Thanks Steve, I removed the user on the affected machine, Should I expect any problems? Steve, k6kya On Wed, May 10, 2017 at 12:19 PM, Steve Zingman <szingman@msgstor.com> wrote:

That is a leftover "mandated" from above. It will be disabled in the RC.

Steve N4IRS

On 5/10/2017 3:15 PM, Steve Passmore wrote:

Does anyone know what the user "debian" is used for in the DIAL distro? I had a node compromised where it appears they guessed the password for the user debian. I note on other un-compromised nodes there is a preexisting user "debian" with a password set. The attacker installed a bitcoin miner, storing their files under /var/tmp/.new chrootkit reported it as possibly being the Mumblehard backdoor.

I'd suggest anyone with a DIAL node, at the very least, remove the user "debian"'s password.

passwd -d debian

Steve, k6kya

_______________________________________________ App_rpt-users mailing listApp_rpt-users@lists.allstarlink.orghttp://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users

To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.

_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users

To unsubscribe from this list please visit http://lists.allstarlink.org/ cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.

I have updated the amd64-i386 installer and the RPi image to disable the default accounts. Note BOTH these are RC1 changes only. After we get back from the Hamvention, I'll make them full release. 73, Steve N4IRS On 5/10/2017 3:38 PM, Steve Zingman wrote:

No, It was never used. Jim never explained WHY he wanted it. I'm fixing the installer now.

Steve

On 5/10/2017 3:36 PM, Steve Passmore wrote:

...

Thanks Steve,

I removed the user on the affected machine, Should I expect any problems?

Steve, k6kya

On Wed, May 10, 2017 at 12:19 PM, Steve Zingman <szingman@msgstor.com <mailto:szingman@msgstor.com>> wrote:

That is a leftover "mandated" from above. It will be disabled in the RC.

Steve N4IRS

On 5/10/2017 3:15 PM, Steve Passmore wrote:

...

Does anyone know what the user "debian" is used for in the DIAL distro? I had a node compromised where it appears they guessed the password for the user debian. I note on other un-compromised nodes there is a preexisting user "debian" with a password set. The attacker installed a bitcoin miner, storing their files under /var/tmp/.new chrootkit reported it as possibly being the Mumblehard backdoor.

I'd suggest anyone with a DIAL node, at the very least, remove the user "debian"'s password.

passwd -d debian

Steve, k6kya

_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org <mailto:App_rpt-users@lists.allstarlink.org> http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users <http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users>

To unsubscribe from this list please visithttp://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users <http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users> and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.

_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org <mailto:App_rpt-users@lists.allstarlink.org> http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users <http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users> To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users <http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users> and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.

_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users

To unsubscribe from this list please visithttp://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.

Based on tests that the security research arm of my company has run (well-known IT company that's been around for over a century...), the elapsed time that a system exposed to the network is discovered, probed, and if well-known vulnerable ports are detailed (and the scum or nation states who do this keep records), then attempted to be pwned is somewhere between a minute to a half hour. Just for giggles, i spun up a pi with a sip server enabled connected to a second port on my router and started a tail -f on the messages file and grepped for the sip daemon. routed the sip port on my external router to the pi, a sat back. (there was no route from the pi to my internal network) 3 minutes till the first probe. 15 till the attempted pwning. SIP was the only inbound port opened. I just watched...and went on for an hour (no, they didn't take over the system, only ate up bandwidth, of which I am pretty ok with being on FTTH). It's all automated. don't even need human intervention for the probe, just to select the attack vectors when the automated system pops a live port selection. Default SSH is NO guarantee. Allowing root access from an interactive login from the net port deserves to be punished. Bogus user passwords that are guessable should be cause for your isp to turn off your connection. Moving to a different port is just attempted security through obscurity. Open ports from the outside inbound that allow anyone on the network to connect will be probed and attempts (DoS, null sled, buffer overruns, etc) to subvert your system as a c&c node, bitcoin miner, email spam relay, porn repository, or whathaveyou is the goal. After doing this since 1988 or so, it's only the frequency that it happens that's changing, not that it's happening. fail2ban is a good stopgap measure for ports that you positively HAVE to have exposed. router firewall enabled and locked down? good. iptables set up properly? passwords NOT based on dictionary words or used for your other online activities? yeah, it's a pain. the alternative is your system being taken over and used for other purposes while you sleep. Lots more you can do. the basic mantra you should have is: "That which is not expressly permitted is prohibited". -- Bryan CISSP/CEH/CISM Sent from my iPhone 6S...No electrons were harmed in the sending of this message.

UFW is really just a front-end for iptables. You give instructions to UFW, it does the correct IPTables lines to make it happen. Firewalld on CentOS 7 is the same way. Any network firewalling tool on Linux is going to be IPTables under the hood. Jeremy, NQ0M From: App_rpt-users [mailto:app_rpt-users-bounces@lists.allstarlink.org] On Behalf Of Loren Tedford Sent: Thursday, June 8, 2017 3:13 AM To: Users of Asterisk app_rpt <app_rpt-users@lists.allstarlink.org> Subject: Re: [App_rpt-users] Security was Re: What is the "debian" user in the DIAL distro? Bryan What about the use of UFW?? I have been using ufw in place of iptables started that about 4 years ago.. Is their a known risk from ufw rather iptables?? I thought they had similar characteristics.. Loren Tedford (KC9ZHV) Phone:618-553-0806 Fax: 1-618-551-2755 Email: <mailto:lorentedford@gmail.com> lorentedford@gmail.com Email: <mailto:KC9ZHV@KC9ZHV.com> KC9ZHV@KC9ZHV.com <http://www.lorentedford.com/> http://www.lorentedford.com <http://www.kc9zhv.com/> http://www.kc9zhv.com <http://forum.kc9zhv.com/> http://forum.kc9zhv.com <http://hub.kc9zhv.com/> http://hub.kc9zhv.com <http://ltcraft.net/> http://Ltcraft.net http://voipham.com On Wed, Jun 7, 2017 at 8:55 PM, Bryan D. Boyle <bdboyle@bdboyle.com <mailto:bdboyle@bdboyle.com> > wrote: Based on tests that the security research arm of my company has run (well-known IT company that's been around for over a century...), the elapsed time that a system exposed to the network is discovered, probed, and if well-known vulnerable ports are detailed (and the scum or nation states who do this keep records), then attempted to be pwned is somewhere between a minute to a half hour. Just for giggles, i spun up a pi with a sip server enabled connected to a second port on my router and started a tail -f on the messages file and grepped for the sip daemon. routed the sip port on my external router to the pi, a sat back. (there was no route from the pi to my internal network) 3 minutes till the first probe. 15 till the attempted pwning. SIP was the only inbound port opened. I just watched...and went on for an hour (no, they didn't take over the system, only ate up bandwidth, of which I am pretty ok with being on FTTH). It's all automated. don't even need human intervention for the probe, just to select the attack vectors when the automated system pops a live port selection. Default SSH is NO guarantee. Allowing root access from an interactive login from the net port deserves to be punished. Bogus user passwords that are guessable should be cause for your isp to turn off your connection. Moving to a different port is just attempted security through obscurity. Open ports from the outside inbound that allow anyone on the network to connect will be probed and attempts (DoS, null sled, buffer overruns, etc) to subvert your system as a c&c node, bitcoin miner, email spam relay, porn repository, or whathaveyou is the goal. After doing this since 1988 or so, it's only the frequency that it happens that's changing, not that it's happening. fail2ban is a good stopgap measure for ports that you positively HAVE to have exposed. router firewall enabled and locked down? good. iptables set up properly? passwords NOT based on dictionary words or used for your other online activities? yeah, it's a pain. the alternative is your system being taken over and used for other purposes while you sleep. Lots more you can do. the basic mantra you should have is: "That which is not expressly permitted is prohibited". -- Bryan CISSP/CEH/CISM Sent from my iPhone 6S...No electrons were harmed in the sending of this message. _______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org <mailto:App_rpt-users@lists.allstarlink.org> http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.

Updated images will use Shorewall to "frontend" iptables On 6/8/2017 9:27 AM, Bryan D. Boyle wrote:

you beat me to it.

thanks! -- Bryan Sent from my iPhone 6S...No electrons were harmed in the sending of this message.

On Jun 8, 2017, at 08:26, Jeremy Utley <jerutley@gmail.com <mailto:jerutley@gmail.com>> wrote:

...

UFW is really just a front-end for iptables. You give instructions to UFW, it does the correct IPTables lines to make it happen. Firewalld on CentOS 7 is the same way. Any network firewalling tool on Linux is going to be IPTables under the hood.

Jeremy, NQ0M

*From:* App_rpt-users [mailto:app_rpt-users-bounces@lists.allstarlink.org] *On Behalf Of *Loren Tedford *Sent:* Thursday, June 8, 2017 3:13 AM *To:* Users of Asterisk app_rpt <app_rpt-users@lists.allstarlink.org <mailto:app_rpt-users@lists.allstarlink.org>> *Subject:* Re: [App_rpt-users] Security was Re: What is the "debian" user in the DIAL distro?

Bryan What about the use of UFW?? I have been using ufw in place of iptables started that about 4 years ago.. Is their a known risk from ufw rather iptables?? I thought they had similar characteristics..

Loren Tedford (KC9ZHV)

Phone:618-553-0806

Fax: 1-618-551-2755 Email: lorentedford@gmail.com <mailto:lorentedford@gmail.com>

Email: KC9ZHV@KC9ZHV.com <mailto:KC9ZHV@KC9ZHV.com>

http://www.lorentedford.com <http://www.lorentedford.com/>

http://www.kc9zhv.com <http://www.kc9zhv.com/>

http://forum.kc9zhv.com <http://forum.kc9zhv.com/>

http://hub.kc9zhv.com <http://hub.kc9zhv.com/>

http://Ltcraft.net <http://ltcraft.net/>

http://voipham.com

On Wed, Jun 7, 2017 at 8:55 PM, Bryan D. Boyle <bdboyle@bdboyle.com <mailto:bdboyle@bdboyle.com>> wrote:

Based on tests that the security research arm of my company has run (well-known IT company that's been around for over a century...), the elapsed time that a system exposed to the network is discovered, probed, and if well-known vulnerable ports are detailed (and the scum or nation states who do this keep records), then attempted to be pwned is somewhere between a minute to a half hour.

Just for giggles, i spun up a pi with a sip server enabled connected to a second port on my router and started a tail -f on the messages file and grepped for the sip daemon. routed the sip port on my external router to the pi, a sat back. (there was no route from the pi to my internal network)

3 minutes till the first probe. 15 till the attempted pwning. SIP was the only inbound port opened. I just watched...and went on for an hour (no, they didn't take over the system, only ate up bandwidth, of which I am pretty ok with being on FTTH). It's all automated. don't even need human intervention for the probe, just to select the attack vectors when the automated system pops a live port selection.

Default SSH is NO guarantee. Allowing root access from an interactive login from the net port deserves to be punished. Bogus user passwords that are guessable should be cause for your isp to turn off your connection. Moving to a different port is just attempted security through obscurity. Open ports from the outside inbound that allow anyone on the network to connect will be probed and attempts (DoS, null sled, buffer overruns, etc) to subvert your system as a c&c node, bitcoin miner, email spam relay, porn repository, or whathaveyou is the goal.

After doing this since 1988 or so, it's only the frequency that it happens that's changing, not that it's happening.

fail2ban is a good stopgap measure for ports that you positively HAVE to have exposed. router firewall enabled and locked down? good. iptables set up properly? passwords NOT based on dictionary words or used for your other online activities? yeah, it's a pain. the alternative is your system being taken over and used for other purposes while you sleep.

Lots more you can do. the basic mantra you should have is: "That which is not expressly permitted is prohibited". --

Bryan CISSP/CEH/CISM

Sent from my iPhone 6S...No electrons were harmed in the sending of this message.

_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org <mailto:App_rpt-users@lists.allstarlink.org> http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users

To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.

_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org <mailto:App_rpt-users@lists.allstarlink.org> http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users

To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.

_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users

To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.