- wlug - list.wlug.org.nz

The Ars guide to building a Linux router from scratch
by rowan schischka 19 Apr '16

19 Apr '16

> What about a MIPS-oriented distro like OpenWRT? I have never tested OpenWRT. I would think that the strength of openWRT would be in its web interface and it has been customised for specific hardware. Both my embedded devices are capable of running debian and I have no need for a web interface. I think you would use OpenWrt if you already have the hardware for it.

1 0

Re: [wlug] The Ars guide to building a Linux router from scratch
by Roger Hardy 18 Apr '16

18 Apr '16

I run several instances of pfsense on both pcengines APU boards and as Xen VM's, and I would use that over pretty much anything these days. Good throughput, easy to manage, and lots of features. In my case this was because my iptables script was getting to be handful as well as IPSec and OpenVPN installations that are now much easier to manage and monitor. Industrial strength magic for home router price from my point of view.

1 0

The Ars guide to building a Linux router from scratch
by rowan schischka 18 Apr '16

18 Apr '16

A few years ago I built an ap on a pc engines alix board. Of course the choice of wireless card is going to be the deciding factor in performance as the alix's cpu and ram is higher than most wireless appliances. My performance was good but not as good as similar priced appliances. I am not using it atm because I'm using a skinny 4g modem. If I needed a wireless ap in the future I would buy an appliance over built due to cost, time, and performance. What you loose out on appliance ap is software and security upgrades. Also the coolest thing with building a router based on debian is you can install anything you want. But if you want to install proxy server, file server and virus scanners don't go for an embedded chip, get a proper pc with decent cpu and hard drive. And lastly I tested the original raspberry pi as an ap. Throughput was terrible. About 1mb per second file transfer speed using rsync, my understanding is that is due to everything running through its USB controller

2 1

The Ars guide to building a Linux router from scratch
by Peter Reutemann 17 Apr '16

17 Apr '16

"After finally reaching the tipping point with off-the-shelf solutions that can't match increasing speeds available, we recently took the plunge. Building a homebrew router turned out to be a better proposition than we could've ever imagined. With nearly any speed metric we analyzed, our little DIY kit outpaced routers whether they were of the $90- or $250-variety." -- source: http://arstechnica.com/gadgets/2016/04/the-ars-guide-to-building-a-linux-ro… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

2 1

Ubuntu 16.04 LTS Will Bring Snap Packages For Up-To-Date, More Secure Apps
by Peter Reutemann 13 Apr '16

13 Apr '16

"Canonical, Ubuntu's parent company, has announced that Ubuntu 16.04 LTS (Long Term Support) will come with support for the snap packaging format and tools. As a result, end users will get more up-to-date apps, something that proved tricky in the past due âoethe complexity of packaging and providing updates,â which prevented updates to some apps being delivered. Snaps will make the Ubuntu platform more unified, developers will more easily be able to create software for PC, Server, Mobile, or IoT devices. The other major benefit of snaps is that that they're more secure than software installed through deb packages. Snaps are isolated from the rest of the system, meaning that malware packaged with a snap won't be able to affect your Ubuntu installation." -- source: https://news.slashdot.org/story/16/04/13/1627204 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

The Future of Firefox is Chrome
by Peter Reutemann 13 Apr '16

13 Apr '16

"Mozilla seems to think a new future for Firefox [lies in Chrome]. While they claim that it is only about new ways of browser design, it is also an open secret that they are running into more and more problems lately with web compatibility. [Senior VP Mark Mayo caused a storm by revealing that the Firefox team is working on a next-generation browser that will run on the same technology as Google's Chrome browser. The project, named Tofino, will not use Firefox's core technology, Gecko, but will instead plumb for Electron, which is built on the technology behind Google's rival Chrome browser, called Chromium.] The benefit of Chromium/Electron would be that it is a solution they could pull much faster forward than their own Servo plans [Servo being Mozilla's Rust-based web engine]. What the real outcome of all this will be, only Mozilla knows so far. But inside Mozilla there is much resistance against such plans... Interesting times are ahead." -- source: https://news.slashdot.org/story/16/04/12/2025215 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Yes, Badlock bug was shamelessly hyped, but the threat is real
by Peter Reutemann 13 Apr '16

13 Apr '16

"In a nutshell, Badlock refers to a defect in a security component contained in just about every version of the Windows and Linux operating systems. Known as the Distributed Computing Environment/Remote Procedure Call (DCE/RPC), it's used by administrators around the world to access the most valuable asset on any Windows network—the Active Directory, which acts as a network's digital security guard, allowing, for instance, an organization's CFO to log in to an accounting server, while locking out the janitor or the groundskeeper. Because Active Directories enforce security policies and contain password data and other crucial credentials, they are almost always the first asset hackers access once they gain a limited foothold into a targeted network." "An Active Directory infrastructure with a Samba server as a domain member is vulnerable to this flaw," an advisory published Tuesday by Linux distributor Red Hat warned. "A man-in-the-middle attacker could intercept DCE/RPC traffic between the domain member and the domain controller to impersonate the client and get the same privileges as the authenticated user account. The attacker could view or modify secrets within an AD database, including user password hashes, or shutdown critical services." -- source: http://arstechnica.com/security/2016/04/yes-badlock-bug-was-shamelessly-hyp… Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Linux-On-Windows Performance
by Lawrence D'Oliveiro 11 Apr '16

11 Apr '16

Some initial benchmarks on the Linux layer that Microsoft has added to Windows 10: <http://www.phoronix.com/scan.php?page=article&item=windows-10-lxcore&num=1>. Summary: CPU performance seems quite good, while I/O is terrible.

1 0

Popular Firefox Add-Ons Open Millions To New Attack
by Peter Reutemann 09 Apr '16

09 Apr '16

'Security researchers claim that NoScript and other popular Firefox add-on extensions are exposing millions of end users to a new type of vulnerability which, if exploited, can allow an attacker to execute malicious code and steal sensitive data. The vulnerability resides in the way Firefox extensions interact with each other. From a report on SlashGear, "The problem is that these extensions do not run sandboxed and are able to actually access data or functions from other extensions that are also enabled. This could mean, for example, that a malware masquerading as an add-on can access the functionality of one add-on to get access to system files or the ability of another add-on to redirect users to a certain web page, usually a phishing scam page. In the eyes of Mozilla's automated security checks, the devious add-on is blameless as it does nothing out of the ordinary."' 'Firefox's VP of Product acknowledged the existence of the aforementioned vulnerability. "Because risks such as this one exist, we are evolving both our core product and our extensions platform to build in greater security. The new set of browser extension APIs that make up WebExtensions, which are available in Firefox today, are inherently more secure than traditional add-ons, and are not vulnerable to the particular attack outlined in the presentation at Black Hat Asia. As part of our electrolysis initiative -- our project to introduce multi-process architecture to Firefox later this year -- we will start to sandbox Firefox extensions so that they cannot share code."' -- source: https://it.slashdot.org/story/16/04/09/1758255 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0

Researchers Help Shut Down Spam Botnet That Enslaved 4, 000 Linux Machines
by Peter Reutemann 09 Apr '16

09 Apr '16

'A botnet that enslaved about 4,000 Linux computers and caused them to blast the Internet with spam for more than a year has finally been shut down. Sophisticated Mumblehard spamming malware flew under the radar for five years. Known as Mumblehard, the botnet was the product of highly skilled developers. It used a custom "packer" to conceal the Perl-based source code that made it run, a backdoor that gave attackers persistent access, and a mail daemon that was able to send large volumes of spam. Command servers that coordinated the compromised machines' operations could also send messages to Spamhaus requesting the delisting of any Mumblehard-based IP addresses that sneaked into the real-time composite blocking list, or CBL, maintained by the anti-spam service. "There was a script automatically monitoring the CBL for the IP addresses of all the spam-bots," researchers from security firm Eset wrote in a blog post published Thursday. "If one was found to be blacklisted, this script requested the delisting of the IP address. Such requests are protected with a CAPTCHA to avoid automation, but OCR (or an external service if OCR didn't work) was used to break the protection."' -- source: https://linux.slashdot.org/story/16/04/09/1827238 Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

1 0