Re: [OpenVMS, DECnet] How to do DECnet over - secure (ssh, ssl) - IP ? IP ? IP ?

From: Barry Treahy, Jr. (Treahy_at_MMaz.com)
Date: 06/21/04 

Date: Mon, 21 Jun 2004 07:46:01 -0700

Dirk Munk wrote:

> The problem with stuff like SSH is that there is no real concept
> behind it. It is the Unix style of solving problems. You have a
> problem, so you design a small tool for just that little problem.
> Another small problem ? Another small tool. Someone once wanted to use
> encryption for telnet and file transfer, so we got SSH. Instead of
> thinking about a way to encrypt *all* IP traffic, we got SSH, Stunnel,
> and other tools that more or less gave us small sollutions for
> encrypted traffic. That wasn't sufficient, and then they even went
> futher and designed a way to tunnel other IP traffic over SSH. It is a
> kind of chewinggum, sticky tape and paperclip way of software design.
> And before I forget, there is also OpenSSH which is similar to SSH,
> but just a bit different. Nice......
>
> Now there is a new concept called IPsec, and if I'm not mistaken it
> will offer encyption for any IP port. There is a concept behind it, is
> most likely not easy to implement, and so it will take a long time to
> get accepted. I assume it will be possible to encrypt DECnet over IP
> with IPsec, but alas we have to wait just a little bit longer before
> we can use secure DECnet over IP.

What planet are you from? IPsec has been around for a long time and has
been the basis for point to point as well as network to network
tunneling! Since, with IPsec, you can encrypt all traffic between two
ends points (hosts and/or subnets), any traffic (even DECnet over IP)
will be encrypted. VPN tunneling (using IPsec) has been around much
longer than you are eluding too, so perhaps you should do a little more
research than just ranting and raving about Un*x command/tool style...

Barry 

-- 
Barry Treahy, Jr                       E-mail: Treahy@MMaz.com
Midwest Microwave                          Phone: 480/314-1320
Vice President & CIO                         FAX: 480/661-7028

Relevant Pages

  • RE: [fw-wiz] RDP and security
    ... administrators can choose to encrypt the data using a 56- ... a non-Windows authentication ... > Windows 2003 Server may fixed the issue. ... > design flaw that supposedly hasn't been fixed (ie. server ...
    (Firewall-Wizards)
  • Multiple Gateway IPSEC Problem
    ... Cisco Router: Gateway Interface: 10.0.1.2 ... spdadd 91.18.78.0/27 91.18.78.32/27 any -P in ipsec ... # Encrypt and direct all other traffic ...
    (freebsd-net)
  • RE: username and Password sent as clear text strings
    ... ipsec communication to only encrypt traffic to this particular ... What does everyone think of implementing a IPSEC solution to resolve the ... SSL was designed for client application-to-server application ... I completed a security review of a web server, ...
    (Pen-Test)
  • Problem - Using IPSec to secure Windows Messenger Traffic
    ... We have problems with encrypting Windows Messenger traffic with Windows ... First of all did anybody succeed to encrypt this traffic? ... IPSec policy, I give it below: ... Communication occurs between clients and server through ports: ...
    (Focus-Microsoft)
  • Encrypt some services with ipsec
    ... They running some services like dns, ssh, http, ftp, etc. ... - DNS replication master-slave: encrypted by ipsec. ... is it possible to encrypt only certains services under ipsec tunnel?? ...
    (FreeBSD-Security)