5 ms·

Quite neat, and solves a big problem I had (devices at customers sites). However for me it would be very hard to trust you (security and availability wise). I

by Faaak 9y ago

Quite neat, and solves a big problem I had (devices at customers sites). However for me it would be very hard to trust you (security and availability wise). I opted (some months ago when the problem arose), to simply set up a private VPN server, and every device I have at customers connects to it. That way, I can simply `ssh device.cust.vpn.mycompany.tld` and I'm in.

tjoff 9y ago
Yes, this needs a self-hosted alternative to their cloud be viable in my book.
- rkangel 9y ago
  This is easy to set up self-hosted - there would be no value in them providing that. The value is that it is cloud hosted so you don't have to do anything.
  - 0xdeadbeefbabe 9y ago
    "You don't have to do anything" is better than something "easy" for you to do? That seems like a very small value add.
deleted 9y ago
[deleted]
Fnoord 9y ago
A "private VPN server" is meaningless, could be IPsec or PPTP or OpenVPN or SSH or ... If you're already using SSH you can use it to forward ports. You can SSH into that SSH server (with Mosh you'd achieve low latency) and craft a SSH config (at ~/.ssh/config or /etc/ssh/config), make a bunch of shell scripts (including ProxyCommand if needed). You could even run your SSH server over Tor, or as I briefly suggested above you could go with a SSH server as VPN. One disadvantage that has, is that on Android it will not work with without root. Tor also won't work with Mosh (uses UDP), so you'd have higher latency. See also this recent HN post "SSH vs. OpenVPN for Tunneling" [1] [1] https://news.ycombinator.com/item?id=15773466 https://news.ycombinator.com/item?id=15773466
- askz 9y ago
  SSH tunnels adds hassle to deploy and maintain. Compared to openvpn once your server is up you just need to deploy software and install certs and byebye! It is my prefered solution for devices since it takes 5min to deploy. And you have instant access to all ports of the device(s)
  - drchickensalad 9y ago
    Ssh local forwarding gives you pretty simple access to all ports though?
    - magnetic 9y ago
      Yes, but: 1) you have to know which ports you want to forward before you ssh into the remote host and 2) you have to change configurations (hostname and ports) in all the programs you use (for example, instead of pointing your browser to http://foo http://foo, you're going to have to go and type http://localhost:8888 http://localhost:8888 - not to mention all the scripts or other pieces of software that "just work" using the canonical name and standardized port to connect, and would require customizations to change that)
      - Fnoord 9y ago
        With Sshuttle you got access to all TCP ports. You can add hosts in /etc/hosts, ~/.ssh/ssh_config, /etc/ssh/ssh_config, dnsmasq, or aliases in your favourite shell. If you prefer port 80 and it is being used on local host already you can manually do what ZeroTier does: add a /32 or /128 to an interface and route it. I just tried ZeroTier yesterday and it is nice indeed, basically an advanced, open source Hamachi. But it is not rocket science. What I especially like is that you can completely self host.
  - rsync 9y ago
    "SSH tunnels adds hassle to deploy and maintain." Agreed. That is why I love sshuttle: https://github.com/sshuttle/sshuttle https://github.com/sshuttle/sshuttle Any host that is running plain old sshd is now a potential VPN endpoint. No config or settings (or even permission) necessary. Supports --dns.
Nicholas7900 9y ago
Using email is one of my favorite ways of breaking into an organization! Usually, I will send out 10 emails to different employees. Out of those 10 people, 5 will click the link that I included. Of the 5 people, two or three will tell me their real work username and password. Pretty scary, isn't it? Why are they so interested? Why would they give me their passwords? The email that I send does not look like a scam from a rich prince in an African nation. Instead, it looks like a professional email from a company conducting a survey on behalf of the employee’s organization. Who wouldn’t be interested in filling out a survey about Salary Satisfaction? Once they click on the link, they are taken to a login page. It is then than an average of 25% of the people emailed submit their passwords. This is where the fun begins! If the company is using Microsoft Exchange (email server), I can use their credentials to synchronize a copy of their email onto my computer. Once it is synchronized, I can create a client-side rule that runs a program every time a certain email is received. This rule will synchronize over Exchange across all the computers that use that persons account. Once they receive the special email, my program runs on the victim’s computer. Another option in which i can use to Hack a computer through email is to send a user a malicious Word document. However, that usually requires building up a context where it would make sense for that attachment to be opened. Recently, I received a very interesting attachment. It was an obvious attempt to break into my computer using a malicious Word document. It came at a time where I was needing a more effective payload to send to my potential victims. I was so grateful to the hacker for introducing me to a new technique that I replied with a thank you note. The Word document contained an embedded object that appeared to be a another document. But in reality, it was a VB Script that would launch a malicious payload. Fascinating! FOR URGENT PROFESSIONAL HACKING ADVICE & HACKING SERVICES, you can reach out to me via compositehacks@gmail.com Image may contain: text
Already__Taken 9y ago
What did you decide to use to set up the shared vpn endpoint to route the traffic?
- Faaak 9y ago
  OpenVPN listening TCP and UDP on various ports. I was always able to get through.
  - gsich 9y ago
    iodine if you are in really harsh environments
aequitas 9y ago
I manage a few network devices as a hobby and recently implemented just this. I have not yet setup the DNS part as I'm still trying to decide if I want to go IPv6 only on this network (which makes unique determinable addresses a lot easier). The current implementation is a hybrid of Puppet (Openvpn, firewalling) and Docker (radvd, librenms, other monitoring). Don't know if it will be useful for you but I might share it if its done.
- Faaak 9y ago
  Actually, I have a hook on the openvpn server (on docker), that talks to the DNS server when a new device connects to it. The DNS and reverse DNS is automatically added. I use the 11.0.0.0/16 zone. It's not a good practice at all, but in this case it's very useful (doesn't conflict with any network map, only routed inside my devices, which only talk to each other). But I would love to take a look at it if you share it ;-)
  - aequitas 9y ago
    Currently my implementation only has 1 VPN endpoint per 'location' so the other devices still need to get their IP some way else (DHCP/router advertisement). Since my network is not that large layer2 is doable and i'm trying to see where I hit practical limits.
  - Piskvorrr 9y ago
    Why clobber an allocated segment, is 10.0.0.0/8 not large enough for you? (e.g. never have I ever seen 10.11.0.0/16 in a network)
    - Faaak 9y ago
      Of course it's large enough, but it's also widely used. If you use 10.11.0.0/16, then you can be sure that you'll run into a company that also uses it. And when there's a conflit between your VPN device space and your custommer's IP space, … well, it's really annoying. Sure, you could use 192.168/24, or 172.16/12 but you'll run into the same problem. Once it'll be a hotel that uses this space, and another time it'll be an industry. So that's why I use 11.0.0.0/16. Yes it's allocated, but my devices will (never) need to talk to it (they only talk with me, and I'll never install devices in the DoD, so there won't be a conflict).

by Faaak 9y ago

tjoff 9y ago

Yes, this needs a self-hosted alternative to their cloud be viable in my book.

rkangel 9y ago
This is easy to set up self-hosted - there would be no value in them providing that. The value is that it is cloud hosted so you don't have to do anything.
- 0xdeadbeefbabe 9y ago
  "You don't have to do anything" is better than something "easy" for you to do? That seems like a very small value add.

deleted 9y ago

[deleted]

Fnoord 9y ago

A "private VPN server" is meaningless, could be IPsec or PPTP or OpenVPN or SSH or ... If you're already using SSH you can use it to forward ports. You can SSH into that SSH server (with Mosh you'd achieve low latency) and craft a SSH config (at ~/.ssh/config or /etc/ssh/config), make a bunch of shell scripts (including ProxyCommand if needed). You could even run your SSH server over Tor, or as I briefly suggested above you could go with a SSH server as VPN. One disadvantage that has, is that on Android it will not work with without root. Tor also won't work with Mosh (uses UDP), so you'd have higher latency. See also this recent HN post "SSH vs. OpenVPN for Tunneling" [1] [1] https://news.ycombinator.com/item?id=15773466 https://news.ycombinator.com/item?id=15773466

askz 9y ago
SSH tunnels adds hassle to deploy and maintain. Compared to openvpn once your server is up you just need to deploy software and install certs and byebye! It is my prefered solution for devices since it takes 5min to deploy. And you have instant access to all ports of the device(s)
- drchickensalad 9y ago
  Ssh local forwarding gives you pretty simple access to all ports though?
  - magnetic 9y ago
    Yes, but: 1) you have to know which ports you want to forward before you ssh into the remote host and 2) you have to change configurations (hostname and ports) in all the programs you use (for example, instead of pointing your browser to http://foo http://foo, you're going to have to go and type http://localhost:8888 http://localhost:8888 - not to mention all the scripts or other pieces of software that "just work" using the canonical name and standardized port to connect, and would require customizations to change that)
    - Fnoord 9y ago
      With Sshuttle you got access to all TCP ports. You can add hosts in /etc/hosts, ~/.ssh/ssh_config, /etc/ssh/ssh_config, dnsmasq, or aliases in your favourite shell. If you prefer port 80 and it is being used on local host already you can manually do what ZeroTier does: add a /32 or /128 to an interface and route it. I just tried ZeroTier yesterday and it is nice indeed, basically an advanced, open source Hamachi. But it is not rocket science. What I especially like is that you can completely self host.
- rsync 9y ago
  "SSH tunnels adds hassle to deploy and maintain." Agreed. That is why I love sshuttle: https://github.com/sshuttle/sshuttle https://github.com/sshuttle/sshuttle Any host that is running plain old sshd is now a potential VPN endpoint. No config or settings (or even permission) necessary. Supports --dns.

Nicholas7900 9y ago

Using email is one of my favorite ways of breaking into an organization! Usually, I will send out 10 emails to different employees. Out of those 10 people, 5 will click the link that I included. Of the 5 people, two or three will tell me their real work username and password. Pretty scary, isn't it? Why are they so interested? Why would they give me their passwords? The email that I send does not look like a scam from a rich prince in an African nation. Instead, it looks like a professional email from a company conducting a survey on behalf of the employee’s organization. Who wouldn’t be interested in filling out a survey about Salary Satisfaction? Once they click on the link, they are taken to a login page. It is then than an average of 25% of the people emailed submit their passwords. This is where the fun begins! If the company is using Microsoft Exchange (email server), I can use their credentials to synchronize a copy of their email onto my computer. Once it is synchronized, I can create a client-side rule that runs a program every time a certain email is received. This rule will synchronize over Exchange across all the computers that use that persons account. Once they receive the special email, my program runs on the victim’s computer. Another option in which i can use to Hack a computer through email is to send a user a malicious Word document. However, that usually requires building up a context where it would make sense for that attachment to be opened. Recently, I received a very interesting attachment. It was an obvious attempt to break into my computer using a malicious Word document. It came at a time where I was needing a more effective payload to send to my potential victims. I was so grateful to the hacker for introducing me to a new technique that I replied with a thank you note. The Word document contained an embedded object that appeared to be a another document. But in reality, it was a VB Script that would launch a malicious payload. Fascinating! FOR URGENT PROFESSIONAL HACKING ADVICE & HACKING SERVICES, you can reach out to me via compositehacks@gmail.com Image may contain: text

Already__Taken 9y ago

What did you decide to use to set up the shared vpn endpoint to route the traffic?

Faaak 9y ago
OpenVPN listening TCP and UDP on various ports. I was always able to get through.
- gsich 9y ago
  iodine if you are in really harsh environments

aequitas 9y ago

I manage a few network devices as a hobby and recently implemented just this. I have not yet setup the DNS part as I'm still trying to decide if I want to go IPv6 only on this network (which makes unique determinable addresses a lot easier). The current implementation is a hybrid of Puppet (Openvpn, firewalling) and Docker (radvd, librenms, other monitoring). Don't know if it will be useful for you but I might share it if its done.

Faaak 9y ago
Actually, I have a hook on the openvpn server (on docker), that talks to the DNS server when a new device connects to it. The DNS and reverse DNS is automatically added. I use the 11.0.0.0/16 zone. It's not a good practice at all, but in this case it's very useful (doesn't conflict with any network map, only routed inside my devices, which only talk to each other). But I would love to take a look at it if you share it ;-)
- aequitas 9y ago
  Currently my implementation only has 1 VPN endpoint per 'location' so the other devices still need to get their IP some way else (DHCP/router advertisement). Since my network is not that large layer2 is doable and i'm trying to see where I hit practical limits.
- Piskvorrr 9y ago
  Why clobber an allocated segment, is 10.0.0.0/8 not large enough for you? (e.g. never have I ever seen 10.11.0.0/16 in a network)
  - Faaak 9y ago
    Of course it's large enough, but it's also widely used. If you use 10.11.0.0/16, then you can be sure that you'll run into a company that also uses it. And when there's a conflit between your VPN device space and your custommer's IP space, … well, it's really annoying. Sure, you could use 192.168/24, or 172.16/12 but you'll run into the same problem. Once it'll be a hotel that uses this space, and another time it'll be an industry. So that's why I use 11.0.0.0/16. Yes it's allocated, but my devices will (never) need to talk to it (they only talk with me, and I'll never install devices in the DoD, so there won't be a conflict).