But just because you’ve enabled SSH on all your devices doesn’t mean your network is any more secure. SSH is only one in many changes that need to be changed in order to have a secure network.

Network Management, most network management software still access your devices using insecure techniques (some of which are listed below). What’s the use of using SSH, when you network management polls it every 5 minutes insecurely

Keys
A simple think overlooked in most SSH setups, is that keys are never logged / saved, nor are private/public key authentication. So when you have 500 network devices, when you connect to one, people start getting into the habit of just accepting ssh keys without looking at them. A simple ARP man in the middle attack could allow a user to grab your password without any work.

File Transfer
So you need to upload a config file. Simple I’ll just TFTP or FTP it. Maybe you might even HTTP it across. Well there you go, all the work of installing SSH on all your devices has been wasted. This can easily be fixed with either SCP, HTTPS or FTPS.

SNMP
Commonly used SNMPv2 and v1 has no encryption support. It is common that most devices are setup with SNMPv2 and v1 rather than the SNMPv3 which support encryption. SNMP can be used to monitor, and set configuration options on most devices.

Vulnerabilities in software
Sounds pretty stupid, but why would an attacker bother with SSH when they can just exploit a page. It’s annoying, but IOS and other software need to stay updated.

Routing Protocols
Routing protocols really need to stay on routed links. Having OSPF running on general access VLANs is not a good idea. Very easy to make a man in the middle attack.

Spanning Tree
Spanning Tree can easily be disturbed, and be used for malicious activities. BPDU GUARD really needs to be enabled on access ports, otherwise you’ll be in trouble.

Theses simple fixes will in fact make your network more secure than SSH would.

• At least one post for every year, up to Year 2011
• Written by either a Monkey or proofed read by one
• Be completely letters C,O and 2 free by 2212

If you have any issues with the quality of my blog you can contact Marvin [ Manger of Monkey Slave Co Team 2 ].

To me, Habari looks like what the Wordpress would have created if they could go forward into time to look at the beast they have created. The best part of Habari is how lite it is, and how well set out everything is. Habari setup is straight forward and can be pointed at several different types of database servers. Less than 5 minutes and I had a blog up and running. Another 2 minutes and I had a second blog running off the same install. With the set out of the system you can make changes that apply to all or just one. It’s very light and simple to use. It appears that the community is making tones of great themes and plugins and I find that Habari will grow to point it takes over Wordpress. As long as it doesn’t become kludgy like Wordpress, I think it’s a great competitor.

Habari, give it a go.

I’m going to keep this short because I’m typing this on my phone. Moving into a new place, what is the one most important device you need? An IP router ofcourse. I was tempted to fork out the money to get a shiny new Cisco one… Maybe a 2851 or something but considering the price I asked around. Fortunenly a helpful IRC user suggested I look into getting a RouterBoard 750 or 750G. I looked the nicely priced device and decided to go with the G model as it supported gig and had a faster CPU.

Now considering that this router is priced cheaper than most DLink routers and switches I was surprised with a few things. First of all, it’s friggin small! No longer than my iPhone and only just wider. Packaging is minimal to save the enviroment.

Now just because it’s cheap and small doesn’t mean it isn’t packed full of features. It supports MPLS and all the common routing protocol. It has it’s own version of HSRP , includes Layer 2 and Layer 3 VPN clients and your usual PPPoE and stuff.

The device has low power requirements and can even be powered over PoE. I can see this device being perfect for where a L3 endpoint is required. Hookup a switchmode powersupply and battery. Battery backup would last hours if not days

Getting the job in Rockhampton was the easy part, and I am now onto the hard job of moving away from home and into a rental (once i find one). Surely it can’t be that hard, that’s not a lot to worry about…

List of things to do:

• Find a place to stay
• Close to an ADSL 2+ exchange
• Air Con
• Security Screens
• Lockup Garage
• Good area
• Under $300
• Find a decent Internet Plan
• Move all my stuff
• PC and MacBook
• Computer parts, routers and switches
• Clothing
• Stero
• Various Stuff from Mum/Dad
• Fridge
• Washing Machine
• Tables and Chairs
• ect..
• Purchase Items
• A few Lack Racks
• Bed
• Tupperware – noting down part numbers for future purchases to ensure that most lids fit most things
• Microwave
• Lawn mower (dependant on lawn)
• Asian Slave
• Level up in some skills
• Learn to cook
• Learn to clean
• Learn to pay bills
• Learn to tie shoe lacers
• Pay for
• Electricity
• Water
• Internet
• Rent
• Food
• Asian Slave
• Asian Slaves Food

File/Folder layout

Yup, this is a killer. Windows over the time has been built up of hack ontop of hack, and it’s file structure has changed several times, but with every change the older folders have been left for legacy applications. In OS X, GNU/Linux and BSD operating systems file locations are some what sensible. /etc for config files, /lib for libraries, /home for homes, /bin for binaries. It’s all placed in logical places.

Application Support files / Install

Windows has no single way to install and setup applications. Installers are not standardised and usually make a mess of the system. There is no one location for start up applications and every time you want to install or remove an application you must use a software vendors application, trusting them to clean up their mess.

Support files for applications are scattered throughout the system and it makes backing up a programs setting is fairly hard. It is slowly improving with Local Settings and Application Data, but still fair from perfect.

Standards

Microsoft can’t even follow their own standards, so how are developers meant to. Microsoft event’s a new standard for each problem they run into, and don’t even bother to look at existing standards to improve on.

EEE

Which brings me to my next point. The good old EEE – Embrace extend and extinguish. The wiki page explains it quite well, and even provides examples :>

DIrectX
Well fuck you DirectX.

Shell / Command Line

Oh dear god. The current standard shell is absolutely use, and has barely improved since DOS 6. Oh well, at least we have tab completion now. YAY! The good news is PowerShell is looking pretty cool. Shame PowerShell isn’t supported on Windows 2000.

Dodgy Virus Protection

Windows has protected once again. To slow down virus they have limited our connections and removed our telnet. It hasn’t stopped viruses, although it has annoyed the hell out of us.

Requirement to have a virii scanner

An operating system that suggests you run a virus scanner is flawed. All that should be required is security updates every several days, not a whole new product by a third party.

5000 versions of the same product (ultimate ect…)

Home Basic, Home Premium, Business, Business Premium, Ultimate. This makes maintaing computers an absolute bitch, and just silly. Provide one operating system for all computers. Eg OS X :P.

NTFS not being an open standard

This really isn’t a Windows annoyance, but an announce if you aren’t using Windows. NTFS standard needs to be open so other operating systems can read it.

Updates

Windows is excellent at updating every 3 hours, not to mention updating even when automatic updates has been turned off. This is quite annoying for me, and people that just want to turn off their computers. Instead they have to wait an hour just install a simple update.

Warning Messages

If you ever download an application on Windows Vista or 7, you’ll have just under 8 warning messages to click allow to, and due to this, all users become quite jaded towards the messages, and completely ignore them.

Unrelated Note

On an unrelated note, I would like to see Windows have a unified way to saving application data, and sandbox each applications. When applications want to use other applications data files the OS throws up a warning message asking if the program can have control over those files.

First and foremost, PDF allows me to know that any operating system and PDF viewer can read my resume and still present it the same way. With the Microsoft Word format, I have no way of knowing if my resume is being viewed the same. Different software and even different versions of Microsoft Word renders documents differently and formatting completely changes if a different printer is used with a weird paper size or origination.

The second reason is because recruitment agencies tend to like to change your resume to their formatting and modify what is written on your resume, before they pass it on to the employer. Although PDF documents doesn’t stop them from copy the text into their own formatted template, it sure does slow them down. I’d much rather that my resume stays in the same condition all the way through to the employer.

The final reason is because my resume is created and rendered in LaTeX, so producing a Microsoft Word document at the same time as my current resume is relatively time consuming and hard. I shouldn’t be forced to use Microsoft Word to apply for jobs.

That said, company HR teams should get less lazy and actually do some work. You don’t need recruitment agencies these days with the internet, and even if the company does use a recruitment agency at least post the company name and location (not just Queensland) on the ad. I don’t want to waste my time applying for .net startup companies or jobs in locations I can’t commute to or live at.

Well there you go, one of my life goal complete, clustering. I got a hold of two Dell 2650 and wanted to build a nice little cluster for dynamips so I can start testing / practising for my CCNP. I decided to go with OpenSSI, and Debian, because that’s all people have been talking about. Took me awhile to find the correct documentation for Debian Lenny, but once I did it was smooth sailing. The doco’s can be found here .

Once it’s installed it works pretty nicely, you set processes load balance using the cryptic command “loadlevel”, when processors start to use more CPU that get moved to CPU’s.

OpenSSI is very smooth to use with automatic setup of PXE booting and etherboot. Installed GNS3 and processes started to move over to the second server. I did have to set the max memory setting in GNS3 to the size of one IOS RAM requirements so it would spawn multiple dynamips hypervisors.