Why AS400 sucks

Yes. It. Does.

The client connection is a telnet session that backpacks traffic over a few other useless ports. The server watches for a constant signal from the client, but since there is no heartbeat signal, most firewalls and routers will drop the session as an idle connection if you don't watch for it in your network config.

AS400 systems are older than dirt.

Why do people insist to use archaic, useless hardware, and expect it to work seamlessly with today's technology? And WHY (please tell me why!) DO THEY EXPECT ME TO KNOW HOW TO FIX THEIR DUMB AS400 PROBLEMS?!? Well, ok, that last question is rhetorical. I DID fix their as400 problem.

AS400 SUCKS!

Whilst I was away

This weekend I took a trip to my parents.

My dad is very amusing when it comes to him trying to use any sort of technology. He recently bought himself a laptop, which he has no idea how to use, so my sister and I spent a good 8 hours just in the car, not counting the time I spent trying to write step-by-step instructions on how to do *everything* with his laptop. The funny thing is, he probably will have one of my brothers *do* everything for him, so when he ends up on the road he won't know how to use it anyway. hah, I love my Dad, and it was pretty cool to have the extra time to catch up with my sister. I hope she didn't go too crazy spending sooo much time around me!

My brother James is indeed now taller than me. Don't worry, I beat him around enough to make sure he remembers his place in the pecking order. Joshua is actually getting pretty close himself. It is really sad, I figured since I was taller than both of my parents, I would end up staying the tallest. As luck would have it, both of my younger brothers will probably end up passing me. I guess I really _should_ have eaten all of the brussel sprouts, liver, lima beans, squash, broccoli and calliflower and such that I avoided as a child. Oh well, as long as I can still beat both of them up, it's all good.

The wife has her Spring Break from teaching, so she is down south visiting some of her friends and family. After my first day back at the appt alone, the next three days are looking very sad and lonely for me. Ah, when you are in love, being apart is oh-so-not-fun.

Today I took my bike out for a spin. I put a few miles on it thismorning as a very nice break from work. I really mourn the past when I actually was any good at biking, but for now I am content to ride along the silly paved path through a well maintained and somewhat treed area that the city folks here fondly like to call a "forest preserve". I call it a well maintained, somewhat treed area with a paved little path running through it. Forest, my ass.

Actually, I am breaking from work right now to write this. Yes, I am still working. My boss decided to send me home to work on a project. This was supposed to free me of distractions for the remainder of March to finish said project. Unfortunately, somewhere along the line the concept of "free of distractions" was lost. So leave it to say I have many sleepless nights ahead of me as I try to cram this project that could probably use another 2 weeks of work into the next 3 days. Wheeeee! Deadlines are fun.

So yep, I am basically slaving away at work, with the very rare exposure to sunlight today that almost blinded me. Fresh air and sunlight I have decided are VERY over-rated, and in general very unpleasant to deal with.

I want my Underworld soundtrack. I ordered it and the tracking thingy at Best Buy said it was shipped, but guess what, I DONT HAVE IT AND I WANT IT. Anywhoo, its really good from what I can tell from the crappy previews they give on the website, and I have found that techno-industrial actually is a better background for a work-minded environment than even classical. My Moby and Crystal Method are definitely getting their milage in addition to Mozart and Bach. No, I am not becoming a little pansy clubbing poser. I leave that to the youngins. But in moderation (both time and volume), there are some decent indy-tech cuts out there.

Well, time to get back to hacking out code. I have some sexy COM+ database objects that need a bit of a makeover before I share them with the world.

As always, I love you my dearest of friends and blog readers. Remember, a little insanity makes life alot easier.

Don King explains Cisco router access lists

Cisco router access lists described only as Don King can. Hillarious but informative.

http://routergod.com/donking/index.html

Internet Security

Internet Security

The World Wide Web has become a center for e-business, communication, entertainment and information.  Anywhere money is made, you will find a crook that will try to steal it.  How do you keep your information safe?  How do you secure the privacy of business or personal information, and your identity?  This paper will explore three levels necessary to provide security and privacy of information on the Internet: information protection in transit, certified identity, and a secure point of access.

Information protection - Encryption

Cryptography is essential for the secure exchange of information across intranets, extranets, and the Internet. From a business point of view, the security functions enabled by cryptography are authentication, which assures the recipient of a message that the originator is who he or she claims to be; confidentiality.  Cryptography protects users by providing functionality for the encryption of data and authentication of other users. This technology lets the receiver of an electronic message verify the sender, ensures that a message can be read only by the intended person, and assures the recipient that a message has not be altered in transit.  which ensures that a message can be read only by the intended recipient; and integrity. From a technical point of view, cryptography is the science of protecting data by mathematically transforming it into an unreadable format.

Encryption is that process of transforming data to secure the communication of data, in this instance over the Internet.  There are three main classes of encryption: symmetric-key encryption, public-key encryption, and hash algorithm encryption.

Symmetric-key encryption uses a single key to encrypt the data at the source, and also decrypt the data at the destination.  This key is called a secret key or a symmetric key because both the sender and recipient possess an identical key.  Symmetric-key encryption is efficient for large amounts of data, and its effectiveness is dependent on the complexity of the encryption algorithm and the length of the key.

Public-key encryption uses two separate keys that are mathematically related, a public and a private key.  The public key can be published openly but the related private key remains protected.  Data encrypted with the public key can only be decrypted with the private key, and vice-versa.  Public-key cryptography uses very complex and slow algorithms, and so is used primarily for short critical transmissions.

It is common to use public-key cryptography to transmit a symmetric-key, and then complete a data transmission using the symmetric-key encryption.

One-way hash encryption is the conversion of a piece of data of any length into a non-reversible fixed-length number by applying a one-way mathematical function called a hash algorithm to the data. The length of the resulting hash value is large enough to make the chances of finding two pieces of data with the same hash value insignificant. The sender generates a hash of the message, encrypts it, and sends it with the message itself. The recipient then decrypts both the message and the hash, produces another hash from the received message, and compares the two hashes. If they are the same, there is an extremely high probability that the message was transmitted intact.

But simply protecting the data you transmit is not always enough.  Sending credit card information over the Internet requires not only that the number is protected from interception, but also that the sender and receiver are actually who they say they are.

Certifying Identity – Digital Signatures

When a message is sent or received, the recipient may desire to verify that the message has not been altered in transit.  Also, the recipient may wish to be certain of the originator's identity.  Both of these services can be provided by the use of a Digital Signature. A digital signature is an electronic analogue of a written signature in that the digital signature can be used in proving to the recipient or a third party that the originator in fact, signed the message. Digital signatures may also be generated for stored data and programs so that the integrity of the data and programs may be verified at any later time.

Signature verification makes use of a public signature key, and each user possesses a private and public key pair. Thus anyone can verify the signature of a user by employing that user's public key, but only the possessor of the user’s private key can perform signature generation.

Digital signatures are created using a combination of a public-key encryption techniques and the Digital Signature Algorithm (DSA), standardized by the Federal board of Information Processing Standards.   A hash function is used in the signature generation process to obtain a condensed version of data, called a message digest. The message digest is then input to the DSA to generate the digital signature. The digital signature is sent to the intended verifier along with the signed data (often called the message). The verifier of the message and signature verifies the signature by using the sender's public key.

Secure Point of Access – Internet Client and Operating System

Finally, guaranteeing that your information is encrypted properly, and the identities of the source and destination are certified requires a point of access to the system that is not itself vulnerable.  The Internet is literally a network of computer clients, which are physical computers running some form of Internet protocol from its operating system.  If the operating system is vulnerable, any external security measures also become vulnerable.  Here is an example of how operating system security is implemented in Windows 2000, a prominent business-client operating system. 

• Central administration. Security requires simplicity. As networks become larger and more complex, more powerful security management tools are required. The Active Directory service in Windows 2000 simplifies security management. Administrators can manage user accounts and access rights from a central location, and delegate security administration tasks.
• Flexible deployment. Security requires flexibility. In the past, companies could make assumptions about their network users because all users were employees. As companies extend business to the Internet, they can no longer make assumptions about the identity, integrity and desktop platform of their end users. For this reason, Windows 2000 facilitates interoperable, flexible authentication mechanisms that verify identity and securely map external users to the company's internal systems.
• Consistent enforcement. Security requires consistency. A single, consistent model for enforcement of security is crucial. Once a user's identity has been verified, it is important that access to resources be configured and enforced in one manner to simplify management and increase security. Multiple security models often lead to redundant and complex management, increasing the possibility of administration errors and security holes. Windows 2000 employs a single, consistent access control model that is integrated with the Internet-standard Kerberos network authentication protocol.

Secure Internet-enabled Business

• E-commerce. Companies doing business on the Internet must be concerned with proving the identity of customers. Windows 2000 provides a fully-featured public key infrastructure including a certification authority for issuing x.509 certificates and validating identity. Secure Socket Layer/Transport Layer Security (SSL/TLS) protocols confirm the user's identity and protect data on the wire across the Internet.
• Extranets. Support for open PKI standards and secure protocols, such as IPSec, L2TP, SSL/TLS, and S/MIME enables you to extend your network to suppliers and partners more quickly, while protecting against impostors, data theft, or malicious hackers.

Protect Mobile Users and New Devices

• Mobile users. By design, laptops and many new devices are portable and lend themselves to theft. Often these machines hold important company data and represent a security risk if stolen. Windows 2000 offers Encrypted File System functionality that obscures data on the hard drive to render it useless to anyone without access to the encryption or recovery key.
• Home office. Telecommuting is becoming a common part of business life. Here security on the wire becomes crucial as companies are using public infrastructure to transport company data. Windows 2000 offers an extensive virtual private network (VPN) solution with integrated tunneling and encryption technologies including IPSEC, L2TP, PKI and PPTP.

Conclusion

Internet security requires three levels of protection: first, your data must be encrypted to assure that it cannot be intercepted and modified between the desired sender and receiver; second, certifying identities guarantees that your information sent and received is being transmitted with the correct person; and third, the client you access the Internet from must be secure to protect the information used over the Internet when it resides on your machine, and to protect the encryption keys and identity certificates used to authorize its transmission.

By using these techniques, it is possible to secure the sharing of information over the Internet to the degree that the work required by a malicious party to get around the security would far outweigh the benefits.

Works Consulted:

1. Windows 2000 Home page

http://www.microsoft.com/windows2000/default.asp

2. Microsoft Software Developers Network (MSDN)

http://msdn.microsoft.com/default.asp

2. Digital Signature Standard - Federal Information Processing Standards

http://www.itl.nist.gov/fipspubs/fip186.htm

common port and services block list

Protocol	Port	Service name	Comment
TCP	21	FTP	If you use FTP, incoming only
TCP	25	SMTP	Block incoming or route directly to your email server
TCP/UDP	53	DNS	Block incoming or route to your DNS Server
TCP/UDP	67, 68	DHCP	Block incoming and outgoing
TCP/UDP	69	TFTP	Highly recommended for internal use only. * **
TCP	80	WWW, HTTP	Block incoming or route to your web server
TCP/UDP	88	Kerberos
TCP	135	RPC/DCE Endpoint mapper	Highly recommended for internal use only. * **
UDP	137	NetBIOS Name Service	Highly recommended for internal use only. * **
UDP	138	NetBIOS Datagram Service	Highly recommended for internal use only. * **
TCP	139	NetBIOS Session Service	Highly recommended for internal use only. * **
TCP/UDP	389	LDAP
TCP	443	HTTP over SSL/TLS	Block this unless your web server is running SSL certs
TCP/UDP	445	Microsoft SMB/CIFS	ADMINISTRATION PORT! BLOCK THIS!
TCP/UDP	464	Kerberos lpasswd
UDP	500	Internet Key Exchange, IKE (IPSec)	Block this unless using VPN from outside.
TCP	593	HTTP RPC Endpoint mapper	**
TCP	636	LDAP over SSL/TLS
TCP/UDP	1433, 1434	MS SQL Server	hosts data and local server scans
TCP	3268	AD Global Catalog	ADMINISTRATION PORT! BLOCK THIS!
TCP	3269	AD Global Catalog over SSL	ADMINISTRATION PORT! BLOCK THIS!
TCP	3389	Windows Terminal Server	Highly recommended for internal use only. *
TCP/UDP	17027	AdBots	Block outgoing on this port
TCP/UDP	31337	(trojan)	commonly used trojan/backdoor port, such as Back Orifice
TCP	31789, 31790	(trojan)	Commonly used RAT trojan ports, block incoming and outgoing.
* "Internal use only" services were originally never intended for use over the internet, and therefore are highly unsecure.
** indicates these ports are used by MS Blaster and similar worms.