commits

commits@lists.open-mesh.org

1 participants
12373 discussions

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (24781b1a)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit 24781b1a0ebcc3e01bddc689eef9cdb5ed1370ed Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 14:28:09 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- 24781b1a0ebcc3e01bddc689eef9cdb5ed1370ed open-mesh/OpenHarbors.textile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index 9d3815fc..efd38343 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -84,7 +84,7 @@ h3. Issue ** can get physical access to the AP # Can then copy the AP's flash and extract RADIUS credentials # Can then replace with a rogue Man-in-the-Middle AP or install a backdoor -** If no extra encryption/authentication is used between AP<->server then can also simply add a snooping device between AP and wire to server +** If no extra encryption/authentication/tunnel is used between AP<->server then can also simply add a snooping device between AP and wire to server # Now has access to sensitive data in the locked server room h3. Solution

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (750371d4)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit 750371d4a03b3396cc88b8bcce23d061306ee9f7 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 11:57:17 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- 750371d4a03b3396cc88b8bcce23d061306ee9f7 open-mesh/OpenHarbors.textile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index 79cb85a9..d35a66db 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -21,7 +21,7 @@ Gluon also supports adding the following three types of WLAN encryption: # "OWE":https://en.wikipedia.org/wiki/Opportunistic_Wireless_Encryption to encrypt traffic from a user device to the direct mesh node / AP: "OWE on client network":https://gluon.readthedocs.io/en/latest/releases/v2020.2.html#owe-on-client-network # A "''Private WiFi''":https://gluon.readthedocs.io/en/latest/features/private-wlan.html with WPA-Personal/preshared key encryption, simply bridged to a mesh node's WAN port -While 1)+2) protects against passive snooping, it however **does not protect against an active attacker** in an open, public network like Freifunk. Due to the open nature of Freifunk, the SAE password would need to be published / added to the firmware (source code) to allow anyone to setup their own mesh node. So overall Freifunk even with 1)+2) would still be susceptible to Man-in-the-Middle attacks. +While 1)+2) protects against passive snooping, it however **does not protect against an active attacker in an open, public network** like Freifunk. Due to the open nature of Freifunk, the SAE password would need to be published / added to the firmware (source code) to allow anyone to setup their own mesh node. So overall Freifunk even with 1)+2) would still be susceptible to Man-in-the-Middle attacks. The issue with option 3) is that while it is secure, as the mesh node owner can configure their own, private password for it in the Gluon Config-Mode Web-GUI of their Gluon mesh router, it can't be used on foreign, other mesh nodes over the mesh network. There is no secure tunneling or provisioning/collaboration between mesh nodes for the "Private WiFi" feature in Gluon.

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (ef79c3c0)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit ef79c3c0d9f6fdac36d53b78fe05c89748605c2f Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:01:36 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- ef79c3c0d9f6fdac36d53b78fe05c89748605c2f open-mesh/OpenHarbors.textile | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index f8afcceb..539a38b9 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -8,7 +8,12 @@ h2. Issues h3. A) - Issues in Decentral Wireless Community Mesh Networks -In a wireless community mesh network like "Freifunk":https://en.wikipedia.org/wiki/Freifunk involving "batman-adv":https://www.open-mesh.org/projects/batman-adv/wiki/ + "Gluon":https://github.com/freifunk-gluon/gluon/ has two issues: +In a wireless community mesh network like "Freifunk":https://en.wikipedia.org/wiki/Freifunk involving "batman-adv":https://www.open-mesh.org/projects/batman-adv/wiki/ + "Gluon":https://github.com/freifunk-gluon/gluon/: + +# Anyone can setup a node to join + contribute to the mesh +# No prior authorization, anonymous participation possible + +has two issues: # A user's internet traffic is typically unencrypted in the WLAN mesh cloud (except for https etc.) # A set of central gateways behind a VPN tunnel is used for internet traffic (which contradicts Freifunk's philosophy of decentralization, but became defacto mandatory due to for private people unclear Secondary Liability law in Germany: "''Störerhaftung''":https://de.wikipedia.org/wiki/St%C3%B6rerhaftung)

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (5a8662f8)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit 5a8662f829903bd6ec8ce45d043f6e49167b41a7 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:03:57 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- 5a8662f829903bd6ec8ce45d043f6e49167b41a7 open-mesh/OpenHarbors.textile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index 27470545..29c60a6a 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -11,8 +11,8 @@ h3. A) - Issues in Decentral Wireless Community Mesh Networks In a wireless community mesh network like "Freifunk":https://en.wikipedia.org/wiki/Freifunk involving "batman-adv":https://www.open-mesh.org/projects/batman-adv/wiki/ + "Gluon":https://github.com/freifunk-gluon/gluon/: # Anyone can setup a node to join + contribute to the mesh -# OpenSource firmware code # No prior authorization, anonymous participation possible +# Uses OpenSource firmware code Currently has the following two issues:

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (41e38975)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit 41e389756fb063bf1ce997a9d3dd19f669542c58 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:02:15 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- 41e389756fb063bf1ce997a9d3dd19f669542c58 open-mesh/OpenHarbors.textile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index 539a38b9..49030f1b 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -13,7 +13,7 @@ In a wireless community mesh network like "Freifunk":https://en.wikipedia.org/wi # Anyone can setup a node to join + contribute to the mesh # No prior authorization, anonymous participation possible -has two issues: +Currently has the following two issues: # A user's internet traffic is typically unencrypted in the WLAN mesh cloud (except for https etc.) # A set of central gateways behind a VPN tunnel is used for internet traffic (which contradicts Freifunk's philosophy of decentralization, but became defacto mandatory due to for private people unclear Secondary Liability law in Germany: "''Störerhaftung''":https://de.wikipedia.org/wiki/St%C3%B6rerhaftung)

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (336ec2ca)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit 336ec2ca5b1a1bfb9d43ee16a0b4113b012fe009 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:03:25 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- 336ec2ca5b1a1bfb9d43ee16a0b4113b012fe009 open-mesh/OpenHarbors.textile | 1 + 1 file changed, 1 insertion(+) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index 49030f1b..27470545 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -11,6 +11,7 @@ h3. A) - Issues in Decentral Wireless Community Mesh Networks In a wireless community mesh network like "Freifunk":https://en.wikipedia.org/wiki/Freifunk involving "batman-adv":https://www.open-mesh.org/projects/batman-adv/wiki/ + "Gluon":https://github.com/freifunk-gluon/gluon/: # Anyone can setup a node to join + contribute to the mesh +# OpenSource firmware code # No prior authorization, anonymous participation possible Currently has the following two issues:

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (f0e017d2)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit f0e017d23f7ce2fa7f322624c36823a59afca025 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:04:57 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- f0e017d23f7ce2fa7f322624c36823a59afca025 open-mesh/OpenHarbors.textile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index 29c60a6a..48316bc0 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -12,7 +12,7 @@ In a wireless community mesh network like "Freifunk":https://en.wikipedia.org/wi # Anyone can setup a node to join + contribute to the mesh # No prior authorization, anonymous participation possible -# Uses OpenSource firmware code +# Uses a firmware with public OpenSource code Currently has the following two issues:

1 0

[doc] backup-redmine,main: doc: open-mesh/university-server-room-scenario.dia (7d29592b)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit 7d29592b9322bad2b14d6cd9710eeaf6a9c00b86 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 12:34:10 2024 +0000 doc: open-mesh/university-server-room-scenario.dia >--------------------------------------------------------------- 7d29592b9322bad2b14d6cd9710eeaf6a9c00b86 open-mesh/university-server-room-scenario.dia | Bin 0 -> 2508 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/open-mesh/university-server-room-scenario.dia b/open-mesh/university-server-room-scenario.dia new file mode 100644 index 00000000..3aa06a29 Binary files /dev/null and b/open-mesh/university-server-room-scenario.dia differ

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (b9d41c5c)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit b9d41c5cee8370a28f6a4df431e75a91382a565b Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 11:54:16 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- b9d41c5cee8370a28f6a4df431e75a91382a565b open-mesh/OpenHarbors.textile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index f4fd34ab..a08ed06d 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -6,7 +6,7 @@ This document specifies a way to dynamically tunnel WPA over a potentially untru h2. Issues -h3. A) - Decentral Wireless Community Mesh Networks +h3. A) - Issues in Decentral Wireless Community Mesh Networks In a wireless community mesh network like "Freifunk":https://en.wikipedia.org/wiki/Freifunk involving "batman-adv":https://www.open-mesh.org/projects/batman-adv/wiki/ + "Gluon":https://github.com/freifunk-gluon/gluon/ has two issues:

1 0

[doc] backup-redmine,main: doc: open-mesh/OpenHarbors (7cf1a46c)
by postmaster＠open-mesh.org 03 Aug '24

03 Aug '24

Repository : ssh://git@diktynna/doc On branches: backup-redmine,main >--------------------------------------------------------------- commit 7cf1a46c50460a1c9a746b3e8f72d8d3a8c6b5b4 Author: Linus Lüssing <linus.luessing(a)c0d3.blue> Date: Mon Jul 8 11:56:44 2024 +0000 doc: open-mesh/OpenHarbors >--------------------------------------------------------------- 7cf1a46c50460a1c9a746b3e8f72d8d3a8c6b5b4 open-mesh/OpenHarbors.textile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/open-mesh/OpenHarbors.textile b/open-mesh/OpenHarbors.textile index e5716a74..79cb85a9 100644 --- a/open-mesh/OpenHarbors.textile +++ b/open-mesh/OpenHarbors.textile @@ -21,7 +21,7 @@ Gluon also supports adding the following three types of WLAN encryption: # "OWE":https://en.wikipedia.org/wiki/Opportunistic_Wireless_Encryption to encrypt traffic from a user device to the direct mesh node / AP: "OWE on client network":https://gluon.readthedocs.io/en/latest/releases/v2020.2.html#owe-on-client-network # A "''Private WiFi''":https://gluon.readthedocs.io/en/latest/features/private-wlan.html with WPA-Personal/preshared key encryption, simply bridged to a mesh node's WAN port -While 1)+2) protects against passive snooping, it however does not protect against an active attacker in an open, public network like Freifunk. Due to the open nature of Freifunk, the SAE password would need to be published / added to the firmware (source code) to allow anyone to setup their own mesh node. So overall Freifunk even with 1)+2) would still be susceptible to Man-in-the-Middle attacks. +While 1)+2) protects against passive snooping, it however **does not protect against an active attacker** in an open, public network like Freifunk. Due to the open nature of Freifunk, the SAE password would need to be published / added to the firmware (source code) to allow anyone to setup their own mesh node. So overall Freifunk even with 1)+2) would still be susceptible to Man-in-the-Middle attacks. The issue with option 3) is that while it is secure, as the mesh node owner can configure their own, private password for it in the Gluon Config-Mode Web-GUI of their Gluon mesh router, it can't be used on foreign, other mesh nodes over the mesh network. There is no secure tunneling or provisioning/collaboration between mesh nodes for the "Private WiFi" feature in Gluon.

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

commits