Plug-n-Play Server And Network

shyster writes: "The IMASS is a server for the technophobes. Built on a Linux OS, it autodetects network segments in less than 5 minutes, and sets up DHCP, DNS, FTP, Email, file sharing, firewall, NAT, internet access, dial-up, etc. almost automagically. Pluses include a solid state drive for the OS, so the hard drive is only used for file storage and backup (seperate 120GB hard drive for backups.) seems to be just what some of my clients need to finally convince them that Linux CAN be easier to use than Windows, and they can, for the most part, manage the network themselves! Check out a review from PCMagazine."

Comments

imagine..

[sluggie]

a beowulf cluster of those!

no, don't mod me down now! I really mean it!

So, what do you think could happen if you put more than one of those in a network.

do they recognize each other?
are they able to do some basic kind of load balancing (one does mail/ftp/NAT, the other one user homes/printer/etc)?
what if business grows bigger, so that you need more than one server?

I like such pseudo turnkey systems, but where is the scalability?

Kernel 2.2.19

[CDWert]

Kernel version of this wonderbar unit is
2.2.19

And 128 meg ram ???

Re:Almost

[Zocalo]

It's not Plug and (mostly) Play is it?

I suspect it's more like this:

Try DHCP - if OK great, configure eth0 accordingly, if not, not a problem for now

Put eth0 into promiscuous mode

Capture some traffic

Look for where connections are being opened for port 53 (DNS), port 20/21 (FTP), 25 (SMTP)...

Look at the source IPs for local IP's / subnet

Look for where traffic off-net is being sent for the default gateway(s)

etc.

Fill in some blanks with the above

Present harvested info to the user and ask them to fill in any required unknowns, make corrections and confirm the final settings This kind of thing isn't new, and there are lots of other tricks to farm data, like sending forged packets to illicit a response with useful data. Where you tend to come unstuck in what you can achieve though is when you plug the thing into a switch. It's a bit more difficult to find what you want when you can't see it...

Re:Almost

[Zocalo]

and if your on a switched network ? surely you wouldn't recieve any relevant traffic ?

You would initially just see broadcast traffic, and that gives you some IP information to get started from. You could then send a continuous stream of forged packet to the switch pretending to be from MAC addresses you can see. Depending on the switch you may be able to force it to fail and start acting as a hub, or receive packets intended for the legitimate hosts you are faking.

It's a technique known as ARP spoofing, for which there are plenty of tools such as Dugsong's DSniff suite. Get Ethereal as well, capture some packets and see what you can derive about the network - it should be quite a lot. Add a packet generator into the mix and, well, the sky's the limit really. I should also point out that you can very easily break the law with these tools; be careful what you do and where...