Re: SSH on the router - was( IT security people sleep well)

[Alex Bligh <alex () alex org uk>]

--On 07 June 2004 17:50 -0400 Valdis.Kletnieks () vt edu wrote:

> Well, either you have one per POP (and that, as Randy Bush points out, can
> be quite the headache in itself), which is still a single point of
> failure for that POP, or you're advocating that the routers be reachable
> from the magic box at *any* POP (which is right back into the "large
> number of machines" issue....)

Well the way we did it, all routers were accessible from 2 (large) POPs,
two being in the NOC, and one being elsewhere (now you mention it, it was a
datacenter & POP combined). So the "large" number of machines was 3. I am
sure we could have scaled this to (say) 4 without substantial difficulty.

I agree one in every POP would be both painful and pointless. But that
wasn't what I meant.

Alex