• úvod
  • témata
  • události
  • tržiště
  • diskuze
  • nástěnka
  • přihlásit
    registrace
    ztracené heslo?
    SHORTYMikrotik, Alix a jina mala reseni... Arduino, RaspberryPi, Mikrotik, Alix a jina mala reseni...

    OS

    imedialinux.com
    Voyage Linux
    RouterOS/

    Platformy

    PC Engines
    Mikrotik

    Prislusenstvi

    ...

    Reseni

    router, prehravac, ap, monitorovatko, filestorage
    rozbalit záhlaví
    ROENICK
    ROENICK --- ---
    DANYSEK: to byla jen poznamka, podstata tweetu je jinde. A pricin proc ti nekdo upravi http provoz muze byt spousta
    DANYSEK
    DANYSEK --- ---
    ROENICK: resi dusledky, nikoliv priciny...
    ROENICK
    ROENICK --- ---
    DANYSEK: on narazi na to, ze ti pak do http webu nekdo cestou vlepi cryptominer..coz se do https dava blbe. Nemusi to bejt router, ISP vkladali reklamy apod...
    DANYSEK
    DANYSEK --- ---
    ROENICK: seznam hezkej, ale Spackova zkratka je o hovne. Problem je nezabezpecenej management routeru otevreny do sveta, nikoliv absence HTTPS vsudemozne...
    ROENICK
    ROENICK --- ---

    @spazef0rze

    Shodan umí vytvářet i hezké reporty. Tady jsou např. aktuálně napadené routery Mikrotik, které do stránek vkládají skript na těžení kryptoměny:
    https://t.co/ciJPmgOr3w (mimochodem: i proto by HTTPS mělo být všude, i na statických stránkách) #LinuxDays
    NYXEL
    NYXEL --- ---
    Jn, to jsou spis takovy "roztomilosti" :D
    ATAN
    ATAN --- ---
    Neni to nic hrozneho:

    CVE-2018-1156: An authenticated user can trigger a stack buffer overflow.
    CVE-2018-1157: File upload memory exhaustion. An authenticated user can cause the www binary to consume all memory.
    CVE-2018-1158: Recursive JSON parsing stack exhaustion, which could allow an authenticated user to cause crash of the www service.
    CVE-2018-1159: www memory corruption, if connections are initiated and not properly cleaned up then a heap corruption occurs in www.
    FATBOZZ
    FATBOZZ --- ---
    ATAN: Doplnil bych i zbytek :)

    What's new in 6.42.7 (2018-Aug-17 09:48):

    MAJOR CHANGES IN v6.42.7:
    ----------------------
    !) security - fixed vulnerabilities CVE-2018-1156, CVE-2018-1157, CVE-2018-1158, CVE-2018-1159;
    ----------------------

    *) bridge - improved bridge port state changing process;
    *) crs326/crs328 - fixed untagged packet forwarding through tagged ports when pvid=1;
    *) crs3xx - added command that forces fan detection on fan-equipped devices;
    *) crs3xx - fixed port disable on CRS326 and CRS328 devices;
    *) crs3xx - fixed tagged packet forwarding without VLAN filtering (introduced in 6.42.6);
    *) crs3xx - fixed VLAN filtering when there is no tagged interface specified;
    *) dhcpv4-relay - fixed false invalid flag presence;
    *) dhcpv6-client - allow to set "default-route-distance";
    *) dhcpv6 - improved reliability on IPv6 DHCP services;
    *) dhcpv6-server - properly update interface for dynamic DHCPv6 servers;
    *) ethernet - improved large packet handling on ARM devices with wireless;
    *) ethernet - removed obsolete slave flag from "/interface vlan" menu;
    *) ipsec - fixed "sa-src-address" deduction from "src-address" in tunnel mode;
    *) ipsec - improved invalid policy handling when a valid policy is uninstalled;
    *) ldp - properly load LDP configuration;
    *) led - fixed default LED configuration for RBLHGG-5acD-XL devices;
    *) lte - added signal readings under "/interface lte scan" for 3G and GSM modes;
    *) lte - fixed memory leak on USB disconnect;
    *) lte - fixed SMS send feature when not in LTE network;
    *) package - do not allow to install out of bundle package if it already exists within bundle;
    *) ppp - fixed interface enabling after a while if none of them where active;
    *) sfp - hide "sfp-wavelength" parameter for RJ45 transceivers;
    *) tr069-client - fixed unresponsive tr069 service when blackhole route is present;
    *) upgrade - fixed RouterOS upgrade process from RouterOS v5;
    *) userman - fixed compatibility with PayPal TLS 1.2;
    *) vrrp - fixed VRRP packet processing on VirtualBox and VMWare hypervisors;
    *) w60g - added distance measurement feature;
    *) w60g - fixed random disconnects;
    *) w60g - general stability and performance improvements;
    *) w60g - improved MCS rate detection process;
    *) w60g - improved MTU change handling;
    *) w60g - properly close connection with station on disconnect;
    *) w60g - stop doing distance measurements after first successful measurement;
    *) winbox - added "secondary-channel" setting to wireless interface if 80 MHz mode is selected;
    *) winbox - fixed "sfp-connector-type" value presence under "Interface/Ethernet";
    *) winbox - fixed warning presence for "IP/IPsec/Peers" menu;
    *) winbox - properly display all flags for bridge host entries;
    *) winbox - show "System/RouterBOARD/Mode Button" on devices that has such feature;
    *) wireless - added option to disable PMKID for WPA2;
    *) wireless - fixed memory leak when performing wireless scan on ARM;
    *) wireless - fixed packet processing after removing wireless interface from CAP settings;
    *) wireless - updated "united-states" regulatory domain information;
    NYXEL
    NYXEL --- ---
    Uz mam vsude 8)
    Delal jsem to o vikendu ;))
    ATAN
    ATAN --- ---
    Nezapominame aktualizovat na 6.42.7. CVE-2018-1156, CVE-2018-1157, CVE-2018-1158, CVE-2018-1159
    OTZ
    OTZ --- ---
    ROENICK: jo, snazi se tam nacpat bud pres telnet nebo ssh..

    DANYSEK: uz ne. nicmene "ja" to nemam, delam tu jenom technika, na adminu a vymejsleni pravidel jsou tu jini. tofuzel, nez se neco takovyho zprocesuje (vzdalenej upgrade z verzi cca od 6.35 i starsich + rekonfigurace x stovek RBcek, nejlip na bezdratech, kde se leckdy vyskytne nejaky prekvapeni :)), tak to trva tydny a mesice.. (taky me to sere, melo se to resit hned, aspon nouzove, ale..). ale zase je to zgruntu, tak snad uz to bude dobry. aspon jsme se pres prazdniny nenudili :D
    DANYSEK
    DANYSEK --- ---
    OTZ: A to fakt mas otevrenej management do celyho sveta? Proc, proboha...? :)
    ROENICK
    ROENICK --- ---
    OTZ: telnet? orly? :)
    OTZ
    OTZ --- ---
    ROENICK: jo s tim ted bojujem. nejakej bot nam prolomil heslo pres telnet na vsech RB na verejkach a nahral si tam nejaky ppp skripty, curag. nejde to pak upgradovat normalne, musi se pres netinstall...
    LEXXA
    LEXXA --- ---
    DELVIT: kdybys chtel neco extra schodou okolnosti distributor pro cr pracuje u nas ve firme. tak muzem neco poresit
    DELVIT
    DELVIT --- ---
    LEXXA: škoda té podpory u Mirotiku, tím jsem vyloučil další věc z nákupu. Čísté neo není už je jenom s NFC. Díky za rady.
    LEXXA
    LEXXA --- ---
    DELVIT: jenom nano bylo zatim kompromitovano. je neo a pak je neo nfc a pak je neo s usbc.
    ale abychom nebyli ot. ani jedno z toho nepodporuje mikrotik nativne.
    leda ze bys to resil pres ssh jump host ve virtualu.
    DELVIT
    DELVIT --- ---
    nebo nějakou alternativu? Jako - https://shop.nitrokey.com/shop
    DELVIT
    DELVIT --- ---
    LEXXA: Aha, díky. No právě bych si rád pořídil neo (to je to nfc ne? Nebo máš něco zvlášť?) a tu 4ku. Koupím to normální 4ku, ta je v pohodě?
    LEXXA
    LEXXA --- ---
    DELVIT: mam neo, dvojku a nfc. :)
    Kliknutím sem můžete změnit nastavení reklam