Re^4: How to implement a fourth protocol

[Moron]

Port knocking is discussed elsewhere in the thread - so you can see the problem with that.

I hope to be able to reduce the risks of "untested" by seeking as much tried and tested material as possible hence the reference to NetServer::Generic which I presume IS tested. I might be able to build the protocol over another for example, but I left that idea out to give people a chance to suggest it ;) e.g. Telnet. Of course I may be being naive about that idea - I'm not a networking guru, so I didn't want to put that idea in people's minds too early.

[Fletch]

. . . I'm not a networking guru . . .

Don't take this the wrong way, but: Stop now, because you don't know enough and you're probably going to screw something up (as if the mention of Telnet in the context of secure protocols didn't prove that already :). In all likelihood you probably don't even know what you don't know (if I may wax Rumsfeldian).

There's an entire very good book on the subject which one probably could summarize in one sentence: "Security is hard; doing security correctly, even for people that know what they're doing, is hard and even the experts often make mistakes.".

Now that I've at least hopefully dulled your hopes, let me say that I'm not saying 100% that you shouldn't do it (more like 99.8% that you shouldn't, lowered to a 99.4% once you've read Schneier and understand more of the implications of what you're proposing). But don't undertake this lightly and make sure you pay attention to prior art and reuse proven, tested components where possible.

And if the desire persists, repeatedly apply the Schneier book to the forehead until the urge passes. :)

[jgamble]

Re: telnet

There have been some password files snatched due to a bug in telnet. There are lots of links to look for with your favorite search engine. Here's one such report from my favorite web-magazine: http://www.theregister.co.uk/2007/03/01/solaris_security_worm/

.