Hot answers tagged

35

This is because DES-based crypt (AKA 'descrypt') truncates passwords at 8 bytes, and only checks the first 8 for the purpose of password verification. That's the answer to your direct question, but here's some general advice implied by your context: Fortunately, from my reading, MD5 in /etc/login.defs is actually md5crypt ($1$), which, while a little ...


20

I modified this in /etc/login.defs: PASS_MAX_LEN 8 problem fixed. Important additions: After I changed the above parameters, although I can set a password larger than 8 digits, it is still invalid because the real password is only the first eight digits. I don't know if this is my problem. My final solution is to set # ENCRYPT_METHOD DES ...


14

In order to see associated wifi clients, even if they don't have a DHCP Client or have no ip, you have to ask the AP for associated wifi devices: # Universal (Tested with OpenWRT 14.07 and 15.05.X) iwinfo wlan0/wl0/ath0 assoclist # Proprietary Broadcom (wl) wl -i wl0 assoclist # Proprietary Atheros (madwifi) wlanconfig ath0 list sta # MAC80211 iw dev ...


13

DNS server adress corresponds to DHCP option 006. According to the OpenWRT Wiki your /etc/config/dhcp should look like config 'dhcp' 'lan' ... list 'dhcp_option' '6,yourDNSIP'


10

Don't bother with DNS forwarding, or with OpenWrt's internal DNS server, just serve the existing DNS servers to your DHCP clients directly. You can do this by setting DHCP option 6, which will be formatted in the web interface like: 6,192.168.32.35,192.168.48.35 You can access the relevant part of the web interface in LuCI by going through Network --> ...


9

As an alternative to using DHCP option 6 you can directly change the DNS servers which OpenWrt uses. To do this navigate under the webinterface LuCI to Network → Interfaces → WAN → Edit → Advanced Settings and uncheck the option Use DNS servers advertised by peer. Then a new option field Use custom DNS servers should appear where you can enter the ...


8

If you have dnsmasq enabled you need to use DHCP-option 6 So in /etc/dnsmasq.conf you would add: dhcp-option=6,8.8.8.8,8.8.4.4 To add the google DNS servers


7

This is copied from the OpenWRT Page concerning your router: Wired stations cannot ping each other This is a known bug: "switch eth0(Atheros AR8316) no traffic between ports possible" Based on the comments from the bug you can try these commands: swconfig dev eth0 vlan 1 set ports "0 1 2 3 4 5" swconfig dev eth0 set apply If these work you ...


6

Dropbear does not support the short form of options, try this instead: ssh -N -f -R 9022:127.0.0.1:22 <target>


6

Packets that surf the FORWARD table don't hit the INPUT table. So, if your packets are actually hitting the FORWARD table, they're probably being natted or something similar -- which is okay, but it means you can't use INPUT rules to affect them. There's a great reference diagram - daunting to read but great for reference - at the Netfilter entry in ...


5

I have met similar problem and I can share solution which appears to be very simple. In OpenWRT the feature you are looking at is plain port forward. Open you router IP, typically http://192.168.1.1 In Network menu, choose Firewall, the Port Frowards. Scroll down to "New port forward" and add: Name: ALL->DMZ Protocol: choose do you need both TCP=UDP or ...


5

In short, yes it can be the right tool, but in fact it makes no odds if you are using SSLStrip, SSLSplit, mitmproxy or any other tool that can do your job, you should only beware of the way it works. As @Quantim mentioned, this is not possible without installing/having custom cert/CA in device behind the router since it needs custom CA to act as a man-in-the-...


4

According to OpenVPN documentation server-bridge is a shortcut expression for mode server tls-server push "route-gateway dhcp" and server-bridge nogw is a shortcut expression for mode server tls-server Interestingly push "route-gateway dhcp" activates a DHCP-proxy that stripes out the default gateway option in DHCP response from the original DHCP server....


4

You asked: "OpenWrt configuration on the remote server: Is there a solution for that?" I'm daily dealing with more than 80 OpenWRT boxes (three hardware platform running a mix of Backfire (some), Attitude Adjustment (most of them) and Barrier Braker (some)) and... last year I started searching deeply about a "configuration management" platform, suited for ...


4

I'm looking for a solution through IP chains/tables, firewall rules etc (or at least "plugins" with some history) rather than custom generated code. Not going to happen, sorry. Firewall and routing engines will typically resolve the DNS record to an IP address when the policy is activated, and Linux is no exception to this. The kernel will not perform ...


4

First of all, have a look here: Concepts of Interception Caching to have some idea on the advantages, disadvantages or possible issues of using transparent proxy. Secondly, HTTPS or ssl traffic won't work with a normal transparent proxy. You need to have a special configuration called ssl-bump, which has its own issues to consider in regards of privacy. ...


3

As advised above, I'd really recommend just forwarding the port(s) needed for discovery and data retrieval. Forwarding all ports will expose the administration login mechanism on your device to the entire internet. Being that your storage will likely contain personal data which I'm pretty sure you wouldn't want just anyone to be able to read, the DMZ/forward ...


3

Your are attempting to reinvent wheels. Logrotate does this efficiently: https://www.linode.com/docs/uptime/logs/use-logrotate-to-manage-log-files http://www.rackspace.com/knowledge_center/article/understanding-logrotate-utility https://www.digitalocean.com/community/tutorials/how-to-configure-logging-and-log-rotation-in-apache-on-an-ubuntu-vps Rather ...


3

The biggest problem I see is that I don't think you can do captive portal and any form of link-layer encryption (WEP, WPA, WPA2) at the same time. The problem is that link-layer encryption schemes require link-layer authentication before you can use the link, and captive portal authentication is higher-layer authentication that requires a working link. That ...


3

You can use the ethtool command http://linux.die.net/man/8/ethtool EDIT: You need to check the 'Speed' section. Check below: root ~ ethtool eth0 Settings for eth0: Supported ports: [ TP ] Supported link modes: 10baseT/Half 10baseT/Full 100baseT/Half 100baseT/Full 1000baseT/Full ...


3

Unfortunately @HBruijn's quite clever idea of simply making /generate_204 a directory rather than a file and then using that as the cgi_prefix with an index.cgi-file inside it as the index_page, only works partly. When I open /generate_204 from the browser myself, it does exactly what I wanted, but only after first returning a redirect to /generate_204/, ...


3

By default, when an OpenVPN client is active, only network traffic to and from the OpenVPN server site will pass over the VPN, i.e. you only have new routes to the subnets on the remote side, while the default gateway stays local. If all traffic goes through VPN, you may have these on your server configuration file: push "redirect-gateway def1" push "dhcp-...


2

Instead of cat /tmp/dhcp.leases|wc -l and arp -a, my solution is opkg update opkg install arp-scan arp-scan --interface=br-lan --localnet | grep responded | awk '{print $12}' It will return the number of devices which connected to OpenWRT by LAN port. Almost real time.


2

You probably have the domain-needed option enabled: -D, --domain-needed Tells dnsmasq to never forward A or AAAA queries for plain names, without dots or domain parts, to upstream nameservers. If the name is not known from /etc/hosts or DHCP then a "not found" answer is returned. Find where this is set (either /etc/dnsmasq.conf or the ...


2

If I were you I'd buy a couple MikroTik Routerboard RB751G-2HnD and configure them with WDS. MikroTik is a phenomenal value and I can testify to the fact that it's rock solid. Putting two of these in place should be able to shoulder the load you're looking to throw at it.


2

The easiest thing to do is to setup an internal DNS server that resolves the hostname of your site to the internal IP address. In the alternative, you can enter an /etc/hosts entry (or equivalent) on your client machine and achieve the same result.


2

You need name resolution to work differently from inside and outside the network. Your dyndns entry will route to external IP. Firewall routes are different from inside and outside the route. Add you dyndns name with the servers IP address to the local hosts file on OpenWrt and the dnsmasq DNS service should override the entry from the Internet. If you ...


2

At a guess, you've got 1 of 2 issues, or possibly both. Machine 2 doesn't have a default route (or any route) via Machine 1. You haven't mentioned the operating systems or subnets in use so I can't give you much more information about how to resolve that. You haven't actually enabled IP Forwarding on Machine 1: sysctl -w net.ipv4.ip_forward=1 or echo 1 &...


2

The OpenWrt wiki had an answer: With IGMP snooping, multicast forwarding is disabled for bridges. One pure bridge solution is to disable multicast_snooping. Add the following in /etc/rc.local echo "0" > /sys/devices/virtual/net/br-lan/bridge/multicast_snooping Replace br-lan with your actual bridge interface, sometimes also called br0. ...


2

Check the manual of the prio scheduler (man tc-prio) to see how TOS bits relate to the priomap. TOS 0x08 and TOS 0x10 correspond to priomap entrien #5 and #9 respectively, which in your example are mapped both to band 1, corresponding to qdisc 20: You should change the priomap to have TOS-LowDelay packets sent to band 0


Only top voted, non community-wiki answers of a minimum length are eligible