On 2015-09-13 5:00 PM, Etienne Champetier wrote:
Hi Daniel,
For me listenning only on lan will break all my setups (15+):
- On most of my openwrt there is no lan, it's management, or
'name-of-the-site' ...
- on some of them i can access from multiple interface (VPNs + ...)
What I'm talking about is a change to the *default* /etc/config/uhttpd
so that it by *default* on *new installations* listens on lan network
and not all networks.
a) It would not prevent choosing to have multiple networks and to listen
only on the management network (or whichever network or networks you
choose).
b) It would not change existing installs
I would argue against trying migrate existing configurations since there
is no good way of determining if the loose setup is intentional or not,
although perhaps having luci option 'asked_migrate' and a luci banner
that indicates your setup might benefit from migrating might be useful
(so that existing uses that could benefit might find out about it).
The capability of listening on the ip address(es) of your choice already
exists uhttpd, it is simply that currently the default is to listen on
all networks. Presumably if you can change the default network config,
with this (existing) uci option added to the LuCI config you would also
be savvy enough to make LuCI listen on the network(s) of your choice.
You can't prevent people from shooting themselves in the foot (maybe
port openning was on purpose),
You can, however, make it less likley and/or make reasonable efforts to
help protect newbies (or half-asleep admins) from making
easily-preventable mistakes.
but you can:
-Put a huge warning in luci when you set firewall default to 'ACCEPT'
-add robots.txt (i think the router will still end up on shodan)
-add a big warning if robots.txt is accessed (reliable way to know that
you're open on the internet)
Also you are talking about luci but what about dropbear (ssh)? There is
no anti brute force, and maybe there is a banner (on my phone, can't check)
The same principal would apply to SSH - warn user if they open SSH to
internet with password based logins enabled, make dropbear listen on on
lan by default (in fact LuCI for dropbear already allows you to setup
SSH only for the network(s) you want; it's just that the default is to
allow on all).
Please don't break my setups :)
There is no reason changing *default* UCI config should break an
existing config or prevent the type of setup you want (access via some
network but not others).
When I'm talking about default uci config I mean /etc/config/uhttpd (and
/etc/config/dropbear) that are embedded in images should be changed (in
the case of uhttpd this would require adding to LuCI the ability to
change the uci config for networks to listen on since atm those uci
options are not exposed in LuCI).
This would only result in a difference to users who
a) Flash for the first time
b) Do a factory reset
c) Sysupgrade without preserving config (effectively doing b as part of
a firmware upgrade).
Regards,
Daniel
_______________________________________________
openwrt-devel mailing list
openwrt-devel@lists.openwrt.org
https://lists.openwrt.org/cgi-bin/mailman/listinfo/openwrt-devel
