On 6/15/23 15:14, Spiros Bousbouras wrote:
> On 15 Jun 2023 09:04:58 +1000
> not@telling.you.invalid (Computer Nerd Kev) wrote:
>> Spiros Bousbouras <spibou@gmail.com> wrote:
>>> At least , it will be somewhat interesting to see how many random attempts
>>> I get of people trying to log in to the computer.
>>
>> Unless you've set up port forwarding to the internet for computer A
>> then I don't think you'll ever see anyone but yourself trying to
>> log in.
>
> Still , I can get SSH to log them , yes ?

It will by default. On Debian systems, sshd logs all connection
attempts, whether they succeed or fail, to /var/log/auth.log as
configured when installed.

On Wed, 14 Jun 2023 20:04:58 +0100
The Natural Philosopher <tnp@invalid.invalid> wrote:
> On 14/06/2023 17:31, Rich wrote:
> > If the router your ISP supplies does not give you a CLI interface
> > option, you are out of luck there with that desire.
>
> You can supply your own router.

I know. If I ever reach a point where I have to often modify the router
settings , I may follow this option. But for now I rarely have to modify them
so I just grit my teeth and use the web interface.

> However the default situation is that unless you specifically enable
> port forwarding there will be none, and inbound access from the internet
> to machines behind the router will be blocked.
>
> If you are excessively paranoid you can configure sshd to only respond
> to local IP addresses only, which is another layer of (effective)
> firewall,

Ahh ok , I asked about this earlier and was told to use a firewall. Also
<sc6kljx4pf.ln2@Telcontar.valinor> says

You can limit connections to the IP range given by your router, but an
intruder might fake that.

> and for a third you can setup a linux firewall as well, to do
> the same.

I'm trying not to spend too long on this. I started the thread in order to
learn which programme I should use to achieve my task and how to configure
it. Learning about firewalls on top of that is an extra complication I'd
rather avoid for now.

> Why you don't want to use the routers web interface is beyond me. their
> CLI interfaces are out of the ark usually. I only use mine because there
> is one piece of data I cant get out of it using snmp

In general , I prefer CLIs than <point and click>. For one thing , with a
CLI I can automatically record all the exchanges so that I will know in
the future what I did but with a <point and click> interface I would have
to keep notes ; something like ,

I chose menu ABC and from that submenu DEF and changed option 2 from
X to Y.

It's extra work and boring work to boot. Apart from that , my router not only
seems to offer only a web interface but it requires javascript too for the
login screen to function. I don't like complexity for the sake of complexity
and obviously you don't need javascript to type a username and password. In
addition , I normally do almost all my browsing using a text based browser.
So instead I have to start a graphical browser just to inspect and possibly
change some stupid router settings. I don't like to be made to jump through
hoops and this whole thing very much makes me jump through hoops and I resent
that.

--
Like an oyster coating an impurity to produce a pearl, a Hollywood movie
typically encases and suppresses the issue or event it is based on. Put
another way, it is the final washing of the hands after history has gone to
the bathroom.
http://www.spectacle.org/195/schindl.html

On Wed, 14 Jun 2023 16:28:09 -0000 (UTC)
Rich <rich@example.invalid> wrote:
> Maybe -- or maybe not -- it depends upon the configuration of the box
> you are referring to as "the router".
>
> If it is a typical ISP provided combo box

Technicolor DGA4134 .

>>>>> On 2023-06-14, Computer Nerd Kev wrote:
>>>>> Ivan Shmakov <ivan@siamics.netnospam.invalid> wrote:
>>>>> On 2023-06-12, Computer Nerd Kev wrote:

>>> I'm posting from Debian version 3 right now, so that makes sense
>>> to me, but it did occur to me afterwards that the OP may have
>>> meant an old but still supported Debian version.

>> While I'm no stranger to running unmaintained software (or
>> versions thereof) myself, I'm curious what could be the reason
>> to run a no longer supported version of Debian specifically?
>> (With i686 in User-Agent:, I'd venture to guess it's not a matter
>> of having hardware no longer supported by Debian?)

> It's set up how I like, runs old software I like without having to
> patch it myself to make it build for later GCC or libraries, and
> runs much faster (possibly also better, in terms of supported
> drivers) on old computers that I still use. Actually I don't think
> current Debian would run on the PC I'm posting from now either
> (that i686 has changed to an i586).

To me, using software is largely means to an end; namely,
software allows me to contribute to society. Were I able to
grow my own oats, my reasoning would likely be different, but
as it is, I need to do something of value, so that society will
give me food, clothing, shelter, and so on. And of course I
feel responsible for contributing back to free software projects
that enable me to do my work, to learn new things (that may or
may not become opportunities in the future: there's no way to
know in advance), and to find inspiration in the work of others.

Hence, from where I stand, I'd be inclined to ask myself, is
the software I use /necessary/ in my choosen field of work?
and if so, will the others benefit from it as well?

I don't generally believe that the problems I solve are
unique. If some software is useful to me, then there're
likely other people who will benefit from its availability.
If the software I came to prefer is old and unmaintained, and
not compatible with contemporary platforms, I will consider
adopting it and updating it for such compatibility.

At the same time, I will consider the lack of interest
in software I use as a possible indication that there're
alternatives I should consider learning and switching to.

As to the examples...

I've used GNU Emacs from c. 2002 to c. 2020. When it grew too
big for me to wrap my mind around, I've looked for possible
alternatives, and before long switched back to Vim. Should
there be an indication of sufficient interest in maintaining
GNU Emacs 24, I'd probably join the effort. I don't find the
idea of sticking to a version that probably has lots of by now
known security issues particularly enticing.

I've used Firefox from about the time it appeared until Quantum.
I've used a number of plugins that the new APIs made impossible
to implement (e. g., Classic Theme Restorer, Certificate Partol;
I've also tried but never mastered Vimperator and Pentadactyl.)
I /did/ note that there is a project dedicated to maintaining
pre-Quantum APIs, but found the effort needed to become involved
prohibitive. As such, I've switched to Chromium for my second
Web user agent. (My preferred Web browser since about the time
I've got Internet connectivity at home was and remains Lynx.)

Alongside, I've found that I can use HTML and CSS for preparing
printable documents. Instead of having to care about Chromium
/and/ LaTeX, I'm now using only Chromium (which I need for other
purposes anyway. See also news:u656kk$2pm6s$1@dont-email.me .)

I've also found that if someone asks me to send them something
or another "in Microsoft Word format," I can often send an HTML
with <style /> instead and the person will be just as happy.
This way, Chromium allows me to avoid having to deal with the
likes of Libreoffice, too.

The last version of Debian to support i586 was Buster, so when
time came to retire a Squeeze install, I've unfortunately had
to retire the i586 box that it ran on as well. (The Jessie's
version of Bash has particularly atrocious bugs, so by that
time I've already decided against using Jessie there.)

My intent is to revive the machine with a NetBSD install. The
'base' NetBSD system is developed rather conservatively and the
system's x86-32 port claims to support "486DX or later." There's
some effort involved in learning pkgsrc, but it seems rather
modest (as compared to becoming involved in UXP development.)

There's a couple of no longer maintained packages that I rely
on: Polipo HTTP proxy and hddtemp(8). Frankly, I've found the
reasoning given for removing the latter from Debian somewhat
surprising (it can be read as suggesting that it's in the best
interest of system stability to have an in-kernel implementation
of a feature rather than one that needs root; like, really?)
Nevertheless, I intend to update my scripts to rely on /sys or
(and) smartd(8) .state files instead. Eventually.

I'm considering taking over Polipo maintenance.

[...]

> OK, fair enough, although using virtual LANs on a supported router
> might make keeping separate LANs easier than you think.

My understanding was that VLANs are a feature of switches.
(Not that it's impossible for a router to implement a switch
/ bridge function as well.)

Either way, so far I've been requiring strong cryptography
for nearly everything but accessing 'public' resources on my
servers, which once again takes the (mental) 'LAN vs. Internet'
specialcasing out of consideration. Thankfully.

>> And of course I use Rsync over SSH extensively, be that for backups
>> or for pushing new versions of ~/.bashrc et al. from my primary box
>> to every other *nix home directory I have.

>> I suppose with some 'necessary work' I can do the things above with
>> Telnet as well, but I'd think that by that point, resurrecting RSH
>> would be a more straightforward solution.

> Sure, I don't try to use Telnet for anything but terminal access.
> But the other tools without encryption do the same job with much
> less to go wrong. You've got RSH, also Rexec, FTP, Rsync (without
> SSH), etc.

There's a difference between Rsync over TCP vs. Rsync over
remote shell, though. In the latter case, remote shell allows
access to arbitrary accounts (subject to access restrictions.)
In addition to my 'user' account, I also run Rsync over SSH
as 'backup' and 'root'.

> The latest SSH annoyance I've had is a system I set up with current
> software only three years ago now needing a redesign because of the
> present switch from SCP to SFTP. If I'd used RCP, or more likely
> FTP, instead, no problem.

I've pretty much always used Rsync over SSH to copy files around.
Sure, Rsync is limited to Unix-like systems, but that's what
I'm using for any serious work for over two decades now anyway.

I recall the issue with scp(1) and while I find it unfortunate,
I personally wasn't affected in the slightest.

>>> (especially because SSH isn't very helpful with its error
>>> messages, and old versions don't support the -Q option).

>> Well, cannot quite argue with that. If anything, I haven't yet
>> figured out how to connect to my OpenSSH instances with SSH2DOS.

> Yes well I'd definately look for a Telnet client there, but I never
> have used networking in DOS.

It's relatively straightforward, so long as you keep in mind
that while a packet driver provides a standardized ABI to send
and receive Ethernet frames, implementing any protocol on top
of that is a responsibility of the application.

There're (static) libraries that implement TCP/IP (such as
the "classic" Waterloo AKA WATTCP, and the much newer mTCP,
http://www.brutman.com/mTCP/ ), but you need to make sure
that if you use applications that rely on different libraries,
you configure /all/ such libraries. And you'll probably want
to keep those configurations in sync, too. Like:

### MTCP.CFG
PACKETINT 0x7E
IPADDR 192.0.2.34
NETMASK 255.255.255.0
NAMESERVER 192.0.2.53

### WATTCP.CFG
pkt.vector = 0x7e
my_ip = 192.0.2.34
netmask = 255.255.255.0
gateway = 0.0.0.0
nameserver = 192.0.2.53

That said, while the ability to run an SSH client on FreeDOS
would've been handy occasionally, it's hardly a necessity.
For me, Telnet is no substitute for SSH, and if I can't run
an SSH client there, then so be it.

> I do boot into it on this computer and use files that I copied
> over the network earlier while booted into Linux though.

The machine I run FreeDOS on is based on a 40 MHz Am386 CPU
and I mainly use it as a counterexample to the claim that
"but you must have a good GPU to run video games!" (Aside of
shareware from http://classicdosgames.com/ , I have in my GOG
collection a little less than 300 titles, the majority of
which are DOSBox-based, and those generally can run on real
hardware as well; though I've stumbled on several apparent
exceptions so far, and of course there're games that need a
486+ CPU to be playable.)

On Wed, 14 Jun 2023 16:18:51 -0000 (UTC)
Rich <rich@example.invalid> wrote:
> Note that "IP address of 10.0.0.X" is not 100% identical to "only
> connected to router by cable" as there is no mechanism at the
> networking layer for IP packets to know they are traversing cables
> "only connected to the router". So doing your actual ask is
> impossible. But denying any source IP other than the IP range used for
> the local LAN is the closest possibility.

Let me ask something for my general education. The router can know whether
some packets came from the part of its hardware which deals with WiFi as
opposed to ethernet ports. So would it be possible to have a router based
firewall which has different restrictions for WiFi accesses vs ethernet
accesses ?

Spiros Bousbouras <spibou@gmail.com> wrote:
> On Wed, 14 Jun 2023 16:18:51 -0000 (UTC)
> Rich <rich@example.invalid> wrote:
>> Note that "IP address of 10.0.0.X" is not 100% identical to "only
>> connected to router by cable" as there is no mechanism at the
>> networking layer for IP packets to know they are traversing cables
>> "only connected to the router". So doing your actual ask is
>> impossible. But denying any source IP other than the IP range used for
>> the local LAN is the closest possibility.
>
> Let me ask something for my general education. The router can know whether
> some packets came from the part of its hardware which deals with WiFi as
> opposed to ethernet ports. So would it be possible to have a router based
> firewall which has different restrictions for WiFi accesses vs ethernet
> accesses ?

Assuming a /typical/ setup, the WiFi would be a separate network
interface (i.e., wlan0 instead of eth0) and therefore you can filter
(at least with Linux's firewall) based on the network interface the
packet arrived on, or is going towards.

If the WiFi assigned IP addresses are separate from the wired ethernet
addresses, then you can also filter on the IP addresses (as source,
destination, or both).

If WiFi shares a common pool of IP addresses with wired, and a given IP
might be handed out to WiFi one day, and a wired device the next, then
filtering on IP would not work (as the IP would not say where the
packet came from or is going to).

As to what capabilities might be exposed by the firmware in your ISP's
router, none of us know. But it is a reasonable assumption to state
that what the firmware might expose is likely only a small subset of
what the full Linux firewall can perform.

Spiros Bousbouras <spibou@gmail.com> wrote:
> On 15 Jun 2023 09:04:58 +1000
> not@telling.you.invalid (Computer Nerd Kev) wrote:
>> Spiros Bousbouras <spibou@gmail.com> wrote:
>> > On 13 Jun 2023 09:11:14 +1000
>> > not@telling.you.invalid (Computer Nerd Kev) wrote:
>> > So with such a set up , I'm guessing that anyone will be able to try
>> > and connect to computer A but , as long as my password is secure enough ,
>> > then it shouldn't be a problem. I'm guessing that it's possible to
>> > configure SSH to log all attempts to log in (both successful and not)
>> > and also have a delay after an unsuccessful attempt.
>> >
>> > Do I have all this right ?
>>
>> Sure. The log-in retry delay is default.
>>
>> > At least , it will be somewhat interesting to see how many random attempts
>> > I get of people trying to log in to the computer.
>>
>> Unless you've set up port forwarding to the internet for computer A
>> then I don't think you'll ever see anyone but yourself trying to
>> log in.
>
> Still , I can get SSH to log them , yes ?

Yes.

>> >> > Can the router itself be tricked in that regard ?
>> >>
>> >> Only if people can get onto your LAN.
>> >
>> > You mean physically get onto the LAN ?
>>
>> I mean be able to connect to your router via Ethernet or WiFi.
>> Physical access is obviously required for Ethernet. WiFi should be
>> OK if the encryption is, or nobody else is ever anywhere within
>> range.
>
> Since the router is recent enough , hopefully encryption is ok.

Ought to be. If the ISP stuffed up the default WiFi settings that
seriously, then lots of their customers would start having people
steal access to their internet, so presumably they can't be that
bad at setting them.

> I see plenty
> of (not my) signals on wireless devices so I assume that other
> people can see my wireless signal when it's on.

As a separate thing to the encryption you can also set WiFi ESSID
broadcasting (or some similarly labeled setting) off on most such
routers. This means that typical devices won't be able to see your
"wireless signal" as a connection option. You then have to specify
the name of your network manually on devices that connect with it.
The OpenWrt docs also advise: "Where the ESSID is hidden, clients
may fail to roam and airtime efficiency may be significantly
reduced."

>> > By the way , is the book "Linux firewalls" by Michael Rash still
>> > considered relevant enough ?
>>
>> You don't need a book.
>
> I want it for general knowledge too. Every time I see networks discussion
> online , there are many terms I'm not familiar with and I don't seem to
> learn this stuff by osmosis either. So I want a more systematic approach.

OK, but I really wouldn't avoid setting up a firewall just because
you haven't got through a book on Linux networking/firewalls. For
what you're trying to do it's dead easy, and UFW and others are
designed to make it so.

--
__ __
#_ < |\| |< _#

On 6/14/23 4:23 AM, The Natural Philosopher wrote:
> On 14/06/2023 05:01, 24D.245 wrote:
>> On 6/13/23 6:36 PM, The Natural Philosopher wrote:
>>> On 13/06/2023 21:25, Carlos E.R. wrote:
>>>> On 2023-06-13 01:11, Computer Nerd Kev wrote:
>>>>> Spiros Bousbouras <spibou@gmail.com> wrote:
>>>>>> Thanks for all the replies everyone. That's a lot to read on.
>>>>
>>>> ...
>>>>
>>>>>>>> 3. Can it be done safely without having to enter a password on
>>>>>>>> B when I want to connect to A ?
>>>>>>>
>>>>>>> If you care about this then perhaps Telnet isn't for you because
>>>>>>> "safely" probably means that you don't want plain-text passwords
>>>>>>> and anything else will mean raising version incompatibility
>>>>>>> problems with authentication systems such as are used by SSH.
>>>>>>
>>>>>> Ideally , I don't want passwords at all , as I've said. But I think
>>>>>> I'm missing your point.
>>>>>
>>>>> Yeah, any secure passwordless authentication system has the same
>>>>> issues as SSH. Telnet itself only supports not having any
>>>>> authentication, or passwords. If only computer B can connect to A
>>>>> over Telnet due to firewall settings then going without
>>>>> authentication should be OK, but it's not necessarily "safe"
>>>>> against all attacks. Probably safe against any attacks that you're
>>>>> likely to experience in many cases though.
>>>>
>>>>
>>>> Telnet is an ancient protocol, and is considered to be unsafe in
>>>> many aspects. Anyone with access to the LAN can see anything inside
>>>> the telnet session.
>>>>
>>> Incorrect. Not since switches replaced hubs.
>>> Apart from WiFi
>>
>>    Mostly correct ... but you can still poll addresses
>>    looking for Telnet activity and then go from there.
>>    Switches don't/can't hide EVERYTHING ... there are
>>    numerous utilities that can still see a LOT going
>>    on in the local network. Try WireShark ...
>>
> No, you cant.

Did it last Thursday.

Switches do NOT hide all activity not directed
to your specific PCs IP.

They do REDUCE it a bit though. I kept a traditional
HUB I can put right after the router to monitor ALL
activity, just in case. Has a big label saying "NEVER
THROW THIS AWAY" :-)

> BTDTGTTS
>
> You can only see broadcast traffic on other segments.

But most places only have ONE segment ...

> That might tell you a connection is being made, but once established MAC
> addresses are used to limit propagation to only the segment where the
> target machine resides. Thats what a switch *does*.
>
>
>>    Telnet is of the same generation as POP - a kinder
>>    and gentler era where 'security'/encryption was
>>    not considered a big deal (we're all pals here,
>>    right ?). It's BEST not to use Telnet - indeed
>>    block its port in your router.
>>
>>    Did have some fun lately though using Telnet to
>>    log into a mail server, you can select an alt port.
>>    Had to type weird stuff into prompts - but you COULD
>>    connect/receive/send.
>
> Been doing that for years.

Not exactly "user friendly" though ...

> And I still use POP to download my mail from my internet based server.
> Old school. Only this networks IP address can do that.

Try POP ... or even IMAP ... with M$ mail servers.
Last week they CUT THAT OFF. Only OAuth2 connections
still work. Thunderbird can do it, but not everything.
Mostly they want to force you to their online version
of Outlook ... my guess is that it spies on all your
other activity ....... more $$$ for M$

On 6/15/23 6:15 PM, Rich wrote:
> Spiros Bousbouras <spibou@gmail.com> wrote:
>> On Wed, 14 Jun 2023 16:18:51 -0000 (UTC)
>> Rich <rich@example.invalid> wrote:
>>> Note that "IP address of 10.0.0.X" is not 100% identical to "only
>>> connected to router by cable" as there is no mechanism at the
>>> networking layer for IP packets to know they are traversing cables
>>> "only connected to the router". So doing your actual ask is
>>> impossible. But denying any source IP other than the IP range used for
>>> the local LAN is the closest possibility.
>>
>> Let me ask something for my general education. The router can know whether
>> some packets came from the part of its hardware which deals with WiFi as
>> opposed to ethernet ports. So would it be possible to have a router based
>> firewall which has different restrictions for WiFi accesses vs ethernet
>> accesses ?
>
> Assuming a /typical/ setup, the WiFi would be a separate network
> interface (i.e., wlan0 instead of eth0) and therefore you can filter
> (at least with Linux's firewall) based on the network interface the
> packet arrived on, or is going towards.
>
> If the WiFi assigned IP addresses are separate from the wired ethernet
> addresses, then you can also filter on the IP addresses (as source,
> destination, or both).
>
> If WiFi shares a common pool of IP addresses with wired, and a given IP
> might be handed out to WiFi one day, and a wired device the next, then
> filtering on IP would not work (as the IP would not say where the
> packet came from or is going to).
>
> As to what capabilities might be exposed by the firmware in your ISP's
> router, none of us know. But it is a reasonable assumption to state
> that what the firmware might expose is likely only a small subset of
> what the full Linux firewall can perform.

OK .. face the awful awful Truth - THERE IS NO REAL
"Protection". There are a zillion ways to tap your
traffic, sneak into your boxes, trick your users. It's
TOO MANY to cope with. Your best defense is obscurity,
being beneath notice, having nothing of value.

All the "wonderful" stuff you can do with modern networking
comes at a PRICE. It's all deep, Deep, DEEP - endless hooks
for evil-doers. M$ is so fucked up that it makes things
even EASIER for the bastards - stick to Linux/Unix as much
as you can.

On 15/06/2023 21:57, Ivan Shmakov wrote:
>>>>>> On 2023-06-14, Computer Nerd Kev wrote:
>>>>>> Ivan Shmakov <ivan@siamics.netnospam.invalid> wrote:
>>>>>> On 2023-06-12, Computer Nerd Kev wrote:
>
> >>> I'm posting from Debian version 3 right now, so that makes sense
> >>> to me, but it did occur to me afterwards that the OP may have
> >>> meant an old but still supported Debian version.
>
> >> While I'm no stranger to running unmaintained software (or
> >> versions thereof) myself, I'm curious what could be the reason
> >> to run a no longer supported version of Debian specifically?
> >> (With i686 in User-Agent:, I'd venture to guess it's not a matter
> >> of having hardware no longer supported by Debian?)
>
> > It's set up how I like, runs old software I like without having to
> > patch it myself to make it build for later GCC or libraries, and
> > runs much faster (possibly also better, in terms of supported
> > drivers) on old computers that I still use. Actually I don't think
> > current Debian would run on the PC I'm posting from now either
> > (that i686 has changed to an i586).
>
> To me, using software is largely means to an end; namely,
> software allows me to contribute to society. Were I able to
> grow my own oats, my reasoning would likely be different, but
> as it is, I need to do something of value, so that society will
> give me food, clothing, shelter, and so on. And of course I
> feel responsible for contributing back to free software projects
> that enable me to do my work, to learn new things (that may or
> may not become opportunities in the future: there's no way to
> know in advance), and to find inspiration in the work of others.
>
Wow! A REAL socialist.
(as opposed to a political socialist)

> Hence, from where I stand, I'd be inclined to ask myself, is
> the software I use /necessary/ in my chosen field of work?
> and if so, will the others benefit from it as well?
>
>

--
“It is dangerous to be right in matters on which the established
authorities are wrong.”

― Voltaire, The Age of Louis XIV

On 15/06/2023 22:01, Spiros Bousbouras wrote:
> On Wed, 14 Jun 2023 16:18:51 -0000 (UTC)
> Rich <rich@example.invalid> wrote:
>> Note that "IP address of 10.0.0.X" is not 100% identical to "only
>> connected to router by cable" as there is no mechanism at the
>> networking layer for IP packets to know they are traversing cables
>> "only connected to the router". So doing your actual ask is
>> impossible. But denying any source IP other than the IP range used for
>> the local LAN is the closest possibility.
>
> Let me ask something for my general education. The router can know whether
> some packets came from the part of its hardware which deals with WiFi as
> opposed to ethernet ports. So would it be possible to have a router based
> firewall which has different restrictions for WiFi accesses vs ethernet
> accesses ?

Oh yes. In fact you can set up as many networks on your router as you
want (up to some arbitrary limit) and give them all different network
addresses - you could have, for example, a/the wifi network on a
different set of IP addresses and then the router would have to route
between that and your wired network, and you could then set up the
router as a firewall between the two.

At least on my router you can. Its not cheap, but it damn well works.

I did set up a separate guest wifi network that couldn't access my LAN
at all - just the Internet.

But eventually concluded that I didn't have any real assholes as friends
anyway. And the one that might have been, died.

--
“It is dangerous to be right in matters on which the established
authorities are wrong.”

― Voltaire, The Age of Louis XIV

On 16/06/2023 06:27, 24D.245 wrote:
> On 6/14/23 4:23 AM, The Natural Philosopher wrote:
>> On 14/06/2023 05:01, 24D.245 wrote:
>>> On 6/13/23 6:36 PM, The Natural Philosopher wrote:
>>>> On 13/06/2023 21:25, Carlos E.R. wrote:
>>>>> On 2023-06-13 01:11, Computer Nerd Kev wrote:
>>>>>> Spiros Bousbouras <spibou@gmail.com> wrote:
>>>>>>> Thanks for all the replies everyone. That's a lot to read on.
>>>>>
>>>>> ...
>>>>>
>>>>>>>>> 3. Can it be done safely without having to enter a password on
>>>>>>>>> B when I want to connect to A ?
>>>>>>>>
>>>>>>>> If you care about this then perhaps Telnet isn't for you because
>>>>>>>> "safely" probably means that you don't want plain-text passwords
>>>>>>>> and anything else will mean raising version incompatibility
>>>>>>>> problems with authentication systems such as are used by SSH.
>>>>>>>
>>>>>>> Ideally , I don't want passwords at all , as I've said. But I think
>>>>>>> I'm missing your point.
>>>>>>
>>>>>> Yeah, any secure passwordless authentication system has the same
>>>>>> issues as SSH. Telnet itself only supports not having any
>>>>>> authentication, or passwords. If only computer B can connect to A
>>>>>> over Telnet due to firewall settings then going without
>>>>>> authentication should be OK, but it's not necessarily "safe"
>>>>>> against all attacks. Probably safe against any attacks that you're
>>>>>> likely to experience in many cases though.
>>>>>
>>>>>
>>>>> Telnet is an ancient protocol, and is considered to be unsafe in
>>>>> many aspects. Anyone with access to the LAN can see anything inside
>>>>> the telnet session.
>>>>>
>>>> Incorrect. Not since switches replaced hubs.
>>>> Apart from WiFi
>>>
>>>    Mostly correct ... but you can still poll addresses
>>>    looking for Telnet activity and then go from there.
>>>    Switches don't/can't hide EVERYTHING ... there are
>>>    numerous utilities that can still see a LOT going
>>>    on in the local network. Try WireShark ...
>>>
>> No, you cant.
>
>   Did it last Thursday.
>
>   Switches do NOT hide all activity not directed
>   to your specific PCs IP.
>
>   They do REDUCE it a bit though. I kept a traditional
>   HUB I can put right after the router to monitor ALL
>   activity, just in case. Has a big label saying "NEVER
>   THROW THIS AWAY" :-)
>
>> BTDTGTTS
>>
>> You can only see broadcast traffic on other segments.
>
>
>   But most places only have ONE segment ...
>
most places only have ONE segment per ethernet connected device.

There fixed that for yuu

>>>    Did have some fun lately though using Telnet to
>>>    log into a mail server, you can select an alt port.
>>>    Had to type weird stuff into prompts - but you COULD
>>>    connect/receive/send.
>>
>> Been doing that for years.
>
>   Not exactly "user friendly" though ...
>
For test purposes its ideal.

>> And I still use POP to download my mail from my internet based server.
>> Old school. Only this networks IP address can do that.
>
>   Try POP ... or even IMAP ... with M$ mail servers.
>   Last week they CUT THAT OFF. Only OAuth2 connections
>   still work. Thunderbird can do it, but not everything.
>   Mostly they want to force you to their online version
>   of Outlook ... my guess is that it spies on all your
>   other activity ....... more $$$ for M$

I have never ever had a microsoft email account and only have a gmail
one because its apparently necessary for android and youtube.

I download from gmail using POP with authentication.
There is no way I want ANY mail sitting on some public server, even the
ones I run myself

My mail, apart from that, runs on my own server on a VPS. I have 4 or 5
domains and about 20 email addresses. All handled seamlessly by thunderbird.

Telnetting into those mail servers was how I debugged them on setting
them up.

--
Canada is all right really, though not for the whole weekend.

"Saki"

On 16/06/2023 06:33, 24D.245 wrote:
> OK .. face the awful awful Truth - THERE IS NO REAL
>   "Protection". There are a zillion ways to tap your
>   traffic, sneak into your boxes, trick your users. It's
>   TOO MANY to cope with. Your best defense is obscurity,
>   being beneath notice, having nothing of value.
>
Oh dear, the ArtStudent™ mind with its Boolean Logic Only mentailitry
rears its ugly head...

Its not a matter of whether something *is* secure, its a matter of
*how* secure it is, but to assess that require Intelligence and Thinking
- qualities absolutely abhorrent to the modern social mind , as they
smell strongly of elitism, and probably Imperialism if not even Racism.

Today, you must be a good liitle child and believe in and do exactly
what you are told, or you will be cancelled.

If you want to be *practically* secure as against *theoretically*secure
you need to do a cost benefit analysis on what your data is worth and
how much in any coin you consider important, it will cost you to protect
it, and, indeed, work out whether that protections is worthwhile at all.

If you regularly leave the windows open, locking the door is a
relatively pointless waste of money on locks.

So you need to examine and understand all attack vectors, and realise
that an attacker who wants to target you *personally* is unlikely to
stop at throwing random packets at your router when he can burgle your
house and steal your computers, especially if he has government authority.

And if its random RATWARE, the most likely vulnerability will be you,
clicking on a URL and typing 'yes' when you should have typed 'no' on a
Windows based machine.

(I had a wonderful 20 minutes following instructions from a gentleman
from the subcontinent, on the phone, who had called me about the
'problem with my internet'. Eventually he said 'and what does it say
there?' and I truthfully said 'Linux Mint'. 'Oh, Linux doesn't have the
problem' he said, and hung up.
Sadly I don't have the time to do that every time

>   All the "wonderful" stuff you can do with modern networking
>   comes at a PRICE. It's all deep, Deep, DEEP - endless hooks
>   for evil-doers. M$ is so fucked up that it makes things
>   even EASIER for the bastards - stick to Linux/Unix as much
>   as you can.

Well yes, the last malware I 'caught' was on Windows 95 IIRC.

Since going 'all linux' I have not had any problems.
The random scripts that attack my public facing servers are all so
moronic, tgat I cant even be bothered to try and protect against them

I mean, if you have the nous to set up a public facing server on the
internet, are you *really* going to allow root logins via ssh with the
password 'gandalf'?

--
Climate Change: Socialism wearing a lab coat.

On 2023-06-15 23:01, Spiros Bousbouras wrote:
> On Wed, 14 Jun 2023 16:18:51 -0000 (UTC)
> Rich <rich@example.invalid> wrote:
>> Note that "IP address of 10.0.0.X" is not 100% identical to "only
>> connected to router by cable" as there is no mechanism at the
>> networking layer for IP packets to know they are traversing cables
>> "only connected to the router". So doing your actual ask is
>> impossible. But denying any source IP other than the IP range used for
>> the local LAN is the closest possibility.
>
> Let me ask something for my general education. The router can know whether
> some packets came from the part of its hardware which deals with WiFi as
> opposed to ethernet ports. So would it be possible to have a router based
> firewall which has different restrictions for WiFi accesses vs ethernet
> accesses ?

Yes, certainly.

However, what we know as "home router", the typical router you get from
your ISP, don't have those capabilities.

--
Cheers, Carlos.

On 2023-06-16 07:27, 24D.245 wrote:
> On 6/14/23 4:23 AM, The Natural Philosopher wrote:
>> On 14/06/2023 05:01, 24D.245 wrote:

....

>> And I still use POP to download my mail from my internet based server.
>> Old school. Only this networks IP address can do that.
>
>   Try POP ... or even IMAP ... with M$ mail servers.
>   Last week they CUT THAT OFF. Only OAuth2 connections
>   still work. Thunderbird can do it, but not everything.
>   Mostly they want to force you to their online version
>   of Outlook ... my guess is that it spies on all your
>   other activity ....... more $$$ for M$

OAuth2 is only the authentication part. The server part can be whatever,
like IMAP, or Microsoft own protocols.

For instance, with gmail you can use POP3 with OAuth2.

--
Cheers, Carlos.

On 2023-06-15 21:53, Spiros Bousbouras wrote:
> On Wed, 14 Jun 2023 20:04:58 +0100
> The Natural Philosopher <tnp@invalid.invalid> wrote:
>> On 14/06/2023 17:31, Rich wrote:
>>> If the router your ISP supplies does not give you a CLI interface
>>> option, you are out of luck there with that desire.

....

>> Why you don't want to use the routers web interface is beyond me. their
>> CLI interfaces are out of the ark usually. I only use mine because there
>> is one piece of data I cant get out of it using snmp
>
> In general , I prefer CLIs than <point and click>. For one thing , with a
> CLI I can automatically record all the exchanges so that I will know in
> the future what I did but with a <point and click> interface I would have
> to keep notes ; something like ,
>
> I chose menu ABC and from that submenu DEF and changed option 2 from
> X to Y.
>
> It's extra work and boring work to boot. Apart from that , my router not only
> seems to offer only a web interface but it requires javascript too for the
> login screen to function. I don't like complexity for the sake of complexity
> and obviously you don't need javascript to type a username and password. In
> addition , I normally do almost all my browsing using a text based browser.
> So instead I have to start a graphical browser just to inspect and possibly
> change some stupid router settings. I don't like to be made to jump through
> hoops and this whole thing very much makes me jump through hoops and I resent
> that.

But your router is listening on ssh. Haven't you tried it yet?

--
Cheers, Carlos.

24D.245 wrote:

>   Try POP ... or even IMAP ... with M$ mail servers.
>   Last week they CUT THAT OFF. Only OAuth2 connections
>   still work.

That's been the direction of travel for gmail, outlook, 365 over the
last couple of years, IME thunderbird handles oAuth2 just fine.

> Thunderbird can do it, but not everything.
>   Mostly they want to force you to their online version
>   of Outlook ... my guess is that it spies on all your
>   other activity ....... more $$$ for M$

On 16/06/2023 11:29, Andy Burns wrote:
> 24D.245 wrote:
>
>>    Try POP ... or even IMAP ... with M$ mail servers.
>>    Last week they CUT THAT OFF. Only OAuth2 connections
>>    still work.
>
> That's been the direction of travel for gmail, outlook, 365 over the
> last couple of years, IME thunderbird handles oAuth2 just fine.
>
>>    Thunderbird can do it, but not everything.
>>    Mostly they want to force you to their online version
>>    of Outlook ... my guess is that it spies on all your
>>    other activity ....... more $$$ for M$
>
Yes, by gmail grumbles if you use it at setup time.
--
“A leader is best When people barely know he exists. Of a good leader,
who talks little,When his work is done, his aim fulfilled,They will say,
“We did this ourselves.”

― Lao Tzu, Tao Te Ching

On 6/16/23 2:57 AM, The Natural Philosopher wrote:
> On 16/06/2023 06:33, 24D.245 wrote:
>> OK .. face the awful awful Truth - THERE IS NO REAL
>>    "Protection". There are a zillion ways to tap your
>>    traffic, sneak into your boxes, trick your users. It's
>>    TOO MANY to cope with. Your best defense is obscurity,
>>    being beneath notice, having nothing of value.
>>
> Oh dear, the ArtStudent™ mind with its Boolean Logic Only mentailitry
> rears its ugly head...

Sorry, was never good at 'art' :-)

And that was hardly boolean logic - just notice that
'security', esp computer security, is always a
dangerous illusion. There are shades of grey, and
a lot of factors which influence your color.

> Its not a matter of whether  something *is* secure, its a matter of
> *how* secure it is, but to assess that require Intelligence and Thinking
> - qualities absolutely abhorrent to the modern social mind , as they
> smell strongly of elitism, and probably Imperialism if not even Racism.
>
> Today, you must be a good liitle child and believe in and do exactly
> what you are told, or you will be cancelled.

News story yesterday - Amazon thought some guy said something
'racist' to a delivery guy and completely shut down his
Amazon-driven "smart"-home :-)

https://www.msn.com/en-us/news/technology/amazon-shuts-down-customer-s-smart-home-devices-after-delivery-driver-s-false-racism-claim/ar-AA1cBxsE

The STATE may have to give you (mostly) free speech, but
INDUSTRY is under no such obligation.

On 17/06/2023 02:12, 24D.245 wrote:
> On 6/16/23 2:57 AM, The Natural Philosopher wrote:
>> On 16/06/2023 06:33, 24D.245 wrote:
>>> OK .. face the awful awful Truth - THERE IS NO REAL
>>>    "Protection". There are a zillion ways to tap your
>>>    traffic, sneak into your boxes, trick your users. It's
>>>    TOO MANY to cope with. Your best defense is obscurity,
>>>    being beneath notice, having nothing of value.
>>>
>> Oh dear, the ArtStudent™ mind with its Boolean Logic Only mentailitry
>> rears its ugly head...
>
>   Sorry, was never good at 'art'  :-)
>
>   And that was hardly boolean logic - just notice that
>   'security', esp computer security, is always a
>   dangerous illusion.

That is boolean logic.

'true' versus 'dangerous illusion'

Its not a matter of true, it's a matter of *how* true.

There are shades of grey, and
>   a lot of factors which influence your color.
>
Exactly. so dont cover an entire spectrum with a single statement
'illusion'.

>> Its not a matter of whether  something *is* secure, its a matter of
>> *how* secure it is, but to assess that require Intelligence and
>> Thinking - qualities absolutely abhorrent to the modern social mind ,
>> as they smell strongly of elitism, and probably Imperialism if not
>> even Racism.
>>
>> Today, you must be a good liitle child and believe in and do exactly
>> what you are told, or you will be cancelled.
>
>     News story yesterday - Amazon thought some guy said something
>   'racist' to a delivery guy and completely shut down his
>   Amazon-driven "smart"-home  :-)
>
More fool him for having one.
The only cloud I use is *my* cloud.

> https://www.msn.com/en-us/news/technology/amazon-shuts-down-customer-s-smart-home-devices-after-delivery-driver-s-false-racism-claim/ar-AA1cBxsE
>
>   The STATE may have to give you (mostly) free speech, but
>   INDUSTRY is under no such obligation.
>
The State is adept at circumventing it anyway.

--
"When a true genius appears in the world, you may know him by this sign,
that the dunces are all in confederacy against him."

Jonathan Swift.

Computer Nerd Kev <not@telling.you.invalid> wrote:
> Spiros Bousbouras <spibou@gmail.com> wrote:
>> I have 2 Linux computers connected to the same router through
>> ethernet cables. Computer A runs Devuan , computer B an older
>> version of Debian. I want to connect from B to A and execute
>> shell commands on A. X11 forwarding would be a plus.
>>
>> I assume that something SSH related is the right approach
>
> Without knowing how old your old version of Debian is and how long
> you intend to keep using it without upgrading, my recommendation
> would be to not use SSH because either now or later it will be
> unable to connect with the newer Devuan system because all the
> supported authentication or encryption systems will be depreciated
> in the newer software.

I had that problem recently connecting from Arch Linux to a 5 years old
LEDE router (BusyBox 1.25), which IIRC uses dropbear instead of OpenSSH.
It was quite hard to guess the right options to make the connection,
and the SSH documentation does not make it easy, but at the end I was
able to connect with

ssh -o"HostKeyAlgorithms=+ssh-rsa" \
root@192.168.1.1 "${@}"

Javier <invalid@invalid.invalid> wrote:
>
> I had that problem recently connecting from Arch Linux to a 5 years old
> LEDE router (BusyBox 1.25), which IIRC uses dropbear instead of OpenSSH.
> It was quite hard to guess the right options to make the connection,
> and the SSH documentation does not make it easy, but at the end I was
> able to connect with
>
> ssh -o"HostKeyAlgorithms=+ssh-rsa" \
> root@192.168.1.1 "${@}"

That's newer OpenSSH versions (8.2 onwards) requiring SHA-2 instead
of SHA-1 for RSA keys. I've had the same trouble the other way
'round with a non-OpenSSH client failing to connect to a recent
OpenSSH server (with an error implying a problem with my public
key, rather than with the hash algorithm). Apparantly it also won't
work by default with OpenSSH version prior to 7.2.

https://www.openssh.com/txt/release-8.2

--
__ __
#_ < |\| |< _#

Computer Nerd Kev <not@telling.you.invalid> wrote:
> I've had the same trouble the other way 'round with a non-OpenSSH
> client failing to connect to a recent OpenSSH server

The other way round the problem is much worser, because one needs to
tinker with server config files, and restart the openssh server, with
the risk of breaking the server config and losing remote access to it.

In that case it is better to run a second instance of the server with
a different sshd_config file and a non-standard port.

> (with an error implying a problem with my public key,
> rather than with the hash algorithm)

I also found the error message quite unhelpful. The error reporting in
ssh should be improved.

On 6/13/23 16:30, Carlos E.R. wrote:
> And once there you can type "firefox &" and get firefox, or anything else.

Firefox always seems to know you are on a remote system and acts as it
sees fit.