lukas.im

Selling dehydrated

2020-01-30T01:14:00+01:00

TLDR: dehydrated will move, the license will NOT change, and I will still take care of the project

A few days ago I was approached by Julian from apilayer who told me that they wanted to buy dehydrated as a project and that they would even like to pay me to continue working on it. At first I thought it was a joke, but Julians profile seemed legit and after a few messages it was clear they really wanted to have my project.

They made an acceptable offer and after a good night's sleep I agreed.

It still feels a bit wrong to hand over this project I have been working on over the last few years, but as I'll effectively stay in charge of the project it made the decision a lot easier.

The following statement has been given by apilayer about this purchase:

As a highly developer focused company, apilayer has committed to use part of it’s profits to sponsor open source projects, both as support for the developer community and to generate uplift for our brands. We‘d like to welcome Lukas and the dehydrated community to our portfolio and are looking forward to support the project long-term."

As I didn't want a companies project in my personal GitHub account we decided to move it to a new namespace:

New versions of dehydrated will from now on be maintained at github.com/dehydrated-io/dehydrated.

Being paid will obviously be a great reason to invest more time into dehydrated and this will definitively accelerate my work on dehydrated, which in the last few months was a bit slow, but not stale:

I was already working on a new testing-system to make sure that new commits don't break compatibility with especially older systems and there are a few changes towards RFC8555-compliance. When these tasks are done the next big task on my long list will be better documentation, which I actually wanted to do since a long time ago and was actually the reason I registered the dehydrated.de/io Domains.

Other than that nothing should change for anybody. Dehydrated will stay as free (as in freedom and as in free beer) as always, you can use it for whatever you want. It will stay under the MIT-License.

Thank you for the support over the last few years, especially to the people who sent me small gifts along the way (which you can still do :P), but also for all the people reporting bugs and sending in fixes. And of course thanks to apilayer for this great opportunity!

Let's make the next few years even better ;)

Reinstall Debian over serial console

2016-03-26T00:26:00+01:00

I ordered an SC2016 at online.net yesterday, and wanted to reinstall it with encrypted rootfs.

All my other servers had KVM consoles and possibilities to mount CD images, but this one only had a serial console and a rescue system, so I had to be a little bit creative.

In the end the solution was to download the netboot image, load it with kexec and boot into that minimal system, after that I was able to continue the installation normally via the serial console.

apt-get install kexec-tools
wget http://ftp.fr.debian.org/debian/dists/jessie/main/installer-amd64/current/images/netboot/netboot.tar.gz
tar xvf netboot.tar.gz
kexec --load --initrd=debian-installer/amd64/initrd.gz debian-installer/amd64/linux --append="console=ttyS1,9600"
kexec -e

End of installation

At the end of the installation there is one more thing to do. First open a shell (by going back when it says it finished, and selecting the option to open a shell) and mount virtual paths into target:

mount --bind /dev /target/dev
mount --bind /sys /target/sys
mount --bind /proc /target/proc

Now edit /target/etc/default/grub, replace GRUB_CMDLINE_LINUX="" with GRUB_CMDLINE_LINUX="console=ttyS1,9600".

After editing the file chroot into target filesystem and update grub config:

chroot /target /bin/bash
update-grub # in chroot

If you want to you could also instruct grub to use the serial console, but in my case it did that automatically and if it ever stops working i'll just fix it using the rescue mode.

ASRock C2750D4I Fan-Control

2016-02-21T00:04:00+01:00

Just a quick note on how to reconfigure fan speeds on an ASRock C2750D4I (and similar) board without rebooting into BIOS.

Changes made this way should be kept over reboots but will be lost on powercycle (stored in volatile IPMI memory).

ipmitool raw 0x3a 0x01 0x(AA) 0x(BB) 0x(CC) 0x(DD) 0x(EE) 0x(FF) 0x00 0x00

AA: CPU_FAN1
BB: CPU_FAN2
CC: REAR_FAN1
DD: REAR_FAN2
EE: FRNT_FAN1
FF: FRNT_FAN2

0x00 smart fan(bios configured)
0x01 stoped fan
0x02 lower rpm value
......  
0x64 max rpm value

Configuring EdgeRouter for internet over PPTP (Part 2)

2016-02-20T23:47:00+01:00

In the last post I showed you how to configure an Ubiquiti EdgeRouter to use kernelmode PPTP.

This post will be a continuation on the general config, showing how to set up the local network.

Parts of this post may be specific to the configuration for Studierendenwerk Bonn, but most should work everywhere.

Also this probably isn't complete, I just wanted to provice a little insight for people figuring out how to use these devices.

Local Network: br0

For my local network I want to use a bridge, so this is how I have configured it:

ubnt@ubnt:~$ configure
[edit]
ubnt@ubnt# edit interfaces bridge br0
[edit interfaces bridge br0]
ubnt@ubnt# set address 10.25.11.1/24
[edit interfaces bridge br0]
ubnt@ubnt# set address 2a00:5ba0:8000:9e5b::1/64
[edit interfaces bridge br0]
ubnt@ubnt# set description "Local Network"
[edit interfaces bridge br0]
ubnt@ubnt# up
[edit interfaces]
ubnt@ubnt# edit ethernet eth0
[edit interfaces ethernet eth0]
ubnt@ubnt# delete address
[edit interfaces ethernet eth0]
ubnt@ubnt# set bridge-group bridge br0
[edit interfaces ethernet eth0]
ubnt@ubnt# commit
[ interfaces ethernet eth0 bridge-group ]
Adding interface eth0 to bridge br0

[edit interfaces ethernet eth0]
ubnt@ubnt# save
Saving configuration to '/config/config.boot'...
Done

DNS

Enable DNS forwarding on the router:

ubnt@ubnt:~$ configure
[edit]
ubnt@ubnt# set service dns forwarding listen-on br0
[edit]
ubnt@ubnt# commit
[edit]
ubnt@ubnt# save
Saving configuration to '/config/config.boot'...
Done

IPv4

DHCP server on br0

ubnt@ubnt:~$ configure
[edit]
ubnt@ubnt# edit service dhcp-server shared-network-name LAN
[edit service dhcp-server shared-network-name LAN]
ubnt@ubnt# set subnet 10.25.11.0/24
[edit service dhcp-server shared-network-name LAN]
ubnt@ubnt# edit subnet 10.25.11.0/24
[edit service dhcp-server shared-network-name LAN subnet 10.25.11.0/24]
ubnt@ubnt# set start 10.25.11.100 stop 10.25.11.200
[edit service dhcp-server shared-network-name LAN subnet 10.25.11.0/24]
ubnt@ubnt# set default-router 10.25.11.1
[edit service dhcp-server shared-network-name LAN subnet 10.25.11.0/24]
ubnt@ubnt# set dns-server 10.25.11.1
[edit service dhcp-server shared-network-name LAN subnet 10.25.11.0/24]
ubnt@ubnt# set domain-name ip
[edit service dhcp-server shared-network-name LAN subnet 10.25.11.0/24]
ubnt@ubnt# commit
[ service dhcp-server ]
Starting DHCP server daemon...

[edit service dhcp-server shared-network-name LAN subnet 10.25.11.0/24]
ubnt@ubnt# save
Saving configuration to '/config/config.boot'...
Done

Firewall

This is a lot of config, so I'll just give you the export of the config, you'll have to type the commands yourself:

ubnt@ubnt# show firewall name
 name LAN_IN {
     default-action accept
     description "Local network to internet"
 }
 name STW_IN {
     default-action drop
     description "STW to local network"
     rule 1 {
         action accept
         description "Allow established/related connections"
         log disable
         state {
             established enable
             related enable
         }
     }
     rule 2 {
         action drop
         description "Drop invalid packets"
         log disable
         state {
             invalid enable
         }
     }
 }
 name STW_LOCAL {
     default-action drop
     description "STW to router"
     rule 1 {
         action accept
         description "Allow established/related connections"
         log disable
         state {
             established enable
             related enable
         }
     }
     rule 2 {
         action drop
         description "Drop invalid packets"
         log disable
         state {
             invalid enable
         }
     }
     rule 3 {
         action drop
         description "Drop some ports, just to be sure they never get exposed."
         destination {
             port 21,22,23,80,443,843,3389,5631
         }
         log disable
         protocol tcp
     }
     rule 4 {
         action accept
         description "Allow icmp echo-requests"
         icmp {
             type-name echo-request
         }
         log disable
         protocol icmp
     }
     rule 5 {
         action accept
         description "Allow DHCP"
         destination {
             port 67,68
         }
         log disable
         protocol udp
         source {
             address 192.168.128.1-192.168.128.3
         }
     }
 }
 name STW_WAN_IN {
     default-action drop
     description "Internet to local network"
     rule 1 {
         action accept
         description "Allow established/related connections"
         log disable
         state {
             established enable
             related enable
         }
     }
     rule 2 {
         action drop
         description "Drop invalid packets"
         log disable
         state {
             invalid enable
         }
     }
 }
 name STW_WAN_LOCAL {
     default-action drop
     description "Internet to router"
     rule 1 {
         action accept
         description "Allow established/related connections"
         log disable
         state {
             established enable
             related enable
         }
     }
     rule 2 {
         action drop
         description "Drop invalid packets"
         log disable
         state {
             invalid enable
         }
     }
     rule 3 {
         action drop
         description "Drop some ports, just to be sure they never get exposed."
         destination {
             port 21,22,23,80,443,843,3389,5631
         }
         log disable
         protocol tcp
     }
     rule 4 {
         action accept
         description "Allow icmp echo-requests"
         icmp {
             type-name echo-request
         }
         log disable
         protocol icmp
     }
 }
[edit]

To enable these rules:

ubnt@ubnt:~$ configure
[edit]
ubnt@ubnt# set interfaces bridge br0 firewall in name LAN_IN
[edit]
ubnt@ubnt# set interfaces pptp-client pptpc0 firewall in name STW_WAN_IN
[edit]
ubnt@ubnt# set interfaces pptp-client pptpc0 firewall local name STW_WAN_LOCAL
[edit]
ubnt@ubnt# set interfaces ethernet eth1 firewall in name STW_IN
[edit]
ubnt@ubnt# set interfaces ethernet eth1 firewall local name STW_LOCAL
[edit]
ubnt@ubnt# commit
[edit]
ubnt@ubnt# save
Saving configuration to '/config/config.boot'...
Done

NAT

To enable NAT set the following configuration:

ubnt@ubnt:~$ configure
[edit]
ubnt@ubnt# edit service nat rule 5000
[edit service nat rule 5000]
ubnt@ubnt# set log disable
[edit service nat rule 5000]
ubnt@ubnt# set outbound-interface pptpc0
[edit service nat rule 5000]
ubnt@ubnt# set type masquerade
[edit service nat rule 5000]
ubnt@ubnt# set protocol all
[edit service nat rule 5000]
ubnt@ubnt# up
[edit service nat]
ubnt@ubnt# edit rule 5001
[edit service nat rule 5001]
ubnt@ubnt# set log disable
[edit service nat rule 5001]
ubnt@ubnt# set outbound-interface eth1
[edit service nat rule 5001]
ubnt@ubnt# set type masquerade
[edit service nat rule 5001]
ubnt@ubnt# set protocol all
[edit service nat rule 5001]
ubnt@ubnt# commit
[edit service nat rule 5001]
ubnt@ubnt# save
Saving configuration to '/config/config.boot'...
Done

At this point you should be able to connect to the internet on your local network. The internal network (between your PPTP server and your router) should also be rechable.

IPv6

Router Advertisements on br0

For IPv6 we want to enable router advertisements:

ubnt@ubnt:~$ configure
[edit]
ubnt@ubnt# edit interfaces bridge br0
[edit interfaces bridge br0]
ubnt@ubnt# set ipv6 router-advert prefix 2a00:5ba0:8000:9e5b::/64
[edit interfaces bridge br0]
ubnt@ubnt# set ipv6 router-advert send-advert true
[edit interfaces bridge br0]
ubnt@ubnt# set ipv6 router-advert name-server 2a00:5ba0:8000:9e5b::1
[edit interfaces bridge br0]
ubnt@ubnt# commit
[ interfaces bridge br0 ipv6 router-advert ]
Re-generating radvd config file for interface br0...
Starting radvd...
Starting radvd: radvd.

[edit interfaces bridge br0]
ubnt@ubnt# save
Saving configuration to '/config/config.boot'...
Done

Firewall

Again, a lot of configuration, here just the export:

ubnt@ubnt# show firewall ipv6-name
 ipv6-name LAN6_IN {
     default-action accept
 }
 ipv6-name STW6_IN {
     default-action drop
     description "STW to local network (IPv6)"
     rule 1 {
         action accept
         description "Allow established/related connections"
         log disable
         state {
             established enable
             related enable
         }
     }
     rule 2 {
         action drop
         description "Drop invalid packets"
         log disable
         state {
             invalid enable
         }
     }
     rule 3 {
         action accept
         description "Allow ICMPv6 echo-requests"
         icmpv6 {
             type echo-request
         }
         log disable
         protocol icmpv6
     }
     rule 4 {
         action accept
         description "Allow incoming SSH connections on various ports"
         destination {
             port 22,222,2222,1337
         }
         protocol tcp
     }
 }
 ipv6-name STW6_LOCAL {
     default-action drop
     description "STW to router (IPv6)"
     rule 1 {
         action accept
         description "Allow established/related connections"
         log disable
         state {
             established enable
             related enable
         }
     }
     rule 2 {
         action drop
         description "Drop invalid packets"
         state {
             invalid enable
         }
     }
     rule 3 {
         action accept
         description "Allow ICMPv6 echo-requests"
         icmpv6 {
             type echo-request
         }
         log disable
         protocol icmpv6
     }
 }
 ipv6-name STW_WAN6_IN {
     default-action drop
     description "Internet to local network (IPv6)"
     rule 1 {
         action accept
         description "Allow established/related connections"
         log disable
         state {
             established enable
             related enable
         }
     }
     rule 2 {
         action drop
         description "Drop invalid packets"
         log disable
         state {
             invalid enable
         }
     }
     rule 3 {
         action accept
         description "Allow ICMPv6 echo-requests"
         icmpv6 {
             type echo-request
         }
         log disable
         protocol icmpv6
     }
     rule 4 {
         action accept
         description "Allow incoming SSH connections on various ports"
         destination {
             port 22,222,2222,1337
         }
         protocol tcp
     }
 }
 ipv6-name STW_WAN6_LOCAL {
     default-action drop
     description "Internet to router (IPv6)"
     rule 1 {
         action accept
         description "Allow established/related connections"
         log disable
         state {
             established enable
             related enable
         }
     }
     rule 2 {
         action drop
         description "Drop invalid packets"
         state {
             invalid enable
         }
     }
     rule 3 {
         action accept
         description "Allow ICMPv6 echo-requests"
         icmpv6 {
             type echo-request
         }
         log disable
         protocol icmpv6
     }
     rule 4 {
         action accept
         description "Allow router advertisements"
         icmpv6 {
             type router-advertisement
         }
         log disable
         protocol icmpv6
     }
 }
[edit]

To enable that config:

ubnt@ubnt# set interfaces bridge br0 firewall in ipv6-name LAN6_IN
[edit]
ubnt@ubnt# set interfaces ethernet eth1 firewall in ipv6-name STW6_IN
[edit]
ubnt@ubnt# set interfaces ethernet eth1 firewall local ipv6-name STW6_LOCAL
[edit]
ubnt@ubnt# set interfaces pptp-client pptpc0 firewall in ipv6-name STW_WAN6_IN
[edit]
ubnt@ubnt# set interfaces pptp-client pptpc0 firewall local ipv6-name STW_WAN6_LOCAL

Fast PPTP client on Ubiquiti EdgeRouter (+ basic config for STW Bonn)

2016-02-13T22:00:00+01:00

I'm currently living in a building of Studierendenwerk Bonn and for our internet connection we have to use a PPTP client.

As a big fan of the Ubiquiti EdgeMax series of routers I wanted to use my EdgeRouter PoE for this, but there is a problem: PPTP on EdgeMax devices is running in Userland, and it is slow, very very slow. Of my 100Mbit/s connection i was only able to get around 12Mbit/s, this is not good.

Unfortunately Ubiquiti doesn't see improving this as a priority, so I'll have to fix it myself. Here is a tutorial on how to configure PPTP on EdgeMax devices to run with the pptp kernel module.

Important note

Sadly while actually improving the performance a lot, the finished result of this howto is not really what I would call "production-ready".

Some of the problems:

Packet loss (on my custom Debian based router and on openwrt which both use the same software this issue doesn't occure)
Firmware-Updates will remove some of the changes, requiring you to reapply them
Firmware-Updates may at some point have an updated pppd version, you'll have to find the correct header files again
Installing the required packages (further down) updates some essential system packages, which may at some point result in a (soft-)bricked router...

Also unrelated to the changes:

IPv6 on PPTP seems to be broken a little bit in EdgeMax firmware right now... it sets forwarding=1 but leaves accept_ra=1, which should be accept_ra=2...

DHCP on eth1

First step to get this working is to just enable DHCP (client) on eth1, to get a connection to the intranet:

ubnt@ubnt:~$ configure
[edit]
ubnt@ubnt# edit interfaces ethernet eth1
[edit interfaces ethernet eth1]
ubnt@ubnt# set address dhcp
[edit interfaces ethernet eth1]
ubnt@ubnt# set description "STW Intranet"
[edit interfaces ethernet eth1]
ubnt@ubnt# set dhcp-options default-route no-update
[edit interfaces ethernet eth1]
ubnt@ubnt# commit
[ interfaces ethernet eth1 address dhcp ]
Starting DHCP client on eth1 ...

[edit interfaces ethernet eth1]
ubnt@ubnt# save
Saving configuration to '/config/config.boot'...
Done
[edit]
ubnt@ubnt# exit

Also set up a route for the internal network:

ubnt@ubnt# set protocols static route 192.168.0.0/16 next-hop 192.168.128.1

Check that it is working by running show interfaces ethernet eth1 (outside of config mode). It should look like this:

eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN
    link/ether 24:a4:3c:05:6c:90 brd ff:ff:ff:ff:ff:ff
    inet 192.168.128.250/24 brd 192.168.128.255 scope global eth1
       valid_lft forever preferred_lft forever
    inet6 fe80::26a4:3cff:fe05:6c90/64 scope link
       valid_lft forever preferred_lft forever
    Description: STW Intranet

    RX:  bytes    packets     errors    dropped    overrun      mcast
          1978         19          0          0          0          0
    TX:  bytes    packets     errors    dropped    carrier collisions
          1134          7          0          0          0          0

At this point I rebooted my router to make sure that my route overrides were exactly as they should be.

PPTP configuration

After this just normally configure your PPTP connection:

ubnt@ubnt:~$ configure
[edit]
ubnt@ubnt# edit interfaces pptp-client pptpc0
[edit interfaces pptp-client pptpc0]
ubnt@ubnt# set server-ip vpn.stw-bonn.de
[edit interfaces pptp-client pptpc0]
ubnt@ubnt# set user-id z[...]
[edit interfaces pptp-client pptpc0]
ubnt@ubnt# set password [...]
[edit interfaces pptp-client pptpc0]
ubnt@ubnt# set default-route auto
[edit interfaces pptp-client pptpc0]
ubnt@ubnt# set description "STW VPN"
[edit interfaces pptp-client pptpc0]
ubnt@ubnt# set ipv6 enable
[edit interfaces pptp-client pptpc0]
ubnt@ubnt# set ipv6 address autoconf
[edit interfaces pptp-client pptpc0]
ubnt@ubnt# set mtu 1486
[edit interfaces pptp-client pptpc0]
ubnt@ubnt# commit
[ interfaces pptp-client pptpc0 ipv6 address autoconf ]
Address auto-configuration will be enabled when interface comes up.

[ interfaces pptp-client pptpc0 ipv6 dup-addr-detect-transmits 1 ]
Will set dup_addr_detect_transmits when pptpc0 comes up

[edit interfaces pptp-client pptpc0]

Again verify that everything is working to this point by running show interfaces pptp-client pptpc0 (again outside of config mode). It should look like this:

ubnt@ubnt:~$ show interfaces pptp-client pptpc0
pptpc0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1486 qdisc pfifo_fast state UNKNOWN qlen 100
    link/ppp
    inet 212.201.70.162 peer 192.168.1.31/32 scope global pptpc0
       valid_lft forever preferred_lft forever

    RX:  bytes    packets     errors    dropped    overrun      mcast
          3312         46          0          0          0          0
    TX:  bytes    packets     errors    dropped    carrier collisions
           186         10          0          0          0          0

At this point you should be able to ping the outside world from the router.

PPTP in Kernel

Now this is where it gets a bit ugly. We have to change quite a lot of stuff...

Kernel module

First we need to get root access: sudo -s.

Try loading the pptp kernel module with modprobe pptp, and add loading it to rc.local by running echo -e '#!/bin/sh -e\nmodprobe pptp\nexit 0' > /etc/rc.local.

Add Debian repository

We need to compile a different client, so we need to install some tools. For this we first add a debian repository.

Go back to config mode and set up the repository:

ubnt@ubnt# set system package repository debian url http://ftp.stw-bonn.de/debian/
[edit]
ubnt@ubnt# set system package repository debian distribution jessie
[edit]
ubnt@ubnt# set system package repository debian components "main"
[edit]
ubnt@ubnt# commit
[ system package repository debian ]
Adding new entry to /etc/apt/sources.list...

[edit]
ubnt@ubnt# save
Saving configuration to '/config/config.boot'...
Done
[edit]
ubnt@ubnt# exit

After this go back to a root shell and run apt-get update.

Install packages

Install required packages: apt-get install gcc g++ make cmake

If you get some questions while installing answer Restart services during package upgrades without asking? with no and on the question what to restart just press enter.

Get ppp headers

We can't install ppp-dev the normal way since (at least the Ubiquiti-modified) vyatta comes with its own (kinda outdated...) pppd, and apt would basically try uninstalling vyatta because of this... that's not good.

As a workaround we download and extract an archived package manually:

vbash-4.1# cd /config/user-data
vbash-4.1# mkdir ppp-dev
vbash-4.1# cd ppp-dev
vbash-4.1# curl -LO http://archive.debian.org/debian-archive/backports.org/pool/main/p/ppp/ppp-dev_2.4.4rel-1bpo1_all.deb
vbash-4.1# ar x ppp-dev_2.4.4rel-1bpo1_all.deb
vbash-4.1# rm control.tar.gz debian-binary ppp-dev_2.4.4rel-1bpo1_all.deb
vbash-4.1# gzip -d data.tar.gz
vbash-4.1# tar xf data.tar
vbash-4.1# cp -Ra usr /

Build accel-pptp

Now with everything in place we can build accel-pptp:

vbash-4.1# cd /config/user-data
vbash-4.1# curl -Lso accel-pptp.tar.gz https://github.com/winterheart/accel-pptp/archive/master.tar.gz
vbash-4.1# tar xf accel-pptp.tar.gz
vbash-4.1# rm accel-pptp.tar.gz
vbash-4.1# cd accel-pptp-master/
vbash-4.1# mkdir build
vbash-4.1# cd build
vbash-4.1# cmake -DPPP_PREFIX_DIR=/usr ../
vbash-4.1# make
vbash-4.1# make install
vbash-4.1# mv /usr/lib/pppd/2.4.4/pptp.so /usr/lib/pppd/pptp.so

Modify vyatta to use accel-pptp instead of pptp-linux

Run this and hope for the best:

vbash-4.1# cat > /opt/vyatta/share/vyatta-cfg/templates/interfaces/pptp-client/node.tag/server-ip/node.def << EOF
type: txt
help: Remote IP address or hostname for this tunnel [REQUIRED]

syntax:expression: pattern \$VAR(@) "^[[:alnum:]][-.[:alnum:]]*[[:alnum:]]\$"
                   ; "Invalid server \$VAR(@)"

update: sudo sed -i -e '/^pty/d' -e '/^plugin pptp.so/d' -e '/^pptp_server/d' /etc/ppp/peers/\$VAR(../@)
        sudo sh -c "echo plugin pptp.so >> /etc/ppp/peers/\$VAR(../@)"
        sudo sh -c "echo pptp_server \$VAR(@) >> /etc/ppp/peers/\$VAR(../@)"

delete: sudo sed -i -e '/^pty/d' -e '/^plugin pptp.so/d' -e '/^pptp_server/d' /etc/ppp/peers/$VAR(../@)
EOF

It replaces the definitions on how to generate the server-ip part of the pptp client config.

Regenerate ppp client config

To regenerate the ppp client config the easiest way is go into config mode, change a few settings, commit, change them back.

ubnt@ubnt:~$ configure
[edit]
ubnt@ubnt# edit interfaces pptp-client pptpc0
[edit interfaces pptp-client pptpc0]
ubnt@ubnt# set server-ip 127.0.0.1
[edit interfaces pptp-client pptpc0]
ubnt@ubnt# commit
[edit interfaces pptp-client pptpc0]
ubnt@ubnt# set server-ip vpn.stw-bonn.de
[edit interfaces pptp-client pptpc0]
ubnt@ubnt# commit
[edit interfaces pptp-client pptpc0]
ubnt@ubnt# save
Saving configuration to '/config/config.boot'...
Done
[edit]
ubnt@ubnt# exit

You can verify that it worked by looking at the client config. This is how it should look:

ubnt@ubnt:~$ tail -n2 /etc/ppp/peers/pptpc0
plugin pptp.so
pptp_server vpn.stw-bonn.de

Troubleshooting

If you ever run into a problem and need internet access to get something working you have to remove the plugin pptp.so and pptp_server vpn.stw-bonn.de lines and add pty "/usr/sbin/pptp vpn.stw-bonn.de --nolaunchpppd" to /etc/ppp/peers/pptpc0.

IPv6 workaround

We need a workaround to enable IPv6 on the pptp client interface:

ubnt@ubnt:~$ sudo -s
vbash-4.1# mkdir -p /config/scripts/ppp/ip-up.d
vbash-4.1# cat > /config/scripts/ppp/ip-up.d/autoconf.sh << EOF
#!/bin/bash
sysctl -w net.ipv6.conf.pptpc0.autoconf=2
sysctl -w net.ipv6.conf.pptpc0.accept_ra=2
ip -6 addr flush dev pptpc0
ip -6 addr add \$(ip -6 addr show eth1 | grep fe80:: | awk '{print \$2}' | awk -F ':' '{print \$1"::"1337":"\$4":"\$5":"\$6}') dev pptpc0
EOF
vbash-4.1# chmod a+x /config/scripts/ppp/ip-up.d/autoconf.sh

This sets the appropriate system configuration to allow autoconf on forwarding devices and adds a link local address (derived from eth1 address) to the pptp client interface.

Nearly Done

You now should have pptp working in your kernel, making it a lot faster.

But: You are not yet finished configuring your router! You'll need to configure your local network and you'll need to define firewall rules!

letsencrypt.sh

2016-02-10T12:49:00+01:00

Trusted SSL certificates used to cost money, but in the past companies like StartCom already started to hand out domain-verified certificates for free, but now we have Let's Encrypt, which takes a different approach.

How it used to work in the past

Getting one of those certificates usually involved signing up for an account, starting a domain verification by letting StartCom send you a pin to an email address associated with your domain, starting the signing process by either letting startcom generate a key for you or uploading a CSR, waiting a few minutes to hours until your certificate got signed, installing the certificate on your server, looking at tons of forum entries to exactly know which CA certificates to include in your certificate chain, and just like that, you had your site available over trusted https! Yay! \o/

Let's Encrypt!

Let's Encrypt takes a different approach.

Instead of you having to do all these manual steps it was designed to be nearly fully automatic. The whole process from registering an account to getting your domain signed only takes a few seconds.
It also can install the certificate for you, no more hassle trying to figure out which files to use!

Isn't that great?! Yay! \o/

Well... kinda... but.

The official client is great if you are just getting started setting up a server, having a simple webserver configuration and absolutely nothing writing to your config files. In a lot of automated and/or more complex setups this will fail.

Not so great, but okay, with some additional parameters it basically allows you to work around this.

curl | sh...ish

A different problem (at least for me) was the approach of how this updates itself. Every time you run the official client it looks for a newer version of itself and may also install some python modules into it's virtualenv. It mostly doesn't use your package manager, and it downloads and runs code (intended to run as root!) automatically, which is kinda bad.

You can install all the requirements manually and set it up to now download stuff, but that's kinda annoying.

No space left on device

Another problem is the size of the requirements. The client is written in python, requiring you to basically install python and all the other requirements, which is quite big, and may result in a few problems on some systems that just don't have much space.

Think of a tiny ARM-based linux board with 1G nand (or even smaller, like 128MB in a router or something similar). You really don't want that stuff on there.

This is where letsencrypt.sh comes in.

letsencrypt.sh

I was reading Hacker News when I found a link to a very tiny python based client for letsencrypt.

Reading the script I noticed that most of the important stuff was just wrapped around the openssl binary, and when it comes to wrapping stuff around a binary what do I think of? My shell of course!

I started with a very simple proof of concept, basically being just able to send a request to Boulder (the server-side of ACME, the protocol used by Let's Encrypt).
This initial step was basically just trying to register an account key with Let's Encrypt, and after that worked I started expanding the script, and finally pushed a first version to GitHub.

This first version was very simple, it generated a key and signing-request, created the files needed for domain verification, and finally received the certificate from Boulder. Nothing too complicated, but well... There was little to no error handling, it was working, but if something went wrong you could easily have erased your certificate... Not so great...

But that was fixed, there is a lot more error handling, also old certificates and keys are not deleted, just a symlink gets changed, so if anything still goes wrong you can easily go back to the last working state.

It now also works on BSD and with ZSH instead of just GNU/Linux and Bash.

People started adding a lot of features to letsencrypt.sh:

certificate revocation (thanks to germeier)
expiration checks (thanks to tralafiti)
domain name config change detection (thanks to germeier)
DNS-01 verification (thanks to germeier)
support for Elliptic Curve Cryptography (thanks to germeier)
signing of custom CSRs (thanks to nielslaukens)
custom hooks at a lot of places inside letsencrypt.sh (initial implementation thanks to rudis)

What started as a simple proof of concept is now basically a fully fledged client for Let's Encrypt (or any other ACME server).

Also thanks to all the other people who contributed to this project up to now or in the future! Have a look at the contributors graph to see who else worked on this.

Replace broken USB-Stick in Ubiquiti EdgeMax routers

2016-01-25T19:48:00+01:00

In this blog post I'm going to explain how to replace a broken USB-stick in Ubiquiti EdgeMax Routers or in this case the Ubiquiti EdgeMax EdgeRouter-POE. This guide can also be used to recover from a failed firmware update.

First thing you have to do is to get a new USB-stick. The stick has to be very slim (basically not wider than the USB-port itself). Also you have to be a bit careful as the EdgeMax routers are very picky about the stick in use, if your stick takes too long to be recognized by the system it won't boot. I used an Kingston DataTraveler DTSE9H 8GB USB-stick, which seems to work fine, I think you need at least 4GB for the stick to work as that is the size of the original USB-stick.

To take the EdgeRouter apart take out the screws on the back (you don't need to remove the ground-screw-terminal) and slide the cover from the router.

Internally it looks like this (the stick is on the right-hand side):

To prepare your stick format it with FAT32 using an MBR partition scheme.

After formatting the stick go to http://packages.vyos.net/tools/emrk/0.9c/ and download emrk-0.9c.bin. Copy that file on the stick, eject it and plug it into the internal USB-socket of your router.

Plug a console cable into your router and connect the first network port of the router to your network. Open a serial terminal on your computer and connect power to the router.

You should see something like this:

The vmlinux.64 error is normal, it is shown because the stick doesn't contain EdgeOS yet. Take a good look at the USB section, it should show your USB stick. If you get any errors or warnings about USB devices the router will not (always) boot! It may also be a good idea to power-cycle the router a few times just to make sure it recognizes the stick every single time.

After these "debug" messages you are dropped to a bootloader shell. We want to load emrk-0.9c.bin from the stick so we run fatload usb 0 $loadaddr emrk-0.9c.bin. It should print a few dots followed by a message like 15665511 bytes read and shouldn't display any errors. When this is done we can boot into that image by executing bootoctlinux $loadaddr. It should now start booting a very minimal Linux (rescue) system, will ask you to accept the disclaimer and you need to configure a network connection (I used DHCP). The router will need internet access for the next step to work!

In the rescue-system we type emrk-reinstall for a full reformat and reinstall of EdgeOS on the stick. It will ask for an EdgeOS download URL. For ER-lite and ER-POE that URL is (at the time of writing this) http://dl.ubnt.com/firmwares/edgemax/v1.7.0/ER-e100.v1.7.0.4783374.tar. You can get that URL from the Firmware Download page on https://ubnt.com.

The whole reinstall process while look like this:

After this disconnect your network cable (to avoid conflicts) and type reboot. I'd suggest not to disconnect power at this point, as that may corrupt the newly created filesystems as they may not have been completely written to the stick yet). After the reboot it should be fine.

It should now boot EdgeOS from the new stick. The default login will be ubnt as both username and password.

Hide process list from users

2014-07-22T15:48:00+02:00

If you have multiple users on a single machine every user can normally see all running processes, their own, other users processes and even system processes. Sometimes people append sensitive data like passwords to a command, and since you can see the process list you'll also get that password, which isn't good.

One solution would be to teach all your users to never ever do this, as if that would work... Also sometimes you may not even do this yourself but an installer script could download a piece of software with the product serial as parameter of the URL or something similar.

The better solution is to hide processes the user isn't controlling.

To do this temporarily you can run mount -o remount,hidepid=2 /proc, which will remount /proc (the directory containing all process information) with the hidepid parameter which will control what a user can see. As root you'll continue seeing all processes.

To get this as a permanent setting you can alter /etc/fstab to have a line for /proc looking something like this:

proc /proc proc defaults,hidepid=2 0 0

Here under "4.1 Mount options" you can find a few more details. There also is an option to allow a group to see all processes which could be useful if you have non-root admin accounts.

dpkg-divert

2014-07-15T01:07:00+02:00

Just a short note for myself...

To move a dpkg-managed file out of the way:

dpkg-divert --rename --divert /usr/share/initramfs-tools/dropbear.original /usr/share/initramfs-tools/scripts/init-premount/dropbear

Copy and edit original.

cp /usr/share/initramfs-tools/dropbear.original /usr/share/initramfs-tools/scripts/init-premount/dropbear
ed /usr/share/initramfs-tools/scripts/init-premount/dropbear

Power over Ethernet on Raspberry Pi

2014-07-13T23:50:00+02:00

I have a few devices that support (passive) power-over-ethernet, and I quite like that as I don't need a power supply for every single device filling up my power strip and I even can mount devices further away where there is no power available.

The Raspberry Pi board normally has two ways of getting power: You can either connect a Micro-USB cable, or you can use the GPIO headers to inject power.

I don't like using both of these methods. Most (cheap) Micro-USB cables I used didn't carry enough power to reliably power the Raspberry Pi, and with GPIO headers you have to connect wires to it every single time (or build a chunky breakout board with a 5V power socket or something).

Since I did have a few switch-mode power supplies laying around that were able to convert down from 24V (my passive-POE voltage) to 5V without any problems I decided to mount one of those inside a Raspberry Pi and connect it to the unused power-carrying pins of the ethernet socket.

Power over Ethernet

The first thing I needed to do was to actually get to the connections carrying power over the network cable, but that wasn't that easy because the Raspberry Pi is using an RJ45 socket with internal magnetics, so there is no power on the pins on the board! I needed to open and modify that socket.

I carefully pried it open, cut away a piece of plastic and was able to see the 8 pins of the actual RJ45 socket in front of the magnetics.

From left to right those pins are: GND, GND, DATA, 24V, 24V, DATA, DATA, DATA

I connected both ground and 24V pins and attached pieces of wire.

Power Supply 24V -> 5V

So... the "tiny" power supply I had wasn't that tiny after all, it didn't fit nicely into the case I wanted to use, so I had to desolder the Micro-USB socket and the filtering cap. I also needed to desolder and move the 3.3V regulator and naturally I destroyed it while doing that and had to replace it.

DIY IP-KVM

2014-06-01T01:07:00+02:00

Note: This is a slightly updated version of the old blogpost (re-written on 2016/01/25).

I really like IP-KVMs. They are great devices that allow you to directly connect to and control your computer from basically anywhere in the world, even if your system crashed or your network card died. Also you can access the bios settings and raid configuration utilities which wouldn't be possible with normal remote-desktop tools.

Some of there devices also have a possibility to attach "virtual media" to your device, essentially allowing you to boot your remote system off an iso image on your local system, giving you a lot of possibilities to reinstall or rescue an operating system.

There are quite a few IP-KVMs on the market, but they are quite expensive (cheap ones starting at over 250€), and they often run outdated and insecure (custom) software. Also these devices often need Java or Flash for their client software, which is an absolute no-go for me. These tools also often have problems with keyboard layouts, mouse positioning/acceleration and are very slow (low fps and ultra slow speed for virtual media).

It's okay(ish) for rescuing a system, but it's far from good.

So... the plan is to build an IP-KVM myself, keeping price relatively low while having a better user experience than commercial devices.

Hardware

In total with required cables and SD-Card around 150€.

With a few changes in hardware selection the price probably can be under 100€.

OLinuXino

The OLinuXino A20 Micro is used as the heart of this device. It controls the video-streaming, keyboard inputs and as it supports USB-OTG it can emulate a USB-connected cd/dvd-drive using a normal ISO file.

Alternatively you can use OLinuXino-Lime(2), Beaglebone Black or similar devices, but if you want to use it as virtual media you need a board with USB-OTG, so that wouldn't work with e.g. a Raspberry Pi.

I originally wanted to use my Beaglebone Black for this experiment, but I accidentally shorted out some Pins and fried my board... Meh.

VGA -> S-Video -> USB

How do we get a video signal into the device? Well, over USB of course!

I started looking for VGA to USB devices, and I actually found a few, but they were horribly expensive... More expensive than commercial IP-KVM solutions... That's no good.

So we need a workaround...

Quality doesn't really matter as all we need is to be able to read some text and navigate some menus, after all this is just for installing and configuring an OS, and not really anything else. Don't expect ultra fluid low-latency HD graphics for gaming :'D

So... the idea is: People want to connect notebooks and computers to their TVs. What do (almost all) TVs have? S-Video and composite inputs! So these adapters (VGA->S-Video) are quite cheap, you can grab one for 20€ on Amazon (or quite a bit cheaper directly from China).

I also had a DVB-T stick with S-Video input laying around that I bought for around 80€ a few years back, so I knew that there are cheap(ish) devices for capturing S-Video. After looking around I found a few USB devices capable of capturing S-Video. I decided on one that was available for just 11€ on Amazon. There was a cheaper one, which probably would also have worked, but it didn't have any reviews. Directly from China these devices are probably even cheaper.

After trying this out I was quite amazed about the picture quality. I expected far worse. Only problem I noticed was that sometimes the VGA adapter stops working, but power-cycling always helped, so maybe adding a reset-functionality would solve this problem (components like a mosfet or relay and some other stuff would only be a few euros and could be controlled by the OLinuXino).

As I didn't like having all these cables laying around I decided to combine the capture-stick and the adapter into one device, which now looks like this:

STM32F4-Discovery

I found it quite hard to get a combined usb-device running with the old Linux kernel version I was running back when originally writing this blog post, so I decided to use an STM32F4-Discovery as U(S)ART controlled USB keyboard.

At the point of re-writing this post (mostly for translation purposes) the Linux mainline kernel has support for USB-OTG on A20 SoCs, and therefore newer USB-OTG functionality can be used, which should make it actually quite easy to combine HID and virtual media, basically getting rid completely of the STM32F4 in this build.

I may actually try to get this running in the near future. Also I'll probably rewrite most of the software I already had.

Software

Linux Kernel

Back when writing this post originally it was best to use the linux-sunxi-kernel on A20 based boards, but nowadays all required features are in linux-mainline and if you want to try to build this yourself you should go with that.

If you want to use the sunxi kernel for whatever reason you'll need to install some backports to get some newer capture devices running. These can be found on linuxtv.org.

I have a very outdated fork which contains some patches to get these backports to compile and also includes AUFS which I wanted back in the day... no idea why.

To build a Debian package with the kernel, media modules and kernel headers I put together a small buildsystem. No idea if that still works.

Video-Streaming...

...is one of the most complicating things I've ever tried to do on a computer.

I tried tools like mjpg-streamer (wrong colors and high lag), some cgi-scripts for capturing single MJPG-frames (memory leak, only 1 client/browser or it would fail), and I tried some other pieces of software, but all failed eventually, except for VLC...

Nobody on the internet seems to want to stream Video from /dev/video0 to a browser with low(ish) latency... It was quite some work to get VLC working as intended, and it was especially annoying that the version of VLC without X bindings in the Debian repository wasn't compiled with ffmpeg-encoder-support, so I had to install the full package with all X requirements it had.

So, after all this, here is the magic command that actually worked:

#!/bin/sh
vlc \
  -I dummy \
  --control dummy \
  --no-disable-screensaver \
  v4l:///dev/video0 \
  :v4l2-standard=NTSC_M \
  :v4l2-input=4 \
  :v4l2-fps=0 \
  :no-v4l2-use-libv4l2 \
  :v4l2-controls-reset \
  \
  :live-caching=100 \
  \
  :sout=#transcode{vcodec=MJPG,width=720,height=480,vb=40000,scale=1,acodec=none,venc=ffmpeg{strict=1}}:http{mux=mpjpeg,dst=127.0.0.1:8080/video.mjpg} \
  :sout-keep \
  --sout-ffmpeg-qscale=1 \
  --sout-http-mime="multipart/x-mixed-replace;boundary=--7b3cc56e5f51db803f790dad720ed50a"

If I'd do this again I'd probably take a (brief) look at gstreamer.

USB CD/DVD-Drive

modprobe g_mass_storage stall=0 cdrom=1 removable=1 nofua=1
echo /tmp/debian.iso > /sys/devices/platform/sw_usb_udc/gadget/lun0/file

Done. It's really that easy. Don't forget the stall=0 or your kernel will... stall.

This may be a tiny bit more complicated if you want to combine it with a HID device, but not really much harder.

Webinterface

The webinterface is a tiny python-script using flask and some client-side javascript.

I don't have the code anymore but here is what it was basically doing:

Generated a list of ISO-files, providing a selection (including "None") which ISO should be mounted and showing which ISO was currently in use. It basically controls lun0/file.
It received keyDown and keyUp events, translated the keycodes according to the ~~configured~~ hardcoded keyboard layout (this was a bit of a pain to figure out, I now see why pre-build IP-KVMs have problems with this), and sent them over U(S)ART to the STM32F4-Discovery board, which translated it into USB-HID keyboard commands.
It also had the capability to drive a GPIO pin to reset the STM32F4, and I wanted to have another pin to reset the VGA->S-Video adapter, but i never got around to build that.

Reverse-Proxy

I'm using nginx as reverse-proxy to combine the webinterface and mjpg-stream into one page and also to add SSL and authentication. This was a lot easier than writing this as custom code in the webinterface script.

Here is the important part of the nginx config:

    auth_basic "KaputtKVM";
    auth_basic_user_file /etc/nginx/htpasswd;
    default_type application/octet-stream;

    upstream kaputtkvm  {
        server 127.0.0.1:5000;
    }

    upstream videostream  {
        server 127.0.0.1:8080;
    }

    [...]
        location / {
            proxy_pass  http://kaputtkvm;
            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
            proxy_redirect off;
            proxy_buffering off;
        }

        location /video.mjpg {
            proxy_pass  http://videostream;
            proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
            proxy_redirect off;
            proxy_buffering off;
        }
    [...]

STM32-USB-Keyboard Firmware

...wasn't that much fun either.

I build a libopencm3 based Firmware for the STM32F4-Discovery which acts as an U(S)ART controlled USB keyboard.

The firmware was working quite good, but had some problems, especially USB resets weren't really recognized, which sometimes resulted in problems using it in bios.

As I already stated a few times nowadays it's probably better to just do this on the OLinuXino board as well, but that wasn't possible when I first wrote this stuff.

🇩🇪 Fledermaus-Lichtschranken-Fail

2014-05-27T05:57:00+02:00

Nur kurz am Rande: Der Fledermauslichtschrankenaufbau hat uns über knapp einen Monat wunderbar Daten geliefert, danach fielen jedoch nach und nach die Sensoren aus.

Das Problem: Wildbienen. Die Tiere scheinen sich wohl im Infrarot-Licht wohl zu fühlen... naja... das Experiment ist jetzt auf jeden Fall abgebrochen.

Resize CoreOS rootfs

2014-04-07T19:27:00+02:00

I was playing around with CoreOS in the last few days and i had a problem that the "installer" only created a 3GB GPT-label, with the problem that the backup header wasn't at the end of my disk but at the end of this 3GB section, so I couldn't just resize my rootfs to the full disk.

To resize the ROOT-filesystem we'll have to move this backup data to the end of the disk:

localhost core # gdisk /dev/sda
GPT fdisk (gdisk) version 0.8.6

Partition table scan:
  MBR: protective
  BSD: not present
  APM: not present
  GPT: present

Found valid GPT with protective MBR; using GPT.

Command (? for help): x

Expert command (? for help): e
Relocating backup data structures to the end of the disk

Expert command (? for help): m

Command (? for help): w

Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING
PARTITIONS!!

Do you want to proceed? (Y/N): Y
OK; writing new GUID partition table (GPT) to /dev/sda.
Warning: The kernel is still using the old partition table.
The new table will be used at the next reboot.
The operation has completed successfully.
localhost core # reboot

After a reboot we open gdisk again, delete the ROOT-partition and recreate it with the same starting sector and the default end sector (which normally is the highest possible value). Partition type should be FFFF.

localhost core # gdisk /dev/sda
GPT fdisk (gdisk) version 0.8.6

Partition table scan:
  MBR: protective
  BSD: not present
  APM: not present
  GPT: present

Found valid GPT with protective MBR; using GPT.

Command (? for help): p
Disk /dev/sda: 234441648 sectors, 111.8 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): 83A877DF-4A87-1E4A-B413-BEABFD879D68
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 234441614
Partitions will be aligned on 2048-sector boundaries
Total free space is 228543341 sectors (109.0 GiB)

Number  Start (sector)    End (sector)  Size       Code  Name
   1            2048          264191   128.0 MiB   EF00  EFI-SYSTEM
   2         2361344         2492415   64.0 MiB    FFFF  BOOT-B
   3          264192         2361343   1024.0 MiB  FFFF  USR-A
   4         2492416         4589567   1024.0 MiB  FFFF  USR-B
   6         4589568         4851711   128.0 MiB   8300  OEM
   9         4851712         5900287   512.0 MiB   FFFF  ROOT

Command (? for help): d
Partition number (1-9): 9

Command (? for help): n
Partition number (5-128, default 5): 9
First sector (34-234441614, default = 4851712) or {+-}size{KMGTP}: 4851712
Last sector (4851712-234441614, default = 234441614) or {+-}size{KMGTP}:
Current type is 'Linux filesystem'
Hex code or GUID (L to show codes, Enter = 8300): FFFF
Exact type match not found for type code FFFF; assigning type code for
'Linux filesystem'
Changed type of partition to 'Linux filesystem'

Command (? for help): w

Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING
PARTITIONS!!

Do you want to proceed? (Y/N): Y
OK; writing new GUID partition table (GPT) to /dev/sda.
Warning: The kernel is still using the old partition table.
The new table will be used at the next reboot.
The operation has completed successfully.
localhost core # reboot

After another reboot we now can resize the btrfs filesystem to the whole partition:

localhost core # btrfs filesystem resize max /
Resize '/' of 'max'

Using df -h / should now show the new size:

localhost core # df -h /
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda9       110G  537M  109G   1% /

Outgoing IPv6-address

2014-04-07T17:27:00+02:00

On my server I have multiple IPv6 addresses, but I want to define that all outgoing connections should always use one specific address.

On Linux there is an option to mark an IPv6 address as "deprecated", you can do that by setting the address parameter preferred_lft to 0. After that the address is still reachable, and you can still respond over it, but Linux will newer use it for new outgoing connections.

My network config now looks like this:

auto 6in4
iface 6in4 inet6 v4tunnel
    address 2001:4dd0:ff00:189b::2
    netmask 64
    endpoint 78.35.24.124
    gateway 2001:4dd0:ff00:189b::1
    up ip -6 addr add 2001:4dd0:ff00:989b::1/64 dev 6in4 preferred_lft 1
    up ip -6 addr change 2001:4dd0:ff00:189b::2 dev 6in4 preferred_lft 0
    down ip -6 addr del 2001:4dd0:ff00:989b::1/64 dev 6in4

This creates a 6in4 device, sets the IPv6 address that SixXs assigned my tunnel, and afterwards runs the commands which marks the original address as "deprecated" and adds a new one from the subnet I get routed to the original address.

Now the server can be reached over both addresses, but any outgoing connections will come from 2001:4dd0:ff00:989b::1.

🇩🇪 Fledermaus Lichtschranke

2014-03-14T17:20:00+01:00

Eine Lichtschrankeninstallation zur Überwachung von Fledermausbewegungen an einem Quartier

Software: https://github.com/lukas2511/FlederSchranke (Installationsanleitung)

Idee

Anfang dieses Jahres hat mich Martin vom Bonner Arbeitskreis für Fledermausschutz BAFF angeschrieben und mich um Hilfe bei einigen Projekten gebeten um die Bewegungen von Fledermäusen nachvollziehen zu können.

Konkreter ging es in der ersten Mail um eine Lichtschranke, welche an einem Dachbodenfenster montiert werden soll, und dort Aufzeichnen sollte zu welchen Uhrzeiten und zu welchen ungefähren Massen die Fledermäuse ihr Quartier verlassen und betreten.

Martin hatte schon die ersten Ideen und kam beim ersten Treffen mit einem Arduino Mega, einem Ethernet Shield, ein paar Infrarot LEDs und einigen sündhaft teuren Infrarot-Sensoren an. Leider war diese Zusammenstellung an Hardware für den Anwendungsfall nicht wirklich vollständig, und durch die Sensoren auch unnötig teuer.

Lichtschranke

Typ 1 - Dreieck

Nach einigem hin und her hatten wir uns geeinigt wie wir die Lichtschranken umsetzen wollten: Es sollten jeweils zwölf IR-Leds und IR-Transistoren gegenüber gesetzt werden, und das ganze dann noch eine Ebene in die Tiefe gezogen werden, so dass es insgesamt 24 Lichtschranken ergibt.

Die LEDs und Transistoren sind in kleine Aluminiumröhrchen montiert um Störungen durch Licht von aussen zu vermeiden, bieten aber auch eine große Hilfe beim ausrichten der einzelnen Teile, welche sich als kniffliger erwies als zunächst gedacht. Falls möglich wollen wir bei einer weiteren Version des Lichtschrankenaufbaus auf einem Metallrahmen setzen, wir befürchten dass sich das Holz womöglich verziehen könnte, was die Lichtschranken unbrauchbar macht.

Die Transistoren haben in unserem Aufbau einen 10kOhm Pull-Up, und die LEDs einen 220Ohm Vorwiderstand. Solang der Transistor das Licht der LED sieht wird die Signalleitung auf 0 gezogen, bei Unterbrechung des Strahls wird die Signalleitung durch den Pull-Up auf 5V gezogen, und kann von unserer Elektronik eingelesen werden.

Typ 2 - Rechteck

Wir haben zum Testen unserer Elektronik eine Lichtschranke in einem anderen Format gebaut, um diese hinter einer gekauften Rahmen aus einem anderen Projekt zu testen und nachher die Daten zu vergleichen.
Die Technik ist hier exakt die gleiche.

Elektronik

Versuch 1 - Raspberry Pi

Unser Aufbau für den ersten Prototypen besteht aus dem bereits erwähnten Arduino Mega, einem Raspberry Pi, einem 3G-Stick für das Hochladen von Logdateien und die Kontrolle von aussen, sowie einem modifizerten USB-Hub bei dem sich die einzelnen Ports aus- und anschalten lassen.
Zusätzlich hat der 3G-Stick noch sein eigenes Relais, so wie einen fetten Kondensator bekommen, da er doch beim einschalten relativ viel Strom zieht, und die Elektronik teilweise beim einschalten des Sticks abgestürzt ist.

Ausserdem befindet sich in der Box ein Funk-Wetterdatenlogger, da man auch gucken wollte wie sich das Verhalten der Fledermäuse zu bestimmten Wettersituationen verändert.

Auf dem Arduino läuft ein simples Sketch, welches die Signalleitungen der Transistoren einzeln einliest, und bei Veränderung ein Signal über die USB-Verbindung an das Raspberry Pi gibt.
In dem Signal steht welche Lichtschranke sich wie verändert hat, und es ist ein Timestamp (über die micros()-Funktion realisiert) angefügt.
Damit die Zahl der Mikrosekunden nicht überläuft wird das Arduino alle 30 Minuten automatisch rebootet, und gibt an das Raspberry Pi zurück dass es wieder bei 0 anfängt zu zählen.

Auf dem Raspberry Pi laufen zwei Python Scripts, UMTSkeeper, ein OpenVPN-Client, und ein kleiner Watchdog.

Der Watchdog sorgt dafür dass UMTSkeeper gestartet wird und wartet darauf dass eine Verbindung aufgebaut ist. Sobald eine Verbindung zum Internet verfügbar ist, wird mit ntpdate die Uhrzeit aus dem Netz gezogen, und kurz darauf sowohl NTPd als auch der OpenVPN-Client gestartet.

Das VPN bietet uns eine Möglichkeit von aussen auf das Raspberry Pi zuzugreifen, ohne ginge es nicht, da es im Mobilfunk natürlich hinter einem NAT hängt.

Die Python Scripts loggen relativ simpel die eingehenden Daten mit absoluten Timestamp auf eine seperate Partition der SD-Karte.

Ein Server greift in regelmäßigen Abständen (wenn möglich) auf das Raspberry Pi zu, und zieht sich mittels rsync alle Logs, und löscht die alten Logs von der SD-Karte um Platz zu sparen.

Leider stürzt der Kram regelmäßig ab und reisst SD-Karten mit in den Tod...

Versuch 2 - BeagleBone

Wir hatten während unserer Tests immer wieder Probleme mit Raspberry Pis im Dauerbetrieb, ausserdem ist die Kombination aus Arduino Mega, Raspberry Pi und USB-Hub doch relativ teuer.

In meinem Regal habe ich dann das BeagleBone Black wiederentdeckt, welches ich mir "damals" kurz nachdem es verfügbar war gekauft habe. Das BeagleBone Black ist um einiges Robuster als das Raspberry Pi, das alte BeagleBone White lief bereits mehrere Monate als Temperaturlogger an meiner Heizung, ohne dass mir irgendwelche Fehler aufgefallen wären. Es hat genug GPIO-Pins um die Lichtschranken direkt auszuwerten, und es lässt sich auch viel leichter um z.B. eine Echtzeituhr erweitern.

Zusätzlich besitzt das BeagleBone Black eine schnellere CPU (jedoch langsamere GPU, welche wir aber sowieso nicht benötigen), wodurch uns evtl. ermöglicht wird sogar die Auswertung vor Ort vorzunehmen, und/oder Log-Dateien während des Betriebs stärker zu komprimieren (beim Raspberry-Pi gab es bei hoher CPU-Auslastung teilweise Stabilitäts-Probleme).

~~Demnächst wollen wir eine Platine zusammenlöten die auf das BeagleBone Black gesteckt werden soll, dann werde ich diese Seite erweitern.~~
Leider haben wir wegen Zeitdrucks keine Gelegenheit mehr gehabt das Beaglebone selbst als I/O Device zu nutzen, sondern haben es letzenendes einfach als Ersatz für das Raspberry Pi verwendet, womit auch der USB-Hub nicht mehr benötigt wurde, und die Box mit der Elektronik jetzt einigermaßen übersichtlich geworden ist.

Bilder

Hier noch ein paar weitere Bilder:

Wordclock

2013-11-21T00:00:00+01:00

A few months ago somebody used the lasercutter at Dingfabrik to cut a box for a clock that shows time using words. I liked the idea so I asked for a box, and I got one.

Now... originally this should've been a birthday present for my dad, but the controller I built had some problems and I had no time™ and other stuff happened so yea... I basically finished this about a year later... but hey, it works!

Hardware (Version 1)

The controller is based around an ATMega1284P, a small RTC and a DCF77 receiver.

The LEDs for the clock are separated into two sections, the upper half and the lower half.

LEDs for each word are connected, so for each word only 1 pin has to be controlled (with few exceptions). There even are some times of the day on which the display can be static because only the upper half is used, this time period could be used to sync time using the DCF77 receiver... but I never implemented that. I tried, but I think the receiver I build into this thing was actually broken.

Since I kinda forgot to add resistors the hardware behaved a bit... weird. Some operations in software made the controller freeze, others just did nothing. I eventually got it to work, but only for a few days at a time. After a few more fixes it worked weeks at a time. I kinda started hating this thing, so I didn't bother trying to fix it anymore.

Software Update (for HW Version 1)

About a year later I started a rewrite of the firmware, mostly because I found the old code and thought to myself that it could be implemented a lot better. So I did that.

After the rewrite the clock worked quite reliable. It ran for months at a time and just crashed a few times in quite a long time.

Then I optimized the firmware again to reduce flicker and delays so the LEDs would be a bit brighter... that was not a good idea. After a few more months the ATMega just died.

So, if you ever want to control a bunch of LEDs... include resistors.

Hardware (Version 2 - 2015 Update)

The clock was basically sitting in a corner of my room for a few months after the ATMega broke, I kinda didn't want to fix it, but after a bit of time my dad asked my if I'm ever going to repair it.

At that time I was experimenting with STM32 chips, and I just bought a few cheap boards from eBay, so I thought this would be a great project, especially to test out the new boards.

So, I rebuild the hardware around a small stm32f103c8t6 based board, actually used resistors this time(!), and started working on the software.

Software (for HW Version 2)

First of: you can find the software here.

I first implemented just driving the display, then I started implementing code to use the in-chip real-time-clock, and it worked beautifully!

With the old hardware every time I needed to set time (for whatever reason it got lost) I had to use an ISP to flash a firmware setting the time and afterwards flash the old firmware back to the device, that was kinda annoying and I wanted to have a better solution.

Since I also wanted to do more stuff with USB i set for the task of implementing a very simple USB device, using libusb in a tiny python script to set the time, and after a few hours of swearing it actually worked!

The new hard- and software are now running very stable, the clock never ever crashed since i finished the firmware, which at the point of writing this blogpost-update was about 10 months ago.

One problem remains, the RTC drifts slowly (not a perfect quartz), so from time to time I need to correct it. It is actually possible to implement code to add a minute every few weeks or so, but measuring the drift over time is a bit troublesome as I'm not at home most of the time and since the clock only shows time in 5 minute intervals anyway it's not really a big problem to just set it twice a year or so.

Kobo Mini Telnet/FTP Server

2013-01-01T22:02:00+01:00

I recently bought a Kobo Mini ebook reader because I wanted to play around with the e-ink display. To do that I obviously needed a shell on the device, and here I'll describe how I got that.

There are basically two ways to get the (already built-in) telnet- and ftp-server to start. One way is to open up the Kobo Mini, take out it's internal MicroSD card, mount that on a Linux computer, and modify some scripts. The other way it to build a fake update package.

I choose the way of opening the device and accessing the root filesystem directly.

To actually use the telnet-server we need pseudo-shells, and for that we need to create an init-script that mounts /dev/pts on the device. So I created /etc/init.d/rcS2 (like other people on the internet did) and filled it with the following little code snippet:

#!/bin/sh
# /etc/init.d/rcS2
mkdir -p /dev/pts
mount -t devpts devpts /dev/pts

The file should be executable, so chmod a+x etc/init.d/rcS2 and we are good to go.

Next we need to actually get the telnet server to start, for that we modify /etc/inetd.conf and add the following lines:

21 stream tcp nowait root /bin/busybox ftpd -w -S /
23 stream tcp nowait root /bin/busybox telnetd -i

To get our init-script and inetd to run we also need to append some lines to /etc/inittab:

::sysinit:/etc/init.d/rcS2
::respawn:/usr/sbin/inetd -f /etc/inetd.conf

If you want to go the route with the fake update package you'll have to put all these new and modified files into a gzip compressed tar-file and put it as .kobo/KoboRoot.tgz on the device. Keep in mind that you will need the original content of /etc/inittab, so you may need to extract that from an official firmware update or get it from somewhere else on the internet.

After putting the MicroSD back into my Kobo Mini i started it up and ran the Webbrowser to start the wifi connection. After all that telnet was finally reachable, and I could login with user root without a password (probably a bad idea to do this on a public wifi network...).

On the shell you can run killall nickel to get rid of the original eBook-software (until next reboot), which also disables the automatic disconnect of the wifi connection (which will obviously drain your battery).

Change Windows 7 SATA driver mode from AHCI to RAID (Intel Chipset)

2012-10-25T17:46:00+02:00

I wanted to use a Intel Rapid Storage controller in "RAID" mode, but Windows 7 didn't like me changing that option and refused to boot, just showing me a very generic bsod.

After quite some time I found a solution:

First start from the installer disc and go to recovery options, open a command prompt.

Look for the system drive, on my system it was just drive C, so typing c: changed the current directory to the base directory on that drive.

Next load the registry: reg load HKLM\TempSys C:\Windows\System32\SYSTEM

Now you can run regedit.exe, go to HKEY_LOCAL_MACHINE\TempSys, and look in the control sets in there for iaStorV directories. In all iaStorV directories change the option Start from 3 to 0.

After modifying the registry you need to unload it: reg unload HKLM\TempSys

Reboot and just hope it works.

Mac App: Wineskin Winery

2012-08-04T19:21:00+02:00

Sometimes there is the need to run a piece of Windows software, and if you don't have Windows running on your system you will need a workaround. Solutions are using a virtual machine with Windows or using wine, which can sometimes be a bit annoying.

As a mac user there is a solution that makes wine a bit more comfortable: Wineskin Winery It's (obviously) based on wine and bundles Windows programs as Mac apps, including a fancy Icon in your Dock while it is running!

When you first start Wineskin you have to download a wine version. That can be done in just three clicks, just take the suggested (newest stable) version. If you know that the application you want to bundle is working best under an older wine version you can select that instead (e.g. Warcraft III had problems in the past the reappeared from time to time in newer versions, but this should be solved by now).

You'll also need to update the wrapper, which can be done with a click on the Update button.

Now you are ready to create your first wrapper. Click on the button to create a new blank wrapper, and it will ask you for the name of the application you want to install. On newer versions of wine you'll also be asked if you want to install mono (open .NET implementation) and gecko (IE-like HTML rendering library). I'd suggest to do that, as most Windows software needs one or even both of those libraries.

After the wrapper is created just start it as if it was a normal app. You'll get a menu that asks you what you want to do, you can install software from a setup executable, copy over existing files, or do advanced configuration. If your installer asks for a target location make sure to select a location under C:\.

When everything installed without problems you'll get a dialog asking you for the executable of the program you just installed (e.g. putty.exe), and you'll have the option to set an app icon. You can also do some advanced stuff like opening regedit to set some options (e.g. for Warcraft III you may want to enable OpenGL rendering and maybe window-mode).

After this the app is build. If you want to make some changes at a later point you can right-click the app, select "Show Package Contents", and open the Wineskin app you'll find inside. This can be useful if e.g. you want to install an expansion pack for a game.

All these bundles are normally written to a location under /Users/$username/Applications/Wineskin, but you can move and copy them without any problems. I even copied a few apps over to another mac and they worked fine.

The only downside I see with Wineskin is the size of the bundles you create. As every bundle contains wine, the wineskin wrapper software, a few Windows libraries and temporary files and of course the software you installed those apps can get quite big. My putty wrapper had a size of 350MB, where putty itself only takes around 0.5MB... yea... but since this only is for the rare case that you may need to run a Windows application and you'll only have very few of those I guess it's okay.