Showing posts with label openwrt. Show all posts
Showing posts with label openwrt. Show all posts

Saturday, October 30, 2021

cum sa spionezi ce fac angajatii pe calculator fara ca ei sa stie

Intrebarea este cum iti spionezi angajatii ce fac pe calculatorul/laptopul de serviciu in timpul programului si daca tehnic poti face acest lucru?

Da, tehnic poti face lucrul acesta foarte simplu si in urma implementarii solutiei de mai jos poti vedea in timp real chiar ecranul calculatorului unui anumit angajat si ce face el de fapt pe calculator.

Tot ce trebuie este sa schimbi ruterul de acces la net cu un router care suporta openwrt. Sunt destul de multe, unele chiar cu conectivitate gigabit (care ofera viteza maxim la ora actuala) pe toate mufele. Eu, de exemplu, am luat un router din acesta second hand cu 30 de lei de pe olx. 

Se instaleaza openWRT pe router, se instaleaza Open VPN pe router, clientul openvpn pe laptopul sau telefonul sefului, un server vnc care ruleaza invizibil pe fundal pe calculatoarele angajatilor, un client vnc viewer pe calculatorul/laptopul/telefonul sefului si tot pe calculatorul/telefonul sefului un client open vpn . Deci, seful poate spiona si de pe telefonul lui nu numai de pe laptopul/calculatorul personal.

Deci, trebuie un router modificat cu 2 programe software instalate, un program instalat pe calculatorul angajatului si doua programe pe calculatorul/laptopul/telefonul sefului.

Dupa ce routerul a fost modificat, toate instalarile astea dureaza 5 minute pe calculatorul angajatului si 10-20 minute pe calculatorul/telefonul sefului. Dureaza mai mult modificarea routerului - care este complicata, mie mi-a luat ce lputin 2-3 ore!

Reteta de mai sus a fost probata si folosita cu succes intr-o unitate unde seful avea banuiala ca angajatii nu bat pe aplicatia de vanzari toate produsele. Uitandu-se simultan pe camera video si pe ecranul care arata aplicatia de vanzari ( ecran care se vedea cu ajutorul solutiei tehnice descrise mai sus) seful a putut combina datele si sa-si dea seama cine il inseala.

Din punct de vedere legal implementarea unei astfel de solutii este dificila, dar din punct de vedere tehnic este foarte usor. Dar, nu a avut nevoie de implementare legala ci, a avut nevoie doar sa stie pentru el cine e angajatul problema. Dupa aia s-a descurcat el, orice patron stie ce are de facut cu un angajat care fura!

Cam asta este! În caz ca aveti nevoie de sprijin pentru implementarea unei astfel de solutii si nu gasiti pe cineva care s-o faca puteti trimite un mail la omotamm arond gmail punct com si rezolvam! Costul va fi de 200 ron onorariul meu, plus eventual achizitia unui router potrivit.   Implementarea se poate face si de la distanta prin teamviewer!

installing openwrt and openvpn on a router

 Hy!

I have an Asus RT-AC51U router and i have OpenWRT on it! Putting OpenWRT on this router is explained very good on the page dedicated to it on openWRT site. I used windows method.

Now, why not installing a private VPN? Maybe you are abroad and want access to your internal network or want to watch your netflix series or other tv stations/programs who cannot stream abroad because DRM and copyright things...

Installing openvpn is explained here very good. All you have to do is ssh into your router and literally write down every line in the tutorial followed by enter key. The single thing that didn't work very well for me was the firewall thing. In that case i followed the tutorial HERE (network/firewall section of the tutorial). After that, follow along the firs tutorial issuing terminal commands like they are written, till the end.

An observation: i generated 4 key for clients, as maybe i will gave one or two to somebody in the family. I used tcp protocol instead of udp.

Of course, after that you need to ftp into your router and edit manually some files to better link/fit to your needs and correct some errors who might have appear.

 

i modified 

/etc/openvpn/server.conf  ("server" is the name i gave to my server, really original :) )

/etc/openvpn/client.ovpn

examples of "server.conf" and "client.ovpn" are provided here. keys and certificates are deleted form examples.

for "server.conf".

user nobody
group nogroup
dev tun0
port 1194
proto tcp
server 192.168.8.0 255.255.255.0
topology subnet
client-to-client
keepalive 10 120
persist-tun
persist-key
push "dhcp-option DNS 8.8.8.8"
#push "dhcp-option 8.8.8.8 "
push "route 192.168.1.0 255.255.255.0"

# these 2 lines are for when you want to "see" the internal network behind the router and #use samba or ftp with your home station


push "redirect-gateway def1"
push "persist-tun"
push "persist-key"
#tls-auth /etc/easy-rsa/pki/ta.pem 0 this is old and incompatible with the new tls auth

mssfix 1305
 ifconfig-pool-persist   /tmp/ipp.txt
<dh>
-----BEGIN DH PARAMETERS-----

..................
-----END DH PARAMETERS-----
</dh>
<tls-crypt-v2>
-----BEGIN OpenVPN tls-crypt-v2 server key-----
..................
-----END OpenVPN tls-crypt-v2 server key-----
</tls-crypt-v2>
<key>
-----BEGIN PRIVATE KEY-----

-----END PRIVATE KEY-----
</key>
<cert>
-----BEGIN CERTIFICATE-----

...............

-----END CERTIFICATE-----

</cert>
<ca>
-----BEGIN CERTIFICATE-----.

........................

-----END CERTIFICATE-----
</ca>


the corespondent client.ovpn for the file above is:

(keys and certificates are deleted form example here)

user nobody
group nogroup
dev tun0
nobind
client
proto tcp
remote put your ddns/IP address or your domain here  1194
auth-nocache
persist-key
persist-tun
ns-cert-tls server
remote-cert-tls server
<tls-crypt-v2>
-----BEGIN OpenVPN tls-crypt-v2 client key-----
..........................
-----END OpenVPN tls-crypt-v2 client key-----
</tls-crypt-v2>
<key>
-----BEGIN PRIVATE KEY-----
.......................
-----END PRIVATE KEY-----
</key>
<cert>
-----BEGIN CERTIFICATE-----
.......................
-----END CERTIFICATE-----
</cert>
<ca>
-----BEGIN CERTIFICATE-----
................
-----END CERTIFICATE-----
</ca>


a screenshot of my firewall:

openwrt and openvpn firewall

a screenshot of interfaces (note, i didn't delete ip's and things, i don't care as i have everyday another ip address)

openwrt with openvpn interfaces


and thats it! Restart your router and enjoy your private VPN! :)

p.s.: do not forget to assign your VPN0 interface to vpn firewall zone (after you create VPN0 unmanaged interface additional settings will apear, among them is assign to firewall zone).