Basic Security - Revision history

Roland at 05:59, 13 August 2013

2013-08-13T05:59:16Z

Roland at 06:01, 27 May 2013

2013-05-27T06:01:03Z

← Older revision		Revision as of 06:01, 27 May 2013
Line 160:		Line 160:
	root@Telem-GWM ~ $		root@Telem-GWM ~ $
	</pre>		</pre>
			=== Secure the Setup and Logs ===
			As setup contains sensitive information it is best to keep it in a safe place. Use special PC or a virtual machine for configuration purposes. Keep the setups in encrypted volume or drive. Don't send setups to third parties. Don't send your setup to Martem. If you must send it to Martem for trouble shooting or any other purposes PLEASE remove the VPN certificates and keys or replace them with empty ones.
			<br />
			<br />
			All most the same applies to logs as well. Just send relevant part from logs.

Roland at 05:59, 27 May 2013

2013-05-27T05:59:53Z

← Older revision		Revision as of 05:59, 27 May 2013
Line 85:		Line 85:
	SSL, OpenVPN and IPsec private and public keys are kept in plain text inside the TELEM-GWM filesystem.		SSL, OpenVPN and IPsec private and public keys are kept in plain text inside the TELEM-GWM filesystem.
	<br />		<br />
			=== Setup History ===
			TELEM-GWM backups automatically old setups. Old and current setup is kept in /usr/local/etc/telem.
			<pre>
			myco2@Telem-GWM ~ $ ls -la /usr/local/etc/telem/
			total 104
			drwxrws--T 3 root gws 1680 Dec 14 14:29 .
			drwxr-xr-x 3 root root 224 Dec 10 13:13 ..
			-rw-rw---- 1 root gws 452 Dec 13 13:34 asciiart
			-rw-r--r-- 1 root gws 4095 Dec 14 14:29 config.xml
			lrwxrwxrwx 1 root gws 27 Jan 1 1970 gpio -> /usr/local/etc/telem/gpio.2
			drw-rw---- 2 root gws 720 Dec 14 13:31 gpio.2
			-rw-rw---- 1 root gws 1936 Dec 14 14:29 gwSetup.bin
			-rw-rw---- 1 root gws 292 Nov 7 11:21 gwSetup.bin.0.old
			-rw-rw---- 1 root gws 5594 Nov 7 11:14 gwSetup.bin.1.old
			-rw-rw---- 1 root gws 292 Dec 14 13:23 gwSetup.bin.new
			-rw-rw---- 1 root gws 878 Dec 14 14:29 hw-run.xml
			-rw-rw---- 1 root gws 878 Dec 13 13:34 hw.xml
			-rw-rw---- 1 root gws 2967 Dec 13 13:34 log-conf.xml
			-rw-rw---- 1 myco2 gws 5480 Dec 14 14:28 setup.tar.xz
			-rw-rw---- 1 root gws 5260 Dec 14 13:23 setup.tar.xz.0
			-rw-rw---- 1 1001 gws 7396 Dec 10 09:56 setup.tar.xz.1
			-rw-rw---- 1 1001 gws 6160 Dec 7 06:50 setup.tar.xz.2
			-rw-rw---- 1 1001 gws 6092 Dec 6 07:19 setup.tar.xz.3
			-rw-rw---- 1 1001 gws 5744 Dec 6 07:16 setup.tar.xz.4
			-rw-rw---- 1 root gws 21 Dec 13 13:34 version
			-rw-rw---- 1 root gws 54 Dec 13 13:34 version-GwLinux-git
			-rw-rw---- 1 root gws 61 Dec 13 13:34 version-Telem-GW-git
			-rw-rw---- 1 root gws 62 Dec 13 13:34 version-buildroot
			myco2@Telem-GWM ~ $
			</pre>
			Old setups can be deleted with command rm.
			<pre>
			root@Telem-GWM ~ $ rm /usr/local/etc/telem/setup.tar.xz.*
			root@Telem-GWM ~ $ rm /usr/local/etc/telem/gwSetup.bin.*
			root@Telem-GWM ~ $ ls -la /usr/local/etc/telem/
			total 48
			drwxrws--T 3 root gws 1088 Dec 14 15:09 .
			drwxr-xr-x 3 root root 224 Dec 10 13:13 ..
			-rw-rw---- 1 root gws 452 Dec 13 13:34 asciiart
			-rw-r--r-- 1 root gws 4095 Dec 14 14:29 config.xml
			lrwxrwxrwx 1 root gws 27 Jan 1 1970 gpio -> /usr/local/etc/telem/gpio.2
			drw-rw---- 2 root gws 720 Dec 14 13:31 gpio.2
			-rw-rw---- 1 root gws 1936 Dec 14 14:29 gwSetup.bin
			-rw-rw---- 1 root gws 878 Dec 14 15:08 hw-run.xml
			-rw-rw---- 1 root gws 878 Dec 13 13:34 hw.xml
			-rw-rw---- 1 root gws 2967 Dec 13 13:34 log-conf.xml
			-rw-rw---- 1 myco2 gws 5480 Dec 14 14:28 setup.tar.xz
			-rw-rw---- 1 root gws 21 Dec 13 13:34 version
			-rw-rw---- 1 root gws 54 Dec 13 13:34 version-GwLinux-git
			-rw-rw---- 1 root gws 61 Dec 13 13:34 version-Telem-GW-git
			-rw-rw---- 1 root gws 62 Dec 13 13:34 version-buildroot
			root@Telem-GWM ~ $ sync
			</pre>
			After updating the configuration the /usr/local/etc/telem folder looks something like so:
			<pre>
			root@Telem-GWM ~ $ ls -la /usr/local/etc/telem/
			total 60
			drwxrws--T 3 root gws 1160 Dec 14 15:12 .
			drwxr-xr-x 3 root root 224 Dec 10 13:13 ..
			-rw-rw---- 1 root gws 452 Dec 13 13:34 asciiart
			-rw-r--r-- 1 root gws 4111 Dec 14 15:12 config.xml
			lrwxrwxrwx 1 root gws 27 Jan 1 1970 gpio -> /usr/local/etc/telem/gpio.2
			drw-rw---- 2 root gws 720 Dec 14 13:31 gpio.2
			-rw-rw---- 1 root gws 1938 Dec 14 15:12 gwSetup.bin
			-rw-rw---- 1 root gws 878 Dec 14 15:12 hw-run.xml
			-rw-rw---- 1 root gws 878 Dec 13 13:34 hw.xml
			-rw-rw---- 1 root gws 2967 Dec 13 13:34 log-conf.xml
			-rw-rw---- 1 myco2 gws 5484 Dec 14 15:11 setup.tar.xz
			-rw-rw---- 1 myco2 gws 5480 Dec 14 14:28 setup.tar.xz.0
			-rw-rw---- 1 root gws 21 Dec 13 13:34 version
			-rw-rw---- 1 root gws 54 Dec 13 13:34 version-GwLinux-git
			-rw-rw---- 1 root gws 61 Dec 13 13:34 version-Telem-GW-git
			-rw-rw---- 1 root gws 62 Dec 13 13:34 version-buildroot
			root@Telem-GWM ~ $
			</pre>

Roland at 05:57, 27 May 2013

2013-05-27T05:57:39Z

← Older revision		Revision as of 05:57, 27 May 2013
Line 83:		Line 83:
	<br />		<br />
	<br />		<br />
	SSL and ~~OpenVPN~~ private and public keys are kept in plain text inside the TELEM-GWM filesystem.		SSL, OpenVPN and IPsec private and public keys are kept in plain text inside the TELEM-GWM filesystem.
	<br />		<br />

Roland at 05:56, 27 May 2013

2013-05-27T05:56:28Z

← Older revision		Revision as of 05:56, 27 May 2013
Line 75:		Line 75:
	=== Plain Text Passwords and Keys in Configuration ===		=== Plain Text Passwords and Keys in Configuration ===
	Passwords for SIM card, http and https are kept in plain text in different configuration files.		Passwords for SIM card, http and https are kept in plain text in different configuration files.
			<br />
	<br />		<br />
	SIM card unlock pin is kept in sim1_chat or in sim2_chat.		SIM card unlock pin is kept in sim1_chat or in sim2_chat.
			<br />
	<br />		<br />
	Passwords for web access is kept in gwSetup.bin. gwSetup.bin is a configuration file for telem-gw, which is main application that runs on Telem-GWM. Setup in XML format is available from web as well. If this is not desirable then this can be disabled from Webservers configuration by un checking the “Enable configuration(gw6config.xml)” selection.		Passwords for web access is kept in gwSetup.bin. gwSetup.bin is a configuration file for telem-gw, which is main application that runs on Telem-GWM. Setup in XML format is available from web as well. If this is not desirable then this can be disabled from Webservers configuration by un checking the “Enable configuration(gw6config.xml)” selection.
			<br />
	<br />		<br />
	SSL and OpenVPN private and public keys are kept in plain text inside the TELEM-GWM filesystem.		SSL and OpenVPN private and public keys are kept in plain text inside the TELEM-GWM filesystem.
	<br />		<br />

Roland at 05:56, 27 May 2013

2013-05-27T05:56:07Z

← Older revision		Revision as of 05:56, 27 May 2013
Line 72:		Line 72:
	=== Restoring Default Accounts ===		=== Restoring Default Accounts ===
	Default accounts with their passwords are kept in default setup which can be restore with DIP switch.		Default accounts with their passwords are kept in default setup which can be restore with DIP switch.

			=== Plain Text Passwords and Keys in Configuration ===
			Passwords for SIM card, http and https are kept in plain text in different configuration files.
			<br />
			SIM card unlock pin is kept in sim1_chat or in sim2_chat.
			<br />
			Passwords for web access is kept in gwSetup.bin. gwSetup.bin is a configuration file for telem-gw, which is main application that runs on Telem-GWM. Setup in XML format is available from web as well. If this is not desirable then this can be disabled from Webservers configuration by un checking the “Enable configuration(gw6config.xml)” selection.
			<br />
			SSL and OpenVPN private and public keys are kept in plain text inside the TELEM-GWM filesystem.
			<br />

Roland at 05:34, 27 May 2013

2013-05-27T05:34:57Z

← Older revision		Revision as of 05:34, 27 May 2013
Line 70:		Line 70:
	</pre>		</pre>
	deletes user martem and it's home directory.		deletes user martem and it's home directory.
			=== Restoring Default Accounts ===
			Default accounts with their passwords are kept in default setup which can be restore with DIP switch.

Roland at 05:34, 27 May 2013

2013-05-27T05:34:11Z

← Older revision		Revision as of 05:34, 27 May 2013
Line 38:		Line 38:
	<br />		<br />
	gws.exe can be used to change passwords by pressing “Change Password” at “SSH Settings” dialog.		gws.exe can be used to change passwords by pressing “Change Password” at “SSH Settings” dialog.
			<br />
			In order to change password for root first change the password for regual user. Then log in again and chage the root password with command passwd.

	=== Adding New Users and Removing Old Accounts ===		=== Adding New Users and Removing Old Accounts ===

Roland at 05:31, 27 May 2013

2013-05-27T05:31:27Z

@@ Line 1: / Line 1: @@
-This is a basic guideline for securing TELEM-GWM. It is assumed that reader is familiar with TELEM-GWM configuration software gws.exe.
+This is a basic guideline for securing TELEM-GWM. It is assumed that reader is familiar with TELEM-GWM configuration software gws.exe and has used Linux command line interface before.
 == Account Management ==
@@ Line 38: / Line 38: @@
 <br />
 gws.exe can be used to change passwords by pressing “Change Password” at “SSH Settings” dialog.

Roland at 05:28, 27 May 2013

2013-05-27T05:28:37Z

← Older revision		Revision as of 05:28, 27 May 2013
Line 8:		Line 8:
	<br />		<br />
	Here is the default /etc/shadow files content:		Here is the default /etc/shadow files content:
	<~~syntaxhighlight lang="bash"~~>		<pre>
	root@Telem-GWM ~ $ cat /etc/shadow		root@Telem-GWM ~ $ cat /etc/shadow
	root:$1$Urv3LxYa$hf.UwazXZLYQmhZ2KWfdk1:10933:0:99999:7:::		root:$1$Urv3LxYa$hf.UwazXZLYQmhZ2KWfdk1:10933:0:99999:7:::
Line 24:		Line 24:
	martem:$1$9Z9vTc0h$eWWGwJgXC6H2o65V1p0Tl1:14477:0:99999:7:::		martem:$1$9Z9vTc0h$eWWGwJgXC6H2o65V1p0Tl1:14477:0:99999:7:::
	root@Telem-GWM ~ $		root@Telem-GWM ~ $
	</~~syntaxhighlight~~>		</pre>
	<br />		<br />
	From command prompt issue command passwd to change current users password. For instance:		From command prompt issue command passwd to change current users password. For instance:
	<~~syntaxhighlight lang="bash"~~>		<pre>
	root@Telem-GWM ~ $ passwd		root@Telem-GWM ~ $ passwd
	Changing password for root		Changing password for root
Line 34:		Line 34:
	Password for root changed by root		Password for root changed by root
	root@Telem-GWM ~ $		root@Telem-GWM ~ $
	</~~syntaxhighlight~~>		</pre>
	changes password for root. Similarly password for user martem can be changed.		changes password for root. Similarly password for user martem can be changed.
	<br />		<br />
	gws.exe can be used to change passwords by pressing “Change Password” at “SSH Settings” dialog.		gws.exe can be used to change passwords by pressing “Change Password” at “SSH Settings” dialog.