On Wed, 7 Mar 2001, Tim Seifert wrote:
> By: Fred Wright <[EMAIL PROTECTED]>
> On: Wednesday, March 07, 2001, 8:25:29 AM
>
> TS>> The disadvantage is that a hacker always knows where you are, and you
> TS>> can't just disconnect, and reconnect with a new IP to escape them.
>
> FW> Though that's less important with less vulnerable software like MiamiDx.
>
> It's not just hack attempts, but also denial of service attacks.
Well, yes, but due to bandwitdh asymmetries it would have to be a DDoS
attack to saturate your link.
> Another problem, with dynamic IPs, that I'd forgotten about: You dial up,
> and get the IP that someone else had a short moment ago, and they'd been
> running a server. It can be quite annoying to log in, and get hundreds of
> connection attempts from a group of strangers.
Yes. A good argument against DynDns. :-)
On Wed, 7 Mar 2001 [EMAIL PROTECTED] wrote:
>
> If, to the outside world, you only show a single IP
> address, how does the ISP know? I think my server maps the
As someone else posted, the number of IP addresses is not the issue.
> internal IP addresses (in the 192.168.1.x range) to port
> numbers on the IP address my ISP assigns.
Well, sort of. Mainly it's remapping the internal IPs of all your
machines to the single IP of your net connection, but this means that port
numbers (for connections to and from the net) now need to be unique across
all your machines. For outgoing connections, local port numbers are
normally dynamically assigned, but they will then be remapped either
conditionally or unconditionally to insure uniqueness. For incoming
connections you need to specify any remapping explicitly, and in
particular you can only run a given service on its standrad port for a
single computer. By default, all incoming connections go to the gateway
itself in this setup.
> Unless he's going to demand that specific port numbers, and
> only those port numbers be used, he shouldn't be aware of
> the local server. Or am I missing something here?
All standrad services use "well-known" port numbers, since this is the
only means of determining the desired service. Usually, port numbers can
be configured to nonstandard values, but both the server and client(s)
need to agree.
On Thu, 8 Mar 2001, Jeffrey E. Harris wrote:
> > JH> 1) File and print server sharing is built into ever version of windows;
> > JH> does the ISP define that as a "server"?
> >
> > It may be available, nut it's not always enabled. Most home PCs don't
> > have a LAN, and without a network connection of some kind, file and
> > printer sharing aren't enabled.
> >
>
> Tim, that may be true in Australia, but I find there are more and more
> people in the US who have home networks, if for no other reason than to
> share one Internet connection (a cheap way to take advantage of a high
> speed Internet connection). Many of those people may not have file and
> print sharing enabled, but many do, particularly so they share a printer.
Anyone who enables file and printer sharing without putting it behind a
firewall needs his head examined. That's like dropping the soap in the
shower at San Quentin. :-)
On Tue, 13 Mar 2001, Doug Rudd wrote:
>
> > Passwords are often sent in the clear, too. So
> > anybody able to snoop the network, can capture
> > the passwords. They're often /only/ hidden from
> > the person typing them in.
>
> A bit OT, but in this line, does anyone have
> experience with Anonymizer using SSH1 on the Amiga?
> It would seem a good way to prevent anyone on the
> cable loop from sniffing out a pw or any other sensitive
> info.
SSH as a substitute for Telnet certainly avoids the password-sniffing
problems, and it also offers authentication methods more secure than
passwords. SSH port forwarding can be used in *some* cases to protect
other TCP-based services, but one needs to preconfigure a tunnel for each
combination of host and port to be used, and the security is only valid
for the path to the SSH server, which might not be the target server if
the target server doesn't support SSH. The first requirement makes it
practically useless for things like web access, where SSL is a much more
reasonable approach.
AFAIK Anonymizer is concerned just with web browsing, and is mainly
concerned with issues other than passwords, so SSH doesn't have much
bearing on it.
Fred Wright
--
To unsubscribe send "unsubscribe miami-talk-ml" to
"[EMAIL PROTECTED]". For help on list commands send "help" to
"[EMAIL PROTECTED]".
