Subject: Re: your mail

From: Dean Anderson <[email-masked]>
Date: Wed, 17 Mar 1999 13:40:19 -0500

This section is well intended, but not useful.   Using switched segments
don't improve security of the host; only obsurity is improved.  This is
another security myth.

All switches have limited internal tables for storing hardware addresses.
Once those tables overflow, the port changes to broadcast mode, and can be
sniffed just like a broadcast ethernet hub.

Vlans are safe against this sort of sniffer attack, but host security can
still be compromised.

Secondly, as Johnny points out, no one ever intentionally puts up a
"crackable" host.  All hosts are crackable.  Some are more or less easily
cracked depending on their management and current software, physical
security, etc. This is akin to a requirement that the operator not be
stupid.  Or that one never write code with a bug.  Operationally, everyone
does their best.  

But some people (prospective operators) might not have the background
knowledge or experience to realistically be expected to be able to do some
this correctly.  Those people can be identified and screened out.  What you
can do is require the operator to be knowledgeable and competent with high
visibility internet operations for the equipment and software they are
going to operate.

		--Dean

At 03:38 PM 3/17/1999 MET, Johnny Eriksson wrote:
>> Randy;
>> 
>>>        3.2.3 The LAN segment(s) on which a root server is homed MUST NOT
>>>              also home crackable hosts.  I.e. the LAN segments should be
>>>              switched or routed so there is no possibility of
>>>              masquerading.
>>
>> Isn't it better to require root servers attached to a single
>> LAN segment that each has only one IP address?
>
>The best might be if we also required all routers on the path from the
>end user to the root server to be uncrackable.
>
>Seriously, maybe the term "crackable host" in the original sentence
>should be changed to just "host".
>
>> 							Masataka Ohta
>
>--Johnny
>
>
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
           Plain Aviation, Inc                  [email-masked]
           LAN/WAN/UNIX/NT/TCPIP          http://www.av8.com
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

---

From: [email-masked] (Greg A. Woods)
Date: Wed, 17 Mar 1999 23:12:48 -0500 (EST)

[ On Wednesday, March 17, 1999 at 13:40:19 (-0500), Dean Anderson wrote: ]
> Subject: Re: your mail 

Hmmm... not necessarily:

	http://www.cri.cz/kra/index.html

perhaps if the VLAN switch has had the authorized MAC's hard-coded....

(the original reference I saw to this HUNT Project was on BUGTRAQ)

-- 
							Greg A. Woods

+1 416 218-0098      VE3TCP      <[email-masked]>      <robohack!woods>
Planix, Inc. <[email-masked]>; Secrets of the Weird <[email-masked]>