Meshtastic (not meshtasticd) Install on Raspberry Pi Bookworm Lite

 I like to use the Lite version of Raspberry Pi O.S. and for the moment I've been sticking with Bookworm.  Due to some issues during install, I decided to document step-by-step for getting the meshtastic software installed.  Note: this is not the meshtasticd software.

• Lora radio is a Heltec v3 connected via USB but will work with a SX1262 hat/etc.

---

# Install required packages

sudo apt install python3 python3-pip python3-venv -y

# Create a Meshtastic virtual environment
python3 -m venv ~/meshtastic-env

# Activate the environment
source ~/meshtastic-env/bin/activate

# Your shell prompt should change to something like:

# (meshtastic-env) pi@raspberrypi:~

# Install/Upgrade pip

pip install --upgrade pip

# Install Meshtastic inside the environment

# This step will take forever on a Pi Zero

pip install meshtastic pytap2

# This will let you run meshtastic from a regular login.

sudo ln -s ~/meshtastic-env/bin/meshtastic /usr/local/bin/meshtastic

# Test the CLI
meshtastic --help

meshtastic --nodes

# Easier to read:
# meshtastic --nodes | awk -F'│' '{print $3,$4,$5}' | sed 's/^ *//'

Security+ Topic - Backups

  Backups of the environment are an unsung hero of the security of servers and network devices.  It’s not just about having a backup.  You have to do the backups correctly.  Don’t get me wrong; having some sort of backup is better than nothing.  Just make sure you are securing your backups as well as your production servers.  A good backup solution implements the Grandfather-Father-Son aspect but it also takes into consideration the location of those backups, how often they run, and making sure they are secured with encryption.

Let’s start with the basics.  Plug in a USB hard drive, copy your files, and congrats you’ve got a backup!  Technically yes but please please take it a few steps further after this.  If your system becomes compromised, it’s not terribly difficult for a malicious actor to wipe the backup.  At that point, if ransomware were installed, they would have removed your ability to restore.  From a simple data availability standpoint, a USB drive could get you started but from a security perspective it is a very bad idea.  What about just disconnecting the USB drive after you do your backup?  Being air gapped is secure right?  That depends on how you reconnect that drive.  If your system is still compromised, plugging in the drive could wipe it or encrypt it too so you’d have to remember to not plug it in.  Plus it’s your only copy of the data which is a separate problem.

Now what about an upgrade to sending your data to a different server.  In this example we’ve decided to install backup software that sends our data to a backup server.  Nice upgrade!  This will secure your data from any local bad software that makes it onto your system.  My next question; how did you send that data to the server?  If it was simply over a SMB share, you might not be as safe as you think.  If you’ve got access to it, so does the attacker.  Make sure the backup software you install is placing it out-of-band to standard file sharing methods.  If it can be deleted, your backups are not secure.

Having the backup server on-site is not a bad thing though.  If you had to restore a server or data when your ISP is down or being very slow could be very problematic.  Make sure your on-site backup server is secured into its own segment of the network.  This could be via a simple SoHo router/NAT, separate segment of your Cisco routing with ACLs, or a network in-line firewall with specific firewall rules for backup only.  The point is that you need to secure your backup server so that when it comes time to restore, you are actually able to restore.  Quick note about offsites backups.  You can also send your data offsite to keep multiple copies and locations but ensure the offsite location is also secure.  There are a variety of ways you can accomplish multi-location backups but that’ll need to be a topic for another day.  Just know that you’ll be in a better security posture by doing so.

The last thing that I want to touch on are making sure your data is secure.  Every step of the data transmission needs to be reviewed to ensure things are not vulnerable.  At a high level you’ve got the data being read from the disk, encrypted by software, sent over a network which should use encryption on the fly, and then written to a backup server in an encrypted format.  I know that’s a lot but if any one of those vectors becomes compromised, you could be leaking data.

Security+ Topic - Monitoring

  Monitoring your network, servers, or general devices is one of the most important aspects of overall systems security.  I have reviewed many environments that simply put up a server and when there is a problem, they do not know about it because of a lack of monitoring.  When an attack takes over, they don’t know about it.  We like to think that everything is running just fine because the server is responding but monitoring goes beyond just a ping.  It even goes beyond a port check to make sure a service is responding.  True monitoring gets into the full flow of data through an application.

At the basics, a ping is better than nothing.  Most general monitoring software implements a ping function.  Great for a simple check but not so great for security.  Some security experts will even tell you to block ping for your servers or network nodes but there is always a trade-off with security.  If you block ping, you could trigger monitoring services which rely on it for a status or uptime information.  It could also prevent useful tools such as Trace Route.  From a security perspective it can be a layer of obscuring your servers but has other considerations.  For the first issue, that’s something more easily addressed.  Generally speaking if a server is on the network, it has a listening port to provide a service.  Thus you can determine that a server is offline by checking that service and no ping is needed.  On the second issue, a more round-about method can be used to check node-to-node connectivity utilizing documentation.  If you know that RouterA is supposed to talk to RouterB, check for a listening SSH port or otherwise throughout the network.  In general terms, ping is not the worst thing to have but if you really want to lock down the environment, disabling it does mean implimenting workarounds.

Next up is the extremely useful and easy port check.  Monitoring for a listening port is the basics of server ownership.  This type of monitoring gives you immediate information about the status because if you are the victim of a DDoS attack, you’ll know right away that your server is no longer responding.  The same thing for if the server goes offline, reboots, or a firewall change.  Many software suites such as Nagios or Solarwinds offer the ability to do a simple TCP connection to make sure the connection is alive.  This is where the monitoring of what ports are open on the server makes a large impact.  The software will give you alerts of an issue but there is an even better way to make sure your system is online, and not compromised.

Monitoring the actual function of a site or the content of the service gets you full-circle in verifying the status of the environment and the security of it’s setup.  While website defacement is much less common these days, it’s still a good idea to keep an eye on the status of the content of the website.  I use websites as my example here as it’s the most common source of a defacement attack.  One method that seems to work ok on static websites is a simple MD5SUM.  By running a curl on the website home page, you can then pipe the output to MD5SUM and get a fingerprint of the site.  This is a process that might require frequent updates to the whitelisted string but it is a suggestion of a starting point.  The other option that is much more intense but provides proof that a service is functional and not tampered with would be the submission of data and the retrieval of that data.  For example, I setup a script that sent an email through my exchange server to an email address outside of the environment.  Then I had second script that would get emails from the outside server and check the included security string and timestamp.  This verified to me that my email server was not maliciously shutdown, disabled, blocked, or otherwise toyed with.

There are a lot of options for monitoring your environment but I highly encourage you to at least take the first steps of securing your environment by at least some level of monitoring to ensure you can take action if something were to happen.

Security+ Topic - Disable Network Ports

  Disabling ports to secure your environment is one of the first things that should be done when setting up your servers or other network connected devices.  Let’s think about this for a minute.  What is the most simple way that someone is going to find your device to try and attack it.  Answer; with a port scan!  You could argue that setting your password might be the most important, or another setup item but as far as the network is concerned, you need to lock down the attack vector right away.

A lot of environments will start their setup journey behind a Network Address Translation (NAT) device which by default is going to provide a level of port protection.  If for some reason you’re setting up a brand new device with a public IP, keep a network firewall in between so you can make sure to block random internet traffic.  Sounds obvious right?

It seems so simple and really it is.  The issue is that people forget.  Or worse, an operating system update forces a service to turn on and/or enable a port.  When was the last time you reviewed your firewall ports?  For a lot of people, they probably never have.  The simple thought process is that “it’s working”.  Ask yourself if you really know what’s being allowed through the firewall because I’ll bet it will surprise you.  The last time I reviewed one of the windows firewalls on one of my servers, there was all sorts of xbox connections being allowed and sharing of odd sorts.

Now this brings up a huge security issue that I couldn’t believe was happening.  After taking a lot of time to go through my firewalls and disable rules that I explicitly wanted disabled, a windows update went through and ENABLED them again!  My monitoring software alerted me to this huge security flaw because I have it monitoring for firewall rules.  Could you imagine if you knew 100% that a service had a security flaw so you blocked it; then during an O.S. upgrade the developers decided they know better than you and enabled it as part of the update?  Well that’s really what happened!

This is why making sure to review the ports you’re allowing into your server is very very important.  It’s not just about watching out for what you know about.  It’s about watching out for what you don’t know about.  I understand that monitoring a server for all 65,535 ports is not a feasible undertaking but monitoring your firewall is something that can be done.  For example, I use Nagios with a custom script to complete the job.

Finally, what about your secure environment?  Why disable rules or make sure server ports are locked down when you’re behind a network firewall?  This is a matter of trust and layers.  Disabling the port is only one layer.  Blocking the port on the network firewall is another layer.  You never know when a bad actor is going to find a flaw in that network firewall which would allow connection deeper into your network.  That flaw could let them port forward 3389 RDP for example without your knowledge.  By locking down those ports locally on your server, it’s created another barrier to the attack vector even if one gets through.

Network Separation for IoT Servers Phone Laptop Gaming OH MY!

 Let’s talk about ‘IoT’, ‘Servers’ and ‘Other’ stuff on your home network.

Keep your network components separated.  Let me say that again but re-worded.  Keep the devices on your network away from each other.

I’m not talking about VLAN’s here.  Yes, that’s one way to do the trick but for a home user that can be a bit out of reach.  We’ve seen the meme where the super-tech guy doesn’t want any tech in their house because it “could be listening” and if the toaster makes an odd noise they’ll throw it out the window.  Not this guy.  I’m all about not getting out of my bed to flip the light switch that’s 8 feet away from me.  I’ll grab my phone and trigger it to turn off.  This of course comes with a security risk.

Now that you know the basis of what I’m talking about, let’s jump right into the meat and potatoes of this post.

1. Put your IoT devices onto their own access point.  Yes.  Physical access point.  VLAN hopping is real and again, VLAN’s can be out of reach for your mom & pop.

2. Put your servers into their own network also.  The servers are probably ok behind a router and then a VLAN/etc. but remember that we’re talking about home setup or mom & pops house.  It’s not too far fetched these days to apply the same principle of putting your servers behind their own router.

3. Put your phones/laptop/etc onto their own device also.

4. Put gaming devices on their own WiFi.  I have a personal preference here for the last one about putting my gaming devices on their own WiFi network.  I have no evidence to back-up the “speed gains” but it gives me a warm & fuzzy that they’re not competing with other devices as much.

How do you make this happen?  There is a cheap route and an expensive route.  They both come with trade-offs in security though.

- The cheap route:

Go to your local thrift store and find a couple of old routers.  The trade-off here is that the firmware is probably going to be way out of date and have it’s own potential threat vectors.  The upside is that if an IoT device is compromised, it probably doesn’t matter if the router for it has a couple of issues.  We’re separating that network completely anyway.  I’m not advocating for opening some security issues but it might be possible to flash it with DD-WRT to get it a bit more up-to-date.  Just pull up the compatibility list while you’re in the store to see if it’s on the compatibility list.  Another downside to this route is that the hardware could only be 10/100 Mbps.  That’s ok for your IoT network, but not so great for other stuff you may be working with.  Whatever you do, just configure your router to disable the 5Ghz network if possible.  Every IoT device I’ve worked with has utilized 2.4Ghz.  Thus by disabling the 5Ghz band, you’re not sending out junk wireless signal for other access points to compete with.  What about the other hardware that I want 1Gbps or faster?  Well, the next option then.

- The less-cheap route:

Buy an off-the-shelf router or re-use what you have for your gaming and/or other devices network.  Sometimes, you can even use this same router with a “DMZ” component for your server network.  A DMZ is basically just another subnet that you’ve locked down to allow specific access to.  Fancy word, basic security.  This router will probably still get security and/or firmware updates from the vendor so it’s a good chance that it’s ok to leave as is, as long as you’re actually applying those updates.  If it’s reached end-of-life, check the HCL (hardware compatibility list) for DD-WRT because you might find you can squeak out a few more years with what you’ve got.

- The server network:

When it comes to your servers, this probably depends on the size of your home network.  I have a router/access point that I use for my server network but then disable the WiFi of it.  This way I’m not sending out useless signals.  Also, nothing in my server network utilizes wifi… but maybe I could experiment with this.  Another angle is that it reduces the attack vector of your server network as not wireless exploits could be used against it if you’ve disabled it.

Why do all this for your home network though?  With the increase in IoT devices and so many phones, laptops, gaming consoles, fridges, etc. making their way onto our networks, it’ll be better to have a secure approach to utilizing them instead of it being a problem later if something gets compromised.  Security comes with additional steps such as port-forwarding from the phone/laptop network into the server network but once it’s setup, you don’t really have to think about it again until a new server is setup.  A little bit of work early on makes me sleep easier at night and if we all do something similar to this, we could greatly reduce our attack footprint.

One final note that’s not needed but potentially a good idea.  Each router could be a different brand.  That way if a flaw is found in TP-Link, your Linksys isn’t impacted.  Again it introduces a layer of vendor confusion learning new setups for various devices but might help prevent an attack.  Also could just be dumb because one second-hand device I snagged is limited to only 16 ports forwarded.  odd

NConf 1.3.0 Install on Ubuntu 22.04.5 LTS

This is how I got NConf working on my Nagios server.  Components:

• Ubuntu 22.04.5 LTS  Server (minimized install)
• Nagios 4
• NConf 1.3.0
• Full package list at the bottom.
• It'll setup Apache for HTTPS with auto re-write from 80 to 443
• Also it will turn on your firewall with prior rules allowing SSH/HTTP/HTTPS

Make a backup of your Nagios server if you've already got one setup. 

Do a backup.

Perform the backup.

Backup the server!

None of this should break anything but you're introducing OLD CODE with possible SECURITY FLAWS.  If you decide you don't want that risk, you can revert to your backup.

That said, put your dang Nagios server behind a firewall/etc if you're going to do this.  Don't come complaining to me that you go hacked because you followed this and put your Nagios server directly onto the internet with a public IP.

Also a side note.  Apparently you can automatically transfer the config to your Nagios server via SCP or you could even do a SMB mount I suppose.  From a security perspective, you could give NConf it's own server in a locked down environment, then the only thing it can do is send those configs over to Nagios for use.  That's a whole different discussion though.

Ok, moving on...

This is a bash script tested on a fresh install of Ubuntu Server Minimized.  Nothing special.  Nothing extra installed.  etc etc etc.

##########################################

#!/bin/bash
set -e
clear
echo "=== Installing NConf on Ubuntu 22.04 ==="

# === SECURITY WARNING ===
echo -e "\033[1;31mWARNING:\033[0m NConf is old, unmaintained software."
echo -e "\033[1;31mIt may contain security vulnerabilities and should NOT be exposed to the internet.\033[0m"
echo -e "\033[1;31mUse this only in a secured, isolated environment for legacy Nagios configurations.\033[0m"
echo

read -p "Do you still want to continue the installation? (y/N): " confirm
if [[ ! "$confirm" =~ ^[Yy]$ ]]; then
    echo -e "\033[1;33mInstallation aborted by user.\033[0m"
    exit 1
fi

echo ""
read -rp "Enter NConf database username: " NCONF_DB_USER
read -srp "Enter password for user '$NCONF_DB_USER': " NCONF_DB_PASS
echo ""
read -rp "Enter WebUI username (ex: admin): " NCONF_UI_USER
read -srp "Enter WebWI password: " NCONF_UI_PASS
echo ""

# --- Function to check and install a dependency ---
check_install() {
    pkg=$1
    if ! dpkg -s "$pkg" &>/dev/null; then
        echo "Installing missing dependency: $pkg"
        sudo apt install -y "$pkg"
    else
        echo "Dependency already installed: $pkg"
    fi
}

# --- Update and ensure dependencies ---
sudo apt update -y

for pkg in software-properties-common curl ufw unzip wget apache2 mariadb-server mariadb-client; do
    check_install "$pkg"
done

# PHP 5.6 modules
sudo add-apt-repository ppa:ondrej/php -y
sudo apt update -y
for pkg in php5.6 php5.6-cli php5.6-mysql php5.6-ldap php5.6-gd php5.6-xml php5.6-mbstring libapache2-mod-php5.6; do
    check_install "$pkg"
done

# --- Start services ---
sudo systemctl enable --now mariadb apache2

# --- MariaDB setup ---
sudo mysql_secure_installation

sudo mysql -u root <<EOF
CREATE DATABASE IF NOT EXISTS nconf CHARACTER SET utf8 COLLATE utf8_general_ci;
GRANT ALL PRIVILEGES ON nconf.* TO '${NCONF_DB_USER}'@'localhost' IDENTIFIED BY '${NCONF_DB_PASS}';
FLUSH PRIVILEGES;
EOF

# --- Fetch and verify NConf ---
cd /var/www/html
NCONF_TGZ="nconf-1.3.0-0.tgz"
NCONF_URL="https://sourceforge.net/projects/nconf/files/nconf/1.3.0-0/$NCONF_TGZ"

echo "Downloading NConf..."
wget -q --show-progress -O "$NCONF_TGZ" "$NCONF_URL" || { echo "ERROR: Download failed!"; exit 1; }

if [[ ! -f "$NCONF_TGZ" ]]; then
    echo "ERROR: NConf tarball not found after download!"
    exit 1
fi

echo "Extracting NConf..."
tar -xf "$NCONF_TGZ" || { echo "ERROR: Extraction failed!"; exit 1; }

if [[ ! -d "nconf" ]]; then
    echo "ERROR: Extraction did not create expected 'nconf' directory!"
    exit 1
fi

sudo chown -R www-data:www-data /var/www/html/nconf
sudo mkdir -p /var/www/html/nconf/cfg_files
sudo chmod -R 775 /var/www/html/nconf/{config,output,static_cfg,temp,cfg_files}

echo "NConf successfully downloaded and extracted."

# --- Apache config ---
sudo tee /etc/apache2/sites-available/nconf.conf > /dev/null <<'APACHECONF'
<VirtualHost *:80>
    ServerName nconf.local
    Redirect / https://nconf.local/
</VirtualHost>

<VirtualHost *:443>
    ServerName nconf.local
    DocumentRoot /var/www/html/nconf
    <Directory /var/www/html/nconf>
        AllowOverride All
        Options Indexes FollowSymLinks
        Require all granted
        AuthType Basic
        AuthName "NConf Access"
        AuthUserFile /etc/apache2/.htpasswd
        Require valid-user
    </Directory>
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/nconf-selfsigned.crt
    SSLCertificateKeyFile /etc/ssl/private/nconf-selfsigned.key
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
    ErrorLog ${APACHE_LOG_DIR}/nconf-error.log
    CustomLog ${APACHE_LOG_DIR}/nconf-access.log combined
</VirtualHost>
APACHECONF

# --- SSL + htpasswd ---
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout /etc/ssl/private/nconf-selfsigned.key \
  -out /etc/ssl/certs/nconf-selfsigned.crt \
  -subj "/C=US/ST=State/L=City/O=Org/OU=IT/CN=nconf.local"

sudo htpasswd -b -c /etc/apache2/.htpasswd $NCONF_UI_USER $NCONF_UI_PASS

# --- Perl fix for ExportNagios.pm ---
sudo sed -i.bak 's/%{\$srv->\[2\]}/\${\$srv->[2]}/g' /var/www/html/nconf/bin/lib/NConf/ExportNagios.pm

# --- Update PHP configuration dynamically ---
PHP_VER=$(ls /etc/php | grep -Eo '^[0-9]+\.[0-9]+' | sort -r | head -1)
sudo sed -i 's/^short_open_tag.*/short_open_tag = On/; s/^register_globals.*/register_globals = Off/; s/^magic_quotes_gpc.*/magic_quotes_gpc = Off/' /etc/php/$PHP_VER/apache2/php.ini

# --- Enable Apache modules and restart ---
sudo a2enmod rewrite ssl headers
sudo a2ensite nconf.conf
sudo systemctl restart apache2

# --- Firewall setup ---
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw --force enable

# --- Import NConf schema ---
mysql -u "$NCONF_DB_USER" -p"$NCONF_DB_PASS" nconf < /var/www/html/nconf/INSTALL/create_database.sql

# --- PHP autoload fix ---
sudo tee /var/www/html/nconf/include/includeAllClasses.php > /dev/null <<'EOF'
<?php
spl_autoload_register(function ($class_name) {
    $class_path = NCONFDIR.'/include/classes/class.'.$class_name.'.php';
    if (!empty($class_name) && file_exists($class_path)) {
        require_once($class_path);
        NConf_DEBUG::set("class $class_name", 'DEBUG', 'Autoload');
    }
});
?>
EOF

sudo perl -pi.bak -e 's/foreach my \$def_srv_deps_param \(keys\(\$\{\$srv->\[2\]\}\)\)/foreach my \$def_srv_deps_param (keys(%{$srv->[2]}))/; s/unless\(\$def_srv_deps_param && \${\$srv->\[2\]}->\{\$def_srv_deps_param\}\)/unless($def_srv_deps_param && $srv->[2]->{$def_srv_deps_param})/; s/\$fval\s*=\s*\${\$srv->\[2\]}->\{\$def_srv_deps_param\}/\$fval = $srv->[2]->{$def_srv_deps_param}/' /var/www/html/nconf/bin/lib/NConf/ExportNagios.pm

sudo rm -rf /var/www/html/nconf/temp/* && \
sudo mkdir -p /var/www/html/nconf/temp/test /var/www/html/nconf/temp/Default_collector && \
sudo chown -R www-data:www-data /var/www/html/nconf/temp && \
sudo chmod -R 775 /var/www/html/nconf/temp



DEPLOY_FILE="/var/www/html/nconf/config/deployment.ini"

# Backup existing file if it exists
[ -f "$DEPLOY_FILE" ] && sudo cp "$DEPLOY_FILE" "${DEPLOY_FILE}.old"

# Write the new deployment.ini
sudo tee "$DEPLOY_FILE" > /dev/null <<'EOF'
[extract config]
type        = local
source_file = "/var/www/html/nconf/output/NagiosConfig.tgz"
target_file = "/var/www/html/nconf/cfg_files/"
action      = extract
EOF



# --- Verification ---
echo -e "\n=== Verifying NConf setup ==="

echo -e "\n--- Checking MariaDB ---"
sudo systemctl is-active --quiet mariadb && echo "MariaDB is running ✔" || echo "MariaDB not running ❌"

echo -e "\n--- Testing NConf database access ---"
mysql -u "$NCONF_DB_USER" -p"$NCONF_DB_PASS" -e "SHOW TABLES;" nconf >/dev/null && echo "NConf DB accessible ✔" || echo "NConf DB access failed ❌"

echo -e "\n--- Checking Apache ---"
sudo systemctl is-active --quiet apache2 && echo "Apache is running ✔" || echo "Apache not running ❌"

echo -e "\n--- Checking PHP ---"
php -v | head -n 1

echo -e "\n--- Testing NConf web ---"
curl -skI https://localhost/nconf/ | grep -q "200\|302" && echo "NConf web responds ✔" || echo "NConf not responding ❌"

echo -e "\n--- Checking permissions ---"
for dir in config output static_cfg temp; do
  test -w /var/www/html/nconf/$dir && echo "$dir writable ✔" || echo "$dir not writable ❌"
done

echo -e "\n=== Installation complete ==="
echo -e "\nAccess NConf at: https://<server-ip>/nconf/"
echo "DBNAME = nconf"
echo "DBUSER = $NCONF_DB_USER"
echo "DBPASS = $NCONF_DB_PASS"
echo -e "\nRemember to set your Nagios binary path inside the NConf web GUI."
echo -e "\nAlso you'll need to set your nagios.cfg to point to /var/www/html/nconf/cfg_files/"

##########################################

A couple things:

1. At the end of the web ui config, you'll get "copy config file (deployment.ini) FAILED".  That's ok.  The script did it for us.

2. After config, permissions will need set for config output per our config:
chown www-data:www-data /var/www/html/nconf/cfg_files/

3. When you go to 'Generate Nagios config', you'll probably get:
Error: Cannot open main configuration file '/var/www/html/nconf/temp/test/Default_collector.cfg' for reading!
- To fix this, edit the config file as shown:
nano +1273 /var/www/html/nconf/bin/lib/NConf/ExportNagios.pm

foreach my $def_srv_deps_param (keys(%{$srv->[2]})){
# OLD --> foreach my $def_srv_deps_param (keys(${$srv->[2]})){
unless($def_srv_deps_param && $srv->[2]->{$def_srv_deps_param}) { next }
# OLD --> unless($def_srv_deps_param && ${$srv->[2]}->{$def_srv_deps_param}){next}
$fattr = $def_srv_deps_param;
# OLD --> $fval = ${$srv->[2]}->{$def_srv_deps_param};
$fval = $srv->[2]->{$def_srv_deps_param};

##########################################

Package	Version	Ubuntu/Source
apache2	2.4.52-1	ubuntu4.16
apache2-bin	2.4.52-1	ubuntu4.16
apache2-data	2.4.52-1	ubuntu4.16
apache2-utils	2.4.52-1	ubuntu4.16
curl	7.81.0-1	ubuntu1.21
libapache2-mod-php5.6	5.6.40-86+	ubuntu22.04.1+deb.sury.org+1
libcurl3-gnutls	7.81.0-1	ubuntu1.21
libcurl4	7.81.0-1	ubuntu1.21
libxmlsec1-openssl	1.2.33-1build2
mariadb-client	1:10.6.22-0	ubuntu0.22.04.1
mariadb-client-10.6	1:10.6.22-0	ubuntu0.22.04.1
mariadb-client-core-10.6	1:10.6.22-0	ubuntu0.22.04.1
mariadb-server	1:10.6.22-0	ubuntu0.22.04.1
mariadb-server-10.6	1:10.6.22-0	ubuntu0.22.04.1
mariadb-server-core-10.6	1:10.6.22-0	ubuntu0.22.04.1
needrestart	3.5-5	ubuntu2.4
openssl	3.0.2-0	ubuntu1.20
php5.6	5.6.40-86+	ubuntu22.04.1+deb.sury.org+1
php5.6-cli	5.6.40-86+	ubuntu22.04.1+deb.sury.org+1
php5.6-common	5.6.40-86+	ubuntu22.04.1+deb.sury.org+1
php5.6-gd	5.6.40-86+	ubuntu22.04.1+deb.sury.org+1
php5.6-json	5.6.40-86+	ubuntu22.04.1+deb.sury.org+1
php5.6-ldap	5.6.40-86+	ubuntu22.04.1+deb.sury.org+1
php5.6-mbstring	5.6.40-86+	ubuntu22.04.1+deb.sury.org+1
php5.6-mysql	5.6.40-86+	ubuntu22.04.1+deb.sury.org+1
php5.6-opcache	5.6.40-86+	ubuntu22.04.1+deb.sury.org+1
php5.6-readline	5.6.40-86+	ubuntu22.04.1+deb.sury.org+1
php5.6-xml	5.6.40-86+	ubuntu22.04.1+deb.sury.org+1
python3-openssl	21.0.0-1
software-properties-common	0.99.22.9
tar	1.34+dfsg-1	ubuntu0.1.22.04.2
ufw	0.36.1-4	ubuntu0.1
unzip	6.0-26	ubuntu3.2
wget	1.21.2-2	ubuntu1.1

Raspberry Pi 2 USB Adapter Speed Test

This is a speed test of a couple USB adapters on my Raspberry Pi Model B+ V1.2 that I plan on using for an upcoming project.

TLDR here. Results in MB/s.

Drive	Average	Test1	Test2	Test3	Test4
Mini Flash USB	4.35	3.4	4.0	4.6	5.4
Black Micro SD Adapter	7.05	7.2	6.9	7.0	7.1
White Micro SD Adapter	8.28	9.8	9.5	8.1	5.7
On-Board	18.9	18.4	18.7	19.2	19.3

• I used dd for a basic but effective test of writing to the drives.
  dd if=/dev/zero of=/path/to/mounted/usb/dd-test.img bs=100M count=1 oflag=dsync
• I also realize that 100M is a bit smaller than I should have tested but found very similar results with 1G and 100M was faster :)
• The really crazy part is how much faster the adapters are going to the Micro SD card.  I really thought the regular USB drive would have been faster.
• For a final test, I used the same Micro SD card for the O.S. in the on-board slot.  Not surprisingly it was over twice as fast.
• The purpose of this post is so I can reference it in the future as well as make note of how I might want to group these styles of drives in the future.
• NOTE:  I've experienced SOME sustained write issues with one of the adapters.  It was a long time ago and I was in the middle of swapping stuff around so I don't recall which had the issue.  My guess is that the chip warms up a bit and then doesn't play nice.  Just keep that in mind for deciding how you want to proceed with your setup.

---

• Regular USB

This drive is the PNY 256GB Elite-X Fit USB 3.1 Flash Drive - 200MB/s

Here is the item description:

- Elite-X Fit USB 3.1 Gen 1 Flash Drive, backwards compatible with USB 2.0 (USB 3.1 Gen 1 offers identical performance as USB 3.0, but under a new name)

- Amazing performance with read speeds up to 200MB/s, ideal for large files and demanding applications

- Transfer speeds up to 30 times faster than standard PNY USB 2.0 Flash Drives

- A compact, plug-and-stay flash drive that’s ideal for adding more storage to computers, in-car stereos, game consoles, and more

- Micro-sized, long stay, low profile design can remain connected to host devices or maximum convenience. No need to insert and remove it after each use

Compatible with most PC and Mac laptop and desktop computers, in-car stereos, game consoles, printers, TV’s, and more

 

---

• Micro SD Cards

This same card is used in both of the adapters below.

SanDisk 256GB Extreme microSDXC UHS-I Memory Card with Adapter - Up to 190MB/s, C10, U3, V30, 4K, 5K, A2, Micro SD Card - SDSQXAV-256G-GN6MA

- Up to 190MB/s powered by SanDisk QuickFlow Technology (Up to 190MB/s read speeds, engineered with proprietary technology to reach speeds beyond UHS-I 104MB/s, requires compatible devices capable of reaching such speeds. Based on internal testing; performance may be lower depending upon host device interface, usage conditions and other factors. 1MB=1,000,000 bytes. SanDisk QuickFlow Technology is only available for 64GB, 128GB, 256GB, 400GB, 512GB, and 1TB capacities. 1GB=1,000,000,000 bytes and 1TB=1,000,000,000,000 bytes. Actual user storage less.)

Pair with the SanDisk Professional PRO-READER SD and microSD to achieve maximum speeds (sold separately), Compatible with microSDHC, microSDXC, microSDHC UHS-I, and microSDXC UHS-I supporting host devices

- Up to 130MB/s write speeds for fast shooting (Based on internal testing; performance may be lower depending upon host device interface, usage conditions and other factors. 1MB=1,000,000 bytes.)

- 4K and 5K UHD-ready with UHS Speed Class 3 (U3) and Video Speed Class 30 (V30) (Compatible device required. Full HD (1920x1080), 4K UHD (3840 x 2160), and 5K UHD (5120 X 2880) support may vary based upon host device, file attributes and other factors. See HD page on SanDisk site. UHS Speed Class 3 (U3) designates a performance option designed to support real-time video recording with UHS-enabled host devices. Video Speed Class 30 (V30), sustained video capture rate of 30MB/s, designates a performance option designed to support real-time video recording with UHS-enabled host devices. See the SD Association’s official website.)

- Rated A2 for faster loading and in-app performance (A2 performance is 4000 read IOPS, 2000 write IOPS. Results may vary based on host device, app type and other factors)

 

---

• Black Adapter

This was advertised as a generic "Memory Card Reader Adapter High Speed USB 2.0 Reader for Micro SD SDHC SDXC Z9Y6".  

Here is the item description:

SuperSpeed USB 2.0 TF Card Reader Adapter

Quantity: 1 piece

USB 2.0 interface.

Fast transfer rates for reliable copy/download/backup.

No additional driver installation is required.

Powered by USB port, no additional power supply required.

Card Compatibility: for Micro SD SDXC/TF card

Compatible with Windows ME, 2000, XP, Vista, WIN 7 and OS with USB interface.

---

• White Adapter

This is the Micro SD Card to USB Adapter, TF Card Reader with Mini Size

Here is the item description:

The Micro SD/TF card slot adopts a hidden design and is embedded in the USB plug, which can minimize the volume and protect the memory card at the same time.

Stable Work: The shell is made of aluminum alloy, which has a longer service life. The new chip and circuit design can minimize heat generation and ensure the stability and reliability of data transmission.

Portable: Ultra-light and ultra-small, the lanyard hole design can be easily connected with keychains or electronic devices, preventing loss and portability.

Scope of Application: Applicable to all USB 2.0 standard ports, providing 480Mbps read and write speed, compatible with USB 3.0 ports.

Compatible Devices: Compatible with all mainstream operating system USB port, such as TV, portable audio, notebook, computer, car system, etc.

 

---

• Final thoughts

We're working with a USB 2.0 port which has a potential max of 60MB/s.  That's much faster than the speeds I'm seeing.  In real world testing we rarely see the max speed of a connection though.  Even if we took half the potential max of USB 2.0 we're not getting close to potential speeds.  At this point the Raspberry Pi 2 is aging hardware and we cannot expect to have datacenter/server grade performance.  What this does do for me is provide a baseline that I can use to identify issue hardware.  I plan on using a few Pi's for some projects and I'll be able to have a baseline for identifying issue drives in the future.

---

Install Zabbix 2.4.6 on a Raspberry Pi 2

First note that the original instructions I followed to get this going were written in 2015 when MySQL 5.5 or 5.7 was the latest. My attempt is in 2024 and MySQL 8 is what I'm working with. I'm putting this as the first thing you read because I am able to get Zabbix installed BUT it's not compatible with MySQL 8. Thus nothing really works after you log into the Zabbix interface. Supposedly the person at https://blog.fawcs.info/2015/09/zabbix-onf-raspberry-pi-2/ was able to get MySQL 5 for ARM processors installed but I'm having a hard time figuring out if ARM was supported back then. Something is weird. Still, I'm documenting my process to get it installed. If you know of how to get MySQL 5 instead of 8 during the install, please let me know.

Now, this is basically a dump of my notes during the install.  Don't expect it to be a line by line walkthrough of exactly what you need to do/change/type/etc.

# ##########################

# This is the basic information of my server

# ##########################

# uname -a

# Linux Pi-Zabbix 5.4.0-1069-raspi #79-Ubuntu SMP PREEMPT Thu Aug 18 18:18:46 UTC 2022 armv7l armv7l armv7l GNU/Linux

# cat /etc/*elea*

# DISTRIB_ID=Ubuntu

# DISTRIB_RELEASE=20.04

# DISTRIB_CODENAME=focal

# DISTRIB_DESCRIPTION="Ubuntu 20.04.6 LTS"

# NAME="Ubuntu"

# VERSION="20.04.6 LTS (Focal Fossa)"

# ID=ubuntu

# ID_LIKE=debian

# PRETTY_NAME="Ubuntu 20.04.6 LTS"

# VERSION_ID="20.04"

# VERSION_CODENAME=focal

# UBUNTU_CODENAME=focal

# ##########################

# NOTE; it's possible locations change with versions (very likely!) so /etc/php/7.4/ and similiar references may not be the same as your system in the future!

# ##########################

# Download the installation software from:

# http://downloads.sourceforge.net/project/zabbix/ZABBIX%20Latest%20Stable/2.4.6/zabbix-2.4.6.tar.gz

# Transfer the gz file to the Raspberry Pi 2 putting it in the /opt folder.

# Become root or use sudo in front of each of these commands

sudo su

groupadd zabbix

useradd -g zabbix zabbix

passwd zabbix

# Install dependencies

apt-get install make apache2 libapache2-mod-php php-mysql mysql-server mysql-common libiksemel-dev libiksemel-utils libxml2-dev libxml2-utils libxml2 snmp libsnmp-dev libsnmp-perl libssh2-1-dev libssh2-1 libcurl4 libghc-curl-dev libmysql++-dev php-gd php-bcmath php-mbstring php-xml -y

# The mysql-utilities package may be needed but is not available natively (I'll see about coming back to this)

# Verify mysql is running

service mysql status

# Verify you are in the zabbix installation directory (example: /opt/zabbix-2.4.6)

# Run the installation/configure of Zabbix

./configure --enable-server --enable-agent --with-mysql --with-libxml2 --with-net-snmp --with-ssh2 --with-libcurl

# --with-jabber was removed as it created an error during the configure.  It's optional as it's a feature of Zabbix that allows users to send notifications via Jabber.

# Complete the install; note there could be many warnings about "<sys/sysctl.h> header" which are ok to ignore.

# Warning: This could take a very long time.

make install

# Copy init scripts

cp /opt/zabbix-2.4.6/misc/init.d/debian/* /etc/init.d/

# Setup the web pages

mkdir /var/www/zabbix/

cp -r /opt/zabbix-2.4.6/frontends/php/* /var/www/zabbix/

chown -R www-data:www-data /var/www/zabbix/

# Create the database

# Note; the IDENTIFIED BY in single quotes below is the password.

mysql -uroot -p

create database zabbix character set utf8 collate utf8_bin;

CREATE USER 'zabbix'@'localhost' IDENTIFIED BY 'zabbix';

grant all privileges on zabbix.* to zabbix@localhost;

set global log_bin_trust_function_creators = 1;

quit;

# Import the SQL data for the database

# Note; this utilizes the default password from above

# Warning: This could take a very long time.

mysql -uzabbix -pzabbix zabbix < /opt/zabbix-2.4.6/database/mysql/schema.sql

mysql -uzabbix -pzabbix zabbix < /opt/zabbix-2.4.6/database/mysql/images.sql

mysql -uzabbix -pzabbix zabbix < /opt/zabbix-2.4.6/database/mysql/data.sql

# Verify database installation

mysql

show databases;

#+--------------------+

#| Database           |

#+--------------------+

#| information_schema |

#| mysql              |

#| performance_schema |

#| sys                |

#| zabbix             |

#+--------------------+

use zabbix;

show tables;

select * from users;

quit;

# Prepare file system folders

mkdir -p /var/log/zabbix

chown -R zabbix:zabbix /var/log/zabbix/

mkdir -p /var/zabbix/alertscripts

mkdir -p /var/zabbix/externalscripts

chown -R zabbix:zabbix /var/zabbix/

mkdir /var/www/html/zabbix

cd ~/zabbix-2.4.6/frontends/php

cp -a . /var/www/html/zabbix/

chown -R www-data:www-data /var/www/html/zabbix

chmod +x /var/www/html/zabbix/conf/

# Adjust the config file to match below lines (change password if different than default)

nano /usr/local/etc/zabbix_server.conf

LogFile=/var/log/zabbix/zabbix_server.log

DBUser=zabbix

DBPassword=zabbix

AlertScriptsPath=/var/zabbix/alertscripts

ExternalScripts=/var/zabbix/externalscripts

# Adjust the php settings

nano /etc/php/7.4/apache2/php.ini

post_max_size = 16M

max_execution_time = 300

max_input_time = 300

date.timezone = 

# Bypass a version check as the newer PHP versions take care of this issue but the UI errors

nano /var/www/html/zabbix/include/classes/setup/CFrontendSetup.php

# #################

# Original Code:

// check for deprecated PHP 5.6.0 option 'always_populate_raw_post_data'

if (version_compare(PHP_VERSION, '[B]5.6[/B]', '>=')) {

         $result[] = $this->checkPhpAlwaysPopulateRawPostData();

# After making the change:

// check for deprecated PHP 5.6.0 option 'always_populate_raw_post_data'

if (version_compare(PHP_VERSION, '[B]7.5[/B]', '>=')) {

         $result[] = $this->checkPhpAlwaysPopulateRawPostData();

# ##################

nano /var/www/html/zabbix/include/func.inc.php

# ##################

# Original Code:

function str2mem($val) {

        $val = trim($val);

        $last = strtolower(substr($val, -1));

        switch ($last) {

                case 'g':

                        $val *= 1024;

                        /* falls through */

                case 'm':

                        $val *= 1024;

                        /* falls through */

                case 'k':

                        $val *= 1024;

        }

        return $val;

}

# After making the change:

function str2mem($val) {

        $val = trim($val);

        $last = strtolower(substr($val, -1));

        $val = substr_replace($val, "", -1);

        switch ($last) {

                case 'g':

                        $val *= $val * 1024;

                        /* falls through */

                case 'm':

                        $val *= $val * 1024;

                        /* falls through */

                case 'k':

                        $val *= $val * 1024;

        }

        return $val;

}

# ##################

# ##########################

# Create startup file for the server

# Note; this will get it going on boot but needs improved for functioning with other commands.

# ##########################

nano /etc/systemd/system/zabbix-server.service

[Unit]

Description=zabbix-server

[Service]

Type=forking

ExecStart=/etc/init.d/zabbix-server start

[Install]

WantedBy=multi-user.target

# Create startup file for the agent

# Note; this will get it going on boot but needs improved for functioning with other commands.

nano /etc/systemd/system/zabbix-agent.service

[Unit]

Description=zabbix-agent

[Service]

Type=forking

ExecStart=/etc/init.d/zabbix-agent start

[Install]

WantedBy=multi-user.target

# Set permissions on the startup files

chmod 644 /etc/systemd/system/zabbix-*

# Temporarily move the control scripts

mv /etc/init.d/zabbix-* /.

# Setup the services

systemctl daemon-reload

systemctl enable zabbix-server zabbix-agent apache2

# Move files back to their original location

mv /zabbix-* /etc/init.d/.

systemctl restart zabbix-server zabbix-agent apache2

# Open Zabbix UI web page

# The default URL for Zabbix UI when using Apache web server is http://host/zabbix

# The default user/password is Admin/zabbix

# ##########################

# This is where I played around with uninstalling MySQL 8 and trying to get 5.7

# It wouldn't pull 5.7 due to no ARM support

# ##########################

sudo systemctl stop mysql

sudo apt autoremove

sudo apt autoclean

wget https://dev.mysql.com/get/mysql-apt-config_0.8.12-1_all.deb

sudo dpkg -i mysql-apt-config_0.8.12-1_all.deb

In the prompt, choose Ubuntu Bionic and click Ok

The next prompt shows MySQL 8.0 chosen by default. Choose the first option and click OK

In the next prompt, select MySQL 5.7 server and click OK.

The next prompt selects MySQL5.7 by default. Choose the last otpion Ok and click OK

gpg --keyserver repo.mysql.com --recv-keys B7B3B788A8D3785C

gpg --export --armor B7B3B788A8D3785C | sudo apt-key add -

sudo apt-get update 

sudo apt-cache policy mysql-server

Security+ Topic - Penetration Testing Authorization

At some point in an IT administrators career they do a little dabbling in penetration testing of systems that they have access to. Sometimes these tests start as a simple check of vulnerabilities on their own system and sometimes it ends up being a test against the companies production servers simply because they are curious. What most of these casual or introductory penetration testers do not take into account, is that some of those test could cause a server to stop responding. If the administrator is working against a lab environment or a couple of servers that are not in production, this is usually not a big deal. A simple reboot and then things are back up and running. Things get a bit messier when that same thing happens against the production environment. The owners of a company do not usually take kindly to when their production servers go offline. Let's talk about using a test lab for a moment. Generally speaking a company will have enough resources for an IT administrator to setup a test lab. Some will have a fully virtualized environment that the administrator can simply spin up a few virtual machines into a separate VLAN to do their testing. On the other end of the spectrum is a tight budget IT department with scrutinized purchases. No matter where you are on the spectrum, there is still room for making sure that your penetration testing is not initially on production systems. The reason for these environments is pre-planning in regards to getting authorization for penetration testing on production systems. If you were to go to your management with an idea of penetration testing your production environment and they asked you what the impact would be, the only realistic answer would be that you do not know. Management wouldn’t take too kindly to not knowing if their servers were to go down and because you were the one to take them offline, you are the one getting fired. Doing testing within a lab environment gives you the pushing power for completing tests in a production environment. Company implementations of their server setup are unique and the tests in your lab environment must match that environment as close as possible. After the tests have been completed in the lab environment with proof of what may or may not happen, then you can go to management with a plan for the production environment. Sometimes you may find that a certain vulnerability test identifies an issue in the lab environment and a simple patch corrects the issue. After applying the patch in the lab and verifying functionality, it can then be pushed to the production environment. Once this is completed a plan can be presented to management for a specific vulnerability test in which you confirm the patch is in place and you would like to confirm that the correction is working properly. A lot of what this boils down to is making sure you have permission. Without permission, when something goes wrong it is you who takes the brunt of management. With an outlined plan for what you would like to do and how it is going to be implemented, management can sign off on the process which frees you from repercussions if something happens. Making sure to have all your documentation in place and a plan for what is happening is key to correct authorization.

Security+ Topic - Dictionary Cryptographic Attack

How effective is a Dictionary Cryptographic Attack?  Seriously, how many people really use the word password as their password?  Well according to Wikipedia, password was in the number four spot for 2019 and in the number two spot for the previous 6 years!  That is really amazing and goes to show just how effective a dictionary attack can be even though IT administrators have been enforcing strong passwords for a very long time.  It really is no wonder so many accounts get compromised just based off a dictionary attack.

If we stick with only alpha-numeric passwords from 2019 on the Wikipedia list, these simple passwords are crazy easy to defeat.  password, iloveyou, admin, lovely, welcome, princess, and dragon top their list.  If these are the top of the list then we can only imagine what other words are commonly used but are not used quite enough to make the list.  Granted there are other mitigation techniques to this type of attack such as a limit on the number of attempts, source of login restriction, or up-to-day blacklists to name a few.  This still doesn’t excuse the use of extremely weak passwords based on the dictionary.

I’ve posted in the past about tools you could use which have dictionaries built in and are able to speed through them in their attempts to log into the account.  On top of that, rainbow tables already include most (if not all) of the dictionary and can match a simple dictionary password extremely fast.  In reality we have to take into considerations the default password on customer devices such as DSL Modems, Cable Modems, SoHo Routers, and switches to name a few.  These are most likely the biggest culprit of these easy dictionary passwords.  Still when you weed out those from the list, there are plenty of other simple dictionary passwords that are in use.

What is really boils down to is the fight in regards to “ease of use” vs “secure environment”.  Why do people use simple dictionary passwords?  They are simple to use.  I’ve seen a meme that says “I changed all my passwords to incorrect so whenever I forget it will tell me  that my password is incorrect”.  There is always some truth in every joke and this joke really has application to why a dictionary attack works.  Just last week I went to log into a bank and couldn’t remember my password.  I tried to reset it but it told me that I couldn’t re-use a password that I previously used.  What happened is that I was forced to change my password so many times that I didn’t even know my own password and was forced to use a password I never remember.  Hence the introduction of simple passwords brought from frustration.

End users will almost always use the most simple password that they can come up with.  If their favorite childhood book is “The Cow Jumped Over the Moon” and they have a fond memory of it, their password is now “thecowjumpedoverthemoon”.  The point that I would like taken away from this is to make sure and use a secure password that will be much less vulnerable to a dictionary attack while still maintaining ease of use.  Enforce a password policy that lets the user have a password they can remember such as “thec0wjump$dOVERthem00n” without making your organization vulnerable to a dictionary attack. Aka, not that password.

Security+ Topic - Always On VPN

Having remote access to a corporate or private network is a very powerful tool in the security toolbox. While the setup of a VPN server and client software can take some time, the time-cost benefit is ease of mind when doing work remotely. In the IT industry we know to make sure and connect to secure WiFi and not perform sensitive work on untrusted networks. This is not always the case for remote employees who just want to get the job done quickly and without hassle. This is where some advantages of an Always On VPN setup come into play.

The next question to address for this is what is Microsoft Always On VPN? Historically Microsoft had the DirectAccess remote access process and the Always On VPN is a recreation and improvement on that secure access process. As the name implies, this technology is always running in the background and does not require the user to manually connect. One exception to the rule is if the user is required to enter two-factor authentication as part of the VPN access. When the user is connected via the Always On VPN solution, it is just like they are at their company workplace and able to work on their data or applications as if they were on-site.

When looking at the required items for getting this up and running, it looks similar to the historic DirectAccess setup. As part of evolution of products though, there are many more benefits that the Always On VPN provides such as traffic filtering, granular restriction of network resources via administration controls, working with non-domain workstations and servers, as well as integration with Azure Active Directory. Even further into the benefits is something that most IT administrators will already be familiar with such as where the user is connecting from, the health of the end device, and credential authorizations.

There are a few nuts and bolts to take into consideration of implementing the Always On VPN solution. The process it not yet turn-key but hopefully we will get closer to that goal in the future. The upside of implementing Always On VPN is that most of the underlying components for setup are already in most company setups. The connected components are as follows:

Domain Controllers
DNS Servers
Network Policy Server (NPS)
Certificate Authority Server (CA)
Routing and Remote Access Server

Part of the implementation is that Always On VPN uses Mobile Device Management which provides for flexibility including System Center Configuration Manager, Intune, and other third party platforms. These combined with the multi-factor authentication make for a strong processes in either granting access or denying access.

To further mitigate risk and help control the access, Azure is able to detects sign-in risks based on the behavior of the sign-in request and potentially even blocking a user if warranted. If the location of connection is deemed less secure, there may be a need to prove identity prior to finalizing connection. There is also the ability to restrict access to only corporate-owned and managed devices.

Using Microsoft Always On VPN makes securing the end user and more as seamless as possible. While there is a bit of setup to take on, the benefits are huge. Bringing in a swath of options such as non-enterprise licenses end devices and non-domain joined nodes, Always On VPN is a great option for VPN implementation.

Security+ Topic - ACL

A recent concern of mine is the understanding of Access Control Lists, or ACLS's. This might sound like an entrance to a club and if you did, you are completely right!  Minus the hoppin music for the club anyway. Access Control List do exactly as they say and prevent the movement of data from an ingress to a device or filter to the egress side.  Depending your device it could be setup so the Access Control List works bi-directional or only one way.

As data moves from one network to another we need to be sure to secure it in more than one way and with more than one device.  Tracking all this change can be a bit cumbersome but isn’t that what security is all about. Sacrificing ease of access for security.  In our case here, change control play a key role in making sure that the troubleshooting process is minimized at a later date.

Let's take the scenario of a person's firewall and a simple Cisco router.  It is fairly simple to tell a personal computer firewall to block traffic on a port.  Now let’s take this one step further and as a network or system administrator you decide to block outbound FTP connections at the computer level.  A Group Policy Object is put into place where you have every desktop firewall in the domain blocking FTP outbound. When techy user Joe comes into work the next day and the functionality stops working, they decide to make a change or completely bypass that firewall rule.

Disclaimer; in reality this type of computer based firewall rule would probably be implemented in reverse but for the sake of discussion we are working on it this way.

The other item of concern here is that depending on the level of hardware at the site, it may not allow the functionality of blocking certain ports outbound (only inbound).  This is where the beauty of our Cisco’s (in this scenario) router comes into play with the Access Control Lists that we can apply on it. At this point we are introducing network level blocking via the Access Control List so that not only if the firewall rules in place are bypassed but any new or unexpected devices on the network are blocked as well.

At this point we have the ability to lock down in either direction we want and what network we want.  By applying the Access Control List to the outside interface on a router, the block will happen network wide but what if we want to get a bit more granular with what networks are getting blocked or allowed.  Again making sure that change control and documentation are up to date and followed, the Access Control List can be applied to each subnet’s interface.

By applying the Access Control List to each subnet’s interface, a new network for a specific department could be allowed access on certain ports that other networks are blocked on.  The other part of this configuration is that one internal network could be allowed a certain port to another internal network but not a third internal network.

I have been speaking in regards to ports throughout this post but in reality it can be applied to networks and protocols as well.  At this point you may be thinking to yourself that this sounds very close to a network firewall and you’d be right. ACL’s are basically a simple, poor mans, or redundant firewall for the network.  Security is about layering and if one firewall is compromised you can stop an intruder in their tracks by making sure your network ACL’s are working in tandem with your firewall.

Security+ Topic - Wireless Antennas and Power

I’m not sure I know of anyone who doesn’t use wifi.  It has become part of our everyday lives and without it I am not sure some people would know to cook.  When it comes to our homes, most of us will simply plug in an access point and we are good with the setup as long as we can get a signal in our living room.  In business, most IT departments will setup a distribution of access points to cover the entire area as seemless as possible.  Both of these are great strategies but there is another scenario that I would like to bring up as the normal setup provides an easy gateway for any attacker to monitor your wireless network.

I worked with a gentlemen that setup wireless communications between buildings for companies.  Now this sounds like a task that almost any IT person could accomplish but the reason he was contracted for it was that this connection needed to be secure.  Some of you may be saying at this point that they could just setup WPA2 and be done.  The little  bit of information here that is missing is the antenna used for the communication.  Generally, antennas will be omni-directional which means that the signal goes in every direction.  This is good for most setups but not for the ultra-secure setups needed by this company.  Antenna design is something that can go very in depth and I have experimented with designs as an amature radio operator so I will not be going into the details here except to give you an overview.

The antenna that needs to be used for this scenario is a yagi antenna that points the signal as much as possible in one direction.  This is not to say that the signal will be one hundred percent in one direction.  Signals will still propagate in every direction but the yagi antenna does a great job of focusing the signals in one direction.  Generally there will be a little bit of back-black of signal but it is not that big of radiation in the direction opposite of where you are pointing.  There are two benefits to this.  One being that signals can be pin-pointed to the target.  The second is that a yagi antenna can help extend the distance of the signal.  I encourage you to take a look into the yagi radiation pattern if this is something that sounds interesting to you.

Now comes the part of actually verifying that your antenna is doing what you want it to do by performing a site survey.  I personally use software called Heatmapper where I can import my own image (or floorplan) for where the signal is the strongest.  Basically you walk around the office clicking on where you are and the software creates a heat map of how strong the wireless signal is.  In the original application, it is good to see if every square inch of the office is able to get its wireless signal.  In the second part of this top, talking about a yagi, it can work wonders on if your antenna is working correctly by only giving signal in one direction.  Basically we are looking for an oblong shape of a signal and the heat map software will show strong signal in one direction away from the access point antenna.