Project Turris. Open router with OpenWrt. Bedřich Košata

Transcription

1 Project Turris Open router with OpenWrt Bedřich Košata

2 Who we are and what we do CZ.NIC is the operator of.cz TLD domain Not-for-profit oranization Projects for the good of the Internet BIRD routing daemon, Knot DNS server DNSSEC plugins for browsers, security research and much more... We run the Czech national CSIRT team Everything we do is open-source

3 What is project Turris Security research in SOHO networks distributed anomaly detection distributed measurements centralized security management Router as a security probe and protection Introduce new technologies to SOHO networks DNSSEC, better IPv6 OpenWrt + custom hardware

4 Current status Started in routers given to volunteers for free in more now in process of distribution Highlights 10 large automatic updates, including major OpenWrt version malware in LAN caught in >20 cases botnet of more than 20,000 ASUS routers found

5 Output public global statistics IPv4/IPv6, most attacked port, attacking countries,... more stats available to individual users greylist of suspicious IP addresses portrend ports blocked on firewalls everything is on

6

7 Hardware for project Turris Turris 1.0 Turris 1.1

8 Hardware highlights P2020 dual-core GHz Made in Czech Republic 2 GB RAM in SO-DIMM slot 5 Gbit LAN ports + 1 Gbit WAN port 16 MB NOR MB NAND flash 2 minipcie slots (one used by Wifi) Integrated debug console with FTDI chip, dimmable LEDs :),...

9 Turris OS our fork of OpenWrt Automatic updates Different partition setup (no SquashFS, everything updatable) Basic software changes Virtually no space constraints Unbound as default DNS resolver - DNSSEC support OpenSSH instead of Dropbear Foris our simple set-up wizard Finer control of released versions

10 How we work We follow upstream with some delay SVN + GIT do not mix that well :( We try to push stuff to upstream with mixed success hope to improve that We test on machines and people Lava, considering BoardFarm Tiered distribution of updates

11 What we can offer Updater our system for automated updates Majordomo statistics of LAN devices traffic NUCI - NETCONF interface to UCI experience with DNSSEC on SOHO device Specific hardware support

12 Turris Omnia (aka Lite) Demand for Turris outside Czech Republic First publicly available Turris No need for profit Router designed for geeks Built for and shipped with OpenWrt Open hardware

13

14 Omnia hardware details SoC Marvell Armada 2 x 1.6 GHz 1 GB RAM 4 GB emmc + 8 MB NOR Gbit port + SFP dedicated line for WAN port + SFP 2 lines between CPU and switch chip

15 Omnia more hardware details 2 x USB x minipcie (one switchable to msata) optional wifi in 2 slots, SIM slot RTC chip with battery backup Cryptochip for better entropy in RNG Dimmable programmable RGB LEDs 10x GPIO, 2x UART, SPI, I2C on pinheader

16 Omnia more hardware details 2 x USB x minipcie (one switchable to msata) optional wifi in 2 slots, SIM slot RTC chip with battery backup Cryptochip for better entropy in RNG Dimmable programmable RGB LEDs 10x GPIO, 2x UART, SPI, I2C on pinheader

17 Omnia - benchmarks Turris Omnia Linksys WRT1200AC Wyse R90L ThinClient extra acceleration off in Omnia MD5 benchmark AES-128 benchmark Linksys WRT1200AC Turris Omnia Project Turris TP-Link TL-WDR4900 v1 Raspberry PI 2 Model B Northstar Prototype Wyse R90L ThinClient Linksys WRT1200AC Raspberry PI 2 Model B Linksys WRT1200AC Project Turris Gateworks Ventana GW5104 TP-Link TL-WDR4900 v

18 Omnia - status First prototype running with bugs to fix Second prototype in November 1300 routers preordered (non-bindingly) on our website Indiegogo campaign in preparation Manufacturing in Q Would you like one?

19 Here we are... We love OpenWrt! Talk to us and let's find the best way to cooperate

20 Thank You Bedřich Košata