Earlier quoted context omitted.
Well no, in that case all traffic is exposed anyway.
I meant will people be able to find that the hostname exists.
Who's your DNS set to (on both ends)? They're probably selling logs.
When internal hostnames are leaked to the clown
251–260 of 265 posts
Re: When internal hostnames are leaked to the clown
#252Earlier quoted context omitted.
The extremely old kernel on Synology makes it hard or impossible to run some containers.
I have a fairly recent DS920+ and never had issues with containers - I have probably 10+ containers on it - grafana, victoriametrics/logs, jellyfin, immich with ML, my custom ubuntu toolboxes for net, media, ffmpeg builds, gluetun for vpn, homeassistant, wallabag,... Edit: I just checked Grafana and cadvisor reports 23 containers. Edit2: 4.4.302+ (2022) is my kernel version, there might be specific tools that require…
While gluetun works great, there are other implementations of wireguard that fail without the kernel modules. I've also ran into issues from containers wanting the kernel modules for iptables-nft but Synology only has legacy iptables.
Re: When internal hostnames are leaked to the clown
#253Re: When internal hostnames are leaked to the clown
#254Is "clown GCP Host" a technical term I am unaware of, or is the author just voicing their discontent? Seems to me that the problem is the NAS's web interface using sentry for logging/monitoring, and part of what was logged were internal hostnames (which might be named in a way that has sensitive info, e.g, the corp-and-other-corp-merger example they gave. So it wouldn't matter that it's inaccessible in a private netw…
I remember the term "clown computing" to describe "cloud computing" from IRC earlier than 2016 I use a localhost TLS forward proxy for all TCP and HTTP over the LAN There is no access to remote DNS, only local DNS. I use stored DNS data periodically gathered in bulk from various sources. As such, HTTP and other traffic over TCP that use hostnames cannot reach hosts on the internet unless I allow it in local DNS or th…
"snowgoose"
Re: When internal hostnames are leaked to the clown
#255Earlier quoted context omitted.
I have a fairly recent DS920+ and never had issues with containers - I have probably 10+ containers on it - grafana, victoriametrics/logs, jellyfin, immich with ML, my custom ubuntu toolboxes for net, media, ffmpeg builds, gluetun for vpn, homeassistant, wallabag,... Edit: I just checked Grafana and cadvisor reports 23 containers. Edit2: 4.4.302+ (2022) is my kernel version, there might be specific tools that require…
While gluetun works great, there are other implementations of wireguard that fail without the kernel modules. I've also ran into issues from containers wanting the kernel modules for iptables-nft but Synology only has legacy iptables.
I belive even for gluetun I had to add the WG kernel module. I think I used this to compile it for myself https://github.com/runfalk/synology-wireguard
I know there are userspace implementations, but can't remember the specifics rn and don't have my notes with me.
> kernel modules for iptables-nft
I think you meant nftables. The iptables-nft package is meant to provide iptables interface for nftables for code that still expects that, afaik. I didn't run into that issue yet (knock-knock). According to docs nftables is available since kernel 3.13, so in theory it might be possible to build the modules for Synology.
However, I don't think I will be buying another Synology in the future, mainly because of other issues like they restricting what RAM I can use or what I want to use the M2 slots for, or their recent experiment with trying to push their own drives only, etc. I might give TrueNAS a try if I am not bored enough to just build one on top of a general purpose OS...
Re: When internal hostnames are leaked to the clown
#256Earlier quoted context omitted.
> certificate authority logs, which are actively monitored by vulnerability scanners That sounds like a large kick-me sign taped to every new service. Reading how certificate transparency (CT) works leads me to think that there was a missed opportunity to publish hashes to the logs instead of the actual certificate data. That way a browser performing a certificate check can verify in CT, but a spammer can't monitor C…
I think it was more of an intentional tradeoff, as one of the many goals of CT logs was to allow domain owners to discover certificates issued for their domains, or more generally for any interested party to audit the activity of a certificate authority. What you're describing there is certificate... translucency, I guess?
Yes, "translucent database" was exactly the concept I thought of when asking the question. The concept is keep access to specific items easy but accessing the entire thing as a whole more costly.
Re: When internal hostnames are leaked to the clown
#257These requests to the Sentry company used to be sent over HTTP with no encryption
https://blog.sentry.io/sentry-ingestion-domains-updates/
https://cloud.google.com/blog/topics/partners/using-sentry-t...
https://old.reddit.com/r/PleX/comments/1b12phf/plex_sending_...
There has never been any resource record for any sentry.io domain in the DNS that is used by computers I control. This DNS is local and I control it. I saw a request to an ingest.sentry.io domain once while experimenting with Firefox. It failed
The DNS used by me only contains addresses for servers that I find useful
But every user has their own preferences. It is possible that some end-users might see value in allowing their computers to automatically send requests to sentry.io while receiving nothing in return. I am not one of those users
Re: When internal hostnames are leaked to the clown
#258Earlier quoted context omitted.
> Sure. but this is a Network Attached Storage product, and the user explicitly chose to use network functions (domains, http), it's not the same category of issue. Is it fair to say that you're saying that it should be considered normal to expect that network-attached devices (designed and sold by reliable, aboveboard companies) connected to (V)LANs with no Internet access will be configured to use computers that us…
Yes, correct. If you are using a storage device with a Layer 3 interface, you have already signed off that you aren't too concerned with the connection being airgapped. Otherwise you would have used a Layer 1 protocol, or hell, even a layer 2. You are giving the thing an IP address and IP capabilities? It's like signing one of those lengthy disclaimers that you might die and won't sue anyone for side effects. Not say…
> If you are using a storage device with a Layer 3 interface, you have already signed off that you aren't too concerned with the connection being airgapped.
I'll proceed as if you're ignorant, rather than looking for a (pretty weak-ass) fight. (I'm always (unjustifiably) surprised that folks are unaware of the capabilities of Mikrotik kit.)
There's a world of difference between a bottom-of-the-barrel SOHO LAN where your only host isolation mechanism is to pray that the host in question never bypasses your firewall rules by changing their IP or MAC address, and a just slightly better one where your switch ports mark host traffic [0] and the edge router uses those infrastructure-controlled marks (rather than IP and MAC address, which are controlled by the host you're trying to isolate) to know what networks that host's traffic is permitted to travel across.
This marking technique is called VLAN tagging and has been around since at least 1998. Routers and switches that are capable of using VLAN tagging are inexpensive; from Newegg you can get a Mikrotik RB2060GSP six-port switch for ~65USD and a Mikrotik hEX router (which is also a four-port switch) for ~70USD.
This notion that you have about IP network security has been out of date for more than than a quarter century. Now that you're aware of what's possible, hopefully you'll go have some fun with the kit that Mikrotik is producing; it's good stuff.
[0] ...and -to prevent forgeries- drop traffic that the host already marked...
Re: When internal hostnames are leaked to the clown
#259Earlier quoted context omitted.
While gluetun works great, there are other implementations of wireguard that fail without the kernel modules. I've also ran into issues from containers wanting the kernel modules for iptables-nft but Synology only has legacy iptables.
I belive even for gluetun I had to add the WG kernel module. I think I used this to compile it for myself https://github.com/runfalk/synology-wireguard I know there are userspace implementations, but can't remember the specifics rn and don't have my notes with me. > kernel modules for iptables-nft I think you meant nftables. The iptables-nft package is meant to provide iptables interface for nftables for code that st…
I had to look it up and I think it was a mix of user error and a bad container. At one point I had been trying to use the nicolaka/netshoot container as a sidecar to troubleshoot iptables on another container and it is/was(?) missing the iptables-legacy package and unable to interact with the first containers iptables.
As great as containerization is, having the right kernel modules available goes a long way and I probably wouldn't have run into trouble like that if the first container hadn't fallen back to iptables because nftables was unavailable.
All of these NAS OSs that include docker work great for the most popular containers, but once you get into the more complex ones strange quirks start poping up.
Re: When internal hostnames are leaked to the clown
#260Earlier quoted context omitted.
Storage target mode is block-level, not filesystem-level, meaning it won't support concurrent access and any network hiccup or dropped connection will leave the filesystem in an unclean state.
> ...any network hiccup or dropped connection will leave the filesystem in an unclean state. Given that the docs claim that this is an implementation of an official NVMe thing, I'd be very surprised if it had absolutely no facility for recovering from intermittent network failure. "The network is unreliable" [0] is axiom #1 for anyone who's building something that needs to go over a network. If what you report is tru…
NVME only provides block IO. An interruption of the connection is equivalent to forcibly unplugging a hard drive. If the filesystem you put on top supports that and is able to recover from that, you're fine. But most filesystems do not optimize for that happening anywhere near as frequently as it would if you were using this as a regular file sharing protocol over unreliable networks.