Digital Man has implemented this in Synchronet/BinkIT and after the small amount of testing I have done I think binkps is a reality for Synchronet sysops. It's just a quick and easy setup in Synchronet and as far as I can tell it's all ready for action for those Synchronet sysops.
--- ENiGMA 1/2 v0.0.11-beta (linux; x64; 12.13.1)NuSkooler
Xibalba BBS @ xibalba.l33t.codes / 44510(telnet) 44511(ssh)
ENiGMA 1/2 BBS WHQ | Phenom | 67 | iMPURE | ACiDic
How did this finally get implemented? ENiG doesn't provide Bink
directly but relies on an external tool such as binkd, but if it's
just TLS that should be pretty easy to proxy. I'd love to have my FTN packets secured :)
How did this finally get implemented?
ENiG doesn't provide Bink directly but relies on an external tool such
as binkd, but if it's just TLS that should be pretty easy to proxy.
I'd love to have my FTN packets secured :)
DM added these features and gave deuce credit for making the TLS support for Synchronet services and JS modules easy.
Is ENiG written for/with node.js? Hmm.. :)
I think that is the way we should do things and I'm hoping other deveolpers either are or will be on board and help make it easy for nodes to do this.
--- ENiGMA 1/2 v0.0.11-beta (linux; x64; 12.13.1)NuSkooler
Xibalba BBS @ xibalba.l33t.codes / 44510(telnet) 44511(ssh)
ENiGMA 1/2 BBS WHQ | Phenom | 67 | iMPURE | ACiDic
DM added these features and gave deuce credit for making the TLS
support for Synchronet services and JS modules easy.
Sorry, I mean what is the technical implementation? Is it simply bink
over TLS where a proxy can work?
Is ENiG written for/with node.js? Hmm.. :)
Yes, but I don't currently have plans to write a bink client/server,
or at least it's down low on the list behind other features.
I think that is the way we should do things and I'm hoping other
deveolpers either are or will be on board and help make it easy
for nodes to do this.
+1!
There has been a fair bit of talk lately about binkps.
I see some are using proxy's and/or stunnel to do this also with binkd although I have been looking at that it's a bit more involved with
binkd. I'm just about to get my hands in there and see if I can make a
go of it.
Let me know if you'd like to do this between our nodes and we can do some testing.
There has been a fair bit of talk lately about binkps.
I have been trying (and failing) to keep up with this thread over
multiple echos..
Let me know if you'd like to do this between our nodes and we can
do some testing.
I am keen Al but let me have a few days before we test stuff out. I
think the idea of securing comms between nodes using this sort of
stuff is a good thing also.
like self signed certs are going to be frowned upon. I have a cert from
like self signed certs are going to be frowned upon. I have a
cert from
I run TLS on my systems ~ no certs needed. Certs in today's age is
well you know...
No hurries at all. I am happy enough that at the moment a number of
folks more technical than myself are busy at these details and I'll just wait while it all settles.
It looks at the moment that the default port for binkps is 24553 and
also looks like self signed certs are going to be frowned upon. I have a cert from letsencrypt for trmb.ca but need to figure out how to use it.
I run TLS on my systems ~ no certs needed. Certs in today's age is well you know... Ozz
--- ENiGMA 1/2 v0.0.11-beta (linux; x64; 12.13.1)NuSkooler
Xibalba BBS @ xibalba.l33t.codes / 44510(telnet) 44511(ssh)
ENiGMA 1/2 BBS WHQ | Phenom | 67 | iMPURE | ACiDic
DM added these features and gave deuce credit for making the
TLS support for Synchronet services and JS modules easy.
Sorry, I mean what is the technical implementation? Is it simply bink
over TLS where a proxy can work?
It looks at the moment that the default port for binkps is 24553 and
also looks like self signed certs are going to be frowned upon. I
have a cert from letsencrypt for trmb.ca but need to figure out how
to use it.
It looks at the moment that the default port for binkps is 24553
and also looks like self signed certs are going to be frowned
upon. I have a cert from letsencrypt for trmb.ca but need to
figure out how to use it.
IMHO there is nothing wrong with using self-signed certs for binkps.
Hi Ozz
Just a heads up that I still see some errors when you're polling in and connecting with BinkD as 1/144
Here's the last part of a recent log that shows the error
[snip]
+ 23 Dec 20:50:07 [18288] sending 006ff519.mo0 as 006ff519.mo0 (2651)
+ 23 Dec 20:50:07 [18288] sending c:\mystfsx\echomail\out\fidonet\00715f00.mo0 as 00715f00.mo0 (1827)
? 23 Dec 20:50:08 [18288] rerror: ERR: Command or Block > 32k received, aborting.
+ 23 Dec 20:50:08 [18288] done (from 21:1/144@fsxnet, failed, S/R: 2/0 (9107/0 bytes))
[snip]
so it looks like some sent fine but an error remains with something you were sending the HUB. I think.. :)
Hi Ozz
Just posting some NET 1 logging of your inbound polling and what BinkD is reporting. It looks like there are two polls to the HUB made at almost the exact same time. One fails as no AKA are available and the other with a different error. See below for info.
Not sure why the need to poll twice at the same time? Perhaps stopping that will help resolve issues?
like self signed certs are going to be frowned upon. I have a
cert from
I run TLS on my systems ~ no certs needed. Certs in today's age is
well you know...
How do you use TLS without a certificate? o.O
I have built systems ~ using built-in TLS authentication and
encryption for over a decade now. None of those systems have been breached. As the last post implies - you have encryptioon, but
since it is on-the-fly negotiation you only have authentication
based upon Node, IP, Session-PW. If you just read (a now web
oriented) step by step of how to implement OpenSSL's TLS asClient
and asServer, the examples out there will show you - set cipher,
and no PEM files, and viola - TLS authenticated encryption.
I think you are reading that backwards...as far as sending. The error
I will double check my frame builder routine - and may add a separate
log just so I can make sure I never exceed the 32kb limit in my calculation(s).
Thanks for looking though!
Per my email a couple days ago - I found I had a /etc/crontab and a crontab -e ... both files doing the same job about 8 seconds apart. And then about week ago, arcron (whatever that is) just started launching crontab jobs ever second, until I actually had 300 concurrent polls go out to all of my uplinks. Killed it all down, and about 5 to 6 hours
ago, I relaunched crond. Once I verified that I do not have duplicate crontab files ... and I also changes the script they call to touch "polling", and remove polling upon complete... first line says if -f fileexists then exit 0. So should be impossible to have that runaway situation again ;-)
Equinox BBS
1:153/757.2 or 21:4/106.1
equinoxbbs.ddns.net binkp on 24554 and binkps on
24555
If you have a node we can test against I'll be happy
to do that. I'd just need your node #, hostname and
port.
It's important that these different implementations
can talk to each other.
It's important that these different implementations
can talk to each other.
unfortunately openssl s_client does not connect to binkit
sucessfully. has someone already filed a bug report?
unfortunately openssl s_client does not connect to binkit sucessfully. has someone already filed a bug report?
unfortunately openssl s_client does not connect to binkit
sucessfully. has someone already filed a bug report?
What do you mean?
I connected with "openssl s_client -showcerts -status -state -host equinoxbbs.ddns.net -port 24555" and I see the BINKP initialisation stuff...
Do you have a binkd you can try with? Either..
It's important that these different implementations
can talk to each other.
unfortunately openssl s_client does not connect to binkit
sucessfully. has someone already filed a bug report?
This has been rolling around in my head. I can't poll 153/757.2
(binkit) from 153/757 (binkd) but Tommi did, we exchanged netmail. I'm going to ask Tommi if he has any details around that and pass them to
DM but I want to double check that first.
unfortunately openssl s_client does not connect to binkit
sucessfully. has someone already filed a bug report?
What do you mean?
I connected with "openssl s_client -showcerts -status -state -host equinoxbbs.ddns.net -port 24555" and I see the BINKP initialisation stuff...
...deon
This has been rolling around in my head. I can't poll
153/757.2 (binkit) from 153/757 (binkd) but Tommi did, we
exchanged netmail. I'm going to ask Tommi if he has any
details around that and pass them to DM but I want to double
check that first.
Maybe we use different openssl versions? My guess is that newer
openssl don't allow some older SSL / TLS options.
Which openssl version do you have? Mine is
Maybe we use different openssl versions? My guess is
that newer openssl don't allow some older SSL / TLS
options.
That could be it. I'll have to ask him. I checked my
openssl version where sysnchronet lives on Slackware
14.2 and it says 1.0.2t, the same date as yours but a
different version, but it was just updated recently.
I don't think openssl comes into the picture in that
case though, I think it is cryptlib that takes care
of TLS in Synchronet/BinkIT.
Re: binkps
By: Oli to Alterego on Sun Dec 29 2019 11:01 am
Which openssl version do you have? Mine is
[deon@d-1-1 ~]$ openssl version
OpenSSL 1.0.2k-fips 26 Jan 2017
| Sysop: | sneaky |
|---|---|
| Location: | Ashburton,NZ |
| Users: | 31 |
| Nodes: | 8 (0 / 8) |
| Uptime: | 190:57:47 |
| Calls: | 2,082 |
| Calls today: | 5 |
| Files: | 11,137 |
| Messages: | 947,706 |