[arm-allstar] Address to use SuperMon away from home network

Tue Jan 30 00:12:10 EST 2018

Simon,

   Enquiries to asnode sends you to the IP address of a given node number
it does not actually connect you to a specific port unless specified. The
point is since node numbers are just sequential numbers a hacker or anyone
could write a script to probe every Allstar IP address and its ports. Here
is an example -

 http://41245.asnode.org:8181/allmon/about.php

I pulled this info from google so its no secret. This individual has put
their allmon out there for anyone to see, Since the CURRENT allmon is very
insecure a hacker could get into this system very easily. There are
hundreds out there like this.

So lets say your node was 40000 -

http://40000.asnode.org:80/     << the 0 is default and not needed but you
could put any port there.

would in fact connect a user to your default Allstar web page if it was
port forwarded and you would see this -

THIS IS A TEST !

If you see this the web server is working.

Likewise if you used ssh or putty, etc.   -   ssh 40000.asnode.org -p 222
- you would be connected to this node ssh port assuming it was on port 222.

*73 Doug*

*WA3DSP*

*http://www.crompton.com/hamradio <http://www.crompton.com/hamradio>*

On Mon, Jan 29, 2018 at 11:43 PM, "Simon Keys via arm-allstar" <
arm-allstar at hamvoip.org> wrote:

> Doug, will connections through asnode work if you do not have port 80
> opened on the router?  I hope not!
>
>
> On 30/01/2018 5:19 PM, Doug Crompton via arm-allstar <
> arm-allstar at hamvoip.org> wrote:
>
>> I might add that the asnode.org method while convenient opens a very
>> serious security hole for Allstar. Whomever runs this site is not helping
>> to ensure our security. It is not a hamvoip or Allstar supported site. We
>> would really like to see it shut down as everything we are doing right now
>> is aimed at improving security. Any hacker has an immediate list of every
>> Allstar IP address using this site and could hit every address
>> specifically. I would also warn that because it is an independently run
>> site there is no guarantee it will always be there. Our upcoming DNS
>> rollout will be very secure but it is people like those that run
>> asnode.org that ruin a good thing. Years ago before the big hacker craze
>> this might have been a neat thing to do but not today!
>>
>>
>> *73 Doug*
>>
>> *WA3DSP*
>>
>> *http://www.crompton.com/hamradio <http://www.crompton.com/hamradio>*
>>
>>
>> On Mon, Jan 29, 2018 at 11:11 AM, "Neil Mooney via arm-allstar" <
>> arm-allstar at hamvoip.org> wrote:
>>
>>> Instead of using a dynamic DNS provider you could try using <your node
>>> number>.asnode.org
>>>
>>> If your node is 1001 your address would be 1001.asnode.org
>>>
>>> This works as long as your node is registered with allstarlink and
>>> doesn't need you to install any software to keep the DDNS updated.
>>>
>>>
>>> Regards,
>>>
>>> Neil
>>> ------------------------------
>>> *From:* arm-allstar <arm-allstar-bounces at hamvoip.org> on behalf of
>>> "Doug Crompton via arm-allstar" <arm-allstar at hamvoip.org>
>>> *Sent:* 28 January 2018 18:17:29
>>> *To:* ARM Allstar
>>> *Cc:* Doug Crompton
>>> *Subject:* Re: [arm-allstar] Address to use SuperMon away from home
>>> network
>>>
>>> Maurice,
>>>
>>> A few points....
>>>
>>>   Supermon and allmon are http  applications and for them  to work
>>> externally requires that port 80 tcp be forwarded in your router. Some
>>> providers do not allow outgoing port 80 from their customers although this
>>> is much less common than it use to be. If that is the case the http port
>>> can be changed in the apache configuration.
>>>
>>> In order to reach your system from a remote location you need to use the
>>> public IP address assigned to you by your provider. This is most often a
>>> dynamic address meaning it can change. You could check it using your
>>> allstar with a command  - dns-query <yournode>  The problem is is could
>>> change. The answer is to use a free Dyndns so that you address your home
>>> system by a domain name rather than an IP address. This domain name is then
>>> converted to an IP address which follows any changes that might happen to
>>> it.
>>>
>>> All that being said be aware that the current allmon and supermon
>>> programs of any version are extremely insecure. It is very simple for a
>>> hacker to get into your system and your network if you open up ports to
>>> either of these programs. We are working on a fix for that and it should be
>>> out in an update very soon. Until then I would NOT recommend  opening your
>>> system to remote allmon or supermon.
>>>
>>>
>>> *73 Doug *
>>>
>>> *WA3DSP *
>>>
>>> *http://www.crompton.com/hamradio <http://www.crompton.com/hamradio> *
>>>
>>>
>>>
>>> On Sun, Jan 28, 2018 at 12:58 PM, "Maurice Dake via arm-allstar" <
>>> arm-allstar at hamvoip.org> wrote:
>>>
>>> What address do I use to connect to my home node using SuperMon when
>>> away from my home network?  I’ve tried to use the address listed in the
>>> Allstar registration but that doesn’t go any where.
>>>
>>> _______________________________________________
>>>
>>> arm-allstar mailing list
>>> arm-allstar at hamvoip.org
>>> http://lists.hamvoip.org/cgi-bin/mailman/listinfo/arm-allstar
>>>
>>> Visit the BBB and RPi2/3 web page - http://hamvoip.org
>>>
>>>
>>>
>>> _______________________________________________
>>>
>>> arm-allstar mailing list
>>> arm-allstar at hamvoip.org
>>> http://lists.hamvoip.org/cgi-bin/mailman/listinfo/arm-allstar
>>>
>>> Visit the BBB and RPi2/3 web page - http://hamvoip.org
>>>
>>
>>
>> _______________________________________________
>>
>> arm-allstar mailing list
>> arm-allstar at hamvoip.org
>> http://lists.hamvoip.org/cgi-bin/mailman/listinfo/arm-allstar
>>
>> Visit the BBB and RPi2/3 web page - http://hamvoip.org
>>
>
> _______________________________________________
>
> arm-allstar mailing list
> arm-allstar at hamvoip.org
> http://lists.hamvoip.org/cgi-bin/mailman/listinfo/arm-allstar
>
> Visit the BBB and RPi2/3 web page - http://hamvoip.org
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.hamvoip.org/pipermail/arm-allstar/attachments/20180130/916770e2/attachment.html>