On 2012-07-10 12:47, Trent W. Buck wrote:

Lindsay Sprinter wrote:

...

I use Virgin moble broadband using the 12gig for $149 plan. The modem being a Huawei E1762.

I also used a USB 3g dongle for a while, IIRC it was this one. Making it work was reasonably straightforward pppd configuration, once I stole the secret magic AT handshaking from a post on this list (thanks, btw).

It didn't have split-personality thing where the device pretends to be a CD-ROM until you say "the driver is installed, now present as a modem". IIRC there is a utility in Debian to force that, but I don't remember its name.

mattcen@andy:tmp$ aptitude show usb-modeswitch Package: usb-modeswitch New: yes State: not installed Version: 1.1.4-2 Priority: extra Section: comm Maintainer: Didier Raboud <didier@raboud.com> Uncompressed Size: 180 k Depends: libc6 (>= 2.3), libusb-0.1-4 (>= 2:0.1.12), tcl | tclsh, usb-modeswitch-data (>= 20100127) Suggests: comgt, wvdial Description: mode switching tool for controlling "flip flop" USB devices Several new USB devices have their proprietary Windows drivers onboard, especially WAN dongles. When plugged in for the first time, they act like a flash storage and start installing the driver from there. If the driver is already installed, the storage device vanishes and a new device, such as an USB modem, shows up. This is called the "ZeroCD" feature. On Debian, this is not needed, since the driver is included as a Linux kernel module, such as "usbserial". However, the device still shows up as "usb-storage" by default. usb-modeswitch solves that issue by sending the command which actually performs the switching of the device from "usb-storage" to "usbserial". This package contains the binaries and the brother scripts. Homepage: http://www.draisberghof.de/usb_modeswitch/ Tags: admin::hardware, hardware::usb, implemented-in::c, implemented-in::tcl, interface::commandline, role::program, use::configuring, use::driver -- Regards, Matthew Cengia

On 11/07/12 11:30, Lindsay Sprinter wrote:

...

For normal intenet access the service is great for any large downloads its WAY to expensive. For these I go into town to the intenet cafe, one can get 4 gig for 3 dollars there AND its fast, I can get 700 meg bytes (1 debian CD) in around 9 minutes. You can get the first 7 which is usually all one needs in around an hour.

If there's reasonable access in town, maybe you could try something a former colleague managed.. he set up a kind of bucket chain of wifi links out from the edge of the town to his rural property.

With directional antennas and line-of-sight you can get long distances, so not too many nodes are required. Just need a few windmills, silos or comms towers to attach 'em to.

How are these being powered? Just curious :) James

Toby Corkindale wrote:

On 11/07/12 12:11, James Harper wrote:

...

...

With directional antennas and line-of-sight you can get long distances, so not too many nodes are required. Just need a few windmills, silos or comms towers to attach 'em to.

How are these being powered? Just curious :)

Good question, I don't remember. I guess he was able to get power up to most of them somehow. I suppose solar would be an option too.

You did mention windmills... devices whose whole purpose is to generate power. :-)

James Harper <james.harper@bendigoit.com.au> wrote:

Power comes in many forms... I suspect that the power to mill grain isn't directly usable by a router though!

Unless you can somehow attach a small generator...

On Wed, 11 Jul 2012, Toby Corkindale wrote:

On 11/07/12 11:30, Lindsay Sprinter wrote:

...

For normal intenet access the service is great for any large downloads its WAY to expensive. For these I go into town to the intenet cafe, one can get 4 gig for 3 dollars there AND its fast, I can get 700 meg bytes (1 debian CD) in around 9 minutes. You can get the first 7 which is usually all one needs in around an hour.

If there's reasonable access in town, maybe you could try something a former colleague managed.. he set up a kind of bucket chain of wifi links out from the edge of the town to his rural property.

With directional antennas and line-of-sight you can get long distances, so not too many nodes are required. Just need a few windmills, silos or comms towers to attach 'em to.

I looked into this sometime back, the problem is no way is there a line of site and to get line of site would not really be feasable not to say way to expensive. Security did not appear to be an issue as the radio link itself can be encrypted and all I talked to said this was OK. The current setup does what I need (Note 1) although I would say most would find it to restrictve. Rememeber this is a rural area, there is plenty to do outside one is not forced by population pressure to stay inside. Lindsay Note 1: Even getting Debian now is no longer an issue as I can download the CD's from the cafe.

On Fri, 13 Jul 2012, Toby Corkindale wrote:

On 13/07/12 16:12, Lindsay Sprinter wrote:

...

On Wed, 11 Jul 2012, Toby Corkindale wrote:

...

On 11/07/12 11:30, Lindsay Sprinter weote: With directional antennas and line-of-sight you can get long distances, so not too many nodes are required. Just need a few windmills, silos or comms towers to attach 'em to.

I looked into this sometime back, the problem is no way is there a line of site and to get line of site would not really be feasable not to say way to expensive.

You mentioned before that you "use Virgin moble broadband using the 12gig for $149 plan."

What about getting a satellite connection? 9G for $35/month at 512kbps, or $100 for 15G at 1Mbps (based on the first provider I hit on google)

Thanks for the reply, Like all (most?) people I am limited with what I can do by personal choices. I do not have any kind of plastic money and I do NOT do direct debit. This is because I have had the unfortunate luck to have two of these go astray. The second being the killer as it involved alarge sum of money ($6000) and both financial institutions refused to believe a problem existed and it took over 4 months to correct a problem that was the fault of one of the said institutions. The whole exersize being a real eye opener and how these people work. This choice severely limits how I can work in to days society, but it does of course go with my general philosphy of life. Both ISP's I work with have counter staff and allow direct payment in cash, both ISP's some of the last of the rugged individualists. This of course suits me well. Running Linux now for 19 years, Lindsay

On Wed, 11 Jul 2012, Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> wrote:

I am surprised that nobody seems to be concerned about the security of having your public IP address directly on the attached computer. Sure, you can firewall everything, but without a suitable firewall, your machine [Windows, Linux, Mac or other...] will be directly exposed to the Internet.

If you use Windows (particularly the older versions) this is a problem. Modern Linux distributions tend to have almost nothing listening for inbound connections by default so this shouldn't be an issue. Most people here probably started using Linux after ssh obsoleted telnet and rsh for remote logins and after shadow password became mandatory everywhere. There are probably very few people here who can remember the old days when Unix was insecure. http://www.coker.com.au/selinux/play.html Let me know if there's any particular application which you think is a security risk which is typically listening for connections from the outside world and I'll add it to my Play Machine. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

On Wed, 11 Jul 2012, James Harper <james.harper@bendigoit.com.au> wrote:

It's been a while since I installed a Debian machine via any other means than debootstrap... do any flavours of Linux these days take any steps to ensure you choose a sensible password? A computer without a firewall is only as secure as the user that set it up, regardless of the OS.

I recently installed a Ubuntu 12.04 on my test network and it whinged about the password.

So if the user didn't choose a good password, and ran openssh-server with password authentication, then we have a problem. (or maybe modern distributions don't enable password authentication on ssh by default?? In which case I withdraw my remarks :)

I think that most of them enable passwords by default.

For my kids at home, I just used their name as a password (a 2 year old can easily learn to type their name (or a shortened version of), but probably not a password that anyone would consider secure), but I separated that machine from anything that could attack it. Someone without any network knowledge wouldn't be able to do that.

For such systems the best thing to do is use AllowUsers or one of the related options. Young kids don't need to ssh in to a system. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

Jason White <jason@jasonjgw.net> wrote:

James Harper <james.harper@bendigoit.com.au> wrote:

...

It's been a while since I installed a Debian machine via any other means than debootstrap... do any flavours of Linux these days take any steps to ensure you choose a sensible password? A computer without a firewall is only as secure as the user that set it up, regardless of the OS.

I think there are checks performed on passwords entered by users other than root, but I'm not sure.

I can confirm that checks are performed: /etc/pam.d/common-password: password [success=1 default=ignore] pam_unix.so obscure sha512 The obscure option performs the checks listed in the pam_unix(8) manual page.

James Harper wrote:

It's been a while since I installed a Debian machine via any other means than debootstrap... do any flavours of Linux these days take any steps to ensure you choose a sensible password? A computer without a firewall is only as secure as the user that set it up, regardless of the OS.

Last time I looked, in d-i Ubuntu checked password strength (but not enforce it); Debian did not check it. I cannot comment on ubiquity. This is for the initial user. Once install has completed, it would depend on how you were adding accounts (e.g. adduser, or LDAP, or what?) and whether strength checking was enabled in e.g. /etc/pam*. I don't know offhand. As at lucid, RFC2307 accounts in slapd do not have password strength checking when setting passwords with exop. There is an option for it in the slapo_ppolicy overlay, but you must write your own C function to perform the check.

So if the user didn't choose a good password, and ran openssh-server with password authentication, then we have a problem. (or maybe modern distributions don't enable password authentication on ssh by default?? In which case I withdraw my remarks :)

I am repeatedly annoyed that "apt-get install openssh-server" results in a daemon binding to *:22 by default. IMO it should behave like all other daemons and either not run, or bind only to lo by default. Otherwise, there is an (admittedly small) window between installing sshd, and locking down sshd_config, in which people can attack sshd in its default configuration.

Quoting Trent W. Buck (trentbuck@gmail.com):

Otherwise, there is an (admittedly small) window between installing sshd, and locking down sshd_config, in which people can attack sshd in its default configuration.

(For values of 'attack' approximating twisting a house's front doorknob.) Anyone who's run a public sshd and noted automated attempts to login using 'joe' account/password combinations will have noticed that the rate of traffic involved is really slow. It would be interesting to run the numbers on that; I'll readily confess I haven't, but breaking into systems that way strikes me as pretty improbable under most circumstances, and basically not worth worrying about unless you have users who use _literally_ trivially guessable credentials. (I've run Linux servers fully exposed to the Internet since 1993, FWIW.) Anyway, to enforce password strength on all non-root users: 1. Install libpam_cracklib . (In Debian, that's the literal package name.) 2. Add this to /etc/pam.d/common-password password required pam_cracklib.so retry=2 minlen=10 difok=3 'difok' should be visually parsed as 'diff OK', and specifies the number of characters permitted to be the same between password N and password N+1.

Quoting Russell Coker (russell@coker.com.au):

http://etbe.coker.com.au/2012/07/09/postfwd-local-email/

I recently had a SMTP AUTH account compromised.

Connection attempts to an MTA can be made at a rate orders of magnitude faster than can be made to an sshd. As I said, anyone who's run a public sshd and noted automated attempts to login using 'joe' account/password combinations will have noticed that the rate of traffic involved is really slow. Also, I'll note your blog takes as given that guessing the password was the vector for compromise. Could be, or might not be. Anyway, FWIW, net.randoms' SSH password guessing attempts against the 'rick' login on linuxmafia.com have been ongoing for about 19 years, now. No luck yet.

Quoting Russell Coker (russell@coker.com.au):

If they did make lots of connections then I would have noticed. The number of login errors etc didn't increase much.

If you're saying they guessed your SMTP auth credentials without very many connection attempts, maybe you ought to be trying to figure out _how_ they arrived at the right solution so quickly. I'd love to help figure that out, but lack the raw data.

If they had some better way of gaining access then they would have done something more useful than send out spam from the test account.

Oh, I wouldn't be so sure. Many security breakins are not only not very intelligent but in fact are run by completely automated (and necessarily single-minded) processes.

Rick Moen <rick@linuxmafia.com> wrote:

Anyone who's run a public sshd and noted automated attempts to login using 'joe' account/password combinations will have noticed that the rate of traffic involved is really slow. It would be interesting to run the numbers on that; I'll readily confess I haven't, but breaking into systems that way strikes me as pretty improbable under most circumstances, and basically not worth worrying about unless you have users who use _literally_ trivially guessable credentials.

I agree, and if you do have such users there is every reason to follow Rick's excellent advice (not quoted here) for strengthening the checks performed on candidate passwords. It doesn't take long to shut down ssh before editing /etc/ssh/sshd_config to set PasswordAuthentication no. If I didn't want ssh to listen on non-local interfaces, I wouldn't install the package in the first place.

Trent W. Buck <trentbuck@gmail.com> wrote:

But we all (well, Russell and I) just agreed that stuff shouldn't listen until explicitly told to! Why should sshd be an exception?

I suppose I don't agree with the principle. I think that if you run, say, Postfix, it's perfectly reasonable to have a default configuration that listens to non-local interfaces. I don't want to get into a disagreement about this, but I really don't think there's much point in installing and starting something which exists primarily or only to accept network connections unless you want it to do precisely that. Of course, I think the default configuration should include reasonable security precautions, but that's a separate issue. For example, perhaps PasswordAuthentication no should be the default for ssh, except in live distributions where keys may not be available and quick access is paramount.

On 13 July 2012 11:54, Rick Moen <rick@linuxmafia.com> wrote:

The world would be a better and more wondrous place if more people were aware of and used ssh localhost. 'ssh -X root@localhost', for example.

Too scary; what if I get the answer to the following wrong? brian@aquitard:~$ ssh localhost The authenticity of host 'localhost (::1)' can't be established. RSA key fingerprint is 2c:6d:99:8b:b8:92:99:e4:29:9c:e0:27:f9:e9:9b:a2. Are you sure you want to continue connecting (yes/no)? ^C Somebody might be intercepting packages on my lo network! How can I be sure that I am really me? -- Brian May <brian@microcomaustralia.com.au>

Jason White wrote:

...

If I didn't want ssh to listen on non-local interfaces, I wouldn't install the package in the first place.

But we all (well, Russell and I) just agreed that stuff shouldn't listen until explicitly told to! Why should sshd be an exception?

I'm sure there was an implied "where it makes sense" for that agreement though. Why would you install ssh server if you didn't want to use it remotely? I don't think it installs by default on any of the distributions I'm familiar with (which these days is 2!) and it's next to useless without remote access unlike (say) mysql which definitely shouldn't listen on anything but 127.0.0.1 by default. James

Quoting Jason White (jason@jasonjgw.net):

...

It doesn't take long to shut down ssh before editing /etc/ssh/sshd_config to set PasswordAuthentication no.

Personally, I wouldn't even do that. (In fact, I don't do it.)

The PAM details mentioned upthread prevent non-root users from using trivially guessable 'joe account' passwords. Once those are out of the picture, guessing just isn't a credible threat.

I'm glad to hear someone else say that.

Stolen credentials, by contrast, are -- and both passwords and keypairs can be equally easily stolen on a compromised host and then used to impersonate users in connection sessions to elsewhere.

For us know-it-all IT types that might be true, but many people use the same username and password _everywhere_, so it is far more likely to have a username/password combination stolen than a key and I wouldn't say "equally easily stolen". There's a scam going around that involves smsing the stolen username and password back to the user... I'm not sure exactly how the scam works (or even if I am correct in calling it a scam) but I have spoken to someone who has had this happen to them, and it seems to be happening to others as well http://whocallsme.com/Phone-Number.aspx/0458702000 (that's the same number as the person I spoke to). I wonder if the sms-back is a way of getting confirmation of the credentials before trying them (eg waiting for a response like "wtf hw did u no my pass?!1!?1?"). Or maybe it's a whitehat letting people know that they have access to a username, password, and mobile number. James

Rick Moen wrote:

If he/she merely uses the same SSH passphrase everywhere, that's just about as bad, because it means the private key can get stolen and used locally, and then the imposter sshes to the next system, repeats the theft, und so weiter.

That sounds like the user leaves private keys on intermediary hops (cf. -oProxyCommand or -oForwardAgent, which have different attack profiles).

Rick Moen wrote:

Stolen credentials, by contrast, are -- and both passwords and keypairs can be equally easily stolen on a compromised host and then used to impersonate users in connection sessions to elsewhere.

It's worth noting that a passphrase-protected SSH private key, once stolen, can have its passphrase cracked offline at leisure. With existing tools -- ssh-keygen -p.

On 13/07/12 05:51, Rick Moen wrote:

Anyone who's run a public sshd and noted automated attempts to login using 'joe' account/password combinations will have noticed that the rate of traffic involved is really slow.

What is your definition of really slow? cheers, Chris -- Chris Samuel : http://www.csamuel.org/ : Melbourne, VIC

Rick Moen wrote:

Quoting Chris Samuel (chris@csamuel.org):

...

What is your definition of really slow?

I already said I haven't run the numbers. However, you are welcome to put an ssh up and see for yourself.

I was getting enough of them that I instructed my firewall to blacklist (for an hour) any IP making more than three SSH attempts in a minute. All traffic in the blacklist gets tarpitted. Subsequent traffic resets the blacklist timer back to one hour. Password auth is off ANYWAY, but log flooding was annoying me. Hopefully tarpitting also increases operational-costs-per-compromise for the attackers, too. http://cyber.com.au/~twb/doc/iptab.ips

Quoting James Harper (james.harper@bendigoit.com.au):

Yes that was my reason for blocking too... too much noise in the logs makes log analysis difficult. For the same reason I've changed ports in a lot of cases too - now when I see traffic its probably worth following up.

Personally, I regard that as solving the wrong problem. Instead, I tweak logfile analysis to ignore basically meaningless so-called 'attacks' (net.randoms' doorknob-twisting of the sshd, etc.). (Noise in your logs? Of course there's noise in your logs. It's the Internet, after all. If the 'flooding' bothers you, don't look at it.) Automated iptables blacklists are mostly just a clever way to DoS yourself, in my experience, and add to system complexity and impair the goal of deterministic behaviour without any benefit worth having. Your Mileage May Differ[tm].

All of this in reply to a 3G network though. I've not yet seen any 3G provider actually provide a non-rfc1918 internal IP which is not NATed to the Internet.. Unless you actually pay for that function. Thereby rendering most of this thread moot :) That is until mobile provides actually bother to implement IPv6 on their subscriber networks

On Sun, 15 Jul 2012, hannah commodore <hannah@tinfoilhat.net> wrote:

...

All of this in reply to a 3G network though. I've not yet seen any 3G provider actually provide a non-rfc1918 internal IP which is not NATed to the Internet.. Unless you actually pay for that function. Thereby rendering most of this thread moot :)

That is until mobile provides actually bother to implement IPv6 on their subscriber networks

http://en.wikipedia.org/wiki/4g#IPv6_support

4G AKA LTE is going to be pretty much IPv6 everywhere. While technically this isn't 3G, I think that most users don't care much about the difference, in both cases it's just mobile net access. Also rumor has it that Telstra LTE is giving better performance than expected due to the lack of users...

Rumour also has it that Telstra has pinched some 3G spectrum for use on its 4G network. We have some customers in Bendigo CBD where Telstra 3G is effectively useless since 4G trials started (Optus works fine), so the rumour would be one explanation for that... james

hannah commodore <hannah@tinfoilhat.net> wrote:

All of this in reply to a 3G network though. I've not yet seen any 3G provider actually provide a non-rfc1918 internal IP which is not NATed to the Internet.. Unless you actually pay for that function. Thereby rendering most of this thread moot :)

That is until mobile provides actually bother to implement IPv6 on their subscriber networks

I've heard that there's at least one North American mobile provider which already offers IPv6 on its subscriber network. I can't remember the name, however.

At 05:10 PM 7/15/2012, hannah commodore wrote:

All of this in reply to a 3G network though. I've not yet seen any 3G provider actually provide a non-rfc1918 internal IP which is not NATed to the Internet.. Unless you actually pay for that function. Thereby rendering most of this thread moot :)

Internode does, I am able to use apps which require non NAT'd connectivity on Internode without any workarounds. Downside is they don't offer voice services, so it's only good for iPads and 3G dongles.

That is until mobile provides actually bother to implement IPv6 on their subscriber networks

I'm not aware of any in Australia. 73 de VK3JED / VK3IRL http://vkradio.com

At 06:03 PM 7/15/2012, Jason White wrote:

Tony Langdon <vk3jed@gmail.com> wrote:

...

Internode does, I am able to use apps which require non NAT'd connectivity on Internode without any workarounds. Downside is they don't offer voice services, so it's only good for iPads and 3G dongles.

Unless, of course, the latency and jitter are tolerable for RTP traffic.

Yes, VoIP does seem to work well when I've tried, though the RTP based protocols I'm using are a bit more tolerant to delay and jitter than the format used for telephony. 73 de VK3JED / VK3IRL http://vkradio.com

Hello Hannah, On Sun, 2012-07-15 at 17:10 +1000, hannah commodore wrote:

All of this in reply to a 3G network though. I've not yet seen any 3G provider actually provide a non-rfc1918 internal IP which is not NATed to the Internet.. Unless you actually pay for that function. Thereby rendering most of this thread moot :)

I have read the thread with interest, there has been a great deal of information to glean, but minimal information about actually using such, and more particularly, no pointers to initialising under Linux rather than Windows or a Mac. It makes me think that I really need a 3G (or maybe 4G?)device that provides WiFi connection, or an ethernet port, rather than a USB device.

That is until mobile provides actually bother to implement IPv6 on their subscriber networks

It is coming to a crunch where it should be IPv6, and nothing else, but I am certain that they will not move soon enough, citing "legacy" systems that cannot cope. The sooner that Microsoft Windows is _NOT_ supported, the better for all of us. I cannot see why they cannot do perl scripts for both Mac and generic GNU/Linux, both have perl installed by default, it is not on Windows by default, but can be installed, or run from a minimalist installation on the USB device. It should be a lot more robust, but less obscure, and more open to the hacker (and cracker) communities. Regards, Mark Trickett

Sorry for not being clearer Mark. Most 3G devices if they are supported by the kernel will work 'out of the box' - ie. whatever network manager you are using will recognise it and perhaps have the setup needed (APN etc) for Australian providers supplied. Which means clicking the network icon and selecting it... To determine whether it's supported, I would find the model no. of the device and do a search based on the distro you are intending to use. Be sure to search for the exact model, a slight variation may mean it is not yet supported. I have been using a Huawei E160 for 3.5 years and it has been fully supported under the 2.6 or 3 kernels I have used in that time - I remember someone couldn't get an E160g to work though. Occasionally the network manager will not play nice, as in early versions of KDE4 - in such circumstances I have used the wvdial utility, with the config information found from a quick search. Other devices may require the use of usb modeswitch, but with this additional configuration will work fine. On 15 July 2012 20:43, Hiddensoul (Mark Clohesy) < hiddensoul@twistedsouls.com> wrote:

I recently purchased a Telstra Prepaid SIM for my toughbook, it has an internal MODEM that shows up as a USB device. I went with Telstra as the connection manager (In Windows) showed that I could only "See" the telstra network inside my house and only Telsta and Vodafone outside, I was with Amaysim (Using Optus Infrastructure) and could not find the network (A downfall of living rural)

I went with Telstra solely for coverage reasons. When I activated the SIM via a phone call to Telstra I was asked what version of Windows I was using, when I said I was using Linux I was told it would not work with linux and that I should install Windows. I stated I was not using a Telstra Dongle but an internal MODEM and that I was not looking for technical support but that I just wanted the SIM activated.

I am running Ubuntu 12.04 and it was really easy to setup, my son runs a DCSI (Optus Network) dongle on his linux laptop and it automagically switched to MODEM mode when plugged in to a Ubuntu 11.10 install.

Ubuntu Network Manager already had Telstra in its list of providers and it was a simple matter of selecting Telstra then selecting the appropriate APN form the list to suit your account type. This information was found by using the setup page on Telstras website for Android Devices.

--

Mark "Hiddensoul" Clohesy Mob Phone: (+61) 406 417 877 Email: hiddensoul@twistedsouls.com G-Talk: mark.clohesy@gmail.com - www.shed.twistedsouls.com - GNU/Linux.. Linux Counter #457297

"I would love to change the world, but they won't give me the source code"

"Linux is user friendly...its just selective about who its friends are"

"Never underestimate the bandwidth of a V8 station wagon full of tapes hurtling down the highway"

"The difference between e-mail and regular mail is that computers handle e-mail, and computers never decide to come to work one day and shoot all the other computers"

_______________________________________________ luv-main mailing list luv-main@luv.asn.au http://lists.luv.asn.au/listinfo/luv-main

On 15 July 2012 21:16, James Harper <james.harper@bendigoit.com.au> wrote:

I'm all for Microsoft bashing, but if you are implying that Windows doesn't support IPv6 then you are very wrong. In fact you'll have trouble with some of their server software if you disable IPv6.

Lots of people still use Windows XP, which doesn't have built in IPv6 support. I believe there is an add-on that provides IPv6 support, however this was the first attempt Microsoft made, and as a result not recommended for serious use. Or so I have read. On this particular issue, I would rephrase the original comment as "The sooner that Microsoft Windows XP is _NOT_ supported, the better for all of us." -- Brian May <brian@microcomaustralia.com.au>

Hello James, On Sun, 2012-07-15 at 11:16 +0000, James Harper wrote:

...

It is coming to a crunch where it should be IPv6, and nothing else,

but I am

...

certain that they will not move soon enough, citing "legacy" systems that cannot cope. The sooner that Microsoft Windows is _NOT_ supported, the better for all of us.

I'm all for Microsoft bashing, but if you are implying that Windows doesn't support IPv6 then you are very wrong. In fact you'll have trouble with some of their server software if you disable IPv6.

James

My comments were prompted by the fact that the biggest competitor to Microsoft's latest versions has been the installed base of prior versions. Given the escalating hardware requirements, and propensity to rape wallets, it would be good to be vendor and OS neutral. The legacy of older versions of Microsoft Widows that will not cope with IPv6, and the relative costs of the upgrades, Linux is looking good to those of us with knowledge and competence. Regards, Mark Trickett

I have read the thread with interest, there has been a great deal of information to glean, but minimal information about actually using such, and more particularly, no pointers to initialising under Linux rather than Windows or a Mac. It makes me think that I really need a 3G (or maybe 4G?)device that provides WiFi connection, or an ethernet port, rather than a USB device.

I regularly use my Android phone as a 3G modem, either wireless or tethered via USB depending on if I forgot my cable or not. It has the advantage that the phone can be on charge near a window to get good reception and I can be a short distance away where it is more comfortable :) James

On 15/07/12 21:28, Jeremy Visser wrote:

James Turnbull

Sorry, meant James Harper in case that’s not obvious.

On 15/07/2012, at 21:18, Jeremy Visser <jeremy@visser.name> wrote:

Every Optus 3G connection I’ve checked (personal mobile phone services) has a public IPv4 address attached (albeit dynamic). Really handy actually, as I do like to SSH into my mobile phone from time to time.

Sorry. I stand corrected. Is it just Telstra consumer plans that use internal ip addresses on 3G then?

Hi, On 15/07/2012 5:10 PM, hannah commodore wrote:

All of this in reply to a 3G network though. I've not yet seen any 3G provider actually provide a non-rfc1918 internal IP which is not NATed to the Internet.. Unless you actually pay for that function. Thereby rendering most of this thread moot :)

I use [and can sell] a premium service, it gives me static IP on 3G service using Optus network. Cheers -- Kind Regards AndrewM Andrew McGlashan Broadband Solutions now including VoIP Current Land Line No: 03 9012 2102 Mobile: 04 2574 1827 Fax: 03 9012 2178 National No: 1300 85 3804 Affinity Vision Australia Pty Ltd http://www.affinityvision.com.au http://adsl2choice.net.au In Case of Emergency -- http://www.affinityvision.com.au/ice.html

On 13/07/12 15:09, Rick Moen wrote:

Quoting Chris Samuel (chris@csamuel.org):

...

What is your definition of really slow?

I already said I haven't run the numbers. However, you are welcome to put an ssh up and see for yourself.

We have quite a few here at work (comes with the territory) and we have gone to rate limiting incoming SSH connections with iptables because of the brute forcers connecting so much. I was just wondering if that meant we were more of an attraction than other sites. cheers, Chris -- Chris Samuel : http://www.csamuel.org/ : Melbourne, VIC

Rick Moen wrote:

[...] And also that I have about 19 years of direct Internet exposure to illustrate the point.

The plural of anecdote is not data :-) Hey, if what you're doing works for you, great. I was not trying to change your mind, merely describe my own setup.

On Mon, Jul 16, 2012 at 01:51:39PM +1000, Chris Samuel wrote:

We have quite a few here at work (comes with the territory) and we have gone to rate limiting incoming SSH connections with iptables because of the brute forcers connecting so much.

yep, me too. i whitelist known good addresses (incl. our own :-) and everything else is subject to iptables recent-match rules. i also use /etc/security/access.conf via the pam_access module to limit who is allowed to login (and from where), and only allow password auth from whitelisted hosts - other access to ssh is either blocked or key-based auth only, e.g.: PubkeyAuthentication yes PasswordAuthentication no Match Address IP.IP.IP.IP/MASK,127.0.0.0/8 PasswordAuthentication yes NOTE: the Match Address feature of sshd_config is fairly recent, only a year or two old IIRC so it won't work if you are running an ancient or crap distro.

I was just wondering if that meant we were more of an attraction than other sites.

probably not. if you put a machine on the net then it's going to get probed for all sorts of potential exploits, real or imaginary or obsolete or just hopeful - including ssh and mysql and ms sql and smb and telnet and rpc and hundreds/thousands of other ports, many of which haven't even had an exploitable version for over a decade. since it's all done by bots, one IP address is as "attractive" as any other. of course, if you've got some highly desirable or valuable data then your known IP address ranges may be specifically targeted, but mere presence or number of accessible machines doesn't make your site a more attractive target. craig -- craig sanders <cas@taz.net.au>

On 11/07/2012 2:48 PM, Russell Coker wrote:

If you use Windows (particularly the older versions) this is a problem.

Modern Linux distributions tend to have almost nothing listening for inbound connections by default so this shouldn't be an issue.

It's important to remain factual. All current desktop versions of Windows in use today (XP SP2+, Vista, Win 7) include the Windows Firewall, enabled by default, which filters all services unless you explicitly unblock them. [0] -- [0] A server process that opens a listening socket will trigger a Windows Firewall dialog asking the user whether to "Unblock" the application. As a result, most users would have a very large firewall exception list after a short period of using the computer. This doesn't devalue the fact that it is firewalled by default, however.

On Wed, 11 Jul 2012, James Harper <james.harper@bendigoit.com.au> wrote:

...

It's important to remain factual. All current desktop versions of Windows in use today (XP SP2+, Vista, Win 7) include the Windows Firewall, enabled by default, which filters all services unless you explicitly unblock them. [0]

This discussion is about firewalls and whether they are necessary. Stating that a firewall is enabled by default is not particularly relevant to the issue of whether it's necessary. Although the presence of a firewall by default may suggest that it is necessary. Someone could have responded to Andrew suggesting that his firewall suggestion might be obsoleted by the iptables configuration in RHEL or one of the variety of Windows firewall products.

Also note that the first time someone has problems with anything network related (p2p, multiplayer games), the first troubleshooting step is often to turn off the firewall, and if that fixes the problem it will remain off.

Yes. Also if you are setting up a server it's a good idea to turn off the firewall as it's a major PITA to have a server stop doing it's thing because the firewall gets in the way. I recently had this problem when dealing with some proprietary server software that only ran on Windows and was too broken to run correctly on Wine. To add to the fun there were two firewall products installed on the Windows server in question. The problem is that in most cases firewalls don't do much good. If a firewall is deny by default then it gets in the way every time the user installs a new Bittorrent program that uses different ports and is likely to get turned off. If it's allow by default then it probably won't do any good. http://en.wikipedia.org/wiki/SQL_Slammer Really the best thing is for applications to not listen for external connections unless explicitely configured to do so. This solves the problem of daemons the user didn't directly install being vulnerable, apparently some people who had their systems infected by Slammer were unaware that they had MSDE installed - including some MS employees. -- My Main Blog http://etbe.coker.com.au/ My Documents Blog http://doc.coker.com.au/

Russell Coker wrote:

The problem is that in most cases firewalls don't do much good. If a firewall is deny by default then it gets in the way every time the user installs a new Bittorrent program that uses different ports

That's a *feature*.

and is likely to get turned off.

The user is broken. Swap in a new one.

Really the best thing is for applications to not listen for external connections unless explicitely configured to do so.

IMO both are desirable, and orthogonal to one another. Programs shouldn't listen until instructed to do so, but operating a default deny firewall is a defense-in-depth safety net to protect you when a program *does* listen by default.

hi for range extenders 24dB and external rated parabolic antenna http://www.tp-link.com/en/products/details/?model=TL-ANT2424B two of these may help, but alignment is necessary Steve

Jobst Schmalenbach wrote:

Get yourself a 3g(4g) WIFI modem (aka Huwei), anybody can connect to that, no drivers required. I share mine with my partner, we have a WinXP laptop, a Fedora Laptop, two GalaxiesII's and two AsusTransformers.

Well, you need at least a USB bus driver and USB serial device driver. They're just very likely to be enabled out of the box :-) -- twb, who occasionally runs into grief with his temporary-oops-permanent android kernel on his TF101, which has e.g. iso9660 compiled out and no .ko handy.

On Tue, 31 Jul 2012 02:59:15 PM Jobst Schmalenbach wrote:

Get yourself a 3g(4g) WIFI modem (aka Huwei), anybody can connect to that, no drivers required. I share mine with my partner, we have a WinXP laptop, a Fedora Laptop, two GalaxiesII's and two AsusTransformers.

Optus sells them, do not know what brad Telstra's is but I know they have a similar one.

Telstra Sierra Wireless AirCard 760S Telstra Wi-Fi 4G modem works exactly like that, but it has to be activated first. Easy if you can use Windows computer but somewhat tricky if your run Windows-free system. I activated Sierra Wireless AirCard 760S Telstra Wi-Fi 4G modem on Linux mint recently. Most of it was pretty trivial using www.bigpond.4g over Firefox but as is often the case there was one part which was rather tricky - Sierra asks for executionable (Windows or Mac) to be executed! I saved the windows file BPSignMeUp.exe to disc, installed wine and after some tinkering with winecfg managed to run BPSignMeUp.exe enough to allow it to sign with Telstra. Unfortunately, wine did show only buttons "cancel" and "next" and nothing else! So I accepted blindly all options and www.bigpond.4g reported "connected". I had still no access to web but I was able to find in section: advanced settings | WAN | Setup | Add/Edit Profiles | my user name and password - which were obviously default place-holders only. When I substituted my correct user name and password as provided by Telstra Sierra finally worked as it should. All together it is nice that it is possible to get Sierra Wireless AirCard 760S working with common Linux tools only, but it is not entirely easy sailing. Easier way would be to ask in shop for unlocking of modem, it needs to be done only once. Detailed setup is easy with www.bigpond.4g afterwards. Petr -- <pb-luv@baum.com.au> Petr Baum, P.O.Box 2364, Rowville 3178 fax +61-3-97643342 This message was created in naturally virus-free operating system: Linux