Re: [lime-users] Security questions and customizations

 Hi All I have a few questions I’m hoping you can help me with: 1] How do I make the single ethernet port in ubiquiti devices such as the rocket or the bullet a wan interface and not a lan? I’ve added a wan interface and it works but traffic from lan doesn’t pass through to it, I can only ping an internet destination from luci diagnostics, not from actual lan clients. 2] How can I cook my profile for a device that isn’t listed? Can I submit one for addition? Or do I have to compile it manually outside of chef? 3] Is bmx7 already available in chef? If so how do I select it? And most importantly, will it break compatibility with bmx6 nodes if introduced later on? In a more general question, within the same network in chef, what can break compatibility between profiles? I had written Pau a very long mail with these questions but I’m sure it was a little overwhelming [sorry about that ;]. I’m also having spam issues due to a recent server migration. I hope someone can help me with this. Thank you so much in advance! I really appreciate your help. Nicolas From: Nicolas North <nk(a)os.vu> Date: 27 January 2017 at 23:58:59 To: libremesh users <lime-users(a)lists.libremesh.org> Subject:  Re: [lime-users] Security questions and customizations Hi Pau! Thank you very much for your very nice and kind introduction to this “new world” for us. It’s kind of a shocker for us since - as I’ve mentioned - we discovered you exactly when putting the finishing touches on our very long research into olsr based mesh networks, and sparked some heated debate between us as whether to stay with our stable and known setup or to leave it aside and follow on with your project - since it looks extremely exciting. I’m also amazed at the level of work that Axel [and you / others?] have put into bmx7 [I’ve watched the entire presentation from last year just tonight]. It’s very encouraging for me [being a complete security freak] to see others tackling the issue straight-on and with such open-mindedness. I’ve joined the bmx7 ml and will wait to read what they write :] The lack of the web interface in LiMe is kind of scary for us, especially when building networks from scratch where even the slightest indication can make a difference in the real world when installing routers and stuff. I’m already missing the coloured strength indicators from olsr, but I’ll get used to it over time. Thank you for the tips: I’ll try adding wpa2/aes to the AP wireless network. I’m trying with: option ap_encryption 'psk2/aes'  option ap_key 'your-secret-password’ I now have reworked our naming conventions and allowed for a mixed-band SSIDs. Back to actual technical problems ;] I’ll hold off on 802.11s for now as I’m eagerly waiting for bmx7. Is it already available in chef? If so how do I select it? And most importantly, will it break compatibility with bmx6 nodes if introduced later on? In a more general question, within the same network in chef, what can break compatibility between profiles? A "big chunk" of our research was getting our firmware on every device possible, and we’ve been having a lot of fun with GL Inet mini-routers, that have performed optimally in our tests, supporting both the AP and MESH wireless networks with high speeds and low latency. Also we’ve been experimenting with portable wifi routers / power banks, that are based on older GL Inet router boards, with the idea of using them as a replacement for traditional 3G hotspot, therefore creating a dynamic mesh topology that follows you and others around. How could I, for instance, cook my profile for a device that isn’t listed? Can I submit one for addition? Or do I have to compile it manually outside of chef? Our network aims to be a city-wide network. It’s a nearly-impossible ambition, but there’s nothing stopping us from trying. Our dream is to have it everywhere, and therefore its security is obviously a core issue. I think that bmx7 combined with some kind of online web-of-trust could be good solution one day, for now we’ll have to wait and see how things evolve. I hope I’m not violating any ml rules here by saying that our network is a project of our hacker space we’re bringing to life here in Milano, Italia. I won’t say any names in case this does go against the rules [advertising / propaganda / etc… ;]. I’m only mentioning this because, as I wrote on the Ninux ml a few weeks back, I’d love for anyone as passionate as we are about mesh networks to come and check out our humble but ambitious work, and to share with us their experiences, and - who knows - maybe even help us experiment out in the field the next generations of LiMe as you’ve so nicely suggested to us. In any event I really hope to be able to attend one of the next conferences and meet you in person. I also hope we can somehow contribute to your fantastic project in the future beyond simple testing, once we acquire more skilled people that could actually make the difference for you. Thank you so much once again. Please let me know what you think! I hope this makes some sort of sense :] Nicolas From: Pau <pau(a)dabax.net> Reply: libremesh users <lime-users(a)lists.libremesh.org> Date: 23 January 2017 at 19:02:02 To: lime-users(a)lists.libremesh.org <lime-users(a)lists.libremesh.org> Subject:  Re: [lime-users] Security questions and customizations Hi Nicolas. Welcome to the libre-mesh community :) Find my comments in-line. On 23/01/17 03:59, Nicolas North wrote: Commotion VS Libremesh have been always a nice topic since 2013 when we did a talk together on the WCW of Berlin. There have been also some cooperation between teams but obviously we choose different ways. I would say that our approach is more experimental and innovative while their is more conservative. What we do by mixing routing protocols on different layers is kind of crazy for the traditional thinking. But now that it is implemented and working I would say it is was the correct choice. To know more http://libre-mesh.org/howitworks.html However the main missing point IMO for Libremesh is the web interface. It is still on the to-do list. There is a first very-simple implementation but we are planning to write it from scratch using LUCI2 as basis instead. So the current idea under libre-mesh is that you prepare a /etc/config/lime and/or /etc/config/lime-defaults configuration file for your mesh network (it has a lot of options and it is very flexible). And thanks to the implemented heuristics it should automatically work on all your nodes. So one config for all nodes. Thanks to you for working on this also :) WPA2 AP encryption is already implemented and working. Check [1] for more details. About Mesh Encryption, there is currently a thread about this issue. If you rally need this (IMHO a preshared key on a open mesh network makes not sense), you can use 802.11s for link layer instead of Ad-Hoc (which is already supported and tested on LiMe). 802.11s has its on link layer encryption mechanism, but I never tested it. Check this as an example [2]. If everything works as expected you might use these to options on /etc/config/lime (wifi section): option mesh_encryption 'psk2/aes' option mesh_key 'your-secret-password' Let us know if you try it please. About authenticate nodes, LiMe will do it automatically if you choose to use bmx7 instead of bmx6. Bmx7 has very advanced security extensions, much more powerful than OLSR+plugin. However it is still in beta state. You can learn more about bmx7 here [3][4]. But don't worry, everything is done automatically :) [1] http://libre-mesh.org/docs/config.html [2] https://wiki.openwrt.org/doc/howto/mesh.80211s [3] http://bmx6.net/projects/bmx6/news [4] http://bmx6.net/projects/bmx6/documents All this is automatically handled by bmx7. Axel is doing a really good job on this scope. Do not hesitate on joining the bmx mailing list and asking anything you want to know. Using blockchain on a 300MHz MIPS device might be very challenging. I already considered this option on the past but I don't see it as a good solution for the moment. Thanks to you. Cheers! -- ./p4u _______________________________________________ lime-users mailing list lime-users(a)lists.libremesh.org https://lists.libremesh.org/mailman/listinfo/lime-users