Post #151,554
4/18/04 12:31:30 AM
|
Networking etiquette questions, please
Szo, meine Droogies.. once more into the transistor fray -
I've gleaned enough of the topic to appreciate how much time can be wasted in setup - forgetting one simple step. Or MAC, or an unfortunate choice of arb. address. I'd 'do' my own if needed, as there is nothing at stake. Much useful primer stuff resides in our hoary archives = Thanks! This, however - is different.
I may need to vet by phone, a few local purveyors of fine Network buzzwords, on behalf of a friend. (Seems massively unwise to imagine managing this from afar, including Apple lore.. even were I to become ept in a focussed way. Especially not where another's income is at stake; the last place where "wanting to help" is ever enough.)
Scenario: Will be among a v. few early adopters of a telecommuting scheme, as she moves from Ohio to AZ. (I shudder at the company's inexperience in this, combined with the long distance scenario - but they didn't want to lose her talents, etc. Still.. more onus at this end than one would wish).
Seeking opinions on: how not to cross the line between trying to assess credentials, attitude etc. | VS | meddling, via becoming too specific about exact router, firewall prep questions, etc. Any reason why 98SE can't handle this simple operation?
NOTE: [link|http://www.litepc.com/xplite.html| The Lite Folks] now at a new addy/name: have a dejunker for W2K and Ex Pee, for those who must stay on this treadmill to heat death, for Corporate Reasons. Not an option on a 500-P-III, aside from all the other daily bug-fix BS for the weekly scourges. So any 'up'grade is pretty unlikely - EULA would then give The Beast access - and All That Jazz.
So... how do youse folks Like to be treated, at square 1? (I tend to assume competence until.. an answer causes butterflies in the right hemisphere.)
Details: The basics of her job, Eng. language docs, have been tested by dial-up; next stage requires use of Co. VPN for further admin details, etc. They will hand-hold on set-up and work with local nominee - to some unknown extent.
Hardware, OSs:
2 Apples, a G-4 desktop and a new Powerbook G4 (15" cheapest model). 1 e-Machine, 500 MHz P-III, 128M - no NIC yet. 98-lite, just upgraded to latest build. I installed OS clean and dejunked.. originally.
Just disinfected of Real Player 7, etc. Ran Stinger to check for presence of popular Doze afflictions, usual fumigations and repeated defrags.. Has Adobe V.4 and may need 5.0 ==> Co. knows about buggy V.6. (Any movie playing, toys etc. can be done on Apple)
Options: No DSL: >3 mi from closest switch - so cable modem, only choice. Phone line IS noisy - logon at ~24K, whichever machine - I can hear the noise.
3 machines in adjacent 2 rooms - no WiFi desired or needed (yet). So I guess short CAT-5 through wall from router, as extent of cabling concern. Cable guy/gal can put that hose WTF is easiest. Guess the indomitable e-Machine gets to run ~24/7 (A clone has been doing so for some many weeks - elsewhere)
Questions:
1) How no-brainer is the router config as firewall, in '02? I'd assume (hope) it wakes up locked down and then only needed ports are opened. Some test suite like Steve Gibson's grc.com (and two others, I've heard) tend to quit at first 1000 ports as "stealth" / invisible. How do you test? Can't hoit to leave ZA active as well (??) for backup paranoia. Ditto Apple firewall s/ware (?)
2) Matter a lot which router? or.. which to avoid - as these seem to be reaching commodity status.
3) NICs: any modern cheap one OK? (w/ drivers for Doze 9.x, natch)
*nix not an option - her brain cells need to be free to do her work. So far she has managed a succession of machines without serious problems; likely will pick up at least basic triage before calling for $-Help.
So .. in the end, it's a psych test by phone - right?
Thanks for any hints.
moi
Hard typing with a cat asleep on right arm. But.. nice Cto for Left Hand, Op.1.0
Sent at 24K through man-made noise squalls
|
Post #151,563
4/18/04 3:00:45 AM
|
Re: Networking etiquette questions, please
1. Usually driven through a web-based wizard of some description. I tend to disregard GRC's network pronouncements; he's a wiz at assembly language, but doesn't seem to understand security terribly well - cf. the "raw sockets" fiasco. Testing is simple. You get a friend to portscan you and you make that request IN EMAIL so that if either ISP goes loopy you have something to wave at them.
2. I've got a three-year old Netgear RT314 - it's got 4 10/100MB switch ports, a DHCP server, a packet-inspecting stateful firewall, port forwarding, can be controlled via web/telnet menu/telnet CLI, and can be obtained for less than the price of a couple of coffees in Starbucks from eBay. Lessee: [link|http://search.ebay.com/search/search.dll?cgiurl=http%3A%2F%2Fcgi.ebay.com%2Fws%2F&krd=1&from=R8&MfcISAPICommand=GetResult&ht=1&SortProperty=MetaEndSort&query=RT314|http://search.ebay.c...dSort&query=RT314]
I'm not convinced that software firewalls are any use at all; after all, by the time the evil has been detected by, say, ZA, then the evil has already connected to your computer. And tools like ZA have their own exploits. It's true that there are also vulnerabilities in the firmware of things like the RT314, but when you consider that the RT314 is running a tiny embedded OS that's likely to have been considerably more thoroughly debugged than Windows, you may come to the conclusion that the RT314 is more useful in a security context than ZA.
Overall, though, go for a name you trust and get something in a formfactor that you can squirrel away - my preference is for Netgear kit because (a) I've seen it working under very heavy loads 24x7 at work for 5 years with no failures and (b) (some of) it's square and blue. They're succumbing to the blobby shiny silver disease in places, specifically their wireless AP/DSL router things.
3. 3Com no longer produce the best network adapters. I'm all about Intel adapters now. They have some of the best driver support I've seen, and they're priced to fit all pockets, even those of W9x-running cheapskates :-).
Peter [link|http://www.debian.org|Shill For Hire] [link|http://www.kuro5hin.org|There is no K5 Cabal] [link|http://guildenstern.dyndns.org|Blog]
|
Post #151,569
4/18/04 5:26:47 AM
|
Thanks, Peter
re 1) Yes, recall the raw sockets crusade and agree that the style of his presentations is a bit Disneylandish. As I comprehend it - his little Shields Up thingie merely tries for access at a few over 1000 ports. If "they" cannot see you, or 2nd grade: can see you but not enter - isn't that Good Enough? Perhaps there are better attacks I might request (of the installer / congfigurator). No argument from moi re Gibson's net wiles being Wizard-grade, though he appeared at one point to have pretty well ID'd the source/child of a DDOS attack, etc.
2) Netgear longevity noted; pondering presenting locals with fait accompli - especially if it saves friend some $ while also working quite well.
Unclear about ZA acting only after connection to computer succeeds - thought the point of its messages ~same as a rudimentary packet sniffer: acknowledging that such were aimed at any open port xxxx: had you left it open. You hadn't. [or.. is your box even visible on Net at all, if ZA is properly functioning?]
I note the artfulness of their moving around, hiding - the guts of the True Vector engine, via changing directory name randomly, etc. I expect that many are at work attempting to beat that system; these methods are, of course - outta my league.
I just wondered if ZA could /should remain a backup, or if KISS is better - delete one more running task in Doze, say. That seeems to be your recommendation. OK
3) Intel >> 3Com. Drivers point also noted.
3B) Cheapskates indeed! but cheap in terms of wasted fix-labour. I sorta Know this putrefying [9.x] piece of Billy-innovation (though hardly in the way that You Know intimately where it screws up in actual heavy service). Friend realizes by now: don't ask it to do more than 3 things, and maybe it will. And she 'knows' the layout of this POS.
[RT-314] See what you mean re prices. If paranoid get two - one is bound to work, even from eBay.
5 years is proof of concept, and I believe I can count on you to have noticed any weirdness. ;-) Believe I'll snipe this new one w/ 5 yr warranty, today (3091329117)- seller's lengthy description fills in all the blanks, obv from Netgear specs. Heh, saves faux debate with local guru.. Maybe an el-cheapo one too, for at-home amidst the 9.x Loosers, who are Waiting for Godot
Thanks much; I adore simple/perfect solutions. On to Intel; can't fight nasty Big monopolies in this yuga!
Ashton, gratefully Drill hole; run CAT-5, PnP Hmmm may end up staying around and seeing if I can make the sucker sing, from just whatever Netgear's how-to describes.
Must. Study. NAT.
|
Post #151,572
4/18/04 8:13:40 AM
|
If she's going to use a VPN
Most companies will configure the VPN to disallow a connection to a home network while running. There are ways around this but it's a question to ask.
As for the rest rest, try [link|http://www.ddj.com/documents/s=2856/nam1012432334/|this]. Dr. Dobb's guide to basic home networking security.
----------------------------------------- It is much harder to be a liberal than a conservative. Why? Because it is easier to give someone the finger than it is to give them a helping hand. Mike Royko
|
Post #151,576
4/18/04 8:39:40 AM
|
Using Cisco VPN..
..in my current position and have no issues with home networking.
If you push something hard enough, it will fall over. Fudd's First Law of Opposition
[link|mailto:bepatient@aol.com|BePatient]
|
Post #151,628
4/18/04 4:17:43 PM
|
I'm glad for you.
Your company must have weighed the benefits and costs of this measure and carefully...
What am I saying? Who'd ya bribe?
----------------------------------------- It is much harder to be a liberal than a conservative. Why? Because it is easier to give someone the finger than it is to give them a helping hand. Mike Royko
|
Post #151,708
4/18/04 10:59:01 PM
|
Small start-up
Well, not so small anymore, but still VC based and progressive on the work from home rules.
If you push something hard enough, it will fall over. Fudd's First Law of Opposition
[link|mailto:bepatient@aol.com|BePatient]
|
Post #151,855
4/19/04 7:41:06 PM
|
Gracias, as always -
Netgear RT314, NIC enroute from eBay.
Thanks also for Dr. Dobb's link. Now I have to translate things to - which logs to monitor, why a UPS is a keen idea for the network, etc.
..And figure out how to vet the locals; possibly Barry could administer one of his Quasimodo-type tests via RAS?
(Remote ego-Assassination Services).. then I pick out the least-quivering blob.
moi
|