Phaselockedloopable- PLL's continued exploration of networking, self-hosting and decoupling from big tech

@SgtAwesomesauce et al Probably one of the more useful cases of what I am running (cockpit)… is the solution center on SELinux issues

[[email protected] ~]$ sudo ausearch -c 'rtkit-daemon' --raw | audit2allow -M my-rtkitdaemon # semodule -X 300 -i my-rtkitdaemon.pp
[sudo] password for eric: 
******************** IMPORTANT ***********************
To make this policy package active, execute:

semodule -i my-rtkitdaemon.pp

[[email protected] ~]$ sudo semodule -i my-rtkitdaemon.pp
[[email protected] ~]$ 

SELinux has never been easier and I love it

Security and Convenience? Why not both?


For those unfamiliar

What is SELinux:

Perhaps the most useful description is thinking of it as a framework for managing access control to files and other resources in the Linux system that go far beyond standard file permissions or aces control lists. As if chown and chmod werent already a headache :wink:

Is there a Presentation I can watch?

Yes, RHEL has one. The video goes into its difficulties but also why its good.

Whats my issue?

My issue before was inconvenience. I never had a testing and production system. You want an air gapped testing system so that you dont have to remove protections from your production machine to fix the issue. Cockpit mostly solves that including for stuff that doesnt like SELinux (like PiHole)

1 Like

Its here. Time to load openwrt

Something ive always applauded netgear for as an rf engineer is protecting the rpsma connectors with rubber covers… they never skimp

2 Likes

Connectivity pictures for those who care

2 Likes

Interesting 2 antenna 1s a 2 and a 3. This may shed light on how the code the mu-mimo and how the array transmits and recieves. Ill dig into that later after a before and after testing of stock vs professional antennas

1 Like

Thanks Novasty testing whiskey on me is fun :yay:

Coolio she’s set to go

------------------------------------
[[email protected] ~]$ ssh [email protected]
[email protected]'s password: 


BusyBox v1.30.1 () built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 19.07.4, r11208-ce6496d796
 -----------------------------------------------------
[email protected]:~# cat /etc/config/wireless  

config wifi-device 'radio0'
	option type 'mac80211'
	option hwmode '11a'
	option path 'soc/1b500000.pci/pci0000:00/0000:00:00.0/0000:01:00.0'
	option htmode 'VHT80'
	option channel '157'
	option legacy_rates '0'
	option country 'US'
	option txpower '30'
	option beacon_int '1000'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option network 'lan'
	option mode 'ap'
	option dtim_period '1'
	option ssid 'asgard.yggdrasil'
	option encryption 'psk2+ccmp'
	option wpa_disable_eapol_key_retries '1'
	option ieee80211w '2'
	option key '*******************************'
	option disassoc_low_ack '0'
	option ieee80211w_max_timeout '500'
	option ieee80211w_retry_timeout '100'

config wifi-device 'radio1'
	option type 'mac80211'
	option hwmode '11g'
	option path 'soc/1b700000.pci/pci0001:00/0001:00:00.0/0001:01:00.0'
	option txpower '30'
	option channel '1'
	option beacon_int '1000'
	option legacy_rates '0'
	option htmode 'HT40'
	option country 'US'

config wifi-iface 'default_radio1'
	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option dtim_period '1'
	option ssid 'nidavellir.yggdrasil'
	option encryption 'psk2+ccmp'
	option wpa_disable_eapol_key_retries '1'
	option ieee80211w '2'
	option key '*********'
	option disassoc_low_ack '0'
	option ieee80211w_max_timeout '500'
	option ieee80211w_retry_timeout '100'

[email protected]:~# 

Alright guys heres the AP setup for signal strength testing. You will notice I am going to keep the power the same and keep DTIM and beacon interval the same so to not skew the tests as well as disabled disassociate on low ACK… When I run my tests you will see the difference between true professional antennas and the basic stocks.

Might even do an antenna tear down!

Notable Configuration Mentions:

Please note I will change the TX power to accurate reflect EIRP to be within legal bounds later. Im sure a test or two wont upset HAM folk

Reason for testing is for science

Notes about high gain antennas; If you change the following parameters via antennas you can no longer guarantee you are operating within FCC Spec and proper EIRP:

  • Gain
  • Output S parameters (output VSWR etc)
  • Q factor
  • Impedance
  • Beamwidth

Its important to realize if you do get higher gain antennas the polite thing to do is to turn down the power and try to stay in spec. Its not nice to operators or your neighbors. Most consumer and even prosumer radios do not have the abilit yot check the matching and all the parameters above, only high end Amatuer radios. They are programmed with whatever they got from the factory!

2 Likes

Documents ill use in initial conjecture and testing theories of why something might have behaved the way it did

https://fccid.io/PY315100319/Test-Report/Test-Report-DTS-rev-pdf-2801861.pdf

1 Like

hell yes… got matching IPv4 and IPv6 tails
image

[[email protected] ~]$ ifconfig
enp4s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.31.82.4  netmask 255.255.255.0  broadcast 10.31.82.255
        inet6 fe80::fec0:28fa:803b:a8c9  prefixlen 64  scopeid 0x20<link>
        inet6 2601:680:ca80:7302::4  prefixlen 128  scopeid 0x0<global>
        ether 10:7b:44:18:0e:6d  txqueuelen 1000  (Ethernet)
        RX packets 6223412  bytes 7667332272 (7.1 GiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2519467  bytes 598562042 (570.8 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device memory 0xf6500000-f651ffff 

Now that I completely understand the stack. IPv6 aint hard

image

1 Like

Relevent to your interests: https://labzilla.io/blog/force-dns-pihole

If you’re using PiHole on your network to block ads and prevent your various smart devices from sending tracking information to their manufacturers, you might be surprised to find out that some of these devices are using a sneaky tactic to bypass your PiHole entirely.

Smart devices manufacturers often “hard-code” in a public DNS server, like Google’s 8.8.8.8, and their devices ignore whatever DNS server is assigned by your router - such as your PiHole.

Nearly 70% of smart TVs and 46% of game consoles were found to contain hardcoded DNS settings - allowing them to simply ignore your local network’s DNS server entirely. On average, Smart TVs generate an average of 60 megabytes of outgoing Internet traffic per day , all the while bypassing tools like PiHole.

Fortunately, with a few simple firewall rules, you can intercept these hardcoded DNS queries and redirect them to your PiHole. These instructions are for pfSense, however you should be able to adapt them for Sophos XG, Ubiquiti EdgeRouter, etc.

7 Likes

lol

yes exactly. I have been doing that on the OPNsense. It was not too hard. The direct rule for redirecting 53 was the first step.

Its really really annoying that smart things folk do this.

Still working out the kinks but once its all stable. Ill test the router antenna differences

Thanks for the link man!

3 Likes

Just wait till thay all have 5G built in and there’s hotspots for that all over the place and they just connect to one of them, bypassing your LAN completely. :frowning:

1 Like

At that point I will just start building my own stuff lol

2 Likes

Lol well testing delayed. Honest reason : work has gotten hectic. And lol laziness sorry. Just need a moment!

1 Like

On GrapheneOS you can install google play apps using Aurora Store.

For a hardware firewall it is much better to use an AMD CPU - ideally an older CPU without a PSP (Intel CPU’s are open books for state actors)

1 Like

See above. Coreboot. ME nuked from orbit. I dont care about state actors. I just like supporting the development on these. After all I am an engineer for the DOD lol. Open firmware is cool and its not just for the careful.

The older AMD CPUs cant match the troughput in the power and form factor of what I bought. Consider checking it out!

2 Likes

Intel CPU’s have an always on 3G connection in hardware. It is how airgapped machines are exploited.

1 Like

wat

4 Likes

wait what? No they dont. That would require FCC approval and all the documentation associated

1 Like

Intel CPUs really do have secret 3G chip

If you run Intel - your system is an open book whatever os you run.

1 Like

Thats the vPro which is for business stuff.

3 Likes