security policy rant

[hymie!]

OMG i just need to scream at somebody.

I work for a large government agency. I don't know if it matters that I
am based in Maryland while my production machinery is housed in New Mexico.

Part of ${LGA}'s security policy is that network switches cannot have ports
just turned on and waiting. I need to have a specific machine, that has
been approved to connect to that specific network; and I need to request
a specific port be activated for this specific machine. [1]

So far so good. However...

Another part of $LGA policy, a machine can only be attached to one port. [2]
So even though we allegedly have a pair of "redundant switches", each
machine is plugged into one or the other.

For our own convenience, we assign the switche ports as a pair, so if
(say) port 12 is in use on switch A, it will be empty on switch B. So in
theory, it's easy to tell the on-site people "Take all of the cables
out of Switch B and plug them into the like-numbered ports on Switch A."

At least, it would be easy... However...

The redundant ports are not turned on. That would be against $LGA policy.

As I found out just this morning, having a dead switch is not sufficient
to bypass the normal turning-on-a-switch-port procedure -- identify
the machine(s), submit a request, wait for the appropriate number of
signatures, and wait for the network team to turn the port on.

So in sum, I've got
* a dead switch
* 2 inaccessable machines
* a live "redundant" switch that I cannot plug these machines into

[1] Even further, the switches monitor the MAC address of the devices plugged
into it, so if I change the machine plugged into a port, the port will
auto-off itself.

[2] This is not 100% accurate, as we have machines with multiple networks
that are plugged into ports on other switches. I freely admit that I
don't fully understand the policies in question.

--hymie! http://lactose.homelinux.net/~hymie ***@lactose.homelinux.net

[The Horny Goat]

Post by hymie!
OMG i just need to scream at somebody.
I work for a large government agency. I don't know if it matters that I
am based in Maryland while my production machinery is housed in New Mexico.
Part of ${LGA}'s security policy is that network switches cannot have ports
just turned on and waiting. I need to have a specific machine, that has
been approved to connect to that specific network; and I need to request
a specific port be activated for this specific machine. [1]
So far so good. However...
Another part of $LGA policy, a machine can only be attached to one port. [2]
So even though we allegedly have a pair of "redundant switches", each
machine is plugged into one or the other.
For our own convenience, we assign the switche ports as a pair, so if
(say) port 12 is in use on switch A, it will be empty on switch B. So in
theory, it's easy to tell the on-site people "Take all of the cables
out of Switch B and plug them into the like-numbered ports on Switch A."
At least, it would be easy... However...
The redundant ports are not turned on. That would be against $LGA policy.
As I found out just this morning, having a dead switch is not sufficient
to bypass the normal turning-on-a-switch-port procedure -- identify
the machine(s), submit a request, wait for the appropriate number of
signatures, and wait for the network team to turn the port on.
So in sum, I've got
* a dead switch
* 2 inaccessable machines
* a live "redundant" switch that I cannot plug these machines into
[1] Even further, the switches monitor the MAC address of the devices plugged
into it, so if I change the machine plugged into a port, the port will
auto-off itself.
[2] This is not 100% accurate, as we have machines with multiple networks
that are plugged into ports on other switches. I freely admit that I
don't fully understand the policies in question.

Hell if your network card dies and you have to replace it with another
you've got a problem.

If this is UI to you then to quote Bill Clinton "I feel your pain!"
(Though likely not nearly as much as Bill did when Hillary found out
about Monica which apparently was the last straw for her)

[Roger Bell_West]

Post by The Horny Goat
Hell if your network card dies and you have to replace it with another
you've got a problem.

Not necessarily, because <UI>. Which is why the whole thing adds so
little to security, considering the hassle it generates.

[Alexander Schreiber]

Post by Roger Bell_West

Post by The Horny Goat
Hell if your network card dies and you have to replace it with another
you've got a problem.

Not necessarily, because <UI>. Which is why the whole thing adds so
little to security, considering the hassle it generates.

Well, depends. When I was part of the crew running the dormitory network
at $UNIVERSITY, we had all our switches in port security mode (which shuts
down the port if the MAC changes). Not so much for security (due to <UI>),
but to
- reduce the amount of irritation caused by clueless wannabe hacker kiddies
- keep the clueless from breaking policies (e.g. only registered machines
allowed in order to nail abuse to names)
- detect wonky crap on the hardware side[0]

Kind regards,
Alex.
[0] A certain POS Realtek NIC[1] which was built using the absolute minimum
of silicon and did everything possible, down to building actual ethernet
packets, in the Window driver, would occasionally forget about that
ethernet stuff and vomit raw IP onto the ether. Oops. Our recommended
fix for that: "Nail this POS to the wall and buy something decent[2].
[1] But I repeat myself.
[2] e.g. DEC Tulip or 3Com.[3]
[3] Yes, this has been A While Ago (TM).

[Roger Bell_West]

Post by Alexander Schreiber
[0] A certain POS Realtek NIC[1]
[1] But I repeat myself.

Yeah. Seems like every second mainboard has a Realtek POS on it now.
They won.

[Steve VanDevender]

Post by Roger Bell_West

Post by Alexander Schreiber
[0] A certain POS Realtek NIC[1]
[1] But I repeat myself.

Yeah. Seems like every second mainboard has a Realtek POS on it now.
They won.

Amazingly enough this page is still in its original location on the web:

http://pages.cs.wisc.edu/~kovar/realtek.html

[AdB]

Post by hymie!
[1] Even further, the switches monitor the MAC address of the devices plugged
into it, so if I change the machine plugged into a port, the port will
auto-off itself.

A past coworker had his own desk in the NOC, with his very own port thus
keyed to his laptop, but it seemed that every other shift started with
him getting someone to open a ticket for him to have it reactivated
because some transient ignoranus's literacy had not encompassed the DO
NOT USE THIS PORT sign on the port.

There's a better feature that can be configured to let strange MACs use
the clown VLAN and still let known MACs onto their proper networks.
Lest this be UI, I note that configuration of the clown network is left
as an exercise for the reader.

[Garrett Wollman]

Post by AdB
There's a better feature that can be configured to let strange MACs use
the clown VLAN and still let known MACs onto their proper networks.
Lest this be UI, I note that configuration of the clown network is left
as an exercise for the reader.

On a somewhat related note, today we had a new Lignux install on a
system which was then subsequently configured for failover bonding,
but rather than using one of the MAC addresses attached to the
interfaces in question, it pulled one out of its ass instead. This
caused it to be unable to communicate with anything, since (from the
install) it had an active DHCP lease for the MAC address it was
supposed to use, and so long as that lease was unexpired, $UI[0] on
the switch would drop $UI[1] for that IP from any other MAC address.

-GAWollman

[Steve VanDevender]

Post by Garrett Wollman
configured for failover bonding

Things that sound kinkier than they actually are.

[Wojciech Derechowski]

Post by Steve VanDevender

Post by Garrett Wollman
configured for failover bonding

Things that sound kinkier than they actually are.

Sex changers.

--
WD

Who is Entscheidungs and what is his problem?

[AdB]

Post by Steve VanDevender

Post by Garrett Wollman
configured for failover bonding

Things that sound kinkier than they actually are.

The kinky reality you're looking for is filed under "flailover". Some
days noone wants to be the passive member of the pair.

[Steve VanDevender]

Post by AdB

Post by Steve VanDevender

Post by Garrett Wollman
configured for failover bonding

Things that sound kinkier than they actually are.

The kinky reality you're looking for is filed under "flailover". Some
days noone wants to be the passive member of the pair.

That is, of course, why you shoot the other node in the head.

[Peter Corlett]

Post by hymie!
OMG i just need to scream at somebody.

[Tale of typical Kafkaesque government bureaucracy deleted]

As I see it, you are in an organisation with a policy that actively prevents
you from working. So find a good book to read, rest your feet on the desk, and
make sure you're not working. Anything else would be against policy.