Here are the most popular ideas ever about Network Manager .
Security and stability centre
No information about this blueprint
Information is updated every 5 minutes.
Please wait till the next update.
Written by Auzy the 29 Feb 08 at 11:25.
New
What we need is an application which centralises security. I'd like to think of it as "Security and Stability". It should monitor the following in a centralised location:
- Track system crashes/unclean shutdowns of applications and make it easily accessible. If apache has never crashed except the day a server was compromised for instance, it may provide a clue about how it was hacked.
- Firewall status. No IPtables enabled = insecure
- Show all security updates. Users should be informed when there are updates available specifically targetting security (in addition to the applet currently present).
- User rights. If the user is running as root, they should be told the risks.
- Anti-virus. There should be integration with Anti-virus here, or a one click means of listing various versions of anti-virus. Integration should also allow a one click option to start scanning, and an indication if automatic scanning is enabled. It could also offer an easy way to install rootkit detectors and anti-virus. Its better for us to get ahead of viruses, and make sure people don't pass existing ones on (I believe ClamAV is an example of a free one?)
- Rootkit detection. There are lots of Rootkit detection systems out there. I suggest that users be able to click a button and run a quick test.
- Permission checker, Use information from APT to identify changes in permissions to system files. Many newbies do stupid things like change the permissions on a config file so they can access it via gui. Lets make sure they have an easy way to fix it.
- Identify if your network is broadcasting everyones traffic to everyone (ie, hubs, not switches). Maybe not easy, and not really neccessary.
[....]
Solution #2:
a professional tools all in one
Written by
etusha the 22 Jan 09 at 22:22.
i suggest
a professional tools all in one ,IPS, IDS, brute force detection ,Anti-virus real time protection ( CLAMAV not good slow poor ), firewall , port scanner detection , etc etc
it will be good to for server it will give UBUNTU big PLUS
i suggest
a professional tools all in one ,IPS, IDS, brute force detection ,Anti-virus real time protection ( CLAMAV not good slow poor ), firewall , port scanner detection , etc etc
it will be good to for server it will give UBUNTU big PLUS
Solution #3:
Create a "Security" section in software repositories for synaptic
Written by
kpeiruza the 11 May 09 at 16:26.
It is really hard to find out which software do you have to increase / test your security.
Just adding a new section to the repositories might increase the average level of security and show Ubuntu a bit more robust as operating system.
You don't need to add new packages at all, as it's only an extra tag on some packages!!!!
Also vote for #1 :D
It is really hard to find out which software do you have to increase / test your security.
Just adding a new section to the repositories might increase the average level of security and show Ubuntu a bit more robust as operating system.
You don't need to add new packages at all, as it's only an extra tag on some packages!!!!
Also vote for #1 :D
Solution #4:
A simple GUI with bullets that summarize the checks and results.
Various easy things to do:
- Check to see if the firewall is running: sudo ufw status
- Maybe check for iptables directly?
- Look for processes listening: lsof -i|grep -i listen
- Look for SUID root applications which shouldn't be and fix them.
- Look for default passwords or weak passwords, especially on anything that could become web facing.
- Check to see if the user is running as root explain how to fix it.
- Run something like chkrootkit and grep for problems. (sanitize for new users)
- Run rkhunter and look for problems. (sanitize for new users)
- Run clamav and look from problems
- etc, etc, etc
I think I could hack this together in a few hours for a prototype, but want some feedback.
Various easy things to do:
- Check to see if the firewall is running: sudo ufw status
- Maybe check for iptables directly?
- Look for processes listening: lsof -i|grep -i listen
- Look for SUID root applications which shouldn't be and fix them.
- Look for default passwords or weak passwords, especially on anything that could become web facing.
- Check to see if the user is running as root explain how to fix it.
- Run something like chkrootkit and grep for problems. (sanitize for new users)
- Run rkhunter and look for problems. (sanitize for new users)
- Run clamav and look from problems
- etc, etc, etc
I think I could hack this together in a few hours for a prototype, but want some feedback.
Solution #5:
A SIMPLE tool wich ummarize the checks and results.
Written by
chill the 23 May 09 at 14:13.
PLEASE Tiger is a very nice tool but it leaks on dev's and support. Last release was published in september 2007.
At first the code should be reviewed and maybe reimplemented in an other language. Then the Idears of Bryan Harris and chkrootkit.org should be implemented
Then the dev's should talk to the dev's of debians own security tool. So that one day Tiger replace the default security tool on Debian. And gets in the Base install of ubuntu.
At the end use your brain and the code of SUSE's Seccheck + Mandrake's msec to keep Tiger uptodate.
Contect the dev's of Tiger and work togather with them.
It would be nice for the hole security and openSource community.
http://www.nongnu.org/tiger/
http://packages.debian.org/sid/checksecurity
www.chkrootkit.org
http://www.openbsd.org/cgi-bin/cvsweb/src/etc/security
PLEASE Tiger is a very nice tool but it leaks on dev's and support. Last release was published in september 2007.
At first the code should be reviewed and maybe reimplemented in an other language. Then the Idears of Bryan Harris and chkrootkit.org should be implemented
Then the dev's should talk to the dev's of debians own security tool. So that one day Tiger replace the default security tool on Debian. And gets in the Base install of ubuntu.
At the end use your brain and the code of SUSE's Seccheck + Mandrake's msec to keep Tiger uptodate.
Contect the dev's of Tiger and work togather with them.
It would be nice for the hole security and openSource community.
http://www.nongnu.org/tiger/
http://packages.debian.org/sid/checksecurity
www.chkrootkit.org
http://www.openbsd.org/cgi-bin/cvsweb/src/etc/security
http://lists.debian.org/debian-devel/2002/12/msg01566.html
Solution #6:
We need a centralizing security center in ubuntu
Here is some outcome of the discussion on the ubuntu-hardened list, which took place a few weeks ago:
1) Summarized insights & conclusions on the issue of a security center in Ubuntu:
1. Trust SELinux despite its NSA history, because Linus audits the code (Sir Conquer)
2. Documentation / Wiki is important before a GUI, that also goes beyond the already implemented default security features in ubuntu, because a little technically understanding of functionalities is needed prior to recognizing security problems and taking action (Kees Cook and Christopher Warner )
3. Technically less skilled users could benefit from an easy to use GUI of a „security-center“, combined with an excellent, eye-catching documentation → Psychology!
4. Existing security oriented distributions are no appropriate alternatives, because for example BackTrack Linux runs as root permanently, etc.
2) What information should a documentation provide?:
1. LVM encryption
2. Creation, alternation and usage of secure passwords with different security levels
3. Risks of monopolists services (email, social networks, search engines, etc.)
4. Installation, usage, risks of tor, privoxy, ntp
Here is some outcome of the discussion on the ubuntu-hardened list, which took place a few weeks ago:
1) Summarized insights & conclusions on the issue of a security center in Ubuntu:
1. Trust SELinux despite its NSA history, because Linus audits the code (Sir Conquer)
2. Documentation / Wiki is important before a GUI, that also goes beyond the already implemented default security features in ubuntu, because a little technically understanding of functionalities is needed prior to recognizing security problems and taking action (Kees Cook <kees@ubuntu.com> and Christopher Warner <cwarner@kernelcode.com>)
3. Technically less skilled users could benefit from an easy to use GUI of a „security-center“, combined with an excellent, eye-catching documentation → Psychology!
4. Existing security oriented distributions are no appropriate alternatives, because for example BackTrack Linux runs as root permanently, etc.
2) What information should a documentation provide?:
1. LVM encryption
2. Creation, alternation and usage of secure passwords with different security levels
3. Risks of monopolists services (email, social networks, search engines, etc.)
4. Installation, usage, risks of tor, privoxy, ntp
3) What features should a security-center provide?:
1. Password strength tester (maybe with an updatable online database to check password-lists and international dictionaries → blackhats already have those lists for bruteforce attacks)
2. Starting a popup, telling the user the risks of running as root at the moment
3. moblock for ip-list blocking (maybe also for blocking known insecure tor exitnodes)
4. tripwire for integrity
5. aide for file changes
6. logcheck
7. checksecurity
8. denyhosts
9. Email aencryption like Enigmail or Seahorse
10. Bleachbit for deleting log, temp and chache files, etc.
11. Deborphan for deleting obsolete
12. Wipe to delete files safely (maybe implemented by default in the context menu)
13. User-agent and language switcher for Webbrowsers (Firefox, Epiphany)
14. Permission check, using information provided by apt to identify changes to system files
15. Check whether a keylogger is running (like lkl)
16. rkhunter / chkrootkit for rootkits, backdoor, exploits
17. John and rainbow tables
18. ClamAV / clamtk
19. Truecrypt for easy encryption of containers
20. GUFW Firewall (sudo gufw status) / iptables / port management
4) References:
1.https://lists.ubuntu.com/mailman/listinfo/ubuntu-hardened <ubuntu-hardened@lists.ubuntu.com>
2.http://www.debian.org/doc/manuals/securing-debian-howto/
3.https://wiki.ubuntu.com/Security/Features#Matrix
4.http://packages.ubuntu.com/de/karmic/denyhosts
5.http://www.debuntu.org/intrusion-detection-with-aide
6.https://help.ubuntu.com/community/MoBlock
7.http://brainstorm.ubuntu.com/idea/1282/
8.http://brainstorm.ubuntu.com/idea/19648/
9.http://www.nongnu.org/tiger/
10.http://savannah.nongnu.org/project/memberlist.php?group=tiger
11.http://savannah.nongnu.org/projects/tiger
12.https://lists.ubuntu.com/archives/ubuntu-hardened/2010-April/date.html
Auto detect the Wireless Security for WEP encryption
Written by shang the 17 Jun 09 at 17:20.
New
I understand WEP is not the most secure wireless encryption. However,
many people still use it at home these days. MANY users have the "pass"
but doesn't know which security option to pick. In Jaunty, We have:
WEP 40/128-bit Key
WEP 128-bit Passphrase
Replace Network Manager
Written by dendron the 28 Feb 09 at 21:10.
New
It's time to admit it - the Network Manager is a failure. Searching for "network manager" in launchpad bugtracker returns more than 1,000 (one thousand!) results.
Moreover, I find it easier and more reliable to use CLI tools for setting up network, then to use buggy and secretive nm-applet interface.
Solution #1:
Use alternative mobile network configuration tools
Written by
dendron the 28 Feb 09 at 21:10.
The main purpose of NM is to enable mobile users easily connect to mobile networks. There are a number of alternative configuration tools which provide this functionality (I recommend RutilIT).
For wired connections gnome-network-admin is enough, as they usually are not changed very often.
The main purpose of NM is to enable mobile users easily connect to mobile networks. There are a number of alternative configuration tools which provide this functionality (I recommend RutilIT).
For wired connections gnome-network-admin is enough, as they usually are not changed very often.
Solution #2:
Increase development and provide more testing for NM
Instead of using a "non-native" network manager by default, more people should work and improve NM. Canonical should temporary use more resources on NM until most bugs are fixed.
Instead of using a "non-native" network manager by default, more people should work and improve NM. Canonical should temporary use more resources on NM until most bugs are fixed.
Solution #3:
Consider Intel's Connection Manager as a replacement
Written by
urandom the 1 Mar 09 at 17:37.
While Intel's connection manager is currently lacking some features of NM, its design allows it to be quite extensible. This allows for easier additions of new features and easier maintainability.
URL:
http://moblin.org/projects/connection-manager
note: Jaunty's repository contains Intel's connection manager under the name 'connman' for anyone who wants to test it right now.
While Intel's connection manager is currently lacking some features of NM, its design allows it to be quite extensible. This allows for easier additions of new features and easier maintainability.
URL: http://moblin.org/projects/connection-manager
note: Jaunty's repository contains Intel's connection manager under the name 'connman' for anyone who wants to test it right now.
Solution #4:
use wicd
This tool has been the solution for many ubuntu users with internet connection problems. Wicd detects all cable and wifi connections, and avoids the NM problem in ubuntu 8.10
This tool has been the solution for many ubuntu users with internet connection problems. Wicd detects all cable and wifi connections, and avoids the NM problem in ubuntu 8.10
Solution #5:
Build a GTK interface for one of the better CLI tools
Written by
jamesmcm the 16 Mar 09 at 08:35.
It shouldn't be too difficult to build a GTK interface which pipes to one of the CLI tools mentioned. I'd try myself but I don't use a wireless connection and so have never had this problem, so have no idea what CLI tools and what functionality is required.
It shouldn't be too difficult to build a GTK interface which pipes to one of the CLI tools mentioned. I'd try myself but I don't use a wireless connection and so have never had this problem, so have no idea what CLI tools and what functionality is required.
Wifi manager : don't ask for Wep Key Type : Hexa, ASCII, 64/128bit,etc
Written by ktulu77 the 27 Jun 08 at 23:00.
New
I don't understand why we need to choose the key (or password) type of our wifi network.
I always try all the possibilities (hexa, ascii, 64, 128bit...) and cross my fingers for it to work.
The best thing to make working my wifi network is still the command line and iwconfig or edit manually /etc/network/interfaces. With these solutions, I never have to specify which type of key i'm using, and it always works.
Can ubuntu simply detect automatically which type of key we have to use ? Or if it is not possible, it could try each type one per one, if one doesn't work, try the next, ... until we have the connection working.
Save network settings during install
Written by bud the 4 Mar 10 at 20:23.
New
For the installation many users use the CD. At live boot you can configure the network to fetch many packages during installation.
Before the installation, at reboot all settings are lost, and many users had to reconfigure the network.
For example, do you remember the wpa key?
Solution #1:
Save the configuration
Written by
bud the 4 Mar 10 at 20:23.
During install, the installer can store the connection settings in the "new" installed system. At reboot, the network is ready to go!
During install, the installer can store the connection settings in the "new" installed system. At reboot, the network is ready to go!
Solution #2:
Don't automatically save configuration. Add choice to.
What If you are like me (& I know some who are), and you like to see what the liveCD environment can do by adding tons of stuff. & then once you see how cool or messed up you can make it, you decide to install it anyways. Wouldn't you like a FRESH install without saving your mistakes and learning from them when you start Ubuntu from the HDD? I think it would be a cool choice to save the configurations that you made to the system, but why not just WRITE DOWN THE WPA KEY?!
I have mine saved in a secure location. that way, I can just get the piece of paper, and type it in. It isn't that difficult to type.
What If you are like me (& I know some who are), and you like to see what the liveCD environment can do by adding tons of stuff. & then once you see how cool or messed up you can make it, you decide to install it anyways. Wouldn't you like a FRESH install without saving your mistakes and learning from them when you start Ubuntu from the HDD? I think it would be a cool choice to save the configurations that you made to the system, but why not just WRITE DOWN THE WPA KEY?!
I have mine saved in a secure location. that way, I can just get the piece of paper, and type it in. It isn't that difficult to type.
Firewall activates when connected to unsecure network
Written by christopher_lees the 7 Jun 09 at 15:30.
New
Many people don't bother to run a personal firewall on their computers, because they know their entire network is protected by the firewall in their ADSL router.
However, if they take their computer to a public wifi hotspot or connect to the internet via mobile broadband, they are no longer protected by their router, and any services that they were comfortable running on their home network will suddenly be exposed to strangers on the local wireless network or on the internet.
Solution #1:
UFW collaborates with NetworkManager
NetworkManager exposes its functionality to client programs through Dbus, so clients can be aware of network connectivity. It can also send signals to client programs on certain network-related events.
If NetworkManager connects to the following types of networks:
* Dial-up
* Mobile Broadband (3G, WiMax etc)
* Unsecured Wi-Fi
* WEP-protected network that is not the default connection
then UFW (Uncomplicated Firewall) will set itself to "block all incoming ports", for protection. This setting can be overridden or completely disabled.
On connection to an Ethernet network, WPA-secured WiFi or VPN, the connection is assumed to be safe behind a firewall, and UFW will return to previous settings.
Optionally, connection to any network EXCEPT the user's home network (or other user-specified "safe" network) triggers the raising of the firewall.
NetworkManager already communicates its status through Dbus, so the only code that would need to be touched would be in UFW.
NetworkManager exposes its functionality to client programs through Dbus, so clients can be aware of network connectivity. It can also send signals to client programs on certain network-related events.
If NetworkManager connects to the following types of networks:
* Dial-up
* Mobile Broadband (3G, WiMax etc)
* Unsecured Wi-Fi
* WEP-protected network that is not the default connection
then UFW (Uncomplicated Firewall) will set itself to "block all incoming ports", for protection. This setting can be overridden or completely disabled.
On connection to an Ethernet network, WPA-secured WiFi or VPN, the connection is assumed to be safe behind a firewall, and UFW will return to previous settings.
Optionally, connection to any network EXCEPT the user's home network (or other user-specified "safe" network) triggers the raising of the firewall.
NetworkManager already communicates its status through Dbus, so the only code that would need to be touched would be in UFW.
Solution #2:
Firewall on at all times
Written by
vektor the 8 Jun 09 at 10:03.
I suggest to have the firewall on at all times, regardless of the network you are connected to.
- a running firewall is not a relevant load on the CPU,
- in the case of miscommunication NM-FW you are not left unprotected,
- even behind ADSL router, your own FW is another level of security.
I suggest to have the firewall on at all times, regardless of the network you are connected to.
- a running firewall is not a relevant load on the CPU,
- in the case of miscommunication NM-FW you are not left unprotected,
- even behind ADSL router, your own FW is another level of security.
Solution #3:
Incorporate firewall management in NetworkManager
Written by
Lyset the 9 Jun 09 at 22:43.
Instead of writing another daemon/script to monitor dbus and toggle ufw it would be nice if some basic firewall rules can be controlled directly by NetworkManager and its applet.
This allows faster and more intelligent response to network events - integration as tight as it can be.
It would also be easy and intuitive for the user to access firewall settings through network applet without any need to install gufw or firestarter.
Instead of writing another daemon/script to monitor dbus and toggle ufw it would be nice if some basic firewall rules can be controlled directly by NetworkManager and its applet.
This allows faster and more intelligent response to network events - integration as tight as it can be.
It would also be easy and intuitive for the user to access firewall settings through network applet without any need to install gufw or firestarter.
Solution #4:
Integrate into Upstart
I thought having a billion little separate daemons waiting for DBus changes to fire off a task was something Upstart was supposed to solve. Have this be controlled in the back-end with Upstart.
I thought having a billion little separate daemons waiting for DBus changes to fire off a task was something Upstart was supposed to solve. Have this be controlled in the back-end with Upstart.
Solution #5:
always on with auto off
Written by
nloewen the 14 Jun 09 at 21:14.
Risk is danger multiplied by exposure so why not work at keeping exposure down. Keep all incoming ports locked down unless a process is using the port.
eg: I want to check for mail. The port is currently closed. I open evolution. The port used for email is automaticly opened, mail is received, the port is closed again.
an attacker would only have a 5-30s time slot while your receiving email before the port is closed again.
Risk is danger multiplied by exposure so why not work at keeping exposure down. Keep all incoming ports locked down unless a process is using the port.
eg: I want to check for mail. The port is currently closed. I open evolution. The port used for email is automaticly opened, mail is received, the port is closed again.
an attacker would only have a 5-30s time slot while your receiving email before the port is closed again.
Network details should be easier to see
Written by timnwells the 15 Mar 09 at 02:03.
New
Currently with network manager you can right click and get connection information, in a separate window. While it is a lot easier to get the network details this way than it is in Vista, and this would be great for detailed information. If you just want to know your IP, wifi speed, or current gprs/utms etc status for mobile broadband it's annoying.
Intelligent integration of Network Manager with applications
Written by carpex the 8 Sep 08 at 14:50.
New
Ubuntu applications that use the network could use the status of Network Manager to provide more appropriate messages and behaviours. For example, when not connected to the network, instead of having Thunderbird tell you
"Error connecting to ***** server".
You could get
"You are not connected to the internet"
That could also save some time because the mail client should simply not even attempt to check for new mail when there are no network connections. The same general principle could apply to any browser.
Another example: If you start Firefox while the network connection is getting established, it could wait for it instead of giving you a "Page not found" screen.
Even synaptics doesn't seem to know when you are connected to the internet and gives you an error message. The list of examples could include audio players, IMs, apt-get, etc.
I am sure other people can think of more interesting examples that I could add to this idea.
Solution #1:
Auto-generated solution of idea #12934
Written by
carpex the 8 Sep 08 at 14:50.
Ubuntu Brainstorm was updated in January 2009. Since the
idea #12934 was submitted before this update, its rationale and solution are not separated. Please vote accordingly, and if you have the necessary rights, please separate the rationale from the solution. Thanks!
<i>Ubuntu Brainstorm was updated in January 2009. Since the idea #12934 was submitted before this update, its rationale and solution are not separated. Please vote accordingly, and if you have the necessary rights, please separate the rationale from the solution.</i><br /> Thanks!
Solution #2:
Add awareness of network type to update utility
Written by
kruemi the 22 Mar 10 at 14:38.
If I am on a 2G or 3G connection I don't want to waste my bandwith on the search for updates.
It should be possible to put different network connections in "classes" which define what automatic stuff should be disabled over this connection (IM, Starpages of Browsers, Automatic Updates).
If I am on a 2G or 3G connection I don't want to waste my bandwith on the search for updates.
It should be possible to put different network connections in "classes" which define what automatic stuff should be disabled over this connection (IM, Starpages of Browsers, Automatic Updates).