felixfoertsch/syncthing
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

Discovery clarifications

Browse Source
This commit is contained in:
Jakob Borg
2015-09-02 17:36:15 +02:00
parent f7573e99a7
commit f66a9046e7
1 changed files with 14 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
users/security.rst
+14 -9
View File
@@ -6,11 +6,11 @@ possible for an attacker to join a cluster uninvited, and it should not be
possible to extract private information from intercepted traffic. Currently this possible to extract private information from intercepted traffic. Currently this
is implemented as follows. is implemented as follows.
All traffic is protected by TLS. To prevent uninvited nodes from joining a All device to device traffic is protected by TLS. To prevent uninvited nodes
cluster, the certificate fingerprint of each node is compared to a preset list from joining a cluster, the certificate fingerprint of each node is compared
of acceptable nodes at connection establishment. The fingerprint is computed as to a preset list of acceptable nodes at connection establishment. The
the SHA-256 hash of the certificate and displayed in BASE32 encoding to form a fingerprint is computed as the SHA-256 hash of the certificate and displayed
reasonably compact and convenient string. in BASE32 encoding to form a reasonably compact and convenient string.
Incoming requests for file data are verified to the extent that the requested Incoming requests for file data are verified to the extent that the requested
file name must exist in the local index and the global model. file name must exist in the local index and the global model.
@@ -26,15 +26,20 @@ Global Discovery
~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~
When global discovery is enabled, Syncthing sends an announcement packet every When global discovery is enabled, Syncthing sends an announcement packet every
30 minutes to the global discovery server, so that it can keep a mapping between 30 minutes to the global discovery server so that it can keep a mapping
your device ID and external IP. Also, when connecting to other devices that have between your device ID and external IP. The packets contain the device ID and
not been seen on the local network, a query is sent to the global discovery listening port. Also, when connecting to other devices that have not been seen
server containing the device ID of the requested device. The discovery server is on the local network, a query is sent to the global discovery server
containing the device ID of the requested device. The discovery server is
currently hosted by :user:`calmh`. Global discovery defaults to **on**. currently hosted by :user:`calmh`. Global discovery defaults to **on**.
When turned off, devices with dynamic addresses not on the local network cannot When turned off, devices with dynamic addresses not on the local network cannot
be found and connected to. be found and connected to.
An eavesdropper on the Internet can deduce which machines are running
Syncthing with global discovery enabled, what their device IDs are, and what
device IDs they are attempting to connect to via global discovery.
If a different global discovery server is configured, no data is sent to the If a different global discovery server is configured, no data is sent to the
default global discovery server. default global discovery server.