Hosting a BBS for my friends and I. I have a few questions and would also like some advice. reddit / bbs ---------------------------------------------------------------------- wispyRed · 2018-10-24 08:38 Hey! I've been thinking about starting my own personal BBS for a while due to liking things like this kind of stuff and overall wanting some experience induling into this interest. A few questions I have before i go further:1: is hosting something on telnet safe? Once I have everything set up and I port-forward this I'm a little concerned about some kind of invader or virus hacking my computer from whatever port telnet hosts on. 2: is there a way to keep my telnet BBS under the radar? i wanna host it as a little passion project between some friends and i and im wary of it being found by random strangers. 3: If i dont port forward this is there a simple way for me to just host it on my home network and have my computers connect to it? it seems like a simple question but im rather dense and im trying to do this at 3am haha. 4: Any advice for me before I go further? 5: this is going to sound dumb but how would i go about uploading and downloading files? im used to using this from my linux terminal honestly so im not quite sure how i'd go about doing this 6: how would i know if its online or not? im not sure if its online, on my local network, or just not on at all right now. Thanks in advance! For anyone wondering im hosting this on an old rig i put raspbian onto with MysticBBS. ---------------------------------------------------------------------- z80org · 2018-10-24 08:42 1. Telnet is not safe by any means. Use SSH if possible. 2. Put it on a wierd port, like 2323 or 4711 or whatever. 3. Yes you can just host it internally. 4. Try lots of different systems before you decide. 5. Try Syncterm. Most BBS systems from the day use Z-modem as a transfer protocol. 6. If you can connect to it, it's online. ---------------------------------------------------------------------- [deleted] · 2018-10-24 08:42 [removed] ---------------------------------------------------------------------- wispyRed · 2018-10-24 08:53 1 & 2: oh? if i did portforward it to an odd port are there any other ways i can protect it? 3 & 6: how would i go about hosting it locally exactly? also how would i go about hosting a bbs via SSH? sorry bout all my newby questions haha. im thinking my bbs will be dedicated to being a community cloud and a backup chat with a bunch of old door games tbh. ---------------------------------------------------------------------- z80org · 2018-10-24 11:06 1 & 2: telnet is telnet and no matter what port you put it on it will still be unsecure but at least if you put it on a obscure port it will be harder to find for a human user. However there are always scripts and bots looking for open ports so it will be found no matter what. 3 & 6: You run it on a computer in your home. Some BBS systems offer SSH-security, others does not which means that you have to put another server in front of the BBS system (a correctly configured Linux system, I might add). ​ You have a lot of reading to do so my suggestion is you start by choosing your BBS system. Mystic will probably do the trick so download that and run it on your PC and you will soon figure things out. ---------------------------------------------------------------------- jdavidramsey · 2018-10-24 11:29 While z80org is right in that telnet isn't "safe," I think their answer could mislead you. Nobody is going to suddenly be able to get to your server/network just because you have a telnet server running. The problem would have to be some sort of exploit in the telnet server or the services (e.g., your BBS) it gives access to. However, telnet is fully plain text, so all data sent is in the clear, including passwords. But, I don't think any of the parties with the ability and will to "listen in" to random IPs are going to get much of value by intercepting BBS communications. The government/corporate actors doing all the IP scanning and snooping probably aren't going to come to your BBS with one of your users' accounts to mess up their door game turns for the day. ;-) Most BBSes today run telnet on the standard port, and I've never heard of any issues arising from that: certainly not a computer/network intrusion. All of today's BBS packages seem to be secure enough. Whether that's through design or obscurity, I don't know, but the threat level is still almost non-existent. Still, SSH is a good option to have. If you're using one of the currently in-development BBS packages like Synchronet and Mystic, the SSH server is built-in and probably running by default after installation. ---------------------------------------------------------------------- 13_0_0_0_0 · 2018-10-24 13:47 Look into port-knocking. The idea is, the outside facing port is closed by default. The user tries connecting to a few pre-determined (also closed) ports in the right order, and the knock daemon opens up the desired port for a min to that source address. It's security through obscurity, but decent enough to prevent filthy casuals from accidentally finding your port. If you do, just forward 4 ports (1 incoming and 3 knock ports) to your rPi, install and configure knockd, and you should be good. ---------------------------------------------------------------------- -CatX- · 2018-10-24 13:55 Just to add to what the others have said, if you don't want any strangers getting in you can set a system passsword they need to enter before actually arriving at the login prompt. Mystic BBS supports this natively. You could also use a SSH key, though this is a bit trickier to set up since Mystic doesn't support it. ---------------------------------------------------------------------- jhavard · 2018-10-24 17:33 As someone that ran a BBS for a decade \*starting\* in 2006... you don't have to worry about #2. Even if a thousand randos find it, their nostalgia will be sated in a day or two. You can advertise the board widely and will have zero daily callers after an initial burst of interest. As for #1... you seem to be confusing transport security and system security. The ability of random third parties to eavesdrop on a telnet session has nothing to do with whether or not the overall system is secure. Does the system allow untrusted third parties to run programs they uploaded? I can't really think of any BBS software that was that dumb. My advice is this... only go through the hassle of setting up a BBS if you want your own BBS just for the sake of having your own BBS. There are thousands of easier ways for users to accomplish the tasks that used to be conducted on a BBS. It is highly unlikely you can convert a brief pulse of nostalgia into a lasting user community. ​ ---------------------------------------------------------------------- wispyRed · 2018-10-24 17:47 thanks! im still reading everyone elses responses as i just woke up but this made me feel a bit better about hosting it. im always a bit worried about somehow losing the files on my server where im hosting this cause its a backup of pretty much everything of mine. ---------------------------------------------------------------------- wispyRed · 2018-10-24 17:50 alright thanks for dealing with me so far! im probably gonna do a testing run by having it run on my home network ---------------------------------------------------------------------- ThisIsALousyUsername · 2018-10-24 22:03 Agreed: SSH is necessary for login & transmission security, but a Telnet connection is not itself a systemic vulnerability. It all depends on what a user can do once connected; which could be almost nothing, or deleting all the files, depending on how your BBS software is configured. SSH is just better encryption. If somebody else got a Co-Admin's password, SSH would be no more secure than Telnet logins. SSH just secures the connection, not the system. Mystic is reputedly a fairly secure Bulletin Board System. ---------------------------------------------------------------------- ThisIsALousyUsername · 2018-10-24 22:11 Some early versions of Remote Access (& maybe even WWIV) did have vulnerabilities allowing remote users to access a DOS shell with commands like DEL available for system folders. As far as I know, all those vulnerabilities were patched by the late '90s. ---------------------------------------------------------------------- jdavidramsey · 2018-10-26 18:54 Hey z80org. I meant to do this yesterday but something distracted me. I just wanted to apologize for not being more clear that my comments about telnet and SSH weren't meant to be disparaging of your point. When I wrote it, I planned to close with a paragraph reiterating that you were absolutely correct that telnet isn't secure as a transport protocol. Sorry about that. I intended no offense or questioning of the validity of your suggestion. ---------------------------------------------------------------------- z80org · 2018-10-27 13:11 Not a problem. :) ---------------------------------------------------------------------- NuSkooler · 2018-10-31 03:45 In order: 1. As mentioned, Telnet is plain-text. Ignore the "XXXXX is probably not listening" stuff. Everyone is. Just use something secure. Since this is for your friends, you can make it even easier and just host VTX or fTelent + secure WebSocket proxy so all traffic goes over modern TLS and they can access via their web browser (no term required!). 2. In addition to non-standard port, you can put a system password on a lot of BBS software such that users have to type a known system password to even see the board (in addition to logging in). Also, require approval of accounts. 3. You'll probably want port forwarding. If running a older software (ie: DOS) I'd say to run that in a VM as any security vulnerabilities that let people break out of the system just gets them to a VM.... and as such, you'll probably be forwarding some port -> your board. Anyway, a non-standard port helps keeps the basic scanners away and reduce traffic that "calls" constantly and probes for vulnerabilities. Again, with older software this can cause your open nodes to be used up. 4. Try a lot of software! Experiment! Once you do proceed, modify your board so it's not the vanilla out of the box experience. 5. Z-Modem is popular. If over fTelnet (web browser) IIRC you're limited to Y-Modem and perhaps X-Modem. If you use ENiGMA 1/2 BBS (and perhaps some others?) you also have web (HTTP(S)) downloads. Bonus for using VTX with clickable web links. 6. If you can connect :D There are also services online that will check the port availability (just Google, there are many)