Post B6jkBESfRWcwbsbR20 by azonenberg@ioc.exchange
(DIR) More posts by azonenberg@ioc.exchange
(DIR) Post #B6ji7rfNXPXH8SoZxw by azonenberg@ioc.exchange
0 likes, 0 repeats
Starting to set up a second of these FS 40/100G switches.Both of them have the same SSH host key. That's... a problem lol. I need to figure out how to regenerate that...
(DIR) Post #B6ji9EE19P9fODfQcS by azonenberg@ioc.exchange
0 likes, 0 repeats
I mean they're on a closed management network so it *should* still be fine but... lol
(DIR) Post #B6jiwHZnTmU9yOFGGP by jpm@aus.social
0 likes, 0 repeats
@azonenberg AHAHAHAHAHAHAHAHA they created the gold system image without deleting /etc/ssh/ssh_host*
(DIR) Post #B6jiyEQ4Bhb8lFchOa by azonenberg@ioc.exchange
0 likes, 0 repeats
@jpm yeah something like that. I'm sure there is a way to re-key i just have to figure it out
(DIR) Post #B6jjGzdPNiIwPPoH9k by FritzAdalis@infosec.exchange
0 likes, 0 repeats
@azonenberg Submit it to https://badkeys.info!
(DIR) Post #B6jjI96FfwZ03QqoTI by azonenberg@ioc.exchange
0 likes, 0 repeats
Figured out how to do 40G QSFP+ to 4x single lane breakout, and it *does* support 1000baseX mode in breakout (which means I can talk to my legacy 1G switches this way).But turning on breakout mode for a port requires rebooting the switch, which is at least slightly annoying
(DIR) Post #B6jjxrsu4W2IpBVBKa by choofa@infosec.exchange
0 likes, 0 repeats
@azonenberg is it port specific or gearbox like and force quads/pairs/groups of ports to breakout as well?
(DIR) Post #B6jkBESfRWcwbsbR20 by azonenberg@ioc.exchange
0 likes, 0 repeats
@choofa So far it appears you can enable breakout on a per-QSFP basis, and control the speed of each lane within the breakout group individually (I had one lane at 1G and one at 10G on the same 40G QSFP+ and it appeared to link up although i didn't try passing traffic yet)
(DIR) Post #B6jm8xSFtzapC5SAfw by Stormgren@obsidianmoon.com
0 likes, 0 repeats
@azonenberg @jpm I think those are FSOS, which in that case "crypto key generate (rsa or dsa)" should be the start of that command
(DIR) Post #B6jmO60OOSF63adg6y by azonenberg@ioc.exchange
0 likes, 0 repeats
@Stormgren @jpm yes these are FSOS not PicOS. The 8x 100G + 16x 40G I want to get later in the year is PicOS based but it can't ship until August and I didn't want to wait so I got this to hold me over in the meantime
(DIR) Post #B6jmutCl0T6duf3l8S by azonenberg@ioc.exchange
0 likes, 0 repeats
@Stormgren @jpm but that exact command doesnt work it seems to be "rsa key" ...
(DIR) Post #B6jn1iKrofvsEJ6i0G by azonenberg@ioc.exchange
0 likes, 0 repeats
@Stormgren @jpm or no, that's for ssh client key generation like to ssh from the switch. it's not obvious how to roll the host key
(DIR) Post #B6kG9Es29ERLphYq92 by brouhaha@mastodon.social
0 likes, 0 repeats
@azonenberg Having written firmware for switches at multiple vendors, I'm guessing that at config time they've only allocated one set of data structures for each QSFP+ that isn't doing breakout, and so adding a breakout makes them want to change the allocation. They should just always allocate four for QSFP+, QSFP28, QSFP56, etc.Switch firmware wants to do as little dynamic allocation as possible, ideally none, to prevent memory fragmentation problems later.
(DIR) Post #B6kGkF3MQoYV78VHHs by azonenberg@ioc.exchange
0 likes, 0 repeats
@brouhaha yeah it makes sense doesnt mean I have to like it.How much resources can it really take to just allocate the 4 all the time?
(DIR) Post #B6kHuoAgoke2shX9pQ by astraleureka@social.treehouse.systems
0 likes, 0 repeats
@azonenberg Are they the whitelabeled Ruijie or another OEM?
(DIR) Post #B6kIUbAkcoBWzTd2Uy by azonenberg@ioc.exchange
0 likes, 0 repeats
@astraleureka Not sure who the OEM is but it's a Chinese switch ASIC.I don't plan to keep them for all that long, I plan to replace the pair with a beefier one that has more ports but this is what I could get quickly on my budget for the monthNew plan is https://www.fs.com/products/338447.html
(DIR) Post #B6kIp7n144arwVJYjw by astraleureka@social.treehouse.systems
0 likes, 0 repeats
@azonenberg Never heard of Pica8/PicOS. Ruijie is the OEM for the FS.com WAPs and at least some of their PoE switching. The firmware is .. interesting. almost a direct port from an IOS-like monolithic cooperative multitasking kernel to Linux, the userland is several processes all talking to each other over a massive shmem buffer, with another big blob of shmem exposed by their kernel drivers. Of course, no GPL releases or even mention of Linux on their websites. It took less than an hour to find a root-level RCE on my first poking of their hardware 🙃
(DIR) Post #B6kJ2CRR52DI8QSHCK by astraleureka@social.treehouse.systems
0 likes, 0 repeats
@azonenberg Ah apparently Pica8 went bankrupt and FS bought them out, brought the dev team in-house. So, possibly a better experience than their older whitelabel-but-mostly-stock-OEM gear. I'd be interested in hearing more about your experience
(DIR) Post #B6kJ78O9ZnPL0rGyZ6 by azonenberg@ioc.exchange
0 likes, 0 repeats
@astraleureka Yes, that's the idea. The current switches were very much "I need an upgrade now" and I figured they're probably not worse than a Cisco that's been EOL for a while and likely has known vulns in the firmware lol
(DIR) Post #B6kJ9z5qamw13L4M6a by azonenberg@ioc.exchange
0 likes, 0 repeats
@astraleureka (and it's not like i have management exposed to anything world facing anyway, these are all internal behind my firewall and never touch anything coming from the internet)