First the In Control notification system (which has obviously been put there to protect the SOHO and alert system administrators to potential breaches) seems to operate solely from the Web Gui and when you ‘Apply’ any changes, I suspect it is simply a mechanism that when you click the ‘Apply’ button sends an instruction through to Pepwave notifying it. I appreciate the system monitors rebooting and loss of connectivity, but I remain unconvinced that a real hacker working in the Cli (say via ssh) would trip the system or alert the administrator. Please can you confirm?
Second, it appears that although you can change the default administrator account name in the GUI, this does not get changed at a Cli/ssh level and remains as admin . . clearly one of the first things a competent system administrator should do is change the System administrator account name/disable it and create a new (and unknown) administrator username, yet your system appears to only support this at the GUI level (a bit like the query above). Can you
confirm if this essential security feature is in the process of being added to the Firmware?
Actually the primary purpose of InControl 2 is central management and monitoring of the devices. A side effect of that is that you can then monitor for suspicious activity (ie you can see when a new device has joined your network). All event logging in InControl 2 mirrors those logs found on the device.
The CLI is heavily restricted and limited in functionality. As far as I’m aware apart from being able to reboot the device and reset to factory defaults (once authenticated) the only thing you can do in the CLI is get device info and status.
The ‘admin’ account name is currently hardcoded (this account is locked into a very limited set of capabilities and is not given a full shell) and as yet there is no intention to make that username reflect the one used in the webui.
CLI is by default disabled and unless you have a very good reason to enable it I would suggest that you leave it turned off. if you do enable it you can only allow access on the LAN.
Hi Martin, I understand that Peplink have (on an unhacked and uncompromised device) have limited the commands that can be executed under the admin Cli/ssh user, and maybe that is enough and permission can never be eleveated . . but this is a Linux based system architecture and of course one would always leave the Cli turned off by default - BUT a hacker will look at a range of attack vectors and possibly gain access to the device through in-obvious means and gain root access and then all the limitations you have put in place on the admin user and an unhacked SOHO are pointless!
Given the fact that this is a Linux OS and device, would it not be possible to also use In Control to just scan the /var/log/authlog or wherever/whatever area the underlying OS tracks logs such actions as well as any changes in the /etc/passwd file direct in the Linux every hour or so for real security? Or run a Cron to do so? It is certainly very possible and not at all hard and would enhance the security of the product significantly. Thanks Tereza
Yes I agree. Notifications and logs in InControl for successful (and failed) login attempts and local device account creation / modification events (like password changes) would be beneficial.
I cannot log into my InControl2 account, I have tried resetting the password on 3 occasions and still
After resetting it, it states ‘Invalid username or password’ not sure how to contact Pepwave
Technical support without a log in so can you forward and ask them if the account has been locked
For some reason and if so to unlock it?
