[2024-feb-29] Sad news: Eric Layton aka Nocturnal Slacker aka vtel57 passed away on Feb 26th, shortly after hospitalization. He was one of our Wiki's most prominent admins. He will be missed.
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
| howtos:network_services:running_an_access_point_from_a_slackware_box [2016/10/23 08:18 (UTC)] – [6.1 Use Non Standard Ports] louigi600 | howtos:network_services:running_an_access_point_from_a_slackware_box [2016/10/28 07:40 (UTC)] – [6 Remote Administration] louigi600 | ||
|---|---|---|---|
| Line 18: | Line 18: | ||
| * AP/VLAN | * AP/VLAN | ||
| * monitor | * monitor | ||
| - | AP need to be amongst | + | AP needs to be among the software interface modes. |
| + | |||
| + | Ok there is still some Wireless NICs that support hardware master mode but that's 3 against all the rest I'm not going to bother going into any detail with those 3 exceptions, google is your friend if you want to insist in the hardware master mode way. | ||
| ====== 3 Software Requirements ====== | ====== 3 Software Requirements ====== | ||
| Line 453: | Line 455: | ||
| You can dump dnsmasq' | You can dump dnsmasq' | ||
| - | root@router: | + | root@router: |
| 1411875361 00: | 1411875361 00: | ||
| 1411874427 0a: | 1411874427 0a: | ||
| Line 509: | Line 511: | ||
| ====== 6 Remote Administration ====== | ====== 6 Remote Administration ====== | ||
| I'm not advocating that allowing remote administration from your WAN connection is a good thing but there are times where it may be necessary so here are some tips for minimizing the risk of having your router suffering brute force attacks or other bad things happen to it. | I'm not advocating that allowing remote administration from your WAN connection is a good thing but there are times where it may be necessary so here are some tips for minimizing the risk of having your router suffering brute force attacks or other bad things happen to it. | ||
| + | |||
| + | I'm an old fashioned system administrator so for me remote administration is done via ssh, if you've added a nice web administration tool to your AP/Router keep in mind that running apache just for the sake of having remote web administration will expose you to a whole lot of security issues that need to be addressed and maintained over time. | ||
| + | |||
| + | - use non standard ports | ||
| + | - disallow password authentication | ||
| + | - minimize your attack surfaces | ||
| + | Let me give you a little reasoning for the list. | ||
| ===== 6.1 Use Non Standard Ports ===== | ===== 6.1 Use Non Standard Ports ===== | ||
| - | If you've been doing stuff as described here you're going to need to have ssh access to your router, if not whatever you're going to use to do your remote administration | + | Whatever is your remote administration |
| ===== 6.2 Disallow Password Authentication ===== | ===== 6.2 Disallow Password Authentication ===== | ||
| - | Allowing password authentication is a welcome for brute force attacks so avoid it wherever possible (ie for ssh administrations only allow authentication with keys). | + | Allowing password authentication is a welcome for brute force attacks so avoid it wherever possible (ie for ssh administrations only allow authentication with keys). If you're doing web based remote administration you could send in a key via get and then set a cookie or something like that along with password protected htaccess. |
| - | ===== 6.2 Avoid Running Remote Administration 24x7 ===== | + | ===== 6.3 Minimize Your Attack Surfaces ===== |
| + | Your AP/Router should expose to the WAN connection nothing more then what is really needed. Scanning your own AP/Router and closing or disabling unnecessary services to WAN is something you should allays do so that you minimize the attack surfaces should you ever get unwanted attention. | ||
| + | |||
| + | ==== 6.3.1 Avoid Running Remote Administration 24x7 ==== | ||
| If you can have remote administration active only when you need it you're not leaving the attack surface available all the time but then you need an easy way to turn it on when you're away from home. | If you can have remote administration active only when you need it you're not leaving the attack surface available all the time but then you need an easy way to turn it on when you're away from home. | ||
| - | I' | + | I' |
| - | * If any family member is home it can be temporarily activated by pressing a specific button on the router itself. | + | * If any family member is home it can be temporarily activated by pressing a specific button on the router itself |
| - | * If nobody is home I've modified a 200 line minimal web server (nweb) to temporarily allow remote administration | + | * If nobody is home I've modified a 200 line minimal web server (nweb) to listen to requests on a non standard port and temporarily allow remote administration |
| + | |||
| + | Whichever way the temporary remote admin is enabled it also get's automatically turned off after some time (should you ever forget | ||
| + | |||
| + | Nweb is a really basic webserver that only servers static html images and a few archive formats, it does not even allow directory listing. Besides that I have it parse and enable before serving the page ... so if you don't physically have the page that enables the remote administration a 403 is returned anyway | ||
| - | Whichever way the temporary remote admin is enabled it also get's automatically turned off after some time. | + | If you're interested in nweb you can get it by googling " |
| - | If you're interested in nweb you can get it by googling " | + | |
