June 2017 - App_rpt-users - lists.keekles.org

To All DIAL Users from AllStarLink Admin Team
by Bryan Fields 08 Jun '17

08 Jun '17

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 All DIAL users, The AllStarLink administrative team has identified a vulnerability in DIAL. These details are available in a separate notice. In part to mitigate this, we have identified a way to fix this via the well known user account. We propose to to script and execute code which should fix this issue on any nodes connected to the ASL network. What will this script do? This script will disable all the "pi" and "debian" users, killall process running by these users and then logout of the node. Once this is complete ASL will no longer have remote access to the node. What if I don't want this done to my node? Change the login or restrict login via ssh for the pi and debian users. You may also email the admin team with your node numbers to opt-out. Why is the admin team taking these actions? Why not allow people to fix their own nodes? The admin team believes most users of DIAL are generally radio users first, and Linux administrators second. Many may not know what issues this can cause on their system and the admin team believes this will mitigate any problems end users may have mitigating this on their own. Any user is free to opt-out and respond to this issue in their own way if they so choose. What if I'm running ACID? ACID is unsupported and quite outdated. We encourage all ACID users to migrate to DIAL. What if I'm using another distribution or have compiled AllStar from source? It's likely you're unaffected and have the skills to maintain your node securely on your own. What if my box is compromised? If your node is compromised we suggest a complete re-install. From the exploits we have seen in the wild, none have root or done anything other than scanning/bitcoin mining. We have see the attackers download the asterisk config files so it would be wise to change any passwords you may have. We suspect this is looking to exploit SIP call termination for profit. What if I have questions not answered here? Please post them to the AllStarLink mailing list. Note: you must be subscribed to post. http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users When will this action take place? The ASL admin team is expecting to do this at 0000 UTC June 10, 2017 Status of this Notice This notice provides information for the community. Distribution of this notice is unlimited. Copyright Copyright (C) AllStarLink, Inc (2017). All Rights Reserved. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJZOZukAAoJEGE5oGFSxpFAeLEQALpM6xXUBKYPJkg0A2hBvliO XaacHft445/UHDku6U+1+U3SBXaqePmkjLZHrvW9leXoNxX3uhrqudj/VihYl8t2 O3o+jl056SeQWwwEP10u0dFgUgqcSPpOjl2z8DrKQOJgTp7M/NxCBIJZolaQLih2 AtF/FQWD0BVhml5ngdzq6NwuvSqL/wsf+WgwxKCTjh8zZA6VnRhCgg2+khxD2rgp TWWnQ6uyLrUijVINyS2U0+TCWobQ+NDkAm6acRXpgPzn63ufvfSrqfEWWEeOlGkq qxjkrrTg5jZwKvUBruNtqnOt+3TZa4r1vin51VtgRll0pRfUWl6cHPBUHoziM4it FlJUGLJg1fnqBWOiYi6R58QddK5sffaDO7UTmTJKb6TOGsS86iF4nu2p2TgPJL8z TxQkaLx7+/3VhJ+6ZlV1T82Ma9bzb+P3WLasRiOPYiazXoQXaKSuaLJ9u/yZKp2r P03O2KKIZ9pw1a5KikkJvJoCzfOkOTesvYxJPdt5iRffMW9S6wS+M0ixCCjrZF+V ylCcUjs2lu+dh5PkG7rzY42xKYZLL97YmYEzE8OzmX0m6tK4yN6cgjlFL7/fyCpD wZN+3d0Nc/PZzRyHE2c71s48yGfT54ZxwEVT319BIyeNd03AMSdrcohod9OHmP2W snoffMWy6An+zHv8uY0u =K4be -----END PGP SIGNATURE-----

2 1

What is the "debian" user in the DIAL distro?
by Steve Passmore 08 Jun '17

08 Jun '17

Does anyone know what the user "debian" is used for in the DIAL distro? I had a node compromised where it appears they guessed the password for the user debian. I note on other un-compromised nodes there is a preexisting user "debian" with a password set. The attacker installed a bitcoin miner, storing their files under /var/tmp/.new chrootkit reported it as possibly being the Mumblehard backdoor. I'd suggest anyone with a DIAL node, at the very least, remove the user "debian"'s password. passwd -d debian Steve, k6kya

6 11

Anyone doing HF remote base using hamlib?
by Barry Buelow 08 Jun '17

08 Jun '17

I'd be interested in asking some questions off-list. Thanks Barry w0iy

2 1

RTCM Simulcast and 9.6 MHz Phase locking
by Joe Moskalski 07 Jun '17

07 Jun '17

I wanted to throw this email out to the group for all those who want to simulcast with the RTCM. For those who don't know, in order to make the RTCM suitable for simulcast you must have a more accurate 9.6 MHz clock for the RTCM in order to ensure the audio sounds acceptable in the overlap areas. I did this a few months ago using 9.6 MHz OCXO's. This worked reasonably well. Not as well as I would have liked but the system was very usable, but of course I wanted it to be better. Since the PCGM (Programmable Clock Generation Module) is no longer available, I decided to roll my own as some say. I created a PLL circuit that can accept a 10 MHz, 1 MHz or 100 KHz reference input and produce a phase locked 9.6 MHz out for the RTCM. I have been testing this over the past few days and it has made an great improvement in the audio quality in the overlap. The quality of the audio in the overlap areas sounds very, very good, it's very similar to what I expect to hear in commercial simulcast systems. My circuit is heavily based off of an old Motorola MSF5000 HSO PLL circuit that I was able to adapt and modify to my needs. There are other uses for this circuit that make it attractive for simulcasting but I wont get into them here. I am will to share my schematic and bill of materials (digikey) with anyone. Please send me an email and I will be willing to share all of my information on the project. <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> Virus-free. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campai…> <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

8 23

TX Timeout
by Bernie McIntosh 07 Jun '17

07 Jun '17

I am using a smartphone to access my node so that I can listen to the radio channel, and when required, transmit on the channel. All is well, but I want to implement a timeout so that if I put the node into transmit mode from my smartphone and do not return it to receive, the transmitter will turn off, after say, 30 seconds. I am using the default IAX configuration for the smartphone. The tx_timeout parameter makes the transmitter turn off at the required time as expected. But when a radio user subsequently transmits on the channel and then goes back to receive, the node keys the transmitter again and continues to send audio from the smartphone on the channel. It is as if the smartphone PTT is still "closed" and so the timeout timer resets itself and waits another 30 seconds before switching off again. So I guess I need a way to disconnect the smartphone after x seconds of PTT from it ? Google is failing me on this one and I'd be grateful for any help. Thanks Bernie GM4WZG > -----Original Message----- > From: app_rpt-users-bounces(a)ohnosec.org [mailto:app_rpt-users- > bounces(a)ohnosec.org] On Behalf Of app_rpt-users-request(a)ohnosec.org > Sent: 03 December 2016 17:00 > To: app_rpt-users(a)ohnosec.org > Subject: App_rpt-users Digest, Vol 94, Issue 3 > > Send App_rpt-users mailing list submissions to > app_rpt-users(a)ohnosec.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users > or, via email, send a message with subject or body 'help' to > app_rpt-users-request(a)ohnosec.org > > You can reach the person managing the list at > app_rpt-users-owner(a)ohnosec.org > > When replying, please edit your Subject line so it is more specific than "Re: > Contents of App_rpt-users digest..." > > > Today's Topics: > > 1. Re: Podcast Server (Danny) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 2 Dec 2016 19:03:17 +0200 > From: Danny <mynixmail(a)gmail.com> > To: app_rpt-users(a)ohnosec.org > Subject: Re: [App_rpt-users] Podcast Server > Message-ID: <20161202170316.GA3444(a)fever.havannah.local> > Content-Type: text/plain; charset=us-ascii > > >On Dec 02 16, Eric Guth : > > > > Dear Danny, > > > > This is very clever. Thanks for including my podcast, QSO Today, in your > Allstar jukebox of podcasts. > > > > 73, > > > > Eric Guth > > 4Z1UG > > Allstar: 28422 > > QSO Today > > > > Hi Eric, > > It is only a pleasure. I have been listening to your podcast for so long and I > thought it would be befitting to repay you and all the others that have > podcasts in such a manner. > > Would you believe me if I told you the same evening I advertised "Play > Something" on this list we experienced heavy thunderstorms which forced > me to shut down the whole system ... lol ... > > But at least I got to test my skills at unplugging everything within a flash. I > think I broke my own record ... less than 4 minutes to pull the plug and > disconnect all feedlines ... > > However, on a slightly different note ... please guys, if you register with a > mistyped callsign contact me immediately in order for me to rectify it. Too > many hams blamed the system, but when I checked the database and their > original registration e-mail, they mistyped/misspelled their own callsigns > and/or e-mail address. > > Some of you asked me to give a little more detail, so here goes. > > "Play Something" does exactly what it's name says, it "Plays Something". You > don't know what you are going to get. But I guarantee you will not hear the > same podcast played more than once in 3 months or more (except for ARRL > news). The algorithm I have developed will prevent this from happening. > Podcasts are not randomly selected, but rather in a fashion where you will be > able to follow a certain podcast provider from his first podcast to his last > podcast in a sequential order. Also, you will not hear the same podcaster > twice in a row. > > "Play Something" observes time-outs. It transmits for 150 seconds, then > unkeys for 10 seconds. I think 10 seconds should be enough for anyone to > squeeze through a DTMF code ... ;) ... > > Oh yes ... one important thing ... YOU NEED TO CONNECT TO MY NODE to > listen ... > people send me mails telling me "Play Something" is not working but they > never even connected ... ;) ... > > "Play Something" is for EVERYONE and ANYONE for FREE (for as long as > possible). > I have no problem if you park your node permanently at my node whilst you > are just listening ... that's just fine by me ... > > I am open to suggestions ... and if you have a podcaster you would like to add > you are more than welcome to make a suggestion > > Thank you > > Danny > ZS6XOX > 73's > > AllStar node 44081 > EchoLink ZS6XOX-R > > zs6xox(a)gmail.com > > (p.s: Thank you for listening ...) > > > > ------------------------------ > > _______________________________________________ > App_rpt-users mailing list > App_rpt-users(a)ohnosec.org > http://ohnosec.org/cgi-bin/mailman/listinfo/app_rpt-users > > > End of App_rpt-users Digest, Vol 94, Issue 3 > ********************************************

1 0

Re: [App_rpt-users] /bin/cp: /tmp/rpt_extnodes-temp and /tmp/rpt_extnodes-temp are the same file
by izzy_y2k＠yahoo.com 06 Jun '17

06 Jun '17

Hello Steve Thanks for the quick reply I am using Dial version 325 Thanks John K1IF --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

1 0

A little confusion regarding the X86 Downloads
by Jeremy Utley 06 Jun '17

06 Jun '17

Hey all! As I reinstall my hub node after it got compromised this morning, I find myself a little confused at just which download option I should use for an amd64 architecture machine. The site seems to recommend DIAL RC1, but RC *usually* means Release Candidate - meaning it's not quite ready for prime time, but getting close to release. I would not usually consider a "RC" release to be the recommended release under any circumstances. The other problem comes from looking at the file modification dates on the dvswitch.org server: The RC1 file - amd64-i386-DIAL-RC1.tar.gz - is dated Nov 15, 2016 The other file - dial-allstar-netinstall.iso - is dated Jan 22, 2017 So it *seems* that the RC1 is older than the other one, while still being the recommended install - but the name would not tend to agree, as the RC should be a candidate for release as a newer version, so should be newer than the existing "stable" version - and the stable version should be the recommended download - or at least this is how it would work in most open source projects. What am I missing? And once installed, is there any danger in using the Debian "apt-get update" command to update the packages for the underlying Linux OS to their newest versions? Thanks, Jeremy, NQ0M

2 1

/bin/cp: /tmp/rpt_extnodes-temp and /tmp/rpt_extnodes-temp are the same file
by izzy_y2k＠yahoo.com 06 Jun '17

06 Jun '17

Keep seeing this error pop up. I assume it is from an update node list generated by allstar but not sure how or where to fix? Thank you John K1if --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

2 1

Re: [App_rpt-users] What is the "debian" user in the DIAL distro?
by Thor Wiegman 06 Jun '17

06 Jun '17

You're not the first person I'm aware of to have this type of problem. AllStarLink nodes are an easy target to become bitcoin miners and members of botnets. Most people installing these nodes don't know the basics of Linux system administration and the defaults aren't even remotely secure. Not only should that "debian" user be deleted, the appropriate changes to SSH need to be made to prevent the superuser "root" from logging in remotely. That is one of the first things that everyone needs to be change after installation of a DIAL system, not sure why it's even allowed by default. I've noticed that a lot of node ops tend to login as root and execute commands as the root user. Crazy! It's an extremely dangerous and insecure thing to do, but people new to Linux don't know any better. It would be nice if the default installation were setup in such a way that prevented or discouraged login by the superuser. It's odd that sudo doesn't appear to be installed by default. Would be very nice if the installation script prompted for the creation of a user account with proper permissions in much the same way as standard distros do. Not perfect, but it's a start. Most of these systems are being run by people who are new to Linux. They don't know about Linux/Unix system administration and nobody is "elmering" them in it. The result is people taking dangerous shortcuts and developing bad habits. The community would benefit from some guidance in system administration as well as from some improved defaults in the distro. On 05/10/2017 12:38 PM, app_rpt-users-request(a)lists.allstarlink.org wrote: > What is the "debian" user in the DIAL distro?

6 8

Re: [App_rpt-users] App_rpt-users Digest, Vol 100, Issue 6
by Steve Wright 05 Jun '17

05 Jun '17

On Tue, Jun 6, 2017 at 9:00 AM, Bob Pyke <k6ecm1(a)gmail.com> wrote: > > > http://docs.allstarlink.org/drupal/ > > Thanks Bob, others. Don't quite know why I didn't find that.. Overall, the docs are pretty frustrating and I don't have anywhere near the skills to rewrite them. Steve

3 2