Just another blog …

My router has open ssh port so that I can connect from Internet to home, and recently I’ve noticed in logs that someone is scanning my ports:

Jun  5 15:13:49 dropbear[745]: login attempt for nonexistent user from 187.141.73.66:47311
Jun  5 15:13:50 dropbear[745]: exit before auth: Disconnect received

It seems like some one is looking for vulnerabilities. But why – you ask? It could be worm which is infecting mipsel routers running under Linux. That’s life, devices become more powerful, they become like servers and if infected they could pose a big threat.

There are a few rules on how protect yourself from being hacked.

1. First, share as minimum ports as possible.

2. Use non standard login names. Default is admin/admin. So it has to be changed into something different. Luckily Oleg’s firmware & DD-WRT allows to change user name

3.  Make passwords more complex for ssh and| or http administration page.

4.  Use Brute Force Attack protection for ssh / http page. I use 1 hit count per 600 seconds.

Now, the most interesting thing. In oleg’s firmware you can change the user name, and password. But it seems like the password changes affects only http configuration page. The ssh daemon still uses old password. In order to solve this problem login to router via ssh and run:

passwd

It will ask you to enter new password and confirm it.Afterwards you will have to store the password using:

flashfs save && flashfs commit && flashfs enable
reboot

I also hit another bug when changing password in http page It’s length is limited to 17 characters. If you specify longer password it just cuts. It is hard then to understand why you can’t login and why the previous password does not work.

It’s been a couple of weeks since I bought RT-N16 and during this time I’ve accumulated some experience. The most important thing that I could understand for this time – firmware from Asus – sucks, because even though it provides minimalistic features it is very unstable and does not utilize the power of router’s hardware!

Now, let me shortly review all firmwares I tried from Asus:

1.0.0.6 – was installed when I bought a router. Very unstable, huge pings to router if you visit rich flash site as youtube.com. It was impossible to talk via skype on this firmware: video and sound ware delayed, etc.

1.0.1.2 – installed it as soon as I’ve discovered that 1.0.0.6 sucks. At the beginning everything was stable, but then I got dropping wi-fi connections, even without a load.

1.0.1.3 – beta firmware from Asus, never published. Same problem as with 1.0.1.2 – network periodically disappears by itself.

1.0.1.4 – interesting firmware. A day after it was released, it was removed from Asus site, and then reappeared as another file – with different md5, creation date, but the version was exactly the same

If the company where I work treats its customers in the same way as Asus, I would already have been looking some job because of unemployment. Well, if you release 1.0.1.4 and found a bug, why not to release a corrected firmware as 1.0.1.5? And why there is no changes.log file for each firmware?

After all, it is important to know what bugs were fixed and what changes are made, because it will save time for users – if fixes are just cosmetic – there is no need to do firmware upgrade …

In 1.0.1.4 there were several critical issues which forces me to quit using Asus firmware:

1. Mystical disconnects of wi-fi

2. Asus tools are very buggy, for example, scanning does not work. Printer hungs sometimes. If you disconnect network cable or your laptop is not in the range of wifi spot the Asus tools use 100% of your CPU. Cool, huh???

3. After changing some options of router – it hangs. To remove the mystical disconnects I decided to shutdown unnecessary services, for example, upnp media server, firewall logs, etc. And what was my surprise when, after changing the options and saving them, the router after reboot did not connect the wi-fi clients!

At some point, while solving problems with Asus software, I caught myself thinking that it just sucks. I bought router to be stable and work 24×7. In fact, the RT-N16 became a capricious piece of hardware which became less stable as my old Dlink DI-524 for 40 $

So I decided to look for something different, like dd-wrt, tomato usb mod, and oleg’s firmware. At this stage I can tell you that all three firmwares are more stable and better than Asus firmware. Make conclusions, gentlemen!

1. dd-wrt – interesting but raw firmware. It works quite stable, but to make printing or scaning work it is a pain.

2. tomato usb mod – very good firmware. The printer is fully operational just out of the box, firmware has an excellent web interface that shows you a lot of details – the noise of wifi signal, neighboring wi-fi spots, which channels they are use, etc. But at the same time I had trouble with USB flash drive formatted ext3 – it was unable to be mounted

3. oleg’s firmware – a very stable firmware which I use at the moment.

I’ve downloaded one of the nightly builds of olegs firmware: I discovered how cool it is.

First, it is very stable. Everything just works and does not disconnect.

Secondly, there is a huge amount of information on how to extend firmware with ipkg, etc.

Thirdly, the project is very active – almost every day there come new versions, and you can see the changelog on the project site.

There is also information on how to build firmware from sources, the site of the project also has the necessary mips toolchains for download.

And last, what is very important for me, with oleg’s firmware you can install via ipkg a sane scanning server on the router. Thus I was able to find a replacement for Asus Tools, I made printing and scanning work with my router.

Using ipkg I also was able to setup big amount of useful tools on the router like:

1.wakelan to turn on my computer from internet

2.vim to edit files

3.mc to browse files like in Far Manager

4.sane scanning server

5.printing server

So I am happy now It just works and I don’t bother myself trying to dig into shitty firmware from Asus trying to explain why wifi suddenly stopped working, etc ..

P.S. You can download firmware from oleg here: ftp://core.dumped.ru/rt-n/ . Currently I am on RT-N16-1.9.2.7-rtn-r1639 . If by some reason you don’t trust *.ru websites, you can download firmware from my site: http://www.shcherbyna.com/files/rt-n16/RT-N16-1.9.2.7-rtn-r1639.trx.zip

Update: I am not using Asus firmware anymore, it is very unstable and buggy, so if I write in my article below “stable” read it as “unstable”

Note: In this post I am talking about installing ipkg on the native firmware from Asus version 1.0.1.2. With dd-wrt, oleg’s firmware there are no problems to install ipkg, just follow the instructions that are posted on their sites.

After trying different firmware, I have decided to stay with Asus firmware 1.0.1.2. The reason for this is one – 100% support for multi functional USB devices (MFD) + good stability of 1.0.1.2. With a powerful enough hardware you may wish to install some useful software on it and here we have several options …

- You can compile packages using the mips toolchain which of course is very interesting, but turns into a loss of time if you just need put a couple of services on the router …

- You can install on the router the ipkg – a package manager similar to apt-get in debian, or yum in fedora … ipkg can install huge number of services on the router, and we just can’t skip this possibility!

What are the other benefits of ipkg? In addition to the huge number of ready-to-install packages ipkg also also takes care of their dependencies, so there will be no need to figure out why, for example, nano will not start and requires a libcurl, or something like that …

With dd-wrt or oleg’s firmware ipkg is already installed, but in our case we will have to suffer a bit, because information on how to install ipkg is hard to collect from multiple places in Internet, and errors sometimes are bizarre, even google can’t help. But as Comrade Lenin said, “patience and hard work wins”

So, let’s start. Following is required to install ipkg:

1. USB drive, formatted in ext3. You will loose all your data after format!

2. Access to the router via telnet

I recommend regular USB stick because the external disk may need power supply (I read that sometimes RT-N16 can not feed the external USB drive). It has to be formatted in ext3. FAT or NTFS is not suitable. Google on how to format USB driver in ext3.

You must allow access to the router via telnet. Go to the web interface of the router in the section Advanced-Lan-LanIP and check telnetd:

Click Apply and try to connect to router via telnet. You can use putty for this. Here is how it looks like:

Now insert into router a formated USB stick and check whether it is visible:

# cd /tmp/harddisk

# ls

part0

In my case the USB drive is seen as part0, but in your case it can be part1. We need to mount it in /opt. Why exactly /opt? The reason for this is the way ipkg works. It stores all packages and configuration files in /opt.

First, do unmount the drive

umount /tmp/harddisk/part0/

Now mount it to /opt

mount /tmp/harddisk/part0 /opt

Now you need to download ipkg on router, create a folder /opt/etc with a configuration file ipkg.conf, continue to create some more files, install uclibc-opt, add ipkg to $PATH and everything will work In order to automate this I created a shell script which runs and make this to work. The script has to be called from /opt. Let’s do it:

cd /opt

wget http://rt-n16.googlecode.com/files/ipkg_rt_n16.sh

chmod +x ipkg_rt_n16.sh

sh ./ipkg_rt_n16.sh

After you run this, the output will be something like this:

# sh ./ipkg_rt_n16.sh

=============================================================================

Shell script to set up ipkg on Asus RT-N16

Written by Volodymyr M. Shcherbyna, volodymyr@shcherbyna.com

Comments, questions? Post them to http://www.shcherbyna.com/?cat=24&lang=en

=============================================================================

Step 1: building directory structure …

Step 2: making folders writable …

Step 3: downloading config file for ipkg …

Connecting to rt-n16.googlecode.com (72.14.221.82:80)

ipkg.conf 100% |********************************************************************************************************************************| 156 –:–:– ETA

Step 4: downloading and configuring ipkg …

Connecting to rt-n16.googlecode.com (72.14.221.82:80)

ipkg 100% |********************************************************************************************************************************| 180k –:–:– ETA

Step 5: probing ipkg by issuing update…

Downloading http://ipkg.nslu2-linux.org/feeds/optware/oleg/cross/stable/Packages.gz

Inflating http://ipkg.nslu2-linux.org/feeds/optware/oleg/cross/stable/Packages.gz

Updated list of available packages in /opt/lib/ipkg/lists/optware

Downloading http://wl500g.googlecode.com/svn/ipkg/optware/Packages.gz

Inflating http://wl500g.googlecode.com/svn/ipkg/optware/Packages.gz

Updated list of available packages in /opt/lib/ipkg/lists/wl500g-optware

Successfully terminated.

Installing uclibc-opt (0.9.28-13) to /opt/…

Downloading http://ipkg.nslu2-linux.org/feeds/optware/oleg/cross/stable/uclibc-opt_0.9.28-13_mipsel.ipk

package uclibc-opt suggests installing ipkg-opt

Configuring uclibc-opt

Updating /opt/etc/ld.so.cache

Successfully terminated.

Step 6: setting ipkg to PATH variable …

Step 7: everything done, trying to update

Downloading http://ipkg.nslu2-linux.org/feeds/optware/oleg/cross/stable/Packages.gz

Inflating http://ipkg.nslu2-linux.org/feeds/optware/oleg/cross/stable/Packages.gz

Updated list of available packages in /opt/lib/ipkg/lists/optware

Downloading http://wl500g.googlecode.com/svn/ipkg/optware/Packages.gz

Inflating http://wl500g.googlecode.com/svn/ipkg/optware/Packages.gz

Updated list of available packages in /opt/lib/ipkg/lists/wl500g-optware

Successfully terminated.

That’s it! Now we need to add ipkg into $PATH, so that we would not need to call it /opt/bin/ipkg but just ipkg:

export PATH=$PATH:/opt/bin:/opt/sbin

Now we can try to install ssh server on router:

# ipkg install dropbear

Installing dropbear (0.52-5) to /opt/…

Downloading http://ipkg.nslu2-linux.org/feeds/optware/oleg/cross/stable/dropbear_0.52-5_mipsel.ipk

Installing psmisc (21.4-1) to /opt/…

Downloading http://ipkg.nslu2-linux.org/feeds/optware/oleg/cross/stable/psmisc_21.4-1_mipsel.ipk

Installing ncurses (5.7-1) to /opt/…

Downloading http://ipkg.nslu2-linux.org/feeds/optware/oleg/cross/stable/ncurses_5.7-1_mipsel.ipk

Configuring dropbear

Will output 1024 bit rsa secret key to ‘/opt/etc/dropbear/dropbear_rsa_host_key’

Generating key, this may take a while…

Public key portion is:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgnHrYkGZhdoywaH7l0FpiCdKHG//oPXy1VeNk7mN/5TjrNaf3m0F7QAIRI1LuoRaVfYNxcz47Y39YpxTc4894WZfq2AYWb8pxFoF7h96E4WEtDiAQ1Sj6IbDgAvJ35ymGYxPIhF2RV30Jq/L6UnvKdcmRyCQxtSnBkx5lO9v4EhuuUs= admin@RT-E0CB4E87B123

Fingerprint: md5 a9:d1:04:1a:57:c4:54:bc:8c:c1:05:78:c4:d7:3d:48

Will output 1024 bit dss secret key to ‘/opt/etc/dropbear/dropbear_dss_host_key’

Generating key, this may take a while…

Public key portion is:

ssh-dss AAAAB3NzaC1kc3MAAACBAKbc+V1lKJgHOQ2TQkbOmF/KzSEu6bq6SKzlQU+bq+GR8GLueBbCz09H9gkK1UijRDoEJBEtNHZerOx+HThiCjGr0Ej+0hWFFJ0zM2/G/MrXMjRX97+mZN/TB3vWXT+IcL7VO9btqoHPy3talXTZ9M1GIM+Lcsbdbq47jhQW1p33AAAAFQD5B+GhJHE6l8Do9W0saBn3nySAZwAAAIBhq9N2U3f8OPU0K0i+PwDARd4CQ3WxzJ5lAfZenZvXRgfu0A6Po72opszoKxz3AN85IDwVBVjmdAkY25UmYztI4oca/yToZ3IqhdRNU4yXW82oimBzdML2DB0udJfJAcur9G0XP7Lw7TyFl8a1X3p9UBLLaA8WXOoxGbrM1AOItAAAAIAytoysFr40uPqwhHvSRR4JSo6Kz8dHvB2nsRnOlwXoQTB9rIBqe+OoDPELlN3jGHikQpiLj23275Kyw6xic4PMD31vArMlZ9vjrtBTaFSDPn0G6w678ZV2kftBUuj2cUBZD2VjlScEzNwbfnY8TEWSjZbL+mm6w1BO4Uj3rpRW8A== admin@RT-E0CB4E87B123

Fingerprint: md5 5c:52:f4:91:57:6f:02:c6:27:85:7b:1f:59:61:08:a3

mkdir: cannot create directory ‘/root’: Read-only file system

/opt/etc/init.d/S51dropbear: line 11: pidof: not found

Configuring ncurses

Configuring psmisc

Successfully terminated.

And some text editor, vim or nano … I prefer vim:

# ipkg install vim

Installing vim (7.2-2) to /opt/…

Downloading http://ipkg.nslu2-linux.org/feeds/optware/oleg/cross/stable/vim_7.2-2_mipsel.ipk

Configuring vim

Successfully terminated.

You can test vim by typing vim in console. You can try to connect to your router via ssh, it should work. If you want to see how many packages are avialable via ipkg visit these urls: http://ipkg.nslu2-linux.org/feeds/optware/oleg/cross/stable and http://wl500g.googlecode.com/svn/ipkg/optware.

Have fun!

My wi-fi router (Dlink DI-524) worked very bad last time, especially under load – hangs, disappeared wi-fi network, etc … and I decided to buy a decent replacement:). A few days of review in the market and I bought quite cheap in my area RT-N16 which seduced me with the following parameters:

1. A powerful processor (533 MHz)

2. Rather big number of memory: ROM 32 Mb, RAM 128 Mb

3. Two USB ports for USB devices (printers, disks)

4. Open source Linux firmware (GPL) for 2.6 kernel!

5. Wi-fi N

I bought the router to solve two important tasks:

1. Host multipurpose devices on it (printer, scanner, fax)

2. Make it as a mini-server that would host the files, small projects, and in case of failure inside the network to provide a possibility to connect from WAN via ssh and solve the problem

However, what I received was able to solve only the problem number 1 … The latest official firmware 1.0.1.2 does not contain the ssh server, only telnet… Not very secure to connect from the outside via telnet. But this problem can be solved …

So, about the firmware. Out of the box it was 1.0.0.6 which seems to be ok at the begining, but on closer examination there were found the following bugs:

1. Even small internet activity makes router pings to grow from 1ms to 2000ms

2.  youtube does not work

3. skype does not work

I decided to upgrade to latest official firmware 1.0.1.2 and that was done. At the begining everything was just fine, but afterwards laptop stopped seeing wi-fi, though pc via ethernet was working .. I got desperate, I decided to install dd-wrt …

Installed dd-wrt. It looks OK, but USB support is lame. The thing is that the firmware from Asus makes USB relay for devices, this function is performed by so-called Asus tools – they intercept USB commands from Windows and send them to the router. The router sends them to the printer, as a result, Windows thinks that it is working with a local device. This means that you can install printer drivers with additional features and everything will work like a charm!

With dd-wrt it is much worse. There is primitive printing only supported ; and if you have a printer with scanner all-in-one, it just does not work … After playing with dd-wrt firmware I put back the Asus 1.0.1.2 and made nvram clearing (Factory reset). And as soon as I did Factory reset the router has become relatively stable and works without any problems.

Having a stable firmware I started to dig deeper to see if it is possible to install additional services on a router, and it turns out – you can! To do this you need to put the appropriate toolchain to compile something for mipsel and USB drive to copy files and run them on router … (but we will come back to this later).

After several days of use I found another annoying problem with the device. These Asus tools that provide work for USB devices in Windows eat 100% of CPU when printer is turned off, or for whatever reasons, the wi-fi network is not accessible. Can be fixed easily – always turn on the printer, but at home it is certainly not the best solution.

So, to summarize…

Given that Asus is attempting to simplify the interface of routers that they could be set up even by a housewifes, even a basic user will be disappointed because the default firmware sucks in terms of stability : it just does not work out of the box! Experienced users will be disappointed as-well, why not to provide ssh server on the router? Telnet sends non-encrypted data, and thus, unsecure … For advanced users there is little room for maneuver – it is possible to compile and run your custom tools, and this is very good, as it opens an opportunity to extend features of your router.

Sadly of course to realize that Asus top model by functionality is worse than the old non-top Di-524. In Dlink for port forwarding you can specify what days and time for the forward – very convenient, however in Asus this is not possible. Instead, ASUS has a buggy QOS that reduces the speed of the Internet and only reboot of router fix it:).

Not pleased with the work of DHCP server. It generates dynamic IPs for the same hosts, while previous Di-524 generated the same IPs, it was convenient to do port forwarding to the well-known hosts… In the RT-N16 you will have to add static assignment via MAC address.

Bug with Asus tools on the Windows machine is generally a disgrace. This is such a simple test case, and how it could pass through the Asus test labs?

I would rate hardware as 4 points out of 5, and software as 3 with minus. Why not giving 5 to the hardware? It seems like the router is a bit heating. Two USB ports in the butt to one another, not very comfortable, because distance between ports is very narrow and you would have to use thin devices …

But in general it is a good router:)