Re: [App_rpt-users] DIAL node hack
Good to know about RC1. I had months ago disabled access to root via ssh. Even I have to ssh in as SU with a password. I was wondering if this exploit hack was seen by others, just a heads-up. Duane KA1LM
On 6/16/2017 8:56 AM, DuaneVT . wrote:
Good to know about RC1. I had months ago disabled access to root via ssh. Even I have to ssh in as SU with a password. I was wondering if this exploit hack was seen by others, just a heads-up. Duane KA1LM
ANY port that you have open to the outside world is going to add to the risk you enjoy (!) from being connected to the network. There are well-known ports; in the U/Lin-UX world, the goldmine ports (ie those which are reserved to the root group, are those port #s < 1024...and once you have root, all bets are off as to what you can do. That many people have their routers set up to automagically establish persistent connections when any outbound traffic port is opened, this means that if your machine is pwned and a rogue daemon sets up a channel to a command and control system, YOUR machine is part of a botnet...doing who knows what. In 7 years of running an asterisk box, I have NEVER had a reason, while away from the site, of having to log in to do something. Now, it may be different if your box is on a mountain top and inaccessible for 4 months of the year...but, my rule is, if you can drive there, then I don't enable shell access from the outside. I turn off, on my router, PnP. I deny ANY to ANY inbound connections as the default ACL. My boxes have static IPs on the inside of a NAT, and ports are routed to specific host/ports. Fail2ban is running, and, as a luxury, my logs are NOT stored on the machines that ARE accessible; the first thing that a miscreant is going to do is try and erase system log entries of what they've done. So...how to do those things that you have to do administratively? Think belt and suspenders. One of the nice things about asterisk is that you can script almost anything both inside the application as well as the operating system to respond to DTMF. Now, I realize that not everyone has this ability, but, being all my boxes are accessible via the net in some manner...I have a receive-only node on an oddball frequency in a second location locally, which also has an echolink node assigned...and have scripted the admin functions *I* use on a regular basis. Things like reboot the box...restart asterisk...even down to connect and disconnect nodes (ie command *node#3 or *node#1 to connect or disconnect node#), etc. Add in the fact that you can have control over the GPIO pins on the DMK and RIM URIs, and you can even do relay-driven (I like electromechanical stuff) things: turn on fans, turn off fans, turn on power, turn off power...the possibilities are endless, if you think through just what it is that you need to when you supposedly have to log in via a shell. Haven't quite worked out how to mount a cdrom that has a clonezilla image of a fresh box to restore a system from a DTMF command...but, I'm sure with some hacking, even that could be done to remotely restore a system that HAS been trashed. In my opinion, we have to get away from thinking that we need to have terminal access to what is (or should be) essentially an appliance that controls radios. And, no, I'm not thinking that a web interface is necessarily the way to go either.
Bryan you can run a DD command on a backup hard drive where you store your images to flash your running drive.. Typically speaking most of your os is in the memory so you won't affect much until the reboot.. Better hope you setup the boot manger correctly but it can be done via dtmf and shell script if you really wanted to. Its the same principle as doing a rm -r / command.. But yes this can be technically done via dtmf however i don't recommend it.. #I<3Shellscripts Loren Tedford (KC9ZHV) Phone: Fax: Email: lorentedford@gmail.com Email: KC9ZHV@KC9ZHV.com http://www.lorentedford.com http://www.kc9zhv.com http://forum.kc9zhv.com http://hub.kc9zhv.com http://Ltcraft.net <http://ltcraft.net/> http://voipham.com On Fri, Jun 16, 2017 at 9:33 AM, Bryan D. Boyle <bdboyle@bdboyle.com> wrote:
On 6/16/2017 8:56 AM, DuaneVT . wrote:
Good to know about RC1. I had months ago disabled access to root via ssh. Even I have to ssh in as SU with a password. I was wondering if this exploit hack was seen by others, just a heads-up. Duane KA1LM
ANY port that you have open to the outside world is going to add to the risk you enjoy (!) from being connected to the network. There are well-known ports; in the U/Lin-UX world, the goldmine ports (ie those which are reserved to the root group, are those port #s < 1024...and once you have root, all bets are off as to what you can do.
That many people have their routers set up to automagically establish persistent connections when any outbound traffic port is opened, this means that if your machine is pwned and a rogue daemon sets up a channel to a command and control system, YOUR machine is part of a botnet...doing who knows what.
In 7 years of running an asterisk box, I have NEVER had a reason, while away from the site, of having to log in to do something. Now, it may be different if your box is on a mountain top and inaccessible for 4 months of the year...but, my rule is, if you can drive there, then I don't enable shell access from the outside. I turn off, on my router, PnP. I deny ANY to ANY inbound connections as the default ACL. My boxes have static IPs on the inside of a NAT, and ports are routed to specific host/ports. Fail2ban is running, and, as a luxury, my logs are NOT stored on the machines that ARE accessible; the first thing that a miscreant is going to do is try and erase system log entries of what they've done.
So...how to do those things that you have to do administratively? Think belt and suspenders.
One of the nice things about asterisk is that you can script almost anything both inside the application as well as the operating system to respond to DTMF. Now, I realize that not everyone has this ability, but, being all my boxes are accessible via the net in some manner...I have a receive-only node on an oddball frequency in a second location locally, which also has an echolink node assigned...and have scripted the admin functions *I* use on a regular basis. Things like reboot the box...restart asterisk...even down to connect and disconnect nodes (ie command *node#3 or *node#1 to connect or disconnect node#), etc.
Add in the fact that you can have control over the GPIO pins on the DMK and RIM URIs, and you can even do relay-driven (I like electromechanical stuff) things: turn on fans, turn off fans, turn on power, turn off power...the possibilities are endless, if you think through just what it is that you need to when you supposedly have to log in via a shell. Haven't quite worked out how to mount a cdrom that has a clonezilla image of a fresh box to restore a system from a DTMF command...but, I'm sure with some hacking, even that could be done to remotely restore a system that HAS been trashed.
In my opinion, we have to get away from thinking that we need to have terminal access to what is (or should be) essentially an appliance that controls radios. And, no, I'm not thinking that a web interface is necessarily the way to go either.
_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/ cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
To restore a node to its original state can be done by a simple script and the script can be called by dtmf, just need some preparation first.. first when your node is as it should be, all configured tested and secur. do a dd command to dump an image of your system. to find what you need to dump do first a fdisk -l command. this will list all the filessystem on the machine. find the disk you want to backup, let say sda. you wil have a list of all the partition on sda, sda1, sda2... now take note of the last used sector of the last partition on the disk. add one to it and take the bs or block size value,usely 512 bites. now the dd command type dd if=/dev/sda of= /mnt/ what ever the disk you mounted to back your image/ nodexxxx.img count=(the number of the last used block on your last partitio plus 1 , we calculate it earlier) bs=the block size found on the fdisk command usely 512 then it enter. this will make a file named nodexxxx.img and will be the smaller it can be since we stop copying the data 1 block after the last used block. you can then tar and gz it. but I find it not usefull for such utility we do now. then in the script you call by dtmf make asterisk stop and call the command dd if=/mnt/where is your backup file/ nodexxxx.img of=/dev/sda then do a reboot and your node is back as itwas when you did the first image.. hope it helped someone.. Pierre VE2PF Le ven. 16 juin 2017 à 10:33, Bryan D. Boyle <bdboyle@bdboyle.com> a écrit :
On 6/16/2017 8:56 AM, DuaneVT . wrote:
Good to know about RC1. I had months ago disabled access to root via ssh. Even I have to ssh in as SU with a password. I was wondering if this exploit hack was seen by others, just a heads-up. Duane KA1LM
ANY port that you have open to the outside world is going to add to the risk you enjoy (!) from being connected to the network. There are well-known ports; in the U/Lin-UX world, the goldmine ports (ie those which are reserved to the root group, are those port #s < 1024...and once you have root, all bets are off as to what you can do.
That many people have their routers set up to automagically establish persistent connections when any outbound traffic port is opened, this means that if your machine is pwned and a rogue daemon sets up a channel to a command and control system, YOUR machine is part of a botnet...doing who knows what.
In 7 years of running an asterisk box, I have NEVER had a reason, while away from the site, of having to log in to do something. Now, it may be different if your box is on a mountain top and inaccessible for 4 months of the year...but, my rule is, if you can drive there, then I don't enable shell access from the outside. I turn off, on my router, PnP. I deny ANY to ANY inbound connections as the default ACL. My boxes have static IPs on the inside of a NAT, and ports are routed to specific host/ports. Fail2ban is running, and, as a luxury, my logs are NOT stored on the machines that ARE accessible; the first thing that a miscreant is going to do is try and erase system log entries of what they've done.
So...how to do those things that you have to do administratively? Think belt and suspenders.
One of the nice things about asterisk is that you can script almost anything both inside the application as well as the operating system to respond to DTMF. Now, I realize that not everyone has this ability, but, being all my boxes are accessible via the net in some manner...I have a receive-only node on an oddball frequency in a second location locally, which also has an echolink node assigned...and have scripted the admin functions *I* use on a regular basis. Things like reboot the box...restart asterisk...even down to connect and disconnect nodes (ie command *node#3 or *node#1 to connect or disconnect node#), etc.
Add in the fact that you can have control over the GPIO pins on the DMK and RIM URIs, and you can even do relay-driven (I like electromechanical stuff) things: turn on fans, turn off fans, turn on power, turn off power...the possibilities are endless, if you think through just what it is that you need to when you supposedly have to log in via a shell. Haven't quite worked out how to mount a cdrom that has a clonezilla image of a fresh box to restore a system from a DTMF command...but, I'm sure with some hacking, even that could be done to remotely restore a system that HAS been trashed.
In my opinion, we have to get away from thinking that we need to have terminal access to what is (or should be) essentially an appliance that controls radios. And, no, I'm not thinking that a web interface is necessarily the way to go either.
_______________________________________________ App_rpt-users mailing list App_rpt-users@lists.allstarlink.org http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users
To unsubscribe from this list please visit http://lists.allstarlink.org/cgi-bin/mailman/listinfo/app_rpt-users and scroll down to the bottom of the page. Enter your email address and press the "Unsubscribe or edit options button" You do not need a password to unsubscribe, you can do it via email confirmation. If you have trouble unsubscribing, please send a message to the list detailing the problem.
participants (4)
-
Bryan D. Boyle -
DuaneVT . -
Loren Tedford -
Pierre Martel