commits

commits@lists.open-mesh.org

1 participants
12373 discussions

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (46f3016b)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit 46f3016bb7b82ceaad74bd5c8e6dbfd49b0e9da2 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 14:29:56 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- 46f3016bb7b82ceaad74bd5c8e6dbfd49b0e9da2 open-mesh/OpenHarbors.textile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index efd38343..a4771f68 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -94,7 +94,7 @@ h3. Solution # Like in scenario A), move the authenticator from the AP into the server room # Client device will have encrypted communication into the server room, AP + wire becomes part of the untrusted medium # No potential to Man-in-the-Middle from outside the server room -# Attacker now *needs a physical key* to the server room to get the sensitive data +# Attacker now *needs a physical key* to the server room to get the sensitive data (or access to the client device) h2. (Additional) Use-cases & Benefits

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (b6a677e3)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit b6a677e3f97684871026b84ff1e58bef612e34e3 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:09:56 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- b6a677e3f97684871026b84ff1e58bef612e34e3 open-mesh/OpenHarbors.textile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index a47f2215..7e1e1603 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -33,7 +33,7 @@ The issue with option 3) is that while it is secure, as the mesh node owner can !OpenHarbors-diagram-freifunk.png! -h3. A) Issues with Passpoint/Hotspot 2.0/OpenRoaming solutions +h3. Issues with Passpoint/Hotspot 2.0/OpenRoaming solutions Industry leaders currently seem to propose and advocate for solutions based on "Passpoint/Hotspot 2.0":https://en.wikipedia.org/wiki/Wi-Fi_hotspot#Hotspot_2.0 (which in turn utilizes/builds upon "WPA-Enterprise":https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#Target_users_(authentication_key_distribution)). Potentially with "WBA OpenRoaming":https://wballiance.com/openroaming/ (Informational RFC: "here":https://datatracker.ietf.org/doc/draft-tomas-openroaming/ or similar trust/contract relations as a federation. Hotspot 2.0 was/is also a requirement for the EU "WiFi4EU":https://wifi4eu.ec.europa.eu/#/home initiative/funding.

1 0

[doc] backup-redmine,main: doc: open-mesh/university-server-room-scenario-traditional.png (d53713b4)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit d53713b45dcf51a2c12733fc72b0da92829b864a Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:34:13 2024 +0000 doc: open-mesh/university-server-room-scenario-traditional.png >--------------------------------------------------------------- d53713b45dcf51a2c12733fc72b0da92829b864a .../university-server-room-scenario-traditional.png | Bin 0 -> 23258 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/open-mesh/university-server-room-scenario-traditional.png b/open-mesh/university-server-room-scenario-traditional.png new file mode 100644 index 00000000..6084b950 Binary files /dev/null and b/open-mesh/university-server-room-scenario-traditional.png differ

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (ff86660a)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit ff86660a5096b602a2497c6b2d764ae3cc260cf8 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:27:26 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- ff86660a5096b602a2497c6b2d764ae3cc260cf8 open-mesh/OpenHarbors.textile | 1 + 1 file changed, 1 insertion(+) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index 5ee85045..d119eabb 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -72,6 +72,7 @@ Or in other words, move the 802.1x authenticator from the AP to a remote host of h2. Scenario B) Hospital/University/Company/... + h3. (Additional) Use-cases & Benefits This proposed, dynamic solution yields the following, additional interesting opportunities:

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (505212df)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit 505212dfbae393977e364079cf01cb7e33313cd8 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:11:01 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- 505212dfbae393977e364079cf01cb7e33313cd8 open-mesh/OpenHarbors.textile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index 7e1e1603..5ee85045 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -70,7 +70,7 @@ Or in other words, move the 802.1x authenticator from the AP to a remote host of !OpenHarbors-diagram.png! -h3. S +h2. Scenario B) Hospital/University/Company/... h3. (Additional) Use-cases & Benefits

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (04ec5579)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit 04ec55798a0696ddb839af1cd0c18f861cb74a49 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:09:14 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- 04ec55798a0696ddb839af1cd0c18f861cb74a49 open-mesh/OpenHarbors.textile | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index 48316bc0..a47f2215 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -4,9 +4,7 @@ h1. Idea/Draft: OpenHarbors ("Gotham Docks" / "WPA over L2TP") This document specifies a way to dynamically tunnel WPA over a potentially untrusted IP network to a gateway of the user's choice. -h2. Issues - -h3. A) - Issues in Decentral Wireless Community Mesh Networks +h2. Scenario A): Decentral Wireless Community Mesh Networks In a wireless community mesh network like "Freifunk":https://en.wikipedia.org/wiki/Freifunk involving "batman-adv":https://www.open-mesh.org/projects/batman-adv/wiki/ + "Gluon":https://github.com/freifunk-gluon/gluon/: @@ -14,6 +12,8 @@ In a wireless community mesh network like "Freifunk":https://en.wikipedia.org/wi # No prior authorization, anonymous participation possible # Uses a firmware with public OpenSource code +h3. Issues in Decentral Wireless Community Mesh Networks + Currently has the following two issues: # A user's internet traffic is typically unencrypted in the WLAN mesh cloud (except for https etc.) @@ -70,6 +70,8 @@ Or in other words, move the 802.1x authenticator from the AP to a remote host of !OpenHarbors-diagram.png! +h3. S + h3. (Additional) Use-cases & Benefits This proposed, dynamic solution yields the following, additional interesting opportunities:

1 0

[doc] backup-redmine,main: doc: open-mesh/university-server-room-scenario-tunneled.png (1a5a64af)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit 1a5a64af2557e72209eb7adfc73e9e84ba5fa49e Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:34:16 2024 +0000 doc: open-mesh/university-server-room-scenario-tunneled.png >--------------------------------------------------------------- 1a5a64af2557e72209eb7adfc73e9e84ba5fa49e open-mesh/university-server-room-scenario-tunneled.png | Bin 0 -> 19587 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/open-mesh/university-server-room-scenario-tunneled.png b/open-mesh/university-server-room-scenario-tunneled.png new file mode 100644 index 00000000..a101ee74 Binary files /dev/null and b/open-mesh/university-server-room-scenario-tunneled.png differ

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (b380c08e)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit b380c08ecc0ac0be627495c51d2aa2199f1752f1 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:53:59 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- b380c08ecc0ac0be627495c51d2aa2199f1752f1 open-mesh/OpenHarbors.textile | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index d119eabb..1bcaf4cc 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -72,8 +72,31 @@ Or in other words, move the 802.1x authenticator from the AP to a remote host of h2. Scenario B) Hospital/University/Company/... +!university-server-room-scenario-traditional.png! -h3. (Additional) Use-cases & Benefits +* An exposed AP, visible/reachable by visitors +* A server with sensitive data +* Authorized employees/students/... accessing the server via WPA Enterprise from their laptop + +h3. Issue + +# Via easy social engineering (e.g. putting on the right cloths, suitcase, a ladder): +** can get physical access to the AP +# Can then copy the AP's flash and extract RADIUS credentials +# Can then replace with a rogue Man-in-the-Middle AP or install a backdoor +** If no extra encryption/authentication is used between AP<->server then can also simply add a snooping device between AP and wire +# Now has access to sensitive data in the locked server room + +h3. Solution + +!university-server-room-scenario-tunneled.png! + +# Like in scenario A), move the authenticator from the AP into the server room +# Client device will have encrypted communication into the server room, AP + wire becomes part of the untrusted medium +# No potential to Man-in-the-Middle from outside the server room +# Attacker now *needs a physical key* to the server room to get the sensitive data + +h2. (Additional) Use-cases & Benefits This proposed, dynamic solution yields the following, additional interesting opportunities:

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (cce8a202)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit cce8a202712a1f828bd92bba9810bef5587a05db Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 14:25:51 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- cce8a202712a1f828bd92bba9810bef5587a05db open-mesh/OpenHarbors.textile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index 1bcaf4cc..c09657f2 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -75,7 +75,7 @@ h2. Scenario B) Hospital/University/Company/... !university-server-room-scenario-traditional.png! * An exposed AP, visible/reachable by visitors -* A server with sensitive data +* A server with sensitive data inside a locked server room * Authorized employees/students/... accessing the server via WPA Enterprise from their laptop h3. Issue

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (130f1e45)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit 130f1e4508a94d66baf8a4a38a49d6dde539e493 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 14:27:35 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- 130f1e4508a94d66baf8a4a38a49d6dde539e493 open-mesh/OpenHarbors.textile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index c09657f2..9d3815fc 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -84,7 +84,7 @@ h3. Issue ** can get physical access to the AP # Can then copy the AP's flash and extract RADIUS credentials # Can then replace with a rogue Man-in-the-Middle AP or install a backdoor -** If no extra encryption/authentication is used between AP<->server then can also simply add a snooping device between AP and wire +** If no extra encryption/authentication is used between AP<->server then can also simply add a snooping device between AP and wire to server # Now has access to sensitive data in the locked server room h3. Solution

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

commits