September 2014 - App_rpt-users

Fwd: COR signal getting confused
by Mike M 28 Sep '14

28 Sep '14

Resending since my initial post has been pending moderation for 2 days now and got no reply from the list owner email. I have modified an HT to bring out the receive LED signal and use it as the COR input to a DMK URI. It is a digital signal as viewed on a scope (i.e. very short slope in the transitions) This seems like it would work well and it does on strong signals. But on marginal signals where the LED may blink on and off quickly (like during picket fencing), it seems to confuse the URI (or the software) were it will start off good, but then a quick dropout of the COR signal will cause the software to no longer detect carrier, even though the signal on the COR input has been restored. Even if the input is solid high (or low in my case, I'm using usbinvert) it will not detect a carrier until there is another dropout of adequate time to "reset" it. I've tried putting a simple RC on the input but it didn't really help much. Seems the URI (or software) needs a significant minimum time between transitions to properly detect them, long enough that it would delay the carrier detection too much without a circuit more complex than an RC (i.e. something that would allow instant keyup, but delay the key down.) Linked is a scope image. https://lh5.googleusercontent.com/-CsJ9autUTAE/VCWK-uNJJpI/AAAAAAAAPSM/VsVv… Carrier was detected until this signal dropout event. Ch A is my RC filtered signal sent to the URI, Ch B is the signal out of the radio. Carrier was not detected after the 5th dropout even though the signal remained low. Anyone ever experience this and/or have ideas on how to fix it? Thanks. Mike KF7MBK

5 21

FW: Node numbers
by Bob 27 Sep '14

27 Sep '14

I thought I heard "node 26070 connected to node 28765" this morning about 0630, then again when disconnected a few moments later (the latter node being mine, and I had gotten out of CLI> last night, not recording the connection). When I attempted to look up node 26070 I found no nodes between the 2xxx series and 27000. Don't think I was dreaming... but what happened to the nodes in between? Where could this contact have originated? Thanks, Bob kk6ecm

1 0

Re: [App_rpt-users] Fwd: COR signal getting confused
by mike＠midnighteng.com 27 Sep '14

27 Sep '14

2 1

NEW Security Issues
by mike＠midnighteng.com 26 Sep '14

26 Sep '14

10 12

SSH Security Issues
by Ken W4NOC 26 Sep '14

26 Sep '14

DMZ will invite SSH attacks and about every other known hack. Within a few days or a week they will zero in on your pubic IP. I know someone that inadvertently left their machine behind a DMZ and the SSH attack traffic was incredible. Pick an odd port for your SSH. I won't mention the ports we use on this reflector. That is what we did on several nodes and that stopped the SSH attacks. All of the hacks know to go after port 22 and they have long wised up to 222. So, you may wish to avoid 222 as your SSH port. As already mentioned, pick a really good password. Ken W4NOC > > Message: 3 > Date: Thu, 25 Sep 2014 10:16:12 -0500 > From: Joe Bennett <aprs(a)ka3nam.com> > To: app_rpt-users(a)ohnosec.org > Subject: Re: [App_rpt-users] Security Issues > Message-ID: <542431BC.6010708(a)ka3nam.com> > Content-Type: text/plain; charset="windows-1252"; Format="flowed" > > I guess I'm worried about some of the 'security' comments being shared > here... First of all, if there is a service that is not used, it should > be disabled. Firewall or no firewall... It's somewhat like locking the > doors of your car, but leaving the convertible top down... Second, while > fail2ban would stop the potential 'hacker' from potentially reaching the > service or application itself, the incoming packet/ frame still has to > be processed to find out if it should be banned, dropped or allowed... > So a DoS or DDos attack is not squelched... > > A couple of things to recommend is that you use some sort of two-factor > authentication on your SSH users. Google auth is free and works well... > Find yourself a password generator and make strong passwords (like 32 > characters)... Disable any service that is not critical for the > operation of the intended use... I recommend all of these, and best of > all, ALL of this can be done for FREE! Installation and setup can > readily be found online... > > > -Joe > KA3NAM > > > On 9/25/2014 9:06 AM, Jon Byrne wrote: >> Hi Loren, >> >> I guess you are running your Allstar node on a Virtual server, I do >> the same and have found bouts of activity from Chinese IP Addresses >> and other countries. Mostly SIP attempts, but also SSH. >> >> If you do not use SIP then unload it and set your IPTABLES to block >> that port. >> >> As for the SSH, this is will probably not be a targeted attack more >> that they are targeting the block of IP Addresses yours is in. If you >> have specific IP Addresses you connect to then you can lock >> connections to those IP's, plus install the fail2ban as mentioned and >> ensure there is a secure password and you should be ok. You could also >> enable PORTKNOCKING http://en.wikipedia.org/wiki/Port_knocking >> >> As for the 3101702 connection, is that no an Echolink node? >> >> http://ns2.s13avahost.net/repeaters/echolink/node_status.php?node=CX4BBH#st… >> >> Hope that helps. >> >> Jon >> 2E0RFU >> >> >> >> ------------ >> Jon Byrne >> email(a)jonbyrne.com <mailto:email@jonbyrne.com> >> >> On 25 September 2014 08:43, Ken Boyle <ken(a)kc2idb.net >> <mailto:ken@kc2idb.net>> wrote: >> >> You could also install fail2ban. By default it allows three failed >> password attempts. Than temporarily bans the IP address. >> >> On Sep 24, 2014 10:43 PM, Doug Crompton <doug(a)crompton.com >> <mailto:doug@crompton.com>> wrote: >> > >> > I assume you have the linux box behind a router? If so why would >> you have sip even routed to your linux box if you are not using >> it? Routers make good firewalls. The only thing you should have >> routed is 4569 (udp) and 222 (tcp) neither have to be routed. >> 4569 would only need to be routed if you wanted to accept incoming >> connections. Outgoing would work fine without it. 222 would only >> be needed for administration. >> > >> > From what you are saying you obviously must not have a front-end >> (router firewall etc.) on your system . It sounds like you are >> just hanging on the raw Internet!! Some people go the easy route >> and put thhings in the DMZ of their routers which does open them >> up to the world. I went into an Allstar system this week to help >> with setup and I immediately knew it was on the DMZ. In the >> Asterisk client I was getting sip messages left and right. I >> unloaded the sip module and they went away. Not the right way to >> do it though as it should not be on dmz to begin with. Simply not >> having a sip.conf file does not prevent sip traffic!!! >> > >> > Assuming you have a router there should be no need to disable >> sip as it is never going to get to your box unless you port >> forward it there. It would be a good idea thought to not load the >> code for it if you are not using it. A noload=chan_sip.so in >> modules.conf would take care of that. >> > >> > Most good routers also allow you to specify specific or blocks >> of IP addresses to disallow. If there is a specific foreign block, >> say in China you can identify you could probably block it. >> > >> > So the bottom line is you could make your linux system tottally >> unavailable to the outside world by just not forwarding any ports. >> The downside is no one could connect to you (sometimes desirable) >> and you could not remotely administer your system. >> > >> > >> > 73 Doug >> > WA3DSP >> > http://www.crompton.com/hamradio >> > >> > >> > ________________________________ >> > Date: Wed, 24 Sep 2014 20:52:22 -0500 >> > From: lorentedford(a)gmail.com <mailto:lorentedford@gmail.com> >> > To: app_rpt-users(a)ohnosec.org <mailto:app_rpt-users@ohnosec.org> >> > Subject: [App_rpt-users] Security Issues >> > >> > Hey its Loren here again... >> > >> > Was curious what everyone found was the most substantial >> security risk with a Acid installation connected too two >> repeaters.. The sip.conf was deleted from the asterisks folder.. >> Noticed a strange node connection that didn?t match all stars >> normal node numbers 3101702 also found some thing with >> x.allstarlink.org <http://x.allstarlink.org> in it anybody know >> what this is?? Anyway my linode server has been under constant >> attack from China they keep wanting to ssh into the server we had >> to drastically beef up things on the server such as changing the >> whole root user issue and moving to another port number etc.. Any >> thoughts ideas did i just become victum of a Sip attack too >> besides 19 ddos attacks this week already and over a million >> failed ssh attempts into my person linode server... >> > >> > >> > Loren Tedford (KC9ZHV) >> > Email: lorentedford(a)gmail.com <mailto:lorentedford@gmail.com> >> > >> > http://www.lorentedford.com >> > http://www.Ltcraft.net >> > http://www.richlandcountycomputers.com >> > http://kc9zhv.lorentedford.com >> > >> > >> > _______________________________________________ App_rpt-users >> mailing list App_rpt-users(a)ohnosec.org >> <mailto:App_rpt-users@ohnosec.org> >> http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users To >> unsubscribe from this list please visit >> http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and >> scroll down to the bottom of the page. Enter your email address >> and press the "Unsubscribe or edit options button" You do not need >> a password to unsubscribe, you can do it via email confirmation. >> If you have trouble unsubscribing, please send a message to the >> list detailing the problem. >> _______________________________________________ >> App_rpt-users mailing list >> App_rpt-users(a)ohnosec.org <mailto:App_rpt-users@ohnosec.org> >> http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users >> >> To unsubscribe from this list please visit >> http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and >> scroll down to the bottom of the page. Enter your email address >> and press the "Unsubscribe or edit options button" >> You do not need a password to unsubscribe, you can do it via email >> confirmation. If you have trouble unsubscribing, please send a >> message to the list detailing the problem. >> >> >> >> >> _______________________________________________ >> App_rpt-users mailing list >> App_rpt-users(a)ohnosec.org >> http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users >> >> To unsubscribe from this list please visit >> http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down >> to the bottom of the page. Enter your email address and press the >> "Unsubscribe or edit options button" >> You do not need a password to unsubscribe, you can do it via email >> confirmation. If you have trouble unsubscribing, please send a message to >> the list detailing the problem. > >

2 1

Re: [App_rpt-users] NEW Security Issues
by Tim Sawyer 26 Sep '14

26 Sep '14

Agreed! And glad you are back on the air. -- Tim :wq On Sep 25, 2014, at 6:47 PM, Bob <kk6ecm(a)gmail.com> wrote: > Thanks again... worked as advertised. I’m still amazed at the genius behind this system. > > From: Tim Sawyer [mailto:tim.sawyer@mac.com] > Sent: Thursday, September 25, 2014 1:42 PM > To: Bob > Cc: Doug Crompton; app_rpt-users(a)ohnosec.org > Subject: Re: [App_rpt-users] NEW Security Issues > > This should fix your update… > http://docs.allstarlink.org/drupal/node/111 > -- > Tim > :wq > > On Sep 25, 2014, at 1:02 PM, Bob <kk6ecm(a)gmail.com> wrote: > > > I performed the yum update... killed asterisk... lots of errors, repeater down. looks like I should have just updated bash (sigh!) need to rebuild ACID unless there is a way to “undo” the yum update. (sigh!) >

1 0

RXDELAY in XIPAR
by Lu Vencl 26 Sep '14

26 Sep '14

I have a XIPAR node that needs a little support with pulseback removal. Never had to utilize this before, but when looking in URD.conf, I don't see the rxdelay= parameter like I do on ACID builds. I went ahead and inserted the command into the file, but there does not seem to be any action. Can someone confirm the parameter and placement? Here is my example: [usb] hdwtype=0 ; 0=std,1=dev eeprom=0 ; unless you have a cable w/eeprom duplex=0 ; 0=simplex, 1=duplex invertptt=0 ;minsigproc=0 ; minimal signal processing ;sendvoter=0 ; 0=default, no voter rssi, 1=enable voter rssi carrierfrom=usbinvert ; no,usb,usbinvert,dsp,vox ctcssfrom=no ; no,usb,dsp rxondelay=3000 ; Gets rid of the pulseback problem ;rxboost=1 ; rx input boost of 20dB rxboost=0 ; no boost rxdemod=flat ; no,speaker,flat txprelim=0 ; 1 = pre-emphasize and limit txmixa=voice ; no,voice,tone,composite txmixb=tone ; no,voice,tone,composite,auxvoice ;txctcssdefault=77.0 ;rxctcssfreqs=77.0; ;txctcssfreqs=77.0; txtoctype=notone; rxsquelchdelay=900 ; delayline in ms carrier squelch tail eliminator rxnoisefiltype=0 ; 0 for +/-5KHz, 2 for +/-2.5KHz systems Lu, KA4EPS

3 7

Re: [App_rpt-users] Subject: Changing the time on the BBB
by Mike Lussier 25 Sep '14

25 Sep '14

Thank you Tom, I will try that this evening -- *"We must reject the idea that every time a law is broken, society is guilty rather than the law breaker.It is time to restore the American precept that each individual is accountable for his actions." ~ Ronald Regan*

1 0

Re: [App_rpt-users] Security Issues
by Jon Byrne 25 Sep '14

25 Sep '14

Hi Loren, I guess you are running your Allstar node on a Virtual server, I do the same and have found bouts of activity from Chinese IP Addresses and other countries. Mostly SIP attempts, but also SSH. If you do not use SIP then unload it and set your IPTABLES to block that port. As for the SSH, this is will probably not be a targeted attack more that they are targeting the block of IP Addresses yours is in. If you have specific IP Addresses you connect to then you can lock connections to those IP's, plus install the fail2ban as mentioned and ensure there is a secure password and you should be ok. You could also enable PORTKNOCKING http://en.wikipedia.org/wiki/Port_knocking As for the 3101702 connection, is that no an Echolink node? http://ns2.s13avahost.net/repeaters/echolink/node_status.php?node=CX4BBH#st… Hope that helps. Jon 2E0RFU ------------ Jon Byrne email(a)jonbyrne.com On 25 September 2014 08:43, Ken Boyle <ken(a)kc2idb.net> wrote: > You could also install fail2ban. By default it allows three failed > password attempts. Than temporarily bans the IP address. > > On Sep 24, 2014 10:43 PM, Doug Crompton <doug(a)crompton.com> wrote: > > > > I assume you have the linux box behind a router? If so why would you > have sip even routed to your linux box if you are not using it? Routers > make good firewalls. The only thing you should have routed is 4569 (udp) > and 222 (tcp) neither have to be routed. 4569 would only need to be > routed if you wanted to accept incoming connections. Outgoing would work > fine without it. 222 would only be needed for administration. > > > > From what you are saying you obviously must not have a front-end (router > firewall etc.) on your system . It sounds like you are just hanging on the > raw Internet!! Some people go the easy route and put thhings in the DMZ of > their routers which does open them up to the world. I went into an Allstar > system this week to help with setup and I immediately knew it was on the > DMZ. In the Asterisk client I was getting sip messages left and right. I > unloaded the sip module and they went away. Not the right way to do it > though as it should not be on dmz to begin with. Simply not having a > sip.conf file does not prevent sip traffic!!! > > > > Assuming you have a router there should be no need to disable sip as it > is never going to get to your box unless you port forward it there. It > would be a good idea thought to not load the code for it if you are not > using it. A noload=chan_sip.so in modules.conf would take care of that. > > > > Most good routers also allow you to specify specific or blocks of IP > addresses to disallow. If there is a specific foreign block, say in China > you can identify you could probably block it. > > > > So the bottom line is you could make your linux system tottally > unavailable to the outside world by just not forwarding any ports. The > downside is no one could connect to you (sometimes desirable) and you could > not remotely administer your system. > > > > > > 73 Doug > > WA3DSP > > http://www.crompton.com/hamradio > > > > > > ________________________________ > > Date: Wed, 24 Sep 2014 20:52:22 -0500 > > From: lorentedford(a)gmail.com > > To: app_rpt-users(a)ohnosec.org > > Subject: [App_rpt-users] Security Issues > > > > Hey its Loren here again... > > > > Was curious what everyone found was the most substantial security risk > with a Acid installation connected too two repeaters.. The sip.conf was > deleted from the asterisks folder.. Noticed a strange node connection that > didn’t match all stars normal node numbers 3101702 also found some thing > with x.allstarlink.org in it anybody know what this is?? Anyway my linode > server has been under constant attack from China they keep wanting to ssh > into the server we had to drastically beef up things on the server such as > changing the whole root user issue and moving to another port number etc.. > Any thoughts ideas did i just become victum of a Sip attack too besides 19 > ddos attacks this week already and over a million failed ssh attempts into > my person linode server... > > > > > > Loren Tedford (KC9ZHV) > > Email: lorentedford(a)gmail.com > > > > http://www.lorentedford.com > > http://www.Ltcraft.net > > http://www.richlandcountycomputers.com > > http://kc9zhv.lorentedford.com > > > > > > _______________________________________________ App_rpt-users mailing > list App_rpt-users(a)ohnosec.org > http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe > from this list please visit > http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down > to the bottom of the page. Enter your email address and press the > "Unsubscribe or edit options button" You do not need a password to > unsubscribe, you can do it via email confirmation. If you have trouble > unsubscribing, please send a message to the list detailing the problem. > _______________________________________________ > App_rpt-users mailing list > App_rpt-users(a)ohnosec.org > http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users > > To unsubscribe from this list please visit > http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down > to the bottom of the page. Enter your email address and press the > "Unsubscribe or edit options button" > You do not need a password to unsubscribe, you can do it via email > confirmation. If you have trouble unsubscribing, please send a message to > the list detailing the problem. >

3 2

Re: [App_rpt-users] Security Issues
by Doug Crompton 25 Sep '14

25 Sep '14

Loren, You did not explain why the allstar server has to be on DMZ? If there are other ports you need forwarded echolink, irlp, etc. to that computer you can do that. It would be much better to take the time and get the proper ports working then to have it open to the world. DMZ is OK for testing but not continuous use. You can certainly add protection to the linux box in the form of firewall, PW protection etc. but the best place to do it is at the source in the router. Why make it complicated!! The BeagleBone Black Allstar does have a pre-configured firewall that can be implemented easily in a situation where you might need it. 73 Doug WA3DSP http://www.crompton.com/hamradio Date: Thu, 25 Sep 2014 08:58:58 -0500 Subject: Re: [App_rpt-users] Security Issues From: lorentedford(a)gmail.com To: doug(a)crompton.com Doug We are using a ARRIS/Motorola SBG6580 SURFboard DOCSIS 3.0 Cable Modem and WiFi-N Router. This unit is DMZ to our Allstar box for a few purposes one being that the node is also being utilized for more that just repeater functions.. 2nd we have changed our port for ssh for security purposes first off just in the event we get attacked with a bunch of ssh hackers like my Linode server was under the past 3 weeks... We keep getting Chinese Ips trying to hack access to our public servers... Anyway back to the point.. We didnt realize that the server over all is open so.. If this is the case isnt there a firewall built into the acid distro? if not would it be easier for us to throw like Debian like what i have on my other servers that I use and still be capable of running allstar setup with both repeaters.. Lots of questions here i know.. But if the software cant handle its own firewall functions I need to look at a more long term solutions. I at least figured it had Iptables in it unless i looked in the wrong place.. also in the Moduels.conf ; ; Asterisk configuration file ; ; Module Loader configuration file ; [modules] autoload=yes noload=chan_oss.so noload=chan_alsa.so noload=chan_phone.so noload=chan_sip.so [global] I really like remoting the system do it all the time from work using ssh via my phone when making adjustments to my stuff.. Thanks so much for getting back to me so quickly and let me know if there is anything i did wrong or any other suggestions based on this.. I am also using the Echolink.conf file for now it will one day be moved to the 2 meter repeater once we get our duplexer problem fixed been a rough couple of weeks from everything to unauthorized access attempts to damaged product during shipping gotta love UPS thanks again 73's Loren~ Loren Tedford (KC9ZHV) Email: lorentedford(a)gmail.com Email: lorentedford(a)live.comEmail: lorentedford(a)aol.comEmail: LorenCS(a)Ltcraft.netEmail: lorentedford(a)yahoo.comEmail: loren(a)lorentedford.com Email: loren(a)richlandcountycomputers.comPhone: 618-553-0806http://www.lorentedford.com http://www.Ltcraft.nethttp://www.richlandcountycomputers.comhttp://kc9zhv.l… On Wed, Sep 24, 2014 at 9:43 PM, Doug Crompton <doug(a)crompton.com> wrote: I assume you have the linux box behind a router? If so why would you have sip even routed to your linux box if you are not using it? Routers make good firewalls. The only thing you should have routed is 4569 (udp) and 222 (tcp) neither have to be routed. 4569 would only need to be routed if you wanted to accept incoming connections. Outgoing would work fine without it. 222 would only be needed for administration. >From what you are saying you obviously must not have a front-end (router firewall etc.) on your system . It sounds like you are just hanging on the raw Internet!! Some people go the easy route and put thhings in the DMZ of their routers which does open them up to the world. I went into an Allstar system this week to help with setup and I immediately knew it was on the DMZ. In the Asterisk client I was getting sip messages left and right. I unloaded the sip module and they went away. Not the right way to do it though as it should not be on dmz to begin with. Simply not having a sip.conf file does not prevent sip traffic!!! Assuming you have a router there should be no need to disable sip as it is never going to get to your box unless you port forward it there. It would be a good idea thought to not load the code for it if you are not using it. A noload=chan_sip.so in modules.conf would take care of that. Most good routers also allow you to specify specific or blocks of IP addresses to disallow. If there is a specific foreign block, say in China you can identify you could probably block it. So the bottom line is you could make your linux system tottally unavailable to the outside world by just not forwarding any ports. The downside is no one could connect to you (sometimes desirable) and you could not remotely administer your system. 73 Doug WA3DSP http://www.crompton.com/hamradio Date: Wed, 24 Sep 2014 20:52:22 -0500 From: lorentedford(a)gmail.com To: app_rpt-users(a)ohnosec.org Subject: [App_rpt-users] Security Issues Hey its Loren here again... Was curious what everyone found was the most substantial security risk with a Acid installation connected too two repeaters.. The sip.conf was deleted from the asterisks folder.. Noticed a strange node connection that didn’t match all stars normal node numbers 3101702 also found some thing with x.allstarlink.org in it anybody know what this is?? Anyway my linode server has been under constant attack from China they keep wanting to ssh into the server we had to drastically beef up things on the server such as changing the whole root user issue and moving to another port number etc.. Any thoughts ideas did i just become victum of a Sip attack too besides 19 ddos attacks this week already and over a million failed ssh attempts into my person linode server... Loren Tedford (KC9ZHV) Email: lorentedford(a)gmail.com http://www.lorentedford.com http://www.Ltcraft.nethttp://www.richlandcountycomputers.comhttp://kc9zhv.l… _______________________________________________ App_rpt-users mailing list App_rpt-users(a)ohnosec.org http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.

1 0