Raspberry Pi OS with LUKS

Short notes with setup for working remote LUKS decrypt. Unofrtunately after cryptroot-unlock success it shutdowns the system :) Maybe I will try again when will find some time.

1. Burn Rasberry Pi OS Lite image

2. Create additional partition for encrypted root partition.

3. Update and restart:

apt-get update && apt-get upgrade
sudo shutdown -r now

4. Install deps:

apt-get install busybox cryptsetup dropbear-initramfs lvm2

5. Prepare partition:

cryptsetup -v -y --cipher aes-xts-plain64 --key-size 256 luksFormat <newroot>
cryptsetup -v luksOpen <newroot> sdcard
mkfs.ext4 /dev/mapper/sdcard
cryptsetup luksClose /dev/mapper/sdcard

6. Configure partition in the system: check :

blkid | grep crypto_LUKS

open /etc/crypttab and add:

sdcard    <newroot>    none    luks,initramfs

open /etc/fstab and replace original root partition with:

/dev/mapper/sdcard      /       ext4    defaults        0       1

open /boot/cmdline.txt and replace existing partition config with:

root=/dev/mapper/sdcard cryptdevice=<newroot>:sdcard

also add at the end of the same file dhcp configuration:

ip=:::::eth0:dhcp

7. Configure early decryption:

echo 'DROPBEAR_OPTIONS="-RFEsjk -c /bin/cryptroot-unlock"' > /etc/dropbear-initramfs/config
echo "CRYPTSETUP=y" >> /etc/cryptsetup-initramfs/conf-hook

8. Fix issue with short timeout for decryption:

sed -i 's/^TIMEOUT=.*/TIMEOUT=100/g' /usr/share/cryptsetup/initramfs/bin/cryptroot-unlock

9. Configure early remote access over SSH:

touch /boot/ssh
echo '<your_public_ssh_key>' > /etc/dropbear-initramfs/authorized_keys

10. Copy files from original root partition to the new encrypted partition. 11. Generate initramfs:

sudo mkinitramfs -o /boot/initramfs.gz
echo "initramfs initramfs.gz" >> /boot/config.txt

12. Reboot and try to connect remotely. Configs for ssh:

Host pi
    HostName <ip>
    User user
    PreferredAuthentications password

Host pi-enable
    HostName <ip>
    User root
    StrictHostKeyChecking no
    UserKnownHostsFile /dev/null
    IdentityFile ~/.ssh/<your_public_ssh_key>

Links:

https://github.com/ViRb3/pi-encrypted-boot-ssh

https://www.paxswill.com/encrypted-raspberry-pi/

https://www.kali.org/docs/arm/raspberry-pi-with-luks-full-disk-encryption/

https://www.arminpech.de/2019/12/23/debian-unlock-luks-root-partition-remotely-by-ssh-using-dropbear/

Connect to the bluetooth serial port in linux

From time to time I use my bluetoth module HC-05 to communicate with microcontroller. Every time I have the same problem because I don't remember how to do that. Short receipe working for me (at least for openSUSE):

 sudo bluetoothctl  
 power on  
 agent on  
 scan on  
 pair <MAC>  

Then:

 sudo killall rfcomm  
 sudo rfcomm connect /dev/rfcomm0 <MAC> 1  

/dev/rfcomm0 is ready to use now.

source

Linux rescue after Windows 10 Creators Update

Last night I've updated my Windows 10. That was big update called "Creators Update". I don't know details what was changed (I noticed only new privacy settings and mail client) but one thing was significant for me as a linux user. When I wanted to switch to my openSUSE it opened rescue mode. It happend after I entered password to my encrypted home partition. My first thought: update modified my partition! Fortunately it was possible to open and mount it using cryptsetup. I checked also /etc/crypttable and I realized what is the root cause of my problems.
In my config I found /dev/sda7 but my current encrypted partition number is 6! Fast research and I found empty space on my disk between two partitions. Possibly the update removed one of partitions existing before (created during Windows 10 installation) and now all my linux partitions have decreased numbers.
I created new partition in the empty space. Reboot. Linux works.

How to run JHipster on openSUSE 42.2

JHipster is a tool to generate full web app template using Spring Boot and Angular frameworks. When I've tried to run it for a first time on my openSUSE 42.2 I've got:

/usr/local/lib/node_modules/generator-jhipster/generators/app/index.js:15
    constructor: function (...args) { // eslint-disable-line object-shorthand
                           ^^^

SyntaxError: Unexpected token ...
    at exports.runInThisContext (vm.js:53:16)
    at Module._compile (module.js:373:25)
    at Object.Module._extensions..js (module.js:416:10)
    at Module.load (module.js:343:32)
    at Function.Module._load (module.js:300:12)
    at Module.require (module.js:353:17)
    at require (internal/module.js:12:17)
    at Object.defineProperty.get [as jhipster:app] (/usr/local/lib/node_modules/yo/node_modules/yeoman-environment/lib/store.js:40:23)
    at Store.get (/usr/local/lib/node_modules/yo/node_modules/yeoman-environment/lib/store.js:64:35)
    at Environment.get (/usr/local/lib/node_modules/yo/node_modules/yeoman-environment/lib/environment.js:261:21)

Unfortunately JHipster needs node.js with version 6, not 4 which I installed from my default repositories. After node.js 6 installation it was working.

After successful generation I wanted to start my web app, but I've met second problem. H2 database which I wanted to use for developing was throwing java.net.UnknownHostException:

java.net.UnknownHostException: HOSTNAME.suse

Solution is simple: add new entry in the /etc/hosts

127.0.0.1       HOSTNAME.suse

openSUSE Tumbleweed - grub2 installed in non-EFI mode

Last time after I've installed openSUSE Tumbleweed, I've got incorrect grub2 installation (but system instalation was successful). Instead of using EFI my grub2 was configured to run in the classic mode. After reboot I was able to see only the grub2 command line.

Here is the solution:

First we need to find our grub config file. We can do it using:

 > search.file /boot/grub2/grub.cfg

We should get something like:

 (hd1,gpt6)

Now load that config:

 > configfile (hd1,gpt6)/boot/grub2/grub.cfg

The grub menu should appear. Unfortunately entries were incorrect because of using e.g. "linux" command instead of "linuxefi". We have to change that, so press "e" to edit your entry. Next, change "linux" to "linuxefi" and "initrd" to "initrdefi".
To boot press F10.
After your OS is loaded open YaST, then go to Bootloader settings and change mode to "GRUB2 EFI". Done!

Samba 3 with LDAP as a Primary Domain Controller

In this tutorial I will show how to configure samba 3 as a PDC with LDAP support. It will be possible also to use domain users on the server machine. I was using minimal Debian 8, openLDAP 2.4 (from repositories) and samba 3.6 (compiled from sources). My hostname is ldapserv and domain domain.edu

LDAP

First install LDAP from repository:

 apt-get install slapd ldap-utils  

Then edit /etc/ldap/ldap.conf file and set your domain base and URI:

 BASE   dc=domain,dc=edu  
 URI    ldap://127.0.0.1/  

You can check if it is working with:

 ldapsearch -x  

You should get information about domain and admin.
Now create temporary file (temp.ldif) with this content:

 dn: ou=People,dc=domena,dc=edu  
 ou: People  
 objectClass: organizationalUnit  
 dn: ou=Group,dc=domena,dc=edu  
 ou: Group  
 objectClass: organizationalUnit  

This describes new nodes in our LDAP tree which will be used for our users and groups.
Add these nodes to the tree:

 ldapadd -c -x -D cn=admin,dc=domain,dc=edu -W -f temp.ldif  

cn=admin,dc=domain,dc=edu this is my LDAP admin

Restart slapd:

 systemctl restart slapd.service  

Now we can create and add new user. Open new temporary file (john.ldif):

 dn: cn=john,ou=group,dc=domain,dc=edu  
 cn: john  
 gidNumber: 20000  
 objectClass: top  
 objectClass: posixGroup  
 dn: uid=john,ou=people,dc=domain,dc=edu  
 uid: john  
 uidNumber: 20000  
 gidNumber: 20000  
 cn: john  
 sn: john  
 objectClass: top  
 objectClass: person  
 objectClass: posixAccount  
 objectClass: shadowAccount  
 loginShell: /bin/bash  
 homeDirectory: /home/john  

Add john.ldif:

 ldapadd -c -x -D cn=admin,dc=domain,dc=edu -W -f john.ldif  

Set the password for john:

 ldappasswd -x -D cn=admin,dc=domain,dc=edu -W -S uid=john,ou=people,dc=domain,dc=edu  

NSS

When you enter command "id john", system couldn't find our user. We can make it possible.

 apt-get install libnss-ldap nscd  

Edit /etc/libnss-ldap.conf:

 BASE   dc=domain,dc=edu  
 URI    ldap://127.0.0.1/  

Edit /etc/nsswitch.conf and change these lines to:

 passwd:     files ldap  
 group:      files ldap  

Run:

 systemctl stop nscd.service  

And check again "id john", now you should see information about your user.

PAM

In this moment our OS know user "john", but it is impossible to log in. We must provide information about passwords for PAM. Install ldap support:

 apt­-get install libpam­ldap  

Again enter your ldap base and uri in this file:

 nano /etc/pam_ldap.conf  

Then write to files (and delete previous content):
/etc/pam.d/common­account:

 account sufficient      pam_unix.so  
 account required        pam_ldap.so  

/etc/pam.d/common­auth:

 auth [success=1 default=ignore] pam_unix.so nullok_secure  
 auth required pam_ldap.so use_first_pass  
 auth required pam_permit.so    

/etc/pam.d/common­session:

 session required        pam_unix.so  
 session required        pam_mkhomedir.so skel=/etc/skel/ umask=0022   

Now test settings (on second terminal, without restarting, because you can lost your system).

SAMBA

We will create domain controller with samba. I will be using Windows 7 clients so samba version mus be >= 3.3.
Download and extract samba sources:

 wget https://download.samba.org/pub/samba/samba­3.6.25.tar.gz  
 tar ­zxvf samba­3.6.25.tar.gz  
 cd samba­3.6.25/source3  

Install required libraries:

 apt­get install gcc make libldap2­dev libkrb5­dev libpam0g­dev  

Configure and compile samba (with LDAP support, install dir: ​/usr/local/samba):

 ./configure ­­prefix=/usr/local/samba/ ­­--with­-ldap ­­--with­-ads ­­--with­-pam ­­--disable­-cups  
 make  
 make install    

Add samba schema to the LDAP schema directory:

 cd ..  
 cp examples/LDAP/samba.schema /etc/ldap/schema/samba.schema   

Now we will add this schema to the LDAP configuration. To do this using LDAP 2.4 we must create ldif file. Create file schema_convert.conf:

 cd ~/  
 nano schema_convert.conf  

And pase this content:

 include /etc/ldap/schema/core.schema  
 include /etc/ldap/schema/collective.schema  
 include /etc/ldap/schema/corba.schema  
 include /etc/ldap/schema/cosine.schema  
 include /etc/ldap/schema/duaconf.schema  
 include /etc/ldap/schema/dyngroup.schema  
 include /etc/ldap/schema/inetorgperson.schema  
 include /etc/ldap/schema/java.schema  
 include /etc/ldap/schema/misc.schema  
 include /etc/ldap/schema/nis.schema  
 include /etc/ldap/schema/openldap.schema  
 include /etc/ldap/schema/ppolicy.schema  
 include /etc/ldap/schema/samba.schema    

Generate cn=samba.ldif file using slapcat:

 mkdir ­-p ldif_output  
 slapcat ­-f ~/schema_convert.conf ­-F ~/ldif_output ­-n0 ­-s "cn={12}samba,cn=schema,cn=config"  > ~/cn=samba.ldif  

Edit file:

 nano cn=samba.ldif    

Delete {13} from lines 1 and 3:

 dn: cn=samba,cn=schema,cn=config  
 objectClass: olcSchemaConfig  
 cn: samba    

And delete this lines (from the end of file):

 structuralObjectClass: olcSchemaConfig  
 entryUUID: bd8a7a82­3cb8­102f­8d5f­070b4e5d16f8  
 creatorsName: cn=config  
 createTimestamp: 20100815125953Z   
 entryCSN: 20100815125953.198505Z#000000#000#000000  
 modifiersName: cn=config  
 modifyTimestamp: 20100815125953Z    

Add ldif file to the LDAP configuration:

 ldapadd ­-Y EXTERNAL ­-H ldapi:/// ­-f ~/cn=samba.ldif   

Restart ldap:

 systemctl restart slapd    

Create samba config file:

 nano /usr/local/samba/lib/smb.conf    

And paste:

 [global]  
 ldap admin dn = "cn=admin,dc=domain,dc=edu"  
 passdb backend = ldapsam:ldap://127.0.0.1:389  
 ldap ssl = off  
 ldap suffix = "dc=domain,dc=edu"  
 ldap passwd sync = yes  
 ldap group suffix = ou=Group  
 ldap user suffix = ou=People  
 workgroup = DOMAIN.EDU  
 netbios name = LDAPSERV  
 local master = yes  add machine script = /usr/sin/useradd ­-d \  /dev/null ­-g 200 ­-s /sbin/nologin ­-M %u  
 security = user  
 logon drive = H:  
 domain master = yes  
 domain logons = yes  
 preferred master = yes  
 wins support = yes  
 log level = 2  
 log file = /usr/local/samba/logs  
 [homes]  
 comment = Home dirs  
 path = /home/%u  
 read only = no  
 create mode = 0750  
 browseable = yes  
 [netlogon]  
 path = /usr/local/samba/netlogon  
 guest ok = yes  
 browseable = no  
 [profiles]  
 path = /usr/local/samba/profiles  
 writeable = no  
 guest ok = yes  
 browseable = yes  
 create mode = 0700   

Create directories and group for machines:

 mkdir /usr/local/samba/profiles  
 mkdir /usr/local/samba/netlogon  
 groupadd ­-g 200 machine    

Test config:

 /usr/local/samba/bin/testparm    

Change samba admin password:

 export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/samba/lib  
 /usr/local/samba/bin/smbpasswd ­-W    

We need samba tools to create LDAP nodes:

 cpan  
 cpan> install Net::LDAP  
 cpan> install Crypt::SmbHash  
 cpan> install Digest::SHA1  
 cd ~/  
 wget http://download.gna.org/smbldap­tools/sources/0.9.9/smbldap­tools­0.9.9.tar.gz  
 tar xvfz smbldap­tools­0.9.9.tar.gz  
 cd smbldap­tools­0.9.9  
 ./configure --­­with­-samba­-sysconfdir=/usr/local/samba/lib  ­--with­-samba­-bindir=/usr/local/samba/bin --sysconfdir=/etc/samba  
 make && make install    

Copy config files:

 cp ­-pr smbldap.conf /etc/samba/smbldap­tools/smbldap.conf  
 cp ­-pr smbldap_bind.conf /etc/samba/smbldap­tools/smbldap_bind.conf   

Get domain SID number:

 export PATH=$PATH:/usr/local/samba/bin  
 net getlocalsid   

Edit /etc/samba/smbldap­tools/smbldap.conf and change lines:

 SID=<YOUR SID>  
 sambaDomain="DOMAIN.EDU"  
 masterLDAP="ldap://127.0.0.1/"  
 ldapTLS="0"  
 verify="require"  
 suffix="dc=domain,dc=edu"  
 usersdn="ou=People,${suffix}"  
 groupsdn="ou=Group,${suffix}"  
 userHome="/home/%U"  
 userSmbHome="\\LDAPSERV\%U"  
 userProfile="\\LDAPSERV\profiles\%U"   

Edit /etc/samba/smbldap­tools/smbldap_bind.conf:

 masterDN="cn=admin,dc=domain,dc=edu"  
 masterPw="<ldap admin password>"    

Run:

 smbldap­-populate  

Add library path:

 export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/samba/lib    

Restart samba:

 killall smbd  
 killall nmbd  
 /usr/local/samba/sbin/smbd  
 /usr/local/samba/sbin/nmbd    

You can check domain state:

 /usr/local/samba/bin/findsmb    

Add user for our domain:

 useradd DOMAIN.EDU$  
 /usr/local/samba/bin/smbpasswd ­-a -­i DOMAIN.EDU  ​ (without $)    

Add users

Add user with:

 smbldap­-useradd <name>   

Then set password:

 smbpasswd -­a <name>  

Now you can join to this domain with Windows 7 client but remember to change compatibility settings.