Security

[jdogherman]

with all this concern about security it amazes me that we dont have encryption on the management ssid NOR SSL on the web traffic..

Out of the box I guess you could do an shell connection with port forwarding.

So the moral of the story is think carefully about changing the root password to something that is familiar to you as it is transmitted in clear text.

[jdogherman]

Future security solutions...

• limit http and ssh access to certain hosts
  
• add encryption to a new management ssid
  
• enable ssh & http to only eth0 interface
  
• enable SSL on http access / https
  
• only permit management though ssh access (restrict http access to all but lo)
  
• build web user access who is not root
  
• disable root access, make user escalate for SU rights
  

Just brainstorming ideas

[Whistle Master]

All that makes sense if we were on a production environment :) Here, this is a hacker tool ;)

[Sebkinne]

Some of this will make it to the next release.

Best,

Sebkinne

[jdogherman]

All that makes sense if we were on a production environment Here, this is a hacker tool

the problem i see is what happens when you are using this hacker tool near other hackers?

[Sebkinne]

the problem i see is what happens when you are using this hacker tool near other hackers?

The intended use for the Pineapple is penetration testing though, so it should be unlikely.

BUT non the less, some of these features will be added in the next bigger version.

Best,

Sebkinne

[jdogherman]

thanks Seb!

[R04DRUNN3R]

Nice, I hope you intergrate ssl (https) in the Pineapple

[farfel]

The intended use for the Pineapple is penetration testing though, so it should be unlikely.

Our use of Pineapple is not for pen testing, troubleshooting networks or hacking; we'd just as soon see those features able to be hidden. I'm glad to see that some of the suggestions made will be in the next release.

Edited August 28, 2012 by farfel

[barry99705]

Our use of Pineapple is not for pen testing, troubleshooting networks or hacking; we'd just as soon see those features able to be hidden. I'm glad to see that some of the suggestions made will be in the next release.

Not to sound too much like an ass, but if you're not using the Pineapple for pen testing, troubleshooting networks, or hacking, what are you using it for???

[farfel]

Not to sound too much like an ass, but if you're not using the Pineapple for pen testing, troubleshooting networks, or hacking, what are you using it for???

The Pineapple is to be located at conferences, seminar rooms etc. All Wi-Fi connections to the Pineapple are directed to its internal webserver. The web content is attendee materials such as speakers' papers and event schedules. We've done this with other hardware but are checking out whether Pineapple is good for this purpose.

[Sebkinne]

The Pineapple is to be located at conferences, seminar rooms etc. All Wi-Fi connections to the Pineapple are directed to its internal webserver. The web content is attendee materials such as speakers' papers and event schedules. We've done this with other hardware but are checking out whether Pineapple is good for this purpose.

It will be as it gives you a lot of ways to handle exactly that. To secure it, I will be adding encrypted fs, https and so on.

Best Regards,

Sebkinne

[barry99705]

The Pineapple is to be located at conferences, seminar rooms etc. All Wi-Fi connections to the Pineapple are directed to its internal webserver. The web content is attendee materials such as speakers' papers and event schedules. We've done this with other hardware but are checking out whether Pineapple is good for this purpose.

Cool!