From tyl@ssh.com Wed Apr 10 01:59:30 2013 Return-Path: X-Original-To: ops-area@ietfa.amsl.com Delivered-To: ops-area@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7810521F901B for ; Wed, 10 Apr 2013 01:59:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 2.796 X-Spam-Level: ** X-Spam-Status: No, score=2.796 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_HELO_EQ_D_D_D_D=1.597, FH_HOST_EQ_D_D_D_D=0.765, FM_DDDD_TIMES_2=1.999, RCVD_IN_SORBS_WEB=0.619, RDNS_DYNAMIC=0.1, SARE_MILLIONSOF=0.315] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9kESEOhPO26A for ; Wed, 10 Apr 2013 01:59:30 -0700 (PDT) Received: from ip-194-137-52-209.ssh.com (ip-194-137-52-209.ssh.com [194.137.52.209]) by ietfa.amsl.com (Postfix) with ESMTP id DA2A121F905A for ; Wed, 10 Apr 2013 01:59:29 -0700 (PDT) Received: from [192.168.43.158] (ma92836d0.tmodns.net [208.54.40.169]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by allman.clausal.com (Postfix) with ESMTPSA id ABDB3780190 for ; Sat, 6 Apr 2013 17:04:43 +0300 (EEST) From: Tatu Ylonen Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Date: Sat, 6 Apr 2013 16:54:18 +0300 Message-Id: To: ops-area@ietf.org Mime-Version: 1.0 (Apple Message framework v1283) X-Mailer: Apple Mail (2.1283) X-Mailman-Approved-At: Wed, 10 Apr 2013 02:10:54 -0700 Subject: [OPS-AREA] SSH Key Management for Automated access X-BeenThere: ops-area@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OPS Area e-mail list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 10 Apr 2013 08:59:30 -0000 A new draft "SSH Key Management for Automated Access - Current = Recommended Practice" has been published on managing SSH keys. The = topic has been discussed in SAAG in the last two IETF meetings, and we = also had a side meeting on the topic in Orlando. I'm sending this to = ops-area, because the topic relates to operations and management more = than technical details on security (though admittedly more to general = management of IT systems, especially unix/linux environments, than = management of routers or networks, but SSH is also very widely used for = managing routers and telecommunications networks). The draft can be found at = https://tools.ietf.org/html/draft-ylonen-sshkeybcp-01 The draft is relevant for anyone interested in SSH user key management = and more generally identity and access management for automated access = and/or based on the SSH protocol. We have found hundreds of thousands = to millions of SSH authorized keys from the IT environments of many = large enterprises (many times more than they have interactive users), = and bringing key-based access under control is very important. The = draft outlines the risks with unmanaged key-based access and presents a = process for remediating the situation in an existing environment and = implementing an ongoing process for monitoring and managing key-based = access (and other automated access). I am hoping the draft will evolve into a BCP (Best Current Practice) = standard on managing SSH user keys in organizations. The draft is = mostly about process and policy, not technical protocols, as SSH user = key management is really an identity and access management issue and the = problems involve policy, process, and auditing related to controlling = access to information systems in an organization, especially with = regards to automated machine-to-machine access. A mailing list sshmgmt@ietf.org has been created for discussion about = the draft (and other issues related to managing SSH). Please send = comments on the draft to the list. To subscribe (or unsubscribe), go = to: https://www.ietf.org/mailman/listinfo/sshmgmt Regards, Tatu Ylonen From johnsonhammond1@hushmail.com Sat Apr 27 16:38:36 2013 Return-Path: X-Original-To: ops-area@ietfa.amsl.com Delivered-To: ops-area@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4FAD721F98AF for ; Sat, 27 Apr 2013 16:38:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.475 X-Spam-Level: X-Spam-Status: No, score=-2.475 tagged_above=-999 required=5 tests=[AWL=0.124, BAYES_00=-2.599] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 44GUXbjFnow1 for ; Sat, 27 Apr 2013 16:38:36 -0700 (PDT) Received: from smtp10.hushmail.com (smtp10a.hushmail.com [65.39.178.239]) by ietfa.amsl.com (Postfix) with ESMTP id 7A6BC21F9720 for ; Sat, 27 Apr 2013 16:38:31 -0700 (PDT) Received: from smtp10.hushmail.com (smtp10a.hushmail.com [65.39.178.239]) by smtp10.hushmail.com (Postfix) with SMTP id A99BE1B532A for ; Sat, 27 Apr 2013 17:32:43 +0000 (UTC) X-hush-relay-time: 213 X-hush-relay-id: b1bd903faba185ee07e5a0ed3a1fde37 Received: from smtp.hushmail.com (w5.hushmail.com [65.39.178.80]) by smtp10.hushmail.com (Postfix) with ESMTP for ; Sat, 27 Apr 2013 17:32:43 +0000 (UTC) Received: by smtp.hushmail.com (Postfix, from userid 99) id 79916E6739; Sat, 27 Apr 2013 17:32:43 +0000 (UTC) MIME-Version: 1.0 Date: Sat, 27 Apr 2013 13:32:43 -0400 To: ops-area@ietf.org From: johnsonhammond1@hushmail.com Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="UTF-8" Message-Id: <20130427173243.79916E6739@smtp.hushmail.com> Subject: [OPS-AREA] Biggest Fake Conference in Computer Science X-BeenThere: ops-area@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OPS Area e-mail list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 27 Apr 2013 23:38:36 -0000 Biggest Fake Conference in Computer Science We are researchers from different parts of the world and conducted a study on the world’s biggest bogus computer science conference WORLDCOMP ( http://sites.google.com/site/worlddump1 ) organized by Prof. Hamid Arabnia from University of Georgia, USA. We submitted a fake paper to WORLDCOMP 2011 and again (the same paper with a modified title) to WORLDCOMP 2012. This paper had numerous fundamental mistakes. Sample statements from that paper include: (1). Binary logic is fuzzy logic and vice versa (2). Pascal developed fuzzy logic (3). Object oriented languages do not exhibit any polymorphism or inheritance (4). TCP and IP are synonyms and are part of OSI model (5). Distributed systems deal with only one computer (6). Laptop is an example for a super computer (7). Operating system is an example for computer hardware Also, our paper did not express any conceptual meaning. However, it was accepted both the times without any modifications (and without any reviews) and we were invited to submit the final paper and a payment of $500+ fee to present the paper. We decided to use the fee for better purposes than making Prof. Hamid Arabnia (Chairman of WORLDCOMP) rich. After that, we received few reminders from WORLDCOMP to pay the fee but we never responded. We MUST say that you should look at the above website if you have any thoughts to submit a paper to WORLDCOMP. DBLP and other indexing agencies have stopped indexing WORLDCOMP’s proceedings since 2011 due to its fakeness. See http://www.informatik.uni-trier.de/~ley/db/conf/icai/index.html for of one of the conferences of WORLDCOMP and notice that there is no listing after 2010. See Section 2 of http://sites.google.com/site/dumpconf for comments from well-known researchers about WORLDCOMP. The status of your WORLDCOMP papers can be changed from scientific to other (i.e., junk or non-technical) at any time. Better not to have a paper than having it in WORLDCOMP and spoil the resume and peace of mind forever! Our study revealed that WORLDCOMP is a money making business, using University of Georgia mask, for Prof. Hamid Arabnia. He is throwing out a small chunk of that money (around 20 dollars per paper published in WORLDCOMP’s proceedings) to his puppet (Mr. Ashu Solo or A.M.G. Solo) who publicizes WORLDCOMP and also defends it at various forums, using fake/anonymous names. The puppet uses fake names and defames other conferences to divert traffic to WORLDCOMP. He also makes anonymous phone calls and tries to threaten the critiques of WORLDCOMP (See Item 7 of Section 5 of above website). That is, the puppet does all his best to get a maximum number of papers published at WORLDCOMP to get more money into his (and Prof. Hamid Arabnia’s) pockets. Monte Carlo Resort (the venue of WORLDCOMP for more than 10 years, until 2012) has refused to provide the venue for WORLDCOMP’13 because of the fears of their image being tarnished due to WORLDCOMP’s fraudulent activities. That is why WORLDCOMP’13 is taking place at a different resort. WORLDCOMP will not be held after 2013. The draft paper submission deadline is over but still there are no committee members, no reviewers, and there is no conference Chairman. The only contact details available on WORLDCOMP’s website is just an email address! Let us make a direct request to Prof. Hamid arabnia: publish all reviews for all the papers (after blocking identifiable details) since 2000 conference. Reveal the names and affiliations of all the reviewers (for each year) and how many papers each reviewer had reviewed on average. We also request him to look at the Open Challenge (Section 6) at https://sites.google.com/site/moneycomp1 Sorry for posting to multiple lists. Spreading the word is the only way to stop this bogus conference. Please forward this message to other mailing lists and people. We are shocked with Prof. Hamid Arabnia and his puppet’s activities http://worldcomp-fake-bogus.blogspot.com Search Google using the keyword worldcomp fake for additional links.