7/27 One of the instructional computers was found cracked and was
possibly running a sniffer. Since the machine in question was
on the 43 net, soda accounts might have been compr[o]mised.
\_ are there political problems w/ turning off rsh telnet and
so on (in favor of ssh)
\_ Is that a pretty elitist point of view? Maybe we should just
leave rsh/telnet enabled, but force them to use a one-time-use
password scheme.
\_ lots of people don't access to ssh.
\_ lots of people don't [have] access to ssh.
\_ SSH does not work well with some corporate firewalls
\_ A more 3l33t plan would be to unplug soda's net connection, and
have all interaction with the machine be via hardwired TVI 920
terminals. All the terminals would be in the same room as soda
(to make sure that hackurs from the outside don't splice their
way into the wiring), and that room would be TEMPEST shielded.
\_ and what would we use soda for it it had no net connection?
\_ Don't use telnet. Don't use telnet. Don't use telnet.
(I have said it thrice; what I tell you three times is true.)
\_...or ftp, or pop3...
\_ Kerberized telnet? telnet -x otherhost
\_ not to soda
\_ sometimes we have to connect to soda from devices that don't
support anything BUT telnet. Like routers and access servers.
We need one-time-passwords on telnetd. -ERic
\_ but was the snark a boojum?
\_ The snark WAS a boojum, you see.
\_ If your firewall is lame-ass (i.e. run by BBN because
some marketroid thought it would be a good idea) and
you are forced to use telnet, do what you can to set up
one-time passwords via s/key. There is a free WinBlows
one-time password computer available out there (I got
my copy from somewhere on <DEAD>ftp.msri.org<DEAD>) and if you want
to port it to another UNIX then we have source here on
soda. Doesn't solve all problems, but at least prevents
scriptkiddies from grabbing your real password.
rtfm on skey(1) for more info. -- tmonroe
\_ Might want to check out OPIE instead of S/Key. --dim
\_ urlP
\_ ftp://ftp.nrl.navy.mil/pub/security/opie or
ftp://ftp.inner.net/pub/opie --dim
\_ One-time passwords are somewhat limited compared to
SSH, though, since they don't typically encrypt the
contents of your session (thus preventing you from
safely typing other passwords from within telnet).
Better than nothing, though.
\_ The point was not everyone can use ssh.
\_ ssh is also much better than telnet for dealing
with flaky connections that drop a lot of packets
for extended periods of time, if you don't want
to lose link. For some reason. Can someone
explain this? I'm curious. -John
\_ TCP_KEEPALIVES-- telnet uses them, ssh doesn't.
odd that the SO_KEEPALIVE would cause to lose
connections in a lossy network, but thats how
it works. -ERic
\_ Since the 43-net runs through public access labs that anyone can
bring their laptop into and start sniffing, always assume packets
to soda are being sniffed.
\_ Why isn't access at the public access labs run on switches?
Is there a reason to expose the communications "backbone"?
\_ What's the notation for "current PID" in most shells and
Perl? There's your answer.
\_ Geek. Just say $$. Sheesh. Had to be "clever"?
\_ Switches cost money - the dept's just barely finishing
converting Cory Hall - Soda Hall is scheduled to be
converted as soon as they figure out who's paying for it.
\_ the cost difference between switched and shared is
negligible these days. -tom
\_ But they already have shared and already paid.
Also, maybe they want to wait for Fast Ethernet?
\_ Because the university by its nature is always behind. |