<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
I don't know if classes on network security have been done at this
level before, but since it's an advanced topic, I'd suggest that
attendees for packet tracing (Wireshark) first have a working knowledge
of network protocols. Perhaps they could go hand-in-hand in the same
class, but not for the faint at heart! You may have some difficulties
trying to cram everything into a single 6-8 hr session!<br>
<br>
The SANS Institute (<a href="www.sans.org">http://www.sans.org</a>) is
a valuable resource and, to the best of my knowledge, is the #1 network
security training organization. I believe they provide online and
in-person training sessions throughout the country, occasionally even
in Columbus or Dayton. Might be worth a look, for those interested.<br>
<br>
Chad<br>
<pre class="moz-signature" cols="72">-----------------------
Chad Neeper
Senior Systems Engineer
Level 9 Networks
740-548-8070 (voice)
866-214-6607 (fax)
-- Full LAN/WAN consulting services --
-- Specialized in libraries and schools --</pre>
<br>
<br>
Mary Leffler wrote:
<blockquote cite="mid:000a01c9cf33$36ef1650$a4cd42f0$@org" type="cite">
<pre wrap="">I think a workshop is a great idea! I will start looking into having a
workshop on this topic. If any of you are interested in this topic, please
reply off-list and I will contact you when we have a workshop ready to
launch.
Mary Leffler
------------------------------------
Southeast Regional Library System (SERLS)
Executive Director
<a class="moz-txt-link-abbreviated" href="mailto:dirserls@oplin.org">dirserls@oplin.org</a>
252 W. 13th St.
Wellston, OH 45692
tel: (740) 384-2103 x5
fax: (740) 384-2106
<a class="moz-txt-link-freetext" href="http://www.serls.org/">http://www.serls.org/</a>
------------------------------------
-----Original Message-----
From: <a class="moz-txt-link-abbreviated" href="mailto:oplintech-bounces@oplin.org">oplintech-bounces@oplin.org</a> [<a class="moz-txt-link-freetext" href="mailto:oplintech-bounces@oplin.org">mailto:oplintech-bounces@oplin.org</a>] On
Behalf Of Phil Shirley
Sent: Thursday, May 07, 2009 9:23 AM
To: <a class="moz-txt-link-abbreviated" href="mailto:oplintech@oplin.org">oplintech@oplin.org</a>
Subject: Re: [OPLINTECH] Another virus related spam issue, but a new
solution
Using Wireshark to find a problem computer (and for other purposes)
might be a good tech workshop for regionals and other organizations to
present (I don't think it's already been done around here but I could be
wrong).
Phil
Karl Jendretzky wrote:
</pre>
<blockquote type="cite">
<pre wrap="">As far as I know the library from two weeks ago still hasn't found the
infected machine. I just see it poking at me every couple days, checking
to see if I'm willing to play again.
The machine from today is the only one on the offending ip address, but
the box isn't managed by the site, so we won't know whats actually on
there until the outside management gets back to us.
Once I know specifically whats hitting them, I'll try to give you
something special to look for. If you're already up to date on your
patches/definitions, and you've got measures in place to either restrict
user actions, or wipe out user changes on a regular basis, then the only
thing I would recommend is that you have some plan for finding a
misbehaving machine on the network. Even if its just having a spanning
port setup and making yourself familiar with a app like Wireshark, not
having to scramble to learn the stuff when something is on fire will
save you some frustration. Even unsinkable ships need lifeboats. :)
Thanks,
Karl Jendretzky
Technology Project Manager
Ohio Public Library Information Network
<a class="moz-txt-link-abbreviated" href="mailto:jendreka@oplin.org">jendreka@oplin.org</a>
(614) 728-1515
Chad Neeper wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Aside from perhaps selective egress blocking at the network perimeter
firewall and keeping current on the virus definitions, is there
anything else you'd like us to be doing at individual libraries to
mitigate these problems?
Chad
-----------------------
Chad Neeper
Senior Systems Engineer
Level 9 Networks
740-548-8070 (voice)
866-214-6607 (fax)
-- Full LAN/WAN consulting services --
-- Specialized in libraries and schools --
Karl Jendretzky wrote:
</pre>
<blockquote type="cite">
<pre wrap="">All,
I was greeted this morning with yet another infected library
machine using the OPLIN mail server as a spam cannon. I've already
spoken to the library, and if any details come up that could be
useful to the group, we'll let you know.
With increased virus activity out in the libraries, I'm trying to
find the best way to lock down our services, while still providing
access for library staff. At this point I think the best way for me
to prevent exploits like this, while still allowing libraries to use
our server as a relay for their ILS notices, is by allowing relaying
based partly off of the "from" address.
If you are using the OPLIN mail server as a relay, and the mail is
coming from an email address that isn't @oplin.org, I need you to
shoot either myself, or OPLIN support an email letting us know what
address, or at least domain the emails are coming from. My thought is
that going this direction, I can stop the phishing emails, while not
requiring anyone in the network to reconfigure their ILS setup.
If you have any questions, feel free to contact me.
</pre>
</blockquote>
<pre wrap="">------------------------------------------------------------------------
_______________________________________________
OPLINTECH mailing list
<a class="moz-txt-link-abbreviated" href="mailto:OPLINTECH@oplin.org">OPLINTECH@oplin.org</a>
<a class="moz-txt-link-freetext" href="http://mail.oplin.org/mailman/listinfo/oplintech">http://mail.oplin.org/mailman/listinfo/oplintech</a>
Search: <a class="moz-txt-link-freetext" href="http://oplin.org/techsearch">http://oplin.org/techsearch</a>
</pre>
</blockquote>
<pre wrap="">_______________________________________________
OPLINTECH mailing list
<a class="moz-txt-link-abbreviated" href="mailto:OPLINTECH@oplin.org">OPLINTECH@oplin.org</a>
<a class="moz-txt-link-freetext" href="http://mail.oplin.org/mailman/listinfo/oplintech">http://mail.oplin.org/mailman/listinfo/oplintech</a>
Search: <a class="moz-txt-link-freetext" href="http://oplin.org/techsearch">http://oplin.org/techsearch</a>
</pre>
</blockquote>
<pre wrap=""><!---->
</pre>
</blockquote>
</body>
</html>