Raspberry Pi router and Openvpn client

I wanted a cheap VPN proxy service. As per my previous post I set up a small cloud server with openvpn plus dnscache. You add squid proxy too depending on your needs.

I decided to use a Raspberry Pi as a cheap router. I bought a Edimax USB ethernet adaptor to give me two ports.

I got myself a stripped down version of Wheezy (I wasn't up to tackling that piece of junk called systemd)

This is for a V1 Pi :

https://www.linuxsystems.it/raspbian-wheezy-armhf-raspberry-pi-minimal-image/

There are others for a v2 out there. The choice is yours.

Once installed we need to do the following:

apt-get install fake-hwclock ntp ntpstat lsusb usbutils firmware-realtex nmap vnstat nload bmon htop mc openvpn dnsmasq net-tools resolvconf

# Make sure dnsmaq for dhcp/dns is running
root@raspberry-pi:~# grep -v '^$\|^#' /etc/default/dnsmasq
ENABLED=1

# Setup the interfaces and DHCP range it wil serve to clients
root@raspberry-pi:/etc# grep -v '^$\|^#' /etc/dnsmasq.conf
interface=eth1
domain=local.net
dhcp-range=192.168.50.50,192.168.50.150,12h

# Make sure forwarding is set
root@raspberry-pi:/etc# grep -v '^$\|^#' /etc/sysctl.conf
net.ipv4.ip_forward=1
vm.min_free_kbytes = 8192

# Forward everything to the VPN tunnel
root@raspberry-pi:/etc# grep -v '^$\|^#' /etc/iptables.conf
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:LOGGING - [0:0]
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 192.168.50.0/24 -o tun0 -j MASQUERADE
COMMIT

# SSHD
# Set some keys in ssh, change the default port and and disable ssh password authentication !


# Copy your keys and configs to /etc/openvpn

# For DNS you can use /etc/openvpn/update-resolv-conf
# add this to your client config /etc/openvpn/myclient.conf
# It could be added to your server so it is added to the conf
up /etc/openvpn/update-resolv-conf

#We can also add this but if you run as a restricted user e.g. nobody it will fail
down /etc/openvpn/update-resolv-conf

# If you don't use resolvconf, make sure your DNS is sent to your resolver - you will have to set a static IP on eth0
# or this wil get overwrittent
root@raspberry-pi:/etc# cat /etc/resolv.conf
nameserver 192.168.95.1


root@raspberry-pi:/etc# cat /etc/network/interfaces
# interfaces(5) file used by ifup(8) and ifdown(8)
auto lo
iface lo inet loopback

allow-hotplug eth0
# Note above comments re DNS
iface eth0 inet dhcp

allow-hotplug eth1
iface eth1 inet static
   address 192.168.50.1
   netmask 255.255.255.0
   network 192.168.50.0
   broadcast 192.168.50.255


# Make sure you have some time servers...

root@raspberrypi:/etc/resolvconf# grep -v '^$\|^#' /etc/ntp.conf
driftfile /var/lib/ntp/ntp.drift
statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable
server 0.debian.pool.ntp.org iburst
server 1.debian.pool.ntp.org iburst
server 2.debian.pool.ntp.org iburst
server 3.debian.pool.ntp.org iburst
restrict -4 default kod notrap nomodify nopeer noquery
restrict -6 default kod notrap nomodify nopeer noquery
restrict 127.0.0.1
restrict ::1

# Connect to your Pi

Check that your connection works with places like whatsmyip.net and dnsleaktest.com

Cheap VPN server using openvpn and Centos

Well, VPN servers are all the rage since Mr Snowden blew the gaff on the NSA & GCHQ et al ,and Nanny states clamping down and spying on your every move.

And the BBC iPlayer got blocked as the BBC  shut out swathes of VPN addresses in yet another attempt to monetise their media.
When will they realise that blocking the internet and trying to block encryption and geoip blocking etc is just a path to madness. I have no problems with them checking my data if they have suspicion I have done something illegal like make a bomb. But they can go through the normal channels and get a warrant to do so. I am innocent until proven guilty.

But with the way the law is going, we are all tarred as guilty, and should all be spied on. Orwellian.

Anyway, for a variety of reasons I wanted a cheap little VPN with a UK IP address.

After a bit of advice (and a referral to save me a few pounds) I got me a droplet over at www.digitalocean.com to act as server. I use all sorts of devices to connect including a Raspberry Pi as a simple VPN router for some kit I have.

From choice as a systemd loather I decided to install CentOS 6.x with openvpn and tinydns and dnscache as I am familiar with it from my server of choice Koozali SME Server. I could install squid/danguardian etc as well, but this suits purpose for now


Roughly speaking this is how to do it..... I'll add a note on the Rasberry Pi config in the next post


# install wget

yum install wget

wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
wget http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.3-1.el6.rf.x86_64.rpm



# Get epel & rpmforge repos

yum localinstall epel-release-6-8.noarch.rpm rpmforge-release-0.5.3-1.el6.rf.x86_64.rpm



# Add the webmin repo
cat < /etc/yum.repos.d/webmin.repo
[Webmin]
name=Webmin Distribution Neutral
#baseurl=http://download.webmin.com/download/yum
mirrorlist=http://download.webmin.com/download/yum/mirrorlist
enabled=1
EOF

 
# And keys
wget http://www.webmin.com/jcameron-key.asc
rpm --import jcameron-key.asc

 
# Add some stuff
mc openvpn wget mutt mailx man syslog traceroute nload iptraf vnstat webmin ntpdate bind-utils daemontools elinks ndjbdns htop


# Allow access to webmin with your own IPs

mcedit /etc/webmin/miniserv.conf
allow=127.0.0.1 1.2.3.4 5.6.7.8 LOCAL


# Sort the time out
Webmin - set timezone in System Time

cat < /etc/ntp/ntp.conf
server 0.uk.pool.ntp.org
server 1.uk.pool.ntp.org
server 2.uk.pool.ntp.org
server 3.uk.pool.ntp.org
EOF


# Sort out ssh to prevent password access - make sure you add your keys
scp ~/.ssh/id_rsa.pub root@1.2.3.4://root/.ssh/id_rsa.pub.mykey
cat /root/.ssh/id_rsa.pub.mykey /root/.ssh/authorized_hosts

# Change the default port please.
mcedit /etc/ssh/sshd_config
Port 2244
PasswordAuthentication no

# Sort out iptables - see the file below
# adjust your IPs/VPN accordingly in it
copy to /etc/sysconfig/iptables

# Add Openvpn module
# Webmin/Configuration/Add module
http://www.openit.it/downloads/OpenVPNadmin/openvpn-2.6.wbm.gz

 
# You don't really need tinydns unless you are answering queries for the 'domain' on the server. dnscache will handle it.  

# Sort out cache
mcedit /etc/ndjbdns/dnscache.conf
 
# Choose your VPN IP range here
IP=192.168.x.1
cp /etc/ndjbdns/ip/127.0.0.1 192.168.x


# Webmin adjust Bootup & shutdown - tinydns & dnscache

dnscache will fail to start correctly and when you then try to start it manually you will get a 'subsystem locked' error. This is caused by dnscache trying to start on a non existent interface - e.g. tun0 which doesn't appear until openvpn has started.

openvpn starts at S24 and dnscache at S20 so I set dnscache to S30

Edit /etc/rc.d/init.d/dnscache

modify # chkconfig: - 30 80

Then

chkconfig dnscache off and then on


# Webmin Openvpn - First sort your certs

New CA Authority

Make sure country code is two letters e.g. UK or ES

In CA list
VPN Server list select Keys List
New Server and generate key
# Get coffee

# Now
VPN List
New VPN Server

# Basic minimal settings

Management Yes 8876
Net Ip - your tunnel IP
Persist Yes
router client to client Yes
option cipher AES-256-CBC
user/group nobody
verb 5
tun-mtu 1500
fragment 1300
mssfix 1300
push "dhcp-option DNS 192.168.x.1"
push "route 192.168.x.0 255.255.255.0"
push "redirect-gateway def1"

Go back to CA list
Select Keys List
Add New key
Key Name - whatever
Pass - no
KeyServer Client

Go to VPN List, Client List
Add Client

# Then get your client certificates out and installed. Minimal opvn file below


# Modify Logging for openvpn and iptables

mcedit /etc/openvpn/{your-server}.conf

status /var/log/openvpn/openvpn-status.log
# log-append servers/DigiDrop-SVR/logs/openvpn.log


touch /etc/rsyslog.d/10-iptables.conf
cat </etc/rsyslog.d/10-iptables.conf
:msg, startswith, "IPTables-Dropped: " -/var/log/iptables.log
& ~
EOF


touch /etc/rsyslog.d/20-ovpn.conf

cat < /etc/rsyslog.d/20-ovpn.conf
# Create a template for the vpn log location
$template OpenVPN,"/var/log/openvpn/openvpn.log"

if $programname startswith 'openvpn' then /var/log/openvpn/openvpn.log
& ~
EOF

touch /etc/logrotate.d/ovpn

cat < /etc/logrotate.d/ovpn
/var/log/openvpn/*.log {
        weekly
        size 100M
        rotate 4
        compress
        delaycompress
        missingok
        notifempty
        create 640 syslog adm
}
EOF


# Set DNS to OpenDNS if you want
/etc/sysconfig/network-scripts/ifcfg-eth0
DNS1=208.67.222.222
DNS2=208.67.220.220

# And get beer :-)

----------------------------------

# Generic opvn for Android - add your keys in the relevant sections

client
dev tun
proto udp
remote 46.101.92.188 1194
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
cipher BF-CBC
comp-lzo
verb 3

#mute-replay-warnings

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----


-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----


-----BEGIN PRIVATE KEY-----

-----END PRIVATE KEY-----



----------------------------------

/etc/sysconfig/iptables

# /etc/sysconfig/iptables
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 192.168.x.0/24 -o eth0 -j MASQUERADE

# Pre Route OpenVPN
-A PREROUTING -p udp -m udp --dport 1194 -j ACCEPT
COMMIT

*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT

*filter
:FORWARD ACCEPT [0:0]
:INPUT DROP [0:0]
:OUTPUT ACCEPT [0:0]
:LOGGING - [0:0]
# Allow tunnel out forward
-A FORWARD -o tun+ -j ACCEPT
# Allow tunnel out
-A OUTPUT -o tun+ -j ACCEPT
# Allow tunnel in forward
-A FORWARD -i tun+ -j ACCEPT
# Allow tunnel in
-A INPUT -i tun+ -j ACCEPT
# Accept traffic from internal interfaces
-A INPUT ! -i eth0 -j ACCEPT
# Accept traffic with the ACK flag set
-A INPUT -p tcp -m tcp --tcp-flags ACK ACK -j ACCEPT
# Allow incoming data that is part of a connection we established
-A INPUT -m state --state ESTABLISHED -j ACCEPT
# Allow data that is related to existing connections
-A INPUT -m state --state RELATED -j ACCEPT
# Accept responses to DNS queries
-A INPUT -p udp -m udp --dport 1024:65535 --sport 53 -j ACCEPT
# Accept responses to our pings
-A INPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT
# Accept notifications of unreachable hosts
-A INPUT -p icmp -m icmp --icmp-type destination-unreachable -j ACCEPT
# Accept notifications to reduce sending speed
-A INPUT -p icmp -m icmp --icmp-type source-quench -j ACCEPT
# Accept notifications of lost packets
-A INPUT -p icmp -m icmp --icmp-type time-exceeded -j ACCEPT
# Accept notifications of protocol problems
-A INPUT -p icmp -m icmp --icmp-type parameter-problem -j ACCEPT
# Allow connections to our SSH server
-A INPUT -p tcp -m tcp --dport 2222 -j ACCEPT
# Allow connections to our IDENT server
-A INPUT -p tcp -m tcp --dport auth -j ACCEPT
# Allow Webmin
-A INPUT -p tcp -m tcp --dport 10000 -j ACCEPT
# Allow OpenVPN
-A INPUT -p udp -m udp -i eth0 --dport 1194 -j ACCEPT
# Logging
-A INPUT -j LOGGING
-A LOGGING -m limit --limit 2/sec -j LOG  --log-prefix "IPTables-Dropped: " --log-level 4
-A LOGGING -j DROP
COMMIT

ssh - Too many authentication failures for username

If you have a lot of servers you can run into problems when trying to login - you can get lots of errors like this :

ssh - Too many authentication failures for username

I found the following page which explains some solutions but the best one I found for me was below :

http://superuser.com/questions/187779/too-many-authentication-failures-for-username


Just use this format :

ssh -o PubkeyAuthentication=no username@hostname.com

As ever, it is best to use keyless login and disable standard password login, but if you get stuck, or can't then this will help !

Simple graphical disk space monitor

If you want a simple command line program to give you a quick view of your disk space usage then try gt5

It's available on most distros.

It runs du and outputs it to a simple html file that can be viewed in a text only browser. You can walk up and down directories to see where those big files are hiding.

It also caches the usage so when you next run it you can see the increase/decrease in usage.

Although it doesn't to appear to have been updated in years, it still works.

All in all a very handy tool. Why can't the rest of life be so simple ?

IPsec VPN to Draytek 2820 routers

I had a terrible fight getting my Linux box to connect and talk to my Draytek routers using a IPSec VPN.

There was little information about, and nothing concrete.

So I am recording here how I did it.

I wanted to use IPSec VPN tunnels in my routers as it is built in, and I had a number of VPN tunnels between routers that were already running with this method

I was running CentOS 5 with my favourite distro contribs.org on a VPS server and wanted to create a IPSec VPN tunnel to the Draytek.

I tried various different implementations of IPsec but at the end of the day I used Openswan.

my ipsec.conf looked like this :

# basic configuration
config setup
    # Debug-logging controls:  "none" for (almost) none, "all" for lots.
    # This is enabled currently
    klipsdebug=all
    plutodebug="control parsing"
    interfaces=%defaultroute
    oe=no
    protostack=netkey
    syslog=syslog.debug
    # These are the two local nets I am tunelling
    virtual_private=%v4:10.1.0.0/24,%v4:192.168.88.0/24

conn net-to-net
    type=tunnel
    authby=secret
    auto=start
    ikelifetime=28800s
    keylife=3600s
    left=%defaultroute
   # This is the VPS Server
    leftsourceip=192.168.88.1
    leftsubnet=192.168.88.0/24
    pfs=yes
    dpdaction=restart
    #This is the Draytek forward facing IP address
    right=123.128.243.69
    rightsubnet=10.1.0.0/24

Put your PSK password in ipsec.secrets :

# /etc/ipsec.secrets - strongSwan IPsec secrets file
#The IP is the forward facing IP of the VPS
5.99.23.43 %any : PSK "SomeStrongPassword#"

I was advised to set the advanced IPSec conf of the Draytek as follows :

"use aes256,sha1,group14 and you also enable pfs in the advanced setting"

 Last is you need to set your iptables up correctly. My server is set in what is known as 'Server and Gateway' mode. It is meant to have two network cards, one for the outside world and the other for the internal/local network and it routes across as required. Masquerading is enabled.

I *believe* you need the following. I am no iptables guru. I think you need port 500 for ipsec.

/sbin/iptables -A INPUT -i $OUTERIF -p udp --sport 500 --dport 500 -j ACCEPT
/sbin/iptables -t mangle -A PREROUTING -i $OUTERIF -p 50 -j MARK --set-mark 1
/sbin/iptables -A INPUT -i $OUTERIF -m mark --mark 1 -j ACCEPT
/sbin/iptables -A FORWARD -i $OUTERIF -m mark --mark 1 -j ACCEPT
/sbin/iptables -A INPUT -i $OUTERIF -m mark --mark 2 -j ACCEPT
/sbin/iptables -A FORWARD -i $OUTERIF -m mark --mark 2 -j ACCEPT

# Not sure if this should go here but it works.
iptables -t nat -I POSTROUTING -m policy --dir out --pol ipsec -j ACCEPT

The last was the final bit of the jigsaw - without it I could ping from the Draytek end to the server, but not the server to the Draytek.



Fire up the last line and it all worked.

Thanks to the people on the OpenSwan list for help and guidance  and I hope this helps someone.

SME server - easy to use linux server

Thought I would write a short piece on my favourite Linux server software.

Thinking of moving away from Windows, or feel you could do with a small file server at home ?

I have been using SME Server aka contribs.org for about 10 years now. It's history is long and varied and has passed through a number of hands, and plenty of turmoil, in that time.

The commercial version of it is used as the basis for Mitel Networks VOIP servers.

The fundamental tenet of the distro is that it should 'just work'.

The base system is CentOS - repackaged Red Hat Enterprise Linux. So you get a rock solid core.

The system is designed to be secure out of the box. You can change that as you require, but you can sleep easy knowing that even if you aren't a linux admin, your box is safe.

On top of this is an easy to use management system written in Perl (I know, I used to panic, but not any more - if you think PHP is great, read here and here). The beauty of it is that you can start by just using the built in web interface. So it is easy to set up users, shares, email etc.

Underneath this simple system is a very clever set of templates. So all the fundamental config files are regenerated without you having to touch a thing if you don't want to.

If you want do do more, the template system has an override system, so you can add your own templates, or fragments thereof, which will be incorporated into the config when you regenerate files.

All the important system settings are stored in an easy to use database system and you can modify or add to these easily from the command line if you so require.

There are numerous contributions from users for all sorts of things. I have run various different applications on mine - currently we use vTiger for work, I have one for SVN and trac, Joomla, eGroupware, Wordpress, ZenCart and so the list goes on.

It has 3 basic modes - Local server only, Local Gateway and server or Public gateway and server. You can also modify it to run on a VPS as well - this needs a small hack now, but will be incorporated in due course.

The downsides. There aren't many really.

It's weakest link is that is IS easy to use and attracts a lot of 'non' admins. That means that there are fewer competent people to code for it. As a result after the release of v8 based on CentOS 5.x last year, things had gone very quiet.

However, there has been a renewed interest recently, and the community is now trying to forge ahead and build v9 built on CentOS 6.

I for one would recommend it to anyone, but particularly if you are just starting with a linux.

I did, mainly because I was concerned about security as I didn't have that much knowledge and was concerned that if I built a box myself, it would be vulnerable. Why reinvent the wheel ???

In 10 years I have had only two successful hack attempts, and both of those were because the people whose servers were hacked had done some silly things - one had disabled the automatic enforcement of strong passwords and changed their passwords to easy ones....... and the other one had installed a php application, disabled some security,  and not kept it updated..... both against my advice :-)

Even now, I have no reason to go elsewhere. It does all I need, quietly and without fuss. The uptimes can be astonishing (the odd updates excepted).

So if you fancy a play, go and have a look on www.contribs.org

And don't just download it, join in. There is a job for EVERYONE !  It only works with help from the community, be that coding, bug fixing, testing, writing or reading documents.

So go on, grab a copy and have a play ! It's childs play.....

sudo: unable to resolve host

Just had a bundle of fun & games trying to resolve this error which I started to get on my Xubuntu 12.04 Precise. Pidgin also gave me a Facebook "Unable to authenticate: Authentication Failure"

I checked my /etc/hosts file which looked OK as follows :

127.0.0.1 localhost

127.0.1.1 John-Xubuntu

# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

But if I tried to ping John-Xubuntu I got host not found.

/etc/hostname showed :

John-Xubuntu

So their was another issue at play. After mulling it over a bit I realised that the change happened whilst I was messing about with domain logons. I must have changed something and not changed it back.

On (X)Ubuntu /etc/resolv.conf is now handled automatically by resolvconf so that was unlikely to be the issue.

Next I thought I would check /etc/nsswitch.conf  This file determines where, and in what order, it looks up DNS queries. Sure enough, there was the problem. It had been renamed to nsswitch.conf.domain

I renamed it back to nsswitch.conf (after checking the contents !) and problem solved.......

Hope that helps someone !

Linux standard UIDs and GIDs

Well, Linux is usually my best friend, but not today.

It usually sets standards, but in one respect it is seriously lacking.

Standard UIDs & GIDs.

I am trying to network with my server via NFS. All well and good. Except the file names & permissions are all over the show because the UIDs and GIDs are different.

So my server knows me as john:5001 but my desktop made me john:1001

Ok, so a bit of messing around could sort that a bit. But then I still have a problem with groups etc.

Why is apache "apache:x:102" on one box whilst it is "messagebus:x:102" on another ?

So any files that are say apache:shared on the server show as messagebus:shared on my desktop.

This is ridiculous and should be sorted the same way that TCP/IP services are with ports.

Everyone use the same UID/GID for the same service.  Can't be that difficult can it ?

Bash, PID and queues

Something useful for a change.

I run some synchronisation between servers using unison

I won't go into the details of setting it up, but it's pretty easy.

I had a couple of issues to resolve. First was that this was running every 20 minutes, which was fine for a few small changes, but if you had a large change/s then it would trigger itself again, and again, and again....

To cure this I added a check to see if the job was already running, and if so, too bail out.

I knicked a bit of code from a script called pid_queue.sh here and hacked it about slightly.

#!/bin/bash

if [ ! -z "`ps -C unison --no-headers -o "pid,ppid,sid,comm"|grep -v "$$ "|grep -v ""`" ]; then
#script is already running  so abort
exit 1
fi

So that will stop the script running if the process is already on the go.

Some of the syncs only run daily. In that case I don't want it to exit til the following day, but want it to sleep until the current process has stopped.

#!/bin/bash

while [ ! -z "`ps -C unison --no-headers -o "pid,ppid,sid,comm"|grep -v "$$ "|grep -v ""`" ]
do
# echo "sleeping"
 sleep 1
done

Then I realised that some things were probably hanging around if they couldn't find the server. My servers are on a DMZ on their routers. The problem was that I couldn't work out if the server was up with a ping because the router answered. Checking something with telnet or ssh took a while so I thought about nmap and came up with the following :

X=`/usr/bin/nmap -PN -p53 myserver.somedomain.org |grep open`

    

if [ ! "$X" = "" ]; then

    # do whatever

fi

This very quickly checks whether the DNS port is open - it could be any port really. If the server is up, it shows as open, but if it is not it is shown as filtered.

Job done.....