ixs' Vodkamelone

Nachdem ich ja schon ausgiebig meine Abenteuer mit der T-Com beklagte, musste ich heute ernüchtert feststellen, dass nicht nur die T-Com mich hasst. Nein, auch Cisco mag mich nicht.

Heute Nacht wurde der Access Concentrator in Stuttgart umgetauscht. Früher war ich an STGX42-erx, einer Juniper Networks E-Series, angeschlossen. Mittlerweile ist es ein Cisco 10000 Router mit der Performance Routing Engine 3.

Das Ergebnis ist deutlich:

Mar 13 17:37:29 rtr pppd[19032]: pppd 2.4.3 started by root, uid 0
Mar 13 17:37:29 rtr pppd[19032]: Using interface ppp0
Mar 13 17:37:30 rtr pppd[19032]: Connect: ppp0 <--> /dev/pts/0
Mar 13 17:37:30 rtr pppoe[19035]: PPP session is 63082
Mar 13 17:37:31 rtr pppd[19032]: CHAP authentication succeeded
Mar 13 17:37:31 rtr pppd[19032]: local  IP address 91.32.100.35
Mar 13 17:37:31 rtr pppd[19032]: remote IP address 217.0.118.57
Mar 13 17:50:01 rtr pppd[19032]: LCP terminated by peer
Mar 13 17:50:01 rtr pppd[19032]: Connect time 12.5 minutes.
Mar 13 17:50:01 rtr pppoe[19035]: Session 63082 terminated -- received PADT from peer
Mar 13 17:50:01 rtr pppoe[19035]: Sent PADT
Mar 13 17:50:01 rtr pppd[19032]: Sent 39902910 bytes, received 18850825 bytes.
Mar 13 17:50:01 rtr pppd[19032]: Modem hangup
Mar 13 17:50:01 rtr pppd[19032]: Connection terminated.
Mar 13 17:50:02 rtr pppd[19032]: Exit.

Man sieht also sehr schön, wie es eben nicht geht. :-(

Warren wondered whether it would make any sense including a version of scp or ssh which do not encrypt their traffic on the network.

As far as I can see, such a tool would indeed be useful for many tasks. "brokensh" might not be that useful, but "brokencp" is certainly useful.
Consider the roadwarrior with his notebook who is transferring some data from the server to his notebook. He is already encrypting the data-traffic by using openvpn or ipsec. The network between his tunnel-terminator and the server can be considered secure. He would save CPU-time by not having to encrypt the traffic twice.
Or the system-administrator who has to copy a whole tree of files, including permissions from one machine to another. He could just call tar c /dir | ssh root@server tar xv to achieve this. If the machines are directly connected the transfer is probably faster, as the data does not need to be encrypted. Generally, I do help myself in this case by using netcat, but still.

I for one do like the idea of selectivly disabling encryption for scp as long as the authentication against the remote system is secure, that is no cleartext password crosses the wire. I do not care if the attacker sniffing my line is able to reconstruct the latest Fedora ISO image which I'm copying, I do care that he is not able to sniff my password.