System iNetwork

June 2005

June 30, 2005 12:31 PM

World Flattener: M-Tech's GPS NTP Server

The world is getting flatter every day according to Thomas L. Friedman, author of The World is Flat: A Brief History of the Twenty-first Century. And nowhere is that more apparent than in e-commerce, where you can purchase stuff online, pay for it in whatever coin of the realm you choose, and still get it delivered with instant-gratification speed. Such is the case with M-Tech's very inexpensive, and thus novel, Network Time Protocol (NTP) server, which at $500 is one third the price of the nearest competitor.

You probably already know what an NTP server is, but just to refresh your memory, it provides an accurate time source for the clock/calendar chips built into all your network devices: routers, switches, servers, even desktop systems. The NTP server gets its time from some authoritative source -- ultimately one of the atomic time standards available from various governments -- and then passes it on to end-user devices. To prevent any one NTP server from being saturated, the entire galaxy of NTP servers are organized in a hierachy, with each existing in a particular level in that hierarchy, called a Stratum, which represents its distance from the atomic standard. Stratum-0 servers are the atomic sources themselves, with Stratum-1 servers being once removed, Stratum-2 twice removed, and so on. The farther removed a server is from Stratum-0, the less accurate and reliable it is.

Most network admins get their NTP service from an NTP server on the Internet, and are lucky if they can find a usable Stratum-3 server. That makes their own network server of Stratum-4 quality, which is none too good, let me tell you. If your Internet connection goes down, your devices depending on the Internet-resident NTP server may simply revert their clocks to some ancient date and time.

Network time synchronization is important to network administrators. First, tracing events through the time-stamped logs of various devices requires those devices to agree on the time to make sense of their logs. Second, some protocols, such as SSL and VPN, are very time-dependent, and may fail if clocks get too far out of synch. Third, many applications are ill-equiped to handle a sudden blast-to-the-past and will explode spectacularly when such timequakes occur. A possibly apocrypal incident had one employee getting 60 years of back pay when the clock reset on a computer running his company's payroll.

It turns out that there is one spectacularly wonderful Stratum-0 time standard whirling constantly above our heads: the Global Positioning System. With the right equipment you can suck the Stratum-0 time right out of the air, making your local network a Stratum-1 time standard. And so far the GPS system has not crashed once (knock on wood), so you can pretty much be assured of 100% reliability. Alas, until recently, the "right equipment" cost at least $1,500, took up a whole rack space, and was designed to be painfully difficult to configure and deploy. I suspect mostly phone companies buy these things ("At the tone, the time will be...").

Enter the Slovakian company M-Tech, who sells a very nice-looking, Web-adminstered GPS NTP server the size of a compact modem. You plug Ethernet in one side, hand the supplied GPS antenna out the window, and you're a Stratum-1 NTP site! As a bonus, the thing supports SNMP traps to let you know if all the GPS satellites disappear (a grim prospect), and NMEA-standard GPS output that you can use for other things GPS, such as tracking the location of your building. Out here in California that's a useful function.

I know what you're asking. "Slovakia? Where the heck is that? Is it near Outer Mongolia? [It isn't.] Do they have FedEx? I don't want to wait six months to get this thing!." My answer is that it doesn't really matter where Slovakia is. You pay with a credit card in U.S. dollars and if they don't deliver you reverse the charge. Except by all accounts they do deliver, so it's really no different than buying a book from Amazon. Maybe even faster.

OKAY, okay, if you insist. Here's what the capital of Slovakia looks like:
[Click here to see Bratislava] I don't know if M-Tech is in Bratislava or some other corner of Slovakia, because I can't read Slovensky, but it doesn't matter, does it, because they have an English catalog page and online ordering:

http://www.mtechba.sk/gpsntp/gpsntp_selection.html

I love it. I've just made the world a little flatter.

Posted by mbeckman on June 30, 2005 at 12:31 PM

June 17, 2005 10:11 AM

On Tsunamis and Other Threats

At 6:50 p.m. on Tuesday, June 14th a magnitude 7.2 earthquake occured in the deep sea 90 miles off the coast of northern California. Shortly thereafter, the West Coast and Alaska Tsunami Warning Center issued a Tsunami warning to all residents of coastal California. An hour later, to everyone's relief, the warning was rescinded, as no Tsunami occurred.

Unfortunately, most people knew nothing of the warning until after it was canceled. That's a problem.

On that pleasant summer evening days ago, many people were away from their TVs and radios, and those that heard the few sirens that sounded were simply puzzled. A Tsunami, had one originated so close to the coast, would have innundated many areas witin the hour, before any significant reaction by residents. Despite the ubiquitous distribution of text-message-capable cell phones, there is no coordinated method for distributing a Tsunami warning to individuals in California. In fact, there isn't a way to notifify individuals anywhere in the U.S. of any natural disaster. There are only news media broadcasts and disaster sirens.

A better way to inform the public is through personal alerts delivered by cell phone. Alas, getting the government to instantiate a personal disaster warning system would be a massive undertaking. But there isn't any reason the public can't take matters into its own hands: A grass-roots warning system could be launched just like any other open-source project, and be up and running before the government finished the feasibility study on its own system.

As network administrators, we already have the requisite personal notification mechanisms in place. The network management systems we currently employ to montitor networks have the ability to send pages, make phone calls, and deliver faxes. These systems are battle-tested and generally reliable. They're an excellent way to deliver disaster alerts.

Personal disaster alerts need not reach every individual directly to be effective. If one person in a building gets an alert, he or she can readily notify others nearby, shortening reaction time to the impending disaster. A good model for such a system is the existing NOAA Specific Area Message Encoder (SAME) Emergency Alert System, a radio-based nationwide broadcast system that encodes textual disaster alert messages along with location information to trigger alarms on individual NOAA radio receivers. You can buy these receivers for under $50 and program them to alert you to disasters in your area. An example of such a device is the Midland 74-250C weather radio.

The first step in a personal disaster notification system is marrying NOAA's EAS with our existing NMSs. Once we can receive localized disaster information, we can disseminate it to selected individual cell phones, pagers, and fax machines in realtime. EAS supports two radio notification systems: One using terrestrial FM transmitters, and another using satellite broadcasts. The satellite system, called Emergency Managers Weather Information Network (EMWIN), supports direct-to-computer interfaces. An EMWIN earth station consists of an EMWIN reciever and a three-foot satellite dish antenna. Commercial EMWIN stations cost between $1,000 and $2,000. You can purchase EMWIN hardware and software from Skywalker, Skywatch, Tigertronics, and Zephyrus.

An alternative to an expensive direct radio interface is extracting alerts from NOAA's disaster Web site. Alas, NOAA does not seem to have a single Web point of contact for alert information. Each kind of alert -- earthquake, fire, Tsunami, severe weather, fire -- appears to have its own NOAA page. An experimental XML message service for Tsunamis is at http://wcatwc.arh.noaa.gov/message.shtml. We should lobby NOAA to deliver event messages through a single, well-defined XML-based Web Services interface.

If you know of an existing EMWIN NMS interface, or have ideas on how to construct one, post your ideas here. If enough interest develops, I'll create a Web site dedicated to the grass-roots disaster network concept.

Posted by mbeckman on June 17, 2005 at 10:11 AM | Comments (6)

Password Safe: Bruce Schneier's Blowfish Utility

Keeping track of passwords and user IDs is tedious; doing so securely seems almost impossible. Numerous commercial products have pretended to solve the problem, but all that I've seen have fallen short in security, convenience, or both. Bruce Schneier -- a well-known security consultant, author of the classic security tome Applied Cryptography, and the creator of the Blowfish encryption algorithm -- has released to the open-source community his own personal password managagment tool called Password Safe.

Password Safe runs on both Windows and Pocket PC operating systems from either the local hard drive or a removeable USB thumb drive. Schneier's company, Counterpane Labs, verified the program's security, and the source code is available for public scrutiny on Source Forge. The program is easy to use -- interacting with the Windows copy/paste buffer. After gaining access to Password Safe through your master password, you click on the password entry you want to copy and then paste the associated user ID and password into the log-in screen or other authentication interface. This has the benefit of being both simple and secure from shoulder-surfing attacks.

The utility also sports an auto-type feature that generates the actual keystrokes required to fill a user ID and password field, letting you avoid the copy/paste step altogether. And for creating secure passwords on the spot, Password Safe incorporates a policy-driven password generator that produces secure passwords resistant to dictionary and other brute-force attacks.

Password Safe includes a thorough, HTML-based user guide that you can view readily in any Web browser.

http://passwordsafe.sourceforge.net/.

Posted by mbeckman on June 17, 2005 at 9:50 AM

June 2, 2005 9:26 AM

Seen at Interop: Anakam's Cellphone-based Two-Factor Authentication

E-commerce authentication is a bugaboo. Users typically log in with just a user ID and password, and these are easily compromised with phishing attacks and password guessers. The result is the current flood of e-commerce fraud and identity theft, which dampens users' enthusiasm for e-commerce and represents a huge liability for e-vendors. One fix to the problem is to use two-factor authentication -- a second credential that a user must supply in order to log into his or her e-commerce account. The second factor could be biometric or some sort of token, such as a smartcard or one-time-password generator. Alas, biometric readers are not commonplace, and distributing tokens is too cumbersome and expensive.

Anakam LLC has a clever solution to the problem in its Whisper product: Employ a token nearly everyone has already, the ordinary cell phone.

When a user logs into a Whisper-enabled Web site, Whisper generates a unique one-time access key and transmits it to the user's registered cell phone address via an e-mail or SMS message. The user then completes the e-commerce login by entering this key into the logon page, which permanently authorizes that particular computer to the site for a pre-determined time interval.

This approach blocks phishing attacks, because the phisher does not know the victim's registered cell phone number. It thwarts password guessers by changing the effective password with every login, guaranteeing that the password can't be brute-forced by systematic guessing.

Whisper isn't expensive either -- it can be deployed at the cost of just pennies per user in large applications like online banking, but costs only a few dollars per user in smaller deployments, making it practical for even specialized e-commerce applications.

http://www.anakam.com

Posted by mbeckman on June 2, 2005 at 9:26 AM

Seen at Interop: LogLogic's Log Management Appliance

An interesting new product niche for network managers is log management. All of our network devices spew reams of log information, in multiple formats and stored on multiple ancillary systems. These logs must be tended regularly to be useful -- both to detect significant events and to prevent the logs from overflowing available storage. New regulatory requirements -- such as Sarbannes-Oxley and HIPPA -- will likely mandate that we keep these logs on hand for a long time and protect them from tampering. A log management appliance does all that for you by providing log post-processing and analysis, data compression and storage, and digital signatures to detect alterations.

LogLogic is one of the first vendors of a drop-in log management appliance, and an Interop Best-of-Show winner. Offered in two flavors -- ST for long-term archival storage and LX for short-term storage, analysis, and alerting -- these devices are one-U boxes that set up in minutes. You configure them to accept SYSLOG records from routers, switches, servers, firewalls, and the like, and they then automatically manage these logs without further attention.

A LogLogic appliance processes entries in realtime, adding digital signatures and compressing them, then spooling the entries into an indexed store. LogLogic units can have their own 2.5 terabyte storage, or they can work with a third-party network attached storage (NAS) device. LogLogic claims compression ratios as high as 12:1, which is believable since log files often contain a great deal of repetitive data. You have the option of rolling the oldest log entries to DVD or tape, making this a virtually inexhaustible data sink.

The ST version lets you archive prodigious amounts of log data while retaining the ability to search and retrieve entries via a Web browser interface. The LX version lacks the vast storage abilities of the ST, but provides realtime log analysis, alerting for pre-selected conditions, and extensive reporting capabilities. As with the ST, you can view entries with a Web browser; but the LX also supports a live viewer application to let you watch log entries stream by as they occur.

The LX only holds 90 days of data, but you can team an LX box with an ST for long-term storage. In fact, you can mix and match versions to extend logging capabilities to everywhere in your enterprise, making this solution very scalable.

The products have list prices starting at about $20,000, so they're aimed at enterprises rather than small shops. But if you're in a mid-sized enterprise facing serious labor costs to comply with data retention mandates, a log management appliance may well be the cheapest solution available.

http://www.loglogic.com

Posted by mbeckman on June 2, 2005 at 8:45 AM