Here is a Cisco video on the product they hyped as changing the internet.  Most non-IT persons don’t understand how much data this router can move so the message was lost on the general public.  This router will definitely changes things since it provides the backbone for streaming video to become commonplace.  Once service providers can supply high speed connections to homes over fiber we’ll all be watching television and making phone calls over the internet.

Click here to view the embedded video.

I’m not really sure how this happened but Bing was suddenly set to be the default search engine in Firefox.  I was installing software on my PC and one of them made the change without my noticing.    I really don’t mind using Bing occasionally but for most searches I prefer Google.  I know as a company Google seems to be in everyone’s business but that is the reason the search engine works so well.  So after searching the web (using Google), I found several sites with information on returning  to the default settings on Firefox.

1.  Open Firefox and enter about:config in the address bar.  Oh and agree to be careful.

2.  There are many entries in the configuration file so you’ll need to filter for the entry keyword.url

There is the setting that has Bing doing all the searching in Firefox.

3.  Change the value to the following – http://www.google.com/search?ie=UTF-8&oe=UTF-8&q=

This URL will bring up Google search results for the topic that was entered in the address bar.  If you are the adventurous type and you like the “I’m feeling lucky” search option in Google you can enter the following link under keyword.url: http://www.google.com/search?ie=UTF-8&sourceid=navclient&gfns=1&q=

Now Google will take you to the site most likely to match your query.  It’s not my preference but to each his own.  Either way, Bing is no longer the default search engine when you enter a topic in the address bar.

Turns out being a systems administrator/engineer (whatever you want to call us) is one of the best jobs in America.  This makes sense to me.  Not many people have the passion to be a sysadmin, much less a good one.  This is a real barrier to entry and it keeps the field of good candidates small.  Every company needs at least on IT guy/gal.  This will always keep salaries higher and provide job security to those with experience.  This article might get a few more people interested in the field but it’s much harder to break into now.  Even if the economy was firing on all cylinders and there were many job openings, IT as a field has matured in the last ten years.  You really have to know what you’re doing or be willing to learn.  This might mean an entry level job on the helpdesk or for an experienced admin it means constant learning.  The experienced sysadmin who gets lazy and stops learning ends up at the helpdesk.  While the helpdesk tech that never takes the time to learn higher level skills never moves up.  So if you’re a sysadmin, rejoice!  You have one of the best jobs in America.  I include myself in this, learn to appreciate the job and keep on learning new technologies.

Here is the article:

http://news.cnet.com/8301-17852_3-10468165-71.html?tag=rtcol;pop

Here is a video  that is supposedly used by Cisco internally to train staff on basic security.  Seems like a good bit of propaganda but from working in the corporate world I know that what happens in the video could happen anywhere.  Cisco security products are good but expensive.  Having a Cisco Security Agent on the servers would be cost prohibitive for many companies especially in this economy.  I know first hand that they work.

Click here to view the embedded video.

With SSH being the protocol of choice for connecting to systems and Windows not even installing a telnet client by default, its time to find a way to remotely manage routers, switches, etc.  A popular choice is the free Telnet/SSH client called Putty (http://www.chiark.greenend.org.uk/~sgtatham/putty/).  It runs on Windows and Unix systems but it’s really basic, especially on Microsoft systems.

On Unix and Linux systems  you can use the terminal and open up multiple tabs with several different remote connections.  That is a very handy feature that I have used many times.  Often there will be several open connections at once and with configurations being copied from one router to another.  So what is the solution for the SysAdmin on a Windows box?  The answer is Putty Connection Manager (http://puttycm.free.fr/cms/).  After downloading the putty.exe file and placing on the local hard drive, Putty Connection Manager can be used as a very useful front end for managing connections.  Just install Putty Connection Manager and let it know where the the Putty executable is.  It works great when working on Cisco labs created with GNS3 or managing a production network.  Once you create a database  of connections, it’s possible to save them and categorize them by protocol (SSH or Telnet), location, device name, etc.

This screen shot gives an idea of how it works.

Here is a interview with Kevin Wallace, the co-author of the CCNA Security Official Exam Certification Guide from Cisco Press.  It’s interesting to hear him speak of his experience, how he came to teach networking and eventually write a study guide.  Much can be learned from his experience.  I always find it inspiring to hear from these guys that have achieved so much in the Cisco networking world.    Kevin Wallace also states the goal of the CCNA Security certification and what topics to are covered by the exam.  He also describes the book and strategies for getting the certification.  By the way, the interviewer is Jeff Doyle, the writer of Routing TCP/IP Volumes I & II. He is practically a legend among Cisco devotees.

Click here to view the embedded video.

SSH is the protocol to use for remotely accessing Cisco network devices without exposing the password.   Telnet as everyone knows transmits the username and password  in clear text making it easy for anyone with a sniffer to gather that information and break into the network.  Telnet is usually enabled by default and some routers and switches don’t come with an IOS that supports SSH.  With companies having to comply with SOX and PCI requirements, the change to SSH access needs to be made.  For a Cisco router or switch to accept SSH connections the IOS has to support IPSec.  For Cisco firewalls like the ASA or PIX, this isn’t a problem but I was very suprised to see how few of the switches and routers I work with need an IOS upgrade to get this functionality.  In this post I run through setting up SSH access on a router.  This is done using GNS3 to simulate a Cisco 2691 router running an IOS with the Advanced Security feature set.  To begin I console into the router and enter global configuration mode:

Router#config t

Next I give the router a hostname and domain name.  This is necessary for SSH configuration.

Router(config)#hostname SDMLab-Main
SDMLab-Main(config)#ip domain-name sdmlab.local

The next step is to create the SSH encryption keys.  I run the following command to make sure the keys don’t already exist:

SDMLab-Main(config)#crypto key zeroize
% DSS Keys not found in configuration.

If there were some previuosly created RSA keys under a different hostname and domain name, they would have been erased.  This step is necessary to make sure the new information goes into the keys.

Generate the RSA keys with the following command:

SDMLab-Main(config)#crypto key generate rsa
The name for the keys will be: SDMLab-Main.sdmlab.local
Choose the size of the key modulus in the range of 360 to 2048 for your
General Purpose Keys. Choosing a key modulus greater than 512 may take
a few minutes.

How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys …[OK]

The default modulus is 512 as shown above but Cisco recommends at least 1024 bits.

This command also enables SSH on the router.  The following commands are optional but should be included in every configuration to improve security.  The first sets a timeout of 60 seconds for the SSH client to respond to the router.  This will keep the request from being open indefinitely:

SDMLab-Main(config)#ip ssh time-out 60

The next command limits the number of failed authentication attempts to three:

SDMLab-Main(config)#ip ssh authentication-retries 3

The final step is to set the transport input to the default vty lines to SSH only:

SDMLab-Main(config)#line vty 0 4
SDMLab-Main(config-line)#transport input ssh

If you are using the additional vty lines 5 15, you would do the same for those lines.  That is it.  So for PCI or SOX compliance or just general security and peace of mind, remove telnet and add SSH.  It may be necessary to upgrade the IOS image on the device but it is well worth doing.  Since I’m working on the CCNA Security certification, this is something that I need to know.