The DMZ

Iszi

12:07 AM

@packs Hah... funny.

packs

12:53 AM

I aim to pleasure

Rory Alsop

1:18 AM

@nealmcb done

Iszi

Anyone else see this one as "subjective and argumentative"?

1

Q: To firewall or not to firewall?

There's recently been some discussion (to be generous) about the pros and cons of having a firewall deployed in front of servers. The con mainly being that it's a point of failure in case of a DDoS. Microsoft has been talking about doing away with the standalone firewall and instead basing securi...

Rory Alsop

@Iszi hahaha - VX!

and, evening all

Iszi

@RoryAlsop Yeah, if I'd written the equation properly the first time, the Roman algebra joke would have been a little funnier because x=X.

Rory Alsop

LOL - wish I'd read it, but I was running around getting stuff ready and didn't have time

it is funny now though - so still worthwhile :-)

As to the firewall one, possibly subjective but I think the answers coming out are interesting. Maybe it should be a community wiki

Preparing an answer now, as the majority of the setups I work with are different to all the ones illustrated there :-)

nealmcb

@RoryAlsop Thanks!

Rory Alsop

1:52 AM

@Iszi - regarding the default passwords one - think we should give him a wee bit more time. Looks like he hasn't been back so won't have seen the comments.

I do agree with you though :-)

packs

@RoryAlsop I agree with the default passwords one, I'm holding judgement until he clarifies a bit.

Iszi

@RoryAlsop Don't disagree. Just wanted to put my $0.02 in, in case there were already close votes active. It's becoming mildly frustrating that I can't see close votes until I actually have the close-vote permission.

Rory Alsop

what rep do you need @Iszi?

Iszi

@RoryAlsop I think... 1k for beta? (Checking)

Oh, it's 500

Rory Alsop

you're nearly there then :-)

Iszi

1:57 AM

@RoryAlsop Aye :-)

Rory Alsop

get a couple of answers in and you'll be closing before the weekend

Iszi

@RoryAlsop Yeah, problem is that compared to most on here I'm still pretty newbish at ITSec.

Rory Alsop

Definitely worth asking about anything that you need to know about then

that will also get your rep up quickly

anyway - got to go, it's 2am and I still need to submit all my set lists for the last 19 gigs so I can collect some royalties payments. Ah, the rock and roll lifestyle :-)

Iszi

"How do you afford your rock and roll lifestyle..."

Rory Alsop

it pays for itself

the gigs cover petrol, new kit etc

Iszi

2:02 AM

@RoryAlsop ('Twas a song quote, in case you aren't familiar.)

Rory Alsop

Hahaha - totally missed it, sorry :-)

In my defence, it is 2am...and I have spent the last 4 hours practicing so the brain is almost as numb as the fingers

Iszi

@RoryAlsop Yeah, sounds like tome for bed for you.

Took your advice by the way...

0

Q: Automated tools for Cisco IOS config auditing?

Are there any automated tools for auditing config files exported from Cisco IOS devices? Free/Open Source is always nice, but anything that does the job would be of interest.

audit ios cisco

packs

2:20 AM

@RoryAlsop s/defence/defense/ There, I fixed that for you.

I do rather find the random placement of privs on the beta sites to be rather....odd.

I think they're in a different fricken order

Iszi

@packs I've checked before - they are. And non-proportional in progression either.

packs

@Iszi Is this auditing it against set policies? I.e., All Routers Shall Use NTP Against This Server

Iszi

@packs I'd be happy if it made the configuration more human-readable. But yeah, validating a given policy is a bonus.

packs

I think I've seen something like that before, I'll try to remember to look for it.

For a while, I was hot and heavy into the config stuff for Cisco. I.e., I had to write a config parser and automated management tools for the PIXes since nothing that existed supported multi-context mode.

I definitely came across some cool stuff, but that's been a while

Now time for tele with the wife.

Of course, tomorrow I also have to get some photoshop time in.

We're doing Shackled City as a round-robin GM and my chapter starts tomorrow night.

Trying to get reveal layers for, at least, the first map done

Iszi

Don't speak Photoshop myself, or I'd be happy to help.

Feeds

10:33 AM

Stack Overflow Blog: Moderator Messages

Posted by Jeff Atwood on February 2nd, 2011

First, a quick update on the Stack Exchange moderator election schedule.

Ending today, so get those votes in!

Ending soon:

Just started:

Coming soon, in this order, at 3 per week:

As you can see, we have a lot of community moderators! That’s why we’ve been working so hard lately on improving our moderator tooling, to make sure our new class of incoming moderators have as pleasant, polished, and smooth an experience as possible.

One thing we haven’t helped much with, historically, is when a moderator needs to contact a user directly to resolve serious issues. We always encourage direct one-on-one communication to resolve user behavior issues before they become a problem. Unfortunately, the only way for a community moderator to contact a user was to email the user from his or her personal email account. Ew, right? Far from an ideal solution, but it was the only one we had… until today! …

packs

1:30 PM

@AviD So if I am reading all this stuff right, every question gets tweeted out?

Also. Good Morning Gentlemen, and Ladies should that be applicable.

Rory Alsop

2:46 PM

@packs - good afternoon :-)

packs

3:11 PM

@RoryAlsop At 10:11am? Unpossible!

Rory Alsop

3:31 PM

@packs - LOL at you and your 5 hour offset

packs

God Rory! We've been over this. UTC-5 is canonical!

Rory Alsop

I thought we'd agreed UTC + or - anything was nonsensical :-)

packs

Only in New Zealand or Tuvalu

I leave the rest as an exercise to the reader.

Rory Alsop

3:49 PM

I'll just have to keep calling it Greenwich Mean Time then, to hark back to the days of Empire

►

:-)

packs

I may have to watch that later

Elbow deep in setting up the provisioning of 5 more snort sensors

packs

4:08 PM

Took me longer than I care to admit to get the infrastructure tested and built, but I'm to the point of managing a few dozen with relatively little effort. That makes me happy :)

Iszi

6:03 PM

@packs Oooh, I may have to pick your brain on that sometime. Snort is something on our to-do list.

packs

6:14 PM

@Iszi Sure, np.

You work in the private sector, yes?

Rory Alsop

7:26 PM

Ah - I'm delighted - my band has been nominated for best Metal Act in the 2011 Scottish Alternative Music Awards!

2

infosecfrog.blogspot.com/2011/01/…

Anyone likes 80's rock guitar and 90's techno rhythms held together with exceedingly funky bass, feel free to head on over (and vote for us from Monday!)

:-)

packs

</selfpromotion class="shameless">

Your makeup is cute :)

Doktor! YUS! I know exactly what I will be calling you henceforth.

Rory Alsop

@packs Hahahaha - yep it's shameless, and I weighed up the risks of presenting my alter ego over here....

packs

It's true, risk assessment is a big part of our industry.

This has you guys listed in Edinburgh. I thought you were a bit to the west

Rory Alsop

8:03 PM

I live about 12 miles west, or thereabouts

but this is just a suburb of Edinburgh

packs

Ah, I thought you were in Glasgow, hence my confusion

I get what you mean about the suburb thing. We honeymooned out of Currie

Rory Alsop

Ahh - now Currie is very close, about halfway between here and Edinburgh city centre

packs

I just checked on the map and saw that it was about 6 miles out. I actually thought it was closer in.

packs

8:42 PM

I was just wondering.

The spirit of higher ed is in your favor if you're there.

But, your removal of that statement does make my spidey-senses tingle

Iszi

@packs I just prefer to keep disclosure of my RL to a minimum audience, on the Internet.

AviD

evening, folks

Iszi

@AviD Howdy.

packs

@AviD!

@Iszi I was big on that as a kid. After a couple of years working in the industry, and especially at a university, I grew to realize two things.

1) Professionally - I am public record, although some small parts of me may be redactable.

2) Online reputation is good

I mean, look at that one mod that we have here. His linkedin page is killer

Oh, Hi AviD

Iszi

Yeah, LinkedIn... I should update that.

packs

8:55 PM

:)

AviD

lol

@packs in what way do you mean?

or was it just general sarcasm? ;)

packs

Well, according to that place, you do have a good looking CV. But yeah, the general air of sarcasm also applies

AviD

well, thank you - and, gee thanks ;)

Iszi

I do have some RL-associable accounts, but I try to keep those fairly separated from my online alias. If someone tried, they could put the two together but I'm still just paranoid enough that I don't want to make it too easy.

AviD

actually, my linkedin profile does get me a lot of work - potentially, anyway

there was a time that I was getting a job offer every few weeks through it

now, less so - but instead I'm getting projects/clients

it does actually work, at least for me....

Rory Alsop

8:59 PM

@AviD et al - my online profiles get me a lot of work, both in security and music

AviD

(nevermind that I'm so picky that very little was actually relevant, but still...)

Rory Alsop

essential!

In fact I just posted a piece on LinkedIn specifically about social networking :-)

AviD

@RoryAlsop absolutely

Rory Alsop

I like talking at conferences so I can't really separate much online from RL

packs

@RoryAlsop That's my thing too. I'm trying to work myself up to that kind of thing.

That was one reason I decided to get involved in these sites, actually.

I need to add some more info to my linked in account, and update my cv in general.

I've spoken at a few local conferences, but nothing is really documented

Iszi

9:04 PM

Isn't cisco-ios a little redundant of cisco? I mean, in the sense that the two don't really need to be together?

Rory Alsop

@AviD The SE model is proving pretty good from a sharing experience with the community perspective, and in terms of getting your name in front of a wider audience it is already showing value - which will increase as it grows

@Iszi - I think we had the discussion a while back that ios was now pretty much regarded as the apple OS, so the cisco prefix was to distinguish it

packs

Is it worth making a synonym to cisco?

I realize they are technically different, but...

Iszi

@RoryAlsop Right, but what I'm saying is does the cisco tag really need to be on the same post as a cisco-ios tag?

Also, I did propose an alternative, here:

0

A: Will there be a problem with the [ios] tag?

Just wanted to throw another suggestion in here. For Apple/Cisco iOS/IOS questions, use both applicable tags. My question about Cisco IOS config file auditing has both the cisco and ios tags.

Rory Alsop

@Iszi - gotcha. I reckon you would only need cisco-ios, not both cisco and cisco-ios

AviD

@Iszi did you mean if you already have cisco, why bother with cisco-ios?

Iszi

9:06 PM

@AviD The other way around, actually.

AviD

@RoryAlsop I agree - I actually had a few leads via my stackoverflow profile, too... and my rep there really isnt even very high

@Iszi ah, okay

is there not other cisco gear, besides ios?

packs

From a technical perspective, IOS only runs on the routers. Other cisco devices had different enough operating systems that it would be like saying that 'We already have [aix] so why do we need [linux]?'

Iszi

@packs I'm not saying do away with the cisco tag entirely. Only on questions already tagged with cisco-ios.

And, I thought IOS also ran on switches, APs, etc?

Rory Alsop

@Iszi totally agree in this sort of case. You already have cisco-ios, and it can stand alone, but is a sub tag of cisco, so adding cisco adds no value

AviD

"sub tags" are not unheard of...

packs

9:10 PM

@Iszi That's a negative. The command structures may be similar, but it is a different OS

I can into this problem with trying to manage PIXes back when we still did that

Rory Alsop

@Iszi Just routers

Iszi

@AviD The first that come to my mind are the SOHO products via Linksys.

Rory Alsop

@packs - you're too fast for me

packs

Yeah, I effectively had to write my own version of rancid

I made the mistake of making a pot of coffee after lunch, and am apparently the only guy drinking it.

I am ON FIRE!

Iszi

@packs Hm. I took a CCNA class not long ago, and there didn't seem to be much distinction made. Of course, there's plenty else I can say about that particular class...

packs

9:13 PM

@Iszi By and large, the command structures are very, VERY similar, but there are differences.

Most likely, you would find out about that in an actual PIX, or now I suppose an ASA specific class.

Rory Alsop

It's the little things that trip you up between PIXs and routers

trying to remember one of the things that always annoyed me

Iszi

@packs I know there's differences between devices, but they're all (not including PIX/ASA) still IOS are they not?

packs

@Iszi Nope, the PIX/ASA have their own OS

Iszi

@packs I said excluding PIX/ASA.

packs

Oh, sorry.

I misread that.

Outside those, I dunno. I've only ever worked with 7200s and pixes

Iszi

9:17 PM

Just talking about general routers, switches, APs....

AviD

well, there you go - [cisco] is definitely larger than (and inclusive of) [cisco-ios].
is there value in having the more specific tag? wont someone who is expert in [cisco] also have equal expertise in ios?

packs

I would be really surprised if the APs ran IOS, but I really don't know.

Iszi

@AviD Perhaps, but someone looking for Cisco IOS questions isn't necessarily interested in PIX/ASA or SOHO devices.

AviD

so it is a distinct and independant subset?

I see.

packs

Quite, in fact I know guys who are Cisco switching gods, but have never touched a router in their professional lives.

Iszi

9:21 PM

@packs I'm not quite sure we'll need to break it down that far though.

AviD

what would a cisco switching god look like?

all robes and sandals and everything, greek/roman style?

or more with horns and helmets, ala vikings?

i know, strange heads, like the egyptian gods

packs

@AviD I would say Roman, except that their skin cannot be touched because they radiate too much heat.

And when they open their mouths gale force winds are produced.

AviD

heh

on the other hand, I think it does make sense to tag q's with both

as i said, its kinda a sub-tag

Iszi

@AviD On the same token, would you tag windows and windows-xp on the same question?

AviD

someone looking at the cisco tag would expect to see also ios stuff, no?

packs

9:25 PM

You see, it's funny because a single rack of Cisco equipment can be used to heat a small former Soviet Bloc country.

AviD

@packs lol

packs

@AviD That's why I was wondering if [cisco-ios] should be a synonym

AviD

@Iszi I really dont think we should have a windows-xp tag

packs

SP3 is still supported

Iszi

@AviD Thought that was the purpose of a sub-tag though? To establish a connection between the two?

AviD

9:26 PM

@packs synonyms are automatically translated into the master tag. its not kept...

not really a sub-tag....

Iszi

@packs And further, some organizations could argue there's need for a windows-98 tag.

Sad, but true.

packs

@AviD I don't know that I've actually seen a sub-tag, so I'm not sure how they work.

AviD

@packs hehe, thats not why... I meant, same as we shouldnt have windows-2008 and windows-7 and windows-vista

Rory Alsop

Luckily the oldest windows boxes any of my clients have is NT

packs

@Iszi No! Bad!

@RoryAlsop That's still downright scary

Rory Alsop

9:27 PM

unluckily they are large corporates - and they can't patch this 'essential' kit

very scary

packs

Have they called the vendor to ask?

AviD

same way I dont think we should have .net-4, .net-3.5 and .net-2.0

Iszi

@AviD And why not? There's plenty of solutions that are very much isolated to certain editions.

AviD

@packs you aint seen em cuz they dont exist

Rory Alsop

how many .net-x questions do we have?

AviD

9:28 PM

when i said "sub-tag", i meant virtually

logically

packs

@RoryAlsop I hear crap like that all the time, and the real reason is that the techs are too lazy to actually find out if a newer version can work.

Rory Alsop

@packs - god , yes. or that the vendors will not do an update

AviD

@packs hear hear

Iszi

@packs There's also the "the guy who put this together is not around anymore, and we don't think we can touch it without it turning to dust" excuse.

packs

@AviD Heh, I honestly wouldn't be surprised if they did exist. I don't follow the SO blog because of the SNR, so I miss all kinds of things like that.

AviD

9:29 PM

@Iszi but does it matter? is a simple [windows] tag not good enough?

Rory Alsop

the ones I see still working away are usually because the original vendor no longer exists

as Iszi said

AviD

will that scare off all those that are only experts in a specific edition?

packs

@RoryAlsop I've seen something like that with SCADA style systems

However, at least they're current, supported OSes, just a year-ish out of patches.

Rory Alsop

yay for SCADA - was safe-ish until it got connected to the Interpipes

Iszi

@AviD When it means lumping XP together with 7, absolutely not.

packs

9:30 PM

@RoryAlsop Smells like network-segmentation!

AviD

@Iszi gimme an example where a simple [windows] tag wouldnt work.

dont forget, we're on itsec - not SF or SU

@RoryAlsop 7 .net questions

Iszi

@AviD Windows Firewall, and group policies.

AviD

so why would [windows] tag not work?

Iszi

Big differences between XP/7.

AviD

@Iszi oh, i agree 100%.

I'm just saying that tagging a question [windows] is correct, and [windows-xp] or [windows-7] is extraneous at best, harmful and cofusing at worst

Iszi

9:33 PM

Each edition's tag can easily exist on its own, and still garner a lot of posts.

AviD

but you need to specify versions in the question, and thats not what the tags are for

@Iszi yes, but what is the benefit there?

will a windows security expert only know windows vista, but not 7?

Iszi

@AviD Specificity? Searchability?

Rory Alsop

kids all asleep. need some beers with SWMBO - might be back later on

Iszi

@AviD Actually, it's probably more likely the other way around. Vista being what Vista was, and all.

AviD

tags are not for specificity, and for searchability (i assume you mean ala seo?) it can be in the title, or the body, etc...

packs

9:35 PM

@RoryAlsop Enjoy! I'll drink a few tonight while I try to kill my friends with fiendish critters :)

AviD

@Iszi heh, fair enough, bad example - but you know what I mean

Iszi

In any case, I gotta get rolling. Can continue later tonight.

AviD

gnite @Iszi @RoryAlsop

Rory Alsop

nite @AviD

packs

Oh, @AviD, with respect to the 'different requirements levels' I referred to in that Secure Programming standard question.

We would only have 3, and they map directly to the Data Classification policy. So no more than 3, but probably 2.

AviD

9:45 PM

ah

not so bad then - but still a bit tricky to manage

unless, the levels are already clearly and unambiguously defined and agreed upon, and everyone understands them, and always knows which is the relevant level....

packs

We went down this road with servers a few years ago, so I'm trying to keep them as similar as I can for consistency.

AviD

makes sense, though really, how many of your audience would see/use both?

though it would definitely help for the security guys...

packs

That is what is more important to me. If we can be as consistent as possible across the board, then we can speak better.

Plus, it would help classify the overall stack

I'm bouncing ideas around, so we'll see how it pans out :)

AviD

@packs good luck!

packs