Mastodawn

Markus Sugarhill

1d ago

@geerlingguy but is it made in US when all your components for it are not made in US?

McTwist 1d ago

@geerlingguy Exactly my thought when I heard about this silliness.

Aho 1d ago

@geerlingguy a silly question I sometimes ask Steven J. Vaughan-Nichols, thinking of moving to the land of the free or as some call it Canada?

maya_b 🇨🇦1d ago

@geerlingguy

shakedowns are not tariffs.

Michael T Babcock 1d ago

@geerlingguy as a guy who's been building his own routers professionally for decades now, this is great advice. Also its really quite easy (and always has been with the right knowledge).
Just PLEASE don't run additional software on your routers. Run them on a device *behind* the router. You'll thank me eventually.
#firewall #router #sysadmin #networking

@mikebabcock @geerlingguy

Madagascar_Sky 1d ago

Lol, that sounds like wisdom earned through blood and tears

Michael T Babcock 1d ago

@Madagascar_Sky @geerlingguy among other things, your 'forward' rules used to restrict access to your LAN don't apply directly to local services. Your INPUT rules for local services don't apply to forwarded things. And if you have an allocated fixed IP range from your ISP, you probably want to bridge instead of forwarding your interfaces as well.
Should totally document my standard Linux router setup some day.

@mikebabcock @geerlingguy

Madagascar_Sky 1d ago

Make YouTube shorts, you'll reach the youngins so easily. Linux wisdom by bonafide sorcerer. Blood magic Linux this way.

@Madagascar_Sky @mikebabcock @geerlingguy I’m inclined to agree it will reach more eyes.

But a 3 minute short is not much time to cover firewalling. Not in sufficient detail.

There is so much you need to know about networking and services to be able to understand what the firewall is doing and what impact it will have other than just breaking things.

Admittedly less than packet sniffing.

😈

@drscriptt @Madagascar_Sky @geerlingguy see also "just turn off #selinux" on every package.

@mikebabcock @Madagascar_Sky @geerlingguy I say “no” followed by “not yet” and “not without explicit information on why it won’t work with SELinux enabled” when people suggest that I should disable SELinux or similar things.

@drscriptt so there I am on the phone with tech support for a database vendor and he explains that licensing isn't working because #SELinux is enabled, so I set it to permissive, log the errors, make an appropriate permissions list, compile and turn it back on.
He says "nobody in house has made it work with SELinux on" -- obviously none of them spent 15 minutes learning how to use the tools. Ugh. #rant

@mikebabcock that sounds about like what I’ve seen most other people not try to do.

Kudos to you sir!

What database?

I was actually thinking Oracle when I typed my previous comment.

Aside; I’ve seen a very small number of things fail in permissive mode but work when disabled. That was weird. It too required audit log mining and updating the policy to make work.

@drscriptt

I've also run into this, and there are ways around it, but its really annoying. It usually means the software is doing something pretty non-standard and makes you wonder.

That said, I'm not going to throw the (much smaller than Oracle) vendor under the bus ... but much smaller.

Analog AI 18h ago

@mikebabcock @drscriptt @Madagascar_Sky @geerlingguy
Like windows software which says "if you get antivirus errors, ignore them".

@Retreival9096 @drscriptt @Madagascar_Sky
I have different feelings about Windows AV than I do about mandatory access controls like SELinux.

We ship a small terminal emulator internally to clients. We do not pay the Microsoft tax to have them sign it. As a result, Defender yells at everyone that it might not be safe. Why? Because we didn't pay the tax. Not because its safer to use signed software; it isn't.

#rant #antivirus

@mikebabcock @Retreival9096 @Madagascar_Sky could you sign it with an internal private corp cert and load the root cert I to clients to avoid this issue?

I was involved in a different discussion elsewhere about this.

Michael T Babcock 17h ago

@drscriptt @Retreival9096 @Madagascar_Sky this gets around the Microsoft warnings but not the random AV warnings. I also don't like loading additional certs on client machines when I'm "just a vendor" and not their own IT. Respect and all that.
So yes I right-click AV, disable for 10 minutes, load app, re-enable.

DrScriptt 17h ago

@mikebabcock @Retreival9096 @Madagascar_Sky I’m surprised that the AV doesn’t trust the local root certificate store. 🤔 TIL

I share your concern about a root certificate as a vendor.

In corporate IT there is more freedom for such things.

Though lately I’ve been messing with name based constraints as I work on things.

It’s an ongoing effort that both works (for the name on the tin) and doesn’t work (for IPs when name constraining to corp domain) at the same time.

Doing unconstrained allows me to sign SANs for the FQDN, UQN, nickname, and IP.

Michael T Babcock 17h ago

@drscriptt @Retreival9096 @Madagascar_Sky I'd really like a more powerful system-wide cert system (on Linux as well as Windows) with a full ACL rules system.

Cert A trusted for websites only.
Cert B trusted for applications not running as admin.
Cert C trusted for IPSec *and* website authentication.

Relatedly, I'm frequently found ranting about why I hate npm, pip, cargo et al. from a verification perspective.

DrScriptt 17h ago

@mikebabcock I would wonder if you could use (an environment variable which points to) a custom openssl.conf file that has separate configurations specifying where the trusted root certificates are.

Today has been long enough that I don’t remember if it’s .conf or .cnf, so take what I’m saying for a BIG helping of salt.

You might be able to have a custom file that includes the default configuration file and overwrite the CA specification at the end.

Or if OpenSSL’s config is like OpenSSH’s config specify it at the top and nothing comi g after can change it.

You can play (sym)link games to have some of the same certs in custom CA directories as the default CA directory. Or elsewhere if they aren’t in the default.

I’m speculating out of my ring buffer. But that’s what I’d try if I were you.

No, I do t fault you for wanting to do this.

I may blame you a little bit for prompting me to question the same thing.

@mikebabcock @drscriptt @Retreival9096

Madagascar_Sky 16h ago

rpm-ostree all the way baybee!

It's a pain in the ass, but "only sandboxed apps please" is a good approach to making users safe. I think.

I'm sorry, this was off topic. I saw pip and immediately was transported back to vietnam, trying to manage different python environments. Toolbox has made my life so much easier. Python install looking mangled? Delete and re-install.

I'm not a professional dev.

Analog AI 17h ago

@mikebabcock @drscriptt @Madagascar_Sky And if that's explained well to the user, that's great. I don't like those who blanket say ignore warnings without giving the reasons. And having Avira say it thinks something is a virus is different that having Defender say something isn't signed. (Even though both might be safe.)

@Retreival9096 @mikebabcock @Madagascar_Sky @geerlingguy again “no”. 😒

@Madagascar_Sky as much as I love some other people's videos (who I untagged because this is barely about his post at this point), I'm thinking a substack/medium post would be too short to cover the details.

Relatedly, I'm reminded of when quality of service scripts started popping up to magically configure peoples' routers before fqcodel and cake ... nobody was *learning* how things worked, they were just applying fixes like script kiddies.

I want people to understand instead. #technology

@mikebabcock @Madagascar_Sky @geerlingguy

I’d be curious to read such an article.

I should do similar too.

Aside: when the FORWARD and INPUT chain jump to a common (sub)chain, they can share rules. 😈

Assuming iptables which I’ve been doing for … ~25 years.

I remember reading a Sys Admin magazine article about the new iptables in about 2001. Been using it ever sense.

SGOTI 1d ago

@geerlingguy The "Forbidden Router" from Level1 techs. Thanks Jeff, I agree 100%!

@geerlingguy hmm, one of the reasons wifi chipset vendors (for example to provide #OpenWrt support) more and more grown to refuse not just source code but also hardware/programming specifications because of a blind reference to the #FCC not allowing it. It’s understood that with documentation *anyone* can then modify it to use frequencies or modulations not permitted by the #FCC

This is now a completely useless argument, if the FCC doesn’t approve routers anyway, so I’ll say, let them release the full specs! It would actually benefit the router ecosystem to bring up everyone to at least the security of OpenWrt…

Diane 1d ago

@geerlingguy

After thinking of my stash of old routers and hoping I can still get new dev boards... I went and complained to my representative because this is also a stupid rule and congress could overturn it.

Bruce Simpson, Ph.D.1d ago

@geerlingguy Or snag yourself a Dell VEP aftermarket like I did this week for OPNsense development.

Noah Bailey 1d ago

@geerlingguy so true. I’ve been running a #Debian firewall with iptables for the better part of a decade and it’s worked incredibly well. Basically any computer that can boot Linux will work. I even used a USB Ethernet dongle for a while.

edafe 11h ago

@nbailey @geerlingguy

Build it while you can!

Philip 1d ago

@geerlingguy so if they can't sell to consumers but can sell to businesses does that mean that you can still rent a router from your ISP? Is that too "small potatoes" to be the motivation behind this?

Echo Nar 1d ago

@geerlingguy it's also the worst time cause you have to pray that your ISP overlord allows you to use your own hardware 🙃

Steve 1d ago

@geerlingguy trying to ban DIY router builds would fail just like age verification will fail in the open source OS space..

Kroc Camen 1d ago

@geerlingguy I hate to say it, but this is exactly the action you take if your plan is to back-door the internet connection of every US American, in a shoddy fashion

luca 1d ago

@geerlingguy FCC will agree if you add an open tap for NSA free access.

Lykso 1d ago

@geerlingguy Here's how I set up mine: https://lyk.so/debian-router.html

Carlos Solís 1d ago

Is there some solution to replace a fiber optics receiver? I'd like to try self-hosting without requiring a VPS, but I'm not sure if there are any routers that allow me to substitute the one provided by my ISP for that specific case.

panu 1d ago

@csolisr
So you have an FTTH type of setup, right? So why don't you just put your own router right behind the ISP provided fibre to ethernet box?

That's what I do. I treat the ISP device as an untrusted device, a part of the public internet as far as I'm concerned. No need to try to circumvent the ISP device.