Dan York

Just a guy in Vermont trying to connect all the dots...

Author's posts

Aug 09

Slovenian Government IPv6 Study Now Available In English

Back in 2010, the Go6 Institute brought together a group of experts to write a comprehensive report for the Slovenian Ministry of Higher Education, Science and Technology about IPv6 and how the government and industry should respond.

This year they were able to update the study with newer information and translate the report from Slovenian into English. They have now made this detailed document available for public viewing and download at:

http://go6.si/en/2012/04/slovenian-ipv6-study-english-version/

While obviously some of the information is focused on IPv6 deployment in Slovenia, the document speaks very broadly to issues that governments and businesses need to consider – and in particularly why they need to move ahead with their use of IPv6 now.

Congratulations – and thanks – to Jan Žorž and the others involved with the effort of making this document available in English where it can be more widely read.

Aug 08

Looking for DNSSEC Training? Here Is Some Courseware…

DNSSECLooking for some material to teach people about DNSSEC? Would you like to run your own training session? Or incorporate some DNSSEC material into other courses you have?

If so, Olaf Kolkman and the great folks at NLNet Labs have released some courseware coming out of some DNSSEC training they did earlier this year at:

http://www.dns-school.org/Slides/index.html

Available in PDF, Keynote and PowerPoint – and available under a Creative Commons distribution license – the material covers overall DNSSEC issues and also goes into deep dives in installing/configuring Unbound and OpenDNSSEC.

Great materials to have out there openly available – and many thanks to Olaf and the crew at NLNet Labs for making this material available to the public.

Aug 07

Video Tutorial: Using FTP over IPv6

The folks at RhinoSoft recently published a video on YouTube showing how their “Serv-U” FTP server and “FTP Voyager” FTP client all work with IPv6. While obviously focused on one vendor’s implementation, it provides an interesting view into how IPv6 can work with FTP. Kudos to the team at RhinoSoft for making this video available.

As with any reference we make to commercial products, we at the Internet Society Deploy360 Programme are not explicitly endorsing this product but rather providing a view of what this vendor is doing with FTP and IPv6. If we find other similar vendors providing services over IPv6 we are glad to consider posting about their videos, too. (And suggestions are always welcome.)

Aug 06

NIST’s Excellent Guidelines On How To Securely Deploy IPv6

Looking to understand how to securely deploy IPv6? Want a document you can provide to your security team or others concerned about IPv6?

If so, we’ve recently added to our list of resources an excellent “Special Publication” from the U.S. National Institute of Standards and Technology (NIST):

Guidelines for the Secure Deployment of IPv6

Like most of NIST’s special publications, including their excellent guide to DNSSEC, the document begins with a lengthy tutorial and then walks through a number of IPv6 security issues in great depth. It’s a very thorough document and includes detailed sections on the many different IPv4-to-IPv6 transition mechanisms as well as detailed appendices.

While the document naturally includes sections providing guidance for US federal agencies, the majority of the document is very applicable for anyone looking to understand issues of IPv6 security.  Well worth a read… and worth passing along to others who may be asking you questions about IPv6 security.

 

Jul 31

SC Magazine: Security practitioners need to learn the basics of IPv6

SC Magazine LogoWhat are the security issues of IPv6? With World IPv6 Launch now underway, what should security practitioners care about?

The Australian edition of SC Magazine ran a piece last Friday called “IPv6 co-founder talks protocol security” where Robert Hinden lays out some of the main issues security professionals need to be concerned about, including:

  • Unauthorized IPv6 tunnels can provide hidden gateways in and out of a network;
  • Security devices may not have IPv6 turned on and are therefore not monitoring/scanning any IPv6 traffic;
  • Operating systems may have IPv6 enabled by default and without IT’s knowledge; and
  • These IPv6 tunnels may completely bypass firewalls, intrusion prevention systems, etc.

The article recommends – but unfortunately doesn’t link to – the excellent guidelines from NIST about how to securely deploy IPv6.

We definitely agree with the thrust of the article – security professionals definitely do need to understand the basics of IPv6 because the reality is that IPv6 will be on most networks purely through operating system defaults.  Plus, as World IPv6 Launch has shown, more and more networks are starting to move to IPv6.  The time to learn how to securely implement IPv6 is now!

Jul 31

The Case Of The Missing Hotel Stationery…

Hotel deskSomething's gone missing from hotel rooms these days. In fact, I haven't seen it for quite some time. It used to always be there... and as a lover of writing I'd use it now and then. It was a fun way for me to stay in touch with those back at home.

I'm talking about hotel stationery.

Back in the day, as the younger kids say, that drawer in the desk in your hotel room often contained several pieces of stationery with the hotel name, address, etc. on it. If it wasn't in the desk drawer, it was perhaps in the binder or folder that was in your room describing all the hotel amenities, typically in the pocket in the front or the back.

The best stationery I can remember often had the hotel name in some fancy typeface... or perhaps embossed into the paper. Sometimes there was a drawing or the logo or branding of the hotel or of the geographic. The companion envelopes were also similarly designed.

In the evening, I'd sometimes write letters back to my wife or to other friends. Mail them off the next day... and very often beat them home so that they'd show up sometime after I'd returned. I didn't do it all that often, but now and then it was something fun to do.

Now, though, in the era of email and Facebook and Skype and Instagram, we as a society pretty much don't write letters any more. Not in our homes... not to our friends... not to our family... and not when traveling. Heck, these days many folks would probably be challenged to even find a stamp in their house if they randomly decided to send off a letter! Plus, they'd have to remember how to write with their hand for more than a few words...

And even in the random hotel that might still have stationery, the process of mailing a letter may be more trouble than it's worth. I remember maybe a year or two ago I tried to send a letter to my kids. I wrote it on the hotel stationery, but when I went to the front desk they (after looking at me as if was from Mars) said they had no stamps but that I could perhaps get them from the hotel gift shop. The shop was closed, though, and I was leaving early in the morning, and so I seem to recall bringing that letter home in my bag. Since that time, on a few random times when I've thought of it, I've not seen any evidence of any stationery anywhere in my rooms.

And so, just like hot meals on airplanes, hotel stationery fades off into memory... a quaint anachronism of a distant era.

As a writer and lover of pens and language, I admit that a part of me does lament the passing. There was something solid about writing letters. Something tangible... something "real." And something fun... since each hotel's stationery was different from that of the others.

'Twas an experience that can't really be replicated in the sterile digital world of 1's and 0's. Sure, we can use funky typefaces and can take photos of where we're at... and don't get me wrong, I love having the real-time updates from my friends and family while I'm away and completely enjoy the video calls back home.

But I can't shake the feeling that in those empty desk drawers we've lost a little something...

Ah, well.

Time to post this to my blog, where it will then go out to Twitter and Facebook and be published in ways we could never have even remotely imagined... back in the days when stationery was all there was...

P.S. And if you are young enough to have perhaps never experienced receiving anything written on stationery, the Wikipedia entry talks a bit about what you missed. :-)

P.P.S. As a bonus, if the word "stationery" falls out of usage, the new generations of kids will never have to be concerned about the difference between "stationEry" (writing materials) and "stationAry" (in a fixed place).

If you found this post interesting or useful, please consider either:

Jul 30

How To Hack OpenSSH To Add DNSSEC Validation

OpenSSH logoWould you like to have SSH just automagically use DNSSEC to verify the authenticity of the SSH keys you are using to connect to another system?

Over on his blog, Jan-Piet Mens lays out the steps to add exactly this, demonstrating how to add ldns support into OpenSSH. Essentially all you need to do is recompile OpenSSH with the “--with-ldns” option.

To back up a moment and explain a bit more, RFC 4255 defines how to store SSH keys in DNS as SSHFP resource records. With DNSSEC signing all the resource records for a domain, you can now verify the authenticity of those SSH keys with the use of a DNSSEC-validating resolver. This provides a more secure alternative than requiring you to in theory confirm an RSA fingerprint when you are connecting to a server.

So for this all to work, you need to:

  1. Have SSH keys for the target machine stored in DNS as SSHFP resource records.
  2. Have the domain for the target machine signed with DNSSEC.
  3. Compile and install OpenSSH with the ldns option.
  4. Have access to a DNSSEC-validating DNS resolver. (Which could be accomplished by installing DNSSEC-Trigger, for instance, or using a DNSSEC-validating DNS resolver from your ISP if they offer one.)

Once you have done those steps, the beauty of the process is that you are no longer prompted with the message “The authenticity of host ‘____’ can’t be established” with the RSA key and the question about do you really want to connect.

Right now you have to recompile OpenSSH to add the ldns support, but hopefully as DNSSEC becomes increasingly deployed more widely this will just be one of the standard compilation options so that you’ll be able to just go to the command-line and type “ssh” and let it automatically do the DNSSEC validation.

Thanks, Jan-Piet, for writing up these steps!

Jul 27

NIST Guidelines for the Secure Deployment of IPv6

The United States National Institute of Standards and Technology (NIST) created an excellent “Special Publication” related to IPv6 security called:

Guidelines for the Secure Deployment of IPv6

Like most of NIST’s special publications, including their excellent guide to DNSSEC, the document begins with a lengthy tutorial about IPv6 and how it compares to IPv4.   The document then walks through a number of IPv6 security issues in great detail.  As the title implies, a large part of the document is focused on how to deploy IPv6 securely, and includes detailed sections on the many different IPv4-to-IPv6 transition mechanisms.

It concludes on the very positive note:

Security risks are inherent during the initial deployment of a new protocol such as IPv6, but mitigation strategies exist and many of the residual risks are no different from those that challenge existing IPv4 networks.

And then goes on to provide lengthy appendices fully of definitions, references and links to learn more.

While written for the audience of US federal agencies, this document is an outstanding reference for anyone seeking to understand how to securely deploy IPv6 within their networks.

 

Jul 27

Warning! DNSSEC-Trigger Installation Issue After Mountain Lion Upgrade

Dnssec TriggerIf you are a Mac OS X user looking to upgrade to the brand new Mountain Lion release – and you also have installed DNSSEC-Trigger to have a local DNSSEC-validating DNS resolver, it seems there may be an issue during the upgrade process that you need to deal with.

[UPDATE: This issue apparently only affects new installations of DNSSEC-Trigger.  If you already have DNSSEC-Trigger installed, the upgrade to Mountain Lion works.  It is when you go to install DNSSEC-Trigger on Mountain Lion that the issue appears.]

Over on the dnssec-trigger mailing list, Olaf Kolkman of NLnet Labs writes about the problem with Mountain Lion and provides instructions for how to address the problem.  If you notice unbound not starting after  the Mountain Lion upgrade, you will need to follow Olaf’s instructions:

If the command
$ id unbound
returns “no such user”, you know that you have been bitten by this problem.

To fix:
Allocate yourself a free id. You can see the allocated ids using the following:
dscl localhost -list /Local/Default/Groups PrimaryGroupID
dscl localhost -list /Local/Default/Users UniqueID

Then assign the ids to the unbound user.
sudo dscl localhost -create /Local/Default/Users/unbound PrimaryGroupID <number>
sudo dscl localhost -create /Local/Default/Users/unbound UniqueID <number>

In his email message, Olaf also provides a “use-at-your-own-risk” shell script for performing this fix.  He also indicates that the DNSSEC-Trigger team will be including a fix in a new release sometime in the next few weeks.

Jul 26

Google Now Lets You Handwrite Search Queries On iPad, iPhone, Android

Google handwritingOkay, I admittedly find this pretty cool... you can now enter search queries into Google on a tablet or mobile phone just by writing anywhere on the screen!

As Google's blog post outlines, you need to go to www.google.com on your mobile device and then go into the Settings to configure this option. You do NOT need to sign in to Google. You just need to go there in your mobile web browser.

I've tested this on both my iPad and iPhone and found it worked quite well (per the blog post and Help Center page, it also works on Android phones and tablets - and is available in 27 languages). I find it particularly useful on the iPad where you have the larger screen to write on. On the iPhone, maybe my fingers are just too big but I found it tight to write in the regular portrait mode.

I did notice, though, that you can enter one or two letters, pause, then enter another letter or two... and as you do the search window is updated with what Google thinks the text should be as well as search query suggestions. So you may just be able to write a few letters and then tap the correct search suggestion.

Now, the question, of course, is WHY I find this interesting and the answer is that I have had some times when I'm in situations where it's not super easy to type nor do I want to be talking to my phone (i.e. using Siri). With the iPad, in particular, there are times I'm holding it while walking around at an event where typing with two hands would not be easy and voice usage isn't really possible. I could see this potentially being faster than hunt-and-peck typing a query using one hand. Will I use it all the time? No... but certainly I can see it being nice to have this option.

What's also interesting about this feature is that it requires you to go to "www.google.com". It doesn't work with the "search" box that is in the top of Mobile Safari in iOS. You need to go to Google's home page... so Google is pulling you out of using the app (Safari) and into using their web page. If you get used to doing that, Google can of course introduce other functionality - and if you are "signed in" you see your Google+ notifications and can easily access other Google services. Intriguing move by Google.

What do you think? Will you use this capability on your iPad, iPhone or Android device?

P.S. Alas, it is not as all-powerful as TechCrunch asserts with an ability to interpret cursive handwriting. I made several attempts at using cursive and found that in some cases the accuracy was "okay", but clearly not as good as block printing. In fact, Google's Tips for Handwrite very clearly state at the beginning that you should use block printing versus cursive.

And here is Google's video on the topic:

If you found this post interesting or useful, please consider either: