Plug-n-Play Server And Network

shyster writes: "The IMASS is a server for the technophobes. Built on a Linux OS, it autodetects network segments in less than 5 minutes, and sets up DHCP, DNS, FTP, Email, file sharing, firewall, NAT, internet access, dial-up, etc. almost automagically. Pluses include a solid state drive for the OS, so the hard drive is only used for file storage and backup (seperate 120GB hard drive for backups.) seems to be just what some of my clients need to finally convince them that Linux CAN be easier to use than Windows, and they can, for the most part, manage the network themselves! Check out a review from PCMagazine."

Comments

Security?

[ymgve]

How's the security on such a device that automagically sets up everything and then some?

(Remember, it was the automatic detection of network services (UPNP) that compromised WinXP..)

Re:Security?

[blane.bramble]

You have a choice of automagically created passwords to enhance security. These are "password", "secret", "fred", "fido", "1234", and the ever-popular "******". So far, no senior manager has been able to hack in (to their own account).

Blurb ahoy

[CaptainAlbert]

Apparently, it runs a...

> Hardened & ruggedized Linux based UNIX kernel

?

Could someone from marketing please tell me what that means?

Re:Blurb ahoy

[Anonymous Coward]

I tried to translate it back into English, but all I got was "The synergistic turnkey solution is an ideal e-business solution for tommorows iTransactions. The .NET based XML Java regidised engine transaction services compoenent technology provides a lower TCO and higher turnaround of your base assests. QED."

I think I may have accidentely translated it from Marketing to Management though.

Re:Blurb ahoy

[iMASS]

• Apparently it runs a "Hardened & ruggedized Linux based UNIX kernel"

That is indeed marketese. What we tried to tell them was we stripped the Linux OS (not the kernel) down to a system that fits (kernel Apache, perl, php, qmail, and all) in 12 megs on a flash disk, and so it's much more reliable and will keep doing basic tasks (like routing) even if the disk dies.

Naturally, they thought an OS was the same as a kernel, and liked the word "ruggedized", and the rest is history...

Uh, no

[Anonymous Coward]

[S]eems to be just what some of my clients need to finally convince them that Linux CAN be easier to use than Windows

Sorry, but this product does not demonstrate any such thing. Using any OS in this kind of device makes it an embedded OS and therefore invisible to the end user. If it's invisible then by definition it has no usability, good or otherwise.

I'm sure Linux was a good choice for the OS in this product, as it's cheap and infinitely configurable. But the OS's inherent ease of use to the customer is not on the list.

*This* is what they would have used in ID4

[dustpuppy]

it autodetects network segments in less than 5 minutes, and sets up DHCP, DNS, FTP, Email, file sharing, firewall, NAT, internet access, dial-up, etc. almost automagically

This is the sort of system they would have used in Independence Day 4 to autoconnect to the alien network and upload that virus. None of that stupid Apple crap ...

Kernel 2.2.19

[CDWert]

Kernel version of this wonderbar unit is
2.2.19

And 128 meg ram ???

Re:Almost

[Zocalo]

It's not Plug and (mostly) Play is it?

I suspect it's more like this:

Try DHCP - if OK great, configure eth0 accordingly, if not, not a problem for now

Put eth0 into promiscuous mode

Capture some traffic

Look for where connections are being opened for port 53 (DNS), port 20/21 (FTP), 25 (SMTP)...

Look at the source IPs for local IP's / subnet

Look for where traffic off-net is being sent for the default gateway(s)

etc.

Fill in some blanks with the above

Present harvested info to the user and ask them to fill in any required unknowns, make corrections and confirm the final settings This kind of thing isn't new, and there are lots of other tricks to farm data, like sending forged packets to illicit a response with useful data. Where you tend to come unstuck in what you can achieve though is when you plug the thing into a switch. It's a bit more difficult to find what you want when you can't see it...

Re:Almost

[Zocalo]

and if your on a switched network ? surely you wouldn't recieve any relevant traffic ?

You would initially just see broadcast traffic, and that gives you some IP information to get started from. You could then send a continuous stream of forged packet to the switch pretending to be from MAC addresses you can see. Depending on the switch you may be able to force it to fail and start acting as a hub, or receive packets intended for the legitimate hosts you are faking.

It's a technique known as ARP spoofing, for which there are plenty of tools such as Dugsong's DSniff suite. Get Ethereal as well, capture some packets and see what you can derive about the network - it should be quite a lot. Add a packet generator into the mix and, well, the sky's the limit really. I should also point out that you can very easily break the law with these tools; be careful what you do and where...

Re:Qmail licensing

[iMASS]

Not true. We explicitly checked with djb before we packaged qmail like this. It *is* allowed to distribute qmail in unmodified binary form *if* you do it as a tarball that follows his instructions... which we did.

Re:2.4 kernel

[iMASS]

Can it automagically upgrade the 2.4 kernel every couple of weeks and set the correct AC patches?

Yes! Although we tend to only upgrade the kernel when it's useful, not with every single release. Most of our customers don't care whether they're using 2.2 or 2.4 kernels, or apache 1.x or 2.0. I personally don't trust apache 2.0 yet.

Last time I checked, I think it takes three mouse clicks to upgrade the entire OS, which fits in 12 megs on a 32-meg flash disk (so you can hold two copies, and old "known working" one and a new "test" version). iMASS downloads the new version from our web site, verifies its integrity, and installs it automatically.

Unfortunately you have to reboot to upgrade the kernel. If it doesn't work for any reason, next time you reboot you get the old, safe version back automatically.