NYI was established in 1996 NYI caters to small to medium-size enterprises NYI is located in the heart of Wall Street area in New York NYI owns and maintains its own Data Centers All services can be priced and ordered on this site WHAT'S UP ON WHATSDOWN? NYI now offers an online diagnostic toolbox ONE MORE TIME ON FIREWALL SOLUTIONS, PACKET SNIFFING, AND INTRUSION DETECTION WEBMAIL: MORE FUNCTIONALITY, MORE OPTIONS About the new interface and features for NYI's Webmail NYI'S NEW PEERING ARRANGEMENT NYI is now peering at NYIIX CONTROL PANEL GETS A MAKEOVER SECURE HELPDESK NYI encrypts the Helpdesk system SPAM SHIELD Spam Assassin detects 92% of spam and tags it WHAT'S AN IDS AND WHY DO YOU NEED IT Get more security with IDS' help NEW BANDWIDTH OPTION BE YOUR FIREWALL'S GATE KEEPER ULTIMATE GOAL: ACHIEVING BALANCE On Load Balancing solution NEW BACKUP SOLUTION FROM NYI WE SNORT; SO SHOULD YOU Snort detects the trouble early SUNSCREEN FOR YOUR DATA On NYI's firewall capabilities OUT OF SITE, OUT OF MIND About NYI's web accessed, environment monitoring tool SECURITY LINK ANALYSIS About NYI's network monitoring tool LOCK AND LOAD NYI's suggestions on how to make your machine more secure. (by A. Koralewski) STARTING UNIX FOR STARTERS Useful tips on unix system boot up (by A. Koralewski) INFORMED CLIENT IS A SATISFIED CLIENT NYI's Colocation and Dedicated Server clients can now view their servers' exact bandwidth usage. CODE RED WORM TALK Read about preventive maintenance against the current plague of the Red Worm. NEW AND IMPROVED HELPDESK A WORD ON QUOTE GENERATOR UPGRADE CENTER What's Up on Whatsdown? When a system of yours has trouble, it may be difficult to objectionably diagnose it unless you have the right tools. In an effort to help our clients have all the resources they need, we've set up a multi-use toolbox available at http://www.whatsdown.net/. There you will be able to diagnose connectivity problems from multiple locations (not just from NYI's network), as well as port scan your system(s) for possible insecure services. In addition, we have a mail server test to identify if your mail server has an open relay which could add to the internet's already rampant unsolicited mail problem. Your system may get black-listed if you do not clear such problems up. We are accepting suggestions on how to further improve this toolbox for network/system diagnosis/troubleshooting so if you have any ideas on how to improve it, please drop us a line at support@nyi.net and we'll try to accommodate you as best we can. back to headlines One More Time on Firewall Solutions, Packet Sniffing, and Intrusion Detection NYI is mostly a FreeBSD shop and we use its ipfw filtering software to do all of our filtering and bandwidth management. It allows us to pretty much control everything about all the packets entering and leaving our network at different locations. We can filter packets based on a number of criteria, such as to which subnet it is destined to or from which it originated. Other criteria include, which network service is requested (based on port numbers for UDP/IP). ICMP hasn't been left out either, we can filter based on ICMP types such as allowing ping requests and replies to pass through or block, while controlling other ICMP functions such as destination unreachable messages. We can get more intimate with our packets by looking at the TCP flags (SYN,ACK,FIN,etc) to determine whether the connection is initializing, ending, or transient. For even more flexibility with the firewall, we can examine IP options such as fragmentation characteristics. Additionally, we have the facility to create virtual traffic pipes to control the flow of traffic based on any aforementioned criteria in order to emulate a more limited bandwidth connection (i.e. we physically use a 100BaseT port but emulate a 512Kbps link for a client who needs a half a meg pipe), as well as packet loss rate for testing purposes, etc. This also allows us to give different traffic types different weights. For example, if you have a mail server and an FTP server on the same subnetwork, you do not want your more important email services being degraded by the bulk traffic of the FTP services. In such a case, we would assign a higher priority/weight to the mail services (e.g. by port numbers) than FTP so that mail would take precedence over other traffic (such as FTP). When there is no email passing through the subnetwork, other traffic would not be limited as no other traffic has been configured to take precedence. In terms of intrusion detection, we use a very mature and effective open source project called Snort (www.snort.org). A great number of closed source commercial solutions are either based upon this successful program, or are compatible with it. Snort allows us to monitor in real time suspicious activity based on known patterns (i.e. rules) of network traffic (e.g. packet contents; traffic flow characteristics). We have developed an in-house program that lets us to easily choose which rules we want to use. We have also tied Snort into the ipfw utility to dynamically disable access to offending users from accessing hosts behind the firewall for a specific amount of time. We feel this is the best combination of power and flexibility in a managed firewall solution while maintaining control over what happens. back to headlines Webmail: More Functionality, More Options Recently, NYI has introduced the new interface for the Webmail to make it easier, more convenient and more functional for our clients. This new interface will keep you logged in longer, so if you have passed off Webmail for just this reason, give it another try. The update also included adding many new useful features such as: - Mail Filters, that will help you better organize your mail and dispose of unsolicited advertisements (spam) - Notifications of new email messages - Spell Checker - Translator by the way of Babelfish, InterTran and others - Calendar All of the aforementioned features can be easily configured by clicking on the "Options" link at the top of your browser's window. If you need a few pointers on the new features, here is a short guide to using some of them. back to headlines NYI's New Peering Arrangement NYI is proud to announce that it will be peering at NYIIX, which will allow direct connections with dozens of network, not limited to but including: Demon, Nildram, Wirehub, Net Access, Abovenet, BBC, KDDI, Internet Solution, Tiscali, Globix, Stealth, Colt, Time Warner, TTSG, IIJ, Emirates Telecommunication, Akamai, Chello, Mobilcom CityLine, DSL.net, VillageWorld.com, Pacific Century CyberWorks, Hurricane Electric, Deutsche Telekom, Peer1, Sunrise, Blue Stream, Chunghwa Telecom (HiNet), NTL, Thorn Communications, DACOM, Group Telecom, Easynet, BT North America, Nexus Telecom, ISPrime, Finnet International, Accretive Networks, BigPipe, FLAG Telecom, Primustel Canada, Like Whoa, Logic Communications. Why is peering important to ISPs? Peering is an inexpensive means of exchanging Internet traffic. Without peering, ISPs must pay expensive fees (called "transit fees") to national (mostly Telco-based) network providers. Once a peering connection is installed, private peering enables ISPs to move traffic from the ISP's transit circuit to the ISP's peering circuit. The freed transit bandwidth can be used for additional customers and/or to save the ISP money by postponing the need to purchase additional transit bandwidth. NYI looks forward to connecting with the regional, national, and international networks that comprise the NYIIX member list, and feel that this will bolster NYI's ability to serve our clients data in the most efficient manner possible. We look forward to begin peering sessions in Washington DC, Chicago, and San Jose in the near future. Other well known peering points are: ATL-NAP Atlanta, BMPX - Boston Metropolitan Exchange Point, Bellsouth Multimedia eXchange, BNAP - Baltimore NAP, ipx - A New Jersey Activity, Louisville-nap.net, MAGPI - a Mid Atlantic Gigapop for Internet2, NNAP - Neutral NAP/ inactive link, Nashville Regional Exchange Point, Nap of the Americas, NY6iX - A New York IPv6 exchange, Philadelphia Internet Exchange, Pittsburgh Internet Exchange, Research Triangle Park, Sprint NAP (Pennsauken NJ), Vermont ISP Exchange, AMAP - Anchorage Metropolitan Access Point, COX - Central Oregon Internet Exchange, HIX - Hawaii Internet Exchange, LAIIX - Telehouse LosAngles, LAP - A Los Angeles Exchange, includes MAE-LA, Northwest Access Exchange - Portland, OIX - Oregon Internet Exchange, Pacific Bell NAP Information, PACIFIC WAVE - Pacific Wave Exchange, SD-NAP - San Diego (Caida), SIX - Seattle Internet Exchange, New Mexico Internet Exchange, New Mexico Network Access Point, TTI - The Tucson Interconnect, Compaq's Houston NAP, The Middle American Exchange Points, Ameritech NAP info (Chicago NAP), CMH-IX - Columbus Internet Exchange, DIX - Denver Internet Exchange, IndyX - Indianapolis Data Exchange, Nashville CityNet, Ohio Exchange, RMIX Rocky Mountain Internet exchange, STAR TAP (12 GigaPOP), The Arch - St. Louis, Mo, Utah REP, BCIX - British Columbia Internet Exchange, CA/NAP Canada/Toronto Exchange, CANIX: Originally CA*net sponsored - No URL Supplied, Edmonton Internet Exchange, MIX - Montreal Internet Exchange, The Nova Scotia Internet exchange, Ottawa Internet exchange, Quebec Internet Exchange (French), Toronto Internet Exchange and more. back to headlines Control Panel Gets a Makeover As many of our hosting clients have probably noticed, our virtual hosting control panel has finally been redesigned and some features have been added. While the adjustments may seem minor, this is part of a massive overhaul in our online control panel area that will eventually become an NYI Client Portal to manage all aspects of their NYI account(s) from adding email accounts to updating billing information to viewing open invoices on the account. This control panel will soon not only be for virtual hosting clients, but for all clients and incorporate all of the specific services involved with the particular account (i.e.email management, mrtg stats, firewall/IDS configuration, HelpDesk access, etc.) This is further evidence of NYI's unending quest to make sure our clients experience the best and most efficient service in the market today. back to headlines Secure Helpdesk All of NYI's clients are familiar with our HelpDesk system. This powerful tool serves as a communication medium between our customers and technical staff, allowing for the best response times in case of any kind of technical issue. All a client needs to do is to logon with a unique user ID and generate a trouble ticket that will immediately alert NYI's tech support staff that will address the issue at once. The HelpDesk system is relatively new and we work on improving it on a daily basis. The latest improvement was bringing the maximum level of security by ensuring that all the information entered in the system is encrypted. In other words the HelpDesk has been made secure, in case any sensitive information needs to be submitted by our clients. The HelpDesk's URL is now https://hd.nyi.net back to headlines Spam Shield If you have been online for a fair amount of time, chances are, you have received your share of spam -- unsolicited commercial bulk email. In other words, electronic junk mail, anything from financial services advertisements to adult material. And chances are that you have suffered from such unsolicited mailings, when your privacy was invaded by explicit images and vulgar language, or when you missed a legitimate email among the dozens of spam messages, or many other unpleasant scenarios. Things are changing, however. New York Internet is pleased to announce its plan of instituting a number of filtering methods to combat spam. The software will combine a growing number of known signatures common to spam along with keen decision making to mark spam email as such. You will still receive every message intended for your address, but you will be able to easily set filters within your email program to either move the suspected spam message into a special folder, awaiting your scrutiny, or simply move it to the trash. From our tests, we have found our filters to be very effective, recognizing over 92% of all incoming spam messages as such. Any higher a rating is exponentially more difficult to attain because of spammers' continued modification of their methods to stay abreast of anti-spam tools. This rating is still very high, and will be very effective in helping you manage your mailbox. back to headlines What's an IDS and Why Do You Need It? We all have been witness to the increasing frequency of security incidents, ranging from intricate and involved hacks, to run-away Internet based worms like Code Red and Klez. The costs involved in dealing with such incidents are staggering. A hacking attempt may begin with an attacker port scanning your server to see which ports, and thus, which services are opened and accepting connections. Many tools have the ability to even guess which operating system you are running. Armed with this information an attacker can simply search for easy to use software to exploit the server software you are running. An attacker might also scan an entire range of IP addresses, looking for a specific port. Case in point: the recent increase in scanning of port 1433 by the myriad of recent Windows-biased worms looking to enter your system through Microsoft's SQL server. In the past, such activity could largely go unnoticed. But as the Internet becomes less of a friendly community and more of a hostile battleground pitting systems administrators and security experts against hobbyist or malicious attackers, more tools are available to notify you of possible attacks, and even act to protect your systems. These tools fall under the category of Intrusion Detection Systems (IDS). You might be wondering why you need such a system when you already have a firewall in place. The term "firewall" encompasses a wide variety of devices and may give a false sense of security. In its purest form, a firewall is only as good as the access rules it is configured with. Let's use an example to illustrate the point. Suppose you needed the database server to be available to clients outside of your network, making the server accessible to anyone. And suppose the Klez worm has just been released into the wild. Your risk of being infected would be great. You might be fortunate enough to hear of the worm in time, and had your network specialist block off the port to the outside. But that would mean interrupted service and loss of productivity. And if you did get infected, it could spell disaster. Now imagine that you were protected by intelligent software that can recognize the signature of an attack and automatically block the IP address of the sender. The service is still available to your customers and the attacks never arrive at your server. Your clients are never denied service, your servers are never compromised and do not have to be reinstalled from scratch, and your server never has to use its resources to process the attacker's requests, and instead process legitimate traffic. The above example doesn't limit the use of IDS to just that situation. Among hundreds of various attack signatures, the IDS protects you against port scans, distributed scans of a specific port on many machines, web access to exe and ids programs common to Microsoft's IIS, CGI exploits and buffer overflows, and many more. back to headlines New Bandwidth Option Here at NYI, we care about our clients. We research their needs and modify our services to match these needs. We want our offerings to be as flexible and as helpful as they can be. As many of you have probably noticed, our Quote Generators constantly get updated and improved. One of the options that we regularly update is bandwidth. First, we offered a Fixed bandwidth option. This option allowed clients to have a constant bandwidth throughout the month. Soon after, we realized that this option wasn't flexible enough and did not suit all our customers. Thus, we added the Burstable bandwidth solution. This option allowed a dedicated or colocated server to have a constant bandwidth, but when necessary, stretch (or "burst") to a higher tier if traffic increased. This became a popular option, but we didn't want to stop there. To add more flexibility, we added the Data Transfer bandwidth option. This option allowed a client to specify the amount of data that his/her server would be sending per month. Yet, this option turned out to be insufficient, as it didn't specify the speed at all. After careful review, we have decided to improve this option by combining it with our Tiered Burstable option. With this new Data Transfer option, our clients can specify the amount of data they wish to transfer per month and the line speed that they want to do it at. This option is the most efficient for clients whose speed needs fluctuate (as opposed to clients whose speed needs are consistent, in which case they are better off with NYI's Fixed solution). With this option, you kill two birds with one stone: you get the ability of transferring data at high speeds while not incurring the high cost of the fixed bandwidth. (Example: 75 gigabytes of data transfer at 2 Mbps per month costs less than 50% of the cost of a fixed 2 Mbps line.) Another important advantage of this bandwidth option is that there won't be a cap once the selected data transfer option is reached. Instead, the transfer will take place at additional cost of $3.50 per gigabyte. We invite you to generate quotes with our new bandwidth option and use our present 10% discount on monthly and setup charges. back to headlines Be Your Firewall's Gate Keeper Wouldn't it be great to control the dedicated New York Internet firewalls that your servers are being protected by? Now you can! New York Internet's developers bring you yet another tool to make your life easier. The Firewall Control Panel will let you control any traffic to any of your IP addresses through an intuitive, web based application accessible from any browser. And if you sign up for our Network Intrusion Detection solution, you will be able to see in real time which IP addresses have been dynamically denied access to your address space. back to headlines Ultimate Goal: Achieving Balance Uptime and availability are crucial to companies with an Internet presence. It's no secret that misfortunes do happen: hard disks crash, processors fry, power supplies explode, etc. These accidents, however, should not necessitate downtime for your company or your clients. With New York Internet's load balancing solutions, you will have the ability to run multiple servers concurrently sharing the workload of serving your visitors. If you experience a spike in traffic, your web services will not be overwhelmed, but rather share the load. If one of your machines crashes terminally, your other server(s) will pick up the load, unbeknownst to your end users. This can be achieved by situating your server farm behind a dedicated UNIX-based load balancer and having assigned to it a private IP range. This solution has a number of advantages. First, all requests would come to the same IP address that you have always used for your server, which means no turnaround time. Second, you would not have to use up any more of your NYI assigned IP addresses. Third, the fact that all requests go through a central server means that you will have the ability to filter the traffic with firewall software, and protect your web servers from worms or port scans with Intrusion Detection Software back to headlines New Backup Solution from NYI Whether you are a purely digital company, or simply one with a web presence, your digital resources are an integral part of your wealth. At the same time, they are a very fragile and volatile resource, subject to destruction due to accidental deletion, attacks, or severe hardware failures. We recognize your need for redundancy in the form of secure backup solutions. That is why we are pleased to offer to you the New York Internet Backup Server solution which will be fully operational starting July 1st. The New York Internet Backup Server is a secure UNIX based server that will allow you to store your important files in a central and secure location for safe keeping. After being granted an account with a disk space quota of your choice, you will be able to transfer your files from your server here at NYI to the backup machine using ftp, scp, or sftp. You will be allowed to log in with your user name and password to perform a limited number of administrative tasks, such as managing your files and checking your disk usage stats. You may type "?" (without the quotes) while logged in to receive some helpful hints. back to headlines We Snort; So Should You. There are many reasons people use the Internet. Some like the possibilities, while others like the anonymity. Like in real life, some just like to cause trouble. Fortunately for everyone else, there are great utilities to detect when trouble is on the way. One such utility is Snort. Snort is a network intrusion detection system. NYI makes extensive use of Snort to monitor our network usage and make sure that the rest of the Internet is getting along well with NYI. Snort is our network-intrusion detecting program of choice because of its flexibility and scalability. Snort is able to notify NYI's ever-vigilant staff of anything suspicious, so that we may take appropriate action, from keeping an eye out on things, to blocking malicious traffic or even contacting the responsible party. Snort is able to match data to many predefined regulations for traffic passing in or out to the Internet and if something looks fishy, you can be sure NYI will know about it and will keep it from becoming a problem later. back to headlines Sunscreen For Your Data Recently New York Internet has integrated firewall capabilities to our product colocation and dedicated server offerings. With recent attacks on the largest names in web space, firewall protection will surely benefit almost any installation to our network. New York Internet has chosen to partner with Netscreen Technologies, after testing their equipment, as well as Cisco's PIX 520, Sonic firewall, and Checkpoint firewall. Features such as statefull inspection of every data packet coming across the ethernet connection at wire speed, hardened and customized firewall -centric os, and ASIC-based hardware components make Netscreen that fastest firewall we could find. Rated at 512,000 concurrent sessions, this firewall will be every client's dream come true. Firewall features include: - Deny any or every packet from every or any IP address - Deny any or every port from every or any IP address - Deny any or every packet to every or any IP address - Deny any or every port to every or any IP address - Detect SYN attack - Detect ICMP flood - Detect UDP flood - Detect ping of death attack - Detect tear drop attack - Detect WinNuke attack - Filter IP Source route - Detect port scan Attack - Detect address sweep attack - Detect land attack - Optional block Java/ActiveX/ZIP/EXE component - Optional URL filtering With this technology implemented, NYI can also execute VPN solutions for secure communication of your data. Whether you're setting up for LAN-to-LAN or Dialup-to-LAN communication, VPN will increase the level of security. To create an Autokey IKE VPN: VPN tunnel's encryption and authentication is actually a two-phase process. Phase 1 essentially covers how the gateways will securely negotiate and handle the building of the tunnel. The P1 (Phase 1) Proposal sets the terms of the negotiation. Phase 2 sets up how the data passing through the tunnel will be encrypted at one end and decrypted at the other. The encryption method you choose needs to account for both phases. This process is carried out on both sides of the tunnel. The P2 (Phase 2) Proposal sets the terms of the negotiation. The predefined Phase Proposals are listed: Phase 1 Proposals: pre-g2-des-md5 pre-g2-des-sha pre-g2-3des-md5 pre-g2-3des-sha rsa-g2-des-md5 rsa-g2-des-sha rsa-g2-3des-md5 rsa-g2-3des-sha dsa-g2-des-md5 dsa-g2-des-sha dsa-g2-3des-md5 dsa-g2-3des-sha Phase 2 Proposals: nopfs-esp-des-md5 nopfs-esp-des-sha nopfs-esp-3des-md5 nopfs-esp-3des-sha g2-esp-des-md5 g2-esp-des-sha g2-esp-3des-md5 g2-esp-3des-sha back to headlines Out of Site, Out of Mind Sometimes there is no substitute for "just being there". I am referring, of course to NYI's colocation solution. Well, now you can leverage NYI's IP network and have a visual of your equipment at your finger tips! The Security ViewCam is a web-accessed, environment-monitoring appliance that checks the internal environment conditions of an equipment cabinet such as temperature, humidity, smoke, and airflow. Alarms providing you with advanced warning of equipment failure are sent via email and pager when a connected devices condition is out of range. A built-in camera records individuals accessing the rack or cabinet and allows both the customer and technician to easily view the condition of equipment via an internally generated web page. User-defined alarms are sent via pager and email notification to designated personnel. back to headlines Security Link Analysis NYI monitors its network accurately and thoroughly at all times. One of tools we use for that is Security Link Analysis. This tool lets us monitor multiple network statistics variables concurrently and allows us to predict future network needs and plan for them accordingly. Alarms are generated whenever present threshold parameters are exceeded, informing us about network exception conditions that may require immediate attention. When clients experience an attack or some strange activity on their IP, NYI can provide them with detailed statistics and graphs of their traffic. If you think there is an issue with your machine, IP, etc., please submit a ticket on our online Helpdesk requesting the Security Link Analysis. This program monitors and displays a network segment's packet rate, utilization and error rate in real time. Statistical counters for all network detail parameters are maintained in memory, and may be exported to Excel format for tabulation or charting. The host table maintains each network node's traffic statistics in real time. It keeps MAC, IP network, IP application, IPX transport layer information in separate tables, all of which may be viewed in table, bar or pie chart formats. The host table can be sorted by any statistical variable of your choice, in either ascending or descending order. The matrix table maintains network node pair conversation traffic statistics in real time. It keeps MAC, IP network, IP application, IPX network, and IPX transport layer information in separate tables, all of which may be viewed in table, bar or pie or pie chart formats. The matrix table can be sorted by any statistical variable of your choice, in either ascending or descending order. The traffic map provides a birds-eye view of the network traffic patterns in real time. It gives a complete graphical presentation of the traffic pattern between network nodes. The Security Link Analysis Protocol Distribution function allows the reporting of network usage based on the network layer, TCP/IP application layer, and IPX transport layer protocols. Network Layer protocols monitored are IPX/SPX, TCP/IP, NetBIOS, AppleTalk, DECnet, SNA, Banyan, and others. The "TCP/IP Application Distribution" function reports on the percentage or cumulated load of each TCP/IP application as part of TCP/IP traffic. This tool monitors popular applications, including NFS, FTP, Telnet, SMTP, POP2, POP3, HTTP (WWW), Gopher, NNTP, SNMP, X-Window, and others. Security Link Analysis is capable of capturing all packets at near wire speed. When we use it with various address, protocol, and data pattern filters, it lets us pinpoint network trouble areas accurately and effectively. In particular, the IP address filter provides a powerful way to capture conversations between nodes that span across routers. back to headlines Lock and Load Once you get your new machine, there are some things you might want to look into before you have your computer known to the rest of the Internet. Not everyone on the Internet behaves well, so there are some precautions you should take to secure your machine. It's important that your machine only performs the services it's supposed to. Every extra thing it does can be looked at as an extra vulnerability. Most new unix installations install a service called portmap, which often is not necessary (unless you're running nfs or rpc services). It'd be wise to leave that turned off. We at NYI make sure to do this when we install a colocated machine for you but it may be overlooked if you do not have NYI install your machine. Another common service that's become the target of Internet delinquents is traffic sniffing. While NYI does its part to minimize the possibility of listening in on network traffic, there isn't anything we can do about the rest of the Internet. One commonly sniffed protocol is telnet. As you may know, telnet allows you to log in remotely to another system. The problem with telnet however is that it sends everything, your commands, the system's responses, even your login/password using plaintext. That means anyone can see what is being typed. Ideally, this kind of information should be encrypted to keep from prying eyes. This is where SSH comes in. The Secure SHell service allows you to do whatever you would using telnet, but keeps it secure. Furthermore, it allows you to tunnel other plaintext service using encrypted channels. At NYI our goal is not only reliable operations but also secure ones. This is why we not only encourage, but recommend SSH usage as an alternate to telnet. Machines installed by NYI have telnet disabled by default and ssh access exclusively available for your convenience. There are many SSH clients available for just about any operating system you use. Additionally, once you have your machine running the absolute bare essentials, you can concentrate on the system's internal security. If an intruder does get access to your machine, you want to minimize the chances of them gaining administrative (root) access. The target of such an attack are usually set-uid and set-gid programs. Such programs, are set to run as the root user to do their task and then exit. However if a malicious user knows how to manipulate poorly written programs, he may be able to get root access (because the program runs as the root user momentarily). What you will want to do is to deinstall any insecure programs, especially ones you don't use, and if at all possible, replace them with a more secure version. One such example is sendmail. Sendmail is a well established mail daemon but it has a history of security holes not only locally but remotely exploitable. At NYI, we encourage alternate mail daemon use such as Qmail and Postfix. We do not run sendmail on any critical systems of our own. Any server program that provides remote service and runs as root needs to be evaluated in your security model to make sure it is really necessary, and whether it can be made more secure by using an alternate version of the server program. back to headlines Starting UNIX for Starters To someone who is new to the world of unix, seeing a unix system boot up for the first time can be a rather intimidating experience. It's a lot less friendly than a typical windows system. Instead, you're greeted with pages full of text that scrolls off the screen before you have a chance to read a sentence of it. Fortunately, what's actually happening isn't as complex as it looks. Once the boot loader, usually located among the first few physical sectors of the media, finishes loading, the kernel loads. The boot loader is a small program which begins loading/executing the kernel of the operating system. The kernel is actually a program like any other, that is the heart of the operating system, and is responsible for many incredibly critical, yet transparent-to-the-user tasks. One of its most important tasks is memory management, another is hardware access, network access, filesystem access, permission checking, etc. A well-written operating system will make it seem as if there wasn't even any kernel running because all things are so seamless. The kernel is so important that it's always running and always in memory. Once loaded, it begins execution. This is what the first page or two of text messages you see when a unix system boots. The text is actually the kernel's output stating what hardware and drivers it recognizes as it loaded. The kernel will then mount (make accessible) a root partition, and afterwards, continue to the next step of the boot process. The kernel itself is typically a special filename such as: /unix or /genunix (for Solaris), /kernel (for FreeBSD), /vmlinuz (for Linux), etc. Once the root partition is accessible, the program /sbin/init is called. Then there are two schools of thought on how the system should proceed to boot up, and different unix systems use one of these two ways. These two different methodologies' origins trace back to the beginning of unix itself. The first philosophy is used on System V (SYSV) systems, such as Solaris and RedHat Linux. This method is concerned with different 'run levels' that the system enters. Each run level is represented as a directory on the system, and each run level directory has a set of scripts (or links to scripts) that perform a function, such as starting one service or stopping another. The scripts themselves are usually in the directory /etc/init.d/ (or/etc/rc.d/init.d/) and are a flexible version that are capable of both stopping and starting a service. To determine how it behaves, the script's link begins with S (start) or K (stop), followed by two numbers (which determine its order of execution) and a short name. The order of execution is determined by alphabetical/numerical order. An example is: -rwxr--r-- 5 root sys 7317 Sep 1 1998 S69inet - ../init.d/inetinit The script itself is in init.d/inetdinit, but the symlink in the run level directory called S69init. This means it would call the script init.d/inetinit with the 'start' parameter and would execute after all K00-99 and S00 - S68 scripts but before any S70-S99 scripts. If the link name had began with K instead of S, being K69inet, it would call the script init.d/inetinit with the 'stop' parameter, running after K00-68 scripts, but before any K70-99 and S00-99 scripts. Which run level is entered (and hence, which set of scripts is ran) is determined by what needs to be accomplished. The levels are: 0 - ran when the system is about to be powered down; 1 - administrative mode, also known as single user mode (level s or S is another name for it); 2 - multi-user mode; 3 - multi-user mode with remote file sharing; 4 - user definable, but not often used; and level 6 - which is used for shutting down and rebooting. The run level that the system would normally boot up to is determined by the 'initdefault' line in the file /etc/inittab. The program telinit is called when the system's state (run level) changes. The other method of booting up, is used by the Berkeley System Distribution (BSD), such as FreeBSD, and Slackware Linux. It isn't quite as organized so it's not as complex as the SYSV approach. Instead, init calls a script in /etc called 'rc'. This script, in turn, calls other scripts to handle functions such as bringing the network up (rc.network), checking filesystems, etc. The script, rc.local, usually runs last. Once the last of the init scripts have finished running, the system is ready to accept connections and perform the services it has been set up for. If there are services that shouldn't be running (such as portmap), you would need to configure your init scripts to prevent it from running. back to headlines Informed Client Is a Satisfied ClientThere's a certain appeal to knowing vital statistics about your system(s). That appeal probably has something to do with the fact that you become an informed client and aren't left in the dark. We at NYI not only want you to be a satisfied client, but an informed one as well. For this reason, we worked hard to develop a way for you to view your exact bandwidth usage on four different time intervals (last few days, weeks, months or year) in a convenient and private way. We use an external program (for the curious, it is called MRTG, the Multi-Router Traffic Grapher, written by Tobias Oetiker among others) to collect the relevant numbers from our routers and graph them. Then our system makes your graph or set of graphs available to you using a secure method that ensures your privacy as well as convenience (see example below). All the relevant set of your systems has its own graph, displayed neatly one below another with a textual summary for the current time interval for a quick way to understand exactly what's going on at all times. back to headlines Code Red Worm Talk In the past several weeks, NYI has dealt with few servers infected by viruses, most common being the Code Red Worm. We've all been hearing about this recent virus scare in the news, however it seems that not everybody knows what it is and how to fight against it. The Code Red Worm is a dangerous virus, that can infect any Windows NT 4.0 or Windows 2000 operating system, that doesn't have the latest patch from Microsoft. There are two versions of this worm, Code Red and Code Red II. Though both are serious threats, Code Red II is much more dangerous. The way it works is it takes advantage of vulnerability in unpatched systems by causing a buffer overflow. The first version of the worm would then attack what used to be the white house web page. The second version of the worm is much more harmful. It installs a back-door (A program which allows users to take over your system) onto the system allowing any user to take advantage of the system and use it for whatever they intend to do. Then, the program will lay dormant until a certain date. Once the virus stops being dormant, it will try to find at least 300 other machines that are not patched and infect them, causing the virus to spread rapidly. For example, assume one system was originally infected. That single infected system then tries to find 300 other unpatched systems, which are not yet infected. It then infects those systems. Once those systems are infected, they all try to infect 300 other systems. After only the second round of infections, there would be 90,000 machines infected with this worm. These numbers show that every system, that is not patched, is either going to be, or already is infected. Once we started monitoring for the Code Red worm, we realized that some of our clients' machines in our Data Center did not have the patch. Even though this virus has gotten so much media attention, some users haven't taken the measures of protecting their machine as well as other users. The problem with monitoring for this virus is that we can only see that it is on a system when it's actually trying to compromise other machines. While it is in its dormant stage, it is impossible for us to see it on the machine. The bottom line is: if you have a Windows NT 4.0 or Windows 2000 machine, make sure to get the latest patch. If your machine is not patched, the chances of it not getting infected are slim. The URL to the patch that will fix the vulnerability in Windows NT and 2000 systems is http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS01-033.asp Please note that this patch only makes it so that you can not be infected with the virus. In order to cleanup the trojan that the worm leaves behind, it is advisable to upgrade your virus scan and to scan the whole system. back to headlines New and Improved HelpDesk In the ideal world, there would be no problems and everyone would have whatever they wanted when they wanted. However in reality, things aren't so perfect. At NYI, we recognize this and have worked hard to address this by taking an old idea and giving it a new approach. Whenever you have a question, inquiry or request, it's not very efficient to call in to our headquarters, and if you have done so, you may have been referred to the HelpDesk. The HelpDesk is NYI's online support system, where we can communicate and work together with our clients more effectively to come up with a solution to our clients changing needs. At the beginning of August, you may have noticed a new look to this HelpDesk system that we've been using for a few months. This is because it's been entirely re-designed and re-written from scratch by NYI's talented programmers and designers. To make the transition easier, the process of which you would open up a Support Case, (formerly known as a "ticket") is similar, but more powerful and flexible. We hope you will find this system a lot easier to use if ever the need arises to seek further help from NYI concerning your service. A lot of time, thought and effort has been put into re-designing the system to make it the best available. And like any great project, it might still be improved upon. If you have any suggestions as to how you believe the HelpDesk can be made even better, please email us or live the experience and open up a case online. back to headlines A Word on Quote Generators For the last year, NYI has offered customers what no other ISP has been able to effectively offer; the ability to generate customized quotes with no obligation for services such as Hosting, Colocation, and Dedicated Servers. Over the past year, we have added features and allowed for unique specifications that have made our Quote Generators some of the most widely used methods of pricing on the Internet today with tens of thousands of quotes being generated daily. Earlier this month, NYI released a redesigned and re-engineered version of its patented Quote Generators. The new design is even easier to use and allows users to follow the progress of the quote through the time that it becomes an order. This process of Quote generation eliminates the need for intrusive sales people that have no idea what the customer is looking for. These new generators allow potential clients to become familiar with the various features of our services which allows the sales process to proceed much more efficiently and quickly. NYI will continue to maintain and upgrade our Quote Generators in an effort to provide the most comprehensive quote generating tools available on the Internet today. Upgrade Center NYI has created the Upgrade Center for its current clients. This tool is a twin of the Quote Generator except it's only for upgrading the already existing service. It works the same way as the Quote Generator: you choose the options you need, view the price online, and then proceed to order. Please note that the options you choose will be added on to whatever options you had prior to the upgrade. back to headlines Homepage • Services • Pricing • Network • Support • Contact © 2009 The New York Internet Company, Inc. All Rights Reserved Privacy Policy • Terms & Conditions • Acceptable Usage Policy • Sitemap • Suggestions?