4 ms·

You may already know this, but it's worth getting the word out. Do not just deny routing to 127.0.0.1. 127.0.0.1 is merely the conventional "localhost" address;

by jerf 7y ago

You may already know this, but it's worth getting the word out. Do not just deny routing to 127.0.0.1. 127.0.0.1 is merely the conventional "localhost" address; however, ALL 127.x.x.x is "localhost". You can check this now on your local command line with "ping 127.1.2.3". (This just seems to be one of those bugs that every proxy goes through at some point, just like pretty much any attempt to write a web server that serves files off disk will have at least one directory traversal bug.)

zrm 7y ago
Also don't forget that IPv6 ::1 is localhost too.
- deleted 7y ago
  [deleted]
z3t4 7y ago
The IP protocol is full of security gotchas so you better use a higher level protocol. Spoofing, arp attacks, TCP session hijacking, etc.
MrStonedOne 7y ago
Fun fact, windows blocks remote desktoping to localhost (because doing so would lock the console session unless you break license and modify termserv). Fun fact 2, this only blocks 127.0.0.1. (side note: if you don't mind breaking license compliance on your personal pc, you can use this to remote desktop into other user accounts on the same pc for a nice separation of work spaces (or just move to linux))
- o-__-o 7y ago
  You are not breaking the license if you pay per-seat rather than per-device. Ask me about CALs, I can tell you all about them.
  - monsieurbanana 7y ago
    Let's start with an easy question, what is CAL?
    - o-__-o 7y ago
      Client access license. For Microsoft Windows they come in per-seat and per-machine. To OPs point, they were talking about RDP. When you are licensing per-machine then (windows server) you are limited to one desktop user and two remote users (for windows desktop it’s one user at a time). When it is per-seat then you can have as many concurrent connections as you have licensed for. Per-seat is enforced by Microsoft Licensing Server
      - MrStonedOne 7y ago
        I was mainly referring to personal pc uses, not corp/server users. It's still technically breaking the license to override TERMSERV.dll's protections on home/professional PCs not allowing somebody to be logged in while somebody else is already logged in. ie, a home or professional licensed pc can not support 1 user on remote desktop, and 1 user sitting down in front of it at the same time, you have to pay for a server license to get that functionality. This technical limitation is considered a DRM measure and also protected by the DMCA anti-circumvention provision. if you don't mind breaking the law, I was pointing out how you could use abuse 127.0.0.2 to connect remote desktop to localhost in other to do seperate user accounts for seperate tasks, (such as putting your job hunting activities in a seperate account so you don't get distracted by discord/chrome desktop notifications and reddit in your new tab page)
jackewiehose 7y ago
Yes and I think you typically want to use this whole recommended list of deny-ips. Maybe that should be the default for coturn. But running coturn in its default-config isn't a good idea anyway.
ddrt 7y ago
Isn’t that 127 address a bogon?

by jerf 7y ago

zrm 7y ago

Also don't forget that IPv6 ::1 is localhost too.

deleted 7y ago
[deleted]

z3t4 7y ago

The IP protocol is full of security gotchas so you better use a higher level protocol. Spoofing, arp attacks, TCP session hijacking, etc.

MrStonedOne 7y ago

Fun fact, windows blocks remote desktoping to localhost (because doing so would lock the console session unless you break license and modify termserv). Fun fact 2, this only blocks 127.0.0.1. (side note: if you don't mind breaking license compliance on your personal pc, you can use this to remote desktop into other user accounts on the same pc for a nice separation of work spaces (or just move to linux))

o-__-o 7y ago
You are not breaking the license if you pay per-seat rather than per-device. Ask me about CALs, I can tell you all about them.
- monsieurbanana 7y ago
  Let's start with an easy question, what is CAL?
  - o-__-o 7y ago
    Client access license. For Microsoft Windows they come in per-seat and per-machine. To OPs point, they were talking about RDP. When you are licensing per-machine then (windows server) you are limited to one desktop user and two remote users (for windows desktop it’s one user at a time). When it is per-seat then you can have as many concurrent connections as you have licensed for. Per-seat is enforced by Microsoft Licensing Server
    - MrStonedOne 7y ago
      I was mainly referring to personal pc uses, not corp/server users. It's still technically breaking the license to override TERMSERV.dll's protections on home/professional PCs not allowing somebody to be logged in while somebody else is already logged in. ie, a home or professional licensed pc can not support 1 user on remote desktop, and 1 user sitting down in front of it at the same time, you have to pay for a server license to get that functionality. This technical limitation is considered a DRM measure and also protected by the DMCA anti-circumvention provision. if you don't mind breaking the law, I was pointing out how you could use abuse 127.0.0.2 to connect remote desktop to localhost in other to do seperate user accounts for seperate tasks, (such as putting your job hunting activities in a seperate account so you don't get distracted by discord/chrome desktop notifications and reddit in your new tab page)

jackewiehose 7y ago

Yes and I think you typically want to use this whole recommended list of deny-ips. Maybe that should be the default for coturn. But running coturn in its default-config isn't a good idea anyway.

ddrt 7y ago

Isn’t that 127 address a bogon?