9 replies to this topic

[imopen]

Hello,

I'm trying to protect my box compiling /etc/hosts.allow and /etc/hosts.deny files, but without success, it seems they are completely ignored.

Am I doing something wrong or tcpd is not supported in enigma2 images? 

 

What I'm trying to do is to geo-protect my devices (with tcpd and geoip database), I do manage it successfully on a Nuc server but it seems impossible to achieve on my Gigablue decoder.

 

Thanks in advance and keep up the good work,

imopen

 

[littlesat]

Why? First don’t share you e2 box on the www! Without using ssh with a key or vpn.

Edited by littlesat, 5 September 2018 - 06:26.

[imopen]

Why? First don’t share you e2 box on the www! Without using ssh with a key or vpn.

 

Mainly because I use WebIf (API) opened on web, to remote control my box (add timer from outside my home, view epg on my Android app ) and to remote stream my channels.

 

I do NOT use standard port but I'd like to be sure that my server is unreachable from outside my country.

 

On my Nuc server (plex and transmission) there were connections from China or US and on it I successfully installed a geo block with hosts.allow/deny and GeoIp database, I'd like to do the same on my decoder.

Edited by imopen, 5 September 2018 - 07:15.

[Pr2]

Hi,

I do NOT use standard port but I'd like to be sure that my server is unreachable from outside my country.

I am quite sure that this guy also think that its OpenWebif is secured because he uses another port:
http://www.yamburg.com.ua:13120/
 
How to find, very easily using Google! You can use any port you want we can retrieve plenty of OpenWebif over the internet with a basic search engine.

So if you want to secure your box, setup a VPN.

Pr2

[littlesat]

NEVER forward the OWIF to the WWW... even when it is on a different port and within one country...

When you want to access the OWIF on any place of the world use SSH with a key or (Open)VPN (preferably via your router).

[imopen]

I very appreciate your suggestions but it's not the topic: I'm asking if exist a way to enable hosts.allow/deny control, not the best practice to secure a box.

 

I do know that VPN it's a better way but it's not pratical, expecially for other user (my wife) that want simply record a tv show when not at home with a tap. 

I know the risk of a open port (even with authentication enabled).

[littlesat]

As far I know IP tables can be installed on the box... but it was a long time ago I used it. And then also it is always better to configure your firewall on your router.

 

And then (and this is not really meant off-topic) we still strongly recommend even not to think about of opening the OWIF on the WWW.... You might experience that over a while using ssh with keys no password -or- VPN is much more practical... And even with a phone (Android and iOS) you use (Open)VPN to get access to your box but then fully secure. The only thing that is not practical  is the first configuration...

[imopen]

iptables doesn't work, there are unsatisfied dependency with kernel

 

iptables -L

modprobe: FATAL: Module ip_tables not found in directory /lib/modules/4.1.20-1.9

iptables v1.6.1: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)

Perhaps iptables or your kernel needs to be upgraded.

 

 

for the rest I know you are right, I'm a computer scientist and I know the risk.

 

the setup of VPN it's unpratical because every time you have to add a timer or view the EPG, you must open VPN on phone or forward the port over ssh. it could be easy for me, not for my wife. anyway consider my topic as an academic one: setting up a minimal firewall on a enigma2 box.

[Pr2]

Except that Engima2 will never be a Firewall since every box use a different kernel version so some boxes are still using unpatched kernel with security weakness.

[Erik Slagter]

That's not the real reason. You just don't want your STB to be a firewall as well.