[71064] in North American Network Operators' Group
Re: SSH on the router - was( IT security people sleep well)
daemon@ATHENA.MIT.EDU (Alex Bligh)
Mon Jun 7 17:57:03 2004
Date: Mon, 07 Jun 2004 22:56:23 +0100
From: Alex Bligh <alex@alex.org.uk>
Reply-To: Alex Bligh <alex@alex.org.uk>
To: Valdis.Kletnieks@vt.edu
Cc: Randy Bush <randy@psg.com>, Michael.Dillon@radianz.com,
nanog@merit.edu, Alex Bligh <alex@alex.org.uk>
In-Reply-To: <200406072150.i57Loga6003518@turing-police.cc.vt.edu>
Errors-To: owner-nanog-outgoing@merit.edu
--On 07 June 2004 17:50 -0400 Valdis.Kletnieks@vt.edu wrote:
> Well, either you have one per POP (and that, as Randy Bush points out, can
> be quite the headache in itself), which is still a single point of
> failure for that POP, or you're advocating that the routers be reachable
> from the magic box at *any* POP (which is right back into the "large
> number of machines" issue....)
Well the way we did it, all routers were accessible from 2 (large) POPs,
two being in the NOC, and one being elsewhere (now you mention it, it was a
datacenter & POP combined). So the "large" number of machines was 3. I am
sure we could have scaled this to (say) 4 without substantial difficulty.
I agree one in every POP would be both painful and pointless. But that
wasn't what I meant.
Alex
