Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Next revisionBoth sides next revision | ||
| docs:guide-user:security:openwrt_security [2021/03/18 23:07] – header levels vgaetera | docs:guide-user:security:openwrt_security [2022/11/06 13:10] – [I have custom packages installed...] mdvthu | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== | + | ====== OpenWrt |
| Good news, OpenWrt has reasonable security by default. | Good news, OpenWrt has reasonable security by default. | ||
| - | If you are inexperienced in hardening and firewall and web security, there is no need to worry, OpenWrt is "hardened" | + | If you are inexperienced in hardening and firewall and web security, there is no need to worry, OpenWrt is hardened by default in a sufficient way, such that non-experienced muggles can use it right away, without being worried. |
| **...with one important single exception: | **...with one important single exception: | ||
| - | You need to set a password on your OpenWrt | + | You need to set a password on your OpenWrt root account. |
| + | The root account is the default OpenWrt admin account on your device. | ||
| + | The next chapter will show you how to do this. | ||
| This page also contains some general information about security of OpenWrt and what you should do in general, to keep your router in a properly secured state. | This page also contains some general information about security of OpenWrt and what you should do in general, to keep your router in a properly secured state. | ||
| - | ===== Setting | + | ===== Setting |
| - | To initially set (or later on change) | + | Set the root password |
| - | | + | - Navigate to **LuCI |
| - | | + | |
| - | + | | |
| - | Alternatively, | + | |
| + | You can also set the root password using command-line | ||
| + | |||
| + | <code bash> | ||
| + | passwd | ||
| + | </ | ||
| ===== Securing TTY and serial console ===== | ===== Securing TTY and serial console ===== | ||
| - | See also: [[docs: | + | Enable |
| - | As a principle, networking hardware should never be accessible and should be locked-down to avoid attacks. | + | <code bash> |
| - | After OpenWrt | + | uci set system.@system[0].ttylogin=" |
| - | However | + | uci commit system |
| - | Very few OpenWrt users are aware that their hardware is wide open, and you should be aware and find solutions. | + | /etc/init.d/system restart |
| - | You should know that hardware attacks on serial console pins are always | + | </ |
| - | However, it requires time and skills. | + | |
| + | Authentication for OpenWrt | ||
| + | Using TTY and serial console requires physical | ||
| + | You can reduce the attack surface by enabling authentication. | ||
| + | |||
| + | Note that hardware attacks on serial console pins are also possible. | ||
| + | However, it requires | ||
| ===== Disabling Linux single user mode ===== | ===== Disabling Linux single user mode ===== | ||
| Line 33: | Line 46: | ||
| This has to be discussed and this is not yet documented. | This has to be discussed and this is not yet documented. | ||
| - | ===== I am expert, show me some extra "hardening"... ===== | + | ===== I am expert, show me some extra hardening... ===== |
| - | | + | If you have 8MB flash or more and share your home network |
| - | - '' | + | |
| - | - '' | + | If you don't ever use your LuCI web interface |
| - | - ''/ | + | |
| - | - you can now access the web admin GUI by using '' | + | ===== My OpenWrt web interface |
| - | * if you don't ever use your LuCi web admin GUI at all, you can even disable LuCi (the web admin GUI): | + | |
| - | | + | |
| - | - stop the LuCi service: ''/ | + | |
| - | * if you have disabled your web GUI and and want to reenable it: | + | |
| - | - enable LuCi autostartion: | + | |
| - | - start the LuCi service: ''/ | + | |
| - | + | ||
| - | ===== My OpenWrt web admin page is always open in the background for ease of access... ===== | + | |
| ...and that is a very bad idea. | ...and that is a very bad idea. | ||
| - | Treat your admin root account with some sane respect. | + | Treat your root account with some sane respect. |
| - | Do what every major company does with the "root" | + | Do what every major company does with the root accounts of their Linux servers: |
| - | * Stay away from admin access (SSH and web GUI), when you don't need it | + | * Stay away from admin access (SSH and web interface), when you don't need it |
| * Close/Log off your root admin sessions once your are done administrating (not 8h later) | * Close/Log off your root admin sessions once your are done administrating (not 8h later) | ||
| * Only connect as root, when really in the need for administration | * Only connect as root, when really in the need for administration | ||
| Line 58: | Line 63: | ||
| * Don't share your root password with others, even if they promise some hot skateboarding penguins pictures in return | * Don't share your root password with others, even if they promise some hot skateboarding penguins pictures in return | ||
| - | ===== I don't need to set a 'root' | + | ===== I don't need to set a root password, when I am the only user. Right?.... ===== |
| Congratulations that you do not have to share precious bandwidth with others, but you still need to set a root password. | Congratulations that you do not have to share precious bandwidth with others, but you still need to set a root password. | ||
| - | Because any web site you call from a browser in your home network (e.g. those that promise hot skateboarding penguins pictures) could easily use so called | + | Any web site you call from a browser in your home network (e.g. those that promise hot skateboarding penguins pictures) could easily use so called |
| - | So just go and set a password on your "root" | + | If no root password is set, such malicious sites could manipulate your OpenWrt device in a way that you won't like. |
| + | So just go and set a password on your root account now. | ||
| ===== Let's just open this one single port for incoming traffic, what could possibly go wrong?... ===== | ===== Let's just open this one single port for incoming traffic, what could possibly go wrong?... ===== | ||
| Line 79: | Line 85: | ||
| Did you notice that even OpenWrt firmware gets updated from time to time? | Did you notice that even OpenWrt firmware gets updated from time to time? | ||
| - | As with your former vendor firmware, you should check regularly, whether OpenWrt has released new firmware and apply these updates to your device. There is even a configuration backup and restore feature, such that you do not have to start from scratch after each update. | + | As with your former vendor firmware, you should check regularly, whether OpenWrt has released new firmware and apply these updates to your device. |
| + | There is even a configuration backup and restore feature, such that you do not have to start from scratch after each update. | ||
| ===== I have custom packages installed... ===== | ===== I have custom packages installed... ===== | ||
| - | As with the firmware you should also keep an eye on the custom packages you install. There are several hundreds of optional packages. Not all security problems of those packages get addressed by OpenWrt system upgrades, but instead require you to manually upgrade the packages as well. | + | As with the firmware you should also keep an eye on the custom packages you install. |
| + | There are several hundreds of optional packages. | ||
| + | Not all security problems of those packages get addressed by OpenWrt system upgrades, but instead require you to manually upgrade the packages as well. | ||
| - | If you are using custom packages, you should run a '' | + | If you are using custom packages, you should run a '' |
| - | You then install package upgrades manually by running '' | + | This shows your installed packages that have available updates. |
| + | You then install package upgrades manually by running '' | ||
| Note that not every listed package upgrade is due to security issues, it can also be a harmless bug fix or feature extension. | Note that not every listed package upgrade is due to security issues, it can also be a harmless bug fix or feature extension. | ||
| An update will continue to use your existing service configuration, | An update will continue to use your existing service configuration, | ||
| - | Note: OpenWrt uses a read-only root file system plus a differential extension partition for all package installs and upgrades. When wanting to maximize usage of your precious flash space, it tends to be a better approach, to applying up-to-date OpenWrt firmware and then reinstall your packages instead of only upgrading packages, when expecting larger volumes of upgrades. | + | Note: OpenWrt uses a read-only root file system plus a differential extension partition for all package installs and upgrades. |
| + | When wanting to maximize usage of your precious flash space, it tends to be a better approach, to applying up-to-date OpenWrt firmware and then reinstall your packages instead of only upgrading packages, when expecting larger volumes of upgrades. | ||
| {{page> | {{page> | ||
| ===== A word about high-value weak points on OpenWrt ===== | ===== A word about high-value weak points on OpenWrt ===== | ||
| - | OpenWrt devices have 2-4 common services running, which kind of mark high-value targets for malware (even when only available in your LAN-zone): Any harmless looking web site, you have visited in your browser, could use cross site request forgery tricks, abusing an unpached | + | OpenWrt devices have 2-4 common services running, which kind of mark high-value targets for malware (even when only available in your LAN-zone): Any harmless looking web site, you have visited in your browser, could use cross site request forgery tricks, abusing an unpatched |
| + | This could lead to malicious malware redirect attacks where [[https://attack.mitre.org/techniques/T1189/|website redirects to a malware site]] and so on. | ||
| These high-value services in particular are: | These high-value services in particular are: | ||
| - | * the webserver running | + | * The webserver running |
| - | * the dropbear SSH server for OpenWrt | + | * The dropbear SSH server for OpenWrt |
| * The SFTP deamon for GUI file explorer admin access (only if manually activated, it's not there by default) | * The SFTP deamon for GUI file explorer admin access (only if manually activated, it's not there by default) | ||
| * Samba SMB share to provide user network file shares (only if manually activated, it's not there by default) | * Samba SMB share to provide user network file shares (only if manually activated, it's not there by default) | ||
| It is up to your personal responsibility, | It is up to your personal responsibility, | ||
| - | * set a "root" | + | * Set a root password |
| - | * keep your OpenWrt firmware up to date | + | * Keep your OpenWrt firmware up to date |
| - | * when you have Samba and/or SFTP activated manually: check regularly, if there are package | + | * When you have Samba and/or SFTP activated manually: check regularly, if there are package |