Patching/Upgrading OpenSSL
-
What is really missing for Web UI is the IP lockout if someone tries to brute force password.
That actually is NOT missing at all… you are welcome to try and lock yourself out. :P
-
VPN or SSH is best. Letting anyone even touch your GUI port remotely from an arbitrary IP is a bad thing. As this proves, it's not about a password, it's about exploiting the service itself. Custom ports won't hide you for long.
Are you saying VPN or SSH never had any security issues? Don't think so. VPN is also not convenient - does not work from many locations. SSH is better, but theoretically can be exploited as well - with the bug you do not know about (yet).
Not had any? No, but generally a better track record. If you protect access to the GUI properly behind a VPN, then even if the encryption of the VPN has failed (see PPTP) it is still useful for access control as an additional layer of protection/authentication.
OpenVPN works from anywhere that you can make an HTTPS connection from if you run it the right way(s). And the fact that it isn't convenient is a plus, not a minus.
What is really missing for Web UI is the IP lockout if someone tries to brute force password.
That's already present. But you don't want the world to be able to hit your GUI port directly anyhow, so it's more useful against local attackers/infected local hosts, but it is there.
-
For those complaining about lack of updates, you clearly are not working in the I.T Field.
I hate when something goes down, you get 100 people contacting you "crap is down..when will it be backup" and then people who linger over your shoulder like that is going to help.
It will be fixed when they get it fixed so don't get angry if all you get is 1 daily update, think of the time they are not wasting answering the forums and instead working on the problem.
as said, if you have your GUI open to the internet, lock it down, IP restrictions, port changes, what ever!
-
Not had any? No, but generally a better track record. If you protect access to the GUI properly behind a VPN, then even if the encryption of the VPN has failed (see PPTP) it is still useful for access control as an additional layer of protection/authentication.
OpenVPN works from anywhere that you can make an HTTPS connection from if you run it the right way(s). And the fact that it isn't convenient is a plus, not a minus.
Well, openssl had excellent track record up to about 2 days ago as well.
That's already present. But you don't want the world to be able to hit your GUI port directly anyhow, so it's more useful against local attackers/infected local hosts, but it is there.
Did not see any setting to limit number of bad login attempts, did not see it clearly documented…
If it is there - good.As far as WebUI - I suggest everyone makes their own risk analysis. Information is out there to make a proper judgement and having WebUI open is not that bad as you try to describe (when TLS is not broken, of course and IP restrictions are in place).
-
I have always disabled the WebGUI to the outside world. I have on occasion specified one or 2 IP's that can access it if I knew I was going to be working on it from that location for a while. I.E. When working the firewall located at my house while at work I would allow just that one IP. Otherwise I use OpenVPN to access it.
Isn't this firewall security 101?
-
I have always disabled the WebGUI to the outside world. I have on occasion specified one or 2 IP's that can access it if I knew I was going to be working on it from that location for a while. I.E. When working the firewall located at my house while at work I would allow just that one IP. Otherwise I use OpenVPN to access it.
Isn't this firewall security 101?
Yep. Looks like you get an A.
-
2 quick questions.
I'm still on 2.0.3, can I go directly to 2.1.2 once it's out ?
Was 2.0.3 even vulnerable ? -
@Satras:
I'm still on 2.0.3, can I go directly to 2.1.2 once it's out ?
Yes.
@Satras:
Was 2.0.3 even vulnerable ?
No. Only if you used the Unbound package.
-
As far as WebUI - I suggest everyone makes their own risk analysis. Information is out there to make a proper judgement and having WebUI open is not that bad as you try to describe (when TLS is not broken, of course and IP restrictions are in place).
I tend to agree with this. I'm using it in a home environment, not a corporate production network. Sometimes things break when I'm not there, and given that I'm the only person who knows anything about IT in the house it falls to me to fix it (often quickly due to some perceived life-or-death situation that really isn't as important as it's made out to be, ah the joys of family).
Risk assessment = minimal, as far as I'm concerned. There are plenty more interesting networks out there to play around in than mine.
-
It's not really a question of your network being uninteresting. It's far more likely to be some bot that grabs your login details and turns your router into a spam relay. The bot doesn't care how interesting your network is.
Like any risk assessment you have to consider both the chances of something happening and the consequences. If the potential consequence is that your firewall is compromised leading to your internal machines being compromised requiring complete re-install of everything - is that a risk worth taking?Steve
-
It's not really a question of your network being uninteresting. It's far more likely to be some bot that grabs your login details and turns your router into a spam relay.
And you would be amazed how often this happens via SSH with weak root password!
-
Weak Passwords and root? Authorized_keys only, AllowUsers, Port only open to specific IP or Range.. Those who use root-access with weak passwords won't start updating now, so this will always be a lost cause.
-
Weak Passwords and root? Authorized_keys only, AllowUsers, Port only open to specific IP or Range.. Those who use root-access with weak passwords won't start updating now, so this will always be a lost cause.
And that is my point - it is not the protocol, which is "bad", it is how it is being used.
-
-
-
It's not really a question of your network being uninteresting. It's far more likely to be some bot that grabs your login details and turns your router into a spam relay. The bot doesn't care how interesting your network is.
I grant you, this is possible. That said, there have to be hundreds of thousands of other home networks just on my ISP alone, notwithstanding the dozen or so other ISPs in this country. Any one of them would make a perfectly tempting target for such a bot (even more so given the fact that most home routers are virtually never updated). I'd also like to take this opportunity to point out that there's only so much that one can do with 2Mbps upstream.
Like any risk assessment you have to consider both the chances of something happening and the consequences. If the potential consequence is that your firewall is compromised leading to your internal machines being compromised requiring complete re-install of everything - is that a risk worth taking?
For that, someone would have to not only get through the firewall but through the internal machines too, which are not exactly unprotected themselves.
All said, you've made your case, and while I stand by my original point that my network is simply not interesting enough to warrant targeting, I'm going to take a look at the feasibility of setting up a basic VPN solution in pfSense to handle remote support requirements.
-
@ingenieurmt:
my network is simply not interesting enough to warrant targeting,
No Offend, but this Attitude makes you a prime Target. People believeing they are save cause they are not interresting enough.
-
Everyone is interesting to an indiscriminate bot scanning for hosts to exploit.
-
Use VPN
OpenVPN is vulnerable too.
Only if used in SSL/TLS mode without a TLS authentication key. The way the wizard sets it up for a simple RA VPN for management use it would not be vulnerable.
Yeah, that's good news. When I have once manually set up my OpenVPN server without the wizard I did not exactly understand what this setting would achieve but considered it safe. I have just found your statement confirmed in the OpenVPN community:
https://community.openvpn.net/openvpn/wiki/heartbleed
Peter
-
So there are two versions of openssl in pfsense:
/usr/bin/openssl - OpenSSL 0.9.8y 5 Feb 2013 which is the base system openssl
and
/usr/local/bin/openssl - OpenSSL 1.0.1e 11 Feb 2013 which presumably was installed via the ports system to get a more recent version because of dependencies
A simple freebsd-update fetch; freebsd-update install will take care of the first version of openssl.
The second version (/usr/local/bin/openssl) will need to be compiled on a 8.3-p11 system via ports to get 1.0.1g. openvpn 2.3.2 needs to be rebuilt from ports along with lighttpd 1.4.32. Move all of this over then while in single user mode.
Not terribly difficult, but time consuming - but doable if you need a fix ASAP.
NOTE: There may be other dependencies on openssl that I've missed. lighttpd and openvpn are the obvious ones.
