Template:Networking rutos manual administration: Difference between revisions
Template:Networking rutos manual administration (view source)
Revision as of 15:51, 18 December 2023
, 18 December 2023→Security
No edit summary |
|||
(80 intermediate revisions by 10 users not shown) | |||
Line 1: | Line 1: | ||
<!--- {{{series}}}, {{{name}}} ---> | <!--- {{{series}}}, {{{name}}} ---> | ||
{{Template: | {{Template: Networking_device_manual_fw_disclosure | ||
| | | series = {{{series}}} | ||
| series | | name = {{{name}}} | ||
| fw_version ={{Template: Networking_device_manual_latest_fw | |||
| series = {{{series}}} | |||
| name = {{{name}}} | |||
}} | |||
}} | }} | ||
{{#ifeq: {{{series}}} | RUT9 |<br><i><b>Note</b>: <b>[[{{{name}}} Administration (legacy WebUI)|click here]]</b> for the old style WebUI (FW version {{Template: Networking_device_manual_latest_fw | series = RUT9XX}} and earlier) user manual page.</i>|}} | |||
{{#ifeq: {{{series}}} | RUT2 |<br><i><b>Note</b>: <b>[[{{{name}}} Administration (legacy WebUI)|click here]]</b> for the old style WebUI (FW version {{Template: Networking_device_manual_latest_fw | series = RUT2XX}} and earlier) user manual page.</i>|}} | |||
__TOC__ | |||
==Summary== | ==Summary== | ||
Line 12: | Line 18: | ||
The <b>General</b> section is used to set up some of device managerial parameters, such as changing device name. For more information on the General section, refer to figure and table below. | The <b>General</b> section is used to set up some of device managerial parameters, such as changing device name. For more information on the General section, refer to figure and table below. | ||
{{#switch:{{{series}}} | |||
{{# | | TAP100|TAP200=[[File:Networking_rutos_manual_administration_general_tap100_v1.png|border|class=tlt-border]] | ||
|[[File: | | TCR1=[[File:Networking_rutos_manual_administration_general_tcr_v2.png|border|class=tlt-border]] | ||
| TRB1|TRB2|TRB5=[[File:Networking_rutos_manual_administration_general_trb_v2.png|border|class=tlt-border]] | |||
| #default=[[File:Networking_rutos_manual_administration_general_rut_v2.png|border|class=tlt-border]] | |||
}} | |||
<table class="nd-mantable"> | <table class="nd-mantable"> | ||
<tr> | <tr> | ||
Line 21: | Line 29: | ||
<th>Value</th> | <th>Value</th> | ||
<th>Description</th> | <th>Description</th> | ||
</tr>{{#switch:{{{series}}}|TAP100|TAP200=|#default= | |||
<tr> | |||
<th>General Settings</th> | |||
<th></th> | |||
<th></th> | |||
</tr> | |||
<tr> | |||
<td>Language</td> | |||
<td>English {{!}} Turkish<span class="asterisk">*</span> {{!}} Spanish<span class="asterisk">*</span> {{!}} Portuguese<span class="asterisk">*</span> {{!}} German<span class="asterisk">*</span> {{!}} Japanese<span class="asterisk">*</span>; default: <b>English</b></td> | |||
<td>Changes the router's WebUI language.</td> | |||
</tr> | |||
<tr> | |||
<td>Configuration Mode</td> | |||
<td>Basic {{!}} Advanced; default: <b>Basic</b></td> | |||
<td>Mode determines what options and configurations are shown. In Basic mode only the essential configurations are shown. In Advanced mode there is greater freedom to configure and access more options.</td> | |||
</tr>}} | |||
<tr> | |||
<th>Device name and hostname</th> | |||
<th></th> | |||
<th></th> | |||
</tr> | </tr> | ||
<tr> | <tr> | ||
Line 33: | Line 61: | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td> | <th>LED Indication</th> | ||
<th></th> | |||
<th></th> | |||
</tr> | |||
<tr> | |||
<td>Enable</td> | |||
<td>off {{!}} on; default: <b>on</b></td> | |||
<td>Manages signal strength{{#ifeq:{{{series}}}|RUTX||, LAN}} and connection status indication LEDs.</td> | |||
</tr> | |||
<tr> | |||
<th>Reset Button Configuration</th> | |||
<th></th> | |||
<th></th> | |||
</tr> | </tr> | ||
<tr> | <tr> | ||
Line 46: | Line 84: | ||
<td>integer [1..60]; default: <b>none</b></td> | <td>integer [1..60]; default: <b>none</b></td> | ||
<td>Maximum time (in seconds) the button can be held to perform an action, after which no action will be performed.</td> | <td>Maximum time (in seconds) the button can be held to perform an action, after which no action will be performed.</td> | ||
</tr> | |||
</table> | |||
{{#switch:{{{series}}}|TAP100|TAP200=|#default=<span class="asterisk">*</span> Different language packages can be downloaded separately from the <b>System → [[{{{name}}} Package Manager|Package Manager]]</b> page.}} | |||
==Date & Time== | |||
===Summary=== | |||
---- | |||
<b>Network Time Protocol</b> (<b>NTP</b>) is a networking protocol for clock synchronization between computer | |||
systems over packet-switched, variable-latency data networks. This chapter is an overview of the NTP section for {{{name}}} devices. | |||
===General=== | |||
---- | |||
The <b>Time Synchronization</b> section lets you select time zone{{#ifeq:{{{gps}}}|1|, enable GPS synchronization|}} and synchronize the time. | |||
The figure below is an example of the Time Synchronization section and the table below | |||
provides information about the fields contained in that section: | |||
[[File:Networking_rutos_ntp_general_gps_{{{gps}}}.png|border|class=tlt-border]] | |||
<table class="nd-mantable"> | |||
<tr> | |||
<th>Field</th> | |||
<th>Value</th> | |||
<th>Description</th> | |||
</tr> | |||
<tr> | |||
<td>Current system time</td> | |||
<td>time; default: <b>none</b></td> | |||
<td>Current local time of the device.</td> | |||
</tr> | |||
<tr> | |||
<td>Sync with browser</td> | |||
<td>-(interactive button)</td> | |||
<td>Click to synchronize device time and time zone to browsers, if your device time or time zone is not correct.<br></td> | |||
</tr> | |||
<tr> | |||
<td>Time zone</td> | |||
<td>time zone; default: <b>UTC</b></td> | |||
<td>The device will sync time in accordance with the selected time zone.</td> | |||
</tr> | |||
{{#ifeq:{{{gps}}}|1| | |||
<tr> | |||
<td>GPS Synchronization</td> | |||
<td>off {{!}} on; default: <b>off</b></td> | |||
<td>Enables periodic time synchronization for the system using the GPS module which does not require an Internet connection.</td> | |||
</tr>|}} | |||
</table> | |||
===NTP=== | |||
---- | |||
This section is used to configure NTP client, server and time servers. | |||
====Time Synchronization==== | |||
---- | |||
This section is used to configure the device's time settings. | |||
[[File:Networking_rutos_ntp_ntp_time_synchronization_{{{mobile}}}.png|border|class=tlt-border]] | |||
<table class="nd-mantable"> | |||
<tr> | |||
<th>Field</th> | |||
<th>Value</th> | |||
<th>Description</th> | |||
</tr> | |||
<tr> | |||
<td>Enable NTP Client</td> | |||
<td>off {{!}} on; default: <b>on</b></td> | |||
<td>Turns NTP on or off.</td> | |||
</tr> | |||
<tr> | |||
<td>Save time to flash</td> | |||
<td>off {{!}} on; default: <b>off</b></td> | |||
<td>Saves last synchronized time to flash memory.</td> | |||
</tr> | |||
<tr> | |||
<td>Force Servers</td> | |||
<td>off {{!}} on; default: <b>off</b></td> | |||
<td>Forces unreliable NTP servers.</td> | |||
</tr> | |||
<tr> | |||
<td>Update interval (in seconds)</td> | |||
<td>integer; default: <b>86400</b></td> | |||
<td>How often the device will update the time.</td> | |||
</tr> | |||
<tr> | |||
<td>Offset frequency</td> | |||
<td>integer; default: <b>0</b></td> | |||
<td>Adjusts the minor drift of the clock so that it will run more accurately.</td> | |||
</tr> | |||
<tr> | |||
<td>Count of time synchronizations</td> | |||
<td>integer; default: <b>none</b></td> | |||
<td>The amount of times the device will perform time synchronizations. Leave empty in order to set to infinite.</td> | |||
</tr>{{#ifeq: {{{mobile}}} | 1 | | |||
<tr> | |||
<td>Operator Station Synchronization</td> | |||
<td>off {{!}} on; default: <b>off</b></td> | |||
<td>Synchronizes time with mobile operator's base station.</td> | |||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Timezone Synchronization</td> | |||
<td> | <td>off {{!}} on; default: <b>off</b></td> | ||
<td> | <td>Sync time data with mobile operator.</td> | ||
</tr>|}} | |||
</table> | |||
====Time Servers==== | |||
---- | |||
This section is used to specify which time servers the device will use for time synchronization. To add more time servers to the list, click the 'Add' button. | |||
{{#switch:{{{series}}}|TAP100|TAP200=[[File:Networking_rutos_ntp_ntp_time_servers_tap100_v2.png|border|class=tlt-border]]|#default=[[File:Networking_rutos_ntp_ntp_time_servers_v2.png|border|class=tlt-border]]}} | |||
<table class="nd-mantable"> | |||
<tr> | |||
<th>Field</th> | |||
<th>Value</th> | |||
<th>Description</th> | |||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Hostname</td> | |||
<td>ip {{!}} url; default: <b>0.openwrt.pool.ntp.org</b></td> | |||
<td>NTP servers that this device uses to sync time.</td> | |||
</tr> | </tr> | ||
</table> | </table> | ||
{{#switch:{{{series}}}|TAP100|TAP200=|#default= ====NTP Server==== | |||
---- | |||
The device can also act as an <b>NTP Server</b>, providing clock synchronization to other devices in the network. From this section you can turn this feature on or off: | |||
[[File:Networking_rutos_ntp_ntp_server.png|border|class=tlt-border]]}} | |||
{{#switch:{{{series}}}|TAP100|TAP200=|#default= ===NTPD=== | |||
---- | |||
The <b>NTPD</b> program is an operating system daemon that synchronizes the system clock to remote NTP time servers or local reference clocks. NTPD includes the ability to use this to keep your clock in sync and will run more accurately than a clock on a device not running NTPD. NTPD will also use several servers to improve accuracy. It is a complete implementation of NTP version 4 defined by RFC-5905, but also retains compatible with version 3 defined by RFC-1305 and versions 1 and 2, defined by RFC-1059 and RFC-1119, respectively. | |||
<b>Note:</b> NTPD is additional software that can be installed from the <b>System → [[{{{name}}} Package Manager|Package Manager]]</b> page. | |||
[[File:Networking_rutos_ntp_ntpd_v2.png|border|class=tlt-border]] | |||
<table class="nd-mantable"> | |||
<tr> | |||
<th>Field</th> | |||
<th>Value</th> | |||
<th>Description</th> | |||
</tr> | |||
<tr> | |||
<td>Enable NTPD</td> | |||
<td>off {{!}} on; default: <b>off</b></td> | |||
<td>Turns NTPD on or off.</td> | |||
</tr> | |||
<tr> | |||
<td>Enable NTP config from file</td> | |||
<td>off {{!}} on; default: <b>off</b></td> | |||
<td>Run NTPD with uploaded configuration file.</td> | |||
</tr> | |||
<tr> | |||
<td>NTP configuration file</td> | |||
<td>.conf file; default: <b>none</b></td> | |||
<td>Upload a custom configuration file.</td> | |||
</tr> | |||
<tr> | |||
<td>Server</td> | |||
<td>ip {{!}} url; default: <b>0.openwrt.pool.ntp.org</b></td> | |||
<td>NTP servers that this device uses to sync time.</td> | |||
</tr> | |||
<tr> | |||
<td>Enable Server</td> | |||
<td>off {{!}} on; default: <b>off</b></td> | |||
<td>Enables NTPD server to make the router act as an NTP server so that it can provide time synchronization services for other network devices.</td> | |||
</tr> | |||
</table>}} | |||
==User Settings== | |||
{{Template: Networking_rutos_manual_users | series = {{{series}}} | name = {{{name}}} | wifi = {{{wifi}}} | mobile = {{{mobile}}}}} | |||
==Access Control== | ==Access Control== | ||
===General=== | ===General=== | ||
---- | ---- | ||
The <b>Access Control</b> page is used to manage remote and local access to device. | The <b>Access Control</b> page is used to manage {{#switch:{{{series}}}|TAP100|TAP200=|#default= remote and}} local access to device. | ||
<b>Important</b>: turning on remote access leaves your device vulnerable to external attackers. Make sure you use a strong password. | {{#switch:{{{series}}}|TAP100|TAP200=|#default=<b>Important</b>: turning on remote access leaves your device vulnerable to external attackers. Make sure you use a strong password. | ||
<br><br> | <br><br>}} | ||
<b>SSH</b> | <b>SSH</b> | ||
---- | ----{{#switch:{{{series}}} | ||
[[File: | |TAP100|TAP200 = [[File:Networking_rutos_manual_administration_access_control_general_ssh_tap100_v1.png|border|class=tlt-border]] | ||
|#default = [[File:Networking_rutos_manual_administration_access_control_general_ssh_v1.png|border|class=tlt-border]]}} | |||
<table class="nd-mantable"> | <table class="nd-mantable"> | ||
Line 78: | Line 275: | ||
<tr> | <tr> | ||
<td>Enable SSH access</td> | <td>Enable SSH access</td> | ||
<td>off | <td>off {{!}} on; default: <b>on</b></td> | ||
<td>Turns SSH access from the local network (LAN) on or off.</td> | <td>Turns SSH access from the local network (LAN) on or off.</td> | ||
</tr> | </tr>{{#switch:{{{series}}}|TAP100|TAP200=|#default | ||
<tr> | <tr> | ||
<td>Remote SSH access</td> | <td>Remote SSH access</td> | ||
<td>off | <td>off {{!}} on; default: <b>off</b></td> | ||
<td>Turns SSH access from remote networks (WAN) on or off.</td> | <td>Turns SSH access from remote networks (WAN) on or off.</td> | ||
</tr> | </tr>}} | ||
<tr> | <tr> | ||
<td>Port</td> | <td>Port</td> | ||
<td>integer [0..65535]; default: <b>22</b></td> | <td>integer [0..65535]; default: <b>22</b></td> | ||
<td>Selects which port to use for SSH access.</td> | <td>Selects which port to use for SSH access.</td> | ||
</tr> | |||
<tr> | |||
<td>Enable key-based authentication</td> | |||
<td>off {{!}} on; default: <b>off</b></td> | |||
<td>Use public keys for authentication.</td> | |||
</tr> | </tr> | ||
</table> | </table> | ||
<br> | <br> | ||
<b>WebUI</b> | <b>WebUI</b> | ||
---- | ----{{#switch:{{{series}}} | ||
[[File: | |TAP100|TAP200 = [[File:Networking_rutos_manual_administration_access_control_general_webui_tap100_v1.png|border|class=tlt-border]] | ||
|#default = [[File:Networking_rutos_manual_administration_access_control_general_webui_v1.png|border|class=tlt-border]]}} | |||
<table class="nd-mantable"> | <table class="nd-mantable"> | ||
Line 105: | Line 308: | ||
<tr> | <tr> | ||
<td>Enable HTTP access</td> | <td>Enable HTTP access</td> | ||
<td>off | <td>off {{!}} on; default: <b>on</b></td> | ||
<td>Turns HTTP access from the local network (LAN) to the device WebUI on or off.</td> | <td>Turns HTTP access from the local network (LAN) to the device WebUI on or off.</td> | ||
</tr><tr><td>Enable HTTPS access | </tr> | ||
</td><td>off | <tr> | ||
<td>Enable HTTPS access</td> | |||
<td>off {{!}} on; default: <b>on</b></td> | |||
<td>Turns HTTPS access from the local network (LAN) to the device WebUI on or off.</td> | |||
</tr> | |||
<tr> | |||
<td>Redirect to HTTPS</td> | <td>Redirect to HTTPS</td> | ||
<td>off | <td>off {{!}} on; default: <b>off</b></td> | ||
<td>Redirects connection attempts from HTTP to HTTPS.</td> | <td>Redirects connection attempts from HTTP to HTTPS.</td> | ||
</tr> | </tr>{{#switch:{{{series}}}|TAP100|TAP200=|#default= | ||
<tr> | <tr> | ||
<td>Enable remote HTTP access</td> | <td>Enable remote HTTP access</td> | ||
<td>off | <td>off {{!}} on; default: <b>off</b></td> | ||
<td>Turns HTTP access from remote networks (WAN) to the device WebUI on or off.</td> | <td>Turns HTTP access from remote networks (WAN) to the device WebUI on or off.</td> | ||
</tr> | </tr>}} | ||
<tr> | <tr> | ||
<td>Port</td> | <td>Port</td> | ||
<td>integer [0..65535]; default: <b>80</b></td> | <td>integer [0..65535]; default: <b>80</b></td> | ||
<td>Selects which port to use for HTTP access.</td> | <td>Selects which port to use for HTTP access.</td> | ||
</tr> | </tr>{{#switch:{{{series}}}|TAP100|TAP200=|#default= | ||
<tr> | <tr> | ||
<td>Enable remote HTTPS access</td> | <td>Enable remote HTTPS access</td> | ||
<td>off | <td>off {{!}} on; default: <b>off</b></td> | ||
<td>Turns HTTPS access from remote networks (WAN) to the device WebUI on or off.</td> | <td>Turns HTTPS access from remote networks (WAN) to the device WebUI on or off.</td> | ||
</tr> | </tr>}} | ||
<tr> | <tr> | ||
<td>Port</td> | <td>Port</td> | ||
<td>integer [0..65535]; default: <b>443</b></td> | <td>integer [0..65535]; default: <b>443</b></td> | ||
<td>Selects which port to use for HTTPS access.</td> | <td>Selects which port to use for HTTPS access.</td> | ||
</tr> | </tr>{{#switch:{{{series}}}|TAP100|TAP200=|#default= | ||
<tr> | |||
<td>Ignore private IPs on public interface</td> | |||
<td>off {{!}} on; default: <b>on</b></td> | |||
<td>Prevent access from private (RFC1918) IPs on an interface if it has an public IP address.</td> | |||
</tr>}}{{#switch:{{{series}}}|TAP100|TAP200=|#default= | |||
<tr> | |||
<td>Certificate files from device</td> | |||
<td>off {{!}} on; default: <b>on</b></td> | |||
<td>Choose this option if you want to select certificate files from device. Certificate files can be generated in [[{{{name}}} Administration#Certificates|Certificates]] section.</td> | |||
</tr>}}{{#switch:{{{series}}}|TAP100|TAP200=|#default= | |||
<tr> | |||
<td>Server certificate</td> | |||
<td>.crt; default: <b>uhttpd.crt</b></td> | |||
<td>Server certificate file.</td> | |||
</tr>}}{{#switch:{{{series}}}|TAP100|TAP200=|#default= | |||
<tr> | |||
<td>Server key</td> | |||
<td>.key; default: <b>uhttpd.key</b></td> | |||
<td>Server key file.</td> | |||
</tr>}} | |||
</table> | </table> | ||
<br> | <br> | ||
<b>CLI</b> | <b>CLI</b> | ||
---- | ----{{#switch:{{{series}}} | ||
[[File:Networking_rutos_manual_administration_access_control_general_cli.png|border|class=tlt-border]] | |TAP100|TAP200 = [[File:Networking_rutos_manual_administration_access_control_general_cli_tap100.png|border|class=tlt-border]] | ||
|#default = [[File:Networking_rutos_manual_administration_access_control_general_cli.png|border|class=tlt-border]]}} | |||
<table class="nd-mantable"> | <table class="nd-mantable"> | ||
Line 147: | Line 376: | ||
<tr> | <tr> | ||
<td>Enable CLI</td> | <td>Enable CLI</td> | ||
<td>off | <td>off {{!}} on; default: <b>on</b></td> | ||
<td>Turns CLI access from the local network (LAN) on or off.</td> | <td>Turns CLI access from the local network (LAN) on or off.</td> | ||
</tr> | </tr>{{#switch:{{{series}}}|TAP100|TAP200=|#default= | ||
<tr> | <tr> | ||
<td>Enable remote CLI</td> | <td>Enable remote CLI</td> | ||
<td>off | <td>off {{!}} on; default: <b>off</b></td> | ||
<td>Turns CLI access from remote networks (WAN) on or off.</td> | <td>Turns CLI access from remote networks (WAN) on or off.</td> | ||
</tr> | </tr>}} | ||
<tr> | <tr> | ||
<td>Port range</td> | <td>Port range</td> | ||
Line 166: | Line 395: | ||
</tr> | </tr> | ||
</table> | </table> | ||
<br>{{#switch:{{{series}}}|TAP100|TAP200=|#default= | |||
<b>Telnet</b> | |||
---- | ---- | ||
[[File: | [[File:Networking_rutos_manual_administration_access_control_general_telnet.png|border|class=tlt-border]] | ||
<table class="nd-mantable"> | <table class="nd-mantable"> | ||
Line 178: | Line 407: | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td> | <td>Enable Telnet access</td> | ||
<td> | <td>off {{!}} on; default: <b>on</b></td> | ||
<td> | <td>Turns Telnet access from the local network (LAN) on or off.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td> | <td>Enable remote Telnet access</td> | ||
<td> | <td>off {{!}} on; default: <b>off</b></td> | ||
<td> | <td>Turns Telnet access from remote networks (WAN) on or off.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td> | <td>Port range</td> | ||
<td>integer</td> | <td>integer [0..65535]; default: <b>23</b></td> | ||
<td> | <td>Selects which port to use for Telnet access.</td> | ||
</tr> | </tr> | ||
</table> | </table> | ||
=== | ===PAM=== | ||
---- | ---- | ||
<b>Note:</b> PAM is additional software that can be installed from the <b>System → [[{{{name}}} Package Manager|Package Manager]]</b> page. | |||
[[File: | [[File:Networking_rutos_manual_administration_access_control_pam_v2.png|border|class=tlt-border]] | ||
== | ====Modify PAM Auth==== | ||
= | |||
---- | ---- | ||
[[File:Networking_rutos_manual_administration_access_control_pam_modify_pam_auth_v1.png|border|class=tlt-border]] | |||
[[File: | |||
<table class="nd-mantable"> | <table class="nd-mantable"> | ||
Line 215: | Line 440: | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Enable</td> | |||
<td>off {{!}} on; default: <b>on</b></td> | |||
<td>Turns the PAM auth on or off.</td> | |||
</tr> | |||
<tr> | |||
<td>Module</td> | |||
<td><span style="color:blue">TACACS+</span> {{!}} <span style="color:red">Radius</span> {{!}} Local; default: <b>Local</b></td> | |||
<td>Specifies the PAM module that implements the service.</td> | |||
</tr> | |||
<tr> | |||
<td>Type</td> | |||
<td>Required {{!}} Requisite {{!}} Sufficient {{!}} Optional; default: <b>Required </b></td> | |||
<td>Determines the continuation or failure behavior for the module</td> | |||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td><span style="color:blue">TACACS+</span>/<span style="color:red">Radius</span>: Server</td> | |||
<td>ip4 {{!}} ip6; default: <b>none</b></td> | |||
<td>The IP address of the RADIUS server</td> | |||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td><span style="color:blue">TACACS+</span>/<span style="color:red">Radius</span>: Secret</td> | |||
<td>string; default: <b>none</b></td> | |||
<td>RADIUS shared secret</td> | |||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td><span style="color:blue">TACACS+</span>/<span style="color:red">Radius</span>: Port</td> | |||
<td>integer [0..65535]; default: <b><span style="color:blue">49</span>/<span style="color:red">1812</span></b></td> | |||
<td>RADIUS server authentication port</td> | |||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td><span style="color:red">Radius</span>: Timeout</td> | |||
<td>integer [3..10]; default: <b>3</b></td> | |||
<td>Timeout in seconds waiting for RADIUS server reply.</td> | |||
</tr> | </tr> | ||
</table> | </table>}} | ||
===Security=== | |||
---- | |||
The <b>Security</b> tab provides the possibility to enable/disable blocking IP's service and delete blocked devices from the list. | |||
<b>IP Block Settings</b> | |||
---- | ---- | ||
[[File:Networking_rutos_manual_administration_access_control_security_v3.png|border|class=tlt-border]] | |||
[[File: | |||
<table class="nd-mantable"> | <table class="nd-mantable"> | ||
<tr> | <tr> | ||
Line 254: | Line 490: | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td> | <td>Enable</td> | ||
<td> | <td>off {{!}} on; default: <b>on</b></td> | ||
<td> | <td>Enable or disable blocking IP's if they have reached the set amount of failed times.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td> | <td>Fail count</td> | ||
<td> | <td>integer [1..1000]; default: <b>10</b></td> | ||
<td> | <td>An amount of times IP address can try to access SSH or WebUI before being blocked.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td> | <td>Clean after reboot</td> | ||
<td> | <td>off {{!}} on; default: <b>off</b></td> | ||
<td> | <td>If enabled, blocked loging attempts list will be cleared on device reboot.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Enable MAC blockig</td> | |||
<td>off {{!}} on; default: <b>off</b></td> | |||
<td>If enabled, MAC adresses wil be blocked.</td> | |||
<td>Enable | |||
<td>off | |||
<td> | |||
</tr> | </tr> | ||
</table> | </table> | ||
< | <b>Login Attempts</b> | ||
---- | ---- | ||
[[File:Networking_rutos_manual_administration_access_control_security_login.png|border|class=tlt-border]] | |||
[[File: | |||
<table class="nd-mantable"> | <table class="nd-mantable"> | ||
<tr> | <tr> | ||
Line 297: | Line 521: | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td> | <td>Source address</td> | ||
<td> | <td>IP address</td> | ||
<td> | <td>Shows the IP address from which the connection failed.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td> | <td>Device port</td> | ||
<td> | <td>Port number</td> | ||
<td> | <td>Shows the port number from which the connection failed.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td> | <td>Destination address</td> | ||
<td> | <td>IP address</td> | ||
<td> | <td>Shows yours device IP adress</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td> | <td>Protocol</td> | ||
<td> | <td>Connection protocol</td> | ||
<td> | <td>Displays the connection protocol used for connection.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td> | <td>Failed atempts</td> | ||
<td> | <td>Number</td> | ||
<td> | <td>Shows the number of failed attempts to connect to device.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td> | <td>Status</td> | ||
<td> | <td>- {{!}} Blocked</td> | ||
<td> | <td>Indicates whether the source address is blocked or not.</td> | ||
</tr> | |||
<tr> | |||
<td>Reset</td> | |||
<td>Check box</td> | |||
<td>Allows you to select multiple IP addresses.</td> | |||
</tr> | |||
<tr> | |||
<td>Unblock all</td> | |||
<td>-(interactive button)</td> | |||
<td>Unblocks all source adresses from the list.</td> | |||
</tr> | </tr> | ||
<tr> | |||
<td> | <td>Unblock selected</td> | ||
<td> | <td>-(interactive button)</td> | ||
<td> | <td>Unblocks selected source adresses from the list.</td> | ||
</tr> | </tr> | ||
</table> | </table> | ||
=== | {{#switch:{{{series}}}|TAP100|TAP200= ===Device Pairing=== | ||
---- | ---- | ||
[[File:Networking_rutos_manual_administration_access_control_pairing_v2.png|border|class=tlt-border]] | |||
[[File: | |||
<table class="nd-mantable"> | <table class="nd-mantable"> | ||
<tr> | <tr> | ||
Line 346: | Line 577: | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Enable</td> | |||
<td>off {{!}} on; default: <b>on</b></td> | |||
<td>Enable or disable device pairing.</td> | |||
</tr> | </tr> | ||
</table>|#default=}} | |||
{{#switch:{{{series}}}|TAP100|TAP200=|#default= | |||
==Recipients== | ==Recipients== | ||
The <b>Recipients</b> section is used to configure phone groups and email users, which can later be used along with SMS or email related services, such as [[{{{name}}} Events Reporting|Events Reporting]]. | The <b>Recipients</b> section is used to configure{{#ifeq:{{{mobile}}}|0| | phone groups and }}email | ||
users, which can later be used along with{{#ifeq:{{{mobile}}}|0| | SMS or }}email related | |||
services{{#ifeq:{{{events_reporting}}}|0|.|, such as [[{{{name}}} Events Reporting|Events Reporting]].}} | |||
{{#ifeq:{{{mobile}}}|0|| | |||
===Phone Groups=== | ===Phone Groups=== | ||
---- | ---- | ||
Line 384: | Line 598: | ||
<li>Enter a custom name for the phone group into the 'Name' field.</li> | <li>Enter a custom name for the phone group into the 'Name' field.</li> | ||
<li>Click the 'Add' button.</li> | <li>Click the 'Add' button.</li> | ||
</ol> | </ol> | ||
[[File: | [[File:Networking_rutos_manual_administration_recipients_phone_groups_add_button.png|border|class=tlt-border]] | ||
After clicking 'Edit' you should be redirected to that phone group's configuration page where you can start adding phone numbers to it. | After clicking 'Edit' you should be redirected to that phone group's configuration page where you can start adding phone numbers to it. | ||
Line 413: | Line 626: | ||
===Email Accounts=== | ===Email Accounts=== | ||
---- | ---- | ||
When email related services (such as [[{{{name}}} Events Reporting|Events Reporting]]) are used, the device logs in to the specified email account and reads the inbox (e.g., Email to SMS) or sends out a message (e.g., SMS to Email) depending on the configured service. In this context, an <b>Email Account</b> is an configuration instance that contains the necessary data required in order to log into an email account. | When email related services{{#ifeq:{{{events_reporting}}}|0| | (such as [[{{{name}}} Events Reporting|Events Reporting]]) }}are used, the device logs in to the specified email account and reads the inbox (e.g., Email to SMS) or sends out a message (e.g., SMS to Email) depending on the configured service. In this context, an <b>Email Account</b> is an configuration instance that contains the necessary data required in order to log into an email account. | ||
The email accounts list is empty by default thus, you must first add at least one new account before you can configure it. To create and begin editing an email account, follow these steps: | The email accounts list is empty by default thus, you must first add at least one new account before you can configure it. To create and begin editing an email account, follow these steps: | ||
Line 420: | Line 633: | ||
<li>Enter a custom name for the email account into the 'Name' field.</li> | <li>Enter a custom name for the email account into the 'Name' field.</li> | ||
<li>Click the 'Add' button.</li> | <li>Click the 'Add' button.</li> | ||
</ol> | </ol> | ||
[[File: | [[File:Networking_rutos_manual_administration_recipients_email_accounts_groups_add_button.png|border|class=tlt-border]] | ||
After clicking 'Edit' you should be redirected to that email account's settings page where you can start configuring the account. | After clicking 'Edit' you should be redirected to that email account's settings page where you can start configuring the account. | ||
[[File: | [[File:Networking_rutos_manual_administration_recipients_email_accounts_modify_email_account_v2.png|border|class=tlt-border]] | ||
<table class="nd-mantable"> | <table class="nd-mantable"> | ||
Line 451: | Line 663: | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td> | <td>Credentials</td> | ||
<td>off {{!}} on; default: <b>off</b></td> | |||
<td>This options allows you to set username and password of email account.</td> | |||
</tr> | |||
<tr> | |||
<td>Username</td> | |||
<td>string; default: <b>none</b></td> | <td>string; default: <b>none</b></td> | ||
<td>Username used to authenticate to the email service.</td> | <td>Username used to authenticate to the email service.</td> | ||
Line 465: | Line 682: | ||
<td>Configured SMTP server user's email address.</td> | <td>Configured SMTP server user's email address.</td> | ||
</tr> | </tr> | ||
</ | <tr> | ||
<td>Send test email</td> | |||
<td> - (interactive button)</td> | |||
<td> Sends an email based on the current configuration. This is used to test whether the configuration works as intended.</td> | |||
</tr> | |||
</table>}}}} | |||
}} | |||
{{#switch:{{{series}}}|TAP100|TAP200=|#default= | |||
==Certificates== | ==Certificates== | ||
The <b>Certificates</b> page is used for convenient TLS certificate and key generation and management. Generated files can be exported and used on other machines or locally on this device with functions that use TLS/SSL, such as [[{{{name}}} MQTT|MQTT]], [[{{{name}}} VPN#OpenVPN|OpenVPN]], [[{{{name}}} VPN#IPsec|IPsec]] and others. | The <b>Certificates</b> page is used for convenient TLS certificate and key generation and management. Generated files can be exported and used on other machines or locally on this device with functions that use TLS/SSL, such as {{#ifeq:{{{mqtt}}}|0||[[{{{name}}} MQTT|MQTT]], }}[[{{{name}}} VPN#OpenVPN|OpenVPN]], [[{{{name}}} VPN#IPsec|IPsec]] and others. | ||
===Certificate Generation=== | ===Certificate Generation=== | ||
Line 563: | Line 772: | ||
<tr> | <tr> | ||
<td>Delete Signing Request</td> | <td>Delete Signing Request</td> | ||
<td>off | <td>off {{!}} on; default: <b>off</b></td> | ||
<td>Generation creates additional 'signing request' files (which appear under the [[#Certificate_Manager|Certificate Manager]] tab) that are later used to sign the generated certificates. When this option is set to 'on', the device deletes the signing request files after the signing process is complete.</td> | <td>Generation creates additional 'signing request' files (which appear under the [[#Certificate_Manager|Certificate Manager]] tab) that are later used to sign the generated certificates. When this option is set to 'on', the device deletes the signing request files after the signing process is complete.</td> | ||
</tr> | </tr> | ||
Line 572: | Line 781: | ||
[[File:Networking_rutos_manual_administartion_certificates_certificates_generation_private_key_decryption_password_v1.png|border|class=tlt-border]] | [[File:Networking_rutos_manual_administartion_certificates_certificates_generation_private_key_decryption_password_v1.png|border|class=tlt-border]] | ||
===Certificate Signing=== | ====Certificate Signing==== | ||
---- | ---- | ||
The <b>Certificate Signing</b> section is used to validate (sign) unsigned certificates. | The <b>Certificate Signing</b> section is used to validate (sign) unsigned certificates. | ||
[[File: | [[File:Networking_rutos_manual_administartion_certificates_certificates_generation_certificate_signing_v2.png|border|class=tlt-border]] | ||
<table class="nd-mantable"> | <table class="nd-mantable"> | ||
Line 586: | Line 795: | ||
<tr> | <tr> | ||
<td>Signed Certificate Name</td> | <td>Signed Certificate Name</td> | ||
<td>string; default: <b> | <td>string; default: <b>none</b></td> | ||
<td>Name of the signed certificate.</td> | <td>Name of the signed certificate.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Type of Certificate to Sign</td> | <td>Type of Certificate to Sign</td> | ||
<td>Certificate Authority | <td>Certificate Authority {{!}} Client Certificate {{!}} Server Certificate; default: <b>Certificate Authority</b></td> | ||
<td>Specifies what type of file will be signed.</td> | <td>Specifies what type of file will be signed.</td> | ||
</tr> | </tr> | ||
Line 601: | Line 810: | ||
<tr> | <tr> | ||
<td>Days Valid</td> | <td>Days Valid</td> | ||
<td>integer; default: <b> | <td>integer; default: <b>none</b></td> | ||
<td>Length of the signature's validity.</td> | <td>Length of the signature's validity.</td> | ||
</tr> | </tr> | ||
Line 616: | Line 825: | ||
<tr> | <tr> | ||
<td>Delete Signing Request</td> | <td>Delete Signing Request</td> | ||
<td>off | <td>off {{!}} on; default: <b>off</b></td> | ||
<td>Generation creates additional 'signing request' files (which appear under the [[#Certificate_Manager|Certificate Manager]] tab) that are later used to sign the generated certificates. When this option is set to 'on', the device deletes the signing request files after the signing process is complete.</td> | <td>Generation creates additional 'signing request' files (which appear under the [[#Certificate_Manager|Certificate Manager]] tab) that are later used to sign the generated certificates. When this option is set to 'on', the device deletes the signing request files after the signing process is complete.</td> | ||
</tr> | </tr> | ||
Line 632: | Line 841: | ||
====Certificate Import==== | ====Certificate Import==== | ||
---- | ---- | ||
The <b>Certificate Import</b> section provides the possibility to import certificates and files generated on another machine. To upload such a file simply click 'Browse' | The <b>Certificate Import</b> section provides the possibility to import certificates and files generated on another machine. To upload such a file simply click 'Browse' and locate the file on your computer, it should then start uploading automatically. | ||
[[File: | [[File:Networking_rutos_manual_administartion_certificates_certificates_manager_certificate_import_v3.png|border|class=tlt-border]] | ||
====Certificates, Keys & Requests==== | ====Certificates, Keys & Requests==== | ||
---- | ---- | ||
The <b>Certificates</b>, <b>Keys</b> and < | The <b>Certificates</b>, <b>Keys</b> and <b>Requests</b> section display files generated on or imported to the device along with the most important information related to them. | ||
By default, the lists are empty. A set certificates generated using 'Simple' file type would look something like this: | By default, the lists are empty. A set certificates generated using 'Simple' file type would look something like this: | ||
[[File: | [[File:Networking_rutos_manual_administartion_certificates_certificates_manager_certificate_list_v2.png|border|class=tlt-border]] | ||
The 'Export' buttons are used to download the files from the device onto your local machine. The 'X' buttons located to the right of each entry are used to delete related files. | The 'Export' buttons are used to download the files from the device onto your local machine. The 'X' buttons located to the right of each entry are used to delete related files. | ||
== | ===Root CA=== | ||
---- | |||
The <b>Root CA</b> section is used to add a root CA certificate file to the device. There is a default file already preloaded on the device which will be overwritten by any uploaded file. The certificates must be in .pem format, maximum file size is 300 KB. These certificates are only needed if you want to use HTTPS for your services and the default file should be sufficient in most cases. | |||
[[File:Networking_rutos_manual_administration_access_control_root_ca_v1.png|border|class=tlt-border]]}} | |||
==Profiles== | |||
{{Template: Networking_rutos_manual_profiles | series = {{{series}}} | name = {{{name}}}}} | |||
{{#switch:{{{series}}}|TAP100|TAP200=|#default= | |||
==Storage Memory Expansion== | |||
{{#ifeq:{{{usb}}}| 1 | | |||
===USB=== | |||
---- | |||
The <b>Storage Memory Expansion</b> function provides the possibility to expand the device's flash memory with a USB mass storage device. | |||
====Memory Expansion==== | |||
---- | |||
You can <b>expand the flash memory</b> of this device with a USB Mass Storage Device (MSD) and use the extra memory to install additional software packages. This section provides instruction on how to do just that. However, there are a few prerequisites and warnings to take note of before using memory expansion. | |||
To be eligible for memory expansion, the USB MSD must meet the following restrictions. | |||
<ul> | |||
<li>The MSD must be the last one (chronologically) inserted.</li> | |||
<li>If you are using a USB hub, the target MSD must be the last one attached to the hub.</li> | |||
<li><b>No important data on the MSD as it will be wiped during expansion setup!</b></li> | |||
</ul> | |||
When expansion is enabled, <b>do not detach the USB device as this will delete the data stored on it</b>. Changes made to the device configuration while expansion was enabled will disappear after it is disabled. | |||
====Enabling memory expansion==== | |||
---- | |||
To successfully expand the flash memory of your device follow the steps described below. | |||
<ol> | |||
<li>Attach a USB Mass Storage Device (MSD) to the USB connector on the device and go to the Services → Storage Memory Expansion page.</li> | |||
<li>Set the 'Enable storage expansion' slider to 'on' and click 'Save & Apply'.<br>[[File:Networking_rutos_manual_storage_memory_expansion_enable_1.png|border|class=tlt-border]]</li> | |||
<li>You will see a pop-up asking for confirmation. Take note that <u>if you continue from this point on:</u> | |||
<ul> | |||
<li>your <b>USB device's memory will be wiped</b> and formatted to ext2 format;</li> | |||
<li>your device's <b>current configuration will be backed up</b> and restored to this point if the USB drive is removed or memory expansion is disabled;</li> | |||
<li>the entire procedure <b>may take a very long time</b> and includes a reboot at the end; exact time will vary depending on the size of the MSD (larger size will take longer; for example, using a 128 GB drive will take about 2 hours to fully set up, while a 16 GB will only take about 5 minutes).</li> | |||
</ul>Click 'Continue' to proceed.<br>[[File:Networking_rutos_manual_storage_memory_expansion_enable_2.png|border|class=tlt-border]] | |||
</li> | |||
<li>If all is in order you should see a 'Formatting MSD...' message on the screen. This indicates that the MSD is being formatted and integrated with the system. This procedure can take a long time and ends with a reboot of the device.<br>[[File:Networking_rutos_manual_storage_memory_expansion_enable_3.png]]</li> | |||
<li>Your device's flash memory will be expanded once the reboot has finished. In order to check, log in to the WebUI and look to the 'System' widget in the 'Overview' page. Hover your mouse cursor over the 'FLASH' memory indicator; you should see an increase to the device's flash memory.<br>[[File:Networking_rutos_manual_storage_memory_expansion_enable_4.png|border|class=tlt-border]]</li> | |||
</ol> | |||
====Disabling memory expansion==== | |||
---- | |||
To successfully disable memory expansion follow the steps described below. | |||
<ol> | |||
<li>Go to the Services → Storage Memory Expansion page.</li> | |||
<li>Set the 'Enable storage expansion' slider to 'off' and click 'Save & Apply'.<br>[[File:Networking_rutos_manual_storage_memory_expansion_disable_1.png|border|class=tlt-border]]</li> | |||
<li>You will see a pop-up asking for confirmation. Take note that <u>if you continue from this point on:</u> | |||
<ul> | |||
<li>your <b>USB device's memory will be wiped</b> and formatted to NTFS format;</li> | |||
<li>your <b>device's configuration will be restored</b> to the point it was before memory expansion;</li> | |||
<li>the entire procedure <b>will take up to 2 minutes</b> including a reboot.</li> | |||
</ul>Click 'Continue' to proceed.<br>[[File:Networking_rutos_manual_storage_memory_expansion_disable_2.png|border|class=tlt-border]] | |||
</li> | |||
<li>If all is in order you should see a 'Formatting MSD...' message on the screen. This indicates that the MSD is being formatted and detached from the system. This procedure can take up to a couple of minutes and ends with a reboot of the device.<br>[[File:Networking_rutos_manual_storage_memory_expansion_disable_3.png]]</li> | |||
<li>Your device's flash memory will be restored to normal once the reboot has finished. In order to check, log in to the WebUI and look to the 'System' widget in the 'Overview' page. Hover your mouse cursor over the 'FLASH' memory indicator; you should see your device's flash memory return to its regular size.<br>[[File:Networking_rutos_manual_storage_memory_expansion_disable_4.png|border|class=tlt-border]]</li> | |||
</ol>|}} | |||
===SSHFS=== | |||
---- | |||
<b>SSHFS</b> is a tool, which allows you to mount a remote filesystem (in remote SSH server) to your {{{name}}} device using SSH. | |||
This service is safe to use as it authenticates connections and encrypts them. | |||
<b>SSHFS</b> configuration consists of setting up authentication, port and mount information parameters. Below is an example oh the SSHFS configuration page. | |||
[[File:Networking_rutos_manual_sshfs_v3.png|border|class=tlt-border]] | |||
<table class="nd-mantable"> | |||
<tr> | |||
<th>Field</th> | |||
<th>Value</th> | |||
<th>Description</th> | |||
</tr> | |||
<tr> | |||
<td>Enable</td> | |||
<td>off {{!}} on; default: <b>off</b></td> | |||
<td>Turns the SSHFS service on or off.</td> | |||
</tr> | |||
<tr> | |||
<td>Hostname</td> | |||
<td>string; default: <b>none</b></td> | |||
<td>Hostname of the remote SSH server.</td> | |||
</tr> | |||
<tr> | |||
<td>Port</td> | |||
<td>integer [0..65535]; default: <b>none</b></td> | |||
<td>Port of the remote SSH server.</td> | |||
</tr> | |||
<tr> | |||
<td>Username</td> | |||
<td>string; default: <b>none</b></td> | |||
<td>Username of the remote SSH server.</td> | |||
</tr> | |||
<tr> | |||
<td>Password</td> | |||
<td>string; default: <b>none</b></td> | |||
<td>Password of the remote SSH server.</td> | |||
</tr> | |||
<tr> | |||
<td>Mount Point</td> | |||
<td>filepath; default: <b>/sshmount</b></td> | |||
<td>Mount point of remote file system <b>in the {{{name}}}</b>. Remote file system has to be mounted at root <b>/</b> level. | |||
By default the remote file system will be mounted on <b>/sshmount</b>, directory will be automatically created if does not exist yet.</td> | |||
</tr> | |||
<tr> | |||
<td>Mount Path</td> | |||
<td>filepath; default: <b>/home/</b></td> | |||
<td>Mount path <b>in the remote SSH server</b>. For example, if SSH server is hosted on Ubuntu operating system, the Mount Path could look like this (depending on your needs): <b>/home/username/</b></td> | |||
</tr> | |||
</table>}} | |||
[[Category:{{{name}}} System section]] | [[Category:{{{name}}} System section]] |