search

cubieplayer / Cubian

Debian for Cubieboard
http://cubian.org
271 stars 49 forks source link

Ajenti "phones home" every time it starts. #366

Open madscifi opened 9 years ago

madscifi commented 9 years ago

Ajenti makes an http request of Ajenti.org every time it starts up.

Found in: Cubian-base-r8-a10.img

gcc, g++, and zile where all installed before I noticed the issue. No other system configuration changes where made.

Commands used to identify the issue:

cubie@Cubian:/etc/ajenti$ netstat -a
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
...
tcp        1      0 Cubian.lan:40008        j77268.servers.jif:http CLOSE_WAIT 
...

cubie@Cubian:/etc/ajenti$ sudo lsof -nl | egrep "TCP|UDP"
[sudo] password for cubie: 
...
ajenti-pa  1939             0   15u     IPv4       3693      0t0        TCP 192.168.0.160:40008->109.239.49.179:http (CLOSE_WAIT)
...
ajenti-pa  1939 2568        0   15u     IPv4       3693      0t0        TCP 192.168.0.160:40008->109.239.49.179:http (CLOSE_WAIT)
...

AjenTi.org WHOIS, DNS, & Domain Info - DomainTools
whois.domaintools.com/ajenti.org
AjenTi.org is hosted in Berlin, Berlin, DE at 109.239.49.179 and expires on 2014-10-19.
cubieplayer commented 9 years ago

Ajenti is not modified, I think it's the default behavior. If you don‘t need Ajenti, just disable it inserv -r ajenti. PS. The new version cubian X1 is released today, It allows you disable ajenti on first boot.

madscifi commented 9 years ago

The real problem with this is that no notice is given to the user. Since the purpose of this software is to administer a local machine, there is no good reason for it to make a request of a second or third party machine at startup. If they want to track usage that is their prerogative, but I think it is a generally accepted concept that the user must be notified that the software will do so.

If the socket had closed correctly I'd still be in the dark. I'm assuming, for the moment, that nothing of consequence is sent to ajenti, but at the moment I don't actually know that for a fact.

michalliu commented 9 years ago

Thanks for pointing out the issue. I agree with you, User must be notified before they send something back to there server as a administration tool. I haven't dig into the code, so my suggestion is if you service is information sensitive, you should remove the ajenti service.