I have seen tremendous amounts of guides on how to protect yourself when using a public wireless internet connection, but nothing about how to protect your public access point from malicious users.
A bit of background. I had bought this raspberry Pi and still nothing useful to do with it, and a spare USB WiFi Dongle(with an antenna). So I decided to share my internet connection when I'm not using it. So i have installed hostapd, use dnsmasq for dhcp, a squid proxy server (transparent with iptables redirecting port 80 to 3128). Note here that i'm aware of how short the lifetime of my SD card will be. Another point you should not consider is bandwidth usage consumption, since I have setup QoS on my gateway and hve unlimited internet (standard here, in France)
What I'm concerned about is I have no idea of what kind of security policy I should setup to prevent, say, someone to inject a malicious program inside the raspberry pi which will then infect not only every new client on the Wireless subnet, but any computer I have plugged to the local LAN.
I also feel concerned about how to protect any connected host from another malicious wifi user. Having had the same concern once at work, all I thought about would be ARP poisonning every host saying them any MAC address different from theirs is the access point, but that seems overkill and inefficient.
Here are my ideas:
- Block port 443 on any connection
- Install SquidGuard to enforce authorized/unauthorized websites (I tried, too CPU-intensive for a RPi)
- Restrict interactions on the local network (except the internet gateway) to SSH from my computer and HTTP for my monitoring tools
What I already have as a security measure :
- non-standard passwords for local users
sshdnot listening on wireless interface
httpdnot listening on wireless interface
- Regular backups of my
squidlogs on an offline media in case any legal source asks for them ?
So, what else should I set up, according to you?