[71063] in North American Network Operators' Group
Re: SSH on the router - was( IT security people sleep well)
daemon@ATHENA.MIT.EDU (Valdis.Kletnieks@vt.edu)
Mon Jun 7 17:51:09 2004
To: Alex Bligh <alex@alex.org.uk>
Cc: Randy Bush <randy@psg.com>, Michael.Dillon@radianz.com,
nanog@merit.edu
In-Reply-To: Your message of "Mon, 07 Jun 2004 22:12:36 BST."
<46D9282A94CA03DFCC87E247@[192.168.100.19]>
From: Valdis.Kletnieks@vt.edu
Date: Mon, 07 Jun 2004 17:50:42 -0400
Errors-To: owner-nanog-outgoing@merit.edu
--==_Exmh_-2078710602P
Content-Type: text/plain; charset=us-ascii
On Mon, 07 Jun 2004 22:12:36 BST, Alex Bligh said:
> Where did the word "single" come from, given he had an "s" on gateways?
> Replicate them across POPs. Having lots of routers accessible from a small
> number of machines, which are (relatively) widely accessible but can be
> firewalled to hell, seems a better option than having lots of routers
> accessible from a large number of machines (esp. ones outside ones own
> administrative domain, e.g. home machines). YMMV. [no I don't think
> they need the other pixie dust stuff on though]
Well, either you have one per POP (and that, as Randy Bush points out, can
be quite the headache in itself), which is still a single point of failure for
that POP, or you're advocating that the routers be reachable from the magic box
at *any* POP (which is right back into the "large number of machines"
issue....)
In any case, the concept is merely a workaround that doesn't actually fix the
real problem - right up there with arguing what color band-aids to use on a
hemophiliac....
--==_Exmh_-2078710602P
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001
iD8DBQFAxOMycC3lWbTT17ARAtYSAKDEl2qLNRpdQF2KkfXrsrhRYZtY0ACcCJGp
O0gOq2nzrXcac3HcqXDhs34=
=QalX
-----END PGP SIGNATURE-----
--==_Exmh_-2078710602P--
