31 replies to this topic

[Rick Hunter]

Dear all,

 

With the come of Mac OS High Sierra, Apple has decided to remove telnet client from the installation. 

I've made a simple manual how to restore telnet client on your mac. 

 

Please look at: https://wiki.openpli..._OS_High_Sierra when you're are in need of the telnet client. 

 

Best Regards,

Rick Hunter

[Erik Slagter]

Is there still an ssh client? I'd say use that instead, then. Telnet has been dead for years (as Apple correctly states here).

[betacentauri]

But after flashing you need to use a telnet client as ssh without password don't work.
Maybe set a random root password after flashing and show that in the menu? So we can get rid of telnet. Well not really as maybe tools depend on it.

[Erik Slagter]

We could revert the default root password to something like, say, dreambox, but the risk of that is that people won't change it. So it should be like a one-off password. I don't think dropbear supports that.

[betacentauri]

You can create a random password by your own in python code. But to show it in the menu so that users can access the box, you need to store it somewhere. That would be not very nice.

[MiLo]

We could revert the default root password to something like, say, dreambox, but the risk of that is that people won't change it.

Worse than that, it would open up an attack window.

The reason that you're not allowed to log into ssh without the root password being set is that when you flash the box, but have a portforward from the router to port 22 active, there will be a period that the root password is still empty but the SSH server already running. At that point, it would let anyone in from the internet. By not allowing any login until root has a password, this is made impossible and you can securely forward port 22 anywhere you like.

Setting any default password will re-enable this loophole.

Even a random password (at first boot) will not be completely secure. The box doesn't have any randomness in its hardware, so there are a limited set of "random" values that the box could end up with at boot, and that would make it possible for an outsider to just guess the random number seed used to create the password.

[MiLo]

You can create a random password by your own in python code. But to show it in the menu so that users can access the box, you need to store it somewhere. That would be not very nice.

A variation on that would work: A menu item to create and show a random root password. The password is shown on screen, and doesn't need to be stored permanently (other than its hash in /etc/shadow). If you forgot it, you can create a new one any time.

[betacentauri]

Not a bad idea . As long as e2 runs as root. But I guess this won't change in near future.

[Pr2]

Hi,

 

If you already have installed brew on your mac, simply type:

 

brew update

brew upgrade

 

then

 

brew install telnet

 

If not, install brew on your mac.

 

https://brew.sh/index_fr.html

 

Pr2

Edited by Pr2, 1 October 2017 - 10:46.

[littlesat]

I think what we have now is fine... we only need to add something to clear the password, so you can restore it via telnet. And actually you do need a password at all. It is better to use keys without a password..

[Dream1975]

There is also a plugin that can reset the root password the plugin is in the feed and called setpasswd in systemlugins

[Pr2]

 

You can create a random password by your own in python code. But to show it in the menu so that users can access the box, you need to store it somewhere. That would be not very nice.

A variation on that would work: A menu item to create and show a random root password. The password is shown on screen, and doesn't need to be stored permanently (other than its hash in /etc/shadow). If you forgot it, you can create a new one any time.

 

 

Simply use the MAC address of the box has password rather than a randon one (just have to know if you want it uppercase or lowercase), so people know in advance what the password will be and they don't need to turn on the TV to know it.

[betacentauri]

Who knows the MAC of his box? I don't. I know how to get it without trouble. But normal users don't know it.

[Pr2]

But you can display it on screen in place of the randon generated password, because indeed don't turn on TV was an option for "advanced" end-users.

[SpaceRat]

The theory that MAC addresses are unique is exactly that ... a theory.

In reality, some vendors use the same MAC for all boxes of a certain model (or simply all boxes) ... that's the reason there is a MAC changing functionality in oe-a.

 

Actually you do not need a telnet client anymore, at least as long as the box works or you prepared ssh to work.

We have a built-in terminal in OpenWebif, I'm not sure if OpenPLi builds/puts it on the feeds though:

 

[WanWizard]

We use the standard E2OpenPlugins version of OpenWebIf. If your fork has fed any changes in your fork back upstream, it should be in OpenPLi too.

[SpaceRat]

I spent ages on making E2OpenPlugins' and oe-a's versions of OpenWebif nearly identical again.
Since then, they are identical, except for transcoding.py which reads the transcoding settings from E2 in a different way and the owibranding.py which is missing in oe-a (Simply because it is nothing else but a poor man's rip-off of the oe-alliance branding).

If I'm not totally wrong you should have terminal inside the main package = always, as long as OWIF is installed.
Problem is: It requires "shellinabox" as RRECOMMEND, which probably does not exist in oe-core-openpli.

Feel free to "steal" the shellinabox recipe: https://github.com/o...ity/shellinabox

[WanWizard]

We don't steal, credit where credit's due.

 

We indeed don't have shellinabox, the problem I have with it, is that it isn't particularly secure, and it hasn't been maintained for quite a few years. Personally, I prefer https://github.com/yudai/gotty, when I have time I'll have a look at this, which which case you're free to borrow...

[SpaceRat]

We don't steal, credit where credit's due.
 
We indeed don't have shellinabox, the problem I have with it, is that it isn't particularly secure, and it hasn't been maintained for quite a few years.

b.) https://github.com/s...box/shellinabox is/was maintained ... at least in January/February, when we added that functionality to OWIF.
a.) In addition, I patched out the ability to bind to anything but localhost
Our shellinaboxd can only bind to ::1 and thus only accepts connections from the same machine, that is between OWIF and shellinabox.
... similar to our busybox-telnetd refusing any external connections (= not from the same network or private address space).

Users are free to shoot their own feet with their rifles, but if I can keep them from directing their rifles towards me (I'm now on that provider whose telephony/VoIP was taken down by Mirai ), I do that.

[Rick Hunter]

The theory that MAC addresses are unique is exactly that ... a theory.

In reality, some vendors use the same MAC for all boxes of a certain model (or simply all boxes) ... that's the reason there is a MAC changing functionality in oe-a.

 

Actually you do not need a telnet client anymore, at least as long as the box works or you prepared ssh to work.

We have a built-in terminal in OpenWebif, I'm not sure if OpenPLi builds/puts it on the feeds though:

 

The terminal option in the OpenWebIf isn't available at our images.