<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">I can configure my system to accept a connection from a host with a dynamic address since I can limit the port to the range of possible addresses instead of opening it to the world. I would probably want to configure the circuit to use a routing initialization password, however. Let me know if interested.<div class=""><br class=""></div><div class="">Mark Berryman<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Apr 4, 2019, at 6:03 PM, Paul Koning <<a href="mailto:paulkoning@comcast.net" class="">paulkoning@comcast.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">On Apr 4, 2019, at 6:32 PM, Johnny Billquist <<a href="mailto:bqt@softjar.se" class="">bqt@softjar.se</a>> wrote:<br class=""><br class="">On 2019-04-04 15:28, Paul Koning wrote:<br class=""><blockquote type="cite" class=""><blockquote type="cite" class="">On Apr 4, 2019, at 7:53 AM, Supratim Sanyal <<a href="mailto:supratim@riseup.net" class="">supratim@riseup.net</a>> wrote:<br class=""><br class="">On 4/4/19 6:12 AM, Keith Halewood wrote:<br class=""><blockquote type="cite" class="">Hi,<br class="">I'm pretty sure that a TCP listen doesn't care who connects to it on VAX Multinet. UDP is a different matter.<br class="">For example, there's a listener device set up with a 1.1.1.1 address on DUNE here. PIVAX0 connects to it from a completely different address. I use access controls on the router to restrict just who is allowed to connect to it.<br class="">If you want I can set up another incoming line/circuit and you can connect to it. I'm in area 29 FYI.<br class=""></blockquote><br class="">I have listeners waiting on 0.0.0.0. Yes, MULTINET does not seem to care what address connections come in from.<br class=""></blockquote>Does that mean anyone can connect to HECnet without any authentication? Or is DECnet node init authentication used?<br class="">"Security by obscurity" only goes so far. Is it good enough for HECnet?<br class=""></blockquote><br class="">So far that's mostly what we have, yes.<br class="">I have from time to time considered maybe adding a password on the link, as DECnet do support that.<br class=""><br class="">But so far, there has never been a single instance of someone actually trying to connect some unknown node with DECnet on any link of mine. But it is most likely just because pretty much any remote script-kid just have no clue that DECnet even exists, what to do with it, or anything else.<br class=""><br class="">Also, the worst I think anyone could do would just be disrupting DECnet. But maybe someone else can think of anything else potentially interesting someone could do by hijacking a circuit.<br class=""></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">The worst you could do is what was done with BGP in the past: create a route diversion that sends a pile of the traffic to a rogue router. Most of that traffic would not be all that interesting, I suppose.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-decoration: none;" class="">My biggest issue with those link passwords in RSX is that I think I can only have one password, and it will be applied to all links. And I also think that maybe I had to turn it on on all links if I turn it on on any.<br class=""><br class="">But if people are willing to experiment some, we could test enabling it.<br class=""></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">For RSTS, the password to use is a node attribute, so you specify what password to send to and expect from a given claimed neighbor node. (RSTS doesn't support Multinet or GRE, though -- but it does support DDCMP which is a fine way to offer point to point links over TCP.) And of course for routers we build we can make the flexibility whatever we care to code.</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span class="Apple-tab-span" style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: pre; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"> </span><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">paul</span></div></blockquote></div><br class=""></div></body></html>