<div dir="ltr"><div><span class="gmail_default" style="font-family:arial,helvetica,sans-serif">Mikel,</span><br clear="all"></div><div><span class="gmail_default" style="font-family:arial,helvetica,sans-serif"><br></span></div><div><span class="gmail_default" style="font-family:arial,helvetica,sans-serif">Can you explain the reason for having bidirectional node connections?</span><span style="font-family:arial,helvetica,sans-serif"> I do not run my node that way here and never have.</span></div><div><span style="font-family:arial,helvetica,sans-serif"><br></span></div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">T<span class="gmail_default" style="font-family:arial,helvetica,sans-serif">hanks!</span></div><div dir="ltr"><br></div><div dir="ltr"> <br><b>Regards,<br><br>Anthony </b><div><b> N2KI</b><br><br><br><br><br><br><br><br></div></div></div></div><br></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Tue, Mar 4, 2025 at 6:33 AM Mikel EA2CW via Dxspider-support <<a href="mailto:dxspider-support@tobit.co.uk">dxspider-support@tobit.co.uk</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Good morning all,<br>
<br>
I share your concernings about how information is sometimes too spreaded <br>
along the list, and after seeing this last weekends situation, I've <br>
tried to resume the measures which sysops can adopt to minimise the <br>
impact of attacks.<br>
<br>
To avoid the CR\LR cuts of some lines, I'll to attach the original text <br>
file too.<br>
<br>
Here they are. If there is something wrong or not clear enough, please <br>
correct me.<br>
<br>
73, Mikel<br>
<br>
==============================================================================<br>
<br>
MINIMUM SECURITY MEASURES TO MINIMIZE ATTACKS TO THE DX CLUSTER NETWORK<br>
<br>
First of all, be conscious that these all measures don't depend on the <br>
software developers nor the users, but only on the nodes sysops.<br>
It is mainly our responsability to keep the cluster network safe.<br>
<br>
==============================================================================<br>
NOTES:<br>
- The "$" shown at the beginning of the command lines is not to be <br>
included, but just an indication of being logged as sysop and at the <br>
command prompt of your computer<br>
- When some text is enclosed between "<" ">", they don't have to be <br>
included. It is just to say that some info must be typed.<br>
f.i., if you see <callsign>, a callsign (without < >) must be <br>
typed. It must include the -SSID in case, f.i.: EA2XX-23<br>
<br>
==============================================================================<br>
MEASURES NEEDED: JUST FOUR!<br>
==============================================================================<br>
1.- KEEP YOUR CLUSTER SOFTWARE UPDATED.<br>
If new solutions to enforce security are implemented on the new node <br>
software versions, only after updating it they can be enabled.<br>
<br>
Procedure:<br>
* Download <a href="http://check_build.pl" rel="noreferrer" target="_blank">check_build.pl</a> , from your command prompt and as sysop user:<br>
$ wget -q <br>
<a href="https://raw.githubusercontent.com/EA3CV/dxspider_info/main/check_build.pl" rel="noreferrer" target="_blank">https://raw.githubusercontent.com/EA3CV/dxspider_info/main/check_build.pl</a><br>
<br>
* Move the file to your /spider/local_cmd/ directory:<br>
$ mv <a href="http://check_build.pl" rel="noreferrer" target="_blank">check_build.pl</a> /spider/local_cmd/<br>
<br>
* Add to /spider/local_cmd/crontab file the following line to check for <br>
new versions at least once per day, except weekends (don't change <br>
version during contests):<br>
sysop@spider:~$ nano /spider/local_cmd/crontab<br>
<br>
* Include the following line, changing days and/or hours. The following <br>
one will check for updates from Mon to Fri at 03:18 UTC:<br>
18 03 * * 1,2,3,4,5 spawn('cd /spider/local_cmd; wget -q <br>
<a href="https://raw.githubusercontent.com/EA3CV/dxspider_info/main/check_build.pl" rel="noreferrer" target="_blank">https://raw.githubusercontent.com/EA3CV/dxspider_info/main/check_build.pl</a> <br>
-O /spider/local_cmd/<a href="http://check_build.pl" rel="noreferrer" target="_blank">check_build.pl</a>')<br>
<br>
(You can use <a href="https://crontab.guru/" rel="noreferrer" target="_blank">https://crontab.guru/</a> to check your crontab syntax, <br>
but be aware that dxspider crontab file doesn't follow exactly linux <br>
cron rules) <br>
<br>
==============================================================================<br>
2.- CONNECT TO NO MORE THAN 4-6 NODES AND SECURE THESE CONNECTIONS WITH <br>
PASSWORDS.<br>
All the spots are forwarded to all the nodes in the network. There is <br>
no need to have each single spot being received from 30 nodes, and then <br>
forwarded again by your node to all your partners. This only causes <br>
unnecessary traffic overload. 4 to 6 partner connections are far enough <br>
to avoid network problems, giving redundancy enough.<br>
On the other hand, a large number of partner nodes could be difficult <br>
to be mantained on good shape. If some of partners stop working, change <br>
their configurations, etc., the connections will become erroneous, and <br>
it could also constitute a hole for hackers to come into your system.<br>
<br>
Procedure:<br>
* Agree a password with your partner node sysop. It can be the same <br>
on both senses (your partner connecting you or you connecting your partner<br>
<br>
* At the spider console type: (don't include the symbols < and > on <br>
the commands or lines)<br>
set/register <partner_call><br>
set/spider <partner_call><br>
set/password <partner_call> <password><br>
<br>
* Then, edit the /spider/connects/<partner_call> (include the -SSID if <br>
it exist) file:<br>
$ sudo nano /spider/connects/<partner_call><br>
<br>
* Add the following line after the 'ogin:' '<your_node_call>' line:<br>
'word:' '<here_your_password>' # send your password while <br>
connecting to your partner<br>
<br>
==============================================================================<br>
3.- DON'T LINK AS PARTNERS TO NODES WHICH:<br>
- Are running outdated or deadware (not updated regularly or deprecated).<br>
- Allow sending spots to all their users without identifying themselves.<br>
- Are running software versions that doesn't inform of users <br>
connections and disconnections, deadware or with connections to insecure <br>
3rd part nodes.<br>
- have connections to other partners with no or poor security policies. <br>
That is, your connection is secured, but your partner connects other <br>
nodes on an insecure way.<br>
<br>
==============================================================================<br>
4.- ALLOW SPOTTING FROM YOUR NODE *ONLY* TO REGISTERED USERS.<br>
(optionally and better, also ask them for a password to authenticate.)<br>
<br>
Procedure:<br>
* Edit your /spider/scripts/startup file:<br>
$ nano /spider/scripts/startup<br>
<br>
* Include the following lines on your /spider/scripts/startup file:<br>
set/var $main::reqreg = 1 # allow sending spots to <br>
registered users only.<br>
set/var $main::passwdreq = 0 # 0: no password required just for <br>
receive spots, required for send spots , 1: password required also for <br>
login.<br>
<br>
* Then you can register the users from the dxspider console with the <br>
command:<br>
set/register <callsign><br>
<br>
* If you also want to assign a password to the registered user type, <br>
again from dxspider console:<br>
set/password <callsign> <password> <br>
<br>
* NOTICE: Dont use "set/pass", type the full command "set/password" !!!<br>
<br>
* Then, you must send this password to the user by means of e-mail, <br>
whatsapp, telegram, signal or any other more-or-less private way...<br>
<br>
<br>
<br>
-- <br>
73 de Mikel Berrocal EA2CW-AE2CW<br>
Bilbao, Basque Country<br>
<a href="mailto:ea2cw@gautxori.com" target="_blank">ea2cw@gautxori.com</a><br>
<a href="https://www.ea2cw.eus" rel="noreferrer" target="_blank">https://www.ea2cw.eus</a><br>
_______________________________________________<br>
Dxspider-support mailing list<br>
<a href="mailto:Dxspider-support@tobit.co.uk" target="_blank">Dxspider-support@tobit.co.uk</a><br>
<a href="https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support" rel="noreferrer" target="_blank">https://mailman.tobit.co.uk/mailman/listinfo/dxspider-support</a><br>
</blockquote></div>