Basic Security
This is a basic guideline for securing TELEM-GWM. It is assumed that reader is familiar with TELEM-GWM configuration software gws.exe and has used Linux command line interface before.
Account Management
As the configuration of the TELEM-GWM is done over SSH it is important to change the default accounts passwords. As a minimum change the passwords for users martem and root.
Changing the Default Account Credentials
TELEM-GWM chips with default accounts and known passwords. By default two accounts have passwords set. Only user martem can be used for changing the configuration of the device as root is not permit by SSH daemon configuration.
Here is the default /etc/shadow files content:
root@Telem-GWM ~ $ cat /etc/shadow root:$1$Urv3LxYa$hf.UwazXZLYQmhZ2KWfdk1:10933:0:99999:7::: bin:*:10933:0:99999:7::: daemon:*:10933:0:99999:7::: adm:*:10933:0:99999:7::: lp:*:10933:0:99999:7::: sync:*:10933:0:99999:7::: shutdown:*:10933:0:99999:7::: halt:*:10933:0:99999:7::: uucp:*:10933:0:99999:7::: operator:*:10933:0:99999:7::: nobody:*:10933:0:99999:7::: default:*:10933:0:99999:7::: martem:$1$9Z9vTc0h$eWWGwJgXC6H2o65V1p0Tl1:14477:0:99999:7::: root@Telem-GWM ~ $
From command prompt issue command passwd to change current users password. For instance:
root@Telem-GWM ~ $ passwd Changing password for root New password: Retype password: Password for root changed by root root@Telem-GWM ~ $
changes password for root. Similarly password for user martem can be changed.
gws.exe can be used to change passwords by pressing “Change Password” at “SSH Settings” dialog.
In order to change password for root first change the password for regual user. Then log in again and chage the root password with command passwd.
Adding New Users and Removing Old Accounts
New user can be created with command adduser. For instance:
root@Telem-GWM ~ $ adduser myco Changing password for myco New password: Retype password: Password for myco changed by root root@Telem-GWM
creates new user myco. If new user needs the ability to configure the device it needs to be in the group gws. This can be done with command adduser. For instance:
root@Telem-GWM ~ $ adduser -G gws myco2 Changing password for myco2 New password: Retype password: Password for myco2 changed by root root@Telem-GWM ~ $
creates new user myco2 and adds it to group gws so that myco2 can change configuration.
Now user martem can be deleted with command deluser. For instance:
root@Telem-GWM ~ $ deluser martem root@Telem-GWM ~ $ rm -r /home/martem/ root@Telem-GWM ~ $
deletes user martem and it's home directory.
Restoring Default Accounts
Default accounts with their passwords are kept in default setup which can be restore with DIP switch.
Plain Text Passwords and Keys in Configuration
Passwords for SIM card, http and https are kept in plain text in different configuration files.
SIM card unlock pin is kept in sim1_chat or in sim2_chat.
Passwords for web access is kept in gwSetup.bin. gwSetup.bin is a configuration file for telem-gw, which is main application that runs on Telem-GWM. Setup in XML format is available from web as well. If this is not desirable then this can be disabled from Webservers configuration by un checking the “Enable configuration(gw6config.xml)” selection.
SSL, OpenVPN and IPsec private and public keys are kept in plain text inside the TELEM-GWM filesystem.
Setup History
TELEM-GWM backups automatically old setups. Old and current setup is kept in /usr/local/etc/telem.
myco2@Telem-GWM ~ $ ls -la /usr/local/etc/telem/ total 104 drwxrws--T 3 root gws 1680 Dec 14 14:29 . drwxr-xr-x 3 root root 224 Dec 10 13:13 .. -rw-rw---- 1 root gws 452 Dec 13 13:34 asciiart -rw-r--r-- 1 root gws 4095 Dec 14 14:29 config.xml lrwxrwxrwx 1 root gws 27 Jan 1 1970 gpio -> /usr/local/etc/telem/gpio.2 drw-rw---- 2 root gws 720 Dec 14 13:31 gpio.2 -rw-rw---- 1 root gws 1936 Dec 14 14:29 gwSetup.bin -rw-rw---- 1 root gws 292 Nov 7 11:21 gwSetup.bin.0.old -rw-rw---- 1 root gws 5594 Nov 7 11:14 gwSetup.bin.1.old -rw-rw---- 1 root gws 292 Dec 14 13:23 gwSetup.bin.new -rw-rw---- 1 root gws 878 Dec 14 14:29 hw-run.xml -rw-rw---- 1 root gws 878 Dec 13 13:34 hw.xml -rw-rw---- 1 root gws 2967 Dec 13 13:34 log-conf.xml -rw-rw---- 1 myco2 gws 5480 Dec 14 14:28 setup.tar.xz -rw-rw---- 1 root gws 5260 Dec 14 13:23 setup.tar.xz.0 -rw-rw---- 1 1001 gws 7396 Dec 10 09:56 setup.tar.xz.1 -rw-rw---- 1 1001 gws 6160 Dec 7 06:50 setup.tar.xz.2 -rw-rw---- 1 1001 gws 6092 Dec 6 07:19 setup.tar.xz.3 -rw-rw---- 1 1001 gws 5744 Dec 6 07:16 setup.tar.xz.4 -rw-rw---- 1 root gws 21 Dec 13 13:34 version -rw-rw---- 1 root gws 54 Dec 13 13:34 version-GwLinux-git -rw-rw---- 1 root gws 61 Dec 13 13:34 version-Telem-GW-git -rw-rw---- 1 root gws 62 Dec 13 13:34 version-buildroot myco2@Telem-GWM ~ $
Old setups can be deleted with command rm.
root@Telem-GWM ~ $ rm /usr/local/etc/telem/setup.tar.xz.* root@Telem-GWM ~ $ rm /usr/local/etc/telem/gwSetup.bin.* root@Telem-GWM ~ $ ls -la /usr/local/etc/telem/ total 48 drwxrws--T 3 root gws 1088 Dec 14 15:09 . drwxr-xr-x 3 root root 224 Dec 10 13:13 .. -rw-rw---- 1 root gws 452 Dec 13 13:34 asciiart -rw-r--r-- 1 root gws 4095 Dec 14 14:29 config.xml lrwxrwxrwx 1 root gws 27 Jan 1 1970 gpio -> /usr/local/etc/telem/gpio.2 drw-rw---- 2 root gws 720 Dec 14 13:31 gpio.2 -rw-rw---- 1 root gws 1936 Dec 14 14:29 gwSetup.bin -rw-rw---- 1 root gws 878 Dec 14 15:08 hw-run.xml -rw-rw---- 1 root gws 878 Dec 13 13:34 hw.xml -rw-rw---- 1 root gws 2967 Dec 13 13:34 log-conf.xml -rw-rw---- 1 myco2 gws 5480 Dec 14 14:28 setup.tar.xz -rw-rw---- 1 root gws 21 Dec 13 13:34 version -rw-rw---- 1 root gws 54 Dec 13 13:34 version-GwLinux-git -rw-rw---- 1 root gws 61 Dec 13 13:34 version-Telem-GW-git -rw-rw---- 1 root gws 62 Dec 13 13:34 version-buildroot root@Telem-GWM ~ $ sync
After updating the configuration the /usr/local/etc/telem folder looks something like so:
root@Telem-GWM ~ $ ls -la /usr/local/etc/telem/ total 60 drwxrws--T 3 root gws 1160 Dec 14 15:12 . drwxr-xr-x 3 root root 224 Dec 10 13:13 .. -rw-rw---- 1 root gws 452 Dec 13 13:34 asciiart -rw-r--r-- 1 root gws 4111 Dec 14 15:12 config.xml lrwxrwxrwx 1 root gws 27 Jan 1 1970 gpio -> /usr/local/etc/telem/gpio.2 drw-rw---- 2 root gws 720 Dec 14 13:31 gpio.2 -rw-rw---- 1 root gws 1938 Dec 14 15:12 gwSetup.bin -rw-rw---- 1 root gws 878 Dec 14 15:12 hw-run.xml -rw-rw---- 1 root gws 878 Dec 13 13:34 hw.xml -rw-rw---- 1 root gws 2967 Dec 13 13:34 log-conf.xml -rw-rw---- 1 myco2 gws 5484 Dec 14 15:11 setup.tar.xz -rw-rw---- 1 myco2 gws 5480 Dec 14 14:28 setup.tar.xz.0 -rw-rw---- 1 root gws 21 Dec 13 13:34 version -rw-rw---- 1 root gws 54 Dec 13 13:34 version-GwLinux-git -rw-rw---- 1 root gws 61 Dec 13 13:34 version-Telem-GW-git -rw-rw---- 1 root gws 62 Dec 13 13:34 version-buildroot root@Telem-GWM ~ $