QNAP [QPKG] Qwhitelist app -> Super whitelisting (Qnap Firewall) version 1.6 [14-09-2015]

  • Vague de SPAM

    Suite à une vague de spam sur le forum, les inscriptions sont temporairement limitées.

    Après votre inscription, un membre de l'équipe devra valider votre compte avant qu'il ne soit activé. Nous sommes désolés pour la gêne occasionnée et vous remercions de votre patience.
Stéphane,

I got some very discomforting news from the QNAP helpdesk

They confirmed that the warning is legit

None of the legacy apps work after the final release of 4.2 !!!

What will you do with all your packages?
 
i sent a mail to HQ to have more info

strangely i dont have this popup... but i reinstall each time my apps

other clue, they will migrate in full 64bit, and i could understand the incompatibility... let see the answer
 
QoolBox a dit:
Hi ,

i am not in touch of this,

I think they wrong, probably a flag to set in QPKG...

do you have the tech name ? who answered
Cliquez pour agrandir...

Sure the ticket number is #LOO-777-29636
And the tech is : Manuel Koolhoven

He's response to my question if the apps will not be supported anymore was :
"they will stop working is what i heard"
 
weird, i dont know him .. i asked on our Skype TSD Group but no answer may be too late and he is back home

i will check internally will be faster
 
sebastienbo a dit:
Stéphane,

I got some very discomforting news from the QNAP helpdesk

They confirmed that the warning is legit

None of the legacy apps work after the final release of 4.2 !!!

What will you do with all your packages?
Cliquez pour agrandir...

here is the answer from HQ :

it means your apps are not registered in official app center list.
So it thinks these are unknown apps. It shouldn't have impact on the operation.

To avoid confusing end-user, The dialog message is removed in RC2, It will be released before this week

;)
 
Thanks for beeing so fast, I just verified and now it works completely out of the box after install.

Only cron is not automaticly added because the /etc/config/crontab is read only for the www user, so we need to find a way to update it :-(

I also noticed that the cron is beeing overwritten and chmodded 644 at every nas restart ... that means that It must be located somewhere else

Does anyone have an idea where this source crontab could be located?

Edit: it seems to be hidden deeply in ramblocks ... and overwriting at every nas restart
 
sebastienbo a dit:
Does anyone have an idea where this source crontab could be located?

Edit: it seems to be hidden deeply in ramblocks ... and overwriting at every nas restart
Cliquez pour agrandir...
Did you make to solve this problem?
 
In practice you added to startup a script which reset the cron job and chmod again the file?

Can you share more on that, 'cause it may be helpful for other projects as well? Thanks
 
QoolBox a dit:
simply check /etc/init.d/QWhiteList.sh in start section ;)
Cliquez pour agrandir...


Stéphane,

I'm glad it works so great, I finally am not affraid to open services to the internet anymore :-)

What a relief, I was always getting robots from the internet trying to logon to my ssh and webdav service, now nothing :-)

The cronjob is also completely functional and resolving my hostnames every 30 minutes :-)

I can also confirm that a reboot doesn't remove everything, your script functions like magic

The only thing that I'm gonna configure now is the two-factor authentication so that I can whitelist on the road and give people temporary access :-)

Thanks for everything
 
Hi, I installed two weeks ago, but uninstalled son later as I don't really feel to need it. However I will give it a new test as I really like the idea and the added value it brings to daily security.

In any case a 2 factor authenticator to bypass the ip restriction and change settings could be a good idea. In fact what scares me is the possibility to close me out of my network...
 
giopas thanks for your feedback

There are 5 build in failsaves to protect yourself:
1) whatever you try to do with the app , it will always add your current subnet automaticly to the private ip adresses field (even if you delete it or change it wrongly and then save it ) -> it will always add the private ip adress subnet where your nas is located: if your nas is 192.168.4.50 or 192.168.1.4 it will automaticly whitelist 192.168.0.0/255.255.0.0
If it was located in the ip adress 10.1.0.34 it would whitelist 10.1.0.0/255.255.0.0
2) IP adresses are always validated 3 times, they will be ignored and not be compiled when you put a syntax error in one of the fields (it will even warn you that the ip adress is no valid)
3) When compiling a list, it never writes directly to the ipsec.conf file to avoid beeing interupted during such a sensative process , instead it writes to a tempory file, and if the write was succesfull it will do a file copy (which is much faster and save)
4) Compiling is protected against to many writes, between each compilation you need to wait 1 minute (to protect against bruteforcing comming from a whitelisted ip adress)
5) If however all the above failsaves fail, you can still press the reset button 1.5 second on the nas, this will cause a soft reset, and remove al lthe security features that you set on the nas (also the whitelisting will be resetted), but your other nas config and files remain the same (As long as you don't press the reset button for 10 seconds -> which is the hard reset (where all the config will be errased and only your files will survive)
 
Vous devez vous connecter ou vous enregistrer pour répondre ici.
Haut Bas
Retour