Re: Olsr-users Digest, Vol 28, Issue 20

> - Do we have any AAA mechansim
[...]
> - I checked the scure plugin which is using MD5.

I think you're confused.  Securing routing traffic has nothing to do
with user authentication.

> Can I know that for what purpose we can use the existing secure
> plugin.

It is designed to guarantee authenticity and integrity of routing
traffic.  However, it is mostly a proof of concept, since it only
supports shared key authentication using MD5.  (I'm also not sure
whether it correctly protects from replayed messages.)

I hope it is clear to you that merely authentifying routing traffic is
not enough to provide secure communications (think ARP, DNS or whatever),
and that in any case this has nothing to do with user-level authentication.

> - We have started working for some defence project for MANET

I suggest that you employ a competent security consultant, then.

                                        Juliusz

--

-- 
Olsr-users mailing list
Olsr-users <at> lists.olsr.org
http://lists.olsr.org/mailman/listinfo/olsr-users

Re: Olsr-users Digest, Vol 28, Issue 20

Am Freitag 30 Oktober 2009 05:34:09 schrieb kumar.vijai <at> wipro.com:
> Hi Henning/Markus,
> 
> - Do we have any AAA mechansim in OLSR 6 release or planning to include?
There will be a 0.6.0 release of OLSR, but it will contain no AAA. This is out 
of scope for the routing daemon I think.

> - I checked the scure plugin which is using MD5. Can I know that for
> what purpose we can use the existing secure plugin.
The secure plugin does a authentification based on a shared group secret for 
the routing messages.

> - We have started working for some defence project for MANET so I would
> like to get help that what are the existing olsr plugin and features we
> can use for the project and what added features could be easy to
> implement with olsr 6 release.
It depends what kind of security do you need. Do you just have to keep out 
attackers which do NOT get a copy of your crypto keys ? Then just encrypt 
everything on link-layer with a common group key.

Do you want to have security even against attackers who are already inside 
your network (for example who have stolen a device) ? Then you need some 
additional stuff like authenticated routing messages (not the secure plugin, 
because it's based on a shared GROUP secret), IPsec and some other mechanisms.

Henning Rogge

--

-- 
Olsr-users mailing list

olsrd question

--

-- 
Olsr-users mailing list
Olsr-users <at> lists.olsr.org
http://lists.olsr.org/mailman/listinfo/olsr-users

Authentication, Authorization and Accouting in OLSR (AAA)

Thanks Henning for comments........

I have one more question.... Suppose a particular node is in network and
discovered the neighbors using OLSR TC and hello messages. 
Now without using the crypto keys any node cannot get the message or
data correctly.. Am I right?

Then If we use X-supplicant (open source which use EAP massages over
Ethernet or radius) and/or Radius (open source) then the user can be
authenticated and registered before starting communication using TLS
certificates. We used this TLS (Transport Layer Security) mechanism in
mobile IP. Is it fesiable with OLSR?

Regards
vijai

-----Original Message-----
From: Henning Rogge [mailto:hrogge <at> googlemail.com] 
Sent: Monday, November 02, 2009 3:01 PM
To: olsr-users <at> lists.olsr.org
Cc: Vijai Kumar (WT01 - Joint CEO Office)
Subject: Re: [Olsr-users] Olsr-users Digest, Vol 28, Issue 20

Am Freitag 30 Oktober 2009 05:34:09 schrieb kumar.vijai <at> wipro.com:
> Hi Henning/Markus,
> 
> - Do we have any AAA mechansim in OLSR 6 release or planning to
include?
There will be a 0.6.0 release of OLSR, but it will contain no AAA. This
is out of scope for the routing daemon I think.

> - I checked the scure plugin which is using MD5. Can I know that for 
> what purpose we can use the existing secure plugin.
The secure plugin does a authentification based on a shared group secret
for the routing messages.

> - We have started working for some defence project for MANET so I 
> would like to get help that what are the existing olsr plugin and 
> features we can use for the project and what added features could be 
> easy to implement with olsr 6 release.
It depends what kind of security do you need. Do you just have to keep
out attackers which do NOT get a copy of your crypto keys ? Then just
encrypt everything on link-layer with a common group key.

Do you want to have security even against attackers who are already
inside your network (for example who have stolen a device) ? Then you
need some additional stuff like authenticated routing messages (not the
secure plugin, because it's based on a shared GROUP secret), IPsec and
some other mechanisms.

Henning Rogge

Please do not print this email unless it is absolutely necessary. 

The information contained in this electronic message and any attachments to this message are intended for
the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged
information. If you are not the intended recipient, you should not disseminate, distribute or copy this
e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. 

WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any
attachments for the presence of viruses. The company accepts no liability for any damage caused by any
virus transmitted by this email. 

www.wipro.com

--

-- 
Olsr-users mailing list
Olsr-users <at> lists.olsr.org
http://lists.olsr.org/mailman/listinfo/olsr-users

Re: olsrd question

Am Dienstag 03 November 2009 01:42:42 schrieb josef amarra:
> Hello!
> Anyone here who is willing to answer a few questions about implementing
>  olsrd?
olsrd is an OLSR implementation.

>  It's inappropriate to ask it directly to the mailing list so if
>  anyone will be generous enough to spare a few minutes for me that would be
>  great :) my email is Josef_amarra <at> yahoo.com
I think it's always better to ask a question then to ask if you may ask a 
question. ;)

Henning

--

-- 
Olsr-users mailing list
Olsr-users <at> lists.olsr.org
http://lists.olsr.org/mailman/listinfo/olsr-users

Re: Authentication, Authorization and Accouting in OLSR (AAA)

Am Dienstag 03 November 2009 04:26:40 schrieb kumar.vijai <at> wipro.com:
> Thanks Henning for comments........
> 
> I have one more question.... Suppose a particular node is in network and
> discovered the neighbors using OLSR TC and hello messages.
> Now without using the crypto keys any node cannot get the message or
> data correctly.. Am I right?
> 
> Then If we use X-supplicant (open source which use EAP massages over
> Ethernet or radius) and/or Radius (open source) then the user can be
> authenticated and registered before starting communication using TLS
> certificates. We used this TLS (Transport Layer Security) mechanism in
> mobile IP. Is it fesiable with OLSR?
The problem with "authenticated OLSR" is that OLSR is a mesh of nodes where 
each node forwards/floods protocol messages for all other nodes. Because of 
this it's trivial to fake a protocol message originator.

All OLSR messages are flooded, so they are 1-to-many transmissions, which are 
difficult to encrypt and timeconsuming to authenticate.

In Vienna (as an example) we get hundreds of OLSR messages per second on each 
node, so signing each of them with a small RSA key would overload our 
hardware.

Henning Rogge

--

-- 
Olsr-users mailing list
Olsr-users <at> lists.olsr.org
http://lists.olsr.org/mailman/listinfo/olsr-users

Re: question

On Wed November 4 2009 13:58:15 josef amarra:
> sir sorry  to bother you but i am really pissed at myself for not
> understanding olsrd. i have set up olsrd in my linux terminal and when
> im trying to "make" the main project it cannot locate the olsrd.conf
> but from what I read in the documents, the olsrd.conf is available at
> /etc/olsrd.conf however, the package i downloaded (olsrd-0.5.6-r6)
> does not have that folder or even the file. thank you sir.
At first you should check if you unpacked the complete archive into your 
directory. Maybe you missed the /files folder, thats where olsrd stores some 
examples for config files.

I would like to see a copy of the error message from your console and some of 
the context around it (plus the command you used to trigger make).

Henning Rogge

--
Diplom-Informatiker Henning Rogge , Fraunhofer-Institut für
Kommunikation, Informationsverarbeitung und Ergonomie FKIE
Kommunikationssysteme (KOM)
Neuenahrer Straße 20, 53343 Wachtberg, Germany
Telefon +49 228 9435-263,   Fax +49 228 9435 685
mailto:henning.rogge <at> fkie.fraunhofer.de http://www.fkie.fraunhofer.de
GPG: E1C6 0914 490B 3909 D944 F80D 4487 C67C 55EC CFE0

--

-- 
Olsr-users mailing list
Olsr-users <at> lists.olsr.org
http://lists.olsr.org/mailman/listinfo/olsr-users

olsrd problem

--

-- 
Olsr-users mailing list
Olsr-users <at> lists.olsr.org
http://lists.olsr.org/mailman/listinfo/olsr-users

Re: olsrd problem

On Wed November 4 2009 14:31:04 josef amarra wrote:
> i found it already! i got the "olsrd.conf.default.lq" and renamed it to
> olsrd.conf then i created a folder in the main folder named "etc" then
> placed the file there. runs okay but then i ran the olsrd it said
> something like this:
> Checking wlan0:
>     wireless interface detected
>     could not get address of interface - skipping it
> Checking ath0:
>     No such interface!
> 
> what does this mean?
You have to edit the sample files. At least you have to put in your interface 
names (we cannot know them ^^).

Henning Rogge

--
Diplom-Informatiker Henning Rogge , Fraunhofer-Institut für
Kommunikation, Informationsverarbeitung und Ergonomie FKIE
Kommunikationssysteme (KOM)
Neuenahrer Straße 20, 53343 Wachtberg, Germany
Telefon +49 228 9435-263,   Fax +49 228 9435 685
mailto:henning.rogge <at> fkie.fraunhofer.de http://www.fkie.fraunhofer.de
GPG: E1C6 0914 490B 3909 D944 F80D 4487 C67C 55EC CFE0

--

-- 
Olsr-users mailing list
Olsr-users <at> lists.olsr.org
http://lists.olsr.org/mailman/listinfo/olsr-users

Re: [B.A.T.M.A.N.] A peer-reviewed assessment of OLSR, BATMAN and Babel

On Sun, Nov 08, 2009 at 12:35:39AM +0100, L. Aaron Kaplan wrote:
> I would have liked to see a comparison with OLSR.org default settings  
> (ETX metric) instead of
> hopcount metric. As Henning already pointed out, hop count metric is  
> not useful at all and was long abandoned.
> 
> Nobody in our freifunk/funkfeuer networks actually uses hopcount and  
> therefore we could achieved mesh sizes of 1000+ nodes *in practice*  
> with OLSR.

Maybe we should change our defaults to be the optimum then? Or make
it very obvious which config file to use and which not to use.
Maybe olsrd.conf.default.rfc should be removed or renamed to
something that make it obvious that it should not be used, for
instance olsrd.conf.default.rfc-unused, olsrd.conf.default.rfc-old,
olsrd.conf.default.rfc-dead.

John
-- 
John Hay -- jhay <at> meraka.csir.co.za / jhay <at> FreeBSD.org

--

-- 
Olsr-users mailing list
Olsr-users <at> lists.olsr.org
http://lists.olsr.org/mailman/listinfo/olsr-users