Turris Security report 2022/12

Dear Turris users,

the new security issue has been discovered in samba packages from version 3.5 onwards. This issue allows the attacker to run the malicious code of his choice on the vulnerable device.

We are testing the security patch for Turris routers right now and we want to release it tomorrow.

Until that, samba users can use this workaround:

Add the parameter:

`nt pipe support = no`

to the [global] section of your smb.conf and restart smbd. This prevents clients from accessing any named pipe endpoints. Note this can disable some expected functionality for Windows clients.

Good to know:

•  Please, do not open smb sharing to the Internet. Never. It is not secure.
•  Keep automatic updates on.

You can find out more about this issue on the topic on our forum.

Schnapps is a tool for managing snapshots, which are states of the operating system at a given moment in time. How to use Schnapps on Turris routers? More details.

How to set the connection to a failover regime, when the primary connection is through WAN and in case of a failure, all traffic is directed through LTE? Quick guide is here. 

Do you need list and description of the processes that are present in the router after the basic installation? Just in case? Here. 

Turris Omnia routers are equipped with GPIO connector. How to use it? We have added detailed instructions.

Breaking news. We finally finished the blueprints for the next generation of our router, the Turris Omnia² (read: The Square Omnia). To make it cheaper, we decided to manufacture just one colour, but we believe our choice will suit everyone. 

Some feature highlights include: 

• Dimensions: 5*4*1 microfurlongs 
• Weight: 44PJ 
• Builtin support for RFC 748, 1149, 1438 and 1924 
• Log splitting support (an axe) 
• Automatic self defence mechanism (an axe) 

Stay tuned for more information!

We developed the Turris router interface in English and we use Czech as the reference localization language. If you want, you can be now a part of the translation of the Foris interface to any other language. How to do it?

Turris Omnia is on the market for several months but seems to interest only linux geeks. Therefore it was a pleasant surprise that the public at CeBit really liked it.

Why open source router

Their first question was inspired by the slogan of our stand: “Why is this router open-source? What is it for?” Good question. Why should a router be “open source? First of all, because of you can be sure that it does what it is supposed to do. Transfer data where it is supposed to transfer to. That there are no backdoors or spies. You can be less and less sure of this when it comes to closed-source programs. Turris source codes are freely available and if you cannot study those, a lot of people had already studied those. Open source means security, not only for the open source fans but also for normal users.

Openness of the router is not only a security issue, but also usefulness and scalability. The visitors to our stand appreciated that they can install their own software to our router and utilize relatively powerful and still size- and energy-economical hardware instead of the usual server. We have encountered lots of demands …

Our secure router Turris Omnia is successful on the open market so we are going to show it on the world's biggest information technology expo CeBIT in German city Hannover. You'll be able to see our exposition in the hall 12 during the whole show from 20th to 24th March.

All attendees from consumers to business partners can look forward to see not only the router and related HW, but they will be also able to meet the project chief Patrick Zandl and Community Manager Václav Zbránek. Representatives of sales and marketing department will be also there.

Nice bonus for the attendees will be also the possibility to get the 15% discount voucher to buy Turris Omnia in selected e-shop.

Do you need to connect remotely and securely to your network? OpenVPN is a great tool whose Turris configuration needed a lot of settings. Now there is a simple configuration of OpenVPN server from the Forris interface in Turris OS starting with version 3.6.

Keep in mind that the simplified OpenVPN configuration can collide with the previous configuration. If you have configured the OpenVPN on your Turris router please do check if this configuration does not collide, or disable it.

OpenVPN server does not appear automatically after the configuration, it is necessary to update it as a package. The update is in the Updater menu in the Updater where you can see OpenVPN in Package lists. Check it, router will start to download it automatically and after the download and installation (according to your connection speed) the OpenVPN option appears in menu of interface Forris.

Why is it necessary to install OpenVPN as an update? 

An additional software run on the router can present a security risk. Although we update the Turris routers regularly, we trust in the rule that services that are not used do not need to be present on the server. It makes the attacker’s’ job difficult …

We take protecting our customers’ personal data very seriously. Simply put, we don’t do anything to others, which we would not like to have done to ourselves.

Human readable agreement

We don‘t require, collect or process any personal data, unless it is vitally necessary for the operation of the services provided by the router Turris and unless you explicitly agree to it. This can for example be done via e-mail when you want to be informed about security issues. Running the router Turris can be done completely anonymously and without direct contact with us.

In the cases where it is necessary to collect data, we collect and keep the smallest possible amount, which is required for our service to function. If there are any changes in the Turris services, which require us to process a new set of data, you will always be notified about it clearly and transparently. We keep all effective legal regulations. We do not share data with third parties without your knowledge and consent, except if it is fully and consistently anonymous and statistically processed (e.g. in graphs). We will not inform you of sharing your data with third parties only in those cases, where it …

Turris OS 3.6 is going out today with easy OpenVPN setup, full list of changes is following:

• foris: new plugin for easy OpenVPN management
• suricata: new IDS package 
• kernel: support for CPUFreq, w1-gpio-cust and EC25-E LTE module on Omnia
• updates to various packages, especially DNS resolvers