Ethernet Security tips ?

[PaulH]

Hello,

I’m using RPi4 and Pcp and LMS with wired Ethernet. Could you give me some additional security advices.

There is already:

- Change Pcp password.

Into LMS advanced security enable:
- Password protection
- Block incoming connection
- CSRF protection level HIGH
- CORS ??


Is it possible to allow only one IP computer to connect it ?


Any other ideas ?

Thanks

[Julf]

I’m using RPi4 and Pcp and LMS with wired Ethernet. Could you give me some additional security advices.

Is it possible to allow only one IP computer to connect it ?

Yes, by using (linux) firewall rules. Does pcp support ufw (uncomplicated firewall)?

[gordonb3]

Detach all cables, encase it in concrete and drop it in the ocean right on top of a tectonic plate boundary.

[Bscott]

Assuming you are using an external firewall and non routable IP addresses, the question is, what are you trying to protect against? Limiting user access on your internal network?

[d6jg]

Assuming you are using an external firewall and non routable IP addresses, the question is, what are you trying to protect against? Limiting user access on your internal network?

My thoughts exactly.
I seriously would not attempt to lock down to just one IP address as you could easily lock yourself out and not be able to get back in without a lot of hassle.

[slartibartfast]

My thoughts exactly.
I seriously would not attempt to lock down to just one IP address as you could easily lock yourself out and not be able to get back in without a lot of hassle.

I did that once [emoji1787]

Sent from my Pixel 3a using Tapatalk

[PaulH]

Assuming you are using an external firewall

No external FW

Limiting user access on your internal network?

Yes, avoid unwanted external access on my internal network.

Maybe the Pi with Pcp and LMS is only slightly vulnerable ???

[PaulH]

Detach all cables, encase it in concrete and drop it in the ocean right on top of a tectonic plate boundary.

I just want to avoid "exaggerations" and try to configure this with the maximum common sense...

[PaulH]

Yes, by using (linux) firewall rules. Does pcp support ufw (uncomplicated firewall)?

It could be great idea, but I'm not sure ufw could works with Tiny Core Linux

[slartibartfast]

No external FW


Yes, avoid unwanted external access on my internal network.

Maybe the Pi with Pcp and LMS is only slightly vulnerable ???

Are you sure you have no external firewall? Modem/Routers normally have them built in.

Sent from my Pixel 3a using Tapatalk

[gordonb3]

No external FW


Yes, avoid unwanted external access on my internal network.

Maybe the Pi with Pcp and LMS is only slightly vulnerable ???

Okay. If you have an internal network that implies that you have a (masquerading) router that allows you access to the internet. I'll give it a 99% chance that you are using an internal address range reading 192.168.x.x, just like 99% of the other home users and the address 192.168.0.1 probably exists more than 1 million times which means that it is impossible to access (or reply to) any specific machine with that address from any random location on the internet, except within that same local network or as a response to the masquerading firewall. In theory IPV6 changes this, but just like IPV4 the extended protocol lacks autodiscovery and thus if your router would even be bidirectional then a perpetrator would have to know both your external address and your internal address range to set up his own routing rules because no public system will provide these routes.

In other words, if someone on the outside would be able to gain access to your LMS then you will have a much bigger problem because all your Windows machines will have been compromised already.

[d6jg]

Okay. If you have an internal network that implies that you have a (masquerading) router that allows you access to the internet. I'll give it a 99% chance that you are using an internal address range reading 192.168.x.x, just like 99% of the other home users and the address 192.168.0.1 probably exists more than 1 million times which means that it is impossible to access (or reply to) any specific machine with that address from any random location on the internet, except within that same local network or as a response to the masquerading firewall. In theory IPV6 changes this, but just like IPV4 the extended protocol lacks autodiscovery and thus if your router would even be bidirectional then a perpetrator would have to know both your external address and your internal address range to set up his own routing rules because no public system will provide these routes.

In other words, if someone on the outside would be able to gain access to your LMS then you will have a much bigger problem because all your Windows machines will have been compromised already.

I suggest 1 million is a very significant underestimate!
I think this is a case of “a little knowledge…..”

[sodface]

I mean PaulH doesn't specify, but generally speaking, there may be some situations where you don't have control of a network that you use which is also shared with people you don't necessarily "trust". Maybe a dorm or some other kind of shared living arrangement where it's a big flat internal network. Maybe they aren't malicious insiders but maybe you don't want them dicking with your LMS either.

In which case, I'd probably try to setup my own router that connects to the shared wifi and hide everything behind that.

//edit, OP says he's using wired lan so my scenario and solution probably doesn't apply... but who knows

[PaulH]

//edit, OP says he's using wired lan so my scenario and solution probably doesn't apply... but who knows

Indeed it's not the case !

[PaulH]

Are you sure you have no external firewall? Modem/Routers normally have them built in.

I found some information and indeed, the router of the internet provider has a firewall. However it is preconfigured (how??) and we can not make any changes.
I think it must be a general rule.
It's probably better than nothing!