44net

44net@mailman.ampr.org

3196 discussions

Re: [44net] Security - Telnet (port tcp/23)
by Rob Janssen 29 Sep '16

29 Sep '16

> The term to search for is 'honeypot'. There are many such scripts out there > on github and on the web in general. That is correct. In my case I quickly hacked something together but there are lots of examples to be found that are probably much more advanced. When I had SSH open to the world, I saw similar usernames in the failure log as I now see on this telnet honeypot. Rob

2 1

Re: [44net] Security - Telnet (port tcp/23)
by Gabriel Medinas 29 Sep '16

29 Sep '16

Hello Lynwood, I had in my JNOS virtually a lot of attempts connections to port 23 from all part of the world, to achieve forwarding to other BBS had change the telnet port to 2323 and substantially lower these attempts. When I speak attempts to port 23 are evidence of brute force, it is almost impossible to have open this port, also same the 20, 21, 443, etc. 73 Gabriel YV5KXE. Venezuela AmprNet Coordinator yv5kxe.ampr.org Date: Thu, 29 Sep 2016 12:15:57 -0400 From: lleachii(a)aol.com To: 44net(a)hamradio.ucsd.edu Subject:Date: Thu, 29 Sep 2016 12:15:57 -0400 From: lleachii(a)aol.com To: 44net(a)hamradio.ucsd.edu Subject: [44net] Security - Telnet (port tcp/23) Message-ID: <8c28faa2-76ff-45a9-06c6-1705433cf307(a)aol.com> Content-Type: text/plain; charset=windows-1252; format=flowed All, In June, we discussed a topic entitled: "Odd Username attempts at login" where Bill, KG6BAJ noticed odd connection attempts to his JNOS system via Telnet. I have recently been working on my SNMP and NetFlow servers, and noticed quite a bit of Telnet connection attempts from Asia, Europe and South America. While I have also seen SSH, RDP, NTP, ICMP and VNC, by far the largest amount of traffic reaching my border interface is Telnet. Doing some research, I discovered that NIC.CZ <http://nic.cz/> has been operating the Turris Project. They have determined that these attempts are coming from a botnet of embedded devices that have Telnet vulnerabilities. I have provided a link to those findings here: https://en.blog.nic.cz/2016/09/01/telnet-is-not-dead-at- least-not-on-smart-devices/ 09-28 19:57:36 0.000 TCP 60.189.137.98:28940 -> 44.60.44.128:2323 09-28 19:57:55 0.000 TCP 115.219.124.37:49067 -> 44.60.44.133:23 09-28 19:57:55 0.000 TCP 222.124.85.17:34905 -> 44.60.44.133:23 09-28 19:57:52 5.552 TCP 190.67.215.114:29593 -> 44.60.44.6:23 09-28 19:58:03 0.123 TCP 115.219.124.37:21070 -> 44.60.44.133:23 09-28 19:58:54 0.000 TCP 116.102.62.182:37311 -> 44.60.44.135:23 Please be mindful. 73, - Lynwood KB3VWG

1 0

Security - Telnet (port tcp/23)
by lleachii＠aol.com 29 Sep '16

29 Sep '16

All, In June, we discussed a topic entitled: "Odd Username attempts at login" where Bill, KG6BAJ noticed odd connection attempts to his JNOS system via Telnet. I have recently been working on my SNMP and NetFlow servers, and noticed quite a bit of Telnet connection attempts from Asia, Europe and South America. While I have also seen SSH, RDP, NTP, ICMP and VNC, by far the largest amount of traffic reaching my border interface is Telnet. Doing some research, I discovered that NIC.CZ has been operating the Turris Project. They have determined that these attempts are coming from a botnet of embedded devices that have Telnet vulnerabilities. I have provided a link to those findings here: https://en.blog.nic.cz/2016/09/01/telnet-is-not-dead-at-least-not-on-smart-… 09-28 19:57:36 0.000 TCP 60.189.137.98:28940 -> 44.60.44.128:2323 09-28 19:57:55 0.000 TCP 115.219.124.37:49067 -> 44.60.44.133:23 09-28 19:57:55 0.000 TCP 222.124.85.17:34905 -> 44.60.44.133:23 09-28 19:57:52 5.552 TCP 190.67.215.114:29593 -> 44.60.44.6:23 09-28 19:58:03 0.123 TCP 115.219.124.37:21070 -> 44.60.44.133:23 09-28 19:58:54 0.000 TCP 116.102.62.182:37311 -> 44.60.44.135:23 Please be mindful. 73, - Lynwood KB3VWG

2 1

Re: [44net] Fwd: MicroTik and Dumb Questions
by Rob Janssen 29 Sep '16

29 Sep '16

> You need to use mangle rules in firewall to mark the incoming packets from the gateway interface and then using route marking route them back out the way they came. That is another approach, but you will have to handle outgoing connections as well. Rob

3 4

Fwd: MicroTik and Dumb Questions
by Miguel Rodriguez 26 Sep '16

26 Sep '16

Good evening/morning folks! I have some dumb questions about setting up the MicroTik. I currently have everything set(I got all the RIP records and routes created), however, it can't talk to the internet. I'm trying to figure out, would this be a firewall issue? Do I need to create a whole new NIC just for the 44net? Basically, where should I go from here? Thanks, Miguel Rodriguez 12th Grade Student miguemely101(a)gmail.com <javascript:_e(%7B%7D,'cvml','miguemely101(a)gmail.com');> Tel: *561-758-0631* *Accredited District Since 2008; Re-certification - January 2013* Home of Florida's first LEED Gold Certified School *Disclaimer*: Under Florida law, e-mail addresses are *public records*. If you do not want your e-mail address released in response to a public records request, do not send electronic mail to this entity. Instead, contact this office by phone or in writing. -- Miguel Rodriguez 12th Grade Student miguemely101(a)gmail.com Tel: *561-758-0631* *Accredited District Since 2008; Re-certification - January 2013* Home of Florida's first LEED Gold Certified School *Disclaimer*: Under Florida law, e-mail addresses are *public records*. If you do not want your e-mail address released in response to a public records request, do not send electronic mail to this entity. Instead, contact this office by phone or in writing.

4 4

Re: [44net] Fwd: MicroTik and Dumb Questions
by Rob Janssen 26 Sep '16

26 Sep '16

> Rob, > I thought the script took care of routing. So I would have to create new routes for 44net to go to the IPIP tunnel? It should not be required for 44net, but only for internet. I.e. for communication between your 44net hosts and systems on internet outside 44net. That traffic has to be forced through the IPIP tunnel to UCSD (169.228.66.251) instead of directly to your ISP, which will drop it. This can be achieved by creating the 44net routes in a different routing table, I'll wait to see if Marius joins the discussion to find how this is best achieved when using his script. I am not using IPIP myself on my MikroTik, I have a VPN to another system and use BGP. There I have configured the BGP to put the routes in a separate routing table named amprnet and configured some IP Route Rules so that this table is used for amprnet traffic only. Rob

2 2

Re: [44net] Fwd: MicroTik and Dumb Questions
by Rob Janssen 26 Sep '16

26 Sep '16

> I have some dumb questions about setting up the MicroTik. I currently have > everything set(I got all the RIP records and routes created), however, it > can't talk to the internet. I'm trying to figure out, would this be a > firewall issue? Do I need to create a whole new NIC just for the 44net? When you want to route from net-44 addresses to internet (non-net-44), and your ISP implements source address filtering (BCP38) you need to setup policy routing, because you need a separate default route for traffic from your public internet address (pointing to your ISP) and for traffic from your net-44 systems (pointing to the IPIP tunnel to UCSD). Rob

2 1

Allocation of addresses
by John Ricketts 25 Sep '16

25 Sep '16

Thank you to all that responded to my email, I made my request through the portal. I would like to provide free tunnel services to any amateur that applies and issue 44net addresses to those who qualify. I also will be experimenting locally with RF. I am currently connected to AT&T at 10gbits/sec, should be snappy. Thanks! John KD5ZZH

1 0

Re: [44net] Co-located point of presence for 44net
by Rob Janssen 25 Sep '16

25 Sep '16

> So my question is this: Is what I want to do feasable as a way to get a > static address and act as an AMPR gateway? Yes, this works quite well. I have the same setup here. I have a colocated Raspberry Pi that is on the IPIP mesh using ampr-ripd in the standard setup that is described on the WiKi, and it serves my subnet and a couple of /32 addresses. My subnet is tunneled to my home using IPsec in AH/Tunnel mode. Using AH instead of ESP (as is usually used) reduces CPU usage, and encryption is not required for this purpose anyway. At home I have a MikroTik router. I do have a fixed IP at home so IPsec is easy, when you don't have that it may be easier to use a VPN that does not care about addresses, e.g. OpenVPN. I also run a couple of applications locally on the Pi, hence the /32 addresses. Today, thanks to Marius' work, it is also possible to use a MikroTik router instead of the Raspberry Pi. It may be easier to configure and is available in rackmount formfactor. Rob

1 0

Co-located point of presence for 44net
by Tom C 25 Sep '16

25 Sep '16

Greetings. I'm somewhat new to the list and would like to join the network. I am not able to get a static address from my ISP, well I could, but I'd have to get a business account and my speeds would be a lot slower than they are now. I'm considering getting a VPS or a colocated raspberry pi to act as a vpn server and my point of presence to connect to my network via a tunnel. A rough ASCII diagram follows: (^^^^^^^^^^^^^^^^^^^^^^^^^^^^) ( IPIP/Tun0/VPN Svr <<--- ) ( Ieth0 RasPi in DATA CENTER) (vvIvvvvvvvvvvvvvvvvvvvvvvvvv) I (^^I^^^^^^^^^^) (^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^) ( Internet )====(>LinuxRouter/VPN/Tun0/eth2-->>44.98.63.0/29) (vvIvvvvvvvvvv) (vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv) I (^^I^^^^^^^^) (IPIP @ SDSU) ( 44/8 ) (vvvvvvvvvvv) My intent is to initilly have connectivity for a small LAN and then build it out over AX25 for my local area. I've run linux as my router/firewall (iptables and ipset) since 2012, but have not done much with "ip route" or "route", tunneling or anything with bridging but I did play a little with GRE and OpenSwan a couple of years ago. My thinking is building tun0/eth0 bridge and feeding that through the VPN to the distant RasPi which would vbidge the other end of the connection to the IPIP tunnel. So my question is this: Is what I want to do feasable as a way to get a static address and act as an AMPR gateway? Any suggestions, hints or approaches to prod me in the right direction to get me going would be appreciated. -- tom 73 de N2XU/Tom Cardinal/MSgt USAF (Ret)/BSCS/Security+/IPv6 Certified

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

44net