Security topic: Someone is listening... about tch-nginx-gui

[Ansuel]

it's just the quantenna chip that comunicate with eth5

it's a shitty implementation... the 5ghz wifi is a complete separate system with own uboot and gets ip address and all that things.

[meyergru]

O.K., understood. Not an issue of the GUI and I guess we can do nothing much about it, although it is a probable security issue: Perhaps one could control the 5 GHz WLAN by this from the LAN side.

[meyergru]

I just read a tip regarding this: remove eth5 from the lan bridge and the problem is gone:

In /etc/config/network:

config interface 'lan'
option type 'bridge'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '64'
option force_link '0'
option ipv6 '0'
option ifname 'eth0 eth1 eth2 eth3 eth5'
option pppoerelay ''
option ipaddr '192.168.1.1'

This should at least be done for bridge mode.

[Ansuel]

yes and you lose 5ghz connection... can't see the problem...

[meyergru]

In bridge mode? I see, WiFi could theoretically be enabled, but is useless then anyway. Matter-of-fact, in that mode, there are DHCP client requests against the MSAN.

[Kherby]

Should defently be done in Bridge Mode... Who needs wifi when using the device in Bridge Mode ?
If someone is using Wifi to gather stats/access the GUI 2.4GHz should be enough or even better because of the range limitation of 5GHz...

[meyergru]

The Wifi card could also be removed for bridge mode...

[Ansuel]

ummm lan5 can be removed from the gui anyway ....

[meyergru]

Right. Should be an implicit setting (e.g. when 5Ghz is enabled).

[nclmrc]

Any update?

[kevdagoat]

Sounds a bit unrealistic to me...

…

On 5 Oct 2018, at 4:50 am, Niccolò Marchi ***@***.***> wrote: Any update? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[kevdagoat]

@meyergru can you close this now?