Re: [pfSense] Access Point Recommendations?

2015-07-24 Thread Mark Tinka
On 24/Jul/15 08:53, Seth Mos wrote: In a pinch I use the Linksys E2500 or EA2700 dual band wireless access points. Set a static IP, disable the DCHP server and connect the cable to the LAN ports. That's handy for connecting the Xbox in the living room. I mounted it behind the TV using one of

Re: [pfSense] Access Point Recommendations?

2015-07-24 Thread Dave Warren
On 2015-07-23 21:24, Adam Thompson wrote: On 2015-07-23 10:46 AM, Karl Fife wrote: Your point about having a one-off solution is a great one. Installing a single UniFi AP would be unnecessarily complex. The TP-Link TL-WA801nd is a BGN-only device. Do you (or anyone) have a preferred

Re: [pfSense] Access Point Recommendations?

2015-07-24 Thread Seth Mos
Karl Fife schreef op 23-7-2015 om 17:46: Your point about having a one-off solution is a great one. Installing a single UniFi AP would be unnecessarily complex. In a pinch I use the Linksys E2500 or EA2700 dual band wireless access points. Set a static IP, disable the DCHP server and connect

Re: [pfSense] Primer for AP/bridge setup? (based on Re: Access Point Recommendations?)

2015-07-24 Thread Steve Yates
Kenward Vaughan wrote on Fri, Jul 24 2015 at 10:00 am: We have a laser printer down the hall to which I attached an old home wifi router (don't recall the brand) making it accessible to people. Thought it would be nice to have this also bridge to the LAN Usually devices can be access

[pfSense] Primer for AP/bridge setup? (based on Re: Access Point Recommendations?)

2015-07-24 Thread Kenward Vaughan
Hello, At my school I own a small LAN with a VPN to the outside world, and use pfSense to control that part of things with a regular HP 2530 switch internally. I'd like to be able to have students/professors access the LAN outside of the boxes themselves, so getting an AP seems like an

[pfSense] How do I harden my pfsense install WRT TLS and ssh?

2015-07-24 Thread Ted Byers
I have checked our installation of our website (a classic protected LAN with a DMZ formed by two pfsense machines serving as our inner and outer firewall, and one machine in the DMZ and the rest behind the inner firewall) using a PCI scanner. The PCI scan identified two vulnerabilities WRT our

Re: [pfSense] How do I harden my pfsense install WRT TLS and ssh?

2015-07-24 Thread Adam Thompson
I'm 95% sure the answer is wait for the developers to fix those issues and/or become a developer and fix those issues :-). Configuration of lighttpd is controlled by the pfSense management framework, so once you discover the correct invocation, you could locally modify the PHP file that

Re: [pfSense] How do I harden my pfsense install WRT TLS and ssh?

2015-07-24 Thread Steve Yates
Ted Byers wrote on Fri, Jul 24 2015 at 3:51 pm: First, the scanner complains that TLS1 is supported and we need to restrict it to TLS1.2. Second, it appears that ssh-server on pfsense is version 6.6 Is this an internal scan or external? Hopefully those aren't exposed externally.

Re: [pfSense] Primer for AP/bridge setup? (based on Re: Access Point Recommendations?)

2015-07-24 Thread Steve Yates
Kenward Vaughan wrote on Fri, Jul 24 2015 at 11:00 am: I currently use the older router wired to the laserjet because I expected it to have more range, and honestly haven't tried setting up a printer's wifi connection before. So it is a standalone system right now. Would that printer work

Re: [pfSense] Access Point Recommendations?

2015-07-24 Thread Dave Warren
On 2015-07-24 10:15, Adam Thompson wrote: To clarify, I have an EAP-600, which is a pure access point, not a router at all. It only has one LAN port, grand total. There is *no* universe where it makes sense for an access point to run a DNS server/forwarder/whatever. I have the EAP900H,

Re: [pfSense] How do I harden my pfsense install WRT TLS and ssh?

2015-07-24 Thread Yehuda Katz
If you are forwarding the ports to other machines, it is those machines which need and update, not pfSense. This is the test: get out your ssh client of choice and connect to the port from outside. If you get something that is not pfSense, then upgrading ssh on your firewall isn't going to help.

Re: [pfSense] How do I harden my pfsense install WRT TLS and ssh?

2015-07-24 Thread Ted Byers
Thanks for this. I'd hoped it would be as simple as apt-get-update apt-get upgrade apt-get update openssh-server. That is,whatever the equivalent of apt-get is on a pfsense machine, I'd hoped it would be a command invoked from ssh to ask the system to check for updates and apply any found.

Re: [pfSense] How do I harden my pfsense install WRT TLS and ssh?

2015-07-24 Thread Ted Byers
This is an external scan. We forward ports such as 443 and 22 to specific Ubuntu machines. But both sshd and apache have been configured to accept only TLS1.2 Port 443 must be open to support the web server in our DMZ, and we need ssh to connect to each machine for administration purposes. (if

Re: [pfSense] How do I harden my pfsense install WRT TLS and ssh?

2015-07-24 Thread Ted Byers
Thanks. I will do this this evening. Thanks ted On Fri, Jul 24, 2015 at 6:18 PM, David Burgess apt@gmail.com wrote: On Fri, Jul 24, 2015 at 4:14 PM, Ted Byers r.ted.by...@gmail.com wrote: Thanks for this. I'd hoped it would be as simple as apt-get-update apt-get upgrade apt-get

Re: [pfSense] How do I harden my pfsense install WRT TLS and ssh?

2015-07-24 Thread Ted Byers
We have version 2.2.2. What is the easiest way to upgrade on eminor versiion? On Ubuntu, I'd use 'apr-get update' and/or 'apt-get upgrade', or one of the variants thereof. But, if I understand correctly, pfsense is built on freeBSD, about which I know nothing. Thanks Ted On Fri, Jul 24, 2015

Re: [pfSense] How do I harden my pfsense install WRT TLS and ssh?

2015-07-24 Thread David Burgess
On Fri, Jul 24, 2015 at 4:14 PM, Ted Byers r.ted.by...@gmail.com wrote: Thanks for this. I'd hoped it would be as simple as apt-get-update apt-get upgrade apt-get update openssh-server. That is,whatever the equivalent of apt-get is on a pfsense machine, I'd hoped it would be a command

Re: [pfSense] How do I harden my pfsense install WRT TLS and ssh?

2015-07-24 Thread Chris Buechler
On Fri, Jul 24, 2015 at 3:51 PM, Ted Byers r.ted.by...@gmail.com wrote: I have checked our installation of our website (a classic protected LAN with a DMZ formed by two pfsense machines serving as our inner and outer firewall, and one machine in the DMZ and the rest behind the inner firewall)

Re: [pfSense] How do I harden my pfsense install WRT TLS and ssh?

2015-07-24 Thread Ted Byers
On Fri, Jul 24, 2015 at 6:29 PM, Chris Buechler c...@pfsense.com wrote: On Fri, Jul 24, 2015 at 5:20 PM, Ted Byers r.ted.by...@gmail.com wrote: This is an external scan. We forward ports such as 443 and 22 to specific Ubuntu machines. But both sshd and apache have been configured to

Re: [pfSense] How do I harden my pfsense install WRT TLS and ssh?

2015-07-24 Thread Ryan Coleman
On Jul 24, 2015, at 7:18 PM, Ted Byers r.ted.by...@gmail.com wrote: On Fri, Jul 24, 2015 at 6:29 PM, Chris Buechler c...@pfsense.com wrote: On Fri, Jul 24, 2015 at 5:20 PM, Ted Byers r.ted.by...@gmail.com wrote: This is an external scan. We forward ports such as 443 and 22 to specific