1. My apologies to the network savants out there who already knew this,
but I think the following may be of interest to some people who are not
interested in devoting an ongoing portion of their lives to network
security, but are intolerant of hackers and hacking attempts.
For some time, we've been running our spectrometer hosts and associated
workstations on a private network, which was the old thick-wire coax left
behind when our building was rewired for 100 Mbit category 5 connections.
Because the old wire is about to be torn out, I needed to find an
alternative, and am now using non-routable IP numbers with the computers
attached to the new building wiring. Addresses in the range 192.168.x.x
are suitable for this purpose. Using the enabled-by-default SGI network
daemons, I have always found it necessary to put in a default network
route (gateway address) to get the system to work. It is still necessary
to do that, with an address in the 192.168 range. The fact that in
this case there is no piece of hardware having that address is apparently
immaterial, but without this definition, the SGI declares that the
network is unreachable. (I have heard, but can't verify, that the Macs in
our building want a default route also, whereas PCs don't need it.)
I set up host resolution with files only (all the machines to be
recognized are in /etc/hosts). Set up this way, the SGIs can do all the
usual things like NFS mounts and printer sharing, but the machines around
them in the 129.237 domain are invisible to them, and vice versa. They
are totally inaccessible via the Internet, since these IP addresses are
not routed outside the building; someone in our building who put
a machine in the same address range could connect to them, but when you
can walk right up to them, it hardly seems worth it for hacking purposes.
For legitimate file sharing, anyone can set up a machine to join in as
long as they are on the same side of the router as you are (something you
may have little control over). One machine can be on both public
and private networks if it has two configured network cards, but unless it
has firewall level security, the purpose of the private network is
defeated. More elaborate (and presumably expensive) implementations of a
private intranet on internet wiring are also available, which may be
more flexible, but I haven't investigated them.
The advantages of this system are a high degree of isolation from
the outside world while someone else installs, maintains, and upgrades the
necessary wiring for you.
2. Toney Miller at MilTech Laboratory Services in Tulsa is
looking for a surplus but operational permanent magnet NMR. If you would
like to offload such an instrument, you can reach him at MLTKLB_at_cs.com.
Dave Vander Velde, University of Kansas
Received on Fri Jul 07 2000 - 13:52:34 MST