News for hackers. Stuff that matters.

A comment on Ubiquiti all but confirms breach response iniquity. Parent comment

Re:Ubiquiti all but confirms breach response iniquity by bpye on Sunday April 04, 2021 @05:52PM (#26693150)
During this week I've been playing around with replacing my USG with my existing home server - it already has two NICs - my first thought was to run OPNSense in a VM but nftables on NixOS seems to work well enough - there are a few examples floating online [0,1]. OpenBSD even supports the USG [2] but I couldn't think of much reason to keep the extra hardware.

The next thing I want to do is reflash my Unifi APs with OpenWRT [3] - the hardware is fine, but at that point I'll get all the support without the controller software.

My home environment is fairly basic so moving away isn't too hard - this would obviously be much harder for a small business...

[0] - https://francis.begyn.be/blog/nixos-home-router

[1] - http://www.willghatch.net/blog/2020/06/22/nixos-raspberry-pi...

[2] - https://www.openbsd.org/octeon.html

[3] - https://openwrt.org/toh/ubiquiti/start

[ Parent | on HN ]
Re:Ubiquiti all but confirms breach response iniquity by zrail on Sunday April 04, 2021 @08:38PM (#26694206)
> The next thing I want to do is reflash my Unifi APs with OpenWRT

My understanding is that this doesn't work anymore because Ubiquiti started signing firmware. Your link also goes to a blank page.

[ Parent | on HN ]
Re:Ubiquiti all but confirms breach response iniquity by bpye on Monday April 05, 2021 @05:24AM (#26696906)
That’s odd, the link works for me but the wiki was very slow earlier. From what I’ve read Ubiquiti have made it harder to flash new hardware, but even the new ax APs are supported by OpenWRT. There is a commit with some info - it seems there is a way to disable signature verification [0].

[0] - https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=fb...

[ Parent | on HN ]
Re:Ubiquiti all but confirms breach response iniquity by kelnos on Sunday April 04, 2021 @10:00PM (#26694597)
Depends on the hardware, I guess? I bought an AC AP Pro last fall and had no problem flashing OpenWRT on it.
[ Parent | on HN ]
Re:Ubiquiti all but confirms breach response iniquity by zbrozek on Sunday April 04, 2021 @07:40PM (#26693814)
I _do_ run opnsense in a VM and am very happy with the setup. My requirements for APs are simple but hard to satisfy. Ceiling mount, PoE, present-day-best 802.11 standard, and openwrt-capable.
[ Parent | on HN ]
Re:Ubiquiti all but confirms breach response iniquity by lostlogin on Sunday April 04, 2021 @06:51PM (#26693522)
> replacing my USG with my existing home server

I like this idea too, but would prefer that the router was physically separated and before any hardware that was in the network.

Is this a pointless concern?

[ Parent | on HN ]
Re:Ubiquiti all but confirms breach response iniquity by jefurii on Monday April 05, 2021 @01:40PM (#26702026)
If you have your router in a separate box then you won't have to take down your whole network if you have to restart your VM host.
[ Parent | on HN ]
Re:Ubiquiti all but confirms breach response iniquity by vageli on Sunday April 04, 2021 @07:25PM (#26693737)
It's hard to say whether or not the concern is pointless without knowing its basis. Why do you want it physically separated?
[ Parent | on HN ]
Re:Ubiquiti all but confirms breach response iniquity by lostlogin on Sunday April 04, 2021 @11:53PM (#26695162)
I had assumed a setup which had several VMs, with one being a PFSense or similar to be less secure than a standalone firewall. Reading about the pros and cons leads me to conclude that security in a virtual setup is just fine.
[ Parent | on HN ]
Re:Ubiquiti all but confirms breach response iniquity by neolog on Sunday April 04, 2021 @07:44PM (#26693842)
If your server is vulnerable to some threat, adding another barrier in front of it could help.
[ Parent | on HN ]