Dan York

Just a guy in Vermont trying to connect all the dots...

Author's posts

Aug 07

Video Tutorial: Using FTP over IPv6

The folks at RhinoSoft recently published a video on YouTube showing how their “Serv-U” FTP server and “FTP Voyager” FTP client all work with IPv6. While obviously focused on one vendor’s implementation, it provides an interesting view into how IPv6 can work with FTP. Kudos to the team at RhinoSoft for making this video available.

As with any reference we make to commercial products, we at the Internet Society Deploy360 Programme are not explicitly endorsing this product but rather providing a view of what this vendor is doing with FTP and IPv6. If we find other similar vendors providing services over IPv6 we are glad to consider posting about their videos, too. (And suggestions are always welcome.)

Aug 06

NIST’s Excellent Guidelines On How To Securely Deploy IPv6

Looking to understand how to securely deploy IPv6? Want a document you can provide to your security team or others concerned about IPv6?

If so, we’ve recently added to our list of resources an excellent “Special Publication” from the U.S. National Institute of Standards and Technology (NIST):

Guidelines for the Secure Deployment of IPv6

Like most of NIST’s special publications, including their excellent guide to DNSSEC, the document begins with a lengthy tutorial and then walks through a number of IPv6 security issues in great depth. It’s a very thorough document and includes detailed sections on the many different IPv4-to-IPv6 transition mechanisms as well as detailed appendices.

While the document naturally includes sections providing guidance for US federal agencies, the majority of the document is very applicable for anyone looking to understand issues of IPv6 security.  Well worth a read… and worth passing along to others who may be asking you questions about IPv6 security.

 

Jul 31

SC Magazine: Security practitioners need to learn the basics of IPv6

SC Magazine LogoWhat are the security issues of IPv6? With World IPv6 Launch now underway, what should security practitioners care about?

The Australian edition of SC Magazine ran a piece last Friday called “IPv6 co-founder talks protocol security” where Robert Hinden lays out some of the main issues security professionals need to be concerned about, including:

  • Unauthorized IPv6 tunnels can provide hidden gateways in and out of a network;
  • Security devices may not have IPv6 turned on and are therefore not monitoring/scanning any IPv6 traffic;
  • Operating systems may have IPv6 enabled by default and without IT’s knowledge; and
  • These IPv6 tunnels may completely bypass firewalls, intrusion prevention systems, etc.

The article recommends – but unfortunately doesn’t link to – the excellent guidelines from NIST about how to securely deploy IPv6.

We definitely agree with the thrust of the article – security professionals definitely do need to understand the basics of IPv6 because the reality is that IPv6 will be on most networks purely through operating system defaults.  Plus, as World IPv6 Launch has shown, more and more networks are starting to move to IPv6.  The time to learn how to securely implement IPv6 is now!

Jul 31

The Case Of The Missing Hotel Stationery…

Hotel deskSomething's gone missing from hotel rooms these days. In fact, I haven't seen it for quite some time. It used to always be there... and as a lover of writing I'd use it now and then. It was a fun way for me to stay in touch with those back at home.

I'm talking about hotel stationery.

Back in the day, as the younger kids say, that drawer in the desk in your hotel room often contained several pieces of stationery with the hotel name, address, etc. on it. If it wasn't in the desk drawer, it was perhaps in the binder or folder that was in your room describing all the hotel amenities, typically in the pocket in the front or the back.

The best stationery I can remember often had the hotel name in some fancy typeface... or perhaps embossed into the paper. Sometimes there was a drawing or the logo or branding of the hotel or of the geographic. The companion envelopes were also similarly designed.

In the evening, I'd sometimes write letters back to my wife or to other friends. Mail them off the next day... and very often beat them home so that they'd show up sometime after I'd returned. I didn't do it all that often, but now and then it was something fun to do.

Now, though, in the era of email and Facebook and Skype and Instagram, we as a society pretty much don't write letters any more. Not in our homes... not to our friends... not to our family... and not when traveling. Heck, these days many folks would probably be challenged to even find a stamp in their house if they randomly decided to send off a letter! Plus, they'd have to remember how to write with their hand for more than a few words...

And even in the random hotel that might still have stationery, the process of mailing a letter may be more trouble than it's worth. I remember maybe a year or two ago I tried to send a letter to my kids. I wrote it on the hotel stationery, but when I went to the front desk they (after looking at me as if was from Mars) said they had no stamps but that I could perhaps get them from the hotel gift shop. The shop was closed, though, and I was leaving early in the morning, and so I seem to recall bringing that letter home in my bag. Since that time, on a few random times when I've thought of it, I've not seen any evidence of any stationery anywhere in my rooms.

And so, just like hot meals on airplanes, hotel stationery fades off into memory... a quaint anachronism of a distant era.

As a writer and lover of pens and language, I admit that a part of me does lament the passing. There was something solid about writing letters. Something tangible... something "real." And something fun... since each hotel's stationery was different from that of the others.

'Twas an experience that can't really be replicated in the sterile digital world of 1's and 0's. Sure, we can use funky typefaces and can take photos of where we're at... and don't get me wrong, I love having the real-time updates from my friends and family while I'm away and completely enjoy the video calls back home.

But I can't shake the feeling that in those empty desk drawers we've lost a little something...

Ah, well.

Time to post this to my blog, where it will then go out to Twitter and Facebook and be published in ways we could never have even remotely imagined... back in the days when stationery was all there was...

P.S. And if you are young enough to have perhaps never experienced receiving anything written on stationery, the Wikipedia entry talks a bit about what you missed. :-)

P.P.S. As a bonus, if the word "stationery" falls out of usage, the new generations of kids will never have to be concerned about the difference between "stationEry" (writing materials) and "stationAry" (in a fixed place).

If you found this post interesting or useful, please consider either:

Jul 30

How To Hack OpenSSH To Add DNSSEC Validation

OpenSSH logoWould you like to have SSH just automagically use DNSSEC to verify the authenticity of the SSH keys you are using to connect to another system?

Over on his blog, Jan-Piet Mens lays out the steps to add exactly this, demonstrating how to add ldns support into OpenSSH. Essentially all you need to do is recompile OpenSSH with the “--with-ldns” option.

To back up a moment and explain a bit more, RFC 4255 defines how to store SSH keys in DNS as SSHFP resource records. With DNSSEC signing all the resource records for a domain, you can now verify the authenticity of those SSH keys with the use of a DNSSEC-validating resolver. This provides a more secure alternative than requiring you to in theory confirm an RSA fingerprint when you are connecting to a server.

So for this all to work, you need to:

  1. Have SSH keys for the target machine stored in DNS as SSHFP resource records.
  2. Have the domain for the target machine signed with DNSSEC.
  3. Compile and install OpenSSH with the ldns option.
  4. Have access to a DNSSEC-validating DNS resolver. (Which could be accomplished by installing DNSSEC-Trigger, for instance, or using a DNSSEC-validating DNS resolver from your ISP if they offer one.)

Once you have done those steps, the beauty of the process is that you are no longer prompted with the message “The authenticity of host ‘____’ can’t be established” with the RSA key and the question about do you really want to connect.

Right now you have to recompile OpenSSH to add the ldns support, but hopefully as DNSSEC becomes increasingly deployed more widely this will just be one of the standard compilation options so that you’ll be able to just go to the command-line and type “ssh” and let it automatically do the DNSSEC validation.

Thanks, Jan-Piet, for writing up these steps!

Jul 27

NIST Guidelines for the Secure Deployment of IPv6

The United States National Institute of Standards and Technology (NIST) created an excellent “Special Publication” related to IPv6 security called:

Guidelines for the Secure Deployment of IPv6

Like most of NIST’s special publications, including their excellent guide to DNSSEC, the document begins with a lengthy tutorial about IPv6 and how it compares to IPv4.   The document then walks through a number of IPv6 security issues in great detail.  As the title implies, a large part of the document is focused on how to deploy IPv6 securely, and includes detailed sections on the many different IPv4-to-IPv6 transition mechanisms.

It concludes on the very positive note:

Security risks are inherent during the initial deployment of a new protocol such as IPv6, but mitigation strategies exist and many of the residual risks are no different from those that challenge existing IPv4 networks.

And then goes on to provide lengthy appendices fully of definitions, references and links to learn more.

While written for the audience of US federal agencies, this document is an outstanding reference for anyone seeking to understand how to securely deploy IPv6 within their networks.

 

Jul 27

Warning! DNSSEC-Trigger Installation Issue After Mountain Lion Upgrade

Dnssec TriggerIf you are a Mac OS X user looking to upgrade to the brand new Mountain Lion release – and you also have installed DNSSEC-Trigger to have a local DNSSEC-validating DNS resolver, it seems there may be an issue during the upgrade process that you need to deal with.

[UPDATE: This issue apparently only affects new installations of DNSSEC-Trigger.  If you already have DNSSEC-Trigger installed, the upgrade to Mountain Lion works.  It is when you go to install DNSSEC-Trigger on Mountain Lion that the issue appears.]

Over on the dnssec-trigger mailing list, Olaf Kolkman of NLnet Labs writes about the problem with Mountain Lion and provides instructions for how to address the problem.  If you notice unbound not starting after  the Mountain Lion upgrade, you will need to follow Olaf’s instructions:

If the command
$ id unbound
returns “no such user”, you know that you have been bitten by this problem.

To fix:
Allocate yourself a free id. You can see the allocated ids using the following:
dscl localhost -list /Local/Default/Groups PrimaryGroupID
dscl localhost -list /Local/Default/Users UniqueID

Then assign the ids to the unbound user.
sudo dscl localhost -create /Local/Default/Users/unbound PrimaryGroupID <number>
sudo dscl localhost -create /Local/Default/Users/unbound UniqueID <number>

In his email message, Olaf also provides a “use-at-your-own-risk” shell script for performing this fix.  He also indicates that the DNSSEC-Trigger team will be including a fix in a new release sometime in the next few weeks.

Jul 26

Google Now Lets You Handwrite Search Queries On iPad, iPhone, Android

Google handwritingOkay, I admittedly find this pretty cool... you can now enter search queries into Google on a tablet or mobile phone just by writing anywhere on the screen!

As Google's blog post outlines, you need to go to www.google.com on your mobile device and then go into the Settings to configure this option. You do NOT need to sign in to Google. You just need to go there in your mobile web browser.

I've tested this on both my iPad and iPhone and found it worked quite well (per the blog post and Help Center page, it also works on Android phones and tablets - and is available in 27 languages). I find it particularly useful on the iPad where you have the larger screen to write on. On the iPhone, maybe my fingers are just too big but I found it tight to write in the regular portrait mode.

I did notice, though, that you can enter one or two letters, pause, then enter another letter or two... and as you do the search window is updated with what Google thinks the text should be as well as search query suggestions. So you may just be able to write a few letters and then tap the correct search suggestion.

Now, the question, of course, is WHY I find this interesting and the answer is that I have had some times when I'm in situations where it's not super easy to type nor do I want to be talking to my phone (i.e. using Siri). With the iPad, in particular, there are times I'm holding it while walking around at an event where typing with two hands would not be easy and voice usage isn't really possible. I could see this potentially being faster than hunt-and-peck typing a query using one hand. Will I use it all the time? No... but certainly I can see it being nice to have this option.

What's also interesting about this feature is that it requires you to go to "www.google.com". It doesn't work with the "search" box that is in the top of Mobile Safari in iOS. You need to go to Google's home page... so Google is pulling you out of using the app (Safari) and into using their web page. If you get used to doing that, Google can of course introduce other functionality - and if you are "signed in" you see your Google+ notifications and can easily access other Google services. Intriguing move by Google.

What do you think? Will you use this capability on your iPad, iPhone or Android device?

P.S. Alas, it is not as all-powerful as TechCrunch asserts with an ability to interpret cursive handwriting. I made several attempts at using cursive and found that in some cases the accuracy was "okay", but clearly not as good as block printing. In fact, Google's Tips for Handwrite very clearly state at the beginning that you should use block printing versus cursive.

And here is Google's video on the topic:

If you found this post interesting or useful, please consider either:

Jul 26

Video: An Excellent Tour Of Voxeo’s Awesome New Office!

Voxeo logoMy friends and former colleagues at Voxeo have produced a truly outstanding video giving a tour of the incredible space they have created in Orlando, Florida:

Kudos to the Voxeo marketing team for creating this video! And congrats to Jonathan Taylor and the rest of the team for realizing his vision of creating a truly unique working space and corporate culture in Orlando.

I'd note that Voxeo is quite often hiring and truly is a great company to work for. If you're looking for a job in the communications space with an excellent team of people, you should definitely check them out!

(Full disclosure: I worked for Voxeo from 2007-2011 and remain a shareholder.)

If you found this post interesting or useful, please consider either:

Jul 25

Hiring! Looking For An IETFer To Join ISOC’s Deploy360 Programme

Deploy360logo 300Do you want to help get open standards like IPv6 and DNSSEC more widely deployed? Would you like to see other technologies developed by the Internet Engineering Task Force (IETF) more rapidly adopted by network operators?

Are you passionate about the need to preserve the open nature of the Internet? Do you like to write, speak and create other forms of content? Would you like to be part of the Internet Society, the global nonprofit that serves as the organizational home of the IETF?

If so, the team I'm part of that is behind the Internet Society Deploy360 Programme is looking for YOU!

As we noted on the Deploy360 blog, we're currently hiring a new position into the team specifically to interact with network operators and help accelerate the deployment of open Internet standards.

You can read read the job description for what is called the "Operational Engagement Programme Manager". As noted in the document:

The Operational Engagement Programme Manager is a newly created position within the Internet Society. This position will report to the Director, Deployment and Operationalization. The primary focus areas of this position will be to: 1) develop and coordinate increased industry collaboration and conversations about the operationalization of Internet technologies; 2) work with targeted audiences around the globe to develop operational documentation on technology topics covered by the Internet Society Deploy360 Programme including, but not limited to, IPv6 and DNSSEC.

The job description goes on to list out the responsibilities and desired qualifications... the key point is that we're looking for someone who can help us expand the work we're doing in creating content that helps people deploy technologies such as IPv6 and DNSSEC. We're a small, fast-moving team that is highly focused on finding and creating the best possible content and promoting that through many different channels.

If you join our team, you'll be writing for the Deploy360 site and probably working with video, too. You'll be interacting with network operators through various online channels, including social media. You'll be speaking at events scattered all around the world.

And you'll be having fun while doing it! And serving the incredibly important mission of promoting the value of the open Internet!

Additionally, THIS IS A "TELEWORKING"/VIRTUAL POSITION! You do NOT have to be located in our Geneva, Switzerland, or Reston, Virginia, offices, but can be located anywhere. You can, just like me, work out of a home office. (There's this wee little thing called the Internet that makes this possible!)

One note - you MUST have experience with the IETF, so if you have never interacted with the IETF... well... don't bother applying! Experience with other operator groups is also very important.

If you're interested, the job description has contact information and instructions. We're also going to be out at IETF 84 in Vancouver next week speaking to people about this new role and would be glad to meet with you there. We have already received applications, so if you are interested, please contact us soon!

We've got a lot of great plans ahead of us... and we're looking for the right person to join our team. Please do check it out and consider applying!

P.S. The Internet Society is also hiring a Senior Director of IT Development and several other roles. It's a great organization with great benefits, great people and a great mission!

If you found this post interesting or useful, please consider either: