Slashdot Mirror
Is Rendezvous Sharing More Than You'd Like?
Gropo asks: "I just got an email from my father who has just recently upgraded from OS 9 to Mac OS X on his PowerMac. He's connected to the 'net via Adelphia Cable and shares his TCP connection with my Mother's iMac via Software Base Station. He got a call from his neighbor (also running Mac OS X) who noticed 'My Father's Computer' show up on his network. My first thought was: 'He's picking up your AirPort signal' - alas the neighbor has no AirPort card. The neighbor *does* however also have an Adelphia cable modem. I asked him to scan for available afp:// servers and sure enough, a foreign machine showed up. What's the easiest way (if at all possible) to enable auto-detection for the local wireless LAN (useful for file and printer sharing within the household) yet remain invisible to other people also behind the cable companies' local DHCP box?"
Firewall? Isn't this the same issue one would have with Windows file-sharing?
"Ignorance more frequently begets confidence than does knowledge"
- Charles Darwin
If you really don't want to use a firewall, you can always just give computer a meaningless name, and password protect all users on it.
In this particular case the problem is appletalk routing. Since you are creating a local subnet using the PowerMac as the router, you probably have appletalk activated on the wrong network interface. It needs to be on the Airport ethernet only and not on the wired connection. It can only be on one at a time so just switch it. - incidentally this won't change your ability to share info with the airported computer. You could also try blocking access to the appletalk port (548 IIRC) on your built in firewall. Alternatively, get a proper hardware firewall and use that to mask your subnet. Ultimately you need to be careful what services you enable on which interface as one of them is visible to the world and one isn't.
PS I don't think this has anything to do with Rendezvous.
Rendezvous is designed to work on a subnet, and likely your dad and his neighbor are on the same subnet, thus the inintended sharing.
Since he has a broadband connection, I'd recommend that you buy him a router, so that all of his Rendezvous packets stay in his house. No muss, no fuss. And routers can be as cheap as $30 -- I just bought a cool NetGear router to replace my LinkSys and it cost about $50. With the router, he can have multiple computers on his network, keep his LAN separate from the WAN, and have some basic security protection above and beyond the built-in firewall in Mac OS X.
Or you can convince him to buy a new AirPort base station that has a built-in router so he can solve his problem as well as allow you to surf the 'Net on your PowerBook while you're over visiting.
To me, it's a short threshold to come up with an excuse to buy sexy new Apple hardware.
Insert simplistic political, ideological, or personal proselytization here.
there once was a power mac
on the net i thought i'd hack
i was stunned to see
it ran bsd
my plans were thus set back
Michael.
sh:
Linux : Mac
Maybe, just maybe, the machine was not literally 'My Father's Computer'. It could have been 'Gropo senior's Computer' or 'Name withheld from public slashdot discussions' Computer'. You pick.
Hank! White!
ipfw rules sudo ipfw add 08800 deny tcp from any to any portnumber in via en0 for wired connections If i remember correctly... You will have to edit the ipfw file to get it to remember this on startup though... sudo pico /etc/ipfw.conf
Cable modems are notorious for creating security openings. In many cases, you and all the other computers in your neighborhood are bridged onto a single network. So it's the same as if you were on one big LAN.
This issue affects your dad's computer whether or not your mom's computer is connected via it (the in-house network is just an extra wrinkle).
So you need to do a careful job of insulating your dad's computer from the outside network. Start by turning off all unnecessary services that could be carried on the Ethernet adapter. (i.e., make sure these services are not allowed to communicate over the Ethernet adapter. It's fine to let them run over the Airport adapter if your software base station is configured correctly, but you will have to discriminate between the two). OS X does a pretty good job of not loading too many services in the default configuration. But you can fine tune what's going on using OS X's internal firewall. You should also turn off any file or printer sharing on the Ethernet adapter (using the Sharing preference panel). I'm not sure whether you can turn off Rendezvous on one particular adapter, but if you can, that would be a good idea too.
Another way to restrict data from being sent over the Ethernet connection out to your neighbors, would be to install firewall or routing hardware between your Dad's computer and the cable modem. Then you won't really have to worry about reconfiguring your dad's computer at all. Anything that is labeled for "cable modem sharing" or "DSL connection sharing" should work fine for you. However, if you're going to get a connection sharing box, you might as well get one that can provide a connection directly to both your dad's computer and your mom's, so hers doesn't have to go through his to get to the Internet. There are plenty of cable modem routers out there that also include 802.11b support, and any of these should solve all your problems at once (i.e., they will hide your computers from your neighbors, and they will allow both of your computers to connect to the Internet independently via Airport or Ethernet). Apple's Airport base station is particularly nice, but there are other boxes in the $100 range that will work fine.
Take a look at BrickHouse, an interface for configuring the rules for ipfw. It provides a combination of a simple interface that still provides much more flexibility than the interface that Mac OS X gives you, plus conveniently allows you to edit the rules in the configuration file manually if you wish. Yah, you could do this using $EDITOR_OF_CHOICE, but I find this more convenient.
Just apply the patch. ;-)
Recent versions of MacOS added rendezvous support to web servers, so you can automatically detect those web servers using Safari. As a result I came across a co-worker's web site and saw some rather racy web sites that he was working on in his spare time.
So yes. Rendezvous just might be sharing more than you'd like!
This is a common problem, and is not specific to Mac OS X. If your father had been running windows, your neighbour would find your fathers windows shares on his Windows or Mac OS X box.
The solution? Firewall.
Read up on ipfw. Its the nice firewall FreeBSD uses and Darwin/OSX has it too.
A few simple rules (default to deny etc) and you will be locked down tight.
D.
You can tell how powerful someone is by the magnitude of the crime they can commit and be able to get away with.
Two guys, neighbors, both running Jaguar, both on the same cable modem subnet.
:-)
I mean, what are the odds? They're so low to be trivial!
(Caveat: I've been a Mac user since 1984, so this slam is just good natured ribbing...)
My father is a blogger.
I think we really need to educate everyone that a firewall is always needed between the home computer and broadband connections, even if there is only one computer connected. The ISP are not providing the firewall with the modems because they want to sell that service for more money, if they want to allow it at all.
Of course all the other rules apply. Turn off all services that are not needed. Use good passwords on the services that are. I am afraid that Apple is going down the road of reduced security and feature bloat.
"She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
One specific thing you may want to try with a firewall is blocking packets to 224.0.0.251. I've been using MacSniffer to monitor the traffic on my own home lan to see what I might need to do security-wise and noticed packets going to this address periodically. After some searching, I found that this is probably Rendezvous activity. See this article.
People above have mentioned using a NAT/firewall. You also mentioned that your dad has a airport base station. AFAIK a Base Station is capable of being a NAT/firewall. So I'd just use that. You won't even need new hardware.
I know I'm going to hell, I'm just trying to get good seats.
on the topic of open macs hwoever, if you happen to be in central london someday with some spare time, just sit down at bar italia on frith street soho, pop on yr wifi and see how many drop boxes you can visit. i found at least 5 open wifi networks and each one of those exposed lots of macs. didn't find any ichat users tho... but plenty of rendesvous (or liberty connector as i hear you merkins prefer nowadays) shared web sites (99% default index pages).
oh and if you really wanna get into closed wifi networks remeber there is always KisMAC.
enjoy
I used to have a better sig than this, but I got tired of it
I don't think he needs some greenhorn pissant telling him what platform best suits his needs. SOMEONE SET UP MY DAD THE RAW SOCKETS
Try again, dingleberry.
I hate Grammar Nazi's
You could check if the problem is Rendezvous by sending your father DockBrowser (perhaps by compiling it up for him first.) This should only show the machines available via Rendezvous.
You could check if it was Appletalk by loading up chooser in Classic mode, perhaps with the Who's There rdev. It should only show machines available via Appletalk
You could disable appletalk in the ethernet interface connnected to the cable modem (Its in the Network pane in the System Preferences app.) and leave it on in the Airport interface.
Cable ISP's sometimes build their networks like LAN's. This aparently fools some macintoshes into thinking that it is, in fact, a LAN. I used to be able to see some macintoshes of my neighbourhood, until they fixed the problem.
Hello! I'm a disaster waiting to happen!
Rendezvous uses Multicast DNS (mDNS) to find and announce services. Multicast DNS uses a link-local multicast address, which means that routers should never forward mDNS packets from one link to another.
Simon
So, with Rendezvous on, you could potentially have a TON of iTunes libraries at your disposal, right?
At first it was only one person's computer, but as other releases of OS X came out (1.x, etc.) there were more and more people visible on the network.
That said, this was well before Rendezvous entered the picture, so it's probable that it is AppleTalk related.
But, I am pretty sure that if you have your users password protected, people can't access info from your computer - unless it's in your public folder.
Maybe a Firewall would help?
Gropo's dad again. The earlier mail got truncated, so you can see how my antediluvian geekness has deteriorated. Don't know what happened to it (the mail that is). I was also unable to establish an account on this site (a further measure of my ineptness).
,but it is not obvious how to accomplish this using the control panels for Network setup and/or Mail Account setup.
The reason my computer showed up next door was due to the LAN created by my (cable) ISP. I share this with the neighbor. My computer was identified as "my-names-computer", so it is no mystery how my neighbor recognized it.
He is a dentist and even less Mac knowledgeable than I, but he knows how to dial the phone, so he gave me a call.
My latest problem is that Mail doesn't seem to allow me to set up an account that uses one site for sending (my cable isp) and another for receiving (another POP server). Outlook express was quite happy with this arrangement
Thanks for all the suggestions for resolving my other problem. I changed the "name" of my computer and turned on the firewall, so I feel relatively secure here in my bucolic surroundings.