LuCI: Securing against brute-force attacks

Talk about Documentation
1

Hello,

I've added something to my setup that might be beneficial to others, so I figured I'd share it.

When using the Securing against brute-force attacks from the documentation, I always hate that I have to start luci/uhttpd and stop it on exit. I sometimes forget to do that and lately discovered them all running.

To combat my forgetfulness I wrote a small script to start luci/uhttpd automatically when I go in over SSH and stop it on exit.

/root/.profile

if [ -n "$SSH_CONNECTION" ]
then
trap "/etc/init.d/uhttpd stop" EXIT
/etc/init.d/uhttpd start
fi

The test I use to see if luci/uhttpd is really stopped when logged out:

ssh -L127.0.0.1:8000:127.0.0.1:80 root@openwrt.lan "service uhttpd status"

will return inactive indicating the service is not running.

EDIT:
I also added /root/.profile to /etc/sysupgrade.conf so its kept after an upgrade.

2

You are describing something that I assume you interpreted from the section of the Wiki you linked called "Kill LuCI service". It says that:

For additional security, you may disable the uHTTPd webserver altogether and start it via SSH only when needed.

  • I disagree it's required
  • I also disagree it provides additional security
    • It's configured to only be accessible by localhost, so if an attacker can access that, they can enable it again just like you
  • There are other options, e.g., firewalling ports 80/TCP and 443/TCP LAN like on WAN, using scripts to enable/disable those, allowing only the MAC of your management device, etc.

Cool script, and good for this purpose, you should add it to the Wiki.

4

U.S. government systems can remain vulnerable because of outdated legacy technology and bureaucratic inefficiencies that delay modernization. However, that does not mean AI can automatically break into OpenWrt LuCI or SSH.

Anthropic’s Glasswing project provided early access to the Linux Foundation, enabling vulnerabilities to be identified and fixed proactively.

Government bureaucracy = full of crap

5

I agree its a bit overkill. Somehow keeping it running felt wrong, but thats just me.

The -L127.0.0.1:8000:127.0.0.1:80 flag was a bit long and after some experimenting it seems that -L8000:0:80 has the same result. But I'm unsure if it does something else. Logically 0 might be 0.0.0.0 which would be any interface iirc, but my knowledge on SSH is little at best.