So what is this all about?
It's about the network area in your typical office.
So it's about the switches, the routers, and the Wi-Fi access points.
It's not about home networks.
I think that's important to stress.
And, well, given that some people may also be in a position to decide on what you do.
There's a short management level overview.
Then I'll go towards the technical implementation.
And at the end, after the last slide, there are some arguments on why this is a good idea.
In case you need to convince somebody who is allowed to decide on what you do next.
So this is a classical, get to make the management intentional and having slides to convince them.
Just in case you, I'm an entrepreneur.
If I don't manage to convince you, well, that's my problem.
So first of all, I want to celebrate how far we've come.
So looking at false them, being that old,
and having been there for so a long time,
and then looking at what field an open source of fear has achieved in the meantime.
Remembering, well, installing Linux from floppy, yes, I'm old.
And now everything is just seamless and works just fine, and this is awesome.
And you do not even need to sacrifice a chicken,
and the moon needs to be just right.
You just have sound and Linux or whatever.
It's everything works just.
But there are some things which are still not that you use that often.
And I'm here to show you how easy it is to run a certain network infrastructure,
just with an open source of fear from there.
And your task, should you choose to accept it,
is to copy this and enjoy.
So yeah, the obligatory should love about me.
I'm called Daniel Hilfinger.
I work for the German Federal Office for Information Security.
I'm working on operating system security for mercy security.
I used to be, well, even longer.
So some networks, and there it gets murky, some people say,
well, for home use, you may be able to install OpenWRT or whatever.
But is it enterprise ready?
So a certain office network, different challenges to
compare to home network.
And the office network stuff needs to work reliably,
or your manager will yell at you.
Your colleagues will yell at you.
Somebody needs to be at fault if things break down.
And you know, this old saying nobody ever got fired for buying
IBM.
Do something similar for, yeah, well, by that network,
yeah, we always bought that.
If you buy the same network here again, it's okay, it will work.
So I will be tried at this eye.
Well, more like, hey, well, you do all that open source stuff.
Maybe you want to try doing this with a Wi-Fi network.
So yeah, well, but it's not my normal task doing that,
let's say, yeah, well, in that case, please do it
because then you have a different view on things.
And I said, okay, cool.
I was a bit hesitant because I was using OpenWRT at home.
It worked.
It was okay.
And I said, yeah, about a large scale like 20, 30,
40, 40, excess points, a bunch of switches, routers, etc.
Not, never did something on that scale before.
So I tried.
And surprisingly, it works well enough, real well.
So the usability is good.
It's pretty good.
If anybody, if you has used OpenWRT last time, maybe 10 years ago,
the usability has improved a lot.
Extremely, even.
So it really is some part of commercial offerings.
Reliability.
Well, it hasn't gone down.
And yet, the infrastructure, so it works.
I generally have no problems.
Sometimes, even forget that this stuff is running
because it needs no attention, which is good
from an operational point of view.
The features.
Yeah, well, this is a different story.
You lose some, for example.
Some switches have cable test functionality
to find problems in your cables or whatever.
On OpenWRT, which I'm using here, this feature,
could in software.
So you've been on that case.
So overall, the choice stays on the same in the same ballpark.
And I think OpenWRT really is enterprise ready.
And some companies are using OpenWRT in various networks.
I know of one deployment, which is in excess of 100,000 devices
running OpenWRT.
So you can certainly manage that stuff.
It works.
I'm not going to name company names.
Sorry.
But yeah.
So what were my goals?
COTS is commercial of the shelf, just in case somebody
doesn't know that acronym.
So making this network hardware trustworthy
with very little effort.
It's easy to try and ice software.
Pretty much everybody can do it.
YouTube tutorials out there.
It's pointless even thinking that this would be difficult.
However, try and ice hardware is way more difficult
because then usually, if you manufacture that as part of a chip,
then all the chips from that run will have the back door.
And then you need to reliable way to trigger that, even if the software
won't necessarily want to trigger that.
Building hardware back doors is way harder, maybe too
orders of magnitude harder than building a software back door.
And the cost is even greater.
So I'm not worried about that much.
And the other goal was have all the network here in our office
run trustworthy field open source software.
So well, the second goal I didn't achieve because this
other network here, nobody allowed me to replace the other
the working enterprise stuff.
But I have my own little network in various places.
So definitions because we need to be honest and upfront.
Easy installation does not mean open the device,
so there's something down.
If the one is just right, no.
Easy installation means no opening the case.
No soldering.
Five minutes max per device.
Which is otherwise really, you would probably
would not do that.
Easy management is not profitable anymore.
That's not your problem anymore.
And because we're having a free network operating system,
you get updates for a long time.
Have no extra cost because it's just installing software.
And you do not need to do this rip in the blaze
stands if you replace one vendor if another.
So that's good.
It's easy.
Yeah.
Come from a CRA background.
I'm active in cyber civilians externalization.
I've seen so much stuff which I want to forget.
Also looking at bugs in operating systems.
Oh my.
You get a complete software build of materials.
You know what's running on there.
That's good.
It's ecological also because you do not need to fill up
a way older gear.
You can use it as long as it's fit for purpose.
And if you're missing a feature,
well, you can still pay somebody.
So this was the very long management part.
Too long didn't read.
Replace the firmware for OpenWRT.
Of your network here.
It's secure in works well.
Okay.
And of management part.
So.
Thanks.
So disclaimers.
I need to read some disclaimers.
I just do so.
I mentioned one's made to emphasize this is not being used in production.
Not at all.
Officially it's a proof of concept.
Well, it works well, but I'm yeah.
Officially it's a proof of concept.
And they are well, the operating system I used for this proof of concept was chosen because
they are well.
The community is awesome.
It has been proven to be around for a long time.
It's usable and high range support is pretty good.
The hardware.
Well, I bought quite a bit of hardware and sometimes installing OpenWRT is not fun.
And you need to solder whatever.
So I picked hardware where OpenWRT was easy to install and which didn't fail me.
Later, the hardware is so yeah.
Depending on your needs, you may need something different.
And this is not an endorsement of any vendor of any hardware for any software whatever.
Okay.
And yeah.
Security currency ratio.
So it's an average office.
It's not your highly secure government.
Whatever.
You have separate guest Wi-Fi.
If there's wired access, you can just plug in unless it's in the guest room.
There's only wired guest access.
And yeah.
Network separation with relans.
And you should be able to offer people without changing the Wi-Fi password.
Right?
Because people need to be offered all the time.
So I picked WPA free enterprise with certificate which was well.
So just separate relans.
Management with no bilan.
Use network one bilan.
Guest network.
Another bilan.
You're done.
And backbone for authentication is ready.
There were a thing in.
You can talk radius over TLS.
I recommend that.
So you can install Retic proxy which translates radius to radius over TLS.
That's great.
And they all.
The access points do the authentication that way.
I have a certificate generation script which just handles open SSL.
It creates all those slightly different certificate formats.
Because Windows will want different cryptocurrencies compared to Linux compared to
network manager Linux versus other Linux variants.
Et cetera.
It's not fun.
But I have a fully compact script doing everything in that way.
It's inspired by Edurome.
This Wi-Fi roaming infrastructure from universities because first of all Edurome is awesome.
Second, they know how to run a network even if people want to break that.
They know that really well.
So I tripped lots of their docs.
And you could even hook that network to Edurome.
So 40 Wi-Fi access points.
Now there's a long procedure.
Here it also shows screenshots that it's a long list of things you have to do.
Essentially, you go to the OpenWRT webpage and say, OK, I want an image.
For this device add to more feature the packs.
Because the first one makes system upgrades easier.
Because it keeps all the configuration and all the software.
And the second one is, well, you want to access this over TLS.
You request the build takes usually five minutes.
Then you have an image.
And then install that stuff.
Now, installing this, I used a picked a cycle one.
Which is easy to install.
Trade a separate network.
Use that to flash.
I'm going to skip over that.
Due to time constraints, my apologies for that.
But essentially, you upload a critical factory image for OpenWRT,
which means the factory firmware on the access point can handle that one.
And for later updates, you use a different image which is called system upgrade image.
And you up when, once OpenWRT is installed, you connect to the OpenWRT,
and upload the config files, which will be uploaded after the talk,
where you can just get all the configuration I created.
So you can just copy this setup.
And then set a password.
Obviously, I'm not going to set a password for you, but be pointless.
And then, after reboot, you can upload, well, change the password,
and then download the config to change the password.
So you can replicate that over your network.
Use that for all the new other access points.
Rather than switches, same procedure, but a little bit less complicated.
So, not going to repeat that would be stupid.
The radius is just the current devion, unpack the config files,
which are part of the web page, the first and third page.
And the CA also unpack a bunch of scripts, so that's simple.
I don't need to tell you how to unpack this.
And then you're done.
Well, not really.
The bigger problem is, you need to have got the cables.
Depending on how old you are cabling infrastructure is,
you will need to find cables or a socket which I'm not broken.
Depending on the office building and how old it is.
And you need a new Wi-Fi password for guests,
because you're probably not going to use the default password.
I set.
And yeah, there is one big challenge in all of this.
And it's.
The resistance to change.
So, you can do this in a small setup.
I picked mostly silks will gear,
because it worked in the installation was easy.
You can use pretty much anything which is so important
by openWRT, but just make sure you are not going to have to
solar because, well, solar is fun, but it doesn't scale.
So, there is one thing which I really would like to say,
which is a huge thank you to all the people
and if you're an open source community, working on that.
Because the stuff I was using, I didn't have to develop anything.
It just worked.
This is great.
This is awesome.
I benefit from that.
And that's why I want to express my heartfelt thanks
for all those people working on that.
And so, that's also how I want to conclude, still.
Do you have any questions?
Yep.
How do you keep this software out today?
I'm going to give you two like the current software updates
or do you just refresh it?
You're going to pull three bills and refresh it and you probably have an image.
Maybe I can share my...
Sorry.
Oh, you're right.
Repeating the question, obviously.
So, how do you do firmware upgrades?
It just refreshing everything or is there a different method?
So, with OpenWRT, current OpenWRT,
this additional package I recommend it to install,
does this attend its system upgrade?
It just click, okay.
I want to click attend its system upgrade on the device itself.
Can also do it on the command line.
And say, okay, I want a new image.
Current OpenWRT, keep my configuration click.
I will tell you, okay.
Building an image.
Five minutes later, okay.
Uploading the image.
Do you want to proceed?
Click, okay.
Device reboots.
You're done.
So, I think that's pretty comfortable.
That's way better than it was before.
Yep.
What happens during the update phase?
Never had that in the past.
Sorry.
Yeah.
So, what happens if not the update phase?
Never happened to me in the past.
But the gear I picked, which is also the configuration files presented for
is, has good recovery mechanisms.
That's also one of the other things I wanted to address.
Pardon?
Can I stop?
I'll just say, back up.
Back up.
Yeah.
And that also would require a reset button.
You also have a reset button, which can reset the configuration.
So, thank you very much.
Thank you.