An Ideal Appliance?
AR Infotek's new entry into the network security appliance market is the Teak 3018, which the AR Infotek Web site bills as having “...reliable high performance that meets trusted wireless network security appliance requirements in ROBO (Remote Office, Branch Office), SOHO (Small Office, Home Office), SMB (Small/Medium Business) environments.”
That was part of the announcement that ran in all the Linux hardware rags in December '07 and January '08. A small, low-profile, hackable fanless box, the Teak 3018 looked to be a great entry into the realm of appliance hardware. It promoted itself as a solid platform with excellent capabilities, good security and an all-around solution for SOHO network security woes. We laid our grubby little paws on a pair of them and dug deep inside to answer some important questions about them:
Are they, as the press releases imply, consumer appliances, or are they something else?
Do they perform as advertised?
What other nefarious ends might they be put to by the intrepid hardware hacker?
After a lot of delving, digging, hacking and cataloging, I bring you the good, the bad, and the ugly of this unassuming-looking little brown box.
The Teak 3018 is compact, unobtrusive and looks pretty spiffy sitting on fashionable bookshelves—mostly because, unlike the rather gaudy Linksys firewalls, it stays out of the way, visually speaking. The whole thing, both in its design and implementation, is (as designed) fairly hospitable to Linux hackers. The CPU chipset and peripheral components are all well supported by the kernel, but just in case you're installing a distro that doesn't have the right drivers, it includes the source for the kernel modules and device drivers on the included SDK CD-ROM.
Under the hood, the Teak is a low-power x86 system. Specifically, it's a 500MHz AMD Geode LX-800 processor with the CS5536 companion device, equipped with 128–512MB of DDR RAM (128MB standard) soldered onto the motherboard. It sports a CompactFlash socket and a 2.5" hard drive bay with an Ultra DMA 66/100 IDE controller for your internal storage needs, as well as two OHCI-compliant USB 2.0 ports. A serial COM port gives auxiliary access for those wishing to hook up extra peripherals, such as a Linux console or a home automation device, while four 10/100Mbps auto-switching Ethernet ports—two of which have a hardware bridge that keeps your network signals traveling through the box in case of power failure—and a pair of Wi-Fi aerials hooked up to an Atheros 5004X SuperAG 802.11a/b/g chipset-based Wi-Fi module round out the feature set. Further icing on the cake is a watchdog timer, which can cause the system to reboot automatically if the software crashes.
The box the Teak sits in is sturdily built. Everything is securely bolted down. The top slides off easily after you remove just four screws, and the quality of the external design is a cut above—not only is it unobtrusive as previously mentioned, it also has a reset switch on the front, rather than hidden around back as is common on most SOHO network appliances. A front panel mounted set of four system status lights, and a pair of status lights located by each Ethernet port, let you verify the operation of your system as well. The power supply—external, to help maintain the fanlessness and keep the case quiet—has all the proper international safety certifications and provides very clean power from a wide range of power sources.
Of course, with a setup like that in an easily accessible box, you can build pretty much anything you like. AR Infotek's marketing and press releases for the 3018 pitch it as a network security appliance, but with that kind of open hardware sitting under the hood, you can make it sit up and do tricks with a little bit of work. Still, what review would be complete without a good look at whether the machine can do what it says it's supposed to be able to do?
The manual suggests a number of uses for the box, most of which are actually doable.
Table 1. Uses for the Teak
|Router||Possibly as a subnet router||Too few ports to be really useful as a general-purpose router.|
|Access pointers||Uncertain||It's hard to tell from the documentation what is meant by “access pointers”.|
|VPN endpoint||Yes||Hardware AES encryption is a plus.|
|Intrusion detection system||Yes|
|Bandwidth management device||Yes|
The hardware itself meets all the trusted wireless network security appliance requirements for ROBO, SOHO and SMB environments, with the AES encryption standard supported in hardware.
There are a few other interesting little tricks up the Teak's sleeve. The system is built on a commodity motherboard, which means it not only runs a standard Phoenix BIOS, but it also has a sound chip and, because it's an AMD chipset with an ATI graphics package, a video capture chip. Although the pinouts for the video capture hardware and the sound hardware aren't documented in the manual, they may be among the undocumented functions of J12. This isn't the kind of board that can easily be hacked up by a hardware hacker with a soldering iron—multilayer boards with flat packs aren't really designed for that sort of thing. If the interface pins were brought out onto pads or connectors, that'd be another thing entirely, but as it stands, some of the more interesting functions of the Geode chipset are inaccessible.
So, is the Teak a “network security appliance” suitable for small-/medium-sized business, small office/home office and remote office/branch office applications?
Unfortunately, that brings us to the bad part of the review.
Fast/Flexible Linux OS Recovery
On Demand Now
In this live one-hour webinar, learn how to enhance your existing backup strategies for complete disaster recovery preparedness using Storix System Backup Administrator (SBAdmin), a highly flexible full-system recovery solution for UNIX and Linux systems.
Join Linux Journal's Shawn Powers and David Huffman, President/CEO, Storix, Inc.
Free to Linux Journal readers.Register Now!
- Server Hardening
- BitTorrent Inc.'s Sync
- The Death of RoboVM
- EnterpriseDB's EDB Postgres Advanced Server and EDB Postgres Enterprise Manager
- The Humble Hacker?
- New Container Image Standard Promises More Portable Apps
- The US Government and Open-Source Software
- Open-Source Project Secretly Funded by CIA
- Canonical and BQ's Aquaris M10 Ubuntu Edition Tablet
- ACI Worldwide's UP Retail Payments
In modern computer systems, privacy and security are mandatory. However, connections from the outside over public networks automatically imply risks. One easily available solution to avoid eavesdroppers’ attempts is SSH. But, its wide adoption during the past 21 years has made it a target for attackers, so hardening your system properly is a must.
Additionally, in highly regulated markets, you must comply with specific operational requirements, proving that you conform to standards and even that you have included new mandatory authentication methods, such as two-factor authentication. In this ebook, I discuss SSH and how to configure and manage it to guarantee that your network is safe, your data is secure and that you comply with relevant regulations.Get the Guide