtpgate.saa-cons.co.uk(10.10.10.182) by gateway.reims.net via smap (3.2)
	id xma024956; Fri, 9 Jan 98 15:15:31 GMT
Received:  by smtpgate.saaconsultants.com (8.6.8.1/1.3-eef)
	id PAA23858; Fri, 9 Jan 1998 15:19:24 GMT
Received: from haddock.saa-cons.co.uk(10.1.11.2) by amnesiac via smap (V1.3)
	id sma023856; Fri Jan  9 15:19:22 1998
Received: from localhost by haddock.saa-cons.co.uk (AIX 3.2/UCB 5.64/5.00)
          id AA21498; Fri, 9 Jan 1998 15:15:51 GMT
Date: Fri, 9 Jan 1998 15:15:51 +0000 (GMT)
From: Dave Roberts <dave.roberts@saaconsultants.com>
To: "H. Morrow Long" <morrow.long@yale.edu>
Cc: Firewalls Mailing List <firewalls@greatcircle.com>
Subject: Re:  Re[2]: Hardware for seperating LAN from dialouts
In-Reply-To: <199801061522.KAA17141@SPARKY.CF.CS.YALE.EDU>
Message-Id: <Pine.A32.3.96.980109151225.21985A-100000@haddock.saa-cons.co.uk>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Tue, 6 Jan 1998, H. Morrow Long wrote:

> You have to be very careful about file/disk shares on Windows 95 PCs,
> when dialing out to the Internet.  Most "shares" that users have set
> up are very insecurely passworded and are read/write.  Filesharing
> should be turned off if you are connected to the Internet and 
> NetBIOS over TCP/IP (esp. TCP port 139) is not filtered out.

Yeah, and how many of us are constantly logging denied packets on our
external router destined for ports 137-139?  How many insecure machines
does *that* equate to?  And I don't think this is limited to just home
users either!  

- Dave.


From firewalls-owner  Fri Jan  9 12:47:36 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA02481; Fri, 9 Jan 1998 11:05:35 -0800 (PST)
Received: from raven.axent.com (raven.axent.com [205.159.112.243]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id LAA02339 for <firewalls@greatcircle.com>; Fri, 9 Jan 1998 11:05:05 -0800 (PST)
Received: by raven.axent.com with Internet Mail Service (5.0.1458.49)
	id <CT07HKQ8>; Fri, 9 Jan 1998 12:08:37 -0700
Message-ID: <D76E0932FE4ED11196880060B06716E90DF8BE@raven.axent.com>
From: Darin Fisher <oz@axent.com>
To: "'Ted Doty'" <ted@iss.net>, firewalls@greatcircle.com
Subject: RE: Firewall Audit Tools
Date: Fri, 9 Jan 1998 12:08:35 -0700
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1458.49)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Depending on the platform you are using, we have products for this type
of monitoring.

check out:

	http://www.axent.com

thanx
darin

----
#include <cya/company/disclaim.h>
"In order to succeed, one must pay attention" 

-----Original Message-----
From: Ted Doty [mailto:ted@iss.net]
Sent: Friday, January 09, 1998 6:56 AM
To: firewalls@greatcircle.com
Subject: Re: Firewall Audit Tools


On Thu, 8 Jan 1998 21:51:00 Jeffrey Loewenstein <edpaudit@i-2000.com>
wrote:

>There are tools that can be used for auditing and reviewing Internet
security at 
> an outfit called ISS. I think their Web site is www.iss.com

Actually, that's www.iss.net

There is an iss.com, but they don't have firewall monitoring tools.

- Ted

--------------------------------------------------------------
Ted Doty, Internet Security Systems | Phone: +1 770 395 0150
41 Perimeter Center East            | Fax:   +1 770 395 1972
Atlanta, GA 30346  USA              | Web: http://www.iss.net
--------------------------------------------------------------
PGP key fingerprint: 362A EAC7 9E08 1689  FD0F E625 D525 E1BE

From firewalls-owner  Fri Jan  9 13:24:21 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id FAA27126; Fri, 9 Jan 1998 05:53:05 -0800 (PST)
Received: from rohan.btg.com (rohan.btg.com [199.29.53.67]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id FAA27092 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 05:52:51 -0800 (PST)
Received: from fsapc.btg.com (fsa-pc.btg.com [208.213.184.104]) by rohan.btg.com (8.8.5/8.7.3) with SMTP id IAA22272; Fri, 9 Jan 1998 08:53:40 -0500 (EST)
Received: by localhost with Microsoft MAPI; Fri, 9 Jan 1998 08:50:44 -0500
Message-ID: <01BD1CDB.ABFF6920.scot@btg.com>
From: scot <scot@btg.com>
Reply-To: "scot@btg.com" <scot@btg.com>
To: "'Johan Teekens'" <calculus@pi.net>,
        "firewalls@GreatCircle.COM"
	 <firewalls@GreatCircle.COM>
Subject: RE: IBM firewall
Date: Fri, 9 Jan 1998 08:50:41 -0500
Organization: IOD
X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Well, you do know what "AIX" stands for, don't you?

"AIX" == "Ain't Unix"

Now, don't get me wrong, I think it's a GREAT operating 
system.  Driver development for it is a memorable, 
gratifying experience.  Software distribution is a dream 
come true.

But, as I said, it Ain't Unix.

--------------------------------------------------------  
---------
Scot Anderson | 703-383-7950 | SkyTel 800-413-4612
--If you're not part of the solution, you're part of the 
precipitate

On Thursday, January 08, 1998 11:55 AM, Johan Teekens 
[SMTP:calculus@pi.net] wrote:
> Next week an RS6000, model 43p, with AIX, is going to be
> delivered to me,
> on wich I have to install the IBM firewall, this is not
> exactly what I
> wanted, I wanted Raptor or Linux, but for political
> reasons we have to buy
> the IBM firewall.
> Has anyone any experience with it, what are the
> advantages? How stable is
> it? Where are it's holes?
>
> It's not that I don' t trust it or anything, but this
> software is quite new
> for me, and the art of automation this to decrease the
> risk of anything
> going wrong, I can't estimate that risk at the moment.
>
> Can anyone tell me what is going to happen to me?

From firewalls-owner  Fri Jan  9 13:32:20 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA00247; Fri, 9 Jan 1998 08:41:22 -0800 (PST)
Received: from mail.diginsite.com (mail.diginsite.com [208.2.189.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id IAA00230 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 08:41:16 -0800 (PST)
Received: from localhost (dlang@localhost)
	by mail.diginsite.com (8.8.8/8.8.6) with SMTP id JAA30640;
	Fri, 9 Jan 1998 09:33:33 -0800
Date: Fri, 9 Jan 1998 09:33:32 -0800 (PST)
From: David Lang <dlang@diginsite.com>
To: Christian Reiser <C.Reiser@Austria.EU.net>
cc: firewalls@GreatCircle.COM
Subject: Re: Firewall for ISP
In-Reply-To: <199801090814.JAA02861@vindobona.intern.austria.eu.net>
Message-ID: <Pine.LNX.3.96.980109093141.30456A-100000@mail.diginsite.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Cisco tells me that the only way they have to do anything other then by ip
address is to setup a tacas or radius server on a network (a problem if
you are trying to use it to seperate two sections of a company and don't
really want to consider either side "trusted")

david Lang

On Fri, 9 Jan 1998, Christian Reiser wrote:

> 
> >[Why have a config file of 400+ lines on a PIX?]
> >
> >as you need a different line for each source/destination/service
> >combination it can add up quickly.
> >
> >Case in point (from an internal firewall implementation with the PIX)
> >
> >10 source machines
> >10 destinations
> >6 services telnet, ftp, dns, mail, web, ssl
> >600 lines (assuming you are needing to let them in from the "outside"
> 
> Well, for me this assumption is wrong. I would not let anybody in over my
> firewall based on the IP-Adress. This is error prone and very unhandy
> especially if ISPs use dynamic IPs for dial-in. Authentication from the
> outside to the internal network has to be done by cryptography. I implement
> VPNs, for example the AltaVista Tunnel. So I have only two lines for that on
> the PIX.
> 
> If it comes to the question, who is allowed to connect to the internet from
> the internal network (something I am asked quite frequently), I propose having
> an internal cashing proxy (usefull anyway), with the permission stuff done
> there. This is much simpler and nobody has to touch the firewall just because
> somebody new has joined the company.
> 
> Greatings from Vienna/Austria
> mfg
> CR
> 
> -- 
> Christian Reiser (EUnet Austria)      e-mail: C.Reiser@Austria.EU.net
> Tel: +431 899 33-0                         http://www.Austria.EU.net/
> Fax: +431 899 33-533        CR86-RIPE         priv: C.Reiser@ieee.org
>       To get my PGP-Key send e-mail with Subject: Query PGP Key
> 


From firewalls-owner  Fri Jan  9 14:09:56 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA03306; Fri, 9 Jan 1998 08:58:23 -0800 (PST)
Received: from mailrelay.atsi.com ([204.209.211.162]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id IAA03149 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 08:57:45 -0800 (PST)
Received: (from styx@localhost) by mailrelay.atsi.com (8.7.5/8.6.9) id LAA07643; Fri, 9 Jan 1998 11:03:55 -0700
Received: from mailhub.atsi.com by mailrelay.atsi.com via smap (V2.0)
	id xma007640; Fri, 9 Jan 98 11:03:44 -0700
Received: from zeus.atsi.com (BRobinson@atsi.com) by atsi.com (8.8.7/8.8.7) with SMTP id JAA06802; Fri, 9 Jan 1998 09:55:27 -0700 (MST)
Received: by zeus.atsi.com (SMI-8.6/SMI-SVR4)
	id JAA06715; Fri, 9 Jan 1998 09:59:51 -0700
Date: Fri, 9 Jan 1998 09:59:51 -0700
Message-Id: <199801091659.JAA06715@zeus.atsi.com>
From: Bret Robinson <brobinso@atsi.com>
To: C.Reiser@Austria.EU.net
CC: firewalls@GreatCircle.COM
In-reply-to: <199801090823.JAA02875@vindobona.intern.austria.eu.net> (message
	from Christian Reiser on Fri, 9 Jan 1998 09:23:08 +0100)
Subject: Re: SKIP question
References:  <199801090823.JAA02875@vindobona.intern.austria.eu.net>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> >I have a question about SKIP that I hope someone can help me with. We are
> >testing a set-up that will allow employees to access our internal network
> >from home and also allow us to connect to partners' sites using SKIP. The
> >two set-ups are shown below:
> 
> [lots of problems with SKIP deleted]
> 
> I am afraid, this won't help very much, but I prefere VPN-solutions, where I
> don't depend on any IP infrastructural feature of an ISP. What if the external
> PC is travelling around using a great number of different ISPs to dial into
> the Net and connect to your site?
> 

The EFS/SKIP software can take this into account, but it makes things
insecure since you basically have to define a rule that allows any
IP address to connect with the remote machine's defined public key. 

> There are products out there, where encrypted IP-tunneling over IP is
> done. Some of them are even independend of the firewall (no CPU-power needed
> there, no maintenance/changes for new users). Well, they don't use standard
> protocols, but so what, I doubt, wether two different SKIP-products would work
> together.

How are these VPN products independent of the firewall? You still need to
have some dual-homed host (firewall) to provide some type of protection to
your internal network. The other product we have looked at for this is the
AltaVista Tunnel which provides similar functionality but uses a
proprietary encryption method. With this I still route all encrypted
traffic through a firewall and do some filtering based on addresses and can
use authentication at the firewall before the encrypted packets even get a
chance to make it through the firewall. DEC also provides a proxy that
makes sure the packets coming through at least *look* like valid encrypted
packets. 

Thanks, Bret.

| Bret Robinson, Snr. System Admin    \       Voice: +1-403-213-8413        |
| Applied Terravision Systems, Inc.    \        Fax: +1-403-264-2122        | 
| Calgary, Alberta     Canada           \     Web site: www.atsi.com        |
| BRobinson@atsi.com                     \                                  |
|       "Keep your stick on the ice"      \___ o  <- puck (for US viewers)  |

From firewalls-owner  Fri Jan  9 14:19:13 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id NAA05615; Fri, 9 Jan 1998 13:49:45 -0800 (PST)
Received: from inergen.sybase.com (inergen.sybase.com [192.138.151.43]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id NAA05550 for <Firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 13:49:30 -0800 (PST)
Received: from smtp1.sybase.com (sybgate.sybase.com [130.214.220.35])
          by inergen.sybase.com (8.8.4/8.8.4) with SMTP
	  id NAA24987; Fri, 9 Jan 1998 13:52:11 -0800 (PST)
Received: from gwwest.sybase.com by smtp1.sybase.com (4.1/SMI-4.1/SybH3.5-030896)
	id AA16573; Fri, 9 Jan 98 13:49:54 PST
Received: by gwwest.sybase.com(Lotus SMTP MTA v1.1 (385.6 5-6-1997))  id 88256587.00785F2F ; Fri, 9 Jan 1998 13:54:46 -0800
X-Lotus-Fromdomain: SYBASENOTES
From: "Ryan Russell"<ryanr@sybase.com>
To: StoutW@pios.com
Cc: Firewalls@GreatCircle.COM
Message-Id: <88256587.007623F1.00@gwwest.sybase.com>
Date: Fri, 9 Jan 1998 13:48:46 -0800
Subject: RE: RE: Stateful Inspection Anyone? Session limits on state
	-tracking systems?
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


If I'm following your statement correctly, I can confirm
the DoS possibility, at least on Firewall-1.  Back with 2.0,
I was getting frequent crashes where the firewall was complaining
of being unable to allocate "cookies" and other things (I don't
know exactly what Checkpoint means by cookie in this
contetext, but evidently, I'd run out.)

The symptom was that CPU usage would max out, and I'd have
to reboot the machine to clear the problem.  Sometimes the CPU
wpuld be pegged so bad that I'd have to reboot ungracefully, sometimes
corrupting files.  The corrupting of files seemed to be the worst
consequence
of this problem.  If it was *has* to max out, refusing new connections
is the "correct" way to deal with it, though I'd obviously have liked
to see it be a bit more graceful.

I'm not privy to the internals, but I don't believe this was case
of the state table being corrupt, just full.

The fix was to allocate more memory to the firewall
(fwhmem, whatever part of the firewall that is.)

Recently, I'd wiped my firewall clean, and reloaded the OS.  I'd
forgotten to put the fwhmem line back in (it goes in /etc/system on
my SOlaris machine.)  I was running FW1 3.0 at this point, and it
ran happily for a few months that way, so I assume Checkpoint
has changed some default allocations, or improved the way they
handle that table, or something.

It was fine, until I ran the ISS security scanner from the inside, to the
outside
of my FW1.  That caused the symptoms I'd seen with 2.0.  So, I conclude
that enough new connections can still fill up the state table.  I've put
the fwhmem parameter back, but haven't retried the ISS scan yet.
Near as I can tell, that san represented 10's of thousands of connections
withing a few minutes.

Again, while I would have like to have seen something more graceful
than screeching to a halt, it didn't appear to have corrupted the state
table, just filled it.  I see this as being roughly analogous to the
TCP SYN DoS problem.  OS vendors have gotten smarter about
how they deal with that.  Presumably, if lots of folks started doing this
type of attack against FW1's, Checkpoint would get smarter about how
they handle it.  I've had proxy's behave similar (SOCKS 4) in that the
proxy would stop responding under low memory/underpowered
machine circumstances.

I see the problem of filling SPF state tables up vs. whatever problems
AGs exhibit under extream load as being different, but not neccessarily
worse.

                         Ryan





StoutW@pios.com on 01/09/98 09:59:03 AM

To:   Firewalls@GreatCircle.COM
cc:    (bcc: Ryan Russell/SYBASE)
Subject:  RE: RE: Stateful Inspection Anyone?   Session limits on
      state-tracking systems?


I'd like someone to verify this:
One interesting thing I've noticed is that for a high-session site,
state-based filters have a smaller established session capacity than
services it protects.  The memory-resident state-table which maintains
session state can only be so big in stack shims and router-based
state-systems.  I would think that disk-based state-table would have a
bit of an impact on performancenwriting/reading to disk for a for every
new packet, not helping the situation.  If the webserver (farm) is
serving many established sessions with small packets, the state-based
system appears to become overwhelmed, the packet-filter locks up, and
needs to be hard-booted to recover.  Theoretically state-based systems
can be DOS'd by establishing, holding, and queueing up more TCP sessions
to (protected) servers than the state-based system can handle.  A proxy
server on the other hand acts like the application it protects, so no
'weirdness' occurs.
Note this is not a bandwidth issue, but an established TCP session
issue.
Bill Stout






From firewalls-owner  Fri Jan  9 14:24:32 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA01612; Fri, 9 Jan 1998 08:48:02 -0800 (PST)
Received: from mercury.Sun.COM (mercury.Sun.COM [192.9.25.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id IAA01584 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 08:47:51 -0800 (PST)
Received: from Eng.Sun.COM ([129.144.134.6]) by mercury.Sun.COM (SMI-8.6/mail.byaddr) with SMTP id IAA00916; Fri, 9 Jan 1998 08:48:38 -0800
Received: from basilisk.Eng.Sun.COM (basilisk.Eng.Sun.COM [129.144.49.2])
	by Eng.Sun.COM (SMI-8.6/SMI-5.3) with SMTP id IAA23503;
	Fri, 9 Jan 1998 08:48:36 -0800
Received: from wolfe by basilisk.Eng.Sun.COM (SMI-8.6/SMI-SVR4)
	id IAA21377; Fri, 9 Jan 1998 08:48:29 -0800
Date: Fri, 9 Jan 1998 09:47:25 -0700 (MST)
From: "Gary R. Wolfe" <Gary.Wolfe@Eng.Sun.COM>
Reply-To: "Gary R. Wolfe" <Gary.Wolfe@Eng.Sun.COM>
Subject: Re: SKIP question
To: Bret Robinson <brobinso@atsi.com>
Cc: firewalls@GreatCircle.COM
In-Reply-To: "Your message with ID" <199801081620.JAA06461@zeus.atsi.com>
Message-ID: <Roam.SIMC.2.0.6.884364445.17360.wolfe@basilisk>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> I have a question about SKIP that I hope someone can help me with. We are
> testing a set-up that will allow employees to access our internal network
> from home and also allow us to connect to partners' sites using SKIP. The
> two set-ups are shown below:
> 
>    Employee access                Partner site access
>   -----------------              ---------------------
> 
>       home-pc                        partner network
>          |                                  |
>          |                                  |
>          |                                  |
>          |                                  |
>     SKIP firewall                     SKIP firewall
>          |                                  |
>          |                                  |
>          |                                  |
>          |                                  |
>    internal host(s)                   SKIP firewall
>                                             |
>                                             |
>                                             |
>                                             |
>                                       internal host(s)
> 
> 
> 
> Access between both the home-pc and SKIP firewall/gateway and between the
> two SKIP firewall/gateways is across the local cable companies network 
> (ie - Internet/untrusted network). The product(s) that we are testing is
> Sun's SKIP and their EFS software that runs on the SKIP firewall. We have
> also done the same test using just SKIP - without the EFS. Connecting to an
> internal host from the PC (using SKIP for Win95) was working until the
> cable company reconfigured their routers. We are using an "unregistered"
> network address on our internal network and it turns out that packets being
> sent back to the PC have a source address of the internal machine.

SunScreen EFS supports NAT. Can you NAT the internal hosts that have
unregistrered IP addresses? 

> The
> routers are configured to drop any packets that *don't* have a source
> address of the our DMZ. Sooo, my question is does any one know how to
> configure SKIP (or EFS) so that the packets going back to the PC through
> the SKIP firewall have the source address re-written with the address of
> the external interface of that machine. 

I would try NAT first. You could also use tunnel mode for both Win 95 SKIP and
SUnScreen EFS. (Note: tunneling for WIN95 is available on latest release
12/27/97).

> We did get this to work using EFS,
> but the PC doesn't seem to want to look inside that packet to find the
> *real* IP packet. Is there something that we need to configure on the PC to
> see the encrypted packet? Or is there something else missing in the config
> of the SKIP firewall? Also, is the set-up we are trying to achieve with our
> business partners possible just using SKIP? Its probably possible with SKIP
> and EFS, but we don't want to have all our partners go out and by a new
> Sparc and SKIP/EFS. We are hoping we can use Solaris x86 and SKIP for the
> SKIP firewalls/gateways.

With the tunneling feature os SKIP now in Win95 product you shoul have no
problem. But, again, I think NAT should solve your problem.

> 
> The home-pc has been configured to use encryption between itself and the
> external interface of the SKIP gateway and also between itself and the
> internal network using the SKIP gateway as the "tunnel".
> 
> The SKIP firewall/gateway is a Sparc Ultra running both SKIP and EFS. We
> are also testing using another gateway running Solaris x86 with just
> SKIP. Both are running Solaris 2.5.1.
> 
> The local Sun SE's have not been able to resolve the question yet. They
> also tell me that SKIP encrypts the entire IP packet and puts it into
> another packet (as the data portion) regardless of whether the packet is
> going through a tunnel or not. Is this true?
> 

yes that is true. With SKIP, the entire original IP packet is encrypted and
then a new IP header is prepended. The default is to use the same src and dest
IP addresses as the original. With tunneling, we use different src and dest IP
addresses as defined by the tunnel.


Thanks,
Gary

=========================================================================

    /\      Gary R. Wolfe
   \\ \     Network Security Specialist
  \ \\ /    Sun Microsystems
 / \/ / /   Internet Commerce and Security
/ /   \//\  
\//\   / /  
 / / /\ /   http://www.sun.com/security
  / \\ \    Cell Phone:    (719) 331-7912
   \ \\     Fax:           (719) 481-1273
    \/      E-mail:        gary.wolfe@sun.com
           
=========================================================================




From firewalls-owner  Fri Jan  9 14:28:38 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA11350; Fri, 9 Jan 1998 06:53:32 -0800 (PST)
Received: from icosrt1.icos-informatik.de (icos-gw.isdn.she.de [193.141.149.102]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id GAA11166 for <firewalls@greatcircle.com>; Fri, 9 Jan 1998 06:52:59 -0800 (PST)
Received: from icos-informatik.de ([194.122.37.132])
          by icosrt1.icos-informatik.de (8.8.4/8.8.4) with ESMTP
	  id PAA00217; Fri, 9 Jan 1998 15:55:09 +0100
Message-ID: <34B639ED.184057A1@icos-informatik.de>
Date: Fri, 09 Jan 1998 15:53:33 +0100
From: Yasar Arman <yasar@icos-informatik.de>
Organization: ICOS Informatik GmbH
X-Mailer: Mozilla 4.04 [en] (WinNT; I)
MIME-Version: 1.0
To: Levent Yuce <ylevent@promete.tetm.tubitak.gov.tr>
CC: firewalls@greatcircle.com
Subject: Re: hiding IP-Adress
References: <Pine.OSF.3.95.980109111544.27019A-100000@promete.tetm.tubitak.gov.tr>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Levent Yuce wrote:
> 
> Hi ,

Hi,

> 
> I would like to ask how I can hide  my ip addresses from outside
> Also I want to learn if I can Hide my ip address when I make a telnet
> connection ,web oriented connection ,ftp oriented connection.

As I would say, just use proxies and/or IP-Masquerading. a well configured linux box does this for
you with minimal costs.

> 
> With my best wishes
> Levent YUCE

selamlar (mean greetings) 

Yasar Arman
-- 
Don't SPAM me or I'll sue YOU!

From firewalls-owner  Fri Jan  9 15:49:58 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id OAA20544; Fri, 9 Jan 1998 14:57:41 -0800 (PST)
Received: from hq.si.net (hq.si.net [192.156.192.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id OAA20482 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 14:57:24 -0800 (PST)
Received: from hq.si.net (hq [192.156.192.10]) by hq.si.net (8.8.5/8.7.3) with SMTP id SAA17620; Fri, 9 Jan 1998 18:00:07 -0500 (EST)
Date: Fri, 9 Jan 1998 18:00:07 -0500 (EST)
From: Ming Lu <mlu@hq.si.net>
To: Simon K Ash <simon.ash@eudoramail.com>
cc: firewalls@GreatCircle.COM
Subject: Re: Proxy server to hide IP Add.. from your Firewall
In-Reply-To: <DEPNKAAJNCMOHAAA@shared1-mail.whowhere.com>
Message-ID: <Pine.SOL.3.91.980109175917.3456I-100000@hq.si.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Yes, I did it before. It worked fine.

_ming

On Thu, 8 Jan 1998, Simon K Ash wrote:

> Question 1
> 
> Is it possible to use a proxy server (such a MS Proxy) inside Firewall-1, to hide
> a group of IP Addresses from Firewall-1. This would allow you to buy a 100 node licence
> and have it protecting 250 in reality, and greatly reduce the cost of Firewall-1.
> 
> 
> Can anyone see any problems with this concept?
> 
> 
> 
> Join 18 million Eudora users by signing up for a free Eudora Web-Mail account at http://www.eudoramail.com
> 

From firewalls-owner  Fri Jan  9 16:04:47 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA27204; Fri, 9 Jan 1998 15:34:39 -0800 (PST)
Received: from gargoyle.clark.net (pm1-28.dcwt.infi.net [208.136.65.28]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id PAA27195 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 15:34:32 -0800 (PST)
Received: (qmail 2899 invoked by uid 500); 9 Jan 1998 23:42:34 -0000
Date: Fri, 9 Jan 1998 18:42:34 -0500 (EST)
From: "Paul D. Robertson" <proberts@clark.net>
X-Sender: proberts@gargoyle
To: Ming Lu <mlu@hq.si.net>
cc: Simon K Ash <simon.ash@eudoramail.com>, firewalls@GreatCircle.COM
Subject: Re: Proxy server to hide IP Add.. from your Firewall
In-Reply-To: <Pine.SOL.3.91.980109181723.3456M-100000@hq.si.net>
Message-ID: <Pine.LNX.3.91.980109183942.1955C-100000@gargoyle>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Fri, 9 Jan 1998, Ming Lu wrote:

> I don't think so, as long as you use cross over cable connetc the proxy 
> server and firewall together, then rest of stations or lines go through
> proxy. you did not valid any integrity of the firewall at all.

My read of every per-node license agreement I've seen counts nodes as on the
internal network irregardless of the presence of screening routers, 
application gateways, or indeed other firewall products in multi-tier 
configurations.  If you ask Checkpoint directly if this is a violation of 
their license agreement, I doubt that you'll get a different answer.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
proberts@clark.net      which may have no basis whatsoever in fact."
                                                                     PSB#9280


From firewalls-owner  Fri Jan  9 16:46:30 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id OAA20939; Fri, 9 Jan 1998 14:59:28 -0800 (PST)
Received: from mail.diginsite.com (mail.diginsite.com [208.2.189.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id OAA20822 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 14:58:49 -0800 (PST)
Received: from localhost (dlang@localhost)
	by mail.diginsite.com (8.8.8/8.8.6) with SMTP id PAA07412;
	Fri, 9 Jan 1998 15:51:07 -0800
Date: Fri, 9 Jan 1998 15:51:07 -0800 (PST)
From: David Lang <dlang@diginsite.com>
To: Bret Robinson <brobinso@atsi.com>
cc: C.Reiser@Austria.EU.net, firewalls@GreatCircle.COM
Subject: Re: SKIP question
In-Reply-To: <199801091659.JAA06715@zeus.atsi.com>
Message-ID: <Pine.LNX.3.96.980109154958.30456V-100000@mail.diginsite.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



On Fri, 9 Jan 1998, Bret Robinson wrote:

> > 
> > >I have a question about SKIP that I hope someone can help me with. We are
> > >testing a set-up that will allow employees to access our internal network
> > >from home and also allow us to connect to partners' sites using SKIP. The
> > >two set-ups are shown below:
> > 
> > [lots of problems with SKIP deleted]
> > 
> > I am afraid, this won't help very much, but I prefere VPN-solutions, where I
> > don't depend on any IP infrastructural feature of an ISP. What if the external
> > PC is travelling around using a great number of different ISPs to dial into
> > the Net and connect to your site?
> > 
> 
> The EFS/SKIP software can take this into account, but it makes things
> insecure since you basically have to define a rule that allows any
> IP address to connect with the remote machine's defined public key. 
> 

can you do this for many remote machines? i.e. 20 sales laptops that you
have the keys for that may connect from anywhere.

david Lang



From firewalls-owner  Fri Jan  9 17:01:33 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA25380; Fri, 9 Jan 1998 15:20:13 -0800 (PST)
Received: from hq.si.net (hq.si.net [192.156.192.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id PAA25361 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 15:20:07 -0800 (PST)
Received: from hq.si.net (hq [192.156.192.10]) by hq.si.net (8.8.5/8.7.3) with SMTP id SAA17838; Fri, 9 Jan 1998 18:22:47 -0500 (EST)
Date: Fri, 9 Jan 1998 18:22:47 -0500 (EST)
From: Ming Lu <mlu@hq.si.net>
To: "Paul D. Robertson" <proberts@clark.net>
cc: Simon K Ash <simon.ash@eudoramail.com>, firewalls@GreatCircle.COM
Subject: Re: Proxy server to hide IP Add.. from your Firewall
In-Reply-To: <Pine.LNX.3.91.980109015340.500A-100000@gargoyle>
Message-ID: <Pine.SOL.3.91.980109181723.3456M-100000@hq.si.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


I don't think so, as long as you use cross over cable connetc the proxy 
server and firewall together, then rest of stations or lines go through
proxy. you did not valid any integrity of the firewall at all.

_ming

On Fri, 9 Jan 1998, Paul D. Robertson wrote:

> On Thu, 8 Jan 1998, Simon K Ash wrote:
> 
> > Question 1
> > 
> > Is it possible to use a proxy server (such a MS Proxy) inside Firewall-1, to hide
> > a group of IP Addresses from Firewall-1. This would allow you to buy a 100 node licence
> > and have it protecting 250 in reality, and greatly reduce the cost of Firewall-1.
> > 
> > 
> > Can anyone see any problems with this concept?
> 
> It's a violation of the license agreement and can get you sued.
> It's unethical as well.
> 
> Paul
> -----------------------------------------------------------------------------
> Paul D. Robertson      "My statements in this message are personal opinions
> proberts@clark.net      which may have no basis whatsoever in fact."
>                                                                      PSB#9280
> 
> 

From firewalls-owner  Fri Jan  9 17:13:05 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA26166; Fri, 9 Jan 1998 15:23:59 -0800 (PST)
Received: from mailrelay.atsi.com ([204.209.211.162]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id PAA26159 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 15:23:52 -0800 (PST)
Received: (from styx@localhost) by mailrelay.atsi.com (8.7.5/8.6.9) id RAA14198; Fri, 9 Jan 1998 17:30:27 -0700
Received: from mailhub.atsi.com by mailrelay.atsi.com via smap (V2.0)
	id xma014196; Fri, 9 Jan 98 17:30:10 -0700
Received: from zeus.atsi.com (BRobinson@atsi.com) by atsi.com (8.8.7/8.8.7) with SMTP id QAA13191; Fri, 9 Jan 1998 16:21:51 -0700 (MST)
Received: by zeus.atsi.com (SMI-8.6/SMI-SVR4)
	id QAA06772; Fri, 9 Jan 1998 16:26:16 -0700
Date: Fri, 9 Jan 1998 16:26:16 -0700
Message-Id: <199801092326.QAA06772@zeus.atsi.com>
From: Bret Robinson <brobinso@atsi.com>
To: dlang@diginsite.com
CC: firewalls@GreatCircle.COM
In-reply-to: <Pine.LNX.3.96.980109154958.30456V-100000@mail.diginsite.com>
	(message from David Lang on Fri, 9 Jan 1998 15:51:07 -0800 (PST))
Subject: Re: SKIP question
References:  <Pine.LNX.3.96.980109154958.30456V-100000@mail.diginsite.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> > 
> > The EFS/SKIP software can take this into account, but it makes things
> > insecure since you basically have to define a rule that allows any
> > IP address to connect with the remote machine's defined public key. 
> > 
> 
> can you do this for many remote machines? i.e. 20 sales laptops that you
> have the keys for that may connect from anywhere.
> 

Yes, since you define the remote IP address as part of the rule and you
just define "*" (or 192.9.*.*, etc).

Bret

| Bret Robinson, Snr. System Admin    \       Voice: +1-403-213-8413        |
| Applied Terravision Systems, Inc.    \        Fax: +1-403-264-2122        | 
| Calgary, Alberta     Canada           \     Web site: www.atsi.com        |
| BRobinson@atsi.com                     \                                  |
|       "Keep your stick on the ice"      \___ o  <- puck (for US viewers)  |


From firewalls-owner  Fri Jan  9 17:15:25 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id OAA13956; Fri, 9 Jan 1998 14:28:19 -0800 (PST)
Received: from inergen.sybase.com (inergen.sybase.com [192.138.151.43]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id OAA13826 for <Firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 14:27:50 -0800 (PST)
Received: from smtp1.sybase.com (sybgate.sybase.com [130.214.220.35])
          by inergen.sybase.com (8.8.4/8.8.4) with SMTP
	  id OAA28028; Fri, 9 Jan 1998 14:30:31 -0800 (PST)
Received: from gwwest.sybase.com by smtp1.sybase.com (4.1/SMI-4.1/SybH3.5-030896)
	id AA19488; Fri, 9 Jan 98 14:28:13 PST
Received: by gwwest.sybase.com(Lotus SMTP MTA v1.1 (385.6 5-6-1997))  id 88256587.007BDF7D ; Fri, 9 Jan 1998 14:33:01 -0800
X-Lotus-Fromdomain: SYBASENOTES
From: "Ryan Russell"<ryanr@sybase.com>
To: StoutW@pios.com
Cc: Firewalls@GreatCircle.COM
Message-Id: <88256587.007B0131.00@gwwest.sybase.com>
Date: Fri, 9 Jan 1998 14:27:00 -0800
Subject: RE: relative strengths of different encyrption techniques
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk







StoutW@pios.com on 01/08/98 03:24:32 PM

To:   Firewalls@GreatCircle.COM
cc:    (bcc: Ryan Russell/SYBASE)
Subject:  RE: relative strengths of different encyrption techniques


Someone always has to point out the math errors....

So it might as well be me :)

That's not 10^128/10^112, it's 2^128/2^112,
or 65536 (2^16.)

Note: you'd still want that extra, as it means the attacker
now has to throw 65536 times more machines at the
problem to get it done in the same amount of time.

               Ryan




> ----- Original Message -----
> From:   Bowers T (Thomas)  at MSXSSC [SMTP:TB186459@shellus.com]
> Sent:   Wednesday, January 07, 1998, 14:46:31
> To:     Stout, William
> Subject:     relative strengths of different encyrption techniques
>

'Dancing cyphers' can help, where the encrypting nodes synchronously
'dance across the range', similar to how spread-spectrum
frequency-hopping radio works, where the frequency (key) for each piece
of the message is different.  FWIW - 128-bit encryption is approximately
10,000,000,000,000,000 times stronger (multiple of 'x' more possible
values) than 112-bit encryption (10^128)/(10^112).
Bill Stout






From firewalls-owner  Fri Jan  9 17:17:55 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA24180; Fri, 9 Jan 1998 15:14:26 -0800 (PST)
Received: from hq.si.net (hq.si.net [192.156.192.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id PAA24135 for <Firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 15:14:16 -0800 (PST)
Received: from hq.si.net (hq [192.156.192.10]) by hq.si.net (8.8.5/8.7.3) with SMTP id SAA17780; Fri, 9 Jan 1998 18:16:45 -0500 (EST)
Date: Fri, 9 Jan 1998 18:16:45 -0500 (EST)
From: Ming Lu <mlu@hq.si.net>
To: phoenix@clark.net
cc: Bob Bryant <rhb1@gte.com>, rmckosky@gte.com, enorris@gte.com,
        djuitt@gte.com, ccarroll@gte.com, Jyri Kaljundi <jk@stallion.ee>,
        Firewalls@GreatCircle.COM
Subject: Re: ctia hotel confirmations
In-Reply-To: <Pine.GSO.3.96.980108133125.26102A-100000@clark.net>
Message-ID: <Pine.SOL.3.91.980109181341.3456L-100000@hq.si.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Maybe that hotel needs people to install a lot of firewalls. I am pretty 
at construction work...:-), sign me on...

On Thu, 8 Jan 1998 phoenix@clark.net wrote:

>      Umm... good thing we're all friends here.  This information has
> serious practical joke value.  ;)  I wonder how many cancellations The
> Salt Lake City Hilton will receive...
> 
> 
> On Wed, 7 Jan 1998, Bob Bryant wrote:
> 
> > I have confirmed with the Salt Lake City Hilton that the following hotel
> > reservations have been made.
> > name                    dates                   confirmation  #
> > R stanley               13-16                   832781
> > C Carroll               13-16                   832780
> > R McKosky          12-16                   832816
> > Djuitt                     13-16                   831992
> > R Bryant                12-16                   832815
> > E Norris                  12-16                  831991
> > I did this so we would not get the "Mary and Joseph" responce in the lobby.
> > 
> > *******************************************************************************
> > Robert Bryant                           email           rhb1@gte.com
> > Member Technical Staff                  Fax             617-466-2838
> > Secure Systems Department
> > GTE Labrotories                         office ph       617-466-2821
> > 40 Sylvan Rd    MS/55                   Cell ph         617-733-7757
> > Waltham, MA 02254
> > ****************************************************************************
> > ***
> 
> 
> Trees:2 Skiers:0
> 
> 
> 
_ming


From firewalls-owner  Fri Jan  9 17:20:44 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA28745; Fri, 9 Jan 1998 15:47:30 -0800 (PST)
Received: from skycorp.skynet.be (skycorp.skynet.be [195.238.0.128]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id OAA20136 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 14:55:51 -0800 (PST)
Received: from papagena.skynet.be (papagena.skynet.be [195.238.1.2])
	by skycorp.skynet.be (8.8.7/8.8.7) with ESMTP id XAA13542;
	Fri, 9 Jan 1998 23:56:19 +0100 (MET)
Received: from skynet.be (dialup61.gent.skynet.be [195.238.9.61])
	by papagena.skynet.be (8.8.5/JOVI-1.0-8.8.5) with ESMTP id XAA10140;
	Fri, 9 Jan 1998 23:56:35 +0100 (MET)
Message-ID: <32FE5572.F009080B@skynet.be>
Date: Sun, 09 Feb 1997 23:53:38 +0100
From: _bLaDe_ <_blade_@skynet.be>
X-Mailer: Mozilla 4.03 [en] (Win95; I)
MIME-Version: 1.0
To: Steve Kruse <jsk347@sprynet.com>
CC: Peter da Silva <peter@baileynm.com>, MacGyver <macgyver@tos.net>,
        firewalls@GreatCircle.COM
Subject: Re: E-mail Encryption
References: <199801070018.SAA31044@starbase.tos.net> <3.0.3.32.19980107160808.006a33b4@m6.sprynet.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Is a 1024bit key enough??

Steve Kruse wrote:

> I think it might have been mentioned on here, but there is a $5.00
> "up-downgrade" that lets you use the RSA which IS compatabile with PGP 2.x.
>  Check the PGP website for info.
>
> Steve Kruse
>
> At 09:36 AM 1/7/98 -0600, Peter da Silva wrote:
> >> Using Eudora 4.0 onward (I'm not sure if previous versions support this
> >> feature), you have the ability to set an "output filter", which can be set
> >> to call any arbitrary program.  PGP 5.0+ has a Eudora plugin option that
> >> you can use to automagically guarantee that all emails sent out are
> >> encrypted in an invisible way to the user.
> >
> >Unfortunately PGP 5.0+ encryption is incompatible with PGP 2.6, which is
> >what most of the people who use PGP are using. I understand the political
> >reasons for switching to D-H key exchange to get out from under RSA, but
> >I'm going to stick with 2.6 until there's a really compatible upgrade path
> >that works on both protocols and all platforms.
> >



--
_bLaDe_
Belgium, Europe
UIN: 2346943
_blade_@skynet.be

-- "Wherever you go, there you are..." --

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.3ia

mQCNAzSeStUAAAEEALnUwJbmehdJElVNxdZS4eh9Px7JahLyshVlp0n9Q+bcYhL+
sjXGUU4NF5jcwik+WJ75ttjLSfwVnuHZdCuK5VcBoneMFjV+EF4uCRT7c2iff+SR
xYoUIFoRGI8plZcxsbnFo8PxLpnfc8p1wMA0MB/VvQrpW8r3g/Qxws0qK4uRAAUR
tBtfYkxhRGVfIDxfYmxhZGVfQHNreW5ldC5iZT6JAJUDBRA0nkrV9DHCzSori5EB
AfyNBACAkfulGxywbXfu1303eGhElsuboEuPaj9cM62uYH2mP+kFhnVmu4ZkCemR
U5TkdSyyAwH2ihzyKCmlrDChrSwOTeY4eEuX1xZ/KPXFprmAGKWXE3HiGgxwoVZR
1gKVz2CDTPWbmOuMbTOV9ZLIbDpmA67GoxmV/NzDXSF8PEMRQg==
=DPfY
-----END PGP PUBLIC KEY BLOCK-----

From firewalls-owner  Fri Jan  9 17:22:23 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id OAA20542; Fri, 9 Jan 1998 14:57:41 -0800 (PST)
Received: from magna.com.au (mail.magna.com.au [203.4.212.90]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id OAA20430 for <firewalls@greatcircle.com>; Fri, 9 Jan 1998 14:57:14 -0800 (PST)
Received: from saccess-02-041.magna.com.au (saccess-02-041.magna.com.au [203.111.80.41]) by magna.com.au (8.8.5/8.6.10) with SMTP id JAA03754; Sat, 10 Jan 1998 09:57:37 +1100 (EST)
Received: by saccess-02-041.magna.com.au with Microsoft Mail
	id <01BD1DAE.29739E80@saccess-02-041.magna.com.au>; Sat, 10 Jan 1998 09:57:29 +1100
Message-ID: <01BD1DAE.29739E80@saccess-02-041.magna.com.au>
From: Ian Krieger <iank@magna.com.au>
To: "'Paul D. Robertson'" <proberts@clark.net>
Cc: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: RE: Re[2]: Hardware for seperating LAN from dialouts
Date: Sat, 10 Jan 1998 09:54:29 +1100
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Tue, 6 Jan 1998, RANDAL LATHROP wrote:

>      But this is true only if you are running a service (daemon) that =
can=20
>      be exploited.  If you do not share any resources on your system, =
are=20

If you've got a few thousand users, and you have enough control over the =

OS, stack, clients, and configuration, as well as a way to audit that,=20
then you're doing well enough to probably not worry about it.  For the=20
real world, it's *trivially* easy to get a user to load (a) a demo for=20
finance/mailroom/logistics/pick_a_target, or (b) a game, or extension to =

Quake, or (c) New version of a browser, E-mail client, or IRC program. =20
If it's done right, most of them will get the IS people to lend them a=20
modem for the duration of the attack... er demo.
[$]  Yeah right, what planet do you come from??? What I.S. person would =
allow users to install what they like, e.s.p. when it came to =
applications that access the internet. Especially if you are dealing =
with a "few thousand users". I think that what you are suggest is far =
too complex to be even taken seriously. It would be far easier to walk =
into an office as a technician, unplug the PC you want, and walk out.

How many places go through testing new Internet clients on a test bed=20
with modems, LAN cards, and record and decode the traffic?  How many=20
places have enough control over their user population to specify client=20
versions, and distribution channels?=20
[$]  Quite a lot actually, esp when they are sites you'd want to =
actually get data from.

 Probably about as many who run=20
virus suscptable systems with no scanners, no protection, and who get=20
zero incidents.  Next time you see a virus, ask yourself what would have =

happened if that was a sleeping trojan...=20
[$]  Will always happen...

[$]  Oh and I totally agree with your sig. there is no basis for your =
argument in fact, except in the last statement.

Paul D. Robertson      "My statements in this message are personal =
opinions
proberts@clark.net      which may have no basis whatsoever in fact."
                                                                     =
PSB#9280
Ian.
---------------------------------------------------------------
Ian W Krieger						IanK@Magna.com.au

"qIm tera'ngan!" - Translated from Klingon "Attention Earther!"
		http://www.magna.com.au/~iank
=20


From firewalls-owner  Fri Jan  9 17:23:44 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id QAA03502; Fri, 9 Jan 1998 16:09:02 -0800 (PST)
Received: from hq.si.net (hq.si.net [192.156.192.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id QAA03491 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 16:08:56 -0800 (PST)
Received: from hq.si.net (hq [192.156.192.10]) by hq.si.net (8.8.5/8.7.3) with SMTP id TAA18260; Fri, 9 Jan 1998 19:11:29 -0500 (EST)
Date: Fri, 9 Jan 1998 19:11:29 -0500 (EST)
From: Ming Lu <mlu@hq.si.net>
To: "Paul D. Robertson" <proberts@clark.net>
cc: Simon K Ash <simon.ash@eudoramail.com>, firewalls@GreatCircle.COM
Subject: Re: Proxy server to hide IP Add.. from your Firewall
In-Reply-To: <Pine.LNX.3.91.980109183942.1955C-100000@gargoyle>
Message-ID: <Pine.SOL.3.91.980109191034.3456Q-100000@hq.si.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Let me check this out..:-), but not with the vendor.

_ming

On Fri, 9 Jan 1998, Paul D. Robertson wrote:

> On Fri, 9 Jan 1998, Ming Lu wrote:
> 
> > I don't think so, as long as you use cross over cable connetc the proxy 
> > server and firewall together, then rest of stations or lines go through
> > proxy. you did not valid any integrity of the firewall at all.
> 
> My read of every per-node license agreement I've seen counts nodes as on the
> internal network irregardless of the presence of screening routers, 
> application gateways, or indeed other firewall products in multi-tier 
> configurations.  If you ask Checkpoint directly if this is a violation of 
> their license agreement, I doubt that you'll get a different answer.
> 
> Paul
> -----------------------------------------------------------------------------
> Paul D. Robertson      "My statements in this message are personal opinions
> proberts@clark.net      which may have no basis whatsoever in fact."
>                                                                      PSB#9280
> 
> 

From firewalls-owner  Fri Jan  9 17:25:26 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id OAA09033; Fri, 9 Jan 1998 14:07:26 -0800 (PST)
Received: from mailrelay.atsi.com ([204.209.211.162]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id OAA08902 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 14:06:51 -0800 (PST)
Received: (from styx@localhost) by mailrelay.atsi.com (8.7.5/8.6.9) id QAA13094; Fri, 9 Jan 1998 16:13:22 -0700
Received: from mailhub.atsi.com by mailrelay.atsi.com via smap (V2.0)
	id xma013092; Fri, 9 Jan 98 16:13:04 -0700
Received: from zeus.atsi.com (BRobinson@atsi.com) by atsi.com (8.8.7/8.8.7) with SMTP id PAA11929; Fri, 9 Jan 1998 15:04:47 -0700 (MST)
Received: by zeus.atsi.com (SMI-8.6/SMI-SVR4)
	id PAA06739; Fri, 9 Jan 1998 15:09:12 -0700
Date: Fri, 9 Jan 1998 15:09:12 -0700
Message-Id: <199801092209.PAA06739@zeus.atsi.com>
From: Bret Robinson <brobinso@atsi.com>
To: Gary.Wolfe@Eng.Sun.COM
CC: firewalls@GreatCircle.COM
In-reply-to: <Roam.SIMC.2.0.6.884364445.17360.wolfe@basilisk>
	(Gary.Wolfe@Eng.Sun.COM)
Subject: Re: SKIP question
References:  <Roam.SIMC.2.0.6.884364445.17360.wolfe@basilisk>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


> SunScreen EFS supports NAT. Can you NAT the internal hosts that have
> unregistrered IP addresses? 
> 

I would prefer not to have to do this, since we want to just use SKIP as
partner sites and not have to buy EFS - since we can run SKIP on Solaris
x86.

> 
> I would try NAT first. You could also use tunnel mode for both Win 95 SKIP and
> SUnScreen EFS. (Note: tunneling for WIN95 is available on latest release
> 12/27/97).
> 

We are running tunnel mode at both ends, but will check which version of
Win95 SKIP i am using. I downloaded the 512 key version on Jan 5/98.

Thanks, Bret

| Bret Robinson, Snr. System Admin    \       Voice: +1-403-213-8413        |
| Applied Terravision Systems, Inc.    \        Fax: +1-403-264-2122        | 
| Calgary, Alberta     Canada           \     Web site: www.atsi.com        |
| BRobinson@atsi.com                     \                                  |
|       "Keep your stick on the ice"      \___ o  <- puck (for US viewers)  |


From firewalls-owner  Fri Jan  9 17:27:07 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id QAA05284; Fri, 9 Jan 1998 16:16:19 -0800 (PST)
Received: from gargoyle.clark.net (pm1-28.dcwt.infi.net [208.136.65.28]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id QAA05274 for <firewalls@greatcircle.com>; Fri, 9 Jan 1998 16:16:12 -0800 (PST)
Received: (qmail 2994 invoked by uid 500); 10 Jan 1998 00:24:16 -0000
Date: Fri, 9 Jan 1998 19:24:16 -0500 (EST)
From: "Paul D. Robertson" <proberts@clark.net>
X-Sender: proberts@gargoyle
To: Ian Krieger <iank@magna.com.au>
cc: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: RE: Re[2]: Hardware for seperating LAN from dialouts
In-Reply-To: <01BD1DAE.29739E80@saccess-02-041.magna.com.au>
Message-ID: <Pine.LNX.3.91.980109184243.1955D-100000@gargoyle>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Sat, 10 Jan 1998, Ian Krieger wrote:

> If you've got a few thousand users, and you have enough control over the 
> OS, stack, clients, and configuration, as well as a way to audit that, 
> then you're doing well enough to probably not worry about it.  For the 
> real world, it's *trivially* easy to get a user to load (a) a demo for 
> finance/mailroom/logistics/pick_a_target, or (b) a game, or extension to 
> Quake, or (c) New version of a browser, E-mail client, or IRC program.  
> If it's done right, most of them will get the IS people to lend them a 
> modem for the duration of the attack... er demo.
> [$]  Yeah right, what planet do you come from??? What I.S. person would allow users to install what they like, e.s.p. when it came to applications that access the internet. Especially if you are dealing with a "few thousand users". I think that what you are suggest is far too complex to be even taken seriously. It would be far easier to walk into an office as a technician, unplug the PC you want, and walk out.

Lots of IS people would.  Most aren't versed in security.  I've seen very 
few places outside of the government where users are *stopped* from 
loading their own software.  Policies don't stop attackers.  There are 
still hundreds of "non-Internet" services out there which use dial access 
to get stock quotes, tax information, legal research, electronic 
contracting, mailing list informaion, advertising brokerages, and a bunch 
more business level services, are your switches programmed to limit 
outbound modem calls to a specific number?  Care to guess how many of of 
1000 are?  Once those users have access for the business need, it doesn't 
take much more than a client upgrade, competitively priced "service" 
offer, or something like that to get the machine and then the network.  

I don't know how many sites you have, or how long you've been doing this, 
but I *still* see "passwd.txt", "enable, cisco, poncho", and a bunch of 
less business focused thinge that people should have stopped doing years ago.
As I pointed out, if IS people had that much control, virus replication 
would be a moot point, and it isn't for most places.  If you're lucky 
enough to be somewhere small enough to control it, or in a line of 
business where its seen as a necessity, and you have enough good people 
to do it, then as I originally stated, you probably don't need to worry 
about it.  _Most_ places aren't like that.

As for the application, it doesn't *have* to be Internet enabled, it just 
has to get the code to a PC that has Intertnet access.  

Of course, this assumes that the IS department even knows about the 
software.  Contrary to popular belief, most business units tend to not 
consult IS for everything they do.  

> 
> How many places go through testing new Internet clients on a test bed 
> with modems, LAN cards, and record and decode the traffic?  How many 
> places have enough control over their user population to specify client 
> versions, and distribution channels? 
> [$]  Quite a lot actually, esp when they are sites you'd want to actually get data from.

Funny, everyone I know at places with fiscally useful data still has 
virus events, desktops and servers that are back-level enough to have 
known vulnerabilities, FTP'd software from www.microsoft.com,  and a 
bunch of other problems that show that it is next to impossible to scale 
serious security management to a mid to large enterprise without a level of 
commitment that isn't in a lot of places.  I bet you've done checksum 
comparisons of vendor-supplied media, and don't let salesmen bring media in 
the door with them too, right?

Perhaps you'd care to list the number of sites you know that block 
unencrypted, unverified transfers from, say *microsoft.com?  There is a 
large segment of risk management which is largely unaddressed at most 
companies.  If you haven't seen that, then you don't get out much. 

Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
proberts@clark.net      which may have no basis whatsoever in fact."
                                                                     PSB#9280


From firewalls-owner  Fri Jan  9 17:28:38 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA28475; Fri, 9 Jan 1998 15:45:40 -0800 (PST)
Received: from hq.si.net (hq.si.net [192.156.192.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id PAA21317 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 15:01:30 -0800 (PST)
Received: from hq.si.net (hq [192.156.192.10]) by hq.si.net (8.8.5/8.7.3) with SMTP id SAA17657; Fri, 9 Jan 1998 18:04:10 -0500 (EST)
Date: Fri, 9 Jan 1998 18:04:10 -0500 (EST)
From: Ming Lu <mlu@hq.si.net>
To: Jesse Brown <bextreme@pobox.com>
cc: firewalls@GreatCircle.COM
Subject: Re: HTTP/POP3/SMTP Proxies? 
In-Reply-To: <Pine.LNX.3.96.980108215758.1869C-100000@geek-gw.ptw.com>
Message-ID: <Pine.SOL.3.91.980109180329.3456J-100000@hq.si.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Get squid and you will be very happy...

_ming

On Thu, 8 Jan 1998, Jesse Brown wrote:

> Hello, I was wondering if anyone had any recommendations for free proxy
> software that will run on x86 Linux that can either proxy HTTP, POP3,
> SMTP, etc, or just a general proxy that will allow me to redirect a
> connection like http. 
> 
> -J
> 
> --
> Jesse Brown - bextreme@pobox.com  
> 
> 
> 

From firewalls-owner  Fri Jan  9 17:29:48 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA13645; Fri, 9 Jan 1998 07:01:51 -0800 (PST)
Received: from blackhole.dimensional.com (blackhole.dimensional.com [208.206.176.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id HAA13515 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 07:01:24 -0800 (PST)
Received: from obscure.sekurity.org (mdy@obscure.sekurity.org [206.124.30.250])
	by blackhole.dimensional.com (8.8.7/8.8.nospam) with SMTP id IAA21147;
	Fri, 9 Jan 1998 08:02:01 -0700 (MST)
Date: Fri, 9 Jan 1998 09:02:50 -0700 (MST)
From: Modify <mdy@sekurity.org>
To: Johan Teekens <calculus@pi.net>
cc: firewalls@GreatCircle.COM
Subject: Re: IBM firewall
In-Reply-To: <199801081654.RAA22502@mailme.wirehub.nl>
Message-ID: <Pine.LNX.3.96.980109085525.11029B-100000@obscure.sekurity.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I have had experience setting up SNG (IBM's Firewall) and it isnt all too
bad.  The interface is nice, the help is clear, and it seems to work on
high loads of traffic.  The only downfall that I could see (if this is a
downfall) is that you have to set up every little rule.  I would suggest
(If you must use this firewall) that you deselect all the rule sets and
then go back and select the ones you need.

Here is a link to the site:
http://www.ibm.com/security/html/prod_fire.html

Modify

On Thu, 8 Jan 1998, Johan Teekens wrote:

> Next week an RS6000, model 43p, with AIX, is going to be delivered to me,
> on wich I have to install the IBM firewall, this is not exactly what I
> wanted, I wanted Raptor or Linux, but for political reasons we have to buy
> the IBM firewall.
> Has anyone any experience with it, what are the advantages? How stable is
> it? Where are it's holes?
> 
> It's not that I don' t trust it or anything, but this software is quite new
> for me, and the art of automation this to decrease the risk of anything
> going wrong, I can't estimate that risk at the moment.
> 
> Can anyone tell me what is going to happen to me?
> 


From firewalls-owner  Fri Jan  9 17:31:19 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA09297; Fri, 9 Jan 1998 06:46:11 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id GAA02967 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 06:17:22 -0800 (PST)
Received: from loki.iss.net by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-970426)
	id GAA22400; Fri, 9 Jan 1998 06:16:36 -0800 (PST)
Received: from tdoty (tdoty.iss.net [208.21.4.61]) by loki.iss.net (8.8.7/8.7.3) with SMTP id JAA31494 for <firewalls@greatcircle.com>; Fri, 9 Jan 1998 09:17:36 -0500
Message-Id: <3.0.3.32.19980109091243.00a1dcf0@mail.iss.net>
X-Sender: tdoty@mail.iss.net
X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.3 (32)
Date: Fri, 09 Jan 1998 09:12:43 -0500
To: firewalls@GreatCircle.COM
From: Ted Doty <ted@iss.net>
Subject: RE: relative strengths of different encyrption techniques
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Thu, 08 Jan 1998 18:24:32, "Stout, William" <StoutW@pios.com> wrote:

>  A gripe of mine - maximum key strength is incorrectly judged by the
> minimum amount of time it takes to process the entire key range, for
> some odd reason I think it should be measured on the minimum amount of
> time to discover the first usable key in the key range.

For strong ciphers, the key strength is typically represented as the time
required to test one half of all possible keys, rather than the time to
test the entire key range.  Granted, one could be very lucky (succeed on
the first attempt) or very unlucky (succeed on the very last key in the
range), but on average, this is the time you will need to spend to recover
a given key.

[snip]

> 'Dancing cyphers' can help, where the encrypting nodes synchronously
> 'dance across the range', similar to how spread-spectrum
> frequency-hopping radio works, where the frequency (key) for each piece
> of the message is different.  FWIW - 128-bit encryption is approximately
> 10,000,000,000,000,000 times stronger (multiple of 'x' more possible
> values) than 112-bit encryption (10^128)/(10^112).

There is an interesting analysis of brute force key cracking issues at
http://www.counterpane.com/keylength.html.  What is interesting is the
analysis of financial cost per key recovered.  Using this argument,
attackers are eventually forced move to social engineering techniques (a la
John Walker) to break the keys.  Certainly a "frequency hopping" cipher is
likely to fall into this category, but strong ciphers with large key sizes
(IDEA or 3DES) likely do, too.

This is an argument against key escrow, since it provides a point of attack
for these social engineering attacks.

- Ted

--------------------------------------------------------------
Ted Doty, Internet Security Systems | Phone: +1 770 395 0150
41 Perimeter Center East            | Fax:   +1 770 395 1972
Atlanta, GA 30346  USA              | Web: http://www.iss.net
--------------------------------------------------------------
PGP key fingerprint: 362A EAC7 9E08 1689  FD0F E625 D525 E1BE

From firewalls-owner  Fri Jan  9 17:33:26 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA07358; Fri, 9 Jan 1998 11:26:39 -0800 (PST)
Received: from pse01.pios.com (PSE01.PIOS.COM [199.33.129.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id LAA07286 for <Firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 11:26:22 -0800 (PST)
Received: by pse01.pios.com; (5.65v3.2/1.3/10May95) id AA12999; Fri, 9 Jan 1998 14:27:05 -0500
Received: from pio_mail2.cle2.pios.com by gemini.pios.com (PMDF V5.0-6 #18985)
 id <01IS6CS62YW08X1FM1@gemini.pios.com> for Firewalls@GreatCircle.COM; Fri,
 09 Jan 1998 14:27:44 -0500 (EST)
Received: by pio_mail2.cle2.pios.com with SMTP
 (Microsoft Exchange Server Internet Mail Connector Version 4.0.995.52)
 id <01BD1CFE.5D9579F0@pio_mail2.cle2.pios.com>; Fri, 09 Jan 1998 12:59:05 -0500
Date: Fri, 09 Jan 1998 12:59:03 -0500
From: "Stout, William" <StoutW@pios.com>
Subject: RE: RE: Stateful Inspection Anyone?   Session limits on state-tracking
 systems?
To: "'Firewalls-GC'" <Firewalls@GreatCircle.COM>
Message-Id: 
 <c=US%a=_%p=PIOS%l=PIO_MAIL2-980109175903Z-2025@pio_mail2.cle2.pios.com>
Mime-Version: 1.0
X-Mailer: Microsoft Exchange Server Internet Mail Connector Version 4.0.995.52
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> ----- Original Message -----
> From:	Ryan Russell [SMTP:ryanr@sybase.com]
> Sent:	Wednesday, January 07, 1998, 9:08:30
> To:	Stout, William
> Cc:	glasane@gdsconnect.com; firewalls@GreatCircle.COM; macgyver@tos.net
> Subject:	Re: RE: Stateful Inspection Anyone? Explore your options.
> 
> 
> I'm implying that 's a small possibility, at least as far as
> my experience goes.  The possibility of state table corruption
> has been discussed as a potential problem, but since I've
> been on the list, no one has mentioned that they've seen it happen.

Adding fuel to the state-based packet filter vs. proxy firewall religion
war...

I'd like someone to verify this:

One interesting thing I've noticed is that for a high-session site,
state-based filters have a smaller established session capacity than
services it protects.  The memory-resident state-table which maintains
session state can only be so big in stack shims and router-based
state-systems.  I would think that disk-based state-table would have a
bit of an impact on performancenwriting/reading to disk for a for every
new packet, not helping the situation.  If the webserver (farm) is
serving many established sessions with small packets, the state-based
system appears to become overwhelmed, the packet-filter locks up, and
needs to be hard-booted to recover.  Theoretically state-based systems
can be DOS'd by establishing, holding, and queueing up more TCP sessions
to (protected) servers than the state-based system can handle.  A proxy
server on the other hand acts like the application it protects, so no
'weirdness' occurs.

Note this is not a bandwidth issue, but an established TCP session
issue.

Bill Stout

From firewalls-owner  Fri Jan  9 17:33:27 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA23594; Fri, 9 Jan 1998 08:01:07 -0800 (PST)
Received: from tyche.credo.net (tyche.credo.net [199.107.168.8]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id IAA23578 for <firewalls@greatcircle.com>; Fri, 9 Jan 1998 08:01:00 -0800 (PST)
Received: from alectrona.credo.net (alectrona.credo.net [199.107.168.9])
	by tyche.credo.net (8.8.8/8.8.5) with SMTP id IAA01161;
	Fri, 9 Jan 1998 08:01:37 -0800 (PST)
Message-Id: <3.0.32.19980109090703.00b0e508@199.107.168.8>
Received: from john.credo.net by alectrona.credo.net
          via smtpd (for mail.credo.net [199.107.168.8]) with SMTP; 9 Jan 1998 16:00:52 UT
X-Sender: john@199.107.168.8
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Fri, 09 Jan 1998 09:07:04 +0000
To: Pablo Martinez <pablo@lucent.com>
From: John Whittaker <john@zoneoftrust.com>
Subject: Re: Diferrence between Circuit-level Gateway and a generic
  application proxy
Cc: firewalls@greatcircle.com
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

hi pablo,

traditionally a circuit level gateway will lock out all ports save those
that you want to be open and will allow direct access through those ports,
ie. port 80 for http access.  it does not actually look at the service
passing through the open port.  so if i open port 80 and have some weird
non http service running through it the circuit level gateway is not going
to notice.

where as a proxy will view the service and allow or disallow access through
the port based on what is actually passing.  a generic proxy like the
raptor gsp is somewhere between these two options it works very similarly
to the circuit level gateway in that it is not really looking at the
service, but it doesn't open a direct link fron client to host.  it still
has a service take the request from the outside interphace, runs it up to
the proxy where it can apply rules for authentication, etc. and then has
the proxy pass it on to the host, and visa versa.  so it is actually a
little more secure.  

in a perfect world you would not want to run anything that didn't have a
full proxy in front of it.  on the positive side most of the main services
have proxies available to them (even cifs now!).  i hope this is helpfull.

best,

john.



At 03:10 PM 1/8/98 -0500, you wrote:
>I have a question for you guys.  What is the key difference between 
>a generic application proxy running in an application gateway firewall 
>and a circuit-level gateway?  I know that the circuit gateway 
>is a proxy that runs at the transport layer while the application 
>proxy runs at the application layer.  However,  the part that 
>confuses me a little is that it is "generic."  Are these generic 
>proxies just "forwarding" a specified protocol to a specified port 
>on an specified separate server for further procesing (similar 
>to Raptor's Generic Service Passer)? 
>
---------------------------------------------------------------------------
ZONEOFTRUST
a division of Credo Computer Systems, Inc.
---------------------------------------------------------------------------

22941 Triton Way, 2nd Floor
Laguna Hills, CA  92653

(714) 859-0196 tel.
(714) 452-0513 fax.

http://www.zoneoftrust.com

From firewalls-owner  Fri Jan  9 17:33:30 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA29066; Fri, 9 Jan 1998 06:00:40 -0800 (PST)
Received: from loki.iss.net (loki.iss.net [208.21.0.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id GAA29003 for <firewalls@greatcircle.com>; Fri, 9 Jan 1998 06:00:25 -0800 (PST)
Received: from tdoty (tdoty.iss.net [208.21.4.61]) by loki.iss.net (8.8.7/8.7.3) with SMTP id JAA31027 for <firewalls@greatcircle.com>; Fri, 9 Jan 1998 09:01:07 -0500
Message-Id: <3.0.3.32.19980109085615.00a1b6e0@mail.iss.net>
X-Sender: tdoty@mail.iss.net
X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.3 (32)
Date: Fri, 09 Jan 1998 08:56:15 -0500
To: firewalls@greatcircle.com
From: Ted Doty <ted@iss.net>
Subject: Re: Firewall Audit Tools
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Thu, 8 Jan 1998 21:51:00 Jeffrey Loewenstein <edpaudit@i-2000.com> wrote:

>There are tools that can be used for auditing and reviewing Internet
security at 
> an outfit called ISS. I think their Web site is www.iss.com

Actually, that's www.iss.net

There is an iss.com, but they don't have firewall monitoring tools.

- Ted

--------------------------------------------------------------
Ted Doty, Internet Security Systems | Phone: +1 770 395 0150
41 Perimeter Center East            | Fax:   +1 770 395 1972
Atlanta, GA 30346  USA              | Web: http://www.iss.net
--------------------------------------------------------------
PGP key fingerprint: 362A EAC7 9E08 1689  FD0F E625 D525 E1BE

From firewalls-owner  Fri Jan  9 23:32:14 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id XAA03656; Fri, 9 Jan 1998 23:12:46 -0800 (PST)
Received: from ns.istiy.yn.cn ([168.160.151.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id XAA03562 for <firewalls@GreatCircle.COM>; Fri, 9 Jan 1998 23:12:09 -0800 (PST)
Received: from elephant.istiy.yn.cn ([168.160.151.3]) by ns.istiy.yn.cn (8.8.3/8.8.3) with SMTP id RAA11932; Sat, 10 Jan 1998 17:11:41 -0800
Received: from cat ([168.160.151.233]) by elephant.istiy.yn.cn (5.x/SMI-SVR4)
	id AA11210; Sat, 10 Jan 1998 15:09:25 +0800
Message-Id: <32D6CA20.4546@elephant.istiy.yn.cn>
Date: Fri, 10 Jan 1997 15:00:49 -0800
From: tj <tj@elephant.istiy.yn.cn>
Reply-To: tj@elephant.istiy.yn.cn
X-Mailer: Mozilla 3.0Gold (WinNT; I)
Mime-Version: 1.0
To: "Paul D. Robertson" <proberts@clark.net>
Cc: Ming Lu <mlu@hq.si.net>, Simon K Ash <simon.ash@eudoramail.com>,
        firewalls@GreatCircle.COM
Subject: network configurations
References: <Pine.LNX.3.91.980109183942.1955C-100000@gargoyle>
Content-Type: multipart/mixed; boundary="------------9A52F4D64E9"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

This is a multi-part message in MIME format.

--------------9A52F4D64E9
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

The following fig is our network structure:

      sgi1   211.211.211.1
   ATM  |    211.211.211.0
  ______|______________________________      211.211.212.0
  |                                   | ATM  211.211.212.1
  |              BAY C100             |------sgi2(use as ATM
router)          
  |___________________________________|
        | 10M HUB        | 10M HUB
  ______|____       _____|_____
 |___________|     |__________|
        |                |  211.211.214.1  cisco 2501 (router to
internet)
     ___|__   pc1      __|__211.211.214.0
     |____|            |___|
211.211.213.1            |  211.211.215.1
211.211.213.0            |  211.211.215.0
                         |
                         |
                         to Internet
Now I do not know how to config this network.My questions are:
1.which is the default gateway of pc1 and sgi1 ? Sgi1 or 2501?
2.How to config the ATM router sgi2 ? The route table?
3.How to config the Internet router 2501 ? The route table?
4.How to config the vlan or elan?
5.How to config the c100?

--------------9A52F4D64E9
Content-Type: text/plain; charset=us-ascii; name="atm.txt"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline; filename="atm.txt"

The following fig is our network structure:

      sgi1   211.211.211.1
   ATM  |    211.211.211.0
  ______|______________________________      211.211.212.0
  |                                   | ATM  211.211.212.1
  |              BAY C100             |------sgi2(use as ATM router)          
  |___________________________________|
        | 10M HUB        | 10M HUB
  ______|____       _____|_____
 |___________|     |__________|
        |                |  211.211.214.1  cisco 2501 (router to internet)
     ___|__   pc1      __|__211.211.214.0
     |____|            |___|
211.211.213.1            |  211.211.215.1
211.211.213.0            |  211.211.215.0
                         |
                         |
                         to Internet
Now I do not know how to config this network.My questions are:
1.which is the default gateway of pc1 and sgi1 ? Sgi1 or 2501?
2.How to config the ATM router sgi2 ? The route table?
3.How to config the Internet router 2501 ? The route table?
4.How to config the vlan or elan?
5.How to config the c100?

--------------9A52F4D64E9--


From firewalls-owner  Sat Jan 10 00:02:03 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id XAA08525; Fri, 9 Jan 1998 23:36:40 -0800 (PST)
Received: from nm.cnnic.net.cn (nm.cnnic.net.cn [159.226.1.8]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id XAA08503 for <firewalls@greatcircle.com>; Fri, 9 Jan 1998 23:36:32 -0800 (PST)
From: guard@cnnic.net.cn
Received: from cnnic.net.cn (localhost [127.0.0.1]) by nm.cnnic.net.cn (950413.SGI.8.6.12/950213.SGI.AUTOCF) via ESMTP id PAA25617 for <firewalls@greatcircle.com>; Sat, 10 Jan 1998 15:40:51 -0800
Message-ID: <34B80701.94392A4A@cnnic.net.cn>
Date: Sat, 10 Jan 1998 15:40:49 -0800
X-Mailer: Mozilla 4.02 [en] (X11; I; IRIX64 6.2 IP28)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: What is Stateful inspection
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,experts on Stateful inspection,
I first learned Stateful inspection from checkpoint firewall-1.
I am very intersted in it though I am only a beginner in firewall.
Could you tell me further things about that except those on Checkpoint's
site?
Or at least some referals to relative sites.
Thank you very much.



From firewalls-owner  Sat Jan 10 04:57:44 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id AAA28265; Sat, 10 Jan 1998 00:59:29 -0800 (PST)
Received: from vulcan.achq.dnd.ca ([205.200.255.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id AAA28156 for <firewalls@greatcircle.com>; Sat, 10 Jan 1998 00:59:07 -0800 (PST)
Received: by vulcan.achq.dnd.ca; (5.65v3.2/1.3/10May95) id AA30128; Sat, 10 Jan 1998 03:03:31 -0600
Message-Id: <34B73949.5C1DBCC6@vulcan.achq.dnd.ca>
Date: Sat, 10 Jan 1998 03:03:05 -0600
Received: from [205.200.255.101] by vulcan (smtpxd); id XA30236
From: Rob Janzen <rob@vulcan.achq.dnd.ca>
Reply-To: rob@vulcan.achq.dnd.ca
Organization: 17 Wing Winnipeg
X-Mailer: Mozilla 4.03 [en] (Win95; I)
Mime-Version: 1.0
To: firewalls@greatcircle.com
Subject: SNA Access and Firewalls
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Good morning:

Is anybody aware of an application level firewall which will handle SNA
traffic as well as TCP/IP?

Thanks.

Rob


From firewalls-owner  Sat Jan 10 05:18:51 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id BAA02566; Sat, 10 Jan 1998 01:24:28 -0800 (PST)
Received: from voland.freenet.bishkek.su (voland.freenet.bishkek.su [193.125.230.4]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id BAA02519 for <firewalls@GreatCircle.COM>; Sat, 10 Jan 1998 01:24:08 -0800 (PST)
Received: from freenet.bishkek.su (root@freenet.bishkek.su [193.125.230.1]) by voland.freenet.bishkek.su (8.8.4/8.8.4) with ESMTP id OAA30979; Sat, 10 Jan 1998 14:36:32 +0500
Received: from localhost (fygrave@localhost) by freenet.bishkek.su (8.8.4/8.6.12) with SMTP id MAA00348; Sat, 10 Jan 1998 12:57:05 -0500
Date: Sat, 10 Jan 1998 12:57:05 -0500 (GMT+5)
From: Fyodor <fygrave@freenet.bishkek.su>
Reply-To: fygrave@usa.net
To: Norman Widders <winspace@atinet.com.au>
cc: "'firewalls mailing list'" <firewalls@GreatCircle.COM>
Subject: Re: rootshell has a mailing list
In-Reply-To: <Paladin.2.33.883986026-959915837345291.beethoven>
Message-ID: <Pine.LNX.3.96.980110125524.24199F-100000@freenet.bishkek.su>
X-lummer: Bill Gates
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


On Mon, 5 Jan 1998, Norman Widders wrote:
> 
> folks,
> 
> www.rootshell.com has a mailing list, well worth subscribing imho
> just to keep abreast of current exploits, useful if you like to see
> what it is that they are using on us... just started on 1/2/1998, ymmv

Greetings,
 Can you provide more info about this please? I.G. location, subscription
info, whatever...



From firewalls-owner  Sat Jan 10 05:33:12 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id CAA08229; Sat, 10 Jan 1998 02:01:45 -0800 (PST)
Received: from oakland-ws-34.clark.net (oakland-ws-34.clark.net [204.245.172.34]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id CAA08216 for <firewalls@GreatCircle.COM>; Sat, 10 Jan 1998 02:01:24 -0800 (PST)
From: mht@clark.net
Received: from highlander (215.middletown-07.va.dial-access.ATT.net [12.68.19.215])
	by oakland-ws-34.clark.net (8.8.5/8.8.5) with SMTP id GAA00582;
	Sat, 10 Jan 1998 06:06:31 -0500
Message-Id: <3.0.3.32.19980110045849.009f5550@pop3.clark.net>
X-Sender: mht@pop3.clark.net
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Sat, 10 Jan 1998 04:58:49 -0500
To: "jimst@enteract.com" <jimst@enteract.com>,
        "'Kerry Jones'" <kjones@aims.gov.au>,
        "firewalls@GreatCircle.COM" <firewalls@GreatCircle.COM>
Subject: RE: DNS on firewall??
In-Reply-To: <01BD1C26.526493A0.jimst@enteract.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Refer to Building Internet Firewalls in regards to different DNS scenarios..


/mht

At 11:08 AM 1/8/98 -0600, James Strompolis wrote:
>Why not pay your ISP to be your secondary?  Takes the secondary off-site
making things somewhat more reliable.
>
>- James Strompolis
>  Aleph Consultants, Inc.
>  jimst@enteract.com
>
>On Tuesday, January 06, 1998 12:02 AM, Kerry Jones
[SMTP:kjones@aims.gov.au] wrote:
>> Hi,
>> 
>> Simple question. Is it a good idea to run a DNS server on a
>> Firewall?????
>> 
>> AUNIC require at least 2 DNS servers, so I am trying to decide where to
>> configure the 2nd DNS server for our domain (Primary one is currently on
>> the DMZ). Will putting the secondary DNS on the firewall create a
>> security hole in the Firewall which would best be avoided????????
>> Is it acceptable (secure) to put the DNS and other services (e.g.
>> http/ftp) on the Firewall??
>> 
>> What do you think??
>> What are your opinions??
>> 
>> I have a fairly standard setup as follows;
>> 
>> Internet
>>     |
>>  router
>>     |
>>  firewall - dmz (1 machine: http/ftp/dns)
>>       |
>>   internal network.
>> 
>> --
>> Kerry Jones
>> kjones@aims.gov.au
>> 
>
>

From firewalls-owner  Sat Jan 10 06:06:00 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id BAA00164; Sat, 10 Jan 1998 01:13:56 -0800 (PST)
Received: from grab.mulligan.com (grab.coslabs.com [199.233.92.34]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id BAA00133 for <Firewalls@GreatCircle.COM>; Sat, 10 Jan 1998 01:13:43 -0800 (PST)
Received: from future.mulligan.com (future [199.233.92.11])
	by grab.mulligan.com (8.8.7/8.8.7) with SMTP id CAA02016;
	Sat, 10 Jan 1998 02:14:52 -0700 (MST)
Received: from future by future.mulligan.com (SMI-8.6/SMI-SVR4)
	id CAA07317; Sat, 10 Jan 1998 02:14:17 -0700
Message-Id: <199801100914.CAA07317@future.mulligan.com>
X-Mailer: exmh version 2.0.1 12/23/97
To: "Stout, William" <StoutW@pios.com>
cc: "'Firewalls-GC'" <Firewalls@GreatCircle.COM>
Subject: Re: Stateful Inspection Anyone? Session limits on state-tracking systems? 
In-reply-to: Your message of "Fri, 09 Jan 1998 12:59:03 EST."
             <c=US%a=_%p=PIOS%l=PIO_MAIL2-980109175903Z-2025@pio_mail2.cle2.pios.com> 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Sat, 10 Jan 1998 02:14:17 -0700
From: Geoff Mulligan <geoff@mulligan.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

StoutW@pios.com said:
> One interesting thing I've noticed is that for a high-session site,
> state-based filters have a smaller established session capacity than
> services it protects.

I don't know where you have noticed this, but it is simply not true.  Most 
stateful packet filters have a much higher "established session capacity" than 
the servers they are protecting.  Sunscreen's kernel state table capacity is 
at least a couple orders of magnitude larger than what a server can support.

It is certainly possible to put a huge number of servers behind a firewall and 
claim that they can support more sessions than the firewall can, but you would 
quickly reach a capacity issue with your bandwidth.

> The memory-resident state-table which maintains
> session state can only be so big in stack shims and router-based
> state-systems. 

Yes, but the state table entries are small and a stateful packet screen can 
maintain an immense number of entries.

> I would think that disk-based state-table would have a
> bit of an impact on performancenwriting/reading to disk for a for
> every new packet, not helping the situation. 

No one in their right mind would maintain these tables on disk.

> If the webserver (farm)
> is serving many established sessions with small packets, the
> state-based system appears to become overwhelmed, the packet-filter
> locks up, and needs to be hard-booted to recover.

"Appears" where? -- What stateful packet screen are you talking about? And btw,
packet size is irrelevant to the issue of state tables, but it is very relevant
to the issue of performance.  Under heavy loads Sunscreen does NOT lock up and
require hard booting.

>  Theoretically
> state-based systems can be DOS'd by establishing, holding, and
> queueing up more TCP sessions to (protected) servers than the
> state-based system can handle.

Only in a badly constructed stateful packet screen.  It is much simpler to
maintain the state tables in the screen that the job the server has maintaining
its queue of connections.  Again the state table entries are smaller than the
PCB's and other kernel table entries the server needs to maintain.  You can DOS
a server easily with half opened connections.  Not so with Sunscreen.

> A proxy server on the other hand acts like the application it protects, so no
> 'weirdness' occurs.

RIGHT, and for the reasons just stated, it will perform worse than a stateful 
packet screen under these conditions.

> Note this is not a bandwidth issue, but an established TCP session
> issue.

As to the issue of small packets and bandwidth, stateful packet screens handle
load MUCH better than application relays.  All of the work is done in the
kernel, where as with application relays each packet much traverse the entire
tcp/ip stack, context switch to user space (possibly page in the application
relay), be processed by the application, context switch back to kernel space,
traverse the tcp/ip stack again and then finally get put back out on the wire.
This then becomes a bandwidth problem!

	geoff



From firewalls-owner  Sat Jan 10 06:33:16 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA08139; Sat, 10 Jan 1998 06:03:36 -0800 (PST)
Received: from ns2.emirates.net.ae (ns2.emirates.net.ae [194.170.1.45]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id GAA08097 for <firewalls@GreatCircle.COM>; Sat, 10 Jan 1998 06:03:22 -0800 (PST)
Received: from localhost (tde036.emirates.net.ae [195.229.10.36]) by ns2.emirates.net.ae (8.8.6/8.6) with ESMTP id SAA02359; Sat, 10 Jan 1998 18:00:21 -0400 (GMT)
Message-Id: <199801102200.SAA02359@ns2.emirates.net.ae>
Reply-To: <prabhags@goldensun.com>
From: "GSC Prabhakar" <prabhags@goldensun.com>
To: <fygrave@usa.net>, "Norman Widders" <winspace@atinet.com.au>
Cc: "'firewalls mailing list'" <firewalls@GreatCircle.COM>
Subject: Re: rootshell has a mailing list
Date: Sat, 10 Jan 1998 18:07:48 +0400
X-MSMail-Priority: Normal
X-Priority: 3
X-Mailer: Microsoft Internet Mail 4.70.1161
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

This is the website of rootshell. 
[ http://www.rootshell.com/ ].

It has got a good collection of materials on security exploits . 

An archive of this list is available at :
http://www.rootshell.com/mailinglist-archive ...   

GSC Prabhakar
GoldenSun Internet Consulting




----------
From: Fyodor <fygrave@freenet.bishkek.su>
To: Norman Widders <winspace@atinet.com.au>
Cc: 'firewalls mailing list' <firewalls@GreatCircle.COM>
Subject: Re: rootshell has a mailing list
Date: Saturday, January 10, 1998 9:57 PM

On Mon, 5 Jan 1998, Norman Widders wrote:
> 
> folks,
> 
> www.rootshell.com has a mailing list, well worth subscribing imho
> just to keep abreast of current exploits, useful if you like to see
> what it is that they are using on us... just started on 1/2/1998, ymmv

Greetings,
 Can you provide more info about this please? I.G. location, subscription
info, whatever...


From firewalls-owner  Sat Jan 10 07:01:46 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA09270; Sat, 10 Jan 1998 06:09:33 -0800 (PST)
Received: from gate.quick.com.au (gate.quick.com.au [203.12.250.130]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id GAA09214 for <firewalls@greatcircle.com>; Sat, 10 Jan 1998 06:09:17 -0800 (PST)
Received: (from sjg@localhost) by gate.quick.com.au (8.8.5/8.7.3) id BAA23962; Sun, 11 Jan 1998 01:08:43 +1100 (EST)
Date: Sun, 11 Jan 1998 01:08:43 +1100 (EST)
From: "Simon J. Gerraty" <sjg@quick.com.au>
Message-Id: <199801101408.BAA23962@gate.quick.com.au>
To: Bogdan Pelc <pelc@fb3-s7.math.tu-berlin.de>
Cc: firewalls@greatcircle.com
Subject: Re: Split DNS??
References: <199801081353.AA19530@fb3-s12.math.tu-berlin.de>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>your Firewall get hacked, also your both DNS get hacked, didn' they?  If
>you have primary DNS for your Site in the internal network (for example

Thats what I said.  The primary server for the internal domains is
not the firewall.  The nameserver on the firewall is a secondary for its
own use not of anything else.  Oh and don't confuse all that with the 
nameserver that listens on the ppp interface - they are different beasts.
Not even the firewall looks at that one it is only for outsiders.

>I don't understand Point Nr. 1. Sorry :(

Ok, try dropping your internet link for a month and see what that
does to your internal nameservers :-)  named likes to check the NS list
for . occasionally or it gets upset.  The fact that there are no root
servers in this country (AU) has caused grief in the past when the
AU-US link was flakey for an extended period.

>  SJG> network. 2. use of illegal nets on corp net means external address
>  SJG> resolution is meaningless in most cases.  3. the forwarding model
>  SJG> described above does not scale well to _big_ corporate nets.
>  SJG> 4. passing zero DNS traffic through firewall ensures that Internet
>  SJG> is not poluted with internal roots.

>2.3 I don't understand it either. So if I am on the Corp-net, and I want to

Ok.  Lets say you are using one of nasa.gov's addresses on your corp net
and you want to get to ns.nasa.gov for some reason.  If you look that up
you will get 128.102.16.10, and when you try to reach it, you connect
to a machine on your internal net....  either way it is not much use.

Most folk access external sites via SMTP (e-mail), HTTP, FTP and to a 
lesser extent TELENT.  The first two work fine becuase they do their
"routing" on domain names more that IP addresses, eg I can tell SMTP
that all non-local mail should go to my firewall.  Application proxies on
the firewall for FTP and TELNET deal with the addressing problems fine.
So the lack of external address resolution is not really a big deal - unless
you want transparent proxies - which you cannot have with illegal (as 
opposed to unregistered rfc1597 et al) addresses.

Oh, and we are talking about nets built before rfc1597 came out, and where
the NIC got sick of giving legal addresses so don't be too hash :-)

>good. I have here site with 400+ Machines, and DNS is OK. I cannot imagine,
>that one DNS-forward more and caching DNS-Server should not scale good.

Try a corp net 100 times that size with many delegated sub-domains (with
delegated sub-domains).  Trust me, it does not scale.  
For instance in the past I've had to modify bind to make the number of 
zone serial no checks per hour a function of the number of zones being 
served (rather than fixed at 4/hr) to keep it all working.

>Could you please explain?

Hope that helps.  BTW, I think this is past the point of interest for
most firewalls readers so followups to e-mail please.

--sjg


From firewalls-owner  Sat Jan 10 09:53:55 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA00618; Sat, 10 Jan 1998 09:34:12 -0800 (PST)
Received: from imsp074.netvigator.com (imsp074.netvigator.com [205.252.144.129]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA00595 for <firewalls@GreatCircle.COM>; Sat, 10 Jan 1998 09:34:03 -0800 (PST)
Received: from js-computer (hhtam020154.netvigator.com [208.139.106.154])
	by imsp074.netvigator.com (8.8.8/8.8.8) with SMTP id BAA28606
	for <firewalls@GreatCircle.COM>; Sun, 11 Jan 1998 01:34:09 +0800 (HKT)
Message-Id: <199801101734.BAA28606@imsp074.netvigator.com>
Date: Sun, 01 Feb 1998 17:03:23 +0800
From: MS <"ims02@netvigator.com"@netvigator.com>
Reply-To: "ims02@netvigator.com"@netvigator.com
X-Mailer: Mozilla 3.0Gold (Win95; I)
MIME-Version: 1.0
To: "firewalls@GreatCircle.COM" <firewalls@GreatCircle.COM>
Subject: Proxy Servers on DMZ?
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

Is it a secure method to place all the proxy servers(eg mail server, ftp
server)
into the DMZ segment?

Jim

From firewalls-owner  Sat Jan 10 10:41:07 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA00591; Sat, 10 Jan 1998 09:34:00 -0800 (PST)
Received: from lama.supermedia.pl (lama.supermedia.pl [195.116.168.67]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA00558 for <Firewalls@GreatCircle.COM>; Sat, 10 Jan 1998 09:33:50 -0800 (PST)
Received: from localhost (andy@localhost)
	by lama.supermedia.pl (8.8.7/8.8.5) with SMTP id SAA03865
	for <Firewalls@GreatCircle.COM>; Sat, 10 Jan 1998 18:34:49 +0100
Date: Sat, 10 Jan 1998 18:34:41 +0100 (MET)
From: Andrzej Blaszczyk <andy@lama.supermedia.pl>
To: Firewalls@GreatCircle.COM
Subject: Information about Babylon Firewall
In-Reply-To: <199801100119.RAA19475@honor.greatcircle.com>
Message-ID: <Pine.LNX.3.96.980110183344.19212C-100000@lama.supermedia.pl>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello everybody!

Does anybody have any experience with Babylon firewall family from BioData
Co. (Germany)?

Thanks for any comments.

Regards,
<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>
<>    Andrzej Blaszczyk <> ab@supermedia.pl     <>
<> System Administrator <> http://supermedia.pl <>
<>       SuperMedia CUI <> Office: +48228296573 <>
<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>



From firewalls-owner  Sat Jan 10 11:24:23 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA16204; Sat, 10 Jan 1998 11:13:57 -0800 (PST)
Received: from ntserver.newoak.com ([146.115.61.251]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id LAA16197 for <firewalls@GreatCircle.COM>; Sat, 10 Jan 1998 11:13:51 -0800 (PST)
Received: from mfeinstein ([10.0.21.191]) by ntserver.newoak.com
          (Netscape Mail Server v2.02) with ESMTP id AAA163;
          Sat, 10 Jan 1998 14:12:19 -0500
Message-ID: <34B7C832.EFB095F5@newoak.com>
Date: Sat, 10 Jan 1998 14:12:51 -0500
From: mfeinstein@newoak.com (Michael G. Feinstein)
Reply-To: mfeinstein@newoak.com
Organization: New Oak Communications
X-Mailer: Mozilla 4.01 [en] (Win95; I)
MIME-Version: 1.0
To: David Lang <dlang@diginsite.com>
CC: Bret Robinson <brobinso@atsi.com>, C.Reiser@Austria.EU.net,
        firewalls@GreatCircle.COM
Subject: Re: SKIP question
X-Priority: 3 (Normal)
References: <Pine.LNX.3.96.980109154958.30456V-100000@mail.diginsite.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

For something more flexible, you might want to try to use PPTP or
IPsec.  My company makes a large scale PPTP and IPsec server, with many
other features.  You can deploy these solutions with client software
that does not presume any particular infrastructure on the Internet.

--
Michael Feinstein                        New Oak Communications
VP, Product Marketing                    125 Nagog Park
Tel: 978-266-1011 x103                   Acton, MA  01720
Fax: 978-266-1080                        http://www.newoak.com
mfeinstein@newoak.com                    Pager: 800-592-6311



From firewalls-owner  Sat Jan 10 12:48:04 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA25462; Sat, 10 Jan 1998 12:34:43 -0800 (PST)
Received: from enteract.com (enteract.com [206.54.252.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA25445 for <firewalls@GreatCircle.COM>; Sat, 10 Jan 1998 12:34:37 -0800 (PST)
Received: from jimst.alephconsult.com (jimst.sa.enteract.com [207.229.133.64]) by enteract.com (8.8.8/8.7.6) with SMTP id OAA28559; Sat, 10 Jan 1998 14:35:34 -0600 (CST)
Received: by localhost with Microsoft MAPI; Sat, 10 Jan 1998 14:35:21 -0600
Message-ID: <01BD1DD4.FA9E6A00.jimst@enteract.com>
From: James Strompolis <jimst@enteract.com>
Reply-To: "jimst@enteract.com" <jimst@enteract.com>
To: "'Kerry Jones'" <kjones@aims.gov.au>,
        "firewalls@GreatCircle.COM"
	 <firewalls@GreatCircle.COM>
Subject: RE: DNS on firewall??
Date: Sat, 10 Jan 1998 14:21:31 -0600
Organization: Aleph Consultants, Inc.
X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

  Here's how I would set up a minimal DNS structure with security in mind. 
 When I speak of security, I mean protection & availability for your 
network.  At least three DNS servers are required.  Four would be nice for 
redundancy.  Five would be even better.

  Unless you are using IPX/SPX and/or NETBEUI and/or Appletalk and some 
type of protocol translation method (a proxy maybe), install one internal 
Primary DNS so your internal network machines can find each other.  This 
one sits inside the firewall.  Optional (not really if you have a large 
organization) internal Secondary also goes inside the firewall.  It is 
really a good idea to have an internal Secondary "in case".  You can put 
other DNS servers all over your internal network if you have subdomains 
that you want to be able to keep running in the event of a breakdown in the 
primary(ies).  It depends on the size and complexity of the organization.

  A single machine with multiple network interfaces is NOT a DMZ.  A DMZ is 
an external subnet that sits between two filtering routers, firewalls or 
combination of these, etc.  There would be a hub in there somewhere.  By 
running all of your traffic through the machine you have labeled as your 
firewall, you are most likely opening up that machine to a successful 
attack.  As one other poster suggested, get "Building Internet Firewalls" 
by Chapman & Zwicky.  Published by O'Reilly & Associates, Inc.  "Firewalls 
and Internet Security" by Cheswick & Bellovin is another title I recommend.

  Back to DNS.  Install one public Primary DNS in your DMZ (a real DMZ). 
 You could run other services on this machine if $$$ is an issue and you do 
not have a high traffic site.  It is configured to be authoritative for 
your domain.  The public Secondary DNS should reside with your ISP or 
another external organization so you don't disappear from the net in the 
event of a long local power failure or connection failure (someone cuts the 
cables and it takes a while to fix them).  Sometimes you can work it out 
with another company to be your Secondary in exchange for being their 
Secondary.  It's better to have multiple Secondaries.  You could have a 
Primary and a Secondary in your DMZ and also have an additional Secondary 
off site.

  That would set you up more securely than you are now.  I've probably left 
things that need to be considered out.  Read the books.  Apply what you 
pick up from there to your own situation.

- James Strompolis
  Aleph Consultants, Inc.
  jimst@enteract.com


From firewalls-owner  Sat Jan 10 14:53:26 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id OAA05035; Sat, 10 Jan 1998 14:39:24 -0800 (PST)
Received: from mcfeely.bsfs.org (mcfeely.bsfs.org [204.91.13.34]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id OAA05021 for <firewalls@GreatCircle.COM>; Sat, 10 Jan 1998 14:39:19 -0800 (PST)
Received: (from wombat@localhost) by mcfeely.bsfs.org (8.6.12/8.6.12) id DAA01879; Sat, 10 Jan 1998 03:31:45 -0500
Date: Sat, 10 Jan 1998 03:31:37 -0500 (EST)
From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: MS <"ims02@netvigator.com"@netvigator.com>
cc: "firewalls@GreatCircle.COM" <firewalls@GreatCircle.COM>
Subject: Re: Proxy Servers on DMZ?
In-Reply-To: <199801101734.BAA28606@imsp074.netvigator.com>
Message-ID: <Pine.BSF.3.91.980110032420.1597E-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Depends on what you are doing with these servers, and what your level of 
paranoia is.

In general, it is ok for most people. You can add to the security of this 
configuration very inexpensively by using a secure hub to provide the DMZ 
segment.

With ethernet, every device on the segment must receive the datagram. 
This makes it easy for someone who has taken over a system to put the 
system's network interface into promiscuous mode (passing all frames up 
the stack, not just those w/ the system's mac address) and reading 
everyone's traffic. Secure hubs get around this by overwriting the data 
payload with random junk when sending the frame out ports that don't 
service the destination mac address; the other stations still get the 
frame, but the data payload is useless. Many vendors make these hubs - 
3Com sells an 8 port unit for a few hundrred $$.

The above is not foolproof, especially if users are legitimately 
conversing between the "compromised" systems and other systems on the 
DMZ. It will slow an intruder down, however, giving you more of an 
opportunity to detect them before they can obtain additional access. For 
the small cost, it is a worthwhile addition to your configuration.

-r.w.

On Sun, 1 Feb 1998, MS wrote:

> Hi,
> 
> Is it a secure method to place all the proxy servers(eg mail server, ftp
> server)
> into the DMZ segment?
> 
> Jim
> 

From firewalls-owner  Sat Jan 10 16:03:02 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA15827; Sat, 10 Jan 1998 15:52:46 -0800 (PST)
Received: from mercury.Sun.COM (mercury.Sun.COM [192.9.25.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id PAA15810 for <firewalls@GreatCircle.COM>; Sat, 10 Jan 1998 15:52:39 -0800 (PST)
Received: from Eng.Sun.COM ([129.144.134.6]) by mercury.Sun.COM (SMI-8.6/mail.byaddr) with SMTP id PAA28258; Sat, 10 Jan 1998 15:53:46 -0800
Received: from basilisk.Eng.Sun.COM (basilisk.Eng.Sun.COM [129.144.49.2])
	by Eng.Sun.COM (SMI-8.6/SMI-5.3) with SMTP id PAA29869;
	Sat, 10 Jan 1998 15:53:41 -0800
Received: from wolfe by basilisk.Eng.Sun.COM (SMI-8.6/SMI-SVR4)
	id PAA18705; Sat, 10 Jan 1998 15:53:33 -0800
Date: Sat, 10 Jan 1998 16:52:28 -0700 (MST)
From: "Gary R. Wolfe" <Gary.Wolfe@Eng.Sun.COM>
Reply-To: "Gary R. Wolfe" <Gary.Wolfe@Eng.Sun.COM>
Subject: Re: SKIP question
To: David Lang <dlang@diginsite.com>
Cc: firewalls@GreatCircle.COM
In-Reply-To: "Your message with ID" <Pine.LNX.3.96.980109154958.30456V-100000@mail.diginsite.com>
Message-ID: <Roam.SIMC.2.0.6.884476348.14294.wolfe@basilisk>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> 
> On Fri, 9 Jan 1998, Bret Robinson wrote:
> 
> > > 
> > > >I have a question about SKIP that I hope someone can help me with. We are
> > > >testing a set-up that will allow employees to access our internal network
> > > >from home and also allow us to connect to partners' sites using SKIP. The
> > > >two set-ups are shown below:
> > > 
> > > [lots of problems with SKIP deleted]
> > > 
> > > I am afraid, this won't help very much, but I prefere VPN-solutions, where I
> > > don't depend on any IP infrastructural feature of an ISP. What if the external
> > > PC is travelling around using a great number of different ISPs to dial into
> > > the Net and connect to your site?
> > > 
> > 
> > The EFS/SKIP software can take this into account, but it makes things
> > insecure since you basically have to define a rule that allows any
> > IP address to connect with the remote machine's defined public key. 
> > 
> 
> can you do this for many remote machines? i.e. 20 sales laptops that you
> have the keys for that may connect from anywhere.
> 
Yes you can. And it does not make it insecure. All traffic must be encrypted
and authenticate with the proper DH keys.



Thanks,
Gary

=========================================================================

    /\      Gary R. Wolfe
   \\ \     Network Security Specialist
  \ \\ /    Sun Microsystems
 / \/ / /   Internet Commerce and Security
/ /   \//\  
\//\   / /  
 / / /\ /   http://www.sun.com/security
  / \\ \    Cell Phone:    (719) 331-7912
   \ \\     Fax:           (719) 481-1273
    \/      E-mail:        gary.wolfe@sun.com
           
=========================================================================




From firewalls-owner  Sat Jan 10 16:25:50 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA16029; Sat, 10 Jan 1998 15:56:00 -0800 (PST)
Received: from magna.com.au (mail.magna.com.au [203.4.212.90]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id PAA16002 for <firewalls@greatcircle.com>; Sat, 10 Jan 1998 15:55:44 -0800 (PST)
Received: from saccess-04-001.magna.com.au (saccess-08-063.magna.com.au [203.111.73.63]) by magna.com.au (8.8.5/8.6.10) with SMTP id KAA07230; Sun, 11 Jan 1998 10:56:37 +1100 (EST)
Received: by saccess-04-001.magna.com.au with Microsoft Mail
	id <01BD1E7F.9097F6C0@saccess-04-001.magna.com.au>; Sun, 11 Jan 1998 10:56:27 +1100
Message-ID: <01BD1E7F.9097F6C0@saccess-04-001.magna.com.au>
From: Ian Krieger <iank@magna.com.au>
To: "'Paul D. Robertson'" <proberts@clark.net>
Cc: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: RE: Re[2]: Hardware for seperating LAN from dialouts
Date: Sun, 11 Jan 1998 10:56:23 +1100
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Lots of IS people would.  Most aren't versed in security.  I've seen =
very=20
few places outside of the government where users are *stopped* from=20
loading their own software. =20
[$]  Maybe true for you, clients of mine generally are quite security =
conscious, and those who are not are persuaded to be through security =
audits or simple intrusion tests.

Policies don't stop attackers.  There are=20
still hundreds of "non-Internet" services out there which use dial =
access=20
to get stock quotes, tax information, legal research, electronic=20
contracting, mailing list informaion, advertising brokerages, and a =
bunch=20
more business level services,
[$]  To my knowledge these all that I or my clients use are quite safe =
in that sense. Any updates are thoroughly tested.

are your switches programmed to limit=20
outbound modem calls to a specific number?
[$]  depending upon the site, YES.

  Care to guess how many of of 1000 are?
[$]  ????

  Once those users have access for the business need, it doesn't=20
take much more than a client upgrade, competitively priced "service"=20
offer, or something like that to get the machine and then the network. =20
[$]  True but as I said earlier, it is far easier to walk in as a =
consultant or a technician and walk out with a PC , or a couple of =
HDD's.

I don't know how many sites you have, or how long you've been doing =
this,
[$]  about 30-40 sites, both government and private, from small sites to =
ones with offices all over the country.
=20
but I *still* see "passwd.txt", "enable, cisco, poncho", and a bunch of=20
less business focused thinge that people should have stopped doing years =
ago.
As I pointed out, if IS people had that much control, virus replication=20
would be a moot point, and it isn't for most places.
[$]  Still a problem occasionally but normally gets canned the first =
time a disk gets put in a drive.

  If you're lucky enough to be somewhere small enough to control it, or =
in a line of=20
business where its seen as a necessity, and you have enough good people=20
to do it, then as I originally stated, you probably don't need to worry=20
about it.  _Most_ places aren't like that.
[$]  OK I'll give you _Most_, though recently I have noticed that a lot =
of people are becoming more and more paranoid regarding virus and other =
intrusions.

Of course, this assumes that the IS department even knows about the=20
software.  Contrary to popular belief, most business units tend to not=20
consult IS for everything they do. =20
[$]  Yes, this can be a problem at times.

Funny, everyone I know at places with fiscally useful data still has=20
virus events, desktops and servers that are back-level enough to have=20
known vulnerabilities, FTP'd software from www.microsoft.com,  and a=20
bunch of other problems that show that it is next to impossible to scale =

serious security management to a mid to large enterprise without a level =
of=20
commitment that isn't in a lot of places.  I bet you've done checksum=20
comparisons of vendor-supplied media, and don't let salesmen bring media =
in=20
the door with them too, right?
[$]  OK haven't run checksums, though sales people loading software is =
completely taboo... If that is needed mostly goes onto a test system of =
some sort.

Perhaps you'd care to list the number of sites you know that block=20
unencrypted, unverified transfers from, say *microsoft.com?  There is a=20
large segment of risk management which is largely unaddressed at most=20
companies.  If you haven't seen that, then you don't get out much.=20
[$]  A lot of large sites DO NOT need to have to the desktop access to =
the internet. And most do not. Those that do, I will agree, are =
certainly at risk. And I do agree that there is a large number of =
companies that either do not know of the risk or don't think that it is =
one. Oh, and by the way I get out quite often thankyou.

Ian.
---------------------------------------------------------------
Ian W Krieger						IanK@Magna.com.au

"qIm tera'ngan!" - Translated from Klingon "Attention Earther!"
		http://www.magna.com.au/~iank
 

From firewalls-owner  Sat Jan 10 18:48:07 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id SAA29860; Sat, 10 Jan 1998 18:33:34 -0800 (PST)
Received: from gargoyle.clark.net (gargoyle.clark.net [168.143.0.250]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id SAA29853 for <firewalls@greatcircle.com>; Sat, 10 Jan 1998 18:33:26 -0800 (PST)
Received: (qmail 6820 invoked by uid 500); 11 Jan 1998 02:41:59 -0000
Date: Sat, 10 Jan 1998 21:41:59 -0500 (EST)
From: "Paul D. Robertson" <proberts@clark.net>
X-Sender: proberts@gargoyle
To: Ian Krieger <iank@magna.com.au>
cc: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: RE: Re[2]: Hardware for seperating LAN from dialouts
In-Reply-To: <01BD1E7F.9097F6C0@saccess-04-001.magna.com.au>
Message-ID: <Pine.LNX.3.91.980110193836.6529B-100000@gargoyle>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Sun, 11 Jan 1998, Ian Krieger wrote:

> Policies don't stop attackers.  There are 
> still hundreds of "non-Internet" services out there which use dial access 
> to get stock quotes, tax information, legal research, electronic 
> contracting, mailing list informaion, advertising brokerages, and a bunch 
> more business level services,
> [$]  To my knowledge these all that I or my clients use are quite safe in that sense. Any updates are thoroughly tested.

As I originally stated, if you have that much control, then you probably 
don't have to worry about it.  

> are your switches programmed to limit 
> outbound modem calls to a specific number?
> [$]  depending upon the site, YES.

"Depending on the site" means that some are, and some aren't.  Obviously, 
that means that some are dependent on host configuration for outbound dial
security.  Wonder how many of those still have dial-up networking installed 
at the desktop?  Is the threat level sufficient for everyone to require 
outbound call management?  Probably not at the moment, but my point 
stands that someone has to consider the threat level and plan accordingly.

As more and more functions move into OS', and more and more bad guys 
discover how to chain them together, things get worse, not better.  How 
many function calls does it take under Win95 to tunnel HTTP?  MS' 
arguments about the browser being built into the OS should give you some 
insight into how secured that OS is from doing things you'd rather not 
have it do over either dial up or Internet links.   

>   Once those users have access for the business need, it doesn't 
> take much more than a client upgrade, competitively priced "service" 
> offer, or something like that to get the machine and then the network.  
> [$]  True but as I said earlier, it is far easier to walk in as a consultant or a technician and walk out with a PC , or a couple of HDD's.

My experiences with smaller companies is that they generally have weak 
electronic and physical security.  But you can do much more damage with a 
network connection than you can with a single hard drive or machine, and this 
isn't physical_security@greatcircle.com.  As has been pointed out before, 
there's a chain of evidence in physical crime that doesn't necessarily exist 
online, and not having one is no excuse for not having the other.


> I don't know how many sites you have, or how long you've been doing this,
> [$]  about 30-40 sites, both government and private, from small sites to ones with offices all over the country.

Most of my current responsibilies scope about 150 mostly autonomous business 
units, as well as several partners, "friends of the company", subsiduaries, 
and potential and actual investments.    

> If you're lucky enough to be somewhere small enough to control it, or in a line of 
> business where its seen as a necessity, and you have enough good people 
> to do it, then as I originally stated, you probably don't need to worry 
> about it.  _Most_ places aren't like that. 
> 
[$] OK I'll give you _Most_,though recently I have noticed that a lot of people are becoming more and more paranoid regarding virus and other intrusions. 

Well, "Most" was the gist of the original note, which is why I pointed 
out some of the things you'd need to think about if you were in the 
"most" category.  

Paranoia is a good thing.  For the past decade, not much has changed in 
the way of virus prevention.  In the last few years, if anything it's 
gotten worse due to the proliferation of appliation layer viruses.  

We don't need the same thing to happen with network intrusions over the next 
few years because though virus scanning is great business for AV companies, 
it really doesn't address the disease, just the symptom.  IDS' are the same 
way for the security market.  Virus distribution, prevention and control 
is a very good parallel, and we can all learn quite a bit from it.  

> [$]  OK haven't run checksums, though sales people loading software is completely taboo... If that is needed mostly goes onto a test system of some sort.

Salespeople don't load it, they hand it to their customer in accounting, 
supply, sales, or wherever.  Funnily enough, my boss just won't let me
strip search all the visitors for computer media.  Maybe I should move to 
.au...

Last month's issue of a computer magazine contained a CD with a virus on 
it attached to the cover.  Just like "most IS people wouldn't...", most 
computer publications wouldn't...  Not accounting for incompetence a 
layer down the distribution chain is a fault with most places.  Make that 
malicious, and "game over".

> Perhaps you'd care to list the number of sites you know that block 
> unencrypted, unverified transfers from, say *microsoft.com?  There is a 
> large segment of risk management which is largely unaddressed at most 
> companies.  If you haven't seen that, then you don't get out much. 
> [$]  A lot of large sites DO NOT need to have to the desktop access to the internet. And most do not. Those that do, I will agree, are certainly at risk. And I do agree that there is a large number of companies that either do not know of the risk or don't think that it is one. Oh, and by the way I get out quite often thankyou.

I don't think that _most_ companies need desktop access.  I also don't 
think that stops _most_ companies from providing it.  3 years ago, that wasn't
as true as it is today.  I don't think I've visited a company in the last 
three years that didn't allow desktop access.  

Given the fact that tunnels over SMTP, modifying data over FTP, and reverse 
telnet over ICMP have all been repeatedly demonstrated, it should be obvious 
that trusting security to a single product's configuration is something we 
should avoid if at all possible, irregardless of how deluded you may think me 
saying that is.  I continue to stand by my original assertions.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson      "My statements in this message are personal opinions
proberts@clark.net      which may have no basis whatsoever in fact."
                                                                     PSB#9280


From firewalls-owner  Sat Jan 10 20:47:56 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id UAA13319; Sat, 10 Jan 1998 20:31:15 -0800 (PST)
Received: from m6.sprynet.com (m6.sprynet.com [165.121.2.89]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id UAA13312 for <firewalls@GreatCircle.COM>; Sat, 10 Jan 1998 20:31:08 -0800 (PST)
Received: from zepher (hdn91-150.hil.compuserve.com [206.175.99.150]) by m6.sprynet.com (8.6.12/8.6.12) with SMTP id UAA25491; Sat, 10 Jan 1998 20:31:52 -0800
Message-Id: <3.0.3.32.19980110232702.006b7b78@m6.sprynet.com>
X-Sender: jsk347@m6.sprynet.com
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Sat, 10 Jan 1998 23:27:02 -0500
To: _bLaDe_ <_blade_@skynet.be>
From: Steve Kruse <jsk347@sprynet.com>
Subject: Re: E-mail Encryption
Cc: Peter da Silva <peter@baileynm.com>, MacGyver <macgyver@tos.net>,
        firewalls@GreatCircle.COM
In-Reply-To: <32FE5572.F009080B@skynet.be>
References: <199801070018.SAA31044@starbase.tos.net>
 <3.0.3.32.19980107160808.006a33b4@m6.sprynet.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Personal Opinion Begins!~
Yes...I think that for the most part 1024 bit keys are more than 
sufficient. All the data I've seen indicates that the time to do a 
key search on it would be far beyond most means.  Brute force attack 
would be far more likely to succeed somewhere in the eons than 
cracking the key unless some sort of really tremendous resources were 

put into play.  Even then, I'm not sure most information would be 
worth that amount of compute cycles although some would be I'm sure.  

There have been several threads here and elsewhere on how long it 
would take to crack a key that long.  I don't remember the numbers 
now, but it's longer than your chewing gum will last on the bedpost 
overnight!  Course, if you feel compelled, by all means use 2048 bit 
keys.  On a Pentium, the extra time to encrypt and decrypt with 2048 
is not ALL that much longer anyway.

I welcome anyone else's opinion on the matter...however I'm sure that 

I'd be more than comfortable with 1024, personally.

Steve Kruse
Milkyway Networks
 
At 11:53 PM 2/9/97 +0100, _bLaDe_ wrote:
>Is a 1024bit key enough??
>
>Steve Kruse wrote:
>
>> I think it might have been mentioned on here, but there is a $5.00
>> "up-downgrade" that lets you use the RSA which IS compatabile with 

PGP 2.x.
>>  Check the PGP website for info.
>>
>> Steve Kruse
>>
>> At 09:36 AM 1/7/98 -0600, Peter da Silva wrote:
>> >> Using Eudora 4.0 onward (I'm not sure if previous versions 
support this
>> >> feature), you have the ability to set an "output filter", which 

can be set
>> >> to call any arbitrary program.  PGP 5.0+ has a Eudora plugin 
option that
>> >> you can use to automagically guarantee that all emails sent out 

are
>> >> encrypted in an invisible way to the user.
>> >
>> >Unfortunately PGP 5.0+ encryption is incompatible with PGP 2.6, 
which is
>> >what most of the people who use PGP are using. I understand the 
political
>> >reasons for switching to D-H key exchange to get out from under 
RSA, but
>> >I'm going to stick with 2.6 until there's a really compatible 
upgrade path
>> >that works on both protocols and all platforms.
>> >
>
>
>
>--
>_bLaDe_
>Belgium, Europe
>UIN: 2346943
>_blade_@skynet.be
>
>-- "Wherever you go, there you are..." --
>
>-----BEGIN PGP PUBLIC KEY BLOCK-----
>Version: 2.6.3ia
>
>mQCNAzSeStUAAAEEALnUwJbmehdJElVNxdZS4eh9Px7JahLyshVlp0n9Q+bcYhL+
>sjXGUU4NF5jcwik+WJ75ttjLSfwVnuHZdCuK5VcBoneMFjV+EF4uCRT7c2iff+SR
>xYoUIFoRGI8plZcxsbnFo8PxLpnfc8p1wMA0MB/VvQrpW8r3g/Qxws0qK4uRAAUR
>tBtfYkxhRGVfIDxfYmxhZGVfQHNreW5ldC5iZT6JAJUDBRA0nkrV9DHCzSori5EB
>AfyNBACAkfulGxywbXfu1303eGhElsuboEuPaj9cM62uYH2mP+kFhnVmu4ZkCemR
>U5TkdSyyAwH2ihzyKCmlrDChrSwOTeY4eEuX1xZ/KPXFprmAGKWXE3HiGgxwoVZR
>1gKVz2CDTPWbmOuMbTOV9ZLIbDpmA67GoxmV/NzDXSF8PEMRQg==
>=DPfY
>-----END PGP PUBLIC KEY BLOCK-----
>
- -----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNLhJx+Z40Wmdt8j7EQKLPQCeOp4mkumBIv8zkjB2y8kDEkCf3RgAoNbb
nUFxRMHhrr3k/c4nGnjpYBOG
=w0XH
- -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBNLhKFeZ40Wmdt8j7EQJdgQCgrKYTt+Wl8564vBfODX0qcx7mn/sAoOIo
iK0+8yLOkWVFIcIL5BWw6BU3
=Qk7X
-----END PGP SIGNATURE-----

***********************************************************************
* Steve Kruse                            skruse@milkyway.com          *
* Milkyway Networks                      jsk347@sprynet.com           *
* Network Systems Engineer               PGP Key on MIT Keyserver     *
* KEY FINGERPRINT: 6F80 6F39 33F2 195A 0937  A91D E678 D169 9DB7 C8FB *
* Support your right to privacy.  Encrypt whenever possible!          *
***********************************************************************

From firewalls-owner  Sun Jan 11 02:17:58 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id CAA07684; Sun, 11 Jan 1998 02:05:41 -0800 (PST)
Received: from imsp074.netvigator.com (imsp074.netvigator.com [205.252.144.129]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id CAA07585 for <firewalls@GreatCircle.COM>; Sun, 11 Jan 1998 02:04:59 -0800 (PST)
Received: from js-computer (hhtam023155.netvigator.com [208.139.107.155])
	by imsp074.netvigator.com (8.8.8/8.8.8) with SMTP id SAA06036;
	Sun, 11 Jan 1998 18:05:06 +0800 (HKT)
Message-Id: <199801111005.SAA06036@imsp074.netvigator.com>
Date: Sun, 01 Feb 1998 18:43:08 +0800
From: MS <"ims02@netvigator.com"@netvigator.com>
Reply-To: "ims02@netvigator.com"@netvigator.com
X-Mailer: Mozilla 3.0Gold (Win95; I)
MIME-Version: 1.0
To: Rabid Wombat <wombat@mcfeely.bsfs.org>
CC: "firewalls@GreatCircle.COM" <firewalls@GreatCircle.COM>
Subject: Re: Proxy Servers on DMZ?
References: <Pine.BSF.3.91.980110032420.1597E-100000@mcfeely.bsfs.org>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Rabid Wombat wrote:
> 
> Depends on what you are doing with these servers, and what your level of
> paranoia is.
> 
> In general, it is ok for most people. You can add to the security of this
> configuration very inexpensively by using a secure hub to provide the DMZ
> segment.
> 
> With ethernet, every device on the segment must receive the datagram.
> This makes it easy for someone who has taken over a system to put the
> system's network interface into promiscuous mode (passing all frames up
> the stack, not just those w/ the system's mac address) and reading
> everyone's traffic. Secure hubs get around this by overwriting the data
> payload with random junk when sending the frame out ports that don't
> service the destination mac address; the other stations still get the
> frame, but the data payload is useless. Many vendors make these hubs -
> 3Com sells an 8 port unit for a few hundrred $$.
> 
> The above is not foolproof, especially if users are legitimately
> conversing between the "compromised" systems and other systems on the
> DMZ. It will slow an intruder down, however, giving you more of an
> opportunity to detect them before they can obtain additional access. For
> the small cost, it is a worthwhile addition to your configuration.
> 
> -r.w.
> 
> On Sun, 1 Feb 1998, MS wrote:
> 
> > Hi,
> >
> > Is it a secure method to place all the proxy servers(eg mail server, ftp
> > server)
> > into the DMZ segment?
> >
> > Jim
> >
Thanks your information.

Do you mean that using the secure hub, the broadcast ethernet payload
containing
a password (eg through the LAN to login a system) will not be seen when
somebody
capture the traffic using an LAN analyser software.  If so, what is the
method
(encryption? scrambling? ..) behind such secure hub? Is this a secure
method to 
remove the inherent security risk assosicated with broadcast LAN
environment?

Jim

From firewalls-owner  Sun Jan 11 02:32:58 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id CAA09820; Sun, 11 Jan 1998 02:23:45 -0800 (PST)
Received: from marge.cyber-dyne.com (marge.cyber-dyne.com [208.129.41.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id CAA09800 for <firewalls@greatcircle.com>; Sun, 11 Jan 1998 02:23:37 -0800 (PST)
Received: from RealWorld.uoregon.edu (lineG.cyber-dyne.com [208.129.41.16])
	by marge.cyber-dyne.com (8.8.8/8.8.8) with SMTP id CAA05006;
	Sun, 11 Jan 1998 02:15:27 -0800
Message-Id: <3.0.2.32.19980111020952.006e2f2c@websoftassoc.com>
X-Sender: websoft@websoftassoc.com (Unverified)
X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.2 (32)
Date: Sun, 11 Jan 1998 02:09:52 -0800
To: WebSoft Associates <websoft@websoftassoc.com>
From: WebSoft Associates <websoft@websoftassoc.com>
Subject: Congratulations!
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Dear Sir or Ms:
 
We at WebSoft Associates (http://www.websoftassoc.com) would like to
congratulate you on your recent selection by Inc. Magazine as
one of the 500 fastest growing private companies in the United States.
 
Being a small private company like yourself, we understand the need for
innovative and technically advanced business solutions.  We believe that we
can offer these solutions at a fair price and at an unmatched professional
level.  If you are committed to having an Internet presence, we are
committed to making that presence be as affordable, practical, and
professional as possible.
 
We are currently increasing both our customer base and the services that we
provide, as we strive to one day be included
in the Inc. 500.  We would like you to consider contacting WebSoft for any
of your future Internet and business technology needs, and help us meet
that goal.
 
Once again congratulations, and thank you for your time and consideration.
We will not send further email to your account unless you contact us first.
 
Sincerely,
 
Brian L. Cheek
President
WebSoft Associates
E-mail:  Websoft@websoftassoc.com
Website:  http://www.websoftassoc.com

From firewalls-owner  Sun Jan 11 03:33:03 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id DAA17163; Sun, 11 Jan 1998 03:08:12 -0800 (PST)
Received: from mtigwc03.worldnet.att.net (mtigwc03.worldnet.att.net [204.127.131.34]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id DAA16964 for <firewalls@GreatCircle.COM>; Sun, 11 Jan 1998 03:07:36 -0800 (PST)
From: mht@clark.net
Received: from highlander ([12.68.178.136]) by mtigwc03.worldnet.att.net
          (post.office MTA v2.0 0613 ) with SMTP id AAB11186;
          Sun, 11 Jan 1998 11:08:46 +0000
Message-Id: <3.0.3.32.19980111060600.008ebe60@pop3.clark.net>
X-Sender: mht@pop3.clark.net
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Sun, 11 Jan 1998 06:06:00 -0500
To: Ed Forbes <ejf@bbnplanet.com>
Subject: Re: CHARMARK
Cc: firewalls@GreatCircle.COM
In-Reply-To: <3.0.3.32.19980110232702.006b7b78@m6.sprynet.com>
References: <32FE5572.F009080B@skynet.be>
 <199801070018.SAA31044@starbase.tos.net>
 <3.0.3.32.19980107160808.006a33b4@m6.sprynet.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Ed,

I recently added Computer Security Institute Course F1 and was wondering if
you could provide me with some more information about the material??

It stated it was copyrighted by CHARMARK but yet the presenter was from the
one of those Big Six Corporations..  Any ideas??


/mht

From firewalls-owner  Sun Jan 11 05:18:00 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id FAA01583; Sun, 11 Jan 1998 05:10:26 -0800 (PST)
Received: from mtigwc03.worldnet.att.net (mtigwc03.worldnet.att.net [204.127.131.34]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id FAA01574 for <firewalls@GreatCircle.COM>; Sun, 11 Jan 1998 05:10:20 -0800 (PST)
From: mht@clark.net
Received: from highlander ([12.68.178.122]) by mtigwc03.worldnet.att.net
          (post.office MTA v2.0 0613 ) with SMTP id AAA2221;
          Sun, 11 Jan 1998 13:11:31 +0000
Message-Id: <3.0.3.32.19980111080834.0082fc00@pop3.clark.net>
X-Sender: mht@pop3.clark.net
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Sun, 11 Jan 1998 08:08:34 -0500
To: Ed Forbes <ejf@bbnplanet.com>
Subject: Re: CHARMARK
Cc: firewalls@GreatCircle.COM
In-Reply-To: <3.0.3.32.19980111060600.008ebe60@pop3.clark.net>
References: <3.0.3.32.19980110232702.006b7b78@m6.sprynet.com>
 <32FE5572.F009080B@skynet.be>
 <199801070018.SAA31044@starbase.tos.net>
 <3.0.3.32.19980107160808.006a33b4@m6.sprynet.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Ed,

I recently attended Computer Security Institute Course F1 and was wondering
if you could provide me with some more information about the material??

It stated it was copyrighted by CHARMARK but yet the presenter was from the
one of those Big Six Corporations..  Any ideas??


/mht



From firewalls-owner  Sun Jan 11 10:47:59 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id KAA26222; Sun, 11 Jan 1998 10:43:22 -0800 (PST)
Received: from grab.mulligan.com (grab.coslabs.com [199.233.92.34]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id KAA26212 for <firewalls@GreatCircle.COM>; Sun, 11 Jan 1998 10:43:16 -0800 (PST)
Received: from future.mulligan.com (future [199.233.92.11])
	by grab.mulligan.com (8.8.7/8.8.7) with SMTP id LAA12746;
	Sun, 11 Jan 1998 11:44:44 -0700 (MST)
Received: from future by future.mulligan.com (SMI-8.6/SMI-SVR4)
	id LAA16348; Sun, 11 Jan 1998 11:44:10 -0700
Message-Id: <199801111844.LAA16348@future.mulligan.com>
X-Mailer: exmh version 2.0.1 12/23/97
To: guard@cnnic.net.cn
cc: firewalls@GreatCircle.COM
Subject: Re: What is Stateful inspection 
In-reply-to: Your message of "Sat, 10 Jan 1998 15:40:49 PST."
             <34B80701.94392A4A@cnnic.net.cn> 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Sun, 11 Jan 1998 11:44:10 -0700
From: Geoff Mulligan <geoff@mulligan.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

you might try taking a look at www.sunscreen.com.

	geoff



From firewalls-owner  Sun Jan 11 11:18:04 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA28264; Sun, 11 Jan 1998 11:02:48 -0800 (PST)
Received: from c00069-100lez.eos.ncsu.edu (c00069-100lez.eos.ncsu.edu [152.1.26.28]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id LAA28257 for <firewalls@GreatCircle.COM>; Sun, 11 Jan 1998 11:02:41 -0800 (PST)
Received: from localhost (jkwilli2@localhost)
          by c00069-100lez.eos.ncsu.edu (8.8.4/EC02Jan97) with SMTP
	  id OAA05171; Sun, 11 Jan 1998 14:03:24 -0500 (EST)
X-Authentication-Warning: c00069-100lez.eos.ncsu.edu: jkwilli2 owned process doing -bs
Date: Sun, 11 Jan 1998 14:03:23 -0500 (EST)
From: Ken Williams <jkwilli2@unity.ncsu.edu>
X-Sender: jkwilli2@c00069-100lez.eos.ncsu.edu
To: fygrave@usa.net
cc: Norman Widders <winspace@atinet.com.au>,
        "'firewalls mailing list'" <firewalls@GreatCircle.COM>
Subject: Re: rootshell has a mailing list
In-Reply-To: <Pine.LNX.3.96.980110125524.24199F-100000@freenet.bishkek.su>
Message-ID: <Pine.SOL.3.96.980111140208.4845A-100000@c00069-100lez.eos.ncsu.edu>
X-PreMailer: Microsoft-Unix '99 MSProExcelSendMail ver 0.98 beta
X-NoSpam: Pursuant to US Code; Title 47; Chapter 5; Subchapter II; 227
X-NoSpam: any and all nonsolicited commercial E-mail sent to this address is
X-NoSpam: subject to a download and archival fee in the amount of 500 US dollars.
X-NoSpam: Any E-mail sent to this address denotes acceptance of these terms.
X-Copyright: The contents of this message may not be reproduced in any form
X-Copyright: (including Commercial use) unless specific permission is granted
X-Copyright: by the author of the message.  All requests must be in writing.
X-Disclaimer: This email is meant for educational purposes only.
X-Disclaimer: The contents of this email do not reflect the thoughts
X-Disclaimer: or opinions of either myself or my employer and are not
X-Disclaimer: endorsed by sponsored by or provided on behalf of
X-Disclaimer: North Carolina State University.
X-Disclaimer: Any errors in spelling tact or fact are transmission errors.
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Sat, 10 Jan 1998, Fyodor wrote:

>
>On Mon, 5 Jan 1998, Norman Widders wrote:
>> 
>> folks,
>> 
>> www.rootshell.com has a mailing list, well worth subscribing imho
>> just to keep abreast of current exploits, useful if you like to see
>> what it is that they are using on us... just started on 1/2/1998, ymmv
>
>Greetings,
> Can you provide more info about this please? I.G. location, subscription
>info, whatever...

Send a message to majordomo@rootshell.com with "subscribe announce" in the
body (without the quotes). New exploits will be mailed to you
automatically.

go to http://www.rootshell.com/ for more details.

Respectfully,

Ken Williams 

/--------------|  TATTOOMAN -aka- rute  |--------------\  
  NCSU Computer Science    Member of E.H.A.P.   
  jkwilli2@unity.ncsu.edu  http://www.hackers.com/ehap/ 
  UNIX ICQ UIN# 4231260    ehap@hackers.com     
  FTP Site:  ftp://152.7.11.38/pub/personal/tattooman/
  WWW 2:     http://www4.ncsu.edu/~jkwilli2/
  PGP Key:   http://www4.ncsu.edu/~jkwilli2/pgp.asc
      http://www4.ncsu.edu/~jkwilli2/pgp_fingerprint
\---------|  http://152.7.11.38/~tattooman/  |---------/




From firewalls-owner  Sun Jan 11 12:18:08 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA06984; Sun, 11 Jan 1998 12:02:49 -0800 (PST)
Received: from pentagon.io.com (pentagon.io.com [199.170.88.5]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA06968 for <firewalls@GreatCircle.COM>; Sun, 11 Jan 1998 12:02:43 -0800 (PST)
Received: from localhost (cooper@localhost)
	by pentagon.io.com (8.8.5/8.8.5) with SMTP id OAA05493;
	Sun, 11 Jan 1998 14:03:45 -0600 (CST)
X-Authentication-Warning: pentagon.io.com: cooper owned process doing -bs
Date: Sun, 11 Jan 1998 14:03:45 -0600 (CST)
From: William Cooper <cooper@io.com>
To: guard@cnnic.net.cn
cc: firewalls@GreatCircle.COM
Subject: Re: What is Stateful inspection
In-Reply-To: <34B80701.94392A4A@cnnic.net.cn>
Message-ID: <Pine.BSI.3.96.980111140312.5444A-100000@pentagon.io.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Sat, 10 Jan 1998 guard@cnnic.net.cn wrote:

> Hi,experts on Stateful inspection,
> I first learned Stateful inspection from checkpoint firewall-1.
> I am very intersted in it though I am only a beginner in firewall.
> Could you tell me further things about that except those on Checkpoint's
> site?
> Or at least some referals to relative sites.
> Thank you very much.


once again, stateful inspection refers to examining each packet "in
context," or comparing each packet to packets that have recently been
inspected.  an example would be if a packet showed up at the firewall from
the public Internet and appeared to be in response to an outbound FTP
request from a machine on the protected network, the logs would be checked
to see if there was indeed an outbound FTP request that should have
resulted in a packet like the one that has now arrived.

considering the fact that "stateful inspection" is basically the
technology that Checck Point uses in FireWal-1 your request to tell you
more is far too vague.  it's almost like saying, "i'm interested in
FireWall-1, can you give me more information on it?"

do you have any quetions that are more specific?
                                                   

- bill

cooper@io.com


From firewalls-owner  Sun Jan 11 13:03:01 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA14579; Sun, 11 Jan 1998 12:59:38 -0800 (PST)
Received: from mail.matav.hu (castor.matav.net [145.236.224.250]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id MAA14538 for <firewalls@greatcircle.com>; Sun, 11 Jan 1998 12:59:25 -0800 (PST)
Received: (qmail 9216 invoked from network); 11 Jan 1998 22:00:29 +0100
Received: from line-210-82.dial.matav.net (HELO default) (145.236.210.82)
  by mail.matav.hu with SMTP; 11 Jan 1998 22:00:29 +0100
Reply-To: "Takacs Istvan" <anonymus@mail.matav.hu>
From: "Takacs Istvan" <anonymus@mail.matav.hu>
To: <firewalls@greatcircle.com>
Subject: IP to DECnet?
Date: Sun, 11 Jan 1998 18:13:28 +0100
Message-ID: <01bd1eb4$3c3e3be0$LocalHost@default>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-2"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 4.71.1712.3
X-MimeOLE: Produced By Microsoft MimeOLE V4.71.1712.3
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

Some lamers question.

Have you ever met any firewall, or router which
has that feature to exchange the IP traffic to
DECnet protocoll? With this, we could let that PCs
to use the Internet which mustn't use the IP
protocoll, because of some security reasons.
I've read something like this when I checked the
OpSec's site  for Guardian.
If it won't work, please, try to explain why not.

Thank you very much!

Regards

                         Istvan Takacs
           mailto:anonymus@mail.matav.hu

p.s. Please, write to my own address, too.



From firewalls-owner  Sun Jan 11 13:33:19 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id NAA16117; Sun, 11 Jan 1998 13:15:14 -0800 (PST)
Received: from mcfeely.bsfs.org (mcfeely.bsfs.org [204.91.13.34]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id NAA16092 for <firewalls@GreatCircle.COM>; Sun, 11 Jan 1998 13:15:01 -0800 (PST)
Received: (from wombat@localhost) by mcfeely.bsfs.org (8.6.12/8.6.12) id CAA04357; Sun, 11 Jan 1998 02:07:34 -0500
Date: Sun, 11 Jan 1998 02:07:32 -0500 (EST)
From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: MS <"ims02@netvigator.com"@netvigator.com>
cc: "firewalls@GreatCircle.COM" <firewalls@GreatCircle.COM>
Subject: Re: Proxy Servers on DMZ?
In-Reply-To: <199801111005.SAA06036@imsp074.netvigator.com>
Message-ID: <Pine.BSF.3.91.980111020041.4242B-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



On Sun, 1 Feb 1998, MS wrote:

> Rabid Wombat wrote:

> 
> Do you mean that using the secure hub, the broadcast ethernet payload
> containing
> a password (eg through the LAN to login a system) will not be seen when
> somebody
> capture the traffic using an LAN analyser software.  If so, what is the
> method
> (encryption? scrambling? ..) behind such secure hub? 

Sorry, missed this question in the last response:

Is this a secure
> method to 
> remove the inherent security risk assosicated with broadcast LAN
> environment?
> 
> Jim
> 

This isn't a foolproof method, as the attacker could still get themselves 
into position between the server in question and the secure hub by 
tapping the cable (intrusive or non-). However, this would keep them from 
bringing up a sniffer on any system on the segment and collecting 
clear-text logins. With a hub like this in place, they'd need to either 
get "between" the target user or server and the hub, or manage to access 
the hub and disable the security option.

If you require a high level of security on an internal LAN, and the 
threat of a cable tap is reasonable, you need to use end-to-end 
encryption. OTOH, if you are satisfied with making it reasonably 
difficult for an interanl LAN intruder (secure hubs, good physical 
security at the wiring closet, and possibly fiber optic runs from closet 
to server, the secure hb I mentioned is a viable option. With most larger 
organizations moving to switching, however, the secure hub is used less 
in an enterprise environment. Still a cheap add-on for a DMZ, though.  :)

-r.w.


From firewalls-owner  Sun Jan 11 13:48:37 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id NAA15357; Sun, 11 Jan 1998 13:07:07 -0800 (PST)
Received: from mcfeely.bsfs.org (mcfeely.bsfs.org [204.91.13.34]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id NAA15334 for <firewalls@GreatCircle.COM>; Sun, 11 Jan 1998 13:06:57 -0800 (PST)
Received: (from wombat@localhost) by mcfeely.bsfs.org (8.6.12/8.6.12) id BAA04258; Sun, 11 Jan 1998 01:59:19 -0500
Date: Sun, 11 Jan 1998 01:59:15 -0500 (EST)
From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: MS <"ims02@netvigator.com"@netvigator.com>
cc: "firewalls@GreatCircle.COM" <firewalls@GreatCircle.COM>
Subject: Re: Proxy Servers on DMZ?
In-Reply-To: <199801111005.SAA06036@imsp074.netvigator.com>
Message-ID: <Pine.BSF.3.91.980111014615.4242A-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



On Sun, 1 Feb 1998, MS wrote:

> Rabid Wombat wrote:
> > 
> > Depends on what you are doing with these servers, and what your level of
> > paranoia is.
> > 
> > In general, it is ok for most people. You can add to the security of this
> > configuration very inexpensively by using a secure hub to provide the DMZ
> > segment.
> > 
> > With ethernet, every device on the segment must receive the datagram.
> > This makes it easy for someone who has taken over a system to put the
> > system's network interface into promiscuous mode (passing all frames up
> > the stack, not just those w/ the system's mac address) and reading
> > everyone's traffic. Secure hubs get around this by overwriting the data
> > payload with random junk when sending the frame out ports that don't
> > service the destination mac address; the other stations still get the
> > frame, but the data payload is useless. Many vendors make these hubs -
> > 3Com sells an 8 port unit for a few hundrred $$.
> > 
> > The above is not foolproof, especially if users are legitimately
> > conversing between the "compromised" systems and other systems on the
> > DMZ. It will slow an intruder down, however, giving you more of an
> > opportunity to detect them before they can obtain additional access. For
> > the small cost, it is a worthwhile addition to your configuration.
> > 
> > -r.w.
> > 
> > On Sun, 1 Feb 1998, MS wrote:
> > 
> > > Hi,
> > >
> > > Is it a secure method to place all the proxy servers(eg mail server, ftp
> > > server)
> > > into the DMZ segment?
> > >
> > > Jim
> > >
> Thanks your information.
> 
> Do you mean that using the secure hub, the broadcast ethernet payload
> containing
> a password (eg through the LAN to login a system) will not be seen when
> somebody
> capture the traffic using an LAN analyser software.  If so, what is the
> method
> (encryption? scrambling? ..) behind such secure hub? Is this a secure
> method to 
> remove the inherent security risk assosicated with broadcast LAN
> environment?
> 
> Jim
> 



The hub does not "encrypt" at all, but overwrites the data payload when 
sending the frame out ports that do not service the destination MAC 
address.

         |     |-------- overwritten -----> User 1
source --| HUB |-------- clear text ------> Destination user     
         |     |-------- overwritten -----> User 3

If you are running a sniffer on the destination system, you can read the
payload. If you are running a sniffer on User 1, you can see that source
has sent a frame of x length to destination user. However, the payoad
received at User 1 has been replaced with random "junk" and a new CRC has
been calculated. The "junk" payload is not an encrypted version of the
original, and bears no relationship to the original at all; therefore, it
can't be "decrypted." The "junk" frame is sent to comply with ethernet
rules that require all devices on a segment to receive the frame. 

This isn't a foolproof solution, especially if there is traffic between 
the various systems within the DMZ; if the attacker can compromise one 
system, they can watch for traffic between the compromised systems and 
the others, and work on compromising each system in turn. However, the 
fact that they can only see traffic to which the compromised system is 
party, rather than all traffic on the segment, will certainly slow them 
down considerably. They also cannot see traffic reaching the hub form 
"outside" the DMZ unless it is destined for the compromised system.

For a couple hundred extra $$, and a few minutes of extra setup time, 
this is worth adding.

A switch would accomplish similar results, except that the switch only 
sends data out the port attached to the destination, rather than sending 
out all ports, as a hub will. Switches cost more, though, and add 
additional latency and management complexity. Also, some cheaper switches 
have been observed to "cheat" by passing traffic out all ports when 
attempting to reduce buffer congestion during heavy loads. The hub is a 
cheap, no-brainer addition.

-r.w.


From firewalls-owner  Sun Jan 11 16:48:04 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id QAA12391; Sun, 11 Jan 1998 16:32:26 -0800 (PST)
Received: from hq.si.net (hq.si.net [192.156.192.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id QAA12384 for <firewalls@GreatCircle.COM>; Sun, 11 Jan 1998 16:32:21 -0800 (PST)
Received: from hq.si.net (hq [192.156.192.10]) by hq.si.net (8.8.5/8.7.3) with SMTP id TAA10966; Sun, 11 Jan 1998 19:34:55 -0500 (EST)
Date: Sun, 11 Jan 1998 19:34:55 -0500 (EST)
From: Ming Lu <mlu@hq.si.net>
To: MS <"ims02@netvigator.com"@netvigator.com>
cc: "firewalls@GreatCircle.COM" <firewalls@GreatCircle.COM>
Subject: Re: Proxy Servers on DMZ?
In-Reply-To: <199801101734.BAA28606@imsp074.netvigator.com>
Message-ID: <Pine.SOL.3.91.980111193403.10835A-100000@hq.si.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Isn't it pretty obvious?

_ming

On Sun, 1 Feb 1998, MS wrote:

> Hi,
> 
> Is it a secure method to place all the proxy servers(eg mail server, ftp
> server)
> into the DMZ segment?
> 
> Jim
> 

From firewalls-owner  Mon Jan 12 03:03:07 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id CAA06870; Mon, 12 Jan 1998 02:58:40 -0800 (PST)
Received: from gatekeeper.alcatel.no (ns0.alcatel.no [193.213.238.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id CAA06853 for <Firewalls@GreatCircle.COM>; Mon, 12 Jan 1998 02:58:33 -0800 (PST)
Received: from alcatel.no by gatekeeper.alcatel.no (8.8.8/Alcanet-SC)
	id LAA11943; Mon, 12 Jan 1998 11:59:50 +0100 (MET)
Message-ID: <34B9F7A6.E411A2BE@alcatel.no>
Date: Mon, 12 Jan 1998 11:59:50 +0100
From: Kare Presttun <Kare.Presttun@alcatel.no>
Organization: Alcanet International
X-Mailer: Mozilla 4.04 [en] (Win95; I)
MIME-Version: 1.0
To: Firewalls@GreatCircle.COM
Subject: Re[4]: Stateful Inspection Anyone?  Explore your options
References: <199801090949.BAA17691@honor.greatcircle.com>
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

Grabbing the packet directly off the wire for inspection and
doing NAT and all the other stuff, is what the SunScreen
SPF 200 does. The machine does not have any IP address, so
there is no way you can connect to it. The only way I can see
to hack it is to pass a packet through it that will make
the state engine go bananas.

Best regards,
Kare

> =

> Date: Fri, 09 Jan 1998 08:18:36 +0100
> From: Oliver Lau <lau@skp.de>
> Subject: Re[3]: Stateful Inspection Anyone?  Explore your options.
> =

> Greetings!
> =

> On Thu, 08 Jan 1998 21:47:02 -0500
> Rick Murphy <rmurphy@itm-inst.com> wrote:
> =

> |  At 09:28 AM 1/7/98 +0100, Oliver Lau wrote:
> |  >You surely haven't had a look inside stateful inspection firewalls,=
 have
> |  >you? You have to distinguish between two possibilities on how table=
s
> |  >can become corrupt:
> |  >
> |  >    1.) accidentally deleted entries
> |  >    2.) forged entries
> |  You forgot at least one other reason:
> |   - You neglected to disable IP forwarding. Before the firewall start=
s
> |  to inspect, you're wide open.
> |  Yeah, it's a "user configuration error". Unfortunately, that's the
> |  way the OS works by default.
> =

> Disregarding OS's default behaviour, the situation will change rapidly,=

> when filtering is no longer done above the protocol stack but below.
> What does this mean? When the firewall filtering engine grabs the
> packets directly from the NIC driver, the packets -- depending on the
> rulesets -- will never reach the protocol stack. While routing/forwardi=
ng is
> done at the protocol stack, a firewall machine firing up won't let any
> packets pass between the networks.
> =

> Regards,
> =

> Oliver Lau
> [CTO]
> Sauer und Partner GmbH, NetzwerkTechnologie und Sicherheit
> Dietrich-Bonhoeffer-Strasse 1-3, 35037 Marburg, Germany
> fon: +49 6421 938300, fax: +49 6421 938390, URL: http://www.skp.de/
> PGP-Fingerprint: 6696 C8B6 F351 A381  D1C9 BC41 98F2 6DE3
> =


-- =

--------------------------------------------------------
K=E5re Presttun                     Alcanet International
Tel   : +47 2263 7601             P.O. Box 60
Fax   : +47 2263 8887             N-0508 Oslo
Mobile: +47 9082 7068             NORWAY
mailto:Kare.Presttun@alcatel.no   http://www.alcatel.no/

From firewalls-owner  Mon Jan 12 04:03:08 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id DAA13619; Mon, 12 Jan 1998 03:55:41 -0800 (PST)
Received: from ns.istiy.yn.cn ([168.160.151.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id DAA13601 for <firewalls@greatcircle.com>; Mon, 12 Jan 1998 03:55:27 -0800 (PST)
Received: from elephant.istiy.yn.cn ([168.160.151.3]) by ns.istiy.yn.cn (8.8.3/8.8.3) with SMTP id VAA29563; Mon, 12 Jan 1998 21:56:22 -0800
Received: from elephant by elephant.istiy.yn.cn (5.x/SMI-SVR4)
	id AA16893; Mon, 12 Jan 1998 19:54:33 +0800
Date: Mon, 12 Jan 1998 19:54:30 +0800 (CST)
From: Tian Jun <tj@elephant.istiy.yn.cn>
X-Sender: tj@elephant
To: Rob Janzen <rob@vulcan.achq.dnd.ca>
Cc: firewalls@greatcircle.com
Subject: radius for linux or nt
In-Reply-To: <34AD73E7.DF4A5A0F@vulcan.achq.dnd.ca>
Message-Id: <Pine.SOL.3.91.980112195311.16890A-100000@elephant>
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Is there any person know where to download a free radius software for 
linux or nt on a cisco 2511 router.

---------------------------------------------------------------------------

                                           ,---
    Tian Jun                              | o o |
    Internet Network Manager              ` \_/ '         Linux
    ISTIY                                 /\___/\         The Choice of
    tj@elephant.istiy.yn.cn              |_/ . \_|        A GNU Generation
    http://www.istiy.yn.cn               \_/___\_/
---------------------------------------------------------------------------    

From firewalls-owner  Mon Jan 12 06:33:26 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA26975; Mon, 12 Jan 1998 06:24:19 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id GAA26967 for <firewalls@GreatCircle.COM>; Mon, 12 Jan 1998 06:24:14 -0800 (PST)
From: frankie@citel.upc.es
Received: from citel.upc.es by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-970426)
	id GAA11566; Mon, 12 Jan 1998 06:20:38 -0800 (PST)
Received: from citel.upc.es (jolibus.upc.es [147.83.36.68])
	by citel.upc.es (8.8.8/8.8.5) with ESMTP id PAA21831;
	Mon, 12 Jan 1998 15:14:05 GMT
Message-ID: <34BA2598.8182FDAB@citel.upc.es>
Date: Mon, 12 Jan 1998 15:15:52 +0100
Organization: UPC
X-Mailer: Mozilla 4.04 [en] (Win95; I)
MIME-Version: 1.0
To: firewalls@GreatCircle.COM, bextreme@pobox.com
Subject: Re: HTTP/POP3/SMTP Proxies?
References: <Pine.SOL.3.91.980109180329.3456J-100000@hq.si.net>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

por pop3 I remember using pop3gwd for linux

Ming Lu wrote:
> 
> Get squid and you will be very happy...
> 
> _ming
> 
> On Thu, 8 Jan 1998, Jesse Brown wrote:
> 
> > Hello, I was wondering if anyone had any recommendations for free proxy
> > software that will run on x86 Linux that can either proxy HTTP, POP3,
> > SMTP, etc, or just a general proxy that will allow me to redirect a
> > connection like http.
> >
> > -J
> >
> > --
> > Jesse Brown - bextreme@pobox.com
> >
> >
> >

-- 
 ^-^.-----,             mailto:frankie@citel.upc.es
 o o _     )            http://www.etsetb.upc.es/~frankie
  Y (_, (__(Ssss

From firewalls-owner  Mon Jan 12 07:26:20 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA01948; Mon, 12 Jan 1998 06:58:02 -0800 (PST)
Received: from sextant.sextant.it (sextant.sextant.it [193.70.65.129]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id GAA01910 for <firewalls@GreatCircle.COM>; Mon, 12 Jan 1998 06:57:47 -0800 (PST)
Received: from localhost (mpoli@localhost)
	by sextant.sextant.it (8.8.6/8.8.6) with SMTP id PAA04703;
	Mon, 12 Jan 1998 15:52:20 +0100
Date: Mon, 12 Jan 1998 15:52:20 +0100 (GMT+0100)
From: Massimo Poli <mpoli@sextant.sextant.it>
To: frankie@citel.upc.es
cc: firewalls@GreatCircle.COM, bextreme@pobox.com
Subject: Re: HTTP/POP3/SMTP Proxies?
In-Reply-To: <34BA2598.8182FDAB@citel.upc.es>
Message-ID: <Pine.LNX.3.96.980112155116.3635A-100000@sextant.sextant.it>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Try delegate proxy server ...
I think is a better and complete proxy over all internet protocol !!!


Massimo Poli
SeXTanT international s.r.l.
Via L. Cipriani n 4/b
40131 - BOLOGNA

tel +39 +51 6490965
fax +39 +51 6491867



On Mon, 12 Jan 1998 frankie@citel.upc.es wrote:

> por pop3 I remember using pop3gwd for linux
> 
> Ming Lu wrote:
> > 
> > Get squid and you will be very happy...
> > 
> > _ming
> > 
> > On Thu, 8 Jan 1998, Jesse Brown wrote:
> > 
> > > Hello, I was wondering if anyone had any recommendations for free proxy
> > > software that will run on x86 Linux that can either proxy HTTP, POP3,
> > > SMTP, etc, or just a general proxy that will allow me to redirect a
> > > connection like http.
> > >
> > > -J
> > >
> > > --
> > > Jesse Brown - bextreme@pobox.com
> > >
> > >
> > >
> 
> -- 
>  ^-^.-----,             mailto:frankie@citel.upc.es
>  o o _     )            http://www.etsetb.upc.es/~frankie
>   Y (_, (__(Ssss
> 


From firewalls-owner  Mon Jan 12 07:34:13 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA01998; Mon, 12 Jan 1998 06:58:26 -0800 (PST)
Received: from mail.advancenet.net (hermes.cu-online.com [205.198.248.82]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id GAA01970 for <firewalls@greatcircle.com>; Mon, 12 Jan 1998 06:58:14 -0800 (PST)
Received: from mail.argus-systems.com (ranger.argus-systems.com [206.221.232.80]) by mail.advancenet.net (8.8.6/8.7.3) with SMTP id KAA31630; Mon, 12 Jan 1998 10:02:36 -0600
Received: by mail.argus-systems.com (SMI-8.6/SMI-SVR4)
	id IAA18801; Mon, 12 Jan 1998 08:58:52 -0600
Date: Mon, 12 Jan 1998 08:58:52 -0600
From: mcnabb@argus-systems.com (Paul McNabb)
Message-Id: <199801121458.IAA18801@mail.argus-systems.com>
To: mlu@hq.si.net
Cc: firewalls@greatcircle.com
Subject: Re: Bank Security
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Ming Lu <mlu@hq.si.net> wrote:
>
>I am looking any info regarding bank security requirements (I know that
>it is a knid of sensetive...:-)) and implementations. It would be greatly
>appreciated if anyone can help on this.

We have been working with a number of U.S. and European banks in building
security solutions.  In addition to the encryption requirements for data
being transmitted, banks and financial institutions tend to have a security
document that imposes all kinds of other restrictions.  Many are detailed
enough to specify allowable network services, use of .rhost files, the
types of passwords allowed, etc.  Nowadays, almost all systems that host
external access (e.g., internet banking servers, extranet servers, etc.)
also have a B1 or higher requirement for the OS.

paul

---------------------------------------------------------
Paul McNabb                     Argus Systems Group, Inc.
Vice President and CTO          1809 Woodfield Drive
mcnabb@argus-systems.com        Savoy, IL 61874 USA
TEL 217-355-6308
FAX 217-355-1433                "Securing the Future"
---------------------------------------------------------

From firewalls-owner  Mon Jan 12 07:45:05 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA01774; Mon, 12 Jan 1998 06:57:19 -0800 (PST)
Received: from imsp073.netvigator.com (imsp073.netvigator.com [205.252.144.130]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id GAA01538 for <firewalls@GreatCircle.COM>; Mon, 12 Jan 1998 06:56:28 -0800 (PST)
Received: from js-computer (hhtam010032.netvigator.com [208.139.102.32])
	by imsp073.netvigator.com (8.8.8/8.8.8) with SMTP id WAA01329;
	Mon, 12 Jan 1998 22:57:13 +0800 (HKT)
Message-Id: <199801121457.WAA01329@imsp073.netvigator.com>
Date: Sun, 01 Feb 1998 22:01:30 +0800
From: MS <"ims02@netvigator.com"@netvigator.com>
Reply-To: "ims02@netvigator.com"@netvigator.com
X-Mailer: Mozilla 3.0Gold (Win95; I)
MIME-Version: 1.0
To: Rabid Wombat <wombat@mcfeely.bsfs.org>
CC: "firewalls@GreatCircle.COM" <firewalls@GreatCircle.COM>
Subject: Re: Proxy Servers on DMZ?
References: <Pine.BSF.3.91.980111014615.4242A-100000@mcfeely.bsfs.org>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Rabid Wombat wrote:
> 
> On Sun, 1 Feb 1998, MS wrote:
> 
> > Rabid Wombat wrote:
> > >
> > > Depends on what you are doing with these servers, and what your level of
> > > paranoia is.
> > >
> > > In general, it is ok for most people. You can add to the security of this
> > > configuration very inexpensively by using a secure hub to provide the DMZ
> > > segment.
> > >
> > > With ethernet, every device on the segment must receive the datagram.
> > > This makes it easy for someone who has taken over a system to put the
> > > system's network interface into promiscuous mode (passing all frames up
> > > the stack, not just those w/ the system's mac address) and reading
> > > everyone's traffic. Secure hubs get around this by overwriting the data
> > > payload with random junk when sending the frame out ports that don't
> > > service the destination mac address; the other stations still get the
> > > frame, but the data payload is useless. Many vendors make these hubs -
> > > 3Com sells an 8 port unit for a few hundrred $$.
> > >
> > > The above is not foolproof, especially if users are legitimately
> > > conversing between the "compromised" systems and other systems on the
> > > DMZ. It will slow an intruder down, however, giving you more of an
> > > opportunity to detect them before they can obtain additional access. For
> > > the small cost, it is a worthwhile addition to your configuration.
> > >
> > > -r.w.
> > >
> > > On Sun, 1 Feb 1998, MS wrote:
> > >
> > > > Hi,
> > > >
> > > > Is it a secure method to place all the proxy servers(eg mail server, ftp
> > > > server)
> > > > into the DMZ segment?
> > > >
> > > > Jim
> > > >
> > Thanks your information.
> >
> > Do you mean that using the secure hub, the broadcast ethernet payload
> > containing
> > a password (eg through the LAN to login a system) will not be seen when
> > somebody
> > capture the traffic using an LAN analyser software.  If so, what is the
> > method
> > (encryption? scrambling? ..) behind such secure hub? Is this a secure
> > method to
> > remove the inherent security risk assosicated with broadcast LAN
> > environment?
> >
> > Jim
> >
> 
> The hub does not "encrypt" at all, but overwrites the data payload when
> sending the frame out ports that do not service the destination MAC
> address.
> 
>          |     |-------- overwritten -----> User 1
> source --| HUB |-------- clear text ------> Destination user
>          |     |-------- overwritten -----> User 3
> 
> If you are running a sniffer on the destination system, you can read the
> payload. If you are running a sniffer on User 1, you can see that source
> has sent a frame of x length to destination user. However, the payoad
> received at User 1 has been replaced with random "junk" and a new CRC has
> been calculated. The "junk" payload is not an encrypted version of the
> original, and bears no relationship to the original at all; therefore, it
> can't be "decrypted." The "junk" frame is sent to comply with ethernet
> rules that require all devices on a segment to receive the frame.
> 
> This isn't a foolproof solution, especially if there is traffic between
> the various systems within the DMZ; if the attacker can compromise one
> system, they can watch for traffic between the compromised systems and
> the others, and work on compromising each system in turn. However, the
> fact that they can only see traffic to which the compromised system is
> party, rather than all traffic on the segment, will certainly slow them
> down considerably. They also cannot see traffic reaching the hub form
> "outside" the DMZ unless it is destined for the compromised system.
> 
> For a couple hundred extra $$, and a few minutes of extra setup time,
> this is worth adding.
> 
> A switch would accomplish similar results, except that the switch only
> sends data out the port attached to the destination, rather than sending
> out all ports, as a hub will. Switches cost more, though, and add
> additional latency and management complexity. Also, some cheaper switches
> have been observed to "cheat" by passing traffic out all ports when
> attempting to reduce buffer congestion during heavy loads. The hub is a
> cheap, no-brainer addition.
> 
> -r.w.

Hi,

Thanks again your valuable information!

I've got one more question on the broacast ethernet LAN.

Is it possible to alter the payload content broadcasting on a ordinary
hub through the use of some equipment or protocol analyser connected
to that hub such that the destination system will act on the wrong 
payload information?

Thank very much
Jim

From firewalls-owner  Mon Jan 12 08:04:11 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA07031; Mon, 12 Jan 1998 07:37:57 -0800 (PST)
Received: from detron.core.afcc.com (detron.afcc2.com [208.136.238.150]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id HAA07008 for <firewalls@GreatCircle.COM>; Mon, 12 Jan 1998 07:37:50 -0800 (PST)
Received: from speedy.core.afcc.com ([192.168.5.1]) by detron.core.afcc.com
          via smtpd (for honor.greatcircle.com [198.102.244.44]) with SMTP; 12 Jan 1998 15:39:14 UT
Received: by afcc.com (SMI-8.6/SMI-SVR4)
	id JAA20325; Mon, 12 Jan 1998 09:39:13 -0600
Received: from detrondmz.core.afcc.com(192.168.5.150) by speedy via smap (V2.0)
	id xmab20308; Mon, 12 Jan 98 09:38:47 -0600
Received: by z1111111.core.afcc.com with Internet Mail Service (5.0.1458.49)
	id <CZA6MG9C>; Mon, 12 Jan 1998 09:38:45 -0600
Message-ID: <B7F4449C26FDD011A115006097DC67EF5538FD@z1111321.core.afcc.com>
From: "Moses, Ikoedem" <Ikoedem_Moses@afcc.com>
To: Geoff Mulligan <geoff@mulligan.com>, guard@cnnic.net.cn
Cc: firewalls@GreatCircle.COM
Subject: RE: What is Stateful inspection 
Date: Mon, 12 Jan 1998 09:38:43 -0600
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1458.49)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I will  like  to know about any issues with sunscreen.

Ikoedem Moses
Security Engineer
The Associates

> -----Original Message-----
> From:	Geoff Mulligan [SMTP:geoff@mulligan.com]
> Sent:	Sunday, January 11, 1998 12:44 PM
> To:	guard@cnnic.net.cn
> Cc:	firewalls@GreatCircle.COM
> Subject:	Re: What is Stateful inspection 
> 
> you might try taking a look at www.sunscreen.com.
> 
> 	geoff
> 

From firewalls-owner  Mon Jan 12 09:33:47 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA15969; Mon, 12 Jan 1998 08:30:46 -0800 (PST)
Received: from lama.supermedia.pl (lama.supermedia.pl [195.116.168.67]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id IAA15833 for <Firewalls@GreatCircle.COM>; Mon, 12 Jan 1998 08:29:39 -0800 (PST)
Received: from localhost (andy@localhost)
	by lama.supermedia.pl (8.8.7/8.8.5) with SMTP id RAA04359
	for <Firewalls@GreatCircle.COM>; Mon, 12 Jan 1998 17:30:53 +0100
Date: Mon, 12 Jan 1998 17:30:51 +0100 (MET)
From: Andrzej Blaszczyk <andy@lama.supermedia.pl>
Reply-To: Andrzej Blaszczyk <andy@lama.supermedia.pl>
To: Firewalls@GreatCircle.COM
In-Reply-To: <199801120900.BAA21742@honor.greatcircle.com>
Message-ID: <Pine.LNX.3.96.980112172720.4132A-100000@lama.supermedia.pl>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello everybody!

Does anybody have any experience with Cisco Centri Firewall ?
Can this product be compared to any other firewall (Eagle etc.) regarding
its price, efficiency and security? Does Centri have any bugs?

Thanks for any comments.

Regards,

<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>
<>    Andrzej Blaszczyk <> ab@supermedia.pl     <>
<> System Administrator <> http://supermedia.pl <>
<>       SuperMedia CUI <> Office: +48228296573 <>
<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>



From firewalls-owner  Mon Jan 12 10:04:22 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA03706; Mon, 12 Jan 1998 09:57:11 -0800 (PST)
Received: from mail-oak-3.pilot.net (mail-oak-3.pilot.net [198.232.147.18]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA03669 for <Firewalls@greatcircle.com>; Mon, 12 Jan 1998 09:57:01 -0800 (PST)
Received: from mail.halsp.hitachi.com (mail.halsp.hitachi.com [198.70.112.2]) by mail-oak-3.pilot.net with ESMTP id JAA29480 for <Firewalls@greatcircle.com>; Mon, 12 Jan 1998 09:50:14 -0800 (PST)
Received: from pop.halsp.hitachi.com ([137.168.8.100])
          by mail.halsp.hitachi.com (Netscape Messaging Server 3.01)
           with ESMTP id AAA15957 for <Firewalls@greatcircle.com>;
          Mon, 12 Jan 1998 09:52:35 -0800
Received: from coho ([137.168.6.112]) by pop.halsp.hitachi.com
          (Netscape Messaging Server 3.01)  with SMTP id AAA21896;
          Mon, 12 Jan 1998 09:58:17 -0800
Message-ID: <34BA5BE6.1209@hal.hitachi.com>
Date: Mon, 12 Jan 1998 10:07:34 -0800
From: Eric Vanuska <eric.vanuska@hal.hitachi.com>
X-Mailer: Mozilla 3.01Gold (X11; I; HP-UX A.09.05 9000/710)
MIME-Version: 1.0
To: Firewalls@greatcircle.com
CC: vanuskae@netcom.com
Subject: Using Kerberos for authentication & encryption
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello all,

We are considering using kerberos for authenticating
users/applications from our Internet DMZ to our 
internal network. The goal is to use a Unix management
application to manage our DMZ from our internal
network. For this app to work, the hosts on the DMZ
must initiate TCP connections to inside hosts. The
app supports Kerberos, but not SSL.

Please note, from the internet to our DMZ, we only allow 
www, mail, ftp, news and time protocol.

Anyone want to comment on the pros and cons of using
Kerberos as a means for authentication and encryption? 
Remember, these connections are _not_ across the
internet. 

For any replies, please copy me directly, I no longer
subscribe to this mailing list.


Thanks, EricV.

From firewalls-owner  Mon Jan 12 10:12:54 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA26589; Mon, 12 Jan 1998 09:19:59 -0800 (PST)
Received: from grab.mulligan.com (grab.coslabs.com [199.233.92.34]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA26445 for <firewalls@GreatCircle.COM>; Mon, 12 Jan 1998 09:19:33 -0800 (PST)
Received: from future.mulligan.com (future [199.233.92.11])
	by grab.mulligan.com (8.8.7/8.8.7) with SMTP id KAA19655;
	Mon, 12 Jan 1998 10:21:05 -0700 (MST)
Received: from future by future.mulligan.com (SMI-8.6/SMI-SVR4)
	id KAA26209; Mon, 12 Jan 1998 10:20:31 -0700
Message-Id: <199801121720.KAA26209@future.mulligan.com>
X-Mailer: exmh version 2.0.1 12/23/97
To: Oliver Lau <lau@skp.de>
cc: Rick Murphy <rmurphy@itm-inst.com>, firewalls@GreatCircle.COM,
        Oliver Lau <lau@majestix.skp.de>
Subject: Re: Re[3]: Stateful Inspection Anyone? Explore your options. 
In-reply-to: Your message of "Fri, 09 Jan 1998 08:18:36 +0100."
             <34B5EB6C2AB.FF54.lau@skp.de> 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Mon, 12 Jan 1998 10:20:31 -0700
From: Geoff Mulligan <geoff@mulligan.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


lau@skp.de said:
> Disregarding OS's default behaviour, the situation will change
> rapidly, when filtering is no longer done above the protocol stack but
> below. What does this mean? When the firewall filtering engine grabs
> the packets directly from the NIC driver, the packets -- depending on
> the rulesets -- will never reach the protocol stack. While routing/
> forwarding is done at the protocol stack, a firewall machine firing up
> won't let any packets pass between the networks.  

This is exactly where sunscreen sits in the stack.  Between the NIC driver and 
IP!

	geoff



From firewalls-owner  Mon Jan 12 10:14:14 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA25416; Mon, 12 Jan 1998 09:15:12 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id IAA14638 for <firewalls@GreatCircle.COM>; Mon, 12 Jan 1998 08:22:28 -0800 (PST)
Received: from hq.si.net by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-970426)
	id IAA12446; Mon, 12 Jan 1998 08:22:13 -0800 (PST)
Received: from hq.si.net (hq [192.156.192.10]) by hq.si.net (8.8.5/8.7.3) with SMTP id LAA17868; Mon, 12 Jan 1998 11:24:29 -0500 (EST)
Date: Mon, 12 Jan 1998 11:24:29 -0500 (EST)
From: Ming Lu <mlu@hq.si.net>
To: frankie@citel.upc.es
cc: firewalls@GreatCircle.COM, bextreme@pobox.com
Subject: Re: HTTP/POP3/SMTP Proxies?
In-Reply-To: <34BA2598.8182FDAB@citel.upc.es>
Message-ID: <Pine.SOL.3.91.980112112115.17747B-100000@hq.si.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


POP3 has nothing to do with proxy cache.

_ming

On Mon, 12 Jan 1998 frankie@citel.upc.es wrote:

> por pop3 I remember using pop3gwd for linux
> 
> Ming Lu wrote:
> > 
> > Get squid and you will be very happy...
> > 
> > _ming
> > 
> > On Thu, 8 Jan 1998, Jesse Brown wrote:
> > 
> > > Hello, I was wondering if anyone had any recommendations for free proxy
> > > software that will run on x86 Linux that can either proxy HTTP, POP3,
> > > SMTP, etc, or just a general proxy that will allow me to redirect a
> > > connection like http.
> > >
> > > -J
> > >
> > > --
> > > Jesse Brown - bextreme@pobox.com
> > >
> > >
> > >
> 
> -- 
>  ^-^.-----,             mailto:frankie@citel.upc.es
>  o o _     )            http://www.etsetb.upc.es/~frankie
>   Y (_, (__(Ssss
> 

From firewalls-owner  Mon Jan 12 10:35:19 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id KAA07200; Mon, 12 Jan 1998 10:21:15 -0800 (PST)
Received: from lama.supermedia.pl (lama.supermedia.pl [195.116.168.67]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id KAA07161 for <Firewalls@GreatCircle.COM>; Mon, 12 Jan 1998 10:21:03 -0800 (PST)
Received: from localhost (andy@localhost)
	by lama.supermedia.pl (8.8.7/8.8.5) with SMTP id TAA06762
	for <Firewalls@GreatCircle.COM>; Mon, 12 Jan 1998 19:22:05 +0100
Date: Mon, 12 Jan 1998 19:22:01 +0100 (MET)
From: Andrzej Blaszczyk <andy@lama.supermedia.pl>
Reply-To: Andrzej Blaszczyk <andy@lama.supermedia.pl>
To: Firewalls@GreatCircle.COM
Subject: Cisco Centri Firewall
Message-ID: <Pine.LNX.3.96.980112192054.6281B-100000@lama.supermedia.pl>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello everybody!

Does anybody have any experience with Cisco Centri Firewall ?
Can this product be compared to any other firewall (Eagle etc.) regarding
its price, efficiency and security? Does Centri have any bugs?

Thanks for any comments.

Regards,

<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>
<>    Andrzej Blaszczyk <> ab@supermedia.pl     <>
<> System Administrator <> http://supermedia.pl <>
<>       SuperMedia CUI <> Office: +48228296573 <>
<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>




From firewalls-owner  Mon Jan 12 10:45:09 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA23712; Mon, 12 Jan 1998 09:02:39 -0800 (PST)
Received: from mailgw2.lmco.com (mailgw2.lmco.com [192.91.147.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA23681 for <firewalls@greatcircle.com>; Mon, 12 Jan 1998 09:02:30 -0800 (PST)
Received: from emss03g01.ems.lmco.com (emss03g01.ems.lmco.com [141.240.4.144])
	by mailgw2.lmco.com (8.8.8/8.8.8) with ESMTP id MAA28037
	for <firewalls@greatcircle.com>; Mon, 12 Jan 1998 12:03:55 -0500 (EST)
Received: from emss20m01.ems.lmco.com ([166.31.252.36])
 by lmco.com (PMDF V5.1-10 #20544) with ESMTP id <0EMO00CACKQ76B@lmco.com> for
 firewalls@greatcircle.com; Mon, 12 Jan 1998 12:03:44 -0500 (EST)
Received: by EMSS20M01 with Internet Mail Service (5.0.1458.49)
 id <CFP00LMF>; Mon, 12 Jan 1998 11:56:38 -0500
Content-return: allowed
Date: Mon, 12 Jan 1998 11:56:32 -0500
From: "Sadler, Connie J" <connie.j.sadler@lmco.com>
Subject: Pushing the envelope...
To: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Message-id: <01D83A97C4E1D01193690000F8046412639F86@EMSS20M01>
MIME-version: 1.0
X-Mailer: Internet Mail Service (5.0.1458.49)
Content-type: text/plain
X-Priority: 3
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Hi, everybody...

In general, our engineers are being blasted with requests to accommodate
access for people who need access to data inside our firewall, but these
are also folks who cannot be authorized the capability to "browse" the
net (i.e. competitors who are partnering with us on a specific project,
foreign nationals, etc.). I am aware of Reverse Proxy, VPN technology,
etc., but this is all piecemeal, or seems to be. Does anybody have a
general architecture which they have or are migrating to that they would
be willing to share? New technology isn't coming fast enough to handle
the need! The problem seems to be especially troublesome on mainframes
and interactive applications (where the data can't be simply "viewed").

I don't expect any miracles here - just fishing for ideas...

Connie

From firewalls-owner  Mon Jan 12 12:17:43 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA14148; Mon, 12 Jan 1998 11:10:09 -0800 (PST)
Received: from glengoyne.canadair.ca (glengoyne.canadair.ca [206.172.9.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id LAA14099 for <firewalls@greatcircle.com>; Mon, 12 Jan 1998 11:09:56 -0800 (PST)
Received: from aberlour.cit.canadair.ca by glengoyne.canadair.ca with SMTP id AA10580
  (5.65+/IDA-1.3.5 for firewalls@greatcircle.com); Mon, 12 Jan 98 14:11:21 -0500
Received: from laphroaig.cit.canadair.ca by aberlour.cit.Canadair.CA with SMTP id AA20661
  (5.65c/IDA-1.4.4 for <firewalls@greatcircle.com>); Mon, 12 Jan 1998 14:11:20 -0500
Message-Id: <199801121911.AA20661@aberlour.cit.Canadair.CA>
To: firewalls@greatcircle.com
Subject: Storagetek (aka Network Systems) Borderguard alternatives
X-Mailer: Mew version 1.69 on Emacs 19.34.1
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Date: Mon, 12 Jan 1998 14:11:20 -0500
From: "Marc P. Rinfret" <marc@cit.canadair.ca>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Greetings,
	I was considering the acquisition of a few of both BorderGuard
1000 and 2000.  I like their filtering capabilities and was also
considering the deployment of NetRanger.

	However the hardware maintenance costs for these boxes is
prohibitive .  It seems that the very limited number of these boxes in
the field prevents Storagetek from offering maintenance at a
competitive cost (or is this because of poor reliability?).

	What are my alternatives?  Who offers good performance even
with extensive, detailed and comprehensive filtering?  Anyone else
offers a similar filtering language for their routers (cisco access
lists simply don't cut it)?  Anyone else maintaining Borderguard
routers in Montreal QC?

	Thanks for sharing suggestions and experiences,

						Marc.
-- 
Marc P. Rinfret					    Marc.Rinfret@Canadair.CA
Reseaux et technologies				    fax:   (514) 855-7402
Bombardier Inc. / Canadair			    phone: (514) 855-7714

From firewalls-owner  Mon Jan 12 13:32:15 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA01888; Mon, 12 Jan 1998 12:43:28 -0800 (PST)
Received: from cta52.cta.ha.osd.mil ([204.208.244.170]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA01730 for <Firewalls@GreatCircle.COM>; Mon, 12 Jan 1998 12:42:48 -0800 (PST)
Received: by CTA52 with Internet Mail Service (5.0.1458.49)
	id <Z7A90DYW>; Mon, 12 Jan 1998 15:33:48 -0500
Message-ID: <F181E1E737B0D011A93E00A0C92D90C7075954@CTA52>
From: Ken Simmons <KenS@mail.cta.ha.osd.mil>
To: Ken Atkinson <kenny@paradigmsim.com>, Bob Bryant <rhb1@gte.com>,
        "'phoenix@clark.net'" <phoenix@clark.net>
Cc: rmckosky@gte.com, enorris@gte.com, djuitt@gte.com, ccarroll@gte.com,
        Jyri Kaljundi <jk@stallion.ee>, Firewalls@GreatCircle.COM
Subject: RE: ctia hotel confirmations
Date: Mon, 12 Jan 1998 15:33:47 -0500
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1458.49)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I got dibs on the stereo!!!

> -----Original Message-----
>      Umm... good thing we're all friends here.  This information has
> serious practical joke value.  ;)  I wonder how many cancellations The
> Salt Lake City Hilton will receive...
> 
> 
> On Wed, 7 Jan 1998, Bob Bryant wrote:
> 
> > I have confirmed with the Salt Lake City Hilton that the following
> hotel
> > reservations have been made.
> > name                    dates                   confirmation  #
> > R stanley               13-16                   832781
> > C Carroll               13-16                   832780
> > R McKosky          12-16                   832816
> > Djuitt                     13-16                   831992
> > R Bryant                12-16                   832815
> > E Norris                  12-16                  831991
> > I did this so we would not get the "Mary and Joseph" responce in the
> lobby.
> > 
> >
> **********************************************************************
> *********
> > Robert Bryant                           email           rhb1@gte.com
> > Member Technical Staff                  Fax             617-466-2838
> > Secure Systems Department
> > GTE Labrotories                         office ph       617-466-2821
> > 40 Sylvan Rd    MS/55                   Cell ph         617-733-7757
> > Waltham, MA 02254
> >
> **********************************************************************
> ******
> > ***
> 
> 
> Trees:2 Skiers:0
> 
> 
> 
> 

From firewalls-owner  Mon Jan 12 13:47:30 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA27528; Mon, 12 Jan 1998 12:24:54 -0800 (PST)
Received: from di2.disclosure.com (di2.disclosure.com [206.181.208.4]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA27360 for <firewalls@Greatcircle.com>; Mon, 12 Jan 1998 12:24:20 -0800 (PST)
Received: from smtpgate.disclosure.com ([192.168.101.5])
	by di2.disclosure.com (8.8.7/8.8.7) with SMTP id PAA00799
	for <firewalls@Greatcircle.com>; Mon, 12 Jan 1998 15:25:42 -0500 (EST)
Received: from ccMail by smtpgate.disclosure.com
  (IMA Internet Exchange 2.12 Enterprise) id 00067645; Mon, 12 Jan 1998 15:28:33 -0500
Mime-Version: 1.0
Date: Mon, 12 Jan 1998 15:18:38 -0500
Message-ID: <00067645.3452@disclosure.com>
From: Larry.Riley@disclosure.com (Larry Riley)
Subject: Secure Web Transaction Solution
To: firewalls@Greatcircle.com
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Content-Description: cc:Mail note part
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

     Does anybody have any experience with Cisco and Hewlett-Packard Secure 
     Web Transaction Solution Architecture?
     
     http://www.ebizsoftware.hp.com/virtualv/hpcisc23.html
     
     Can this solution be compared to any other firewall solution such as 
     Firewall-1, regarding its price, efficiency and security? Does this 
     solution have any bugs?
     
     This solution to me seems too complex and could have a lot of security 
     holes.  My company is currently looking at Firewall-1 as our solution.
     
     Thanks for any comments.

From firewalls-owner  Mon Jan 12 14:15:09 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA27124; Mon, 12 Jan 1998 12:22:36 -0800 (PST)
Received: from ntserver.newoak.com ([146.115.61.251]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA27107 for <firewalls@greatcircle.com>; Mon, 12 Jan 1998 12:22:23 -0800 (PST)
Received: from mfeinstein.newoak.com ([10.0.1.9]) by ntserver.newoak.com
          (Netscape Mail Server v2.02) with ESMTP id AAA113
          for <firewalls@greatcircle.com>; Mon, 12 Jan 1998 15:22:07 -0500
Message-ID: <34BA7B63.A6ED1E85@newoak.com>
Date: Mon, 12 Jan 1998 15:21:56 -0500
From: mfeinstein@newoak.com (Michael G. Feinstein)
Reply-To: mfeinstein@newoak.com
Organization: New Oak Communications
X-Mailer: Mozilla 4.01 [en] (Win95; I)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: Re: Pusing the envelope...
X-Priority: 3 (Normal)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Our product should do everything you need.  It terminates many encrypted
tunnels and can control which devices, protocols, and/or ports on the
network each user, or group of users, can access.  Access controls can
be unique for each user or group.

Check out our Web site http://www.newoak.com for more info, or feel free
to respond to me directly.

>
>Hi, everybody...
>
>In general, our engineers are being blasted with requests to
accommodate
>access for people who need access to data inside our firewall, but
these
>are also folks who cannot be authorized the capability to "browse" the
>net (i.e. competitors who are partnering with us on a specific project,

>foreign nationals, etc.). I am aware of Reverse Proxy, VPN technology,
>etc., but this is all piecemeal, or seems to be. Does anybody have a
>general architecture which they have or are migrating to that they
would
>be willing to share? New technology isn't coming fast enough to handle
>the need! The problem seems to be especially troublesome on mainframes
>and interactive applications (where the data can't be simply "viewed").

>
>I don't expect any miracles here - just fishing for ideas...
>
>Connie



--
Michael Feinstein                        New Oak Communications
VP, Product Marketing                    125 Nagog Park
Tel: 978-266-1011 x103                   Acton, MA  01720
Fax: 978-266-1080                        http://www.newoak.com
mfeinstein@newoak.com                    Pager: 800-592-6311



From firewalls-owner  Mon Jan 12 14:38:39 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id OAA23200; Mon, 12 Jan 1998 14:18:50 -0800 (PST)
Received: from relay3.exodus.net (relay3.exodus.net [206.79.240.118]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id OAA23108 for <firewalls@greatcircle.com>; Mon, 12 Jan 1998 14:18:31 -0800 (PST)
Received: from imx-exchange.com (imxnet.imx-exchange.com [207.82.224.4])
	by relay3.exodus.net (8.8.5/8.8.5) with ESMTP id OAA29364
	for <firewalls@greatcircle.com>; Mon, 12 Jan 1998 14:39:42 -0800
Message-ID: <34BA8E3F.EDD39388@imx-exchange.com>
Date: Mon, 12 Jan 1998 13:42:23 -0800
From: James Terry <james@imx-exchange.com>
Organization: IMX
X-Mailer: Mozilla 4.03 [en] (X11; I; SunOS 5.6 sun4u)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: sanity check / SKIP & FW1...
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

am i correct in assuming that FW1 & SKIP cannot co-exist on the same
box?

They both want to be between the IP & MAC layers, right?


TIA,

james@imx-exchange.com

From firewalls-owner  Mon Jan 12 18:01:52 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id RAA13830; Mon, 12 Jan 1998 17:46:10 -0800 (PST)
Received: from pike.sover.net (pike.sover.net [204.71.16.17]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id RAA13811 for <firewalls@GreatCircle.COM>; Mon, 12 Jan 1998 17:46:03 -0800 (PST)
Received: from sover.net (usr0a39.rut.sover.net [206.25.64.139])
	by pike.sover.net (8.8.5/8.8.5) with ESMTP id UAA20298;
	Mon, 12 Jan 1998 20:47:29 -0500 (EST)
Message-ID: <34BAAE54.64ED641C@sover.net>
Date: Mon, 12 Jan 1998 18:59:16 -0500
From: Chris Brenton <cbrenton@sover.net>
Reply-To: cbrenton@sover.net
X-Mailer: Mozilla 4.03 [en] (Win95; I)
MIME-Version: 1.0
To: Sick Puppy <sikpuppy@maestro.com>
CC: firewalls@GreatCircle.COM
Subject: Re: Wannabe needs a good book
References: <Pine.SUN.3.96.980106105930.4657A-100000@maestro.maestro.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Sick Puppy wrote:

> Can someone please suggest a good book on the
> general topic of networking, with some emphasis on TCP/IP, that we can
> steal?

WARNING!!!   Blatant self plug!

Check out the link to my last book in the tag below. 
Covers network wiring & hardware, topologies (LAN & WAN), 
protocols (heavy on IP but IPX, NetBIOS & AT as well), 
and even a how-to on configuring networking on NetWare, 
Unix, Notes and all Windows platforms. There's even a bit 
on troubleshooting tools and methodologies.

If you can steal it from Amazon, I want to see traces. ;)

Cheers,
Chris
--
**************************************
cbrenton@sover.net

Multiprotocol Network Design & Troubleshooting
http://www.amazon.com/exec/obidos/ISBN=0782120822/0740-8883012-887529

Support the anti-spam movement: http://www.cauce.org/



From firewalls-owner  Mon Jan 12 21:17:05 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id VAA02183; Mon, 12 Jan 1998 21:14:06 -0800 (PST)
Received: from mtigwc03.worldnet.att.net (mtigwc03.worldnet.att.net [204.127.131.34]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id VAA02157 for <firewalls@greatcircle.com>; Mon, 12 Jan 1998 21:13:58 -0800 (PST)
From: NationalContest@worldnet.att.net
Received: from worldnet.att.net ([12.68.130.212])
          by mtigwc03.worldnet.att.net (post.office MTA v2.0 0613 )
          with SMTP id ACD22925; Tue, 13 Jan 1998 05:15:27 +0000
To: NationalContest@worldnet.att.net
Subject: Free Poetry Contest
Date: Tue, 13 Jan 1998 05:15:27 +0000
Message-ID: <19980113050807.ACD22925@worldnet.att.net>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

***NATIONAL POETRY FORUM'S 1998 OFFICIAL CALL FOR ENTRIES!***
***You Could Be Published!  You Could Win the $2,000.00 Grand Prize!***

   It is with great pride that the National Poetry Forum announces its official call for entries for our 1998 poetry competition.  Through this prestigious competition, you are invitied to submit your original poetry for consideration by our distinguished panel of literary judges.  All entries will receive a personal acknowledgement letter from the comittee, and should your poem be selected, you will be honored with publication in our upcoming, hardbound anthology.  A well-deserved showcase for talented poets all across the nation - and around the world!

   If your entry is selected, you also become eligible for the Grand Prize of $2,000 or one of 99 other valuable prizes.  As a winning author, you will also be awarded Privileged Membership in the National Poetry Forum.  Founded over 75 years ago, our publisher, Dorrance Co., has printed books in 12 countries and 6 languages - inclusion in this fraternity is an admirable accomplishment.  
                                R U L E S :
-Send ONE poem, any style on any subject, no more than 25 lines.
-Print or type poem on standard 81/2 x 11 sheet of paper
-In Upper left corner should be:
            -"Contest #1"  
            -Titile of Poem
            -Your Name
            -Mailing Address (City, State, Zip)
-Contest DEADLINE: February 27, 1998
---There are NO FEES to enter, and all winners will be published.  Grand Prize is $2,000.00
-Mail Entries To:
                          National Poetry Forum
                          PO Box 381
                          New York, NY 10040

-Contest open to all, except current or past employees of National Poetry Forum and their families.




From firewalls-owner  Mon Jan 12 21:20:38 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id VAA01146; Mon, 12 Jan 1998 21:01:37 -0800 (PST)
Received: from out1.ibm.net (out1.ibm.net [165.87.194.252]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id VAA01129 for <firewalls@greatcircle.com>; Mon, 12 Jan 1998 21:01:30 -0800 (PST)
From: daemond@ibm.net
Received: from master.ibmcyrix.org ([129.37.123.64]) by out1.ibm.net (8.8.5/8.6.9) with SMTP id FAA46366 for <firewalls@greatcircle.com>; Tue, 13 Jan 1998 05:02:17 GMT
Date: Tue, 13 Jan 1998 00:10:35 -0500 (EST)
X-Sender: daemond@master.ibmcyrix.org
To: firewalls@greatcircle.com
Subject: Exposing fraudulent SA's
Message-ID: <Pine.NEB.3.96.980112235018.5708A-100000@master.ibmcyrix.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello All!

	I have a dilema that I can't seem to find a clear cut solution for
and was wondering if anyone ran into this before and what can be done about
it.  I am a college freshman and while I done have any certifications I am
not stupid about internet security (some of the books that I've read:
"Building Internet Firewalls" Chapman and Zwicky [O'Reilly];  "TCP/IP Network
Administration" Hunt [O'Reilly]; "Practical UNIX & Internet Security"
Simson, Garfinkel and Spafford [O'Reilly]; and "UNIX Systems Administration
Handbook (2nd ed.)" Nemeth, Snyder, Seebass, and Hein [Prentice Hall]; and
thousands of messages from this and other lists). 
I've used SVR4, SCO Openserver, Linux, and NetBSD.  However, at my college,
we have two CNE certifed SAs that claim we have a secure setup
(hahahahaha!!).  Here's what we have: a Cisco router (with no filtering
rules setup that I can find), NT Server for our web & DNS server, and
NetWare 4.x for the students to log in a attach to their home directories,
etc.  From what I can tell our systems are wide open and just waiting to be
sacked left, right, and center.  I see no signs of any tight security
whatsoever.  I've used SATAN and strobe to do my checking to verify this
(all systems are pretty much up for grabs). Aside from that our network is 
S L O W (and probably misconfigured) and it collapses now and then.  I once got
together with the two SA's and tried to point out the flaws and propose
alternatives, but no dice (they've got their club and I'm not invited).  So
here's the question: how do you expose frauds like these so they at least
secure it (or are given the boot)?  I'm not sure I want to be near the
systems around here when our network goes up in smoke.  Who knows what else
can be obtained?  I know the Registar has their systems on a network here
(I'm not sure if it's connected to the one in use by us, but possible). 
There's no telling what damage could be done to here.  I'm a concerned
college student with no options begging for ideas that you may have.  I'll
be thankful for any ideas.  Please help.

-----------------------------------------------------------------------------
Geoff Gowey		| NetBSD: the best multi-platform OS 
daemond(at)ibm.net	| www.netbsd.org
*****************************************************************************
Spammers beware: I do not buy from companies that spam and I keep track!
Above policy STRICTLY ENFORCED!
*****************************************************************************
"All I ask is for the chance to prove that money can't buy me happiness"
or more simply put "SHOW ME THE MONEY!!!"


From firewalls-owner  Mon Jan 12 23:31:48 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id XAA17301; Mon, 12 Jan 1998 23:28:06 -0800 (PST)
Received: from UPIMSRGSMTP08 (upimsrgsmtp08.msn.com [207.68.152.52]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id XAA17286 for <firewalls@greatcircle.com>; Mon, 12 Jan 1998 23:27:58 -0800 (PST)
Received: from upmajb02.msn.com - 204.95.110.74 by msn.com with Microsoft SMTPSVC;
	 Mon, 12 Jan 1998 23:29:30 -0800
Date: Tue, 13 Jan 98 07:25:21 UT
From: "Dorian Hanzich" <DHanzich@classic.msn.com>
Message-Id: <UPMAIL11.199801130728520892@classic.msn.com>
To: "Firewalls" <firewalls@greatcircle.com>
Subject: FW: Free Poetry Contest
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

He thought he saw another spam
penetrate the firewalls list
But when he looked at who it was from
Liquid oozed out of his cyst

Nikes and sugar plums
bada bing bada bang
I pray these bums
will join the Heavens Gate gang. 

----------
From: 	firewalls-owner@GreatCircle.COM on behalf of 
NationalContest@worldnet.att.net
Sent: 	Monday, January 12, 1998 9:15 PM
To: 	NationalContest@worldnet.att.net
Subject: 	Free Poetry Contest

***NATIONAL POETRY FORUM'S 1998 OFFICIAL CALL FOR ENTRIES!***
***You Could Be Published!  You Could Win the $2,000.00 Grand Prize!***

   It is with great pride that the National Poetry Forum announces its 
official call for entries for our 1998 poetry competition.  Through this 
prestigious competition, you are invitied to submit your original poetry for 
consideration by our distinguished panel of literary judges.  All entries will 
receive a personal acknowledgement letter from the comittee, and should your 
poem be selected, you will be honored with publication in our upcoming, 
hardbound anthology.  A well-deserved showcase for talented poets all across 
the nation - and around the world!

   If your entry is selected, you also become eligible for the Grand Prize of 
$2,000 or one of 99 other valuable prizes.  As a winning author, you will also 
be awarded Privileged Membership in the National Poetry Forum.  Founded over 
75 years ago, our publisher, Dorrance Co., has printed books in 12 countries 
and 6 languages - inclusion in this fraternity is an admirable accomplishment. 
 
                                R U L E S :
-Send ONE poem, any style on any subject, no more than 25 lines.
-Print or type poem on standard 81/2 x 11 sheet of paper
-In Upper left corner should be:
            -"Contest #1"  
            -Titile of Poem
            -Your Name
            -Mailing Address (City, State, Zip)
-Contest DEADLINE: February 27, 1998
---There are NO FEES to enter, and all winners will be published.  Grand Prize 
is $2,000.00
-Mail Entries To:
                          National Poetry Forum
                          PO Box 381
                          New York, NY 10040

-Contest open to all, except current or past employees of National Poetry 
Forum and their families.







From firewalls-owner  Tue Jan 13 00:01:44 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id XAA19117; Mon, 12 Jan 1998 23:46:47 -0800 (PST)
Received: from nl-mail-dmz.cmg-gecis.nl (nl-mail-dmz.cmg-gecis.nl [195.109.155.100]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id XAA19095 for <Firewalls@greatcircle.com>; Mon, 12 Jan 1998 23:46:40 -0800 (PST)
Received: from nl-amv-mail01.atf.cmg.nl (10.16.66.200) by nl-mail-dmz.cmg-gecis.nl
 (Integralis SMTPRS 1.51) with ESMTP id <B0000148226@nl-mail-dmz.cmg-gecis.nl>;
 Tue, 13 Jan 1998 08:44:50 +0100
Received: from 10.16.124.7 by nl-amv-mail01.atf.cmg.nl with SMTP (Microsoft Exchange Internet Mail Service Version 5.0.1458.49)
	id ZPH0AP4T; Tue, 13 Jan 1998 08:47:20 +0100
Received: by omnibook with Microsoft Mail
	id <01BD2000.31D56780@omnibook>; Tue, 13 Jan 1998 08:49:44 +0100
Message-Id: <01BD2000.31D56780@omnibook>
From: CMG <renato.kuiper@cmg.nl>
To: "'Firewalls@GreatCircle.com'" <Firewalls@GreatCircle.com>
Subject: filtering ipx/spx
Date: Tue, 13 Jan 1998 08:49:26 +0100
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

=20
Hi,

Does anybody have any experience with Cisco and IPX/SPX filtering. We =
are building  TCP/IP and IPX/SPX firewalls. For the TCP/IP part we use =
the Borderware firewall, for the IPX/SPX part we will use cisco 4700 =
routers.

There is not a clear document about filtering the different SAP and RIP =
parts of IPX/SPX. We have questions like:
	- What do we need to filter if we want to use rconsole ?
	- What will happen when we will stop the SAP 4 protocol of IPX/SPX.
	- i'm looking for the relationship between the novell services and the =
different SAP protocols.?
Does anybody have any idees ?

Thanks for any comments.


Renato Kuiper
Security Consultant CMG.

e-mail: Renato.Kuiper@cmg.nl

From firewalls-owner  Tue Jan 13 00:31:49 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id AAA24612; Tue, 13 Jan 1998 00:13:43 -0800 (PST)
Received: from images.netaddress.usa.net (image03.netaddress.usa.net [204.68.24.75]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id AAA24583 for <firewalls@greatcircle.com>; Tue, 13 Jan 1998 00:13:34 -0800 (PST)
From: zack.whickerman@usa.net
Received: (qmail 29669 invoked from network); 13 Jan 1998 08:16:15 -0000
Received: from unknown (HELO www07.netaddress.usa.net) (204.68.24.83)
  by realimage03.netaddress.usa.net with SMTP; 13 Jan 1998 08:16:15 -0000
Received: (qmail 12538 invoked by uid 60001); 13 Jan 1998 08:15:06 -0000
Message-ID: <19980113081506.12537.qmail@www07.netaddress.usa.net>
Date: Tue, 13 Jan 1998 01:15:06
To: firewalls@greatcircle.com
Subject: NetRanger
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I recently had a chance to look at NetRanger.

Here's notes for pros and cons when playing with it.

In setup, I had a difficult and time-consuming experience
 getting it up and running. IMHO, the User Interface
 was poorly designed. Alot of major functionality of
 NetRanger relied on requiring HP Openview.  HP Openview
 has known security holes that compromise NetRanger.

In determining performance, it missed significant packets on
 typical network traffic.  I don't think much defined
 testing and validation of speed has been done here.

In monitoring, NetRanger is spotty in how many attacks it detects.
 Without being a security expert, just reading security mailing lists,
 I know many missing attacks.

In pricing, with so many competitors, NetRanger's price 
 will need to be cut more than half before I would buy, IMHO.

Has anyone else has evaluated NetRanger and can share
their findings?

I am going to take a look at NFR next as a possible option.
Anyone have success with NFR catching the bad guys? 



____________________________________________________________________
Get free e-mail and a permanent address at http://www.netaddress.com

From firewalls-owner  Tue Jan 13 01:32:00 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id BAA04905; Tue, 13 Jan 1998 01:12:16 -0800 (PST)
Received: from luomat.peak.org (cc344191-a.ewndsr1.nj.home.com [24.2.83.40]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id BAA04891 for <firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 01:12:09 -0800 (PST)
Received: (from luomat@localhost)
	by luomat.peak.org (8.8.8/8.8.8) id EAA00249
	for firewalls@GreatCircle.COM; Tue, 13 Jan 1998 04:13:42 -0500 (GMT-0500)
Message-Id: <199801130913.EAA00249@luomat.peak.org>
Content-Type: text/plain
MIME-Version: 1.0 (NeXT Mail 4.1mach v148)
X-Image-URL: http://www.peak.org/~luomat/next/luomat@peak.org.tiff
In-Reply-To: <UPMAIL11.199801130728520892@classic.msn.com>
X-Nextstep-Mailer: Mail 4.1mach (Enhance 2.1)
Received: by NeXT.Mailer (1.148.RR)
From: Timothy J Luoma <luomat+firewalls@luomat.peak.org>
Date: Tue, 13 Jan 98 04:13:37 -0500
To: "Firewalls" <firewalls@GreatCircle.COM>
Subject: Re: FW: Free Poetry Contest
References: <UPMAIL11.199801130728520892@classic.msn.com>
X-Image-URL-Disclaimer: hey, it's off my student ID, gimme a break ;-)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Ah, but as the first was a spam easily trapped by the simplest of procmail  
recipes, your reply was not so.

Does replying to the list about spam actually accomplish anything?

Has the topic of requiring a subscription to post been mentioned yet?

If not, I'd like to throw it out as a good way of stopping spammers from  
getting through.

TjL,



From firewalls-owner  Tue Jan 13 02:32:12 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id CAA13681; Tue, 13 Jan 1998 02:19:38 -0800 (PST)
Received: from maili.intern.Austria.EU.net (melone.austria.eu.net [193.154.142.240]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id CAA13644 for <firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 02:19:17 -0800 (PST)
Received: from vindobona.intern.austria.eu.net (vindobona.intern.Austria.EU.net [192.168.191.165])
	by maili.intern.Austria.EU.net (8.8.6/8.8.6) with ESMTP id LAA22367
	for <firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 11:21:09 -0100 (GMT)
Received: (from cr@localhost) by vindobona.intern.austria.eu.net (8.7.6/8.7.3) id LAA00433; Tue, 13 Jan 1998 11:20:41 +0100
Date: Tue, 13 Jan 1998 11:20:41 +0100
Message-Id: <199801131020.LAA00433@vindobona.intern.austria.eu.net>
From: Christian Reiser <C.Reiser@Austria.EU.net>
To: brobinso@atsi.com
CC: firewalls@GreatCircle.COM
In-reply-to: <199801091659.JAA06715@zeus.atsi.com> (message from Bret Robinson
	on Fri, 9 Jan 1998 09:59:51 -0700)
Subject: Re: SKIP question
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


>How are these VPN products independent of the firewall?

OK, my wording might have been misleading. Some VPN produkts run only with or
on a special FW. With "independent of the firewall" I ment, that it works with
any FW.

>You still need to
>have some dual-homed host (firewall) to provide some type of protection to
>your internal network. The other product we have looked at for this is the
>AltaVista Tunnel which provides similar functionality but uses a
>proprietary encryption method.

Actually, this is a product I like.

>With this I still route all encrypted
>traffic through a firewall and do some filtering based on addresses and can
>use authentication at the firewall before the encrypted packets even get a
>chance to make it through the firewall.

AltaVista tunnel puts all the trafic encripted into one tcp-connection on a
dedicated Port (6666 by default). I see no practical security-problem allowing
tcp-connections on this port from everywhere to this port on my Tunnel Server
(either by opening the port or installing a generic proxy).

>DEC also provides a proxy that
>makes sure the packets coming through at least *look* like valid encrypted
>packets. 

What does this help? The server denies connections anyway, if they are not
encrypted. 

Greatings from Vienna/Austria
mfg
CR

-- 
Christian Reiser (EUnet Austria)      e-mail: C.Reiser@Austria.EU.net
Tel: +431 899 33-0                         http://www.Austria.EU.net/
Fax: +431 899 33-533        CR86-RIPE         priv: C.Reiser@ieee.org
      To get my PGP-Key send e-mail with Subject: Query PGP Key

From firewalls-owner  Tue Jan 13 04:01:46 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id DAA24624; Tue, 13 Jan 1998 03:37:10 -0800 (PST)
Received: from majestix.skp.de (majestix.skp.de [194.163.133.195]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id DAA24507 for <Firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 03:36:43 -0800 (PST)
Received: (from mail@localhost) by majestix.skp.de (8.7.5/8.7.3) id MAA07004; Tue, 13 Jan 1998 12:39:45 +0100
X-Authentication-Warning: majestix.skp.de: mail set sender to <lau@skp.de> using -f
Received: from hagbard(192.168.0.5) by majestix.skp.de via smap (V1.3)
	id sma007001; Tue Jan 13 12:39:18 1998
Date: Tue, 13 Jan 1998 12:36:52 +0100
To: Andrzej Blaszczyk <andy@lama.supermedia.pl>
From: Oliver Lau <lau@skp.de>
Cc: <Firewalls@GreatCircle.COM>
Subject: Re: Information about Babylon Firewall
In-Reply-To: <Pine.LNX.3.96.980110183344.19212C-100000@lama.supermedia.pl>
References: <199801100119.RAA19475@honor.greatcircle.com> <Pine.LNX.3.96.980110183344.19212C-100000@lama.supermedia.pl>
Message-Id: <34BB6DF42EB.3816.lau@skp.de>
MIME-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
X-Mailer: Becky! ver 1.20
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Greetings!

On Sat, 10 Jan 1998 18:34:41 +0100 (MET)
Andrzej Blaszczyk <andy@lama.supermedia.pl> wrote:

|  Does anybody have any experience with Babylon firewall family from BioData
|  Co. (Germany)?

Actually, it's not called Biodata Babylon (this is their ISDN crypter),
it's called BIGfire, see http://www.biodata.de/i_bigfire.html for
details. For questions on usability and performance please try another
posting in this mailinglist.


Regards,

Oliver Lau
[CTO]
Sauer und Partner GmbH, NetzwerkTechnologie und Sicherheit
Dietrich-Bonhoeffer-Strasse 1-3, 35037 Marburg, Germany
fon: +49 6421 938300, fax: +49 6421 938390, URL: http://www.skp.de/
PGP-Fingerprint: 6696 C8B6 F351 A381  D1C9 BC41 98F2 6DE3

From firewalls-owner  Tue Jan 13 05:17:53 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id EAA05739; Tue, 13 Jan 1998 04:45:13 -0800 (PST)
Received: from cbu.pvtnet.cz (cbu.pvtnet.cz [194.149.105.18]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id EAA01828 for <firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 04:21:12 -0800 (PST)
Received: from rdmhqs02.rdm.cz ([194.149.119.225]) by cbu.pvtnet.cz (8.8.5/8.7.3) with ESMTP id NAA27207 for <firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 13:23:41 +0100 (MET)
Received: by RDMHQS02.rdm.cz with Internet Mail Service (5.0.1458.49)
	id <CTTRVGYL>; Tue, 13 Jan 1998 13:24:00 +0100
Message-ID: <4F963DBDB751D11190FF0000F840FD1E4B1789@RDMHQS02.rdm.cz>
From: =?ISO-8859-2?Q?Grich_Ond=F8ej?= <GrichO@radiomobil.cz>
To: firewalls@GreatCircle.COM,
        "'zack.whickerman@usa.net'"
	 <zack.whickerman@usa.net>
Subject: RE: NetRanger
Date: Tue, 13 Jan 1998 13:23:56 +0100
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1458.49)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Helo Zack,

Could you point out HP Open view security holes? (sources on internet).
I'm in process of evaluation of network management platforms.

thank you
Ondra Grich



> ----------
> From: 	zack.whickerman@usa.net[SMTP:zack.whickerman@usa.net]
> Sent: 	13. ledna 1998 2:15
> To: 	firewalls@GreatCircle.COM
> Subject: 	NetRanger
> 
> I recently had a chance to look at NetRanger.
> 
> Here's notes for pros and cons when playing with it.
> 
> In setup, I had a difficult and time-consuming experience
>  getting it up and running. IMHO, the User Interface
>  was poorly designed. Alot of major functionality of
>  NetRanger relied on requiring HP Openview.  HP Openview
>  has known security holes that compromise NetRanger.
> 
> In determining performance, it missed significant packets on
>  typical network traffic.  I don't think much defined
>  testing and validation of speed has been done here.
> 
> In monitoring, NetRanger is spotty in how many attacks it detects.
>  Without being a security expert, just reading security mailing lists,
>  I know many missing attacks.
> 
> In pricing, with so many competitors, NetRanger's price 
>  will need to be cut more than half before I would buy, IMHO.
> 
> Has anyone else has evaluated NetRanger and can share
> their findings?
> 
> I am going to take a look at NFR next as a possible option.
> Anyone have success with NFR catching the bad guys? 
> 
> 
> 
> ____________________________________________________________________
> Get free e-mail and a permanent address at http://www.netaddress.com
> 

From firewalls-owner  Tue Jan 13 05:32:35 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id EAA29331; Tue, 13 Jan 1998 04:08:47 -0800 (PST)
Received: from gatekeeper.eastman.com (gatekeeper.eastman.com [164.89.253.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id EAA29252 for <Firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 04:08:26 -0800 (PST)
From: dwade@eastman.com
Received: by gatekeeper.eastman.com; id HAA23477; Tue, 13 Jan 1998 07:35:24 -0500 (EST)
Received: from emngw1.eastman.com(164.89.254.2) by gatekeeper.eastman.com via smap (3.2)
	id xma023429; Tue, 13 Jan 98 07:35:20 -0500
Received: by eastman.com id AA28989
  (5.67b/IDA-1.5 for Firewalls@GreatCircle.COM); Tue, 13 Jan 1998 07:10:59 -0500
Received: from ntmcon02.emn.com by eastman.com with SMTP id AA42554
	(5.67b/SMI-4.1 for <Firewalls@GreatCircle.COM>); Tue, 13 Jan 1998 07:10:58 -0500
Received: by ntmcon02.emn.com with Internet Mail Service (5.0.1458.49)
	id <YJ6NSV7T>; Tue, 13 Jan 1998 07:08:18 -0500
Message-Id: <83DA3062D756D1119B990000F881B84432CED2@ntmail20.emn.com>
To: KenS@mail.cta.ha.osd.mil, kenny@paradigmsim.com, rhb1@gte.com,
        phoenix@clark.net
Cc: Firewalls@GreatCircle.COM
Subject: RE: ctia hotel confirmations
Date: Tue, 13 Jan 1998 07:08:05 -0500
X-Priority: 3
Mime-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1458.49)
Content-Type: text/plain;
	charset="ISO-8859-1"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Sightings of the confirmation numbers have moved from the Salt Lake City
Hilton to the Kansas City Hilton Downtown, Little Rock Hilton (oh, that
was a Holiday Inn) and another one in Bridgeport, CT.  There could be a
lot of frequent flyer miles piled up on this one...

Donny Wade, Information Technology
Eastman
Eastman Chemical Company
Eastman Road, Building 284
Kingsport, TN 37664   USA
Phone: (423)229-4971
Fax: (423)229-1188
e-mail: dwade@eastman.com
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


	I got dibs on the stereo!!!

	> -----Original Message-----
	>      Umm... good thing we're all friends here.  This
information has
	> serious practical joke value.  ;)  I wonder how many
cancellations The
	> Salt Lake City Hilton will receive...
	> 
	> 
	> On Wed, 7 Jan 1998, Bob Bryant wrote:
	> 
	> > I have confirmed with the Salt Lake City Hilton that the
following
	> hotel
	> > reservations have been made.
	> > name                    dates                   confirmation
#
	> > R stanley               13-16                   832781
	> > C Carroll               13-16                   832780
	> > R McKosky          12-16                   832816
	> > Djuitt                     13-16                   831992
	> > R Bryant                12-16                   832815
	> > E Norris                  12-16                  831991
	> > I did this so we would not get the "Mary and Joseph"
responce in the
	> lobby.
	> > 
	> >
	>
**********************************************************************
	> *********
	> > Robert Bryant                           email
rhb1@gte.com
	> > Member Technical Staff                  Fax
617-466-2838
	> > Secure Systems Department
	> > GTE Labrotories                         office ph
617-466-2821
	> > 40 Sylvan Rd    MS/55                   Cell ph
617-733-7757
	> > Waltham, MA 02254
	> >
	>
**********************************************************************
	> ******
	> > ***
	> 
	> 
	> Trees:2 Skiers:0
	> 
	> 
	> 
	> 

From firewalls-owner  Tue Jan 13 06:20:38 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id EAA06969; Tue, 13 Jan 1998 04:51:00 -0800 (PST)
Received: from venus.compunet.de (venus.compunet.de [193.102.107.6]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id EAA06819 for <firewalls@greatcircle.com>; Tue, 13 Jan 1998 04:50:25 -0800 (PST)
From: Juergen.Nieveler@gecits-eu.com
Received: from mail.gecits-eu.com (mailge.compunet.de [193.98.133.26]) by venus.compunet.de (AIX4.2/UCB 8.7/8.7) with SMTP id NAA31306; Tue, 13 Jan 1998 13:36:31 +0100 (NFT)
Received: by mail.gecits-eu.com(Lotus SMTP MTA v1.1 (385.6 5-6-1997))  id 4125658B.0046C825 ; Tue, 13 Jan 1998 13:53:07 +0100
X-Lotus-FromDomain: GECITS-EU@GECITS-EXT
To: firewalls@greatcircle.com, firewalls-uk@gbnet.net
Message-ID: <4125658B.00458C08.00@mail.gecits-eu.com>
Date: Tue, 13 Jan 1998 13:51:41 +0100
Subject: Is Compuserve dangerous?
Mime-Version: 1.0
Content-type: text/plain; charset=iso-8859-1
Content-transfer-encoding: quoted-printable
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk





Dear Firewallers,

I=B4m sorry if this should be Off-Topic, but I=B4ve got a problem conce=
rning
CompuServe.

I have to set up a server under Windows NT that has to download Data vi=
a
Modem from Compuserve.

This Server has to forward the Data to other Servers in my Customers=B4=

Network.

Because of Security my customer does not want  _any_ connections betwee=
n
his network and other networks, for
example the Internet. So far, it is planned to install firewalls to the=
 net
and to place all servers with contact to the rest of the world into a D=
MZ,
for example SMTP-Servers etc.

My Questions are:

Has anybody got experience with Compuserve=B4s Network (Which Protocols=
 /
Ports to use etc) ?
Is Compuserve as/more dangerous compared to the Internet ?
Has anybody been attacked through Compuserve ?

Mit freundlichen Gruessen - Yours sincerely

Juergen Nieveler
CompuNet Koeln
System Engineering
Industriestrasse 161e, 50999 Koeln, Germany
Phone: ++49(0)2236/608161, Fax: ++49(0)2236/9651220,
Internet: Juergen.Nieveler@gecits-eu.com

Disclaimer: Above statements are my own, not my employers=B4 !
=



From firewalls-owner  Tue Jan 13 07:33:32 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA02870; Tue, 13 Jan 1998 07:19:46 -0800 (PST)
Received: from pine.tiaa-cref.org (pine.tiaa-cref.org [199.99.139.18]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id HAA02810 for <firewalls@greatcircle.com>; Tue, 13 Jan 1998 07:19:31 -0800 (PST)
X-Server-Uuid: 695d1f0a-1fd8-11d1-894a-0000f6772a5d
Message-ID: <9801138847.AA884704832@balsa.tiaa-cref.org>
Date: Tue, 13 Jan 98 10:19:10 -0500
From: "Dave Spizzirro" <dspizzirro@tiaa-cref.org>
To: <firewalls@greatcircle.com>
Subject: DMZ Infrastructure Statistics
MIME-Version: 1.0
X-WSS-ID: 18A5588997446-18A5588997447-01
Content-Type: text/plain; 
 charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


     Does anyone have any good links to (or hardcopy) statistics of 
     Ethernet vs. Token Ring.  Stats with security ratings, performance, or 
     available tools would be greatly appreciated.  I can't believe that 
     this type of information is not out there somewhere.
     
     - Dave Spizzirro



From firewalls-owner  Tue Jan 13 07:48:27 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA20992; Tue, 13 Jan 1998 06:24:54 -0800 (PST)
Received: from owl.jmu.edu (owl.jmu.edu [134.126.10.50]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id GAA20913 for <firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 06:24:38 -0800 (PST)
Received: from eayqwndo.resnet.jmu.edu (ip242-154.resnet.pc.jmu.edu [134.126.242.154]) by owl.jmu.edu (8.7.5/8.7.3) with SMTP id JAA03279; Tue, 13 Jan 1998 09:26:03 -0500 (EST)
From: "Kayulu, Patrick X" <kayulupx@jmu.edu>
Reply-To: kayulupx@jmu.edu
To: Steve Bagwell <steve@smallworks.com>
cc: firewalls@GreatCircle.COM
Subject: Re: usubscribe firewalls
In-Reply-To: <3.0.3.32.19980109103204.006c54c4@smallworks.com>
Message-ID: <SIMEON.9802130951.A@eayqwndo.resnet.jmu.edu>
Date: Fri, 13 Feb 1998 09:35:51 +0000 (!!!First Boot!!!)
Delivery-Receipt-To: "Kayulu, Patrick X" <kayulupx@jmu.edu>
X-Mailer: Simeon for Win32 Version 4.1 Build (3)
X-Authentication: IMSP
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

 usubscribe firewalls

-- 
Kayulu, Patrick X
kayulupx@jmu.edu



From firewalls-owner  Tue Jan 13 08:49:27 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA03570; Tue, 13 Jan 1998 07:24:10 -0800 (PST)
Received: from inet.unisource.nl (mail.inet.unisource.nl [194.151.95.4]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id HAA03464 for <firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 07:23:46 -0800 (PST)
Received: from inet.unisource.nl (inet.unisource.nl [194.151.95.4])
	by inet.unisource.nl (8.8.5/8.8.5) with SMTP id QAA17181
	for <firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 16:25:09 +0100 (MET)
Date: Tue, 13 Jan 1998 16:25:09 +0100 (MET)
From: Rob Poland <rob.poland@inet.unisource.nl>
Reply-To: Rob Poland <rob.poland@inet.unisource.nl>
Subject: Managed firewall service concept
To: firewalls@GreatCircle.COM
Message-ID: <ML-3.3.884705109.5627.robp@inet.unisource.nl>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

As an ISP we are investigating to provide a managed firewall solution.  Anyone
has any ideas on the different scenario's:
-placing the FW at customer premises or at your own premises (POP);
-combining virtual firewalls implementations on one physical firewall;
-combining with several other ISP services;

I have noticed that Pilot @ http://www.pilot.net/services/serv-firewall.html is
offering managed firewall service which reside at the Pilot's Network Service
Centers. Most other ISP's offering managed firewall services only at customer
side.

Does anyone have expirience with this kind of service? 

Rob Poland

From firewalls-owner  Tue Jan 13 09:20:15 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA02205; Tue, 13 Jan 1998 07:16:12 -0800 (PST)
Received: from loki.iss.net (loki.iss.net [208.21.0.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id HAA02125 for <firewalls@greatcircle.com>; Tue, 13 Jan 1998 07:15:54 -0800 (PST)
Received: from tdoty (tdoty.iss.net [208.21.4.61]) by loki.iss.net (8.8.7/8.7.3) with SMTP id KAA02478 for <firewalls@greatcircle.com>; Tue, 13 Jan 1998 10:17:24 -0500
Message-Id: <3.0.3.32.19980113101225.00976c70@mail.iss.net>
X-Sender: tdoty@mail.iss.net
X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.3 (32)
Date: Tue, 13 Jan 1998 10:12:25 -0500
To: firewalls@greatcircle.com
From: Ted Doty <ted@iss.net>
Subject: Re: Intrusion Detection
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Thu, 8 Jan 1998 07:40:38 -0600, "Gregg Earnhart" <ge@gte.net> wrote:

>Does a list discussing intrusion detection exists?
>Is there a need for such a list or NG to discuss intrusion detection
>systems?

We've started a new, unmoderated IDS mailing list.  It is intended to
provide a forum for discussion of:

- Intrusion Detection Technologies
- Implementing IDS systems
- Legal issues in network monitoring
- Discussing the latest vulnerabilities appearing on 
  heterogenous networks
- Reporting on analyzed data

To join this list, send email to majordomo@iss.net and write:

subscribe ids <your email>

in the text of your message. Do not write it in the subject line.

- Ted

--------------------------------------------------------------
Ted Doty, Internet Security Systems | Phone: +1 770 395 0150
41 Perimeter Center East            | Fax:   +1 770 395 1972
Atlanta, GA 30346  USA              | Web: http://www.iss.net
--------------------------------------------------------------
PGP key fingerprint: 362A EAC7 9E08 1689  FD0F E625 D525 E1BE

From firewalls-owner  Tue Jan 13 09:34:00 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA19938; Tue, 13 Jan 1998 06:18:27 -0800 (PST)
Received: from [208.201.27.131] ([208.201.27.131]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id GAA19929 for <firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 06:18:20 -0800 (PST)
Received: from mail.comsoltx.com by [208.201.27.131]
          via smtpd (for honor.greatcircle.com [198.102.244.44]) with SMTP; 13 Jan 1998 14:24:48 UT
Received: by mail.comsoltx.com with Internet Mail Service (5.0.1458.49)
	id <ZNMRXTX4>; Tue, 13 Jan 1998 08:19:23 -0600
Message-ID: <F11EDA100FAAD011AF690000F63A505D174788@mail.comsoltx.com>
From: Brent Reid <breid@comsoltx.com>
To: "'firewalls@GreatCircle.COM'" <firewalls@GreatCircle.COM>
Subject: Raptor - Limiting Access to Telnet by range of IP's
Date: Tue, 13 Jan 1998 08:19:22 -0600
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1458.49)
Content-Type: multipart/alternative;
	boundary="---- =_NextPart_001_01BD1FFB.F4C44E00"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------ =_NextPart_001_01BD1FFB.F4C44E00
Content-Type: text/plain

We have a Sco-Unix box on our network.

Several of our employees use their ISP's to access the box via Telnet.

How can we use Raptor to limit who can reach that box?
	Can we allow/disallow by IP for Telnet only?
	Can we set up a list of certain individuals?

Many thanks,

Brent Reid
breid@tddc.net


------ =_NextPart_001_01BD1FFB.F4C44E00
Content-Type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.0.1458.49">

</HEAD>
<BODY>
<P><FONT SIZE=2>We have a Sco-Unix box on our network.</FONT>
<BR>
<BR><FONT SIZE=2>Several of our employees use their ISP's to access the box via Telnet.</FONT>
<BR>
<BR><FONT SIZE=2>How can we use Raptor to limit who can reach that box?</FONT>
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <FONT SIZE=2>Can we allow/disallow by IP for Telnet only?</FONT>
<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <FONT SIZE=2>Can we set up a list of certain individuals?</FONT>
<BR>
<BR><FONT SIZE=2>Many thanks,</FONT>
<BR>
<BR><FONT SIZE=2>Brent Reid</FONT>
<BR><FONT SIZE=2>breid@tddc.net</FONT>
<BR>
</P>

</BODY>
</HTML>
------ =_NextPart_001_01BD1FFB.F4C44E00--

From firewalls-owner  Tue Jan 13 10:57:36 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA11622; Tue, 13 Jan 1998 08:15:14 -0800 (PST)
Received: from tcs-sec.com (tcsfw-1.tcs-sec.com [208.219.129.41]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id GAA27836 for <firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 06:55:14 -0800 (PST)
Received: (from uucp@localhost) by tcs-sec.com (8.8.7/8.6.9) id KAA01822; Tue, 13 Jan 1998 10:59:33 -0500
Received: from lambic.tcs-sec.com(205.197.27.135) by tcsfw-1.tcs-sec.com via smap (V1.3)
	id sma001817; Tue Jan 13 10:59:22 1998
Message-Id: <3.0.5.32.19980113095803.007c0c60@lambic>
X-Sender: gperry@lambic
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.5 (32)
Date: Tue, 13 Jan 1998 09:58:03 -0500
To: =?ISO-8859-2?Q?Grich_Ond=F8ej?= <GrichO@radiomobil.cz>,
        firewalls@GreatCircle.COM,
        "'zack.whickerman@usa.net'" <zack.whickerman@usa.net>
From: Gregory Perry <gperry@tcs-sec.com>
Subject: RE: NetRanger
In-Reply-To: <4F963DBDB751D11190FF0000F840FD1E4B1789@RDMHQS02.rdm.cz>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I don't know about any specific vulnerabilities on the HP Openview
platform, but at a previous position I managed a large network on the Sun
Net Manager platform.

Sun Net Manager is:  

a) a poorly written pig of an application 
b) requires custom kernel modifications which could lead to compromised
security
c) requires that the ethernet device be run in promisc mode - makes it
impossible to strip out your corresponding nit'ish device from the kernel,
and makes it difficult to detect a rogue sniffer without a package like lsof.
d) horrible file permissions, several binaries of which are setuid root and
vulnerable to IFS path exploits.

On top of the above mentioned problems, don't count on Sun to respond to
any SNM security related issues with their internal support network - I
probably still have a ticket open from 3 years ago.

One of the major problems with enterprise management applications is the
default SNMP configurations - each device should be independently
configured with unique read and write community strings, unfortunately this
is just not possible when you are managing a network with say 500+ devices.

My two pennies worth.

--greg


At 01:23 PM 1/13/98 +0100, =?ISO-8859-2?Q?Grich_Ond=F8ej?= wrote:
>Helo Zack,
>
>Could you point out HP Open view security holes? (sources on internet).
>I'm in process of evaluation of network management platforms.
>
>thank you
>Ondra Grich

>>  NetRanger relied on requiring HP Openview.  HP Openview
>>  has known security holes that compromise NetRanger.


__________________________________________________________________

Gregory Perry                                phone:  703.318.7134
Trusted Computer Solutions, Inc.               fax:  703.318.5041
13873 Park Center Road Suite 225        email: gperry@tcs-sec.com
Herndon, VA  20171                         http://www.tcs-sec.com
__________________________________________________________________

From firewalls-owner  Tue Jan 13 12:22:33 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id FAA14319; Tue, 13 Jan 1998 05:45:22 -0800 (PST)
Received: from pike.sover.net (pike.sover.net [204.71.16.17]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id FAA13259 for <Firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 05:41:01 -0800 (PST)
Received: from sover.net (usr0a43.rut.sover.net [206.25.64.143])
	by pike.sover.net (8.8.5/8.8.5) with ESMTP id IAA00330;
	Tue, 13 Jan 1998 08:42:15 -0500 (EST)
Message-ID: <34BB6F69.C922B314@sover.net>
Date: Tue, 13 Jan 1998 08:43:05 -0500
From: Chris Brenton <cbrenton@sover.net>
Reply-To: cbrenton@sover.net
X-Mailer: Mozilla 4.03 [en] (Win95; I)
MIME-Version: 1.0
To: CMG <renato.kuiper@cmg.nl>
CC: "'Firewalls@GreatCircle.com'" <Firewalls@GreatCircle.COM>
Subject: Re: filtering ipx/spx
References: <01BD2000.31D56780@omnibook>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

CMG wrote:

> Does anybody have any experience with Cisco and IPX/SPX filtering. We are building  TCP/IP and IPX/SPX firewalls. For the TCP/IP part we use the Borderware firewall, for the IPX/SPX part we will use cisco 4700 routers.

Actually, depending on you security requirements, you could use the Cisco to filter IP as well as IPX. It's packet filtering instead of a proxy but it may be sufficient for your needs (you do not mention what you are
trying to block from who).

IPX filtering is based on sockets. If you wish to block a service, simply block the socket it uses. Some well known IPX sockets are:

0451 = NCP
0452 = SAP
0453 = RIP
0455 = NetBIOS over IPX (blocked by default)
0456 = Server diagnostic packets
0457 = Serial number check
4000-8000 = Reply sockets

With regards to SAP's, you can even filter on type. The most common are:

0004 = File server
0047 = Print server
0278 = NDS server
026B = Time Sync server

Access list setup is very similar to that of IP.


> There is not a clear document about filtering the different SAP and RIP parts of IPX/SPX.

Check out Cisco's web site. They have some excellent on-line documents that explain both theory as well as actual examples of doing IPX filtering.

Cheers,
Chris
--
**************************************
cbrenton@sover.net

Multiprotocol Network Design & Troubleshooting
http://www.amazon.com/exec/obidos/ISBN=0782120822/0740-8883012-887529

Support the anti-spam movement: http://www.cauce.org/




From firewalls-owner  Tue Jan 13 12:21:41 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA07151; Tue, 13 Jan 1998 07:49:40 -0800 (PST)
Received: from mail.advancenet.net (hermes.cu-online.com [205.198.248.82]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id HAA07134 for <firewalls@greatcircle.com>; Tue, 13 Jan 1998 07:49:28 -0800 (PST)
Received: from mail.argus-systems.com (ranger.argus-systems.com [206.221.232.80]) by mail.advancenet.net (8.8.6/8.7.3) with SMTP id KAA26655; Tue, 13 Jan 1998 10:54:08 -0600
Received: by mail.argus-systems.com (SMI-8.6/SMI-SVR4)
	id JAA21875; Tue, 13 Jan 1998 09:50:19 -0600
Date: Tue, 13 Jan 1998 09:50:19 -0600
From: mcnabb@argus-systems.com (Paul McNabb)
Message-Id: <199801131550.JAA21875@mail.argus-systems.com>
To: connie.j.sadler@lmco.com, firewalls@greatcircle.com
Subject: Re: Pushing the envelope...
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Connie,

VPNs are great solutions but they have some restrictions.  For a VPN
to work, both sides have to have some kind of key.  Aside from the
key management issues, VPNs only work when you can be sure of having
a limited, or at least known, set of machines on the outside connecting
to your inside server.  If you are providing extranet services to an
potentially unlimited number of partner computers, the VPN management
can become pretty unwieldy.

A combination of a VPN, an access token (such as SecureID), and a good
firewall can be very powerful, but even then you are going to need to
protect the server host itself.  By definition you are going to have a 
bunch of "authorized" users using one or more network services on a
machine and subnet that are sensitive.  Bugs in network daemons and
applications, systems configuration problems, and other concerns could
allow "authorized" but malicious users to break your security.

paul

---------------------------------------------------------
Paul McNabb                     Argus Systems Group, Inc.
Vice President and CTO          1809 Woodfield Drive
mcnabb@argus-systems.com        Savoy, IL 61874 USA
TEL 217-355-6308
FAX 217-355-1433                "Securing the Future"
---------------------------------------------------------

>  Date: Mon, 12 Jan 1998 11:56:32 -0500
>  From: "Sadler, Connie J" <connie.j.sadler@lmco.com>
>  To: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
>  
>  Hi, everybody...
>  
>  In general, our engineers are being blasted with requests to accommodate
>  access for people who need access to data inside our firewall, but these
>  are also folks who cannot be authorized the capability to "browse" the
>  net (i.e. competitors who are partnering with us on a specific project,
>  foreign nationals, etc.). I am aware of Reverse Proxy, VPN technology,
>  etc., but this is all piecemeal, or seems to be. Does anybody have a
>  general architecture which they have or are migrating to that they would
>  be willing to share? New technology isn't coming fast enough to handle
>  the need! The problem seems to be especially troublesome on mainframes
>  and interactive applications (where the data can't be simply "viewed").
>  
>  I don't expect any miracles here - just fishing for ideas...
>  
>  Connie
>  

From firewalls-owner  Tue Jan 13 13:48:00 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id KAA10345; Tue, 13 Jan 1998 10:39:09 -0800 (PST)
Received: from tyche.credo.net (tyche.credo.net [199.107.168.8]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id KAA10305 for <firewalls@greatcircle.com>; Tue, 13 Jan 1998 10:38:58 -0800 (PST)
Received: from alectrona.credo.net (alectrona.credo.net [199.107.168.9])
	by tyche.credo.net (8.8.8/8.8.5) with SMTP id KAA16967
	for <firewalls@greatcircle.com>; Tue, 13 Jan 1998 10:40:26 -0800 (PST)
Message-Id: <3.0.32.19980113114602.00b46f38@199.107.168.8>
Received: from john.credo.net by alectrona.credo.net
          via smtpd (for mail.credo.net [199.107.168.8]) with SMTP; 13 Jan 1998 18:39:39 UT
X-Sender: john@199.107.168.8
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Tue, 13 Jan 1998 11:46:03 +0000
To: firewalls@greatcircle.com
From: John Whittaker <john@zoneoftrust.com>
Subject: Re: Raptor - Limiting Access to Telnet by range of IP's
Mime-Version: 1.0
Content-Type: text/enriched; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

<excerpt>

hi brent,


yes you can do just about anything with that firewall, i am surprised
that your integrator didn't help you set it up.  i would also probably
recomend some strong authentication solution like securid and encryption
via eagle mobile if they are going to be coming over the internet to
access sensitive computers.



best,


john.



At 08:19 AM 1/13/98 -0600, you wrote: 

>>>>

<excerpt>

<bigger>We have a Sco-Unix box on our network.</bigger> 


<bigger>Several of our employees use their ISP's to access the box via
Telnet.</bigger> 


<bigger>How can we use Raptor to limit who can reach that box?</bigger> 

        <bigger>Can we allow/disallow by IP for Telnet only?</bigger> 

        <bigger>Can we set up a list of certain individuals?</bigger> 


<bigger>Many thanks,</bigger> 


<bigger>Brent Reid</bigger> 

<bigger>breid@tddc.net</bigger> 


</excerpt>


</excerpt><<<<<<<<



---------------------------------------------------------------------------

ZONEOFTRUST

a division of Credo Computer Systems, Inc.

---------------------------------------------------------------------------


22941 Triton Way, 2nd Floor

Laguna Hills, CA  92653


(714) 859-0196 tel.

(714) 452-0513 fax.


http://www.zoneoftrust.com

From firewalls-owner  Tue Jan 13 13:53:56 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA28167; Tue, 13 Jan 1998 09:44:22 -0800 (PST)
Received: from lexicon.ins.com (lexicon.ins.com [199.0.193.11]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA27890 for <Firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 09:43:26 -0800 (PST)
Received: from frank-laptop.vtmednet.org (dmzhost239.vtmednet.org [204.165.197.254]) by lexicon.ins.com (8.7.5/8.7.3) with SMTP id JAA23847; Tue, 13 Jan 1998 09:44:19 -0800 (PST)
Message-Id: <3.0.1.32.19980113124345.006f144c@ins.com>
X-Sender: santia_f@ins.com
X-Mailer: Windows Eudora Pro Version 3.0.1 (32)
Date: Tue, 13 Jan 1998 12:43:45 -0500
To: CMG <renato.kuiper@cmg.nl>,
        "'Firewalls@GreatCircle.com'" <Firewalls@GreatCircle.COM>
From: Frank Santiago <santia_f@INS.COM>
Subject: Re: filtering ipx/spx
In-Reply-To: <01BD2000.31D56780@omnibook>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Check these Cisco sites:

SAP Management: http://www.cisco.com/warp/customer/701/34.html
Novell FAQ:     http://www.cisco.com/warp/customer/458/9.html
More IPX Tech:  http://www.cisco.com/warp/customer/111/index.shtml

These sites explain how to do it. If you any questions, please let me know.

____________________________________________________________
           INTERNATIONAL NETWORK SERVICES 
____________________________________________________________
Frank Santiago                Phone: (919)319-0400 x346(INS)
Network Systems Engineer      Pager: (888)812-2098
Cisco Certified, CCIE #2651   
____________________________________________________________
	    	    I LOVE THIS GAME        



At 08:49 AM 1/13/98 +0100, CMG wrote:
> 
>Hi,
>
>Does anybody have any experience with Cisco and IPX/SPX filtering. We are
building  TCP/IP and IPX/SPX firewalls. For the TCP/IP part we use the
Borderware firewall, for the IPX/SPX part we will use cisco 4700 routers.
>
>There is not a clear document about filtering the different SAP and RIP
parts of IPX/SPX. We have questions like:
>	- What do we need to filter if we want to use rconsole ?
>	- What will happen when we will stop the SAP 4 protocol of IPX/SPX.
>	- i'm looking for the relationship between the novell services and the
different SAP protocols.?
>Does anybody have any idees ?
>
>Thanks for any comments.
>
>
>Renato Kuiper
>Security Consultant CMG.
>
>e-mail: Renato.Kuiper@cmg.nl
>
>


From firewalls-owner  Tue Jan 13 14:02:13 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id KAA12881; Tue, 13 Jan 1998 10:50:36 -0800 (PST)
Received: from medos.de (gate.medos.de [195.125.176.130]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id KAA12682 for <Firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 10:49:57 -0800 (PST)
Received: by gateway.medos.de id <60035>; Tue, 13 Jan 1998 19:44:57 +0100
Message-Id: <98Jan13.194457gmt+0100.60035@gateway.medos.de>
From: "Judas, Roland" <rj@medos.de>
To: "'Oliver Lau'" <lau@skp.de>, Andrzej Blaszczyk <andy@lama.supermedia.pl>
Cc: Firewalls@GreatCircle.COM
Subject: RE: Information about Babylon Firewall
Date: Tue, 13 Jan 1998 19:50:42 +0100
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1458.49)
Content-Type: text/plain; charset="iso-8859-1"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

we used to have a BIGfire about 12 months ago and we were not satisfied
with it at all.  The reasons why we had choosen it were, that it offered
112 bit encryption for VPN and that is was a black box system with a
proprietary OS. The box was using packet filtering techniques and
offered a third interface (which could be used either for administration
or for setting up a DMZ). 

During preparation and setup we got some help from Biodata to get it up
and running, but when we encountered the first problems (Firewall
rebooting nearly 10 times a day) , it took about a week until we got
them solved.

After that we had several problems with firmware upgrades, leaving the
box in a state, where we were no longer able to configure it using the
graphical tool (At this time this was a real big problem for us <G>). As
I said before, the Support from Biodata was not very cooperative, so we
finally replaced it. 

In my opinion, if you are a Firewall wizard and are looking for a packet
filtering Firewall, you should look deeper into the product, but don't
expect to much Support from the developers. 

Regards 

Roland  

	-----Original Message-----
	From:	Oliver Lau [SMTP:lau@skp.de]
	Sent:	Tuesday, January 13, 1998 12:37 PM
	To:	Andrzej Blaszczyk
	Cc:	Firewalls@GreatCircle.COM
	Subject:	Re: Information about Babylon Firewall

	Greetings!

	On Sat, 10 Jan 1998 18:34:41 +0100 (MET)
	Andrzej Blaszczyk <andy@lama.supermedia.pl> wrote:

	|  Does anybody have any experience with Babylon firewall family
from BioData
	|  Co. (Germany)?

	Actually, it's not called Biodata Babylon (this is their ISDN
crypter),
	it's called BIGfire, see http://www.biodata.de/i_bigfire.html
for
	details. For questions on usability and performance please try
another
	posting in this mailinglist.


	Regards,

	Oliver Lau
	[CTO]
	Sauer und Partner GmbH, NetzwerkTechnologie und Sicherheit
	Dietrich-Bonhoeffer-Strasse 1-3, 35037 Marburg, Germany
	fon: +49 6421 938300, fax: +49 6421 938390, URL:
http://www.skp.de/
	PGP-Fingerprint: 6696 C8B6 F351 A381  D1C9 BC41 98F2 6DE3

From firewalls-owner  Tue Jan 13 14:02:24 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id KAA06767; Tue, 13 Jan 1998 10:22:33 -0800 (PST)
Received: from mailrelay.atsi.com ([204.209.211.162]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id KAA06658 for <firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 10:22:09 -0800 (PST)
Received: (from styx@localhost) by mailrelay.atsi.com (8.7.5/8.6.9) id LAA01093; Tue, 13 Jan 1998 11:19:15 -0700
Received: from mailhub.atsi.com by mailrelay.atsi.com via smap (V2.0)
	id xma001091; Tue, 13 Jan 98 11:18:29 -0700
Received: from zeus.atsi.com (BRobinson@atsi.com) by atsi.com (8.8.7/8.8.7) with SMTP id KAA03093; Tue, 13 Jan 1998 10:09:30 -0700 (MST)
Received: by zeus.atsi.com (SMI-8.6/SMI-SVR4)
	id KAA07115; Tue, 13 Jan 1998 10:14:01 -0700
Date: Tue, 13 Jan 1998 10:14:01 -0700
Message-Id: <199801131714.KAA07115@zeus.atsi.com>
From: Bret Robinson <brobinso@atsi.com>
To: C.Reiser@Austria.EU.net
CC: firewalls@GreatCircle.COM
In-reply-to: <199801131020.LAA00433@vindobona.intern.austria.eu.net> (message
	from Christian Reiser on Tue, 13 Jan 1998 11:20:41 +0100)
Subject: Re: SKIP question
References:  <199801131020.LAA00433@vindobona.intern.austria.eu.net>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> 
> OK, my wording might have been misleading. Some VPN produkts run only with or
> on a special FW. With "independent of the firewall" I ment, that it works
> with any FW.

Ok. This is what we are looking for as the "perfect" solution - being able
to connect to partner/client sites regardless of what type of firewall/VPN
software they are using (or at least be able to implement something that is
somewhat inexpensive). I know IPSEC is supposed to do this, but from what I
have heard this is still not possible at this time.

> >DEC also provides a proxy that
> >makes sure the packets coming through at least *look* like valid encrypted
> >packets. 
> 
> What does this help? The server denies connections anyway, if they are not
> encrypted. 

Because I don't want to run the AltaVista Tunnel server on a dual-homed
host. I want it to run on the internal network and use a firewall with the
"tunnel proxy" and authentication. I just feel more comfortable with the
fact that I can firstly authenticate a remote host/user and also make sure
the packets coming into the internal network are indeed AltaVista encrypted
packets *before* it even hits the tunnel machine. Maybe this is overly
cautious or maybe unnecessary? Or maybe just wrong? Opinions?

Either way, I still haven't found a solution to my original SKIP
problem. And the reason I need to find a SKIP solution is for political
reasons - we are a development partner for SUN.

Thanks, Bret

| Bret Robinson, Snr. System Admin    \       Voice: +1-403-213-8413        |
| Applied Terravision Systems, Inc.    \        Fax: +1-403-264-2122        | 
| Calgary, Alberta     Canada           \     Web site: www.atsi.com        |
| BRobinson@atsi.com                     \                                  |
|       "Keep your stick on the ice"      \___ o  <- puck (for US viewers)  |

From firewalls-owner  Tue Jan 13 14:32:26 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA23049; Tue, 13 Jan 1998 11:39:44 -0800 (PST)
Received: from c00069-100lez.eos.ncsu.edu (c00069-100lez.eos.ncsu.edu [152.1.26.28]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id LAA23000 for <firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 11:39:26 -0800 (PST)
Received: from localhost (jkwilli2@localhost)
          by c00069-100lez.eos.ncsu.edu (8.8.4/EC02Jan97) with SMTP
	  id OAA10635; Tue, 13 Jan 1998 14:40:56 -0500 (EST)
X-Authentication-Warning: c00069-100lez.eos.ncsu.edu: jkwilli2 owned process doing -bs
Date: Tue, 13 Jan 1998 14:40:55 -0500 (EST)
From: Ken Williams <jkwilli2@unity.ncsu.edu>
X-Sender: jkwilli2@c00069-100lez.eos.ncsu.edu
To: Dave Spizzirro <dspizzirro@tiaa-cref.org>
cc: firewalls@GreatCircle.COM
Subject: Re: DMZ Infrastructure Statistics
In-Reply-To: <9801138847.AA884704832@balsa.tiaa-cref.org>
Message-ID: <Pine.SOL.3.96.980113142615.9112A-100000@c00069-100lez.eos.ncsu.edu>
X-PreMailer: Microsoft-Unix '99 MSProExcelSendMail ver 0.98 beta
X-NoSpam: Pursuant to US Code; Title 47; Chapter 5; Subchapter II; 227
X-NoSpam: any and all nonsolicited commercial E-mail sent to this address is
X-NoSpam: subject to a download and archival fee in the amount of 500 US dollars.
X-NoSpam: Any E-mail sent to this address denotes acceptance of these terms.
X-Copyright: The contents of this message may not be reproduced in any form
X-Copyright: (including Commercial use) unless specific permission is granted
X-Copyright: by the author of the message.  All requests must be in writing.
X-Disclaimer: This email is meant for educational purposes only.
X-Disclaimer: The contents of this email do not reflect the thoughts
X-Disclaimer: or opinions of either myself or my employer and are not
X-Disclaimer: endorsed by sponsored by or provided on behalf of
X-Disclaimer: North Carolina State University.
X-Disclaimer: Any errors in spelling tact or fact are transmission errors.
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Tue, 13 Jan 1998, Dave Spizzirro wrote:

>
>     Does anyone have any good links to (or hardcopy) statistics of 
>     Ethernet vs. Token Ring.  Stats with security ratings, performance, or 
>     available tools would be greatly appreciated.  I can't believe that 
>     this type of information is not out there somewhere.
>     
>     - Dave Spizzirro

No, I don't have know of or have any links whatsoever to that subject, but
maybe it's due to the fact that token ring-based LANs suck.  I get
irritated enough waiting 1.25 seconds during peak user times for a command
to execute on the ethernet I am connected to.  If I had to sit and wait 3
minutes for my command to execute on a token ring network, then I would
quit my job and work the drive-thru at Taco Bell.

Token rings do have some theoretical and even a few practical advantages,
namely that you can pinpoint alot of problems more precisely and quicker,
and they *can* be more secure, but to sum it all up:  Just go with an
ethernet.


Ken Williams 

*looking forward to the flames, replies by token-ring users, and devil's
advocates*
:)

/--------------|  TATTOOMAN -aka- rute  |--------------\  
  NCSU Computer Science    VP of The EHAP Corp.   
  jkwilli2@unity.ncsu.edu  http://www.hackers.com/ehap/ 
  UNIX ICQ UIN# 4231260    ehap@hackers.com     
  FTP Site:  ftp://152.7.11.38/pub/personal/tattooman/
  WWW 2:     http://www4.ncsu.edu/~jkwilli2/
  PGP Key:   http://www4.ncsu.edu/~jkwilli2/pgp.asc
      http://www4.ncsu.edu/~jkwilli2/pgp_fingerprint
\---------|  http://152.7.11.38/~tattooman/  |---------/




From firewalls-owner  Tue Jan 13 14:47:10 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA01089; Tue, 13 Jan 1998 12:17:48 -0800 (PST)
Received: from venus.caso.net (venus.caso.net [195.52.49.66]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id LAA19257 for <firewalls@greatcircle.com>; Tue, 13 Jan 1998 11:23:35 -0800 (PST)
Received: from mars ([195.52.49.69]) by venus.caso.net
          (Netscape Mail Server v2.02) with SMTP id AAA246
          for <firewalls@greatcircle.com>; Tue, 13 Jan 1998 20:21:03 +0100
From: agabert@caso.de (Alexander Gabert)
To: <firewalls@greatcircle.com>
Subject: teardrop here, teardrop there, teardrop testing everywhere ...
Date: Tue, 13 Jan 1987 20:24:16 +0100
Message-ID: <01b0cafd$26b053b0$453134c3@mars.caso.net>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 4.71.1712.3
X-MimeOLE: Produced By Microsoft MimeOLE V4.71.1712.3
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

ok, so, i tried the new teardrop and i think it is a great tool to make
peace with my friends at work (e.g. in the LAN) but if you try it over a
router (WAN link) the other NT Server is responding and responding and
responding... whatever i try.
(of course the second server on the other router also belongs to my company
, ;) )

so, is it possible to make that work over the WAN ?

sincerely, alex.



... ok, so, i think we blew it ...
Alexander Gabert,
agabert@caso.de


From firewalls-owner  Tue Jan 13 15:28:51 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA11259; Tue, 13 Jan 1998 08:12:48 -0800 (PST)
Received: from detron.core.afcc.com (detron.afcc2.com [208.136.238.150]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id IAA11104 for <firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 08:12:08 -0800 (PST)
Received: from speedy.core.afcc.com ([192.168.5.1]) by detron.core.afcc.com
          via smtpd (for honor.greatcircle.com [198.102.244.44]) with SMTP; 13 Jan 1998 16:13:38 UT
Received: by afcc.com (SMI-8.6/SMI-SVR4)
	id KAA17622; Tue, 13 Jan 1998 10:13:00 -0600
Received: from detrondmz.core.afcc.com(192.168.5.150) by speedy via smap (V2.0)
	id xma017618; Tue, 13 Jan 98 10:12:39 -0600
Received: from [10.98.98.9] by detrondmz.core.afcc.com
          via smtpd (for speedy.core.afcc.com [192.168.5.1]) with SMTP; 13 Jan 1998 16:12:39 UT
Received: by z1111111.core.afcc.com with Internet Mail Service (5.0.1458.49)
	id <CZA6MM50>; Tue, 13 Jan 1998 10:12:39 -0600
Message-ID: <B7F4449C26FDD011A115006097DC67EF580D1E@z1111321.core.afcc.com>
From: "Moses, Ikoedem" <Ikoedem_Moses@afcc.com>
To: firewalls@GreatCircle.COM
Date: Tue, 13 Jan 1998 10:12:37 -0600
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1458.49)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I am trying to pass lotus notes through a raptor firewall. Any ideas?. I
know that you have to open port 1352 on the firewall because I have done
this with an IBM firewall.

Ikoedem Moses
Security Engineer
The Associates


From firewalls-owner  Tue Jan 13 15:43:50 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id OAA23562; Tue, 13 Jan 1998 14:04:27 -0800 (PST)
Received: from mainserver.surfnetusa.com (domain-ns-1.surfnetusa.com [208.201.152.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id OAA23548 for <Firewalls@GreatCircle.com>; Tue, 13 Jan 1998 14:04:17 -0800 (PST)
Received: from cynthia.surfnetusa.com (cynthia.surfnetusa.com [208.201.152.17]) by mainserver.surfnetusa.com (NTMail 3.03.0013/1a.aagj) with ESMTP id ia116098 for <Firewalls@GreatCircle.com>; Tue, 13 Jan 1998 14:07:51 -0800
X-Sender: cynthia@mail.surfnetusa.com
Message-Id: <v01540b03b0e1240814e6@[208.201.152.17]>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
To: cynthia@usenix.org
From: cynthia@usenix.org (Cynthia Deno)
Subject: USENIX SECURITY SYMPOSIUM
Date: Tue, 13 Jan 1998 14:07:50 -0800
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Time is running out.  Register now.

USENIX SECURITY SYMPOSIUM
January 26-29
San Antonio, Texas

Review the program.  See the quality. Register on-line.
Last day for on-line registration:  January 20
http://www.usenix.org/events/sec98/

Last day for faxed/postal registrations:  January 21
Fax:  714.588.9706

Call 714.588.8649 if you'd like to speak to someone about the conference.

================================================================
USENIX is the Advanced Computing Systems Association.  Its members are
the computer technologists responsible for many of the innovations in
computing we enjoy today.  To find out more about USENIX, visit our
web site: http://www.usenix.org.



From firewalls-owner  Tue Jan 13 15:51:18 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA08271; Tue, 13 Jan 1998 07:56:24 -0800 (PST)
Received: from mail.advancenet.net (hermes.cu-online.com [205.198.248.82]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id HAA08187 for <firewalls@Greatcircle.com>; Tue, 13 Jan 1998 07:56:03 -0800 (PST)
Received: from mail.argus-systems.com (ranger.argus-systems.com [206.221.232.80]) by mail.advancenet.net (8.8.6/8.7.3) with SMTP id LAA26957; Tue, 13 Jan 1998 11:00:41 -0600
Received: by mail.argus-systems.com (SMI-8.6/SMI-SVR4)
	id JAA21920; Tue, 13 Jan 1998 09:56:52 -0600
Date: Tue, 13 Jan 1998 09:56:52 -0600
From: mcnabb@argus-systems.com (Paul McNabb)
Message-Id: <199801131556.JAA21920@mail.argus-systems.com>
To: Larry.Riley@disclosure.com, firewalls@Greatcircle.com
Subject: Re: Secure Web Transaction Solution
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>  From: Larry.Riley@disclosure.com (Larry Riley)
>  
>       Does anybody have any experience with Cisco and Hewlett-Packard Secure 
>       Web Transaction Solution Architecture?
>       
>       http://www.ebizsoftware.hp.com/virtualv/hpcisc23.html
>       
>       Can this solution be compared to any other firewall solution such as 
>       Firewall-1, regarding its price, efficiency and security? Does this 
>       solution have any bugs?
>
>       This solution to me seems too complex and could have a lot of security 
>       holes.  My company is currently looking at Firewall-1 as our solution.

If you ignore the load balancing issues you are getting with this, the
security and functionality of HP/CISCO are significantly less than what
you get with a Sun/Argus/Checkpoint combination.  The HP solution is a
lot more expensive as well.

paul

---------------------------------------------------------
Paul McNabb                     Argus Systems Group, Inc.
Vice President and CTO          1809 Woodfield Drive
mcnabb@argus-systems.com        Savoy, IL 61874 USA
TEL 217-355-6308
FAX 217-355-1433                "Securing the Future"
---------------------------------------------------------

From firewalls-owner  Tue Jan 13 15:48:42 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id NAA15598; Tue, 13 Jan 1998 13:17:11 -0800 (PST)
Received: from mailhost.IntNet.net (mercury.IntNet.net [198.252.32.180]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id NAA15503 for <firewalls@greatcircle.com>; Tue, 13 Jan 1998 13:16:53 -0800 (PST)
Received: from cyclops by mailhost.IntNet.net (8.8.5/INTNET/SMI-SVR4)
	id QAA18181; Tue, 13 Jan 1998 16:18:54 -0500 (EST)
X-Auth: cyclops.tecoenergy.com [198.252.43.47]
Received: from YBOR#u#DC-Message_Server by tecoenergy.com
	with Novell_GroupWise; Tue, 13 Jan 1998 16:17:50 -0500
Message-Id: <s4bb93ae.097@tecoenergy.com>
X-Mailer: Novell GroupWise 4.1
Date: Tue, 13 Jan 1998 16:17:41 -0500
From: Paul McClay <pfmcclay@tecoenergy.com>
To: firewalls@greatcircle.com
Subject: FW-1 SMTP problem
Mime-Version: 1.0
Content-Type: text/plain
Content-Disposition: inline
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

We are currently experiencing a problem receiving uuencoded
attachments through Checkpoint FW-1 Secure SMTP Server.  When a
uuencoded attachment is received, the FW-1 SMTP server is inserting a
blank line or lines in the document before forwarding it on to our internal
SMTP server.  This causes garbage to be presented in the attachment
when being opened by client application (MS Word, Acrobat reader, etc.)

We are using the FW-1 SMTP Server to scan incoming mail for viruses
using Norton Anti-Virus for firewalls.  When we disable Norton virus
checking, the problem still occurs.  If we send mail directly to our internal
server without using the FW-1 SMTP Server the problem goes away. 
The problem exists for uuencoded documents only, and does not affect
mime. 

Our 3rd party support contact has been of little help, and we have not
found anything at Checkpoint's site to assist us.  Is anyone else
experiencing this problem or found a way to fix it?

We are currently running FW-1 ver 3.0b, build level 3045 on a Sun Ultra
1, OS ver. 2.5.1.  Our internal mail system is Groupwise ver. 4.

 
   

From firewalls-owner  Tue Jan 13 16:18:46 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id OAA26787; Tue, 13 Jan 1998 14:21:30 -0800 (PST)
Received: from helios.insnet.com (helios.insnet.com [206.54.244.9]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id OAA26697 for <Firewalls@GreatCircle.com>; Tue, 13 Jan 1998 14:21:12 -0800 (PST)
Received: from helios.insnet.com (helios.insnet.com [206.54.244.9])
	by helios.insnet.com (8.8.5/8.8.5) with SMTP id RAA18894
	for <Firewalls@GreatCircle.com>; Tue, 13 Jan 1998 17:20:30 -0600
Date: Tue, 13 Jan 1998 17:20:29 -0600 (CST)
From: Tom Peroulas <peroulas@helios.insnet.com>
To: Firewalls@GreatCircle.com
Subject: minimizing WAN traffic
Message-ID: <Pine.LNX.3.95.980113171810.17732D-100000@helios.insnet.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I am going to be setting up a distributed proxy environment across a WAN.
I want to be able to administer all my proxies remotely.  I also want to
minimize WAN traffic generated by caching.   Microsoft's caching array and
single virtual cache seem more efficient than Netscape's ICP, but I'm
wondering about effects on WAN traffic.

Let's say that I have offices in Boise, Seattle, Myrtle Beach, and Dallas.
Let's say all Internet traffic is handled by a T1 in Dallas, all other
offices are connected via WAN.  There's a proxy server in each office, and
Dallas has 2 for load balancing.

1.  I want to minimize WAN traffic.  Let's say a request is made in Myrtle
Beach, but the only proxy server that has it on its cache is Seattle.  To
minimize WAN traffic, I would rather have that document get retrieved in
Dallas via the Internet.  Can I set up a hierarchy that allows this.  I
understand how the parent-child relationships would be set up, I just want
to know if it's possible.

2.  Can I administer all proxy servers from Dallas?

3.  Where does the single virtual cache reside?  Does the single virtual
cache/proxy array of Microsoft generate more or less WAN traffic to
maintain the cache information across distributed proxies than does
Netscapes ICP?



From firewalls-owner  Tue Jan 13 16:32:04 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id OAA27401; Tue, 13 Jan 1998 14:24:18 -0800 (PST)
Received: from tyche.credo.net (tyche.credo.net [199.107.168.8]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id OAA27262 for <firewalls@greatcircle.com>; Tue, 13 Jan 1998 14:23:48 -0800 (PST)
Received: from alectrona.credo.net (alectrona.credo.net [199.107.168.9])
	by tyche.credo.net (8.8.8/8.8.5) with SMTP id OAA08325;
	Tue, 13 Jan 1998 14:25:20 -0800 (PST)
Message-Id: <3.0.32.19980113153057.00b4613c@199.107.168.8>
Received: from john.credo.net by alectrona.credo.net
          via smtpd (for mail.credo.net [199.107.168.8]) with SMTP; 13 Jan 1998 22:24:33 UT
X-Sender: john@199.107.168.8
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Tue, 13 Jan 1998 15:30:58 +0000
To: Rob Poland <rob.poland@inet.unisource.nl>
From: John Whittaker <john@zoneoftrust.com>
Subject: Re: Managed firewall service concept
Cc: firewalls@greatcircle.com
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

hi rob,

we are currently providing it to some of our customers.  did you have any
particlar questions?


best,

john.

At 04:25 PM 1/13/98 +0100, you wrote:
>As an ISP we are investigating to provide a managed firewall solution.
Anyone
>has any ideas on the different scenario's:
>-placing the FW at customer premises or at your own premises (POP);
>-combining virtual firewalls implementations on one physical firewall;
>-combining with several other ISP services;
>
>I have noticed that Pilot @
http://www.pilot.net/services/serv-firewall.html is
>offering managed firewall service which reside at the Pilot's Network Service
>Centers. Most other ISP's offering managed firewall services only at customer
>side.
>
>Does anyone have expirience with this kind of service? 
>
>Rob Poland
>
>
---------------------------------------------------------------------------
ZONEOFTRUST
a division of Credo Computer Systems, Inc.
---------------------------------------------------------------------------

22941 Triton Way, 2nd Floor
Laguna Hills, CA  92653

(714) 859-0196 tel.
(714) 452-0513 fax.

http://www.zoneoftrust.com

From firewalls-owner  Tue Jan 13 16:33:40 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA10917; Tue, 13 Jan 1998 12:51:00 -0800 (PST)
Received: from freedom.gmsociety.org ([209.116.153.41]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA10809 for <firewalls@greatcircle.com>; Tue, 13 Jan 1998 12:50:38 -0800 (PST)
Received: (from brad@localhost)
	by freedom.gmsociety.org (8.8.8/8.8.5) id PAA14532;
	Tue, 13 Jan 1998 15:51:26 -0500
From: Brad <brad@freedom.gmsociety.org>
Message-Id: <199801132051.PAA14532@freedom.gmsociety.org>
Subject: Re: NetRanger
To: zack.whickerman@usa.net
Date: Tue, 13 Jan 1998 15:51:25 -0500 (EST)
Cc: firewalls@greatcircle.com
In-Reply-To: <19980113081506.12537.qmail@www07.netaddress.usa.net> from "zack.whickerman@usa.net" at Jan 13, 98 01:15:06 am
X-Mailer: ELM [version 2.4 PL25 PGP7]
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Zack, 

I would be interested in who is working with you on your evaluation of NetRanger.

As well, I would like to discuss you results off line as you report here is greatly disturbing and contrary to the results we have been seeing in the field.

NetRanger has over 200 attack signatures and Ihave a sensor on a fddi network that is having no problems keeping up with the traffic and the attacks.

I have many concerns that I would like to take offline with you.  
PLease contact me at your leisure.

Brad H.

I work for WheelGroup, but I do not speak for Wheelgroup.
All opinions stated in the email are my own.



> 
> I recently had a chance to look at NetRanger.
> 
> Here's notes for pros and cons when playing with it.
> 
> In setup, I had a difficult and time-consuming experience
>  getting it up and running. IMHO, the User Interface
>  was poorly designed. Alot of major functionality of
>  NetRanger relied on requiring HP Openview.  HP Openview
>  has known security holes that compromise NetRanger.
> 
> In determining performance, it missed significant packets on
>  typical network traffic.  I don't think much defined
>  testing and validation of speed has been done here.
> 
> In monitoring, NetRanger is spotty in how many attacks it detects.
>  Without being a security expert, just reading security mailing lists,
>  I know many missing attacks.
> 
> In pricing, with so many competitors, NetRanger's price 
>  will need to be cut more than half before I would buy, IMHO.
> 
> Has anyone else has evaluated NetRanger and can share
> their findings?
> 
> I am going to take a look at NFR next as a possible option.
> Anyone have success with NFR catching the bad guys? 
> 
> 
> 
> ____________________________________________________________________
> Get free e-mail and a permanent address at http://www.netaddress.com
> 


From firewalls-owner  Tue Jan 13 16:35:28 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA07775; Tue, 13 Jan 1998 15:10:12 -0800 (PST)
Received: from nucleus.com (nucleus.com [199.45.65.129]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id PAA07618; Tue, 13 Jan 1998 15:09:37 -0800 (PST)
Received: from loki (user3@max1-cgy-146.nucleus.com [207.34.67.146])
	by nucleus.com (8.8.8/8.8.8-NIS-11-28.97) with SMTP id QAA05141;
	Tue, 13 Jan 1998 16:20:19 -0700 (MST)
Message-Id: <3.0.5.32.19980113161252.00b5c120@dreamwvr.com>
X-Sender: dreamwvr@dreamwvr.com
X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.5 (32)
Date: Tue, 13 Jan 1998 16:12:52 -0700
To: Firewalls@GreatCircle.COM, firewalls-digest@GreatCircle.COM
From: dreamwvr <dreamwvr@dreamwvr.com>
Subject: RFC Security plus question
In-Reply-To: <199801131334.FAA11858@honor.greatcircle.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi Everyone,
 A client of mine has requested i investigate the following and i am 
drawing blank stares for the most part so here goes to the group
to get hopefully the creative juices flowing.
       This is a somewhat vague explanation and for that i apologize.
       I remember quite a while ago us talking about a scenario to 
produce broadcast quality images and sound via the Big I and have the 
possibility of doing this firsthand but not sure if on the right track.
Plus the security concerns what i need to do is below.
I need a series of technologies that are easy to put up for a one shot 
deal. What I need to have is a digital video camera, a monitor, tripod,
light kit, mixer, microphone, the computer for capturing and encoding
video, the server for transmitting the video over the Internet, either 56k
or ISDN modem.
(all viewers would be welcome, no authentication)
What technologies would be best suited to do this properly if i do not 
do it right  as it will go live once only over the web but 
must be accessible for all. 
What digitalCamera,sound recorder,would you recommend, sw for
 maximum presentation quality of video and  real time as well
sound capturing and encoding for transmission over the Big I. the 
server must use a 56k or ISDN link to transmit over the web. 
Also how many viewers can be expected to access reliably from a ISDN
line as opposed to 56 k when we go live. There 
can not be any glitches obviously as one shot deal and must be right 
the first time including what security measure to ensure that this does
not hit a DoS attack ot such at that instant but may not have the 
luxury of many bells and whistles:'< 
All being done and transmitted in real time with 
a transmission window of 30 minutes. Otherwise I need to make sure 
reasonable that the technologies will do the job and it can be 
kept up reliably for at least 30 minutes. Also what ballpark am 
i looking at for a plug and pray solution as i may not be the 
one that is running the show so to speak?

                                    Best Regards,
                                               dreamwvr 

From firewalls-owner  Tue Jan 13 16:47:04 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id PAA08276; Tue, 13 Jan 1998 15:12:16 -0800 (PST)
Received: from pse01.pios.com (PSE01.PIOS.COM [199.33.129.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id PAA08132 for <Firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 15:11:44 -0800 (PST)
Received: by pse01.pios.com; (5.65v3.2/1.3/10May95) id AA19563; Tue, 13 Jan 1998 18:13:05 -0500
Received: from pio_mail2.cle2.pios.com by gemini.pios.com (PMDF V5.0-6 #18985)
 id <01ISC5UOBPZ48WYY7X@gemini.pios.com> for Firewalls@GreatCircle.COM; Tue,
 13 Jan 1998 18:14:11 -0500 (EST)
Received: by pio_mail2.cle2.pios.com with SMTP
 (Microsoft Exchange Server Internet Mail Connector Version 4.0.995.52)
 id <01BD204F.1414BAD0@pio_mail2.cle2.pios.com>; Tue, 13 Jan 1998 18:14:24 -0500
Date: Tue, 13 Jan 1998 18:14:23 -0500
From: "Stout, William" <StoutW@pios.com>
Subject: RE: RE: Stateful Inspection Anyone? Session limits on state
 -trackingsystems?
To: "'Ryan Russell'" <ryanr@sybase.com>
Cc: "'Firewalls-GC'" <Firewalls@GreatCircle.COM>
Message-Id: 
 <c=US%a=_%p=PIOS%l=PIO_MAIL2-980113231423Z-3555@pio_mail2.cle2.pios.com>
Mime-Version: 1.0
X-Mailer: Microsoft Exchange Server Internet Mail Connector Version 4.0.995.52
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> ----- Original Message -----
> From:	Ryan Russell [SMTP:ryanr@sybase.com]
> Sent:	Friday, January 09, 1998, 13:48:46
> To:	Stout, William
> Cc:	Firewalls@GreatCircle.COM
> Subject:	RE: RE: Stateful Inspection Anyone? Session limits on state 
> -trackingsystems?
> 
> 
> If I'm following your statement correctly, I can confirm
> the DoS possibility, at least on Firewall-1.  Back with 2.0,
> I was getting frequent crashes where the firewall was complaining
> of being unable to allocate "cookies" and other things (I don't
> know exactly what Checkpoint means by cookie in this
> contetext, but evidently, I'd run out.)
<snip>
> Recently, I'd wiped my firewall clean, and reloaded the OS.  I'd
> forgotten to put the fwhmem line back in (it goes in /etc/system on
> my SOlaris machine.)  I was running FW1 3.0 at this point, and it
> It was fine, until I ran the ISS security scanner from the inside, to the
> outside
> of my FW1.  That caused the symptoms I'd seen with 2.0.  So, I conclude
> that enough new connections can still fill up the state table.  I've put
<snip>
> I see the problem of filling SPF state tables up vs. whatever problems
> AGs exhibit under extream load as being different, but not neccessarily
> worse.

My thought is that the number of sessions tracked depends on how large
each session entry is, and the table size.  Your analogy to the 'SYN
attack' is accurate, where a full session table maxes the CPU, and
crashes the firewall (hard corrupting some files).  The difference is
that with a SYN attack you attack the target directly, but with a
session overload you target servers behind the firewall by establishing
more sessions than the firewall can keep track of.  

I think this is a fundamental state-table vulnerability, and the only
fix is to reject attempted sessions beyond what the table can handle.
This turns the D.O.S. from firewall to servers behind it since a hacker
can hog all available connections.  (Whoops, speaking out of turn since
I don't know max sessions available for server farm vs. filter
state-table).

The fwhmem param raises the level to where the session overload crash
occurs (treats the symptom), but does not cure the problem.  I'm
thinking routers with embedded state-tracking software are even more
vulnerable, since they have less RAM than workstations (software-based
state filter).

Bill Stout

From firewalls-owner  Tue Jan 13 17:17:07 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id KAA08683; Tue, 13 Jan 1998 10:31:25 -0800 (PST)
Received: from lama.supermedia.pl (lama.supermedia.pl [195.116.168.67]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id KAA08666 for <Firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 10:31:17 -0800 (PST)
Received: from localhost (andy@localhost)
	by lama.supermedia.pl (8.8.7/8.8.5) with SMTP id TAA03160
	for <Firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 19:24:42 +0100
Date: Tue, 13 Jan 1998 19:24:42 +0100 (MET)
From: Andrzej Blaszczyk <andy@lama.supermedia.pl>
Reply-To: Andrzej Blaszczyk <andy@lama.supermedia.pl>
To: Firewalls@GreatCircle.COM
Subject: Information about BIFfire firewall
Message-ID: <Pine.LNX.3.96.980113191959.32237B-100000@lama.supermedia.pl>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello everybody!

I have already check Biodata web site for details about BIGfire
firewall and now want to ask you guys about usability, performance and
known bugs of this product.

I will apreciate any comments.

Regards,
<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>
<>    Andrzej Blaszczyk <> ab@supermedia.pl     <>
<> System Administrator <> http://supermedia.pl <>
<>       SuperMedia CUI <> Office: +48228296573 <>
<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>





From firewalls-owner  Tue Jan 13 17:32:03 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id QAA25983; Tue, 13 Jan 1998 16:38:03 -0800 (PST)
Received: from enteract.com (enteract.com [206.54.252.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id QAA25956 for <firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 16:37:53 -0800 (PST)
Received: from jimst.alephconsult.com (jimst.sa.enteract.com [207.229.133.64]) by enteract.com (8.8.8/8.7.6) with SMTP id SAA19551; Tue, 13 Jan 1998 18:39:22 -0600 (CST)
Received: by localhost with Microsoft MAPI; Tue, 13 Jan 1998 18:39:11 -0600
Message-ID: <01BD2052.8A1FF840.jimst@enteract.com>
From: James Strompolis <jimst@enteract.com>
Reply-To: "jimst@enteract.com" <jimst@enteract.com>
To: "'Juergen.Nieveler@gecits-eu.com'" <Juergen.Nieveler@gecits-eu.com>,
        "firewalls@GreatCircle.COM" <firewalls@GreatCircle.COM>,
        "firewalls-uk@gbnet.net" <firewalls-uk@gbnet.net>
Subject: RE: Is Compuserve dangerous?
Date: Tue, 13 Jan 1998 15:43:31 -0600
Organization: Aleph Consultants, Inc.
X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

If he doesn't want _any_ connections between his network and other 
networks, what does he define a network as?  CompuServe _IS_ another 
network.  Any time you connect to another network (public or private, 
CompuServe is semi-private with interconnections to the Internet) that you 
have no control over, you are at risk.

CompuServe can be connected to via TCP/IP into one of their dialups.  Don't 
know the port #.

- James Strompolis
  Aleph Consultants, Inc.
  jimst@enteract.com

On Tuesday, January 13, 1998 6:52 AM, Juergen.Nieveler@gecits-eu.com 
[SMTP:Juergen.Nieveler@gecits-eu.com] wrote:
>
>
>
>
> Dear Firewallers,
>
> I?m sorry if this should be Off-Topic, but I?ve got a problem concerning
> CompuServe.
>
> I have to set up a server under Windows NT that has to download Data via
> Modem from Compuserve.
>
> This Server has to forward the Data to other Servers in my Customers?
> Network.
>
> Because of Security my customer does not want  _any_ connections between
> his network and other networks, for
> example the Internet. So far, it is planned to install firewalls to the 
net
> and to place all servers with contact to the rest of the world into a 
DMZ,
> for example SMTP-Servers etc.
>
> My Questions are:
>
> Has anybody got experience with Compuserve?s Network (Which Protocols /
> Ports to use etc) ?
> Is Compuserve as/more dangerous compared to the Internet ?
> Has anybody been attacked through Compuserve ?
>
> Mit freundlichen Gruessen - Yours sincerely
>
> Juergen Nieveler
> CompuNet Koeln
> System Engineering
> Industriestrasse 161e, 50999 Koeln, Germany
> Phone: ++49(0)2236/608161, Fax: ++49(0)2236/9651220,
> Internet: Juergen.Nieveler@gecits-eu.com
>
> Disclaimer: Above statements are my own, not my employers? !
>
> 


From firewalls-owner  Tue Jan 13 17:47:05 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id RAA05417; Tue, 13 Jan 1998 17:31:36 -0800 (PST)
Received: from ns.acadiacom.net (ns.acadiacom.net [206.104.52.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id RAA05399 for <firewalls@greatcircle.com>; Tue, 13 Jan 1998 17:31:29 -0800 (PST)
Received: from unitedcouncil.org (unverified [206.104.52.12]) by ns.acadiacom.net
 (Rockliffe SMTPRA 2.1.4) with ESMTP id <B0000749621@ns.acadiacom.net> for <firewalls@GreatCircle.COM>;
 Tue, 13 Jan 1998 19:35:54 -0600
Message-ID: <3486A2A4.2E8DCBC3@unitedcouncil.org>
Date: Thu, 04 Dec 1997 07:31:33 -0500
From: Sandman <security@unitedcouncil.org>
Reply-To: security@unitedcouncil.org
X-Mailer: Mozilla 4.04 [en] (Win95; I)
MIME-Version: 1.0
To: firewalls@GreatCircle.COM
Subject: (no subject)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

usubscribe firewalls


From firewalls-owner  Tue Jan 13 17:48:31 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id RAA05329; Tue, 13 Jan 1998 17:30:58 -0800 (PST)
Received: from mh2.cts.com (mh2.cts.com [205.163.24.68]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id RAA05261 for <firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 17:30:38 -0800 (PST)
Received: from king.cts.com (root@king.cts.com [198.68.168.21]) by mh2.cts.com (8.8.7/8.8.5) with ESMTP id RAA14988; Tue, 13 Jan 1998 17:32:17 -0800 (PST)
Received: from crash.cts.com (root@crash.cts.com [192.188.72.17])
	by king.cts.com (8.8.7/8.8.7) with SMTP id RAA12793;
	Tue, 13 Jan 1998 17:32:16 -0800 (PST)
Received: from jcski by crash.cts.com with smtp
	(Smail3.1.29.1 #5) id m0xsHgj-000025C; Tue, 13 Jan 98 17:32 PST
Message-ID: <00a401bd208c$597bfc90$fb48bcc0@jcski>
From: "Jim Raykowski" <jimrski@cts.com>
To: <daemond@ibm.net>
Cc: <firewalls@GreatCircle.COM>
Subject: Re: Exposing fraudulent SA's
Date: Tue, 13 Jan 1998 17:32:58 -0800
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 4.72.2106.4
X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Geoff,
  If you have run SATAN on the system(s) and have the reports it gives you
that shows the systems are open, print it out take it to them and if that
doesn't help motiviate them  take it to their supervisors.
  Also go to www.rootshel.com and get a few of the exploits off there and
run them specifically the Novell password cracker and the NT IIS holes and
run it in front of their supv's.
  I do this on the side as a contractor and if I can not get the SA's to
move, I show it to the owners/pres. of the companies and it seems to
motivate the SA.  The key is to show the SA's first and if now response the
go up the ladder however, have all you ducks in a row.  Get all the
advisories that announce the bugs/holes and be ready to prove your
acqusations.  Show them what you did to find the holes.  Again document,
document and document again.
Hope this helps
Jim Raykowski
jimrski@cts.com

Trying to Learn, Administer, Manage and Secure NT.  What
an impossible job!!!!!!!!!!!!!!!!!!!!!!!!!!!
-----Original Message-----
From: daemond@ibm.net <daemond@ibm.net>
To: firewalls@GreatCircle.COM <firewalls@GreatCircle.COM>
Date: Monday, January 12, 1998 10:22 PM
Subject: Exposing fraudulent SA's


>Hello All!
>
> I have a dilema that I can't seem to find a clear cut solution for
>and was wondering if anyone ran into this before and what can be done about
>it.  I am a college freshman and while I done have any certifications I am
>not stupid about internet security (some of the books that I've read:
>"Building Internet Firewalls" Chapman and Zwicky [O'Reilly];  "TCP/IP
Network
>Administration" Hunt [O'Reilly]; "Practical UNIX & Internet Security"
>Simson, Garfinkel and Spafford [O'Reilly]; and "UNIX Systems Administration
>Handbook (2nd ed.)" Nemeth, Snyder, Seebass, and Hein [Prentice Hall]; and
>thousands of messages from this and other lists).
>I've used SVR4, SCO Openserver, Linux, and NetBSD.  However, at my college,
>we have two CNE certifed SAs that claim we have a secure setup
>(hahahahaha!!).  Here's what we have: a Cisco router (with no filtering
>rules setup that I can find), NT Server for our web & DNS server, and
>NetWare 4.x for the students to log in a attach to their home directories,
>etc.  From what I can tell our systems are wide open and just waiting to be
>sacked left, right, and center.  I see no signs of any tight security
>whatsoever.  I've used SATAN and strobe to do my checking to verify this
>(all systems are pretty much up for grabs). Aside from that our network is
>S L O W (and probably misconfigured) and it collapses now and then.  I once
got
>together with the two SA's and tried to point out the flaws and propose
>alternatives, but no dice (they've got their club and I'm not invited).  So
>here's the question: how do you expose frauds like these so they at least
>secure it (or are given the boot)?  I'm not sure I want to be near the
>systems around here when our network goes up in smoke.  Who knows what else
>can be obtained?  I know the Registar has their systems on a network here
>(I'm not sure if it's connected to the one in use by us, but possible).
>There's no telling what damage could be done to here.  I'm a concerned
>college student with no options begging for ideas that you may have.  I'll
>be thankful for any ideas.  Please help.
>
>---------------------------------------------------------------------------
--
>Geoff Gowey | NetBSD: the best multi-platform OS
>daemond(at)ibm.net | www.netbsd.org
>***************************************************************************
**
>Spammers beware: I do not buy from companies that spam and I keep track!
>Above policy STRICTLY ENFORCED!
>***************************************************************************
**
>"All I ask is for the chance to prove that money can't buy me happiness"
>or more simply put "SHOW ME THE MONEY!!!"
>
>


From firewalls-owner  Tue Jan 13 18:33:11 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id SAA10527; Tue, 13 Jan 1998 18:28:32 -0800 (PST)
Received: from quechua.inka.de (quechua.inka.de [193.197.84.5]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id SAA10490 for <Firewalls@greatcircle.com>; Tue, 13 Jan 1998 18:28:16 -0800 (PST)
Received: from ms1.ka.inka.de (uu.inka.de) [193.197.84.8] 
	by quechua.inka.de with smtp 
	id 0xsIaR-0008AI-00; Wed, 14 Jan 1998 03:29:47 +0100
Received: from lina.inka.de (lists@lina.inka.de) by uu.inka.de
	 with bsmtp (S3.1.29.1) id <m0xsIaS-000DkAC>; Wed, 14 Jan 98 03:29 MET
Received: by lina.inka.de
	id m0xsIQa-00014GC
	(Debian Smail-3.2.0.92 1997-Feb-9 #2); Wed, 14 Jan 1998 03:19:36 +0100 (CET)
Message-ID: <19980114031931.41027@lina>
Date: Wed, 14 Jan 1998 03:19:31 +0100
From: Bernd Eckenfels <lists@lina.inka.de>
To: Tom Peroulas <peroulas@helios.insnet.com>
Cc: Firewalls@GreatCircle.com
Subject: Re: minimizing WAN traffic
References: <Pine.LNX.3.95.980113171810.17732D-100000@helios.insnet.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Mailer: Mutt 0.88
In-Reply-To: <Pine.LNX.3.95.980113171810.17732D-100000@helios.insnet.com>; from Tom Peroulas on Tue, Jan 13, 1998 at 05:20:29PM -0600
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello,

> I am going to be setting up a distributed proxy environment across a WAN.
> I want to be able to administer all my proxies remotely.

Squid on Unix Workstations is powerfull, remote administartion is easy, and
the distribution is very powerfull.

> 1.  I want to minimize WAN traffic.  Let's say a request is made in Myrtle
> Beach, but the only proxy server that has it on its cache is Seattle.  To
> minimize WAN traffic, I would rather have that document get retrieved in
> Dallas via the Internet.  Can I set up a hierarchy that allows this.  I
> understand how the parent-child relationships would be set up, I just want
> to know if it's possible.

Its possible to specifie parents, neighbours and stuff depending on the
location. Squid can use UDP to query neighbours (small pages will be sent as
the answer), it can 'ping' the proxies and the source for getting the
fastest answer.

> 2.  Can I administer all proxy servers from Dallas?
Sure, use telnet :)

> 3.  Where does the single virtual cache reside?  Does the single virtual
> cache/proxy array of Microsoft generate more or less WAN traffic to
> maintain the cache information across distributed proxies than does
> Netscapes ICP?

I think MS Protcoll is very compareable to the Squid ICP Protocoll. Squid is
a very powerfull Cache System, which is widely used in real big
installations all over the internet, and its rather cheap :) There is a
Project called DFN-Cache, a lot of german Educational Sites are links to a
cache-backbone by using distributed parent and neighbour queries.

Squid is derived from the Harvest Project.

http://squid.nlanr.net/
http://www.iaehv.nl/users/devet/squid/

Greetings
Bernd
-- 
  (OO)      -- Bernd_Eckenfels@Wendelinusstrasse39.76646Bruchsal.de --
 ( .. )  ecki@{inka.de,linux.de,debian.org} http://home.pages.de/~eckes/
  o--o     *plush*  2048/93600EFD  eckes@irc  +497257930613  BE5-RIPE
(O____O)       If privacy is outlawed only Outlaws have privacy

From firewalls-owner  Tue Jan 13 19:18:40 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id TAA13708; Tue, 13 Jan 1998 19:00:42 -0800 (PST)
Received: from mtigwc04.worldnet.att.net (mtigwc04.worldnet.att.net [204.127.131.33]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id TAA13597 for <firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 19:00:14 -0800 (PST)
From: mht@clark.net
Received: from highlander ([12.68.178.214]) by mtigwc04.worldnet.att.net
          (post.office MTA v2.0 0613 ) with SMTP id AAB25430;
          Wed, 14 Jan 1998 01:27:40 +0000
Message-Id: <3.0.3.32.19980113200224.00a7dd80@pop3.clark.net>
X-Sender: mht@pop3.clark.net
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Tue, 13 Jan 1998 20:02:24 -0500
To: Rob Poland <rob.poland@inet.unisource.nl>, firewalls@GreatCircle.COM
Subject: Re: Managed firewall service concept -reply
In-Reply-To: <ML-3.3.884705109.5627.robp@inet.unisource.nl>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Have you checked out the managed internet firewall solutions offered by
GTE/BBN???  

/mht

At 04:25 PM 1/13/98 +0100, Rob Poland wrote:
>As an ISP we are investigating to provide a managed firewall solution.
Anyone
>has any ideas on the different scenario's:
>-placing the FW at customer premises or at your own premises (POP);
>-combining virtual firewalls implementations on one physical firewall;
>-combining with several other ISP services;
>
>I have noticed that Pilot @
http://www.pilot.net/services/serv-firewall.html is
>offering managed firewall service which reside at the Pilot's Network Service
>Centers. Most other ISP's offering managed firewall services only at customer
>side.
>
>Does anyone have expirience with this kind of service? 
>
>Rob Poland
>
>

From firewalls-owner  Tue Jan 13 20:18:52 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id UAA20113; Tue, 13 Jan 1998 20:01:01 -0800 (PST)
Received: from mcfeely.bsfs.org (mcfeely.bsfs.org [204.91.13.34]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id UAA20060 for <firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 20:00:44 -0800 (PST)
Received: (from wombat@localhost) by mcfeely.bsfs.org (8.6.12/8.6.12) id IAA08846; Tue, 13 Jan 1998 08:53:46 -0500
Date: Tue, 13 Jan 1998 08:53:43 -0500 (EST)
From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: Dave Spizzirro <dspizzirro@tiaa-cref.org>
cc: firewalls@GreatCircle.COM
Subject: Re: DMZ Infrastructure Statistics
In-Reply-To: <9801138847.AA884704832@balsa.tiaa-cref.org>
Message-ID: <Pine.BSF.3.91.980113084112.8809B-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Why?

The performance advantage of token ring was largely "academic" in nature. 
"On paper", ethernet, which is contention-based, experiences an 
exponential degradation in terms of performance as users are added, 
whereas token ring degrades linearly. In reality, however, ethernet is 
simply segmented as users are added. Ethernet is inexpensive, and 
segmentation is easily achieved and managed.

In general, Ethernet is much less expensive to implement than token ring,
and much easier to maintain and troubleshoot. 

The introduction of fast ethernet / full duplex fast ethernet fairly well 
killed off any performance argument. Token ring is basically a legacy 
protocol at this point.

Most security issues involve higher layers; there aren't really any 
advantages or disadvantages to either ethernet or token ring from an 
architecture standpoint - an intruder can spoof a layer two address in 
either topology.

Both intruder and administrator have a wider variety of toolz available 
in the ethernet world; I'd consider this a reason for the administrator 
to select ethernet (security by obscurity as a bad idea, and the intruder 
is more likely to obtain an obscure tool than the administrator is to 
implement an obscure defense).

I wouldn't put in token ring at this stage; if you need to support SNA, 
use a gateway.

-r.w.

On Tue, 13 Jan 1998, Dave Spizzirro wrote:

> 
>      Does anyone have any good links to (or hardcopy) statistics of 
>      Ethernet vs. Token Ring.  Stats with security ratings, performance, or 
>      available tools would be greatly appreciated.  I can't believe that 
>      this type of information is not out there somewhere.
>      
>      - Dave Spizzirro
> 
> 
> 

From firewalls-owner  Tue Jan 13 20:20:29 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id TAA18650; Tue, 13 Jan 1998 19:45:35 -0800 (PST)
Received: from mcfeely.bsfs.org (mcfeely.bsfs.org [204.91.13.34]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id TAA18621 for <firewalls@GreatCircle.COM>; Tue, 13 Jan 1998 19:45:26 -0800 (PST)
Received: (from wombat@localhost) by mcfeely.bsfs.org (8.6.12/8.6.12) id IAA08829; Tue, 13 Jan 1998 08:38:25 -0500
Date: Tue, 13 Jan 1998 08:38:22 -0500 (EST)
From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: Juergen.Nieveler@gecits-eu.com
cc: firewalls@GreatCircle.COM, firewalls-uk@gbnet.net
Subject: Re: Is Compuserve dangerous?
In-Reply-To: <4125658B.00458C08.00@mail.gecits-eu.com>
Message-ID: <Pine.BSF.3.91.980113083412.8809A-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Content-Transfer-Encoding: QUOTED-PRINTABLE
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



If all you need to do is pass downloaded files in one direction, you may=20
also want to add the following (in addition to firewalling):

Set up an ftp server. An old PC running BSD or Linux will do. Use TCP=20
Wrappers to deny all access to the system from the outside, except for=20
the ftp from untrusted "sending" system and the trusted "receiving" system.

Allow the "sending" system to use ftp to write files into a write-only=20
directory. Use a cron job to periodically move files from there to an=20
area that is accessed "read only" by the internal "receiving" system.

-r.w.



On Tue, 13 Jan 1998 Juergen.Nieveler@gecits-eu.com wrote:

>=20
>=20
>=20
>=20
> Dear Firewallers,
>=20
> I=B4m sorry if this should be Off-Topic, but I=B4ve got a problem concern=
ing
> CompuServe.
>=20
> I have to set up a server under Windows NT that has to download Data via
> Modem from Compuserve.
>=20
> This Server has to forward the Data to other Servers in my Customers=B4
> Network.
>=20
> Because of Security my customer does not want  _any_ connections between
> his network and other networks, for
> example the Internet. So far, it is planned to install firewalls to the n=
et
> and to place all servers with contact to the rest of the world into a DMZ=
,
> for example SMTP-Servers etc.
>=20
> My Questions are:
>=20
> Has anybody got experience with Compuserve=B4s Network (Which Protocols /
> Ports to use etc) ?
> Is Compuserve as/more dangerous compared to the Internet ?
> Has anybody been attacked through Compuserve ?
>=20
> Mit freundlichen Gruessen - Yours sincerely
>=20
> Juergen Nieveler
> CompuNet Koeln
> System Engineering
> Industriestrasse 161e, 50999 Koeln, Germany
> Phone: ++49(0)2236/608161, Fax: ++49(0)2236/9651220,
> Internet: Juergen.Nieveler@gecits-eu.com
>=20
> Disclaimer: Above statements are my own, not my employers=B4 !
>=20
>=20
>=20

From firewalls-owner  Wed Jan 14 00:32:42 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id AAA06706; Wed, 14 Jan 1998 00:15:37 -0800 (PST)
Received: from notes.systekit.com ([202.82.25.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id XAA01043 for <firewalls@greatcircle.com>; Tue, 13 Jan 1998 23:50:02 -0800 (PST)
Received: by notes.systekit.com(Lotus SMTP MTA SMTP MTA v1.1.04  (495.1 10-24-1997))  id 4825658C.002A29EC ; Wed, 14 Jan 1998 15:40:32 +0800
X-Lotus-FromDomain: SYSTEK
From: "Alex Chan"<alexc@systekit.com>
To: firewalls@greatcircle.com
Message-ID: <4825658C.002A167F.00@notes.systekit.com>
Date: Wed, 14 Jan 1998 15:40:26 +0800
Subject: request information
Mime-Version: 1.0
Content-type: text/plain; charset=iso-8859-1
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

reply to alexc@systekit.com



From firewalls-owner  Wed Jan 14 01:23:15 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id AAA07195; Wed, 14 Jan 1998 00:18:17 -0800 (PST)
Received: from smtp2.mailsrvcs.net (smtp2.gte.net [207.115.153.31]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id AAA05532 for <firewalls@greatcircle.com>; Wed, 14 Jan 1998 00:09:51 -0800 (PST)
From: pkyuswr4@gte.net
Received: from smtp.gte.net (1Cust130.tnt14.det3.da.uu.net [208.254.75.130])
	by smtp2.mailsrvcs.net  with SMTP id BAA27771;
	Wed, 14 Jan 1998 01:53:43 -0600 (CST)
Message-Id: <199801140753.BAA27771@smtp2.mailsrvcs.net>
To: ysromaps@lbtl.ca
Date: Tue, 13 Jan 98 23:03:00 EST
Subject: FYI  New Credit File Infomation
Reply-To: data0064@hotmail.com
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Do you like "hard to find" information? If you do, then click on
this link ** http://alpha.com.mx **

A little bit about Alphadata:

As owners of Alphadata, we can tell you firsthand that we have taken years
to create this valuable and informative publication entitled "New Credit File".

This publication had its beginning with our personal struggle against
unfair acts of Credit Reporting Bureaus, then grew further with intensive
research regarding our legal rights to a new credit file.

We have had great success with this program, and would like to share
it with others who have struggled with credit problems as we have. 

We've already helped hundreds of people help themselves with our
program. It's written with easy to follow, step by step language that guides
you through the process of building a brand new credit file for yourself.

Please visit our website if you think you could benefit from our program!

Regards,

Jim & Michele Meyer


 *><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*
    To be removed from future mailings, please e-mail us at:
     wild@alpha.com.mx  with REMOVE typed in the subject header.
 *><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*><*

Alpha Data
11014 19th Ave S.E.
Suite 105
Everett, WA 98208
425-771-0537
wild@alpha.com.mx



From firewalls-owner  Wed Jan 14 02:04:33 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id XAA27463; Tue, 13 Jan 1998 23:33:18 -0800 (PST)
Received: from marvin.ose.eur.deuba.com (gate0.de.deuba.com [193.150.166.50]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id XAA27215 for <firewalls@greatcircle.com>; Tue, 13 Jan 1998 23:32:12 -0800 (PST)
Received: from julia.ksfw.eur.deuba.com by marvin.ose.eur.deuba.com 
          id IAA53972; Wed, 14 Jan 1998 08:33:51 +0100
Received: (from marc@localhost)
	by julia.ksfw.eur.deuba.com (8.8.8/8.8.5) id IAA08018;
	Wed, 14 Jan 1998 08:31:14 +0100
From: Marc Heuse <Marc.Heuse@mail.DeuBa.COM>
Message-Id: <199801140731.IAA08018@julia.ksfw.eur.deuba.com>
Subject: Re: Secure Web Transaction Solution
In-Reply-To: <199801131556.JAA21920@mail.argus-systems.com> from Paul McNabb at "Jan 13, 98 09:56:52 am"
To: mcnabb@argus-systems.com (Paul McNabb)
Date: Wed, 14 Jan 1998 08:31:14 +0100 (CET)
Cc: firewalls@greatcircle.com
X-Mailer: ELM [version 2.4ME+ PL37 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


> >  From: Larry.Riley@disclosure.com (Larry Riley)
> >  
> >       Does anybody have any experience with Cisco and Hewlett-Packard Secure 
> >       Web Transaction Solution Architecture?
> >       
> >       Can this solution be compared to any other firewall solution such as 
> >       Firewall-1, regarding its price, efficiency and security? Does this 
> >       solution have any bugs?
> 
> If you ignore the load balancing issues you are getting with this, the
> security and functionality of HP/CISCO are significantly less than what
> you get with a Sun/Argus/Checkpoint combination.  The HP solution is a
> lot more expensive as well.
> ---------------------------------------------------------
> Paul McNabb                     Argus Systems Group, Inc.

				  ^^^^^^^^^^^^^^^^^^^^^^^^^^

I would trust any vendor claiming that his product is superior ... NOT ...
I hate advertisement with no value for discussions on the mailinglists.

Well the secure solution from HP is a secure web-server right? - with a nice
secure design (Virtual Vault, somthing which was implemented in the mainframe
world a long time ago.)

Firewall-1 is a firewall, Argus a security plug-in for it to reach B level
security.
thats something completly different.

If you need a very secure web server, and you've got enough money, HP's
product is good. If you want a nice firewall, take a stateful-inspection
firewall (like fw-1) or application gateway (like gauntlet, altavista '97
etc.) - whatever is needed - or build you own cheap solution with OpenBSD or
Linux ...



Mit freundlichen Gruessen,
				Marc Heuse


This message and any statements expressed therein are those of myself
and not of the Deutsche Bank AG or its subsidiary companies.



Type Bits/KeyID    Date       User ID
pub  2048/DB5C03C5 1997/09/23 Marc Heuse <marc.heuse@mail.deuba.com>

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.3i

mQENAzQnbFEAAAEIAL/tj4hn/DVjEWAZhuqRdxZQDy5B+gZbE0CD/mUnZqpem+9L
KY+I8te7jMfTQExzqn5jYb5BaibT0SbEBWSx9Gha8EiBLAVcAjvrXpV+HJLcnPRG
YDk5a3s7GrA+QVHbbd9DWgqjMfUMw9oUDAhhjgK20SeOtFGBD2U17GkQF6TK7EjC
CTOuz2Hx/tisDuroJJnxZdbLNvCceOf/D/bbFcR7DfnEJWJ3f9JC4fibZMlX5rXL
Ct/TKhZMd4d42uL7L4KvkT5JCnFuEw1jRDPpBjZ030cK2uWCM//iEVLGmGKOs6Pg
o3Lfnnd6I6bTPHgrNsapNWmocbIGDC/4w9tcA8UABRG0Jk1hcmMgSGV1c2UgPG1h
cmMuaGV1c2VAbWFpbC5kZXViYS5jb20+iQEVAwUQNCdsUQwv+MPbXAPFAQFWEwf5
AWt6PbKLLCCBPnzBMdXatKEJvNzrZRXNSpbgKQUDAKApRUnOkDJ9yp3tfJG0/BsL
XBf+ldmjjoo/OZeWhIhNb71bbCs8BK7/YK5LKef2eq4pzSiWYosrOfjlfyOVhAiP
AiWYtK/HBELy6Zs8QwoPX0QX0+R2+ocMS0TDz7nwBgO5wcj3yMU0geTrnlDpJdj1
RgFQLE6T9qO5coRjj1EAoT5gQMxP9L4TQuifYiQ6S2vh6blr3amjPohKSDzZ62/x
rQ1KMXJd7MlMQndn8UwKt4XgoFIsZOFRrkDiXfm6zFnH40UcotoA+Ygojp52+Y6A
MuixTDbuf3Jph2jEG6r4Dw==
=/n63
-----END PGP PUBLIC KEY BLOCK-----


From firewalls-owner  Wed Jan 14 04:59:04 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id DAA06464; Wed, 14 Jan 1998 03:15:28 -0800 (PST)
Received: from mail.bnetd.sita.net (mail.bnetd.sita.net [57.197.192.5]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id DAA06429 for <firewalls@greatcircle.com>; Wed, 14 Jan 1998 03:15:07 -0800 (PST)
Received: from bnetd.sita.net ([57.197.192.163]) by mail.bnetd.sita.net
          (Netscape Mail Server v2.02) with ESMTP id AAA135
          for <firewalls@greatcircle.com>; Wed, 14 Jan 1998 11:23:09 +0000
Message-ID: <34BC9D5F.EC999D53@bnetd.sita.net>
Date: Wed, 14 Jan 1998 11:11:28 +0000
From: ramamonjisoa@bnetd.sita.net (Ramamonjisoa Charles Emile)
Reply-To: ramamonjisoa@bnetd.sita.net
Organization: BNETD
X-Mailer: Mozilla 4.02 [en] (Win95; I)
MIME-Version: 1.0
To: firewalls@greatcircle.com
Subject: IP addresses
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello,
        We have to realize an important project to become the
provider of internet services for the government of Cote d'Ivoire.

        We run in an unusual configuration because we connect our
node to the Internet with TWO ISPs ( yes 2 ISPs). So, I want to
get your feedback comments on the following configuration and
mostly HOW to manage the IP addresses ISP1 and ISP2 will give us.

Configuration


                                ------------------------
                                !           Router             !
--------------------> ISP1
                                !
! --------------------> ISP2
                                ------------------------
                                    !            !            !
                                    !            !
!--------------------> RAS
    Public Servers<-----!            !
                                            Firewall
                                                 !
                                            Intranet

        TIA
        R. Charles Emile


From firewalls-owner  Wed Jan 14 05:32:56 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id EAA12940; Wed, 14 Jan 1998 04:16:06 -0800 (PST)
Received: from dadc001.hq.af.mil (dadc001.hq.af.mil [134.205.95.21]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id EAA12924 for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 04:15:53 -0800 (PST)
Received: by dadc001.hq.af.mil with SMTP (Microsoft Exchange Server Internet Mail Connector Version 4.0.995.52)
	id <01BD20BC.334767A0@dadc001.hq.af.mil>; Wed, 14 Jan 1998 07:15:32 -0500
Message-ID: <c=US%a=attmail%p=gov+dms+trans%l=DMS/DAPENTAGON/0029CD0A@dadc001.hq.af.mil>
From: "Houston, Lewis, Mr, OPNBM/SETA" <HOUSTONL@army.pentagon.mil>
To: "'Firewalls'" <firewalls@GreatCircle.COM>
Subject: FW: Question:
Date: Wed, 14 Jan 1998 07:11:00 -0500
X-Mailer:  Microsoft Exchange Server Internet Mail Connector Version 4.0.995.52
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

       I found this on the SkyWarn list and thought it of interest to
all.  Does anyone
know if this FCC activity is for real?
>
>
>     Subject: Internet, FCC
>
>     I am writing you this to inform you of a very important matter
>     currently under review by the FCC. Your local telephone company has
>     filed a proposal with the FCC to impose per minute charges for your
>     internet service. They contend that your usage has or will hinder
>     the operation of the telephone network.
>
>     It is my belief that internet usage will diminish if users were
>     required to pay additional per minute charges. The FCC has created
>     an email box for your comments, responses must be received by
>     February 13, 1998.
>
>     Send your comments to  *   isp@fcc.gov  *   and tell them what you
       think.
>     Every phone company is in on this one, and they are trying to
>     sneak it in just under the wire for litigation. Let everyone you
>     know hear this one. Get the e-mail address to everyone you can think
>     of.

From firewalls-owner  Wed Jan 14 05:47:24 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id EAA17001; Wed, 14 Jan 1998 04:33:14 -0800 (PST)
Received: from hotmail.com (F100.hotmail.com [207.82.250.219]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id EAA16823 for <firewalls@greatcircle.com>; Wed, 14 Jan 1998 04:32:34 -0800 (PST)
Received: (qmail 5330 invoked by uid 0); 14 Jan 1998 12:34:10 -0000
Message-ID: <19980114123410.5329.qmail@hotmail.com>
Received: from 202.54.25.121 by www.hotmail.com with HTTP;
	Wed, 14 Jan 1998 04:34:08 PST
X-Originating-IP: [202.54.25.121]
From: "A.S. Sibia" <a_s_sibia@hotmail.com>
To: firewalls@greatcircle.com
Subject: Re: teardrop here, teardrop there, teardrop testing everywhere 
    ...
Content-Type: text/plain
Date: Wed, 14 Jan 1998 18:04:08 IST
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Will you please let me know what it was that you were testing on the NT 
server with new teardrop.

Thanks 

A. S. Sibia

>From firewalls-owner@greatcircle.com Tue Jan 13 15:45:51 1998
>Received: from honor.greatcircle.com by relay7.UU.NET with ESMTP
>	(peer crosschecked as: honor.greatcircle.com [198.102.244.44])
>	id QQdyfe26064; Tue, 13 Jan 1998 18:44:54 -0500 (EST)
>Received: (majordom@localhost) by honor.greatcircle.com 
(8.8.5/Honor-Lists-970926-1) id MAA01089; Tue, 13 Jan 1998 12:17:48 
-0800 (PST)
>Received: from venus.caso.net (venus.caso.net [195.52.49.66]) by 
honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id LAA19257 for 
<firewalls@greatcircle.com>; Tue, 13 Jan 1998 11:23:35 -0800 (PST)
>Received: from mars ([195.52.49.69]) by venus.caso.net
>          (Netscape Mail Server v2.02) with SMTP id AAA246
>          for <firewalls@greatcircle.com>; Tue, 13 Jan 1998 20:21:03 
+0100
>From: agabert@caso.de (Alexander Gabert)
>To: <firewalls@greatcircle.com>
>Subject: teardrop here, teardrop there, teardrop testing everywhere ...
>Date: Tue, 13 Jan 1987 20:24:16 +0100
>Message-ID: <01b0cafd$26b053b0$453134c3@mars.caso.net>
>MIME-Version: 1.0
>Content-Type: text/plain;
>	charset="iso-8859-1"
>Content-Transfer-Encoding: 7bit
>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Mailer: Microsoft Outlook Express 4.71.1712.3
>X-MimeOLE: Produced By Microsoft MimeOLE V4.71.1712.3
>Sender: firewalls-owner@GreatCircle.COM
>Precedence: bulk
>
>ok, so, i tried the new teardrop and i think it is a great tool to make
>peace with my friends at work (e.g. in the LAN) but if you try it over 
a
>router (WAN link) the other NT Server is responding and responding and
>responding... whatever i try.
>(of course the second server on the other router also belongs to my 
company
>, ;) )
>
>so, is it possible to make that work over the WAN ?
>
>sincerely, alex.
>
>
>
>... ok, so, i think we blew it ...
>Alexander Gabert,
>agabert@caso.de
>
>


______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com

From firewalls-owner  Wed Jan 14 06:20:53 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id FAA22094; Wed, 14 Jan 1998 05:21:32 -0800 (PST)
Received: from tcs_gateway2.treas.gov (tcs-gateway2.treas.gov [204.151.246.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id FAA22059 for <firewalls@greatcircle.com>; Wed, 14 Jan 1998 05:21:19 -0800 (PST)
Received: by tcs_gateway2.treas.gov id AA20611
  (InterLock SMTP Gateway 3.0 for firewalls@greatcircle.com);
  Wed, 14 Jan 1998 08:23:03 -0500
Received: by tcs_gateway2.treas.gov (Internal Mail Agent-2);
  Wed, 14 Jan 1998 08:23:03 -0500
Received: by tcs_gateway2.treas.gov (Internal Mail Agent-1);
  Wed, 14 Jan 1998 08:23:03 -0500
Message-Id: <001901bd20f0$4ab83cf0$84abdf98@au01na000792034.aus.swr.irs.gov>
From: "Earl Meck" <earme@ausc-nt1.aus.swr.irs.gov>
To: <firewalls@greatcircle.com>
Date: Wed, 14 Jan 1998 07:28:25 -0600
Mime-Version: 1.0
Content-Type: multipart/mixed;
	boundary="----=_NextPart_000_0015_01BD20BE.000CDD00"
X-Priority: 3
X-Msmail-Priority: Normal
X-Mailer: Microsoft Outlook Express 4.72.2106.4
X-Mimeole: Produced By Microsoft MimeOLE V4.72.2106.4
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

This is a multi-part message in MIME format.

------=_NextPart_000_0015_01BD20BE.000CDD00
Content-Type: multipart/alternative;
	boundary="----=_NextPart_001_0016_01BD20BE.000CDD00"


------=_NextPart_001_0016_01BD20BE.000CDD00
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

unsubscribe firewalls

------=_NextPart_001_0016_01BD20BE.000CDD00
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD W3 HTML//EN">
<HTML>
<HEAD>

<META content=3Dtext/html;charset=3Diso-8859-1 =
http-equiv=3DContent-Type>
<META content=3D'"MSHTML 4.72.2106.6"' name=3DGENERATOR>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT color=3D#000000 size=3D2>unsubscribe =
firewalls</FONT></DIV></BODY></HTML>

------=_NextPart_001_0016_01BD20BE.000CDD00--

------=_NextPart_000_0015_01BD20BE.000CDD00
Content-Type: text/x-vcard;
	name="Earl V. Meck.vcf"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
	filename="Earl V. Meck.vcf"

BEGIN:VCARD
VERSION:2.1
N:Meck;Earl;V.
FN:Earl V. Meck
ORG:IRS;Network Administration
TITLE:WebMaster
TEL;WORK;VOICE:(512)460-4386
TEL;PAGER;VOICE:(512)875-2471
TEL;WORK;FAX:(512)460-4690
ADR;WORK:;Information Systems;3651 S. IH 35;Austin;TX;78741;USA
LABEL;WORK;ENCODING=3DQUOTED-PRINTABLE:Information Systems=3D0D=3D0A3651 =
S. IH 35=3D0D=3D0AAustin, TX 78741=3D0D=3D0AUSA
EMAIL;PREF;INTERNET:earme@mail1.aus.swr.irs.gov
REV:19980114T132815Z
END:VCARD

------=_NextPart_000_0015_01BD20BE.000CDD00--


From firewalls-owner  Wed Jan 14 07:44:31 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA14281; Wed, 14 Jan 1998 07:07:26 -0800 (PST)
Received: from gate3.fmr.com (gate3.fmr.com [192.223.170.13]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id HAA14250 for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 07:07:17 -0800 (PST)
Received: (from adm@localhost) by gate3.fmr.com (8.7.3/8.6.9) id JAA02919 for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 09:42:45 -0500 (EST)
Message-Id: <199801141442.JAA02919@gate3.fmr.com>
Received: from msgmro101nts.fmr.com(172.26.2.64) by gw01i via smap (g3.0.3)
	id xma002911; Wed, 14 Jan 98 09:42:19 -0500
Received: by msgmro101nts.fmr.com with Internet Mail Service (5.0.1459.13)
	id <CSNPFSKM>; Wed, 14 Jan 1998 09:43:29 -0500
From: "Feeney, Tim" <Tim.Feeney@fmr.com>
To: "'Firewalls'" <firewalls@GreatCircle.COM>
Subject: RE: Question:
Date: Wed, 14 Jan 1998 09:42:17 -0500
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1459.13)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

This is not entirely true go to
http://www.fcc.gov/Bureaus/Common_Carrier/Factsheets/ispfact.html to get
the information about this bill.

------------------------------------------------------------------------
-----------------
The opinions expressed in this message do not reflect those of my
employer.

> -----Original Message-----
> From:	Houston, Lewis, Mr, OPNBM/SETA [SMTP:HOUSTONL@army.pentagon.mil]
> Sent:	Wednesday, January 14, 1998 7:11 AM
> To:	'Firewalls'
> Subject:	FW: Question:
> 
>        I found this on the SkyWarn list and thought it of interest to
> all.  Does anyone
> know if this FCC activity is for real?
> >
> >
> >     Subject: Internet, FCC
> >
> >     I am writing you this to inform you of a very important matter
> >     currently under review by the FCC. Your local telephone company
> has
> >     filed a proposal with the FCC to impose per minute charges for
> your
> >     internet service. They contend that your usage has or will
> hinder
> >     the operation of the telephone network.
> >
> >     It is my belief that internet usage will diminish if users were
> >     required to pay additional per minute charges. The FCC has
> created
> >     an email box for your comments, responses must be received by
> >     February 13, 1998.
> >
> >     Send your comments to  *   isp@fcc.gov  *   and tell them what
> you
>        think.
> >     Every phone company is in on this one, and they are trying to
> >     sneak it in just under the wire for litigation. Let everyone you
> >     know hear this one. Get the e-mail address to everyone you can
> think
> >     of.

From firewalls-owner  Wed Jan 14 07:46:05 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA11189; Wed, 14 Jan 1998 06:54:30 -0800 (PST)
Received: from lexicon.ins.com (lexicon.ins.com [199.0.193.11]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id GAA11138 for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 06:54:16 -0800 (PST)
Received: from frank-laptop.vtmednet.org (dmzhost239.vtmednet.org [204.165.197.254]) by lexicon.ins.com (8.7.5/8.7.3) with SMTP id GAA19795; Wed, 14 Jan 1998 06:55:13 -0800 (PST)
Message-Id: <3.0.1.32.19980114095437.006d2944@ins.com>
X-Sender: santia_f@ins.com
X-Mailer: Windows Eudora Pro Version 3.0.1 (32)
Date: Wed, 14 Jan 1998 09:54:37 -0500
To: ramamonjisoa@bnetd.sita.net, firewalls@GreatCircle.COM
From: Frank Santiago <santia_f@INS.COM>
Subject: Re: IP addresses
In-Reply-To: <34BC9D5F.EC999D53@bnetd.sita.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

R. Charles,

What routing porotocol are you guys going to use? BGP4?
How do you want to load balance your traffic between the
tow ISPs, any special requirements? Depending on your 
organization requirements, you are going to receive a 
CIDR block(Class C networks) of IP addresses from each ISP.

____________________________________________________________
           INTERNATIONAL NETWORK SERVICES 
____________________________________________________________
Frank Santiago                Phone: (919)319-0400 x346(INS)
Network Systems Engineer      Pager: (888)812-2098
Cisco Certified, CCIE #2651   
____________________________________________________________
	    	    I LOVE THIS GAME        



At 11:11 AM 1/14/98 +0000, Ramamonjisoa Charles Emile wrote:
>Hello,
>        We have to realize an important project to become the
>provider of internet services for the government of Cote d'Ivoire.
>
>        We run in an unusual configuration because we connect our
>node to the Internet with TWO ISPs ( yes 2 ISPs). So, I want to
>get your feedback comments on the following configuration and
>mostly HOW to manage the IP addresses ISP1 and ISP2 will give us.
>
>Configuration
>
>
>                                ------------------------
>                                !           Router             !
>--------------------> ISP1
>                                !
>! --------------------> ISP2
>                                ------------------------
>                                    !            !            !
>                                    !            !
>!--------------------> RAS
>    Public Servers<-----!            !
>                                            Firewall
>                                                 !
>                                            Intranet
>
>        TIA
>        R. Charles Emile
>
>
>


From firewalls-owner  Wed Jan 14 07:49:32 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA18325; Wed, 14 Jan 1998 07:26:12 -0800 (PST)
Received: from brussels.cisco.com (brussels.cisco.com [171.68.129.238]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id HAA18318 for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 07:26:06 -0800 (PST)
Received: from evyncke-pc.cisco.com (brussels-dynamic35.cisco.com [171.68.129.45])
	by brussels.cisco.com (8.8.5/8.8.5) with SMTP id QAA00103;
	Wed, 14 Jan 1998 16:27:11 +0100 (MET)
Message-Id: <3.0.5.32.19980114162405.00870c80@brussels.cisco.com>
X-Sender: evyncke@brussels.cisco.com
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.5 (32)
Date: Wed, 14 Jan 1998 16:24:05 +0100
To: agabert@caso.de (Alexander Gabert), <firewalls@GreatCircle.COM>
From: Eric Vyncke <evyncke@cisco.com>
Subject: Re: teardrop here, teardrop there, teardrop testing everywhere
  ...
In-Reply-To: <01b0cafd$26b053b0$453134c3@mars.caso.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

The answer might the following:
1) AFAIK the new teardrop is fragmenting WITHIN the TCP header
2) this attack has been described in RFC1858 (or is it 1828?)
   the goal of fragmenting TCP header is to by-pass ACL processing
   on router
3) most routers (at least ours -- no commercial point intended)
   REJECTS IP datagrams whose TCP header is fragmented
4) this it is highly probable that one router has rejected your
   fragments and thus your target have not received them

Just my 0.25 BEF

-eric

At 20:24 13/01/87 +0100, Alexander Gabert wrote:
>ok, so, i tried the new teardrop and i think it is a great tool to make
>peace with my friends at work (e.g. in the LAN) but if you try it over a
>router (WAN link) the other NT Server is responding and responding and
>responding... whatever i try.
>(of course the second server on the other router also belongs to my company
>, ;) )
>
>so, is it possible to make that work over the WAN ?
>
>sincerely, alex.
>
>
>
>... ok, so, i think we blew it ...
>Alexander Gabert,
>agabert@caso.de
>
Eric Vyncke      
Technical Consultant               Cisco Systems Belgium SA/NV
Phone:  +32-2-778.4677             Fax:    +32-2-778.4300
E-mail: evyncke@cisco.com          Mobile: +32-75-312.458

From firewalls-owner  Wed Jan 14 07:51:06 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA16135; Wed, 14 Jan 1998 07:15:49 -0800 (PST)
Received: from snmpmgr.state.tn.us ([170.142.1.74]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id GAA07913 for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 06:40:42 -0800 (PST)
Received: from langate.tnet.state.tn.us by snmpmgr.state.tn.us with SMTP id AA03298
  (5.67b/IDA-1.5 for <firewalls@GreatCircle.COM>); Wed, 14 Jan 1998 08:41:48 -0600
Received: from tn01-Message_Server by langate.tnet.state.tn.us
	with Novell_GroupWise; Wed, 14 Jan 1998 08:46:08 -0600
Message-Id: <s4bc7b50.061@langate.tnet.state.tn.us>
X-Mailer: Novell GroupWise 4.1
Date: Wed, 14 Jan 1998 08:45:40 -0600
From: Jesse White <jwhyte@mail.state.tn.us>
To: HOUSTONL@army.pentagon.mil, firewalls@GreatCircle.COM
Subject: FW: Question: -Reply
Mime-Version: 1.0
Content-Type: text/plain
Content-Disposition: inline
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I heard something similar to this about a year ago with Bell Atlantic, and
nothing came out of it.  Although I did send a comment, I'm not sure if Bell
Atlantic dropped the issue or if the FCC didn't approve.

Jesse Whyte

>>> "Houston, Lewis, Mr, OPNBM/SETA"
<HOUSTONL@army.pentagon.mil> 01/14/98 06:11am >>>
       I found this on the SkyWarn list and thought it of interest to
all.  Does anyone
know if this FCC activity is for real?
>
>
>     Subject: Internet, FCC
>
>     I am writing you this to inform you of a very important matter
>     currently under review by the FCC. Your local telephone company
has
>     filed a proposal with the FCC to impose per minute charges for your
>     internet service. They contend that your usage has or will hinder
>     the operation of the telephone network.
>
>     It is my belief that internet usage will diminish if users were
>     required to pay additional per minute charges. The FCC has created
>     an email box for your comments, responses must be received by
>     February 13, 1998.
>
>     Send your comments to  *   isp@fcc.gov  *   and tell them what you
       think.
>     Every phone company is in on this one, and they are trying to
>     sneak it in just under the wire for litigation. Let everyone you
>     know hear this one. Get the e-mail address to everyone you can
think
>     of.


From firewalls-owner  Wed Jan 14 07:52:17 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id FAA25869; Wed, 14 Jan 1998 05:45:41 -0800 (PST)
Received: from guvnor.blackwell.co.uk (guvnor.blackwell.co.uk [194.130.176.129]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id FAA25816 for <firewalls@greatcircle.com>; Wed, 14 Jan 1998 05:45:27 -0800 (PST)
Received: from exchange1.blackwell.co.uk by guvnor.blackwell.co.uk (MX V4.2
          VAX) with SMTP; Wed, 14 Jan 1998 13:47:57 BST
Received: by EXCHANGE1 with Internet Mail Service (5.0.1458.49) id <ZCX5GDVX>;
          Wed, 14 Jan 1998 13:50:04 -0000
Message-ID: <3BFE2589D330D111AE87006008062DE40DB588@pc37.blackwell.co.uk>
From: Martin Hepworth <martin.hepworth@blackwell.co.uk>
To: "'ramamonjisoa@bnetd.sita.net'" <ramamonjisoa@bnetd.sita.net>,
        firewalls@greatcircle.com
Subject: RE: IP addresses
Date: Wed, 14 Jan 1998 13:48:04 -0000
X-Priority: 3
X-Mailer: Internet Mail Service (5.0.1458.49)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


errmmm....
first job I'd recommend is let the firewall do the controliing of
theISP's/RAS to another (ie have more NIC's in the firewall!)

my 2 peneth worth = 3 cents ;-)

Martin Hepworth
Blackwells Information Services
tel +44 1865 792792 x 3233

WYDSIWGY - 1st rule of computer security
What You don't See Is What Gets you

> -----Original Message-----
> From:	ramamonjisoa@bnetd.sita.net [SMTP:ramamonjisoa@bnetd.sita.net]
> Sent:	Wednesday, January 14, 1998 11:11 AM
> To:	firewalls@greatcircle.com
> Subject:	IP addresses
> 
> Hello,
>         We have to realize an important project to become the
> provider of internet services for the government of Cote d'Ivoire.
> 
>         We run in an unusual configuration because we connect our
> node to the Internet with TWO ISPs ( yes 2 ISPs). So, I want to
> get your feedback comments on the following configuration and
> mostly HOW to manage the IP addresses ISP1 and ISP2 will give us.
> 
> Configuration
> 
> 
>                                 ------------------------
>                                 !           Router             !
> --------------------> ISP1
>                                 !
> ! --------------------> ISP2
>                                 ------------------------
>                                     !            !            !
>                                     !            !
> !--------------------> RAS
>     Public Servers<-----!            !
>                                             Firewall
>                                                  !
>                                             Intranet
> 
>         TIA
>         R. Charles Emile

From firewalls-owner  Wed Jan 14 07:54:36 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id FAA26146; Wed, 14 Jan 1998 05:47:33 -0800 (PST)
Received: from mtigwc03.worldnet.att.net (mtigwc03.worldnet.att.net [204.127.131.34]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id FAA26129 for <firewalls@greatcircle.com>; Wed, 14 Jan 1998 05:47:23 -0800 (PST)
From: NationalContest@worldnet.att.net
Received: from worldnet.att.net ([12.68.130.188])
          by mtigwc03.worldnet.att.net (post.office MTA v2.0 0613 )
          with SMTP id AAA22786; Wed, 14 Jan 1998 13:49:07 +0000
To: NationalContest@worldnet.att.net
Subject: Free Poetry Contest
Date: Wed, 14 Jan 1998 13:49:07 +0000
Message-ID: <19980114134905.AAA22786@worldnet.att.net>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

***NATIONAL POETRY FORUM'S 1998 OFFICIAL CALL FOR ENTRIES!***
***You Could Be Published!  You Could Win the $2,000.00 Grand Prize!***

   It is with great pride that the National Poetry Forum announces its official call for entries for our 1998 poetry competition.  Through this prestigious competition, you are invitied to submit your original poetry for consideration by our distinguished panel of literary judges.  All entries will receive a personal acknowledgement letter from the comittee, and should your poem be selected, you will be honored with publication in our upcoming, hardbound anthology.  A well-deserved showcase for talented poets all across the nation - and around the world!

   If your entry is selected, you also become eligible for the Grand Prize of $2,000 or one of 99 other valuable prizes.  As a winning author, you will also be awarded Privileged Membership in the National Poetry Forum.  Founded over 75 years ago, our publisher, Dorrance Co., has printed books in 12 countries and 6 languages - inclusion in this fraternity is an admirable accomplishment.  
                                R U L E S :
-Send ONE poem, any style on any subject, no more than 25 lines.
-Print or type poem on standard 81/2 x 11 sheet of paper
-In Upper left corner should be:
            -"Contest #1"  
            -Titile of Poem
            -Your Name
            -Mailing Address (City, State, Zip)
-Contest DEADLINE: February 27, 1998
---There are NO FEES to enter, and all winners will be published.  Grand Prize is $2,000.00
-Mail Entries To:
                          National Poetry Forum
                          PO Box 381
                          New York, NY 10040

-Contest open to all, except current or past employees of National Poetry Forum and their families.
-Unpublished and published poets are welcome.  Authors retain all rights to their work.



From firewalls-owner  Wed Jan 14 07:57:26 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id BAA19052; Wed, 14 Jan 1998 01:09:43 -0800 (PST)
Received: from maili.intern.Austria.EU.net (melone.austria.eu.net [193.154.142.240]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id BAA19011 for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 01:09:25 -0800 (PST)
Received: from vindobona.intern.austria.eu.net (vindobona.intern.Austria.EU.net [192.168.191.165])
	by maili.intern.Austria.EU.net (8.8.6/8.8.6) with ESMTP id KAA00551
	for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 10:11:17 -0100 (GMT)
Received: (from cr@localhost) by vindobona.intern.austria.eu.net (8.7.6/8.7.3) id KAA02944; Wed, 14 Jan 1998 10:10:45 +0100
Date: Wed, 14 Jan 1998 10:10:45 +0100
Message-Id: <199801140910.KAA02944@vindobona.intern.austria.eu.net>
From: Christian Reiser <C.Reiser@Austria.EU.net>
To: brobinso@atsi.com
CC: firewalls@GreatCircle.COM
In-reply-to: <199801131714.KAA07115@zeus.atsi.com> (message from Bret Robinson
	on Tue, 13 Jan 1998 10:14:01 -0700)
Subject: Re: SKIP question
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


>> >DEC also provides a proxy that
>> >makes sure the packets coming through at least *look* like valid encrypted
>> >packets. 
>> 
>> What does this help? The server denies connections anyway, if they are not
>> encrypted. 
>
>Because I don't want to run the AltaVista Tunnel server on a dual-homed
>host. I want it to run on the internal network and use a firewall with the
>"tunnel proxy" and authentication. I just feel more comfortable with the
>fact that I can firstly authenticate a remote host/user and also make sure
>the packets coming into the internal network are indeed AltaVista encrypted
>packets *before* it even hits the tunnel machine. Maybe this is overly
>cautious or maybe unnecessary? Or maybe just wrong? Opinions?

I don't run the Tunnel on a dual-homed host, but on one in the internal
network. I don't think, it is realy necessary to authenticate tunnel
connections on the FW. The FW takes care, that only tcp to the tunnel server
on the tunnel port is allowed. Authentication is done by the server using its
cryptography. For me, that's enough. Or maybe just wrong? Opinions? ;-)

Greatings from Vienna/Austria
mfg
CR

-- 
~~~~~~~   EUnet auf der Exponet 98 -- Ebene 2, Stand 22   ~~~~~~~
Christian Reiser (EUnet Austria)  e-mail: C.Reiser@Austria.EU.net
Tel: +431 899 33-0                     http://www.Austria.EU.net/
Fax: +431 899 33-533      CR86-RIPE       priv: C.Reiser@ieee.org

From firewalls-owner  Wed Jan 14 07:57:30 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA03801; Wed, 14 Jan 1998 06:20:25 -0800 (PST)
Received: from cheez.lowprofile.net (cheez.lowprofile.net [206.97.249.88]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id GAA03619 for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 06:19:49 -0800 (PST)
Received: from cheez.lowprofile.net (cheez.lowprofile.net [206.97.249.88])
	by cheez.lowprofile.net (8.8.5/8.8.5) with SMTP id IAA07131;
	Wed, 14 Jan 1998 08:22:17 -0600
Date: Wed, 14 Jan 1998 08:22:17 -0600 (CST)
From: "Daniel \"Cheez\" Brown" <cheez@cheez.lowprofile.net>
To: Ramamonjisoa Charles Emile <ramamonjisoa@bnetd.sita.net>
cc: firewalls@GreatCircle.COM
Subject: Re: IP addresses
In-Reply-To: <34BC9D5F.EC999D53@bnetd.sita.net>
Message-ID: <Pine.LNX.3.95.980114081316.6999B-100000@cheez.lowprofile.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

My personal feeling there, would be to use OSPF routing, with Network Address
Translation on the router for one (or both) of the ISPs, using the other ISP's
or a private network IP scheme. You also, if the provider supports it, could
use BGP routing, however my experiences with BGP have been few and far between.
Diagram:

             +-------+
----ISP1-----|Router |    +--------+   +--------+
             |       =----|Firewall|---|Intranet|
---ISP2------= NAT   |    +--------+   +--------+
             |       |
             +-------+
You can accomplish the same thing with PIX boxes or Proxy servers on the 
outside of the router, if you have money to throw away, but I think a Cisco
2514 with lotsa RAM should be able to do this fine. Now if you want to put
the Remote Access on the outside of the firewall, get a 4000 series and a
dial-in modem controller card. If you want it on the inside, get a Cisco
2511 Access Server and put it in there.

Thats my two cents. (But now I have no sense left.. Uh oh. ;-) 

+----Daniel "Cheez" Brown------------Global Data Systems-------+
| http://cheez.lowprofile.net | Security Advisor, Global Reach |
|     cheez@lowprofile.net    |  Cisco Systems WAN Specialist  |
| UNIX/Linux/HP-UX specialist |  Remote Management Specialist  |
|      If at first you don't succeed, redefine success.        |
| Contrary to popular opinion, UNIX is user friendly. It just  |
+-happens to be very selective about who it makes friends with.+

On Wed, 14 Jan 1998, Ramamonjisoa Charles Emile wrote:

> Hello,
>         We have to realize an important project to become the
> provider of internet services for the government of Cote d'Ivoire.
> 
>         We run in an unusual configuration because we connect our
> node to the Internet with TWO ISPs ( yes 2 ISPs). So, I want to
> get your feedback comments on the following configuration and
> mostly HOW to manage the IP addresses ISP1 and ISP2 will give us.
> 
> Configuration
> 
> 
>                                 ------------------------
>                                 !           Router             !
> --------------------> ISP1
>                                 !
> ! --------------------> ISP2
>                                 ------------------------
>                                     !            !            !
>                                     !            !
> !--------------------> RAS
>     Public Servers<-----!            !
>                                             Firewall
>                                                  !
>                                             Intranet
> 
>         TIA
>         R. Charles Emile
> 


From firewalls-owner  Wed Jan 14 07:58:57 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id FAA25796; Wed, 14 Jan 1998 05:45:22 -0800 (PST)
Received: from arthur.software.net (arthur.software.net [207.82.53.11]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id FAA21555 for <firewalls@greatcircle.com>; Wed, 14 Jan 1998 05:17:50 -0800 (PST)
Received: from excalibur.cybrsource.com
          (196.untrusted.cybersource.com [10.2.2.196])
          by arthur.software.net (Netscape Mail Server v2.0) with SMTP
          id AAA227; Wed, 14 Jan 1998 05:19:31 -0700
From: "John Pettitt" <jpp@cybersource.com>
To: <firewalls@greatcircle.com>
Cc: <daemond@ibm.net>
Subject: Freelance internal hacking a bad idea (was: Exposing fraudulent SA's)
Date: Wed, 14 Jan 1998 05:14:36 -0800
Message-ID: <01bd20ee$5ce41a40$8b0531a6@excalibur.cybrsource.com>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 4.71.1712.3
X-MimeOLE: Produced By Microsoft MimeOLE V4.71.1712.3
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Jim Raykowski <jimrski@cts.com> wrote in reply to Geoff Gowey
daemond@ibm.net with suggestions to hack te interal net then show the SA's
and/or management.

This is A BAD IDEA(tm) hacking the interal net without an explicit
(preferably written) OK from management is a good way to get fired and/or
end up in court.    If the SA's are not a stupid as you think and they spot
you the excuse that you were running a seurity check is probably not going
to fly

Better to write to management (and keep a copy) telling them that you
suspect poor security and suggesting an independent audit (which you will
carry out).   You many not get the audit but your letter will be on file if
it hits the fan later.

John


From firewalls-owner  Wed Jan 14 08:23:41 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA23097; Wed, 14 Jan 1998 08:05:43 -0800 (PST)
Received: from uhura.concentric.net (uhura.concentric.net [206.173.119.93]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id IAA23068 for <firewalls@GreatCircle.com>; Wed, 14 Jan 1998 08:05:26 -0800 (PST)
Received: from cliff.concentric.net (cliff [206.173.119.90])
	by uhura.concentric.net (8.8.8/(97/11/17 5.8))
	id LAA15659; Wed, 14 Jan 1998 11:07:12 -0500 (EST)
	[1-800-745-2747 The Concentric Network]
Received: from ts001d19.pit-pa.concentric.net (ts001d19.pit-pa.concentric.net [209.31.153.31])
	by cliff.concentric.net (8.8.8)
	id LAA26609; Wed, 14 Jan 1998 11:07:09 -0500 (EST)
Message-ID: <34BD0D15.2DEC@concentric.net>
Date: Wed, 14 Jan 1998 11:08:05 -0800
From: mdinvest <mdinvest@concentric.net>
Reply-To: mdinvest@concentric.net
X-Mailer: Mozilla 3.0C-GZone  (Win16; I)
MIME-Version: 1.0
To: firewalls@GreatCircle.com
Subject: System Security and Integrity
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Please help! I need recommendations on software products which analyze
and report on Lan, Wan, Unix, and OS/2 security and integrity. The
products I have reviwed to date include BindView, LTAduitor and Kane
Security Analyst. 
I would like to thank the group in advance for responding to this
request for help!

Regards
Mike
mdinvest@concentric.net

From firewalls-owner  Wed Jan 14 09:56:15 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA00866; Wed, 14 Jan 1998 08:45:21 -0800 (PST)
Received: from mhaaf.inhouse.compuserve.com (mhaaf.inhouse.compuserve.com [149.174.64.79]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id IAA29715 for <firewalls@greatcircle.com>; Wed, 14 Jan 1998 08:40:50 -0800 (PST)
Received: from notes2.compuserve.com (cserve-aaouto1.notes.compuserve.com [149.174.221.54]) by mhaaf.inhouse.compuserve.com (8.6.9/8.6.12) with SMTP id OAA21872.; Wed, 14 Jan 1998 14:12:43 -0500
Received: by notes2.compuserve.com (IBM OS/2 SENDMAIL VERSION 1.3.17/2.0)
	  id AA5265; Wed, 14 Jan 98 11:42:27 -0500
Message-Id: <9801141642.AA5265@notes2.compuserve.com>
Received: by CSERVE (Lotus Notes Mail Gateway for SMTP V1.1) id
  005027340012F89CC125658C0052D21C; Wed, 14 Jan 98 11:42:25 
To: "james lau" <jlau@hotmail.com>, firewalls <firewalls@greatcircle.com>,
        jlau <notes2!jlau@uunet.uu.net>
From: "marc.vael" <marc.vael@ArthurAndersen.com>
Date: 14 Jan 98 16:21:03 
Subject: Re: Content filtering
Mime-Version: 1.0
Content-Type: Text/Plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello James,

I also have a pretty good reference in the industry

MIMEsweeper
which is the content security tool for networks (V3.0 already)
It is a UK product developed about 5 years ago

A lot of banks and government organizations in Europe are using this tool.

Main functions :
- bidirectional (in/out)
- block virusses from web, e-mail and FTP
- manage junk e-mail
- block URL or webpages with certain words / sentences
- add legal disclaimers
- block java applets / scripts / cookies

See the following site for more info
http://www.mimesweeper.integralis.com

also available in the US (Integralis inc. in Washington)

Regards,

Marc Vael
Arthur Andersen

At 02:57 PM 1/7/98 PST, James Lau wrote:
>Hello all,
>This may be a little bit off topic but please bare with me or 
>points me to a right mailing list.
>
>I'm looking for a solution to filter the contents of web traffics,
>ftp files and email.  I know this is not totally firewall related
>but there are a few firewall products can do that. (That's why I
>ask.)  Unfortunately most (may be all) of them use proxy which
>require changes of configuration which we cannot force my users
>to do.  Is there any solution out there which doesn't require
>changing of configuration?  Or is the proxy the only solution?
>Any ideas?
>Thanks in advance.
>James
>______________________________________________________
>Get Your Private, Free Email at http://www.hotmail.com

From firewalls-owner  Wed Jan 14 12:03:56 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id KAA23497; Wed, 14 Jan 1998 10:45:25 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id KAA21042 for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 10:33:08 -0800 (PST)
Received: from cliff.bms.com by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-970426)
	id KAA02161; Wed, 14 Jan 1998 10:33:11 -0800 (PST)
Received: from zim.bms.com (pendragon.zim.bms.com)
 by cliff.bms.com (PMDF V5.1-10 #22413)
 with SMTP id <01ISDAC8MGMO009D43@cliff.bms.com> for firewalls@GreatCircle.com;
 Wed, 14 Jan 1998 13:32:54 EST
Received: from ccmail.zim.bms.com by zim.bms.com (4.1/SMI-4.1) id AA29264; Wed,
 14 Jan 1998 13:35:07 -0500 (EST)
Received: from cc:Mail by ccmail.zim.bms.com id AA884813616; Wed,
 14 Jan 1998 13:25:21 -0500 (EST)
Date: Wed, 14 Jan 1998 13:25:21 -0500 (EST)
From: "Guse, Darren J." <dguse@ccmail.zim.bms.com>
Subject: Re: FW: Question:
To: firewalls@GreatCircle.COM,
        "Houston, Lewis, Mr, OPNBM/SETA" <HOUSTONL@army.pentagon.mil>
Message-id: <9800148848.AA884813616@ccmail.zim.bms.com>
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

       Check out 
       http://www.fcc.gov/Bureaus/Common_Carrier/Factsheets/ispfact.html
       for a full discription, it states that the FCC shot DOWN this proposal.
       
       Darren Guse
       Manager, Computer Operations and Network Services
       
       
       >I found this on the SkyWarn list and thought it of interest to
>all.  Does anyone
>know if this FCC activity is for 
real? >
>
>     Subject: Internet, FCC
>
>     I am writing you this to inform you of a very important matter
>     currently under review by the FCC. Your local telephone company has 
>     Send your comments to  *   isp@fcc.gov  *   and tell them what you
       think.
> snip *
>     Every phone company is in on this one, and they are trying to
>     sneak it in just under the wire for litigation. Let everyone you
>     know hear this one. Get the e-mail address to everyone you can think 
>     of.


From firewalls-owner  Wed Jan 14 13:09:13 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA12145; Wed, 14 Jan 1998 12:20:19 -0800 (PST)
Received: from c00957-100lez.eos.ncsu.edu (c00957-100lez.eos.ncsu.edu [152.1.26.77]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA11961 for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 12:19:38 -0800 (PST)
Received: from localhost (jkwilli2@localhost)
          by c00957-100lez.eos.ncsu.edu (8.8.4/UC02Jan97) with SMTP
	  id PAA24417; Wed, 14 Jan 1998 15:21:14 -0500 (EST)
X-Authentication-Warning: c00957-100lez.eos.ncsu.edu: jkwilli2 owned process doing -bs
Date: Wed, 14 Jan 1998 15:21:14 -0500 (EST)
From: Ken Williams <jkwilli2@unity.ncsu.edu>
X-Sender: jkwilli2@c00957-100lez.eos.ncsu.edu
To: "Houston, Lewis, Mr, OPNBM/SETA" <HOUSTONL@army.pentagon.mil>
cc: "'Firewalls'" <firewalls@GreatCircle.COM>
Subject: Re: FW: Question:
In-Reply-To: <c=US%a=attmail%p=gov+dms+trans%l=DMS/DAPENTAGON/0029CD0A@dadc001.hq.af.mil>
Message-ID: <Pine.SOL.3.96.980114151846.23732B-100000@c00957-100lez.eos.ncsu.edu>
X-PreMailer: Microsoft-Unix '99 MSProExcelSendMail ver 0.98 beta
X-NoSpam: Pursuant to US Code; Title 47; Chapter 5; Subchapter II; 227
X-NoSpam: any and all nonsolicited commercial E-mail sent to this address is
X-NoSpam: subject to a download and archival fee in the amount of 500 US dollars.
X-NoSpam: Any E-mail sent to this address denotes acceptance of these terms.
X-Copyright: The contents of this message may not be reproduced in any form
X-Copyright: (including Commercial use) unless specific permission is granted
X-Copyright: by the author of the message.  All requests must be in writing.
X-Disclaimer: This email is meant for educational purposes only.
X-Disclaimer: The contents of this email do not reflect the thoughts
X-Disclaimer: or opinions of either myself or my employer and are not
X-Disclaimer: endorsed by sponsored by or provided on behalf of
X-Disclaimer: North Carolina State University.
X-Disclaimer: Any errors in spelling tact or fact are transmission errors.
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Wed, 14 Jan 1998, Houston, Lewis, Mr, OPNBM/SETA wrote:

>       I found this on the SkyWarn list and thought it of interest to
>all.  Does anyone
>know if this FCC activity is for real?
>>
>>
>>     Subject: Internet, FCC
>>
>>     I am writing you this to inform you of a very important matter
>>     currently under review by the FCC. Your local telephone company has
>>     filed a proposal with the FCC to impose per minute charges for your
>>     internet service. They contend that your usage has or will hinder
>>     the operation of the telephone network.
>>
>>     It is my belief that internet usage will diminish if users were
>>     required to pay additional per minute charges. The FCC has created
>>     an email box for your comments, responses must be received by
>>     February 13, 1998.
>>
>>     Send your comments to  *   isp@fcc.gov  *   and tell them what you
>       think.
>>     Every phone company is in on this one, and they are trying to
>>     sneak it in just under the wire for litigation. Let everyone you
>>     know hear this one. Get the e-mail address to everyone you can think
>>     of.
>

old news.  this seems to be the latest Internet spam/rumor/scare/hoax.
this idea was on the table until 11/97 at the FCC, but they wisely decided
to drop it.

don't believe the hype.

Ken Williams 

/--------------|  TATTOOMAN -aka- rute  |--------------\  
  NCSU Computer Science    VP of The EHAP Corp.   
  jkwilli2@unity.ncsu.edu  http://www.hackers.com/ehap/ 
  UNIX ICQ UIN# 4231260    ehap@hackers.com     
  FTP Site:  ftp://152.7.11.38/pub/personal/tattooman/
  WWW 2:     http://www4.ncsu.edu/~jkwilli2/
  PGP Key:   http://www4.ncsu.edu/~jkwilli2/pgp.asc
      http://www4.ncsu.edu/~jkwilli2/pgp_fingerprint
\---------|  http://152.7.11.38/~tattooman/  |---------/




From firewalls-owner  Wed Jan 14 15:02:29 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id OAA05355; Wed, 14 Jan 1998 14:12:59 -0800 (PST)
Received: from se.mediaone.net (stjohns.se.mediaone.net [24.129.0.68]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id OAA05278 for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 14:12:41 -0800 (PST)
Received: from dmartin ([24.129.56.43]) by se.mediaone.net
          (Netscape Messaging Server 3.01)  with ESMTP id AAA13474;
          Wed, 14 Jan 1998 17:14:27 -0500
Message-ID: <34BD0154.F1637944@usa.net>
Date: Wed, 14 Jan 1998 18:17:56 +0000
From: Don Martin <grey@usa.net>
Reply-To: grey@usa.net
Organization: New Edge Technologies
X-Mailer: Mozilla 4.01 [en] (Win95; I)
MIME-Version: 1.0
To: cbrenton@sover.net
CC: Sick Puppy <sikpuppy@maestro.com>, firewalls@GreatCircle.COM
Subject: Re: Wannabe needs a good book
X-Priority: 3 (Normal)
References: <Pine.SUN.3.96.980106105930.4657A-100000@maestro.maestro.com> <34BAAE54.64ED641C@sover.net>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I thought for a second Sick Puppy wrote a book on networking.... I can't
describe my initial thoughts on this... but I think I would buy it
anyway....

Chris Brenton wrote:

> Sick Puppy wrote:
>
> > Can someone please suggest a good book on the
> > general topic of networking, with some emphasis on TCP/IP, that we
> can
> > steal?
>
> WARNING!!!   Blatant self plug!
>
> Check out the link to my last book in the tag below.
> Covers network wiring & hardware, topologies (LAN & WAN),
> protocols (heavy on IP but IPX, NetBIOS & AT as well),
> and even a how-to on configuring networking on NetWare,
> Unix, Notes and all Windows platforms. There's even a bit
> on troubleshooting tools and methodologies.
>
> If you can steal it from Amazon, I want to see traces. ;)
>
> Cheers,
> Chris
> --
> **************************************
> cbrenton@sover.net
>
> Multiprotocol Network Design & Troubleshooting
> http://www.amazon.com/exec/obidos/ISBN=0782120822/0740-8883012-887529
>
> Support the anti-spam movement: http://www.cauce.org/




From firewalls-owner  Wed Jan 14 15:17:28 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id OAA10817; Wed, 14 Jan 1998 14:45:50 -0800 (PST)
Received: from pse01.pios.com (PSE01.PIOS.COM [199.33.129.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id OAA10675 for <Firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 14:45:24 -0800 (PST)
Received: by pse01.pios.com; (5.65v3.2/1.3/10May95) id AA21842; Wed, 14 Jan 1998 17:47:02 -0500
Received: from pio_mail2.cle2.pios.com by gemini.pios.com (PMDF V5.0-6 #18985)
 id <01ISDJ8QN8A88X0VLE@gemini.pios.com> for Firewalls@GreatCircle.COM; Wed,
 14 Jan 1998 17:48:09 -0500 (EST)
Received: by pio_mail2.cle2.pios.com with SMTP
 (Microsoft Exchange Server Internet Mail Connector Version 4.0.995.52)
 id <01BD2114.9B299CA0@pio_mail2.cle2.pios.com>; Wed, 14 Jan 1998 17:48:22 -0500
Date: Wed, 14 Jan 1998 17:48:21 -0500
From: "Stout, William" <StoutW@pios.com>
Subject: RE: relative strengths of different encyrption techniques
To: "'Firewalls-GC'" <Firewalls@GreatCircle.COM>
Message-Id: 
 <c=US%a=_%p=PIOS%l=PIO_MAIL2-980114224821Z-3511@pio_mail2.cle2.pios.com>
Mime-Version: 1.0
X-Mailer: Microsoft Exchange Server Internet Mail Connector Version 4.0.995.52
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Sigh. Ryan's right.  Passwords were in my head, and I was thinking about
the real number of keyboard characters (~104), vs. digits (10), and the
number value stuck in my message when I typed about bits (2 for with
today's technology).  ;)  Typo.  You'd think I'd learn by now.

Too much editing can be dangerous.

Bill Stout

> ----- Original Message -----
> From:	Ryan Russell [SMTP:ryanr@sybase.com]
<snip>
> That's not 10^128/10^112, it's 2^128/2^112,
> or 65536 (2^16.)


From firewalls-owner  Wed Jan 14 15:26:44 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id OAA12451; Wed, 14 Jan 1998 14:59:43 -0800 (PST)
Received: from firewall.uprc.com (sentry.uprc.com [144.94.230.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id OAA12435 for <firewalls-digest@greatcircle.com>; Wed, 14 Jan 1998 14:59:36 -0800 (PST)
Received: by firewall.uprc.com; id AA08029; Wed, 14 Jan 98 17:01:27 CST
Received: from elkabong.uprc.com(144.94.68.10) by firewall via smap (3.2)
	id xma008026; Wed, 14 Jan 98 17:01:26 -0600
Received: from kafka.upr.com (kafka.uprc.com [144.94.92.14])
	by elkabong.upr.com (8.8.5/8.8.5) with ESMTP id RAA01854
	for <firewalls-digest@greatcircle.com>; Wed, 14 Jan 1998 17:07:06 -0600 (CST)
From: "Prahl V. E. (Von)" <z76399@upr.com>
Received: (from z76399@localhost)
	by kafka.upr.com (8.8.5/8.8.5) id RAA10810
	for firewalls-digest@greatcircle.com; Wed, 14 Jan 1998 17:07:04 -0600 (CST)
Date: Wed, 14 Jan 1998 17:07:04 -0600 (CST)
Message-Id: <199801142307.RAA10810@kafka.upr.com>
To: firewalls-digest@greatcircle.com
Subject: port config between trusted net and untrusted net
X-Sun-Charset: US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Greetings,


I want configure my firewall to allow tcp traffic from the inside to
an outside address on a specific destination port, eg 400.  I then need to
allow tcp traffic from that outside address through the firewall to 
machines inside the firewll on port 400.  I want to use a plug-gw.

All help will be greatly rewarded.


Von

From firewalls-owner  Wed Jan 14 15:29:00 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA27472; Wed, 14 Jan 1998 11:08:12 -0800 (PST)
Received: from tamc.amedd.army.mil (GATEKEEPER.TAMC.AMEDD.ARMY.MIL [198.250.180.194]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id LAA27389 for <firewalls@GreatCircle.com>; Wed, 14 Jan 1998 11:07:52 -0800 (PST)
Received: by tamc.amedd.army.mil; id JAA11316; Wed, 14 Jan 1998 09:05:20 -1000
Received: from unknown(204.208.85.230) by gatekeeper.tamc.amedd.army.mil via smap (4.0a)
	id xma011268; Wed, 14 Jan 98 09:05:06 -1000
Message-ID: <34BCD4EE.195ECD3B@sound.net>
Date: Wed, 14 Jan 1998 09:08:30 -0600
From: "Gary D. Long" <kindred@sound.net>
Reply-To: kindred@sound.net
Organization: Kindred Systems, Inc.
X-Mailer: Mozilla 4.04 [en] (Win95; U)
MIME-Version: 1.0
To: mdinvest@concentric.net
CC: firewalls@GreatCircle.com
Subject: Re: System Security and Integrity
References: <34BD0D15.2DEC@concentric.net>
Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms4C7CDF2B2D11CC4A35F81E17"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

This is a cryptographically signed message in MIME format.

--------------ms4C7CDF2B2D11CC4A35F81E17
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Take a look at:

http://www.netect.com   entire product list

and

http://www.axent.com    enterprise security manager (ESM)

mdinvest wrote:

> Please help! I need recommendations on software products which analyze
> and report on Lan, Wan, Unix, and OS/2 security and integrity. The
> products I have reviwed to date include BindView, LTAduitor and Kane
> Security Analyst.
> I would like to thank the group in advance for responding to this
> request for help!
>
> Regards
> Mike
> mdinvest@concentric.net



--
Gary D. Long
Kindred Systems, Inc.
888-RINGKSI
kindred@kindredsystems.com


--------------ms4C7CDF2B2D11CC4A35F81E17
Content-Type: application/x-pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIIKuAYJKoZIhvcNAQcCoIIKqTCCCqUCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC
CLAwggP2MIIDX6ADAgECAhAF8m6Cl6sWXSof3+hckLowMA0GCSqGSIb3DQEBBAUAMGIxETAP
BgNVBAcTCEludGVybmV0MRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjE0MDIGA1UECxMrVmVy
aVNpZ24gQ2xhc3MgMSBDQSAtIEluZGl2aWR1YWwgU3Vic2NyaWJlcjAeFw05NzEyMTEwMDAw
MDBaFw05ODAyMDkyMzU5NTlaMIGvMUYwRAYDVQQLEz13d3cudmVyaXNpZ24uY29tL3JlcG9z
aXRvcnkvQ1BTIEluY29ycC4gYnkgUmVmLixMSUFCLkxURChjKTk2MSYwJAYDVQQLEx1EaWdp
dGFsIElEIENsYXNzIDEgLSBOZXRzY2FwZTESMBAGA1UEAxMJR2FyeSBMb25nMSkwJwYJKoZI
hvcNAQkBFhpraW5kcmVkQGtpbmRyZWRzeXN0ZW1zLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOB
jQAwgYkCgYEA2ev8tQMBOVRjz6yY28am7HuNfafzSbIqs5ZjfQY1f2dfVvrPXFHL5XdPxzgX
IgGZSin2uJlYGWRU7npMvK2o80ZzDV/nY5g/op/fX+G2lSe74s45KNy/Rnt0jFdO1hApg7BA
Kjehp/PFJj0Swm0WvD8bVmxVSl4X5uanPGwDR9cCAwEAAaOCAV0wggFZMAkGA1UdEwQCMAAw
ga8GA1UdIASBpzCAMIAGC2CGSAGG+EUBBwEBMIAwKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3
LnZlcmlzaWduLmNvbS9DUFMwYgYIKwYBBQUHAgIwVjAVFg5WZXJpU2lnbiwgSW5jLjADAgEB
Gj1WZXJpU2lnbidzIENQUyBpbmNvcnAuIGJ5IHJlZmVyZW5jZSBsaWFiLiBsdGQuIChjKTk3
IFZlcmlTaWduAAAAAAAAMBEGCWCGSAGG+EIBAQQEAwIHgDCBhgYKYIZIAYb4RQEGAwR4FnZk
NDY1MmJkNjNmMjA0NzAyOTI5ODc2M2M5ZDJmMjc1MDY5YzczNTliZWQxYjA1OWRhNzViYzRi
Yzk3MDE3NDdkYTVkM2YyMTQxYmVhZGIyYmQyZTg5MjEwYWI2OWY5ZDUxMTQ5OWFhMmIzNDRm
ZGYzZWE0NTJjMA0GCSqGSIb3DQEBBAUAA4GBAEmdvIdq7/10TEfla61I4yKB7f5W3jHwgrAM
1CaP4agm2QVWGAVrBo8LNgv+l2vSh4loB+eTPfoiRzo+UeZgzgAIiON4lY5VDkrvC2AjyH+0
UBHIq908wOlL4r98lzRKTS3xKBGkrNaCTpVYbCqUbPX+VVuokNXLD7+Te3rQGVkIMIICfTCC
AeagAwIBAgIUdRNrWPOAaVd1pqJNWRBNnOp2SvEwDQYJKoZIhvcNAQECBQAwXzELMAkGA1UE
BhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAxIFB1Ymxp
YyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MB4XDTk3MDYyNDA3MDAwMFoXDTk5
MDYyNDA3MDAwMFowYjERMA8GA1UEBxMISW50ZXJuZXQxFzAVBgNVBAoTDlZlcmlTaWduLCBJ
bmMuMTQwMgYDVQQLEytWZXJpU2lnbiBDbGFzcyAxIENBIC0gSW5kaXZpZHVhbCBTdWJzY3Jp
YmVyMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC2FKbPTdAFDdjKI9BvqrQpkmOOLPhv
ltcunXZLEbE2jVfJw/0cxrr+Hgi6M8qV6r7jW80GqLd5HUQq7XPysVKDaBBwZJHXPmv5912d
FEObbpdFmIFH0S3L3bty10w/cariQPJUObwW7s987LrbP2wqsxaxhhKdrpM01bjV0Pc+qQID
AQABozMwMTARBglghkgBhvhCAQEEBAMCAQYwDwYDVR0TBAgwBgEB/wIBATALBgNVHQ8EBAMC
AQYwDQYJKoZIhvcNAQECBQADgYEAkgxL6bqTzf/a5mD9nmQDZhUvVjw4TGhKR8Xzq48l2WZD
c0MVc0S+FEiBWncMzHrq2bG88ov/EbHfFFBI3GUdC4n5oV5IUm/ttWv0uAhMOPC5iWcpD+Dg
N/em69T01UKpXf295558G+dPhS0EoWAuhbjr4vrvFAUmFRhVbxOhHXEwggIxMIIBmgIFAqQA
AAEwDQYJKoZIhvcNAQECBQAwXzELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJ
bmMuMTcwNQYDVQQLEy5DbGFzcyAxIFB1YmxpYyBQcmltYXJ5IENlcnRpZmljYXRpb24gQXV0
aG9yaXR5MB4XDTk2MDEyOTAwMDAwMFoXDTk5MTIzMTIzNTk1OVowXzELMAkGA1UEBhMCVVMx
FzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTcwNQYDVQQLEy5DbGFzcyAxIFB1YmxpYyBQcmlt
YXJ5IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
gQDlGb9to1ZhLZlIcfZn3rmN67eehoAKkQ76OCWvRoiC5XOooJskXQ0fzGVuDLDQVoQYh5oG
mxChc9+0WDlrbsH2FdWoqD+qEgaNMax/sDTXjzRniAnNFBHiTkVWaR94AoDa3EeRKbs2yWNc
xeDXLYd7obcysHswuiovMaruo2fa2wIDAQABMA0GCSqGSIb3DQEBAgUAA4GBAFJzuppV3Nw/
gn2wkJhiKoJMdgBuJT3VwglwVwEMD3cfGKH7HGAOoHU7SSFB/qdcLUxCSdP/KNiM6p3+yQfi
d4JTI95V885Ek/r6TL3KNvNbZrKeyPIMXl7UobQhCTPKO1n8ksI4/K3ZliTgLfqjKfUzaHhO
tLyfaTXiqJiUczvEMYIB0DCCAcwCAQEwdjBiMREwDwYDVQQHEwhJbnRlcm5ldDEXMBUGA1UE
ChMOVmVyaVNpZ24sIEluYy4xNDAyBgNVBAsTK1ZlcmlTaWduIENsYXNzIDEgQ0EgLSBJbmRp
dmlkdWFsIFN1YnNjcmliZXICEAXyboKXqxZdKh/f6FyQujAwCQYFKw4DAhoFAKCBsTAYBgkq
hkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw05ODAxMTQxNTA4MzFaMCMG
CSqGSIb3DQEJBDEWBBSy0vE67xGbdtsSigGCRyjq+kGuHDBSBgkqhkiG9w0BCQ8xRTBDMAoG
CCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDAHBgUrDgMCBzANBggqhkiG9w0DAgIBQDANBggq
hkiG9w0DAgIBKDANBgkqhkiG9w0BAQEFAASBgKtqIOek/nOYL2BQxXFObLvH9XfJTB0Zp/i/
iO4IxV8KwHyZjDzR9nfadIyrynZTAmAUSLa1MY5/2wIxNxRuoeFXDl9Nhu9vkGqiRzuLtyO5
47zDbvSNBHdab6Ktg6AmzjwauHG/KnEXehO584hbyBZuYKr3eHrdtV7y2kXkl5Sf
--------------ms4C7CDF2B2D11CC4A35F81E17--


From firewalls-owner  Wed Jan 14 15:30:47 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA15521; Wed, 14 Jan 1998 12:33:28 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA15448 for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 12:33:09 -0800 (PST)
Received: from piglet.cc.utexas.edu by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-970426)
	id MAA03634; Wed, 14 Jan 1998 12:33:08 -0800 (PST)
Received: from ccwf.cc.utexas.edu ([150.114.141.169])
	by piglet.cc.utexas.edu (8.8.5/8.8.5/piglet.mc-1.4) with ESMTP id OAA22647
	for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 14:34:13 -0600 (CST)
Message-ID: <34BD213E.F24F9E0D@ccwf.cc.utexas.edu>
Date: Wed, 14 Jan 1998 14:34:06 -0600
From: Eric Bresie <ebresie@ccwf.cc.utexas.edu>
X-Mailer: Mozilla 4.04 [en] (Win95; I)
MIME-Version: 1.0
To: firewalls@GreatCircle.COM
Subject: FAQ Request
References: <34BC9D5F.EC999D53@bnetd.sita.net>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

I was wondering if there was a FAQ file for this mailing list...before I
start asking questions I need not ask.

====/------ Breezy ---------------------------/
===/----  ebresie@ccwf.cc.utexas.edu -------/
==/----  http://ccwf.cc.utexas.edu/~ebresie --/



From firewalls-owner  Wed Jan 14 15:32:38 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id NAA25577; Wed, 14 Jan 1998 13:23:09 -0800 (PST)
Received: from ns.i-kinetics.com (ns.i-kinetics.com [205.181.32.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id LAA02259 for <firewalls@GreatCircle.com>; Wed, 14 Jan 1998 11:27:54 -0800 (PST)
Received: (from mail@localhost) by ns.i-kinetics.com (8.8.5/8.7.3) id OAA29078 for <firewalls@GreatCircle.com>; Wed, 14 Jan 1998 14:27:57 -0500 (EST)
X-Authentication-Warning: ns.i-kinetics.com: mail set sender to <comalley@dirac.i-kinetics.com> using -f
Received: from dirac.i-kinetics.com(192.31.81.157) by ns.i-kinetics.com via smap (V2.0)
	id xma029070; Wed, 14 Jan 98 14:27:33 -0500
Received: (from comalley@localhost)
	by dirac.i-kinetics.com (8.8.5/8.8.5) id OAA04965
	for firewalls@GreatCircle.com; Wed, 14 Jan 1998 14:27:32 -0500 (EST)
From: "Christopher O'Malley" <comalley@i-kinetics.com>
Message-Id: <199801141927.OAA04965@dirac.i-kinetics.com>
Subject: Experiences with SunScreen?
To: firewalls@GreatCircle.com
Date: Wed, 14 Jan 1998 14:27:32 -0500 (EST)
X-Mailer: ELM [version 2.4 PL20]
Content-Type: text
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


	Anyone out there have any reviews, recommendations (or not),
 experiences, anecdotes, etc, etc, they'd be willing to share about
 Sun's network security products?  Anything from the general (Sun-
 Screen is a joy to use! :) to the specific (how good the logging
 is) would be appreciated.
						Thanks,

						Christopher O'Malley
						Sr. System Engineer
						I-Kinetics, Inc.


From firewalls-owner  Wed Jan 14 15:33:54 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id NAA23798; Wed, 14 Jan 1998 13:16:51 -0800 (PST)
Received: from garrison.com (gw.garrison.com [207.193.95.97]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id NAA23545 for <firewalls@greatcircle.com>; Wed, 14 Jan 1998 13:16:02 -0800 (PST)
Received: by garrison.com; id OAA03758; Thu, 15 Jan 1998 14:57:23 -0600 (CST)
Received: from sdsh11-153.flash.net(209.30.95.153) by gw.garrison.com via smap (3.2)
	id xma003754; Thu, 15 Jan 98 14:57:13 -0600
Message-Id: <3.0.5.32.19980114131918.0087e210@pop.flash.net>
X-Sender: jeromie@pop.flash.net
X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.5 (32)
Date: Wed, 14 Jan 1998 13:19:18 -0800
To: firewalls@greatcircle.com
From: Jeromie Jackson <jeromie@garrison.com>
Subject: Gauntlet 4.0 & 4.0a GUI latency
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

	The new Gauntlet GUI, is _EXTREMELY_ slow.  For remote administration over
modems it can take well over 15 minutes for the thing to even come up!  The
reason being a ton of Java classes get downloaded.  I was wondering if
anyone knows of a way to cache these files, or do _ANYTHING_ to speed this
up..??

Trying to use a product like PC-Extender to do remote administration takes
waaay too much time to be very viable when you need to administer multiples
of these boxes, and the curses based administration tool messes up what the
GUI has implemented.


=-=-=-=-=-=-=-=-=-=-=-=-==-=

Jeromie Jackson - CISSP
Senior Security Engineer
Garrison Technologies
100 Congress Ave. STE:2100
Austin, TX  78701
760-633-1843
jeromie@garrison.com
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

From firewalls-owner  Wed Jan 14 15:35:37 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id NAA25867; Wed, 14 Jan 1998 13:24:55 -0800 (PST)
Received: from dns.portcullis-security.com (dns.portcullis-security.com [194.203.128.120]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id LAA03622 for <firewalls@greatcircle.com>; Wed, 14 Jan 1998 11:34:50 -0800 (PST)
Received: from tgb-mailhost.portcullis-security.com (unverified [194.203.128.123]) by dns.portcullis-security.com
 (Integralis SMTPRS 2.04) with ESMTP id <B0000002899@dns.portcullis-security.com>;
 Wed, 14 Jan 1998 19:36:33 +0000
Received: by tgb-mailhost.portcullis-security.com with Internet Mail Service (5.0.1457.3)
	id <CM83FVCV>; Wed, 14 Jan 1998 19:30:59 -0000
Message-Id: <21905E09B270D111815400C0DFAA15331E05@tgb-mailhost.portcullis-security.com>
From: Thomas Liam Romanis <TLR@portcullis-security.com>
To: "'jlau@hotmail.com'" <jlau@hotmail.com>,
        "'firewalls@greatcircle.com'"
	 <firewalls@greatcircle.com>
Cc: Mark S Lane <MSL@portcullis-security.com>,
        Paul J Docherty
	 <PJD@portcullis-security.com>
Subject: FW: Content filtering
Date: Wed, 14 Jan 1998 19:30:58 -0000
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1457.3)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

resend
> ----------
> From: 	Thomas Liam Romanis
> Sent: 	Wednesday, January 14, 1998 7:22PM
> To: 	'marc.vael'
> Cc: 	Paul J Docherty; Mark S Lane
> Subject: 	RE: Content filtering
> 
> As Mr Vael replied MIMEsweeper is a very good product for content
> analysis for blocking viruses (if the av tool used can detect),
> lexical analysis, blocking junk mail, blocking attachments or
> particular files types such as EXE'S, COM'S, Binary, MOV'S, MPEG'S
> ETC... as well as allowing you to add sections to mail such as legal
> disclaimers. It can also be used to block Java and ActiveX controls. 
> 
> Other products you may wish to look at on this area are FINJAN's
> Surfin' Sheild(Desktop java & activex protection), Surfin' Gate
> etc..... 
> www.finjan.com
> www.portcullis-security.com
> 
> AbirNet SessionWall - Verbose logging of all TCP/IP traffic and
> blocking if required.
> 
> The problem is that whilst products like MIMEsweeper are excellent at
> their job they do need to be protected. I.E. a firewall is a good
> idea.
> 
> Have a look at BIGfire firewall. - BlackBox approach, screening Router
> and packet filter. It allows you for instance to allow users on your
> internal network to browse the web but will not allow HTTP connections
> to be made to your internal network from the internet. Or to your
> intranet from unauthorised networks or specific IP addresses. This
> idea follows for every protocol in the stack. 
> www.biodata.de, www.portcullis-security.com.
>  
> It all depend on what you are trying to achieve, let us know.
> 
> Cheers, Liam Romanis, Technical Manager, Portcullis Computer Security
> Ltd.
> ----------
> From: 	marc.vael[SMTP:marc.vael@ArthurAndersen.com]
> Sent: 	Wednesday, January 14, 1998 4:21PM
> To: 	james lau; firewalls; jlau
> Subject: 	Re: Content filtering
> 
> Hello James,
> 
> I also have a pretty good reference in the industry
> 
> MIMEsweeper
> which is the content security tool for networks (V3.0 already)
> It is a UK product developed about 5 years ago
> 
> A lot of banks and government organizations in Europe are using this
> tool.
> 
> Main functions :
> - bidirectional (in/out)
> - block virusses from web, e-mail and FTP
> - manage junk e-mail
> - block URL or webpages with certain words / sentences
> - add legal disclaimers
> - block java applets / scripts / cookies
> 
> See the following site for more info
> http://www.mimesweeper.integralis.com
> 
> also available in the US (Integralis inc. in Washington)
> 
> Regards,
> 
> Marc Vael
> Arthur Andersen
> 
> At 02:57 PM 1/7/98 PST, James Lau wrote:
> >Hello all,
> >This may be a little bit off topic but please bare with me or 
> >points me to a right mailing list.
> >
> >I'm looking for a solution to filter the contents of web traffics,
> >ftp files and email.  I know this is not totally firewall related
> >but there are a few firewall products can do that. (That's why I
> >ask.)  Unfortunately most (may be all) of them use proxy which
> >require changes of configuration which we cannot force my users
> >to do.  Is there any solution out there which doesn't require
> >changing of configuration?  Or is the proxy the only solution?
> >Any ideas?
> >Thanks in advance.
> >James
> >______________________________________________________
> >Get Your Private, Free Email at http://www.hotmail.com
> 
> 

From firewalls-owner  Wed Jan 14 15:37:27 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id KAA24938; Wed, 14 Jan 1998 10:50:48 -0800 (PST)
Received: from mail.advancenet.net (hermes.cu-online.com [205.198.248.82]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id KAA24845 for <firewalls@greatcircle.com>; Wed, 14 Jan 1998 10:50:30 -0800 (PST)
Received: from mail.argus-systems.com (ranger.argus-systems.com [206.221.232.80]) by mail.advancenet.net (8.8.6/8.7.3) with SMTP id NAA23195; Wed, 14 Jan 1998 13:55:23 -0600
Received: by mail.argus-systems.com (SMI-8.6/SMI-SVR4)
	id MAA25525; Wed, 14 Jan 1998 12:51:28 -0600
Date: Wed, 14 Jan 1998 12:51:28 -0600
From: mcnabb@argus-systems.com (Paul McNabb)
Message-Id: <199801141851.MAA25525@mail.argus-systems.com>
To: Marc.Heuse@mail.DeuBa.COM
Cc: firewalls@greatcircle.com
Subject: Re: Secure Web Transaction Solution
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>  From: Marc Heuse <Marc.Heuse@mail.DeuBa.COM>
>  
>  > >  From: Larry.Riley@disclosure.com (Larry Riley)
>  > >  
>  > >       Does anybody have any experience with Cisco and Hewlett-Packard Secure 
>  > >       Web Transaction Solution Architecture?
>  > >       
>  > >       Can this solution be compared to any other firewall solution such as 
>  > >       Firewall-1, regarding its price, efficiency and security? Does this 
>  > >       solution have any bugs?
>  > 
>  > If you ignore the load balancing issues you are getting with this, the
>  > security and functionality of HP/CISCO are significantly less than what
>  > you get with a Sun/Argus/Checkpoint combination.  The HP solution is a
>  > lot more expensive as well.
>  > ---------------------------------------------------------
>  > Paul McNabb                     Argus Systems Group, Inc.
>                                    ^^^^^^^^^^^^^^^^^^^^^^^^^^
>  
>  I would trust any vendor claiming that his product is superior ... NOT ...
>  I hate advertisement with no value for discussions on the mailinglists.

I apologize for working for a vendor then.  But the "advertisement" (in
this case meaning a reference) IS valuable and a reasonable topic for
discussion for those people on the list who have no idea how firewalls
can be strengthed and complemented by products like HP's VV and Argus's
security.  This is particularly true since my comment was in response
to a specific request for information from a member of the list where
he asked for alternate, equivalent solutions and for a comparison of
the "price, efficiency and security".

>  Well the secure solution from HP is a secure web-server right? - with a nice
>  secure design (Virtual Vault, somthing which was implemented in the mainframe
>  world a long time ago.)
>  
>  Firewall-1 is a firewall, Argus a security plug-in for it to reach B level
>  security.  thats something completly different.

You are not correct on either count.  The solution that Larry asked about

    http://www.ebizsoftware.hp.com/virtualv/hpcisc23.html

is a combination firewall and webserver running on a trusted OS (but not
quite B1).  The VV is a special version of HPUX running with two B1-style
compartments, one for the "inside" and one for the "outside".  VV also
includes a web server and a trusted/secure gateway to allow communication
between the two compartments.

If you take Firewall-1 sitting in front of a Solaris box running both
Argus security and a web server, you exceed the functionality and security
compared to the solution Larry asked about (except, as I mentioned, you
don't get the load balancing provided by CISCO).  For example, you can run
ANY application on the server (VV restricts you to a very small number),
you can run each application in its own security domain/compartment (not
just the two that VV is limited to), you can use other security features
not present in VV (such as OS state based security and capabilities), and
the base OS has been evaluated and subjected to official penetration testing
by an independent, licensed third party.

>  If you need a very secure web server, and you've got enough money, HP's
>  product is good. If you want a nice firewall, take a stateful-inspection
>  firewall (like fw-1) or application gateway (like gauntlet, altavista '97
>  etc.) - whatever is needed - or build you own cheap solution with OpenBSD or
>  Linux ...

The VV solution isn't bad, and I believe it is definitely stronger than
solutions where the server is a standard OS.  No one who wants to protect
a web server should be running it on an unmodified operating system.  If
you don't really care if the server gets trashed, of course it doesn't
matter what OS you use...

paul

---------------------------------------------------------
Paul McNabb                     Argus Systems Group, Inc.
Vice President and CTO          1809 Woodfield Drive
mcnabb@argus-systems.com        Savoy, IL 61874 USA
TEL 217-355-6308
FAX 217-355-1433                "Securing the Future"
---------------------------------------------------------

From firewalls-owner  Wed Jan 14 20:20:32 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id TAA01039; Wed, 14 Jan 1998 19:25:17 -0800 (PST)
Received: from imo11.mx.aol.com (imo11.mx.aol.com [198.81.19.165]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id TAA00957 for <firewalls-digest@GreatCircle.COM>; Wed, 14 Jan 1998 19:24:58 -0800 (PST)
From: DaDe 0Co0L <DaDe0Co0L@aol.com>
Message-ID: <7df4f6f5.34bd7e89@aol.com>
Date: Wed, 14 Jan 1998 22:12:07 EST
To: z76399@upr.com, firewalls-digest@GreatCircle.COM
Subject: Re: port config between trusted net and untrusted net
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7bit
Organization: AOL (http://www.aol.com)
X-Mailer: Inet_Mail_Out (IMOv11)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Can someone send me a firewall.

From firewalls-owner  Wed Jan 14 20:58:47 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id TAA06089; Wed, 14 Jan 1998 19:47:19 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id TAA05924 for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 19:46:47 -0800 (PST)
Received: from mcfeely.bsfs.org by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-970426)
	id TAA06964; Wed, 14 Jan 1998 19:46:55 -0800 (PST)
Received: (from wombat@localhost) by mcfeely.bsfs.org (8.6.12/8.6.12) id IAA10813; Wed, 14 Jan 1998 08:39:21 -0500
Date: Wed, 14 Jan 1998 08:39:18 -0500 (EST)
From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: Don Martin <grey@usa.net>
cc: cbrenton@sover.net, Sick Puppy <sikpuppy@maestro.com>,
        firewalls@GreatCircle.COM
Subject: Re: Wannabe needs a good book
In-Reply-To: <34BD0154.F1637944@usa.net>
Message-ID: <Pine.BSF.3.91.980114083521.10641L-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Sik Puppy's Guide to Networking
Table of Contents

Ch.1 ... Hacking from home will land you in the pound ....  p.3
Ch.2 ... Never pee on the -48VDC Rectifier ...............  p.19
Ch.3

 
On Wed, 14 Jan 1998, Don Martin wrote:

> I thought for a second Sick Puppy wrote a book on networking.... I can't
> describe my initial thoughts on this... but I think I would buy it
> anyway....
> 
> Chris Brenton wrote:
> 
> > Sick Puppy wrote:

From firewalls-owner  Wed Jan 14 21:30:57 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id SAA19745; Wed, 14 Jan 1998 18:33:30 -0800 (PST)
Received: from out4.ibm.net (out4.ibm.net [165.87.194.239]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id SAA19716 for <firewalls@greatcircle.com>; Wed, 14 Jan 1998 18:33:15 -0800 (PST)
From: daemond@ibm.net
Received: from master.ibmcyrix.org (slip129-37-123-246.mo.us.ibm.net [129.37.123.246]) by out4.ibm.net (8.8.5/8.6.9) with SMTP id CAA39036 for <firewalls@greatcircle.com>; Thu, 15 Jan 1998 02:34:50 GMT
Date: Wed, 14 Jan 1998 21:44:44 -0500 (EST)
X-Sender: daemond@master.ibmcyrix.org
To: firewalls@greatcircle.com
Subject: Fraudulent SAs - more 
Message-ID: <Pine.NEB.3.96.980114213650.10096A-100000@master.ibmcyrix.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

First, thank you to all the people who have been sending me many ideas of
how exactly to deal with the two SAs.  I now have many options at my
finger tips and am trying to decide exactly which one I'm going to do.  Now
here's something interesting I ran into today: one of the SAs is in my
CSC-241 class learning Data Structures and Algorithms in C.  I'm still
trying to figure out why these guys are here.  Shouldn't he be doing
something more important like trying to keep the network from crashing every
so often and tightening security?  Oh well.  I've got the advantage of
surprise still so I'd better carefully think out my plan of attack (only one
real shot to give my 2 cents before they fight back).  Thanks again to all the
suggestions and ideas.  I'm thinking along the lines of drafting my solution
and getting it to float around this might prove effective.  L8r.

-----------------------------------------------------------------------------
Geoff Gowey		| NetBSD: the best multi-platform OS 
daemond(at)ibm.net	| www.netbsd.org
*****************************************************************************
Spammers beware: I do not buy from companies that spam and I keep track!
Above policy STRICTLY ENFORCED!
*****************************************************************************
"All I ask is for the chance to prove that money can't buy me happiness"
or more simply put "SHOW ME THE MONEY!!!"


From firewalls-owner  Wed Jan 14 22:29:07 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id UAA11359; Wed, 14 Jan 1998 20:21:29 -0800 (PST)
Received: from imo19.mx.aol.com (imo19.mx.aol.com [198.81.19.176]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id UAA11313 for <Firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 20:21:15 -0800 (PST)
From: Fishpizza <Fishpizza@aol.com>
Message-ID: <9276ef70.34bd8d5c@aol.com>
Date: Wed, 14 Jan 1998 23:15:22 EST
To: Firewalls@GreatCircle.COM
Subject: Re: Firewalls-Digest V7 #7
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7bit
Organization: AOL (http://www.aol.com)
X-Mailer: Inet_Mail_Out (IMOv11)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Please stop sending me this.  I am not interested

From firewalls-owner  Wed Jan 14 22:41:43 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id TAA06111; Wed, 14 Jan 1998 19:47:26 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id TAA05934 for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 19:46:49 -0800 (PST)
Received: from mh2.cts.com by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-970426)
	id TAA06966; Wed, 14 Jan 1998 19:46:57 -0800 (PST)
Received: from king.cts.com (root@king.cts.com [198.68.168.21]) by mh2.cts.com (8.8.7/8.8.5) with ESMTP id TAA04044; Wed, 14 Jan 1998 19:48:05 -0800 (PST)
Received: from crash.cts.com (root@crash.cts.com [192.188.72.17])
	by king.cts.com (8.8.7/8.8.7) with SMTP id SAA09638;
	Wed, 14 Jan 1998 18:47:01 -0800 (PST)
Received: from jcski by crash.cts.com with smtp
	(Smail3.1.29.1 #5) id m0xsfKa-0000BlC; Wed, 14 Jan 98 18:46 PST
Message-ID: <018c01bd215f$f2b26830$fb48bcc0@jcski>
From: "Jim Raykowski" <jimrski@cts.com>
To: "John Pettitt" <jpp@cybersource.com>, <firewalls@GreatCircle.COM>
Cc: <daemond@ibm.net>
Subject: Re: Freelance internal hacking a bad idea (was: Exposing fraudulent SA's)
Date: Wed, 14 Jan 1998 18:47:38 -0800
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 4.72.2106.4
X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

John,
  You are exactly right!  I should have preference that whole statement with
"GET THE MGMT PERMISSION FIRST" that way you &^% is covered.
Thanks for the correction!!
TTFN,
Jim Raykowski
jimrski@cts.com

Trying to Learn, Administer, Manage and Secure NT.  What
an impossible job!!!!!!!!!!!!!!!!!!!!!!!!!!!
-----Original Message-----
From: John Pettitt <jpp@cybersource.com>
To: firewalls@GreatCircle.COM <firewalls@GreatCircle.COM>
Cc: daemond@ibm.net <daemond@ibm.net>
Date: Wednesday, January 14, 1998 1:51 PM
Subject: Freelance internal hacking a bad idea (was: Exposing fraudulent
SA's)


>
>Jim Raykowski <jimrski@cts.com> wrote in reply to Geoff Gowey
>daemond@ibm.net with suggestions to hack te interal net then show the SA's
>and/or management.
>
>This is A BAD IDEA(tm) hacking the interal net without an explicit
>(preferably written) OK from management is a good way to get fired and/or
>end up in court.    If the SA's are not a stupid as you think and they spot
>you the excuse that you were running a seurity check is probably not going
>to fly
>
>Better to write to management (and keep a copy) telling them that you
>suspect poor security and suggesting an independent audit (which you will
>carry out).   You many not get the audit but your letter will be on file if
>it hits the fan later.
>
>John
>
>


From firewalls-owner  Wed Jan 14 22:44:25 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id UAA10513; Wed, 14 Jan 1998 20:16:49 -0800 (PST)
Received: from mcfeely.bsfs.org (mcfeely.bsfs.org [204.91.13.34]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id TAA06451 for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 19:49:27 -0800 (PST)
Received: (from wombat@localhost) by mcfeely.bsfs.org (8.6.12/8.6.12) id IAA10823; Wed, 14 Jan 1998 08:42:38 -0500
Date: Wed, 14 Jan 1998 08:42:35 -0500 (EST)
From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: Eric Bresie <ebresie@ccwf.cc.utexas.edu>
cc: firewalls@GreatCircle.COM
Subject: Re: FAQ Request
In-Reply-To: <34BD213E.F24F9E0D@ccwf.cc.utexas.edu>
Message-ID: <Pine.BSF.3.91.980114084203.10641M-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


FAQ, archives, and digest available via:

http://www.greatcircle.com/lists/firewalls/

-r.w.

On Wed, 14 Jan 1998, Eric Bresie wrote:

> I was wondering if there was a FAQ file for this mailing list...before I
> start asking questions I need not ask.
> 
> ====/------ Breezy ---------------------------/
> ===/----  ebresie@ccwf.cc.utexas.edu -------/
> ==/----  http://ccwf.cc.utexas.edu/~ebresie --/
> 
> 
> 

From firewalls-owner  Wed Jan 14 22:48:21 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id UAA10867; Wed, 14 Jan 1998 20:18:41 -0800 (PST)
Received: from eshu.request.net (mail.request.net [207.48.133.2]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id TAA06059 for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 19:47:12 -0800 (PST)
Received: from max.net ([208.204.15.2]) by eshu.request.net with ESMTP id <1395-13690>; Wed, 14 Jan 1998 22:48:08 -0500
Received: from zap-mama ([134.7.136.12]) by max.net with SMTP id <1949-17412>; Wed, 14 Jan 1998 22:47:55 -0500
Message-Id: <3.0.3.32.19980115114822.0099a120@bwa.net>
X-Sender: lists@bwa.net
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: 	Thu, 15 Jan 1998 11:48:22
To: Eric Bresie <ebresie@ccwf.cc.utexas.edu>
From: Bret Watson <lists@bwa.net>
Subject: Re: FAQ Request
Cc: firewalls@GreatCircle.COM
In-Reply-To: <34BD213E.F24F9E0D@ccwf.cc.utexas.edu>
References: <34BC9D5F.EC999D53@bnetd.sita.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


>I was wondering if there was a FAQ file for this mailing list...before I
>start asking questions I need not ask.

There is a copy of teh firewalls FAQ as well as teh NT Security FAQ at
http://www.ticm.com/about/faq.html

Cheers,

Bret
Technical Incursion Countermeasures 
consulting@bwa.net                      http://www.ticm.com/
ph: (+61)(08) 9454 2487(UTC+8 hrs)      fax: (+61)(08) 9429 8800

The Insider - a e'zine on Computer security
http://www.ticm.com/about/insider.html

From firewalls-owner  Wed Jan 14 23:49:25 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id WAA10995; Wed, 14 Jan 1998 22:25:45 -0800 (PST)
Received: from iproute.com (iproute.com [166.78.1.1]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id WAA10972 for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 22:25:35 -0800 (PST)
From: mikech@avana.net
Received: from att (att.iproute.com [192.168.0.4])
          by iproute.com (8.8.4/8.8.4) with SMTP
	  id BAA13912 for <firewalls@GreatCircle.COM>; Thu, 15 Jan 1998 01:27:21 -0500
Date: Thu, 15 Jan 1998 01:16:57 -0500
Subject: Secure Chat?
To: "'firewalls@greatcircle.com'"  <firewalls@GreatCircle.COM>
X-Mailer: Z-Mail Pro 6.1 (Win32 - 021297) Evaluation Copy, NetManage Inc.
X-Priority: 3 (Normal)
References: <21905E09B270D111815400C0DFAA15331E05@tgb-mailhost.portcullis-security.com> 
Message-ID: <Chameleon.884845624.mikech@att>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; CHARSET=ISO-8859-1
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hello:

I am looking for a secure real-time chat client that is accesible
from a web page. I have remote students that need to chat in real-time
with instructors through a web site and I need to minimize the chances
that anyone could listen in. I don't want to have to load client
software on the student's PCs. I want it to be secure with just a
Netscape or MSIE browser.

I looked at a couple of real-time Java chats that had the feel
of IRC but none were secure. Any ideas out there?

Thanks in advance,

Mike
--
01:16:58
01/15/98
_______________________________________________________________________
Michael W. Chalkley                                Tel: +1.770.772.4567
ZapNet! Inc.                                       Fax: +1.770.475.7640
Suite 400-120                                E-mail: mikech@iproute.com
10945 State Bridge Road                                mikech@avana.net
Alpharetta, GA 30202                             http://www.iproute.com


From firewalls-owner  Thu Jan 15 00:04:35 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id UAA11146; Wed, 14 Jan 1998 20:20:24 -0800 (PST)
Received: from mcfeely.bsfs.org (mcfeely.bsfs.org [204.91.13.34]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id SAA24593 for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 18:56:22 -0800 (PST)
Received: (from wombat@localhost) by mcfeely.bsfs.org (8.6.12/8.6.12) id HAA10672; Wed, 14 Jan 1998 07:49:15 -0500
Date: Wed, 14 Jan 1998 07:49:12 -0500 (EST)
From: Rabid Wombat <wombat@mcfeely.bsfs.org>
To: Ramamonjisoa Charles Emile <ramamonjisoa@bnetd.sita.net>
cc: firewalls@GreatCircle.COM
Subject: Re: IP addresses
In-Reply-To: <34BC9D5F.EC999D53@bnetd.sita.net>
Message-ID: <Pine.BSF.3.91.980114074854.10641B-100000@mcfeely.bsfs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Investigate BGP.

On Wed, 14 Jan 1998, Ramamonjisoa Charles Emile wrote:

> Hello,
>         We have to realize an important project to become the
> provider of internet services for the government of Cote d'Ivoire.
> 
>         We run in an unusual configuration because we connect our
> node to the Internet with TWO ISPs ( yes 2 ISPs). So, I want to
> get your feedback comments on the following configuration and
> mostly HOW to manage the IP addresses ISP1 and ISP2 will give us.
> 
> Configuration
> 
> 
>                                 ------------------------
>                                 !           Router             !
> --------------------> ISP1
>                                 !
> ! --------------------> ISP2
>                                 ------------------------
>                                     !            !            !
>                                     !            !
> !--------------------> RAS
>     Public Servers<-----!            !
>                                             Firewall
>                                                  !
>                                             Intranet
> 
>         TIA
>         R. Charles Emile
> 
> 

From firewalls-owner  Thu Jan 15 00:09:46 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id WAA07051; Wed, 14 Jan 1998 22:07:02 -0800 (PST)
Received: from gateway.mpath.com (gateway.mpath.com [204.242.182.129]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id WAA07014 for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 22:06:44 -0800 (PST)
Received: from mpath.com (nodserv.mpath.com [206.233.214.16])
	by gateway.mpath.com (8.8.5/8.8.5) with ESMTP id WAA14532;
	Wed, 14 Jan 1998 22:08:29 -0800 (PST)
Received: from localhost (vision@localhost)
	by mpath.com (8.8.5/8.8.5) with SMTP id WAA11918;
	Wed, 14 Jan 1998 22:07:50 -0800 (PST)
Date: Wed, 14 Jan 1998 22:07:49 -0800 (PST)
From: Max Vision <vision@mpath.com>
To: daemond@ibm.net
cc: firewalls@GreatCircle.COM
Subject: Re: Fraudulent SAs - more 
In-Reply-To: <Pine.NEB.3.96.980114213650.10096A-100000@master.ibmcyrix.org>
Message-ID: <Pine.SOL.3.95.980114220006.10609C-100000@nodserv.mpath.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

  With all due respect, I think you might do well to re-evaluate this
situation not as a "plan of attack", but rather an opportunity to help
your school, and to possibly advance your own status there.
  Research _exactly_ what it is that you feel is wrong with the system in
_specific_ and you'll find that people will listen to you!  You may feel
that you are "giving up" holes and they will patch those and go back to
being sloppy - but don't let that stop you.  Tell them and their superiors
exactly what you see that is wrong, and if you are paying attention, you
will surely find more and more problems.  (Beleive me, there are always
system or network problems)  They will see the value in what you've done
for them.  Make sure you're not coming off antagonistic, but rather as
concerned (despite any frustration you may have), and this will also go a
long way towards making them feel better about you.

Good luck!
Max (Unix/Web/Security Admin)

On Wed, 14 Jan 1998 daemond@ibm.net wrote:

> First, thank you to all the people who have been sending me many ideas of
> how exactly to deal with the two SAs.  I now have many options at my
> finger tips and am trying to decide exactly which one I'm going to do.  Now
> here's something interesting I ran into today: one of the SAs is in my
> CSC-241 class learning Data Structures and Algorithms in C.  I'm still
> trying to figure out why these guys are here.  Shouldn't he be doing
> something more important like trying to keep the network from crashing every
> so often and tightening security?  Oh well.  I've got the advantage of
> surprise still so I'd better carefully think out my plan of attack (only one
> real shot to give my 2 cents before they fight back).  Thanks again to all the
> suggestions and ideas.  I'm thinking along the lines of drafting my solution
> and getting it to float around this might prove effective.  L8r.
> 
> -----------------------------------------------------------------------------
> Geoff Gowey		| NetBSD: the best multi-platform OS 
> daemond(at)ibm.net	| www.netbsd.org
> *****************************************************************************
> Spammers beware: I do not buy from companies that spam and I keep track!
> Above policy STRICTLY ENFORCED!
> *****************************************************************************
> "All I ask is for the chance to prove that money can't buy me happiness"
> or more simply put "SHOW ME THE MONEY!!!"
> 
> 


From firewalls-owner  Thu Jan 15 00:43:12 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id RAA09416; Wed, 14 Jan 1998 17:38:13 -0800 (PST)
Received: from diablo.cisco.com (diablo.cisco.com [171.68.223.106]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id RAA09347 for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 17:37:57 -0800 (PST)
Received: from big-dawgs.cisco.com (herndon-dhcp-53.cisco.com [171.68.53.53]) by diablo.cisco.com (8.8.5/CISCO.SERVER.1.2) with SMTP id RAA27061; Wed, 14 Jan 1998 17:39:09 -0800 (PST)
Message-Id: <3.0.5.32.19980114203908.00804910@lint.cisco.com>
X-Sender: pferguso@lint.cisco.com
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.5 (32)
Date: Wed, 14 Jan 1998 20:39:08 -0500
To: Eric Bresie <ebresie@ccwf.cc.utexas.edu>
From: Paul Ferguson <ferguson@cisco.com>
Subject: Re: FAQ Request
Cc: firewalls@GreatCircle.COM
In-Reply-To: <34BD213E.F24F9E0D@ccwf.cc.utexas.edu>
References: <34BC9D5F.EC999D53@bnetd.sita.net>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

See:

 http://www.clark.net/pub/mjr/pubs/fwfaq/

- paul

At 02:34 PM 1/14/98 -0600, Eric Bresie wrote:

>I was wondering if there was a FAQ file for this mailing list...before I
>start asking questions I need not ask.
>
>====/------ Breezy ---------------------------/
>===/----  ebresie@ccwf.cc.utexas.edu -------/
>==/----  http://ccwf.cc.utexas.edu/~ebresie --/
>
>
>
>

From firewalls-owner  Thu Jan 15 05:40:41 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id CAA26732; Thu, 15 Jan 1998 02:45:18 -0800 (PST)
Received: from mycroft.GreatCircle.COM (mycroft.greatcircle.com [198.102.244.35]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id CAA26125 for <firewalls@GreatCircle.COM>; Thu, 15 Jan 1998 02:30:48 -0800 (PST)
Received: from dns.portcullis-security.com by mycroft.GreatCircle.COM (8.8.5/SMI-4.1/Brent-970426)
	id CAA10512; Thu, 15 Jan 1998 02:16:33 -0800 (PST)
Received: from tgb-mailhost.portcullis-security.com (unverified [194.203.128.123]) by dns.portcullis-security.com
 (Integralis SMTPRS 2.04) with ESMTP id <B0000002964@dns.portcullis-security.com>;
 Thu, 15 Jan 1998 10:17:34 +0000
Received: by tgb-mailhost.portcullis-security.com with Internet Mail Service (5.0.1457.3)
	id <CM83FV1V>; Thu, 15 Jan 1998 10:12:01 -0000
Message-Id: <21905E09B270D111815400C0DFAA15331E12@tgb-mailhost.portcullis-security.com>
From: Thomas Liam Romanis <TLR@portcullis-security.com>
To: "'firewalls@greatcircle.com'" <firewalls@GreatCircle.COM>
Subject: FW: Content filtering
Date: Thu, 15 Jan 1998 10:12:00 -0000
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1457.3)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



> ----------
> From: 	Thomas Liam Romanis
> Sent: 	Wednesday, January 14, 1998 7:30PM
> To: 	'jlau@hotmail.com'; 'firewalls@greatcircle.com'
> Cc: 	Mark S Lane; Paul J Docherty
> Subject: 	FW: Content filtering
> 
> resend
> > ----------
> > From: 	Thomas Liam Romanis
> > Sent: 	Wednesday, January 14, 1998 7:22PM
> > To: 	'marc.vael'
> > Cc: 	Paul J Docherty; Mark S Lane
> > Subject: 	RE: Content filtering
> > 
> > As Mr Vael replied MIMEsweeper is a very good product for content
> > analysis for blocking viruses (if the av tool used can detect),
> > lexical analysis, blocking junk mail, blocking attachments or
> > particular files types such as EXE'S, COM'S, Binary, MOV'S, MPEG'S
> > ETC... as well as allowing you to add sections to mail such as legal
> > disclaimers. It can also be used to block Java and ActiveX controls.
> 
> > 
> > Other products you may wish to look at on this area are FINJAN's
> > Surfin' Sheild(Desktop java & activex protection), Surfin' Gate
> > etc..... 
> > www.finjan.com
> > www.portcullis-security.com
> > 
> > AbirNet SessionWall - Verbose logging of all TCP/IP traffic and
> > blocking if required.
> > 
> > The problem is that whilst products like MIMEsweeper are excellent
> at
> > their job they do need to be protected. I.E. a firewall is a good
> > idea.
> > 
> > Have a look at BIGfire firewall. - BlackBox approach, screening
> Router
> > and packet filter. It allows you for instance to allow users on your
> > internal network to browse the web but will not allow HTTP
> connections
> > to be made to your internal network from the internet. Or to your
> > intranet from unauthorised networks or specific IP addresses. This
> > idea follows for every protocol in the stack. 
> > www.biodata.de, www.portcullis-security.com.
> >  
> > It all depend on what you are trying to achieve, let us know.
> > 
> > Cheers, Liam Romanis, Technical Manager, Portcullis Computer
> Security
> > Ltd.
> > ----------
> > From: 	marc.vael[SMTP:marc.vael@ArthurAndersen.com]
> > Sent: 	Wednesday, January 14, 1998 4:21PM
> > To: 	james lau; firewalls; jlau
> > Subject: 	Re: Content filtering
> > 
> > Hello James,
> > 
> > I also have a pretty good reference in the industry
> > 
> > MIMEsweeper
> > which is the content security tool for networks (V3.0 already)
> > It is a UK product developed about 5 years ago
> > 
> > A lot of banks and government organizations in Europe are using this
> > tool.
> > 
> > Main functions :
> > - bidirectional (in/out)
> > - block virusses from web, e-mail and FTP
> > - manage junk e-mail
> > - block URL or webpages with certain words / sentences
> > - add legal disclaimers
> > - block java applets / scripts / cookies
> > 
> > See the following site for more info
> > http://www.mimesweeper.integralis.com
> > 
> > also available in the US (Integralis inc. in Washington)
> > 
> > Regards,
> > 
> > Marc Vael
> > Arthur Andersen
> > 
> > At 02:57 PM 1/7/98 PST, James Lau wrote:
> > >Hello all,
> > >This may be a little bit off topic but please bare with me or 
> > >points me to a right mailing list.
> > >
> > >I'm looking for a solution to filter the contents of web traffics,
> > >ftp files and email.  I know this is not totally firewall related
> > >but there are a few firewall products can do that. (That's why I
> > >ask.)  Unfortunately most (may be all) of them use proxy which
> > >require changes of configuration which we cannot force my users
> > >to do.  Is there any solution out there which doesn't require
> > >changing of configuration?  Or is the proxy the only solution?
> > >Any ideas?
> > >Thanks in advance.
> > >James
> > >______________________________________________________
> > >Get Your Private, Free Email at http://www.hotmail.com
> > 
> > 
> 

From firewalls-owner  Thu Jan 15 05:47:35 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id CAA26290; Thu, 15 Jan 1998 02:34:20 -0800 (PST)
Received: from relay.kacst.edu.sa (ns1.kacst.edu.sa [198.77.88.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id CAA26254 for <firewalls@GreatCircle.COM>; Thu, 15 Jan 1998 02:33:38 -0800 (PST)
Received: from ns1.kfupm.edu.sa ([198.77.102.26]) by relay.kacst.edu.sa (8.7.5/8.7.3) with ESMTP id NAA25259 for <firewalls@GreatCircle.COM>; Thu, 15 Jan 1998 13:30:10 -0300 (GMT)
Received: from dpc107.dpc.kfupm.edu.sa ([196.15.32.8]) by ns1.kfupm.edu.sa (8.7.5/8.7.3) with ESMTP id NAA63406 for <firewalls@GreatCircle.COM>; Thu, 15 Jan 1998 13:28:28 +0300
Received: (from g854690@localhost) by dpc107.dpc.kfupm.edu.sa (8.7.5/8.7.3) id NAA30640; Thu, 15 Jan 1998 13:33:54 +0300
Date: Thu, 15 Jan 1998 13:33:54 +0300 (SAUST)
From: Juggernaut <g854690@dpc.kfupm.edu.sa>
To: firewalls@GreatCircle.COM
Subject: digest
Message-ID: <Pine.A32.3.91.980115133033.71008B-100000@dpc107.dpc.kfupm.edu.sa>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


I'm sorry if I may get off topic for a minte, how can I set Firewall to 
digest form; or can't I? I'm not familiar with majordomos 

TIA

jn

From firewalls-owner  Thu Jan 15 05:50:29 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id CAA24931; Thu, 15 Jan 1998 02:12:52 -0800 (PST)
Received: from dns.portcullis-security.com (dns.portcullis-security.com [194.203.128.120]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id CAA24904 for <firewalls-digest@greatcircle.com>; Thu, 15 Jan 1998 02:12:21 -0800 (PST)
Received: from tgb-mailhost.portcullis-security.com (unverified [194.203.128.123]) by dns.portcullis-security.com
 (Integralis SMTPRS 2.04) with ESMTP id <B0000002963@dns.portcullis-security.com>;
 Thu, 15 Jan 1998 10:14:13 +0000
Received: by tgb-mailhost.portcullis-security.com with Internet Mail Service (5.0.1457.3)
	id <CM83FV1T>; Thu, 15 Jan 1998 10:08:41 -0000
Message-Id: <21905E09B270D111815400C0DFAA15331E11@tgb-mailhost.portcullis-security.com>
From: Thomas Liam Romanis <TLR@portcullis-security.com>
To: "'SMTP:z76399@upr.com'" <SMTP:z76399@upr.com>
Cc: "'firewalls-digest@greatcircle.com'"
	 <firewalls-digest@greatcircle.com>
Subject: RE: port config between trusted net and untrusted net
Date: Thu, 15 Jan 1998 10:08:38 -0000
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1457.3)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

What is your firewall? It sounds like the probable solution for you
would be some sort of screening router/packet filter. Or perhaps not.
What service are you wanting to run on this port? Are the machines
outside the protected network which you want to be able to connect
through port 400  specific authorised IP's? Do you want the data along
this route to be protected/encrypted? Do you want authorised users from
outside to be able to securely access resources within the secure
network? If so you may be better off using somesort of encrypted
tunneling requiring the users to login to the protected domain securely
on a specific port before they can gain access there after data transfer
will be tunneled.

i.e.
                     ____p400___+++++++___encrypted logon and tunnel___
++++++++++                    ++++++++
+ secure      +___http____ +firewall +____allowed out_____
+   network  +                    ++++++++
++++++++++ ____smtp___+++++++____allowed in_______

Have a look at www.datafellows.com
                     www.europe.datafellows.com
	         www.biodata.de
	         www.portcullis-security.com



> ----------
> From: 	Prahl V. E. (Von)[SMTP:z76399@upr.com]
> Sent: 	Wednesday, January 14, 1998 11:07PM
> To: 	firewalls-digest@greatcircle.com
> Subject: 	port config between trusted net and untrusted net
> 
> Greetings,
> 
> 
> I want configure my firewall to allow tcp traffic from the inside to
> an outside address on a specific destination port, eg 400.  I then
> need to
> allow tcp traffic from that outside address through the firewall to 
> machines inside the firewll on port 400.  I want to use a plug-gw.
> 
> All help will be greatly rewarded.
> 
> 
> Von
> 

From firewalls-owner  Thu Jan 15 06:50:20 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id BAA19478; Thu, 15 Jan 1998 01:39:15 -0800 (PST)
Received: from harvest.i-way.co.uk (harvest.i-way.co.uk [194.129.192.12]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id BAA19457 for <firewalls@greatcircle.com>; Thu, 15 Jan 1998 01:39:05 -0800 (PST)
Received: from stevege.i-way.co.uk ([194.207.109.9])
	by harvest.i-way.co.uk (8.8.5/8.8.5) with SMTP id JAA04304
	for <firewalls@greatcircle.com>; Thu, 15 Jan 1998 09:56:59 GMT
Message-Id: <3.0.1.32.19980115093831.007c37c0@popmail.i-way.co.uk>
X-Sender: stevege@popmail.i-way.co.uk
X-Mailer: Windows Eudora Light Version 3.0.1 (32)
Date: Thu, 15 Jan 1998 09:38:31 +0000
To: firewalls@greatcircle.com
From: Steve George <stevege@i-way.co.uk>
Subject: Re: Content filtering
In-Reply-To: <9801141642.AA5265@notes2.compuserve.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Hi,

I only just joined tis list so apologies if I repeat something already said
earlier in the thread.

MIMEsweeper is very good - it consists of two portions Mailsweeper and
Websweeper.  You provide it with a virus checker as a plugin.  My only
proviso with it has been that the manual is pretty rubbish, all marketing
and little organised content.  However, I have mailed their support on
occasion and they were quick/quite helpful.

>From the original mail you say you can't force users to use a proxy.  My
understanding of this product (and in fact all content checkers) is that
the client has to make the request through the proxy so that the web page
content can be checked before it gets back to the client.  The MIMEsweeper
manual which is hidden on the site explains this, have a look at:
http://www.mimesweeper.com/downloads/Manual/manual.htm

The only other thing I can think of is putting some sort of product on
every single client :(

Good luck,
Steve

At 16:21 14/01/98, you wrote:
>Hello James,
>
>I also have a pretty good reference in the industry
>
>MIMEsweeper
>which is the content security tool for networks (V3.0 already)
>It is a UK product developed about 5 years ago
>
>A lot of banks and government organizations in Europe are using this tool.
>
>Main functions :
>- bidirectional (in/out)
>- block virusses from web, e-mail and FTP
>- manage junk e-mail
>- block URL or webpages with certain words / sentences
>- add legal disclaimers
>- block java applets / scripts / cookies
>
>See the following site for more info
>http://www.mimesweeper.integralis.com
>
>also available in the US (Integralis inc. in Washington)
>
>Regards,
>
>Marc Vael
>Arthur Andersen
>
>At 02:57 PM 1/7/98 PST, James Lau wrote:
>>Hello all,
>>This may be a little bit off topic but please bare with me or 
>>points me to a right mailing list.
>>
>>I'm looking for a solution to filter the contents of web traffics,
>>ftp files and email.  I know this is not totally firewall related
>>but there are a few firewall products can do that. (That's why I
>>ask.)  Unfortunately most (may be all) of them use proxy which
>>require changes of configuration which we cannot force my users
>>to do.  Is there any solution out there which doesn't require
>>changing of configuration?  Or is the proxy the only solution?
>>Any ideas?
>>Thanks in advance.
>>James
>>______________________________________________________
>>Get Your Private, Free Email at http://www.hotmail.com
>
>


From firewalls-owner  Thu Jan 15 06:56:42 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id CAA25924; Thu, 15 Jan 1998 02:29:02 -0800 (PST)
Received: from relay.kacst.edu.sa (ns1.kacst.edu.sa [198.77.88.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id CAA25887 for <firewalls@GreatCircle.COM>; Thu, 15 Jan 1998 02:28:40 -0800 (PST)
Received: from ns1.kfupm.edu.sa ([198.77.102.26]) by relay.kacst.edu.sa (8.7.5/8.7.3) with ESMTP id NAA25197 for <firewalls@GreatCircle.COM>; Thu, 15 Jan 1998 13:25:11 -0300 (GMT)
Received: from dpc107.dpc.kfupm.edu.sa ([196.15.32.8]) by ns1.kfupm.edu.sa (8.7.5/8.7.3) with ESMTP id NAA103048 for <firewalls@GreatCircle.COM>; Thu, 15 Jan 1998 13:23:34 +0300
Received: (from g854690@localhost) by dpc107.dpc.kfupm.edu.sa (8.7.5/8.7.3) id NAA50983; Thu, 15 Jan 1998 13:29:20 +0300
Date: Thu, 15 Jan 1998 13:29:20 +0300 (SAUST)
From: Juggernaut <g854690@dpc.kfupm.edu.sa>
To: firewalls@GreatCircle.COM
Subject: Re: Fraudulent SAs - more 
In-Reply-To: <Pine.SOL.3.95.980114220006.10609C-100000@nodserv.mpath.com>
Message-ID: <Pine.A32.3.91.980115125135.41268C-100000@dpc107.dpc.kfupm.edu.sa>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


With all due respect, I think you all empathize with the SAdmins because 
you are ones too. I understand the 2 guys came across as arrogant and 
unwilling to listen and take his genuine observations seriously.. a "measly 
freshman". He's done his dues by going to them the first time around. I 
think you should give them a last chance, Geoff, by taking your 
observations right to their superiors and when all that fails, you owe 
it to yourself to have fun crashing their systems while making yourself a 
better Sys Admin too if you ever think of becomeing one... We know that 
hackers are far better programmers... make sure you don't exploit the very 
weaknesses pointed out to them by you earlier.. I mean, being a good hacker 
is one thing but not getting caught is another.. no big damage ofcourse.. 
just a couple of warning shots.. enuff to get them warning shots from their 
management

jn

On Wed, 14 Jan 1998, Max Vision wrote:

>   With all due respect, I think you might do well to re-evaluate this
> situation not as a "plan of attack", but rather an opportunity to help
> your school, and to possibly advance your own status there.
>   Research _exactly_ what it is that you feel is wrong with the system in
> _specific_ and you'll find that people will listen to you!  You may feel
> that you are "giving up" holes and they will patch those and go back to
> being sloppy - but don't let that stop you.  Tell them and their superiors
> exactly what you see that is wrong, and if you are paying attention, you
> will surely find more and more problems.  (Beleive me, there are always
> system or network problems)  They will see the value in what you've done
> for them.  Make sure you're not coming off antagonistic, but rather as
> concerned (despite any frustration you may have), and this will also go a
> long way towards making them feel better about you.
> 
> Good luck!
> Max (Unix/Web/Security Admin)
> 
> On Wed, 14 Jan 1998 daemond@ibm.net wrote:
> 
> > First, thank you to all the people who have been sending me many ideas of
> > how exactly to deal with the two SAs.  I now have many options at my
> > finger tips and am trying to decide exactly which one I'm going to do.  Now
> > here's something interesting I ran into today: one of the SAs is in my
> > CSC-241 class learning Data Structures and Algorithms in C.  I'm still
> > trying to figure out why these guys are here.  Shouldn't he be doing
> > something more important like trying to keep the network from crashing every
> > so often and tightening security?  Oh well.  I've got the advantage of
> > surprise still so I'd better carefully think out my plan of attack (only one
> > real shot to give my 2 cents before they fight back).  Thanks again to all the
> > suggestions and ideas.  I'm thinking along the lines of drafting my solution
> > and getting it to float around this might prove effective.  L8r.
> > 
> > -----------------------------------------------------------------------------
> > Geoff Gowey		| NetBSD: the best multi-platform OS 
> > daemond(at)ibm.net	| www.netbsd.org
> > *****************************************************************************
> > Spammers beware: I do not buy from companies that spam and I keep track!
> > Above policy STRICTLY ENFORCED!
> > *****************************************************************************
> > "All I ask is for the chance to prove that money can't buy me happiness"
> > or more simply put "SHOW ME THE MONEY!!!"
> > 
> > 
> 
> 



From firewalls-owner  Thu Jan 15 07:06:58 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id BAA21375; Thu, 15 Jan 1998 01:52:26 -0800 (PST)
Received: from dns.portcullis-security.com (dns.portcullis-security.com [194.203.128.120]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id BAA21035 for <firewalls@greatcircle.com>; Thu, 15 Jan 1998 01:50:59 -0800 (PST)
Received: from tgb-mailhost.portcullis-security.com (unverified [194.203.128.123]) by dns.portcullis-security.com
 (Integralis SMTPRS 2.04) with ESMTP id <B0000002960@dns.portcullis-security.com>;
 Thu, 15 Jan 1998 09:52:59 +0000
Received: by tgb-mailhost.portcullis-security.com with Internet Mail Service (5.0.1457.3)
	id <CM83FV1Q>; Thu, 15 Jan 1998 09:47:27 -0000
Message-Id: <21905E09B270D111815400C0DFAA15331E10@tgb-mailhost.portcullis-security.com>
From: Thomas Liam Romanis <TLR@portcullis-security.com>
To: "'ramamonjisoa@bnetd.sita.net'" <ramamonjisoa@bnetd.sita.net>
Cc: "'firewalls@greatcircle.com'" <firewalls@greatcircle.com>
Subject: RE: IP addresses
Date: Thu, 15 Jan 1998 09:47:24 -0000
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1457.3)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Have a look at BIGfire firwall www.biodata.de or
www.portcullis-security.com

> ----------
> From: 	Martin Hepworth[SMTP:martin.hepworth@blackwell.co.uk]
> Sent: 	Wednesday, January 14, 1998 1:48PM
> To: 	'ramamonjisoa@bnetd.sita.net'; firewalls@greatcircle.com
> Subject: 	RE: IP addresses
> 
> 
> errmmm....
> first job I'd recommend is let the firewall do the controliing of
> theISP's/RAS to another (ie have more NIC's in the firewall!)
> 
> my 2 peneth worth = 3 cents ;-)
> 
> Martin Hepworth
> Blackwells Information Services
> tel +44 1865 792792 x 3233
> 
> WYDSIWGY - 1st rule of computer security
> What You don't See Is What Gets you
> 
> > -----Original Message-----
> > From:	ramamonjisoa@bnetd.sita.net
> [SMTP:ramamonjisoa@bnetd.sita.net]
> > Sent:	Wednesday, January 14, 1998 11:11 AM
> > To:	firewalls@greatcircle.com
> > Subject:	IP addresses
> > 
> > Hello,
> >         We have to realize an important project to become the
> > provider of internet services for the government of Cote d'Ivoire.
> > 
> >         We run in an unusual configuration because we connect our
> > node to the Internet with TWO ISPs ( yes 2 ISPs). So, I want to
> > get your feedback comments on the following configuration and
> > mostly HOW to manage the IP addresses ISP1 and ISP2 will give us.
> > 
> > Configuration
> > 
> > 
> >                                 ------------------------
> >                                 !           Router             !
> > --------------------> ISP1
> >                                 !
> > ! --------------------> ISP2
> >                                 ------------------------
> >                                     !            !            !
> >                                     !            !
> > !--------------------> RAS
> >     Public Servers<-----!            !
> >                                             Firewall
> >                                                  !
> >                                             Intranet
> > 
> >         TIA
> >         R. Charles Emile
> 

From firewalls-owner  Thu Jan 15 07:19:41 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA23211; Thu, 15 Jan 1998 06:11:28 -0800 (PST)
Received: from imsp074.netvigator.com (imsp074.netvigator.com [205.252.144.129]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id GAA23033 for <firewalls@GreatCircle.COM>; Thu, 15 Jan 1998 06:10:32 -0800 (PST)
Received: from js-computer (hhtam027221.netvigator.com [208.139.108.221])
	by imsp074.netvigator.com (8.8.8/8.8.8) with SMTP id WAA02779
	for <firewalls@GreatCircle.COM>; Thu, 15 Jan 1998 22:11:27 +0800 (HKT)
Message-Id: <199801151411.WAA02779@imsp074.netvigator.com>
Date: Mon, 02 Feb 1998 02:44:06 +0800
From: MS <"ims02@netvigator.com"@netvigator.com>
Reply-To: "ims02@netvigator.com"@netvigator.com
X-Mailer: Mozilla 3.0Gold (Win95; I)
MIME-Version: 1.0
To: "firewalls@GreatCircle.COM" <firewalls@GreatCircle.COM>
Subject: Change Ethernet Payload?
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Dear all,

I've got one a question on the broacast ethernet LAN.

Is it possible to alter the payload content broadcasting on a ordinary
hub through the use of some equipment or protocol analyser connected
to that hub such that the destination system will act on the wrong
(altered)
payload information?  If yes, how to prevent??

Thank very much!!

From firewalls-owner  Thu Jan 15 08:33:13 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id HAA04677; Thu, 15 Jan 1998 07:15:14 -0800 (PST)
Received: from gateway.adidasus.com (spfrw001.adidasus.com [208.146.114.30]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id GAA26931 for <firewalls@GreatCircle.COM>; Thu, 15 Jan 1998 06:30:43 -0800 (PST)
Received: by gateway.adidasus.com; id JAA29778; Thu, 15 Jan 1998 09:30:06 -0500 (EST)
Received: from mjolinor.adidasus.com(10.75.10.7) by gateway.adidasus.com via smap (4.0a)
	id xma029717; Thu, 15 Jan 98 09:29:57 -0500
Message-ID: <34BE1CD7.C2A24C3F@internetmci.com>
Date: Thu, 15 Jan 1998 09:27:35 -0500
From: Tim Lebrun <tlebrun@internetmci.com>
X-Mailer: Mozilla 4.03 [en] (Win95; U)
MIME-Version: 1.0
To: Rabid Wombat <wombat@mcfeely.bsfs.org>
CC: Don Martin <grey@usa.net>, cbrenton@sover.net,
        Sick Puppy <sikpuppy@maestro.com>, firewalls@GreatCircle.COM
Subject: Re: Wannabe needs a good book
References: <Pine.BSF.3.91.980114083521.10641L-100000@mcfeely.bsfs.org>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

ABSOLUTELY!!!!!!!!
GREAT ADVICE, KEEP IT UP!!!!!!!!!!

Rabid Wombat wrote:

> Sik Puppy's Guide to Networking
> Table of Contents
>
> Ch.1 ... Hacking from home will land you in the pound ....  p.3
> Ch.2 ... Never pee on the -48VDC Rectifier ...............  p.19
> Ch.3
>
>
> On Wed, 14 Jan 1998, Don Martin wrote:
>
> > I thought for a second Sick Puppy wrote a book on networking.... I can't
> > describe my initial thoughts on this... but I think I would buy it
> > anyway....
> >
> > Chris Brenton wrote:
> >
> > > Sick Puppy wrote:




From firewalls-owner  Thu Jan 15 08:37:21 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id BAA21014; Thu, 15 Jan 1998 01:50:53 -0800 (PST)
Received: from c00954-100lez.eos.ncsu.edu (c00954-100lez.eos.ncsu.edu [152.1.26.74]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id BAA20904 for <firewalls@GreatCircle.COM>; Thu, 15 Jan 1998 01:50:25 -0800 (PST)
Received: from localhost (jkwilli2@localhost)
          by c00954-100lez.eos.ncsu.edu (8.8.4/UC02Jan97) with SMTP
	  id EAA20865; Thu, 15 Jan 1998 04:52:17 -0500 (EST)
X-Authentication-Warning: c00954-100lez.eos.ncsu.edu: jkwilli2 owned process doing -bs
Date: Thu, 15 Jan 1998 04:52:16 -0500 (EST)
From: Ken Williams <jkwilli2@unity.ncsu.edu>
X-Sender: jkwilli2@c00954-100lez.eos.ncsu.edu
To: mikech@avana.net
cc: "'firewalls@greatcircle.com'" <firewalls@GreatCircle.COM>
Subject: Re: Secure Chat?
In-Reply-To: <Chameleon.884845624.mikech@att>
Message-ID: <Pine.SOL.3.96.980115044313.20000C-100000@c00954-100lez.eos.ncsu.edu>
X-Copyright: The contents of this message may not be reproduced in any form
X-Copyright: (including Commercial use) unless specific permission is granted
X-Copyright: by the author of the message.  All requests must be in writing.
X-Disclaimer: The contents of this email are for educational purposes only.
X-Disclaimer: The contents of this email do not reflect the thoughts
X-Disclaimer: or opinions of either myself or my employer and are not
X-Disclaimer: endorsed by sponsored by or provided on behalf of
X-Disclaimer: North Carolina State University.
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On Thu, 15 Jan 1998 mikech@avana.net wrote:

>Hello:
>
>I am looking for a secure real-time chat client that is accesible
>>from a web page. I have remote students that need to chat in real-time
>with instructors through a web site and I need to minimize the chances
>that anyone could listen in. I don't want to have to load client
>software on the student's PCs. I want it to be secure with just a
>Netscape or MSIE browser.
>
>I looked at a couple of real-time Java chats that had the feel
>of IRC but none were secure. Any ideas out there?
>
>Thanks in advance,
>
>Mike
>--

why not just go with a properly configured wwwboard script from Matt's
Script Archive at http://worldwidemart.com/scripts/wwwboard.shtml

add password protection and make the standard security-related
configurations to the scripts to ensure that nothing is breached.
the wwwboard concept beats any real-time Java or html-based chat client
hands down in my opinion. 

another good idea would be to run a private irc server.  or you could
simply create a couple of irc channels that are keyed, and protect them
with bots.  main drawback is irc splits if your channel is targeted for a
hostile takeover.

you can get nice configureable bots from my ftp server at:
ftp://152.7.11.38/pub/personal/tattooman/
in the irc subdirectory.  standard ftp protocols apply (access via web
browser, or ftp to ftp://152.7.11.38, then login as anonymous with an
email addy, and then enter this command to get to the appropriate
dirdctory:  "cd ../ftp/pub/personal/tattooman/"

Ken Williams 

/--------------|  TATTOOMAN -aka- rute  |--------------\  
  NCSU Computer Science    VP of The EHAP Corp.   
  jkwilli2@unity.ncsu.edu  http://www.hackers.com/ehap/ 
  UNIX ICQ UIN# 4231260    ehap@hackers.com     
  FTP Site:  ftp://152.7.11.38/pub/personal/tattooman/
  WWW 2:     http://www4.ncsu.edu/~jkwilli2/
  PGP Key:   http://www4.ncsu.edu/~jkwilli2/pgp.asc
      http://www4.ncsu.edu/~jkwilli2/pgp_fingerprint
\---------|  http://152.7.11.38/~tattooman/  |---------/




From firewalls-owner  Thu Jan 15 08:48:05 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA17225; Thu, 15 Jan 1998 08:23:57 -0800 (PST)
Received: from europa.lif.icnet.uk (europa.lif.icnet.uk [143.65.100.4]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id IAA17128 for <firewalls@greatcircle.com>; Thu, 15 Jan 1998 08:23:26 -0800 (PST)
From: harley@icrf.icnet.uk
Message-Id: <199801151623.IAA17128@honor.greatcircle.com>
Received: by europa.lif.icnet.uk; Thu, 15 Jan 1998 16:25:44 GMT
Subject: Re: Excessive use of e-mail 
To: firewalls@greatcircle.com
Date: Thu, 15 Jan 1998 16:25:44 +0000 (GMT)
X-Mailer: ELM [version 2.4 PL23]
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

> > Meta-issue: I find it's really useful to be able to discriminate
> > between "technical" and "political/social" problems in jobs like
> > ours. Every once in a while I have to catch myself when I attempt to
> > apply technical solutions to political problems.
> >
> I find the distinction valuable also.  However, I find technical solutions
> applicable to political problems all the time.  The mess usually occurs
                                                  ^^^^^^^^^^^^^^^^^^^^^^^
> when a political solution is mandated for a technical problem....
  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

I don't usually send 'Me too' messages, but ain't -that- the truth?

-- 
David Harley                  |              alt.comp.virus FAQ
D.Harley@icrf.icnet.uk        |           & Anti-Virus Web Page
Support & Security Analyst    |    Folk London On-Line gig-list
Imperial Cancer Research Fund | http://webworlds.co.uk/dharley/

From firewalls-owner  Thu Jan 15 08:58:10 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id QAA29441; Wed, 14 Jan 1998 16:47:24 -0800 (PST)
Received: from mailer.syr.edu (mailer.syr.edu [128.230.20.20]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id QAA29219 for <firewalls@GreatCircle.COM>; Wed, 14 Jan 1998 16:46:42 -0800 (PST)
Received: from rodan.syr.edu by mailer.syr.edu (LSMTP for Windows NT v1.1a) with SMTP id <0.5EE144D0@mailer.syr.edu>; Wed, 14 Jan 1998 19:48:23 -0500
Received: from localhost (rgrimsha@localhost)
	by rodan.syr.edu (8.8.5/8.8.5) with SMTP id TAA13433;
	Wed, 14 Jan 1998 19:48:12 -0500 (EST)
X-Authentication-Warning: rodan.syr.edu: rgrimsha owned process doing -bs
Date: Wed, 14 Jan 1998 19:48:11 -0500 (EST)
From: Randy Grimshaw <rgrimsha@mailbox.syr.edu>
X-Sender: rgrimsha@rodan.syr.edu
Reply-To: Randy Grimshaw <rgrimsha@mailbox.syr.edu>
To: daemond@ibm.net
cc: firewalls@GreatCircle.COM
Subject: Re: Exposing fraudulent SA's
In-Reply-To: <Pine.NEB.3.96.980112235018.5708A-100000@master.ibmcyrix.org>
Message-ID: <Pine.SOL.3.95.980114191004.1583B-100000@rodan.syr.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Geoff Gowey:
  I have pondered your query and have an answer that I trust you will (as
you promised) be greatful for. We all have to submit to a higher
authority.
  I would also suggest approaching this as though you are looking for a
job. You might just get one. If not at this college, for someone else.
This college is at the very least your source of references as you begin
your career. There are actually two criteria for an employee. Someone who
can do the job. and someone who can do the job in the context of other
human beings.
  The dangerous issue that you are dealing with, as revealed by your
question, is that you will in an effort to expose the SA's as unable to do
the job, expose yourself as being unable to work in the context of others.
  I have personally fallen to the trap of bitterness over inept co-workers
and am greatfull to have gotten past it (long ago). We all have our
talents to invest so to speak. You do your best, they do theirs, your
higher authority will notice.
  Take your learning, collect your data, write it up as a paper, besides
your grading professor and advisor, share it with the library staff and
the rescom staff, and trust me -- someone will notice (both groups are
being forced into technology and are extreemly paranoid). If you haven't
already burned your bridges, you might just get that job. 

<><Randall Grimshaw, Network Programmer, Syracuse University, 315-443-5779

On Tue, 13 Jan 1998 daemond@ibm.net (wrote something best paraphrased like
this...)

> 	I have a dilema that I can't seem to find a clear cut solution for
> we have two CNE certifed SAs that claim we have a secure setup(hahahahaha!!).> whatsoever.  I've used SATAN and strobe to do my checking to verify this
> I once got together with the two SA's and tried to point out the flaws
> but no dice (they've got their club and I'm not invited).
> here's the question: how do you expose frauds like these so they at least
> secure it (or are given the boot)?  I'm not sure I want to be near the
> systems around here when our network goes up in smoke.
> I'm a concerned college student with no options begging for ideas that
> you may have.  I'll be thankful for any ideas.  Please help.
> -----------------------------------------------------------------------------
> Geoff Gowey		| NetBSD: the best multi-platform OS 
> daemond(at)ibm.net	| www.netbsd.org
> *****************************************************************************


From firewalls-owner  Thu Jan 15 09:03:07 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id GAA20967; Thu, 15 Jan 1998 06:00:40 -0800 (PST)
Received: from norm.pfsfhq.com ([199.250.164.11]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id FAA20710 for <firewalls@GreatCircle.COM>; Thu, 15 Jan 1998 05:59:48 -0800 (PST)
Received: from pfsfhq.com ([172.16.8.32]) by norm.pfsfhq.com (8.8.5/SCO5) with ESMTP id JAA00819; Thu, 15 Jan 1998 09:01:36 -0500 (EST)
Message-ID: <34BE1423.7E647C74@pfsfhq.com>
Date: Thu, 15 Jan 1998 08:50:27 -0500
From: "John E. Kemker III" <john.kemker@pfsfhq.com>
Organization: Primerica Financial Services
X-Mailer: Mozilla 4.03 [en] (WinNT; I)
MIME-Version: 1.0
To: daemond@ibm.net
CC: firewalls@GreatCircle.COM
Subject: Re: Fraudulent SAs - more
References: <Pine.NEB.3.96.980114213650.10096A-100000@master.ibmcyrix.org>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk



daemond@ibm.net wrote:

> Now here's something interesting I ran into today: one of the SAs is in my
> CSC-241 class learning Data Structures and Algorithms in C.  I'm still
> trying to figure out why these guys are here.  Shouldn't he be doing
> something more important like trying to keep the network from crashing every
> so often and tightening security?

Furthering one's education is a valid portion of one's job.  He might very well be
doing something to keep the network from crashing every so often and tightening
security by increasing his knowledge and expertise.  While you may not see a
direct relationship between Data Structures and Algorithms in C and system
administration, there is one there.  Don't be too quick to judge these guys.
Maybe they don't have a good attitude towards you when you try to help, but
copping an attitude back only makes things worse.  I definitely agree with the
suggestions that you talk to management about *concerns* and not flame these guys
when you do.  Who knows?  You might even come to like them and work with them on a
regular basis.

--John K.


From firewalls-owner  Thu Jan 15 09:18:51 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA17710; Thu, 15 Jan 1998 08:28:38 -0800 (PST)
Received: from sla_nt2.sla.com (mail1.sla.com [207.153.168.35]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id IAA17690 for <firewalls@greatcircle.com>; Thu, 15 Jan 1998 08:28:29 -0800 (PST)
Received: by mail1.sla.com with Internet Mail Service (5.5.1960.3)
	id <CKR9LQA2>; Thu, 15 Jan 1998 08:29:04 -0800
Message-ID: <B07FD9831800D11198B80060974FB8DC19EFE0@mail1.sla.com>
From: "Stackpole, Bill" <BSTACKPO@sla.com>
To: "'daemond@ibm.net'" <daemond@ibm.net>, firewalls@greatcircle.com
Subject: RE: Fraudulent SAs - more 
Date: Thu, 15 Jan 1998 08:28:56 -0800
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.1960.3)
Content-Type: text/plain
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Some one once told me that "Friends come and go but enemies are
forever."  Plan your approach carefully.  If you are really concerned
about security then I would try educating the SAs by showing them some
of the security holes.  An occasional e-mail with the "Gee, I did this
and I didn't think I should be able to,  should I ?"  Keep copies of
your mail and their responses.  Then if things don't improve you can
your case to higher authority with the same approach.  "I'm here because
I'm concern that I might lose and my fellow classmates might lose our
many hours of hard work to a hacker because of some of the security
problems on the system. . . . "  Then educate him about what you've
found, tell him you've been working with the SAs but it hasn't improved
much.  If the SAs come back with guns blazing you have the proof (your
e-mails) to back you up.  Ask for a meeting with the SAs, their boss and
you and go over your concerns with all of them.  Win some friends and
get what you want too.  Believe me, their boss will not forget your
tactfulness and technical ability.

If your are just trying to prove you are better then they are, I'd say
you've already done that.  But if you take that approach to confronting
the problem you will make some powerful enemies and their bosses won't
forget your arrogance dispite your technical abilities.

I either case the problems will likely get fixed.

> -----Original Message-----
> From:	daemond@ibm.net [SMTP:daemond@ibm.net]
> Sent:	Wednesday, January 14, 1998 6:45 PM
> To:	firewalls@greatcircle.com
> Subject:	Fraudulent SAs - more 
> 
> First, thank you to all the people who have been sending me many ideas
> of
> how exactly to deal with the two SAs.  I now have many options at my
> finger tips and am trying to decide exactly which one I'm going to do.
> Now
> here's something interesting I ran into today: one of the SAs is in my
> CSC-241 class learning Data Structures and Algorithms in C.  I'm still
> trying to figure out why these guys are here.  Shouldn't he be doing
> something more important like trying to keep the network from crashing
> every
> so often and tightening security?  Oh well.  I've got the advantage of
> surprise still so I'd better carefully think out my plan of attack
> (only one
> real shot to give my 2 cents before they fight back).  Thanks again to
> all the
> suggestions and ideas.  I'm thinking along the lines of drafting my
> solution
> and getting it to float around this might prove effective.  L8r.
> 
> ----------------------------------------------------------------------
> -------
> Geoff Gowey		| NetBSD: the best multi-platform OS 
> daemond(at)ibm.net	| www.netbsd.org
> **********************************************************************
> *******
> Spammers beware: I do not buy from companies that spam and I keep
> track!
> Above policy STRICTLY ENFORCED!
> **********************************************************************
> *******
> "All I ask is for the chance to prove that money can't buy me
> happiness"
> or more simply put "SHOW ME THE MONEY!!!"

From firewalls-owner  Thu Jan 15 10:26:17 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id IAA18894; Thu, 15 Jan 1998 08:38:58 -0800 (PST)
Received: from out2.ibm.net (out2.ibm.net [165.87.194.229]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id IAA18858 for <firewalls@GreatCircle.COM>; Thu, 15 Jan 1998 08:38:46 -0800 (PST)
From: daemond@ibm.net
Received: from master.ibmcyrix.org (slip129-37-123-91.oh.us.ibm.net [129.37.123.91]) by out2.ibm.net (8.8.5/8.6.9) with SMTP id QAA57908; Thu, 15 Jan 1998 16:40:38 GMT
Date: Thu, 15 Jan 1998 11:50:35 -0500 (EST)
X-Sender: daemond@master.ibmcyrix.org
To: mikech@avana.net
cc: "'firewalls@greatcircle.com'" <firewalls@GreatCircle.COM>
Subject: Re: Secure Chat?
In-Reply-To: <Chameleon.884845624.mikech@att>
Message-ID: <Pine.NEB.3.96.980115114951.357A-100000@master.ibmcyrix.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Try seeing if you can strap SSL on any of these programs.  SSL should
provide enough of a secure connection.

-----------------------------------------------------------------------------
Geoff Gowey		| NetBSD: the best multi-platform OS 
daemond(at)ibm.net	| www.netbsd.org
*****************************************************************************
Spammers beware: I do not buy from companies that spam and I keep track!
Above policy STRICTLY ENFORCED!
*****************************************************************************
"All I ask is for the chance to prove that money can't buy me happiness"
or more simply put "SHOW ME THE MONEY!!!"

On Thu, 15 Jan 1998 mikech@avana.net wrote:

* ->Hello:
* ->
* ->I am looking for a secure real-time chat client that is accesible
* ->from a web page. I have remote students that need to chat in real-time
* ->with instructors through a web site and I need to minimize the chances
* ->that anyone could listen in. I don't want to have to load client
* ->software on the student's PCs. I want it to be secure with just a
* ->Netscape or MSIE browser.
* ->
* ->I looked at a couple of real-time Java chats that had the feel
* ->of IRC but none were secure. Any ideas out there?
* ->
* ->Thanks in advance,
* ->
* ->Mike
* ->--
* ->01:16:58
* ->01/15/98
* ->_______________________________________________________________________
* ->Michael W. Chalkley                                Tel: +1.770.772.4567
* ->ZapNet! Inc.                                       Fax: +1.770.475.7640
* ->Suite 400-120                                E-mail: mikech@iproute.com
* ->10945 State Bridge Road                                mikech@avana.net
* ->Alpharetta, GA 30202                             http://www.iproute.com
* ->
* ->


From firewalls-owner  Thu Jan 15 11:38:40 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA23021; Thu, 15 Jan 1998 09:09:06 -0800 (PST)
Received: from transfer.usit.net ([208.10.171.67]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA22981 for <firewalls@GreatCircle.COM>; Thu, 15 Jan 1998 09:08:55 -0800 (PST)
Received: from dqisystems.com ([199.1.59.2]) by transfer.usit.net (8.8.7/8.8.5) with ESMTP id LAA28050; Thu, 15 Jan 1998 11:59:51 -0500 (EST)
Received: from gcollins.dqisystems.com ([172.16.128.100]) by dqisystems.com (8.8.5/8.6.12) with SMTP id HAA06987; Thu, 15 Jan 1998 07:55:18 -0500
Reply-To: "Greg Collins" <gcollins@dqisystems.com>
From: "Greg Collins" <gcollins@dqisystems.com>
To: <firewalls@GreatCircle.COM>, <ramamonjisoa@bnetd.sita.net>
Subject: Re: IP addresses
Date: Thu, 15 Jan 1998 07:54:44 -0500
Message-ID: <01bd21b4$c0b8ac40$648010ac@gcollins.dqisystems.com>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="US-ASCII"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 4.71.1712.3
X-MimeOLE: Produced By Microsoft MimeOLE V4.71.1712.3
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

While my ISP experience is limited, I would also recommend the  use of BGP.
BGP will allow you to easily (once configured) load balance. A regional ISP
I have worked with constantly evaluates their load on individual connections
to the Internet and balances using "prepends". I have seen more problems
with internal (inside the ISP) routing than with the BGP (ISP to ISP).
Depending on your size and configuration you  can have problems with
flapping interfaces (dial-in interfaces) causing constant changes in routing
tables.
Any of the guys here who are ISPs can probably help more. Good Luck

Greg Collins
Data Quest Information Systems
voice -423-588-4757
fax - 423-945-3846
gcollins@dqisystems.com
"I have but one thing which cannot be taken from me, and that is my
integrity. It I must give up of my own will."
-----Original Message-----
From: Ramamonjisoa Charles Emile <ramamonjisoa@bnetd.sita.net>
To: firewalls@GreatCircle.COM <firewalls@GreatCircle.COM>
Date: Wednesday, January 14, 1998 12:07 PM
Subject: IP addresses


>Hello,
>        We have to realize an important project to become the
>provider of internet services for the government of Cote d'Ivoire.
>
>        We run in an unusual configuration because we connect our
>node to the Internet with TWO ISPs ( yes 2 ISPs). So, I want to
>get your feedback comments on the following configuration and
>mostly HOW to manage the IP addresses ISP1 and ISP2 will give us.
>
>Configuration
>
>
>                                ------------------------
>                                !           Router             !
>--------------------> ISP1
>                                !
>! --------------------> ISP2
>                                ------------------------
>                                    !            !            !
>                                    !            !
>!--------------------> RAS
>    Public Servers<-----!            !
>                                            Firewall
>                                                 !
>                                            Intranet
>
>        TIA
>        R. Charles Emile
>


From firewalls-owner  Thu Jan 15 12:14:42 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA01783; Thu, 15 Jan 1998 09:54:01 -0800 (PST)
Received: from luomat.peak.org (cc344191-a.ewndsr1.nj.home.com [24.2.83.40]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA01673 for <firewalls@GreatCircle.COM>; Thu, 15 Jan 1998 09:53:34 -0800 (PST)
Received: (from luomat@localhost)
	by luomat.peak.org (8.8.8/8.8.8) id MAA23111
	for firewalls@GreatCircle.COM; Thu, 15 Jan 1998 12:55:26 -0500 (GMT-0500)
Message-Id: <199801151755.MAA23111@luomat.peak.org>
Content-Type: text/plain
MIME-Version: 1.0 (NeXT Mail 4.1mach v148)
X-Image-URL: http://www.peak.org/~luomat/next/luomat@peak.org.tiff
In-Reply-To: <01bd20ee$5ce41a40$8b0531a6@excalibur.cybrsource.com>
X-Nextstep-Mailer: Mail 4.1mach (Enhance 2.1)
Received: by NeXT.Mailer (1.148.RR)
From: Timothy J Luoma <luomat@peak.org>
Date: Thu, 15 Jan 98 12:55:21 -0500
To: <firewalls@GreatCircle.COM>
Subject: Re: Freelance internal hacking a bad idea (was: Exposing fraudulent
	SA's)
References: <01bd20ee$5ce41a40$8b0531a6@excalibur.cybrsource.com>
X-Image-URL-Disclaimer: hey, it's off my student ID, gimme a break ;-)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Yeah.... Remember the story of Randall Schwartz @ Intel.  He *was*
the sysadmin and lost his job for running 'crack' because his
actions were seen as a hack-attack.

Then he was taken to court and sued.

Be cautious when mucking with security issues.

TjL



From firewalls-owner  Thu Jan 15 12:17:47 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA02224; Thu, 15 Jan 1998 09:56:43 -0800 (PST)
Received: from lint.cisco.com (lint.cisco.com [171.68.223.44]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA02153 for <Firewalls@GreatCircle.COM>; Thu, 15 Jan 1998 09:56:24 -0800 (PST)
Received: from mtibodea-pc.cisco.com (dhcp-usreston-23.cisco.com [171.68.57.23]) by lint.cisco.com (8.8.5/CISCO.SERVER.1.2) with SMTP id JAA01573; Thu, 15 Jan 1998 09:56:45 -0800 (PST)
Message-Id: <3.0.3.32.19980115122325.007ddc30@lint.cisco.com>
X-Sender: mtibodea@lint.cisco.com
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.3 (32)
Date: Thu, 15 Jan 1998 12:23:25 -0500
To: Andrzej Blaszczyk <andy@lama.supermedia.pl>, Firewalls@GreatCircle.COM
From: Mike Tibodeau <mtibodea@cisco.com>
Subject: Re: Cisco Centri Firewall
In-Reply-To: <Pine.LNX.3.96.980112192054.6281B-100000@lama.supermedia.pl
 >
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Andrzej-

Taking a security-centric approach and not an employer-centric
approach, I can tell you the following generalities:

It can be compared to other packages, but for what specifically 
are you looking?

The last update I saw said:
	No VPN support until IPsec released
	Lack of support for SQLnet until sometime this quarter
	IP types (GRE tunnels) are not allowed through
	Very complex key scheme (lots of calls to TAC I guess)	
	Microsoft ISS and Centri cannot run on the same server
	PPTP and RAS do not work with Centri on the same server
	Multimedia applications cannot use NAT
	Recommend 500 users
	Maximum supported is 1000 users

List price, to my knowledge, is lower than its competitors.

It is claimed to be faster than its competitors, though I
have not seen any test results to support that.

I do not know of any current bug id's opened against it.

As always, you can look at: http://www.cisco.com/centri

-Mike

At 07:22 PM 1/12/98 +0100, Andrzej Blaszczyk wrote:
>Hello everybody!
>
>Does anybody have any experience with Cisco Centri Firewall ?
>Can this product be compared to any other firewall (Eagle etc.) regarding
>its price, efficiency and security? Does Centri have any bugs?
>
>Thanks for any comments.
>
>Regards,
>
><<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>
><>    Andrzej Blaszczyk <> ab@supermedia.pl     <>
><> System Administrator <> http://supermedia.pl <>
><>       SuperMedia CUI <> Office: +48228296573 <>
><<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>
>
>
>
>
>

From firewalls-owner  Thu Jan 15 12:24:48 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA00378; Thu, 15 Jan 1998 09:47:25 -0800 (PST)
Received: from vision.techdata.com (vision.techdata.com [169.153.22.35]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA29975 for <firewalls@GreatCircle.COM>; Thu, 15 Jan 1998 09:46:23 -0800 (PST)
Received: by vision.techdata.com with Internet Mail Service (5.0.1458.49)
	id <DAJAA3A3>; Thu, 15 Jan 1998 12:45:47 -0500
Message-ID: <E3E36E648220D111899600A02461E745DA6EC6@STEALTH>
From: Steven Kupersmith <SKUPERS@techdata.com>
To: "'Firewalls'" <firewalls@GreatCircle.COM>
Subject: RE: Fraudulent SAs - more 
Date: Thu, 15 Jan 1998 11:45:53 -0500
X-Priority: 3
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.0.1458.49)
Content-Type: text/plain;
	charset="iso-8859-1"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Does your university have an Internal Audit Function (most do), they may
be interested in your findings and be able to address the issues from an
independent viewpoint.

> ----------
> From: 	Juggernaut[SMTP:g854690@dpc.kfupm.edu.sa]
> Sent: 	Thursday, January 15, 1998 5:29 AM
> To: 	firewalls@GreatCircle.COM
> Subject: 	Re: Fraudulent SAs - more 
> 
> 
> With all due respect, I think you all empathize with the SAdmins
> because 
> you are ones too. I understand the 2 guys came across as arrogant and 
> unwilling to listen and take his genuine observations seriously.. a
> "measly 
> freshman". He's done his dues by going to them the first time around.
> I 
> think you should give them a last chance, Geoff, by taking your 
> observations right to their superiors and when all that fails, you owe
> 
> it to yourself to have fun crashing their systems while making
> yourself a 
> better Sys Admin too if you ever think of becomeing one... We know
> that 
> hackers are far better programmers... make sure you don't exploit the
> very 
> weaknesses pointed out to them by you earlier.. I mean, being a good
> hacker 
> is one thing but not getting caught is another.. no big damage
> ofcourse.. 
> just a couple of warning shots.. enuff to get them warning shots from
> their 
> management
> 
> jn
> 
> On Wed, 14 Jan 1998, Max Vision wrote:
> 
> >   With all due respect, I think you might do well to re-evaluate
> this
> > situation not as a "plan of attack", but rather an opportunity to
> help
> > your school, and to possibly advance your own status there.
> >   Research _exactly_ what it is that you feel is wrong with the
> system in
> > _specific_ and you'll find that people will listen to you!  You may
> feel
> > that you are "giving up" holes and they will patch those and go back
> to
> > being sloppy - but don't let that stop you.  Tell them and their
> superiors
> > exactly what you see that is wrong, and if you are paying attention,
> you
> > will surely find more and more problems.  (Beleive me, there are
> always
> > system or network problems)  They will see the value in what you've
> done
> > for them.  Make sure you're not coming off antagonistic, but rather
> as
> > concerned (despite any frustration you may have), and this will also
> go a
> > long way towards making them feel better about you.
> > 
> > Good luck!
> > Max (Unix/Web/Security Admin)
> > 
> > On Wed, 14 Jan 1998 daemond@ibm.net wrote:
> > 
> > > First, thank you to all the people who have been sending me many
> ideas of
> > > how exactly to deal with the two SAs.  I now have many options at
> my
> > > finger tips and am trying to decide exactly which one I'm going to
> do.  Now
> > > here's something interesting I ran into today: one of the SAs is
> in my
> > > CSC-241 class learning Data Structures and Algorithms in C.  I'm
> still
> > > trying to figure out why these guys are here.  Shouldn't he be
> doing
> > > something more important like trying to keep the network from
> crashing every
> > > so often and tightening security?  Oh well.  I've got the
> advantage of
> > > surprise still so I'd better carefully think out my plan of attack
> (only one
> > > real shot to give my 2 cents before they fight back).  Thanks
> again to all the
> > > suggestions and ideas.  I'm thinking along the lines of drafting
> my solution
> > > and getting it to float around this might prove effective.  L8r.
> > > 
> > >
> ----------------------------------------------------------------------
> -------
> > > Geoff Gowey		| NetBSD: the best multi-platform OS 
> > > daemond(at)ibm.net	| www.netbsd.org
> > >
> **********************************************************************
> *******
> > > Spammers beware: I do not buy from companies that spam and I keep
> track!
> > > Above policy STRICTLY ENFORCED!
> > >
> **********************************************************************
> *******
> > > "All I ask is for the chance to prove that money can't buy me
> happiness"
> > > or more simply put "SHOW ME THE MONEY!!!"
> > > 
> > > 
> > 
> > 
> 
> 

From firewalls-owner  Thu Jan 15 13:25:56 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA26003; Thu, 15 Jan 1998 12:01:14 -0800 (PST)
Received: from lexicon.ins.com (lexicon.ins.com [199.0.193.11]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA25940 for <firewalls@GreatCircle.COM>; Thu, 15 Jan 1998 12:00:54 -0800 (PST)
Received: from springer.asacomp.com (ppp10.asacomp.com [199.178.136.42]) by lexicon.ins.com (8.7.5/8.7.3) with SMTP id LAA04353; Thu, 15 Jan 1998 11:58:35 -0800 (PST)
Message-Id: <3.0.32.19980115145748.007c1100@ins.com>
X-Sender: spring_a@ins.com
X-Mailer: Windows Eudora Pro Version 3.0 (32)
Date: Thu, 15 Jan 1998 14:58:12 -0500
To: "Greg Collins" <gcollins@dqisystems.com>, <firewalls@GreatCircle.COM>,
        <ramamonjisoa@bnetd.sita.net>
From: Arno Springer <spring_a@INS.COM>
Subject: Re: IP addresses
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

On using BGP, Check out Ciscos explaination of the fundamentals of BGP.  It
has great scenerios such as load balancing. You can find it here:

http://www.cisco.com/univercd/cc/td/doc/cisintwk/ics/icsbgp4.htm

Arno

At 07:54 AM 1/15/98 -0500, Greg Collins wrote:
>While my ISP experience is limited, I would also recommend the  use of BGP.
>BGP will allow you to easily (once configured) load balance. A regional ISP
>I have worked with constantly evaluates their load on individual connections
>to the Internet and balances using "prepends". I have seen more problems
>with internal (inside the ISP) routing than with the BGP (ISP to ISP).
>Depending on your size and configuration you  can have problems with
>flapping interfaces (dial-in interfaces) causing constant changes in routing
>tables.
>Any of the guys here who are ISPs can probably help more. Good Luck
>
>Greg Collins
>Data Quest Information Systems
>voice -423-588-4757
>fax - 423-945-3846
>gcollins@dqisystems.com
>"I have but one thing which cannot be taken from me, and that is my
>integrity. It I must give up of my own will."
>-----Original Message-----
>From: Ramamonjisoa Charles Emile <ramamonjisoa@bnetd.sita.net>
>To: firewalls@GreatCircle.COM <firewalls@GreatCircle.COM>
>Date: Wednesday, January 14, 1998 12:07 PM
>Subject: IP addresses
>
>
>>Hello,
>>        We have to realize an important project to become the
>>provider of internet services for the government of Cote d'Ivoire.
>>
>>        We run in an unusual configuration because we connect our
>>node to the Internet with TWO ISPs ( yes 2 ISPs). So, I want to
>>get your feedback comments on the following configuration and
>>mostly HOW to manage the IP addresses ISP1 and ISP2 will give us.
>>
>>Configuration
>>
>>
>>                                ------------------------
>>                                !           Router             !
>>--------------------> ISP1
>>                                !
>>! --------------------> ISP2
>>                                ------------------------
>>                                    !            !            !
>>                                    !            !
>>!--------------------> RAS
>>    Public Servers<-----!            !
>>                                            Firewall
>>                                                 !
>>                                            Intranet
>>
>>        TIA
>>        R. Charles Emile
>>
>
>
>

********************************************************
* Arno Springer	    <mailto:arno_springer@ins.com	*
* Network Systems Consultant    Pager: +1.800.INS.1INS	*
* International Network Services  Htrs: +1.888.INS.500 *
* Columbus, Ohio		 Visit:<http://www.ins.com>	*
* Office:(614) 760-3412					*
*								*
* 	"Providing the power of operable networks"	*
********************************************************

From firewalls-owner  Thu Jan 15 14:05:29 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA00910; Thu, 15 Jan 1998 12:28:30 -0800 (PST)
Received: from ccimail.mediaone.com (ccimail.mediaone.com [169.152.79.3]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA00828 for <firewalls@greatcircle.com>; Thu, 15 Jan 1998 12:28:12 -0800 (PST)
From: NNG6E30c5@a1oI.com
Received: from IODJ1DVS4 (1Cust64.tnt26.atl2.da.uu.net [208.255.221.64])
	by ccimail.mediaone.com (8.8.7/8.8.7) with SMTP id PAA10187;
	Thu, 15 Jan 1998 15:29:14 -0500 (EST)
DATE: 14 Jan 98 3:34:48 PM
Message-ID: <nV9Qxn4kEuy6VK621>
TO: tell@alltheworld35.com
SUBJECT: Let Us Do It For You!
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

      LET US DO YOUR BULK MAILINGS!!!

..$350 PER MILLION ADDRESSES SENT
..$250 PER 1/2 MILLION ADDRESSES SENT

THE WAY OF THE FUTURE FOR SUCCESS IN YOUR BUSINESS!

Our company will do bulk emailing for your product/service.

Addresses are extracted daily by six of our computers,
which run 24 hours a day 7 days a week, scanning the net
for new addresses.  Estimated 60-80,000 addresses extracted 
daily.  They are fresh!  Over 40 million addresses on file.

No more than 2 pages (50 lines), no porn and no foul 
language.  $50 per page/25 lines per page beyond 2 pages.  
We do not do targeted mailings at this price.

Targeted mailings: 
$150 per 50,000 addresses extracted or less.
We can extract by country, occupation, organizations, 
associations, product, etc.  If we can not 
search and extract what you need, then nobody can.

There are no lower prices on the net.  Your mailing 
can be done in a matter of hours.  We have 6 computers 
extracting addresses 24/7.

For the fastest service, cheapest prices and cleanest
mailings call our processing and new accounts office
at 904-282-0945, Monday - Friday 9 - 5 EST.  If the line is
busy, please keep trying, as bulk mailing is growing fast.  
We do want to work with you to advertise your product.

To have your name removed, call our processing office.
Any negative responses will be dealt with accordingly.

From firewalls-owner  Thu Jan 15 14:12:36 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id MAA03345; Thu, 15 Jan 1998 12:43:03 -0800 (PST)
Received: from hq.si.net (hq.si.net [192.156.192.10]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA03121 for <Firewalls@GreatCircle.COM>; Thu, 15 Jan 1998 12:42:11 -0800 (PST)
Received: from hq.si.net (hq [192.156.192.10]) by hq.si.net (8.8.5/8.7.3) with SMTP id PAA22873; Thu, 15 Jan 1998 15:45:47 -0500 (EST)
Date: Thu, 15 Jan 1998 15:45:47 -0500 (EST)
From: Ming Lu <mlu@hq.si.net>
To: Tom Peroulas <peroulas@helios.insnet.com>
cc: Firewalls@GreatCircle.COM
Subject: Re: minimizing WAN traffic
In-Reply-To: <Pine.LNX.3.95.980113171810.17732D-100000@helios.insnet.com>
Message-ID: <Pine.SOL.3.91.980115153954.22639B-100000@hq.si.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk


Sounds like you are Bill Gates man...:-). Use unix platform and squid (or 
Netcache, commercial package), you can manage them in another corner of 
world.

_ming

On Tue, 13 Jan 1998, Tom Peroulas wrote:

> I am going to be setting up a distributed proxy environment across a WAN.
> I want to be able to administer all my proxies remotely.  I also want to
> minimize WAN traffic generated by caching.   Microsoft's caching array and
> single virtual cache seem more efficient than Netscape's ICP, but I'm
> wondering about effects on WAN traffic.
> 
> Let's say that I have offices in Boise, Seattle, Myrtle Beach, and Dallas.
> Let's say all Internet traffic is handled by a T1 in Dallas, all other
> offices are connected via WAN.  There's a proxy server in each office, and
> Dallas has 2 for load balancing.
> 
> 1.  I want to minimize WAN traffic.  Let's say a request is made in Myrtle
> Beach, but the only proxy server that has it on its cache is Seattle.  To
> minimize WAN traffic, I would rather have that document get retrieved in
> Dallas via the Internet.  Can I set up a hierarchy that allows this.  I
> understand how the parent-child relationships would be set up, I just want
> to know if it's possible.
> 
> 2.  Can I administer all proxy servers from Dallas?
> 
> 3.  Where does the single virtual cache reside?  Does the single virtual
> cache/proxy array of Microsoft generate more or less WAN traffic to
> maintain the cache information across distributed proxies than does
> Netscapes ICP?
> 
> 
> 

From firewalls-owner  Thu Jan 15 14:13:51 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id LAA21298; Thu, 15 Jan 1998 11:27:12 -0800 (PST)
Received: from mail.advancenet.net (hermes.cu-online.com [205.198.248.82]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id LAA21219 for <firewalls@greatcircle.com>; Thu, 15 Jan 1998 11:26:54 -0800 (PST)
Received: from mail.argus-systems.com (ranger.argus-systems.com [206.221.232.80]) by mail.advancenet.net (8.8.6/8.7.3) with SMTP id OAA10231; Thu, 15 Jan 1998 14:31:05 -0600
Received: by mail.argus-systems.com (SMI-8.6/SMI-SVR4)
	id NAA28364; Thu, 15 Jan 1998 13:28:07 -0600
Date: Thu, 15 Jan 1998 13:28:07 -0600
From: mcnabb@argus-systems.com (Paul McNabb)
Message-Id: <199801151928.NAA28364@mail.argus-systems.com>
To: bet@rahul.net
Cc: firewalls@greatcircle.com
Subject: Re: Secure Web Transaction Solution
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

>  From bet@rahul.net Thu Jan 15 09:48 CST 1998
>  
>  >[...] No one who wants to protect a web server should be running it on
>  >an unmodified operating system. If you don't really care if the server
>  >gets trashed, of course it doesn't matter what OS you use...
>  
>  I don't really agree with that statement, as posed, even in the context
>  of this ``secure web transaction solution'' thread. Whether your OS
>  provides you partitions, ACLs, and so on, or not, your job is to secure
>  the content running on top of it. If your server isn't secured, running
>  it on a strongly protective OS might help limit the damage, but it won't
>  eliminate it. You _have_ to secure the server, and if you've succeeded
>  in that the only additional reward of enhanced OS security features is
>  (possibly) simplifying the implementation.

There is no question in my mind that a security product or set of
products is simply insufficient to satisfy the security needs of most
any site.  You've got to have planning and security expertise applied
to solving the problem of providing security, not just plugging holes
as they become visisble.

It's nice to say that "you _have_ to secure the server", but how do
you do that?  If your server is an http server or an ftp server, how
many bugs do you think are still waiting to be discovered (or at least
publicized to those of us who haven't run across them yet) or introduced
with new versions of daemons?  High-end secure OSes allow you to "secure
the server" in ways that just are not possible without their features.

>  A strongly validated OS is a nice idea, and it's quite possible that the
>  validation effort delivers better security than the larger, more active
>  development community of the open OSes. Personally I'm not strongly
>  convinced either way on that question.

One of the problems is that many people don't know much about the security
*features* that are available, in addition to the validation part.  For
example, it is possible to use high-end OS technology to make every disk
drive appear as if it had been mounted read-only.  This can be imposed
on just the processes that have, or ever had, access to a particular
network interface, or descended from a process that had (such as the http
daemon).  On such as system you can give away every account password
(including root) and provide telnet service and a compiler, and still the
system is secured.  The idea of this level of security is that you are
not relying on the correctness of application programs or utilities
to secure your system.

By the same token, you can give a person every account password (including
root) and access to a compiler on your system, and prevent them from
ever connecting through any network interface except the one they came
in on.  Once an administrator starts understanding these other types
of security features, the meaning of "securing a server" changes.

The bottom line is that without OS security, every program on the system
is a potential hole.  With OS security, you don't need to validate most
programs running on the system, even those running as root.  And the
complexity of the underlying OS security code is orders of magnitude
LESS than that of most network service programs.

The tools for securing a site include firewalls, access tokens, intruder
detection tools, secure/trusted OSes, system scanners, etc.  Each solves
a set of security problems.  But they are only useful when in the hands
of someone who knows what he/she is doing.

paul

---------------------------------------------------------
Paul McNabb                     Argus Systems Group, Inc.
Vice President and CTO          1809 Woodfield Drive
mcnabb@argus-systems.com        Savoy, IL 61874 USA
TEL 217-355-6308
FAX 217-355-1433                "Securing the Future"
---------------------------------------------------------

From firewalls-owner  Thu Jan 15 14:14:57 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id KAA11753; Thu, 15 Jan 1998 10:44:30 -0800 (PST)
Received: from brimstone.rnb.com (brimstone.rnb.com [204.178.80.14]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with SMTP id KAA11694 for <firewalls@greatcircle.com>; Thu, 15 Jan 1998 10:44:14 -0800 (PST)
Received: by brimstone.rnb.com; id NAA09357; Thu, 15 Jan 1998 13:46:06 -0500
Comments: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Comments: Internet Message: Sender identity is not verified.
Comments: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Received: from relay.rnb.com(199.99.101.2) by brimstone.rnb.com via smap (4.0a)
	id xma008897; Thu, 15 Jan 98 13:45:23 -0500
Received: from monarch.rnb.com (monarch [150.1.30.112])
	by relay.rnb.com (8.8.5/8.8.5) with ESMTP id NAA20413
	for <firewalls@greatcircle.com>; Thu, 15 Jan 1998 13:45:22 -0500 (EST)
Message-ID: <XFMail.980115134521.kempster@monarch.rnb.com>
X-Mailer: XFMail 1.2 [p0] on Solaris
X-Priority: 3 (Normal)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
Date: Thu, 15 Jan 1998 13:45:21 -0500 (EST)
Organization: Republic National Bank
From: Ken Kempster <kempster@monarch.rnb.com>
To: firewalls <firewalls@greatcircle.com>
Subject: DCE through a firewall
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Has anyone successfully configured
a firewall to pass DCE traffic?

Specifically,  I'm looking to 
configure a Cisco PIX to pass the
traffic.

I anyone even has the comm. requirements
that would be great.

thanx.

|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
|  Ken Kempster               kempster@monarch.rnb.com    |   
|  Systems Consultant                _\|/_                |
|  Republic National Bank            (o o)                |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~oOO-(_)-OOo~~~~~~~~~~~~~~

From firewalls-owner  Thu Jan 15 14:16:30 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id JAA25464; Thu, 15 Jan 1998 09:24:48 -0800 (PST)
Received: from wicked.neato.org (wicked.neato.org [198.70.96.252]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id JAA25387 for <firewalls@GreatCircle.COM>; Thu, 15 Jan 1998 09:24:27 -0800 (PST)
Received: (from george@localhost)
	by wicked.neato.org (8.8.5/8.8.5) id JAA19413;
	Thu, 15 Jan 1998 09:29:22 -0800 (PST)
Date: Thu, 15 Jan 1998 09:29:22 -0800 (PST)
Message-Id: <199801151729.JAA19413@wicked.neato.org>
To: "Christopher O'Malley" <comalley@i-kinetics.com>,
        firewalls@GreatCircle.COM
Subject: Re: Experiences with SunScreen? 
From: george@neato.org
X-Remailed: true
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

Chris,
  I've used the product and it works as advertised.  It is extremely fast and
very reliable.  There are a few different configurations available, such as the
Sunscreen SPF100 and SPF200.  These are "stealth" devices!  They are not
visible on the net and have no ip address - they just filter connections.  The
SPF200 is the update to the 100.  The interesting feature of the 100 was that
it could be managed via a pc.  The spf200 requires a unix box as a management
station.  Since there are no user level servers/services and an extremely
stripped down version of the OS installed on a dedicated device, these are very
very secure devices.

The other version of Sunscreen is the EFS version 1.1.  This is basically the 
same stateful packet screening code as in the SPF, but this software is 
designed to be layered on top of Solaris and therefore is slightly less secure 
but it does act as a router, where as the SPF is more like a bridge device.

Both EFS and SPF are managed using a pretty cool gui and also a web interface
over and encrypted (skip) connection, allowing you to manage the device from
anywhere and still have a secure/authenticated link. It is simple to create and
configuration and get the system up and running.

I understand that the new version of EFS will be managed via JAVA and will add 
proxy support for content filtering, include JAVA and activeX filtering.

	A cool product,
		george

PS - the log functions need to be improved, but maybe this will be tackled in 
the new version.



From firewalls-owner  Thu Jan 15 14:18:27 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id NAA11123; Thu, 15 Jan 1998 13:24:11 -0800 (PST)
Received: from luomat.peak.org (cc344191-a.ewndsr1.nj.home.com [24.2.83.40]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id MAA03436; Thu, 15 Jan 1998 12:43:55 -0800 (PST)
Received: (from luomat@localhost)
	by luomat.peak.org (8.8.8/8.8.8) id PAA01036;
	Thu, 15 Jan 1998 15:45:54 -0500 (GMT-0500)
Message-Id: <199801152045.PAA01036@luomat.peak.org>
Content-Type: text/plain
MIME-Version: 1.0 (NeXT Mail 4.1mach v148)
X-Image-URL: http://www.peak.org/~luomat/next/luomat@peak.org.tiff
X-Nextstep-Mailer: Mail 4.1mach (Enhance 2.1)
Received: by NeXT.Mailer (1.148.RR)
From: Timothy J Luoma <luomat@peak.org>
Date: Thu, 15 Jan 98 15:45:50 -0500
To: firewalls@GreatCircle.COM
Subject: bounces for <brett@tfn.com>
cc: postmaster@GreatCircle.COM
X-Image-URL-Disclaimer: hey, it's off my student ID, gimme a break ;-)
Sender: firewalls-owner@GreatCircle.COM
Precedence: bulk

	
I'm getting multiple copies of an error message saying that <brett@tfn.com>  
is an unknown user.

I've gotten 5 copies so far in the last 10 minutes.

Anyone else seeing this?


TjL

Begin forwarded message:

From: mailer-daemon@mailrelay2.tfn.com
Date: Thu, 15 Jan 98 15:41:21 -0500
To: <luomat@peak.org>
Message-ID: <mailer-daemon@mailrelay2.tfn.com-18A0ABFB104253>
Subject: Message Delivery Failure
X-WSS-ID: 18A0AD91103525-18A0AD91103526-01-tfn.com-18A0ABFB104254-01

The WorldSecure Server SMTP Relay is returning your message because:

	Unable to deliver to recipient on remote mail host:
		<brett@tfn.com> - 550 <brett@tfn.com>... User unknown



----------

X-Server-Uuid: b0832e76-507b-11d1-9cee-00e0290993bc
Message-ID: <199801151755.MAA23111@luomat.peak.org>
From: "Timothy J Luoma" <luomat@peak.org>
Date: Thu, 15 Jan 98 12:55:21 -0500
To: <firewalls@GreatCircle.COM>
Subject: Re: Freelance internal hacking a bad idea (was: Exposing fraudulent SA's)
X-Image-URL-Disclaimer: hey, it's off my student ID, gimme a break ;-)
Sender: <firewalls-owner@GreatCircle.COM>
X-WSS-ID: 18A0AD91103525-18A0AD91103526-01


Yeah.... Remember the story of Randall Schwartz @ Intel.  He *was*
the sysadmin and lost his job for running 'crack' because his
actions were seen as a hack-attack.

Then he was taken to court and sued.

Be cautious when mucking with security issues.

TjL



From firewalls-owner  Thu Jan 15 14:21:02 1998
Received: (majordom@localhost) by honor.greatcircle.com (8.8.5/Honor-Lists-970926-1) id NAA09711; Thu, 15 Jan 1998 13:18:43 -0800 (PST)
Received: from diablo.cisco.com (diablo.cisco.com [171.68.223.106]) by honor.greatcircle.com (8.8.5/Honor-971021-1) with ESMTP id NAA09499 for <firewalls@GreatCircle.COM>; Thu, 15 Jan 1998 13:17:59 -0800 (PST)
Received: from big-dawgs.cisco.com (herndon-dhcp-53.cisco.com [171.68.53.53]) by diablo.cisco.com (8.8.5/CISCO.SERVER.1.2) with SMTP id NAA20481; Thu, 15 Jan 1998 13:19:42 -0800 (PST)
Message-Id: <3.0.5.32.19980115161931.007cde80@lint.cisco.com>
X-Sender: pferguso@lint.cisco.com
X-Mailer: QUALCOMM Windows Eudora Pro Version 3.0.5 (32)
Date: Thu, 15 Jan 1998 16:19:31 -0500
To: mcnabb@argus-systems.com (Paul McNabb)
From: Paul Ferguson <ferguson@cisco.com>
Subject: What _is_ a VPN, anyway? [Was: Re: Pushing the envelope...]
Cc: connie.j.sadler@lmco.com, firewalls@GreatCircle.COM,
        Geoff Huston <gih@telstra.net>
In-Reply-To: <199801131550.JAA21875@mail.argus-systems.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Trans