Security on Jaymin Patel

IPSec VPN on OpenWrt: From Config Files to UCI

Mon, 22 Aug 2022 00:00:00 +0530

Setting up an IPSec VPN on OpenWrt used to mean editing /etc/ipsec.conf by hand -- tracking down the right parameters for your topology, debugging misconfigured secrets, and restarting the service after every change. For site-to-site tunnels between branch offices, or road-warrior access for remote employees, the manual approach worked but didn't scale.

Libreswan, the IPSec implementation used in OpenWrt, is a battle-tested VPN stack. But until now, it lacked the configuration layer that makes OpenWrt's ecosystem so powerful: UCI (Unified Configuration Interface). With UCI support, Libreswan joins the rest of OpenWrt's services -- configurable through a consistent interface, scriptable for automation, and manageable at scale.

Persistent SSH Tunnels with Autossh and UCI on OpenWrt

Mon, 04 Jul 2022 00:00:00 +0530

SSH tunnels are the Swiss Army knife of network connectivity. Need to access a device behind NAT? Reverse tunnel. Want to secure traffic over an untrusted network? Local forward. Managing remote routers from a central jump host? Multiple tunnels, multiple ports.

The problem with SSH tunnels is that they die. Network blips, ISP maintenance, DHCP lease renewals -- any interruption kills the connection and the tunnel goes down. Manually SSH-ing back into a remote router to re-establish tunnels doesn't scale past a handful of devices.

Allow Normal User to su Without Password

Sun, 16 May 2010 11:45:00 +0530

All Unix and Linux system will ship with different default policies. Usually these policies don't match the local policies, such as which users are allowed what kind of access to which resources and when. In addition security policies may require non-default authentication and/or logging.

A system administrator must examine the system's configuration files and update them if necessary to enforce local policies. On modern systems PAM (Pluggable Authentication Modules) can be used to configure a wide range of security policies, including which databases to use to authenticate users, minimum password length, max login attempts, special permissions for console users (to various commands and devices), and many other policies.

Sulogin for Single User Mode

Sun, 16 May 2010 11:36:00 +0530

By default on Red Hat Linux, user can enter single user mode simply by typing "linux single" at the GRUB boot-editing menu. Some believe that this is left in to ease support of users with lost root passwords.

In any case, it represents a clear security risk - authentication should always be required for root level access. It should be noted that it is extremely difficult to prevent compromise by any attacker who has knowledge, tools, and full physical access to a system. This kind of measure simply increases the difficulty of compromise by requiring more of each of these factors. These last two items have attempted to address concerns of physical/boot security.