<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<body>
<div dir="auto">
<div dir="auto">Hear, hear, Bart! As an infosec pro, I was a bit appalled after first installing HamWAN and seeing such lax security, akin to leaving the front door open all day&nite of your house in Sodo. I removed the remote access and reporting configuration from my client nodes for this reason, but now I hear the control nodes have their doors open? Recipe for disaster and subsequent need for DR that can be prevented.</div><div dir="auto"><br></div><div dir="auto">Stephen W9SK</div><div dir="auto"><br></div><div dir='auto'><br></div>
<div id="aqm-original" style="color: black;">
<div dir="auto">On February 8, 2023 3:34:17 AM Bart Kus <me@bartk.us> wrote:</div>
<div><br></div>
<blockquote type="cite" class="gmail_quote" style="margin: 0 0 0 0.75ex; border-left: 1px solid #808080; padding-left: 0.75ex;">
<div dir="auto">All of the network's control points are on public non-firewalled IPs. </div>
<div dir="auto">This is the worst security. It was done this way for the sake of </div>
<div dir="auto">simplicity. Our netops volunteers had to get up to speed with </div>
<div dir="auto">unfamiliar concepts like routing, funky netmasks, dynamic routing </div>
<div dir="auto">protocols, policy routing, VRRP, firewalls, MTUs, MSS control, IPsec, </div>
<div dir="auto">etc. We reaped the rewards of KISS from broader volunteer engagement, </div>
<div dir="auto">but lately we've been paying too heavy of a price for the awful security </div>
<div dir="auto">this simplicity creates. In the most recent breach we've lost important </div>
<div dir="auto">source code that will now need to be re-created. We escaped total </div>
<div dir="auto">disaster by the thinnest of margins, as one critical hypervisor just </div>
<div dir="auto">happened to be patched to 1 version higher than exploitable. This </div>
<div dir="auto">simplicity is not a good tradeoff anymore, so the time has come to </div>
<div dir="auto">introduce more complexity to the network to protect all control points.</div>
<div dir="auto"><br></div>
<div dir="auto">This is not a simple problem, since there are many fragility vs security </div>
<div dir="auto">tradeoffs, as well as complexity cost concerns. If you have experience </div>
<div dir="auto">or thoughts around this area, and can commit to a few weeks of design </div>
<div dir="auto">and implementation work on this project, please indicate your interest. </div>
<div dir="auto">We'll assemble a small working group in the next few days and start </div>
<div dir="auto">discussions. I expect the working format will involve some virtual </div>
<div dir="auto">meetings, since email is not high bandwidth enough to hash out </div>
<div dir="auto">everything quickly.</div>
<div dir="auto"><br></div>
<div dir="auto">Here's hoping we don't make it worse,</div>
<div dir="auto"><br></div>
<div dir="auto">--Bart</div>
<div dir="auto"><br></div>
<div dir="auto">_______________________________________________</div>
<div dir="auto">PSDR mailing list</div>
<div dir="auto">PSDR@hamwan.org</div>
<div dir="auto">http://mail.hamwan.net/mailman/listinfo/psdr</div>
</blockquote>
</div><div dir="auto"><br></div>
</div></body>
</html>