commits August 2024

commits@lists.open-mesh.org

1 participants
41 discussions

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (b380c08e)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit b380c08ecc0ac0be627495c51d2aa2199f1752f1 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:53:59 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- b380c08ecc0ac0be627495c51d2aa2199f1752f1 open-mesh/OpenHarbors.textile | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index d119eabb..1bcaf4cc 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -72,8 +72,31 @@ Or in other words, move the 802.1x authenticator from the AP to a remote host of h2. Scenario B) Hospital/University/Company/... +!university-server-room-scenario-traditional.png! -h3. (Additional) Use-cases & Benefits +* An exposed AP, visible/reachable by visitors +* A server with sensitive data +* Authorized employees/students/... accessing the server via WPA Enterprise from their laptop + +h3. Issue + +# Via easy social engineering (e.g. putting on the right cloths, suitcase, a ladder): +** can get physical access to the AP +# Can then copy the AP's flash and extract RADIUS credentials +# Can then replace with a rogue Man-in-the-Middle AP or install a backdoor +** If no extra encryption/authentication is used between AP<->server then can also simply add a snooping device between AP and wire +# Now has access to sensitive data in the locked server room + +h3. Solution + +!university-server-room-scenario-tunneled.png! + +# Like in scenario A), move the authenticator from the AP into the server room +# Client device will have encrypted communication into the server room, AP + wire becomes part of the untrusted medium +# No potential to Man-in-the-Middle from outside the server room +# Attacker now *needs a physical key* to the server room to get the sensitive data + +h2. (Additional) Use-cases & Benefits This proposed, dynamic solution yields the following, additional interesting opportunities:

1 0

[doc] backup-redmine,main: doc: open-mesh/university-server-room-scenario-tunneled.png (1a5a64af)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit 1a5a64af2557e72209eb7adfc73e9e84ba5fa49e Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:34:16 2024 +0000 doc: open-mesh/university-server-room-scenario-tunneled.png >--------------------------------------------------------------- 1a5a64af2557e72209eb7adfc73e9e84ba5fa49e open-mesh/university-server-room-scenario-tunneled.png | Bin 0 -> 19587 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/open-mesh/university-server-room-scenario-tunneled.png b/open-mesh/university-server-room-scenario-tunneled.png new file mode 100644 index 00000000..a101ee74 Binary files /dev/null and b/open-mesh/university-server-room-scenario-tunneled.png differ

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (04ec5579)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit 04ec55798a0696ddb839af1cd0c18f861cb74a49 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:09:14 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- 04ec55798a0696ddb839af1cd0c18f861cb74a49 open-mesh/OpenHarbors.textile | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index 48316bc0..a47f2215 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -4,9 +4,7 @@ h1. Idea/Draft: OpenHarbors ("Gotham Docks" / "WPA over L2TP") This document specifies a way to dynamically tunnel WPA over a potentially untrusted IP network to a gateway of the user's choice. -h2. Issues - -h3. A) - Issues in Decentral Wireless Community Mesh Networks +h2. Scenario A): Decentral Wireless Community Mesh Networks In a wireless community mesh network like "Freifunk":https://en.wikipedia.org/wiki/Freifunk involving "batman-adv":https://www.open-mesh.org/projects/batman-adv/wiki/ + "Gluon":https://github.com/freifunk-gluon/gluon/: @@ -14,6 +12,8 @@ In a wireless community mesh network like "Freifunk":https://en.wikipedia.org/wi # No prior authorization, anonymous participation possible # Uses a firmware with public OpenSource code +h3. Issues in Decentral Wireless Community Mesh Networks + Currently has the following two issues: # A user's internet traffic is typically unencrypted in the WLAN mesh cloud (except for https etc.) @@ -70,6 +70,8 @@ Or in other words, move the 802.1x authenticator from the AP to a remote host of !OpenHarbors-diagram.png! +h3. S + h3. (Additional) Use-cases & Benefits This proposed, dynamic solution yields the following, additional interesting opportunities:

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (505212df)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit 505212dfbae393977e364079cf01cb7e33313cd8 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:11:01 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- 505212dfbae393977e364079cf01cb7e33313cd8 open-mesh/OpenHarbors.textile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index 7e1e1603..5ee85045 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -70,7 +70,7 @@ Or in other words, move the 802.1x authenticator from the AP to a remote host of !OpenHarbors-diagram.png! -h3. S +h2. Scenario B) Hospital/University/Company/... h3. (Additional) Use-cases & Benefits

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (ff86660a)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit ff86660a5096b602a2497c6b2d764ae3cc260cf8 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:27:26 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- ff86660a5096b602a2497c6b2d764ae3cc260cf8 open-mesh/OpenHarbors.textile | 1 + 1 file changed, 1 insertion(+) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index 5ee85045..d119eabb 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -72,6 +72,7 @@ Or in other words, move the 802.1x authenticator from the AP to a remote host of h2. Scenario B) Hospital/University/Company/... + h3. (Additional) Use-cases & Benefits This proposed, dynamic solution yields the following, additional interesting opportunities:

1 0

[doc] backup-redmine,main: doc: open-mesh/university-server-room-scenario-traditional.png (d53713b4)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit d53713b45dcf51a2c12733fc72b0da92829b864a Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:34:13 2024 +0000 doc: open-mesh/university-server-room-scenario-traditional.png >--------------------------------------------------------------- d53713b45dcf51a2c12733fc72b0da92829b864a .../university-server-room-scenario-traditional.png | Bin 0 -> 23258 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/open-mesh/university-server-room-scenario-traditional.png b/open-mesh/university-server-room-scenario-traditional.png new file mode 100644 index 00000000..6084b950 Binary files /dev/null and b/open-mesh/university-server-room-scenario-traditional.png differ

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (b6a677e3)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit b6a677e3f97684871026b84ff1e58bef612e34e3 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:09:56 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- b6a677e3f97684871026b84ff1e58bef612e34e3 open-mesh/OpenHarbors.textile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index a47f2215..7e1e1603 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -33,7 +33,7 @@ The issue with option 3) is that while it is secure, as the mesh node owner can !OpenHarbors-diagram-freifunk.png! -h3. A) Issues with Passpoint/Hotspot 2.0/OpenRoaming solutions +h3. Issues with Passpoint/Hotspot 2.0/OpenRoaming solutions Industry leaders currently seem to propose and advocate for solutions based on "Passpoint/Hotspot 2.0":https://en.wikipedia.org/wiki/Wi-Fi_hotspot#Hotspot_2.0 (which in turn utilizes/builds upon "WPA-Enterprise":https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#Target_users_(authentication_key_distribution)). Potentially with "WBA OpenRoaming":https://wballiance.com/openroaming/ (Informational RFC: "here":https://datatracker.ietf.org/doc/draft-tomas-openroaming/ or similar trust/contract relations as a federation. Hotspot 2.0 was/is also a requirement for the EU "WiFi4EU":https://wifi4eu.ec.europa.eu/#/home initiative/funding.

1 0

[doc] backup-redmine,main: doc: open-mesh/university-server-room-scenario.dia (7d29592b)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit 7d29592b9322bad2b14d6cd9710eeaf6a9c00b86 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:34:10 2024 +0000 doc: open-mesh/university-server-room-scenario.dia >--------------------------------------------------------------- 7d29592b9322bad2b14d6cd9710eeaf6a9c00b86 open-mesh/university-server-room-scenario.dia | Bin 0 -> 2508 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/open-mesh/university-server-room-scenario.dia b/open-mesh/university-server-room-scenario.dia new file mode 100644 index 00000000..3aa06a29 Binary files /dev/null and b/open-mesh/university-server-room-scenario.dia differ

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (f0e017d2)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit f0e017d23f7ce2fa7f322624c36823a59afca025 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:04:57 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- f0e017d23f7ce2fa7f322624c36823a59afca025 open-mesh/OpenHarbors.textile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index 29c60a6a..48316bc0 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -12,7 +12,7 @@ In a wireless community mesh network like "Freifunk":https://en.wikipedia.org/wi # Anyone can setup a node to join + contribute to the mesh # No prior authorization, anonymous participation possible -# Uses OpenSource firmware code +# Uses a firmware with public OpenSource code Currently has the following two issues:

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (336ec2ca)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit 336ec2ca5b1a1bfb9d43ee16a0b4113b012fe009 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:03:25 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- 336ec2ca5b1a1bfb9d43ee16a0b4113b012fe009 open-mesh/OpenHarbors.textile | 1 + 1 file changed, 1 insertion(+) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index 49030f1b..27470545 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -11,6 +11,7 @@ h3. A) - Issues in Decentral Wireless Community Mesh Networks In a wireless community mesh network like "Freifunk":https://en.wikipedia.org/wiki/Freifunk involving "batman-adv":https://www.open-mesh.org/projects/batman-adv/wiki/ + "Gluon":https://github.com/freifunk-gluon/gluon/: # Anyone can setup a node to join + contribute to the mesh +# OpenSource firmware code # No prior authorization, anonymous participation possible Currently has the following two issues:

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

commits August 2024